4.14.235-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.235-rc1 review
This is the start of the stable review cycle for the 4.14.235 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 02 Jun 2021 13:06:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.235-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.235-rc1
Chunfeng Yun <[email protected]>
usb: core: reduce power-on-good delay time of root hub
Jesse Brandeburg <[email protected]>
drivers/net/ethernet: clean up unused assignments
Mike Kravetz <[email protected]>
hugetlbfs: hugetlb_fault_mutex_hash() cleanup
Randy Dunlap <[email protected]>
MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
Randy Dunlap <[email protected]>
MIPS: alchemy: xxs1500: add gpio-au1000.h header file
Taehee Yoo <[email protected]>
sch_dsmark: fix a NULL deref in qdisc_reset()
Francesco Ruggeri <[email protected]>
ipv6: record frag_max_size in atomic fragments in input path
Dan Carpenter <[email protected]>
scsi: libsas: Use _safe() loop in sas_resume_port()
Jesse Brandeburg <[email protected]>
ixgbe: fix large MTU request from VF
Jussi Maki <[email protected]>
bpf: Set mac_len in bpf_skb_change_head
Dan Carpenter <[email protected]>
ASoC: cs35l33: fix an error code in probe()
Dan Carpenter <[email protected]>
staging: emxx_udc: fix loop in _nbu2ss_nuke()
Taehee Yoo <[email protected]>
mld: fix panic in mld_newpack()
Zhen Lei <[email protected]>
net: bnx2: Fix error return code in bnx2_init_board()
Christophe JAILLET <[email protected]>
net: mdio: octeon: Fix some double free issues
Christophe JAILLET <[email protected]>
net: mdio: thunder: Fix a double free issue in the .remove function
Christophe JAILLET <[email protected]>
net: netcp: Fix an error message
xinhui pan <[email protected]>
drm/amdgpu: Fix a use-after-free
Steve French <[email protected]>
SMB3: incorrect file id in requests compounded with open
Andy Shevchenko <[email protected]>
platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
Shyam Sundar S K <[email protected]>
platform/x86: hp-wireless: add AMD's hardware id to the supported list
Josef Bacik <[email protected]>
btrfs: do not BUG_ON in link_to_fixup_dir
Peter Zijlstra <[email protected]>
openrisc: Define memory barrier mb
Matt Wang <[email protected]>
scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
Greg Kroah-Hartman <[email protected]>
media: gspca: properly check for errors in po1030_probe()
Alaa Emad <[email protected]>
media: dvb: Add check on sp8870_readreg return
Greg Kroah-Hartman <[email protected]>
libertas: register sysfs groups properly
Phillip Potter <[email protected]>
dmaengine: qcom_hidma: comment platform_driver_register call
Phillip Potter <[email protected]>
isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
Atul Gopinathan <[email protected]>
ALSA: sb8: Add a comment note regarding an unused pointer
Tom Seewald <[email protected]>
char: hpet: add checks after calling ioremap
Du Cheng <[email protected]>
net: caif: remove BUG_ON(dev == NULL) in caif_xmit
Anirudh Rayabharam <[email protected]>
net: fujitsu: fix potential null-ptr-deref
Atul Gopinathan <[email protected]>
serial: max310x: unregister uart driver in case of failure and abort
Kai-Heng Feng <[email protected]>
platform/x86: hp_accel: Avoid invoking _INI to speed up resume
Felix Fietkau <[email protected]>
perf jevents: Fix getting maximum number of fds
Jean Delvare <[email protected]>
i2c: i801: Don't generate an interrupt on bus reset
Krzysztof Kozlowski <[email protected]>
i2c: s3c2410: fix possible NULL pointer deref on read message after write
Xin Long <[email protected]>
tipc: skb_linearize the head skb when reassembling msgs
Hoang Le <[email protected]>
Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
Vladyslav Tarasiuk <[email protected]>
net/mlx4: Fix EEPROM dump support
Neil Armstrong <[email protected]>
drm/meson: fix shutdown crash when component not probed
Zhang Xiaoxu <[email protected]>
NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
Trond Myklebust <[email protected]>
NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()
Dan Carpenter <[email protected]>
NFS: fix an incorrect limit in filelayout_decode_layout()
Thadeu Lima de Souza Cascardo <[email protected]>
Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
Pavel Skripkin <[email protected]>
net: usb: fix memory leak in smsc75xx_bind
Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
Zolton Jheng <[email protected]>
USB: serial: pl2303: add device id for ADLINK ND-6530 GC
Dominik Andreas Schorpp <[email protected]>
USB: serial: ftdi_sio: add IDs for IDS GmbH Products
Daniele Palmas <[email protected]>
USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
Sean MacLennan <[email protected]>
USB: serial: ti_usb_3410_5052: add startech.com device id
Zheyu Ma <[email protected]>
serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'
Geert Uytterhoeven <[email protected]>
serial: sh-sci: Fix off-by-one error in FIFO threshold register setting
Johan Hovold <[email protected]>
USB: trancevibrator: fix control-request direction
YueHaibing <[email protected]>
iio: adc: ad7793: Add missing error code in ad7793_setup()
Lucas Stankus <[email protected]>
staging: iio: cdc: ad7746: avoid overwrite of num_channels
Alexander Usyskin <[email protected]>
mei: request autosuspend after sending rx flow control
Mathias Nyman <[email protected]>
thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
Dongliang Mu <[email protected]>
misc/uss720: fix memory leak in uss720_probe
Greg Kroah-Hartman <[email protected]>
kgdb: fix gcc-11 warnings harder
Mikulas Patocka <[email protected]>
dm snapshot: properly fix a crash when an origin has no snapshots
Sriram R <[email protected]>
ath10k: Validate first subframe of A-MSDU before processing the list
Johannes Berg <[email protected]>
mac80211: check defrag PN against current frame
Mathy Vanhoef <[email protected]>
cfg80211: mitigate A-MSDU aggregation attacks
Mathy Vanhoef <[email protected]>
mac80211: prevent mixed key and fragment cache attacks
Mathy Vanhoef <[email protected]>
mac80211: assure all fragments are encrypted
Johan Hovold <[email protected]>
net: hso: fix control-request directions
Kees Cook <[email protected]>
proc: Check /proc/$pid/attr/ writes against file opener
Adrian Hunter <[email protected]>
perf intel-pt: Fix transaction abort handling
Adrian Hunter <[email protected]>
perf intel-pt: Fix sample instruction bytes
Rolf Eike Beer <[email protected]>
iommu/vt-d: Fix sysfs leak in alloc_iommu()
Anna Schumaker <[email protected]>
NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
Dongliang Mu <[email protected]>
NFC: nci: fix memory leak in nci_allocate_device
Mark Tomlinson <[email protected]>
netfilter: x_tables: Use correct memory barriers.
Jack Pham <[email protected]>
usb: dwc3: gadget: Enable suspend events
Andy Shevchenko <[email protected]>
scripts: switch explicitly to Python 3
Finn Behrens <[email protected]>
tweewide: Fix most Shebang lines
Stephen Brennan <[email protected]>
mm, vmstat: drop zone->lock in /proc/pagetypeinfo
-------------
Diffstat:
Documentation/sphinx/parse-headers.pl | 2 +- Documentation/target/tcm_mod_builder.py | 2 +- Documentation/trace/postprocess/decode_msr.py | 2 +- .../postprocess/trace-pagealloc-postprocess.pl | 2 +- .../trace/postprocess/trace-vmscan-postprocess.pl | 2 +- Makefile | 4 +- arch/ia64/scripts/unwcheck.py | 2 +- arch/mips/alchemy/board-xxs1500.c | 1 + arch/mips/ralink/of.c | 2 + arch/openrisc/include/asm/barrier.h | 9 ++ drivers/char/hpet.c | 4 + drivers/dma/qcom/hidma_mgmt.c | 14 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + drivers/gpu/drm/meson/meson_drv.c | 9 +- drivers/i2c/busses/i2c-i801.c | 6 +- drivers/i2c/busses/i2c-s3c2410.c | 3 + drivers/iio/adc/ad7793.c | 1 + drivers/iommu/dmar.c | 4 +- drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 +++-- drivers/md/dm-snap.c | 2 +- drivers/media/dvb-frontends/sp8870.c | 4 +- drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +- drivers/misc/kgdbts.c | 3 +- drivers/misc/lis3lv02d/lis3lv02d.h | 1 + drivers/misc/mei/interrupt.c | 3 + drivers/net/caif/caif_serial.c | 1 - drivers/net/ethernet/broadcom/bnx2.c | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 7 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/dec/tulip/media.c | 5 - drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 + drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 16 ++- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- drivers/net/ethernet/mellanox/mlx4/port.c | 107 ++++++++++++++++++++- drivers/net/ethernet/micrel/ksz884x.c | 3 +- drivers/net/ethernet/neterion/vxge/vxge-traffic.c | 32 +++--- drivers/net/ethernet/sfc/falcon/farch.c | 29 +++--- drivers/net/ethernet/sis/sis900.c | 5 +- drivers/net/ethernet/synopsys/dwc-xlgmac-common.c | 2 +- drivers/net/ethernet/ti/davinci_emac.c | 5 +- drivers/net/ethernet/ti/netcp_core.c | 4 +- drivers/net/ethernet/ti/tlan.c | 4 +- drivers/net/ethernet/via/via-velocity.c | 13 --- drivers/net/phy/mdio-octeon.c | 2 - drivers/net/phy/mdio-thunder.c | 1 - drivers/net/usb/hso.c | 4 +- drivers/net/usb/smsc75xx.c | 8 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 61 +++++++++++- drivers/net/wireless/marvell/libertas/mesh.c | 28 +----- drivers/platform/x86/hp-wireless.c | 2 + drivers/platform/x86/hp_accel.c | 22 ++++- drivers/platform/x86/intel_punit_ipc.c | 1 + drivers/scsi/BusLogic.c | 6 +- drivers/scsi/BusLogic.h | 2 +- drivers/scsi/libsas/sas_port.c | 4 +- drivers/staging/emxx_udc/emxx_udc.c | 4 +- drivers/staging/iio/cdc/ad7746.c | 1 - drivers/thunderbolt/dma_port.c | 11 ++- drivers/tty/serial/max310x.c | 6 +- drivers/tty/serial/rp2.c | 52 ++++------ drivers/tty/serial/sh-sci.c | 4 +- drivers/usb/core/hub.h | 6 +- drivers/usb/dwc3/gadget.c | 4 + drivers/usb/gadget/udc/renesas_usb3.c | 5 +- drivers/usb/misc/trancevibrator.c | 4 +- drivers/usb/misc/uss720.c | 1 + drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 7 ++ drivers/usb/serial/option.c | 4 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/ti_usb_3410_5052.c | 3 + fs/btrfs/tree-log.c | 2 - fs/cifs/smb2pdu.c | 6 +- fs/hugetlbfs/inode.c | 4 +- fs/nfs/filelayout/filelayout.c | 2 +- fs/nfs/nfs4file.c | 2 +- fs/nfs/pagelist.c | 12 +-- fs/nfs/pnfs.c | 15 ++- fs/proc/base.c | 4 + include/linux/hugetlb.h | 2 +- include/linux/netfilter/x_tables.h | 2 +- include/net/nfc/nci_core.h | 1 + mm/hugetlb.c | 11 +-- mm/userfaultfd.c | 2 +- mm/vmstat.c | 3 + net/bluetooth/cmtp/core.c | 5 + net/core/filter.c | 1 + net/ipv6/mcast.c | 3 - net/ipv6/reassembly.c | 4 +- net/mac80211/ieee80211_i.h | 12 ++- net/mac80211/key.c | 7 ++ net/mac80211/key.h | 2 + net/mac80211/rx.c | 34 ++++--- net/mac80211/wpa.c | 13 ++- net/netfilter/x_tables.c | 3 + net/nfc/nci/core.c | 1 + net/nfc/nci/hci.c | 5 + net/sched/sch_dsmark.c | 3 +- net/tipc/msg.c | 9 +- net/tipc/socket.c | 5 +- net/wireless/util.c | 3 + scripts/bloat-o-meter | 2 +- scripts/config | 2 +- scripts/diffconfig | 2 +- scripts/show_delta | 2 +- scripts/sphinx-pre-install | 2 +- scripts/tracing/draw_functrace.py | 2 +- sound/isa/sb/sb8.c | 6 +- sound/soc/codecs/cs35l33.c | 1 + tools/kvm/kvm_stat/kvm_stat | 2 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/python/tracepoint.py | 2 +- tools/perf/python/twatch.py | 2 +- tools/perf/scripts/python/call-graph-from-sql.py | 2 +- tools/perf/scripts/python/sched-migration.py | 2 +- tools/perf/tests/attr.py | 2 +- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 6 +- tools/perf/util/intel-pt.c | 5 +- tools/perf/util/setup.py | 2 +- tools/power/pm-graph/analyze_boot.py | 2 +- tools/power/pm-graph/analyze_suspend.py | 2 +- .../x86/intel_pstate_tracer/intel_pstate_tracer.py | 2 +- tools/testing/ktest/compare-ktest-sample.pl | 2 +- tools/testing/selftests/tc-testing/tdc_batch.py | 2 +- 126 files changed, 548 insertions(+), 311 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/79 mm, vmstat: drop zone->lock in /proc/pagetypeinfo
From: Stephen Brennan <[email protected]>
Commit 93b3a674485f6a4b8ffff85d1682d5e8b7c51560 upstream
Commit 93b3a674485f ("mm,vmstat: reduce zone->lock holding time by /proc/pagetypeinfo") upstream caps the number of iterations over each free_list at 100,000, and also drops the zone->lock in between each migrate type. Capping the iteration count alters the file contents in some cases, which means this approach may not be suitable for stable backports.
However, dropping zone->lock in between migrate types (and, as a result, page orders) will not change the /proc/pagetypeinfo file contents. It can significantly reduce the length of time spent with IRQs disabled, which can prevent missed interrupts or soft lockups which we have observed on systems with particularly large memory.
Thus, this commit is a modified version of the upstream one which only drops the lock in between migrate types.
--- mm/vmstat.c | 3 +++ 1 file changed, 3 insertions(+)
mm/vmstat.c +3 -0
@@ -1313,6 +1313,9 @@ static void pagetypeinfo_showfree_print(list_for_each (curr, &area->free_list[mtype]) freecount++;seq_printf (m,"%6lu " , freecount); +spin_unlock_irq (&zone->lock); +cond_resched (); +spin_lock_irq (&zone->lock); }seq_putc (m,'\n' ); }
Greg Kroah-Hartman
maintainerPATCH 2/79 tweewide: Fix most Shebang lines
In reply to Greg Kroah-HartmanFrom: Finn Behrens <[email protected]>
commit c25ce589dca10d64dde139ae093abc258a32869c upstream.
Change every shebang which does not need an argument to use /usr/bin/env. This is needed as not every distro has everything under /usr/bin, sometimes not even bash.
--- Documentation/sphinx/parse-headers.pl | 2 +- Documentation/target/tcm_mod_builder.py | 2 +- Documentation/trace/postprocess/decode_msr.py | 2 +- Documentation/trace/postprocess/trace-pagealloc-postprocess.pl | 2 +- Documentation/trace/postprocess/trace-vmscan-postprocess.pl | 2 +- arch/ia64/scripts/unwcheck.py | 2 +- scripts/bloat-o-meter | 2 +- scripts/config | 2 +- scripts/diffconfig | 2 +- scripts/show_delta | 2 +- scripts/sphinx-pre-install | 2 +- scripts/tracing/draw_functrace.py | 2 +- tools/kvm/kvm_stat/kvm_stat | 2 +- tools/perf/python/tracepoint.py | 2 +- tools/perf/python/twatch.py | 2 +- tools/perf/scripts/python/call-graph-from-sql.py | 2 +- tools/perf/scripts/python/sched-migration.py | 2 +- tools/perf/tests/attr.py | 2 +- tools/perf/util/setup.py | 2 +- tools/power/pm-graph/analyze_boot.py | 2 +- tools/power/pm-graph/analyze_suspend.py | 2 +- tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py | 2 +- tools/testing/ktest/compare-ktest-sample.pl | 2 +- tools/testing/selftests/tc-testing/tdc_batch.py | 2 +- 24 files changed, 24 insertions(+), 24 deletions(-)
Documentation/sphinx/parse-headers.pl +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/env perl use strict; use Text::Tabs; use Getopt::Long;
Documentation/target/tcm_mod_builder.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # The TCM v4 multi-protocol fabric module generation script for drivers/target/$NEW_MOD # # Copyright (c) 2010 Rising Tide Systems
Documentation/trace/postprocess/decode_msr.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # add symbolic names to read_msr / write_msr in trace # decode_msr msr-index.h < trace import sys
Documentation/trace/postprocess/trace-pagealloc-postprocess.pl +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/env perl # This is a POC (proof of concept or piece of crap, take your pick) for reading the # text representation of trace output related to page allocation. It makes an attempt # to extract some high-level information on what is going on. The accuracy of the parser
Documentation/trace/postprocess/trace-vmscan-postprocess.pl +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/env perl # This is a POC for reading the text representation of trace output related to # page reclaim. It makes an attempt to extract some high-level information on # what is going on. The accuracy of the parser may vary
arch/ia64/scripts/unwcheck.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # SPDX-License-Identifier: GPL-2.0 # # Usage: unwcheck.py FILE
scripts/bloat-o-meter +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # Copyright 2004 Matt Mackall <[email protected]> #
scripts/config +1 -1
@@ -1,4 +1,4 @@ -#!/bin/bash +#!/usr/bin/env bash # SPDX-License-Identifier: GPL-2.0 # Manipulate options in a .config file from the command line
scripts/diffconfig +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # SPDX-License-Identifier: GPL-2.0 # # diffconfig - a tool to compare .config files.
scripts/show_delta +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # show_deltas: Read list of printk messages instrumented with # time data, and format with time deltas.
scripts/sphinx-pre-install +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/env perl use strict; # Copyright (c) 2017 Mauro Carvalho Chehab <[email protected]>
scripts/tracing/draw_functrace.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python """ Copyright 2008 (c) Frederic Weisbecker <[email protected]>
tools/kvm/kvm_stat/kvm_stat +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # top-like utility for displaying kvm statistics #
tools/perf/python/tracepoint.py +1 -1
@@ -1,4 +1,4 @@ -#! /usr/bin/python +#! /usr/bin/env python # SPDX-License-Identifier: GPL-2.0 # -*- python -*- # -*- coding: utf-8 -*-
tools/perf/python/twatch.py +1 -1
@@ -1,4 +1,4 @@ -#! /usr/bin/python +#! /usr/bin/env python # -*- python -*- # -*- coding: utf-8 -*- # twatch - Experimental use of the perf python interface
tools/perf/scripts/python/call-graph-from-sql.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python2 +#!/usr/bin/env python2 # call-graph-from-sql.py: create call-graph from sql database # Copyright (c) 2014-2017, Intel Corporation. #
tools/perf/scripts/python/sched-migration.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # Cpu task migration overview toy #
tools/perf/tests/attr.py +1 -1
@@ -1,4 +1,4 @@ -#! /usr/bin/python +#! /usr/bin/env python # SPDX-License-Identifier: GPL-2.0 import os
tools/perf/util/setup.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python2 +#!/usr/bin/env python2 from os import getenv
tools/power/pm-graph/analyze_boot.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # Tool for analyzing boot timing # Copyright (c) 2013, Intel Corporation.
tools/power/pm-graph/analyze_suspend.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # # Tool for analyzing suspend/resume timing # Copyright (c) 2013, Intel Corporation.
tools/power/x86/intel_pstate_tracer/intel_pstate_tracer.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python +#!/usr/bin/env python # -*- coding: utf-8 -*- # """ This utility can be used to debug and tune the performance of the
tools/testing/ktest/compare-ktest-sample.pl +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/perl +#!/usr/bin/env perl # SPDX-License-Identifier: GPL-2.0 open (IN,"ktest.pl");
tools/testing/selftests/tc-testing/tdc_batch.py +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/python3 +#!/usr/bin/env python3 """ tdc_batch.py - a script to generate TC batch file
Greg Kroah-Hartman
maintainerPATCH 3/79 scripts: switch explicitly to Python 3
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 51839e29cb5954470ea4db7236ef8c3d77a6e0bb upstream.
Some distributions are about to switch to Python 3 support only. This means that /usr/bin/python, which is Python 2, is not available anymore. Hence, switch scripts to use Python 3 explicitly.
--- scripts/bloat-o-meter | 2 +- scripts/diffconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
scripts/bloat-o-meter +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # # Copyright 2004 Matt Mackall <[email protected]> #
scripts/diffconfig +1 -1
@@ -1,4 +1,4 @@ -#!/usr/bin/env python +#!/usr/bin/env python3 # SPDX-License-Identifier: GPL-2.0 # # diffconfig - a tool to compare .config files.
Greg Kroah-Hartman
maintainerPATCH 4/79 usb: dwc3: gadget: Enable suspend events
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
commit d1d90dd27254c44d087ad3f8b5b3e4fff0571f45 upstream.
commit 72704f876f50 ("dwc3: gadget: Implement the suspend entry event handler") introduced (nearly 5 years ago!) an interrupt handler for U3/L1-L2 suspend events. The problem is that these events aren't currently enabled in the DEVTEN register so the handler is never even invoked. Fix this simply by enabling the corresponding bit in dwc3_gadget_enable_irq() using the same revision check as found in the handler.
[[email protected]: backport to pre-5.7 by replacing
DWC3_IS_VER_PRIOR check with direct comparison of dwc->revision]
--- drivers/usb/dwc3/gadget.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/dwc3/gadget.c +4 -0
@@ -1829,6 +1829,10 @@ static void dwc3_gadget_enable_irq(strucif (dwc->revision <DWC3_REVISION_250A ) reg |=DWC3_DEVTEN_ULSTCNGEN ; +/* On 2.30a and above this bit enables U3/L2-L1 Suspend Events */ +if (dwc->revision >=DWC3_REVISION_230A ) + reg |=DWC3_DEVTEN_EOPFEN ; +dwc3_writel (dwc->regs,DWC3_DEVTEN , reg); }
Greg Kroah-Hartman
maintainerPATCH 5/79 netfilter: x_tables: Use correct memory barriers.
In reply to Greg Kroah-HartmanFrom: Mark Tomlinson <[email protected]>
commit 175e476b8cdf2a4de7432583b49c871345e4f8a1 upstream.
