From patchwork Mon Oct 12 13:26:24 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270387 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88771C43467 for ; Mon, 12 Oct 2020 13:34:29 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 51B052074F for ; Mon, 12 Oct 2020 13:34:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509669; bh=mf2qh4WZVg4my0bCzetvDhzrQB7CqPMDZIobCTaGKyo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=xWypHG/D3v79TkZu7N8TqAVCI+gJIUIDt8S9TZbafAuWz9xTIUjnT8KWodjjbIDNf fQDfX85rogOyDU/TidntXVRqDEJ1LnXNw5kzVfno3lgDT/HGsr0CBu61ok7qWPhkEm uECgt8Y9DqE94CTx52lhx31/Mf7imy6G2VAMqLN8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730645AbgJLNe2 (ORCPT ); Mon, 12 Oct 2020 09:34:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:36756 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729297AbgJLNeX (ORCPT ); Mon, 12 Oct 2020 09:34:23 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6938221D7F; Mon, 12 Oct 2020 13:33:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509623; bh=mf2qh4WZVg4my0bCzetvDhzrQB7CqPMDZIobCTaGKyo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iLZ690hde+Ju7bQRUR4RHmy7tN3ZzF/MlyAOCuz2xPFcdZqCduWQBBnFSiehP8DXh 7fA5vzFVH2Rrt1t3hM88SB4NJwA1x+FMD8lCMiRkJLUseZiPx+X+rckzbgNI8Li8dx uB01gbnzk4eeSLQ8OK/XtUpd6NbUy5n2xJC/wgrg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefan Hajnoczi , "Michael S. Tsirkin" , Stefano Garzarella , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 02/54] vsock/virtio: stop workers during the .remove() Date: Mon, 12 Oct 2020 15:26:24 +0200 Message-Id: <20201012132629.711227488@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Stefano Garzarella [ Upstream commit 17dd1367389cfe7f150790c83247b68e0c19d106 ] Before to call vdev->config->reset(vdev) we need to be sure that no one is accessing the device, for this reason, we add new variables in the struct virtio_vsock to stop the workers during the .remove(). This patch also add few comments before vdev->config->reset(vdev) and vdev->config->del_vqs(vdev). Suggested-by: Stefan Hajnoczi Suggested-by: Michael S. Tsirkin Signed-off-by: Stefano Garzarella Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/vmw_vsock/virtio_transport.c | 46 +++++++++++++++++++++++++++++++- 1 file changed, 45 insertions(+), 1 deletion(-) diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c index 32ad7cfa5fa74..67aba63b5c96d 100644 --- a/net/vmw_vsock/virtio_transport.c +++ b/net/vmw_vsock/virtio_transport.c @@ -39,6 +39,7 @@ struct virtio_vsock { * must be accessed with tx_lock held. */ struct mutex tx_lock; + bool tx_run; struct work_struct send_pkt_work; spinlock_t send_pkt_list_lock; @@ -50,6 +51,7 @@ struct virtio_vsock { * must be accessed with rx_lock held. */ struct mutex rx_lock; + bool rx_run; int rx_buf_nr; int rx_buf_max_nr; @@ -57,6 +59,7 @@ struct virtio_vsock { * vqs[VSOCK_VQ_EVENT] must be accessed with event_lock held. */ struct mutex event_lock; + bool event_run; struct virtio_vsock_event event_list[8]; u32 guest_cid; @@ -91,6 +94,9 @@ virtio_transport_send_pkt_work(struct work_struct *work) mutex_lock(&vsock->tx_lock); + if (!vsock->tx_run) + goto out; + vq = vsock->vqs[VSOCK_VQ_TX]; for (;;) { @@ -147,6 +153,7 @@ virtio_transport_send_pkt_work(struct work_struct *work) if (added) virtqueue_kick(vq); +out: mutex_unlock(&vsock->tx_lock); if (restart_rx) @@ -230,6 +237,10 @@ static void virtio_transport_tx_work(struct work_struct *work) vq = vsock->vqs[VSOCK_VQ_TX]; mutex_lock(&vsock->tx_lock); + + if (!vsock->tx_run) + goto out; + do { struct virtio_vsock_pkt *pkt; unsigned int len; @@ -240,6 +251,8 @@ static void virtio_transport_tx_work(struct work_struct *work) added = true; } } while (!virtqueue_enable_cb(vq)); + +out: mutex_unlock(&vsock->tx_lock); if (added) @@ -268,6 +281,9 @@ static void virtio_transport_rx_work(struct work_struct *work) mutex_lock(&vsock->rx_lock); + if (!vsock->rx_run) + goto out; + do { virtqueue_disable_cb(vq); for (;;) { @@ -376,6 +392,9 @@ static void virtio_transport_event_work(struct work_struct *work) mutex_lock(&vsock->event_lock); + if (!vsock->event_run) + goto out; + do { struct virtio_vsock_event *event; unsigned int len; @@ -390,7 +409,7 @@ static void virtio_transport_event_work(struct work_struct *work) } while (!virtqueue_enable_cb(vq)); virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]); - +out: mutex_unlock(&vsock->event_lock); } @@ -521,12 +540,18 @@ static int virtio_vsock_probe(struct virtio_device *vdev) INIT_WORK(&vsock->event_work, virtio_transport_event_work); INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work); + mutex_lock(&vsock->tx_lock); + vsock->tx_run = true; + mutex_unlock(&vsock->tx_lock); + mutex_lock(&vsock->rx_lock); virtio_vsock_rx_fill(vsock); + vsock->rx_run = true; mutex_unlock(&vsock->rx_lock); mutex_lock(&vsock->event_lock); virtio_vsock_event_fill(vsock); + vsock->event_run = true; mutex_unlock(&vsock->event_lock); vdev->priv = vsock; @@ -560,6 +585,24 @@ static void virtio_vsock_remove(struct virtio_device *vdev) /* Reset all connected sockets when the device disappear */ vsock_for_each_connected_socket(virtio_vsock_reset_sock); + /* Stop all work handlers to make sure no one is accessing the device, + * so we can safely call vdev->config->reset(). + */ + mutex_lock(&vsock->rx_lock); + vsock->rx_run = false; + mutex_unlock(&vsock->rx_lock); + + mutex_lock(&vsock->tx_lock); + vsock->tx_run = false; + mutex_unlock(&vsock->tx_lock); + + mutex_lock(&vsock->event_lock); + vsock->event_run = false; + mutex_unlock(&vsock->event_lock); + + /* Flush all device writes and interrupts, device will not use any + * more buffers. + */ vdev->config->reset(vdev); mutex_lock(&vsock->rx_lock); @@ -581,6 +624,7 @@ static void virtio_vsock_remove(struct virtio_device *vdev) } spin_unlock_bh(&vsock->send_pkt_list_lock); + /* Delete virtqueues and flush outstanding callbacks if any */ vdev->config->del_vqs(vdev); mutex_unlock(&the_virtio_vsock_mutex); From patchwork Mon Oct 12 13:26:25 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 317649 Delivered-To: patch@linaro.org Received: by 2002:a92:d603:0:0:0:0:0 with SMTP id w3csp4653916ilm; Mon, 12 Oct 2020 07:06:46 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyjznt1TVH8DSiOGZc1OSRzCDWSDW//TY/YU3rdCjYyVxAfphrMGKFEAG6wK0CBKWWaAKhm X-Received: by 2002:a17:906:26ce:: with SMTP id u14mr27265353ejc.78.1602511606409; Mon, 12 Oct 2020 07:06:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1602511606; cv=none; d=google.com; s=arc-20160816; b=mV2MNAv59zXonCwsNIDM8LzoALUGxFm810ljqt2+wn8WLeFIE6nRgzy+CTeBU7GEpi YwUPFuRkTj9ibkCYoTQLREXMRLFzzbLK+ACD7cBfSCa6/wBo6bBVy1dFmevb5ODLcxtf U+uV1QHG0GUSgnuP2ZMjoCWf/dC7LYkAARVa+QNNOG8YaYIndGGbOd4T00YMWILb7TfH dvJhx/XGTVcS3ur2nQstHkKq7eAf7DIudpCsxpVHI4ytvy1eApmpgY/YK+OIQQfQ9jaj sdEKoNtv3h4EvkL/D+IcZccvZRpo0BC+VbvsyyNCy95tmMW8DIHM+vvOGgrwytpWJb4D p67w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=8IrJaWVq3WQUHaHw2pdfe357OyFOM68B9/JDB4S+m4I=; b=EXNkMbo3DLouEGieM2370YIQYyZBTRzJ5alsfRaay+XPOsLKDpgu3l4E5ZKsykVKPv aSveq1tdHV6b0tjWJePI75aaJHcaLZfsLYXLXZ43JSUa/xfJnh4fwM/8kKG055Z/NIxu J4p3oZJve979N15u2dP69oAhyk8haIJaLVVcRr724r58tWrhvWlADHvBH9q0WLpF49j0 wiqzDYmMduM6ny7AOaIqGdBLul/wb1uMxC2ATTCz+GVRNLKXg/5TRYqhQOXaEK/TDzwN kg/N28HFWcdKS2qBMpKWyV85N2nvVC6p9pmrF8S6JgYxF34TiWy2WZ7uICo38Y/BOv5j yTwA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=j+04lByq; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id r22si11625622eju.372.2020.10.12.07.06.46; Mon, 12 Oct 2020 07:06:46 -0700 (PDT) Received-SPF: pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=j+04lByq; spf=pass (google.com: domain of stable-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=stable-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391105AbgJLOGm (ORCPT + 15 others); Mon, 12 Oct 2020 10:06:42 -0400 Received: from mail.kernel.org ([198.145.29.99]:36758 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730618AbgJLNeX (ORCPT ); Mon, 12 Oct 2020 09:34:23 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B131121BE5; Mon, 12 Oct 2020 13:33:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509626; bh=H4+IAAdHH8z6G7ZjURbGAk2EVjqEvP1hJA0gKTsMC7E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j+04lByqPn8yuhJWwCobk+7Azrkw4eU0d0vJLcmj30vRSHJUe7dbkEmSynvbrkcX7 c661CJKUv2+LOIDqwk6CL2JB4KACUm/Xf3Wi2lqPVbjK3qVacqwiA6UbUWslC3u+BA jCPrj7WYG+154fp3/BZuIpNIkcW91poUxWRLxyhw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ilja Van Sprundel , Brooke Basile , stable , Bryan ODonoghue Subject: [PATCH 4.9 03/54] USB: gadget: f_ncm: Fix NDP16 datagram validation Date: Mon, 12 Oct 2020 15:26:25 +0200 Message-Id: <20201012132629.763422990@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Bryan O'Donoghue commit 2b405533c2560d7878199c57d95a39151351df72 upstream. commit 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()") adds important bounds checking however it unfortunately also introduces a bug with respect to section 3.3.1 of the NCM specification. wDatagramIndex[1] : "Byte index, in little endian, of the second datagram described by this NDP16. If zero, then this marks the end of the sequence of datagrams in this NDP16." wDatagramLength[1]: "Byte length, in little endian, of the second datagram described by this NDP16. If zero, then this marks the end of the sequence of datagrams in this NDP16." wDatagramIndex[1] and wDatagramLength[1] respectively then may be zero but that does not mean we should throw away the data referenced by wDatagramIndex[0] and wDatagramLength[0] as is currently the case. Breaking the loop on (index2 == 0 || dg_len2 == 0) should come at the end as was previously the case and checks for index2 and dg_len2 should be removed since zero is valid. I'm not sure how much testing the above patch received but for me right now after enumeration ping doesn't work. Reverting the commit restores ping, scp, etc. The extra validation associated with wDatagramIndex[0] and wDatagramLength[0] appears to be valid so, this change removes the incorrect restriction on wDatagramIndex[1] and wDatagramLength[1] restoring data processing between host and device. Fixes: 2b74b0a04d3e ("USB: gadget: f_ncm: add bounds checks to ncm_unwrap_ntb()") Cc: Ilja Van Sprundel Cc: Brooke Basile Cc: stable Signed-off-by: Bryan O'Donoghue Link: https://lore.kernel.org/r/20200920170158.1217068-1-bryan.odonoghue@linaro.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/gadget/function/f_ncm.c | 30 ++---------------------------- 1 file changed, 2 insertions(+), 28 deletions(-) --- a/drivers/usb/gadget/function/f_ncm.c +++ b/drivers/usb/gadget/function/f_ncm.c @@ -1217,7 +1217,6 @@ static int ncm_unwrap_ntb(struct gether const struct ndp_parser_opts *opts = ncm->parser_opts; unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0; int dgram_counter; - bool ndp_after_header; /* dwSignature */ if (get_unaligned_le32(tmp) != opts->nth_sign) { @@ -1244,7 +1243,6 @@ static int ncm_unwrap_ntb(struct gether } ndp_index = get_ncm(&tmp, opts->ndp_index); - ndp_after_header = false; /* Run through all the NDP's in the NTB */ do { @@ -1260,8 +1258,6 @@ static int ncm_unwrap_ntb(struct gether ndp_index); goto err; } - if (ndp_index == opts->nth_size) - ndp_after_header = true; /* * walk through NDP @@ -1340,37 +1336,13 @@ static int ncm_unwrap_ntb(struct gether index2 = get_ncm(&tmp, opts->dgram_item_len); dg_len2 = get_ncm(&tmp, opts->dgram_item_len); - if (index2 == 0 || dg_len2 == 0) - break; - /* wDatagramIndex[1] */ - if (ndp_after_header) { - if (index2 < opts->nth_size + opts->ndp_size) { - INFO(port->func.config->cdev, - "Bad index: %#X\n", index2); - goto err; - } - } else { - if (index2 < opts->nth_size + opts->dpe_size) { - INFO(port->func.config->cdev, - "Bad index: %#X\n", index2); - goto err; - } - } if (index2 > block_len - opts->dpe_size) { INFO(port->func.config->cdev, "Bad index: %#X\n", index2); goto err; } - /* wDatagramLength[1] */ - if ((dg_len2 < 14 + crc_len) || - (dg_len2 > frame_max)) { - INFO(port->func.config->cdev, - "Bad dgram length: %#X\n", dg_len); - goto err; - } - /* * Copy the data into a new skb. * This ensures the truesize is correct @@ -1387,6 +1359,8 @@ static int ncm_unwrap_ntb(struct gether ndp_len -= 2 * (opts->dgram_item_len * 2); dgram_counter++; + if (index2 == 0 || dg_len2 == 0) + break; } while (ndp_len > 2 * (opts->dgram_item_len * 2)); } while (ndp_index); From patchwork Mon Oct 12 13:26:29 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270386 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99D7CC43457 for ; Mon, 12 Oct 2020 13:34:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6114320878 for ; Mon, 12 Oct 2020 13:34:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509672; bh=omDmb/EHkfaofnfyWtsh79Yx1RS9yvzCCe9Y5cUMIIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vR/UMAVv1gow7hdcN7trShZn4JFsYBjx/jD+nG4+xl3TWmfFn7HNnyYT3CZcCCmHE