4.14.317-rc1 review
Subsystems (4)
Greg Kroah-Hartman
maintainercover 4.14.317-rc1 review
This is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.317-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.317-rc1
Ping-Ke Shih <[email protected]>
wifi: rtlwifi: 8192de: correct checking of IQK reload
Al Viro <[email protected]>
Fix double fget() in vhost_net_set_backend()
Tudor Ambarus <[email protected]>
net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
Alexander Bersenev <[email protected]>
cdc_ncm: Fix the build warning
Alexander Bersenev <[email protected]>
cdc_ncm: Implement the 32-bit version of NCM Transfer Block
Ben Hutchings <[email protected]>
scsi: dpt_i2o: Do not process completions with invalid addresses
Ben Hutchings <[email protected]>
scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
Helge Deller <[email protected]>
fbcon: Fix null-ptr-deref in soft_cursor
Theodore Ts'o <[email protected]>
ext4: add lockdep annotations for i_data_sem for ea_inode's
Paul Moore <[email protected]>
selinux: don't use make's grouped targets feature yet
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
Deren Wu <[email protected]>
mmc: vub300: fix invalid response handling
Nathan Chancellor <[email protected]>
regulator: da905{2,5}: Remove unnecessary array check
Jakub Kicinski <[email protected]>
wifi: rtlwifi: remove always-true condition pointed out by GCC 12
Nathan Chancellor <[email protected]>
lib/dynamic_debug.c: use address-of operator on section symbols
Nathan Chancellor <[email protected]>
kernel/extable.c: use address-of operator on section symbols
Martin Liška <[email protected]>
eth: sun: cassini: remove dead code
Linus Torvalds <[email protected]>
gcc-12: disable '-Wdangling-pointer' warning for now
Adam Borowski <[email protected]>
ACPI: thermal: drop an always true check
Kees Cook <[email protected]>
x86/boot: Wrap literal addresses in absolute_pointer()
Damien Le Moal <[email protected]>
ata: libata-scsi: Use correct device no in ata_find_dev()
Bart Van Assche <[email protected]>
scsi: stex: Fix gcc 13 warnings
Uttkarsh Aggarwal <[email protected]>
usb: gadget: f_fs: Add unbind event before functionfs_unbind
Sebastian Krzyszkowiak <[email protected]>
net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
Marek Vasut <[email protected]>
iio: dac: mcp4725: Fix i2c_master_send() return value handling
Nikita Zhandarovich <[email protected]>
HID: wacom: avoid integer overflow in wacom_intuos_inout()
Jiakai Luo <[email protected]>
iio: adc: mxs-lradc: fix the order of two cleanup operations
Dan Carpenter <[email protected]>
mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
Arnd Bergmann <[email protected]>
atm: hide unused procfs functions
Arnd Bergmann <[email protected]>
ALSA: oss: avoid missing-prototype warnings
Tom Rix <[email protected]>
netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
Arnd Bergmann <[email protected]>
wifi: b43: fix incorrect __packed annotation
Wenchao Hao <[email protected]>
scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
Yun Lu <[email protected]>
wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
Hyunwoo Kim <[email protected]>
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
Takashi Iwai <[email protected]>
media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
Hyunwoo Kim <[email protected]>
media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
Wei Chen <[email protected]>
media: netup_unidvb: fix irq init by register it at the end of probe
Wei Chen <[email protected]>
media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
Wei Chen <[email protected]>
media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
Zhang Shurong <[email protected]>
media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
Wei Chen <[email protected]>
media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
Wei Chen <[email protected]>
media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
Wei Chen <[email protected]>
media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
Paweł Anikiel <[email protected]>
ASoC: ssm2602: Add workaround for playback distortions
Maxim Kochetkov <[email protected]>
ASoC: dwc: limit the number of overrun messages
Ivan Orlov <[email protected]>
nbd: Fix debugfs_create_dir error checking
Helge Deller <[email protected]>
fbdev: stifb: Fix info entry in sti_struct on error path
Helge Deller <[email protected]>
fbdev: modedb: Add 1920x1080 at 60 Hz video mode
Haibo Li <[email protected]>
ARM: 9295/1: unwind:fix unwind abort for uleb128 case
Lee Jones <[email protected]>
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
Andreas Svensson <[email protected]>
net: dsa: mv88e6xxx: Increase wait after reset deactivation
Vladislav Efanov <[email protected]>
udp6: Fix race condition in udp6_sendmsg & connect
Cambda Zhu <[email protected]>
tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
Eric Dumazet <[email protected]>
af_packet: do not use READ_ONCE() in packet_bind()
Kuniyuki Iwashima <[email protected]>
af_packet: Fix data-races of pkt_sk(sk)->num.
Eric Dumazet <[email protected]>
netrom: fix info-leak in nr_write_internal()
Randy Dunlap <[email protected]>
dmaengine: pl330: rename _start to prevent build error
Ruihan Li <[email protected]>
bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
Cezary Rojewski <[email protected]>
ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
Hans de Goede <[email protected]>
power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
-------------
Diffstat:
Makefile | 8 +- arch/arm/kernel/unwind.c | 25 +- arch/x86/boot/boot.h | 36 +- arch/x86/boot/main.c | 2 +- drivers/acpi/thermal.c | 2 - drivers/ata/libata-scsi.c | 34 +- drivers/block/nbd.c | 4 +- drivers/dma/pl330.c | 8 +- drivers/hid/wacom_wac.c | 2 +- drivers/iio/adc/mxs-lradc-adc.c | 10 +- drivers/iio/dac/mcp4725.c | 16 +- drivers/mailbox/mailbox-test.c | 13 +- drivers/media/dvb-core/dvb_ca_en50221.c | 37 +- drivers/media/dvb-core/dvb_frontend.c | 16 +- drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 17 +- drivers/media/usb/dvb-usb-v2/ce6230.c | 8 + drivers/media/usb/dvb-usb-v2/ec168.c | 12 + drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 20 + drivers/media/usb/dvb-usb/az6027.c | 12 + drivers/media/usb/dvb-usb/digitv.c | 4 + drivers/media/usb/dvb-usb/dw2102.c | 2 +- drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +- drivers/mmc/host/vub300.c | 3 + drivers/net/dsa/mv88e6xxx/chip.c | 2 +- drivers/net/ethernet/sun/cassini.c | 4 +- drivers/net/usb/cdc_ncm.c | 435 ++++++++++++++++----- drivers/net/usb/huawei_cdc_ncm.c | 8 +- drivers/net/usb/qmi_wwan.c | 2 +- drivers/net/wireless/broadcom/b43/b43.h | 2 +- .../net/wireless/broadcom/b43legacy/b43legacy.h | 2 +- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 + .../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 +- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 10 +- drivers/power/supply/bq27xxx_battery.c | 4 +- drivers/regulator/da9052-regulator.c | 2 +- drivers/regulator/da9055-regulator.c | 2 +- drivers/scsi/Kconfig | 2 +- drivers/scsi/dpt_i2o.c | 262 +------------ drivers/scsi/dpti.h | 1 - drivers/scsi/scsi_lib.c | 2 + drivers/scsi/stex.c | 4 + drivers/tty/serial/fsl_lpuart.c | 44 ++- drivers/usb/gadget/function/f_fs.c | 2 +- drivers/vhost/net.c | 15 +- drivers/video/fbdev/core/bitblit.c | 3 + drivers/video/fbdev/core/modedb.c | 5 + drivers/video/fbdev/stifb.c | 1 + fs/ext4/ext4.h | 2 + fs/ext4/xattr.c | 4 + include/linux/usb/cdc_ncm.h | 15 +- kernel/extable.c | 3 +- lib/dynamic_debug.c | 2 +- net/atm/resources.c | 2 + net/bluetooth/hci_sock.c | 28 ++ net/core/sock.c | 2 +- net/ipv4/tcp.c | 3 +- net/netfilter/nf_conntrack_netlink.c | 4 + net/netrom/nr_subr.c | 7 +- net/packet/af_packet.c | 8 +- net/packet/diag.c | 2 +- security/selinux/Makefile | 6 +- sound/core/oss/pcm_plugin.h | 16 +- sound/soc/codecs/ssm2602.c | 15 + sound/soc/dwc/dwc-i2s.c | 4 +- sound/soc/intel/skylake/skl-tplg-interface.h | 3 +- 65 files changed, 748 insertions(+), 491 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/61 power: supply: bq27xxx: After charger plug in/out wait 0.5s for things to stabilize
From: Hans de Goede <[email protected]>
[ Upstream commit 59a99cd462fbdf71f4e845e09f37783035088b4f ]
bq27xxx_external_power_changed() gets called when the charger is plugged in or out. Rather then immediately scheduling an update wait 0.5 seconds for things to stabilize, so that e.g. the (dis)charge current is stable when bq27xxx_battery_update() runs.
--- drivers/power/supply/bq27xxx_battery.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/bq27xxx_battery.c +2 -2
@@ -1817,8 +1817,8 @@ static void bq27xxx_external_power_changed(struct power_supply *psy) {struct bq27xxx_device_info *di =power_supply_get_drvdata (psy); -cancel_delayed_work_sync (&di->work); -schedule_delayed_work (&di->work,0 ); +/* After charger plug in/out wait 0.5s for things to stabilize */ +mod_delayed_work (system_wq, &di->work,HZ /2 ); }int bq27xxx_battery_setup (struct bq27xxx_device_info *di)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/61 ASoC: Intel: Skylake: Fix declaration of enum skl_ch_cfg
In reply to Greg Kroah-HartmanFrom: Cezary Rojewski <[email protected]>
[ Upstream commit 95109657471311601b98e71f03d0244f48dc61bb ]
Constant 'C4_CHANNEL' does not exist on the firmware side. Value 0xC is reserved for 'C7_1' instead.
--- sound/soc/intel/skylake/skl-tplg-interface.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/soc/intel/skylake/skl-tplg-interface.h +2 -1
@@ -71,7 +71,8 @@ enum skl_ch_cfg {SKL_CH_CFG_DUAL_MONO =9 ,SKL_CH_CFG_I2S_DUAL_STEREO_0 =10 ,SKL_CH_CFG_I2S_DUAL_STEREO_1 =11 , -SKL_CH_CFG_4_CHANNEL =12 , +SKL_CH_CFG_7_1 =12 , +SKL_CH_CFG_4_CHANNEL =SKL_CH_CFG_7_1 , SKL_CH_CFG_INVALID };
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/61 bluetooth: Add cmd validity checks at the start of hci_sock_ioctl()
In reply to Greg Kroah-HartmanFrom: Ruihan Li <[email protected]>
commit 000c2fa2c144c499c881a101819cf1936a1f7cf2 upstream.
Previously, channel open messages were always sent to monitors on the first ioctl() call for unbound HCI sockets, even if the command and arguments were completely invalid. This can leave an exploitable hole with the abuse of invalid ioctl calls.
This commit hardens the ioctl processing logic by first checking if the command is valid, and immediately returning with an ENOIOCTLCMD error code if it is not. This ensures that ioctl calls with invalid commands are free of side effects, and increases the difficulty of further exploitation by forcing exploitation to find a way to pass a valid command first.
--- net/bluetooth/hci_sock.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
net/bluetooth/hci_sock.c +28 -0
@@ -968,6 +968,34 @@ static int hci_sock_ioctl(struct socketBT_DBG ("cmd %x arg %lx" , cmd, arg); +/* Make sure the cmd is valid before doing anything */ +switch (cmd) { +case HCIGETDEVLIST : +case HCIGETDEVINFO : +case HCIGETCONNLIST : +case HCIDEVUP : +case HCIDEVDOWN : +case HCIDEVRESET : +case HCIDEVRESTAT : +case HCISETSCAN : +case HCISETAUTH : +case HCISETENCRYPT : +case HCISETPTYPE : +case HCISETLINKPOL : +case HCISETLINKMODE : +case HCISETACLMTU : +case HCISETSCOMTU : +case HCIINQUIRY : +case HCISETRAW : +case HCIGETCONNINFO : +case HCIGETAUTHINFO : +case HCIBLOCKADDR : +case HCIUNBLOCKADDR : +break ; +default : +return -ENOIOCTLCMD ; + } +lock_sock (sk);if (hci_pi (sk)->channel !=HCI_CHANNEL_RAW ) {
Greg Kroah-Hartman
maintainerPATCH 4/61 dmaengine: pl330: rename _start to prevent build error
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit a1a5f2c887252dec161c1e12e04303ca9ba56fa9 ]
"_start" is used in several arches and proably should be reserved for ARCH usage. Using it in a driver for a private symbol can cause a build error when it conflicts with ARCH usage of the same symbol.
Therefore rename pl330's "_start" to "pl330_start_thread" so that there is no conflict and no build error.
drivers/dma/pl330.c:1053:13: error: '_start' redeclared as different kind of symbol
1053 | static bool _start(struct pl330_thread *thrd)
| ^~~~~~
In file included from ../include/linux/interrupt.h:21,
from ../drivers/dma/pl330.c:18:
arch/riscv/include/asm/sections.h:11:13: note: previous declaration of '_start' with type 'char[]'
11 | extern char _start[];
| ^~~~~~--- drivers/dma/pl330.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/dma/pl330.c +4 -4
@@ -1041,7 +1041,7 @@ static bool _trigger(struct pl330_thread *thrd)return true; } -static bool _start (struct pl330_thread *thrd) +static bool pl330_start_thread (struct pl330_thread *thrd) {switch (_state (thrd)) {case PL330_STATE_FAULT_COMPLETING :
@@ -1584,7 +1584,7 @@ static int pl330_update(struct pl330_dmac *pl330) thrd->req_running =-1 ;/* Get going again ASAP */ -_start (thrd); +pl330_start_thread (thrd);/* For now, just make a list of callbacks to be done */ list_add_tail (&descdone->rqd, &pl330->req_done);
@@ -1974,7 +1974,7 @@ static void pl330_tasklet(unsigned long data) }else {/* Make sure the PL330 Channel thread is active */ spin_lock (&pch->thread->dmac->lock); -_start (pch->thread); +pl330_start_thread (pch->thread);spin_unlock (&pch->thread->dmac->lock); }
@@ -1992,7 +1992,7 @@ static void pl330_tasklet(unsigned long data)if (power_down) { pch->active = true;spin_lock (&pch->thread->dmac->lock); -_start (pch->thread); +pl330_start_thread (pch->thread);spin_unlock (&pch->thread->dmac->lock); power_down = false; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/61 netrom: fix info-leak in nr_write_internal()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 31642e7089df8fd3f54ca7843f7ee2952978cad1 ]
Simon Kapadia reported the following issue:
<quote>
The Online Amateur Radio Community (OARC) has recently been experimenting with building a nationwide packet network in the UK.
As part of our experimentation, we have been testing out packet on 300bps HF, and playing with net/rom. For HF packet at this baud rate you really need to make sure that your MTU is relatively low; AX.25 suggests a PACLEN of 60, and a net/rom PACLEN of 40 to go with that.
However the Linux net/rom support didn't work with a low PACLEN;
the mkiss module would truncate packets if you set the PACLEN below about 200 or so, e.g.:
Apr 19 14:00:51 radio kernel: [12985.747310] mkiss: ax1: truncating oversized transmit packet!
This didn't make any sense to me (if the packets are smaller why would they be truncated?) so I started investigating.
I looked at the packets using ethereal, and found that many were just huge compared to what I would expect.
A simple net/rom connection request packet had the request and then a bunch of what appeared to be random data following it:
</quote>
Simon provided a patch that I slightly revised:
Not only we must not use skb_tailroom(), we also do not want to count NR_NETWORK_LEN twice.
--- net/netrom/nr_subr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/netrom/nr_subr.c +4 -3
@@ -126,7 +126,7 @@ void nr_write_internal(struct sock *sk, int frametype)unsigned char *dptr;int len, timeout; - len =NR_NETWORK_LEN +NR_TRANSPORT_LEN ; + len =NR_TRANSPORT_LEN ;switch (frametype &0x0F ) {case NR_CONNREQ :
@@ -144,7 +144,8 @@ void nr_write_internal(struct sock *sk, int frametype)return ; } -if ((skb =alloc_skb (len,GFP_ATOMIC )) ==NULL ) + skb =alloc_skb (NR_NETWORK_LEN + len,GFP_ATOMIC ); +if (!skb)return ;/*
@@ -152,7 +153,7 @@ void nr_write_internal(struct sock *sk, int frametype)*/ skb_reserve (skb,NR_NETWORK_LEN ); - dptr =skb_put (skb,skb_tailroom (skb)); + dptr =skb_put (skb, len);switch (frametype &0x0F ) {case NR_CONNREQ :
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/61 af_packet: Fix data-races of pkt_sk(sk)->num.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 822b5a1c17df7e338b9f05d1cfe5764e37c7f74f ]
syzkaller found a data race of pkt_sk(sk)->num.
The value is changed under lock_sock() and po->bind_lock, so we need READ_ONCE() to access pkt_sk(sk)->num without these locks in packet_bind_spkt(), packet_bind(), and sk_diag_fill().
Note that WRITE_ONCE() is already added by commit c7d2ef5dd4b0 ("net/packet: annotate accesses to po->bind").
BUG: KCSAN: data-race in packet_bind / packet_do_bind
write (marked) to 0xffff88802ffd1cee of 2 bytes by task 7322 on cpu 0:
packet_do_bind+0x446/0x640 net/packet/af_packet.c:3236 packet_bind+0x99/0xe0 net/packet/af_packet.c:3321 __sys_bind+0x19b/0x1e0 net/socket.c:1803 __do_sys_bind net/socket.c:1814 [inline] __se_sys_bind net/socket.c:1812 [inline] __x64_sys_bind+0x40/0x50 net/socket.c:1812 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffff88802ffd1cee of 2 bytes by task 7318 on cpu 1:
packet_bind+0xbf/0xe0 net/packet/af_packet.c:3322 __sys_bind+0x19b/0x1e0 net/socket.c:1803 __do_sys_bind net/socket.c:1814 [inline] __se_sys_bind net/socket.c:1812 [inline] __x64_sys_bind+0x40/0x50 net/socket.c:1812 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x0300 -> 0x0000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7318 Comm: syz-executor.4 Not tainted 6.3.0-13380-g7fddb5b5300c #4 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
--- net/packet/af_packet.c | 4 ++-- net/packet/diag.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
net/packet/af_packet.c +2 -2
@@ -3255,7 +3255,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,memcpy (name, uaddr->sa_data,sizeof (uaddr->sa_data)); name[sizeof (uaddr->sa_data)] =0 ; -return packet_do_bind (sk, name,0 ,pkt_sk (sk)->num); +return packet_do_bind (sk, name,0 ,READ_ONCE (pkt_sk (sk)->num)); }static int packet_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len)
@@ -3273,7 +3273,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_lenreturn -EINVAL ;return packet_do_bind (sk,NULL , sll->sll_ifindex, - sll->sll_protocol ? :pkt_sk (sk)->num); + sll->sll_protocol ? :READ_ONCE (pkt_sk (sk)->num)); }static struct proto packet_proto = {
net/packet/diag.c +1 -1
@@ -142,7 +142,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, rp =nlmsg_data (nlh); rp->pdiag_family =AF_PACKET ; rp->pdiag_type = sk->sk_type; - rp->pdiag_num =ntohs (po->num); + rp->pdiag_num =ntohs (READ_ONCE (po->num)); rp->pdiag_ino = sk_ino;sock_diag_save_cookie (sk, rp->pdiag_cookie);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/61 af_packet: do not use READ_ONCE() in packet_bind()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 6ffc57ea004234d9373c57b204fd10370a69f392 ]
A recent patch added READ_ONCE() in packet_bind() and packet_bind_spkt()
This is better handled by reading pkt_sk(sk)->num later in packet_do_bind() while appropriate lock is held.