When a new table value was assigned, it was followed by a write memory barrier. This ensured that all writes before this point would complete before any writes after this point. However, to determine whether the rules are unused, the sequence counter is read. To ensure that all writes have been done before these reads, a full memory barrier is needed, not just a write memory barrier. The same argument applies when incrementing the counter, before the rules are read.
Changing to using smp_mb() instead of smp_wmb() fixes the kernel panic reported in cc00bcaa5899 (which is still present), while still maintaining the same speed of replacing tables.
The smb_mb() barriers potentially slow the packet path, however testing has shown no measurable change in performance on a 4-core MIPS64 platform.
--- include/linux/netfilter/x_tables.h | 2 +- net/netfilter/x_tables.c | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-)
include/linux/netfilter/x_tables.h +1 -1
@@ -373,7 +373,7 @@ static inline unsigned int xt_write_recs* since addend is most likely 1 */ __this_cpu_add (xt_recseq.sequence, addend); -smp_wmb (); +smp_mb ();return addend; }
net/netfilter/x_tables.c +3 -0
@@ -1249,6 +1249,9 @@ xt_replace_table(struct xt_table *table,smp_wmb (); table->private = newinfo; +/* make sure all cpus see new ->private value */ +smp_mb (); +/* * Even though table entries have now been swapped, other CPU's * may still be using the old entries. This is okay, because
Greg Kroah-Hartman
maintainerPATCH 6/79 NFC: nci: fix memory leak in nci_allocate_device
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit e0652f8bb44d6294eeeac06d703185357f25d50b upstream.
nfcmrvl_disconnect fails to free the hci_dev field in struct nci_dev. Fix this by freeing hci_dev in nci_free_device.
BUG: memory leak
unreferenced object 0xffff888111ea6800 (size 1024):
comm "kworker/1:0", pid 19, jiffies 4294942308 (age 13.580s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 60 fd 0c 81 88 ff ff .........`......
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<000000004bc25d43>] kmalloc include/linux/slab.h:552 [inline]
[<000000004bc25d43>] kzalloc include/linux/slab.h:682 [inline]
[<000000004bc25d43>] nci_hci_allocate+0x21/0xd0 net/nfc/nci/hci.c:784
[<00000000c59cff92>] nci_allocate_device net/nfc/nci/core.c:1170 [inline]
[<00000000c59cff92>] nci_allocate_device+0x10b/0x160 net/nfc/nci/core.c:1132
[<00000000006e0a8e>] nfcmrvl_nci_register_dev+0x10a/0x1c0 drivers/nfc/nfcmrvl/main.c:153
[<000000004da1b57e>] nfcmrvl_probe+0x223/0x290 drivers/nfc/nfcmrvl/usb.c:345
[<00000000d506aed9>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554
[<00000000f5009125>] driver_probe_device+0x84/0x100 drivers/base/dd.c:740
[<000000000ce658ca>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:846
[<000000007067d05f>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
[<00000000f8e13372>] __device_attach+0x122/0x250 drivers/base/dd.c:914
[<000000009cf68860>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
[<00000000359c965a>] device_add+0x5be/0xc30 drivers/base/core.c:3109
[<00000000086e4bd3>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2164
[<00000000ca036872>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
[<00000000d40d36f6>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293
[<00000000bc632c92>] really_probe+0x159/0x4a0 drivers/base/dd.c:554--- include/net/nfc/nci_core.h | 1 + net/nfc/nci/core.c | 1 + net/nfc/nci/hci.c | 5 +++++ 3 files changed, 7 insertions(+)
include/net/nfc/nci_core.h +1 -0
@@ -310,6 +310,7 @@ int nci_nfcc_loopback(struct nci_dev *nd struct sk_buff **resp);struct nci_hci_dev *nci_hci_allocate (struct nci_dev *ndev); +void nci_hci_deallocate (struct nci_dev *ndev);int nci_hci_send_event (struct nci_dev *ndev,u8 gate,u8 event,const u8 *param,size_t param_len); int nci_hci_send_cmd(struct nci_dev *ndev, u8 gate,
net/nfc/nci/core.c +1 -0
@@ -1187,6 +1187,7 @@ EXPORT_SYMBOL(nci_allocate_device);void nci_free_device (struct nci_dev *ndev) {nfc_free_device (ndev->nfc_dev); +nci_hci_deallocate (ndev);kfree (ndev); }EXPORT_SYMBOL (nci_free_device);
net/nfc/nci/hci.c +5 -0
@@ -807,3 +807,8 @@ struct nci_hci_dev *nci_hci_allocate(strreturn hdev; } + +void nci_hci_deallocate (struct nci_dev *ndev) +{ +kfree (ndev->hci_dev); +}
Greg Kroah-Hartman
maintainerPATCH 7/79 NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()
In reply to Greg Kroah-HartmanFrom: Anna Schumaker <[email protected]>
commit a421d218603ffa822a0b8045055c03eae394a7eb upstream.
Commit de144ff4234f changes _pnfs_return_layout() to call pnfs_mark_matching_lsegs_return() passing NULL as the struct pnfs_layout_range argument. Unfortunately, pnfs_mark_matching_lsegs_return() doesn't check if we have a value here before dereferencing it, causing an oops.
I'm able to hit this crash consistently when running connectathon basic tests on NFS v4.1/v4.2 against Ontap.
--- fs/nfs/pnfs.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
fs/nfs/pnfs.c +7 -8
@@ -1136,6 +1136,11 @@ _pnfs_return_layout(struct inode *ino) {struct pnfs_layout_hdr *lo =NULL ;struct nfs_inode *nfsi =NFS_I (ino); +struct pnfs_layout_range range = { + .iomode =IOMODE_ANY , + .offset =0 , + .length =NFS4_MAX_UINT64 , + };LIST_HEAD (tmp_list);nfs4_stateid stateid;int status =0 ;
@@ -1162,16 +1167,10 @@ _pnfs_return_layout(struct inode *ino) } valid_layout =pnfs_layout_is_valid (lo);pnfs_clear_layoutcommit (ino, &tmp_list); -pnfs_mark_matching_lsegs_return (lo, &tmp_list,NULL ,0 ); +pnfs_mark_matching_lsegs_return (lo, &tmp_list, &range,0 ); -if (NFS_SERVER (ino)->pnfs_curr_ld->return_range) { -struct pnfs_layout_range range = { - .iomode =IOMODE_ANY , - .offset =0 , - .length =NFS4_MAX_UINT64 , - }; +if (NFS_SERVER (ino)->pnfs_curr_ld->return_range)NFS_SERVER (ino)->pnfs_curr_ld->return_range (lo, &range); - }/* Don't send a LAYOUTRETURN if list was initially empty */ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) ||
Greg Kroah-Hartman
maintainerPATCH 8/79 iommu/vt-d: Fix sysfs leak in alloc_iommu()
In reply to Greg Kroah-HartmanFrom: Rolf Eike Beer <[email protected]>
commit 0ee74d5a48635c848c20f152d0d488bf84641304 upstream.
iommu_device_sysfs_add() is called before, so is has to be cleaned on subsequent errors.
--- drivers/iommu/dmar.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iommu/dmar.c +3 -1
@@ -1116,7 +1116,7 @@ static int alloc_iommu(struct dmar_drhd_ err =iommu_device_register (&iommu->iommu);if (err) - goto err_unmap; + goto err_sysfs; } drhd->iommu = iommu;
@@ -1124,6 +1124,8 @@ static int alloc_iommu(struct dmar_drhd_return 0 ; +err_sysfs: +iommu_device_sysfs_remove (&iommu->iommu); err_unmap:unmap_iommu (iommu); error_free_seq_id:
Greg Kroah-Hartman
maintainerPATCH 9/79 perf intel-pt: Fix sample instruction bytes
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit c954eb72b31a9dc56c99b450253ec5b121add320 upstream.
The decoder reports the current instruction if it was decoded. In some cases the current instruction is not decoded, in which case the instruction bytes length must be set to zero. Ensure that is always done.
Note perf script can anyway get the instruction bytes for any samples where they are not present.
Also note, that there is a redundant "ptq->insn_len = 0" statement which is not removed until a subsequent patch in order to make this patch apply cleanly to stable branches.
Example:
A machne that supports TSX is required. It will have flag "rtm". Kernel parameter tsx=on may be required.
# for w in `cat /proc/cpuinfo | grep -m1 flags `;do echo $w | grep rtm ; done rtm
Test program:
#include <stdio.h>
#include <immintrin.h>
int main()
{
int x = 0;
if (_xbegin() == _XBEGIN_STARTED) {
x = 1;
_xabort(1);
} else {
printf("x = %d\n", x);
}
return 0;}
Compile with -mrtm i.e.
gcc -Wall -Wextra -mrtm xabort.c -o xabort
Record:
perf record -e intel_pt/cyc/u --filter 'filter main @ ./xabort' ./xabort
Before:
# perf script --itrace=xe -F+flags,+insn,-period --xed --ns
xabort 1478 [007] 92161.431348581: transactions: x 400b81 main+0x14 (/root/xabort) mov $0xffffffff, %eax
xabort 1478 [007] 92161.431348624: transactions: tx abrt 400b93 main+0x26 (/root/xabort) mov $0xffffffff, %eaxAfter:
# perf script --itrace=xe -F+flags,+insn,-period --xed --ns
xabort 1478 [007] 92161.431348581: transactions: x 400b81 main+0x14 (/root/xabort) xbegin 0x6
xabort 1478 [007] 92161.431348624: transactions: tx abrt 400b93 main+0x26 (/root/xabort) xabort $0x1--- tools/perf/util/intel-pt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/util/intel-pt.c +4 -1
@@ -535,8 +535,10 @@ static int intel_pt_walk_next_insn(struc *ip += intel_pt_insn->length; -if (to_ip && *ip == to_ip) +if (to_ip && *ip == to_ip) { + intel_pt_insn->length =0 ; goto out_no_cache; + }if (*ip >= al.map->end)break ;
@@ -923,6 +925,7 @@ static void intel_pt_set_pid_tid_cpu(strstatic void intel_pt_sample_flags (struct intel_pt_queue *ptq) { + ptq->insn_len =0 ;if (ptq->state->flags &INTEL_PT_ABORT_TX ) { ptq->flags =PERF_IP_FLAG_BRANCH |PERF_IP_FLAG_TX_ABORT ; }else if (ptq->state->flags &INTEL_PT_ASYNC ) {
Greg Kroah-Hartman
maintainerPATCH 10/79 perf intel-pt: Fix transaction abort handling
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
commit cb7987837c31b217b28089bbc78922d5c9187869 upstream.
When adding support for power events, some handling of FUP packets was unified. That resulted in breaking reporting of TSX aborts, by not considering the associated TIP packet. Fix that.
Example:
A machine that supports TSX is required. It will have flag "rtm". Kernel parameter tsx=on may be required.
# for w in `cat /proc/cpuinfo | grep -m1 flags `;do echo $w | grep rtm ; done rtm
Test program:
#include <stdio.h>
#include <immintrin.h>
int main()
{
int x = 0;
if (_xbegin() == _XBEGIN_STARTED) {
x = 1;
_xabort(1);
} else {
printf("x = %d\n", x);
}
return 0;}
Compile with -mrtm i.e.
gcc -Wall -Wextra -mrtm xabort.c -o xabort
Record:
perf record -e intel_pt/cyc/u --filter 'filter main @ ./xabort' ./xabort
Before:
# perf script --itrace=be -F+flags,+addr,-period,-event --ns
xabort 1478 [007] 92161.431348552: tr strt 0 [unknown] ([unknown]) => 400b6d main+0x0 (/root/xabort)
xabort 1478 [007] 92161.431348624: jmp 400b96 main+0x29 (/root/xabort) => 400bae main+0x41 (/root/xabort)
xabort 1478 [007] 92161.431348624: return 400bb4 main+0x47 (/root/xabort) => 400b87 main+0x1a (/root/xabort)
xabort 1478 [007] 92161.431348637: jcc 400b8a main+0x1d (/root/xabort) => 400b98 main+0x2b (/root/xabort)
xabort 1478 [007] 92161.431348644: tr end call 400ba9 main+0x3c (/root/xabort) => 40f690 printf+0x0 (/root/xabort)
xabort 1478 [007] 92161.431360859: tr strt 0 [unknown] ([unknown]) => 400bae main+0x41 (/root/xabort)
xabort 1478 [007] 92161.431360882: tr end return 400bb4 main+0x47 (/root/xabort) => 401139 __libc_start_main+0x309 (/root/xabort)After:
# perf script --itrace=be -F+flags,+addr,-period,-event --ns
xabort 1478 [007] 92161.431348552: tr strt 0 [unknown] ([unknown]) => 400b6d main+0x0 (/root/xabort)
xabort 1478 [007] 92161.431348624: tx abrt 400b93 main+0x26 (/root/xabort) => 400b87 main+0x1a (/root/xabort)
xabort 1478 [007] 92161.431348637: jcc 400b8a main+0x1d (/root/xabort) => 400b98 main+0x2b (/root/xabort)
xabort 1478 [007] 92161.431348644: tr end call 400ba9 main+0x3c (/root/xabort) => 40f690 printf+0x0 (/root/xabort)
xabort 1478 [007] 92161.431360859: tr strt 0 [unknown] ([unknown]) => 400bae main+0x41 (/root/xabort)
xabort 1478 [007] 92161.431360882: tr end return 400bb4 main+0x47 (/root/xabort) => 401139 __libc_start_main+0x309 (/root/xabort)--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +5 -1
@@ -1063,6 +1063,8 @@ static bool intel_pt_fup_event(struct in decoder->set_fup_tx_flags = false; decoder->tx_flags = decoder->fup_tx_flags; decoder->state.type =INTEL_PT_TRANSACTION ; +if (decoder->fup_tx_flags &INTEL_PT_ABORT_TX ) + decoder->state.type |=INTEL_PT_BRANCH ; decoder->state.from_ip = decoder->ip; decoder->state.to_ip =0 ; decoder->state.flags = decoder->fup_tx_flags;
@@ -1129,8 +1131,10 @@ static int intel_pt_walk_fup(struct intereturn 0 ;if (err == -EAGAIN ||intel_pt_fup_with_nlip (decoder, &intel_pt_insn, ip, err)) { +bool no_tip = decoder->pkt_state !=INTEL_PT_STATE_FUP ; + decoder->pkt_state =INTEL_PT_STATE_IN_SYNC ; -if (intel_pt_fup_event (decoder)) +if (intel_pt_fup_event (decoder) && no_tip)return 0 ;return -EAGAIN ; }
Greg Kroah-Hartman
maintainerPATCH 11/79 proc: Check /proc/$pid/attr/ writes against file opener
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit bfb819ea20ce8bbeeba17e1a6418bf8bda91fc28 upstream.
Fix another "confused deputy" weakness[1]. Writes to /proc/$pid/attr/ files need to check the opener credentials, since these fds do not transition state across execve(). Without this, it is possible to trick another process (which may have different credentials) to write to its own /proc/$pid/attr/ files, leading to unexpected and possibly exploitable behaviors.
--- fs/proc/base.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/proc/base.c +4 -0
@@ -2557,6 +2557,10 @@ static ssize_t proc_pid_attr_write(strucssize_t length;struct task_struct *task =get_proc_task (inode); +/* A task may only write when it was the opener. */ +if (file->f_cred !=current_real_cred ()) +return -EPERM ; + length = -ESRCH ;if (!task) goto out_no_task;
Greg Kroah-Hartman
maintainerPATCH 12/79 net: hso: fix control-request directions
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 1a6e9a9c68c1f183872e4bcc947382111c2e04eb upstream.
The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation.
Fix the tiocmset and rfkill requests which erroneously used usb_rcvctrlpipe().
--- drivers/net/usb/hso.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/usb/hso.c +2 -2
@@ -1701,7 +1701,7 @@ static int hso_serial_tiocmset(struct ttspin_unlock_irqrestore (&serial->serial_lock, flags);return usb_control_msg (serial->parent->usb, -usb_rcvctrlpipe (serial->parent->usb,0 ),0x22 , +usb_sndctrlpipe (serial->parent->usb,0 ),0x22 ,0x21 , val, if_num,NULL ,0 ,USB_CTRL_SET_TIMEOUT ); }
@@ -2449,7 +2449,7 @@ static int hso_rfkill_set_block(void *daif (hso_dev->usb_gone) rv =0 ;else - rv =usb_control_msg (hso_dev->usb,usb_rcvctrlpipe (hso_dev->usb,0 ), + rv =usb_control_msg (hso_dev->usb,usb_sndctrlpipe (hso_dev->usb,0 ), enabled ?0x82 :0x81 ,0x40 ,0 ,0 ,NULL ,0 ,USB_CTRL_SET_TIMEOUT );mutex_unlock (&hso_dev->mutex);
Greg Kroah-Hartman
maintainerPATCH 13/79 mac80211: assure all fragments are encrypted
In reply to Greg Kroah-HartmanFrom: Mathy Vanhoef <[email protected]>
commit 965a7d72e798eb7af0aa67210e37cf7ecd1c9cad upstream.
Do not mix plaintext and encrypted fragments in protected Wi-Fi networks. This fixes CVE-2020-26147.
Previously, an attacker was able to first forward a legitimate encrypted fragment towards a victim, followed by a plaintext fragment. The encrypted and plaintext fragment would then be reassembled. For further details see Section 6.3 and Appendix D in the paper "Fragment and Forge:
Breaking Wi-Fi Through Frame Aggregation and Fragmentation".
Because of this change there are now two equivalent conditions in the code to determine if a received fragment requires sequential PNs, so we also move this test to a separate function to make the code easier to maintain.
--- net/mac80211/rx.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-)
net/mac80211/rx.c +12 -11
@@ -1968,6 +1968,16 @@ ieee80211_reassemble_find(struct ieee802return NULL ; } +static bool requires_sequential_pn (struct ieee80211_rx_data *rx,__le16 fc) +{ +return rx->key && + (rx->key->conf.cipher ==WLAN_CIPHER_SUITE_CCMP || + rx->key->conf.cipher ==WLAN_CIPHER_SUITE_CCMP_256 || + rx->key->conf.cipher ==WLAN_CIPHER_SUITE_GCMP || + rx->key->conf.cipher ==WLAN_CIPHER_SUITE_GCMP_256 ) && +ieee80211_has_protected (fc); +} + static ieee80211_rx_result debug_noinlineieee80211_rx_h_defragment (struct ieee80211_rx_data *rx) {
@@ -2012,12 +2022,7 @@ ieee80211_rx_h_defragment(struct ieee802/* This is the first fragment of a new frame. */ entry =ieee80211_reassemble_add (rx->sdata, frag, seq, rx->seqno_idx, &(rx->skb)); -if (rx->key && - (rx->key->conf.cipher ==WLAN_CIPHER_SUITE_CCMP || - rx->key->conf.cipher ==WLAN_CIPHER_SUITE_CCMP_256 || - rx->key->conf.cipher ==WLAN_CIPHER_SUITE_GCMP || - rx->key->conf.cipher ==WLAN_CIPHER_SUITE_GCMP_256 ) && -ieee80211_has_protected (fc)) { +if (requires_sequential_pn (rx, fc)) {int queue = rx->security_idx;/* Store CCMP/GCMP PN so that we can verify that the
@@ -2059,11 +2064,7 @@ ieee80211_rx_h_defragment(struct ieee802u8 pn[IEEE80211_CCMP_PN_LEN ], *rpn;int queue; -if (!rx->key || - (rx->key->conf.cipher !=WLAN_CIPHER_SUITE_CCMP && - rx->key->conf.cipher !=WLAN_CIPHER_SUITE_CCMP_256 && - rx->key->conf.cipher !=WLAN_CIPHER_SUITE_GCMP && - rx->key->conf.cipher !=WLAN_CIPHER_SUITE_GCMP_256 )) +if (!requires_sequential_pn (rx, fc))return RX_DROP_UNUSABLE ;memcpy (pn, entry->last_pn,IEEE80211_CCMP_PN_LEN );for (i =IEEE80211_CCMP_PN_LEN -1 ; i >=0 ; i--) {
Greg Kroah-Hartman
maintainerPATCH 14/79 mac80211: prevent mixed key and fragment cache attacks
In reply to Greg Kroah-HartmanFrom: Mathy Vanhoef <[email protected]>
commit 94034c40ab4a3fcf581fbc7f8fdf4e29943c4a24 upstream.
Simultaneously prevent mixed key attacks (CVE-2020-24587) and fragment cache attacks (CVE-2020-24586). This is accomplished by assigning a unique color to every key (per interface) and using this to track which key was used to decrypt a fragment. When reassembling frames, it is now checked whether all fragments were decrypted using the same key.
To assure that fragment cache attacks are also prevented, the ID that is assigned to keys is unique even over (re)associations and (re)connects. This means fragments separated by a (re)association or (re)connect will not be reassembled. Because mac80211 now also prevents the reassembly of mixed encrypted and plaintext fragments, all cache attacks are prevented.
--- net/mac80211/ieee80211_i.h | 1 + net/mac80211/key.c | 7 +++++++ net/mac80211/key.h | 2 ++ net/mac80211/rx.c | 6 ++++++ 4 files changed, 16 insertions(+)
net/mac80211/ieee80211_i.h +1 -0
@@ -99,6 +99,7 @@ struct ieee80211_fragment_entry {u8 rx_queue;bool check_sequential_pn;/* needed for CCMP/GCMP */ u8 last_pn[6 ];/* PN of the last fragment if CCMP was used */ +unsigned int key_color; };
net/mac80211/key.c +7 -0
@@ -647,6 +647,7 @@ int ieee80211_key_link(struct ieee80211_struct ieee80211_sub_if_data *sdata, struct sta_info *sta) { + static atomic_t key_color = ATOMIC_INIT(0);struct ieee80211_local *local = sdata->local;struct ieee80211_key *old_key;int idx = key->conf.keyidx;
@@ -682,6 +683,12 @@ int ieee80211_key_link(struct ieee80211_ key->sdata = sdata; key->sta = sta; +/* +* Assign a unique ID to every key so we can easily prevent mixed +* key and fragment cache attacks. +*/ + key->color =atomic_inc_return (&key_color); +increment_tailroom_need_count (sdata);ieee80211_key_replace (sdata, sta, pairwise, old_key, key);
net/mac80211/key.h +2 -0
@@ -127,6 +127,8 @@ struct ieee80211_key { } debugfs;#endif +unsigned int color; +/* * key config, must be last because it contains key * material as variable length member
net/mac80211/rx.c +6 -0
@@ -2029,6 +2029,7 @@ ieee80211_rx_h_defragment(struct ieee802* next fragment has a sequential PN value. */ entry->check_sequential_pn = true; + entry->key_color = rx->key->color;memcpy (entry->last_pn, rx->key->u.ccmp.rx_pn[queue],IEEE80211_CCMP_PN_LEN );
@@ -2066,6 +2067,11 @@ ieee80211_rx_h_defragment(struct ieee802if (!requires_sequential_pn (rx, fc))return RX_DROP_UNUSABLE ; + +/* Prevent mixed key and fragment cache attacks */ +if (entry->key_color != rx->key->color) +return RX_DROP_UNUSABLE ; +memcpy (pn, entry->last_pn,IEEE80211_CCMP_PN_LEN );for (i =IEEE80211_CCMP_PN_LEN -1 ; i >=0 ; i--) { pn[i]++;
Greg Kroah-Hartman
maintainerPATCH 15/79 cfg80211: mitigate A-MSDU aggregation attacks
In reply to Greg Kroah-HartmanFrom: Mathy Vanhoef <[email protected]>
commit 2b8a1fee3488c602aca8bea004a087e60806a5cf upstream.