HkIsPR6sDovtcuOSSvc2rjhsDXPy0tApcNbYI82vtZxmv8HQ9YAspfKTw5/2D9H1oX 9v6qKrFuoVO1dDNbkfeWxdxbN1W8921ZteARkxg8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730668AbgJLNea (ORCPT ); Mon, 12 Oct 2020 09:34:30 -0400 Received: from mail.kernel.org ([198.145.29.99]:36764 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730603AbgJLNeW (ORCPT ); Mon, 12 Oct 2020 09:34:22 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 3279522202; Mon, 12 Oct 2020 13:33:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509635; bh=omDmb/EHkfaofnfyWtsh79Yx1RS9yvzCCe9Y5cUMIIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BPjTJpWaMqr+bIuDG3soBXgVxQGmJXAuiFSYWd48DBPyhoarx0d10M3qBEgqlM3bR Fp8G3FB3Qx4an3DW/Yi15KP11eZFXaajNekPn7CgHEBOzWEyJA4I0alzd90FR5qwCe 58irUReg9s0XCI8fdEKwijUGKgmm9t4XtYF/eA8U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucy Yan , Moritz Fischer , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 07/54] net: dec: de2104x: Increase receive ring size for Tulip Date: Mon, 12 Oct 2020 15:26:29 +0200 Message-Id: <20201012132629.932476281@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Lucy Yan [ Upstream commit ee460417d254d941dfea5fb7cff841f589643992 ] Increase Rx ring size to address issue where hardware is reaching the receive work limit. Before: [ 102.223342] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.245695] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.251387] de2104x 0000:17:00.0 eth0: rx work limit reached [ 102.267444] de2104x 0000:17:00.0 eth0: rx work limit reached Signed-off-by: Lucy Yan Reviewed-by: Moritz Fischer Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/ethernet/dec/tulip/de2104x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c index cadcee645f74e..11ce50a057998 100644 --- a/drivers/net/ethernet/dec/tulip/de2104x.c +++ b/drivers/net/ethernet/dec/tulip/de2104x.c @@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi #define DSL CONFIG_DE2104X_DSL #endif -#define DE_RX_RING_SIZE 64 +#define DE_RX_RING_SIZE 128 #define DE_TX_RING_SIZE 64 #define DE_RING_BYTES \ ((sizeof(struct de_desc) * DE_RX_RING_SIZE) + \ From patchwork Mon Oct 12 13:26:30 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270204 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9B8D1C43457 for ; Mon, 12 Oct 2020 14:06:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3DFF020757 for ; Mon, 12 Oct 2020 14:06:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511576; bh=XHhT+BWI5pRqE+V74UmBpgVn+ChE0exEXSay7jL+qHA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=Yosuu8ONGxDnM2GUoU0cjQbTXQe6X9FgYD1wDDyrgTtAEB87KKMVG35FBC4MZbpB1 PRPD/oFBYToiU7DPMjr7acqIu4kk85PS+oOUr/d8iiZ0V371Y+YZhjKiBaqOl7GqGp h8Q4g+38QJ6FqbDshpgeoGu8MUYcVlyJAEHShyY4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730639AbgJLNe2 (ORCPT ); Mon, 12 Oct 2020 09:34:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:36768 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730583AbgJLNeX (ORCPT ); Mon, 12 Oct 2020 09:34:23 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7FF5F221FE; Mon, 12 Oct 2020 13:33:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509638; bh=XHhT+BWI5pRqE+V74UmBpgVn+ChE0exEXSay7jL+qHA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Uvs/GUYIkobip4yzjoldn/PAL5ilLhnprLPld9KBnktCAQMlXHatVqVaeByH6HrqH Tpxzc9dFO/lgaQH3ib9cwxgIGO00Yrw0XI1Z8qChRzr0IkDFgid4wwPOFBURiqfipU /Hozm0SQCYGQ9Rcue4uLRpjeG96V59ex0uB+31qQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Olympia Giannou , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 08/54] rndis_host: increase sleep time in the query-response loop Date: Mon, 12 Oct 2020 15:26:30 +0200 Message-Id: <20201012132629.979198020@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Olympia Giannou [ Upstream commit 4202c9fdf03d79dedaa94b2c4cf574f25793d669 ] Some WinCE devices face connectivity issues via the NDIS interface. They fail to register, resulting in -110 timeout errors and failures during the probe procedure. In this kind of WinCE devices, the Windows-side ndis driver needs quite more time to be loaded and configured, so that the linux rndis host queries to them fail to be responded correctly on time. More specifically, when INIT is called on the WinCE side - no other requests can be served by the Client and this results in a failed QUERY afterwards. The increase of the waiting time on the side of the linux rndis host in the command-response loop leaves the INIT process to complete and respond to a QUERY, which comes afterwards. The WinCE devices with this special "feature" in their ndis driver are satisfied by this fix. Signed-off-by: Olympia Giannou Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/usb/rndis_host.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 4f4f71b2966ba..9ccbdf1431063 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen) dev_dbg(&info->control->dev, "rndis response error, code %d\n", retval); } - msleep(20); + msleep(40); } dev_dbg(&info->control->dev, "rndis response timeout\n"); return -ETIMEDOUT; From patchwork Mon Oct 12 13:26:33 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270197 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42E71C433DF for ; Mon, 12 Oct 2020 14:08:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 06239208B6 for ; Mon, 12 Oct 2020 14:08:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511699; bh=KIAdlPqGQxBzYeo+gHSe7Aij7Mx4SkWPk5L0TTbEbic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=SmkLVTsMa8RwwjZv/r7eFeYlpkypMSZH17wcXp+jFOhpsNUXcsTF/VZezCmG4a4Sm uvg5nvvTpj265pNwBOPjTdT4XB8oiA/ue7AVUI2Yb35Nh4Q+14yf0NY71cLbhl1Nj5 yD6RGIWhGEoslHCXDbNnG8EZ2ogzhx1LTc+gcuqQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388590AbgJLOIS (ORCPT ); Mon, 12 Oct 2020 10:08:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:35718 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389170AbgJLNdf (ORCPT ); Mon, 12 Oct 2020 09:33:35 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id EBE3420BED; Mon, 12 Oct 2020 13:33:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509614; bh=KIAdlPqGQxBzYeo+gHSe7Aij7Mx4SkWPk5L0TTbEbic=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pLwAYSsxWaWArGKtn0B430Rpy8e85E5uvwNXFBFm8RGE1h6sXRp4L3Pm2oJW2EkRz owfcvSARAFl+Td2k6CnG/Zlaw9kVWyUHybT0Vv+nh3zzA3nqz5NQ+935cD2Zn8C+3j JWfmG3AuF+AVxgQRql2hhMWqUOQr9WjI2Pq1lW0Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felix Fietkau , Johannes Berg , Sasha Levin Subject: [PATCH 4.9 11/54] mac80211: do not allow bigger VHT MPDUs than the hardware supports Date: Mon, 12 Oct 2020 15:26:33 +0200 Message-Id: <20201012132630.108139595@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Felix Fietkau [ Upstream commit 3bd5c7a28a7c3aba07a2d300d43f8e988809e147 ] Limit maximum VHT MPDU size by local capability. Signed-off-by: Felix Fietkau Link: https://lore.kernel.org/r/20200917125031.45009-1-nbd@nbd.name Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/mac80211/vht.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c index 43e45bb660bcd..b1d3fa708e16b 100644 --- a/net/mac80211/vht.c +++ b/net/mac80211/vht.c @@ -170,10 +170,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, /* take some capabilities as-is */ cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info); vht_cap->cap = cap_info; - vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 | - IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 | - IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 | - IEEE80211_VHT_CAP_RXLDPC | + vht_cap->cap &= IEEE80211_VHT_CAP_RXLDPC | IEEE80211_VHT_CAP_VHT_TXOP_PS | IEEE80211_VHT_CAP_HTC_VHT | IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK | @@ -182,6 +179,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata, IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN | IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN; + vht_cap->cap |= min_t(u32, cap_info & IEEE80211_VHT_CAP_MAX_MPDU_MASK, + own_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK); + /* and some based on our own capabilities */ switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) { case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ: From patchwork Mon Oct 12 13:26:35 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270199 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 739C4C43467 for ; Mon, 12 Oct 2020 14:08:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4441520776 for ; Mon, 12 Oct 2020 14:08:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511689; bh=YZJgG45Syrl+fEpFOfI4hwqWnh1G2Cjf9HsFfsX3gnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=xxuQNe0FYUURSh39JXcZsDL3CA5kiz0n0xXjnJW+cRKywsjBxdSMP4nXdMOupobr6 yFpNO3/hyJj3hi1/UtQ0KGCNZk69FnBXuconRQ04aZR56H9LeWoVH48HZ5KVRMusy7 uxBvq+JEPmuSNZjnVuBm4FPZa6XOVWfgu97uQct8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391181AbgJLOHp (ORCPT ); Mon, 12 Oct 2020 10:07:45 -0400 Received: from mail.kernel.org ([198.145.29.99]:36738 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2389228AbgJLNeW (ORCPT ); Mon, 12 Oct 2020 09:34:22 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C4CB72076E; Mon, 12 Oct 2020 13:33:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509619; bh=YZJgG45Syrl+fEpFOfI4hwqWnh1G2Cjf9HsFfsX3gnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EW9nb5HMPyVSgnmwsl2KyKZIFk7tS2CeJe5go0tO5gjSUFMbrCICi7nIG/BG9jLw+ 7/d79VuFidAQgD/ELHa37tiiwZgB8l4PBrMHjyZMgX8L3LDsvZccchdCqHHlNEuwqe Cr4Ut9rtRHaDElKGXmXwoGRd0CNAFyW3RWcC0wJ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marek Szyprowski , Krzysztof Kozlowski , Sylwester Nawrocki , Stephen Boyd , Sasha Levin Subject: [PATCH 4.9 13/54] clk: samsung: exynos4: mark chipid clock as CLK_IGNORE_UNUSED Date: Mon, 12 Oct 2020 15:26:35 +0200 Message-Id: <20201012132630.200726142@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Marek Szyprowski [ Upstream commit f3bb0f796f5ffe32f0fbdce5b1b12eb85511158f ] The ChipID IO region has it's own clock, which is being disabled while scanning for unused clocks. It turned out that some CPU hotplug, CPU idle or even SOC firmware code depends on the reads from that area. Fix the mysterious hang caused by entering deep CPU idle state by ignoring the 'chipid' clock during unused clocks scan, as there are no direct clients for it which will keep it enabled. Fixes: e062b571777f ("clk: exynos4: register clocks using common clock framework") Signed-off-by: Marek Szyprowski Link: https://lore.kernel.org/r/20200922124046.10496-1-m.szyprowski@samsung.com Reviewed-by: Krzysztof Kozlowski Acked-by: Sylwester Nawrocki Signed-off-by: Stephen Boyd Signed-off-by: Sasha Levin --- drivers/clk/samsung/clk-exynos4.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c index 91f9b79e39411..9a9402f568ef6 100644 --- a/drivers/clk/samsung/clk-exynos4.c +++ b/drivers/clk/samsung/clk-exynos4.c @@ -1060,7 +1060,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = { GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0), GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0), GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0), - GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0), + GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0, @@ -1101,7 +1101,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = { 0), GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0), GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0), - GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0), + GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0), GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1, CLK_IGNORE_UNUSED, 0), GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0, From patchwork Mon Oct 12 13:26:37 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270379 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40FB5C433E7 for ; Mon, 12 Oct 2020 13:36:02 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D8BD82076E for ; Mon, 12 Oct 2020 13:36:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509761; bh=u04UTY/9Gc6U+pNEmqKBde2TzDcfYSXtBIjnN5RzrUk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VaDPaz4Mdu4usPYHaM5XcMdzZLN+baEMnxzjf8fNjRVrHwBG6XIqhG09sxWgALB3V 2Y5d1SkiKgOoYU8yTDD8jkQ0WvRibhCJf4onfjCOtSgfVgPzAOuBdjEljtynTEG0mz hJZ0d0YNWAwEzM+cDIar5yd74uBop171c2NzfG4U= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730943AbgJLNf7 (ORCPT ); Mon, 12 Oct 2020 09:35:59 -0400 Received: from mail.kernel.org ([198.145.29.99]:37900 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730281AbgJLNfU (ORCPT ); Mon, 12 Oct 2020 09:35:20 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B15D222202; Mon, 12 Oct 2020 13:35:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509719; bh=u04UTY/9Gc6U+pNEmqKBde2TzDcfYSXtBIjnN5RzrUk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UVWM70aQe+W0psP0DsLTIRUbRIL2ZFwpwp9r46/zXI1mfD4W81/Y71i4oxIey/g/h ml/f+BHIdIq0Ah8SdRU3FVxE7rIolDM6rQRlRKwWC0Y/uhdhkggPyc2CXXK/4Evk0M /N/fAkv2k0DPNM2bE5GPIJnybpsz02gXTZYOJu7Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nicolas VINCENT , Jochen Friedrich , Christophe Leroy , Wolfram Sang , Sasha Levin Subject: [PATCH 4.9 15/54] i2c: cpm: Fix i2c_ram structure Date: Mon, 12 Oct 2020 15:26:37 +0200 Message-Id: <20201012132630.299601074@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Nicolas VINCENT [ Upstream commit a2bd970aa62f2f7f80fd0d212b1d4ccea5df4aed ] the i2c_ram structure is missing the sdmatmp field mentionned in datasheet for MPC8272 at paragraph 36.5. With this field missing, the hardware would write past the allocated memory done through cpm_muram_alloc for the i2c_ram structure and land in memory allocated for the buffers descriptors corrupting the cbd_bufaddr field. Since this field is only set during setup(), the first i2c transaction would work and the following would send data read from an arbitrary memory location. Fixes: 61045dbe9d8d ("i2c: Add support for I2C bus on Freescale CPM1/CPM2 controllers") Signed-off-by: Nicolas VINCENT Acked-by: Jochen Friedrich Acked-by: Christophe Leroy Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin --- drivers/i2c/busses/i2c-cpm.