READ_ONCE() in writers are often an evidence of something being wrong.
--- net/packet/af_packet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/packet/af_packet.c +5 -3
@@ -3153,6 +3153,9 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,lock_sock (sk);spin_lock (&po->bind_lock); +if (!proto) + proto = po->num; +rcu_read_lock ();if (po->fanout) {
@@ -3255,7 +3258,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,memcpy (name, uaddr->sa_data,sizeof (uaddr->sa_data)); name[sizeof (uaddr->sa_data)] =0 ; -return packet_do_bind (sk, name,0 ,READ_ONCE (pkt_sk (sk)->num)); +return packet_do_bind (sk, name,0 ,0 ); }static int packet_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len)
@@ -3272,8 +3275,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_lenif (sll->sll_family !=AF_PACKET )return -EINVAL ; -return packet_do_bind (sk,NULL , sll->sll_ifindex, - sll->sll_protocol ? :READ_ONCE (pkt_sk (sk)->num)); +return packet_do_bind (sk,NULL , sll->sll_ifindex, sll->sll_protocol); }static struct proto packet_proto = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/61 tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
In reply to Greg Kroah-HartmanFrom: Cambda Zhu <[email protected]>
[ Upstream commit 34dfde4ad87b84d21278a7e19d92b5b2c68e6c4d ]
This patch replaces the tp->mss_cache check in getting TCP_MAXSEG with tp->rx_opt.user_mss check for CLOSE/LISTEN sock. Since tp->mss_cache is initialized with TCP_MSS_DEFAULT, checking if it's zero is probably a bug.
With this change, getting TCP_MAXSEG before connecting will return default MSS normally, and return user_mss if user_mss is set.
--- net/ipv4/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +2 -1
@@ -3037,7 +3037,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,switch (optname) {case TCP_MAXSEG : val = tp->mss_cache; -if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN ))) +if (tp->rx_opt.user_mss && + ((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN ))) val = tp->rx_opt.user_mss;if (tp->repair) val = tp->rx_opt.mss_clamp;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/61 udp6: Fix race condition in udp6_sendmsg & connect
In reply to Greg Kroah-HartmanFrom: Vladislav Efanov <[email protected]>
[ Upstream commit 448a5ce1120c5bdbce1f1ccdabcd31c7d029f328 ]
Syzkaller got the following report:
BUG: KASAN: use-after-free in sk_setup_caps+0x621/0x690 net/core/sock.c:2018 Read of size 8 at addr ffff888027f82780 by task syz-executor276/3255
The function sk_setup_caps (called by ip6_sk_dst_store_flow-> ip6_dst_store) referenced already freed memory as this memory was freed by parallel task in udpv6_sendmsg->ip6_sk_dst_lookup_flow-> sk_dst_check.
task1 (connect) task2 (udp6_sendmsg)
sk_setup_caps->sk_dst_set |
| sk_dst_check->
| sk_dst_set
| dst_release
sk_setup_caps references |
to already freed dst_entry|
The reason for this race condition is: sk_setup_caps() keeps using the dst after transferring the ownership to the dst cache.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
--- net/core/sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/sock.c +1 -1
@@ -1788,7 +1788,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) {u32 max_segs =1 ; -sk_dst_set (sk, dst); sk->sk_route_caps = dst->dev->features;if (sk->sk_route_caps &NETIF_F_GSO ) sk->sk_route_caps |=NETIF_F_GSO_SOFTWARE ;
@@ -1803,6 +1802,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst) } } sk->sk_gso_max_segs = max_segs; +sk_dst_set (sk, dst); }EXPORT_SYMBOL_GPL (sk_setup_caps);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/61 net: dsa: mv88e6xxx: Increase wait after reset deactivation
In reply to Greg Kroah-HartmanFrom: Andreas Svensson <[email protected]>
[ Upstream commit 3c27f3d53d588618d81d30d6712459a3cc9489b8 ]
A switch held in reset by default needs to wait longer until we can reliably detect it.
An issue was observed when testing on the Marvell 88E6393X (Link Street). The driver failed to detect the switch on some upstarts. Increasing the wait time after reset deactivation solves this issue.
The updated wait time is now also the same as the wait time in the mv88e6xxx_hardware_reset function.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +1 -1
@@ -4060,7 +4060,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev) } }if (chip->reset) -usleep_range (1000 ,2000 ); +usleep_range (10000 ,20000 ); err =mv88e6xxx_mdios_register (chip, np);if (err)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/61 mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
[ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ]
If a user can make copy_from_user() fail, there is a potential for UAF/DF due to a lack of locking around the allocation, use and freeing of the data buffers.
This issue is not theoretical. I managed to author a POC for it:
BUG: KASAN: double-free in kfree+0x5c/0xac
Free of addr ffff29280be5de00 by task poc/356
CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x40
dump_stack_lvl+0x64/0x80
print_report+0x188/0x48c
kasan_report_invalid_free+0xa0/0xc0
____kasan_slab_free+0x174/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Allocated by task 356:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xb8/0xc0
kmalloc_trace+0x58/0x70
mbox_test_message_write+0x6c/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Freed by task 357:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
____kasan_slab_free+0x13c/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190--- drivers/mailbox/mailbox-test.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/mailbox/mailbox-test.c +7 -0
@@ -16,6 +16,7 @@#include <linux/kernel.h> #include <linux/mailbox_client.h> #include <linux/module.h> +#include <linux/mutex.h> #include <linux/of.h> #include <linux/platform_device.h> #include <linux/poll.h>
@@ -43,6 +44,7 @@ struct mbox_test_device {char *signal;char *message;spinlock_t lock; +struct mutex mutex;wait_queue_head_t waitq;struct fasync_struct *async_queue; };
@@ -114,6 +116,8 @@ static ssize_t mbox_test_message_write(struct file *filp,return -EINVAL ; } +mutex_lock (&tdev->mutex); + tdev->message =kzalloc (MBOX_MAX_MSG_LEN ,GFP_KERNEL );if (!tdev->message)return -ENOMEM ;
@@ -148,6 +152,8 @@ static ssize_t mbox_test_message_write(struct file *filp,kfree (tdev->message); tdev->signal =NULL ; +mutex_unlock (&tdev->mutex); +return ret <0 ? ret : count; }
@@ -396,6 +402,7 @@ static int mbox_test_probe(struct platform_device *pdev)platform_set_drvdata (pdev, tdev);spin_lock_init (&tdev->lock); +mutex_init (&tdev->mutex);if (tdev->rx_channel) { tdev->rx_buffer = devm_kzalloc(&pdev->dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/61 ARM: 9295/1: unwind:fix unwind abort for uleb128 case
In reply to Greg Kroah-HartmanFrom: Haibo Li <[email protected]>
[ Upstream commit fa3eeb638de0c1a9d2d860e5b48259facdd65176 ]
When unwind instruction is 0xb2,the subsequent instructions are uleb128 bytes.
For now,it uses only the first uleb128 byte in code.
For vsp increments of 0x204~0x400,use one uleb128 byte like below:0xc06a00e4 <unwind_test_work>: 0x80b27fac
Compact model index: 0
0xb2 0x7f vsp = vsp + 1024
0xac pop {r4, r5, r6, r7, r8, r14}
For vsp increments larger than 0x400,use two uleb128 bytes like below:0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
Compact model index: 1
0xb2 0x81 0x01 vsp = vsp + 1032
0xac pop {r4, r5, r6, r7, r8, r14}
The unwind works well since the decoded uleb128 byte is also 0x81.
For vsp increments larger than 0x600,use two uleb128 bytes like below:0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
Compact model index: 1
0xb2 0x81 0x02 vsp = vsp + 1544
0xac pop {r4, r5, r6, r7, r8, r14}
In this case,the decoded uleb128 result is 0x101(vsp=0x204+(0x101<<2)). While the uleb128 used in code is 0x81(vsp=0x204+(0x81<<2)). The unwind aborts at this frame since it gets incorrect vsp.
To fix this,add uleb128 decode to cover all the above case.
--- arch/arm/kernel/unwind.c | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
arch/arm/kernel/unwind.c +24 -1
@@ -313,6 +313,29 @@ static int unwind_exec_pop_subset_r0_to_r3(struct unwind_ctrl_block *ctrl,return URC_OK ; } +static unsigned long unwind_decode_uleb128 (struct unwind_ctrl_block *ctrl) +{ +unsigned long bytes =0 ; +unsigned long insn; +unsigned long result =0 ; + +/* +* unwind_get_byte() will advance `ctrl` one instruction at a time, so +* loop until we get an instruction byte where bit 7 is not set. +* +* Note: This decodes a maximum of 4 bytes to output 28 bits data where +* max is 0xfffffff: that will cover a vsp increment of 1073742336, hence +* it is sufficient for unwinding the stack. +*/ +do { + insn =unwind_get_byte (ctrl); + result |= (insn &0x7f ) << (bytes *7 ); + bytes++; + }while (!!(insn &0x80 ) && (bytes !=sizeof (result))); + +return result; +} +/* * Execute the current unwind instruction. */
@@ -366,7 +389,7 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl)if (ret) goto error; }else if (insn ==0xb2 ) { -unsigned long uleb128 =unwind_get_byte (ctrl); +unsigned long uleb128 =unwind_decode_uleb128 (ctrl); ctrl->vrs[SP ] +=0x204 + (uleb128 <<2 ); }else {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/61 fbdev: modedb: Add 1920x1080 at 60 Hz video mode
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit c8902258b2b8ecaa1b8d88c312853c5b14c2553d ]
Add typical resolution for Full-HD monitors.
--- drivers/video/fbdev/core/modedb.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/video/fbdev/core/modedb.c +5 -0
@@ -257,6 +257,11 @@ static const struct fb_videomode modedb[] = { {NULL ,72 ,480 ,300 ,33386 ,40 ,24 ,11 ,19 ,80 ,3 ,0 , FB_VMODE_DOUBLE }, +/* 1920x1080 @ 60 Hz, 67.3 kHz hsync */ + { NULL, 60, 1920, 1080, 6734, 148, 88, 36, 4, 44, 5, 0, +FB_SYNC_HOR_HIGH_ACT |FB_SYNC_VERT_HIGH_ACT , + FB_VMODE_NONINTERLACED }, +/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */ { NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3, FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/61 fbdev: stifb: Fix info entry in sti_struct on error path
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
[ Upstream commit 0bdf1ad8d10bd4e50a8b1a2c53d15984165f7fea ]
Minor fix to reset the info field to NULL in case of error.
--- drivers/video/fbdev/stifb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/stifb.c +1 -0
@@ -1373,6 +1373,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)iounmap (info->screen_base); out_err0:kfree (fb); + sti->info =NULL ;return -ENXIO ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/61 nbd: Fix debugfs_create_dir error checking
In reply to Greg Kroah-HartmanFrom: Ivan Orlov <[email protected]>
[ Upstream commit 4913cfcf014c95f0437db2df1734472fd3e15098 ]
The debugfs_create_dir function returns ERR_PTR in case of error, and the only correct way to check if an error occurred is 'IS_ERR' inline function. This patch will replace the null-comparison with IS_ERR.
--- drivers/block/nbd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/block/nbd.c +2 -2
@@ -1531,7 +1531,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd)return -EIO ; dir =debugfs_create_dir (nbd_name (nbd), nbd_dbg_dir); -if (!dir) { +if (IS_ERR (dir)) {dev_err (nbd_to_dev (nbd),"Failed to create debugfs dir for '%s'\n" ,nbd_name (nbd));return -EIO ;
@@ -1557,7 +1557,7 @@ static int nbd_dbg_init(void)struct dentry *dbg_dir; dbg_dir =debugfs_create_dir ("nbd" ,NULL ); -if (!dbg_dir) +if (IS_ERR (dbg_dir))return -EIO ; nbd_dbg_dir = dbg_dir;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/61 ASoC: dwc: limit the number of overrun messages
In reply to Greg Kroah-HartmanFrom: Maxim Kochetkov <[email protected]>
[ Upstream commit ab6ecfbf40fccf74b6ec2ba7ed6dd2fc024c3af2 ]
On slow CPU (FPGA/QEMU emulated) printing overrun messages from interrupt handler to uart console may leads to more overrun errors. So use dev_err_ratelimited to limit the number of error messages.
--- sound/soc/dwc/dwc-i2s.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/dwc/dwc-i2s.c +2 -2
@@ -132,13 +132,13 @@ static irqreturn_t i2s_irq_handler(int irq, void *dev_id)/* Error Handling: TX */ if (isr[i] &ISR_TXFO ) { -dev_err (dev->dev,"TX overrun (ch_id=%d)\n" , i); +dev_err_ratelimited (dev->dev,"TX overrun (ch_id=%d)\n" , i); irq_valid = true; }/* Error Handling: TX */ if (isr[i] &ISR_RXFO ) { -dev_err (dev->dev,"RX overrun (ch_id=%d)\n" , i); +dev_err_ratelimited (dev->dev,"RX overrun (ch_id=%d)\n" , i); irq_valid = true; } }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/61 ASoC: ssm2602: Add workaround for playback distortions
In reply to Greg Kroah-HartmanFrom: Paweł Anikiel <[email protected]>
[ Upstream commit f63550e2b165208a2f382afcaf5551df9569e1d4 ]
Apply a workaround for what appears to be a hardware quirk.
The problem seems to happen when enabling "whole chip power" (bit D7 register R6) for the very first time after the chip receives power. If either "output" (D4) or "DAC" (D3) aren't powered on at that time, playback becomes very distorted later on.
This happens on the Google Chameleon v3, as well as on a ZYBO Z7-10:
https://ez.analog.com/audio/f/q-a/543726/solved-ssm2603-right-output-offset-issue/480229
I suspect this happens only when using an external MCLK signal (which is the case for both of these boards).
Here are some experiments run on a Google Chameleon v3. These were run in userspace using a wrapper around the i2cset utility:
ssmset() {
i2cset -y 0 0x1a $(($1*2)) $2
}For each of the following sequences, we apply power to the ssm2603 chip, set the configuration registers R0-R5 and R7-R8, run the selected sequence, and check for distortions on playback.
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x87 # out, dac
ssmset 0x06 0x07 # chip
OK
(disable MCLK)
ssmset 0x09 0x01 # core
ssmset 0x06 0x1f # chip
ssmset 0x06 0x07 # out, dac
(enable MCLK)
OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x1f # chip
ssmset 0x06 0x07 # out, dac
NOT OK
ssmset 0x06 0x1f # chip
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # out, dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x0f # chip, out
ssmset 0x06 0x07 # dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x17 # chip, dac
ssmset 0x06 0x07 # out
NOT OK
For each of the following sequences, we apply power to the ssm2603 chip, run the selected sequence, issue a reset with R15, configure R0-R5 and R7-R8, run one of the NOT OK sequences from above, and check for distortions.
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
OK
(disable MCLK)
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
(enable MCLK after reset)
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x17 # chip, dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x0f # chip, out
NOT OK
ssmset 0x06 0x07 # chip, out, dac
NOT OK
--- sound/soc/codecs/ssm2602.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
sound/soc/codecs/ssm2602.c +15 -0
@@ -67,6 +67,18 @@ static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = { { .reg = 0x09, .def = 0x0000 } }; +/* +* ssm2602 register patch +* Workaround for playback distortions after power up: activates digital +* core, and then powers on output, DAC, and whole chip at the same time +*/ + +static const struct reg_sequence ssm2602_patch[] = { + {SSM2602_ACTIVE ,0x01 }, + {SSM2602_PWR ,0x07 }, + {SSM2602_RESET ,0x00 }, +}; +/*Appending several "None"s just for OSS mixer use*/ static const char *ssm2602_input_select[] = {
@@ -577,6 +589,9 @@ static int ssm260x_codec_probe(struct snd_soc_codec *codec)return ret; } +regmap_register_patch (ssm2602->regmap, ssm2602_patch, +ARRAY_SIZE (ssm2602_patch)); +/* set the update bits */ regmap_update_bits (ssm2602->regmap,SSM2602_LINVOL ,LINVOL_LRIN_BOTH ,LINVOL_LRIN_BOTH );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/61 media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit 858e97d7956d17a2cb56a9413468704a4d5abfe1 ]
In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null, commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99. However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0. We add check on msg[i].len to prevent null-ptr-deref.
