From patchwork Wed Apr 1 16:17:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228449 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A433C2BA19 for ; Wed, 1 Apr 2020 16:35:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4B6F1206F8 for ; Wed, 1 Apr 2020 16:35:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758922; bh=mSvL+Ku0/hfoZ6yGDCwrJ/EfR1GzJJRFMJ8SJ4QiRoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=o0WaJqsMuLkUzZX3ulWc4qtQk8iBenTHAmmtiW9FvB9QQwlyuWofHpkIYIcII3yVA zKyERohqk8SnmrB544nQbg+jE8tQxV7fVVxd0Qy1B+VynxBN9jlDoleBkYEAC7YiV/ Saca0/Fo7ri04Ar4pGPvsT/RTnBO7o0F1IhY7WKU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388713AbgDAQfL (ORCPT ); Wed, 1 Apr 2020 12:35:11 -0400 Received: from mail.kernel.org ([198.145.29.99]:33902 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387563AbgDAQfL (ORCPT ); Wed, 1 Apr 2020 12:35:11 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E036B2063A; Wed, 1 Apr 2020 16:35:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758910; bh=mSvL+Ku0/hfoZ6yGDCwrJ/EfR1GzJJRFMJ8SJ4QiRoY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZGBV2cA9CiGy0VIKRXxJU1SSZqkIRg9xlDcDUmPHoHxniFGQEgog2O0XdizUTzpOQ qA9wIjkdUKKBndUcKyRGo595i5syWaUonWQ1tZmAMYzTrMYWYxGck19B/nWNdWtdaG r3Adl1Z9VcHnU77DzcL4XGasAyHAIqQRztYBhqOk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Michael Ellerman , Sasha Levin Subject: [PATCH 4.9 002/102] powerpc: Include .BTF section Date: Wed, 1 Apr 2020 18:17:05 +0200 Message-Id: <20200401161531.429011705@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Naveen N. Rao [ Upstream commit cb0cc635c7a9fa8a3a0f75d4d896721819c63add ] Selecting CONFIG_DEBUG_INFO_BTF results in the below warning from ld: ld: warning: orphan section `.BTF' from `.btf.vmlinux.bin.o' being placed in section `.BTF' Include .BTF section in vmlinux explicitly to fix the same. Signed-off-by: Naveen N. Rao Signed-off-by: Michael Ellerman Link: https://lore.kernel.org/r/20200220113132.857132-1-naveen.n.rao@linux.vnet.ibm.com Signed-off-by: Sasha Levin --- arch/powerpc/kernel/vmlinux.lds.S | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S index 50d3650608558..c20510497c49d 100644 --- a/arch/powerpc/kernel/vmlinux.lds.S +++ b/arch/powerpc/kernel/vmlinux.lds.S @@ -315,6 +315,12 @@ SECTIONS *(.branch_lt) } +#ifdef CONFIG_DEBUG_INFO_BTF + .BTF : AT(ADDR(.BTF) - LOAD_OFFSET) { + *(.BTF) + } +#endif + .opd : AT(ADDR(.opd) - LOAD_OFFSET) { *(.opd) } From patchwork Wed Apr 1 16:17:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228445 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66B73C43331 for ; Wed, 1 Apr 2020 16:35:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CDE6D212CC for ; Wed, 1 Apr 2020 16:35:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758957; bh=Dxdis/KJKogw06PdKI7YE6I+j6JbrgSMNU1dghE2T48=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oPbQPhBYNiCaHoARehfraq3TItfXNFr4W33Q5RWaOjQ45VaeoyyFl+WT5xr/YlqhQ gPBbypIldmQjxmAtQqmiOLKp8fdzMQmOO5Yvh/tq5msenhgzLwevF6baYy7l/9l3mA yghu2UjmxThl7enmovaoaSd3wDQGw9yAJM/lTCgE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388784AbgDAQf4 (ORCPT ); Wed, 1 Apr 2020 12:35:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:34770 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388795AbgDAQf4 (ORCPT ); Wed, 1 Apr 2020 12:35:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4A55220857; Wed, 1 Apr 2020 16:35:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758955; bh=Dxdis/KJKogw06PdKI7YE6I+j6JbrgSMNU1dghE2T48=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MTJbRmISy47bfK4xp6NBU4z6Tr0KkFwJ82zrrWv6Td0Rjrdf+0rlHgW8iXvkxg6dm RFAkVUrhQwOcs1Ts8SCaRKP1QlqaixtuMOgI3/3cv5vJMB1qHZLIwDjQmLGzxQ3XDa DOAn/eSH53tsEeYXjWyGiM06wq4YXvQC9jXqaY5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kishon Vijay Abraham I , Tony Lindgren , Sasha Levin Subject: [PATCH 4.9 003/102] ARM: dts: dra7: Add "dma-ranges" property to PCIe RC DT nodes Date: Wed, 1 Apr 2020 18:17:06 +0200 Message-Id: <20200401161532.006689044@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kishon Vijay Abraham I [ Upstream commit 27f13774654ea6bd0b6fc9b97cce8d19e5735661 ] 'dma-ranges' in a PCI bridge node does correctly set dma masks for PCI devices not described in the DT. Certain DRA7 platforms (e.g., DRA76) has RAM above 32-bit boundary (accessible with LPAE config) though the PCIe bridge will be able to access only 32-bits. Add 'dma-ranges' property in PCIe RC DT nodes to indicate the host bridge can access only 32 bits. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Tony Lindgren Signed-off-by: Sasha Levin --- arch/arm/boot/dts/dra7.dtsi | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi index a1a928064b53d..f94064c687789 100644 --- a/arch/arm/boot/dts/dra7.dtsi +++ b/arch/arm/boot/dts/dra7.dtsi @@ -282,6 +282,7 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x20013000 0x13000 0 0xffed000>; + dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>; @@ -319,6 +320,7 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x30013000 0x13000 0 0xffed000>; + dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>; From patchwork Wed Apr 1 16:17:07 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228442 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 781E0C2D0F3 for ; Wed, 1 Apr 2020 16:36:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1D690206F8 for ; Wed, 1 Apr 2020 16:36:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758986; bh=T7EptmKtFcmwZNYtW2NJwIhPk4hbrAUxmdJ1+Wx/nAc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=atWzneFuPy/tLpNK6wGmbj48glyQOiuct7Bnn/rjY9OVFOvIQhtey9zJgHqCOZMvW tikPFCJsnofBvWT6sI9wA+KVXKDQXa0Xsm0p+rnh6ih1zp0jEU1gnsRCNMIH3CkJZW Lcqb6bYFbCe+akfqxww/NDs9onh32BjJPbkXgCU4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388586AbgDAQgZ (ORCPT ); Wed, 1 Apr 2020 12:36:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:35250 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388056AbgDAQgW (ORCPT ); Wed, 1 Apr 2020 12:36:22 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 34AD220772; Wed, 1 Apr 2020 16:36:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758981; bh=T7EptmKtFcmwZNYtW2NJwIhPk4hbrAUxmdJ1+Wx/nAc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jG6/C39TasmKGfKX4F0sY9t3CfSrgWPg3eo7jz0EtwZjDgl00NR78treVC3US2lfu ZXytUjGouJ9Lq/1wnPEXmIj66AdAZoVY2cI3+VAjvyMRR0W0lZz1Uo4FghuKrnmCtr LaCm+qs8WkGvVdRzdb2itQSoKBM3WhVoh12b+dnY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thommy Jakobsson , Naga Sureshkumar Relli , Mark Brown , Sasha Levin Subject: [PATCH 4.9 004/102] spi/zynqmp: remove entry that causes a cs glitch Date: Wed, 1 Apr 2020 18:17:07 +0200 Message-Id: <20200401161532.417694260@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Thommy Jakobsson [ Upstream commit 5dd8304981ecffa77bb72b1c57c4be5dfe6cfae9 ] In the public interface for chipselect, there is always an entry commented as "Dummy generic FIFO entry" pushed down to the fifo right after the activate/deactivate command. The dummy entry is 0x0, irregardless if the intention was to activate or deactive the cs. This causes the cs line to glitch rather than beeing activated in the case when there was an activate command. This has been observed on oscilloscope, and have caused problems for at least one specific flash device type connected to the qspi port. After the change the glitch is gone and cs goes active when intended. The reason why this worked before (except for the glitch) was because when sending the actual data, the CS bits are once again set. Since most flashes uses mode 0, there is always a half clk period anyway for cs to clk active setup time. If someone would rely on timing from a chip_select call to a transfer_one, it would fail though. It is unknown why the dummy entry was there in the first place, git log seems to be of no help in this case. The reference manual gives no indication of the necessity of this. In fact the lower 8 bits are a setup (or hold in case of deactivate) time expressed in cycles. So this should not be needed to fulfill any setup/hold timings. Signed-off-by: Thommy Jakobsson Reviewed-by: Naga Sureshkumar Relli Link: https://lore.kernel.org/r/20200224162643.29102-1-thommyj@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin --- drivers/spi/spi-zynqmp-gqspi.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c index 18aeaceee2862..d26c0eda2d9ea 100644 --- a/drivers/spi/spi-zynqmp-gqspi.c +++ b/drivers/spi/spi-zynqmp-gqspi.c @@ -415,9 +415,6 @@ static void zynqmp_qspi_chipselect(struct spi_device *qspi, bool is_high) zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, genfifoentry); - /* Dummy generic FIFO entry */ - zynqmp_gqspi_write(xqspi, GQSPI_GEN_FIFO_OFST, 0x0); - /* Manually start the generic FIFO command */ zynqmp_gqspi_write(xqspi, GQSPI_CONFIG_OFST, zynqmp_gqspi_read(xqspi, GQSPI_CONFIG_OFST) | From patchwork Wed Apr 1 16:17:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228334 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B7C7C2D0F2 for ; Wed, 1 Apr 2020 16:52:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 377322063A for ; Wed, 1 Apr 2020 16:52:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759937; bh=DAzNytEKYVDkkCaQNm7J4s7xcEx2wTe7yrYfQJXX7+Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VTO4Y7+NEzs5j64rac9YWFmrV3X8TKHU3p86JWfeP5Xk1XwjM35Y3spuwUY/GMxKy wWirdXVyM+lK5nUImmWsp9WTXMIsTVDbu7IbwhpucqI20yl3LJqLakI+VbC15XhQ5I Ga+WmW/JHf2tliIoO59LiTyD9evWmBqeyGLPCkyE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388616AbgDAQwQ (ORCPT ); Wed, 1 Apr 2020 12:52:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:35410 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388056AbgDAQg2 (ORCPT ); Wed, 1 Apr 2020 12:36:28 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7805420658; Wed, 1 Apr 2020 16:36:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758987; bh=DAzNytEKYVDkkCaQNm7J4s7xcEx2wTe7yrYfQJXX7+Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tWiEoKciTfShtGo0qWfC89EWEnCC7scIDAu/GNVK/d6XNmINvJjZFPehGYBu2Cjyp S/HdYI6BPBXEgPSaobg41gZR8d0y2iGeJLdFr0LWeTTr3lGGWXkpONS+oCdIOumDUS eMPnKvcry/4lI38dcteeF9GoXJ8xLQ8sxuXzFD4E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Szyprowski , Andrzej Hajda , Inki Dae , Sasha Levin Subject: [PATCH 4.9 006/102] drm/exynos: dsi: fix workaround for the legacy clock name Date: Wed, 1 Apr 2020 18:17:09 +0200 Message-Id: <20200401161532.691800992@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Szyprowski [ Upstream commit c0fd99d659ba5582e09625c7a985d63fc2ca74b5 ] Writing to the built-in strings arrays doesn't work if driver is loaded as kernel module. This is also considered as a bad pattern. Fix this by adding a call to clk_get() with legacy clock name. This fixes following kernel oops if driver is loaded as module: Unable to handle kernel paging request at virtual address bf047978 pgd = (ptrval) [bf047978] *pgd=59344811, *pte=5903c6df, *ppte=5903c65f Internal error: Oops: 80f [#1] SMP ARM Modules linked in: mc exynosdrm(+) analogix_dp rtc_s3c exynos_ppmu i2c_gpio CPU: 1 PID: 212 Comm: systemd-udevd Not tainted 5.6.0-rc2-next-20200219 #326 videodev: Linux video capture interface: v2.00 Hardware name: Samsung Exynos (Flattened Device Tree) PC is at exynos_dsi_probe+0x1f0/0x384 [exynosdrm] LR is at exynos_dsi_probe+0x1dc/0x384 [exynosdrm] ... Process systemd-udevd (pid: 212, stack limit = 0x(ptrval)) ... [] (exynos_dsi_probe [exynosdrm]) from [] (platform_drv_probe+0x6c/0xa4) [] (platform_drv_probe) from [] (really_probe+0x210/0x350) [] (really_probe) from [] (driver_probe_device+0x60/0x1a0) [] (driver_probe_device) from [] (device_driver_attach+0x58/0x60) [] (device_driver_attach) from [] (__driver_attach+0x80/0xbc) [] (__driver_attach) from [] (bus_for_each_dev+0x68/0xb4) [] (bus_for_each_dev) from [] (bus_add_driver+0x130/0x1e8) [] (bus_add_driver) from [] (driver_register+0x78/0x110) [] (driver_register) from [] (exynos_drm_init+0xe8/0x11c [exynosdrm]) [] (exynos_drm_init [exynosdrm]) from [] (do_one_initcall+0x50/0x220) [] (do_one_initcall) from [] (do_init_module+0x60/0x210) [] (do_init_module) from [] (load_module+0x1c0c/0x2310) [] (load_module) from [] (sys_finit_module+0xac/0xbc) [] (sys_finit_module) from [] (ret_fast_syscall+0x0/0x54) Exception stack(0xd979bfa8 to 0xd979bff0) ... ---[ end trace db16efe05faab470 ]--- Signed-off-by: Marek Szyprowski Reviewed-by: Andrzej Hajda Signed-off-by: Inki Dae Signed-off-by: Sasha Levin --- drivers/gpu/drm/exynos/exynos_drm_dsi.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/exynos/exynos_drm_dsi.c b/drivers/gpu/drm/exynos/exynos_drm_dsi.c index 5e202af7fbf53..2b6c04acb24f5 100644 --- a/drivers/gpu/drm/exynos/exynos_drm_dsi.c +++ b/drivers/gpu/drm/exynos/exynos_drm_dsi.c @@ -1790,9 +1790,10 @@ static int exynos_dsi_probe(struct platform_device *pdev) dsi->clks[i] = devm_clk_get(dev, clk_names[i]); if (IS_ERR(dsi->clks[i])) { if (strcmp(clk_names[i], "sclk_mipi") == 0) { - strcpy(clk_names[i], OLD_SCLK_MIPI_CLK_NAME); - i--; - continue; + dsi->clks[i] = devm_clk_get(dev, + OLD_SCLK_MIPI_CLK_NAME); + if (!IS_ERR(dsi->clks[i])) + continue; } dev_info(dev, "failed to get the clock: %s\n", From patchwork Wed Apr 1 16:17:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228441 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20D6AC43331 for ; Wed, 1 Apr 2020 16:36:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E8B7220658 for ; Wed, 1 Apr 2020 16:36:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758994; bh=Wk5vG2jvv3zKm1H8ZHIEKdgfGVZnA91k1WpdRvzFCCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yPWVg3nQcjOqu0RysDKbfNGz3txBItyuHCYjpZVlpHUjKioZVfykzxZrh031kgczY 2WlT68SE8X/OaBx98SW3Z+ENmBuz25sp7m5lBIaVFyNNXWwBMPMjRTPAAEv4pQn0l3 HO44tBLxzY0IBjPIwPn472Dj3XCJtzBx75TZMR2Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388849AbgDAQgc (ORCPT ); Wed, 1 Apr 2020 12:36:32 -0400 Received: from mail.kernel.org ([198.145.29.99]:35466 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388847AbgDAQgb (ORCPT ); Wed, 1 Apr 2020 12:36:31 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 064AB206F8; Wed, 1 Apr 2020 16:36:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758990; bh=Wk5vG2jvv3zKm1H8ZHIEKdgfGVZnA91k1WpdRvzFCCI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SSML69M2CKOGAunBPzOi0ZGZf4mWIP2GgBxftXfAtdzSSeBh7yL60jJYozJh9BPPe ehBAJ++8b8xvv2yo3fgTF3ddYERVHvstevb+VNuDDG/ICJxDnAHdNI/IFn0VVi5Vj3 NHN4o0lFIa0EdnjuXmM4UEH2+ECo6LSr3/SxGXEM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Igor M. Liplianin" , Daniel Axtens , Kees Cook , Sasha Levin Subject: [PATCH 4.9 007/102] altera-stapl: altera_get_note: prevent write beyond end of key Date: Wed, 1 Apr 2020 18:17:10 +0200 Message-Id: <20200401161533.110718483@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Daniel Axtens [ Upstream commit 3745488e9d599916a0b40d45d3f30e3d4720288e ] altera_get_note is called from altera_init, where key is kzalloc(33). When the allocation functions are annotated to allow the compiler to see the sizes of objects, and with FORTIFY_SOURCE, we see: In file included from drivers/misc/altera-stapl/altera.c:14:0: In function ‘strlcpy’, inlined from ‘altera_init’ at drivers/misc/altera-stapl/altera.c:2189:5: include/linux/string.h:378:4: error: call to ‘__write_overflow’ declared with attribute error: detected write beyond size of object passed as 1st parameter __write_overflow(); ^~~~~~~~~~~~~~~~~~ That refers to this code in altera_get_note: if (key != NULL) strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], length); The error triggers because the length of 'key' is 33, but the copy uses length supplied as the 'length' parameter, which is always 256. Split the size parameter into key_len and val_len, and use the appropriate length depending on what is being copied. Detected by compiler error, only compile-tested. Cc: "Igor M. Liplianin" Signed-off-by: Daniel Axtens Link: https://lore.kernel.org/r/20200120074344.504-2-dja@axtens.net Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/202002251042.D898E67AC@keescook Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin --- drivers/misc/altera-stapl/altera.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/misc/altera-stapl/altera.c b/drivers/misc/altera-stapl/altera.c index 494e263daa748..b7ee8043a133e 100644 --- a/drivers/misc/altera-stapl/altera.c +++ b/drivers/misc/altera-stapl/altera.c @@ -2126,8 +2126,8 @@ static int altera_execute(struct altera_state *astate, return status; } -static int altera_get_note(u8 *p, s32 program_size, - s32 *offset, char *key, char *value, int length) +static int altera_get_note(u8 *p, s32 program_size, s32 *offset, + char *key, char *value, int keylen, int vallen) /* * Gets key and value of NOTE fields in the JBC file. * Can be called in two modes: if offset pointer is NULL, @@ -2184,7 +2184,7 @@ static int altera_get_note(u8 *p, s32 program_size, &p[note_table + (8 * i) + 4])]; if (value != NULL) - strlcpy(value, value_ptr, length); + strlcpy(value, value_ptr, vallen); } } @@ -2203,13 +2203,13 @@ static int altera_get_note(u8 *p, s32 program_size, strlcpy(key, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i)])], - length); + keylen); if (value != NULL) strlcpy(value, &p[note_strings + get_unaligned_be32( &p[note_table + (8 * i) + 4])], - length); + vallen); *offset = i + 1; } @@ -2463,7 +2463,7 @@ int altera_init(struct altera_config *config, const struct firmware *fw) __func__, (format_version == 2) ? "Jam STAPL" : "pre-standardized Jam 1.1"); while (altera_get_note((u8 *)fw->data, fw->size, - &offset, key, value, 256) == 0) + &offset, key, value, 32, 256) == 0) printk(KERN_INFO "%s: NOTE \"%s\" = \"%s\"\n", __func__, key, value); } From patchwork Wed Apr 1 16:17:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228335 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67E60C43331 for ; Wed, 1 Apr 2020 16:52:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2C00B2063A for ; Wed, 1 Apr 2020 16:52:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759930; bh=nApbZ80mXRy/+ibrdVc/TvjMd1UMq5jINCA6FxGD2T8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=NFnPCR4NPfkIbxlr3JafqZUWU4a+MpiTNLV2H9K4/vhsKxjSPOlyUX9QaQc478ky7 BHxq1T4RrQTEFETpJVpF81bGyNUvI36wZICni4u9uyCgIM5rJWmcYwfJ6GcdkCGCG8 egxgGtIlXphykcjJ9JWRzprsi24bMN2Q5HtRQRkY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388722AbgDAQge (ORCPT ); Wed, 1 Apr 2020 12:36:34 -0400 Received: from mail.kernel.org ([198.145.29.99]:35552 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388133AbgDAQgd (ORCPT ); Wed, 1 Apr 2020 12:36:33 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7CABE20BED; Wed, 1 Apr 2020 16:36:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758992; bh=nApbZ80mXRy/+ibrdVc/TvjMd1UMq5jINCA6FxGD2T8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fscQi4f6g1flnTKcL505kvLNSMvf527Ddwo5J5wcxb3n0+gca/AMYIpQbLwzjSDCr QBv3GiHbXUp4vjycaas4T+JXFL8OXtx3v6Acw7gMN8IvR6dsWf6AlwQwqEm0cw2In1 ZyHg6VMxsQFrzKs6x7NH0QEV6ntj8wkaw6vCS0gE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern , Kai-Heng Feng Subject: [PATCH 4.9 008/102] USB: Disable LPM on WD19s Realtek Hub Date: Wed, 1 Apr 2020 18:17:11 +0200 Message-Id: <20200401161533.326184425@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kai-Heng Feng commit b63e48fb50e1ca71db301ca9082befa6f16c55c4 upstream. Realtek Hub (0bda:0x0487) used in Dell Dock WD19 sometimes drops off the bus when bringing underlying ports from U3 to U0. Disabling LPM on the hub during setting link state is not enough, so let's disable LPM completely for this hub. Acked-by: Alan Stern Signed-off-by: Kai-Heng Feng Cc: stable Link: https://lore.kernel.org/r/20200205112633.25995-3-kai.heng.feng@canonical.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/core/quirks.c +++ b/drivers/usb/core/quirks.c @@ -229,6 +229,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0b05, 0x17e0), .driver_info = USB_QUIRK_IGNORE_REMOTE_WAKEUP }, + /* Realtek hub in Dell WD19 (Type-C) */ + { USB_DEVICE(0x0bda, 0x0487), .driver_info = USB_QUIRK_NO_LPM }, + /* Action Semiconductor flash disk */ { USB_DEVICE(0x10d6, 0x2200), .driver_info = USB_QUIRK_STRING_FETCH_255 }, From patchwork Wed Apr 1 16:17:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228451 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60FA9C2BA12 for ; Wed, 1 Apr 2020 16:34:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2CB3D20658 for ; Wed, 1 Apr 2020 16:34:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758897; bh=zoIs6g3QiQF1Pb10geW1fimpOpcLW6YJQTXtrUPp+rY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oA6D7vkVFBKA92seDb9SpvFykn/t7OIuRQ3T6L7sbI1Htsbldc9dsUtT61BegGmw7 47qrSRjKftyWvet3WJaymYZigI70GrB/II7UGauFrd2ezcP8L7U37lJ8hOn5NfmNY5 chDVG0E7d9gz1oY3XX129njH1OPzh70XdfzrFUAs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732411AbgDAQek (ORCPT ); Wed, 1 Apr 2020 12:34:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:33316 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388529AbgDAQek (ORCPT ); Wed, 1 Apr 2020 12:34:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D501A20772; Wed, 1 Apr 2020 16:34:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758879; bh=zoIs6g3QiQF1Pb10geW1fimpOpcLW6YJQTXtrUPp+rY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JOPJD4cGXyePPb+T9EczDJauw5Q/AlmJJOKmNsPPmSGhwXfWjONmaxuSyxoBhsZ1+ jtttcTNzGKFO3UP7m5/2im3pZdG4wPLk2B3/U8ZQT9v7S/ZFaV9ovI2cRDcRqUJGj6 b3BL0d0ljeRof7ysSeRVItedRtx5YdGWHjt3Ew+Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ran Wang , Stephen Boyd , Peter Chen Subject: [PATCH 4.9 011/102] usb: host: xhci-plat: add a shutdown Date: Wed, 1 Apr 2020 18:17:14 +0200 Message-Id: <20200401161533.922470748@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Ran Wang commit b433e340e7565110b0ce9ca4b3e26f4b97a1decf upstream. When loading new kernel via kexec, we need to shutdown host controller to avoid any un-expected memory accessing during new kernel boot. Signed-off-by: Ran Wang Cc: stable Tested-by: Stephen Boyd Reviewed-by: Peter Chen Link: https://lore.kernel.org/r/20200306092328.41253-1-ran.wang_1@nxp.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/host/xhci-plat.