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c index d89bde2c5da25..cf285b97a6422 100644 --- a/drivers/i2c/busses/i2c-cpm.c +++ b/drivers/i2c/busses/i2c-cpm.c @@ -74,6 +74,9 @@ struct i2c_ram { char res1[4]; /* Reserved */ ushort rpbase; /* Relocation pointer */ char res2[2]; /* Reserved */ + /* The following elements are only for CPM2 */ + char res3[4]; /* Reserved */ + uint sdmatmp; /* Internal */ }; #define I2COM_START 0x80 From patchwork Mon Oct 12 13:26:38 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270382 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 930F6C43457 for ; Mon, 12 Oct 2020 13:35:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 4576422203 for ; Mon, 12 Oct 2020 13:35:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509725; bh=B8bN0SlsYkWgo9AGboq+O4z9fS5fi6QNspkzVApY1OI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=CX51kTSD5ux1LLp0eRiiV700KH/V0SuI0mGLEESWcMVlqlDwzFegdBxiVzSRVouMC P+p8y2zgC0iQjhLyi6XB/Nz/mmUi9ta90njNxSmjwxtqJ4UzsGRZ8iOEZgsequ6Dhz GR48xEjBzVl5/h/xpF9xxFT9Y1bbpr4E2nX+EbGU= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730657AbgJLNe3 (ORCPT ); Mon, 12 Oct 2020 09:34:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:36782 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730623AbgJLNeX (ORCPT ); Mon, 12 Oct 2020 09:34:23 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 752212222A; Mon, 12 Oct 2020 13:34:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509645; bh=B8bN0SlsYkWgo9AGboq+O4z9fS5fi6QNspkzVApY1OI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OLvJhO5G1rj5OB6PgPgHOk6tYyOmNtkY7wgWv2deXNlYt5cRre6uiXrnO5R6C/YF1 9NMscl0XdORUqjtm6dQWj9peiMbBzd4xUKHq5RNFm3wbNbdiFpn9FbPe8F0HI6vmvO /WmjIdpbnHfZ4mKv2qYsVIiFIV+dLqwucCYhCUFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Willy Tarreau , Emese Revfy , Thibaut Sautereau , Linus Torvalds , Sasha Levin Subject: [PATCH 4.9 16/54] random32: Restore __latent_entropy attribute on net_rand_state Date: Mon, 12 Oct 2020 15:26:38 +0200 Message-Id: <20201012132630.349516268@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Thibaut Sautereau [ Upstream commit 09a6b0bc3be793ca8cba580b7992d73e9f68f15d ] Commit f227e3ec3b5c ("random32: update the net random state on interrupt and activity") broke compilation and was temporarily fixed by Linus in 83bdc7275e62 ("random32: remove net_rand_state from the latent entropy gcc plugin") by entirely moving net_rand_state out of the things handled by the latent_entropy GCC plugin. >From what I understand when reading the plugin code, using the __latent_entropy attribute on a declaration was the wrong part and simply keeping the __latent_entropy attribute on the variable definition was the correct fix. Fixes: 83bdc7275e62 ("random32: remove net_rand_state from the latent entropy gcc plugin") Acked-by: Willy Tarreau Cc: Emese Revfy Signed-off-by: Thibaut Sautereau Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- lib/random32.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/random32.c b/lib/random32.c index 889dab44bd747..d5c3137d93f49 100644 --- a/lib/random32.c +++ b/lib/random32.c @@ -47,7 +47,7 @@ static inline void prandom_state_selftest(void) } #endif -DEFINE_PER_CPU(struct rnd_state, net_rand_state); +DEFINE_PER_CPU(struct rnd_state, net_rand_state) __latent_entropy; /** * prandom_u32_state - seeded pseudo-random number generator. From patchwork Mon Oct 12 13:26:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270385 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E3F7C433DF for ; Mon, 12 Oct 2020 13:34:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id CE9E520838 for ; Mon, 12 Oct 2020 13:34:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509698; bh=z3+prIcdo/jLC3VpEESws0UfaJtKsVE6ehu/FanrpjE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=uz9Nn6udo2+Lwjuc6vupg7moLxBDl9rXWHAP7JRBJc214IBw4IdCvzLpCGlPA7BRi +uG/38diiC2i0X8mkj6AHR85LBEKFIoifiahqANtDSMN+hJ8Rg4Z+Q8yFT3VyqO9dO 8C1TEMqjcIVBFOADbLoiVCi6l+jrpeaPChH1DmqM= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730339AbgJLNe6 (ORCPT ); Mon, 12 Oct 2020 09:34:58 -0400 Received: from mail.kernel.org ([198.145.29.99]:36966 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730260AbgJLNeb (ORCPT ); Mon, 12 Oct 2020 09:34:31 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 019D420678; Mon, 12 Oct 2020 13:34:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509670; bh=z3+prIcdo/jLC3VpEESws0UfaJtKsVE6ehu/FanrpjE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MFYZffnbPXv1kavoyxBOBTmDLS1P9Xgv7HSuOUwJ0U+mZM76BLNG0iP4Dh4cfazas ZK6ouPXrvcmy5aiFG5kzb06rdgj8Igduf0+soWA+K3eg82YxNjOXkdGPcl/cdkLrgf p1RQ82AzU95zbQr1rLCt8AjXr8V7MCj8GGP8u2EE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Or Cohen , Eric Dumazet , Linus Torvalds , Stefan Nuernberger , David Woodhouse , Amit Shah Subject: [PATCH 4.9 17/54] net/packet: fix overflow in tpacket_rcv Date: Mon, 12 Oct 2020 15:26:39 +0200 Message-Id: <20201012132630.392196471@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Or Cohen commit acf69c946233259ab4d64f8869d4037a198c7f06 upstream. Using tp_reserve to calculate netoff can overflow as tp_reserve is unsigned int and netoff is unsigned short. This may lead to macoff receving a smaller value then sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr is set, an out-of-bounds write will occur when calling virtio_net_hdr_from_skb. The bug is fixed by converting netoff to unsigned int and checking if it exceeds USHRT_MAX. This addresses CVE-2020-14386 Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt") Signed-off-by: Or Cohen Signed-off-by: Eric Dumazet Signed-off-by: Linus Torvalds [ snu: backported to pre-5.3, changed tp_drops counting/locking ] Signed-off-by: Stefan Nuernberger CC: David Woodhouse CC: Amit Shah CC: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman --- net/packet/af_packet.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -2161,7 +2161,8 @@ static int tpacket_rcv(struct sk_buff *s int skb_len = skb->len; unsigned int snaplen, res; unsigned long status = TP_STATUS_USER; - unsigned short macoff, netoff, hdrlen; + unsigned short macoff, hdrlen; + unsigned int netoff; struct sk_buff *copy_skb = NULL; struct timespec ts; __u32 ts_status; @@ -2223,6 +2224,12 @@ static int tpacket_rcv(struct sk_buff *s } macoff = netoff - maclen; } + if (netoff > USHRT_MAX) { + spin_lock(&sk->sk_receive_queue.lock); + po->stats.stats1.tp_drops++; + spin_unlock(&sk->sk_receive_queue.lock); + goto drop_n_restore; + } if (po->tp_version <= TPACKET_V2) { if (macoff + snaplen > po->rx_ring.frame_size) { if (po->copy_thresh && From patchwork Mon Oct 12 13:26:41 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270209 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0A250C433DF for ; Mon, 12 Oct 2020 14:05:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C638E2074D for ; Mon, 12 Oct 2020 14:05:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511527; bh=sudRuVoU4xgj+VKWusNGnCB196jQ2NRCgcBSSzuH7Tg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=zg0abHTnfWbRCyQHr7qWJiDPFiYwJvovf6DcD3AijFI7Ko1soUSJj5D2B0lGHyot9 Tz3DHbzKYT5e6PXj3iXNN0e7eGqlwMRlfLpYRStrCvcSlgjCJKAHtwe6pgPNLe0Pq9 oOowxnH1wuvBLuS1bxUnPpO/+E/gHB9LG9suDnmc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390974AbgJLOF1 (ORCPT ); Mon, 12 Oct 2020 10:05:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:37648 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730767AbgJLNfG (ORCPT ); Mon, 12 Oct 2020 09:35:06 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D678C20838; Mon, 12 Oct 2020 13:35:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509705; bh=sudRuVoU4xgj+VKWusNGnCB196jQ2NRCgcBSSzuH7Tg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jz40Xm6474P0L4KqP5Yjd/zhK8BWnWnofoo5NgTyH+zubyrdsqTBMgbJPmHRTuBfl foULEJ1ROH0Y67nWQ62LVncpMrNZ6ZXVHBUoh0EYLsKd4kA86dep2lel3DuV5MJwFz b8v2IPVVKAOkfA3GPltXaM+ZpQfSY4ka4a1Es1pc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro Subject: [PATCH 4.9 19/54] epoll: replace ->visited/visited_list with generation count Date: Mon, 12 Oct 2020 15:26:41 +0200 Message-Id: <20201012132630.489208929@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Al Viro commit 18306c404abe18a0972587a6266830583c60c928 upstream. removes the need to clear it, along with the races. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/eventpoll.c | 26 +++++++------------------- 1 file changed, 7 insertions(+), 19 deletions(-) --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -222,8 +222,7 @@ struct eventpoll { struct file *file; /* used to optimize loop detection check */ - int visited; - struct list_head visited_list_link; + u64 gen; }; /* Wait structure used by the poll hooks */ @@ -267,6 +266,8 @@ static long max_user_watches __read_most */ static DEFINE_MUTEX(epmutex); +static u64 loop_check_gen = 0; + /* Used to check for epoll file descriptor inclusion loops */ static struct nested_calls poll_loop_ncalls; @@ -282,9 +283,6 @@ static struct kmem_cache *epi_cache __re /* Slab cache used to allocate "struct eppoll_entry" */ static struct kmem_cache *pwq_cache __read_mostly; -/* Visited nodes during ep_loop_check(), so we can unset them when we finish */ -static LIST_HEAD(visited_list); - /* * List of files with newly added links, where we may need to limit the number * of emanating paths. Protected by the epmutex. @@ -1724,13 +1722,12 @@ static int ep_loop_check_proc(void *priv struct epitem *epi; mutex_lock_nested(&ep->mtx, call_nests + 1); - ep->visited = 1; - list_add(&ep->visited_list_link, &visited_list); + ep->gen = loop_check_gen; for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) { epi = rb_entry(rbp, struct epitem, rbn); if (unlikely(is_file_epoll(epi->ffd.file))) { ep_tovisit = epi->ffd.file->private_data; - if (ep_tovisit->visited) + if (ep_tovisit->gen == loop_check_gen) continue; error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ep_loop_check_proc, epi->ffd.file, @@ -1771,18 +1768,8 @@ static int ep_loop_check_proc(void *priv */ static int ep_loop_check(struct eventpoll *ep, struct file *file) { - int ret; - struct eventpoll *ep_cur, *ep_next; - - ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, + return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS, ep_loop_check_proc, file, ep, current); - /* clear visited list */ - list_for_each_entry_safe(ep_cur, ep_next, &visited_list, - visited_list_link) { - ep_cur->visited = 0; - list_del(&ep_cur->visited_list_link); - } - return ret; } static void clear_tfile_check_list(void) @@ -1999,6 +1986,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, in error_tgt_fput: if (full_check) { clear_tfile_check_list(); + loop_check_gen++; mutex_unlock(&epmutex); } From patchwork Mon Oct 12 13:26:43 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270208 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC2BAC433DF for ; Mon, 12 Oct 2020 14:05:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9EE5D2074D for ; Mon, 12 Oct 2020 14:05:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511538; bh=ezOUzcrUIiadmFHTCXkiPhveMCAMHY6T5StkAf66SzY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=VWbYoGmoPukR7Y8XviLJSbF8PKpBIqfgJrXoJeBfReWOblqmRyzAIIERZBMfSqAc7 iKYSIzXKTAJwy29CJucnWjr8m3HDP+8THdIsufw2wm2RexCCddbvER7CGAmzM/vM7Y u/hUZcopJJwxruQhCyVh7NE82JedDRDdXVyliaSI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390971AbgJLOF0 (ORCPT ); Mon, 12 Oct 2020 10:05:26 -0400 Received: from mail.kernel.org ([198.145.29.99]:37732 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729949AbgJLNfK (ORCPT ); Mon, 12 Oct 2020 09:35:10 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 769FF221FE; Mon, 12 Oct 2020 13:35:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509710; bh=ezOUzcrUIiadmFHTCXkiPhveMCAMHY6T5StkAf66SzY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xKshFr3sbNnBY5Lh6pJ8CWdt9Y3QpaM7LYFWMJaZtJycILkqiKuIHFntDRz26DEE8 x8xz+3JFHcAok5Tta0BFPZft/6kVhsuSv9QpveLfYmsl9oc5RjkS/4t5AGHyPpxHNL //RHYz90LKJzm5cUB+k7cBga0jUokQpX+y3P6ye8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro Subject: [PATCH 4.9 21/54] ep_create_wakeup_source(): dentry name can change under you... Date: Mon, 12 Oct 2020 15:26:43 +0200 Message-Id: <20201012132630.569922401@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Al Viro commit 3701cb59d892b88d569427586f01491552f377b1 upstream. or get freed, for that matter, if it's a long (separately stored) name. Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/eventpoll.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1260,7 +1260,7 @@ static int reverse_path_check(void) static int ep_create_wakeup_source(struct epitem *epi) { - const char *name; + struct name_snapshot n; struct wakeup_source *ws; if (!epi->ep->ws) { @@ -1269,8 +1269,9 @@ static int ep_create_wakeup_source(struc return -ENOMEM; } - name = epi->ffd.file->f_path.dentry->d_name.name; - ws = wakeup_source_register(name); + take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry); + ws = wakeup_source_register(n.name); + release_dentry_name_snapshot(&n); if (!ws) return -ENOMEM; From patchwork Mon Oct 12 13:26:46 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270210 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C7C0FC43457 for ; Mon, 12 Oct 2020 14:05:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8EC5F2074D for ; Mon, 12 Oct 2020 14:05:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511524; bh=3hi9m9Cnj4WTgtPvSnSz+apK7xXQCPwDRaPgs7QdrGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=T6WvTiw0oaeRmwQBLLIerkX18/t8wwNpZOuhAZhOfXYdyW/D6P0uxLuKWUO1DH7B+ auH7tS459bRmvmDR+qafsTDPrRoWovGeiwCIAqb6LTCa3XKk9AdCvtmqyETxUZAoRW CkN8iBO+5FWGy/j1FjaStlQGAnbXUXnal0RQZ6o8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730806AbgJLOFS (ORCPT ); Mon, 12 Oct 2020 10:05:18 -0400 Received: from mail.kernel.org ([198.145.29.99]:37880 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730797AbgJLNfS (ORCPT ); Mon, 12 Oct 2020 09:35:18 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5B856221FC; Mon, 12 Oct 2020 13:35:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509716; bh=3hi9m9Cnj4WTgtPvSnSz+apK7xXQCPwDRaPgs7QdrGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bZytaSl5JyUzuIfDR1pa2uemMlfA2m7XlyYCXRLPsyYvGACLI7pyL2aaTufPvWs/n mHPduohZ3iaYhdfKUAGQN9pwEkkf+UIOJOeUIRjne8PhnanuV4DmD6jj9j2u3/zeHl 4vSJowi9EKEUPc0vh9boNtcOyghNnwgK9fg2Cd9M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Daniel Vetter Subject: [PATCH 4.9 24/54] Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts Date: Mon, 12 Oct 2020 15:26:46 +0200 Message-Id: <20201012132630.700226039@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit 6735b4632def0640dbdf4eb9f99816aca18c4f16 upstream. syzbot has reported an issue in the framebuffer layer, where a malicious user may overflow our built-in font data buffers. In order to perform a reliable range check, subsystems need to know `FONTDATAMAX` for each built-in font. Unfortunately, our font descriptor, `struct console_font` does not contain `FONTDATAMAX`, and is part of the UAPI, making it infeasible to modify it. For user-provided fonts, the framebuffer layer resolves this issue by reserving four extra words at the beginning of data buffers. Later, whenever a function needs to access them, it simply uses the following macros: Recently we have gathered all the above macros to . Let us do the same thing for built-in fonts, prepend four extra words (including `FONTDATAMAX`) to their data buffers, so that subsystems can use these macros for all fonts, no matter built-in or user-provided. This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h". Cc: stable@vger.kernel.org Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd Signed-off-by: Peilin Ye Reviewed-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/ef18af00c35fb3cc826048a5f70924ed6ddce95b.1600953813.git.yepeilin.cs@gmail.com Signed-off-by: Greg Kroah-Hartman --- include/linux/font.h | 5 +++++ lib/fonts/font_10x18.c | 9 ++++----- lib/fonts/font_6x10.c | 9 +++++---- lib/fonts/font_6x11.c | 9 ++++----- lib/fonts/font_7x14.c | 9 ++++----- lib/fonts/font_8x16.c | 9 ++++----- lib/fonts/font_8x8.c | 9 ++++----- lib/fonts/font_acorn_8x8.c | 9 ++++++--- lib/fonts/font_mini_4x6.c | 8 ++++---- lib/fonts/font_pearl_8x8.c | 9 ++++----- lib/fonts/font_sun12x22.c | 9 ++++----- lib/fonts/font_sun8x16.c | 7 ++++--- 12 files changed, 52 insertions(+), 49 deletions(-) --- a/include/linux/font.h +++ b/include/linux/font.h @@ -65,4 +65,9 @@ extern const struct font_desc *get_defau #define FONT_EXTRA_WORDS 4 +struct font_data { + unsigned int extra[FONT_EXTRA_WORDS]; + const unsigned char data[]; +} __packed; + #endif /* _VIDEO_FONT_H */ --- a/lib/fonts/font_10x18.c +++ b/lib/fonts/font_10x18.c @@ -7,8 +7,8 @@ #define FONTDATAMAX 9216 -static const unsigned char fontdata_10x18[FONTDATAMAX] = { - +static struct font_data fontdata_10x18 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ @@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x1 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ 0x00, 0x00, /* 0000000000 */ - -}; +} }; const struct font_desc font_10x18 = { @@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = { .name = "10x18", .width = 10, .height = 18, - .data = fontdata_10x18, + .data = fontdata_10x18.data, #ifdef __sparc__ .pref = 5, #else --- a/lib/fonts/font_6x10.c +++ b/lib/fonts/font_6x10.c @@ -1,7 +1,9 @@ #include -static const unsigned char fontdata_6x10[] = { +#define FONTDATAMAX 2560 +static struct font_data fontdata_6x10 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_6x10 = { .idx = FONT6x10_IDX, .name = "6x10", .width = 6, .height = 10, - .data = fontdata_6x10, + .data = fontdata_6x10.data, .pref = 0, }; --- a/lib/fonts/font_6x11.c +++ b/lib/fonts/font_6x11.c @@ -8,8 +8,8 @@ #define FONTDATAMAX (11*256) -static const unsigned char fontdata_6x11[FONTDATAMAX] = { - +static struct font_data fontdata_6x11 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_6x11 = { @@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = { .name = "ProFont6x11", .width = 6, .height = 11, - .data = fontdata_6x11, + .data = fontdata_6x11.data, /* Try avoiding this font if possible unless on MAC */ .pref = -2000, }; --- a/lib/fonts/font_7x14.c +++ b/lib/fonts/font_7x14.c @@ -7,8 +7,8 @@ #define FONTDATAMAX 3584 -static const unsigned char fontdata_7x14[FONTDATAMAX] = { - +static struct font_data fontdata_7x14 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 0000000 */ 0x00, /* 0000000 */ @@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14 0x00, /* 0000000 */ 0x00, /* 0000000 */ 0x00, /* 0000000 */ - -}; +} }; const struct font_desc font_7x14 = { @@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = { .name = "7x14", .width = 7, .height = 14, - .data = fontdata_7x14, + .data = fontdata_7x14.data, .pref = 0, }; --- a/lib/fonts/font_8x16.c +++ b/lib/fonts/font_8x16.c @@ -9,8 +9,8 @@ #define FONTDATAMAX 4096 -static const unsigned char fontdata_8x16[FONTDATAMAX] = { - +static struct font_data fontdata_8x16 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_8x16 = { @@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = { .name = "VGA8x16", .width = 8, .height = 16, - .data = fontdata_8x16, + .data = fontdata_8x16.data, .pref = 0, }; EXPORT_SYMBOL(font_vga_8x16); --- a/lib/fonts/font_8x8.c +++ b/lib/fonts/font_8x8.c @@ -8,8 +8,8 @@ #define FONTDATAMAX 2048 -static const unsigned char fontdata_8x8[FONTDATAMAX] = { - +static struct font_data fontdata_8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[ 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_vga_8x8 = { @@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = { .name = "VGA8x8", .width = 8, .height = 8, - .data = fontdata_8x8, + .data = fontdata_8x8.data, .pref = 0, }; --- a/lib/fonts/font_acorn_8x8.c +++ b/lib/fonts/font_acorn_8x8.c @@ -2,7 +2,10 @@ #include -static const unsigned char acorndata_8x8[] = { +#define FONTDATAMAX 2048 + +static struct font_data acorndata_8x8 = { +{ 0, 0, FONTDATAMAX, 0 }, { /* 00 */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */ /* 01 */ 0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */ /* 02 */ 0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */ @@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8 /* FD */ 0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00, /* FE */ 0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00, /* FF */ 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 -}; +} }; const struct font_desc font_acorn_8x8 = { .idx = ACORN8x8_IDX, .name = "Acorn8x8", .width = 8, .height = 8, - .data = acorndata_8x8, + .data = acorndata_8x8.data, #ifdef CONFIG_ARCH_ACORN .pref = 20, #else --- a/lib/fonts/font_mini_4x6.c +++ b/lib/fonts/font_mini_4x6.c @@ -43,8 +43,8 @@ __END__; #define FONTDATAMAX 1536 -static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = { - +static struct font_data fontdata_mini_4x6 = { + { 0, 0, FONTDATAMAX, 0 }, { /*{*/ /* Char 0: ' ' */ 0xee, /*= [*** ] */ @@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini 0xee, /*= [*** ] */ 0x00, /*= [ ] */ /*}*/ -}; +} }; const struct font_desc font_mini_4x6 = { .idx = MINI4x6_IDX, .name = "MINI4x6", .width = 4, .height = 6, - .data = fontdata_mini_4x6, + .data = fontdata_mini_4x6.data, .pref = 3, }; --- a/lib/fonts/font_pearl_8x8.c +++ b/lib/fonts/font_pearl_8x8.c @@ -13,8 +13,8 @@ #define FONTDATAMAX 2048 -static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = { - +static struct font_data fontdata_pearl8x8 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ @@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pear 0x00, /* 00000000 */ 0x00, /* 00000000 */ 0x00, /* 00000000 */ - -}; +} }; const struct font_desc font_pearl_8x8 = { .idx = PEARL8x8_IDX, .name = "PEARL8x8", .width = 8, .height = 8, - .data = fontdata_pearl8x8, + .data = fontdata_pearl8x8.data, .pref = 2, }; --- a/lib/fonts/font_sun12x22.c +++ b/lib/fonts/font_sun12x22.c @@ -2,8 +2,8 @@ #define FONTDATAMAX 11264 -static const unsigned char fontdata_sun12x22[FONTDATAMAX] = { - +static struct font_data fontdata_sun12x22 = { + { 0, 0, FONTDATAMAX, 0 }, { /* 0 0x00 '^@' */ 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ @@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun1 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ 0x00, 0x00, /* 000000000000 */ - -}; +} }; const struct font_desc font_sun_12x22 = { @@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = .name = "SUN12x22", .width = 12, .height = 22, - .data = fontdata_sun12x22, + .data = fontdata_sun12x22.data, #ifdef __sparc__ .pref = 5, #else --- a/lib/fonts/font_sun8x16.c +++ b/lib/fonts/font_sun8x16.c @@ -2,7 +2,8 @@ #define FONTDATAMAX 4096 -static const unsigned char fontdata_sun8x16[FONTDATAMAX] = { +static struct font_data fontdata_sun8x16 = { +{ 0, 0, FONTDATAMAX, 0 }, { /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00, @@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8 /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00, /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00, -}; +} }; const struct font_desc font_sun_8x16 = { .idx = SUN8x16_IDX, .name = "SUN8x16", .width = 8, .height = 16, - .data = fontdata_sun8x16, + .data = fontdata_sun8x16.data, #ifdef __sparc__ .pref = 10, #else From patchwork Mon Oct 12 13:26:47 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270201 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8BAE5C433E7 for ; Mon, 12 Oct 2020 14:06:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 51C512080D for ; Mon, 12 Oct 2020 14:06:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511601; bh=yS1r1UBTDMPm7jip7j1VkAgdBj3p4UJo4rbsI63Irv8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=qRv13zC5WUVk/cP9W0S9U1LlB+ExJRDFVaXI7FIAR2cdBZEI8bC3yBmMKGX1CGTDN 5gVtgUbWf1Rk5hd7VpA1HKYNIok5uQ2BlTpUkuU20nnZSaDXDpUDALcNf1Z+wALaxe dCLWXDLc6Uszqow8qJcB6u7FdGDFlKsDVGF0YvyE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390808AbgJLOGk (ORCPT ); Mon, 12 Oct 2020 10:06:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:36784 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730629AbgJLNeY (ORCPT ); Mon, 12 Oct 2020 09:34:24 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id BEF0722203; Mon, 12 Oct 2020 13:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509647; bh=yS1r1UBTDMPm7jip7j1VkAgdBj3p4UJo4rbsI63Irv8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tznA6sLJU+dDtucqEVe7wo37rTNuQ4lZiZdt36OUTxRkUCFjem+n8gSlR+FPir2P5 7DacJKzTKmfrNfu3LNlcsKuF9yrM2L+u2m4dwFmvY4Gs+b23akuL2Qi8bk/EbD7rfp AR/awww5uye4MkvVg9c7T2vn5pFo9lExpEXHxSus= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Sergei