Mitigate A-MSDU injection attacks (CVE-2020-24588) by detecting if the destination address of a subframe equals an RFC1042 (i.e., LLC/SNAP) header, and if so dropping the complete A-MSDU frame. This mitigates known attacks, although new (unknown) aggregation-based attacks may remain possible.
This defense works because in A-MSDU aggregation injection attacks, a normal encrypted Wi-Fi frame is turned into an A-MSDU frame. This means the first 6 bytes of the first A-MSDU subframe correspond to an RFC1042 header. In other words, the destination MAC address of the first A-MSDU subframe contains the start of an RFC1042 header during an aggregation attack. We can detect this and thereby prevent this specific attack. For details, see Section 7.2 of "Fragment and Forge: Breaking Wi-Fi Through Frame Aggregation and Fragmentation".
Note that for kernel 4.9 and above this patch depends on "mac80211:
properly handle A-MSDUs that start with a rfc1042 header". Otherwise this patch has no impact and attacks will remain possible.
--- net/wireless/util.c | 3 +++ 1 file changed, 3 insertions(+)
net/wireless/util.c +3 -0
@@ -767,6 +767,9 @@ void ieee80211_amsdu_to_8023s(struct sk_ remaining = skb->len - offset;if (subframe_len > remaining) goto purge; +/* mitigate A-MSDU aggregation injection attacks */ +if (ether_addr_equal (eth.h_dest, rfc1042_header)) + goto purge; offset +=sizeof (struct ethhdr ); last = remaining <= subframe_len + padding;
Greg Kroah-Hartman
maintainerPATCH 16/79 mac80211: check defrag PN against current frame
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit bf30ca922a0c0176007e074b0acc77ed345e9990 upstream.
As pointed out by Mathy Vanhoef, we implement the RX PN check on fragmented frames incorrectly - we check against the last received PN prior to the new frame, rather than to the one in this frame itself.
Prior patches addressed the security issue here, but in order to be able to reason better about the code, fix it to really compare against the current frame's PN, not the last stored one.
--- net/mac80211/ieee80211_i.h | 11 +++++++++-- net/mac80211/rx.c | 5 ++--- net/mac80211/wpa.c | 13 +++++++++---- 3 files changed, 20 insertions(+), 9 deletions(-)
net/mac80211/ieee80211_i.h +9 -2
@@ -242,8 +242,15 @@ struct ieee80211_rx_data {*/ int security_idx; -u32 tkip_iv32; -u16 tkip_iv16; +union { +struct { +u32 iv32; +u16 iv16; + } tkip; +struct { +u8 pn[IEEE80211_CCMP_PN_LEN ]; + } ccm_gcm; + }; };struct ieee80211_csa_settings {
net/mac80211/rx.c +2 -3
@@ -2063,7 +2063,6 @@ ieee80211_rx_h_defragment(struct ieee802if (entry->check_sequential_pn) {int i;u8 pn[IEEE80211_CCMP_PN_LEN ], *rpn; -int queue;if (!requires_sequential_pn (rx, fc))return RX_DROP_UNUSABLE ;
@@ -2078,8 +2077,8 @@ ieee80211_rx_h_defragment(struct ieee802if (pn[i])break ; } - queue = rx->security_idx; - rpn = rx->key->u.ccmp.rx_pn[queue]; + + rpn = rx->ccm_gcm.pn;if (memcmp (pn, rpn,IEEE80211_CCMP_PN_LEN ))return RX_DROP_UNUSABLE ;memcpy (entry->last_pn, pn,IEEE80211_CCMP_PN_LEN );
net/mac80211/wpa.c +9 -4
@@ -2,6 +2,7 @@* Copyright 2002-2004, Instant802 Networks, Inc. * Copyright 2008, Jouni Malinen <[email protected]> * Copyright (C) 2016 Intel Deutschland GmbH +* Copyright (C) 2020-2021 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as
@@ -162,8 +163,8 @@ ieee80211_rx_h_michael_mic_verify(struct update_iv:/* update IV in key information to be able to detect replays */ - rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip_iv32; - rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip_iv16; + rx->key->u.tkip.rx[rx->security_idx].iv32 = rx->tkip.iv32; + rx->key->u.tkip.rx[rx->security_idx].iv16 = rx->tkip.iv16;return RX_CONTINUE ;
@@ -289,8 +290,8 @@ ieee80211_crypto_tkip_decrypt(struct iee key, skb->data + hdrlen, skb->len - hdrlen, rx->sta->sta.addr, hdr->addr1, hwaccel, rx->security_idx, - &rx->tkip_iv32, - &rx->tkip_iv16); + &rx->tkip.iv32, + &rx->tkip.iv16);if (res !=TKIP_DECRYPT_OK )return RX_DROP_UNUSABLE ;
@@ -548,6 +549,8 @@ ieee80211_crypto_ccmp_decrypt(struct iee }memcpy (key->u.ccmp.rx_pn[queue], pn,IEEE80211_CCMP_PN_LEN ); +if (unlikely (ieee80211_is_frag (hdr))) +memcpy (rx->ccm_gcm.pn, pn,IEEE80211_CCMP_PN_LEN ); }/* Remove CCMP header and MIC */
@@ -777,6 +780,8 @@ ieee80211_crypto_gcmp_decrypt(struct iee }memcpy (key->u.gcmp.rx_pn[queue], pn,IEEE80211_GCMP_PN_LEN ); +if (unlikely (ieee80211_is_frag (hdr))) +memcpy (rx->ccm_gcm.pn, pn,IEEE80211_CCMP_PN_LEN ); }/* Remove GCMP header and MIC */
Greg Kroah-Hartman
maintainerPATCH 17/79 ath10k: Validate first subframe of A-MSDU before processing the list
In reply to Greg Kroah-HartmanFrom: Sriram R <[email protected]>
commit 62a8ff67eba52dae9b107e1fb8827054ed00a265 upstream.
In certain scenarios a normal MSDU can be received as an A-MSDU when the A-MSDU present bit of a QoS header gets flipped during reception. Since this bit is unauthenticated, the hardware crypto engine can pass the frame to the driver without any error indication.
This could result in processing unintended subframes collected in the A-MSDU list. Hence, validate A-MSDU list by checking if the first frame has a valid subframe header.
Comparing the non-aggregated MSDU and an A-MSDU, the fields of the first subframe DA matches the LLC/SNAP header fields of a normal MSDU. In order to avoid processing such frames, add a validation to filter such A-MSDU frames where the first subframe header DA matches with the LLC/SNAP header pattern.
Tested-on: QCA9984 hw1.0 PCI 10.4-3.10-00047
--- drivers/net/wireless/ath/ath10k/htt_rx.c | 61 ++++++++++++++++++++++++++++--- 1 file changed, 57 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath10k/htt_rx.c +57 -4
@@ -1605,14 +1605,62 @@ static void ath10k_htt_rx_h_unchain(struath10k_unchain_msdu (amsdu); } +static bool ath10k_htt_rx_validate_amsdu (struct ath10k *ar, +struct sk_buff_head *amsdu) +{ +u8 *subframe_hdr; +struct sk_buff *first; +bool is_first, is_last; +struct htt_rx_desc *rxd; +struct ieee80211_hdr *hdr; +size_t hdr_len, crypto_len; +enum htt_rx_mpdu_encrypt_type enctype; +int bytes_aligned = ar->hw_params.decap_align_bytes; + + first =skb_peek (amsdu); + + rxd = (void *)first->data -sizeof (*rxd); + hdr = (void *)rxd->rx_hdr_status; + + is_first = !!(rxd->msdu_end.common.info0 & +__cpu_to_le32 (RX_MSDU_END_INFO0_FIRST_MSDU )); + is_last = !!(rxd->msdu_end.common.info0 & +__cpu_to_le32 (RX_MSDU_END_INFO0_LAST_MSDU )); + +/* Return in case of non-aggregated msdu */ +if (is_first && is_last) +return true; + +/* First msdu flag is not set for the first msdu of the list */ +if (!is_first) +return false; + + enctype =MS (__le32_to_cpu (rxd->mpdu_start.info0), +RX_MPDU_START_INFO0_ENCRYPT_TYPE ); + + hdr_len =ieee80211_hdrlen (hdr->frame_control); + crypto_len =ath10k_htt_rx_crypto_param_len (ar, enctype); + + subframe_hdr = (u8 *)hdr +round_up (hdr_len, bytes_aligned) + + crypto_len; + +/* Validate if the amsdu has a proper first subframe. +* There are chances a single msdu can be received as amsdu when +* the unauthenticated amsdu flag of a QoS header +* gets flipped in non-SPP AMSDU's, in such cases the first +* subframe has llc/snap header in place of a valid da. +* return false if the da matches rfc1042 pattern +*/ +if (ether_addr_equal (subframe_hdr, rfc1042_header)) +return false; + +return true; +} +static bool ath10k_htt_rx_amsdu_allowed (struct ath10k *ar,struct sk_buff_head *amsdu,struct ieee80211_rx_status *rx_status) { -/* FIXME: It might be a good idea to do some fuzzy-testing to drop -* invalid/dangerous frames. -*/ -if (!rx_status->freq) {ath10k_dbg (ar,ATH10K_DBG_HTT ,"no channel configured; ignoring frame(s)!\n" );return false;
@@ -1623,6 +1671,11 @@ static bool ath10k_htt_rx_amsdu_allowed(return false; } +if (!ath10k_htt_rx_validate_amsdu (ar, amsdu)) { +ath10k_dbg (ar,ATH10K_DBG_HTT ,"invalid amsdu received\n" ); +return false; + } +return true; }
Greg Kroah-Hartman
maintainerPATCH 18/79 dm snapshot: properly fix a crash when an origin has no snapshots
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 7e768532b2396bcb7fbf6f82384b85c0f1d2f197 upstream.
If an origin target has no snapshots, o->split_boundary is set to 0. This causes BUG_ON(sectors <= 0) in block/bio.c:bio_split().
Fix this by initializing chunk_size, and in turn split_boundary, to rounddown_pow_of_two(UINT_MAX) -- the largest power of two that fits into "unsigned" type.
--- drivers/md/dm-snap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-snap.c +1 -1
@@ -793,7 +793,7 @@ static int dm_add_exception(void *contexstatic uint32_t __minimum_chunk_size (struct origin *o) {struct dm_snapshot *snap; -unsigned chunk_size =0 ; +unsigned chunk_size =rounddown_pow_of_two (UINT_MAX );if (o)list_for_each_entry (snap, &o->snapshots, list)
Greg Kroah-Hartman
maintainerPATCH 19/79 kgdb: fix gcc-11 warnings harder
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit bda7d3ab06f19c02dcef61fefcb9dd954dfd5e4f upstream.
40cc3a80bb42 ("kgdb: fix gcc-11 warning on indentation") tried to fix up the gcc-11 complaints in this file by just reformatting the #defines. That worked for gcc 11.1.0, but in gcc 11.1.1 as shipped by Fedora 34, the warning came back for one of the #defines.
Fix this up again by putting { } around the if statement, now it is quiet again.
--- drivers/misc/kgdbts.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/misc/kgdbts.c +2 -1
@@ -112,8 +112,9 @@ printk(KERN_INFO a); \ }while (0 ) #define v2printk(a...) do { \ -if (verbose >1 ) \ +if (verbose >1 ) { \ printk(KERN_INFO a); \ + } \touch_nmi_watchdog (); \ } while (0) #define eprintk(a...) do { \
Greg Kroah-Hartman
maintainerPATCH 20/79 misc/uss720: fix memory leak in uss720_probe
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit dcb4b8ad6a448532d8b681b5d1a7036210b622de upstream.
uss720_probe forgets to decrease the refcount of usbdev in uss720_probe. Fix this by decreasing the refcount of usbdev by usb_put_dev.
BUG: memory leak
unreferenced object 0xffff888101113800 (size 2048):
comm "kworker/0:1", pid 7, jiffies 4294956777 (age 28.870s)
hex dump (first 32 bytes):
ff ff ff ff 31 00 00 00 00 00 00 00 00 00 00 00 ....1...........
00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 ................
backtrace:
[<ffffffff82b8e822>] kmalloc include/linux/slab.h:554 [inline]
[<ffffffff82b8e822>] kzalloc include/linux/slab.h:684 [inline]
[<ffffffff82b8e822>] usb_alloc_dev+0x32/0x450 drivers/usb/core/usb.c:582
[<ffffffff82b98441>] hub_port_connect drivers/usb/core/hub.c:5129 [inline]
[<ffffffff82b98441>] hub_port_connect_change drivers/usb/core/hub.c:5363 [inline]
[<ffffffff82b98441>] port_event drivers/usb/core/hub.c:5509 [inline]
[<ffffffff82b98441>] hub_event+0x1171/0x20c0 drivers/usb/core/hub.c:5591
[<ffffffff81259229>] process_one_work+0x2c9/0x600 kernel/workqueue.c:2275
[<ffffffff81259b19>] worker_thread+0x59/0x5d0 kernel/workqueue.c:2421
[<ffffffff81261228>] kthread+0x178/0x1b0 kernel/kthread.c:292
[<ffffffff8100227f>] ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294--- drivers/usb/misc/uss720.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/uss720.c +1 -0
@@ -749,6 +749,7 @@ static int uss720_probe(struct usb_interparport_announce_port (pp);usb_set_intfdata (intf, pp); +usb_put_dev (usbdev);return 0 ; probe_abort:
Greg Kroah-Hartman
maintainerPATCH 21/79 thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit b106776080a1cf953a1b2fd50cb2a995db4732be upstream.
Up to 64 bytes of data can be read from NVM in one go. Read address must be dword aligned. Data is read into a local buffer.
If caller asks to read data starting at an unaligned address then full dword is anyway read from NVM into a local buffer. Data is then copied from the local buffer starting at the unaligned offset to the caller buffer.
In cases where asked data length + unaligned offset is over 64 bytes we need to make sure we don't read past the 64 bytes in the local buffer when copying to caller buffer, and make sure that we don't skip copying unaligned offset bytes from local buffer anymore after the first round of 64 byte NVM data read.
--- drivers/thunderbolt/dma_port.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/thunderbolt/dma_port.c +6 -5
@@ -369,15 +369,15 @@ int dma_port_flash_read(struct tb_dma_po void *buf, size_t size) {unsigned int retries =DMA_PORT_RETRIES ; -unsigned int offset; - - offset = address &3 ; - address = address & ~3 ; do { - u32 nbytes = min_t(u32, size, MAIL_DATA_DWORDS * 4); + unsigned int offset; + size_t nbytes; int ret; + offset = address & 3; + nbytes = min_t(size_t, size + offset, MAIL_DATA_DWORDS * 4); + ret = dma_port_flash_read_block(dma, address, dma->buf, ALIGN(nbytes, 4)); if (ret) {
@@ -389,6 +389,7 @@ int dma_port_flash_read(struct tb_dma_poreturn ret; } + nbytes -= offset;memcpy (buf, dma->buf + offset, nbytes); size -= nbytes;
Greg Kroah-Hartman
maintainerPATCH 22/79 mei: request autosuspend after sending rx flow control
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
commit bbf0a94744edfeee298e4a9ab6fd694d639a5cdf upstream.
A rx flow control waiting in the control queue may block autosuspend. Re-request autosuspend after flow control been sent to unblock the transition to the low power state.
--- drivers/misc/mei/interrupt.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/misc/mei/interrupt.c +3 -0
@@ -220,6 +220,9 @@ static int mei_cl_irq_read(struct mei_clreturn ret; } +pm_runtime_mark_last_busy (dev->dev); +pm_request_autosuspend (dev->dev); +list_move_tail (&cb->list, &cl->rd_pending);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 23/79 staging: iio: cdc: ad7746: avoid overwrite of num_channels
In reply to Greg Kroah-HartmanFrom: Lucas Stankus <[email protected]>
commit 04f5b9f539ce314f758d919a14dc7a669f3b7838 upstream.
AD7745 devices don't have the CIN2 pins and therefore can't handle related channels. Forcing the number of AD7746 channels may lead to enabling more channels than what the hardware actually supports.
Avoid num_channels being overwritten after first assignment.
--- drivers/staging/iio/cdc/ad7746.c | 1 - 1 file changed, 1 deletion(-)
drivers/staging/iio/cdc/ad7746.c +0 -1
@@ -703,7 +703,6 @@ static int ad7746_probe(struct i2c_clien indio_dev->num_channels =ARRAY_SIZE (ad7746_channels); else indio_dev->num_channels = ARRAY_SIZE(ad7746_channels) - 2; - indio_dev->num_channels =ARRAY_SIZE (ad7746_channels); indio_dev->modes =INDIO_DIRECT_MODE ;if (pdata) {
Greg Kroah-Hartman
maintainerPATCH 24/79 iio: adc: ad7793: Add missing error code in ad7793_setup()
In reply to Greg Kroah-HartmanFrom: YueHaibing <[email protected]>
commit 4ed243b1da169bcbc1ec5507867e56250c5f1ff9 upstream.
Set error code while device ID query failed.
--- drivers/iio/adc/ad7793.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/ad7793.c +1 -0
@@ -279,6 +279,7 @@ static int ad7793_setup(struct iio_dev * id &=AD7793_ID_MASK ;if (id != st->chip_info->id) { + ret = -ENODEV ;dev_err (&st->sd.spi->dev,"device ID query failed\n" ); goto out; }
Greg Kroah-Hartman
maintainerPATCH 25/79 USB: trancevibrator: fix control-request direction
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 746e4acf87bcacf1406e05ef24a0b7139147c63e upstream.
The direction of the pipe argument must match the request-type direction bit or control requests may fail depending on the host-controller-driver implementation.
Fix the set-speed request which erroneously used USB_DIR_IN and update the default timeout argument to match (same value).
--- drivers/usb/misc/trancevibrator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/misc/trancevibrator.c +2 -2
@@ -72,9 +72,9 @@ static ssize_t set_speed(struct device */* Set speed */ retval =usb_control_msg (tv->udev,usb_sndctrlpipe (tv->udev,0 ),0x01 ,/* vendor request: set speed */ -USB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_OTHER , +USB_DIR_OUT |USB_TYPE_VENDOR |USB_RECIP_OTHER , tv->speed,/* speed value */ -0 ,NULL ,0 ,USB_CTRL_GET_TIMEOUT ); +0 ,NULL ,0 ,USB_CTRL_SET_TIMEOUT );if (retval) { tv->speed = old;dev_dbg (&tv->udev->dev,"retval = %d\n" , retval);
Greg Kroah-Hartman
maintainerPATCH 26/79 serial: sh-sci: Fix off-by-one error in FIFO threshold register setting
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 2ea2e019c190ee3973ef7bcaf829d8762e56e635 upstream.
The Receive FIFO Data Count Trigger field (RTRG[6:0]) in the Receive FIFO Data Count Trigger Register (HSRTRGR) of HSCIF can only hold values ranging from 0-127. As the FIFO size is equal to 128 on HSCIF, the user can write an out-of-range value, touching reserved bits.
Fix this by limiting the trigger value to the FIFO size minus one. Reverse the order of the checks, to avoid rx_trig becoming zero if the FIFO size is one.
Note that this change has no impact on other SCIF variants, as their maximum supported trigger value is lower than the FIFO size anyway, and the code below takes care of enforcing these limits.
--- drivers/tty/serial/sh-sci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/serial/sh-sci.c +2 -2
@@ -994,10 +994,10 @@ static int scif_set_rtrg(struct uart_por {unsigned int bits; +if (rx_trig >= port->fifosize) + rx_trig = port->fifosize -1 ;if (rx_trig <1 ) rx_trig =1 ; -if (rx_trig >= port->fifosize) - rx_trig = port->fifosize;/* HSCIF can be set to an arbitrary level. */ if (sci_getreg (port,HSRTRGR )->size) {
Greg Kroah-Hartman
maintainerPATCH 27/79 serial: rp2: use request_firmware instead of request_firmware_nowait
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit 016002848c82eeb5d460489ce392d91fe18c475c upstream.
In 'rp2_probe', the driver registers 'rp2_uart_interrupt' then calls 'rp2_fw_cb' through 'request_firmware_nowait'. In 'rp2_fw_cb', if the firmware don't exists, function just return without initializing ports of 'rp2_card'. But now the interrupt handler function has been registered, and when an interrupt comes, 'rp2_uart_interrupt' may access those ports then causing NULL pointer dereference or other bugs.
Because the driver does some initialization work in 'rp2_fw_cb', in order to make the driver ready to handle interrupts, 'request_firmware' should be used instead of asynchronous 'request_firmware_nowait'.