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/usb/host/xhci-plat.c +++ b/drivers/usb/host/xhci-plat.c @@ -335,6 +335,7 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_ static struct platform_driver usb_xhci_driver = { .probe = xhci_plat_probe, .remove = xhci_plat_remove, + .shutdown = usb_hcd_platform_shutdown, .driver = { .name = "xhci-hcd", .pm = DEV_PM_OPS, From patchwork Wed Apr 1 16:17:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228452 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B1F5C2BA12 for ; Wed, 1 Apr 2020 16:34:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0FD9B20658 for ; Wed, 1 Apr 2020 16:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758895; bh=u0oxV+ZE30Cvfe5WC10gcHtQGNHrKMYUrIi5VvOstjo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yYCFqpMD0wPX1jbtLinoqYM+N++3IpCTLrkXYcjvXndz5jvxjp3tTGY50Q5CrTDw7 /Gqt6MeZizc1fjyn8jiJuFHHveIq5k3jwurvfNEPABAPbtZQIaREpcCzWQXHkHpUiG uVUOydxPAgmXJ9cvdvr4wvJODDei9AjHV7nTQJTE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388695AbgDAQeu (ORCPT ); Wed, 1 Apr 2020 12:34:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:33488 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387470AbgDAQes (ORCPT ); Wed, 1 Apr 2020 12:34:48 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id AA5A220772; Wed, 1 Apr 2020 16:34:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758888; bh=u0oxV+ZE30Cvfe5WC10gcHtQGNHrKMYUrIi5VvOstjo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B45Su2g70v1/QLDJlC4mKjHNh1uhagr+TrNU2Jkpxl0PQUpiOJfCAgVif+5Zp3LK+ 7da1L9ZvzOE5u6S27Mla2BO+MoWoGyq85ePe2k9HX74hdOFwBMpj+UHq9pnAbmK/B3 64a6TL5ChKxzqeN9aLMWnZDhEG+IJMobM8pzaPEQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andreas Steinmetz , Takashi Iwai Subject: [PATCH 4.9 014/102] ALSA: seq: virmidi: Fix running status after receiving sysex Date: Wed, 1 Apr 2020 18:17:17 +0200 Message-Id: <20200401161534.606275488@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 4384f167ce5fa7241b61bb0984d651bc528ddebe upstream. The virmidi driver handles sysex event exceptionally in a short-cut snd_seq_dump_var_event() call, but this missed the reset of the running status. As a result, it may lead to an incomplete command right after the sysex when an event with the same running status was queued. Fix it by clearing the running status properly via alling snd_midi_event_reset_decode() for that code path. Reported-by: Andreas Steinmetz Cc: Link: https://lore.kernel.org/r/3b4a4e0f232b7afbaf0a843f63d0e538e3029bfd.camel@domdv.de Link: https://lore.kernel.org/r/20200316090506.23966-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/seq/seq_virmidi.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/core/seq/seq_virmidi.c +++ b/sound/core/seq/seq_virmidi.c @@ -95,6 +95,7 @@ static int snd_virmidi_dev_receive_event if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) continue; snd_seq_dump_var_event(ev, (snd_seq_dump_func_t)snd_rawmidi_receive, vmidi->substream); + snd_midi_event_reset_decode(vmidi->parser); } else { len = snd_midi_event_decode(vmidi->parser, msg, sizeof(msg), ev); if (len > 0) From patchwork Wed Apr 1 16:17:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228450 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DE42C2BA15 for ; Wed, 1 Apr 2020 16:34:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 239FF206F8 for ; Wed, 1 Apr 2020 16:34:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758898; bh=0vKhX8eqkC4hibNoWu6IOHcT8SXG4FHJa/n34WYhQYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=eLgL+9nPAYEwe4sgRgbrYPOVHuFAO9OhbhBaaZhgS143nHVDG9cey3AhGagtshcSW J5aSTRqcPtkTeMMeYKG4X/DaJpQ30CK3gEhKG3hfLy0VYWJKwWn/bo04Yduq9TK6la dNeYtMW1Z8nqOstKTspcMm+NE2eAvwoqJZKAto6o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732336AbgDAQe5 (ORCPT ); Wed, 1 Apr 2020 12:34:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:33598 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387470AbgDAQe4 (ORCPT ); Wed, 1 Apr 2020 12:34:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3BABD206F8; Wed, 1 Apr 2020 16:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758895; bh=0vKhX8eqkC4hibNoWu6IOHcT8SXG4FHJa/n34WYhQYA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tSd28sPxh166ufdM1x4KBkVAJ9r+cmxk835BLo9Hi2dl5N/ArQMiHO6+Lcb7NIhNf cOpyeaOG9P4ag7uQElnAE+o/Pq+klqkPXe3HWxFwnrR/hDkhUIlKPXFJ7roMA8k3ZX pLjiIkqOPuwkjDlJ+WTnP8vbibfCTvjPXiofVsv4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai Subject: [PATCH 4.9 015/102] ALSA: seq: oss: Fix running status after receiving sysex Date: Wed, 1 Apr 2020 18:17:18 +0200 Message-Id: <20200401161534.887920857@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 6c3171ef76a0bad892050f6959a7eac02fb16df7 upstream. This is a similar bug like the previous case for virmidi: the invalid running status is kept after receiving a sysex message. Again the fix is to clear the running status after handling the sysex. Cc: Link: https://lore.kernel.org/r/3b4a4e0f232b7afbaf0a843f63d0e538e3029bfd.camel@domdv.de Link: https://lore.kernel.org/r/20200316090506.23966-3-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/seq/oss/seq_oss_midi.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/core/seq/oss/seq_oss_midi.c +++ b/sound/core/seq/oss/seq_oss_midi.c @@ -615,6 +615,7 @@ send_midi_event(struct seq_oss_devinfo * len = snd_seq_oss_timer_start(dp->timer); if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev); + snd_midi_event_reset_decode(mdev->coder); } else { len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev); if (len > 0) From patchwork Wed Apr 1 16:17:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228331 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B613C2D0F2 for ; Wed, 1 Apr 2020 16:52:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E9C6F20714 for ; Wed, 1 Apr 2020 16:52:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759962; bh=wyLKa9e4fnj7moQyCDcCfUz9jCeCcmM9gRIIhMtIa1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=RhBtq2RlzSfl9DLuS+urLjXnq4oAumlKE+MTpQ77ash8amdTstlWRJTt1TQHJ6Ugf xlTIJ6cOYXq34ksxWtkbk5t6l7BdStdm0ggLTYlDN6zwAD9WXH+XUROWn0/dN99NnX XDK1FV5Ny+brFsZURR3bXtreL7aepBqd5ZEjaXaE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388578AbgDAQfD (ORCPT ); Wed, 1 Apr 2020 12:35:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:33732 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388054AbgDAQfD (ORCPT ); Wed, 1 Apr 2020 12:35:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2C8B020658; Wed, 1 Apr 2020 16:35:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758902; bh=wyLKa9e4fnj7moQyCDcCfUz9jCeCcmM9gRIIhMtIa1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MFy2TsQwvcukvh/TeCdzkzCOEDnHizdK4cOnw/1knZj8w105RbDQlzk9Y/6TK2upb cUu4izRVUS9VXempaFGWebyNLAwarad8ZzRAP3YcJd6zW/q0txsFOhbsT7VExRb21r CNhtpBZYIriDSH6hnLNH5JweQoMGE3nbkweccHtI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+2a59ee7a9831b264f45e@syzkaller.appspotmail.com, Takashi Iwai Subject: [PATCH 4.9 017/102] ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks Date: Wed, 1 Apr 2020 18:17:20 +0200 Message-Id: <20200401161535.494978264@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Takashi Iwai commit 5461e0530c222129dfc941058be114b5cbc00837 upstream. The return value checks in snd_pcm_plug_alloc() are covered with snd_BUG_ON() macro that may trigger a kernel WARNING depending on the kconfig. But since the error condition can be triggered by a weird user space parameter passed to OSS layer, we shouldn't give the kernel stack trace just for that. As it's a normal error condition, let's remove snd_BUG_ON() macro usage there. Reported-by: syzbot+2a59ee7a9831b264f45e@syzkaller.appspotmail.com Cc: Link: https://lore.kernel.org/r/20200312155730.7520-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/core/oss/pcm_plugin.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/core/oss/pcm_plugin.c +++ b/sound/core/oss/pcm_plugin.c @@ -111,7 +111,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_su while (plugin->next) { if (plugin->dst_frames) frames = plugin->dst_frames(plugin, frames); - if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + if ((snd_pcm_sframes_t)frames <= 0) return -ENXIO; plugin = plugin->next; err = snd_pcm_plugin_alloc(plugin, frames); @@ -123,7 +123,7 @@ int snd_pcm_plug_alloc(struct snd_pcm_su while (plugin->prev) { if (plugin->src_frames) frames = plugin->src_frames(plugin, frames); - if (snd_BUG_ON((snd_pcm_sframes_t)frames <= 0)) + if ((snd_pcm_sframes_t)frames <= 0) return -ENXIO; plugin = plugin->prev; err = snd_pcm_plugin_alloc(plugin, frames); From patchwork Wed Apr 1 16:17:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228448 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6A17C2BA1B for ; Wed, 1 Apr 2020 16:35:23 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 55C1B206F8 for ; Wed, 1 Apr 2020 16:35:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758923; bh=sBir27o/Pb8WIzswOqkdHncGGar33AnRwyEMUFF4b2o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=nJloqfuNhZZsk+v7xuO1nAsc0ciiwlUAEb7RfvIi0OfGnqd7VbTBan2sTxZg7Iqwx S5y7NuBZ5vaqDh/Jd/QlCGH2j+kVSqmoXzJlYWY0fYC1Y/F2HN1yj9QhfuyveOGTKC gDJIpLCn+F9/eCZQpr6DdemXFhQkzTS/y4P9hgz8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388153AbgDAQfG (ORCPT ); Wed, 1 Apr 2020 12:35:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:33790 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387563AbgDAQfF (ORCPT ); Wed, 1 Apr 2020 12:35:05 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B5C3920658; Wed, 1 Apr 2020 16:35:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758905; bh=sBir27o/Pb8WIzswOqkdHncGGar33AnRwyEMUFF4b2o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mgEQPAKjYi/4ZqFvdt54Y1sIdbnCUoIBDg2R6HAQLhlqWXHz/ArVWAK6GQ1V9TsW8 KhZ503CsAAgQ6F4Eqa7QwtwtcVtmMLRnyjYmaUh/VONoRnKi+IFGebv8Ae5Cp3cK6X m2EWcbmvpHCFL3coIBpnN6yBYPPY0GJgyKghnsh8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stephan Gerhold , Linus Waleij , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 4.9 018/102] iio: magnetometer: ak8974: Fix negative raw values in sysfs Date: Wed, 1 Apr 2020 18:17:21 +0200 Message-Id: <20200401161536.017379826@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Stephan Gerhold commit b500c086e4110829a308c23e83a7cdc65b26228a upstream. At the moment, reading from in_magn_*_raw in sysfs tends to return large values around 65000, even though the output of ak8974 is actually limited to ±32768. This happens because the value is never converted to the signed 16-bit integer variant. Add an explicit cast to s16 to fix this. Fixes: 7c94a8b2ee8c ("iio: magn: add a driver for AK8974") Signed-off-by: Stephan Gerhold Reviewed-by: Linus Waleij Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- drivers/iio/magnetometer/ak8974.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/magnetometer/ak8974.c +++ b/drivers/iio/magnetometer/ak8974.c @@ -477,7 +477,7 @@ static int ak8974_read_raw(struct iio_de * We read all axes and discard all but one, for optimized * reading, use the triggered buffer. */ - *val = le16_to_cpu(hw_values[chan->address]); + *val = (s16)le16_to_cpu(hw_values[chan->address]); ret = IIO_VAL_INT; } From patchwork Wed Apr 1 16:17:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228447 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22F54C43331 for ; Wed, 1 Apr 2020 16:35:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E7A852137B for ; Wed, 1 Apr 2020 16:35:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758935; bh=F/Gy3fZ+eLJ73Pa8V1RLGOH2/lFrLfrdt909e5D8MEY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HSjG9gAZz36ziJujjCTXke5wYjh9smhj/vMItbJY9JVKvMw5boOHMYcUzOuWETHUK yP00Jw4n9C7Xltovcqi0I4cmqGU644sM+d53y0ULEFT3n4sLv6RdIFNjYZpZCJEu+f AWH9J9rDdCknAT6L0T5ePyn4Jw85pTY/E+Pja/P4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388594AbgDAQf0 (ORCPT ); Wed, 1 Apr 2020 12:35:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:34150 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388738AbgDAQfZ (ORCPT ); Wed, 1 Apr 2020 12:35:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 47ED7206F8; Wed, 1 Apr 2020 16:35:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758924; bh=F/Gy3fZ+eLJ73Pa8V1RLGOH2/lFrLfrdt909e5D8MEY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PgU+RgIrdkTP2OLVBZjqPG+C4HCrBlvp2FkucLmQph7dS0xYxpcCxAUJo3oWJxuBC ts61/416kLxkRh19bvVhn/5OszSNCe6fdjzUvbUjrcnK5nV8xye22p5Uhu39XJ6bzj IckYKHHxs3Yu44oK6A6TF08OyrXkKSpqfOlKpGPo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Linus Torvalds Subject: [PATCH 4.9 023/102] rtc: max8907: add missing select REGMAP_IRQ Date: Wed, 1 Apr 2020 18:17:26 +0200 Message-Id: <20200401161537.427316084@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Corentin Labbe commit 5d892919fdd0cefd361697472d4e1b174a594991 upstream. I have hit the following build error: armv7a-hardfloat-linux-gnueabi-ld: drivers/rtc/rtc-max8907.o: in function `max8907_rtc_probe': rtc-max8907.c:(.text+0x400): undefined reference to `regmap_irq_get_virq' max8907 should select REGMAP_IRQ Fixes: 94c01ab6d7544 ("rtc: add MAX8907 RTC driver") Cc: stable Signed-off-by: Corentin Labbe Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- drivers/rtc/Kconfig | 1 + 1 file changed, 1 insertion(+) --- a/drivers/rtc/Kconfig +++ b/drivers/rtc/Kconfig @@ -304,6 +304,7 @@ config RTC_DRV_MAX6900 config RTC_DRV_MAX8907 tristate "Maxim MAX8907" depends on MFD_MAX8907 + select REGMAP_IRQ help If you say yes here you will get support for the RTC of Maxim MAX8907 PMIC. From patchwork Wed Apr 1 16:17:28 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228446 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7F9BC43331 for ; Wed, 1 Apr 2020 16:35:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7C3E3215A4 for ; Wed, 1 Apr 2020 16:35:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758937; bh=Y48+j7XGhXX/OxaFoe8wgA3dfctoxSz/8JfDkwkdkEQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=E4uMIt8iLCrGMbB9IB0+KqE53uaR1JnMc5deRmGqIW5C1aAlIsc3wQ1UfFkhqrVGx bG6v2ZKF7jinESqZR43ZZtenwjj24yY34H5EaxV3Nolqe44ghmvR5UUqtMRuPUVR/x Y/O10g6n3o82HCMZWxYsS8vU1FW7maxKNCt8rPqs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388637AbgDAQfg (ORCPT ); Wed, 1 Apr 2020 12:35:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:34356 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388322AbgDAQff (ORCPT ); Wed, 1 Apr 2020 12:35:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 79A6B20BED; Wed, 1 Apr 2020 16:35:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758934; bh=Y48+j7XGhXX/OxaFoe8wgA3dfctoxSz/8JfDkwkdkEQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BdvhjNMWniCG3Phvqz/tI7UpfAuLzP3ULOt/Opdo9/Gwg8PhsCWkK1qol/p17dnAf mNJ1QiZ7YMjpShvBTUYgB52PVisPy+eLhfzdPkKlaDceY2bvOByKmuUX/ki3GExgfZ ge0vcYiL7+FrSR6uK6bAN2BPvD5wHOlih3DyzYOA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Linus Torvalds Subject: [PATCH 4.9 025/102] mm: slub: be more careful about the double cmpxchg of freelist Date: Wed, 1 Apr 2020 18:17:28 +0200 Message-Id: <20200401161537.757657267@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Linus Torvalds commit 5076190daded2197f62fe92cf69674488be44175 upstream. This is just a cleanup addition to Jann's fix to properly update the transaction ID for the slub slowpath in commit fd4d9c7d0c71 ("mm: slub: add missing TID bump.."). The transaction ID is what protects us against any concurrent accesses, but we should really also make sure to make the 'freelist' comparison itself always use the same freelist value that we then used as the new next free pointer. Jann points out that if we do all of this carefully, we could skip the transaction ID update for all the paths that only remove entries from the lists, and only update the TID when adding entries (to avoid the ABA issue with cmpxchg and list handling re-adding a previously seen value). But this patch just does the "make sure to cmpxchg the same value we used" rather than then try to be clever. Acked-by: Jann Horn Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -2935,11 +2935,13 @@ redo: barrier(); if (likely(page == c->page)) { - set_freepointer(s, tail_obj, c->freelist); + void **freelist = READ_ONCE(c->freelist); + + set_freepointer(s, tail_obj, freelist); if (unlikely(!this_cpu_cmpxchg_double( s->cpu_slab->freelist, s->cpu_slab->tid, - c->freelist, tid, + freelist, tid, head, next_tid(tid)))) { note_cmpxchg_failure("slab_free", s, tid); From patchwork Wed Apr 1 16:17:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228332 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 260F1C2D0F2 for ; Wed, 1 Apr 2020 16:52:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DD7F520714 for ; Wed, 1 Apr 2020 16:52:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759958; bh=Nb0r+HQTy4g3tmCtBYbsXP+gteUn0DVvrhjMF+wHtw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yLBD/0hlScG4x8tvpokjErteOmcU/FPahW51SB+bOqvhIutOGKXiXRVvtBiei79iH U6zNb1+w0/Lpm8YkdpNpP/xOsknW5q3QWHPcXceSYFm0lal/JfAO7/UWfI58tIQY4F qKyWUPllSHT9iqaubGL3d/US/yZCgsd9js2XMh8A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388661AbgDAQfk (ORCPT ); Wed, 1 Apr 2020 12:35:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:34418 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388757AbgDAQfj (ORCPT ); Wed, 1 Apr 2020 12:35:39 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0AF7420BED; Wed, 1 Apr 2020 16:35:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758938; bh=Nb0r+HQTy4g3tmCtBYbsXP+gteUn0DVvrhjMF+wHtw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mt/p+B+q8f3YrrqJDCKhbZiGTeCshTbnDOpaVdd3c1Uq0djz4RHxxXvS9VV/dqoaB zHtDoHpZZ2n2GiNXnowgi32dvHEqhmdnFk1ehkRv8liKLJ1B56JnmNIQoCM092vVvN HyW9S7pmXY4DB+QowJvtD2vKeK9mIDEt0n6Cw3b4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sachin Sant , PUVICHAKRAVARTHY RAMACHANDRAN , Vlastimil Babka , Andrew Morton , Bharata B Rao , Srikar Dronamraju , Mel Gorman , Michael Ellerman , Michal Hocko , Christopher Lameter , linuxppc-dev@lists.ozlabs.org, Joonsoo Kim , Pekka Enberg , David Rientjes , Kirill Tkhai , Nathan Lynch , Linus Torvalds Subject: [PATCH 4.9 026/102] mm, slub: prevent kmalloc_node crashes and memory leaks Date: Wed, 1 Apr 2020 18:17:29 +0200 Message-Id: <20200401161538.000681014@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vlastimil Babka commit 0715e6c516f106ed553828a671d30ad9a3431536 upstream. Sachin reports [1] a crash in SLUB __slab_alloc(): BUG: Kernel NULL pointer dereference on read at 0x000073b0 Faulting instruction address: 0xc0000000003d55f4 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1 NIP: c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000 REGS: c0000008b37836d0 TRAP: 0300 Not tainted (5.6.0-rc2-next-20200218-autotest) MSR: 8000000000009033 CR: 24004844 XER: 00000000 CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1 GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500 GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620 GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000 GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000 GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002 GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122 GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8 GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180 NIP ___slab_alloc+0x1f4/0x760 LR __slab_alloc+0x34/0x60 Call Trace: ___slab_alloc+0x334/0x760 (unreliable) __slab_alloc+0x34/0x60 __kmalloc_node+0x110/0x490 kvmalloc_node+0x58/0x110 mem_cgroup_css_online+0x108/0x270 online_css+0x48/0xd0 cgroup_apply_control_enable+0x2ec/0x4d0 cgroup_mkdir+0x228/0x5f0 kernfs_iop_mkdir+0x90/0xf0 vfs_mkdir+0x110/0x230 do_mkdirat+0xb0/0x1a0 system_call+0x5c/0x68 This is a PowerPC platform with following NUMA topology: available: 2 nodes (0-1) node 0 cpus: node 0 size: 0 MB node 0 free: 0 MB node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 node 1 size: 35247 MB node 1 free: 30907 MB node distances: node 0 1 0: 10 40 1: 40 10 possible numa nodes: 0-31 This only happens with a mmotm patch "mm/memcontrol.c: allocate shrinker_map on appropriate NUMA node" [2] which effectively calls kmalloc_node for each possible node. SLUB however only allocates kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on node_to_mem_node to return such valid node for other nodes since commit a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node"). This is however not true in this configuration where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31, thus it contains zeroes and get_partial() ends up accessing non-allocated kmem_cache_node. A related issue was reported by Bharata (originally by Ramachandran) [3] where a similar PowerPC configuration, but with mainline kernel without patch [2] ends up allocating large amounts of pages by kmalloc-1k kmalloc-512. This seems to have the same underlying issue with node_to_mem_node() not behaving as expected, and might probably also lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4]. This patch should fix both issues by not relying on node_to_mem_node() anymore and instead simply falling back to NUMA_NO_NODE, when kmalloc_node(node) is attempted for a node that's not online, or has no usable memory. The "usable memory" condition is also changed from node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly the condition that SLUB uses to allocate kmem_cache_node structures. The check in get_partial() is removed completely, as the checks in ___slab_alloc() are now sufficient to prevent get_partial() being reached with an invalid node. [1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@linux.vnet.ibm.com/ [2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtuozzo.com/ [3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/ [4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.cz/ Fixes: a561ce00b09e ("slub: fall back to node_to_mem_node() node if allocating on memoryless node") Reported-by: Sachin Sant Reported-by: PUVICHAKRAVARTHY RAMACHANDRAN Signed-off-by: Vlastimil Babka Signed-off-by: Andrew Morton Tested-by: Sachin Sant Tested-by: Bharata B Rao Reviewed-by: Srikar Dronamraju Cc: Mel Gorman Cc: Michael Ellerman Cc: Michal Hocko Cc: Christopher Lameter Cc: linuxppc-dev@lists.ozlabs.org Cc: Joonsoo Kim Cc: Pekka Enberg Cc: David Rientjes Cc: Kirill Tkhai Cc: Vlastimil Babka Cc: Nathan Lynch Cc: Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.cz Debugged-by: Srikar Dronamraju Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/slub.