Shtylyov , "David S. Miller" Subject: [PATCH 4.9 25/54] Revert "ravb: Fixed to be able to unload modules" Date: Mon, 12 Oct 2020 15:26:47 +0200 Message-Id: <20201012132630.754606012@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Geert Uytterhoeven commit 77972b55fb9d35d4a6b0abca99abffaa4ec6a85b upstream. This reverts commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc. This commit moved the ravb_mdio_init() call (and thus the of_mdiobus_register() call) from the ravb_probe() to the ravb_open() call. This causes a regression during system resume (s2idle/s2ram), as new PHY devices cannot be bound while suspended. During boot, the Micrel PHY is detected like this: Micrel KSZ9031 Gigabit PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Micrel KSZ9031 Gigabit PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=228) ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off During system suspend, (A) defer_all_probes is set to true, and (B) usermodehelper_disabled is set to UMH_DISABLED, to avoid drivers being probed while suspended. A. If CONFIG_MODULES=n, phy_device_register() calling device_add() merely adds the device, but does not probe it yet, as really_probe() returns early due to defer_all_probes being set: dpm_resume+0x128/0x4f8 device_resume+0xcc/0x1b0 dpm_run_callback+0x74/0x340 ravb_resume+0x190/0x1b8 ravb_open+0x84/0x770 of_mdiobus_register+0x1e0/0x468 of_mdiobus_register_phy+0x1b8/0x250 of_mdiobus_phy_device_register+0x178/0x1e8 phy_device_register+0x114/0x1b8 device_add+0x3d4/0x798 bus_probe_device+0x98/0xa0 device_initial_probe+0x10/0x18 __device_attach+0xe4/0x140 bus_for_each_drv+0x64/0xc8 __device_attach_driver+0xb8/0xe0 driver_probe_device.part.11+0xc4/0xd8 really_probe+0x32c/0x3b8 Later, phy_attach_direct() notices no PHY driver has been bound, and falls back to the Generic PHY, leading to degraded operation: Generic PHY e6800000.ethernet-ffffffff:00: attached PHY driver [Generic PHY] (mii_bus:phy_addr=e6800000.ethernet-ffffffff:00, irq=POLL) ravb e6800000.ethernet eth0: Link is Up - 1Gbps/Full - flow control off B. If CONFIG_MODULES=y, request_module() returns early with -EBUSY due to UMH_DISABLED, and MDIO initialization fails completely: mdio_bus e6800000.ethernet-ffffffff:00: error -16 loading PHY driver module for ID 0x00221622 ravb e6800000.ethernet eth0: failed to initialize MDIO PM: dpm_run_callback(): ravb_resume+0x0/0x1b8 returns -16 PM: Device e6800000.ethernet failed to resume: error -16 Ignoring -EBUSY in phy_request_driver_module(), like was done for -ENOENT in commit 21e194425abd65b5 ("net: phy: fix issue with loading PHY driver w/o initramfs"), would makes it fall back to the Generic PHY, like in the CONFIG_MODULES=n case. Signed-off-by: Geert Uytterhoeven Cc: stable@vger.kernel.org Reviewed-by: Sergei Shtylyov Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++++++++---------------- 1 file changed, 55 insertions(+), 55 deletions(-) --- a/drivers/net/ethernet/renesas/ravb_main.c +++ b/drivers/net/ethernet/renesas/ravb_main.c @@ -1336,51 +1336,6 @@ static inline int ravb_hook_irq(unsigned return error; } -/* MDIO bus init function */ -static int ravb_mdio_init(struct ravb_private *priv) -{ - struct platform_device *pdev = priv->pdev; - struct device *dev = &pdev->dev; - int error; - - /* Bitbang init */ - priv->mdiobb.ops = &bb_ops; - - /* MII controller setting */ - priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); - if (!priv->mii_bus) - return -ENOMEM; - - /* Hook up MII support for ethtool */ - priv->mii_bus->name = "ravb_mii"; - priv->mii_bus->parent = dev; - snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", - pdev->name, pdev->id); - - /* Register MDIO bus */ - error = of_mdiobus_register(priv->mii_bus, dev->of_node); - if (error) - goto out_free_bus; - - return 0; - -out_free_bus: - free_mdio_bitbang(priv->mii_bus); - return error; -} - -/* MDIO bus release function */ -static int ravb_mdio_release(struct ravb_private *priv) -{ - /* Unregister mdio bus */ - mdiobus_unregister(priv->mii_bus); - - /* Free bitbang info */ - free_mdio_bitbang(priv->mii_bus); - - return 0; -} - /* Network device open function for Ethernet AVB */ static int ravb_open(struct net_device *ndev) { @@ -1389,13 +1344,6 @@ static int ravb_open(struct net_device * struct device *dev = &pdev->dev; int error; - /* MDIO bus init */ - error = ravb_mdio_init(priv); - if (error) { - netdev_err(ndev, "failed to initialize MDIO\n"); - return error; - } - napi_enable(&priv->napi[RAVB_BE]); napi_enable(&priv->napi[RAVB_NC]); @@ -1473,7 +1421,6 @@ out_free_irq: out_napi_off: napi_disable(&priv->napi[RAVB_NC]); napi_disable(&priv->napi[RAVB_BE]); - ravb_mdio_release(priv); return error; } @@ -1771,8 +1718,6 @@ static int ravb_close(struct net_device ravb_ring_free(ndev, RAVB_BE); ravb_ring_free(ndev, RAVB_NC); - ravb_mdio_release(priv); - return 0; } @@ -1875,6 +1820,51 @@ static const struct net_device_ops ravb_ .ndo_change_mtu = eth_change_mtu, }; +/* MDIO bus init function */ +static int ravb_mdio_init(struct ravb_private *priv) +{ + struct platform_device *pdev = priv->pdev; + struct device *dev = &pdev->dev; + int error; + + /* Bitbang init */ + priv->mdiobb.ops = &bb_ops; + + /* MII controller setting */ + priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb); + if (!priv->mii_bus) + return -ENOMEM; + + /* Hook up MII support for ethtool */ + priv->mii_bus->name = "ravb_mii"; + priv->mii_bus->parent = dev; + snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x", + pdev->name, pdev->id); + + /* Register MDIO bus */ + error = of_mdiobus_register(priv->mii_bus, dev->of_node); + if (error) + goto out_free_bus; + + return 0; + +out_free_bus: + free_mdio_bitbang(priv->mii_bus); + return error; +} + +/* MDIO bus release function */ +static int ravb_mdio_release(struct ravb_private *priv) +{ + /* Unregister mdio bus */ + mdiobus_unregister(priv->mii_bus); + + /* Free bitbang info */ + free_mdio_bitbang(priv->mii_bus); + + return 0; +} + static const struct of_device_id ravb_match_table[] = { { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 }, { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 }, @@ -2079,6 +2069,13 @@ static int ravb_probe(struct platform_de eth_hw_addr_random(ndev); } + /* MDIO bus init */ + error = ravb_mdio_init(priv); + if (error) { + dev_err(&pdev->dev, "failed to initialize MDIO\n"); + goto out_dma_free; + } + netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64); netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64); @@ -2098,6 +2095,8 @@ static int ravb_probe(struct platform_de out_napi_del: netif_napi_del(&priv->napi[RAVB_NC]); netif_napi_del(&priv->napi[RAVB_BE]); + ravb_mdio_release(priv); +out_dma_free: dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat, priv->desc_bat_dma); @@ -2130,6 +2129,7 @@ static int ravb_remove(struct platform_d unregister_netdev(ndev); netif_napi_del(&priv->napi[RAVB_NC]); netif_napi_del(&priv->napi[RAVB_BE]); + ravb_mdio_release(priv); pm_runtime_disable(&pdev->dev); free_netdev(ndev); platform_set_drvdata(pdev, NULL); From patchwork Mon Oct 12 13:26:48 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270200 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B423C43457 for ; Mon, 12 Oct 2020 14:07:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 014582076E for ; Mon, 12 Oct 2020 14:07:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511658; bh=zL9izJMJB54pG1Dl+LvC5fpuv1reHJnvEC2ws5mv0Kg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=D1M0+ZkdHZbwBuLKHtar9qAeVlCtVPh5LCptIvLuiv6Oq44C4DJF2ZjILEAvZvwoa Fg9qIllVEXBxiIHOMlt5XXOYIS1v5RMM5ewQVN4GIegdCxIQD0nBHvRzaqZlrEwPIN R3K8BmvVX/LSsdOM6Uiq1MmSDyC81xkgbFjjTLuo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390777AbgJLOGl (ORCPT ); Mon, 12 Oct 2020 10:06:41 -0400 Received: from mail.kernel.org ([198.145.29.99]:36786 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730190AbgJLNeX (ORCPT ); Mon, 12 Oct 2020 09:34:23 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 181D122228; Mon, 12 Oct 2020 13:34:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509649; bh=zL9izJMJB54pG1Dl+LvC5fpuv1reHJnvEC2ws5mv0Kg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=upsZWYQBcRLKEwEgoFxJezySYfctySyjnmGT720lvm2yqJYG9lftL1VQ/lF+U+DEf O1uCFO+qBB46OqTvWdWiaykFGBlcEpgEflP3t6BLQ7WB+9Ppcn2XOWemDd5NcNQVOR 4rnzDwbM376ubPkcFpnCJkXTV9LI43DN972MLdG0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peilin Ye , Daniel Vetter , syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com Subject: [PATCH 4.9 26/54] fbcon: Fix global-out-of-bounds read in fbcon_get_font() Date: Mon, 12 Oct 2020 15:26:48 +0200 Message-Id: <20201012132630.802633984@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Peilin Ye commit 5af08640795b2b9a940c9266c0260455377ae262 upstream. fbcon_get_font() is reading out-of-bounds. A malicious user may resize `vc->vc_font.height` to a large value, causing fbcon_get_font() to read out of `fontdata`. fbcon_get_font() handles both built-in and user-provided fonts. Fortunately, recently we have added FONT_EXTRA_WORDS support for built-in fonts, so fix it by adding range checks using FNTSIZE(). This patch depends on patch "fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h", and patch "Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts". Cc: stable@vger.kernel.org Reported-and-tested-by: syzbot+29d4ed7f3bdedf2aa2fd@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=08b8be45afea11888776f897895aef9ad1c3ecfd Signed-off-by: Peilin Ye Reviewed-by: Greg Kroah-Hartman Signed-off-by: Daniel Vetter Link: https://patchwork.freedesktop.org/patch/msgid/b34544687a1a09d6de630659eb7a773f4953238b.1600953813.git.yepeilin.cs@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/video/console/fbcon.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/video/console/fbcon.c +++ b/drivers/video/console/fbcon.c @@ -2234,6 +2234,9 @@ static int fbcon_get_font(struct vc_data if (font->width <= 8) { j = vc->vc_font.height; + if (font->charcount * j > FNTSIZE(fontdata)) + return -EINVAL; + for (i = 0; i < font->charcount; i++) { memcpy(data, fontdata, j); memset(data + j, 0, 32 - j); @@ -2242,6 +2245,9 @@ static int fbcon_get_font(struct vc_data } } else if (font->width <= 16) { j = vc->vc_font.height * 2; + if (font->charcount * j > FNTSIZE(fontdata)) + return -EINVAL; + for (i = 0; i < font->charcount; i++) { memcpy(data, fontdata, j); memset(data + j, 0, 64 - j); @@ -2249,6 +2255,9 @@ static int fbcon_get_font(struct vc_data fontdata += j; } } else if (font->width <= 24) { + if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata)) + return -EINVAL; + for (i = 0; i < font->charcount; i++) { for (j = 0; j < vc->vc_font.height; j++) { *data++ = fontdata[0]; @@ -2261,6 +2270,9 @@ static int fbcon_get_font(struct vc_data } } else { j = vc->vc_font.height * 4; + if (font->charcount * j > FNTSIZE(fontdata)) + return -EINVAL; + for (i = 0; i < font->charcount; i++) { memcpy(data, fontdata, j); memset(data + j, 0, 128 - j); From patchwork Mon Oct 12 13:26:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270202 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6A5EC43467 for ; Mon, 12 Oct 2020 14:06:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 93F0C20757 for ; Mon, 12 Oct 2020 14:06:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511587; bh=/ZHgex/KMwOUGfYEdwGUNIyuAGKFvjjDlQKu+Q02E1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=t9HIi7jvtFnZrBcYKii6qRJAhK5RjVnnpGH/mNHSqvkR5aboGajBMHvo3zQRHfwEk YLxlsYs8/20ZiUNpPReEHZUVsTsMsCKQPrYK88mviQeUexJKgIxsdfry3Epcw4oQSZ eLvJVp/Nm3nDXoSCsl239PCOBzfAu27+csk7eKv0= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2389520AbgJLOG1 (ORCPT ); Mon, 12 Oct 2020 10:06:27 -0400 Received: from mail.kernel.org ([198.145.29.99]:36760 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730230AbgJLNe1 (ORCPT ); Mon, 12 Oct 2020 09:34:27 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 016422222F; Mon, 12 Oct 2020 13:34:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509656; bh=/ZHgex/KMwOUGfYEdwGUNIyuAGKFvjjDlQKu+Q02E1c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vTl5xbgGsKW6UdWbYKg+Shi0/7D1hwlZ9xoThCC4X3uwIsejRd3JVAW7eVZuQVJNb rZ0N2xsf81xjrFWoEmhpi76XORF2NbJVYwQCGYtRnSZsBLHglvXrSESkiGE748EFjO GnjLAT24V43JatmpS5HwrKLe5oYctn4IMIqYakUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tom Rix , Hans de Goede , mark gross , Andy Shevchenko Subject: [PATCH 4.9 29/54] platform/x86: thinkpad_acpi: initialize tp_nvram_state variable Date: Mon, 12 Oct 2020 15:26:51 +0200 Message-Id: <20201012132630.941946479@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Tom Rix commit 5f38b06db8af3ed6c2fc1b427504ca56fae2eacc upstream. clang static analysis flags this represenative problem thinkpad_acpi.c:2523:7: warning: Branch condition evaluates to a garbage value if (!oldn->mute || ^~~~~~~~~~~ In hotkey_kthread() mute is