--- drivers/media/usb/dvb-usb/az6027.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/media/usb/dvb-usb/az6027.c +12 -0
@@ -991,6 +991,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n/* write/read request */ if (i +1 < num && (msg[i +1 ].flags &I2C_M_RD )) { req =0xB9 ; +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } index = (((msg[i].buf[0 ] <<8 ) &0xff00 ) | (msg[i].buf[1 ] &0x00ff )); value = msg[i].addr + (msg[i].len <<8 ); length = msg[i +1 ].len +6 ;
@@ -1004,6 +1008,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n/* demod 16bit addr */ req =0xBD ; +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } index = (((msg[i].buf[0 ] <<8 ) &0xff00 ) | (msg[i].buf[1 ] &0x00ff )); value = msg[i].addr + (2 <<8 ); length = msg[i].len -2 ;
@@ -1029,6 +1037,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n }else { req =0xBD ; +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } index = msg[i].buf[0 ] &0x00FF ; value = msg[i].addr + (1 <<8 ); length = msg[i].len -1 ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/61 media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit a6dcefcc08eca1bf4e3d213c97c3cfb75f377935 ]
In ec168_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. If accessing msg[i].buf[0] without sanity check, null pointer deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/ec168.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/media/usb/dvb-usb-v2/ec168.c +12 -0
@@ -125,6 +125,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],while (i < num) {if (num > i +1 && (msg[i+1 ].flags &I2C_M_RD )) {if (msg[i].addr == ec168_ec100_config.demod_address) { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } req.cmd =READ_DEMOD ; req.value =0 ; req.index =0xff00 + msg[i].buf[0 ];/* reg */
@@ -141,6 +145,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], } }else {if (msg[i].addr == ec168_ec100_config.demod_address) { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } req.cmd =WRITE_DEMOD ; req.value = msg[i].buf[1 ];/* val */ req.index =0xff00 + msg[i].buf[0 ];/* reg */
@@ -149,6 +157,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret =ec168_ctrl_msg (d, &req); i +=1 ; }else { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } req.cmd =WRITE_I2C ; req.value = msg[i].buf[0 ];/* val */ req.index =0x0100 + msg[i].addr;/* I2C addr */
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/61 media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit dff919090155fb22679869e8469168f270dcd97f ]
In ce6230_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach ce6230_i2c_master_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/ce6230.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/dvb-usb-v2/ce6230.c +8 -0
@@ -111,6 +111,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap,if (num > i +1 && (msg[i+1 ].flags &I2C_M_RD )) {if (msg[i].addr == ce6230_zl10353_config.demod_address) { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } req.cmd =DEMOD_READ ; req.value = msg[i].addr >>1 ; req.index = msg[i].buf[0 ];
@@ -127,6 +131,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap, }else {if (msg[i].addr == ce6230_zl10353_config.demod_address) { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + } req.cmd =DEMOD_WRITE ; req.value = msg[i].addr >>1 ; req.index = msg[i].buf[0 ];
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/61 media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
In reply to Greg Kroah-HartmanFrom: Zhang Shurong <[email protected]>
[ Upstream commit aa4a447b81b84f69c1a89ad899df157f386d7636 ]
In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/media/usb/dvb-usb-v2/rtl28xxu.c +20 -0
@@ -189,6 +189,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = -EOPNOTSUPP ; goto err_mutex_unlock; }else if (msg[0 ].addr ==0x10 ) { +if (msg[0 ].len <1 || msg[1 ].len <1 ) { + ret = -EOPNOTSUPP ; + goto err_mutex_unlock; + }/* method 1 - integrated demod */ if (msg[0 ].buf[0 ] ==0x00 ) {/* return demod page from driver cache */
@@ -202,6 +206,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret =rtl28xxu_ctrl_msg (d, &req); } }else if (msg[0 ].len <2 ) { +if (msg[0 ].len <1 ) { + ret = -EOPNOTSUPP ; + goto err_mutex_unlock; + }/* method 2 - old I2C */ req.value = (msg[0 ].buf[0 ] <<8 ) | (msg[0 ].addr <<1 ); req.index =CMD_I2C_RD ;
@@ -230,8 +238,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret = -EOPNOTSUPP ; goto err_mutex_unlock; }else if (msg[0 ].addr ==0x10 ) { +if (msg[0 ].len <1 ) { + ret = -EOPNOTSUPP ; + goto err_mutex_unlock; + }/* method 1 - integrated demod */ if (msg[0 ].buf[0 ] ==0x00 ) { +if (msg[0 ].len <2 ) { + ret = -EOPNOTSUPP ; + goto err_mutex_unlock; + }/* save demod page for later demod access */ dev->page = msg[0 ].buf[1 ]; ret =0 ;
@@ -244,6 +260,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], ret =rtl28xxu_ctrl_msg (d, &req); } }else if ((msg[0 ].len <23 ) && (!dev->new_i2c_write)) { +if (msg[0 ].len <1 ) { + ret = -EOPNOTSUPP ; + goto err_mutex_unlock; + }/* method 2 - old I2C */ req.value = (msg[0 ].buf[0 ] <<8 ) | (msg[0 ].addr <<1 ); req.index =CMD_I2C_WR ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/61 media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit 9ded5bd2a49ce3015b7c936743eec0a0e6e11f0c ]
In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach digitv_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
--- drivers/media/usb/dvb-usb/digitv.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/media/usb/dvb-usb/digitv.c +4 -0
@@ -66,6 +66,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int numwarn ("more than 2 i2c messages at a time is not handled yet. TODO." );for (i =0 ; i < num; i++) { +if (msg[i].len <1 ) { + i = -EOPNOTSUPP ; +break ; + }/* write/read request */ if (i+1 < num && (msg[i+1 ].flags &I2C_M_RD )) { if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 23/61 media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit a3fd1ef27aa686d871cefe207bd6168c4b0cd29e ]
In su3000_read_mac_address, if i2c_transfer fails to execute two messages, array mac address will not be initialized. Without handling such error, later in function dvb_usb_adapter_dvb_init, proposed_mac is accessed before initialization.
Fix this error by returning a negative value if message execution fails.
--- drivers/media/usb/dvb-usb/dw2102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dw2102.c +1 -1
@@ -951,7 +951,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])for (i =0 ; i <6 ; i++) { obuf[1 ] =0xf0 + i;if (i2c_transfer (&d->i2c_adap, msg,2 ) !=2 ) -break ; +return -1 ;else mac[i] = ibuf[0 ]; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 24/61 media: netup_unidvb: fix irq init by register it at the end of probe
In reply to Greg Kroah-HartmanFrom: Wei Chen <[email protected]>
[ Upstream commit e6ad6233592593079db5c8fa592c298e51bc1356 ]
IRQ handler netup_spi_interrupt() takes spinlock spi->lock. The lock is initialized in netup_spi_init(). However, irq handler is registered before initializing the lock.
Spinlock dma->lock and i2c->lock suffer from the same problem.
Fix this by registering the irq at the end of probe.
--- .../media/pci/netup_unidvb/netup_unidvb_core.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/media/pci/netup_unidvb/netup_unidvb_core.c +9 -8
@@ -897,12 +897,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev, ndev->lmmio0, (u32 )pci_resource_len (pci_dev,0 ), ndev->lmmio1, (u32 )pci_resource_len (pci_dev,1 ), pci_dev->irq); -if (request_irq (pci_dev->irq, netup_unidvb_isr,IRQF_SHARED , -"netup_unidvb" , pci_dev) <0 ) { -dev_err (&pci_dev->dev, -"%s(): can't get IRQ %d\n" , __func__, pci_dev->irq); - goto irq_request_err; - } + ndev->dma_size =2 *188 *NETUP_DMA_BLOCKS_COUNT *NETUP_DMA_PACKETS_COUNT ; ndev->dma_virt = dma_alloc_coherent(&pci_dev->dev,
@@ -943,6 +938,14 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,dev_err (&pci_dev->dev,"netup_unidvb: DMA setup failed\n" ); goto dma_setup_err; } + +if (request_irq (pci_dev->irq, netup_unidvb_isr,IRQF_SHARED , +"netup_unidvb" , pci_dev) <0 ) { +dev_err (&pci_dev->dev, +"%s(): can't get IRQ %d\n" , __func__, pci_dev->irq); + goto dma_setup_err; + } +dev_info (&pci_dev->dev,"netup_unidvb: device has been initialized\n" );return 0 ;
@@ -961,8 +964,6 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,dma_free_coherent (&pci_dev->dev, ndev->dma_size, ndev->dma_virt, ndev->dma_phys); dma_alloc_err: -free_irq (pci_dev->irq, pci_dev); -irq_request_err:iounmap (ndev->lmmio1); pci_bar1_error:iounmap (ndev->lmmio0);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 25/61 media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit 517a281338322ff8293f988771c98aaa7205e457 ]
Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(), which is called when the device is disconnected, dvb_frontend_free() is not finally called.
This causes a memory leak just by repeatedly plugging and unplugging the device.
Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb().
--- drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/media/usb/ttusb-dec/ttusb_dec.c +1 -2
@@ -1571,8 +1571,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)dvb_dmx_release (&dec->demux);if (dec->fe) {dvb_unregister_frontend (dec->fe); -if (dec->fe->ops.release) - dec->fe->ops.release (dec->fe); +dvb_frontend_detach (dec->fe); }dvb_unregister_adapter (&dec->adapter); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 26/61 media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
[ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ]
Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like:
do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690
For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent.
CVE-2023-31084 was assigned to this bug.
--- drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-)
drivers/media/dvb-core/dvb_frontend.c +12 -4
@@ -301,14 +301,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, }if (events->eventw == events->eventr) { -int ret; +struct wait_queue_entry wait; +int ret =0 ;if (flags &O_NONBLOCK )return -EWOULDBLOCK ; - ret =wait_event_interruptible (events->wait_queue, -dvb_frontend_test_event (fepriv, events)); - +init_waitqueue_entry (&wait, current); +add_wait_queue (&events->wait_queue, &wait); +while (!dvb_frontend_test_event (fepriv, events)) { +wait_woken (&wait,TASK_INTERRUPTIBLE ,0 ); +if (signal_pending (current)) { + ret = -ERESTARTSYS ; +break ; + } + } +remove_wait_queue (&events->wait_queue, &wait);if (ret <0 )return ret; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 27/61 media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
In reply to Greg Kroah-HartmanFrom: Hyunwoo Kim <[email protected]>
[ Upstream commit 280a8ab81733da8bc442253c700a52c4c0886ffd ]
If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node.
The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented.
So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'.
[mchehab: fix a checkpatch warning]
--- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-)
drivers/media/dvb-core/dvb_ca_en50221.c +36 -1
@@ -161,6 +161,12 @@ struct dvb_ca_private {/* mutex serializing ioctls */ struct mutex ioctl_mutex; + +/* A mutex used when a device is disconnected */ +struct mutex remove_mutex; + +/* Whether the device is disconnected */ +int exit; };static void dvb_ca_private_free (struct dvb_ca_private *ca)
@@ -1713,12 +1719,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)dprintk ("%s\n" , __func__); -if (!try_module_get (ca->pub->owner)) +mutex_lock (&ca->remove_mutex); + +if (ca->exit) { +mutex_unlock (&ca->remove_mutex); +return -ENODEV ; + } + +if (!try_module_get (ca->pub->owner)) { +mutex_unlock (&ca->remove_mutex);return -EIO ; + } err =dvb_generic_open (inode, file);if (err <0 ) {module_put (ca->pub->owner); +mutex_unlock (&ca->remove_mutex);return err; }
@@ -1743,6 +1759,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)dvb_ca_private_get (ca); +mutex_unlock (&ca->remove_mutex);return 0 ; }
@@ -1762,6 +1779,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)dprintk ("%s\n" , __func__); +mutex_lock (&ca->remove_mutex); +/* mark the CA device as closed */ ca->open =0 ;dvb_ca_en50221_thread_update_delay (ca);
@@ -1772,6 +1791,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)dvb_ca_private_put (ca); +if (dvbdev->users ==1 && ca->exit ==1 ) { +mutex_unlock (&ca->remove_mutex); +wake_up (&dvbdev->wait_queue); + }else { +mutex_unlock (&ca->remove_mutex); + } +return err; }
@@ -1896,6 +1922,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, }mutex_init (&ca->ioctl_mutex); +mutex_init (&ca->remove_mutex);if (signal_pending (current)) { ret = -EINTR ;
@@ -1939,6 +1966,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)dprintk ("%s\n" , __func__); +mutex_lock (&ca->remove_mutex); + ca->exit =1 ; +mutex_unlock (&ca->remove_mutex); + +if (ca->dvbdev->users <1 ) +wait_event (ca->dvbdev->wait_queue, + ca->dvbdev->users ==1 ); +/* shutdown the thread if there was one */ kthread_stop (ca->thread);
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 28/61 wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
In reply to Greg Kroah-HartmanFrom: Yun Lu <[email protected]>
[ Upstream commit 20429444e653ee8242dfbf815c0c37866beb371b ]
When using rtl8192cu with rtl8xxxu driver to connect wifi, there is a probability of failure, which shows "authentication with ... timed out". Through debugging, it was found that the RCR register has been inexplicably modified to an incorrect value, resulting in the nic not being able to receive authenticated frames.
To fix this problem, add regrcr in rtl8xxxu_priv struct, and store the RCR value every time the register is written, and use it the next time the register need to be modified.
--- drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h +1 -0
@@ -1268,6 +1268,7 @@ struct rtl8xxxu_priv {u32 rege9c;u32 regeb4;u32 regebc; +u32 regrcr;int next_mbox;int nr_out_eps;
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +3 -1
@@ -4051,6 +4051,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)RCR_ACCEPT_MGMT_FRAME |RCR_HTC_LOC_CTRL |RCR_APPEND_PHYSTAT |RCR_APPEND_ICV |RCR_APPEND_MIC ;rtl8xxxu_write32 (priv,REG_RCR , val32); + priv->regrcr = val32;/* * Accept all multicast
@@ -5591,7 +5592,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw, unsigned int *total_flags, u64 multicast) {struct rtl8xxxu_priv *priv = hw->priv; -u32 rcr =rtl8xxxu_read32 (priv,REG_RCR ); +u32 rcr = priv->regrcr;dev_dbg (&priv->udev->dev,"%s: changed_flags %08x, total_flags %08x\n" , __func__, changed_flags, *total_flags);
@@ -5637,6 +5638,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,*/ rtl8xxxu_write32 (priv,REG_RCR , rcr); + priv->regrcr = rcr; *total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_BCN_PRBRESP_PROMISC | FIF_CONTROL | FIF_OTHER_BSS | FIF_PSPOLL |
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 29/61 scsi: core: Decrease scsi_devices iorequest_cnt if dispatch failed
In reply to Greg Kroah-HartmanFrom: Wenchao Hao <[email protected]>
[ Upstream commit 09e797c8641f6ad435c33ae24c223351197ea29a ]
If scsi_dispatch_cmd() failed, the SCSI command was not sent to the target, scsi_queue_rq() would return BLK_STS_RESOURCE and the related request would be requeued. The timeout of this request would not fire, no one would increase iodone_cnt.
The above flow would result the iodone_cnt smaller than iorequest_cnt. So decrease the iorequest_cnt if dispatch failed to workaround the issue.
--- drivers/scsi/scsi_lib.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/scsi_lib.c +2 -0
@@ -1717,6 +1717,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)*/ SCSI_LOG_MLQUEUE (3 ,scmd_printk (KERN_INFO , cmd,"queuecommand : device blocked\n" )); +atomic_dec (&cmd->device->iorequest_cnt);return SCSI_MLQUEUE_DEVICE_BUSY ; }
@@ -1749,6 +1750,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)trace_scsi_dispatch_cmd_start (cmd); rtn = host->hostt->queuecommand (host, cmd);if (rtn) { +atomic_dec (&cmd->device->iorequest_cnt);trace_scsi_dispatch_cmd_error (cmd, rtn);if (rtn !=SCSI_MLQUEUE_DEVICE_BUSY && rtn !=SCSI_MLQUEUE_TARGET_BUSY )
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 30/61 wifi: b43: fix incorrect __packed annotation
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 212457ccbd60dba34f965e4ffbe62f0e4f970538 ]
clang warns about an unpacked structure inside of a packed one:
drivers/net/wireless/broadcom/b43/b43.h:654:4: error: field data within 'struct b43_iv' is less aligned than 'union (unnamed union at /home/arnd/arm-soc/drivers/net/wireless/broadcom/b43/b43.h:651:2)' and is usually due to 'struct b43_iv' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
The problem here is that the anonymous union has the default alignment from its members, apparently because the original author mixed up the placement of the __packed attribute by placing it next to the struct member rather than the union definition. As the struct itself is also marked as __packed, there is no need to mark its members, so just move the annotation to the inner type instead.
As Michael noted, the same problem is present in b43legacy, so change both at the same time.
--- drivers/net/wireless/broadcom/b43/b43.h | 2 +- drivers/net/wireless/broadcom/b43legacy/b43legacy.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/broadcom/b43/b43.h +1 -1
@@ -651,7 +651,7 @@ struct b43_iv {union {__be16 d16;__be32 d32; - } data __packed; + } __packed data; } __packed;
drivers/net/wireless/broadcom/b43legacy/b43legacy.h +1 -1
@@ -379,7 +379,7 @@ struct b43legacy_iv {union {__be16 d16;__be32 d32; - } data __packed; + } __packed data; } __packed;#define B43legacy_PHYMODE (phytype) (1 << (phytype))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 31/61 netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 224a876e37543eee111bf9b6aa4935080e619335 ]
gcc with W=1 and ! CONFIG_NF_NAT net/netfilter/nf_conntrack_netlink.c:3463:32: error:
‘exp_nat_nla_policy’ defined but not used [-Werror=unused-const-variable=]
3463 | static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
| ^~~~~~~~~~~~~~~~~~net/netfilter/nf_conntrack_netlink.c:2979:33: error:
‘any_addr’ defined but not used [-Werror=unused-const-variable=]
2979 | static const union nf_inet_addr any_addr;
| ^~~~~~~~
These variables use is controlled by CONFIG_NF_NAT, so should their definitions.
--- net/netfilter/nf_conntrack_netlink.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_netlink.c +4 -0
@@ -2531,7 +2531,9 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb,return -1 ; } +#if IS_ENABLED (CONFIG_NF_NAT )static const union nf_inet_addr any_addr; +#endif static __be32 nf_expect_get_id (const struct nf_conntrack_expect *exp) {
@@ -3031,10 +3033,12 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,return 0 ; } +#if IS_ENABLED (CONFIG_NF_NAT )static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX +1 ] = { [CTA_EXPECT_NAT_DIR ] = { .type =NLA_U32 }, [CTA_EXPECT_NAT_TUPLE ] = { .type =NLA_NESTED }, }; +#endif static int ctnetlink_parse_expect_nat(const struct nlattr *attr,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 32/61 ALSA: oss: avoid missing-prototype warnings
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 040b5a046a9e18098580d3ccd029e2318fca7859 ]
Two functions are defined and used in pcm_oss.c but also optionally used from io.c, with an optional prototype. If CONFIG_SND_PCM_OSS_PLUGINS is disabled, this causes a warning as the functions are not static and have no prototype:
sound/core/oss/pcm_oss.c:1235:19: error: no previous prototype for 'snd_pcm_oss_write3' [-Werror=missing-prototypes] sound/core/oss/pcm_oss.c:1266:19: error: no previous prototype for 'snd_pcm_oss_read3' [-Werror=missing-prototypes]
Avoid this by making the prototypes unconditional.