This report reveals it:
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59- gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xec/0x156 lib/dump_stack.c:118 assign_lock_key kernel/locking/lockdep.c:727 [inline] register_lock_class+0x14e5/0x1ba0 kernel/locking/lockdep.c:753 __lock_acquire+0x187/0x3750 kernel/locking/lockdep.c:3303 lock_acquire+0x124/0x340 kernel/locking/lockdep.c:3907 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x32/0x50 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] rp2_ch_interrupt drivers/tty/serial/rp2.c:466 [inline] rp2_asic_interrupt.isra.9+0x15d/0x990 drivers/tty/serial/rp2.c:493 rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 </IRQ> RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7 f8
8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
RAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200
RBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840
R10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002
R13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 BUG: unable to handle kernel NULL pointer dereference at 0000000000000010 PGD 8000000056d27067 P4D 8000000056d27067 PUD 56d28067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN PTI CPU: 2 PID: 0 Comm: swapper/2 Not tainted 4.19.177-gdba4159c14ef-dirty #45 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59- gc9ba5276e321-prebuilt.qemu.org 04/01/2014 RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline] RIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c: 493 Code: df e8 43 5d c2 05 48 8d 83 e8 01 00 00 48 89 85 60 ff ff ff 48 c1 e8 03 42 80 3c 30 00 0f 85 aa 07 00 00 48 8b 83 e8 01 00 00 <8b> 40 10 89 c1 89 85 68 ff ff ff 48 8b 83 e8 01 00 00 89 48 10 83 RSP: 0018:ffff88806c287cd0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff88806ade6820 RCX: ffffffff814300b1 RDX: 1ffff1100d5bcd06 RSI: 0000000000000004 RDI: ffff88806ade6820 RBP: ffff88806c287db8 R08: ffffed100d5bcd05 R09: ffffed100d5bcd05 R10: 0000000000000001 R11: ffffed100d5bcd04 R12: ffffc90001e00000 R13: ffff888069654e10 R14: dffffc0000000000 R15: ffff888069654df0 FS: 0000000000000000(0000) GS:ffff88806c280000(0000) knlGS: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000006892c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <IRQ> rp2_uart_interrupt+0x49/0xe0 drivers/tty/serial/rp2.c:504 __handle_irq_event_percpu+0xfb/0x770 kernel/irq/handle.c:149 handle_irq_event_percpu+0x79/0x150 kernel/irq/handle.c:189 handle_irq_event+0xac/0x140 kernel/irq/handle.c:206 handle_fasteoi_irq+0x232/0x5c0 kernel/irq/chip.c:725 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x230/0x3a0 arch/x86/kernel/irq_64.c:87 do_IRQ+0xa7/0x1e0 arch/x86/kernel/irq.c:247 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 </IRQ> RIP: 0010:native_safe_halt+0x28/0x30 arch/x86/include/asm/irqflags.h:61 Code: 00 00 55 be 04 00 00 00 48 c7 c7 00 c2 2f 8c 48 89 e5 e8 fb 31 e7
f8 8b 05 75 af 8d 03 85 c0 7e 07 0f 00 2d 8a 61 65 00 fb f4 <5d> c3 90 90 90 90 90 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 41
RSP: 0018:ffff88806b71fcc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffde
RAX: 0000000000000000 RBX: ffffffff8bde7e48 RCX: ffffffff88a21285
RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff8c2fc200
RBP: ffff88806b71fcc8 R08: fffffbfff185f840 R09: fffffbfff185f840
R10: 0000000000000001 R11: fffffbfff185f840 R12: 0000000000000002
R13: ffffffff8bea18a0 R14: 0000000000000000 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline] default_idle+0x6f/0x360 arch/x86/kernel/process.c:557 arch_cpu_idle+0xf/0x20 arch/x86/kernel/process.c:548 default_idle_call+0x3b/0x60 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x2ab/0x3c0 kernel/sched/idle.c:263 cpu_startup_entry+0xcb/0xe0 kernel/sched/idle.c:369 start_secondary+0x3b8/0x4e0 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) CR2: 0000000000000010 ---[ end trace 11804dbb55cb1a64 ]--- RIP: 0010:readl arch/x86/include/asm/io.h:59 [inline] RIP: 0010:rp2_ch_interrupt drivers/tty/serial/rp2.c:472 [inline] RIP: 0010:rp2_asic_interrupt.isra.9+0x181/0x990 drivers/tty/serial/rp2.c: 493 Code: df e8 43 5d c2 05 48 8d 83 e8 01 00 00 48 89 85 60 ff ff ff 48 c1 e8 03 42 80 3c 30 00 0f 85 aa 07 00 00 48 8b 83 e8 01 00 00 <8b> 40 10 89 c1 89 85 68 ff ff ff 48 8b 83 e8 01 00 00 89 48 10 83 RSP: 0018:ffff88806c287cd0 EFLAGS: 00010046 RAX: 0000000000000000 RBX: ffff88806ade6820 RCX: ffffffff814300b1 RDX: 1ffff1100d5bcd06 RSI: 0000000000000004 RDI: ffff88806ade6820 RBP: ffff88806c287db8 R08: ffffed100d5bcd05 R09: ffffed100d5bcd05 R10: 0000000000000001 R11: ffffed100d5bcd04 R12: ffffc90001e00000 R13: ffff888069654e10 R14: dffffc0000000000 R15: ffff888069654df0 FS: 0000000000000000(0000) GS:ffff88806c280000(0000) knlGS: 0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 000000006892c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
--- drivers/tty/serial/rp2.c | 52 +++++++++++++++-------------------------------- 1 file changed, 17 insertions(+), 35 deletions(-)
drivers/tty/serial/rp2.c +17 -35
@@ -198,7 +198,6 @@ struct rp2_card {void __iomem *bar0;void __iomem *bar1;spinlock_t card_lock; -struct completion fw_loaded; };#define RP_ID (prod) PCI_VDEVICE(RP, (prod))
@@ -667,17 +666,10 @@ static void rp2_remove_ports(struct rp2_ card->initialized_ports =0 ; } -static void rp2_fw_cb (const struct firmware *fw,void *context) +static int rp2_load_firmware (struct rp2_card *card,const struct firmware *fw) { -struct rp2_card *card = context;resource_size_t phys_base; -int i, rc = -ENOENT ; - -if (!fw) { -dev_err (&card->pdev->dev,"cannot find '%s' firmware image\n" , -RP2_FW_NAME ); - goto no_fw; - } +int i, rc =0 ; phys_base =pci_resource_start (card->pdev,1 );
@@ -723,23 +715,13 @@ static void rp2_fw_cb(const struct firmw card->initialized_ports++; } -release_firmware (fw); -no_fw: -/* -* rp2_fw_cb() is called from a workqueue long after rp2_probe() -* has already returned success. So if something failed here, -* we'll just leave the now-dormant device in place until somebody -* unbinds it. -*/ -if (rc) -dev_warn (&card->pdev->dev,"driver initialization failed\n" ); - -complete (&card->fw_loaded); +return rc; }static int rp2_probe (struct pci_dev *pdev,const struct pci_device_id *id) { +const struct firmware *fw;struct rp2_card *card;struct rp2_uart_port *ports;void __iomem *const *bars;
@@ -750,7 +732,6 @@ static int rp2_probe(struct pci_dev *pdereturn -ENOMEM ;pci_set_drvdata (pdev, card);spin_lock_init (&card->card_lock); -init_completion (&card->fw_loaded); rc =pcim_enable_device (pdev);if (rc)
@@ -783,21 +764,23 @@ static int rp2_probe(struct pci_dev *pdereturn -ENOMEM ; card->ports = ports; - rc =devm_request_irq (&pdev->dev, pdev->irq, rp2_uart_interrupt, -IRQF_SHARED ,DRV_NAME , card); -if (rc) + rc =request_firmware (&fw,RP2_FW_NAME , &pdev->dev); +if (rc <0 ) { +dev_err (&pdev->dev,"cannot find '%s' firmware image\n" , +RP2_FW_NAME );return rc; + } -/* -* Only catastrophic errors (e.g. ENOMEM) are reported here. -* If the FW image is missing, we'll find out in rp2_fw_cb() -* and print an error message. -*/ - rc =request_firmware_nowait (THIS_MODULE ,1 ,RP2_FW_NAME , &pdev->dev, -GFP_KERNEL , card, rp2_fw_cb); + rc =rp2_load_firmware (card, fw); + +release_firmware (fw); +if (rc <0 ) +return rc; + + rc =devm_request_irq (&pdev->dev, pdev->irq, rp2_uart_interrupt, +IRQF_SHARED ,DRV_NAME , card);if (rc)return rc; -dev_dbg (&pdev->dev,"waiting for firmware blob...\n" );return 0 ; }
@@ -806,7 +789,6 @@ static void rp2_remove(struct pci_dev *p {struct rp2_card *card =pci_get_drvdata (pdev); -wait_for_completion (&card->fw_loaded);rp2_remove_ports (card); }
Greg Kroah-Hartman
maintainerPATCH 28/79 USB: serial: ti_usb_3410_5052: add startech.com device id
In reply to Greg Kroah-HartmanFrom: Sean MacLennan <[email protected]>
commit 89b1a3d811e6f8065d6ae8a25e7682329b4a31e2 upstream.
This adds support for the Startech.com generic serial to USB converter. It seems to be a bone stock TI_3410. I have been using this patch for years.
--- drivers/usb/serial/ti_usb_3410_5052.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/ti_usb_3410_5052.c +3 -0
@@ -41,6 +41,7 @@/* Vendor and product ids */ #define TI_VENDOR_ID 0x0451#define IBM_VENDOR_ID 0x04b3 +#define STARTECH_VENDOR_ID 0x14b0#define TI_3410_PRODUCT_ID 0x3410#define IBM_4543_PRODUCT_ID 0x4543#define IBM_454B_PRODUCT_ID 0x454b
@@ -378,6 +379,7 @@ static const struct usb_device_id ti_id_ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) }, { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) }, { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) }, + { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) }, { } /* terminator */ };
@@ -416,6 +418,7 @@ static const struct usb_device_id ti_id_ { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1131_PRODUCT_ID) }, { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1150_PRODUCT_ID) }, { USB_DEVICE(MXU1_VENDOR_ID, MXU1_1151_PRODUCT_ID) }, + { USB_DEVICE(STARTECH_VENDOR_ID, TI_3410_PRODUCT_ID) }, { } /* terminator */ };
Greg Kroah-Hartman
maintainerPATCH 29/79 USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
commit e467714f822b5d167a7fb03d34af91b5b6af1827 upstream.
Add support for the following Telit LE910-S1 compositions:
0x7010: rndis, tty, tty, tty0x7011: ecm, tty, tty, tty
--- drivers/usb/serial/option.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/serial/option.c +4 -0
@@ -1243,6 +1243,10 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1901, 0xff), /* Telit LN940 (MBIM) */ .driver_info = NCTRL(0) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7010, 0xff), /* Telit LE910-S1 (RNDIS) */ + .driver_info = NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE910-S1 (ECM) */ + .driver_info = NCTRL(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing device */ .driver_info = NCTRL(0) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
Greg Kroah-Hartman
maintainerPATCH 30/79 USB: serial: ftdi_sio: add IDs for IDS GmbH Products
In reply to Greg Kroah-HartmanFrom: Dominik Andreas Schorpp <[email protected]>
commit c5a80540e425a5f9a82b0f3163e3b6a4331f33bc upstream.
Add the IDS GmbH Vendor ID and the Product IDs for SI31A (2xRS232) and CM31A (LoRaWAN Modem).
--- drivers/usb/serial/ftdi_sio.c | 3 +++ drivers/usb/serial/ftdi_sio_ids.h | 7 +++++++ 2 files changed, 10 insertions(+)
drivers/usb/serial/ftdi_sio.c +3 -0
@@ -1029,6 +1029,9 @@ static const struct usb_device_id id_tab/* Sienna devices */ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) }, { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) }, +/* IDS GmbH devices */ + { USB_DEVICE(IDS_VID, IDS_SI31A_PID) }, + { USB_DEVICE(IDS_VID, IDS_CM31A_PID) },/* U-Blox devices */ { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) }, { USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
drivers/usb/serial/ftdi_sio_ids.h +7 -0
@@ -1568,6 +1568,13 @@#define UNJO_ISODEBUG_V1_PID 0x150D/* +* IDS GmbH +*/ +#define IDS_VID 0x2CAF +#define IDS_SI31A_PID 0x13A2 +#define IDS_CM31A_PID 0x13A3 + +/* * U-Blox products (http://www.u-blox.com). */ #define UBLOX_VID 0x1546
Greg Kroah-Hartman
maintainerPATCH 31/79 USB: serial: pl2303: add device id for ADLINK ND-6530 GC
In reply to Greg Kroah-HartmanFrom: Zolton Jheng <[email protected]>
commit f8e8c1b2f782e7391e8a1c25648ce756e2a7d481 upstream.
This adds the device id for the ADLINK ND-6530 which is a PL2303GC based device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + 2 files changed, 2 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -110,6 +110,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) }, { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) }, + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, { } /* Terminating entry */
drivers/usb/serial/pl2303.h +1 -0
@@ -157,6 +157,7 @@/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */ #define ADLINK_VENDOR_ID 0x0b63#define ADLINK_ND6530_PRODUCT_ID 0x6530 +#define ADLINK_ND6530GC_PRODUCT_ID 0x653a/* SMART USB Serial Adapter */ #define SMART_VENDOR_ID 0x0b8c
Greg Kroah-Hartman
maintainerPATCH 32/79 usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen()
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
commit e752dbc59e1241b13b8c4f7b6eb582862e7668fe upstream.
The usb3_start_pipen() is called by renesas_usb3_ep_queue() and usb3_request_done_pipen() so that usb3_start_pipen() is possible to cause a race when getting usb3_first_req like below:
renesas_usb3_ep_queue()
spin_lock_irqsave()
list_add_tail()
spin_unlock_irqrestore()
usb3_start_pipen()
usb3_first_req = usb3_get_request() --- [1]
--- interrupt ---
usb3_irq_dma_int()
usb3_request_done_pipen()
usb3_get_request()
usb3_start_pipen()
usb3_first_req = usb3_get_request()
...
(the req is possible to be finished in the interrupt)
The usb3_first_req [1] above may have been finished after the interrupt ended so that this driver caused to start a transfer wrongly. To fix this issue, getting/checking the usb3_first_req are under spin_lock_irqsave() in the same section.
--- drivers/usb/gadget/udc/renesas_usb3.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/renesas_usb3.c +3 -2
@@ -1442,7 +1442,7 @@ static void usb3_start_pipen(struct rene struct renesas_usb3_request *usb3_req) {struct renesas_usb3 *usb3 =usb3_ep_to_usb3 (usb3_ep); -struct renesas_usb3_request *usb3_req_first =usb3_get_request (usb3_ep); +struct renesas_usb3_request *usb3_req_first;unsigned long flags;int ret = -EAGAIN ;u32 enable_bits =0 ;
@@ -1450,7 +1450,8 @@ static void usb3_start_pipen(struct renespin_lock_irqsave (&usb3->lock, flags);if (usb3_ep->halt || usb3_ep->started) goto out; -if (usb3_req != usb3_req_first) + usb3_req_first =__usb3_get_request (usb3_ep); +if (!usb3_req_first || usb3_req != usb3_req_first) goto out;if (usb3_pn_change (usb3, usb3_ep->num) <0 )
Greg Kroah-Hartman
maintainerPATCH 33/79 net: usb: fix memory leak in smsc75xx_bind
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 upstream.
Syzbot reported memory leak in smsc75xx_bind(). The problem was is non-freed memory in case of errors after memory allocation.
backtrace:
[<ffffffff84245b62>] kmalloc include/linux/slab.h:556 [inline] [<ffffffff84245b62>] kzalloc include/linux/slab.h:686 [inline] [<ffffffff84245b62>] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 [<ffffffff82b5b2e6>] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728
--- drivers/net/usb/smsc75xx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/usb/smsc75xx.c +6 -2
@@ -1495,7 +1495,7 @@ static int smsc75xx_bind(struct usbnet * ret =smsc75xx_wait_ready (dev,0 );if (ret <0 ) {netdev_warn (dev->net,"device not ready in smsc75xx_bind\n" ); -return ret; + goto err; }smsc75xx_init_mac_address (dev);
@@ -1504,7 +1504,7 @@ static int smsc75xx_bind(struct usbnet * ret =smsc75xx_reset (dev);if (ret <0 ) {netdev_warn (dev->net,"smsc75xx_reset error %d\n" , ret); -return ret; + goto err; } dev->net->netdev_ops = &smsc75xx_netdev_ops;
@@ -1514,6 +1514,10 @@ static int smsc75xx_bind(struct usbnet * dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; dev->net->max_mtu =MAX_SINGLE_PACKET_SIZE ;return 0 ; + +err: +kfree (pdata); +return ret; }static void smsc75xx_unbind (struct usbnet *dev,struct usb_interface *intf)
Greg Kroah-Hartman
maintainerPATCH 34/79 Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 8da3a0b87f4f1c3a3bbc4bfb78cf68476e97d183 upstream.
When cmtp_attach_device fails, cmtp_add_connection returns the error value which leads to the caller to doing fput through sockfd_put. But cmtp_session kthread, which is stopped in this path will also call fput, leading to a potential refcount underflow or a use-after-free.
Add a refcount before we signal the kthread to stop. The kthread will try to grab the cmtp_session_sem mutex before doing the fput, which is held when get_file is called, so there should be no races there.
--- net/bluetooth/cmtp/core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/cmtp/core.c +5 -0
@@ -391,6 +391,11 @@ int cmtp_add_connection(struct cmtp_connif (!(session->flags &BIT (CMTP_LOOPBACK ))) { err =cmtp_attach_device (session);if (err <0 ) { +/* Caller will call fput in case of failure, and so +* will cmtp_session kthread. +*/ +get_file (session->sock->file); +atomic_inc (&session->terminate);wake_up_interruptible (sk_sleep (session->sock->sk));up_write (&cmtp_session_sem);
Greg Kroah-Hartman
maintainerPATCH 35/79 NFS: fix an incorrect limit in filelayout_decode_layout()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 769b01ea68b6c49dc3cde6adf7e53927dacbd3a8 upstream.
The "sizeof(struct nfs_fh)" is two bytes too large and could lead to memory corruption. It should be NFS_MAXFHSIZE because that's the size of the ->data[] buffer.
I reversed the size of the arguments to put the variable on the left.
--- fs/nfs/filelayout/filelayout.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/filelayout/filelayout.c +1 -1
@@ -717,7 +717,7 @@ filelayout_decode_layout(struct pnfs_layif (unlikely (!p)) goto out_err; fl->fh_array[i]->size =be32_to_cpup (p++); -if (sizeof (struct nfs_fh ) < fl->fh_array[i]->size) { +if (fl->fh_array[i]->size >NFS_MAXFHSIZE ) {printk (KERN_ERR "NFS: Too big fh %d received %d\n" , i, fl->fh_array[i]->size); goto out_err;
Greg Kroah-Hartman
maintainerPATCH 36/79 NFS: Dont corrupt the value of pg_bytes_written in nfs_do_recoalesce()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 0d0ea309357dea0d85a82815f02157eb7fcda39f upstream.
The value of mirror->pg_bytes_written should only be updated after a successful attempt to flush out the requests on the list.
--- fs/nfs/pagelist.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-)
fs/nfs/pagelist.c +5 -7
@@ -986,17 +986,16 @@ static void nfs_pageio_doio(struct nfs_p {struct nfs_pgio_mirror *mirror =nfs_pgio_current_mirror (desc); -if (!list_empty (&mirror->pg_list)) {int error = desc->pg_ops->pg_doio (desc);if (error <0 ) desc->pg_error = error; -else +if (list_empty (&mirror->pg_list)) { mirror->pg_bytes_written += mirror->pg_count; - } -if (list_empty (&mirror->pg_list)) { - mirror->pg_count =0 ; - mirror->pg_base =0 ; + mirror->pg_count =0 ; + mirror->pg_base =0 ; + mirror->pg_recoalesce =0 ; + } } }
@@ -1094,7 +1093,6 @@ static int nfs_do_recoalesce(struct nfs_ do { list_splice_init(&mirror->pg_list, &head); - mirror->pg_bytes_written -= mirror->pg_count; mirror->pg_count = 0; mirror->pg_base = 0; mirror->pg_recoalesce = 0;
Greg Kroah-Hartman
maintainerPATCH 37/79 NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
commit e67afa7ee4a59584d7253e45d7f63b9528819a13 upstream.
Since commit bdcc2cd14e4e ("NFSv4.2: handle NFS-specific llseek errors"), nfs42_proc_llseek would return -EOPNOTSUPP rather than -ENOTSUPP when SEEK_DATA on NFSv4.0/v4.1.
This will lead xfstests generic/285 not run on NFSv4.0/v4.1 when set the CONFIG_NFS_V4_2, rather than run failed.
--- fs/nfs/nfs4file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/nfs4file.c +1 -1
@@ -148,7 +148,7 @@ static loff_t nfs4_file_llseek(struct ficase SEEK_HOLE :case SEEK_DATA : ret =nfs42_proc_llseek (filep, offset, whence); -if (ret != -ENOTSUPP ) +if (ret != -EOPNOTSUPP )return ret;default :return nfs_file_llseek (filep, offset, whence);
Greg Kroah-Hartman
maintainerPATCH 38/79 drm/meson: fix shutdown crash when component not probed
In reply to Greg Kroah-HartmanFrom: Neil Armstrong <[email protected]>
commit 7cfc4ea78fc103ea51ecbacd9236abb5b1c490d2 upstream.
When main component is not probed, by example when the dw-hdmi module is not loaded yet or in probe defer, the following crash appears on shutdown:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 ... pc : meson_drv_shutdown+0x24/0x50 lr : platform_drv_shutdown+0x20/0x30 ... Call trace: meson_drv_shutdown+0x24/0x50 platform_drv_shutdown+0x20/0x30 device_shutdown+0x158/0x360 kernel_restart_prepare+0x38/0x48 kernel_restart+0x18/0x68 __do_sys_reboot+0x224/0x250 __arm64_sys_reboot+0x24/0x30
...
Simply check if the priv struct has been allocated before using it.
--- drivers/gpu/drm/meson/meson_drv.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/meson/meson_drv.c +5 -4
@@ -364,11 +364,12 @@ static int meson_probe_remote(struct plastatic void meson_drv_shutdown (struct platform_device *pdev) {struct meson_drm *priv =dev_get_drvdata (&pdev->dev); -struct drm_device *drm = priv->drm; -DRM_DEBUG_DRIVER ("\n" ); -drm_kms_helper_poll_fini (drm); -drm_atomic_helper_shutdown (drm); +if (!priv) +return ; + +drm_kms_helper_poll_fini (priv->drm); +drm_atomic_helper_shutdown (priv->drm); }static int meson_drv_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 39/79 net/mlx4: Fix EEPROM dump support
In reply to Greg Kroah-HartmanFrom: Vladyslav Tarasiuk <[email protected]>
commit db825feefc6868896fed5e361787ba3bee2fd906 upstream.