conditionally set by hotkey_read_nvram() but unconditionally checked by hotkey_compare_and_issue_event(). So the tp_nvram_state variable s[2] needs to be initialized. Fixes: 01e88f25985d ("ACPI: thinkpad-acpi: add CMOS NVRAM polling for hot keys (v9)") Signed-off-by: Tom Rix Reviewed-by: Hans de Goede Acked-by: mark gross Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman --- drivers/platform/x86/thinkpad_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -2476,7 +2476,7 @@ static void hotkey_compare_and_issue_eve */ static int hotkey_kthread(void *data) { - struct tp_nvram_state s[2]; + struct tp_nvram_state s[2] = { 0 }; u32 poll_mask, event_mask; unsigned int si, so; unsigned long t; From patchwork Mon Oct 12 13:26:55 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270381 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55C5DC433DF for ; Mon, 12 Oct 2020 13:35:30 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0E81F2222A for ; Mon, 12 Oct 2020 13:35:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509730; bh=9vOzk6L5ZlgzV3aSRh7G4WCOGUmax/tn8RhXBuTL/64=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2V/jB02Aq0US3PDGF4pPlFbvTPt5FYJHfPRY31R2EqR4NBpgvAc8Dl3ls5RUpojej yp60vaNZ1Ef0DFZyB9jTRIWZe2x1ZJHwHhq/kPjfKAy3Qb5qUPMKMROAFGqg0C6ZEm qmrBKPRm7ak80t6fXn/0xGK6pE6/uD/7GXIOutu8= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728446AbgJLNf2 (ORCPT ); Mon, 12 Oct 2020 09:35:28 -0400 Received: from mail.kernel.org ([198.145.29.99]:36910 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730640AbgJLNe2 (ORCPT ); Mon, 12 Oct 2020 09:34:28 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 5D2C920838; Mon, 12 Oct 2020 13:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509665; bh=9vOzk6L5ZlgzV3aSRh7G4WCOGUmax/tn8RhXBuTL/64=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nk0/5PWJx0aJ1fpj/a5Mq7wOhNpPtbopufJj25uI0CaPMmRzsARKDrEXTMrPDEVlD IOcGrx/xNX0NXg2xVGxJ1FfF6TqSOvPgbhlsm7a00D/OOZ0vZZJ5GlmAhBVlSYbaO6 l822LGYczCzZ8JXQzZuZDvs426g5fAH8MqzKtp8o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miquel Raynal , Nobuhiro Iwamatsu Subject: [PATCH 4.9 33/54] mtd: rawnand: sunxi: Fix the probe error path Date: Mon, 12 Oct 2020 15:26:55 +0200 Message-Id: <20201012132631.124815696@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Miquel Raynal commit 3d84515ffd8fb657e10fa5b1215e9f095fa7efca upstream. nand_release() is supposed be called after MTD device registration. Here, only nand_scan() happened, so use nand_cleanup() instead. Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support") Signed-off-by: Miquel Raynal Cc: stable@vger.kernel.org Link: https://lore.kernel.org/linux-mtd/20200519130035.1883-54-miquel.raynal@bootlin.com [iwamatsu: adjust filename] Signed-off-by: Nobuhiro Iwamatsu Signed-off-by: Greg Kroah-Hartman --- drivers/mtd/nand/sunxi_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/mtd/nand/sunxi_nand.c +++ b/drivers/mtd/nand/sunxi_nand.c @@ -2108,7 +2108,7 @@ static int sunxi_nand_chip_init(struct d ret = mtd_device_register(mtd, NULL, 0); if (ret) { dev_err(dev, "failed to register mtd device: %d\n", ret); - nand_release(nand); + nand_cleanup(nand); return ret; } From patchwork Mon Oct 12 13:26:57 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270384 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAD5DC43457 for ; Mon, 12 Oct 2020 13:35:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 6CA90221FE for ; Mon, 12 Oct 2020 13:35:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509708; bh=Ytcri4kG4M2XhCPYKUnH3cSUlS2ZgeqpgD1d7g2OaPI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=UowOGTZC01HoaFUh9qu+r2Rc6TJlgsGrN5asURcbdLLtv/zQ8Uz14Bs0PohvJbHCh UNmDPStNrbxlgkbeoSL3+Hjvg4KAliOuJ/iB78l+lbcTq0MHoORgzamYPFh6I/Js0o LX0sP+TmsG8EAGnwTsOf7xABls/XmB47Rbz1/sng= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728040AbgJLNe5 (ORCPT ); Mon, 12 Oct 2020 09:34:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:37052 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730273AbgJLNed (ORCPT ); Mon, 12 Oct 2020 09:34:33 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 428F22074F; Mon, 12 Oct 2020 13:34:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509672; bh=Ytcri4kG4M2XhCPYKUnH3cSUlS2ZgeqpgD1d7g2OaPI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YkXqJ4COL9sCZcsuz3TKR8iXZS6uVWMZ8Wu8DOdp0vWQKoNzTExDor98GxvvSD1xP nM7cp9o24OL5BK1KB5rth6jqnFONunba12o1AcFIC1eja0htJ7Cyz6Z5AhY6crtfLy glCWjt16IYpcLdEfaL05oI9HUMFfZUPrN6/ipJc8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Paolo Abeni , Jakub Kicinski Subject: [PATCH 4.9 35/54] macsec: avoid use-after-free in macsec_handle_frame() Date: Mon, 12 Oct 2020 15:26:57 +0200 Message-Id: <20201012132631.214913922@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet commit c7cc9200e9b4a2ac172e990ef1975cd42975dad6 upstream. De-referencing skb after call to gro_cells_receive() is not allowed. We need to fetch skb->len earlier. Fixes: 5491e7c6b1a9 ("macsec: enable GRO and RPS on macsec devices") Signed-off-by: Eric Dumazet Cc: Paolo Abeni Acked-by: Paolo Abeni Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/macsec.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/macsec.c +++ b/drivers/net/macsec.c @@ -1087,6 +1087,7 @@ static rx_handler_result_t macsec_handle struct macsec_rx_sa *rx_sa; struct macsec_rxh_data *rxd; struct macsec_dev *macsec; + unsigned int len; sci_t sci; u32 pn; bool cbit; @@ -1242,9 +1243,10 @@ deliver: macsec_rxsc_put(rx_sc); skb_orphan(skb); + len = skb->len; ret = gro_cells_receive(&macsec->gro_cells, skb); if (ret == NET_RX_SUCCESS) - count_rx(dev, skb->len); + count_rx(dev, len); else macsec->secy.netdev->stats.rx_dropped++; From patchwork Mon Oct 12 13:27:00 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270383 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F1A3C433DF for ; Mon, 12 Oct 2020 13:35:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3D1B62222E for ; Mon, 12 Oct 2020 13:35:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509724; bh=Je0JIiKHXIl9tbT6967+zOl/koGfFKKM7XpiPpCFVi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=ZsNbYZrl8gS4P9z3txAoEIoshul4ZgztS3usWYepRX8a+R5sxpsYLLQ17lJfkxIK9 P8MeSf+UbrxyQm8yX0I3cb3BatYvzhXtCjjxExQzyoDghB3KA6MNm1XgTxsrD5L7Gq 9rR/ZxlqMmphCGJgC+741AePMKOTBI7ZbGuJrlXw= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729967AbgJLNfQ (ORCPT ); Mon, 12 Oct 2020 09:35:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:37170 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730687AbgJLNek (ORCPT ); Mon, 12 Oct 2020 09:34:40 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1761D2087E; Mon, 12 Oct 2020 13:34:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509679; bh=Je0JIiKHXIl9tbT6967+zOl/koGfFKKM7XpiPpCFVi0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ztcH9RwBxENIFzePxgk5oz77ayd+rcrtaKn+Q0kz2t2Osw1Gqk031NSzpazfpac8C pM2VHwKjrGaeDhtyJYUCqnYmN5t6ZwzTlzd0rc3qiBGvYSywQsmR57505NHD+xqyfN Jvdt84O/YHz47Wtjlune7oE7Ze69PSrQuEZelXZo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "David S. Miller" Subject: [PATCH 4.9 38/54] team: set dev->needed_headroom in team_setup_by_port() Date: Mon, 12 Oct 2020 15:27:00 +0200 Message-Id: <20201012132631.344152387@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet commit 89d01748b2354e210b5d4ea47bc25a42a1b42c82 upstream. Some devices set needed_headroom. If we ignore it, we might end up crashing in various skb_push() for example in ipgre_header() since some layers assume enough headroom has been reserved. Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/team/team.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -2085,6 +2085,7 @@ static void team_setup_by_port(struct ne dev->header_ops = port_dev->header_ops; dev->type = port_dev->type; dev->hard_header_len = port_dev->hard_header_len; + dev->needed_headroom = port_dev->needed_headroom; dev->addr_len = port_dev->addr_len; dev->mtu = port_dev->mtu; memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); From patchwork Mon Oct 12 13:27:01 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270203 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C99CC433E7 for ; Mon, 12 Oct 2020 14:06:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C43292080D for ; Mon, 12 Oct 2020 14:06:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511586; bh=JY3QkbtFRG3ZJnkRtN1wiSMf34tBUOJ1EJgwJRKXcxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=vN1XK1R6IKdZywK0JainmNQyAQAwNaZiygWY0od18Sr0fZw5rg7sU/FeTiXMv/wHq yK2sgHSXVzJM4hd4S4foAZtSX0uso+H0g+5f/ETfLRpUEC42uLZwG5aUbB7Jxaxu1D AoTFT2osYO5XBeCSvRCrr3fJBODmBoGuugu7/F1g= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390792AbgJLOGQ (ORCPT ); Mon, 12 Oct 2020 10:06:16 -0400 Received: from mail.kernel.org ([198.145.29.99]:37228 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730700AbgJLNen (ORCPT ); Mon, 12 Oct 2020 09:34:43 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 624A820878; Mon, 12 Oct 2020 13:34:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509681; bh=JY3QkbtFRG3ZJnkRtN1wiSMf34tBUOJ1EJgwJRKXcxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m4y3uEwIKPBzA5iiqcg3vn/gjMvC/ggYLe8xquPlkS2icS5mAiv7Swmy0ohuYEDwz M9+ZdEHfIZvmjW/UrU6y5CloYR2JEIZew/eERWUA63EwK0M5Itg12Amf04rpTCI0Op /b7ima92uJUR9EE4hvhH0MI0EvTKW4QPy1Bfj41M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com, Anant Thazhemadam , "David S. Miller" Subject: [PATCH 4.9 39/54] net: team: fix memory leak in __team_options_register Date: Mon, 12 Oct 2020 15:27:01 +0200 Message-Id: <20201012132631.387586022@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anant Thazhemadam commit 9a9e77495958c7382b2438bc19746dd3aaaabb8e upstream. The variable "i" isn't initialized back correctly after the first loop under the label inst_rollback gets executed. The value of "i" is assigned to be option_count - 1, and the ensuing loop (under alloc_rollback) begins by initializing i--. Thus, the value of i when the loop begins execution will now become i = option_count - 2. Thus, when kfree(dst_opts[i]) is called in the second loop in this order, (i.e., inst_rollback followed by alloc_rollback), dst_optsp[option_count - 2] is the first element freed, and dst_opts[option_count - 1] does not get freed, and thus, a memory leak is caused. This memory leak can be fixed, by assigning i = option_count (instead of option_count - 1). Fixes: 80f7c6683fe0 ("team: add support for per-port options") Reported-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com Tested-by: syzbot+69b804437cfec30deac3@syzkaller.appspotmail.com Signed-off-by: Anant Thazhemadam Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/team/team.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/team/team.c +++ b/drivers/net/team/team.c @@ -299,7 +299,7 @@ inst_rollback: for (i--; i >= 0; i--) __team_option_inst_del_option(team, dst_opts[i]); - i = option_count - 1; + i = option_count; alloc_rollback: for (i--; i >= 0; i--) kfree(dst_opts[i]); From patchwork Mon Oct 12 13:27:02 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270205 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56307C433DF for ; Mon, 12 Oct 2020 14:06:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 13D5820757 for ; Mon, 12 Oct 2020 14:06:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511567; bh=8eEq4KYRpIi3cl/1hrvJIiVsf5tQ2gQ54ewuc+GUgO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=c4aSTHm42cNd5F87AnZaOJdO5kQs1qHKLBHtgxBoZcvD2QqZ+dpSQLQEvOu0xzBR6 BN7g7wct6uwZBhbpwVS+R6T/zVfuWVueRbRSUIWdkg0yWeZjPzHFs4X+WfFZuDFQvp KRReQwa63frcy13tLDDOnt1wNi0dVhrcAI0CVpCc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2391080AbgJLOGE (ORCPT ); Mon, 12 Oct 2020 10:06:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:36796 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730709AbgJLNeo (ORCPT ); Mon, 12 Oct 2020 09:34:44 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id B4036215A4; Mon, 12 Oct 2020 13:34:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509684; bh=8eEq4KYRpIi3cl/1hrvJIiVsf5tQ2gQ54ewuc+GUgO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KLm82e86TI5Hk1ciDigXJT6GkTC9JB1BEIrDcRrAMQ+OXTNfTOPjsfpd6g+ozZegi o/K5whPdjaPeSfAgYzvrCXO9RxlbPSfyBg0GVFy2TMzhlU7nyh+yLuyZ4PRYpoA6Hk FiMBKkSwRdNgrwVk7yzQA82J/7X+9LY9faBnWaBo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Florian Westphal , Dumitru Ceara , Jakub Kicinski Subject: [PATCH 4.9 40/54] openvswitch: handle DNAT tuple collision Date: Mon, 12 Oct 2020 15:27:02 +0200 Message-Id: <20201012132631.436683076@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Dumitru Ceara commit 8aa7b526dc0b5dbf40c1b834d76a667ad672a410 upstream. With multiple DNAT rules it's possible that after destination translation the resulting tuples collide. For example, two openvswitch flows: nw_dst=10.0.0.10,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) nw_dst=10.0.0.20,tp_dst=10, actions=ct(commit,table=2,nat(dst=20.0.0.1:20)) Assuming two TCP clients initiating the following connections: 10.0.0.10:5000->10.0.0.10:10 10.0.0.10:5000->10.0.0.20:10 Both tuples would translate to 10.0.0.10:5000->20.0.0.1:20 causing nf_conntrack_confirm() to fail because of tuple collision. Netfilter handles this case by allocating a null binding for SNAT at egress by default. Perform the same operation in openvswitch for DNAT if no explicit SNAT is requested by the user and allocate a null binding for SNAT for packets in the "original" direction. Reported-at: https://bugzilla.redhat.com/1877128 Suggested-by: Florian Westphal Fixes: 05752523e565 ("openvswitch: Interface with NAT.") Signed-off-by: Dumitru Ceara Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/openvswitch/conntrack.