--- sound/core/oss/pcm_plugin.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
sound/core/oss/pcm_plugin.h +8 -8
@@ -156,6 +156,14 @@ int snd_pcm_area_copy(const struct snd_pcm_channel_area *src_channel,void *snd_pcm_plug_buf_alloc (struct snd_pcm_substream *plug,snd_pcm_uframes_t size);void snd_pcm_plug_buf_unlock (struct snd_pcm_substream *plug,void *ptr); +#else + +static inline snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *handle,snd_pcm_uframes_t drv_size) {return drv_size; } +static inline snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *handle,snd_pcm_uframes_t clt_size) {return clt_size; } +static inline int snd_pcm_plug_slave_format (int format,const struct snd_mask *format_mask) {return format; } + +#endif +snd_pcm_sframes_t snd_pcm_oss_write3 (struct snd_pcm_substream *substream,const char *ptr,snd_pcm_uframes_t size,int in_kernel);
@@ -166,14 +174,6 @@ snd_pcm_sframes_t snd_pcm_oss_writev3(struct snd_pcm_substream *substream,snd_pcm_sframes_t snd_pcm_oss_readv3 (struct snd_pcm_substream *substream,void **bufs,snd_pcm_uframes_t frames); -#else - -static inline snd_pcm_sframes_t snd_pcm_plug_client_size (struct snd_pcm_substream *handle,snd_pcm_uframes_t drv_size) {return drv_size; } -static inline snd_pcm_sframes_t snd_pcm_plug_slave_size (struct snd_pcm_substream *handle,snd_pcm_uframes_t clt_size) {return clt_size; } -static inline int snd_pcm_plug_slave_format (int format,const struct snd_mask *format_mask) {return format; } - -#endif -#ifdef PLUGIN_DEBUG #define pdprintf(fmt, args...) printk(KERN_DEBUG "plugin: " fmt, ##args)#else
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 33/61 atm: hide unused procfs functions
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit fb1b7be9b16c1f4626969ba4e95a97da2a452b41 ]
When CONFIG_PROC_FS is disabled, the function declarations for some procfs functions are hidden, but the definitions are still build, as shown by this compiler warning:
net/atm/resources.c:403:7: error: no previous prototype for 'atm_dev_seq_start' [-Werror=missing-prototypes] net/atm/resources.c:409:6: error: no previous prototype for 'atm_dev_seq_stop' [-Werror=missing-prototypes] net/atm/resources.c:414:7: error: no previous prototype for 'atm_dev_seq_next' [-Werror=missing-prototypes]
Add another #ifdef to leave these out of the build.
--- net/atm/resources.c | 2 ++ 1 file changed, 2 insertions(+)
net/atm/resources.c +2 -0
@@ -447,6 +447,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *arg, int compat)return error; } +#ifdef CONFIG_PROC_FS void *atm_dev_seq_start (struct seq_file *seq,loff_t *pos) {mutex_lock (&atm_dev_mutex);
@@ -462,3 +463,4 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos) {return seq_list_next (v, &atm_devs, pos); } +#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 34/61 mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ]
There was a bug where this code forgot to unlock the tdev->mutex if the kzalloc() failed. Fix this issue, by moving the allocation outside the lock.
--- drivers/mailbox/mailbox-test.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/mailbox/mailbox-test.c +6 -4
@@ -101,6 +101,7 @@ static ssize_t mbox_test_message_write(struct file *filp, size_t count, loff_t *ppos) { struct mbox_test_device *tdev = filp->private_data; +char *message;void *data;int ret;
@@ -116,12 +117,13 @@ static ssize_t mbox_test_message_write(struct file *filp,return -EINVAL ; } -mutex_lock (&tdev->mutex); - - tdev->message =kzalloc (MBOX_MAX_MSG_LEN ,GFP_KERNEL ); -if (!tdev->message) + message =kzalloc (MBOX_MAX_MSG_LEN ,GFP_KERNEL ); +if (!message)return -ENOMEM ; +mutex_lock (&tdev->mutex); + + tdev->message = message; ret =copy_from_user (tdev->message, userbuf, count);if (ret) { ret = -EFAULT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 35/61 iio: adc: mxs-lradc: fix the order of two cleanup operations
In reply to Greg Kroah-HartmanFrom: Jiakai Luo <[email protected]>
commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 upstream.
Smatch reports:drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn:
missing unwind goto?
the order of three init operation:
1.mxs_lradc_adc_trigger_init
2.iio_triggered_buffer_setup
3.mxs_lradc_adc_hw_init
thus, the order of three cleanup operation should be:
1.mxs_lradc_adc_hw_stop 2.iio_triggered_buffer_cleanup 3.mxs_lradc_adc_trigger_remove
we exchange the order of two cleanup operations, introducing the following differences:
1.if mxs_lradc_adc_trigger_init fails, returns directly; 2.if trigger_init succeeds but iio_triggered_buffer_setup fails, goto err_trig and remove the trigger.
In addition, we also reorder the unwind that goes on in the remove() callback to match the new ordering.
--- drivers/iio/adc/mxs-lradc-adc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/iio/adc/mxs-lradc-adc.c +5 -5
@@ -769,13 +769,13 @@ static int mxs_lradc_adc_probe(struct pl ret =mxs_lradc_adc_trigger_init (iio);if (ret) - goto err_trig; +return ret; ret =iio_triggered_buffer_setup (iio, &iio_pollfunc_store_time, &mxs_lradc_adc_trigger_handler, &mxs_lradc_adc_buffer_ops);if (ret) -return ret; + goto err_trig; adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc];
@@ -813,9 +813,9 @@ static int mxs_lradc_adc_probe(struct pl err_dev:mxs_lradc_adc_hw_stop (adc); -mxs_lradc_adc_trigger_remove (iio); -err_trig:iio_triggered_buffer_cleanup (iio); +err_trig: +mxs_lradc_adc_trigger_remove (iio);return ret; }
@@ -826,8 +826,8 @@ static int mxs_lradc_adc_remove(struct piio_device_unregister (iio);mxs_lradc_adc_hw_stop (adc); -mxs_lradc_adc_trigger_remove (iio);iio_triggered_buffer_cleanup (iio); +mxs_lradc_adc_trigger_remove (iio);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 36/61 HID: wacom: avoid integer overflow in wacom_intuos_inout()
In reply to Greg Kroah-HartmanFrom: Nikita Zhandarovich <[email protected]>
commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream.
If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic operations and integer promotions are done, high bits in wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64 type for the right operand.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/hid/wacom_wac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/wacom_wac.c +1 -1
@@ -743,7 +743,7 @@ static int wacom_intuos_inout(struct wac/* Enter report */ if ((data[1 ] &0xfc ) ==0xc0 ) {/* serial number of the tool */ - wacom->serial[idx] = ((data[3 ] &0x0f ) <<28 ) + + wacom->serial[idx] = ((__u64)(data[3 ] &0x0f ) <<28 ) + (data[4 ] <<20 ) + (data[5 ] <<12 ) + (data[6 ] <<4 ) + (data[7 ] >>4 );
Greg Kroah-Hartman
maintainerPATCH 37/61 iio: dac: mcp4725: Fix i2c_master_send() return value handling
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
commit 09d3bec7009186bdba77039df01e5834788b3f95 upstream.
The i2c_master_send() returns number of sent bytes on success, or negative on error. The suspend/resume callbacks expect zero on success and non-zero on error. Adapt the return value of the i2c_master_send() to the expectation of the suspend and resume callbacks, including proper validation of the return value.
--- drivers/iio/dac/mcp4725.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
drivers/iio/dac/mcp4725.c +14 -2
@@ -50,12 +50,18 @@ static int mcp4725_suspend(struct devicestruct mcp4725_data *data =iio_priv (i2c_get_clientdata (to_i2c_client (dev)));u8 outbuf[2 ]; +int ret; outbuf[0 ] = (data->powerdown_mode +1 ) <<4 ; outbuf[1 ] =0 ; data->powerdown = true; -return i2c_master_send (data->client, outbuf,2 ); + ret =i2c_master_send (data->client, outbuf,2 ); +if (ret <0 ) +return ret; +else if (ret !=2 ) +return -EIO ; +return 0 ; }static int mcp4725_resume (struct device *dev)
@@ -63,13 +69,19 @@ static int mcp4725_resume(struct devicestruct mcp4725_data *data =iio_priv (i2c_get_clientdata (to_i2c_client (dev)));u8 outbuf[2 ]; +int ret;/* restore previous DAC value */ outbuf[0 ] = (data->dac_value >>8 ) &0xf ; outbuf[1 ] = data->dac_value &0xff ; data->powerdown = false; -return i2c_master_send (data->client, outbuf,2 ); + ret =i2c_master_send (data->client, outbuf,2 ); +if (ret <0 ) +return ret; +else if (ret !=2 ) +return -EIO ; +return 0 ; }#ifdef CONFIG_PM_SLEEP
Greg Kroah-Hartman
maintainerPATCH 38/61 net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
commit 36936a56e1814f6c526fe71fbf980beab4f5577a upstream.
BM818 is based on Qualcomm MDM9607 chipset.
--- drivers/net/usb/qmi_wwan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/qmi_wwan.c +1 -1
@@ -1274,7 +1274,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */ {QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ - {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ + {QMI_QUIRK_SET_DTR(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */ {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
Greg Kroah-Hartman
maintainerPATCH 39/61 usb: gadget: f_fs: Add unbind event before functionfs_unbind
In reply to Greg Kroah-HartmanFrom: Uttkarsh Aggarwal <[email protected]>
commit efb6b535207395a5c7317993602e2503ca8cb4b3 upstream.
While exercising the unbind path, with the current implementation the functionfs_unbind would be calling which waits for the ffs->mutex to be available, however within the same time ffs_ep0_read is invoked & if no setup packets are pending, it will invoke function wait_event_interruptible_exclusive_locked_irq which by definition waits for the ev.count to be increased inside the same mutex for which functionfs_unbind is waiting.
This creates deadlock situation because the functionfs_unbind won't get the lock until ev.count is increased which can only happen if the caller ffs_func_unbind can proceed further.
Following is the illustration:
CPU1 CPU2
ffs_func_unbind() ffs_ep0_read()
mutex_lock(ffs->mutex) wait_event(ffs->ev.count)
functionfs_unbind()
mutex_lock(ffs->mutex)
mutex_unlock(ffs->mutex)
ffs_event_add()
<deadlock>
Fix this by moving the event unbind before functionfs_unbind to ensure the ev.count is incrased properly.
--- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_fs.c +1 -1
@@ -3500,6 +3500,7 @@ static void ffs_func_unbind(struct usb_c/* Drain any pending AIO completions */ drain_workqueue (ffs->io_completion_wq); +ffs_event_add (ffs,FUNCTIONFS_UNBIND );if (!--opts->refcnt)functionfs_unbind (ffs);
@@ -3524,7 +3525,6 @@ static void ffs_func_unbind(struct usb_c func->function.ssp_descriptors =NULL ; func->interfaces_nums =NULL ; -ffs_event_add (ffs,FUNCTIONFS_UNBIND ); }static struct usb_function *ffs_alloc (struct usb_function_instance *fi)
Greg Kroah-Hartman
maintainerPATCH 40/61 scsi: stex: Fix gcc 13 warnings
In reply to Greg Kroah-HartmanFrom: Bart Van Assche <[email protected]>
commit 6d074ce231772c66e648a61f6bd2245e7129d1f5 upstream.
gcc 13 may assign another type to enumeration constants than gcc 12. Split the large enum at the top of source file stex.c such that the type of the constants used in time expressions is changed back to the same type chosen by gcc 12. This patch suppresses compiler warnings like this one:
In file included from ./include/linux/bitops.h:7,
from ./include/linux/kernel.h:22,
from drivers/scsi/stex.c:13:drivers/scsi/stex.c: In function ‘stex_common_handshake’:./include/linux/typecheck.h:12:25: error: comparison of distinct pointer types lacks a cast [-Werror]
12 | (void)(&__dummy == &__dummy2); \
| ^~./include/linux/jiffies.h:106:10: note: in expansion of macro ‘typecheck’
106 | typecheck(unsigned long, b) && \
| ^~~~~~~~~
drivers/scsi/stex.c:1035:29: note: in expansion of macro ‘time_after’
1035 | if (time_after(jiffies, before + MU_MAX_DELAY * HZ)) {
| ^~~~~~~~~~See also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107405.
--- drivers/scsi/stex.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/scsi/stex.c +4 -0
@@ -114,7 +114,9 @@ enum {TASK_ATTRIBUTE_HEADOFQUEUE =0x1 ,TASK_ATTRIBUTE_ORDERED =0x2 , TASK_ATTRIBUTE_ACA = 0x4, +}; +enum {SS_STS_NORMAL =0x80000000 ,SS_STS_DONE =0x40000000 , SS_STS_HANDSHAKE = 0x20000000,
@@ -126,7 +128,9 @@ enum {SS_I2H_REQUEST_RESET =0x2000 , SS_MU_OPERATIONAL = 0x80000000, +}; +enum {STEX_CDB_LENGTH =16 , STATUS_VAR_LEN = 128,
Greg Kroah-Hartman
maintainerPATCH 41/61 ata: libata-scsi: Use correct device no in ata_find_dev()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit 7f875850f20a42f488840c9df7af91ef7db2d576 upstream.
For devices not attached to a port multiplier and managed directly by libata, the device number passed to ata_find_dev() must always be lower than the maximum number of devices returned by ata_link_max_devices(). That is 1 for SATA devices or 2 for an IDE link with master+slave devices. This device number is the SCSI device ID which matches these constraints as the IDs are generated per port and so never exceed the maximum number of devices for the link being used.
However, for libsas managed devices, SCSI device IDs are assigned per struct scsi_host, leading to device IDs for SATA devices that can be well in excess of libata per-link maximum number of devices. This results in ata_find_dev() to always return NULL for libsas managed devices except for the first device of the target scsi_host with ID (device number) equal to 0. This issue is visible by executing the hdparm utility, which fails. E.g.:
hdparm -i /dev/sdX/dev/sdX:
HDIO_GET_IDENTITY failed: No message of desired type
Fix this by rewriting ata_find_dev() to ignore the device number for non-PMP attached devices with a link with at most 1 device, that is SATA devices. For these, the device number 0 is always used to return the correct pointer to the struct ata_device of the port link. This change excludes IDE master/slave setups (maximum number of devices per link is 2) and port-multiplier attached devices. Also, to be consistant with the fact that SCSI device IDs and channel numbers used as device numbers are both unsigned int, change the devno argument of ata_find_dev() to unsigned int.
--- drivers/ata/libata-scsi.c | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-)
drivers/ata/libata-scsi.c +26 -8
@@ -3054,18 +3054,36 @@ static unsigned int atapi_xlat(struct atreturn 0 ; } -static struct ata_device *ata_find_dev (struct ata_port *ap,int devno) +static struct ata_device *ata_find_dev (struct ata_port *ap,unsigned int devno) { -if (!sata_pmp_attached (ap)) { -if (likely (devno >=0 && - devno <ata_link_max_devices (&ap->link))) +/* +* For the non-PMP case, ata_link_max_devices() returns 1 (SATA case), +* or 2 (IDE master + slave case). However, the former case includes +* libsas hosted devices which are numbered per scsi host, leading +* to devno potentially being larger than 0 but with each struct +* ata_device having its own struct ata_port and struct ata_link. +* To accommodate these, ignore devno and always use device number 0. +*/ +if (likely (!sata_pmp_attached (ap))) { +int link_max_devices =ata_link_max_devices (&ap->link); + +if (link_max_devices ==1 ) +return &ap->link.device[0 ]; + +if (devno < link_max_devices)return &ap->link.device[devno]; - }else { -if (likely (devno >=0 && - devno < ap->nr_pmp_links)) -return &ap->pmp_link[devno].device[0 ]; + +return NULL ; } +/* +* For PMP-attached devices, the device number corresponds to C +* (channel) of SCSI [H:C:I:L], indicating the port pmp link +* for the device. +*/ +if (devno < ap->nr_pmp_links) +return &ap->pmp_link[devno].device[0 ]; +return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 42/61 x86/boot: Wrap literal addresses in absolute_pointer()
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
commit aeb84412037b89e06f45e382f044da6f200e12f8 upstream.