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) --- a/mm/slub.c +++ b/mm/slub.c @@ -1909,8 +1909,6 @@ static void *get_partial(struct kmem_cac if (node == NUMA_NO_NODE) searchnode = numa_mem_id(); - else if (!node_present_pages(node)) - searchnode = node_to_mem_node(node); object = get_partial_node(s, get_node(s, searchnode), c, flags); if (object || node != NUMA_NO_NODE) @@ -2506,17 +2504,27 @@ static void *___slab_alloc(struct kmem_c struct page *page; page = c->page; - if (!page) + if (!page) { + /* + * if the node is not online or has no normal memory, just + * ignore the node constraint + */ + if (unlikely(node != NUMA_NO_NODE && + !node_state(node, N_NORMAL_MEMORY))) + node = NUMA_NO_NODE; goto new_slab; + } redo: if (unlikely(!node_match(page, node))) { - int searchnode = node; - - if (node != NUMA_NO_NODE && !node_present_pages(node)) - searchnode = node_to_mem_node(node); - - if (unlikely(!node_match(page, searchnode))) { + /* + * same as above but node_match() being false already + * implies node != NUMA_NO_NODE + */ + if (!node_state(node, N_NORMAL_MEMORY)) { + node = NUMA_NO_NODE; + goto redo; + } else { stat(s, ALLOC_NODE_MISMATCH); deactivate_slab(s, page, c->freelist); c->page = NULL; From patchwork Wed Apr 1 16:17:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228333 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-14.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A407C43331 for ; Wed, 1 Apr 2020 16:52:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 35B2C20714 for ; Wed, 1 Apr 2020 16:52:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759952; bh=y93Yqnkx4Hl3ZA0sTp1vcKVcdEB/pEvRT2wpcf1fUPk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=JOwtXVKZDVtmGdpng3G0ngEpadMzfN7yEutbT/nLnMdAB+9S5usytNyAXSrI+33HW o2LZOn0vHtwJOa7Y0Tw8KjiSopmAJkwTwh9bg8HvztPq8WbABT720zEazNsv+u2DYx w5/QbGGuU9TB9hCrKxnRioKCXXqiwxsAj+fJvDUM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733025AbgDAQgB (ORCPT ); Wed, 1 Apr 2020 12:36:01 -0400 Received: from mail.kernel.org ([198.145.29.99]:34838 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388557AbgDAQgA (ORCPT ); Wed, 1 Apr 2020 12:36:00 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2977120BED; Wed, 1 Apr 2020 16:35:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758959; bh=y93Yqnkx4Hl3ZA0sTp1vcKVcdEB/pEvRT2wpcf1fUPk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lf6Q6a708oqWAE/ywEjYDyDsHCJ6nqWAzWL5UzlxK+OUZPb3cWQjOQYb7zrALTAj9 T9Ve/Wow9va2e6wCxZRPJo+wRTJoyaMWyyqBgsKvMXuJmLWZdH49h83+CwupVUF+cX whBbrBp7hxXnzrnRE4YXVM9l3UvMbJZZGUopXeXQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Masahiro Yamada , Sasha Levin Subject: [PATCH 4.9 030/102] kbuild: Disable -Wpointer-to-enum-cast Date: Wed, 1 Apr 2020 18:17:33 +0200 Message-Id: <20200401161538.731202411@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nathan Chancellor commit 82f2bc2fcc0160d6f82dd1ac64518ae0a4dd183f upstream. Clang's -Wpointer-to-int-cast deviates from GCC in that it warns when casting to enums. The kernel does this in certain places, such as device tree matches to set the version of the device being used, which allows the kernel to avoid using a gigantic union. https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L428 https://elixir.bootlin.com/linux/v5.5.8/source/drivers/ata/ahci_brcm.c#L402 https://elixir.bootlin.com/linux/v5.5.8/source/include/linux/mod_devicetable.h#L264 To avoid a ton of false positive warnings, disable this particular part of the warning, which has been split off into a separate diagnostic so that the entire warning does not need to be turned off for clang. It will be visible under W=1 in case people want to go about fixing these easily and enabling the warning treewide. Cc: stable@vger.kernel.org Link: https://github.com/ClangBuiltLinux/linux/issues/887 Link: https://github.com/llvm/llvm-project/commit/2a41b31fcdfcb67ab7038fc2ffb606fd50b83a84 Signed-off-by: Nathan Chancellor Signed-off-by: Masahiro Yamada Signed-off-by: Sasha Levin --- scripts/Makefile.extrawarn | 1 + 1 file changed, 1 insertion(+) diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn index d08b6fbdfa853..1532038f60055 100644 --- a/scripts/Makefile.extrawarn +++ b/scripts/Makefile.extrawarn @@ -70,5 +70,6 @@ KBUILD_CFLAGS += $(call cc-disable-warning, format) KBUILD_CFLAGS += $(call cc-disable-warning, sign-compare) KBUILD_CFLAGS += $(call cc-disable-warning, format-zero-length) KBUILD_CFLAGS += $(call cc-disable-warning, uninitialized) +KBUILD_CFLAGS += $(call cc-disable-warning, pointer-to-enum-cast) endif endif From patchwork Wed Apr 1 16:17:34 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228444 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28EC2C2D0F2 for ; Wed, 1 Apr 2020 16:36:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 992B521924 for ; Wed, 1 Apr 2020 16:36:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758965; bh=6bZG9t/Umg2bZVxHj3BdmoBq4fLabhx5PbwTFoN6lMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=H7M3LOw/sXgT0jR9JsrfU7+cJoATDU16sqgAzqePTzkZ+grPxgbXfPxIrdvJc+4lX vKmxkWeaQF1y/Ejh7TJQIayj/Qdep0PP9z1lthkNoMPybypQ2dC+7+AxZJ85IHk+Nu Nv5WTmdYQ0Q/yLPg6PJPA7ixeKT6HkGLrxX36R3o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387597AbgDAQgE (ORCPT ); Wed, 1 Apr 2020 12:36:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:34900 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388647AbgDAQgD (ORCPT ); Wed, 1 Apr 2020 12:36:03 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A97A1206F8; Wed, 1 Apr 2020 16:36:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758962; bh=6bZG9t/Umg2bZVxHj3BdmoBq4fLabhx5PbwTFoN6lMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ycup9IXmPgO6kLsBmljS98w+gaxPwFBstzark66flQWyyAhphIwNtAdv73q28Zq6y h8SDP8qZViTuD43TN/hT9d3npEvC2Gw0QjvKm26AF3mpjCdoqD8/Vk7co1WnwjugWw fT3l/JnltZsxSC417f5YKufw3XcINctcdg1Jq0KY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jann Horn , Linus Torvalds , "Peter Zijlstra (Intel)" Subject: [PATCH 4.9 031/102] futex: Fix inode life-time issue Date: Wed, 1 Apr 2020 18:17:34 +0200 Message-Id: <20200401161538.886483973@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peter Zijlstra commit 8019ad13ef7f64be44d4f892af9c840179009254 upstream. As reported by Jann, ihold() does not in fact guarantee inode persistence. And instead of making it so, replace the usage of inode pointers with a per boot, machine wide, unique inode identifier. This sequence number is global, but shared (file backed) futexes are rare enough that this should not become a performance issue. Reported-by: Jann Horn Suggested-by: Linus Torvalds Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Greg Kroah-Hartman --- fs/inode.c | 1 include/linux/fs.h | 1 include/linux/futex.h | 17 +++++---- kernel/futex.c | 89 +++++++++++++++++++++++++++++--------------------- 4 files changed, 65 insertions(+), 43 deletions(-) --- a/fs/inode.c +++ b/fs/inode.c @@ -135,6 +135,7 @@ int inode_init_always(struct super_block inode->i_sb = sb; inode->i_blkbits = sb->s_blocksize_bits; inode->i_flags = 0; + atomic64_set(&inode->i_sequence, 0); atomic_set(&inode->i_count, 1); inode->i_op = &empty_iops; inode->i_fop = &no_open_fops; --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -679,6 +679,7 @@ struct inode { struct rcu_head i_rcu; }; u64 i_version; + atomic64_t i_sequence; /* see futex */ atomic_t i_count; atomic_t i_dio_count; atomic_t i_writecount; --- a/include/linux/futex.h +++ b/include/linux/futex.h @@ -34,23 +34,26 @@ handle_futex_death(u32 __user *uaddr, st union futex_key { struct { + u64 i_seq; unsigned long pgoff; - struct inode *inode; - int offset; + unsigned int offset; } shared; struct { + union { + struct mm_struct *mm; + u64 __tmp; + }; unsigned long address; - struct mm_struct *mm; - int offset; + unsigned int offset; } private; struct { + u64 ptr; unsigned long word; - void *ptr; - int offset; + unsigned int offset; } both; }; -#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = NULL } } +#define FUTEX_KEY_INIT (union futex_key) { .both = { .ptr = 0ULL } } #ifdef CONFIG_FUTEX extern void exit_robust_list(struct task_struct *curr); --- a/kernel/futex.c +++ b/kernel/futex.c @@ -434,7 +434,7 @@ static void get_futex_key_refs(union fut switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { case FUT_OFF_INODE: - ihold(key->shared.inode); /* implies smp_mb(); (B) */ + smp_mb(); /* explicit smp_mb(); (B) */ break; case FUT_OFF_MMSHARED: futex_get_mm(key); /* implies smp_mb(); (B) */ @@ -468,7 +468,6 @@ static void drop_futex_key_refs(union fu switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) { case FUT_OFF_INODE: - iput(key->shared.inode); break; case FUT_OFF_MMSHARED: mmdrop(key->private.mm); @@ -476,6 +475,46 @@ static void drop_futex_key_refs(union fu } } +/* + * Generate a machine wide unique identifier for this inode. + * + * This relies on u64 not wrapping in the life-time of the machine; which with + * 1ns resolution means almost 585 years. + * + * This further relies on the fact that a well formed program will not unmap + * the file while it has a (shared) futex waiting on it. This mapping will have + * a file reference which pins the mount and inode. + * + * If for some reason an inode gets evicted and read back in again, it will get + * a new sequence number and will _NOT_ match, even though it is the exact same + * file. + * + * It is important that match_futex() will never have a false-positive, esp. + * for PI futexes that can mess up the state. The above argues that false-negatives + * are only possible for malformed programs. + */ +static u64 get_inode_sequence_number(struct inode *inode) +{ + static atomic64_t i_seq; + u64 old; + + /* Does the inode already have a sequence number? */ + old = atomic64_read(&inode->i_sequence); + if (likely(old)) + return old; + + for (;;) { + u64 new = atomic64_add_return(1, &i_seq); + if (WARN_ON_ONCE(!new)) + continue; + + old = atomic64_cmpxchg_relaxed(&inode->i_sequence, 0, new); + if (old) + return old; + return new; + } +} + /** * get_futex_key() - Get parameters which are the keys for a futex * @uaddr: virtual address of the futex @@ -488,9 +527,15 @@ static void drop_futex_key_refs(union fu * * The key words are stored in *key on success. * - * For shared mappings, it's (page->index, file_inode(vma->vm_file), - * offset_within_page). For private mappings, it's (uaddr, current->mm). - * We can usually work out the index without swapping in the page. + * For shared mappings (when @fshared), the key is: + * ( inode->i_sequence, page->index, offset_within_page ) + * [ also see get_inode_sequence_number() ] + * + * For private mappings (or when !@fshared), the key is: + * ( current->mm, address, 0 ) + * + * This allows (cross process, where applicable) identification of the futex + * without keeping the page pinned for the duration of the FUTEX_WAIT. * * lock_page() might sleep, the caller should not hold a spinlock. */ @@ -630,8 +675,6 @@ again: key->private.mm = mm; key->private.address = address; - get_futex_key_refs(key); /* implies smp_mb(); (B) */ - } else { struct inode *inode; @@ -663,40 +706,14 @@ again: goto again; } - /* - * Take a reference unless it is about to be freed. Previously - * this reference was taken by ihold under the page lock - * pinning the inode in place so i_lock was unnecessary. The - * only way for this check to fail is if the inode was - * truncated in parallel which is almost certainly an - * application bug. In such a case, just retry. - * - * We are not calling into get_futex_key_refs() in file-backed - * cases, therefore a successful atomic_inc return below will - * guarantee that get_futex_key() will still imply smp_mb(); (B). - */ - if (!atomic_inc_not_zero(&inode->i_count)) { - rcu_read_unlock(); - put_page(page); - - goto again; - } - - /* Should be impossible but lets be paranoid for now */ - if (WARN_ON_ONCE(inode->i_mapping != mapping)) { - err = -EFAULT; - rcu_read_unlock(); - iput(inode); - - goto out; - } - key->both.offset |= FUT_OFF_INODE; /* inode-based key */ - key->shared.inode = inode; + key->shared.i_seq = get_inode_sequence_number(inode); key->shared.pgoff = basepage_index(tail); rcu_read_unlock(); } + get_futex_key_refs(key); /* implies smp_mb(); (B) */ + out: put_page(page); return err; From patchwork Wed Apr 1 16:17:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228443 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F552C2D0F0 for ; Wed, 1 Apr 2020 16:36:10 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 59C1120BED for ; Wed, 1 Apr 2020 16:36:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758970; bh=LFojRfP+Ryk/Ggz7Q1TEtogALZDvsONa+izl2jHtNXc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=1p2FGz1C4HEQv6BJ7OPazTYBL1tysytbID2teCefJAi7HdC36Un2VtQ4f2MhoWZrb xAzrOo4yvnVBFedaUq+j3CqvQdaH8SvRi0Qbohvg+8OQa0K6w8HNA2SN8wYOSwIPA5 NsxcV3F9+GY2B0NwLMiPzINVYzd6F5moenyBlOlo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388811AbgDAQgI (ORCPT ); Wed, 1 Apr 2020 12:36:08 -0400 Received: from mail.kernel.org ([198.145.29.99]:35010 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387983AbgDAQgI (ORCPT ); Wed, 1 Apr 2020 12:36:08 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5CE0D20857; Wed, 1 Apr 2020 16:36:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585758967; bh=LFojRfP+Ryk/Ggz7Q1TEtogALZDvsONa+izl2jHtNXc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wrg0y1zgHSef1K8ImiOuQ9PsFA2oxhs6mYQlYT0ZSqfFef1ugm7e6DQMhvTirlkmL H9jC9SOIxcU62/THysMeY+/W2JEinW193SvKCkxzYhg9hm9povmy15otcNKdVMnVhm Jztx3OeK+Jv/uI2FcWi5RlsCJLdLnQ/QfSotzFjE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kai-Heng Feng , Takashi Iwai Subject: [PATCH 4.9 033/102] ALSA: hda/realtek: Fix pop noise on ALC225 Date: Wed, 1 Apr 2020 18:17:36 +0200 Message-Id: <20200401161539.129583761@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kai-Heng Feng commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757 upstream. Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot. So partially revert this commit for ALC225 to fix the regression. Fixes: 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") BugLink: https://bugs.launchpad.net/bugs/1866357 Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20200311061328.17614-1-kai.heng.feng@canonical.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman --- sound/pci/hda/patch_realtek.c | 2 ++ 1 file changed, 2 insertions(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -4212,6 +4212,8 @@ static void alc_determine_headset_type(s is_ctia = (val & 0x1c02) == 0x1c02; break; case 0x10ec0225: + codec->power_save_node = 1; + /* fall through */ case 0x10ec0295: case 0x10ec0299: alc_process_coef_fw(codec, coef0225); From patchwork Wed Apr 1 16:17:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228430 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DA0CC2D0F2 for ; Wed, 1 Apr 2020 16:39:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5B902206F8 for ; Wed, 1 Apr 2020 16:39:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759140; bh=IV6LN9ojUKmjnTANKBfZlCpOSzG754DJ0ZRpPWzNJoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pVbmewcB/R+AWF0rjbbGrHhaE/4s4sGE8akJjb00yfEFYntGhKYVRCCBJbw6RCndB vdXfgjsIro2nLMNr+JMObuGTVl3Yojdz5GJ116hhlOjULpHIJ3BcAcfs8duUV/XKci r+wlXD8TaNI3eEeF5pV1JppWEMkvGXOY+NZW9ELg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389141AbgDAQiz (ORCPT ); Wed, 1 Apr 2020 12:38:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:38740 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389137AbgDAQiy (ORCPT ); Wed, 1 Apr 2020 12:38:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 46DDA20772; Wed, 1 Apr 2020 16:38:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759133; bh=IV6LN9ojUKmjnTANKBfZlCpOSzG754DJ0ZRpPWzNJoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Hx/ZHYyoiwLbv+NOwtV7AlKEUWt+akJOjpKFyeZYFZ7a1JBuZ8aZHo6VbG6loJZut mOebFwO8jjAFEH8HHoe4IIz6wukdrhmbJjgnbi4Zxw5Cy4vsX3WqR7es8f58N/7wVa AyfxqQVEwE4ly7EiAAriLrA4PYgnGBVOrm/QB7lY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lyude Paul , Daniel Vetter , Sean Paul , Jerry Zuo , Harry Wentland , Guenter Roeck Subject: [PATCH 4.9 037/102] Revert "drm/dp_mst: Skip validating ports during destruction, just ref" Date: Wed, 1 Apr 2020 18:17:40 +0200 Message-Id: <20200401161539.772280409@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lyude Paul commit 9765635b30756eb74e05e260ac812659c296cd28 upstream. This reverts commit: c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref") ugh. In drm_dp_destroy_connector_work(), we have a pretty good chance of freeing the actual struct drm_dp_mst_port. However, after destroying things we send a hotplug through (*mgr->cbs->hotplug)(mgr) which is where the problems start. For i915, this calls all the way down to the fbcon probing helpers, which start trying to access the port in a modeset. [ 45.062001] ================================================================== [ 45.062112] BUG: KASAN: use-after-free in ex_handler_refcount+0x146/0x180 [ 45.062196] Write of size 4 at addr ffff8882b4b70968 by task kworker/3:1/53 [ 45.062325] CPU: 3 PID: 53 Comm: kworker/3:1 Kdump: loaded Tainted: G O 4.20.0-rc4Lyude-Test+ #3 [ 45.062442] Hardware name: LENOVO 20BWS1KY00/20BWS1KY00, BIOS JBET71WW (1.35 ) 09/14/2018 [ 45.062554] Workqueue: events drm_dp_destroy_connector_work [drm_kms_helper] [ 45.062641] Call Trace: [ 45.062685] dump_stack+0xbd/0x15a [ 45.062735] ? dump_stack_print_info.cold.0+0x1b/0x1b [ 45.062801] ? printk+0x9f/0xc5 [ 45.062847] ? kmsg_dump_rewind_nolock+0xe4/0xe4 [ 45.062909] ? ex_handler_refcount+0x146/0x180 [ 45.062970] print_address_description+0x71/0x239 [ 45.063036] ? ex_handler_refcount+0x146/0x180 [ 45.063095] kasan_report.cold.5+0x242/0x30b [ 45.063155] __asan_report_store4_noabort+0x1c/0x20 [ 45.063313] ex_handler_refcount+0x146/0x180 [ 45.063371] ? ex_handler_clear_fs+0xb0/0xb0 [ 45.063428] fixup_exception+0x98/0xd7 [ 45.063484] ? raw_notifier_call_chain+0x20/0x20 [ 45.063548] do_trap+0x6d/0x210 [ 45.063605] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.063732] do_error_trap+0xc0/0x170 [ 45.063802] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.063929] do_invalid_op+0x3b/0x50 [ 45.063997] ? _GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.064103] invalid_op+0x14/0x20 [ 45.064162] RIP: 0010:_GLOBAL__sub_I_65535_1_drm_dp_aux_unregister_devnode+0x2f/0x1c6 [drm_kms_helper] [ 45.064274] Code: 00 48 c7 c7 80 fe 53 a0 48 89 e5 e8 5b 6f 26 e1 5d c3 48 8d 0e 0f 0b 48 8d 0b 0f 0b 48 8d 0f 0f 0b 48 8d 0f 0f 0b 49 8d 4d 00 <0f> 0b 49 8d 0e 0f 0b 48 8d 08 0f 0b 49 8d 4d 00 0f 0b 48 8d 0b 0f [ 45.064569] RSP: 0018:ffff8882b789ee10 EFLAGS: 00010282 [ 45.064637] RAX: ffff8882af47ae70 RBX: ffff8882af47aa60 RCX: ffff8882b4b70968 [ 45.064723] RDX: ffff8882af47ae70 RSI: 0000000000000008 RDI: ffff8882b788bdb8 [ 45.064808] RBP: ffff8882b789ee28 R08: ffffed1056f13db4 R09: ffffed1056f13db3 [ 45.064894] R10: ffffed1056f13db3 R11: ffff8882b789ed9f R12: ffff8882af47ad28 [ 45.064980] R13: ffff8882b4b70968 R14: ffff8882acd86728 R15: ffff8882b4b75dc8 [ 45.065084] drm_dp_mst_reset_vcpi_slots+0x12/0x80 [drm_kms_helper] [ 45.065225] intel_mst_disable_dp+0xda/0x180 [i915] [ 45.065361] intel_encoders_disable.isra.107+0x197/0x310 [i915] [ 45.065498] haswell_crtc_disable+0xbe/0x400 [i915] [ 45.065622] ? i9xx_disable_plane+0x1c0/0x3e0 [i915] [ 45.065750] intel_atomic_commit_tail+0x74e/0x3e60 [i915] [ 45.065884] ? intel_pre_plane_update+0xbc0/0xbc0 [i915] [ 45.065968] ? drm_atomic_helper_swap_state+0x88b/0x1d90 [drm_kms_helper] [ 45.066054] ? kasan_check_write+0x14/0x20 [ 45.066165] ? i915_gem_track_fb+0x13a/0x330 [i915] [ 45.066277] ? i915_sw_fence_complete+0xe9/0x140 [i915] [ 45.066406] ? __i915_sw_fence_complete+0xc50/0xc50 [i915] [ 45.066540] intel_atomic_commit+0x72e/0xef0 [i915] [ 45.066635] ? drm_dev_dbg+0x200/0x200 [drm] [ 45.066764] ? intel_atomic_commit_tail+0x3e60/0x3e60 [i915] [ 45.066898] ? intel_atomic_commit_tail+0x3e60/0x3e60 [i915] [ 45.067001] drm_atomic_commit+0xc4/0xf0 [drm] [ 45.067074] restore_fbdev_mode_atomic+0x562/0x780 [drm_kms_helper] [ 45.067166] ? drm_fb_helper_debug_leave+0x690/0x690 [drm_kms_helper] [ 45.067249] ? kasan_check_read+0x11/0x20 [ 45.067324] restore_fbdev_mode+0x127/0x4b0 [drm_kms_helper] [ 45.067364] ? kasan_check_read+0x11/0x20 [ 45.067406] drm_fb_helper_restore_fbdev_mode_unlocked+0x164/0x200 [drm_kms_helper] [ 45.067462] ? drm_fb_helper_hotplug_event+0x30/0x30 [drm_kms_helper] [ 45.067508] ? kasan_check_write+0x14/0x20 [ 45.070360] ? mutex_unlock+0x22/0x40 [ 45.073748] drm_fb_helper_set_par+0xb2/0xf0 [drm_kms_helper] [ 45.075846] drm_fb_helper_hotplug_event.part.33+0x1cd/0x290 [drm_kms_helper] [ 45.078088] drm_fb_helper_hotplug_event+0x1c/0x30 [drm_kms_helper] [ 45.082614] intel_fbdev_output_poll_changed+0x9f/0x140 [i915] [ 45.087069] drm_kms_helper_hotplug_event+0x67/0x90 [drm_kms_helper] [ 45.089319] intel_dp_mst_hotplug+0x37/0x50 [i915] [ 45.091496] drm_dp_destroy_connector_work+0x510/0x6f0 [drm_kms_helper] [ 45.093675] ? drm_dp_update_payload_part1+0x1220/0x1220 [drm_kms_helper] [ 45.095851] ? kasan_check_write+0x14/0x20 [ 45.098473] ? kasan_check_read+0x11/0x20 [ 45.101155] ? strscpy+0x17c/0x530 [ 45.103808] ? __switch_to_asm+0x34/0x70 [ 45.106456] ? syscall_return_via_sysret+0xf/0x7f [ 45.109711] ? read_word_at_a_time+0x20/0x20 [ 45.113138] ? __switch_to_asm+0x40/0x70 [ 45.116529] ? __switch_to_asm+0x34/0x70 [ 45.119891] ? __switch_to_asm+0x40/0x70 [ 45.123224] ? __switch_to_asm+0x34/0x70 [ 45.126540] ? __switch_to_asm+0x34/0x70 [ 45.129824] process_one_work+0x88d/0x15d0 [ 45.133172] ? pool_mayday_timeout+0x850/0x850 [ 45.136459] ? pci_mmcfg_check_reserved+0x110/0x128 [ 45.139739] ? wake_q_add+0xb0/0xb0 [ 45.143010] ? check_preempt_wakeup+0x652/0x1050 [ 45.146304] ? worker_enter_idle+0x29e/0x740 [ 45.149589] ? __schedule+0x1ec0/0x1ec0 [ 45.152937] ? kasan_check_read+0x11/0x20 [ 45.156179] ? _raw_spin_lock_irq+0xa3/0x130 [ 45.159382] ? _raw_read_unlock_irqrestore+0x30/0x30 [ 45.162542] ? kasan_check_write+0x14/0x20 [ 45.165657] worker_thread+0x1a5/0x1470 [ 45.168725] ? set_load_weight+0x2e0/0x2e0 [ 45.171755] ? process_one_work+0x15d0/0x15d0 [ 45.174806] ? __switch_to_asm+0x34/0x70 [ 45.177645] ? __switch_to_asm+0x40/0x70 [ 45.180323] ? __switch_to_asm+0x34/0x70 [ 45.182936] ? __switch_to_asm+0x40/0x70 [ 45.185539] ? __switch_to_asm+0x34/0x70 [ 45.188100] ? __switch_to_asm+0x40/0x70 [ 45.190628] ? __schedule+0x7d4/0x1ec0 [ 45.193143] ? save_stack+0xa9/0xd0 [ 45.195632] ? kasan_check_write+0x10/0x20 [ 45.198162] ? kasan_kmalloc+0xc4/0xe0 [ 45.200609] ? kmem_cache_alloc_trace+0xdd/0x190 [ 45.203046] ? kthread+0x9f/0x3b0 [ 45.205470] ? ret_from_fork+0x35/0x40 [ 45.207876] ? unwind_next_frame+0x43/0x50 [ 45.210273] ? __save_stack_trace+0x82/0x100 [ 45.212658] ? deactivate_slab.isra.67+0x3d4/0x580 [ 45.215026] ? default_wake_function+0x35/0x50 [ 45.217399] ? kasan_check_read+0x11/0x20 [ 45.219825] ? _raw_spin_lock_irqsave+0xae/0x140 [ 45.222174] ? __lock_text_start+0x8/0x8 [ 45.224521] ? replenish_dl_entity.cold.62+0x4f/0x4f [ 45.226868] ? __kthread_parkme+0x87/0xf0 [ 45.229200] kthread+0x2f7/0x3b0 [ 45.231557] ? process_one_work+0x15d0/0x15d0 [ 45.233923] ? kthread_park+0x120/0x120 [ 45.236249] ret_from_fork+0x35/0x40 [ 45.240875] Allocated by task 242: [ 45.243136] save_stack+0x43/0xd0 [ 45.245385] kasan_kmalloc+0xc4/0xe0 [ 45.247597] kmem_cache_alloc_trace+0xdd/0x190 [ 45.249793] drm_dp_add_port+0x1e0/0x2170 [drm_kms_helper] [ 45.252000] drm_dp_send_link_address+0x4a7/0x740 [drm_kms_helper] [ 45.254389] drm_dp_check_and_send_link_address+0x1a7/0x210 [drm_kms_helper] [ 45.256803] drm_dp_mst_link_probe_work+0x6f/0xb0 [drm_kms_helper] [ 45.259200] process_one_work+0x88d/0x15d0 [ 45.261597] worker_thread+0x1a5/0x1470 [ 45.264038] kthread+0x2f7/0x3b0 [ 45.266371] ret_from_fork+0x35/0x40 [ 45.270937] Freed by task 53: [ 45.273170] save_stack+0x43/0xd0 [ 45.275382] __kasan_slab_free+0x139/0x190 [ 45.277604] kasan_slab_free+0xe/0x10 [ 45.279826] kfree+0x99/0x1b0 [ 45.282044] drm_dp_free_mst_port+0x4a/0x60 [drm_kms_helper] [ 45.284330] drm_dp_destroy_connector_work+0x43e/0x6f0 [drm_kms_helper] [ 45.286660] process_one_work+0x88d/0x15d0 [ 45.288934] worker_thread+0x1a5/0x1470 [ 45.291231] kthread+0x2f7/0x3b0 [ 45.293547] ret_from_fork+0x35/0x40 [ 45.298206] The buggy address belongs to the object at ffff8882b4b70968 which belongs to the cache kmalloc-2k of size 2048 [ 45.303047] The buggy address is located 0 bytes inside of 2048-byte region [ffff8882b4b70968, ffff8882b4b71168) [ 45.308010] The buggy address belongs to the page: [ 45.310477] page:ffffea000ad2dc00 count:1 mapcount:0 mapping:ffff8882c080cf40 index:0x0 compound_mapcount: 0 [ 45.313051] flags: 0x8000000000010200(slab|head) [ 45.315635] raw: 8000000000010200 ffffea000aac2808 ffffea000abe8608 ffff8882c080cf40 [ 45.318300] raw: 0000000000000000 00000000000d000d 00000001ffffffff 0000000000000000 [ 45.320966] page dumped because: kasan: bad access detected [ 45.326312] Memory state around the buggy address: [ 45.329085] ffff8882b4b70800: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.331845] ffff8882b4b70880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 45.334584] >ffff8882b4b70900: fc fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb [ 45.337302] ^ [ 45.340061] ffff8882b4b70980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.342910] ffff8882b4b70a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 45.345748] ================================================================== So, this definitely isn't a fix that we want. This being said; there's no real easy fix for this problem because of some of the catch-22's of the MST helpers current design. For starters; we always need to validate a port with drm_dp_get_validated_port_ref(), but validation relies on the lifetime of the port in the actual topology. So once the port is gone, it can't be validated again. If we were to try to make the payload helpers not use port validation, then we'd cause another problem: if the port isn't validated, it could be freed and we'd just start causing more KASAN issues. There are already hacks that attempt to workaround this in drm_dp_mst_destroy_connector_work() by re-initializing the kref so that it can be used again and it's memory can be freed once the VCPI helpers finish removing the port's respective payloads. But none of these really do anything helpful since the port still can't be validated since it's gone from the topology. Also, that workaround is immensely confusing to read through. What really needs to be done in order to fix this is to teach DRM how to track the lifetime of the structs for MST ports and branch devices separately from their lifetime in the actual topology. Simply put; this means having two different krefs-one that removes the port/branch device from the topology, and one that finally calls kfree(). This would let us simplify things, since we'd now be able to keep ports around without having to keep them in the topology at the same time, which is exactly what we need in order to teach our VCPI helpers to only validate ports when it's actually necessary without running the risk of trying to use unallocated memory. Such a fix is on it's way, but for now let's play it safe and just revert this. If this bug has been around for well over a year, we can wait a little while to get an actual proper fix here. Signed-off-by: Lyude Paul Fixes: c54c7374ff44 ("drm/dp_mst: Skip validating ports during destruction, just ref") Cc: Daniel Vetter Cc: Sean Paul Cc: Jerry Zuo Cc: Harry Wentland Cc: stable@vger.kernel.org # v4.6+ Acked-by: Sean Paul Link: https://patchwork.freedesktop.org/patch/msgid/20181128210005.24434-1-lyude@redhat.com Cc: Guenter Roeck Signed-off-by: Greg Kroah-Hartman --- drivers/gpu/drm/drm_dp_mst_topology.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) --- a/drivers/gpu/drm/drm_dp_mst_topology.c +++ b/drivers/gpu/drm/drm_dp_mst_topology.c @@ -980,20 +980,9 @@ static struct drm_dp_mst_port *drm_dp_ms static struct drm_dp_mst_port *drm_dp_get_validated_port_ref(struct drm_dp_mst_topology_mgr *mgr, struct drm_dp_mst_port *port) { struct drm_dp_mst_port *rport = NULL; - mutex_lock(&mgr->lock); - /* - * Port may or may not be 'valid' but we don't care about that when - * destroying the port and we are guaranteed that the port pointer - * will be valid until we've finished - */ - if (current_work() == &mgr->destroy_connector_work) { - kref_get(&port->kref); - rport = port; - } else if (mgr->mst_primary) { - rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, - port); - } + if (mgr->mst_primary) + rport = drm_dp_mst_get_port_ref_locked(mgr->mst_primary, port); mutex_unlock(&mgr->lock); return rport; } From patchwork Wed Apr 1 16:17:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228438 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F5F2C43331 for ; Wed, 1 Apr 2020 16:37:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 30959214D8 for ; Wed, 1 Apr 2020 16:37:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759039; bh=nSL2VlQVTb3GPKokrRs/RPqS8c005cAw2vMQezf9gH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=X95MNaF65H9kpNIbd1AmzD9Tkt9sb4LiqHXJGoiKU7kpkB+ui33I2mXKfqqinjnwT B9dAgorp+PBIfBvOu2MebSCYCtIFQYVAYY2ecSY2iXwQULQZ6SV9KOGvhQ+MNMAi/C tSDJ91uGoApbNViNSrxZ8BJTfLquuSUDSpKM+9ak= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388953AbgDAQhS (ORCPT ); Wed, 1 Apr 2020 12:37:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:36406 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388947AbgDAQhR (ORCPT ); Wed, 1 Apr 2020 12:37:17 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EEFEB20658; Wed, 1 Apr 2020 16:37:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759037; bh=nSL2VlQVTb3GPKokrRs/RPqS8c005cAw2vMQezf9gH0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jFYPp/DSuEY2iXjm4C6SQe8eJYEx0SA5VaDLrRhallm6mPfu5/qHjNPlFdLdXfw6+ Hw/wtUy5l0NwaJ2S5anj2xlDzorVx1d+ZojmxP6nY6H9yCR1kPWcVNvVthp0Scaob3 hJ0uko0GiNlqde8hRN2QWAceeFIswlQwbVGARyuA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Willem de Bruijn , "David S. Miller" Subject: [PATCH 4.9 039/102] macsec: restrict to ethernet devices Date: Wed, 1 Apr 2020 18:17:42 +0200 Message-Id: <20200401161540.230054565@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Willem de Bruijn [ Upstream commit b06d072ccc4b1acd0147b17914b7ad1caa1818bb ] Only attach macsec to ethernet devices. Syzbot was able to trigger a KMSAN warning in macsec_handle_frame by attaching to a phonet device. Macvlan has a similar check in macvlan_port_create. v1->v2 - fix commit message typo Reported-by: syzbot Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macsec.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -19,6 +19,7 @@ #include #include #include +#include #include @@ -3219,6 +3220,8 @@ static int macsec_newlink(struct net *ne real_dev = __dev_get_by_index(net, nla_get_u32(tb[IFLA_LINK])); if (!real_dev) return -ENODEV; + if (real_dev->type != ARPHRD_ETHER) + return -EINVAL; dev->priv_flags |= IFF_MACSEC; From patchwork Wed Apr 1 16:17:45 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228345 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CE4CC43331 for ; Wed, 1 Apr 2020 16:50:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4D8782063A for ; Wed, 1 Apr 2020 16:50:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759857; bh=ED4gUPkZoLoNisjrheP355LpjjFe9jLTa6yMO10W2AE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=BpvAMVNnbV/po+0wkoyYUiJ9cUDS1eCwsICocbsDRhSB2096BnODfQPYQrcJU5f9Y FdAzxdC0Ganyoyw2UtSSTqzYI5wztd3I2aQxlTJWaNKWwIjItjaZXxwoEgauhWxnnr 57CVb/T+K29T1Q5svx3p/+pVTSk5BBkzhiPf5fRE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389111AbgDAQio (ORCPT ); Wed, 1 Apr 2020 12:38:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:38440 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388962AbgDAQik (ORCPT ); Wed, 1 Apr 2020 12:38:40 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9915F20772; Wed, 1 Apr 2020 16:38:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759119; bh=ED4gUPkZoLoNisjrheP355LpjjFe9jLTa6yMO10W2AE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lQwVCp0j2VwSiKhTRetlEgvem1KvozWOpiYiHRtj1Dr7CPv+mNGvgmjT8bFCF9YL4 3p9jmnvH/35fwK1CBNU/WovU7OssFMG7Zy0DS6cCucZcxZ0WzjN0a2cIebD3IbdlxO 9t+D540q/GxUxtxlfjdJ3EfSMsNegp3W3h5Yw7Xo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jamal Hadi Salim , Jiri Pirko , Cong Wang , "David S. Miller" , syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com, syzbot+c72da7b9ed57cde6fca2@syzkaller.appspotmail.com Subject: [PATCH 4.9 042/102] net_sched: keep alloc_hash updated after hash allocation Date: Wed, 1 Apr 2020 18:17:45 +0200 Message-Id: <20200401161540.798375716@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Cong Wang [ Upstream commit 0d1c3530e1bd38382edef72591b78e877e0edcd3 ] In commit 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") I moved cp->hash calculation before the first tcindex_alloc_perfect_hash(), but cp->alloc_hash is left untouched. This difference could lead to another out of bound access. cp->alloc_hash should always be the size allocated, we should update it after this tcindex_alloc_perfect_hash(). Reported-and-tested-by: syzbot+dcc34d54d68ef7d2d53d@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+c72da7b9ed57cde6fca2@syzkaller.appspotmail.com Fixes: 599be01ee567 ("net_sched: fix an OOB access in cls_tcindex") Cc: Jamal Hadi Salim Cc: Jiri Pirko Signed-off-by: Cong Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sched/cls_tcindex.c | 1 + 1 file changed, 1 insertion(+) --- a/net/sched/cls_tcindex.c +++ b/net/sched/cls_tcindex.c @@ -325,6 +325,7 @@ tcindex_set_parms(struct net *net, struc if (tcindex_alloc_perfect_hash(cp) < 0) goto errout; + cp->alloc_hash = cp->hash; for (i = 0; i < min(cp->hash, p->hash); i++) cp->perfect[i].res = p->perfect[i].res; balloc = 1; From patchwork Wed Apr 1 16:17:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228346 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76927C43331 for ; Wed, 1 Apr 2020 16:50:55 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4277E206E9 for ; Wed, 1 Apr 2020 16:50:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759855; bh=SZ2hbU+lcMoW+bQFY1RvJSyW+H+et5QDyAcGJi3xasQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zEPGxsN6mCwe3ZwjKqxqb31srAEoWzD5SH/A0GAMsO94voNZn4y4TW6y+11DEPDai soB0VuRofs/+XvIUDEnOWU4YlEqHJH2znO9/MaPalTJrSGJSvB63wYAvM4HQ6kUXct S5xZMQS0d3opUnwMimLIGPXPE7yI8G7m/8wb1NNw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389125AbgDAQit (ORCPT ); Wed, 1 Apr 2020 12:38:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:38628 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387828AbgDAQir (ORCPT ); Wed, 1 Apr 2020 12:38:47 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A2E00206F8; Wed, 1 Apr 2020 16:38:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759127; bh=SZ2hbU+lcMoW+bQFY1RvJSyW+H+et5QDyAcGJi3xasQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AwqJ09O3UHCnP/yO8zjSjb1sNvbRljbjEGKkq0APkIeWIaCFSJGCyfI2tm6FwFsvE ODZ1MghCui1DS4WMEFWjSo5PtldAG3BKGH/gStmp0Ir7c0DsczG+32w69KEjcGruZ2 F2BosoPs/2dIpncUn/MQ8cDvU3OYhkryFtvJ7uHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" Subject: [PATCH 4.9 045/102] vxlan: check return value of gro_cells_init() Date: Wed, 1 Apr 2020 18:17:48 +0200 Message-Id: <20200401161541.347699626@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Taehee Yoo [ Upstream commit 384d91c267e621e0926062cfb3f20cb72dc16928 ] gro_cells_init() returns error if memory allocation is failed. But the vxlan module doesn't check the return value of gro_cells_init(). Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")` Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/vxlan.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/drivers/net/vxlan.c +++ b/drivers/net/vxlan.c @@ -2354,10 +2354,19 @@ static void vxlan_vs_add_dev(struct vxla /* Setup stats when device is created */ static int vxlan_init(struct net_device *dev) { + struct vxlan_dev *vxlan = netdev_priv(dev); + int err; + dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats); if (!dev->tstats) return -ENOMEM; + err = gro_cells_init(&vxlan->gro_cells, dev); + if (err) { + free_percpu(dev->tstats); + return err; + } + return 0; } @@ -2623,8 +2632,6 @@ static void vxlan_setup(struct net_devic vxlan->dev = dev; - gro_cells_init(&vxlan->gro_cells, dev); - for (h = 0; h < FDB_HASH_SIZE; ++h) INIT_HLIST_HEAD(&vxlan->fdb_head[h]); } From patchwork Wed Apr 1 16:17:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228440 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69329C2D0F0 for ; Wed, 1 Apr 2020 16:36:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3664920772 for ; Wed, 1 Apr 2020 16:36:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759009; bh=KcQDRppZ2VF40zfirse00hJ9t9a1++npF9ADLet5GIQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=cWkBc0bi0YY4CSCXQo2hgX9wclOhUuRRvWPsYmbbgEP2i1mKd+IbqECIhbja9F6hI HF2ud3zCHaGRyUqMtuToREZCcBjs68yCqMdmhtr77LRna4LV+uoa0wuOIjoRat31Qu Rxc/GLVy+ZpSYlFfgOtX4z8Kq/jj2l1gXzz2L0nc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388885AbgDAQgs (ORCPT ); Wed, 1 Apr 2020 12:36:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:35874 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388506AbgDAQgr (ORCPT ); Wed, 1 Apr 2020 12:36:47 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 54AAA20BED; Wed, 1 Apr 2020 16:36:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759006; bh=KcQDRppZ2VF40zfirse00hJ9t9a1++npF9ADLet5GIQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f2mPX3djNeMG2jqJw5DvBVFrB6KP9B0fq3wOlTTCfLeofK1kPlXeZZ1GH9YT0nAr2 SNXQqvlD0n3La8ycVRtQEOVBqbPUZuh/B8NsT20gmr75GxxR2fOVxme2lHoeqLt2Z8 j5Qc7QbxBPSOKLwZM5jzjXw/Mb0bMeiymk4TnJLc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" Subject: [PATCH 4.9 047/102] hsr: use rcu_read_lock() in hsr_get_node_{list/status}() Date: Wed, 1 Apr 2020 18:17:50 +0200 Message-Id: <20200401161541.683370714@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Taehee Yoo [ Upstream commit 173756b86803655d70af7732079b3aa935e6ab68 ] hsr_get_node_{list/status}() are not under rtnl_lock() because they are callback functions of generic netlink. But they use __dev_get_by_index() without rtnl_lock(). So, it would use unsafe data. In order to fix it, rcu_read_lock() and dev_get_by_index_rcu() are used instead of __dev_get_by_index(). Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/hsr/hsr_framereg.c | 10 ++-------- net/hsr/hsr_netlink.c | 43 +++++++++++++++++++++---------------------- 2 files changed, 23 insertions(+), 30 deletions(-) --- a/net/hsr/hsr_framereg.c +++ b/net/hsr/hsr_framereg.c @@ -468,13 +468,9 @@ int hsr_get_node_data(struct hsr_priv *h struct hsr_port *port; unsigned long tdiff; - - rcu_read_lock(); node = find_node_by_AddrA(&hsr->node_db, addr); - if (!node) { - rcu_read_unlock(); - return -ENOENT; /* No such entry */ - } + if (!node) + return -ENOENT; ether_addr_copy(addr_b, node->MacAddressB); @@ -509,7 +505,5 @@ int hsr_get_node_data(struct hsr_priv *h *addr_b_ifindex = -1; } - rcu_read_unlock(); - return 0; } --- a/net/hsr/hsr_netlink.c +++ b/net/hsr/hsr_netlink.c @@ -264,17 +264,16 @@ static int hsr_get_node_status(struct sk if (!na) goto invalid; - hsr_dev = __dev_get_by_index(genl_info_net(info), - nla_get_u32(info->attrs[HSR_A_IFINDEX])); + rcu_read_lock(); + hsr_dev = dev_get_by_index_rcu(genl_info_net(info), + nla_get_u32(info->attrs[HSR_A_IFINDEX])); if (!hsr_dev) - goto invalid; + goto rcu_unlock; if (!is_hsr_master(hsr_dev)) - goto invalid; - + goto rcu_unlock; /* Send reply */ - - skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); if (!skb_out) { res = -ENOMEM; goto fail; @@ -326,12 +325,10 @@ static int hsr_get_node_status(struct sk res = nla_put_u16(skb_out, HSR_A_IF1_SEQ, hsr_node_if1_seq); if (res < 0) goto nla_put_failure; - rcu_read_lock(); port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_A); if (port) res = nla_put_u32(skb_out, HSR_A_IF1_IFINDEX, port->dev->ifindex); - rcu_read_unlock(); if (res < 0) goto nla_put_failure; @@ -341,20 +338,22 @@ static int hsr_get_node_status(struct sk res = nla_put_u16(skb_out, HSR_A_IF2_SEQ, hsr_node_if2_seq); if (res < 0) goto nla_put_failure; - rcu_read_lock(); port = hsr_port_get_hsr(hsr, HSR_PT_SLAVE_B); if (port) res = nla_put_u32(skb_out, HSR_A_IF2_IFINDEX, port->dev->ifindex); - rcu_read_unlock(); if (res < 0) goto nla_put_failure; + rcu_read_unlock(); + genlmsg_end(skb_out, msg_head); genlmsg_unicast(genl_info_net(info), skb_out, info->snd_portid); return 0; +rcu_unlock: + rcu_read_unlock(); invalid: netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL); return 0; @@ -364,6 +363,7 @@ nla_put_failure: /* Fall through */ fail: + rcu_read_unlock(); return res; } @@ -390,17 +390,16 @@ static int hsr_get_node_list(struct sk_b if (!na) goto invalid; - hsr_dev = __dev_get_by_index(genl_info_net(info), - nla_get_u32(info->attrs[HSR_A_IFINDEX])); + rcu_read_lock(); + hsr_dev = dev_get_by_index_rcu(genl_info_net(info), + nla_get_u32(info->attrs[HSR_A_IFINDEX])); if (!hsr_dev) - goto invalid; + goto rcu_unlock; if (!is_hsr_master(hsr_dev)) - goto invalid; - + goto rcu_unlock; /* Send reply */ - - skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); if (!skb_out) { res = -ENOMEM; goto fail; @@ -420,14 +419,11 @@ static int hsr_get_node_list(struct sk_b hsr = netdev_priv(hsr_dev); - rcu_read_lock(); pos = hsr_get_next_node(hsr, NULL, addr); while (pos) { res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN, addr); - if (res < 0) { - rcu_read_unlock(); + if (res < 0) goto nla_put_failure; - } pos = hsr_get_next_node(hsr, pos, addr); } rcu_read_unlock(); @@ -437,6 +433,8 @@ static int hsr_get_node_list(struct sk_b return 0; +rcu_unlock: + rcu_read_unlock(); invalid: netlink_ack(skb_in, nlmsg_hdr(skb_in), -EINVAL); return 0; @@ -446,6 +444,7 @@ nla_put_failure: /* Fall through */ fail: + rcu_read_unlock(); return res; } From patchwork Wed Apr 1 16:17:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228336 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BBC4C2D0F2 for ; Wed, 1 Apr 2020 16:51:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id C047E206E9 for ; Wed, 1 Apr 2020 16:51:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759917; bh=7KbVJ4pyGWkFPAmW1q226OXHwGc6AKPnrksV39LEdrM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zMlODOTGzAZ1s1SEojhl22lmOpybitbznpIgT3NFAGfovhrtnRIU21CjI1gLLfosS LAZ0Ks1vzSroJjXi63v5QjBHqdks+Pap9LXkp2M8fjeBme0QQG6F1j+W0azJ9eb3va +Cn7aVZnl3j0mNiyCpXKo7DQZJ6tdp1h2qnLcR6o= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388754AbgDAQgy (ORCPT ); Wed, 1 Apr 2020 12:36:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:35946 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388500AbgDAQgv (ORCPT ); Wed, 1 Apr 2020 12:36:51 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9A52720658; Wed, 1 Apr 2020 16:36:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759011; bh=7KbVJ4pyGWkFPAmW1q226OXHwGc6AKPnrksV39LEdrM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M7LeTBr8wDXDZiUw1SciGzvilTbdEpixyie7hA4kuJm3mczp/rGk0bTi2Jf5u8AWU n7bOAqlgvB97uWUoSEbeBWGKp6TtCgvkwVvRRKXW8hH2NES43nj5ucD1kRYd8TbzVX tKQUvvx2YBQYuDaDZ4+qsOyJ1c5gW+sJOgrRvDwI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" Subject: [PATCH 4.9 048/102] hsr: add restart routine into hsr_get_node_list() Date: Wed, 1 Apr 2020 18:17:51 +0200 Message-Id: <20200401161542.149755699@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Taehee Yoo [ Upstream commit ca19c70f5225771c05bcdcb832b4eb84d7271c5e ] The hsr_get_node_list() is to send node addresses to the userspace. If there are so many nodes, it could fail because of buffer size. In order to avoid this failure, the restart routine is added. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/hsr/hsr_netlink.c | 38 ++++++++++++++++++++++++-------------- 1 file changed, 24 insertions(+), 14 deletions(-) --- a/net/hsr/hsr_netlink.c +++ b/net/hsr/hsr_netlink.c @@ -371,16 +371,14 @@ fail: */ static int hsr_get_node_list(struct sk_buff *skb_in, struct genl_info *info) { - /* For receiving */ - struct nlattr *na; + unsigned char addr[ETH_ALEN]; struct net_device *hsr_dev; - - /* For sending */ struct sk_buff *skb_out; - void *msg_head; struct hsr_priv *hsr; - void *pos; - unsigned char addr[ETH_ALEN]; + bool restart = false; + struct nlattr *na; + void *pos = NULL; + void *msg_head; int res; if (!info) @@ -398,8 +396,9 @@ static int hsr_get_node_list(struct sk_b if (!is_hsr_master(hsr_dev)) goto rcu_unlock; +restart: /* Send reply */ - skb_out = genlmsg_new(NLMSG_GOODSIZE, GFP_ATOMIC); + skb_out = genlmsg_new(GENLMSG_DEFAULT_SIZE, GFP_ATOMIC); if (!skb_out) { res = -ENOMEM; goto fail; @@ -413,17 +412,28 @@ static int hsr_get_node_list(struct sk_b goto nla_put_failure; } - res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex); - if (res < 0) - goto nla_put_failure; + if (!restart) { + res = nla_put_u32(skb_out, HSR_A_IFINDEX, hsr_dev->ifindex); + if (res < 0) + goto nla_put_failure; + } hsr = netdev_priv(hsr_dev); - pos = hsr_get_next_node(hsr, NULL, addr); + if (!pos) + pos = hsr_get_next_node(hsr, NULL, addr); while (pos) { res = nla_put(skb_out, HSR_A_NODE_ADDR, ETH_ALEN, addr); - if (res < 0) + if (res < 0) { + if (res == -EMSGSIZE) { + genlmsg_end(skb_out, msg_head); + genlmsg_unicast(genl_info_net(info), skb_out, + info->snd_portid); + restart = true; + goto restart; + } goto nla_put_failure; + } pos = hsr_get_next_node(hsr, pos, addr); } rcu_read_unlock(); @@ -440,7 +450,7 @@ invalid: return 0; nla_put_failure: - kfree_skb(skb_out); + nlmsg_free(skb_out); /* Fall through */ fail: From patchwork Wed Apr 1 16:17:52 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228439 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 29B49C2D0F0 for ; Wed, 1 Apr 2020 16:36:56 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CB3EC206F8 for ; Wed, 1 Apr 2020 16:36:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759015; bh=gUfkbDF/PluihdK8rLT2KkIrhhv+4baYHmKQun28N90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=EvCzKZu14oVubi5AVGv6BLN1xMWe+QltPmLYtA8y8lViaPEdnt4QTIjH60mlrFsme xVytwmMfpu/EkoBN7VuvRIB+DHBK5EMmXKD0N4RDedVOj59o/o1xk1ktrPAwzHkuBj hNEvodyzR2Ss6GYgnourg/MwpNZ3gwvU3Gv9Niks= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388888AbgDAQgy (ORCPT ); Wed, 1 Apr 2020 12:36:54 -0400 Received: from mail.kernel.org ([198.145.29.99]:35998 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388678AbgDAQgy (ORCPT ); Wed, 1 Apr 2020 12:36:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 38105206F8; Wed, 1 Apr 2020 16:36:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759013; bh=gUfkbDF/PluihdK8rLT2KkIrhhv+4baYHmKQun28N90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oO7OD/qBJbcvc1hOHknHVzqaIhUwp+nOAaw4Rc5QpoJGNx7j3cmWvVqhFs6xRm3Qj f+2+w8ttLqS5pAxcPLNgh5OcFnC2E2xHtNz7zLrFDD46FhFQa3w81pL35xaOmn7gk1 jPCXK3eBwVi+3wouJKtAEhlsvLHNaFvpDoxEsuog= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Taehee Yoo , "David S. Miller" Subject: [PATCH 4.9 049/102] hsr: set .netnsok flag Date: Wed, 1 Apr 2020 18:17:52 +0200 Message-Id: <20200401161542.271967081@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Taehee Yoo [ Upstream commit 09e91dbea0aa32be02d8877bd50490813de56b9a ] The hsr module has been supporting the list and status command. (HSR_C_GET_NODE_LIST and HSR_C_GET_NODE_STATUS) These commands send node information to the user-space via generic netlink. But, in the non-init_net namespace, these commands are not allowed because .netnsok flag is false. So, there is no way to get node information in the non-init_net namespace. Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)") Signed-off-by: Taehee Yoo Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/hsr/hsr_netlink.c | 1 + 1 file changed, 1 insertion(+) --- a/net/hsr/hsr_netlink.c +++ b/net/hsr/hsr_netlink.c @@ -137,6 +137,7 @@ static struct genl_family hsr_genl_famil .name = "HSR", .version = 1, .maxattr = HSR_A_MAX, + .netnsok = true, }; static const struct genl_multicast_group hsr_mcgrps[] = { From patchwork Wed Apr 1 16:17:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228337 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC555C2D0F2 for ; Wed, 1 Apr 2020 16:51:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7B7732063A for ; Wed, 1 Apr 2020 16:51:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759913; bh=EY5R1QC2UFt4ZgEOuanrzEih+GHs096R2FsqatSo/3w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Bk+TbzS9qgOLLguZ/ZooDL/HFlMQtRNbcNN76/wl6Tz9gtR8lPVhdqrmOi9KUBLKZ uygCZZIcyap0khH45RXVcGKxbI7hceh8XdrVMkeCktunKY6uSoNy+avuLuhUBDhcnJ G/Q9P8KoeIXr6Z/OTnyABxOs1ZBxPGEp2CVcV3v0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388916AbgDAQhF (ORCPT ); Wed, 1 Apr 2020 12:37:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:36158 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388914AbgDAQhC (ORCPT ); Wed, 1 Apr 2020 12:37:02 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4CD2F20658; Wed, 1 Apr 2020 16:37:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759021; bh=EY5R1QC2UFt4ZgEOuanrzEih+GHs096R2FsqatSo/3w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IZoz8kALSLujuHUwO7UJ63rCQe9xapmefw1R23Is3TW3GEBaS1PCaTqU/meVPZCAm HW3rxOFFwLKpADPmtWwBio8DI+d198DAgXpiTqw8AXAkK8m7Ba4Ugw3UQ1sTOn+RL+ sVBjKiDivif55XaxJoECBIdA4vmnP0smb8px2LlA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Gilbert , Shuah Khan , Sasha Levin Subject: [PATCH 4.9 052/102] cpupower: avoid multiple definition with gcc -fno-common Date: Wed, 1 Apr 2020 18:17:55 +0200 Message-Id: <20200401161542.671959728@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mike Gilbert [ Upstream commit 2de7fb60a4740135e03cf55c1982e393ccb87b6b ] Building cpupower with -fno-common in CFLAGS results in errors due to multiple definitions of the 'cpu_count' and 'start_time' variables. ./utils/idle_monitor/snb_idle.o:./utils/idle_monitor/cpupower-monitor.h:28: multiple definition of `cpu_count'; ./utils/idle_monitor/nhm_idle.o:./utils/idle_monitor/cpupower-monitor.h:28: first defined here ... ./utils/idle_monitor/cpuidle_sysfs.o:./utils/idle_monitor/cpuidle_sysfs.c:22: multiple definition of `start_time'; ./utils/idle_monitor/amd_fam14h_idle.o:./utils/idle_monitor/amd_fam14h_idle.c:85: first defined here The -fno-common option will be enabled by default in GCC 10. Bug: https://bugs.gentoo.org/707462 Signed-off-by: Mike Gilbert Signed-off-by: Shuah Khan Signed-off-by: Sasha Levin --- tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c | 2 +- tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c | 2 +- tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c | 2 ++ tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h | 2 +- 4 files changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c index 2116df9ad8325..c097a3748674f 100644 --- a/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c +++ b/tools/power/cpupower/utils/idle_monitor/amd_fam14h_idle.c @@ -83,7 +83,7 @@ static struct pci_access *pci_acc; static struct pci_dev *amd_fam14h_pci_dev; static int nbp1_entered; -struct timespec start_time; +static struct timespec start_time; static unsigned long long timediff; #ifdef DEBUG diff --git a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c index 5b3205f162174..5277df27191f3 100644 --- a/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c +++ b/tools/power/cpupower/utils/idle_monitor/cpuidle_sysfs.c @@ -21,7 +21,7 @@ struct cpuidle_monitor cpuidle_sysfs_monitor; static unsigned long long **previous_count; static unsigned long long **current_count; -struct timespec start_time; +static struct timespec start_time; static unsigned long long timediff; static int cpuidle_get_count_percent(unsigned int id, double *percent, diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c index 05f953f0f0a0c..80a21cb67d94f 100644 --- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c +++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.c @@ -29,6 +29,8 @@ struct cpuidle_monitor *all_monitors[] = { 0 }; +int cpu_count; + static struct cpuidle_monitor *monitors[MONITORS_MAX]; static unsigned int avail_monitors; diff --git a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h index 9e43f3371fbc6..3558bbae2b5dc 100644 --- a/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h +++ b/tools/power/cpupower/utils/idle_monitor/cpupower-monitor.h @@ -18,7 +18,7 @@ #define CSTATE_NAME_LEN 5 #define CSTATE_DESC_LEN 60 -int cpu_count; +extern int cpu_count; /* Hard to define the right names ...: */ enum power_range_e { From patchwork Wed Apr 1 16:17:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228338 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7F2FC43331 for ; Wed, 1 Apr 2020 16:51:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 753382063A for ; Wed, 1 Apr 2020 16:51:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759912; bh=4Ki+qkxU39QDsDVJd+9zZO5BdWzNnwZi+XZF9+iCI3o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tbByjc49NQIp3hfWRN+yBbGoMiwYMpjPwudyv/tM3SW6lYOw+7amnR6nh8ECXXwYd RV2AOT9t2BoHE8IjQFZAUlU4MzMAlMkHatPiSwXH4G9puATw9bPDs+pr7a3op5lCP6 jZbeTDG718MQpOsXpiMh1aVKvOVab2D+itlVucS4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388909AbgDAQhG (ORCPT ); Wed, 1 Apr 2020 12:37:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:36220 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387634AbgDAQhG (ORCPT ); Wed, 1 Apr 2020 12:37:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1685A206F8; Wed, 1 Apr 2020 16:37:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759025; bh=4Ki+qkxU39QDsDVJd+9zZO5BdWzNnwZi+XZF9+iCI3o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XDth68QNSSOtSP9zl9D3DNbpb9sybVeN5u1gnFZY+TxdpNkjznrn2lQlxGJRlpskV xFpMnLa4DcBdu+JV2X0ENb+x6Wl38Kx9/LI5OhCGMKWHXVR/zDEke/LJLKkd76gXWV gRiiigEDQ8EFkcxmrWu8Vo0ake/A0Lwqn2r1ZUkI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Madalin Bucur , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 053/102] dt-bindings: net: FMan erratum A050385 Date: Wed, 1 Apr 2020 18:17:56 +0200 Message-Id: <20200401161542.741085212@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Madalin Bucur [ Upstream commit 26d5bb9e4c4b541c475751e015072eb2cbf70d15 ] FMAN DMA read or writes under heavy traffic load may cause FMAN internal resource leak; thus stopping further packet processing. The FMAN internal queue can overflow when FMAN splits single read or write transactions into multiple smaller transactions such that more than 17 AXI transactions are in flight from FMAN to interconnect. When the FMAN internal queue overflows, it can stall further packet processing. The issue can occur with any one of the following three conditions: 1. FMAN AXI transaction crosses 4K address boundary (Errata A010022) 2. FMAN DMA address for an AXI transaction is not 16 byte aligned, i.e. the last 4 bits of an address are non-zero 3. Scatter Gather (SG) frames have more than one SG buffer in the SG list and any one of the buffers, except the last buffer in the SG list has data size that is not a multiple of 16 bytes, i.e., other than 16, 32, 48, 64, etc. With any one of the above three conditions present, there is likelihood of stalled FMAN packet processing, especially under stress with multiple ports injecting line-rate traffic. To avoid situations that stall FMAN packet processing, all of the above three conditions must be avoided; therefore, configure the system with the following rules: 1. Frame buffers must not span a 4KB address boundary, unless the frame start address is 256 byte aligned 2. All FMAN DMA start addresses (for example, BMAN buffer address, FD[address] + FD[offset]) are 16B aligned 3. SG table and buffer addresses are 16B aligned and the size of SG buffers are multiple of 16 bytes, except for the last SG buffer that can be of any size. Additional workaround notes: - Address alignment of 64 bytes is recommended for maximally efficient system bus transactions (although 16 byte alignment is sufficient to avoid the stall condition) - To support frame sizes that are larger than 4K bytes, there are two options: 1. Large single buffer frames that span a 4KB page boundary can be converted into SG frames to avoid transaction splits at the 4KB boundary, 2. Align the large single buffer to 256B address boundaries, ensure that the frame address plus offset is 256B aligned. - If software generated SG frames have buffers that are unaligned and with random non-multiple of 16 byte lengths, before transmitting such frames via FMAN, frames will need to be copied into a new single buffer or multiple buffer SG frame that is compliant with the three rules listed above. Signed-off-by: Madalin Bucur Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- Documentation/devicetree/bindings/powerpc/fsl/fman.txt | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/Documentation/devicetree/bindings/powerpc/fsl/fman.txt b/Documentation/devicetree/bindings/powerpc/fsl/fman.txt index df873d1f3b7c5..2aaae210317bb 100644 --- a/Documentation/devicetree/bindings/powerpc/fsl/fman.txt +++ b/Documentation/devicetree/bindings/powerpc/fsl/fman.txt @@ -110,6 +110,13 @@ PROPERTIES Usage: required Definition: See soc/fsl/qman.txt and soc/fsl/bman.txt +- fsl,erratum-a050385 + Usage: optional + Value type: boolean + Definition: A boolean property. Indicates the presence of the + erratum A050385 which indicates that DMA transactions that are + split can result in a FMan lock. + ============================================================================= FMan MURAM Node From patchwork Wed Apr 1 16:17:59 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228339 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BD24C43331 for ; Wed, 1 Apr 2020 16:51:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CA6B92063A for ; Wed, 1 Apr 2020 16:51:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759908; bh=BDs+C/coW+DnubOt+dhIDCaG5Up4p/pEmCVLYl8TFMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hCAd1ohRlhXkx+d9H19YWU0wU+Om1Dp74fADaJIZ9Bdz0TDg/iyXABj/hhKoyRbBN DQPV83a4blmlx5keeJiCYXwVp5arwOyXIlQoxKoz4BH1DCcVMNyIuBN6vRyqdbLz9/ jontb63iylFnrokl8tamtmlJsAZgLiq3Z9qPqd0A= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388939AbgDAQhQ (ORCPT ); Wed, 1 Apr 2020 12:37:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:36370 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388942AbgDAQhP (ORCPT ); Wed, 1 Apr 2020 12:37:15 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 72F9B20658; Wed, 1 Apr 2020 16:37:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759034; bh=BDs+C/coW+DnubOt+dhIDCaG5Up4p/pEmCVLYl8TFMY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KyinvpB+limXLFbLLj8LAzwfm8KSgtYelZhwp8IOhZy9c0uaw+ALxh3GaMOVNLQd0 HhJbhlREZjohYsgu0hpuVSOFKmqvhRogM3Ri03aZGWki6dShs8Mvg801ktmzdlFwIo JhUWJEDk2B5S551lYanoe6YwJ/ekduSOEbtS4B8U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dominik Czarnota , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 056/102] sxgbe: Fix off by one in samsung driver strncpy size arg Date: Wed, 1 Apr 2020 18:17:59 +0200 Message-Id: <20200401161542.980166459@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dominik Czarnota [ Upstream commit f3cc008bf6d59b8d93b4190e01d3e557b0040e15 ] This patch fixes an off-by-one error in strncpy size argument in drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c. The issue is that in: strncmp(opt, "eee_timer:", 6) the passed string literal: "eee_timer:" has 10 bytes (without the NULL byte) and the passed size argument is 6. As a result, the logic will also accept other, malformed strings, e.g. "eee_tiXXX:". This bug doesn't seem to have any security impact since its present in module's cmdline parsing code. Signed-off-by: Dominik Czarnota Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c index ea44a2456ce16..11dd7c8d576d6 100644 --- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c +++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c @@ -2313,7 +2313,7 @@ static int __init sxgbe_cmdline_opt(char *str) if (!str || !*str) return -EINVAL; while ((opt = strsep(&str, ",")) != NULL) { - if (!strncmp(opt, "eee_timer:", 6)) { + if (!strncmp(opt, "eee_timer:", 10)) { if (kstrtoint(opt + 10, 0, &eee_timer)) goto err; } From patchwork Wed Apr 1 16:18:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228436 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E004C2D0F2 for ; Wed, 1 Apr 2020 16:37:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 08DF920658 for ; Wed, 1 Apr 2020 16:37:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759061; bh=tlBCLzB8KqqSYZkd4B/QOZWltHSyIudbX/rrs3U1giY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=BTwf7xmwBbvkCWKRC/hQKukT6LvOShhX2QdzKpJP9kTmUy6fsaWdUUoNDZ99Tv79h NhYxB9Ncq/tcaX/6mSqQx7ihIbhWNh/MQpg8pEDxMa4lwujKXgpb0gqqT1pukR06Wp NYOD9mMpsZ8GvUHhhqyYumHG8++LFyWTOwRDXs8k= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388715AbgDAQhi (ORCPT ); Wed, 1 Apr 2020 12:37:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:36604 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388814AbgDAQh0 (ORCPT ); Wed, 1 Apr 2020 12:37:26 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B128720772; Wed, 1 Apr 2020 16:37:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759046; bh=tlBCLzB8KqqSYZkd4B/QOZWltHSyIudbX/rrs3U1giY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W/pY+1frTSSsIoPbZd+mM47PJdidAJ1T0jfgxMnZ+dVALHQYO60hBcE+iFLNn/zVe d94uFtVfNSGSEk8Ne+QVXuinuVjql20mWA16W1bMEGYHx9zt2MLXm+jgOQamXjdp8w zYZUvchho1qfHSzGo+9r2BLdWli5X7TZuxoHJccw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Roger Quadros , Tony Lindgren Subject: [PATCH 4.9 059/102] ARM: dts: omap5: Add bus_dma_limit for L3 bus Date: Wed, 1 Apr 2020 18:18:02 +0200 Message-Id: <20200401161543.236331056@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Roger Quadros commit dfa7ea303f56a3a8b1ed3b91ef35af2da67ca4ee upstream. The L3 interconnect's memory map is from 0x0 to 0xffffffff. Out of this, System memory (SDRAM) can be accessed from 0x80000000 to 0xffffffff (2GB) OMAP5 does support 4GB of SDRAM but upper 2GB can only be accessed by the MPU subsystem. Add the dma-ranges property to reflect the physical address limit of the L3 bus. Cc: stable@kernel.org Signed-off-by: Roger Quadros Signed-off-by: Tony Lindgren Signed-off-by: Greg Kroah-Hartman --- arch/arm/boot/dts/omap5.dtsi | 1 + 1 file changed, 1 insertion(+) --- a/arch/arm/boot/dts/omap5.dtsi +++ b/arch/arm/boot/dts/omap5.dtsi @@ -131,6 +131,7 @@ #address-cells = <1>; #size-cells = <1>; ranges = <0 0 0 0xc0000000>; + dma-ranges = <0x80000000 0x0 0x80000000 0x80000000>; ti,hwmods = "l3_main_1", "l3_main_2", "l3_main_3"; reg = <0 0x44000000 0 0x2000>, <0 0x44800000 0 0x3000>, From patchwork Wed Apr 1 16:18:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228437 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A96FC2D0F2 for ; Wed, 1 Apr 2020 16:37:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2174120772 for ; Wed, 1 Apr 2020 16:37:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759052; bh=+Bubee5EQU1n36vkgo2xupBzeF9rBpZYrdoxdCB6/lw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Rp/u0ZJOQpK+yf6wmMCmfdn5Nntef0fugs+cGqkJbluGf8NsiYdsGQb32sWhHYg5m S2P25G7Xb91y92jP1pwVPrrSh5TxbUF8jynn4PeM8i/QwMwPQXr8RVl0HQ/X2+d7Vj tBz4N7xDLlVT3p96KCkWxyO4VaL+u44q/wwJMBmI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388810AbgDAQha (ORCPT ); Wed, 1 Apr 2020 12:37:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:36646 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388970AbgDAQh3 (ORCPT ); Wed, 1 Apr 2020 12:37:29 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 41934212CC; Wed, 1 Apr 2020 16:37:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759048; bh=+Bubee5EQU1n36vkgo2xupBzeF9rBpZYrdoxdCB6/lw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fWYWO4Spg8YYUUO9YDdjY+7vCB2Y/jj5L536IsqbN8HbxdR9joa2vx+5xzBLrxpg1 XCUKle2m8bbUDVaWK3tlPx0suUc9lCzs9e+I18yPnOvsIuHte5oiasBq6Fjh4o3eyl 7HFDfaQkCCarVodbe66/sPIP8ScWIHV3+oqVKUOQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexandre Ghiti , Masami Hiramatsu , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Peter Zijlstra , Sasha Levin , Arnaldo Carvalho de Melo Subject: [PATCH 4.9 060/102] perf probe: Do not depend on dwfl_module_addrsym() Date: Wed, 1 Apr 2020 18:18:03 +0200 Message-Id: <20200401161543.306999743@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Masami Hiramatsu commit 1efde2754275dbd9d11c6e0132a4f09facf297ab upstream. Do not depend on dwfl_module_addrsym() because it can fail on user-space shared libraries. Actually, same bug was fixed by commit 664fee3dc379 ("perf probe: Do not use dwfl_module_addrsym if dwarf_diename finds symbol name"), but commit 07d369857808 ("perf probe: Fix wrong address verification) reverted to get actual symbol address from symtab. This fixes it again by getting symbol address from DIE, and only if the DIE has only address range, it uses dwfl_module_addrsym(). Fixes: 07d369857808 ("perf probe: Fix wrong address verification) Reported-by: Alexandre Ghiti Signed-off-by: Masami Hiramatsu Tested-by: Alexandre Ghiti Cc: Alexander Shishkin Cc: Greg Kroah-Hartman Cc: Jiri Olsa Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Sasha Levin Link: http://lore.kernel.org/lkml/158281812176.476.14164573830975116234.stgit@devnote2 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman --- tools/perf/util/probe-finder.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) --- a/tools/perf/util/probe-finder.c +++ b/tools/perf/util/probe-finder.c @@ -623,14 +623,19 @@ static int convert_to_trace_point(Dwarf_ return -EINVAL; } - /* Try to get actual symbol name from symtab */ - symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL); + if (dwarf_entrypc(sp_die, &eaddr) == 0) { + /* If the DIE has entrypc, use it. */ + symbol = dwarf_diename(sp_die); + } else { + /* Try to get actual symbol name and address from symtab */ + symbol = dwfl_module_addrsym(mod, paddr, &sym, NULL); + eaddr = sym.st_value; + } if (!symbol) { pr_warning("Failed to find symbol at 0x%lx\n", (unsigned long)paddr); return -ENOENT; } - eaddr = sym.st_value; tp->offset = (unsigned long)(paddr - eaddr); tp->address = (unsigned long)paddr; From patchwork Wed Apr 1 16:18:06 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228340 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BE5DC43331 for ; Wed, 1 Apr 2020 16:51:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A39C42063A for ; Wed, 1 Apr 2020 16:51:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759897; bh=XnT3axJxZuyIDthlkR6xDltdMB6xzy/cdD5OiNoKLOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=yypVcsgY6tI19qNihQUUkEwBH4G5+kkJ9kYPoFzMKJGNvuCryWZvkf0MGBppVaF3I 5Lzyrwi9oL/2xlDm5OcAy0/ZDnCezFtOmoXKLoMmow1oTncEfuFySB3A13vokpIzNn IpibPniiiL3XDKHwQadtcuisDJR++To2s1qttlOg= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733165AbgDAQhi (ORCPT ); Wed, 1 Apr 2020 12:37:38 -0400 Received: from mail.kernel.org ([198.145.29.99]:36846 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1733133AbgDAQhh (ORCPT ); Wed, 1 Apr 2020 12:37:37 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 85C1E20658; Wed, 1 Apr 2020 16:37:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759057; bh=XnT3axJxZuyIDthlkR6xDltdMB6xzy/cdD5OiNoKLOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ry9a57frhA1Jii2eTxGVKnr9GuFvaJqXTOPJfLyU6kniYFS+0UzQuXGjNMyNZ9Mv8 9M0igtCMae3Xc7E189DGRTTcAs0nW9o2fDjahZEZgrQCiuqp2FH2YkLkTQlZ/c51Qb S+cEo46mBzmTiMgqaUYUfi4ZZaRzk7syRiOd2Uxg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg Subject: [PATCH 4.9 063/102] mac80211: mark station unauthorized before key removal Date: Wed, 1 Apr 2020 18:18:06 +0200 Message-Id: <20200401161543.546814307@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johannes Berg commit b16798f5b907733966fd1a558fca823b3c67e4a1 upstream. If a station is still marked as authorized, mark it as no longer so before removing its keys. This allows frames transmitted to it to be rejected, providing additional protection against leaking plain text data during the disconnection flow. Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b8921f48c6d3bb2cb763c99@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/sta_info.