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) --- a/net/openvswitch/conntrack.c +++ b/net/openvswitch/conntrack.c @@ -709,15 +709,19 @@ static int ovs_ct_nat(struct net *net, s } err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); - if (err == NF_ACCEPT && - ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) { - if (maniptype == NF_NAT_MANIP_SRC) - maniptype = NF_NAT_MANIP_DST; - else - maniptype = NF_NAT_MANIP_SRC; + if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { + if (ct->status & IPS_SRC_NAT) { + if (maniptype == NF_NAT_MANIP_SRC) + maniptype = NF_NAT_MANIP_DST; + else + maniptype = NF_NAT_MANIP_SRC; - err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, - maniptype); + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, + maniptype); + } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { + err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, + NF_NAT_MANIP_SRC); + } } /* Mark NAT done if successful and update the flow key. */ From patchwork Mon Oct 12 13:27:04 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270380 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24117C433DF for ; Mon, 12 Oct 2020 13:35:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id C94DE22247 for ; Mon, 12 Oct 2020 13:35:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509745; bh=2zpjsqHQJac+zL3lvzEoMNpkQcp72IfoDjRfZJkYqPE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=H7HRNommoLo4NS9blSibbuzz9EdQ0AmR8gRzzx/tn8160axmV22v9z5vfw3DZR3y7 6Ey7HhxhPfHVFE33lSs1q9LfnQz+ezEFLl1VXvksr8LOortRpJf+Au34wyfTrPVIBa RKz2tmMA0vQWvPOcRynon9yn1OAhPjYiXz7yXifQ= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730839AbgJLNfo (ORCPT ); Mon, 12 Oct 2020 09:35:44 -0400 Received: from mail.kernel.org ([198.145.29.99]:37356 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730740AbgJLNeu (ORCPT ); Mon, 12 Oct 2020 09:34:50 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8615321BE5; Mon, 12 Oct 2020 13:34:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509689; bh=2zpjsqHQJac+zL3lvzEoMNpkQcp72IfoDjRfZJkYqPE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lqCmdWWnI9VqpbieDBQBe8yS5APT3/wTUkpDZLTqNGI4iw6NYNxJ7bzi/5Y670IeF Wzg22PXyGqS03wSrX3mYR59qhd3b3a63XcsvEBS+BKO6oItRuJpKCNPE6YOyFeXdND OBZIOAn+V3NGdZLZzHgBXkLxnm2E15ia4nlxX9d4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Antony Antony , Steffen Klassert , Sasha Levin Subject: [PATCH 4.9 42/54] xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate Date: Mon, 12 Oct 2020 15:27:04 +0200 Message-Id: <20201012132631.527506896@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Antony Antony [ Upstream commit 91a46c6d1b4fcbfa4773df9421b8ad3e58088101 ] XFRMA_REPLAY_ESN_VAL was not cloned completely from the old to the new. Migrate this attribute during XFRMA_MSG_MIGRATE v1->v2: - move curleft cloning to a separate patch Fixes: af2f464e326e ("xfrm: Assign esn pointers when cloning a state") Signed-off-by: Antony Antony Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin --- include/net/xfrm.h | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/include/net/xfrm.h b/include/net/xfrm.h index 9e2f260cbb518..b2a405c93a342 100644 --- a/include/net/xfrm.h +++ b/include/net/xfrm.h @@ -1726,21 +1726,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay static inline int xfrm_replay_clone(struct xfrm_state *x, struct xfrm_state *orig) { - x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn), + + x->replay_esn = kmemdup(orig->replay_esn, + xfrm_replay_state_esn_len(orig->replay_esn), GFP_KERNEL); if (!x->replay_esn) return -ENOMEM; - - x->replay_esn->bmp_len = orig->replay_esn->bmp_len; - x->replay_esn->replay_window = orig->replay_esn->replay_window; - - x->preplay_esn = kmemdup(x->replay_esn, - xfrm_replay_state_esn_len(x->replay_esn), + x->preplay_esn = kmemdup(orig->preplay_esn, + xfrm_replay_state_esn_len(orig->preplay_esn), GFP_KERNEL); - if (!x->preplay_esn) { - kfree(x->replay_esn); + if (!x->preplay_esn) return -ENOMEM; - } return 0; } From patchwork Mon Oct 12 13:27:08 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270207 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 303FEC433DF for ; Mon, 12 Oct 2020 14:05:41 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E6D7A2080D for ; Mon, 12 Oct 2020 14:05:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511540; bh=jJgw/SkZ18YIhaj5TflwF/qZFLPKihsWDmc7/ASX/y4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=c7AKAeR1SS3dpcJlUqbAUbk9abI7TazoITyGg/xAqx0ng88oAEjsH/c8CuPFZcVDx 22E40R8NWUvs9Zx6g5iqlEyPndJo1Bf5X8fzJYkadbo3Y6FczH1sA57PwAXlsSIoTd kmM4xhGs6TMGAb8ermUjJnp8VwHJ6yq55F2wYjZY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390745AbgJLOFk (ORCPT ); Mon, 12 Oct 2020 10:05:40 -0400 Received: from mail.kernel.org ([198.145.29.99]:37556 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730757AbgJLNfB (ORCPT ); Mon, 12 Oct 2020 09:35:01 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 4AE2F2076E; Mon, 12 Oct 2020 13:35:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509700; bh=jJgw/SkZ18YIhaj5TflwF/qZFLPKihsWDmc7/ASX/y4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LJeYp3NN6sKkYVO8Njj1HGTzbaQxR2bNWSrBtY9T+c7HIB580RPnUywuTHX4jp64q lHz74jo2a4SyKahz3bzKxPFkCG3BTmdJO7sycyig3omtzQCHirEylW/vnGIYgdhwRc skcoPkx12EuYjpMFLjaa3XohccnZmqmW2YJajXqU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , syzbot , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 46/54] bonding: set dev->needed_headroom in bond_setup_by_slave() Date: Mon, 12 Oct 2020 15:27:08 +0200 Message-Id: <20201012132631.697205084@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Eric Dumazet [ Upstream commit f32f19339596b214c208c0dba716f4b6cc4f6958 ] syzbot managed to crash a host by creating a bond with a GRE device. For non Ethernet device, bonding calls bond_setup_by_slave() instead of ether_setup(), and unfortunately dev->needed_headroom was not copied from the new added member. [ 171.243095] skbuff: skb_under_panic: text:ffffffffa184b9ea len:116 put:20 head:ffff883f84012dc0 data:ffff883f84012dbc tail:0x70 end:0xd00 dev:bond0 [ 171.243111] ------------[ cut here ]------------ [ 171.243112] kernel BUG at net/core/skbuff.c:112! [ 171.243117] invalid opcode: 0000 [#1] SMP KASAN PTI [ 171.243469] gsmi: Log Shutdown Reason 0x03 [ 171.243505] Call Trace: [ 171.243506] [ 171.243512] [] skb_push+0x49/0x50 [ 171.243516] [] ipgre_header+0x2a/0xf0 [ 171.243520] [] neigh_connected_output+0xb7/0x100 [ 171.243524] [] ip6_finish_output2+0x383/0x490 [ 171.243528] [] __ip6_finish_output+0xa2/0x110 [ 171.243531] [] ip6_finish_output+0x2c/0xa0 [ 171.243534] [] ip6_output+0x69/0x110 [ 171.243537] [] ? ip6_output+0x110/0x110 [ 171.243541] [] mld_sendpack+0x1b2/0x2d0 [ 171.243544] [] ? mld_send_report+0xf0/0xf0 [ 171.243548] [] mld_ifc_timer_expire+0x2d7/0x3b0 [ 171.243551] [] ? mld_gq_timer_expire+0x50/0x50 [ 171.243556] [] call_timer_fn+0x30/0x130 [ 171.243559] [] expire_timers+0x4c/0x110 [ 171.243563] [] __run_timers+0x213/0x260 [ 171.243566] [] ? ktime_get+0x3d/0xa0 [ 171.243570] [] ? clockevents_program_event+0x7e/0xe0 [ 171.243574] [] ? sched_clock_cpu+0x15/0x190 [ 171.243577] [] run_timer_softirq+0x1d/0x40 [ 171.243581] [] __do_softirq+0x152/0x2f0 [ 171.243585] [] irq_exit+0x9f/0xb0 [ 171.243588] [] smp_apic_timer_interrupt+0xfd/0x1a0 [ 171.243591] [] apic_timer_interrupt+0x86/0x90 Fixes: f5184d267c1a ("net: Allow netdevices to specify needed head/tailroom") Signed-off-by: Eric Dumazet Reported-by: syzbot Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/bonding/bond_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c index 8322129c3f987..240d7850c8252 100644 --- a/drivers/net/bonding/bond_main.c +++ b/drivers/net/bonding/bond_main.c @@ -1129,6 +1129,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev, bond_dev->type = slave_dev->type; bond_dev->hard_header_len = slave_dev->hard_header_len; + bond_dev->needed_headroom = slave_dev->needed_headroom; bond_dev->addr_len = slave_dev->addr_len; memcpy(bond_dev->broadcast, slave_dev->broadcast, From patchwork Mon Oct 12 13:27:09 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270206 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFD61C433E7 for ; Mon, 12 Oct 2020 14:06:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9C03F20757 for ; Mon, 12 Oct 2020 14:06:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511563; bh=N8UrZrhzNix/bXcJER3RnuEQasK4KRQjKvkr5dRDUok=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=IljUAOAiIWA/IVVu9cUL2DOPN6G4LL/rd2+qhsv3sLmwkI+5aHS5tv/UbqtTuqJId VLCvkqYh2ddkWUVN56Qqrddi/BBdhYWMzg+XRruCCO+lnfI2XzQhniDPba5Rx9qZOs qcjsmFy26a9TlAe+f7qUeEJtfcNMXBYKKkIw1xIc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390379AbgJLOFj (ORCPT ); Mon, 12 Oct 2020 10:05:39 -0400 Received: from mail.kernel.org ([198.145.29.99]:37612 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730760AbgJLNfD (ORCPT ); Mon, 12 Oct 2020 09:35:03 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 71FD820BED; Mon, 12 Oct 2020 13:35:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509703; bh=N8UrZrhzNix/bXcJER3RnuEQasK4KRQjKvkr5dRDUok=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=x8cUKIEgJPBtONFbjP39FspYD/NYUBGHUejyfPbhicD8emZl4wp6N1teDAnC6F1C9 hMHsZlTJYdmngbJMFD80wy0TkbKLBcD6D4JnKPnxQz79CfWwmLuFfmbi5bhVChlXN5 fF0Th4DhNlbYysYJIV9DsE+cObHsbRDh++fgKCsA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Randy Dunlap , Bartosz Golaszewski , Andrew Lunn , Heiner Kallweit , netdev@vger.kernel.org, David Daney , "David S. Miller" , Sasha Levin Subject: [PATCH 4.9 47/54] mdio: fix mdio-thunder.c dependency & build error Date: Mon, 12 Oct 2020 15:27:09 +0200 Message-Id: <20201012132631.748381172@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Randy Dunlap [ Upstream commit 7dbbcf496f2a4b6d82cfc7810a0746e160b79762 ] Fix build error by selecting MDIO_DEVRES for MDIO_THUNDER. Fixes this build error: ld: drivers/net/phy/mdio-thunder.o: in function `thunder_mdiobus_pci_probe': drivers/net/phy/mdio-thunder.c:78: undefined reference to `devm_mdiobus_alloc_size' Fixes: 379d7ac7ca31 ("phy: mdio-thunder: Add driver for Cavium Thunder SoC MDIO buses.") Reported-by: kernel test robot Signed-off-by: Randy Dunlap Cc: Bartosz Golaszewski Cc: Andrew Lunn Cc: Heiner Kallweit Cc: netdev@vger.kernel.org Cc: David Daney Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- drivers/net/phy/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig index 2651c8d8de2f8..032017bd0ced5 100644 --- a/drivers/net/phy/Kconfig +++ b/drivers/net/phy/Kconfig @@ -135,6 +135,7 @@ config MDIO_THUNDER depends on 64BIT depends on PCI select MDIO_CAVIUM + select MDIO_DEVRES help This driver supports the MDIO interfaces found on Cavium ThunderX SoCs when the MDIO bus device appears as a PCI From patchwork Mon Oct 12 13:27:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270211 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A51FC433E7 for ; Mon, 12 Oct 2020 14:05:17 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EF404206F4 for ; Mon, 12 Oct 2020 14:05:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511517; bh=xNQeYc8vbiD1ts3rSFDYRnaEEWjjM7CPcujzTGXaWD8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=tv/FROKX9KH1mdzc2nP7otR6lxXfZMcxA2vztzLS5XxeUuGyl77mCENznMYqoFJg/ SvRKnq0hckFwbnxPm7dnjqlrD+4/pMLSZ8qY6wxsDMQQv55HPPjZVey/lcVqPu8EbW C3+h4ojujxlc2o4GwWTCmztV3lX0qU5X+viFJVHE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731843AbgJLOFJ (ORCPT ); Mon, 12 Oct 2020 10:05:09 -0400 Received: from mail.kernel.org ([198.145.29.99]:38002 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730810AbgJLNfZ (ORCPT ); Mon, 12 Oct 2020 09:35:25 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 6960722227; Mon, 12 Oct 2020 13:35:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509723; bh=xNQeYc8vbiD1ts3rSFDYRnaEEWjjM7CPcujzTGXaWD8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pLJQisWGeETkqHpef1KYUxTZrVapTDvhyxTh6Ge4/MZ1hM7owFLRq+A9gCzMGnBY/ EZZhqyindvIVKJTgA5qYdWNFxxtjn/O+/tXB2/6OdpHNylXbJRl1ouUOLqyyRNLbVp 4QBSKowIrRgvKlU8I5DCuxuCYFpXr+2zkkIT7eO0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Sasha Levin Subject: [PATCH 4.9 50/54] rxrpc: Fix some missing _bh annotations on locking conn->state_lock Date: Mon, 12 Oct 2020 15:27:12 +0200 Message-Id: <20201012132631.889260681@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: David Howells [ Upstream commit fa1d113a0f96f9ab7e4fe4f8825753ba1e34a9d3 ] conn->state_lock may be taken in softirq mode, but a previous patch replaced an outer lock in the response-packet event handling code, and lost the _bh from that when doing so. Fix this by applying the _bh annotation to the state_lock locking. Fixes: a1399f8bb033 ("rxrpc: Call channels should have separate call number spaces") Signed-off-by: David Howells Signed-off-by: Sasha Levin --- net/rxrpc/conn_event.