GCC 11 (incorrectly[1]) assumes that literal values cast to (void *) should be treated like a NULL pointer with an offset, and raises diagnostics when doing bounds checking under -Warray-bounds. GCC 12 got "smarter" about finding these:
In function 'rdfs8',
inlined from 'vga_recalc_vertical' at /srv/code/arch/x86/boot/video-mode.c:124:29,
inlined from 'set_mode' at /srv/code/arch/x86/boot/video-mode.c:163:3:
/srv/code/arch/x86/boot/boot.h:114:9: warning: array subscript 0 is outside array bounds of 'u8[0]' {aka 'unsigned char[]'} [-Warray-bounds]
114 | asm volatile("movb %%fs:%1,%0" : "=q" (v) : "m" (*(u8 *)addr));
| ^~~This has been solved in other places[2] already by using the recently added absolute_pointer() macro. Do the same here.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578
[2] https://lore.kernel.org/all/[email protected]/
--- arch/x86/boot/boot.h | 36 ++++++++++++++++++++++++------------ arch/x86/boot/main.c | 2 +- 2 files changed, 25 insertions(+), 13 deletions(-)
arch/x86/boot/boot.h +24 -12
@@ -114,66 +114,78 @@ typedef unsigned int addr_t;static inline u8 rdfs8 (addr_t addr) { +u8 *ptr = (u8 *)absolute_pointer (addr);u8 v; - asmvolatile ("movb %%fs:%1,%0" :"=q" (v) :"m" (*(u8 *)addr)); + asmvolatile ("movb %%fs:%1,%0" :"=q" (v) :"m" (*ptr));return v; }static inline u16 rdfs16 (addr_t addr) { +u16 *ptr = (u16 *)absolute_pointer (addr);u16 v; - asmvolatile ("movw %%fs:%1,%0" :"=r" (v) :"m" (*(u16 *)addr)); + asmvolatile ("movw %%fs:%1,%0" :"=r" (v) :"m" (*ptr));return v; }static inline u32 rdfs32 (addr_t addr) { +u32 *ptr = (u32 *)absolute_pointer (addr);u32 v; - asmvolatile ("movl %%fs:%1,%0" :"=r" (v) :"m" (*(u32 *)addr)); + asmvolatile ("movl %%fs:%1,%0" :"=r" (v) :"m" (*ptr));return v; }static inline void wrfs8 (u8 v,addr_t addr) { - asmvolatile ("movb %1,%%fs:%0" :"+m" (*(u8 *)addr) :"qi" (v)); +u8 *ptr = (u8 *)absolute_pointer (addr); + asmvolatile ("movb %1,%%fs:%0" :"+m" (*ptr) :"qi" (v)); }static inline void wrfs16 (u16 v,addr_t addr) { - asmvolatile ("movw %1,%%fs:%0" :"+m" (*(u16 *)addr) :"ri" (v)); +u16 *ptr = (u16 *)absolute_pointer (addr); + asmvolatile ("movw %1,%%fs:%0" :"+m" (*ptr) :"ri" (v)); }static inline void wrfs32 (u32 v,addr_t addr) { - asmvolatile ("movl %1,%%fs:%0" :"+m" (*(u32 *)addr) :"ri" (v)); +u32 *ptr = (u32 *)absolute_pointer (addr); + asmvolatile ("movl %1,%%fs:%0" :"+m" (*ptr) :"ri" (v)); }static inline u8 rdgs8 (addr_t addr) { +u8 *ptr = (u8 *)absolute_pointer (addr);u8 v; - asmvolatile ("movb %%gs:%1,%0" :"=q" (v) :"m" (*(u8 *)addr)); + asmvolatile ("movb %%gs:%1,%0" :"=q" (v) :"m" (*ptr));return v; }static inline u16 rdgs16 (addr_t addr) { +u16 *ptr = (u16 *)absolute_pointer (addr);u16 v; - asmvolatile ("movw %%gs:%1,%0" :"=r" (v) :"m" (*(u16 *)addr)); + asmvolatile ("movw %%gs:%1,%0" :"=r" (v) :"m" (*ptr));return v; }static inline u32 rdgs32 (addr_t addr) { +u32 *ptr = (u32 *)absolute_pointer (addr);u32 v; - asmvolatile ("movl %%gs:%1,%0" :"=r" (v) :"m" (*(u32 *)addr)); + asmvolatile ("movl %%gs:%1,%0" :"=r" (v) :"m" (*ptr));return v; }static inline void wrgs8 (u8 v,addr_t addr) { - asmvolatile ("movb %1,%%gs:%0" :"+m" (*(u8 *)addr) :"qi" (v)); +u8 *ptr = (u8 *)absolute_pointer (addr); + asmvolatile ("movb %1,%%gs:%0" :"+m" (*ptr) :"qi" (v)); }static inline void wrgs16 (u16 v,addr_t addr) { - asmvolatile ("movw %1,%%gs:%0" :"+m" (*(u16 *)addr) :"ri" (v)); +u16 *ptr = (u16 *)absolute_pointer (addr); + asmvolatile ("movw %1,%%gs:%0" :"+m" (*ptr) :"ri" (v)); }static inline void wrgs32 (u32 v,addr_t addr) { - asmvolatile ("movl %1,%%gs:%0" :"+m" (*(u32 *)addr) :"ri" (v)); +u32 *ptr = (u32 *)absolute_pointer (addr); + asmvolatile ("movl %1,%%gs:%0" :"+m" (*ptr) :"ri" (v)); }/* Note: these only return true/false, not a signed return value! */
arch/x86/boot/main.c +1 -1
@@ -34,7 +34,7 @@ static void copy_boot_params(void)u16 cl_offset; };const struct old_cmdline *const oldcmd = - (const struct old_cmdline *)OLD_CL_ADDRESS ; +absolute_pointer (OLD_CL_ADDRESS );BUILD_BUG_ON (sizeof boot_params !=4096 );memcpy (&boot_params.hdr, &hdr,sizeof hdr);
Greg Kroah-Hartman
maintainerPATCH 43/61 ACPI: thermal: drop an always true check
In reply to Greg Kroah-HartmanFrom: Adam Borowski <[email protected]>
commit e5b5d25444e9ee3ae439720e62769517d331fa39 upstream.
Address of a field inside a struct can't possibly be null; gcc-12 warns about this.
--- drivers/acpi/thermal.c | 2 -- 1 file changed, 2 deletions(-)
drivers/acpi/thermal.c +0 -2
@@ -1172,8 +1172,6 @@ static int acpi_thermal_resume(struct dereturn -EINVAL ;for (i =0 ; i <ACPI_THERMAL_MAX_ACTIVE ; i++) { -if (!(&tz->trips.active[i])) -break ;if (!tz->trips.active[i].flags.valid)break ; tz->trips.active[i].flags.enabled =1 ;
Greg Kroah-Hartman
maintainerPATCH 44/61 gcc-12: disable -Wdangling-pointer warning for now
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit f7d63b50898172b9eb061b9e2daad61b428792d0 upstream.
[ Upstream commit 49beadbd47c270a00754c107a837b4f29df4c822 ]
While the concept of checking for dangling pointers to local variables at function exit is really interesting, the gcc-12 implementation is not compatible with reality, and results in false positives.
For example, gcc sees us putting things on a local list head allocated on the stack, which involves exactly those kinds of pointers to the local stack entry:
In function ‘__list_add’,
inlined from ‘list_add_tail’ at include/linux/list.h:102:2,
inlined from ‘rebuild_snap_realms’ at fs/ceph/snap.c:434:2:
include/linux/list.h:74:19: warning: storing the address of local variable ‘realm_queue’ in ‘*&realm_27(D)->rebuild_item.prev’ [-Wdangling-pointer=]
74 | new->prev = prev;
| ~~~~~~~~~~^~~~~~But then gcc - understandably - doesn't really understand the big picture how the doubly linked list works, so doesn't see how we then end up emptying said list head in a loop and the pointer we added has been removed.
Gcc also complains about us (intentionally) using this as a way to store a kind of fake stack trace, eg
drivers/acpi/acpica/utdebug.c:40:38: warning: storing the address of local variable ‘current_sp’ in ‘acpi_gbl_entry_stack_pointer’ [-Wdangling-pointer=]
40 | acpi_gbl_entry_stack_pointer = ¤t_sp;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~which is entirely reasonable from a compiler standpoint, and we may want to change those kinds of patterns, but not not.
So this is one of those "it would be lovely if the compiler were to complain about us leaving dangling pointers to the stack", but not this way.
--- Makefile | 4 ++++ 1 file changed, 4 insertions(+)
Makefile +4 -0
@@ -731,6 +731,10 @@ endif KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + +# These result in bogus false positives +KBUILD_CFLAGS += $(call cc-disable-warning, dangling-pointer) + ifdef CONFIG_FRAME_POINTER KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls else
Greg Kroah-Hartman
maintainerPATCH 45/61 eth: sun: cassini: remove dead code
In reply to Greg Kroah-HartmanFrom: Martin Liška <[email protected]>
commit 32329216ca1d6ee29c41215f18b3053bb6158541 upstream.
Fixes the following GCC warning:
drivers/net/ethernet/sun/cassini.c:1316:29: error: comparison between two arrays [-Werror=array-compare] drivers/net/ethernet/sun/cassini.c:3783:34: error: comparison between two arrays [-Werror=array-compare]
Note that 2 arrays should be compared by comparing of their addresses:
note: use ‘&cas_prog_workaroundtab[0] == &cas_prog_null[0]’ to compare the addresses
--- drivers/net/ethernet/sun/cassini.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/sun/cassini.c +2 -2
@@ -1349,7 +1349,7 @@ static void cas_init_rx_dma(struct cas *writel (val, cp->regs +REG_RX_PAGE_SIZE );/* enable the header parser if desired */ -if (CAS_HP_FIRMWARE == cas_prog_null) +if (&CAS_HP_FIRMWARE [0 ] == &cas_prog_null[0 ])return ; val =CAS_BASE (HP_CFG_NUM_CPU ,CAS_NCPUS >63 ?0 :CAS_NCPUS );
@@ -3819,7 +3819,7 @@ static void cas_reset(struct cas *cp, in/* program header parser */ if ((cp->cas_flags &CAS_FLAG_TARGET_ABORT ) || - (CAS_HP_ALT_FIRMWARE == cas_prog_null)) { + (&CAS_HP_ALT_FIRMWARE [0 ] == &cas_prog_null[0 ])) {cas_load_firmware (cp,CAS_HP_FIRMWARE ); }else {cas_load_firmware (cp,CAS_HP_ALT_FIRMWARE );
Greg Kroah-Hartman
maintainerPATCH 46/61 kernel/extable.c: use address-of operator on section symbols
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 63174f61dfaef58dc0e813eaf6602636794f8942 upstream.
Clang warns:
../kernel/extable.c:37:52: warning: array comparison always evaluates to a constant [-Wtautological-compare]
if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) {
^1 warning generated.
These are not true arrays, they are linker defined symbols, which are just addresses. Using the address of operator silences the warning and does not change the resulting assembly with either clang/ld.lld or gcc/ld (tested with diff + objdump -Dr).
--- kernel/extable.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/extable.c +2 -1
@@ -44,7 +44,8 @@ u32 __initdata __visible main_extable_so/* Sort the kernel's built-in exception table */ void __init sort_main_extable (void ) { -if (main_extable_sort_needed && __stop___ex_table > __start___ex_table) { +if (main_extable_sort_needed && + &__stop___ex_table > &__start___ex_table) {pr_notice ("Sorting __ex_table...\n" );sort_extable (__start___ex_table, __stop___ex_table); }
Greg Kroah-Hartman
maintainerPATCH 47/61 lib/dynamic_debug.c: use address-of operator on section symbols
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 8306b057a85ec07482da5d4b99d5c0b47af69be1 upstream.
Clang warns:
../lib/dynamic_debug.c:1034:24: warning: array comparison always evaluates to false [-Wtautological-compare]
if (__start___verbose == __stop___verbose) {
^1 warning generated.
These are not true arrays, they are linker defined symbols, which are just addresses. Using the address of operator silences the warning and does not change the resulting assembly with either clang/ld.lld or gcc/ld (tested with diff + objdump -Dr).
--- lib/dynamic_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/dynamic_debug.c +1 -1
@@ -984,7 +984,7 @@ static int __init dynamic_debug_init(voiint n =0 , entries =0 , modct =0 ;int verbose_bytes =0 ; -if (__start___verbose == __stop___verbose) { +if (&__start___verbose == &__stop___verbose) {pr_warn ("_ddebug table is empty in a CONFIG_DYNAMIC_DEBUG build\n" );return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 48/61 wifi: rtlwifi: remove always-true condition pointed out by GCC 12
In reply to Greg Kroah-HartmanFrom: Jakub Kicinski <[email protected]>
commit ee3db469dd317e82f57b13aa3bc61be5cb60c2b4 upstream.
The .value is a two-dim array, not a pointer.
struct iqk_matrix_regs {
bool iqk_done;
long value[1][IQK_MATRIX_REG_NUM];
};--- drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +1 -4
@@ -2414,10 +2414,7 @@ void rtl92d_phy_reload_iqk_setting(strucRT_TRACE (rtlpriv,COMP_SCAN ,DBG_LOUD ,"Just Read IQK Matrix reg for channel:%d....\n" , channel); -if ((rtlphy->iqk_matrix[indexforchannel]. - value[0 ] !=NULL ) -/*&&(regea4 != 0) */ ) - _rtl92d_phy_patha_fill_iqk_matrix(hw, true, + _rtl92d_phy_patha_fill_iqk_matrix(hw, true, rtlphy->iqk_matrix[ indexforchannel].value, 0, (rtlphy->iqk_matrix[
Greg Kroah-Hartman
maintainerPATCH 49/61 regulator: da905{2,5}: Remove unnecessary array check
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
commit 5a7d7d0f9f791b1e13f26dbbb07c86482912ad62 upstream.
Clang warns that the address of a pointer will always evaluated as true in a boolean context:
drivers/regulator/da9052-regulator.c:423:22: warning: address of array 'pdata->regulators' will always evaluate to 'true' [-Wpointer-bool-conversion]
if (pdata && pdata->regulators) {
~~ ~~~~~~~^~~~~~~~~~
drivers/regulator/da9055-regulator.c:615:22: warning: address of array
'pdata->regulators' will always evaluate to 'true'
[-Wpointer-bool-conversion]
if (pdata && pdata->regulators) {
~~ ~~~~~~~^~~~~~~~~~--- drivers/regulator/da9052-regulator.c | 2 +- drivers/regulator/da9055-regulator.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/regulator/da9052-regulator.c +1 -1
@@ -421,7 +421,7 @@ static int da9052_regulator_probe(struct config.dev = &pdev->dev; config.driver_data = regulator; config.regmap = da9052->regmap; -if (pdata && pdata->regulators) { +if (pdata) { config.init_data = pdata->regulators[cell->id]; }else {#ifdef CONFIG_OF
drivers/regulator/da9055-regulator.c +1 -1
@@ -612,7 +612,7 @@ static int da9055_regulator_probe(struct config.driver_data = regulator; config.regmap = da9055->regmap; -if (pdata && pdata->regulators) { +if (pdata) { config.init_data = pdata->regulators[pdev->id]; }else { ret = da9055_regulator_dt_init(pdev, regulator, &config,
Greg Kroah-Hartman
maintainerPATCH 50/61 mmc: vub300: fix invalid response handling
In reply to Greg Kroah-HartmanFrom: Deren Wu <[email protected]>
commit a99d21cefd351c8aaa20b83a3c942340e5789d45 upstream.
We may get an empty response with zero length at the beginning of the driver start and get following UBSAN error. Since there is no content(SDRT_NONE) for the response, just return and skip the response handling to avoid this problem.
Test pass : SDIO wifi throughput test with this patch
[ 126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12 [ 126.980709] index -1 is out of range for type 'u32 [4]' [ 126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G E 6.3.0-rc4-mtk-local-202304272142 #1 [ 126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300] [ 126.980833] Call Trace: [ 126.980845] <TASK> [ 126.980860] dump_stack_lvl+0x48/0x70 [ 126.980895] dump_stack+0x10/0x20 [ 126.980916] ubsan_epilogue+0x9/0x40 [ 126.980944] __ubsan_handle_out_of_bounds+0x70/0x90 [ 126.980979] vub300_cmndwork_thread+0x58e7/0x5e10 [vub300] [ 126.981018] ? _raw_spin_unlock+0x18/0x40 [ 126.981042] ? finish_task_switch+0x175/0x6f0 [ 126.981070] ? __switch_to+0x42e/0xda0 [ 126.981089] ? __switch_to_asm+0x3a/0x80 [ 126.981129] ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300] [ 126.981174] ? __kasan_check_read+0x11/0x20 [ 126.981204] process_one_work+0x7ee/0x13d0 [ 126.981246] worker_thread+0x53c/0x1240 [ 126.981291] kthread+0x2b8/0x370 [ 126.981312] ? __pfx_worker_thread+0x10/0x10 [ 126.981336] ? __pfx_kthread+0x10/0x10 [ 126.981359] ret_from_fork+0x29/0x50 [ 126.981400] </TASK>
--- drivers/mmc/host/vub300.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/vub300.c +3 -0
@@ -1718,6 +1718,9 @@ static void construct_request_response(sint bytes =3 & less_cmd;int words = less_cmd >>2 ;u8 *r = vub300->resp.response.command_response; + +if (!resp_len) +return ;if (bytes ==3 ) { cmd->resp[words] = (r[1 + (words <<2 )] <<24 ) | (r[2 + (words <<2 )] <<16 )
Greg Kroah-Hartman
maintainerPATCH 51/61 tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
In reply to Greg Kroah-HartmanFrom: Sherry Sun <[email protected]>
commit 2474e05467c00f7d51af3039b664de6886325257 upstream.
LPUART IP now has two known bugs, one is that CTS has higher priority than the break signal, which causes the break signal sending through UARTCTRL_SBK may impacted by the CTS input if the HW flow control is enabled. It exists on all platforms we support in this driver. So we add a workaround patch for this issue: commit c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal").
Another IP bug is i.MX8QM LPUART may have an additional break character being sent after SBK was cleared. It may need to add some delay between clearing SBK and re-enabling CTS to ensure that the SBK latch are completely cleared.
But we found that during the delay period before CTS is enabled, there is still a risk that Bluetooth data in TX FIFO may be sent out during this period because of break off and CTS disabled(even if BT sets CTS line deasserted, data is still sent to BT).
Due to this risk, we have to drop the CTS-disabling workaround for SBK bugs, use TXINV seems to be a better way to replace SBK feature and avoid above risk. Also need to disable the transmitter to prevent any data from being sent out during break, then invert the TX line to send break. Then disable the TXINV when turn off break and re-enable transmitter.
--- drivers/tty/serial/fsl_lpuart.c | 44 ++++++++++++++++++++-------------------- 1 file changed, 23 insertions(+), 21 deletions(-)
drivers/tty/serial/fsl_lpuart.c +23 -21
@@ -1199,34 +1199,36 @@ static void lpuart_break_ctl(struct uartstatic void lpuart32_break_ctl (struct uart_port *port,int break_state) { -unsigned long temp, modem; -struct tty_struct *tty; -unsigned int cflag =0 ; +unsigned long temp; - tty =tty_port_tty_get (&port->state->port); -if (tty) { - cflag = tty->termios.c_cflag; -tty_kref_put (tty); - } - - temp =lpuart32_read (port,UARTCTRL ) & ~UARTCTRL_SBK ; - modem =lpuart32_read (port,UARTMODIR ); + temp =lpuart32_read (port,UARTCTRL ); +/* +* LPUART IP now has two known bugs, one is CTS has higher priority than the +* break signal, which causes the break signal sending through UARTCTRL_SBK +* may impacted by the CTS input if the HW flow control is enabled. It +* exists on all platforms we support in this driver. +* Another bug is i.MX8QM LPUART may have an additional break character +* being sent after SBK was cleared. +* To avoid above two bugs, we use Transmit Data Inversion function to send +* the break signal instead of UARTCTRL_SBK. +*/ if (break_state !=0 ) { - temp |=UARTCTRL_SBK ;/* -* LPUART CTS has higher priority than SBK, need to disable CTS before -* asserting SBK to avoid any interference if flow control is enabled. +* Disable the transmitter to prevent any data from being sent out +* during break, then invert the TX line to send break. */ -if (cflag &CRTSCTS && modem &UARTMODIR_TXCTSE ) -lpuart32_write (port, modem & ~UARTMODIR_TXCTSE ,UARTMODIR ); + temp &= ~UARTCTRL_TE ; +lpuart32_write (port, temp,UARTCTRL ); + temp |=UARTCTRL_TXINV ; +lpuart32_write (port, temp,UARTCTRL ); }else { -/* Re-enable the CTS when break off. */ -if (cflag &CRTSCTS && !(modem &UARTMODIR_TXCTSE )) -lpuart32_write (port, modem |UARTMODIR_TXCTSE ,UARTMODIR ); +/* Disable the TXINV to turn off break and re-enable transmitter. */ + temp &= ~UARTCTRL_TXINV ; +lpuart32_write (port, temp,UARTCTRL ); + temp |=UARTCTRL_TE ; +lpuart32_write (port, temp,UARTCTRL ); } - -lpuart32_write (port, temp,UARTCTRL ); }static void lpuart_setup_watermark (struct lpuart_port *sport)
Greg Kroah-Hartman
maintainerPATCH 52/61 selinux: dont use makes grouped targets feature yet
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 42c4e97e06a839b07d834f640a10911ad84ec8b3 upstream.