Fix SFP and QSFP* EEPROM queries by setting i2c_address, offset and page number correctly. For SFP set the following params:
- I2C address for offsets 0-255 is 0x50. For 256-511 - 0x51.
- Page number is zero.
- Offset is 0-255.
At the same time, QSFP* parameters are different:
- I2C address is always 0x50.
- Page number is not limited to zero.
- Offset is 0-255 for page zero and 128-255 for others.
To set parameters accordingly to cable used, implement function to query module ID and implement respective helper functions to set parameters correctly.
--- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 4 drivers/net/ethernet/mellanox/mlx4/port.c | 107 +++++++++++++++++++++++- 2 files changed, 104 insertions(+), 7 deletions(-)
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +1 -3
@@ -1983,8 +1983,6 @@ static int mlx4_en_set_tunable(struct nereturn ret; } -#define MLX4_EEPROM_PAGE_LEN 256 -static int mlx4_en_get_module_info (struct net_device *dev,struct ethtool_modinfo *modinfo) {
@@ -2019,7 +2017,7 @@ static int mlx4_en_get_module_info(strucbreak ;case MLX4_MODULE_ID_SFP : modinfo->type =ETH_MODULE_SFF_8472 ; - modinfo->eeprom_len =MLX4_EEPROM_PAGE_LEN ; + modinfo->eeprom_len =ETH_MODULE_SFF_8472_LEN ;break ;default :return -EINVAL ;
drivers/net/ethernet/mellanox/mlx4/port.c +103 -4
138 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 40/79 Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv"
In reply to Greg Kroah-HartmanFrom: Hoang Le <[email protected]>
commit 75016891357a628d2b8acc09e2b9b2576c18d318 upstream.
This reverts commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046. Above fix is not correct and caused memory leak issue.
--- net/tipc/socket.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/tipc/socket.c +4 -1
@@ -840,7 +840,10 @@ void tipc_sk_mcast_rcv(struct net *net,spin_lock_bh (&inputq->lock);if (skb_peek (arrvq) == skb) {skb_queue_splice_tail_init (&tmpq, inputq); -__skb_dequeue (arrvq); +/* Decrease the skb's refcnt as increasing in the +* function tipc_skb_peek +*/ +kfree_skb (__skb_dequeue (arrvq)); }spin_unlock_bh (&inputq->lock);__skb_queue_purge (&tmpq);
Greg Kroah-Hartman
maintainerPATCH 41/79 tipc: skb_linearize the head skb when reassembling msgs
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
commit b7df21cf1b79ab7026f545e7bf837bd5750ac026 upstream.
It's not a good idea to append the frag skb to a skb's frag_list if the frag_list already has skbs from elsewhere, such as this skb was created by pskb_copy() where the frag_list was cloned (all the skbs in it were skb_get'ed) and shared by multiple skbs.
However, the new appended frag skb should have been only seen by the current skb. Otherwise, it will cause use after free crashes as this appended frag skb are seen by multiple skbs but it only got skb_get called once.
The same thing happens with a skb updated by pskb_may_pull() with a skb_cloned skb. Li Shuang has reported quite a few crashes caused by this when doing testing over macvlan devices:
[] kernel BUG at net/core/skbuff.c:1970!
[] Call Trace:
[] skb_clone+0x4d/0xb0 [] macvlan_broadcast+0xd8/0x160 [macvlan] [] macvlan_process_broadcast+0x148/0x150 [macvlan] [] process_one_work+0x1a7/0x360 [] worker_thread+0x30/0x390
[] kernel BUG at mm/usercopy.c:102!
[] Call Trace:
[] __check_heap_object+0xd3/0x100 [] __check_object_size+0xff/0x16b [] simple_copy_to_iter+0x1c/0x30 [] __skb_datagram_iter+0x7d/0x310 [] __skb_datagram_iter+0x2a5/0x310 [] skb_copy_datagram_iter+0x3b/0x90 [] tipc_recvmsg+0x14a/0x3a0 [tipc] [] ____sys_recvmsg+0x91/0x150 [] ___sys_recvmsg+0x7b/0xc0
[] kernel BUG at mm/slub.c:305!
[] Call Trace:
[] <IRQ> [] kmem_cache_free+0x3ff/0x400 [] __netif_receive_skb_core+0x12c/0xc40 [] ? kmem_cache_alloc+0x12e/0x270 [] netif_receive_skb_internal+0x3d/0xb0 [] ? get_rx_page_info+0x8e/0xa0 [be2net] [] be_poll+0x6ef/0xd00 [be2net] [] ? irq_exit+0x4f/0x100 [] net_rx_action+0x149/0x3b0
...
This patch is to fix it by linearizing the head skb if it has frag_list set in tipc_buf_append(). Note that we choose to do this before calling skb_unshare(), as __skb_linearize() will avoid skb_copy(). Also, we can not just drop the frag_list either as the early time.
--- net/tipc/msg.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
net/tipc/msg.c +2 -7
@@ -141,18 +141,13 @@ int tipc_buf_append(struct sk_buff **heaif (unlikely (head)) goto err; *buf =NULL ; +if (skb_has_frag_list (frag) &&__skb_linearize (frag)) + goto err; frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err; head = *headbuf = frag;TIPC_SKB_CB (head)->tail =NULL ; -if (skb_is_nonlinear (head)) { - skb_walk_frags(head, tail) { -TIPC_SKB_CB (head)->tail = tail; - } - }else { -skb_frag_list_init (head); - }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 42/79 i2c: s3c2410: fix possible NULL pointer deref on read message after write
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream.
Interrupt handler processes multiple message write requests one after another, till the driver message queue is drained. However if driver encounters a read message without preceding START, it stops the I2C transfer as it is an invalid condition for the controller. At least the comment describes a requirement "the controller forces us to send a new START when we change direction". This stop results in clearing the message queue (i2c->msg = NULL).
The code however immediately jumped back to label "retry_write" which dereferenced the "i2c->msg" making it a possible NULL pointer dereference.
The Coverity analysis:
1. Condition !is_msgend(i2c), taking false branch. if (!is_msgend(i2c)) {
2. Condition !is_lastmsg(i2c), taking true branch. } else if (!is_lastmsg(i2c)) {
3. Condition i2c->msg->flags & 1, taking true branch. if (i2c->msg->flags & I2C_M_RD) {
4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL. s3c24xx_i2c_stop(i2c, -EINVAL);
5. Jumping to label retry_write.
goto retry_write;
6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg. if (!is_msgend(i2c)) {"
All previous calls to s3c24xx_i2c_stop() in this interrupt service routine are followed by jumping to end of function (acknowledging the interrupt and returning). This seems a reasonable choice also here since message buffer was entirely emptied.
Addresses-Coverity: Explicit null dereferenced
--- drivers/i2c/busses/i2c-s3c2410.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/i2c/busses/i2c-s3c2410.c +3 -0
@@ -495,7 +495,10 @@ static int i2c_s3c_irq_nextbyte(struct s* forces us to send a new START * when we change direction */ +dev_dbg (i2c->dev, +"missing START before write->read\n" );s3c24xx_i2c_stop (i2c, -EINVAL ); +break ; } goto retry_write;
Greg Kroah-Hartman
maintainerPATCH 43/79 i2c: i801: Dont generate an interrupt on bus reset
In reply to Greg Kroah-HartmanFrom: Jean Delvare <[email protected]>
commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream.
Now that the i2c-i801 driver supports interrupts, setting the KILL bit in a attempt to recover from a timed out transaction triggers an interrupt. Unfortunately, the interrupt handler (i801_isr) is not prepared for this situation and will try to process the interrupt as if it was signaling the end of a successful transaction. In the case of a block transaction, this can result in an out-of-range memory access.
This condition was reproduced several times by syzbot:
https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e
https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e
https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e
https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb
https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a
https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79
So disable interrupts while trying to reset the bus. Interrupts will be enabled again for the following transaction.
--- drivers/i2c/busses/i2c-i801.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-i801.c +2 -4
@@ -379,11 +379,9 @@ static int i801_check_post(struct i801_pdev_err (&priv->pci_dev->dev,"Transaction timeout\n" );/* try to stop the current command */ dev_dbg (&priv->pci_dev->dev,"Terminating the current operation\n" ); -outb_p (inb_p (SMBHSTCNT (priv)) |SMBHSTCNT_KILL , -SMBHSTCNT (priv)); +outb_p (SMBHSTCNT_KILL ,SMBHSTCNT (priv));usleep_range (1000 ,2000 ); -outb_p (inb_p (SMBHSTCNT (priv)) & (~SMBHSTCNT_KILL ), -SMBHSTCNT (priv)); +outb_p (0 ,SMBHSTCNT (priv));/* Check if it worked */ status =inb_p (SMBHSTSTS (priv));
Greg Kroah-Hartman
maintainerPATCH 44/79 perf jevents: Fix getting maximum number of fds
In reply to Greg Kroah-HartmanFrom: Felix Fietkau <[email protected]>
commit 75ea44e356b5de8c817f821c9dd68ae329e82add upstream.
On some hosts, rlim.rlim_max can be returned as RLIM_INFINITY. By casting it to int, it is interpreted as -1, which will cause get_maxfds to return 0, causing "Invalid argument" errors in nftw() calls. Fix this by casting the second argument of min() to rlim_t instead.
--- tools/perf/pmu-events/jevents.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/pmu-events/jevents.c +1 -1
@@ -695,7 +695,7 @@ static int get_maxfds(void)struct rlimit rlim;if (getrlimit (RLIMIT_NOFILE , &rlim) ==0 ) -return min ((int )rlim.rlim_max /2 ,512 ); +return min (rlim.rlim_max /2 , (rlim_t )512 );return 512 ; }
Greg Kroah-Hartman
maintainerPATCH 45/79 platform/x86: hp_accel: Avoid invoking _INI to speed up resume
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 79d341e26ebcdbc622348aaaab6f8f89b6fdb25f ]
hp_accel can take almost two seconds to resume on some HP laptops.
The bottleneck is on evaluating _INI, which is only needed to run once.
Resolve the issue by only invoking _INI when it's necessary. Namely, on probe and on hibernation restore.
--- drivers/misc/lis3lv02d/lis3lv02d.h | 1 + drivers/platform/x86/hp_accel.c | 22 +++++++++++++++++++++- 2 files changed, 22 insertions(+), 1 deletion(-)
drivers/misc/lis3lv02d/lis3lv02d.h +1 -0
@@ -284,6 +284,7 @@ struct lis3lv02d {int regs_size;u8 *reg_cache;bool regs_stored; +bool init_required;u8 odr_mask;/* ODR bit mask */ u8 whoami;/* indicates measurement precision */ s16 (*read_data) (struct lis3lv02d *lis3,int reg);
drivers/platform/x86/hp_accel.c +21 -1
@@ -101,6 +101,9 @@ MODULE_DEVICE_TABLE(acpi, lis3lv02d_device_ids);static int lis3lv02d_acpi_init (struct lis3lv02d *lis3) {struct acpi_device *dev = lis3->bus_priv; +if (!lis3->init_required) +return 0 ; +if (acpi_evaluate_object (dev->handle,METHOD_NAME__INI ,NULL ,NULL ) !=AE_OK )return -EINVAL ;
@@ -367,6 +370,7 @@ static int lis3lv02d_add(struct acpi_device *device) }/* call the core layer do its init */ + lis3_dev.init_required = true; ret =lis3lv02d_init_device (&lis3_dev);if (ret)return ret;
@@ -414,11 +418,27 @@ static int lis3lv02d_suspend(struct device *dev)static int lis3lv02d_resume (struct device *dev) { + lis3_dev.init_required = false; +lis3lv02d_poweron (&lis3_dev); +return 0 ; +} + +static int lis3lv02d_restore (struct device *dev) +{ + lis3_dev.init_required = true;lis3lv02d_poweron (&lis3_dev);return 0 ; } -static SIMPLE_DEV_PM_OPS(hp_accel_pm, lis3lv02d_suspend, lis3lv02d_resume); +static const struct dev_pm_ops hp_accel_pm = { + .suspend = lis3lv02d_suspend, + .resume = lis3lv02d_resume, + .freeze = lis3lv02d_suspend, + .thaw = lis3lv02d_resume, + .poweroff = lis3lv02d_suspend, + .restore = lis3lv02d_restore, +}; +#define HP_ACCEL_PM (&hp_accel_pm)#else #define HP_ACCEL_PM NULL
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/79 serial: max310x: unregister uart driver in case of failure and abort
In reply to Greg Kroah-HartmanFrom: Atul Gopinathan <[email protected]>
[ Upstream commit 3890e3dea315f1a257d1b940a2a4e2fa16a7b095 ]
The macro "spi_register_driver" invokes the function "__spi_register_driver()" which has a return type of int and can fail, returning a negative value in such a case. This is currently ignored and the init() function yields success even if the spi driver failed to register.
Fix this by collecting the return value of "__spi_register_driver()" and also unregister the uart driver in case of failure.
--- drivers/tty/serial/max310x.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/tty/serial/max310x.c +4 -2
@@ -1385,10 +1385,12 @@ static int __init max310x_uart_init(void)return ret;#ifdef CONFIG_SPI_MASTER -spi_register_driver (&max310x_spi_driver); + ret =spi_register_driver (&max310x_spi_driver); +if (ret) +uart_unregister_driver (&max310x_uart);#endif -return 0 ; +return ret; }module_init (max310x_uart_init);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/79 net: fujitsu: fix potential null-ptr-deref
In reply to Greg Kroah-HartmanFrom: Anirudh Rayabharam <[email protected]>
[ Upstream commit 52202be1cd996cde6e8969a128dc27ee45a7cb5e ]
In fmvj18x_get_hwinfo(), if ioremap fails there will be NULL pointer deref. To fix this, check the return value of ioremap and return -1 to the caller in case of failure.
--- drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/fujitsu/fmvj18x_cs.c +5 -0
@@ -547,6 +547,11 @@ static int fmvj18x_get_hwinfo(struct pcmcia_device *link, u_char *node_id)return -1 ; base =ioremap (link->resource[2 ]->start,resource_size (link->resource[2 ])); +if (!base) { +pcmcia_release_window (link, link->resource[2 ]); +return -1 ; + } +pcmcia_map_mem_page (link, link->resource[2 ],0 );/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/79 net: caif: remove BUG_ON(dev == NULL) in caif_xmit
In reply to Greg Kroah-HartmanFrom: Du Cheng <[email protected]>
[ Upstream commit 65a67792e3416f7c5d7daa47d99334cbb19a7449 ]
The condition of dev == NULL is impossible in caif_xmit(), hence it is for the removal.
Explanation:
The static caif_xmit() is only called upon via a function pointer ndo_start_xmit defined in include/linux/netdevice.h:
```
struct net_device_ops {
...
netdev_tx_t (*ndo_start_xmit)(struct sk_buff *skb, struct net_device *dev);
...
}
```The exhausive list of call points are:
```
drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c
dev->netdev_ops->ndo_start_xmit(skb, dev);
^ ^
drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c
struct opa_vnic_adapter *adapter = opa_vnic_priv(netdev);
^ ^
return adapter->rn_ops->ndo_start_xmit(skb, netdev); // adapter would crash first
^ ^
drivers/usb/gadget/function/f_ncm.c
ncm->netdev->netdev_ops->ndo_start_xmit(NULL, ncm->netdev);
^ ^
include/linux/netdevice.h
static inline netdev_tx_t __netdev_start_xmit(...
{
return ops->ndo_start_xmit(skb, dev);
^
}
const struct net_device_ops *ops = dev->netdev_ops;
^
rc = __netdev_start_xmit(ops, skb, dev, more);
^
```In each of the enumerated scenarios, it is impossible for the NULL-valued dev to reach the caif_xmit() without crashing the kernel earlier, therefore BUG_ON(dev == NULL) is rather useless, hence the removal.
--- drivers/net/caif/caif_serial.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/caif/caif_serial.c +0 -1
@@ -279,7 +279,6 @@ static int caif_xmit(struct sk_buff *skb, struct net_device *dev) {struct ser_device *ser; -BUG_ON (dev ==NULL ); ser =netdev_priv (dev);/* Send flow off once, on high water mark */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/79 char: hpet: add checks after calling ioremap
In reply to Greg Kroah-HartmanFrom: Tom Seewald <[email protected]>
[ Upstream commit b11701c933112d49b808dee01cb7ff854ba6a77a ]
The function hpet_resources() calls ioremap() two times, but in both cases it does not check if ioremap() returned a null pointer. Fix this by adding null pointer checks and returning an appropriate error.
--- drivers/char/hpet.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/char/hpet.c +4 -0
@@ -977,6 +977,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data)if (ACPI_SUCCESS (status)) { hdp->hd_phys_address = addr.address.minimum; hdp->hd_address =ioremap (addr.address.minimum, addr.address.address_length); +if (!hdp->hd_address) +return AE_ERROR ;if (hpet_is_known (hdp)) {iounmap (hdp->hd_address);
@@ -990,6 +992,8 @@ static acpi_status hpet_resources(struct acpi_resource *res, void *data) hdp->hd_phys_address = fixmem32->address; hdp->hd_address =ioremap (fixmem32->address,HPET_RANGE_SIZE ); +if (!hdp->hd_address) +return AE_ERROR ;if (hpet_is_known (hdp)) {iounmap (hdp->hd_address);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/79 ALSA: sb8: Add a comment note regarding an unused pointer
In reply to Greg Kroah-HartmanFrom: Atul Gopinathan <[email protected]>
[ Upstream commit a28591f61b60fac820c6de59826ffa710e5e314e ]
The field "fm_res" of "struct snd_sb8" is never used/dereferenced throughout the sb8.c code. Therefore there is no need for any null value check after the "request_region()".
Add a comment note to make developers know about this and prevent any "NULL check" patches on this part of code.
--- sound/isa/sb/sb8.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
sound/isa/sb/sb8.c +5 -1
@@ -109,7 +109,11 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev) acard = card->private_data; card->private_free = snd_sb8_free; -/* block the 0x388 port to avoid PnP conflicts */ +/* +* Block the 0x388 port to avoid PnP conflicts. +* No need to check this value after request_region, +* as we never do anything with it. +*/ acard->fm_res =request_region (0x388 ,4 ,"SoundBlaster FM" );if (port[dev] !=SNDRV_AUTO_PORT ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/79 isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
[ Upstream commit c446f0d4702d316e1c6bf621f70e79678d28830a ]
Move hw->cfg.mode and hw->addr.mode assignments from hw->ci->cfg_mode and hw->ci->addr_mode respectively, to be before the subsequent checks for memory IO mode (and possible ioremap calls in this case).
Also introduce ioremap error checks at both locations. This allows resources to be properly freed on ioremap failure, as when the caller of setup_io then subsequently calls release_io via its error path, release_io can now correctly determine the mode as it has been set before the ioremap call.
Finally, refactor release_io function so that it will call release_mem_region in the memory IO case, regardless of whether or not hw->cfg.p/hw->addr.p are NULL. This means resources are then properly released on failure.
This properly implements the original reverted commit (d721fe99f6ad) from the University of Minnesota, whilst also implementing the ioremap check for the hw->ci->cfg_mode if block as well.
--- drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++++++++++++++------- 1 file changed, 16 insertions(+), 8 deletions(-)
drivers/isdn/hardware/mISDN/mISDNinfineon.c +16 -8
@@ -645,17 +645,19 @@ static void release_io(struct inf_hw *hw) {if (hw->cfg.mode) { -if (hw->cfg.p) { +if (hw->cfg.mode ==AM_MEMIO ) {release_mem_region (hw->cfg.start, hw->cfg.size); -iounmap (hw->cfg.p); +if (hw->cfg.p) +iounmap (hw->cfg.p); }else release_region (hw->cfg.start, hw->cfg.size); hw->cfg.mode =AM_NONE ; }if (hw->addr.mode) { -if (hw->addr.p) { +if (hw->addr.mode ==AM_MEMIO ) {release_mem_region (hw->addr.start, hw->addr.size); -iounmap (hw->addr.p); +if (hw->addr.p) +iounmap (hw->addr.p); }else release_region (hw->addr.start, hw->addr.size); hw->addr.mode =AM_NONE ;
@@ -685,9 +687,12 @@ setup_io(struct inf_hw *hw) (ulong)hw->cfg.start, (ulong)hw->cfg.size);return err; } -if (hw->ci->cfg_mode ==AM_MEMIO ) - hw->cfg.p =ioremap (hw->cfg.start, hw->cfg.size); hw->cfg.mode = hw->ci->cfg_mode; +if (hw->ci->cfg_mode ==AM_MEMIO ) { + hw->cfg.p =ioremap (hw->cfg.start, hw->cfg.size); +if (!hw->cfg.p) +return -ENOMEM ; + }if (debug &DEBUG_HW ) pr_notice("%s: IO cfg %lx (%lu bytes) mode%d\n", hw->name, (ulong)hw->cfg.start,
@@ -712,9 +717,12 @@ setup_io(struct inf_hw *hw) (ulong)hw->addr.start, (ulong)hw->addr.size);return err; } -if (hw->ci->addr_mode ==AM_MEMIO ) - hw->addr.p =ioremap (hw->addr.start, hw->addr.size); hw->addr.mode = hw->ci->addr_mode; +if (hw->ci->addr_mode ==AM_MEMIO ) { + hw->addr.p =ioremap (hw->addr.start, hw->addr.size); +if (!hw->addr.p) +return -ENOMEM ; + }if (debug &DEBUG_HW ) pr_notice("%s: IO addr %lx (%lu bytes) mode%d\n", hw->name, (ulong)hw->addr.start,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/79 dmaengine: qcom_hidma: comment platform_driver_register call
In reply to Greg Kroah-HartmanFrom: Phillip Potter <[email protected]>
[ Upstream commit 4df2a8b0ad634d98a67e540a4e18a60f943e7d9f ]
Place a comment in hidma_mgmt_init explaining why success must currently be assumed, due to the cleanup issue that would need to be considered were this module ever to be unloadable or were this platform_driver_register call ever to fail.