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c index b099b64366f35..ec02dd7c12ef4 100644 --- a/net/rxrpc/conn_event.c +++ b/net/rxrpc/conn_event.c @@ -309,18 +309,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn, return ret; spin_lock(&conn->channel_lock); - spin_lock(&conn->state_lock); + spin_lock_bh(&conn->state_lock); if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) { conn->state = RXRPC_CONN_SERVICE; - spin_unlock(&conn->state_lock); + spin_unlock_bh(&conn->state_lock); for (loop = 0; loop < RXRPC_MAXCALLS; loop++) rxrpc_call_is_secure( rcu_dereference_protected( conn->channels[loop].call, lockdep_is_held(&conn->channel_lock))); } else { - spin_unlock(&conn->state_lock); + spin_unlock_bh(&conn->state_lock); } spin_unlock(&conn->channel_lock); From patchwork Mon Oct 12 13:27:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270212 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7D0F3C433E7 for ; Mon, 12 Oct 2020 14:05:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 42BBD206F4 for ; Mon, 12 Oct 2020 14:05:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602511509; bh=cRZwsTwV1n6Wp1uz0djYGfR4/C8Jq4a8bdMtfvv7hLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=jDqqOOV4rkdgJy7Dvs4zgKj4kjUJo67MDmI/i7V8j731ICZOWue5a72eR75LSCU1a F9vcmojgjajOtTrerOKVkxsWq5fGpAupD4dMxyBmICnH1EWFlBcF03BmiJhLkFgBJd PCmc/8Vx3F6AC4SsA8Jzgoc1qUA9dC0WDFJrHvrY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390967AbgJLOFD (ORCPT ); Mon, 12 Oct 2020 10:05:03 -0400 Received: from mail.kernel.org ([198.145.29.99]:37228 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730262AbgJLNfh (ORCPT ); Mon, 12 Oct 2020 09:35:37 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 14731208B8; Mon, 12 Oct 2020 13:35:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509728; bh=cRZwsTwV1n6Wp1uz0djYGfR4/C8Jq4a8bdMtfvv7hLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OHg9D/E2KWti101XC9NyT3b+JHOnWIBoa6nYbZjty3XPTEpOfe1FepBDcmun15QQR WWFGIVWSyvC/Woqbz8hw3BWZP28WhaU936cfhTvvNPsgPIrrSoEA+gG+lJrfj3WTTj 69rWFRz6ANvwUxbzl5kHJA89FJ9V1YGDr7wA7YTo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srikar Dronamraju , Kajol Jain , "Peter Zijlstra (Intel)" , Ingo Molnar , Barret Rhoden , Sasha Levin Subject: [PATCH 4.9 52/54] perf: Fix task_function_call() error handling Date: Mon, 12 Oct 2020 15:27:14 +0200 Message-Id: <20201012132631.977230363@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Kajol Jain [ Upstream commit 6d6b8b9f4fceab7266ca03d194f60ec72bd4b654 ] The error handling introduced by commit: 2ed6edd33a21 ("perf: Add cond_resched() to task_function_call()") looses any return value from smp_call_function_single() that is not {0, -EINVAL}. This is a problem because it will return -EXNIO when the target CPU is offline. Worse, in that case it'll turn into an infinite loop. Fixes: 2ed6edd33a21 ("perf: Add cond_resched() to task_function_call()") Reported-by: Srikar Dronamraju Signed-off-by: Kajol Jain Signed-off-by: Peter Zijlstra (Intel) Signed-off-by: Ingo Molnar Reviewed-by: Barret Rhoden Tested-by: Srikar Dronamraju Link: https://lkml.kernel.org/r/20200827064732.20860-1-kjain@linux.ibm.com Signed-off-by: Sasha Levin --- kernel/events/core.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index b562467d2d498..7aad4d22b4223 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -94,7 +94,7 @@ static void remote_function(void *data) * retry due to any failures in smp_call_function_single(), such as if the * task_cpu() goes offline concurrently. * - * returns @func return value or -ESRCH when the process isn't running + * returns @func return value or -ESRCH or -ENXIO when the process isn't running */ static int task_function_call(struct task_struct *p, remote_function_f func, void *info) @@ -110,7 +110,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info) for (;;) { ret = smp_call_function_single(task_cpu(p), remote_function, &data, 1); - ret = !ret ? data.ret : -EAGAIN; + if (!ret) + ret = data.ret; if (ret != -EAGAIN) break; From patchwork Mon Oct 12 13:27:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270375 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F36C4C4363D for ; Mon, 12 Oct 2020 13:36:07 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B00F720838 for ; Mon, 12 Oct 2020 13:36:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509767; bh=fmW3+WNtypgBnhzxFnE4Gy7I1zsUGl/9BllpV+I2avY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=pbUVEl7PrxOXfS0OxjLbVQLjqksvhzVrvlnqya2jzwtLEP/DYkpUbuXwQ38aSmrnp z0hbmgxv6Vh2y6aWIn/jM8EssybgyQbF+9OqqlMUVsep6X92zj6loU80U5RgCTnGqX NfapYD1akc18EjcypGWlLebroMvtkI1QQb4H9W54= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730969AbgJLNgG (ORCPT ); Mon, 12 Oct 2020 09:36:06 -0400 Received: from mail.kernel.org ([198.145.29.99]:37330 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730833AbgJLNfi (ORCPT ); Mon, 12 Oct 2020 09:35:38 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 459572222C; Mon, 12 Oct 2020 13:35:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509730; bh=fmW3+WNtypgBnhzxFnE4Gy7I1zsUGl/9BllpV+I2avY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y+/c2VCczErs85Fq7FVbIDAtozvA26/rLmeqJEle2ZqX9on0YfhAyQnG9tSg6bqH9 5aGV8tIcETAGBOHDA33WzAAy4voRYNjisD7nQIuuY9MQkQvJfNij/hIx7oMrLjRZK6 TzIB5MOQ2xOh8SE1L7qYgnMefV6eW0zlaG9S7f9w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vijay Balakrishna , Andrew Morton , Pavel Tatashin , Michal Hocko , Allen Pais , Andrea Arcangeli , "Kirill A. Shutemov" , Oleg Nesterov , Song Liu , Linus Torvalds Subject: [PATCH 4.9 53/54] mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged Date: Mon, 12 Oct 2020 15:27:15 +0200 Message-Id: <20201012132632.029610828@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Vijay Balakrishna commit 4aab2be0983031a05cb4a19696c9da5749523426 upstream. When memory is hotplug added or removed the min_free_kbytes should be recalculated based on what is expected by khugepaged. Currently after hotplug, min_free_kbytes will be set to a lower default and higher default set when THP enabled is lost. This change restores min_free_kbytes as expected for THP consumers. [vijayb@linux.microsoft.com: v5] Link: https://lkml.kernel.org/r/1601398153-5517-1-git-send-email-vijayb@linux.microsoft.com Fixes: f000565adb77 ("thp: set recommended min free kbytes") Signed-off-by: Vijay Balakrishna Signed-off-by: Andrew Morton Reviewed-by: Pavel Tatashin Acked-by: Michal Hocko Cc: Allen Pais Cc: Andrea Arcangeli Cc: "Kirill A. Shutemov" Cc: Oleg Nesterov Cc: Song Liu Cc: Link: https://lkml.kernel.org/r/1600305709-2319-2-git-send-email-vijayb@linux.microsoft.com Link: https://lkml.kernel.org/r/1600204258-13683-1-git-send-email-vijayb@linux.microsoft.com Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- include/linux/khugepaged.h | 5 +++++ mm/khugepaged.c | 13 +++++++++++-- mm/page_alloc.c | 3 +++ 3 files changed, 19 insertions(+), 2 deletions(-) --- a/include/linux/khugepaged.h +++ b/include/linux/khugepaged.h @@ -13,6 +13,7 @@ extern int __khugepaged_enter(struct mm_ extern void __khugepaged_exit(struct mm_struct *mm); extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma, unsigned long vm_flags); +extern void khugepaged_min_free_kbytes_update(void); #define khugepaged_enabled() \ (transparent_hugepage_flags & \ @@ -70,6 +71,10 @@ static inline int khugepaged_enter_vma_m { return 0; } + +static inline void khugepaged_min_free_kbytes_update(void) +{ +} #endif /* CONFIG_TRANSPARENT_HUGEPAGE */ #endif /* _LINUX_KHUGEPAGED_H */ --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -50,6 +50,9 @@ enum scan_result { #define CREATE_TRACE_POINTS #include +static struct task_struct *khugepaged_thread __read_mostly; +static DEFINE_MUTEX(khugepaged_mutex); + /* default scan 8*512 pte (or vmas) every 30 second */ static unsigned int khugepaged_pages_to_scan __read_mostly; static unsigned int khugepaged_pages_collapsed; @@ -1948,8 +1951,6 @@ static void set_recommended_min_free_kby int start_stop_khugepaged(void) { - static struct task_struct *khugepaged_thread __read_mostly; - static DEFINE_MUTEX(khugepaged_mutex); int err = 0; mutex_lock(&khugepaged_mutex); @@ -1976,3 +1977,11 @@ fail: mutex_unlock(&khugepaged_mutex); return err; } + +void khugepaged_min_free_kbytes_update(void) +{ + mutex_lock(&khugepaged_mutex); + if (khugepaged_enabled() && khugepaged_thread) + set_recommended_min_free_kbytes(); + mutex_unlock(&khugepaged_mutex); +} --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -64,6 +64,7 @@ #include #include #include +#include #include #include @@ -6785,6 +6786,8 @@ int __meminit init_per_zone_wmark_min(vo setup_min_slab_ratio(); #endif + khugepaged_min_free_kbytes_update(); + return 0; } postcore_initcall(init_per_zone_wmark_min) From patchwork Mon Oct 12 13:27:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 270378 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1B6EC43457 for ; Mon, 12 Oct 2020 13:36:03 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9C8C82076E for ; Mon, 12 Oct 2020 13:36:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509763; bh=DPJ7hSF8Bve5Cv5O4DeRfsryLXidSFc+kkrXAutzhMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=hZ7OUCO1kEpDp+d5kUxPti7u7hipLB3K0PC+Kcp6vexhD0CgUMdsMTJ4FU2lcMsq0 4L5kJ+grvvAE4Zj9ejCRsJuNGpZbm470/249tDRnaG9zfYdncGo/DFSVONd3e+pxtm PWXX9bHilofJ8B2kwXNtfe2whfjIx2COYpRSOoqc= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730949AbgJLNgC (ORCPT ); Mon, 12 Oct 2020 09:36:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:36796 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730686AbgJLNfi (ORCPT ); Mon, 12 Oct 2020 09:35:38 -0400 Received: from localhost (83-86-74-64.cable.dynamic.v4.ziggo.nl [83.86.74.64]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id C31DC2222A; Mon, 12 Oct 2020 13:35:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1602509733; bh=DPJ7hSF8Bve5Cv5O4DeRfsryLXidSFc+kkrXAutzhMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XVnMAue6qXHNqUMyrhGEuHfAJ+s6goFN/rd2qtq0nm9dU0NGgpXq/ONrdD5TutoB0 3RmkiLYgvyd4IwPGfYcJbTaxt48XXBLtqg8qKyRjGGCARPnaMyoGvuU8orE2ygrJAQ iLhCf2XzisQgJ9UljKj3XjGK1O0BTG2QUOrNnAAU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com, Petko Manolov , Anant Thazhemadam , "David S. Miller" Subject: [PATCH 4.9 54/54] net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Date: Mon, 12 Oct 2020 15:27:16 +0200 Message-Id: <20201012132632.078339755@linuxfoundation.org> X-Mailer: git-send-email 2.28.0 In-Reply-To: <20201012132629.585664421@linuxfoundation.org> References: <20201012132629.585664421@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Anant Thazhemadam commit f45a4248ea4cc13ed50618ff066849f9587226b2 upstream. When get_registers() fails in set_ethernet_addr(),the uninitialized value of node_id gets copied over as the address. So, check the return value of get_registers(). If get_registers() executed successfully (i.e., it returns sizeof(node_id)), copy over the MAC address using ether_addr_copy() (instead of using memcpy()). Else, if get_registers() failed instead, a randomly generated MAC address is set as the MAC address instead. Reported-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com Tested-by: syzbot+abbc768b560c84d92fd3@syzkaller.appspotmail.com Acked-by: Petko Manolov Signed-off-by: Anant Thazhemadam Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/rtl8150.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) --- a/drivers/net/usb/rtl8150.c +++ b/drivers/net/usb/rtl8150.c @@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * de return 1; } -static inline void set_ethernet_addr(rtl8150_t * dev) +static void set_ethernet_addr(rtl8150_t *dev) { - u8 node_id[6]; + u8 node_id[ETH_ALEN]; + int ret; - get_registers(dev, IDR, sizeof(node_id), node_id); - memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id)); + ret = get_registers(dev, IDR, sizeof(node_id), node_id); + + if (ret == sizeof(node_id)) { + ether_addr_copy(dev->netdev->dev_addr, node_id); + } else { + eth_hw_addr_random(dev->netdev); + netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n", + dev->netdev->dev_addr); + } } static int rtl8150_set_mac_address(struct net_device *netdev, void *p)