The Linux Kernel currently only requires make v3.82 while the grouped target functionality requires make v4.3. Removed the grouped target introduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed") as well as the multiple header file targets in the make rule. This effectively reverts the problem commit.
We will revisit this change when make >= 4.3 is required by the rest of the kernel.
--- security/selinux/Makefile | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
security/selinux/Makefile +5 -1
@@ -22,5 +22,9 @@ quiet_cmd_flask = GEN $(obj)/flask.h cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h targets += flask.h av_permissions.h -$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE +# once make >= 4.3 is required, we can use grouped targets in the rule below, +# which basically involves adding both headers and a '&' before the colon, see +# the example below: +# $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/... +$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE $(call if_changed,flask)
Greg Kroah-Hartman
maintainerPATCH 53/61 ext4: add lockdep annotations for i_data_sem for ea_inodes
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit aff3bea95388299eec63440389b4545c8041b357 upstream.
Treat i_data_sem for ea_inodes as being in their own lockdep class to avoid lockdep complaints about ext4_setattr's use of inode_lock() on normal inodes potentially causing lock ordering with i_data_sem on ea_inodes in ext4_xattr_inode_write(). However, ea_inodes will be operated on by ext4_setattr(), so this isn't a problem.
--- fs/ext4/ext4.h | 2 ++ fs/ext4/xattr.c | 4 ++++ 2 files changed, 6 insertions(+)
fs/ext4/ext4.h +2 -0
@@ -947,11 +947,13 @@ do { \* where the second inode has larger inode number * than the first * I_DATA_SEM_QUOTA - Used for quota inodes only +* I_DATA_SEM_EA - Used for ea_inodes only */ enum {I_DATA_SEM_NORMAL =0 ,I_DATA_SEM_OTHER ,I_DATA_SEM_QUOTA , +I_DATA_SEM_EA };
fs/ext4/xattr.c +4 -0
@@ -120,7 +120,11 @@ ext4_expand_inode_array(struct ext4_xatt#ifdef CONFIG_LOCKDEP void ext4_xattr_inode_set_class (struct inode *ea_inode) { +struct ext4_inode_info *ei =EXT4_I (ea_inode); +lockdep_set_subclass (&ea_inode->i_rwsem,1 ); + (void ) ei;/* shut up clang warning if !CONFIG_LOCKDEP */ +lockdep_set_subclass (&ei->i_data_sem,I_DATA_SEM_EA ); }#endif
Greg Kroah-Hartman
maintainerPATCH 54/61 fbcon: Fix null-ptr-deref in soft_cursor
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 upstream.
syzbot repored this bug in the softcursor code:
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12 CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: events_power_efficient fb_flashcursor Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_report+0xe4/0x514 mm/kasan/report.c:465 kasan_report+0xd4/0x130 mm/kasan/report.c:572 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 __asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105 soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70 bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377 fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380 process_one_work+0x788/0x12d4 kernel/workqueue.c:2405 worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552 kthread+0x288/0x310 kernel/kthread.c:379 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
This fix let bit_cursor() bail out early when a font bitmap isn't available yet.
--- drivers/video/fbdev/core/bitblit.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/fbdev/core/bitblit.c +3 -0
@@ -247,6 +247,9 @@ static void bit_cursor(struct vc_data *v cursor.set =0 ; +if (!vc->vc_font.data) +return ; + c =scr_readw ((u16 *) vc->vc_pos); attribute =get_attribute (info, c); src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
Greg Kroah-Hartman
maintainerPATCH 55/61 scsi: dpt_i2o: Remove broken pass-through ioctl (I2OUSERCMD)
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
adpt_i2o_passthru() takes a user-provided message and passes it through to the hardware with appropriate translation of addresses and message IDs. It has a number of bugs:
- When a message requires scatter/gather, it doesn't verify that the offset to the scatter/gather list is less than the message size.
- When a message requires scatter/gather, it overwrites the DMA addresses with the user-space virtual addresses before unmapping the DMA buffers.
- It reads the message from user memory multiple times. This allows user-space to change the message and bypass validation.
- It assumes that the message is at least 4 words long, but doesn't check that.
I tried fixing these, but even the maintainer of the corresponding user-space in Debian doesn't have the hardware any more.
Instead, remove the pass-through ioctl (I2OUSRCMD) and supporting code.
There is no corresponding upstream commit, because this driver was removed upstream.
--- drivers/scsi/dpt_i2o.c | 258 ------------------------------------------------- drivers/scsi/dpti.h | 1 2 files changed, 3 insertions(+), 256 deletions(-)
drivers/scsi/dpt_i2o.c +3 -255
@@ -630,51 +630,6 @@ static struct scsi_cmnd *return NULL ; } -/* -* Turn a pointer to ioctl reply data into an u32 'context' -*/ -static u32 adpt_ioctl_to_context (adpt_hba * pHba,void *reply) -{ -#if BITS_PER_LONG ==32 -return (u32 )(unsigned long )reply; -#else -ulong flags =0 ; -u32 nr, i; - -spin_lock_irqsave (pHba->host->host_lock, flags); - nr =ARRAY_SIZE (pHba->ioctl_reply_context); -for (i =0 ; i < nr; i++) { -if (pHba->ioctl_reply_context[i] ==NULL ) { - pHba->ioctl_reply_context[i] = reply; -break ; - } - } -spin_unlock_irqrestore (pHba->host->host_lock, flags); -if (i >= nr) { -printk (KERN_WARNING "%s: Too many outstanding " -"ioctl commands\n" , pHba->name); -return (u32)-1 ; - } - -return i; -#endif -} - -/* -* Go from an u32 'context' to a pointer to ioctl reply data. -*/ -static void *adpt_ioctl_from_context (adpt_hba *pHba,u32 context) -{ -#if BITS_PER_LONG ==32 -return (void *)(unsigned long )context; -#else -void *p = pHba->ioctl_reply_context[context]; - pHba->ioctl_reply_context[context] =NULL ; - -return p; -#endif -} -/*=========================================================================== * Error Handling routines *===========================================================================
@@ -1698,201 +1653,6 @@ static int adpt_close(struct inode *inodreturn 0 ; } - -static int adpt_i2o_passthru (adpt_hba * pHba,u32 __user *arg) -{ -u32 msg[MAX_MESSAGE_SIZE ]; -u32 * reply =NULL ; -u32 size =0 ; -u32 reply_size =0 ; -u32 __user *user_msg = arg; -u32 __user * user_reply =NULL ; -void *sg_list[pHba->sg_tablesize]; -u32 sg_offset =0 ; -u32 sg_count =0 ; -int sg_index =0 ; -u32 i =0 ; -u32 rcode =0 ; -void *p =NULL ; -dma_addr_t addr; -ulong flags =0 ; - -memset (&msg,0 ,MAX_MESSAGE_SIZE *4 ); -// get user msg size in u32s -if (get_user (size, &user_msg[0 ])){ -return -EFAULT ; - } - size = size>>16 ; - - user_reply = &user_msg[size]; -if (size >MAX_MESSAGE_SIZE ){ -return -EFAULT ; - } - size *=4 ;// Convert to bytes - -/* Copy in the user's I2O command */ -if (copy_from_user (msg, user_msg, size)) { -return -EFAULT ; - } -get_user (reply_size, &user_reply[0 ]); - reply_size = reply_size>>16 ; -if (reply_size >REPLY_FRAME_SIZE ){ - reply_size =REPLY_FRAME_SIZE ; - } - reply_size *=4 ; - reply =kzalloc (REPLY_FRAME_SIZE *4 ,GFP_KERNEL ); -if (reply ==NULL ) { -printk (KERN_WARNING "%s: Could not allocate reply buffer\n" ,pHba->name); -return -ENOMEM ; - } - sg_offset = (msg[0 ]>>4 )&0xf ; - msg[2 ] =0x40000000 ;// IOCTL context - msg[3 ] =adpt_ioctl_to_context (pHba, reply); -if (msg[3 ] == (u32)-1 ) { -kfree (reply); -return -EBUSY ; - } - -memset (sg_list,0 ,sizeof (sg_list[0 ])*pHba->sg_tablesize); -if (sg_offset) { -// TODO add 64 bit API -struct sg_simple_element *sg = (struct sg_simple_element *) (msg+sg_offset); - sg_count = (size - sg_offset*4 ) /sizeof (struct sg_simple_element ); -if (sg_count > pHba->sg_tablesize){ -printk (KERN_DEBUG "%s:IOCTL SG List too large (%u)\n" , pHba->name,sg_count); -kfree (reply); -return -EINVAL ; - } - -for (i =0 ; i < sg_count; i++) { -int sg_size; - -if (!(sg[i].flag_count &0x10000000 /*I2O_SGL_FLAGS_SIMPLE_ADDRESS_ELEMENT*/ )) { -printk (KERN_DEBUG "%s:Bad SG element %d - not simple (%x)\n" ,pHba->name,i, sg[i].flag_count); - rcode = -EINVAL ; - goto cleanup; - } - sg_size = sg[i].flag_count &0xffffff ; -/* Allocate memory for the transfer */ - p =dma_alloc_coherent (&pHba->pDev->dev, sg_size, &addr,GFP_KERNEL ); -if (!p) { -printk (KERN_DEBUG "%s: Could not allocate SG buffer - size = %d buffer number %d of %d\n" , - pHba->name,sg_size,i,sg_count); - rcode = -ENOMEM ; - goto cleanup; - } - sg_list[sg_index++] = p;// sglist indexed with input frame, not our internal frame. -/* Copy in the user's SG buffer if necessary */ -if (sg[i].flag_count &0x04000000 /*I2O_SGL_FLAGS_DIR*/ ) { -// sg_simple_element API is 32 bit -if (copy_from_user (p,(void __user *)(ulong )sg[i].addr_bus, sg_size)) { -printk (KERN_DEBUG "%s: Could not copy SG buf %d FROM user\n" ,pHba->name,i); - rcode = -EFAULT ; - goto cleanup; - } - } -/* sg_simple_element API is 32 bit, but addr < 4GB */ - sg[i].addr_bus = addr; - } - } - -do { -/* -* Stop any new commands from enterring the -* controller while processing the ioctl -*/ -if (pHba->host) { -scsi_block_requests (pHba->host); -spin_lock_irqsave (pHba->host->host_lock, flags); - } - rcode =adpt_i2o_post_wait (pHba, msg, size,FOREVER ); -if (rcode !=0 ) -printk ("adpt_i2o_passthru: post wait failed %d %p\n" , - rcode, reply); -if (pHba->host) { -spin_unlock_irqrestore (pHba->host->host_lock, flags); -scsi_unblock_requests (pHba->host); - } - }while (rcode == -ETIMEDOUT ); - -if (rcode){ - goto cleanup; - } - -if (sg_offset) { -/* Copy back the Scatter Gather buffers back to user space */ -u32 j; -// TODO add 64 bit API -struct sg_simple_element * sg; -int sg_size; - -// re-acquire the original message to handle correctly the sg copy operation -memset (&msg,0 ,MAX_MESSAGE_SIZE *4 ); -// get user msg size in u32s -if (get_user (size, &user_msg[0 ])){ - rcode = -EFAULT ; - goto cleanup; - } - size = size>>16 ; - size *=4 ; -if (size >MAX_MESSAGE_SIZE ) { - rcode = -EINVAL ; - goto cleanup; - } -/* Copy in the user's I2O command */ -if (copy_from_user (msg, user_msg, size)) { - rcode = -EFAULT ; - goto cleanup; - } - sg_count = (size - sg_offset*4 ) /sizeof (struct sg_simple_element ); - -// TODO add 64 bit API - sg = (struct sg_simple_element *)(msg + sg_offset); -for (j =0 ; j < sg_count; j++) { -/* Copy out the SG list to user's buffer if necessary */ -if (! (sg[j].flag_count &0x4000000 /*I2O_SGL_FLAGS_DIR*/ )) { - sg_size = sg[j].flag_count &0xffffff ; -// sg_simple_element API is 32 bit -if (copy_to_user ((void __user *)(ulong )sg[j].addr_bus,sg_list[j], sg_size)) { -printk (KERN_WARNING "%s: Could not copy %p TO user %x\n" ,pHba->name, sg_list[j], sg[j].addr_bus); - rcode = -EFAULT ; - goto cleanup; - } - } - } - } - -/* Copy back the reply to user space */ -if (reply_size) { -// we wrote our own values for context - now restore the user supplied ones -if (copy_from_user (reply+2 , user_msg+2 ,sizeof (u32)*2 )) { -printk (KERN_WARNING "%s: Could not copy message context FROM user\n" ,pHba->name); - rcode = -EFAULT ; - } -if (copy_to_user (user_reply, reply, reply_size)) { -printk (KERN_WARNING "%s: Could not copy reply TO user\n" ,pHba->name); - rcode = -EFAULT ; - } - } - - -cleanup: -if (rcode != -ETIME && rcode != -EINTR ) { -struct sg_simple_element *sg = - (struct sg_simple_element *) (msg +sg_offset); -kfree (reply); -while (sg_index) { -if (sg_list[--sg_index]) { -dma_free_coherent (&pHba->pDev->dev, - sg[sg_index].flag_count &0xffffff , - sg_list[sg_index], - sg[sg_index].addr_bus); - } - } - } -return rcode; -} -#if defined __ia64__static void adpt_ia64_info (sysInfo_S * si) {
@@ -2019,8 +1779,6 @@ static int adpt_ioctl(struct inode *inodreturn -EFAULT ; }break ; -case I2OUSRCMD : -return adpt_i2o_passthru (pHba, argp);case DPT_CTRLINFO :{drvrHBAinfo_S HbaInfo;
@@ -2174,13 +1932,6 @@ static irqreturn_t adpt_isr(int irq, voiadpt_send_nop (pHba, old_m); } context =readl (reply+8 ); -if (context &0x40000000 ){// IOCTL -void *p =adpt_ioctl_from_context (pHba,readl (reply+12 )); -if ( p !=NULL ) { -memcpy_fromio (p, reply,REPLY_FRAME_SIZE *4 ); - } -// All IOCTLs will also be post wait - }if (context &0x80000000 ){// Post wait message status =readl (reply+16 );if (status >>24 ){
@@ -2188,12 +1939,9 @@ static irqreturn_t adpt_isr(int irq, voi }else { status =I2O_POST_WAIT_OK ; } -if (!(context &0x40000000 )) { - cmd =adpt_cmd_from_context (pHba, -readl (reply+12 )); -if (cmd !=NULL ) { -printk (KERN_WARNING "%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n" , pHba->name, cmd, context); - } + cmd =adpt_cmd_from_context (pHba,readl (reply+12 )); +if (cmd !=NULL ) { +printk (KERN_WARNING "%s: Apparent SCSI cmd in Post Wait Context - cmd=%p context=%x\n" , pHba->name, cmd, context); }adpt_i2o_post_wait_complete (context, status); }else {// SCSI message
drivers/scsi/dpti.h +0 -1
@@ -252,7 +252,6 @@ typedef struct _adpt_hba {void __iomem *FwDebugBLEDflag_P;// Virtual Addr Of FW Debug BLED void __iomem *FwDebugBLEDvalue_P;// Virtual Addr Of FW Debug BLED u32 FwDebugFlags; -u32 *ioctl_reply_context[4 ]; } adpt_hba;struct sg_simple_element {
Greg Kroah-Hartman
maintainerPATCH 56/61 scsi: dpt_i2o: Do not process completions with invalid addresses
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
adpt_isr() reads reply addresses from a hardware register, which should always be within the DMA address range of the device's pool of reply address buffers. In case the address is out of range, it tries to muddle on, converting to a virtual address using bus_to_virt().
bus_to_virt() does not take DMA addresses, and it doesn't make sense to try to handle the completion in this case. Ignore it and continue looping to service the interrupt. If a completion has been lost then the SCSI core should eventually time-out and trigger a reset.
There is no corresponding upstream commit, because this driver was removed upstream.
--- drivers/scsi/Kconfig | 2 +- drivers/scsi/dpt_i2o.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/Kconfig +1 -1
@@ -480,7 +480,7 @@ config SCSI_MVUMI config SCSI_DPT_I2O tristate "Adaptec I2O RAID support " - depends on SCSI && PCI && VIRT_TO_BUS + depends on SCSI && PCI help This driver supports all of Adaptec's I2O based RAID controllers as well as the DPT SmartRaid V cards. This is an Adaptec maintained
drivers/scsi/dpt_i2o.c +2 -2
@@ -59,7 +59,7 @@ MODULE_DESCRIPTION("Adaptec I2O RAID Dri#include <asm/processor.h> /* for boot_cpu_data */ #include <asm/pgtable.h> -#include <asm/io.h> /* for virt_to_bus, etc. */ +#include <asm/io.h> #include <scsi/scsi.h> #include <scsi/scsi_cmnd.h>
@@ -1912,7 +1912,7 @@ static irqreturn_t adpt_isr(int irq, voi }else {/* Ick, we should *never* be here */ printk (KERN_ERR "dpti: reply frame not from pool\n" ); - reply = (u8 *)bus_to_virt (m); +continue ; }if (readl (reply) &MSG_FAIL ) {
Greg Kroah-Hartman
maintainerPATCH 57/61 cdc_ncm: Implement the 32-bit version of NCM Transfer Block
In reply to Greg Kroah-HartmanFrom: Alexander Bersenev <[email protected]>
commit 0fa81b304a7973a499f844176ca031109487dd31 upstream.
The NCM specification defines two formats of transfer blocks: with 16-bit fields (NTB-16) and with 32-bit fields (NTB-32). Currently only NTB-16 is implemented.
This patch adds the support of NTB-32. The motivation behind this is that some devices such as E5785 or E5885 from the current generation of Huawei LTE routers do not support NTB-16. The previous generations of Huawei devices are also use NTB-32 by default.
Also this patch enables NTB-32 by default for Huawei devices.
During the 2019 ValdikSS made five attempts to contact Huawei to add the NTB-16 support to their router firmware, but they were unsuccessful.