--- drivers/dma/qcom/hidma_mgmt.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/dma/qcom/hidma_mgmt.c +14 -0
@@ -454,6 +454,20 @@ static int __init hidma_mgmt_init(void) hidma_mgmt_of_populate_channels(child); }#endif +/* +* We do not check for return value here, as it is assumed that +* platform_driver_register must not fail. The reason for this is that +* the (potential) hidma_mgmt_of_populate_channels calls above are not +* cleaned up if it does fail, and to do this work is quite +* complicated. In particular, various calls of of_address_to_resource, +* of_irq_to_resource, platform_device_register_full, of_dma_configure, +* and of_msi_configure which then call other functions and so on, must +* be cleaned up - this is not a trivial exercise. +* +* Currently, this module is not intended to be unloaded, and there is +* no module_exit function defined which does the needed cleanup. For +* this reason, we have to assume success here. +*/ platform_driver_register (&hidma_mgmt_driver);return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/79 libertas: register sysfs groups properly
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit 7e79b38fe9a403b065ac5915465f620a8fb3de84 ]
The libertas driver was trying to register sysfs groups "by hand" which causes them to be created _after_ the device is initialized and announced to userspace, which causes races and can prevent userspace tools from seeing the sysfs files correctly.
Fix this up by using the built-in sysfs_groups pointers in struct net_device which were created for this very reason, fixing the race condition, and properly allowing for any error that might have occured to be handled properly.
--- drivers/net/wireless/marvell/libertas/mesh.c | 28 +++----------------- 1 file changed, 4 insertions(+), 24 deletions(-)
drivers/net/wireless/marvell/libertas/mesh.c +4 -24
@@ -793,19 +793,6 @@ static const struct attribute_group mesh_ie_group = { .attrs = mesh_ie_attrs, }; -static void lbs_persist_config_init (struct net_device *dev) -{ -int ret; - ret =sysfs_create_group (&(dev->dev.kobj), &boot_opts_group); - ret =sysfs_create_group (&(dev->dev.kobj), &mesh_ie_group); -} - -static void lbs_persist_config_remove (struct net_device *dev) -{ -sysfs_remove_group (&(dev->dev.kobj), &boot_opts_group); -sysfs_remove_group (&(dev->dev.kobj), &mesh_ie_group); -} -/*************************************************************************** * Initializing and starting, stopping mesh
@@ -1005,6 +992,10 @@ static int lbs_add_mesh(struct lbs_private *priv)SET_NETDEV_DEV (priv->mesh_dev, priv->dev->dev.parent); mesh_dev->flags |=IFF_BROADCAST |IFF_MULTICAST ; + mesh_dev->sysfs_groups[0 ] = &lbs_mesh_attr_group; + mesh_dev->sysfs_groups[1 ] = &boot_opts_group; + mesh_dev->sysfs_groups[2 ] = &mesh_ie_group; +/* Register virtual mesh interface */ ret =register_netdev (mesh_dev);if (ret) {
@@ -1012,19 +1003,10 @@ static int lbs_add_mesh(struct lbs_private *priv) goto err_free_netdev; } - ret =sysfs_create_group (&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); -if (ret) - goto err_unregister; - -lbs_persist_config_init (mesh_dev); -/* Everything successful */ ret =0 ; goto done; -err_unregister: -unregister_netdev (mesh_dev); - err_free_netdev:free_netdev (mesh_dev);
@@ -1045,8 +1027,6 @@ void lbs_remove_mesh(struct lbs_private *priv)netif_stop_queue (mesh_dev);netif_carrier_off (mesh_dev); -sysfs_remove_group (&(mesh_dev->dev.kobj), &lbs_mesh_attr_group); -lbs_persist_config_remove (mesh_dev);unregister_netdev (mesh_dev); priv->mesh_dev =NULL ;kfree (mesh_dev->ieee80211_ptr);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/79 media: dvb: Add check on sp8870_readreg return
In reply to Greg Kroah-HartmanFrom: Alaa Emad <[email protected]>
[ Upstream commit c6d822c56e7fd29e6fa1b1bb91b98f6a1e942b3c ]
The function sp8870_readreg returns a negative value when i2c_transfer fails so properly check for this and return the error if it happens.
--- drivers/media/dvb-frontends/sp8870.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/dvb-frontends/sp8870.c +3 -1
@@ -293,7 +293,9 @@ static int sp8870_set_frontend_parameters(struct dvb_frontend *fe)sp8870_writereg (state,0xc05 , reg0xc05);// read status reg in order to clear pending irqs -sp8870_readreg (state,0x200 ); + err =sp8870_readreg (state,0x200 ); +if (err <0 ) +return err;// system controller start sp8870_microcontroller_start (state);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/79 media: gspca: properly check for errors in po1030_probe()
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
[ Upstream commit dacb408ca6f0e34df22b40d8dd5fae7f8e777d84 ]
If m5602_write_sensor() or m5602_write_bridge() fail, do not continue to initialize the device but return the error to the calling funtion.
--- drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/media/usb/gspca/m5602/m5602_po1030.c +7 -3
@@ -159,6 +159,7 @@ static const struct v4l2_ctrl_config po1030_greenbal_cfg = {int po1030_probe (struct sd *sd) {u8 dev_id_h =0 , i; +int err;struct gspca_dev *gspca_dev = (struct gspca_dev *)sd;if (force_sensor) {
@@ -177,10 +178,13 @@ int po1030_probe(struct sd *sd)for (i =0 ; i <ARRAY_SIZE (preinit_po1030); i++) {u8 data = preinit_po1030[i][2 ];if (preinit_po1030[i][0 ] ==SENSOR ) -m5602_write_sensor (sd, - preinit_po1030[i][1 ], &data,1 ); + err =m5602_write_sensor (sd, preinit_po1030[i][1 ], + &data,1 );else -m5602_write_bridge (sd, preinit_po1030[i][1 ], data); + err =m5602_write_bridge (sd, preinit_po1030[i][1 ], + data); +if (err <0 ) +return err; }if (m5602_read_sensor (sd,PO1030_DEVID_H , &dev_id_h,1 ))
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/79 scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic
In reply to Greg Kroah-HartmanFrom: Matt Wang <[email protected]>
[ Upstream commit 56f396146af278135c0ff958c79b5ee1bd22453d ]
Commit 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit") introduced a serious issue for 64-bit systems. With this commit, 64-bit kernel will enumerate 8*15 non-existing disks. This is caused by the broken CCB structure. The change from u32 data to void *data increased CCB length on 64-bit system, which introduced an extra 4 byte offset of the CDB. This leads to incorrect response to INQUIRY commands during enumeration.
Fix disk enumeration failure by reverting the portion of the commit above which switched the data pointer from u32 to void.
--- drivers/scsi/BusLogic.c | 6 +++--- drivers/scsi/BusLogic.h | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-)
drivers/scsi/BusLogic.c +3 -3
@@ -3081,11 +3081,11 @@ static int blogic_qcmd_lck(struct scsi_cmnd *command, ccb->opcode =BLOGIC_INITIATOR_CCB_SG ; ccb->datalen = count *sizeof (struct blogic_sg_seg );if (blogic_multimaster_type (adapter)) - ccb->data = (void *)((unsigned int ) ccb->dma_handle + + ccb->data = (unsigned int ) ccb->dma_handle + ((unsigned long ) &ccb->sglist - - (unsigned long ) ccb)); + (unsigned long ) ccb);else - ccb->data = ccb->sglist; + ccb->data =virt_to_32bit_virt (ccb->sglist);scsi_for_each_sg (command, sg, count, i) { ccb->sglist[i].segbytes =sg_dma_len (sg);
drivers/scsi/BusLogic.h +1 -1
@@ -821,7 +821,7 @@ struct blogic_ccb {unsigned char cdblen;/* Byte 2 */ unsigned char sense_datalen;/* Byte 3 */ u32 datalen;/* Bytes 4-7 */ -void *data;/* Bytes 8-11 */ +u32 data;/* Bytes 8-11 */ unsigned char:8; /* Byte 12 */ unsigned char:8; /* Byte 13 */enum blogic_adapter_status adapter_status;/* Byte 14 */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/79 openrisc: Define memory barrier mb
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 8b549c18ae81dbc36fb11e4aa08b8378c599ca95 ]
This came up in the discussion of the requirements of qspinlock on an architecture. OpenRISC uses qspinlock, but it was noticed that the memmory barrier was not defined.
Peter defined it in the mail thread writing:
As near as I can tell this should do. The arch spec only lists this one instruction and the text makes it sound like a completion barrier.
This is correct so applying this patch.
--- arch/openrisc/include/asm/barrier.h | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 arch/openrisc/include/asm/barrier.h
arch/openrisc/include/asm/barrier.h new file +9 -0
@@ -0,0 +1,9 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __ASM_BARRIER_H +#define __ASM_BARRIER_H + +#define mb () asm volatile ("l.msync" ::: "memory") + +#include <asm-generic/barrier.h> + +#endif /* __ASM_BARRIER_H */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/79 btrfs: do not BUG_ON in link_to_fixup_dir
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
[ Upstream commit 91df99a6eb50d5a1bc70fff4a09a0b7ae6aab96d ]
While doing error injection testing I got the following panic
kernel BUG at fs/btrfs/tree-log.c:1862!
invalid opcode: 0000 [#1] SMP NOPTI
CPU: 1 PID: 7836 Comm: mount Not tainted 5.13.0-rc1+ #305 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 RIP: 0010:link_to_fixup_dir+0xd5/0xe0 RSP: 0018:ffffb5800180fa30 EFLAGS: 00010216 RAX: fffffffffffffffb RBX: 00000000fffffffb RCX: ffff8f595287faf0 RDX: ffffb5800180fa37 RSI: ffff8f5954978800 RDI: 0000000000000000 RBP: ffff8f5953af9450 R08: 0000000000000019 R09: 0000000000000001 R10: 000151f408682970 R11: 0000000120021001 R12: ffff8f5954978800 R13: ffff8f595287faf0 R14: ffff8f5953c77dd0 R15: 0000000000000065 FS: 00007fc5284c8c40(0000) GS:ffff8f59bbd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc5287f47c0 CR3: 000000011275e002 CR4: 0000000000370ee0 Call Trace: replay_one_buffer+0x409/0x470 ? btree_read_extent_buffer_pages+0xd0/0x110 walk_up_log_tree+0x157/0x1e0 walk_log_tree+0xa6/0x1d0 btrfs_recover_log_trees+0x1da/0x360 ? replay_one_extent+0x7b0/0x7b0 open_ctree+0x1486/0x1720 btrfs_mount_root.cold+0x12/0xea ? __kmalloc_track_caller+0x12f/0x240 legacy_get_tree+0x24/0x40 vfs_get_tree+0x22/0xb0 vfs_kern_mount.part.0+0x71/0xb0 btrfs_mount+0x10d/0x380 ? vfs_parse_fs_string+0x4d/0x90 legacy_get_tree+0x24/0x40 vfs_get_tree+0x22/0xb0 path_mount+0x433/0xa10 __x64_sys_mount+0xe3/0x120 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xae
We can get -EIO or any number of legitimate errors from btrfs_search_slot(), panicing here is not the appropriate response. The error path for this code handles errors properly, simply return the error.
--- fs/btrfs/tree-log.c | 2 -- 1 file changed, 2 deletions(-)
fs/btrfs/tree-log.c +0 -2
@@ -1629,8 +1629,6 @@ static noinline int link_to_fixup_dir(struct btrfs_trans_handle *trans, ret =btrfs_update_inode (trans, root, inode); }else if (ret == -EEXIST ) { ret =0 ; - }else { -BUG ();/* Logic Error */ }iput (inode);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/79 platform/x86: hp-wireless: add AMDs hardware id to the supported list
In reply to Greg Kroah-HartmanFrom: Shyam Sundar S K <[email protected]>
[ Upstream commit f048630bdd55eb5379ef35f971639fe52fabe499 ]
Newer AMD based laptops uses AMDI0051 as the hardware id to support the airplane mode button. Adding this to the supported list.
--- drivers/platform/x86/hp-wireless.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/platform/x86/hp-wireless.c +2 -0
@@ -30,12 +30,14 @@ MODULE_LICENSE("GPL");MODULE_AUTHOR ("Alex Hung" );MODULE_ALIAS ("acpi*:HPQ6001:*" );MODULE_ALIAS ("acpi*:WSTADEF:*" ); +MODULE_ALIAS ("acpi*:AMDI0051:*" );static struct input_dev *hpwl_input_dev;static const struct acpi_device_id hpwl_ids[] = { {"HPQ6001" ,0 }, {"WSTADEF" ,0 }, + {"AMDI0051" ,0 }, {"" ,0 }, };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/79 platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit bc1eca606d8084465e6f89fd646cc71defbad490 ]
The intel_punit_ipc driver might be compiled as a module. When udev handles the event of the devices appearing the intel_punit_ipc module is missing.
Append MODULE_DEVICE_TABLE for ACPI case to fix the loading issue.
--- drivers/platform/x86/intel_punit_ipc.c | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/intel_punit_ipc.c +1 -0
@@ -330,6 +330,7 @@ static const struct acpi_device_id punit_ipc_acpi_ids[] = { { "INT34D4", 0 }, { } }; +MODULE_DEVICE_TABLE (acpi, punit_ipc_acpi_ids);static struct platform_driver intel_punit_ipc_driver = { .probe = intel_punit_ipc_probe,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/79 SMB3: incorrect file id in requests compounded with open
In reply to Greg Kroah-HartmanFrom: Steve French <[email protected]>
[ Upstream commit c0d46717b95735b0eacfddbcca9df37a49de9c7a ]
See MS-SMB2 3.2.4.1.4, file ids in compounded requests should be set to 0xFFFFFFFFFFFFFFFF (we were treating it as u32 not u64 and setting it incorrectly).
--- fs/cifs/smb2pdu.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/cifs/smb2pdu.c +3 -3
@@ -2518,10 +2518,10 @@ smb2_new_read_req(void **buf, unsigned int *total_len,* Related requests use info from previous read request * in chain. */ - shdr->SessionId =0xFFFFFFFF ; + shdr->SessionId =0xFFFFFFFFFFFFFFFF ; shdr->TreeId =0xFFFFFFFF ; - req->PersistentFileId =0xFFFFFFFF ; - req->VolatileFileId =0xFFFFFFFF ; + req->PersistentFileId =0xFFFFFFFFFFFFFFFF ; + req->VolatileFileId =0xFFFFFFFFFFFFFFFF ; } }if (remaining_bytes > io_parms->length)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/79 drm/amdgpu: Fix a use-after-free
In reply to Greg Kroah-HartmanFrom: xinhui pan <[email protected]>
[ Upstream commit 1e5c37385097c35911b0f8a0c67ffd10ee1af9a2 ]
looks like we forget to set ttm->sg to NULL.
Hit panic below
[ 1235.844104] general protection fault, probably for non-canonical address 0x6b6b6b6b6b6b7b4b: 0000 [#1] SMP DEBUG_PAGEALLOC NOPTI [ 1235.989074] Call Trace: [ 1235.991751] sg_free_table+0x17/0x20 [ 1235.995667] amdgpu_ttm_backend_unbind.cold+0x4d/0xf7 [amdgpu] [ 1236.002288] amdgpu_ttm_backend_destroy+0x29/0x130 [amdgpu] [ 1236.008464] ttm_tt_destroy+0x1e/0x30 [ttm] [ 1236.013066] ttm_bo_cleanup_memtype_use+0x51/0xa0 [ttm] [ 1236.018783] ttm_bo_release+0x262/0xa50 [ttm] [ 1236.023547] ttm_bo_put+0x82/0xd0 [ttm] [ 1236.027766] amdgpu_bo_unref+0x26/0x50 [amdgpu] [ 1236.032809] amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu+0x7aa/0xd90 [amdgpu] [ 1236.040400] kfd_ioctl_alloc_memory_of_gpu+0xe2/0x330 [amdgpu] [ 1236.046912] kfd_ioctl+0x463/0x690 [amdgpu]
--- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c +1 -0
@@ -1010,6 +1010,7 @@ static void amdgpu_ttm_tt_unpopulate(struct ttm_tt *ttm)if (gtt && gtt->userptr) {kfree (ttm->sg); + ttm->sg =NULL ; ttm->page_flags &= ~TTM_PAGE_FLAG_SG ;return ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/79 net: netcp: Fix an error message
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit ddb6e00f8413e885ff826e32521cff7924661de0 ]
'ret' is known to be 0 here.
The expected error code is stored in 'tx_pipe->dma_queue', so use it instead.
While at it, switch from %d to %pe which is more user friendly.
--- drivers/net/ethernet/ti/netcp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/ti/netcp_core.c +2 -2
@@ -1364,8 +1364,8 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) tx_pipe->dma_queue =knav_queue_open (name, tx_pipe->dma_queue_id,KNAV_QUEUE_SHARED );if (IS_ERR (tx_pipe->dma_queue)) { -dev_err (dev,"Could not open DMA queue for channel \"%s\": %d\n" , - name, ret); +dev_err (dev,"Could not open DMA queue for channel \"%s\": %pe\n" , + name, tx_pipe->dma_queue); ret =PTR_ERR (tx_pipe->dma_queue); goto err; }
Signature · 1 line
2.30.2
Re: [PATCH 4.14 63/79] net: netcp: Fix an error message
Le 31/05/2021 à 15:14, Greg Kroah-Hartman a écrit :
Quoted 23 lines
From: Christophe JAILLET <[email protected]>
[ Upstream commit
ddb6e00f8413e885ff826e32521cff7924661de0]'ret' is known to be 0 here.
The expected error code is stored in 'tx_pipe->dma_queue', so use it instead.While at it, switch from %d to %pe which is more user friendly.
Fixes 84640e27f230 ("net: netcp: Add Keystone NetCP core ethernet driver")Signed-off-by Christophe JAILLET <[email protected]>Signed-off-by David S. Miller <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- drivers/net/ethernet/ti/netcp_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)drivers/net/ethernet/ti/netcp_core.c +0
-0
drivers/net/ethernet/ti/netcp_core.c int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) · line 1371
Quoted 10 lines
drivers/net/ethernet/ti/netcp_core.c +2
-2@@ -1364,8 +1364,8 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe) tx_pipe->dma_queue =knav_queue_open (name, tx_pipe->dma_queue_id,KNAV_QUEUE_SHARED );if (IS_ERR (tx_pipe->dma_queue)) { -dev_err (dev,"Could not open DMA queue for channel \"%s\": %d\n" , - name, ret); +dev_err (dev,"Could not open DMA queue for channel \"%s\": %pe\n" , + name, tx_pipe->dma_queue); ret =PTR_ERR (tx_pipe->dma_queue); goto err; }
Hi,
Apparently %pe is only supported up to (including) 5.5. It is not part of 5.4.123.
So this patch should not be backported here or should be backported differently, ie:
leave dev_err as-is
move "ret = PTR_ERR(tx_pipe->dma_queue);" 1 line above
(or %pe should be backported first)
PS: adding Dan Carpenter because we had a small discussion about some potential backport issue when, using %pe
CJ
Greg Kroah-Hartman
maintainerPATCH 64/79 net: mdio: thunder: Fix a double free issue in the .remove function
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit a93a0a15876d2a077a3bc260b387d2457a051f24 ]
'bus->mii_bus' have been allocated with 'devm_mdiobus_alloc_size()' in the probe function. So it must not be freed explicitly or there will be a double free.
Remove the incorrect 'mdiobus_free' in the remove function.
--- drivers/net/phy/mdio-thunder.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/mdio-thunder.c +0 -1
@@ -129,7 +129,6 @@ static void thunder_mdiobus_pci_remove(struct pci_dev *pdev)continue ;mdiobus_unregister (bus->mii_bus); -mdiobus_free (bus->mii_bus);oct_mdio_writeq (0 , bus->register_base +SMI_EN ); }pci_set_drvdata (pdev,NULL );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/79 net: mdio: octeon: Fix some double free issues
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit e1d027dd97e1e750669cdc0d3b016a4f54e473eb ]
'bus->mii_bus' has been allocated with 'devm_mdiobus_alloc_size()' in the probe function. So it must not be freed explicitly or there will be a double free.
Remove the incorrect 'mdiobus_free' in the error handling path of the probe function and in remove function.
--- drivers/net/phy/mdio-octeon.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/phy/mdio-octeon.c +0 -2
@@ -75,7 +75,6 @@ static int octeon_mdiobus_probe(struct platform_device *pdev)return 0 ; fail_register: -mdiobus_free (bus->mii_bus); smi_en.u64 =0 ;oct_mdio_writeq (smi_en.u64, bus->register_base +SMI_EN );return err;
@@ -89,7 +88,6 @@ static int octeon_mdiobus_remove(struct platform_device *pdev) bus =platform_get_drvdata (pdev);mdiobus_unregister (bus->mii_bus); -mdiobus_free (bus->mii_bus); smi_en.u64 =0 ;oct_mdio_writeq (smi_en.u64, bus->register_base +SMI_EN );return 0 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/79 net: bnx2: Fix error return code in bnx2_init_board()
In reply to Greg Kroah-HartmanFrom: Zhen Lei <[email protected]>
[ Upstream commit 28c66b6da4087b8cfe81c2ec0a46eb6116dafda9 ]
Fix to return -EPERM from the error handling case instead of 0, as done elsewhere in this function.
--- drivers/net/ethernet/broadcom/bnx2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnx2.c +1 -1
@@ -8252,9 +8252,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)BNX2_WR (bp,PCI_COMMAND , reg); }else if ((BNX2_CHIP_ID (bp) ==BNX2_CHIP_ID_5706_A1 ) && !(bp->flags &BNX2_FLAG_PCIX )) { -dev_err (&pdev->dev,"5706 A1 can only be used in a PCIX bus, aborting\n" ); + rc = -EPERM ; goto err_out_unmap; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/79 mld: fix panic in mld_newpack()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 020ef930b826d21c5446fdc9db80fd72a791bc21 ]
mld_newpack() doesn't allow to allocate high order page, only order-0 allocation is allowed.
If headroom size is too large, a kernel panic could occur in skb_put().