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -3,6 +3,7 @@ * Copyright 2006-2007 Jiri Benc * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2016 Intel Deutschland GmbH + * Copyright (C) 2018-2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -945,6 +946,11 @@ static void __sta_info_destroy_part2(str might_sleep(); lockdep_assert_held(&local->sta_mtx); + while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { + ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); + WARN_ON_ONCE(ret); + } + /* now keys can no longer be reached */ ieee80211_free_sta_keys(local, sta); From patchwork Wed Apr 1 16:18:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228435 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0870C43331 for ; Wed, 1 Apr 2020 16:37:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B273620BED for ; Wed, 1 Apr 2020 16:37:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759065; bh=+JAAVEF8KYJY+js1qOPD/3WM6MFYxSxtSx/3r8F4uoM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=V5AnYhmqp00soSqdB8dzpu87kvPiJjQrC6TzWkZ1yLX6j3G+M46tnERdbp094ihqd mVq6+Em+DCl/Rqzth1H7ZDj85bAVgAyfn1+jlpL0WDceGOGRwDt3m0GKskz8WLVVLh UUAsTwQfXXW6BqWUmuvVPANPPGeHDvIz6NYp2/is= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389001AbgDAQho (ORCPT ); Wed, 1 Apr 2020 12:37:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:37020 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388995AbgDAQho (ORCPT ); Wed, 1 Apr 2020 12:37:44 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 00EC920BED; Wed, 1 Apr 2020 16:37:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759063; bh=+JAAVEF8KYJY+js1qOPD/3WM6MFYxSxtSx/3r8F4uoM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qwdm5gIFLzqBO2AGc0QWIfqejEGVY2+LmsTA9HeUE5SPmsFCTkOXmN4smQyN6++nQ VqQV/BkVdXHBH8EMp4uHuDuSd3/XdNBjV9RR6UfwIdOUmhh0mgVoLlw+AZPhC33m3m Kvjm2ZWZj8ZQ0ynAHUAzftDkYsMvyp5UIn/q2X2A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicolas Dichtel , Steffen Klassert Subject: [PATCH 4.9 065/102] vti[6]: fix packet tx through bpf_redirect() in XinY cases Date: Wed, 1 Apr 2020 18:18:08 +0200 Message-Id: <20200401161543.746725659@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nicolas Dichtel commit f1ed10264ed6b66b9cd5e8461cffce69be482356 upstream. I forgot the 4in6/6in4 cases in my previous patch. Let's fix them. Fixes: 95224166a903 ("vti[6]: fix packet tx through bpf_redirect()") Signed-off-by: Nicolas Dichtel Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/ipv4/Kconfig | 1 + net/ipv4/ip_vti.c | 36 +++++++++++++++++++++++++++++------- net/ipv6/ip6_vti.c | 32 +++++++++++++++++++++++++------- 3 files changed, 55 insertions(+), 14 deletions(-) --- a/net/ipv4/Kconfig +++ b/net/ipv4/Kconfig @@ -298,6 +298,7 @@ config SYN_COOKIES config NET_IPVTI tristate "Virtual (secure) IP: tunneling" + depends on IPV6 || IPV6=n select INET_TUNNEL select NET_IP_TUNNEL depends on INET_XFRM_MODE_TUNNEL --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c @@ -208,17 +208,39 @@ static netdev_tx_t vti_xmit(struct sk_bu int mtu; if (!dst) { - struct rtable *rt; + switch (skb->protocol) { + case htons(ETH_P_IP): { + struct rtable *rt; - fl->u.ip4.flowi4_oif = dev->ifindex; - fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; - rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); - if (IS_ERR(rt)) { + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; + rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); + if (IS_ERR(rt)) { + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } + dst = &rt->dst; + skb_dst_set(skb, dst); + break; + } +#if IS_ENABLED(CONFIG_IPV6) + case htons(ETH_P_IPV6): + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; + dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); + if (dst->error) { + dst_release(dst); + dst = NULL; + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } + skb_dst_set(skb, dst); + break; +#endif + default: dev->stats.tx_carrier_errors++; goto tx_error_icmp; } - dst = &rt->dst; - skb_dst_set(skb, dst); } dst_hold(dst); --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -454,15 +454,33 @@ vti6_xmit(struct sk_buff *skb, struct ne int mtu; if (!dst) { - fl->u.ip6.flowi6_oif = dev->ifindex; - fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; - dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); - if (dst->error) { - dst_release(dst); - dst = NULL; + switch (skb->protocol) { + case htons(ETH_P_IP): { + struct rtable *rt; + + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC; + rt = __ip_route_output_key(dev_net(dev), &fl->u.ip4); + if (IS_ERR(rt)) + goto tx_err_link_failure; + dst = &rt->dst; + skb_dst_set(skb, dst); + break; + } + case htons(ETH_P_IPV6): + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |= FLOWI_FLAG_ANYSRC; + dst = ip6_route_output(dev_net(dev), NULL, &fl->u.ip6); + if (dst->error) { + dst_release(dst); + dst = NULL; + goto tx_err_link_failure; + } + skb_dst_set(skb, dst); + break; + default: goto tx_err_link_failure; } - skb_dst_set(skb, dst); } dst_hold(dst); From patchwork Wed Apr 1 16:18:10 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228434 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2DFCC43331 for ; Wed, 1 Apr 2020 16:37:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B89D5206F8 for ; Wed, 1 Apr 2020 16:37:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759077; bh=M1yKdC1PMPoCU3jcC9N0KAwktw1FvUgurSJb8673bKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=J9anKApCjOUl25DXBQqu0QMHnsBZB8/gqTuvzXEEKjBifV1MVVqG7ABXr7QvWi8gx 0ML+/bN2uYZAUI3DAuBlhZ1jrrgJwwTMOrI7LiI5ctfcCf4kDW1x6+mGsvUwG2oFGW zyPUCGPyYBddFd4/W+6Tm2ZQ0Um0+7G9xTnH2mKE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388815AbgDAQh4 (ORCPT ); Wed, 1 Apr 2020 12:37:56 -0400 Received: from mail.kernel.org ([198.145.29.99]:37242 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389024AbgDAQhw (ORCPT ); Wed, 1 Apr 2020 12:37:52 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 44CC1206F8; Wed, 1 Apr 2020 16:37:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759071; bh=M1yKdC1PMPoCU3jcC9N0KAwktw1FvUgurSJb8673bKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VE/X+JoR24h2jeNcfy3z20lipGtIZdeyANf1zbmdhS6sdelG+a1cgnECPRg8hz2Cn PB38UDNA63mjpW3FxIkMYkg56VvmYv4bszBBj5L8vPMrX6wS2ZGqILCfWtMYVuZtGL 4yX8jsEXHA7Bnjpay+sD8NjRaYIO/8dsd7mFmVdU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangbin Liu , Xin Long , Steffen Klassert Subject: [PATCH 4.9 067/102] xfrm: add the missing verify_sec_ctx_len check in xfrm_add_acquire Date: Wed, 1 Apr 2020 18:18:10 +0200 Message-Id: <20200401161544.014427547@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Xin Long commit a1a7e3a36e01ca6e67014f8cf673cb8e47be5550 upstream. Without doing verify_sec_ctx_len() check in xfrm_add_acquire(), it may be out-of-bounds to access uctx->ctx_str with uctx->ctx_len, as noticed by syz: BUG: KASAN: slab-out-of-bounds in selinux_xfrm_alloc_user+0x237/0x430 Read of size 768 at addr ffff8880123be9b4 by task syz-executor.1/11650 Call Trace: dump_stack+0xe8/0x16e print_address_description.cold.3+0x9/0x23b kasan_report.cold.4+0x64/0x95 memcpy+0x1f/0x50 selinux_xfrm_alloc_user+0x237/0x430 security_xfrm_policy_alloc+0x5c/0xb0 xfrm_policy_construct+0x2b1/0x650 xfrm_add_acquire+0x21d/0xa10 xfrm_user_rcv_msg+0x431/0x6f0 netlink_rcv_skb+0x15a/0x410 xfrm_netlink_rcv+0x6d/0x90 netlink_unicast+0x50e/0x6a0 netlink_sendmsg+0x8ae/0xd40 sock_sendmsg+0x133/0x170 ___sys_sendmsg+0x834/0x9a0 __sys_sendmsg+0x100/0x1e0 do_syscall_64+0xe5/0x660 entry_SYSCALL_64_after_hwframe+0x6a/0xdf So fix it by adding the missing verify_sec_ctx_len check there. Fixes: 980ebd25794f ("[IPSEC]: Sync series - acquire insert") Reported-by: Hangbin Liu Signed-off-by: Xin Long Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/xfrm/xfrm_user.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -2178,6 +2178,9 @@ static int xfrm_add_acquire(struct sk_bu err = verify_newpolicy_info(&ua->policy); if (err) goto free_state; + err = verify_sec_ctx_len(attrs); + if (err) + goto free_state; /* build an XP */ xp = xfrm_policy_construct(net, &ua->policy, attrs, &err); From patchwork Wed Apr 1 16:18:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228341 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EF42C43331 for ; Wed, 1 Apr 2020 16:51:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3D8792063A for ; Wed, 1 Apr 2020 16:51:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759890; bh=CgY4mXuITzuTPiXbroF4GvgpCRhDYaZpzAOZmacCfns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=W8swBOdn8AUmBXpUS3NIl3AgrQ8TrOnj/DMWYeaNKn0kENFoJsxPQzMrhQTYLURw9 NaOhDWRFDoIb/S3XvAMM3H3/6ALNZeG6F0Z1HVLbI9KiigTefh3PXR+crENXTiUHMi m3XuF2RKUsv2XiYrY9+i5Z+K3ZYb+JYrXBhSSojs= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732492AbgDAQvR (ORCPT ); Wed, 1 Apr 2020 12:51:17 -0400 Received: from mail.kernel.org ([198.145.29.99]:37306 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388258AbgDAQh4 (ORCPT ); Wed, 1 Apr 2020 12:37:56 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0663C20772; Wed, 1 Apr 2020 16:37:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759075; bh=CgY4mXuITzuTPiXbroF4GvgpCRhDYaZpzAOZmacCfns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L1U1rWfPjmYXvdvTk88MNheWUW35q3Vo62vaEd07v4NBFdFYHTe6+wXaSorVNoRDs W1+2Rtev5QY27EFAz/hZAkvcPN6T1PKYgOKY3wKGhDlkvxekJtmDo37HUylxNa2PqP zBLvbCJhPAwKQqxoT0Az+P0STERtxShm0qomufUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, YueHaibing , =?utf-8?q?Timo_Ter=C3=A4s?= , Herbert Xu , Steffen Klassert Subject: [PATCH 4.9 068/102] xfrm: policy: Fix doulbe free in xfrm_policy_timer Date: Wed, 1 Apr 2020 18:18:11 +0200 Message-Id: <20200401161544.181086408@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: YueHaibing commit 4c59406ed00379c8663f8663d82b2537467ce9d7 upstream. After xfrm_add_policy add a policy, its ref is 2, then xfrm_policy_timer read_lock xp->walk.dead is 0 .... mod_timer() xfrm_policy_kill policy->walk.dead = 1 .... del_timer(&policy->timer) xfrm_pol_put //ref is 1 xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_pol_hold //ref is 1 read_unlock xfrm_pol_put //ref is 0 xfrm_policy_destroy call_rcu xfrm_policy_destroy is called twice, which may leads to double free. Call Trace: RIP: 0010:refcount_warn_saturate+0x161/0x210 ... xfrm_policy_timer+0x522/0x600 call_timer_fn+0x1b3/0x5e0 ? __xfrm_decode_session+0x2990/0x2990 ? msleep+0xb0/0xb0 ? _raw_spin_unlock_irq+0x24/0x40 ? __xfrm_decode_session+0x2990/0x2990 ? __xfrm_decode_session+0x2990/0x2990 run_timer_softirq+0x5c5/0x10e0 Fix this by use write_lock_bh in xfrm_policy_kill. Fixes: ea2dea9dacc2 ("xfrm: remove policy lock when accessing policy->walk.dead") Signed-off-by: YueHaibing Acked-by: Timo Teräs Acked-by: Herbert Xu Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/xfrm/xfrm_policy.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -336,7 +336,9 @@ EXPORT_SYMBOL(xfrm_policy_destroy); static void xfrm_policy_kill(struct xfrm_policy *policy) { + write_lock_bh(&policy->lock); policy->walk.dead = 1; + write_unlock_bh(&policy->lock); atomic_inc(&policy->genid); From patchwork Wed Apr 1 16:18:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228342 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 211EDC2BA12 for ; Wed, 1 Apr 2020 16:51:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id CC7F4206E9 for ; Wed, 1 Apr 2020 16:51:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759867; bh=vHUjieBU5aslM55rEOP09v3yMqm7chbEbPX1sJ1IF44=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VAaErQJ8kklvbFuvvBBg+SsMmtNCVYFE0/iK/nnHYXZJ3CVb+RcNzhX+HWenr/STK cv3gj6i1WOZD0T5l4N6Ron0vw5SVYQUuUcLMBtW2cd9h+1Y2Qd1QpBe6iqiz4TqdKF 50pyYEx7L/+VLmYknx4d1++oJ+IECGeLksATKOA4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389049AbgDAQiC (ORCPT ); Wed, 1 Apr 2020 12:38:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:37460 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388751AbgDAQiB (ORCPT ); Wed, 1 Apr 2020 12:38:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6C587206F8; Wed, 1 Apr 2020 16:38:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759080; bh=vHUjieBU5aslM55rEOP09v3yMqm7chbEbPX1sJ1IF44=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gpg2W2U5QDv1NuUBUYQzxIWJ0eMemTzvBlJWtErVfTAFcUgItZ8G4NkscwuUSeLBh PQ4cmdkpmZD3joqu738GU/6d2L9t3t6SoVe0+3VnU0d8tfr9Wz9GT3z2h14FPdUe5F IsOoLuVwDC9NVAkKakBU/pMYjUyRnXEVUgZo1zKY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Torsten Hilbrich , Nicolas Dichtel , Steffen Klassert Subject: [PATCH 4.9 070/102] vti6: Fix memory leak of skb if input policy check fails Date: Wed, 1 Apr 2020 18:18:13 +0200 Message-Id: <20200401161544.369456064@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Torsten Hilbrich commit 2a9de3af21aa8c31cd68b0b39330d69f8c1e59df upstream. The vti6_rcv function performs some tests on the retrieved tunnel including checking the IP protocol, the XFRM input policy, the source and destination address. In all but one places the skb is released in the error case. When the input policy check fails the network packet is leaked. Using the same goto-label discard in this case to fix this problem. Fixes: ed1efb2aefbb ("ipv6: Add support for IPsec virtual tunnel interfaces") Signed-off-by: Torsten Hilbrich Reviewed-by: Nicolas Dichtel Signed-off-by: Steffen Klassert Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_vti.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv6/ip6_vti.c +++ b/net/ipv6/ip6_vti.c @@ -315,7 +315,7 @@ static int vti6_rcv(struct sk_buff *skb) if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) { rcu_read_unlock(); - return 0; + goto discard; } ipv6h = ipv6_hdr(skb); From patchwork Wed Apr 1 16:18:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228433 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2C85C43331 for ; Wed, 1 Apr 2020 16:38:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 627E6206F8 for ; Wed, 1 Apr 2020 16:38:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759088; bh=SLuziyPDhy/Krr1/3ovv/97FsHO/PgRPxTZKFAYm9Mc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=aqRnYg4Igp+3R9/xfr901z7ZdpVFDgJXk8rTweaaOyGeLPWPwh9tvxBJjTuem6aam yst44ozfzWpyzzr1srMKriG+JPibWsdpz+q2zAuZNg8Q7aJqtrIXv5yoXc/hB4UM9D URcQqyo945R0dIWbAh8F5Bv+3giWmd+2xXJcxJAw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389064AbgDAQiH (ORCPT ); Wed, 1 Apr 2020 12:38:07 -0400 Received: from mail.kernel.org ([198.145.29.99]:37652 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388751AbgDAQiG (ORCPT ); Wed, 1 Apr 2020 12:38:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A764E20772; Wed, 1 Apr 2020 16:38:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759086; bh=SLuziyPDhy/Krr1/3ovv/97FsHO/PgRPxTZKFAYm9Mc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jLvPAOa9gQHMD/POCaeggS9ebTkPdlMHz58EjSBfgJoPcHzF4IoJ8urjMLbCTPaBa jKM5NFeBTr6H4R8OnfAoGu4Lo8DHk9i9Bxu+OovXovzyZcBMuQ9GqjZ7TiL0w0/9kp ZdKrAYlUfmB7imfISiHHiA1qRiMXRZEVTrspuqFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Dmitry Torokhov , Sasha Levin Subject: [PATCH 4.9 072/102] Input: raydium_i2c_ts - fix error codes in raydium_i2c_boot_trigger() Date: Wed, 1 Apr 2020 18:18:15 +0200 Message-Id: <20200401161544.760720853@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dan Carpenter [ Upstream commit 32cf3a610c35cb21e3157f4bbf29d89960e30a36 ] These functions are supposed to return negative error codes but instead it returns true on failure and false on success. The error codes are eventually propagated back to user space. Fixes: 48a2b783483b ("Input: add Raydium I2C touchscreen driver") Signed-off-by: Dan Carpenter Link: https://lore.kernel.org/r/20200303101306.4potflz7na2nn3od@kili.mountain Cc: stable@vger.kernel.org Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin --- drivers/input/touchscreen/raydium_i2c_ts.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/input/touchscreen/raydium_i2c_ts.c b/drivers/input/touchscreen/raydium_i2c_ts.c index 76cdc145c0912..1f5b6b5b1018a 100644 --- a/drivers/input/touchscreen/raydium_i2c_ts.c +++ b/drivers/input/touchscreen/raydium_i2c_ts.c @@ -441,7 +441,7 @@ static int raydium_i2c_write_object(struct i2c_client *client, return 0; } -static bool raydium_i2c_boot_trigger(struct i2c_client *client) +static int raydium_i2c_boot_trigger(struct i2c_client *client) { static const u8 cmd[7][6] = { { 0x08, 0x0C, 0x09, 0x00, 0x50, 0xD7 }, @@ -466,10 +466,10 @@ static bool raydium_i2c_boot_trigger(struct i2c_client *client) } } - return false; + return 0; } -static bool raydium_i2c_fw_trigger(struct i2c_client *client) +static int raydium_i2c_fw_trigger(struct i2c_client *client) { static const u8 cmd[5][11] = { { 0, 0x09, 0x71, 0x0C, 0x09, 0x00, 0x50, 0xD7, 0, 0, 0 }, @@ -492,7 +492,7 @@ static bool raydium_i2c_fw_trigger(struct i2c_client *client) } } - return false; + return 0; } static int raydium_i2c_check_path(struct i2c_client *client) From patchwork Wed Apr 1 16:18:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228343 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B4B2C2D0F2 for ; Wed, 1 Apr 2020 16:51:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 565C3206E9 for ; Wed, 1 Apr 2020 16:51:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759865; bh=tJfTvLthxd3MPNNdu5kwUFJoCWtXlImC1k6Bi9FjK00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pEUVuli46omA+VOf6eotYdlgvHG5abdtrWHFVQHfpZR87ycGGczI52V8V/wfEJKT7 aAltHeHW79wkLZeKA80UT1pfK+9REAAwQMWQ1eizhW8QFAVkhgYixSdWnSH2quTpJn E6iBftMaz2YFMqKmfmhctEPHWJvi/FpFVBM6d9YA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388744AbgDAQiU (ORCPT ); Wed, 1 Apr 2020 12:38:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:37922 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1732570AbgDAQiS (ORCPT ); Wed, 1 Apr 2020 12:38:18 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 66A0E20658; Wed, 1 Apr 2020 16:38:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759097; bh=tJfTvLthxd3MPNNdu5kwUFJoCWtXlImC1k6Bi9FjK00=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z8PxMMirz2H6d2Elwjr/8S1ZWfpINWpY7zX2lu4mAUFgMikTT1qCjacEjoB5P+lgc bQOnAMFc0DpvF9/8BO1JeQ8+K+2muIZnXHBej+nDhBvPv7CtS0uDxkx9P57zMTFgAc CLleMeuQCc1qMH2VRxKzg94vepfxmsW2XA7Y4oDo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cezary Jackiewicz , Pawel Dembicki , Johan Hovold Subject: [PATCH 4.9 074/102] USB: serial: option: add support for ASKEY WWHC050 Date: Wed, 1 Apr 2020 18:18:17 +0200 Message-Id: <20200401161545.092483410@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pawel Dembicki commit 007d20dca2376a751b1dad03442f118438b7e65e upstream. ASKEY WWHC050 is a mcie LTE modem. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1690 ProdID=7588 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=813f0eef6e6e C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution. Co-developed-by: Cezary Jackiewicz Signed-off-by: Cezary Jackiewicz Signed-off-by: Pawel Dembicki Cc: stable Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1983,6 +1983,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ .driver_info = RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2060, 0xff), /* BroadMobi BM818 */ From patchwork Wed Apr 1 16:18:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228432 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83214C2D0F3 for ; Wed, 1 Apr 2020 16:38:26 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2CD5620658 for ; Wed, 1 Apr 2020 16:38:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759106; bh=xRdhyKnGuxjusTLw/aAf27RdDFu0veOQA6/4JO0PSEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=0bhV+00MhwDgoLURusyd91LFEy3ElG0nC9V/eCOS5WryGP8H8ywQcQTQlgEp+I7tF HmYcZvxQeVU3dVI8fnL3EAqF7V7XVnnu2QV4J/cP/ZAparbnGybjsFnHRgvt9A0vC1 SpaX+j894uZuHWBfUEXfaBBZPQZLBYinaPy3hfAI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388864AbgDAQiZ (ORCPT ); Wed, 1 Apr 2020 12:38:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:38076 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388946AbgDAQiY (ORCPT ); Wed, 1 Apr 2020 12:38:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B891920857; Wed, 1 Apr 2020 16:38:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759104; bh=xRdhyKnGuxjusTLw/aAf27RdDFu0veOQA6/4JO0PSEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H0XeqqdDXYeUCKPOMfJAN7XY+WRle0vFFtPp40O0sroXlxC9/Fdug1e4QRzs+rVxX naxTg27XiBOS6YwHhm+UDy8T1ibSE+eob08OoULVkLD+W6vm8eigVuTWXlGC5PV31D tcTZE21+85MUSwoVKlk1y8Dz2UeHVN5zjvQ7Co6M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pawel Dembicki , Johan Hovold Subject: [PATCH 4.9 076/102] USB: serial: option: add Wistron Neweb D19Q1 Date: Wed, 1 Apr 2020 18:18:19 +0200 Message-Id: <20200401161545.401319428@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Pawel Dembicki commit dfee7e2f478346b12ea651d5c28b069f6a4af563 upstream. This modem is embedded on dlink dwr-960 router. The oem configuration states: T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=1435 ProdID=d191 Rev=ff.ff S: Manufacturer=Android S: Product=Android S: SerialNumber=0123456789ABCDEF C:* #Ifs= 6 Cfg#= 1 Atr=80 MxPwr=500mA I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 1 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) E: Ad=86(I) Atr=03(Int.) MxPS= 10 Ivl=32ms E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms E: Ad=87(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms I:* If#= 5 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=(none) E: Ad=89(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms E: Ad=06(O) Atr=02(Bulk) MxPS= 512 Ivl=125us Tested on openwrt distribution Signed-off-by: Pawel Dembicki Cc: stable Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1983,6 +1983,8 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ + { USB_DEVICE_INTERFACE_CLASS(0x1435, 0xd191, 0xff), /* Wistron Neweb D19Q1 */ + .