Stable-dep-of: 7e01c7f7046e ("net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize")
--- drivers/net/usb/cdc_ncm.c | 415 ++++++++++++++++++++++++++++++--------- drivers/net/usb/huawei_cdc_ncm.c | 8 include/linux/usb/cdc_ncm.h | 15 + 3 files changed, 342 insertions(+), 96 deletions(-)
drivers/net/usb/cdc_ncm.c +326 -89
@@ -175,7 +175,11 @@ static u32 cdc_ncm_check_tx_max(struct uu32 val, max, min;/* clamp new_tx to sane values */ - min = ctx->max_datagram_size + ctx->max_ndp_size +sizeof (struct usb_cdc_ncm_nth16 ); +if (ctx->is_ndp16) + min = ctx->max_datagram_size + ctx->max_ndp_size +sizeof (struct usb_cdc_ncm_nth16 ); +else + min = ctx->max_datagram_size + ctx->max_ndp_size +sizeof (struct usb_cdc_ncm_nth32 ); + max =min_t (u32,CDC_NCM_NTB_MAX_SIZE_TX ,le32_to_cpu (ctx->ncm_parm.dwNtbOutMaxSize));if (max ==0 ) max =CDC_NCM_NTB_MAX_SIZE_TX ;/* dwNtbOutMaxSize not set */
@@ -309,10 +313,17 @@ static ssize_t ndp_to_end_store(struct dif (enable == (ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END ))return len; -if (enable && !ctx->delayed_ndp16) { - ctx->delayed_ndp16 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); -if (!ctx->delayed_ndp16) -return -ENOMEM ; +if (enable) { +if (ctx->is_ndp16 && !ctx->delayed_ndp16) { + ctx->delayed_ndp16 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); +if (!ctx->delayed_ndp16) +return -ENOMEM ; + } +if (!ctx->is_ndp16 && !ctx->delayed_ndp32) { + ctx->delayed_ndp32 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); +if (!ctx->delayed_ndp32) +return -ENOMEM ; + } }/* flush pending data before changing flag */
@@ -514,6 +525,9 @@ static int cdc_ncm_init(struct usbnet *ddev_err (&dev->intf->dev,"SET_CRC_MODE failed\n" ); } +/* use ndp16 by default */ + ctx->is_ndp16 =1 ; +/* set NTB format, if both formats are supported. * * "The host shall only send this command while the NCM Data
@@ -521,14 +535,27 @@ static int cdc_ncm_init(struct usbnet *d*/ if (le16_to_cpu (ctx->ncm_parm.bmNtbFormatsSupported) &USB_CDC_NCM_NTB32_SUPPORTED ) { -dev_dbg (&dev->intf->dev,"Setting NTB format to 16-bit\n" ); - err =usbnet_write_cmd (dev,USB_CDC_SET_NTB_FORMAT , -USB_TYPE_CLASS |USB_DIR_OUT - |USB_RECIP_INTERFACE , -USB_CDC_NCM_NTB16_FORMAT , - iface_no,NULL ,0 ); -if (err <0 ) +if (ctx->drvflags &CDC_NCM_FLAG_PREFER_NTB32 ) { + ctx->is_ndp16 =0 ; +dev_dbg (&dev->intf->dev,"Setting NTB format to 32-bit\n" ); + err =usbnet_write_cmd (dev,USB_CDC_SET_NTB_FORMAT , +USB_TYPE_CLASS |USB_DIR_OUT + |USB_RECIP_INTERFACE , +USB_CDC_NCM_NTB32_FORMAT , + iface_no,NULL ,0 ); + }else { + ctx->is_ndp16 =1 ; +dev_dbg (&dev->intf->dev,"Setting NTB format to 16-bit\n" ); + err =usbnet_write_cmd (dev,USB_CDC_SET_NTB_FORMAT , +USB_TYPE_CLASS |USB_DIR_OUT + |USB_RECIP_INTERFACE , +USB_CDC_NCM_NTB16_FORMAT , + iface_no,NULL ,0 ); + } +if (err <0 ) { + ctx->is_ndp16 =1 ;dev_err (&dev->intf->dev,"SET_NTB_FORMAT failed\n" ); + } }/* set initial device values */
@@ -551,7 +578,10 @@ static int cdc_ncm_init(struct usbnet *d ctx->tx_max_datagrams =CDC_NCM_DPT_DATAGRAMS_MAX ;/* set up maximum NDP size */ - ctx->max_ndp_size =sizeof (struct usb_cdc_ncm_ndp16 ) + (ctx->tx_max_datagrams +1 ) *sizeof (struct usb_cdc_ncm_dpe16 ); +if (ctx->is_ndp16) + ctx->max_ndp_size =sizeof (struct usb_cdc_ncm_ndp16 ) + (ctx->tx_max_datagrams +1 ) *sizeof (struct usb_cdc_ncm_dpe16 ); +else + ctx->max_ndp_size =sizeof (struct usb_cdc_ncm_ndp32 ) + (ctx->tx_max_datagrams +1 ) *sizeof (struct usb_cdc_ncm_dpe32 );/* initial coalescing timer interval */ ctx->timer_interval =CDC_NCM_TIMER_INTERVAL_USEC *NSEC_PER_USEC ;
@@ -736,7 +766,10 @@ static void cdc_ncm_free(struct cdc_ncm_ ctx->tx_curr_skb =NULL ; } -kfree (ctx->delayed_ndp16); +if (ctx->is_ndp16) +kfree (ctx->delayed_ndp16); +else +kfree (ctx->delayed_ndp32);kfree (ctx); }
@@ -774,10 +807,8 @@ int cdc_ncm_bind_common(struct usbnet *du8 *buf;int len;int temp; -int err;u8 iface_no;struct usb_cdc_parsed_header hdr; -__le16 curr_ntb_format; ctx =kzalloc (sizeof (*ctx),GFP_KERNEL );if (!ctx)
@@ -882,32 +913,6 @@ int cdc_ncm_bind_common(struct usbnet *d goto error2; } -/* -* Some Huawei devices have been observed to come out of reset in NDP32 mode. -* Let's check if this is the case, and set the device to NDP16 mode again if -* needed. -*/ -if (ctx->drvflags &CDC_NCM_FLAG_RESET_NTB16 ) { - err =usbnet_read_cmd (dev,USB_CDC_GET_NTB_FORMAT , -USB_TYPE_CLASS |USB_DIR_IN |USB_RECIP_INTERFACE , -0 , iface_no, &curr_ntb_format,2 ); -if (err <0 ) { - goto error2; - } - -if (curr_ntb_format ==cpu_to_le16 (USB_CDC_NCM_NTB32_FORMAT )) { -dev_info (&intf->dev,"resetting NTB format to 16-bit" ); - err =usbnet_write_cmd (dev,USB_CDC_SET_NTB_FORMAT , -USB_TYPE_CLASS |USB_DIR_OUT - |USB_RECIP_INTERFACE , -USB_CDC_NCM_NTB16_FORMAT , - iface_no,NULL ,0 ); - -if (err <0 ) - goto error2; - } - } -cdc_ncm_find_endpoints (dev, ctx->data);cdc_ncm_find_endpoints (dev, ctx->control);if (!dev->in || !dev->out || !dev->status) {
@@ -932,9 +937,15 @@ int cdc_ncm_bind_common(struct usbnet *d/* Allocate the delayed NDP if needed. */ if (ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END ) { - ctx->delayed_ndp16 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); -if (!ctx->delayed_ndp16) - goto error2; +if (ctx->is_ndp16) { + ctx->delayed_ndp16 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); +if (!ctx->delayed_ndp16) + goto error2; + }else { + ctx->delayed_ndp32 =kzalloc (ctx->max_ndp_size,GFP_KERNEL ); +if (!ctx->delayed_ndp32) + goto error2; + }dev_info (&intf->dev,"NDP will be placed at end of frame for this device." ); }
@@ -1059,7 +1070,7 @@ static void cdc_ncm_align_tail(struct sk/* return a pointer to a valid struct usb_cdc_ncm_ndp16 of type sign, possibly * allocating a new one within skb */ -static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp (struct cdc_ncm_ctx *ctx,struct sk_buff *skb,__le32 sign,size_t reserve) +static struct usb_cdc_ncm_ndp16 *cdc_ncm_ndp16 (struct cdc_ncm_ctx *ctx,struct sk_buff *skb,__le32 sign,size_t reserve) {struct usb_cdc_ncm_ndp16 *ndp16 =NULL ;struct usb_cdc_ncm_nth16 *nth16 = (void *)skb->data;
@@ -1114,12 +1125,73 @@ static struct usb_cdc_ncm_ndp16 *cdc_ncmreturn ndp16; } +static struct usb_cdc_ncm_ndp32 *cdc_ncm_ndp32 (struct cdc_ncm_ctx *ctx,struct sk_buff *skb,__le32 sign,size_t reserve) +{ +struct usb_cdc_ncm_ndp32 *ndp32 =NULL ; +struct usb_cdc_ncm_nth32 *nth32 = (void *)skb->data; +size_t ndpoffset =le32_to_cpu (nth32->dwNdpIndex); + +/* If NDP should be moved to the end of the NCM package, we can't follow the +* NTH32 header as we would normally do. NDP isn't written to the SKB yet, and +* the wNdpIndex field in the header is actually not consistent with reality. It will be later. +*/ +if (ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END ) { +if (ctx->delayed_ndp32->dwSignature == sign) +return ctx->delayed_ndp32; + +/* We can only push a single NDP to the end. Return +* NULL to send what we've already got and queue this +* skb for later. +*/ +else if (ctx->delayed_ndp32->dwSignature) +return NULL ; + } + +/* follow the chain of NDPs, looking for a match */ +while (ndpoffset) { + ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb->data + ndpoffset); +if (ndp32->dwSignature == sign) +return ndp32; + ndpoffset =le32_to_cpu (ndp32->dwNextNdpIndex); + } + +/* align new NDP */ +if (!(ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END )) +cdc_ncm_align_tail (skb, ctx->tx_ndp_modulus,0 , ctx->tx_curr_size); + +/* verify that there is room for the NDP and the datagram (reserve) */ +if ((ctx->tx_curr_size - skb->len - reserve) < ctx->max_ndp_size) +return NULL ; + +/* link to it */ +if (ndp32) + ndp32->dwNextNdpIndex =cpu_to_le32 (skb->len); +else + nth32->dwNdpIndex =cpu_to_le32 (skb->len); + +/* push a new empty NDP */ +if (!(ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END )) + ndp32 =skb_put_zero (skb, ctx->max_ndp_size); +else + ndp32 = ctx->delayed_ndp32; + + ndp32->dwSignature = sign; + ndp32->wLength =cpu_to_le32 (sizeof (struct usb_cdc_ncm_ndp32 ) +sizeof (struct usb_cdc_ncm_dpe32 )); +return ndp32; +} +struct sk_buff *cdc_ncm_fill_tx_frame (struct usbnet *dev,struct sk_buff *skb,__le32 sign) {struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0 ]; -struct usb_cdc_ncm_nth16 *nth16; -struct usb_cdc_ncm_ndp16 *ndp16; +union { +struct usb_cdc_ncm_nth16 *nth16; +struct usb_cdc_ncm_nth32 *nth32; + } nth; +union { +struct usb_cdc_ncm_ndp16 *ndp16; +struct usb_cdc_ncm_ndp32 *ndp32; + } ndp;struct sk_buff *skb_out;u16 n =0 , index, ndplen;u8 ready2send =0 ;
@@ -1186,11 +1258,19 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev } ctx->tx_low_mem_val--; } -/* fill out the initial 16-bit NTB header */ - nth16 =skb_put_zero (skb_out,sizeof (struct usb_cdc_ncm_nth16 )); - nth16->dwSignature =cpu_to_le32 (USB_CDC_NCM_NTH16_SIGN ); - nth16->wHeaderLength =cpu_to_le16 (sizeof (struct usb_cdc_ncm_nth16 )); - nth16->wSequence =cpu_to_le16 (ctx->tx_seq++); +if (ctx->is_ndp16) { +/* fill out the initial 16-bit NTB header */ + nth.nth16 =skb_put_zero (skb_out,sizeof (struct usb_cdc_ncm_nth16 )); + nth.nth16->dwSignature =cpu_to_le32 (USB_CDC_NCM_NTH16_SIGN ); + nth.nth16->wHeaderLength =cpu_to_le16 (sizeof (struct usb_cdc_ncm_nth16 )); + nth.nth16->wSequence =cpu_to_le16 (ctx->tx_seq++); + }else { +/* fill out the initial 32-bit NTB header */ + nth.nth32 =skb_put_zero (skb_out,sizeof (struct usb_cdc_ncm_nth32 )); + nth.nth32->dwSignature =cpu_to_le32 (USB_CDC_NCM_NTH32_SIGN ); + nth.nth32->wHeaderLength =cpu_to_le16 (sizeof (struct usb_cdc_ncm_nth32 )); + nth.nth32->wSequence =cpu_to_le16 (ctx->tx_seq++); + }/* count total number of frames in this NTB */ ctx->tx_curr_frame_num =0 ;
@@ -1212,13 +1292,17 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev }/* get the appropriate NDP for this skb */ - ndp16 =cdc_ncm_ndp (ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder); +if (ctx->is_ndp16) + ndp.ndp16 =cdc_ncm_ndp16 (ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder); +else + ndp.ndp32 =cdc_ncm_ndp32 (ctx, skb_out, sign, skb->len + ctx->tx_modulus + ctx->tx_remainder);/* align beginning of next frame */ cdc_ncm_align_tail (skb_out, ctx->tx_modulus, ctx->tx_remainder, ctx->tx_curr_size);/* check if we had enough room left for both NDP and frame */ -if (!ndp16 || skb_out->len + skb->len + delayed_ndp_size > ctx->tx_curr_size) { +if ((ctx->is_ndp16 && !ndp.ndp16) || (!ctx->is_ndp16 && !ndp.ndp32) || + skb_out->len + skb->len + delayed_ndp_size > ctx->tx_curr_size) {if (n ==0 ) {/* won't fit, MTU problem? */ dev_kfree_skb_any (skb);
@@ -1240,13 +1324,22 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev }/* calculate frame number withing this NDP */ - ndplen =le16_to_cpu (ndp16->wLength); - index = (ndplen -sizeof (struct usb_cdc_ncm_ndp16 )) /sizeof (struct usb_cdc_ncm_dpe16 ) -1 ; +if (ctx->is_ndp16) { + ndplen =le16_to_cpu (ndp.ndp16->wLength); + index = (ndplen -sizeof (struct usb_cdc_ncm_ndp16 )) /sizeof (struct usb_cdc_ncm_dpe16 ) -1 ; + +/* OK, add this skb */ + ndp.ndp16->dpe16[index].wDatagramLength =cpu_to_le16 (skb->len); + ndp.ndp16->dpe16[index].wDatagramIndex =cpu_to_le16 (skb_out->len); + ndp.ndp16->wLength =cpu_to_le16 (ndplen +sizeof (struct usb_cdc_ncm_dpe16 )); + }else { + ndplen =le16_to_cpu (ndp.ndp32->wLength); + index = (ndplen -sizeof (struct usb_cdc_ncm_ndp32 )) /sizeof (struct usb_cdc_ncm_dpe32 ) -1 ; -/* OK, add this skb */ - ndp16->dpe16[index].wDatagramLength =cpu_to_le16 (skb->len); - ndp16->dpe16[index].wDatagramIndex =cpu_to_le16 (skb_out->len); - ndp16->wLength =cpu_to_le16 (ndplen +sizeof (struct usb_cdc_ncm_dpe16 )); + ndp.ndp32->dpe32[index].dwDatagramLength =cpu_to_le32 (skb->len); + ndp.ndp32->dpe32[index].dwDatagramIndex =cpu_to_le32 (skb_out->len); + ndp.ndp32->wLength =cpu_to_le16 (ndplen +sizeof (struct usb_cdc_ncm_dpe32 )); + }skb_put_data (skb_out, skb->data, skb->len); ctx->tx_curr_frame_payload += skb->len;/* count real tx payload data */ dev_kfree_skb_any (skb);
@@ -1293,13 +1386,22 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev/* If requested, put NDP at end of frame. */ if (ctx->drvflags &CDC_NCM_FLAG_NDP_TO_END ) { - nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; -cdc_ncm_align_tail (skb_out, ctx->tx_ndp_modulus,0 , ctx->tx_curr_size - ctx->max_ndp_size); - nth16->wNdpIndex =cpu_to_le16 (skb_out->len); -skb_put_data (skb_out, ctx->delayed_ndp16, ctx->max_ndp_size); +if (ctx->is_ndp16) { + nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; +cdc_ncm_align_tail (skb_out, ctx->tx_ndp_modulus,0 , ctx->tx_curr_size - ctx->max_ndp_size); + nth.nth16->wNdpIndex =cpu_to_le16 (skb_out->len); +skb_put_data (skb_out, ctx->delayed_ndp16, ctx->max_ndp_size); -/* Zero out delayed NDP - signature checking will naturally fail. */ - ndp16 =memset (ctx->delayed_ndp16,0 , ctx->max_ndp_size); +/* Zero out delayed NDP - signature checking will naturally fail. */ + ndp.ndp16 =memset (ctx->delayed_ndp16,0 , ctx->max_ndp_size); + }else { + nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data; +cdc_ncm_align_tail (skb_out, ctx->tx_ndp_modulus,0 , ctx->tx_curr_size - ctx->max_ndp_size); + nth.nth32->dwNdpIndex =cpu_to_le32 (skb_out->len); +skb_put_data (skb_out, ctx->delayed_ndp32, ctx->max_ndp_size); + + ndp.ndp32 =memset (ctx->delayed_ndp32,0 , ctx->max_ndp_size); + } }/* If collected data size is less or equal ctx->min_tx_pkt
@@ -1322,8 +1424,13 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev }/* set final frame length */ - nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; - nth16->wBlockLength =cpu_to_le16 (skb_out->len); +if (ctx->is_ndp16) { + nth.nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; + nth.nth16->wBlockLength =cpu_to_le16 (skb_out->len); + }else { + nth.nth32 = (struct usb_cdc_ncm_nth32 *)skb_out->data; + nth.nth32->dwBlockLength =cpu_to_le32 (skb_out->len); + }/* return skb */ ctx->tx_curr_skb =NULL ;
@@ -1406,7 +1513,12 @@ cdc_ncm_tx_fixup(struct usbnet *dev, str goto error;spin_lock_bh (&ctx->mtx); - skb_out =cdc_ncm_fill_tx_frame (dev, skb,cpu_to_le32 (USB_CDC_NCM_NDP16_NOCRC_SIGN )); + +if (ctx->is_ndp16) + skb_out =cdc_ncm_fill_tx_frame (dev, skb,cpu_to_le32 (USB_CDC_NCM_NDP16_NOCRC_SIGN )); +else + skb_out =cdc_ncm_fill_tx_frame (dev, skb,cpu_to_le32 (USB_CDC_NCM_NDP32_NOCRC_SIGN )); +spin_unlock_bh (&ctx->mtx);return skb_out;