Test commands:
ip netns del A
ip netns del B
ip netns add A
ip netns add B
ip link add veth0 type veth peer name veth1
ip link set veth0 netns A
ip link set veth1 netns B
ip netns exec A ip link set lo up
ip netns exec A ip link set veth0 up
ip netns exec A ip -6 a a 2001:db8:0::1/64 dev veth0 ip netns exec B ip link set lo up
ip netns exec B ip link set veth1 up
ip netns exec B ip -6 a a 2001:db8:0::2/64 dev veth1 for i in {1..99}
do
let A=$i-1
ip netns exec A ip link add ip6gre$i type ip6gre \
local 2001:db8:$A::1 remote 2001:db8:$A::2 encaplimit 100 ip netns exec A ip -6 a a 2001:db8:$i::1/64 dev ip6gre$i ip netns exec A ip link set ip6gre$i up
ip netns exec B ip link add ip6gre$i type ip6gre \
local 2001:db8:$A::2 remote 2001:db8:$A::1 encaplimit 100 ip netns exec B ip -6 a a 2001:db8:$i::2/64 dev ip6gre$i ip netns exec B ip link set ip6gre$i up
done
Splat looks like:
kernel BUG at net/core/skbuff.c:110!
invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.12.0+ #891 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x15d/0x15f Code: 92 fe 4c 8b 4c 24 10 53 8b 4d 70 45 89 e0 48 c7 c7 00 ae 79 83 41 57 41 56 41 55 48 8b 54 24 a6 26 f9 ff <0f> 0b 48 8b 6c 24 20 89 34 24 e8 4a 4e 92 fe 8b 34 24 48 c7 c1 20 RSP: 0018:ffff88810091f820 EFLAGS: 00010282 RAX: 0000000000000089 RBX: ffff8881086e9000 RCX: 0000000000000000 RDX: 0000000000000089 RSI: 0000000000000008 RDI: ffffed1020123efb RBP: ffff888005f6eac0 R08: ffffed1022fc0031 R09: ffffed1022fc0031 R10: ffff888117e00187 R11: ffffed1022fc0030 R12: 0000000000000028 R13: ffff888008284eb0 R14: 0000000000000ed8 R15: 0000000000000ec0 FS: 0000000000000000(0000) GS:ffff888117c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8b801c5640 CR3: 0000000033c2c006 CR4: 00000000003706f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600 ? ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600 skb_put.cold.104+0x22/0x22 ip6_mc_hdr.isra.26.constprop.46+0x12a/0x600 ? rcu_read_lock_sched_held+0x91/0xc0 mld_newpack+0x398/0x8f0 ? ip6_mc_hdr.isra.26.constprop.46+0x600/0x600 ? lock_contended+0xc40/0xc40 add_grhead.isra.33+0x280/0x380 add_grec+0x5ca/0xff0 ? mld_sendpack+0xf40/0xf40 ? lock_downgrade+0x690/0x690 mld_send_initial_cr.part.34+0xb9/0x180 ipv6_mc_dad_complete+0x15d/0x1b0 addrconf_dad_completed+0x8d2/0xbb0 ? lock_downgrade+0x690/0x690 ? addrconf_rs_timer+0x660/0x660 ? addrconf_dad_work+0x73c/0x10e0 addrconf_dad_work+0x73c/0x10e0
Allowing high order page allocation could fix this problem.
--- net/ipv6/mcast.c | 3 --- 1 file changed, 3 deletions(-)
net/ipv6/mcast.c +0 -3
@@ -1580,10 +1580,7 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu) IPV6_TLV_PADN, 0 };/* we assume size > sizeof(ra) here */ -/* limit our allocations to order-0 page */ - size =min_t (int, size,SKB_MAX_ORDER (0 ,0 )); skb =sock_alloc_send_skb (sk, size,1 , &err); -if (!skb)return NULL ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/79 staging: emxx_udc: fix loop in _nbu2ss_nuke()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit e0112a7c9e847ada15a631b88e279d547e8f26a7 ]
The _nbu2ss_ep_done() function calls:
list_del_init(&req->queue);
which means that the loop will never exit.
--- drivers/staging/emxx_udc/emxx_udc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/staging/emxx_udc/emxx_udc.c +2 -2
@@ -2159,7 +2159,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc, struct nbu2ss_ep *ep, int status) { -struct nbu2ss_req *req; +struct nbu2ss_req *req, *n;/* Endpoint Disable */ _nbu2ss_epn_exit (udc, ep);
@@ -2171,7 +2171,7 @@ static int _nbu2ss_nuke(struct nbu2ss_udc *udc,return 0 ;/* called with irqs blocked */ -list_for_each_entry (req, &ep->queue, queue) { +list_for_each_entry_safe (req, n, &ep->queue, queue) {_nbu2ss_ep_done (ep, req, status); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/79 ASoC: cs35l33: fix an error code in probe()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 833bc4cf9754643acc69b3c6b65988ca78df4460 ]
This error path returns zero (success) but it should return -EINVAL.
--- sound/soc/codecs/cs35l33.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/cs35l33.c +1 -0
@@ -1206,6 +1206,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,dev_err (&i2c_client->dev,"CS35L33 Device ID (%X). Expected ID %X\n" , devid,CS35L33_CHIP_ID ); + ret = -EINVAL ; goto err_enable; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/79 bpf: Set mac_len in bpf_skb_change_head
In reply to Greg Kroah-HartmanFrom: Jussi Maki <[email protected]>
[ Upstream commit 84316ca4e100d8cbfccd9f774e23817cb2059868 ]
The skb_change_head() helper did not set "skb->mac_len", which is problematic when it's used in combination with skb_redirect_peer(). Without it, redirecting a packet from a L3 device such as wireguard to the veth peer device will cause skb->data to point to the middle of the IP header on entry to tcp_v4_rcv() since the L2 header is not pulled correctly due to mac_len=0.
--- net/core/filter.c | 1 + 1 file changed, 1 insertion(+)
net/core/filter.c +1 -0
@@ -2438,6 +2438,7 @@ BPF_CALL_3(bpf_skb_change_head, struct sk_buff *, skb, u32, head_room,__skb_push (skb, head_room);memset (skb->data,0 , head_room);skb_reset_mac_header (skb); +skb_reset_mac_len (skb); }bpf_compute_data_end (skb);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/79 ixgbe: fix large MTU request from VF
In reply to Greg Kroah-HartmanFrom: Jesse Brandeburg <[email protected]>
[ Upstream commit 63e39d29b3da02e901349f6cd71159818a4737a6 ]
Check that the MTU value requested by the VF is in the supported range of MTUs before attempting to set the VF large packet enable, otherwise reject the request. This also avoids unnecessary register updates in the case of the 82599 controller.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c +7 -9
@@ -511,12 +511,16 @@ static int ixgbe_set_vf_vlan(struct ixgbe_adapter *adapter, int add, int vid,return err; } -static s32 ixgbe_set_vf_lpe (struct ixgbe_adapter *adapter,u32 *msgbuf,u32 vf) +static int ixgbe_set_vf_lpe (struct ixgbe_adapter *adapter,u32 max_frame,u32 vf) {struct ixgbe_hw *hw = &adapter->hw; -int max_frame = msgbuf[1 ];u32 max_frs; +if (max_frame <ETH_MIN_MTU || max_frame >IXGBE_MAX_JUMBO_FRAME_SIZE ) { +e_err (drv,"VF max_frame %d out of range\n" , max_frame); +return -EINVAL ; + } +/* * For 82599EB we have to keep all PFs and VFs operating with * the same max_frame value in order to avoid sending an oversize
@@ -576,12 +580,6 @@ static s32 ixgbe_set_vf_lpe(struct ixgbe_adapter *adapter, u32 *msgbuf, u32 vf) } } -/* MTU < 68 is an error and causes problems on some kernels */ -if (max_frame >IXGBE_MAX_JUMBO_FRAME_SIZE ) { -e_err (drv,"VF max_frame %d out of range\n" , max_frame); -return -EINVAL ; - } -/* pull current max frame size from hardware */ max_frs =IXGBE_READ_REG (hw,IXGBE_MAXFRS ); max_frs &=IXGBE_MHADD_MFS_MASK ;
@@ -1248,7 +1246,7 @@ static int ixgbe_rcv_msg_from_vf(struct ixgbe_adapter *adapter, u32 vf) retval =ixgbe_set_vf_vlan_msg (adapter, msgbuf, vf);break ;case IXGBE_VF_SET_LPE : - retval =ixgbe_set_vf_lpe (adapter, msgbuf, vf); + retval =ixgbe_set_vf_lpe (adapter, msgbuf[1 ], vf);break ;case IXGBE_VF_SET_MACVLAN : retval =ixgbe_set_vf_macvlan_msg (adapter, msgbuf, vf);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/79 scsi: libsas: Use _safe() loop in sas_resume_port()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 8c7e7b8486cda21269d393245883c5e4737d5ee7 ]
If sas_notify_lldd_dev_found() fails then this code calls:
sas_unregister_dev(port, dev);
which removes "dev", our list iterator, from the list. This could lead to an endless loop. We need to use list_for_each_entry_safe().
--- drivers/scsi/libsas/sas_port.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/libsas/sas_port.c +2 -2
@@ -41,7 +41,7 @@ static bool phy_is_wideport_member(struct asd_sas_port *port, struct asd_sas_phystatic void sas_resume_port (struct asd_sas_phy *phy) { -struct domain_device *dev; +struct domain_device *dev, *n;struct asd_sas_port *port = phy->port;struct sas_ha_struct *sas_ha = phy->ha;struct sas_internal *si =to_sas_internal (sas_ha->core.shost->transportt);
@@ -60,7 +60,7 @@ static void sas_resume_port(struct asd_sas_phy *phy)* 1/ presume every device came back * 2/ force the next revalidation to check all expander phys */ -list_for_each_entry (dev, &port->dev_list, dev_list_node) { +list_for_each_entry_safe (dev, n, &port->dev_list, dev_list_node) {int i, rc; rc =sas_notify_lldd_dev_found (dev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/79 ipv6: record frag_max_size in atomic fragments in input path
In reply to Greg Kroah-HartmanFrom: Francesco Ruggeri <[email protected]>
[ Upstream commit e29f011e8fc04b2cdc742a2b9bbfa1b62518381a ]
Commit dbd1759e6a9c ("ipv6: on reassembly, record frag_max_size") filled the frag_max_size field in IP6CB in the input path. The field should also be filled in case of atomic fragments.
--- net/ipv6/reassembly.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv6/reassembly.c +3 -1
@@ -347,7 +347,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) hdr =ipv6_hdr (skb); fhdr = (struct frag_hdr *)skb_transport_header (skb); -if (!(fhdr->frag_off &htons (0xFFF9 ))) { +if (!(fhdr->frag_off &htons (IP6_OFFSET |IP6_MF ))) {/* It is not a fragmented frame */ skb->transport_header +=sizeof (struct frag_hdr ); __IP6_INC_STATS(net,
@@ -355,6 +355,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)IP6CB (skb)->nhoff = (u8 *)fhdr -skb_network_header (skb);IP6CB (skb)->flags |=IP6SKB_FRAGMENTED ; +IP6CB (skb)->frag_max_size =ntohs (hdr->payload_len) + +sizeof (struct ipv6hdr );return 1 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/79 sch_dsmark: fix a NULL deref in qdisc_reset()
In reply to Greg Kroah-HartmanFrom: Taehee Yoo <[email protected]>
[ Upstream commit 9b76eade16423ef06829cccfe3e100cfce31afcd ]
If Qdisc_ops->init() is failed, Qdisc_ops->reset() would be called. When dsmark_init(Qdisc_ops->init()) is failed, it possibly doesn't initialize dsmark_qdisc_data->q. But dsmark_reset(Qdisc_ops->reset()) uses dsmark_qdisc_data->q pointer wihtout any null checking. So, panic would occur.
Test commands:
sysctl net.core.default_qdisc=dsmark -w
ip link add dummy0 type dummy
ip link add vw0 link dummy0 type virt_wifi
ip link set vw0 up
Splat looks like:
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] CPU: 3 PID: 684 Comm: ip Not tainted 5.12.0+ #910 RIP: 0010:qdisc_reset+0x2b/0x680 Code: 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 41 57 41 56 41 55 41 54 55 48 89 fd 48 83 c7 18 53 48 89 fa 48 c1 ea 03 48 83 ec 20 <80> 3c 02 00 0f 85 09 06 00 00 4c 8b 65 18 0f 1f 44 00 00 65 8b 1d RSP: 0018:ffff88800fda6bf8 EFLAGS: 00010282 RAX: dffffc0000000000 RBX: ffff8880050ed800 RCX: 0000000000000000 RDX: 0000000000000003 RSI: ffffffff99e34100 RDI: 0000000000000018 RBP: 0000000000000000 R08: fffffbfff346b553 R09: fffffbfff346b553 R10: 0000000000000001 R11: fffffbfff346b552 R12: ffffffffc0824940 R13: ffff888109e83800 R14: 00000000ffffffff R15: ffffffffc08249e0 FS: 00007f5042287680(0000) GS:ffff888119800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055ae1f4dbd90 CR3: 0000000006760002 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ? rcu_read_lock_bh_held+0xa0/0xa0 dsmark_reset+0x3d/0xf0 [sch_dsmark] qdisc_reset+0xa9/0x680 qdisc_destroy+0x84/0x370 qdisc_create_dflt+0x1fe/0x380 attach_one_default_qdisc.constprop.41+0xa4/0x180 dev_activate+0x4d5/0x8c0 ? __dev_open+0x268/0x390 __dev_open+0x270/0x390
--- net/sched/sch_dsmark.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_dsmark.c +2 -1
@@ -397,7 +397,8 @@ static void dsmark_reset(struct Qdisc *sch)struct dsmark_qdisc_data *p =qdisc_priv (sch);pr_debug ("%s(sch %p,[qdisc %p])\n" , __func__, sch, p); -qdisc_reset (p->q); +if (p->q) +qdisc_reset (p->q); sch->qstats.backlog =0 ; sch->q.qlen =0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/79 MIPS: alchemy: xxs1500: add gpio-au1000.h header file
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit ff4cff962a7eedc73e54b5096693da7f86c61346 ]
board-xxs1500.c references 2 functions without declaring them, so add the header file to placate the build.
../arch/mips/alchemy/board-xxs1500.c: In function 'board_setup':../arch/mips/alchemy/board-xxs1500.c:56:2: error: implicit declaration of function 'alchemy_gpio1_input_enable' [-Werror=implicit-function-declaration]
56 | alchemy_gpio1_input_enable();../arch/mips/alchemy/board-xxs1500.c:57:2: error: implicit declaration of function 'alchemy_gpio2_enable'; did you mean 'alchemy_uart_enable'? [-Werror=implicit-function-declaration]
57 | alchemy_gpio2_enable();
--- arch/mips/alchemy/board-xxs1500.c | 1 + 1 file changed, 1 insertion(+)
arch/mips/alchemy/board-xxs1500.c +1 -0
@@ -30,6 +30,7 @@#include <asm/bootinfo.h> #include <asm/reboot.h> #include <asm/mach-au1x00/au1000.h> +#include <asm/mach-au1x00/gpio-au1000.h> #include <prom.h> const char *get_system_type (void )
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/79 MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit fef532ea0cd871afab7d9a7b6e9da99ac2c24371 ]
rt2880_wdt.c uses (well, attempts to use) rt_sysc_membase. However, when this watchdog driver is built as a loadable module, there is a build error since the rt_sysc_membase symbol is not exported. Export it to quell the build error.
ERROR: modpost: "rt_sysc_membase" [drivers/watchdog/rt2880_wdt.ko] undefined!
--- arch/mips/ralink/of.c | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/ralink/of.c +2 -0
@@ -10,6 +10,7 @@#include <linux/io.h> #include <linux/clk.h> +#include <linux/export.h> #include <linux/init.h> #include <linux/sizes.h> #include <linux/of_fdt.h>
@@ -27,6 +28,7 @@__iomem void *rt_sysc_membase;__iomem void *rt_memc_membase; +EXPORT_SYMBOL_GPL (rt_sysc_membase);__iomem void *plat_of_remap_node (const char *node) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/79 hugetlbfs: hugetlb_fault_mutex_hash() cleanup
In reply to Greg Kroah-HartmanFrom: Mike Kravetz <[email protected]>
commit 552546366a30d88bd1d6f5efe848b2ab50fd57e5 upstream.
A new clang diagnostic (-Wsizeof-array-div) warns about the calculation to determine the number of u32's in an array of unsigned longs. Suppress warning by adding parentheses.
While looking at the above issue, noticed that the 'address' parameter to hugetlb_fault_mutex_hash is no longer used. So, remove it from the definition and all callers.
No functional change.
--- fs/hugetlbfs/inode.c | 4 ++-- include/linux/hugetlb.h | 2 +- mm/hugetlb.c | 11 +++++------ mm/userfaultfd.c | 2 +- 4 files changed, 9 insertions(+), 10 deletions(-)
fs/hugetlbfs/inode.c +2 -2
@@ -436,7 +436,7 @@ static void remove_inode_hugepages(strucu32 hash; index = page->index; - hash =hugetlb_fault_mutex_hash (h, mapping, index,0 ); + hash =hugetlb_fault_mutex_hash (h, mapping, index);mutex_lock (&hugetlb_fault_mutex_table[hash]);/*
@@ -618,7 +618,7 @@ static long hugetlbfs_fallocate(struct f addr = index * hpage_size;/* mutex taken here, fault path and hole punch */ - hash =hugetlb_fault_mutex_hash (h, mapping, index, addr); + hash =hugetlb_fault_mutex_hash (h, mapping, index);mutex_lock (&hugetlb_fault_mutex_table[hash]);/* See if already present in mapping to avoid alloc/free */
include/linux/hugetlb.h +1 -1
@@ -123,7 +123,7 @@ void free_huge_page(struct page *page);void hugetlb_fix_reserve_counts (struct inode *inode);extern struct mutex *hugetlb_fault_mutex_table;u32 hugetlb_fault_mutex_hash (struct hstate *h,struct address_space *mapping, -pgoff_t idx,unsigned long address); +pgoff_t idx);pte_t *huge_pmd_share (struct mm_struct *mm,unsigned long addr,pud_t *pud);
mm/hugetlb.c +5 -6
@@ -3802,8 +3802,7 @@ retry:* handling userfault. Reacquire after handling * fault to make calling code simpler. */ - hash =hugetlb_fault_mutex_hash (h, mapping, idx, - address); + hash =hugetlb_fault_mutex_hash (h, mapping, idx);mutex_unlock (&hugetlb_fault_mutex_table[hash]); ret =handle_userfault (&vmf,VM_UFFD_MISSING );mutex_lock (&hugetlb_fault_mutex_table[hash]);
@@ -3916,7 +3915,7 @@ backout_unlocked:#ifdef CONFIG_SMP u32 hugetlb_fault_mutex_hash (struct hstate *h,struct address_space *mapping, -pgoff_t idx,unsigned long address) +pgoff_t idx) {unsigned long key[2 ];u32 hash;
@@ -3924,7 +3923,7 @@ u32 hugetlb_fault_mutex_hash(struct hsta key[0 ] = (unsigned long ) mapping; key[1 ] = idx; - hash =jhash2 ((u32 *)&key,sizeof (key)/sizeof (u32),0 ); + hash =jhash2 ((u32 *)&key,sizeof (key)/(sizeof (u32)),0 );return hash & (num_fault_mutexes -1 ); }
@@ -3934,7 +3933,7 @@ u32 hugetlb_fault_mutex_hash(struct hsta* return 0 and avoid the hashing overhead. */ u32 hugetlb_fault_mutex_hash (struct hstate *h,struct address_space *mapping, -pgoff_t idx,unsigned long address) +pgoff_t idx) {return 0 ; }
@@ -3979,7 +3978,7 @@ int hugetlb_fault(struct mm_struct *mm,* get spurious allocation failures if two CPUs race to instantiate * the same page in the page cache. */ - hash =hugetlb_fault_mutex_hash (h, mapping, idx, address); + hash =hugetlb_fault_mutex_hash (h, mapping, idx);mutex_lock (&hugetlb_fault_mutex_table[hash]); entry =huge_ptep_get (ptep);
mm/userfaultfd.c +1 -1
@@ -272,7 +272,7 @@ retry:*/ idx =linear_page_index (dst_vma, dst_addr); mapping = dst_vma->vm_file->f_mapping; - hash =hugetlb_fault_mutex_hash (h, mapping, idx, dst_addr); + hash =hugetlb_fault_mutex_hash (h, mapping, idx);mutex_lock (&hugetlb_fault_mutex_table[hash]); err = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 78/79 drivers/net/ethernet: clean up unused assignments
In reply to Greg Kroah-HartmanFrom: Jesse Brandeburg <[email protected]>
commit 7c8c0291f84027558bd5fca5729cbcf288c510f4 upstream.
As part of the W=1 compliation series, these lines all created warnings about unused variables that were assigned a value. Most of them are from register reads, but some are just picking up a return value from a function and never doing anything with it.