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x1690, 0x7588, 0xff), /* ASKEY WWHC050 */ .driver_info = RSVD(1) | RSVD(4) }, { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x2031, 0xff), /* Olicard 600 */ From patchwork Wed Apr 1 16:18:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228431 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 23ACBC2D0F0 for ; Wed, 1 Apr 2020 16:38:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EB2F920857 for ; Wed, 1 Apr 2020 16:38:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759117; bh=tet5YOIqQdCOHptiSOmkenXOZ5P8aUOSAsNdEt653NQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=sWsdO/IfJWlC2K0d98iFwyP2bH1XZH4vW8xuAworj01D1+ZykvnJKC5Tct9K4Mtcb s2zLeG7XBUhelygaAVYqenbanXcD4oLOwBe5N9XhRuAdDUdtOW9rtHo3une1jbOvQp cxEo+lytPeFSHkFWXEMl9hYM9A+vrj2IdiQ3TT38= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1733290AbgDAQig (ORCPT ); Wed, 1 Apr 2020 12:38:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:38304 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388962AbgDAQic (ORCPT ); Wed, 1 Apr 2020 12:38:32 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EB1D020772; Wed, 1 Apr 2020 16:38:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759112; bh=tet5YOIqQdCOHptiSOmkenXOZ5P8aUOSAsNdEt653NQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qq/ypKshbB7jWtsxz5UX4A/MH2w0yOzDzF1/ri83ph1TeC2YcNWHVLK2TmnUbHCOD T4QEKhqb870C9DkjWazEywkcG5M+dfM/0kpn4gYwqQeCxmjufPj935Vg8Ui84xN7Os FBiMDO6QL7f/Y4QJHYSsPGU5emlO22No5khjwkMQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qiujun Huang , Johan Hovold , syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com Subject: [PATCH 4.9 078/102] USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback Date: Wed, 1 Apr 2020 18:18:21 +0200 Message-Id: <20200401161545.691788527@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Qiujun Huang commit 57aa9f294b09463492f604feaa5cc719beaace32 upstream. Fix slab-out-of-bounds read in the interrupt-URB completion handler. The boundary condition should be (length - 1) as we access data[position + 1]. Reported-and-tested-by: syzbot+37ba33391ad5f3935bbd@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/io_edgeport.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -634,7 +634,7 @@ static void edge_interrupt_callback(stru /* grab the txcredits for the ports if available */ position = 2; portNumber = 0; - while ((position < length) && + while ((position < length - 1) && (portNumber < edge_serial->serial->num_ports)) { txCredits = data[position] | (data[position+1] << 8); if (txCredits) { From patchwork Wed Apr 1 16:18:22 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228344 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E37CC2D0F2 for ; Wed, 1 Apr 2020 16:50:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D242D2063A for ; Wed, 1 Apr 2020 16:50:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759858; bh=Jb477QnmVOumNiQUhTwmrb7ruwSZE2FwDmZGJD3j1d4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=p4uDqE/ZWyxONxCBHNDzcNDT9ge/kJrHHyeu9yr+hm2Im/5tnJZ+JgLRvkDdsBs45 uXpVTE7BeJe9LrhHWF7ZONjONvcOYUY1TLQLEohew7d7yz/PRw+7b0iau+yhfZiyin Zxpwad1AJRaTyUoR3Mn17B+UiUQ5pWaNV6D4LpyE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389102AbgDAQij (ORCPT ); Wed, 1 Apr 2020 12:38:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:38348 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387520AbgDAQif (ORCPT ); Wed, 1 Apr 2020 12:38:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 66A0020658; Wed, 1 Apr 2020 16:38:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759114; bh=Jb477QnmVOumNiQUhTwmrb7ruwSZE2FwDmZGJD3j1d4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K+7ktAI8vaDdio9psPxFwv5oEEfvAQwnXDYCr8muZk6RHdlWmHwzC1QRW2bMdPpW7 SWLTKi94+OzBhMehpXHdBtfocfHZ5Kmx9hK60sywxnXxvSbimq+Og28S/7lKFwqQBJ kHX2+dT/n0ZJa0oyk8qzr8RAf7nxN37b/FayKCNQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mans Rullgard , Bin Liu Subject: [PATCH 4.9 079/102] usb: musb: fix crash with highmen PIO and usbmon Date: Wed, 1 Apr 2020 18:18:22 +0200 Message-Id: <20200401161545.845950601@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Mans Rullgard commit 52974d94a206ce428d9d9b6eaa208238024be82a upstream. When handling a PIO bulk transfer with highmem buffer, a temporary mapping is assigned to urb->transfer_buffer. After the transfer is complete, an invalid address is left behind in this pointer. This is not ordinarily a problem since nothing touches that buffer before the urb is released. However, when usbmon is active, usbmon_urb_complete() calls (indirectly) mon_bin_get_data() which does access the transfer buffer if it is set. To prevent an invalid memory access here, reset urb->transfer_buffer to NULL when finished (musb_host_rx()), or do not set it at all (musb_host_tx()). Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode") Signed-off-by: Mans Rullgard Cc: stable@vger.kernel.org Signed-off-by: Bin Liu Link: https://lore.kernel.org/r/20200316211136.2274-8-b-liu@ti.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/musb/musb_host.c | 17 +++++------------ 1 file changed, 5 insertions(+), 12 deletions(-) --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c @@ -1494,10 +1494,7 @@ done: * We need to map sg if the transfer_buffer is * NULL. */ - if (!urb->transfer_buffer) - qh->use_sg = true; - - if (qh->use_sg) { + if (!urb->transfer_buffer) { /* sg_miter_start is already done in musb_ep_program */ if (!sg_miter_next(&qh->sg_miter)) { dev_err(musb->controller, "error: sg list empty\n"); @@ -1505,9 +1502,8 @@ done: status = -EINVAL; goto done; } - urb->transfer_buffer = qh->sg_miter.addr; length = min_t(u32, length, qh->sg_miter.length); - musb_write_fifo(hw_ep, length, urb->transfer_buffer); + musb_write_fifo(hw_ep, length, qh->sg_miter.addr); qh->sg_miter.consumed = length; sg_miter_stop(&qh->sg_miter); } else { @@ -1516,11 +1512,6 @@ done: qh->segsize = length; - if (qh->use_sg) { - if (offset + length >= urb->transfer_buffer_length) - qh->use_sg = false; - } - musb_ep_select(mbase, epnum); musb_writew(epio, MUSB_TXCSR, MUSB_TXCSR_H_WZC_BITS | MUSB_TXCSR_TXPKTRDY); @@ -2040,8 +2031,10 @@ finish: urb->actual_length += xfer_len; qh->offset += xfer_len; if (done) { - if (qh->use_sg) + if (qh->use_sg) { qh->use_sg = false; + urb->transfer_buffer = NULL; + } if (urb->status == -EINPROGRESS) urb->status = status; From patchwork Wed Apr 1 16:18:26 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228425 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B1B5C2D0F3 for ; Wed, 1 Apr 2020 16:39:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 285192063A for ; Wed, 1 Apr 2020 16:39:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759187; bh=czNnYhZCIR0owLlyGh6iNgbaZ96RDbl26VfpnZQE6OM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Yoyrx+J6FIe7rUaXMPx+JE8Wz5iaQz72m+e7uj6GP86BrcDM2s+AKVU45jbiOjhaJ EA8QiXNzNZi4Vwi4Gk2Ld5qaGEudCg2CBIMGe9bjju23IHuHHhwiXq2obS92oRdHCO /Rz/b6nvrcvrU/LVvRMhfNgnILwmcvWX+g9NjUJU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388865AbgDAQjq (ORCPT ); Wed, 1 Apr 2020 12:39:46 -0400 Received: from mail.kernel.org ([198.145.29.99]:39812 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387964AbgDAQjp (ORCPT ); Wed, 1 Apr 2020 12:39:45 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 0A9642063A; Wed, 1 Apr 2020 16:39:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759185; bh=czNnYhZCIR0owLlyGh6iNgbaZ96RDbl26VfpnZQE6OM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GPV7FIg7m45j/PzaRBB9CtN/x+YYr5tiV+wES6uSQq8D6sqnlCr4TfFYf8O6KITIL 2rzG6eyfjVWY0ayTWqVDJptQaVXrmemsrfaMXaeMJou1ZjWiB9D072ITzC+b6R2UL2 AQWVLY9GdK+AZpwxn4ckvWkaB2oEkb0N6TNBE1k8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com, Qiujun Huang Subject: [PATCH 4.9 083/102] staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb Date: Wed, 1 Apr 2020 18:18:26 +0200 Message-Id: <20200401161546.381443645@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Qiujun Huang commit a1f165a6b738f0c9d744bad4af7a53909278f5fc upstream. We should cancel hw->usb_work before kfree(hw). Reported-by: syzbot+6d2e7f6fa90e27be9d62@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Cc: stable Link: https://lore.kernel.org/r/1585120006-30042-1-git-send-email-hqjagain@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wlan-ng/prism2usb.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/staging/wlan-ng/prism2usb.c +++ b/drivers/staging/wlan-ng/prism2usb.c @@ -179,6 +179,7 @@ static void prism2sta_disconnect_usb(str cancel_work_sync(&hw->link_bh); cancel_work_sync(&hw->commsqual_bh); + cancel_work_sync(&hw->usb_work); /* Now we complete any outstanding commands * and tell everyone who is waiting for their From patchwork Wed Apr 1 16:18:27 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228350 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34886C43331 for ; Wed, 1 Apr 2020 16:50:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B75F12063A for ; Wed, 1 Apr 2020 16:50:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759834; bh=DahiHw5H4HO3q92hreQmS6hEroRFGFzccqXJwM9Tv3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=G3lqByKPwcZ7YTpDyUc6p/yiku81g+PjMFfnVDu9vI0MU2fUGjFa94j4y4UdHV/TJ sxyVGiKNwyiXMhMb/aKv4nlJMyOxEhX7YrXwm1163GokGZZRPjBQ2k4USypUb0GzHK yN7KnLlaQJ1G01T6W4rxfvvdnoWyi4Q9ZcRPP+k0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389246AbgDAQjs (ORCPT ); Wed, 1 Apr 2020 12:39:48 -0400 Received: from mail.kernel.org ([198.145.29.99]:39854 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389243AbgDAQjs (ORCPT ); Wed, 1 Apr 2020 12:39:48 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8B28D2063A; Wed, 1 Apr 2020 16:39:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759188; bh=DahiHw5H4HO3q92hreQmS6hEroRFGFzccqXJwM9Tv3A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=haBkFEXMYV/UQ0N4+yDp6AQL25QKukc11bN8hZ4F4aJK3zpccN2DakBMajd+8b5W7 ppYBigLfftWqXci1PkM0KfByTW83XOaCGHvS2DaqLFxiJ61xM4IjWEDUSKX1gcN3eA XOvR80mr7sLT/tgZsDTd5EeL63wO/Jnpu8EMslX0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qiujun Huang , syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com Subject: [PATCH 4.9 084/102] staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback Date: Wed, 1 Apr 2020 18:18:27 +0200 Message-Id: <20200401161546.521375881@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Qiujun Huang commit 1165dd73e811a07d947aee218510571f516081f6 upstream. We can't handle the case length > WLAN_DATA_MAXLEN. Because the size of rxfrm->data is WLAN_DATA_MAXLEN(2312), and we can't read more than that. Thanks-to: Hillf Danton Reported-and-tested-by: syzbot+7d42d68643a35f71ac8a@syzkaller.appspotmail.com Signed-off-by: Qiujun Huang Cc: stable Link: https://lore.kernel.org/r/20200326131850.17711-1-hqjagain@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wlan-ng/hfa384x_usb.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/staging/wlan-ng/hfa384x_usb.c +++ b/drivers/staging/wlan-ng/hfa384x_usb.c @@ -3443,6 +3443,8 @@ static void hfa384x_int_rxmonitor(struct WLAN_HDR_A4_LEN + WLAN_DATA_MAXLEN + WLAN_CRC_LEN)) { pr_debug("overlen frm: len=%zd\n", skblen - sizeof(struct p80211_caphdr)); + + return; } skb = dev_alloc_skb(skblen); From patchwork Wed Apr 1 16:18:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228423 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2F94C2D0F0 for ; Wed, 1 Apr 2020 16:40:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7F28C206F8 for ; Wed, 1 Apr 2020 16:40:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759206; bh=Vb7rH95H+cRLRZgwZr5PFtUUZF7nYM9p+VSLhDZaSGI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jsxvAKiBz9xyKkDSrqq8huqaQCIFOadxyzGCrz1QshpNlS0H8M32IwSXncLrZZ7e6 sQdqHedBA1HJBPBL6qRR89bs9SEqEc0lvwF7zH9mHX6HqKhfbDCu1gNjdF7YSE3ooN Sip5SI9lgy6FTpgXZXzmDMedTMJm4QVsFMkRc0Uw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388928AbgDAQjz (ORCPT ); Wed, 1 Apr 2020 12:39:55 -0400 Received: from mail.kernel.org ([198.145.29.99]:39998 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388679AbgDAQjy (ORCPT ); Wed, 1 Apr 2020 12:39:54 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DF46420719; Wed, 1 Apr 2020 16:39:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759194; bh=Vb7rH95H+cRLRZgwZr5PFtUUZF7nYM9p+VSLhDZaSGI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ASNVZMZjpip4M9pEP2XUqeYWLZGbg8FdMlYA7PpPGkS3iLuPBAL9UcRNAfUFUsKYd sP9gKneb2dSxp4vF6YJqI2R+RA4FwHmUiTZD0UtkEwRTpz8/4RKeerCaMLzfzbeeMK St2hxQUHBnps4m1M9dNiOdKTA9UQomJEKj77Cw60= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede , Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 4.9 086/102] media: ov519: add missing endpoint sanity checks Date: Wed, 1 Apr 2020 18:18:29 +0200 Message-Id: <20200401161546.780346676@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold commit 998912346c0da53a6dbb71fab3a138586b596b30 upstream. Make sure to check that we have at least one endpoint before accessing the endpoint array to avoid dereferencing a NULL-pointer on stream start. Note that these sanity checks are not redundant as the driver is mixing looking up altsettings by index and by number, which need not coincide. Fixes: 1876bb923c98 ("V4L/DVB (12079): gspca_ov519: add support for the ov511 bridge") Fixes: b282d87332f5 ("V4L/DVB (12080): gspca_ov519: Fix ov518+ with OV7620AE (Trust spacecam 320)") Cc: stable # 2.6.31 Cc: Hans de Goede Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/gspca/ov519.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/drivers/media/usb/gspca/ov519.c +++ b/drivers/media/usb/gspca/ov519.c @@ -3482,6 +3482,11 @@ static void ov511_mode_init_regs(struct return; } + if (alt->desc.bNumEndpoints < 1) { + sd->gspca_dev.usb_err = -ENODEV; + return; + } + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); reg_w(sd, R51x_FIFO_PSIZE, packet_size >> 5); @@ -3607,6 +3612,11 @@ static void ov518_mode_init_regs(struct return; } + if (alt->desc.bNumEndpoints < 1) { + sd->gspca_dev.usb_err = -ENODEV; + return; + } + packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); ov518_reg_w32(sd, R51x_FIFO_PSIZE, packet_size & ~7, 2); From patchwork Wed Apr 1 16:18:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228424 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CABAC2D0F2 for ; Wed, 1 Apr 2020 16:40:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id DC01020658 for ; Wed, 1 Apr 2020 16:39:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759199; bh=SNq0Obhjt+WPW0WDsUFSj46mTAZUvRRP6sKr3x9ynv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=d9Z1nC6FugjpUwFs1WwtPJdAbNT001bD33mVwURqTjz8jLE7QasMxUVa/PXpyj3ho gtHOO778PuHPFCos4OhqM0wWXHhSAbgmk/51iZTTynfw/fVzYO0383t5hCJP7/9cYN pgmvM3TRnCvQPzVA27o7KdIRYbQ81qQZehzhz2GA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389113AbgDAQj6 (ORCPT ); Wed, 1 Apr 2020 12:39:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:40074 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388679AbgDAQj6 (ORCPT ); Wed, 1 Apr 2020 12:39:58 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EBC6E2063A; Wed, 1 Apr 2020 16:39:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759197; bh=SNq0Obhjt+WPW0WDsUFSj46mTAZUvRRP6sKr3x9ynv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gV/7AcodoUKbpP4AQmTD1HjUhNqR+CXChqQxRx6o+a//djVL8YXpIMQl7UwYGPCwT zFmayWlmulaJL4dmsJmBAHuwkmSZdEo0adfa/FEWE7kGWkdsU+WR7lSim1ZclhfGac ZJH8bCpsUmVNmGgBnOp2hfcGSsM376zh1eDm6uws= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Sean Young , Mauro Carvalho Chehab Subject: [PATCH 4.9 087/102] media: dib0700: fix rc endpoint lookup Date: Wed, 1 Apr 2020 18:18:30 +0200 Message-Id: <20200401161546.911682403@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Johan Hovold commit f52981019ad8d6718de79b425a574c6bddf81f7c upstream. Make sure to use the current alternate setting when verifying the interface descriptors to avoid submitting an URB to an invalid endpoint. Failing to do so could cause the driver to misbehave or trigger a WARN() in usb_submit_urb() that kernels with panic_on_warn set would choke on. Fixes: c4018fa2e4c0 ("[media] dib0700: fix RC support on Hauppauge Nova-TD") Cc: stable # 3.16 Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman --- drivers/media/usb/dvb-usb/dib0700_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/media/usb/dvb-usb/dib0700_core.c +++ b/drivers/media/usb/dvb-usb/dib0700_core.c @@ -812,7 +812,7 @@ int dib0700_rc_setup(struct dvb_usb_devi /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ - if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) + if (intf->cur_altsetting->desc.bNumEndpoints < rc_ep + 1) return -ENODEV; purb = usb_alloc_urb(0, GFP_KERNEL); @@ -832,7 +832,7 @@ int dib0700_rc_setup(struct dvb_usb_devi * Some devices like the Hauppauge NovaTD model 52009 use an interrupt * endpoint, while others use a bulk one. */ - e = &intf->altsetting[0].endpoint[rc_ep].desc; + e = &intf->cur_altsetting->endpoint[rc_ep].desc; if (usb_endpoint_dir_in(e)) { if (usb_endpoint_xfer_bulk(e)) { pipe = usb_rcvbulkpipe(d->udev, rc_ep); From patchwork Wed Apr 1 16:18:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228429 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2417DC2D0F3 for ; Wed, 1 Apr 2020 16:39:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A33C92166E for ; Wed, 1 Apr 2020 16:39:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759144; bh=GauZb6dHMyz2R4rmS5GEIj7YAt4mU6G0N83gbZEowaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=HnFWt6tJNrQN8qEUkxWWHr51CZlR1RGtTQ8PnqH4vL9iqIho1D6Bq76644iCugV4L 6Q5FJYBWo/cpcJmQRrZ5ZxDS0QU69HoADOY3mgF69/yml5lx0VQgiYMsEdy4mL3iET lFU7F3KJOc0QlTePahiMpTxExcue/NygNKLfa1YU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389146AbgDAQjC (ORCPT ); Wed, 1 Apr 2020 12:39:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:38882 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389151AbgDAQjB (ORCPT ); Wed, 1 Apr 2020 12:39:01 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 65D54214D8; Wed, 1 Apr 2020 16:39:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759140; bh=GauZb6dHMyz2R4rmS5GEIj7YAt4mU6G0N83gbZEowaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZIDbxPEdUvzycAEV1C3uOH/J0zEP9jhnegIrbLwQ/LOYafNLymY4zpP8ao7YUeKJL jTqBPim4FjYv2Yr8A1CcYwz9AvZAaZ6IH2mx643JnbQctHjxFbeE5sHXOExv0FjFyJ 6pcguVQo3Wd5378e07TnHee2U5/SJ+z6x8wJuHfE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jouni Malinen , Johannes Berg Subject: [PATCH 4.9 090/102] mac80211: Check port authorization in the ieee80211_tx_dequeue() case Date: Wed, 1 Apr 2020 18:18:33 +0200 Message-Id: <20200401161547.322161405@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jouni Malinen commit ce2e1ca703071723ca2dd94d492a5ab6d15050da upstream. mac80211 used to check port authorization in the Data frame enqueue case when going through start_xmit(). However, that authorization status may change while the frame is waiting in a queue. Add a similar check in the dequeue case to avoid sending previously accepted frames after authorization change. This provides additional protection against potential leaking of frames after a station has been disconnected and the keys for it are being removed. Cc: stable@vger.kernel.org Signed-off-by: Jouni Malinen Link: https://lore.kernel.org/r/20200326155133.ced84317ea29.I34d4c47cd8cc8a4042b38a76f16a601fbcbfd9b3@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman --- net/mac80211/tx.c | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) --- a/net/mac80211/tx.c +++ b/net/mac80211/tx.c @@ -3412,8 +3412,25 @@ begin: tx.skb = skb; tx.sdata = vif_to_sdata(info->control.vif); - if (txq->sta) + if (txq->sta) { tx.sta = container_of(txq->sta, struct sta_info, sta); + /* + * Drop unicast frames to unauthorised stations unless they are + * EAPOL frames from the local station. + */ + if (unlikely(!ieee80211_vif_is_mesh(&tx.sdata->vif) && + tx.sdata->vif.type != NL80211_IFTYPE_OCB && + !is_multicast_ether_addr(hdr->addr1) && + !test_sta_flag(tx.sta, WLAN_STA_AUTHORIZED) && + (!(info->control.flags & + IEEE80211_TX_CTRL_PORT_CTRL_PROTO) || + !ether_addr_equal(tx.sdata->vif.addr, + hdr->addr2)))) { + I802_DEBUG_INC(local->tx_handlers_drop_unauth_port); + ieee80211_free_txskb(&local->hw, skb); + goto begin; + } + } /* * The key can be removed while the packet was queued, so need to call From patchwork Wed Apr 1 16:18:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228347 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BAC0C2D0F0 for ; Wed, 1 Apr 2020 16:50:49 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E2F132063A for ; Wed, 1 Apr 2020 16:50:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759849; bh=IIJI3T9tX8Mz15Z7jrfZaEgMh0c9vgMMNhAxjgC02tY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2FKTzzEaAtx20ea/seCUgxI1/1KI4W5AdN3MvG4M5Ho7vfEpR6QXgNiIh5Vf+WdHm JizzHo7SKC8Bsgz2XoSW2x/vqRyU1l9hjdfhMZHmj3BeYDd3O3ws7Ff5PXvRsW/amy ECJKZc+UhdzLUSIg0MPIiBLlYeUvk2txi+2vIRBA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1732793AbgDAQur (ORCPT ); Wed, 1 Apr 2020 12:50:47 -0400 Received: from mail.kernel.org ([198.145.29.99]:38996 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389151AbgDAQjG (ORCPT ); Wed, 1 Apr 2020 12:39:06 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6EDEA20658; Wed, 1 Apr 2020 16:39:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759145; bh=IIJI3T9tX8Mz15Z7jrfZaEgMh0c9vgMMNhAxjgC02tY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bLYGtmtUvIYAtstpbfqoQWeWeJehetkUy5DmqcIo7MLbejLfpSQULIwOj9A1sphob ApIt+ym4/Lz9WWSf51qFEo25FW/NKCUyUVjlFiUDRWzZg0Rib3JHeZhCQZN88eQeJ/ jwkzovM+GMuxyvP0kwuw7LuAT+28sLVZKdMuy1KM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby Subject: [PATCH 4.9 092/102] vt: selection, introduce vc_is_sel Date: Wed, 1 Apr 2020 18:18:35 +0200 Message-Id: <20200401161547.584816193@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jiri Slaby commit dce05aa6eec977f1472abed95ccd71276b9a3864 upstream. Avoid global variables (namely sel_cons) by introducing vc_is_sel. It checks whether the parameter is the current selection console. This will help putting sel_cons to a struct later. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20200219073951.16151-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/selection.c | 5 +++++ drivers/tty/vt/vt.c | 7 ++++--- drivers/tty/vt/vt_ioctl.c | 2 +- include/linux/selection.h | 4 +++- 4 files changed, 13 insertions(+), 5 deletions(-) --- a/drivers/tty/vt/selection.c +++ b/drivers/tty/vt/selection.c @@ -80,6 +80,11 @@ void clear_selection(void) } } +bool vc_is_sel(struct vc_data *vc) +{ + return vc == sel_cons; +} + /* * User settable table: what characters are to be considered alphabetic? * 256 bits. Locked by the console lock. --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -595,8 +595,9 @@ static void hide_softcursor(struct vc_da static void hide_cursor(struct vc_data *vc) { - if (vc == sel_cons) + if (vc_is_sel(vc)) clear_selection(); + vc->vc_sw->con_cursor(vc, CM_ERASE); hide_softcursor(vc); } @@ -606,7 +607,7 @@ static void set_cursor(struct vc_data *v if (!con_is_fg(vc) || console_blanked || vc->vc_mode == KD_GRAPHICS) return; if (vc->vc_deccm) { - if (vc == sel_cons) + if (vc_is_sel(vc)) clear_selection(); add_softcursor(vc); if ((vc->vc_cursor_type & 0x0f) != 1) @@ -876,7 +877,7 @@ static int vc_do_resize(struct tty_struc if (!newscreen) return -ENOMEM; - if (vc == sel_cons) + if (vc_is_sel(vc)) clear_selection(); old_rows = vc->vc_rows; --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -42,7 +42,7 @@ char vt_dont_switch; extern struct tty_driver *console_driver; #define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count) -#define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_cons[i].d == sel_cons) +#define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_is_sel(vc_cons[i].d)) /* * Console (vt and kd) routines, as defined by USL SVR4 manual, and by --- a/include/linux/selection.h +++ b/include/linux/selection.h @@ -12,8 +12,8 @@ struct tty_struct; -extern struct vc_data *sel_cons; struct tty_struct; +struct vc_data; extern void clear_selection(void); extern int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *tty); @@ -22,6 +22,8 @@ extern int sel_loadlut(char __user *p); extern int mouse_reporting(void); extern void mouse_report(struct tty_struct * tty, int butt, int mrx, int mry); +bool vc_is_sel(struct vc_data *vc); + extern int console_blanked; extern const unsigned char color_table[]; From patchwork Wed Apr 1 16:18:36 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228348 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3D04C2D0F2 for ; Wed, 1 Apr 2020 16:50:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 42CF62063A for ; Wed, 1 Apr 2020 16:50:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759847; bh=FGNU3TYBhXMnbZGkwfxzJZXIqiI4/tL2Rs1aZdf+Y2Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=YTNMkvlq8BKMX2eo5EJDgCu8M0QSiVuph1lA+DSkGnp6KKNLuuOnA1VcxGXSVoxCW V2WWTf/eU+n2ZHgMVjwBsBUGzR2TVEN6DQlLnH1DceINArabAht+4v4iQ+0up7mkDm yq6vxugR+rhPiTcy3ydzTMLEUx6QCdj56LwzbMao= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389170AbgDAQjJ (ORCPT ); Wed, 1 Apr 2020 12:39:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:39044 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388630AbgDAQjJ (ORCPT ); Wed, 1 Apr 2020 12:39:09 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3A97320658; Wed, 1 Apr 2020 16:39:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759148; bh=FGNU3TYBhXMnbZGkwfxzJZXIqiI4/tL2Rs1aZdf+Y2Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=07qjBmRgwNVPMyfWloT9wSMIOU6iEP4uhhfsSMTadJz5ozzMl8eATv6GOT4CVWRtg TSSEnuK5ZhtDQP5JTiWTvu6qsKbdFNIh7RHCK669rbM4CaymcwbCcPfqADngIBxWcY YgfpYVEyq/L9pvmdL89vd1qJ7cdR1EpDRiShURXU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiri Slaby Subject: [PATCH 4.9 093/102] vt: ioctl, switch VT_IS_IN_USE and VT_BUSY to inlines Date: Wed, 1 Apr 2020 18:18:36 +0200 Message-Id: <20200401161547.738410989@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jiri Slaby commit e587e8f17433ddb26954f0edf5b2f95c42155ae9 upstream. These two were macros. Switch them to static inlines, so that it's more understandable what they are doing. Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20200219073951.16151-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/vt_ioctl.c | 29 ++++++++++++++++++++++------- 1 file changed, 22 insertions(+), 7 deletions(-) --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -39,10 +39,25 @@ #include char vt_dont_switch; -extern struct tty_driver *console_driver; -#define VT_IS_IN_USE(i) (console_driver->ttys[i] && console_driver->ttys[i]->count) -#define VT_BUSY(i) (VT_IS_IN_USE(i) || i == fg_console || vc_is_sel(vc_cons[i].d)) +static inline bool vt_in_use(unsigned int i) +{ + extern struct tty_driver *console_driver; + + return console_driver->ttys[i] && console_driver->ttys[i]->count; +} + +static inline bool vt_busy(int i) +{ + if (vt_in_use(i)) + return true; + if (i == fg_console) + return true; + if (vc_is_sel(vc_cons[i].d)) + return true; + + return false; +} /* * Console (vt and kd) routines, as defined by USL SVR4 manual, and by @@ -292,7 +307,7 @@ static int vt_disallocate(unsigned int v int ret = 0; console_lock(); - if (VT_BUSY(vc_num)) + if (vt_busy(vc_num)) ret = -EBUSY; else if (vc_num) vc = vc_deallocate(vc_num); @@ -314,7 +329,7 @@ static void vt_disallocate_all(void) console_lock(); for (i = 1; i < MAX_NR_CONSOLES; i++) - if (!VT_BUSY(i)) + if (!vt_busy(i)) vc[i] = vc_deallocate(i); else vc[i] = NULL; @@ -651,7 +666,7 @@ int vt_ioctl(struct tty_struct *tty, state = 1; /* /dev/tty0 is always open */ for (i = 0, mask = 2; i < MAX_NR_CONSOLES && mask; ++i, mask <<= 1) - if (VT_IS_IN_USE(i)) + if (vt_in_use(i)) state |= mask; ret = put_user(state, &vtstat->v_state); } @@ -664,7 +679,7 @@ int vt_ioctl(struct tty_struct *tty, case VT_OPENQRY: /* FIXME: locking ? - but then this is a stupid API */ for (i = 0; i < MAX_NR_CONSOLES; ++i) - if (! VT_IS_IN_USE(i)) + if (!vt_in_use(i)) break; uival = i < MAX_NR_CONSOLES ? (i+1) : -1; goto setint; From patchwork Wed Apr 1 16:18:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228428 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24446C43331 for ; Wed, 1 Apr 2020 16:39:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B0E2420658 for ; Wed, 1 Apr 2020 16:39:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759161; bh=PypZaYTitvy8LolVwS7vpU9UNlmKNFoE56b6Iu85KzI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pnk0wC9WGMp24rmBx3D2NGPBclo2Zb0XC7GQl9yBJ0bSEaOaS4ItU0+JDJMVooeBL Jub3A6PUhJtrMybUqnGjii9edxc5oeTGJ/JmqyP1icf6qxHeYKY6VFBQBpdLY4oZ7d 80zLyYE9gV6kdQOV72j8BOSOmhesIePUzXvRpbkk= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389183AbgDAQjU (ORCPT ); Wed, 1 Apr 2020 12:39:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:39258 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2388964AbgDAQjT (ORCPT ); Wed, 1 Apr 2020 12:39:19 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C8D4B20719; Wed, 1 Apr 2020 16:39:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759158; bh=PypZaYTitvy8LolVwS7vpU9UNlmKNFoE56b6Iu85KzI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JjCmaOS3yMqg3ReQ09WE+TAlQ10YdNhjqkEwAqgAkNEzPgA908BlNcZNwJMbsSU1C U7Imki1BQXcFccFyAweCGuk6oOFtHtmPQrvVZ3BgrRKsLSJJL4Gjz2WB4D3MBn3B0e 8w0W4vObLbmZKH7SVcPFqzyqO6YaQspHllq64SLU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+522643ab5729b0421998@syzkaller.appspotmail.com, Jiri Slaby , Eric Biggers Subject: [PATCH 4.9 096/102] vt: vt_ioctl: fix VT_DISALLOCATE freeing in-use virtual console Date: Wed, 1 Apr 2020 18:18:39 +0200 Message-Id: <20200401161548.146147636@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Biggers commit ca4463bf8438b403596edd0ec961ca0d4fbe0220 upstream. The VT_DISALLOCATE ioctl can free a virtual console while tty_release() is still running, causing a use-after-free in con_shutdown(). This occurs because VT_DISALLOCATE considers a virtual console's 'struct vc_data' to be unused as soon as the corresponding tty's refcount hits 0. But actually it may be still being closed. Fix this by making vc_data be reference-counted via the embedded 'struct tty_port'. A newly allocated virtual console has refcount 1. Opening it for the first time increments the refcount to 2. Closing it for the last time decrements the refcount (in tty_operations::cleanup() so that it happens late enough), as does VT_DISALLOCATE. Reproducer: #include #include #include #include int main() { if (fork()) { for (;;) close(open("/dev/tty5", O_RDWR)); } else { int fd = open("/dev/tty10", O_RDWR); for (;;) ioctl(fd, VT_DISALLOCATE, 5); } } KASAN report: BUG: KASAN: use-after-free in con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 Write of size 8 at addr ffff88806a4ec108 by task syz_vt/129 CPU: 0 PID: 129 Comm: syz_vt Not tainted 5.6.0-rc2 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20191223_100556-anatol 04/01/2014 Call Trace: [...] con_shutdown+0x76/0x80 drivers/tty/vt/vt.c:3278 release_tty+0xa8/0x410 drivers/tty/tty_io.c:1514 tty_release_struct+0x34/0x50 drivers/tty/tty_io.c:1629 tty_release+0x984/0xed0 drivers/tty/tty_io.c:1789 [...] Allocated by task 129: [...] kzalloc include/linux/slab.h:669 [inline] vc_allocate drivers/tty/vt/vt.c:1085 [inline] vc_allocate+0x1ac/0x680 drivers/tty/vt/vt.c:1066 con_install+0x4d/0x3f0 drivers/tty/vt/vt.c:3229 tty_driver_install_tty drivers/tty/tty_io.c:1228 [inline] tty_init_dev+0x94/0x350 drivers/tty/tty_io.c:1341 tty_open_by_driver drivers/tty/tty_io.c:1987 [inline] tty_open+0x3ca/0xb30 drivers/tty/tty_io.c:2035 [...] Freed by task 130: [...] kfree+0xbf/0x1e0 mm/slab.c:3757 vt_disallocate drivers/tty/vt/vt_ioctl.c:300 [inline] vt_ioctl+0x16dc/0x1e30 drivers/tty/vt/vt_ioctl.c:818 tty_ioctl+0x9db/0x11b0 drivers/tty/tty_io.c:2660 [...] Fixes: 4001d7b7fc27 ("vt: push down the tty lock so we can see what is left to tackle") Cc: # v3.4+ Reported-by: syzbot+522643ab5729b0421998@syzkaller.appspotmail.com Acked-by: Jiri Slaby Signed-off-by: Eric Biggers Link: https://lore.kernel.org/r/20200322034305.210082-2-ebiggers@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/tty/vt/vt.c | 23 ++++++++++++++++++++++- drivers/tty/vt/vt_ioctl.c | 12 ++++-------- 2 files changed, 26 insertions(+), 9 deletions(-) --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -754,6 +754,17 @@ static void visual_init(struct vc_data * vc->vc_screenbuf_size = vc->vc_rows * vc->vc_size_row; } +static void vc_port_destruct(struct tty_port *port) +{ + struct vc_data *vc = container_of(port, struct vc_data, port); + + kfree(vc); +} + +static const struct tty_port_operations vc_port_ops = { + .destruct = vc_port_destruct, +}; + int vc_allocate(unsigned int currcons) /* return 0 on success */ { struct vt_notifier_param param; @@ -779,6 +790,7 @@ int vc_allocate(unsigned int currcons) / vc_cons[currcons].d = vc; tty_port_init(&vc->port); + vc->port.ops = &vc_port_ops; INIT_WORK(&vc_cons[currcons].SAK_work, vc_SAK); visual_init(vc, currcons, 1); @@ -2897,6 +2909,7 @@ static int con_install(struct tty_driver tty->driver_data = vc; vc->port.tty = tty; + tty_port_get(&vc->port); if (!tty->winsize.ws_row && !tty->winsize.ws_col) { tty->winsize.ws_row = vc_cons[currcons].d->vc_rows; @@ -2932,6 +2945,13 @@ static void con_shutdown(struct tty_stru console_unlock(); } +static void con_cleanup(struct tty_struct *tty) +{ + struct vc_data *vc = tty->driver_data; + + tty_port_put(&vc->port); +} + static int default_color = 7; /* white */ static int default_italic_color = 2; // green (ASCII) static int default_underline_color = 3; // cyan (ASCII) @@ -3056,7 +3076,8 @@ static const struct tty_operations con_o .throttle = con_throttle, .unthrottle = con_unthrottle, .resize = vt_resize, - .shutdown = con_shutdown + .shutdown = con_shutdown, + .cleanup = con_cleanup, }; static struct cdev vc0_cdev; --- a/drivers/tty/vt/vt_ioctl.c +++ b/drivers/tty/vt/vt_ioctl.c @@ -313,10 +313,8 @@ static int vt_disallocate(unsigned int v vc = vc_deallocate(vc_num); console_unlock(); - if (vc && vc_num >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc->port); - kfree(vc); - } + if (vc && vc_num >= MIN_NR_CONSOLES) + tty_port_put(&vc->port); return ret; } @@ -336,10 +334,8 @@ static void vt_disallocate_all(void) console_unlock(); for (i = 1; i < MAX_NR_CONSOLES; i++) { - if (vc[i] && i >= MIN_NR_CONSOLES) { - tty_port_destroy(&vc[i]->port); - kfree(vc[i]); - } + if (vc[i] && i >= MIN_NR_CONSOLES) + tty_port_put(&vc[i]->port); } } From patchwork Wed Apr 1 16:18:40 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228427 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0F64C2BA12 for ; Wed, 1 Apr 2020 16:39:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A5E3A20857 for ; Wed, 1 Apr 2020 16:39:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759173; bh=zI1L8fWuxnVasn0HN2osMoOEJhb/uWGdUVBR50usJHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=xK0GGPSskDZ90i4R4w/L5Gu7VAEF3OboekfGGr5MW4kD28RdDQfabKme0FtW/Q3qc /J8SA6zFubqpsDqBNaslsZbepskTKzaxtBdW8gAoGSd7Z64r3sBOugDzRrzvRtjW7u T2HitcGWsmeHAV/i67JPTEb6BSvaheCSQJPr9V6s= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388613AbgDAQjZ (ORCPT ); Wed, 1 Apr 2020 12:39:25 -0400 Received: from mail.kernel.org ([198.145.29.99]:39310 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389171AbgDAQjY (ORCPT ); Wed, 1 Apr 2020 12:39:24 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 13E5B20719; Wed, 1 Apr 2020 16:39:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759162; bh=zI1L8fWuxnVasn0HN2osMoOEJhb/uWGdUVBR50usJHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MzpPFqYKXbJv/q6I2NMgp3/XTJKGlerhLJxcdV0qQXQfgPQD0w1WgHHAOg5BTw62e mgWYAlMY0u0Xlhute+Cbu6Wdm8qclqiWx4HjgvOxZKaj9UUg71nZTnQni79D2g49wQ dHdArfCjOFqiF7KdyyS2fU+k5KlAxP4Efy6DN44Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Peter Zijlstra (Intel)" , Andrew Morton , Linus Torvalds , "Paul E. McKenney" , Thomas Gleixner , Ingo Molnar Subject: [PATCH 4.9 097/102] locking/atomic, kref: Add kref_read() Date: Wed, 1 Apr 2020 18:18:40 +0200 Message-Id: <20200401161548.288744634@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peter Zijlstra commit 2c935bc57221cc2edc787c72ea0e2d30cdcd3d5e upstream. Since we need to change the implementation, stop exposing internals. Provide kref_read() to read the current reference count; typically used for debug messages. Kills two anti-patterns: atomic_read(&kref->refcount) kref->refcount.counter Signed-off-by: Peter Zijlstra (Intel) Cc: Andrew Morton Cc: Greg Kroah-Hartman Cc: Linus Torvalds Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-kernel@vger.kernel.org Signed-off-by: Ingo Molnar [only add kref_read() to kref.h for stable backports - gregkh] Signed-off-by: Greg Kroah-Hartman --- include/linux/kref.h | 5 +++++ 1 file changed, 5 insertions(+) --- a/include/linux/kref.h +++ b/include/linux/kref.h @@ -33,6 +33,11 @@ static inline void kref_init(struct kref atomic_set(&kref->refcount, 1); } +static inline int kref_read(const struct kref *kref) +{ + return atomic_read(&kref->refcount); +} + /** * kref_get - increment refcount for object. * @kref: object. From patchwork Wed Apr 1 16:18:42 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228349 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C1B6C43331 for ; Wed, 1 Apr 2020 16:50:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E741520714 for ; Wed, 1 Apr 2020 16:50:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759843; bh=RozGLdAyNS5qY69xcQRIDv3RdavXVgjOktEZjz26je4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=qBmNwOgv+mxZcj9sZ5xMWezXIiO9YfS0XcC4+NnnoBNJgIw2v82DPJzDCMhQ1rs26 lJoQOWUdyMwHRn85cIe3E7mscT8A54LyEOft6vTyNU4uBAyGod+9iV5N87KrQgoeya yq/NmrhwgEvlG9xgk5kbyu+VHUuOONqZSB7WsOlM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389201AbgDAQjd (ORCPT ); Wed, 1 Apr 2020 12:39:33 -0400 Received: from mail.kernel.org ([198.145.29.99]:39444 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387927AbgDAQj3 (ORCPT ); Wed, 1 Apr 2020 12:39:29 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id A64D720658; Wed, 1 Apr 2020 16:39:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759169; bh=RozGLdAyNS5qY69xcQRIDv3RdavXVgjOktEZjz26je4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a4J97ivJt+VD9k+svJ1S+6NCNlYNRkpIgJm5LB7KVgQDS7R8nODmhRbgJYdMClcD4 VpA2TYJWEpUSIxP0djvzoXaUrYD+Q6/oPz+n9NuBlrR0yKqJYcxD263u1c0wOpPpKC 5AswxUxdvoB89Ase2dY6rgF56issdBUkI/vR/EVY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?utf-8?q?Maciej_=C5=BBenczykowski?= , John Stultz , Alexander Potapenko , Alistair Delva , Daniel Borkmann , Yonghong Song Subject: [PATCH 4.9 099/102] bpf: Explicitly memset the bpf_attr structure Date: Wed, 1 Apr 2020 18:18:42 +0200 Message-Id: <20200401161548.607606712@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Greg Kroah-Hartman commit 8096f229421f7b22433775e928d506f0342e5907 upstream. For the bpf syscall, we are relying on the compiler to properly zero out the bpf_attr union that we copy userspace data into. Unfortunately that doesn't always work properly, padding and other oddities might not be correctly zeroed, and in some tests odd things have been found when the stack is pre-initialized to other values. Fix this by explicitly memsetting the structure to 0 before using it. Reported-by: Maciej Żenczykowski Reported-by: John Stultz Reported-by: Alexander Potapenko Reported-by: Alistair Delva Signed-off-by: Greg Kroah-Hartman Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Link: https://android-review.googlesource.com/c/kernel/common/+/1235490 Link: https://lore.kernel.org/bpf/20200320094813.GA421650@kroah.com Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/syscall.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -802,7 +802,7 @@ static int bpf_obj_get(const union bpf_a SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, size) { - union bpf_attr attr = {}; + union bpf_attr attr; int err; if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) @@ -838,6 +838,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf } /* copy attributes from user space, may be less than sizeof(bpf_attr) */ + memset(&attr, 0, sizeof(attr)); if (copy_from_user(&attr, uattr, size) != 0) return -EFAULT; From patchwork Wed Apr 1 16:18:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 228426 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE9E4C2D0F0 for ; Wed, 1 Apr 2020 16:39:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 644FC212CC for ; Wed, 1 Apr 2020 16:39:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759178; bh=+QjJUEGMxz7btAbAYm/jsWclNxRzd5u/I7HJPsrbUmo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=D2zAL1q1IjaCTeoI15UZ4q2auFIlK2qurve80WF6oZwL1RazvLnMxETOY0WRTNBKO IVprhb6Zr65d9GXw5PtbFkbIrjDkDEGHY9/ck5zjvve0wEN88MHZyhfsF0CCdAx9b1 n91Fnyzqv9BLJQhwYmJg3cxaVovlryXya1zY67NA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388704AbgDAQjg (ORCPT ); Wed, 1 Apr 2020 12:39:36 -0400 Received: from mail.kernel.org ([198.145.29.99]:39572 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389206AbgDAQjf (ORCPT ); Wed, 1 Apr 2020 12:39:35 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 16D7820772; Wed, 1 Apr 2020 16:39:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1585759174; bh=+QjJUEGMxz7btAbAYm/jsWclNxRzd5u/I7HJPsrbUmo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TA2wrM4Cxaxm1pvH3sln+hbdhZiEB3LzaSSSmT1Ac5l1MJXFK3fgSCaywibGd3g8Z eVLFRbQb7AEX65xlSlHy3dor2WU5jPURNuOoFRV2rLTzj6XlMuKIZ+ttpIMYUD2PPI T4wJqvFCfQzIuIngxb9d5cuSldqFd0/octEqdcjE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Vasut , "David S. Miller" , Lukas Wunner , Petr Stetiar , YueHaibing Subject: [PATCH 4.9 100/102] net: ks8851-ml: Fix IO operations, again Date: Wed, 1 Apr 2020 18:18:43 +0200 Message-Id: <20200401161548.762755367@linuxfoundation.org> X-Mailer: git-send-email 2.26.0 In-Reply-To: <20200401161530.451355388@linuxfoundation.org> References: <20200401161530.451355388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Vasut commit 8262e6f9b1034ede34548a04dec4c302d92c9497 upstream. This patch reverts 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") and edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access"), because it turns out these were only necessary due to buggy hardware. This patch adds a check for such a buggy hardware to prevent any such mistakes again. While working further on the KS8851 driver, it came to light that the KS8851-16MLL is capable of switching bus endianness by a hardware strap, EESK pin. If this strap is incorrect, the IO accesses require such endian swapping as is being reverted by this patch. Such swapping also impacts the performance significantly. Hence, in addition to removing it, detect that the hardware is broken, report to user, and fail to bind with such hardware. Fixes: 58292104832f ("net: ks8851-ml: Fix 16-bit IO operation") Fixes: edacb098ea9c ("net: ks8851-ml: Fix 16-bit data access") Signed-off-by: Marek Vasut Cc: David S. Miller Cc: Lukas Wunner Cc: Petr Stetiar Cc: YueHaibing Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/micrel/ks8851_mll.c | 56 ++++++++++++++++++++++++++++--- 1 file changed, 52 insertions(+), 4 deletions(-) --- a/drivers/net/ethernet/micrel/ks8851_mll.c +++ b/drivers/net/ethernet/micrel/ks8851_mll.c @@ -475,6 +475,50 @@ static int msg_enable; */ /** + * ks_check_endian - Check whether endianness of the bus is correct + * @ks : The chip information + * + * The KS8851-16MLL EESK pin allows selecting the endianness of the 16bit + * bus. To maintain optimum performance, the bus endianness should be set + * such that it matches the endianness of the CPU. + */ + +static int ks_check_endian(struct ks_net *ks) +{ + u16 cider; + + /* + * Read CIDER register first, however read it the "wrong" way around. + * If the endian strap on the KS8851-16MLL in incorrect and the chip + * is operating in different endianness than the CPU, then the meaning + * of BE[3:0] byte-enable bits is also swapped such that: + * BE[3,2,1,0] becomes BE[1,0,3,2] + * + * Luckily for us, the byte-enable bits are the top four MSbits of + * the address register and the CIDER register is at offset 0xc0. + * Hence, by reading address 0xc0c0, which is not impacted by endian + * swapping, we assert either BE[3:2] or BE[1:0] while reading the + * CIDER register. + * + * If the bus configuration is correct, reading 0xc0c0 asserts + * BE[3:2] and this read returns 0x0000, because to read register + * with bottom two LSbits of address set to 0, BE[1:0] must be + * asserted. + * + * If the bus configuration is NOT correct, reading 0xc0c0 asserts + * BE[1:0] and this read returns non-zero 0x8872 value. + */ + iowrite16(BE3 | BE2 | KS_CIDER, ks->hw_addr_cmd); + cider = ioread16(ks->hw_addr); + if (!cider) + return 0; + + netdev_err(ks->netdev, "incorrect EESK endian strap setting\n"); + + return -EINVAL; +} + +/** * ks_rdreg16 - read 16 bit register from device * @ks : The chip information * @offset: The register address @@ -484,7 +528,7 @@ static int msg_enable; static u16 ks_rdreg16(struct ks_net *ks, int offset) { - ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02)); + ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02)); iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd); return ioread16(ks->hw_addr); } @@ -499,7 +543,7 @@ static u16 ks_rdreg16(struct ks_net *ks, static void ks_wrreg16(struct ks_net *ks, int offset, u16 value) { - ks->cmd_reg_cache = (u16)offset | ((BE3 | BE2) >> (offset & 0x02)); + ks->cmd_reg_cache = (u16)offset | ((BE1 | BE0) << (offset & 0x02)); iowrite16(ks->cmd_reg_cache, ks->hw_addr_cmd); iowrite16(value, ks->hw_addr); } @@ -515,7 +559,7 @@ static inline void ks_inblk(struct ks_ne { len >>= 1; while (len--) - *wptr++ = be16_to_cpu(ioread16(ks->hw_addr)); + *wptr++ = (u16)ioread16(ks->hw_addr); } /** @@ -529,7 +573,7 @@ static inline void ks_outblk(struct ks_n { len >>= 1; while (len--) - iowrite16(cpu_to_be16(*wptr++), ks->hw_addr); + iowrite16(*wptr++, ks->hw_addr); } static void ks_disable_int(struct ks_net *ks) @@ -1535,6 +1579,10 @@ static int ks8851_probe(struct platform_ goto err_free; } + err = ks_check_endian(ks); + if (err) + goto err_free; + netdev->irq = platform_get_irq(pdev, 0); if ((int)netdev->irq < 0) {