Fixed warnings:.../ethernet/brocade/bna/bnad.c:3280:6: warning: variable ‘rx_count’ set but not used [-Wunused-but-set-variable] .../ethernet/brocade/bna/bnad.c:3280:6: warning: variable ‘rx_count’ set but not used [-Wunused-but-set-variable] .../ethernet/cortina/gemini.c:512:6: warning: variable ‘val’ set but not used [-Wunused-but-set-variable] .../ethernet/cortina/gemini.c:2110:21: warning: variable ‘config0’ set but not used [-Wunused-but-set-variable] .../ethernet/cavium/liquidio/octeon_device.c:1327:6: warning: variable ‘val32’ set but not used [-Wunused-but-set-variable] .../ethernet/cavium/liquidio/octeon_device.c:1358:6: warning: variable ‘val32’ set but not used [-Wunused-but-set-variable] .../ethernet/dec/tulip/media.c:322:8: warning: variable ‘setup’ set but not used [-Wunused-but-set-variable] .../ethernet/dec/tulip/de4x5.c:4928:13: warning: variable ‘r3’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:1652:7: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:1652:7: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:1652:7: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:1652:7: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:4981:6: warning: variable ‘rx_status’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:6510:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] .../ethernet/micrel/ksz884x.c:6087: warning: cannot understand function prototype: 'struct hw_regs ' .../ethernet/microchip/lan743x_main.c:161:6: warning: variable ‘int_en’ set but not used [-Wunused-but-set-variable] .../ethernet/microchip/lan743x_main.c:1702:6: warning: variable ‘int_sts’ set but not used [-Wunused-but-set-variable] .../ethernet/microchip/lan743x_main.c:3041:6: warning: variable ‘ret’ set but not used [-Wunused-but-set-variable] .../ethernet/natsemi/ns83820.c:603:6: warning: variable ‘tbisr’ set but not used [-Wunused-but-set-variable] .../ethernet/natsemi/ns83820.c:1207:11: warning: variable ‘tanar’ set but not used [-Wunused-but-set-variable] .../ethernet/marvell/mvneta.c:754:6: warning: variable ‘dummy’ set but not used [-Wunused-but-set-variable] .../ethernet/neterion/vxge/vxge-traffic.c:33:6: warning: variable ‘val64’ set but not used [-Wunused-but-set-variable] .../ethernet/neterion/vxge/vxge-traffic.c:160:6: warning: variable ‘val64’ set but not used [-Wunused-but-set-variable] .../ethernet/neterion/vxge/vxge-traffic.c:490:6: warning: variable ‘val32’ set but not used [-Wunused-but-set-variable] .../ethernet/neterion/vxge/vxge-traffic.c:2378:6: warning: variable ‘val64’ set but not used [-Wunused-but-set-variable] .../ethernet/packetengines/yellowfin.c:1063:18: warning: variable ‘yf_size’ set but not used [-Wunused-but-set-variable] .../ethernet/realtek/8139cp.c:1242:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] .../ethernet/mellanox/mlx4/en_tx.c:858:6: warning: variable ‘ring_cons’ set but not used [-Wunused-but-set-variable] .../ethernet/sis/sis900.c:792:6: warning: variable ‘status’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:878:11: warning: variable ‘rx_ev_pkt_type’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:877:23: warning: variable ‘rx_ev_mcast_pkt’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:877:7: warning: variable ‘rx_ev_hdr_type’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:876:7: warning: variable ‘rx_ev_other_err’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:1646:21: warning: variable ‘buftbl_min’ set but not used [-Wunused-but-set-variable] .../ethernet/sfc/falcon/farch.c:2535:32: warning: variable ‘spec’ set but not used [-Wunused-but-set-variable] .../ethernet/via/via-velocity.c:880:6: warning: variable ‘curr_status’ set but not used [-Wunused-but-set-variable] .../ethernet/ti/tlan.c:656:6: warning: variable ‘rc’ set but not used [-Wunused-but-set-variable] .../ethernet/ti/davinci_emac.c:1230:6: warning: variable ‘num_tx_pkts’ set but not used [-Wunused-but-set-variable] .../ethernet/synopsys/dwc-xlgmac-common.c:516:8: warning: variable ‘str’ set but not used [-Wunused-but-set-variable] .../ethernet/ti/cpsw_new.c:1662:22: warning: variable ‘priv’ set but not used [-Wunused-but-set-variable]
The register reads should be OK, because the current implementation of readl and friends will always execute even without an lvalue.
When it makes sense, just remove the lvalue assignment and the local. Other times, just remove the offending code, and occasionally, just mark the variable as maybe unused since it could be used in an ifdef or debug scenario.
Only compile tested with W=1.
--- drivers/net/ethernet/brocade/bna/bnad.c | 7 +--- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/dec/tulip/media.c | 5 --- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 - drivers/net/ethernet/micrel/ksz884x.c | 3 -- drivers/net/ethernet/neterion/vxge/vxge-traffic.c | 32 +++++++--------------- drivers/net/ethernet/sfc/falcon/farch.c | 29 +++++++------------ drivers/net/ethernet/sis/sis900.c | 5 +-- drivers/net/ethernet/synopsys/dwc-xlgmac-common.c | 2 - drivers/net/ethernet/ti/davinci_emac.c | 5 +-- drivers/net/ethernet/ti/tlan.c | 4 -- drivers/net/ethernet/via/via-velocity.c | 13 -------- 12 files changed, 34 insertions(+), 77 deletions(-)
drivers/net/ethernet/brocade/bna/bnad.c +2 -5
@@ -3292,7 +3292,7 @@ bnad_change_mtu(struct net_device *netde {int err, mtu;struct bnad *bnad =netdev_priv (netdev); -u32 rx_count =0 , frame, new_frame; +u32 frame, new_frame;mutex_lock (&bnad->conf_mutex);
@@ -3308,12 +3308,9 @@ bnad_change_mtu(struct net_device *netde/* only when transition is over 4K */ if ((frame <=4096 && new_frame >4096 ) || (frame >4096 && new_frame <=4096 )) - rx_count =bnad_reinit_rx (bnad); +bnad_reinit_rx (bnad); } -/* rx_count > 0 - new rx created -* - Linux set err = 0 and return -*/ err =bnad_mtu_set (bnad, new_frame);if (err) err = -EBUSY ;
drivers/net/ethernet/dec/tulip/de4x5.c +2 -2
@@ -4922,11 +4922,11 @@ mii_get_oui(u_char phyaddr, u_long ioaddu_char breg[2]; } a; int i, r2, r3, ret=0;*/ -int r2, r3; +int r2;/* Read r2 and r3 */ r2 =mii_rd (MII_ID0 , phyaddr, ioaddr); - r3 =mii_rd (MII_ID1 , phyaddr, ioaddr); +mii_rd (MII_ID1 , phyaddr, ioaddr);/* SEEQ and Cypress way * / / * Shuffle r2 and r3 * / a.reg=0;
drivers/net/ethernet/dec/tulip/media.c +0 -5
@@ -319,13 +319,8 @@ void tulip_select_media(struct net_devicbreak ; }case 5 :case 6 : { -u16 setup[5 ]; - new_csr6 =0 ;/* FIXME */ -for (i =0 ; i <5 ; i++) - setup[i] =get_u16 (&p[i*2 +1 ]); -if (startup && mtable->has_reset) {struct medialeaf *rleaf = &mtable->mleaf[mtable->has_reset];unsigned char *rst = rleaf->leafdata;
drivers/net/ethernet/mellanox/mlx4/en_tx.c +1 -1
@@ -861,6 +861,7 @@ netdev_tx_t mlx4_en_xmit(struct sk_buffstruct mlx4_en_tx_desc *tx_desc;struct mlx4_wqe_data_seg *data;struct mlx4_en_tx_info *tx_info; +u32 __maybe_unused ring_cons;int tx_ind;int nr_txbb;int desc_size;
@@ -874,7 +875,6 @@ netdev_tx_t mlx4_en_xmit(struct sk_buffbool stop_queue;bool inline_ok;u8 data_offset; -u32 ring_cons;bool bf_ok; tx_ind =skb_get_queue_mapping (skb);
drivers/net/ethernet/micrel/ksz884x.c +1 -2
@@ -1657,8 +1657,7 @@ static inline void set_tx_len(struct ksz#define HW_DELAY (hw, reg) \ do { \ - u16 dummy; \ - dummy = readw(hw->io + reg); \ + readw(hw->io + reg); \ } while (0)/**
drivers/net/ethernet/neterion/vxge/vxge-traffic.c +11 -21
@@ -29,8 +29,6 @@*/ enum vxge_hw_status vxge_hw_vpath_intr_enable (struct __vxge_hw_vpath_handle *vp) { -u64 val64; -struct __vxge_hw_virtualpath *vpath;struct vxge_hw_vpath_reg __iomem *vp_reg;enum vxge_hw_status status =VXGE_HW_OK ;
@@ -83,7 +81,7 @@ enum vxge_hw_status vxge_hw_vpath_intr_e__vxge_hw_pio_mem_write32_upper ((u32 )VXGE_HW_INTR_MASK_ALL , &vp_reg->xgmac_vp_int_status); - val64 =readq (&vp_reg->vpath_general_int_status); +readq (&vp_reg->vpath_general_int_status);/* Mask unwanted interrupts */
@@ -156,8 +154,6 @@ exit:enum vxge_hw_status vxge_hw_vpath_intr_disable (struct __vxge_hw_vpath_handle *vp) { -u64 val64; -struct __vxge_hw_virtualpath *vpath;enum vxge_hw_status status =VXGE_HW_OK ;struct vxge_hw_vpath_reg __iomem *vp_reg;
@@ -178,8 +174,6 @@ enum vxge_hw_status vxge_hw_vpath_intr_d (u32 )VXGE_HW_INTR_MASK_ALL , &vp_reg->vpath_general_int_mask); - val64 =VXGE_HW_TIM_CLR_INT_EN_VP (1 << (16 - vpath->vp_id)); -writeq (VXGE_HW_INTR_MASK_ALL , &vp_reg->kdfcctl_errors_mask); __vxge_hw_pio_mem_write32_upper((u32)VXGE_HW_INTR_MASK_ALL,
@@ -486,9 +480,7 @@ void vxge_hw_device_unmask_all(struct __*/ void vxge_hw_device_flush_io (struct __vxge_hw_device *hldev) { -u32 val32; - - val32 =readl (&hldev->common_reg->titan_general_int_status); +readl (&hldev->common_reg->titan_general_int_status); }/**
@@ -1745,8 +1737,8 @@ void vxge_hw_fifo_txdl_free(struct __vxgenum vxge_hw_status vxge_hw_vpath_mac_addr_add (struct __vxge_hw_vpath_handle *vp, -u8 (macaddr )[ETH_ALEN ], -u8 (macaddr_mask )[ETH_ALEN ], +u8 *macaddr, +u8 *macaddr_mask,enum vxge_hw_vpath_mac_addr_add_mode duplicate_mode) {u32 i;
@@ -1808,8 +1800,8 @@ exit:enum vxge_hw_status vxge_hw_vpath_mac_addr_get (struct __vxge_hw_vpath_handle *vp, -u8 (macaddr )[ETH_ALEN ], -u8 (macaddr_mask )[ETH_ALEN ]) +u8 *macaddr, +u8 *macaddr_mask) {u32 i;u64 data1 =0ULL ;
@@ -1860,8 +1852,8 @@ exit:enum vxge_hw_status vxge_hw_vpath_mac_addr_get_next (struct __vxge_hw_vpath_handle *vp, -u8 (macaddr )[ETH_ALEN ], -u8 (macaddr_mask )[ETH_ALEN ]) +u8 *macaddr, +u8 *macaddr_mask) {u32 i;u64 data1 =0ULL ;
@@ -1913,8 +1905,8 @@ exit:enum vxge_hw_status vxge_hw_vpath_mac_addr_delete (struct __vxge_hw_vpath_handle *vp, -u8 (macaddr )[ETH_ALEN ], -u8 (macaddr_mask )[ETH_ALEN ]) +u8 *macaddr, +u8 *macaddr_mask) {u32 i;u64 data1 =0ULL ;
@@ -2404,7 +2396,6 @@ enum vxge_hw_status vxge_hw_vpath_poll_ru8 t_code;enum vxge_hw_status status =VXGE_HW_OK ;void *first_rxdh; -u64 val64 =0 ;int new_count =0 ; ring->cmpl_cnt =0 ;
@@ -2432,8 +2423,7 @@ enum vxge_hw_status vxge_hw_vpath_poll_r }writeq (VXGE_HW_PRC_RXD_DOORBELL_NEW_QW_CNT (new_count), &ring->vp_reg->prc_rxd_doorbell); - val64 = -readl (&ring->common_reg->titan_general_int_status); +readl (&ring->common_reg->titan_general_int_status); ring->doorbell_cnt =0 ; } }
drivers/net/ethernet/sfc/falcon/farch.c +11 -18
@@ -873,17 +873,12 @@ static u16 ef4_farch_handle_rx_not_ok(st {struct ef4_channel *channel =ef4_rx_queue_channel (rx_queue);struct ef4_nic *efx = rx_queue->efx; -bool rx_ev_buf_owner_id_err, rx_ev_ip_hdr_chksum_err; +bool __maybe_unused rx_ev_buf_owner_id_err, rx_ev_ip_hdr_chksum_err;bool rx_ev_tcp_udp_chksum_err, rx_ev_eth_crc_err;bool rx_ev_frm_trunc, rx_ev_drib_nib, rx_ev_tobe_disc; -bool rx_ev_other_err, rx_ev_pause_frm; -bool rx_ev_hdr_type, rx_ev_mcast_pkt; -unsigned rx_ev_pkt_type; +bool rx_ev_pause_frm; - rx_ev_hdr_type =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_HDR_TYPE ); - rx_ev_mcast_pkt =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_MCAST_PKT ); rx_ev_tobe_disc =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_TOBE_DISC ); - rx_ev_pkt_type =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_PKT_TYPE ); rx_ev_buf_owner_id_err =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_BUF_OWNER_ID_ERR ); rx_ev_ip_hdr_chksum_err = EF4_QWORD_FIELD(*event,
@@ -896,10 +891,6 @@ static u16 ef4_farch_handle_rx_not_ok(st 0 : EF4_QWORD_FIELD(*event, FSF_AA_RX_EV_DRIB_NIB)); rx_ev_pause_frm =EF4_QWORD_FIELD (*event,FSF_AZ_RX_EV_PAUSE_FRM_ERR ); -/* Every error apart from tobe_disc and pause_frm */ - rx_ev_other_err = (rx_ev_drib_nib | rx_ev_tcp_udp_chksum_err | - rx_ev_buf_owner_id_err | rx_ev_eth_crc_err | - rx_ev_frm_trunc | rx_ev_ip_hdr_chksum_err);/* Count errors that are not in MAC stats. Ignore expected * checksum errors during self-test. */
@@ -919,6 +910,13 @@ static u16 ef4_farch_handle_rx_not_ok(st* to a FIFO overflow. */ #ifdef DEBUG + { +/* Every error apart from tobe_disc and pause_frm */ + +bool rx_ev_other_err = (rx_ev_drib_nib | rx_ev_tcp_udp_chksum_err | + rx_ev_buf_owner_id_err | rx_ev_eth_crc_err | + rx_ev_frm_trunc | rx_ev_ip_hdr_chksum_err); +if (rx_ev_other_err &&net_ratelimit ()) {netif_dbg (efx, rx_err, efx->net_dev, " RX queue %d unexpected RX event "
@@ -935,6 +933,7 @@ static u16 ef4_farch_handle_rx_not_ok(st rx_ev_tobe_disc ?" [TOBE_DISC]" :"" , rx_ev_pause_frm ? " [PAUSE]" : ""); } + }#endif /* The frame must be discarded if any of these are true. */
@@ -1646,15 +1645,11 @@ void ef4_farch_rx_push_indir_table(struc*/ void ef4_farch_dimension_resources (struct ef4_nic *efx,unsigned sram_lim_qw) { -unsigned vi_count, buftbl_min; +unsigned vi_count;/* Account for the buffer table entries backing the datapath channels * and the descriptor caches for those channels. */ - buftbl_min = ((efx->n_rx_channels *EF4_MAX_DMAQ_SIZE + - efx->n_tx_channels *EF4_TXQ_TYPES *EF4_MAX_DMAQ_SIZE + - efx->n_channels *EF4_MAX_EVQ_SIZE ) - *sizeof (ef4_qword_t) /EF4_BUF_SIZE ); vi_count =max (efx->n_channels, efx->n_tx_channels *EF4_TXQ_TYPES ); efx->tx_dc_base = sram_lim_qw - vi_count *TX_DC_ENTRIES ;
@@ -2535,7 +2530,6 @@ int ef4_farch_filter_remove_safe(structenum ef4_farch_filter_table_id table_id;struct ef4_farch_filter_table *table;unsigned int filter_idx; -struct ef4_farch_filter_spec *spec;int rc; table_id =ef4_farch_filter_id_table_id (filter_id);
@@ -2546,7 +2540,6 @@ int ef4_farch_filter_remove_safe(struct filter_idx =ef4_farch_filter_id_index (filter_id);if (filter_idx >= table->size)return -ENOENT ; - spec = &table->spec[filter_idx];spin_lock_bh (&efx->filter_lock); rc =ef4_farch_filter_remove (efx, table, filter_idx, priority);
drivers/net/ethernet/sis/sis900.c +2 -3
@@ -783,10 +783,9 @@ static u16 sis900_default_phy(struct netstatic void sis900_set_capability (struct net_device *net_dev,struct mii_phy *phy) {u16 cap; -u16 status; - status =mdio_read (net_dev, phy->phy_addr,MII_STATUS ); - status =mdio_read (net_dev, phy->phy_addr,MII_STATUS ); +mdio_read (net_dev, phy->phy_addr,MII_STATUS ); +mdio_read (net_dev, phy->phy_addr,MII_STATUS ); cap =MII_NWAY_CSMA_CD | ((phy->status & MII_STAT_CAN_TX_FDX)? MII_NWAY_TX_FDX:0) |
drivers/net/ethernet/synopsys/dwc-xlgmac-common.c +1 -1
@@ -523,7 +523,7 @@ void xlgmac_get_all_hw_features(struct xvoid xlgmac_print_all_hw_features (struct xlgmac_pdata *pdata) { -char *str =NULL ; +char __maybe_unused *str =NULL ;XLGMAC_PR ("\n" );XLGMAC_PR ("=====================================================\n" );
drivers/net/ethernet/ti/davinci_emac.c +2 -3
@@ -1240,7 +1240,7 @@ static int emac_poll(struct napi_structstruct net_device *ndev = priv->ndev;struct device *emac_dev = &ndev->dev;u32 status =0 ; -u32 num_tx_pkts =0 , num_rx_pkts =0 ; +u32 num_rx_pkts =0 ;/* Check interrupt vectors and call packet processing */ status =emac_read (EMAC_MACINVECTOR );
@@ -1251,8 +1251,7 @@ static int emac_poll(struct napi_struct mask =EMAC_DM646X_MAC_IN_VECTOR_TX_INT_VEC ;if (status & mask) { - num_tx_pkts =cpdma_chan_process (priv->txchan, -EMAC_DEF_TX_MAX_SERVICE ); +cpdma_chan_process (priv->txchan,EMAC_DEF_TX_MAX_SERVICE ); }/* TX processing */ mask =EMAC_DM644X_MAC_IN_VECTOR_RX_INT_VEC ;
drivers/net/ethernet/ti/tlan.c +1 -3
@@ -672,7 +672,6 @@ module_exit(tlan_exit);static void __init tlan_eisa_probe (void ) {long ioaddr; -int rc = -ENODEV ;int irq;u16 device_id;
@@ -737,8 +736,7 @@ static void __init tlan_eisa_probe(void/* Setup the newly found eisa adapter */ - rc =tlan_probe1 (NULL , ioaddr, irq, -12 ,NULL ); +tlan_probe1 (NULL , ioaddr, irq,12 ,NULL );continue ; out:
drivers/net/ethernet/via/via-velocity.c +0 -13
@@ -875,26 +875,13 @@ static u32 check_connection_type(struct*/ static int velocity_set_media_mode (struct velocity_info *vptr,u32 mii_status) { -u32 curr_status;struct mac_regs __iomem *regs = vptr->mac_regs; vptr->mii_status =mii_check_media_mode (vptr->mac_regs); - curr_status = vptr->mii_status & (~VELOCITY_LINK_FAIL );/* Set mii link status */ set_mii_flow_control (vptr); -/* -Check if new status is consistent with current status -if (((mii_status & curr_status) & VELOCITY_AUTONEG_ENABLE) || -(mii_status==curr_status)) { -vptr->mii_status=mii_check_media_mode(vptr->mac_regs); -vptr->mii_status=check_connection_type(vptr->mac_regs); -VELOCITY_PRT(MSG_LEVEL_INFO, "Velocity link no change\n"); -return 0; -} -*/ -if (PHYID_GET_PHY_ID (vptr->phy_id) ==PHYID_CICADA_CS8201 )MII_REG_BITS_ON (AUXCR_MDPPS ,MII_NCONFIG , vptr->mac_regs);
Greg Kroah-Hartman
maintainerPATCH 79/79 usb: core: reduce power-on-good delay time of root hub
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 90d28fb53d4a51299ff324dede015d5cb11b88a2 upstream.
Return the exactly delay time given by root hub descriptor, this helps to reduce resume time etc.
Due to the root hub descriptor is usually provided by the host controller driver, if there is compatibility for a root hub, we can fix it easily without affect other root hub
--- drivers/usb/core/hub.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/core/hub.h +4 -2
@@ -152,8 +152,10 @@ static inline unsigned hub_power_on_good {unsigned delay = hub->descriptor->bPwrOn2PwrGood *2 ; -/* Wait at least 100 msec for power to become stable */ -return max (delay,100U ); +if (!hub->hdev->parent)/* root hub */ +return delay; +else /* Wait at least 100 msec for power to become stable */ +return max (delay,100U ); } static inline int hub_port_debounce_be_connected(struct usb_hub *hub,
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.235 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 02 Jun 2021 13:06:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.235-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
This set of results are from 4.14.235-rc1.
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.14.235-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-4.14.y
* git commit: 506e0ba115126ff217295dca5197f9688c6f07c0
* git describe: v4.14.234-80-g506e0ba11512
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.234-80-g506e0ba11512
## No regressions (compared to v4.14.233-38-g535f9ea88cc8)
## Fixes (compared to v4.14.233-38-g535f9ea88cc8)
* ltp-mm-tests
- ksm03
- ksm03_1
NOTE: The LTP test suite upgraded to latest release version LTP 20210524.
## Test result summary
total: 62263, pass: 49714, fail: 1558, skip: 10203, xfail: 788,
## Build Summary
* arm: 97 total, 97 passed, 0 failed
* arm64: 24 total, 24 passed, 0 failed
* dragonboard-410c: 1 total, 1 passed, 0 failed
* hi6220-hikey: 1 total, 1 passed, 0 failed
* i386: 14 total, 14 passed, 0 failed
* juno-r2: 1 total, 1 passed, 0 failed
* mips: 36 total, 36 passed, 0 failed
* sparc: 9 total, 9 passed, 0 failed
* x15: 1 total, 1 passed, 0 failed
* x86: 1 total, 1 passed, 0 failed
* x86_64: 14 total, 14 passed, 0 failed
## Test suites summary
* fwts
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kvm-unit-tests
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* network-basic-tests
* packetdrill
* perf
* rcutorture
* ssuite
* v4l2-compliance
--
Naresh Kamboju
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.235 release. There are 79 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 02 Jun 2021 13:06:20 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.235-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Tested on x86 for 4.14.235-rc1,
Kernel repo:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-4.14.y
Version: 4.14.235-rc1
Commit: 709fde45859bbcf6ad058f7f29761df9adfc26b4
Compiler: gcc version 7.3.0 (GCC)
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 8835
passed: 8835
failed: 0
timeout: 0
--------------------------------------------------------------------