@@ -1467,6 +1579,54 @@ error: }EXPORT_SYMBOL_GPL (cdc_ncm_rx_verify_nth16); +int cdc_ncm_rx_verify_nth32 (struct cdc_ncm_ctx *ctx,struct sk_buff *skb_in) +{ +struct usbnet *dev =netdev_priv (skb_in->dev); +struct usb_cdc_ncm_nth32 *nth32; +int len; +int ret = -EINVAL ; + +if (ctx ==NULL ) + goto error; + +if (skb_in->len < (sizeof (struct usb_cdc_ncm_nth32 ) + +sizeof (struct usb_cdc_ncm_ndp32 ))) { +netif_dbg (dev, rx_err, dev->net,"frame too short\n" ); + goto error; + } + + nth32 = (struct usb_cdc_ncm_nth32 *)skb_in->data; + +if (nth32->dwSignature !=cpu_to_le32 (USB_CDC_NCM_NTH32_SIGN )) { +netif_dbg (dev, rx_err, dev->net, +"invalid NTH32 signature <%#010x>\n" , +le32_to_cpu (nth32->dwSignature)); + goto error; + } + + len =le32_to_cpu (nth32->dwBlockLength); +if (len > ctx->rx_max) { +netif_dbg (dev, rx_err, dev->net, +"unsupported NTB block length %u/%u\n" , len, + ctx->rx_max); + goto error; + } + +if ((ctx->rx_seq +1 ) !=le16_to_cpu (nth32->wSequence) && + (ctx->rx_seq ||le16_to_cpu (nth32->wSequence)) && + !((ctx->rx_seq ==0xffff ) && !le16_to_cpu (nth32->wSequence))) { +netif_dbg (dev, rx_err, dev->net, +"sequence number glitch prev=%d curr=%d\n" , + ctx->rx_seq,le16_to_cpu (nth32->wSequence)); + } + ctx->rx_seq =le16_to_cpu (nth32->wSequence); + + ret =le32_to_cpu (nth32->dwNdpIndex); +error: +return ret; +} +EXPORT_SYMBOL_GPL (cdc_ncm_rx_verify_nth32); +/* verify NDP header and return number of datagrams, or negative error */ int cdc_ncm_rx_verify_ndp16 (struct sk_buff *skb_in,int ndpoffset) {
@@ -1503,6 +1663,42 @@ error: }EXPORT_SYMBOL_GPL (cdc_ncm_rx_verify_ndp16); +/* verify NDP header and return number of datagrams, or negative error */ +int cdc_ncm_rx_verify_ndp32 (struct sk_buff *skb_in,int ndpoffset) +{ +struct usbnet *dev =netdev_priv (skb_in->dev); +struct usb_cdc_ncm_ndp32 *ndp32; +int ret = -EINVAL ; + +if ((ndpoffset +sizeof (struct usb_cdc_ncm_ndp32 )) > skb_in->len) { +netif_dbg (dev, rx_err, dev->net,"invalid NDP offset <%u>\n" , + ndpoffset); + goto error; + } + ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset); + +if (le16_to_cpu (ndp32->wLength) <USB_CDC_NCM_NDP32_LENGTH_MIN ) { +netif_dbg (dev, rx_err, dev->net,"invalid DPT32 length <%u>\n" , +le16_to_cpu (ndp32->wLength)); + goto error; + } + + ret = ((le16_to_cpu (ndp32->wLength) - +sizeof (struct usb_cdc_ncm_ndp32 )) / +sizeof (struct usb_cdc_ncm_dpe32 )); + ret--;/* we process NDP entries except for the last one */ + +if ((sizeof (struct usb_cdc_ncm_ndp32 ) + + ret * (sizeof (struct usb_cdc_ncm_dpe32 ))) > skb_in->len) { +netif_dbg (dev, rx_err, dev->net,"Invalid nframes = %d\n" , ret); + ret = -EINVAL ; + } + +error: +return ret; +} +EXPORT_SYMBOL_GPL (cdc_ncm_rx_verify_ndp32); +int cdc_ncm_rx_fixup (struct usbnet *dev,struct sk_buff *skb_in) {struct sk_buff *skb;
@@ -1511,34 +1707,66 @@ int cdc_ncm_rx_fixup(struct usbnet *dev,int nframes;int x;int offset; -struct usb_cdc_ncm_ndp16 *ndp16; -struct usb_cdc_ncm_dpe16 *dpe16; +union { +struct usb_cdc_ncm_ndp16 *ndp16; +struct usb_cdc_ncm_ndp32 *ndp32; + } ndp; +union { +struct usb_cdc_ncm_dpe16 *dpe16; +struct usb_cdc_ncm_dpe32 *dpe32; + } dpe; +int ndpoffset;int loopcount =50 ;/* arbitrary max preventing infinite loop */ u32 payload =0 ; - ndpoffset =cdc_ncm_rx_verify_nth16 (ctx, skb_in); +if (ctx->is_ndp16) + ndpoffset =cdc_ncm_rx_verify_nth16 (ctx, skb_in); +else + ndpoffset =cdc_ncm_rx_verify_nth32 (ctx, skb_in); +if (ndpoffset <0 ) goto error; next_ndp: - nframes =cdc_ncm_rx_verify_ndp16 (skb_in, ndpoffset); -if (nframes <0 ) - goto error; +if (ctx->is_ndp16) { + nframes =cdc_ncm_rx_verify_ndp16 (skb_in, ndpoffset); +if (nframes <0 ) + goto error; - ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset); + ndp.ndp16 = (struct usb_cdc_ncm_ndp16 *)(skb_in->data + ndpoffset); -if (ndp16->dwSignature !=cpu_to_le32 (USB_CDC_NCM_NDP16_NOCRC_SIGN )) { -netif_dbg (dev, rx_err, dev->net, -"invalid DPT16 signature <%#010x>\n" , -le32_to_cpu (ndp16->dwSignature)); - goto err_ndp; - } - dpe16 = ndp16->dpe16; - -for (x =0 ; x < nframes; x++, dpe16++) { - offset =le16_to_cpu (dpe16->wDatagramIndex); - len =le16_to_cpu (dpe16->wDatagramLength); +if (ndp.ndp16->dwSignature !=cpu_to_le32 (USB_CDC_NCM_NDP16_NOCRC_SIGN )) { +netif_dbg (dev, rx_err, dev->net, +"invalid DPT16 signature <%#010x>\n" , +le32_to_cpu (ndp.ndp16->dwSignature)); + goto err_ndp; + } + dpe.dpe16 = ndp.ndp16->dpe16; + }else { + nframes =cdc_ncm_rx_verify_ndp32 (skb_in, ndpoffset); +if (nframes <0 ) + goto error; + + ndp.ndp32 = (struct usb_cdc_ncm_ndp32 *)(skb_in->data + ndpoffset); + +if (ndp.ndp32->dwSignature !=cpu_to_le32 (USB_CDC_NCM_NDP32_NOCRC_SIGN )) { +netif_dbg (dev, rx_err, dev->net, +"invalid DPT32 signature <%#010x>\n" , +le32_to_cpu (ndp.ndp32->dwSignature)); + goto err_ndp; + } + dpe.dpe32 = ndp.ndp32->dpe32; + } + +for (x =0 ; x < nframes; x++) { +if (ctx->is_ndp16) { + offset =le16_to_cpu (dpe.dpe16->wDatagramIndex); + len =le16_to_cpu (dpe.dpe16->wDatagramLength); + }else { + offset =le32_to_cpu (dpe.dpe32->dwDatagramIndex); + len =le32_to_cpu (dpe.dpe32->dwDatagramLength); + }/* * CDC NCM ch. 3.7
@@ -1569,10 +1797,19 @@ next_ndp:usbnet_skb_return (dev, skb); payload += len;/* count payload bytes in this NTB */ } + +if (ctx->is_ndp16) + dpe.dpe16++; +else + dpe.dpe32++; } err_ndp:/* are there more NDPs to process? */ - ndpoffset =le16_to_cpu (ndp16->wNextNdpIndex); +if (ctx->is_ndp16) + ndpoffset =le16_to_cpu (ndp.ndp16->wNextNdpIndex); +else + ndpoffset =le32_to_cpu (ndp.ndp32->dwNextNdpIndex); +if (ndpoffset && loopcount--) goto next_ndp;
drivers/net/usb/huawei_cdc_ncm.c +4 -4
@@ -81,11 +81,11 @@ static int huawei_cdc_ncm_bind(struct us*/ drvflags |=CDC_NCM_FLAG_NDP_TO_END ; -/* Additionally, it has been reported that some Huawei E3372H devices, with -* firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence -* needing to be set to the NTB16 one again. +/* For many Huawei devices the NTB32 mode is the default and the best mode +* they work with. Huawei E5785 and E5885 devices refuse to work in NTB16 mode at all. */ - drvflags |=CDC_NCM_FLAG_RESET_NTB16 ; + drvflags |=CDC_NCM_FLAG_PREFER_NTB32 ; + ret =cdc_ncm_bind_common (usbnet_dev, intf,1 , drvflags);if (ret) goto err;
include/linux/usb/cdc_ncm.h +12 -3
@@ -45,9 +45,12 @@#define CDC_NCM_DATA_ALTSETTING_NCM 1#define CDC_NCM_DATA_ALTSETTING_MBIM 2 -/* CDC NCM subclass 3.2.1 */ +/* CDC NCM subclass 3.3.1 */ #define USB_CDC_NCM_NDP16_LENGTH_MIN 0x10 +/* CDC NCM subclass 3.3.2 */ +#define USB_CDC_NCM_NDP32_LENGTH_MIN 0x20 +/* Maximum NTB length */ #define CDC_NCM_NTB_MAX_SIZE_TX 32768/* bytes */ #define CDC_NCM_NTB_MAX_SIZE_RX 32768/* bytes */
@@ -83,7 +86,7 @@/* Driver flags */ #define CDC_NCM_FLAG_NDP_TO_END 0x02/* NDP is placed at end of frame */ #define CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE 0x04/* Avoid altsetting toggle during init */ -#define CDC_NCM_FLAG_RESET_NTB16 0x08/* set NDP16 one more time after altsetting switch */ +#define CDC_NCM_FLAG_PREFER_NTB32 0x08/* prefer NDP32 over NDP16 */ #define cdc_ncm_comm_intf_is_mbim (x) ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \ (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE)
@@ -112,7 +115,11 @@ struct cdc_ncm_ctx {u32 timer_interval;u32 max_ndp_size; -struct usb_cdc_ncm_ndp16 *delayed_ndp16; +u8 is_ndp16; +union { +struct usb_cdc_ncm_ndp16 *delayed_ndp16; +struct usb_cdc_ncm_ndp32 *delayed_ndp32; + };u32 tx_timer_pending;u32 tx_curr_frame_num;
@@ -149,6 +156,8 @@ void cdc_ncm_unbind(struct usbnet *dev,struct sk_buff *cdc_ncm_fill_tx_frame (struct usbnet *dev,struct sk_buff *skb,__le32 sign);int cdc_ncm_rx_verify_nth16 (struct cdc_ncm_ctx *ctx,struct sk_buff *skb_in);int cdc_ncm_rx_verify_ndp16 (struct sk_buff *skb_in,int ndpoffset); +int cdc_ncm_rx_verify_nth32 (struct cdc_ncm_ctx *ctx,struct sk_buff *skb_in); +int cdc_ncm_rx_verify_ndp32 (struct sk_buff *skb_in,int ndpoffset);struct sk_buff *cdc_ncm_tx_fixup (struct usbnet *dev,struct sk_buff *skb,gfp_t flags);int cdc_ncm_rx_fixup (struct usbnet *dev,struct sk_buff *skb_in);
Greg Kroah-Hartman
maintainerPATCH 58/61 cdc_ncm: Fix the build warning
In reply to Greg Kroah-HartmanFrom: Alexander Bersenev <[email protected]>
commit 5d0ab06b63fc9c727a7bb72c81321c0114be540b upstream.
The ndp32->wLength is two bytes long, so replace cpu_to_le32 with cpu_to_le16.
--- drivers/net/usb/cdc_ncm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/usb/cdc_ncm.c +1 -1
@@ -1176,7 +1176,7 @@ static struct usb_cdc_ncm_ndp32 *cdc_ncm ndp32 = ctx->delayed_ndp32; ndp32->dwSignature = sign; - ndp32->wLength =cpu_to_le32 (sizeof (struct usb_cdc_ncm_ndp32 ) +sizeof (struct usb_cdc_ncm_dpe32 )); + ndp32->wLength =cpu_to_le16 (sizeof (struct usb_cdc_ncm_ndp32 ) +sizeof (struct usb_cdc_ncm_dpe32 ));return ndp32; }
Greg Kroah-Hartman
maintainerPATCH 59/61 net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
commit 7e01c7f7046efc2c7c192c3619db43292b98e997 upstream.
Currently in cdc_ncm_check_tx_max(), if dwNtbOutMaxSize is lower than the calculated "min" value, but greater than zero, the logic sets tx_max to dwNtbOutMaxSize. This is then used to allocate a new SKB in cdc_ncm_fill_tx_frame() where all the data is handled.
For small values of dwNtbOutMaxSize the memory allocated during alloc_skb(dwNtbOutMaxSize, GFP_ATOMIC) will have the same size, due to how size is aligned at alloc time:
size = SKB_DATA_ALIGN(size);
size += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));Thus we hit the same bug that we tried to squash with
commit 2be6d4d16a084 ("net: cdc_ncm: Allow for dwNtbOutMaxSize to be unset or zero")
Low values of dwNtbOutMaxSize do not cause an issue presently because at alloc_skb() time more memory (512b) is allocated than required for the SKB headers alone (320b), leaving some space (512b - 320b = 192b) for CDC data (172b).
However, if more elements (for example 3 x u64 = [24b]) were added to one of the SKB header structs, say 'struct skb_shared_info', increasing its original size (320b [320b aligned]) to something larger (344b [384b aligned]), then suddenly the CDC data (172b) no longer fits in the spare SKB data area (512b - 384b = 128b).
Consequently the SKB bounds checking semantics fails and panics:
skbuff: skb_over_panic: text:ffffffff831f755b len:184 put:172 head:ffff88811f1c6c00 data:ffff88811f1c6c00 tail:0xb8 end:0x80 dev:<NULL>
------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:113! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 57 Comm: kworker/0:2 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 Workqueue: mld mld_ifc_work RIP: 0010:skb_panic net/core/skbuff.c:113 [inline] RIP: 0010:skb_over_panic+0x14c/0x150 net/core/skbuff.c:118 [snip] Call Trace: <TASK> skb_put+0x151/0x210 net/core/skbuff.c:2047 skb_put_zero include/linux/skbuff.h:2422 [inline] cdc_ncm_ndp16 drivers/net/usb/cdc_ncm.c:1131 [inline] cdc_ncm_fill_tx_frame+0x11ab/0x3da0 drivers/net/usb/cdc_ncm.c:1308 cdc_ncm_tx_fixup+0xa3/0x100
Deal with too low values of dwNtbOutMaxSize, clamp it in the range [USB_CDC_NCM_NTB_MIN_OUT_SIZE, CDC_NCM_NTB_MAX_SIZE_TX]. We ensure enough data space is allocated to handle CDC data by making sure dwNtbOutMaxSize is not smaller than USB_CDC_NCM_NTB_MIN_OUT_SIZE.
--- drivers/net/usb/cdc_ncm.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/net/usb/cdc_ncm.c +15 -9
@@ -180,9 +180,12 @@ static u32 cdc_ncm_check_tx_max(struct uelse min = ctx->max_datagram_size + ctx->max_ndp_size +sizeof (struct usb_cdc_ncm_nth32 ); - max =min_t (u32,CDC_NCM_NTB_MAX_SIZE_TX ,le32_to_cpu (ctx->ncm_parm.dwNtbOutMaxSize)); -if (max ==0 ) +if (le32_to_cpu (ctx->ncm_parm.dwNtbOutMaxSize) ==0 ) max =CDC_NCM_NTB_MAX_SIZE_TX ;/* dwNtbOutMaxSize not set */ +else + max =clamp_t (u32,le32_to_cpu (ctx->ncm_parm.dwNtbOutMaxSize), +USB_CDC_NCM_NTB_MIN_OUT_SIZE , +CDC_NCM_NTB_MAX_SIZE_TX );/* some devices set dwNtbOutMaxSize too low for the above default */ min =min (min, max);
@@ -1231,6 +1234,9 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev* further. */ if (skb_out ==NULL ) { +/* If even the smallest allocation fails, abort. */ +if (ctx->tx_curr_size ==USB_CDC_NCM_NTB_MIN_OUT_SIZE ) + goto alloc_failed; ctx->tx_low_mem_max_cnt =min (ctx->tx_low_mem_max_cnt +1 , (unsigned )CDC_NCM_LOW_MEM_MAX_CNT ); ctx->tx_low_mem_val = ctx->tx_low_mem_max_cnt;
@@ -1249,13 +1255,8 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev skb_out =alloc_skb (ctx->tx_curr_size,GFP_ATOMIC );/* No allocation possible so we will abort */ -if (skb_out ==NULL ) { -if (skb !=NULL ) { -dev_kfree_skb_any (skb); - dev->net->stats.tx_dropped++; - } - goto exit_no_skb; - } +if (!skb_out) + goto alloc_failed; ctx->tx_low_mem_val--; }if (ctx->is_ndp16) {
@@ -1448,6 +1449,11 @@ cdc_ncm_fill_tx_frame(struct usbnet *devreturn skb_out; +alloc_failed: +if (skb) { +dev_kfree_skb_any (skb); + dev->net->stats.tx_dropped++; + } exit_no_skb:/* Start timer, if there is a remaining non-empty skb */ if (ctx->tx_curr_skb !=NULL && n >0 )
Greg Kroah-Hartman
maintainerPATCH 60/61 Fix double fget() in vhost_net_set_backend()
In reply to Greg Kroah-HartmanFrom: Al Viro <[email protected]>
commit fb4554c2232e44d595920f4d5c66cf8f7d13f9bc upstream.
Descriptor table is a shared resource; two fget() on the same descriptor may return different struct file references. get_tap_ptr_ring() is called after we'd found (and pinned) the socket we'll be using and it tries to find the private tun/tap data structures associated with it. Redoing the lookup by the same file descriptor we'd used to get the socket is racy - we need to same struct file.
Thanks to Jason for spotting a braino in the original variant of patch - I'd missed the use of fd == -1 for disabling backend, and in that case we can end up with sock == NULL and sock != oldsock.
--- drivers/vhost/net.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-)
drivers/vhost/net.c +7 -8
@@ -1047,13 +1047,9 @@ err:return ERR_PTR (r); } -static struct skb_array *get_tap_skb_array (int fd) +static struct skb_array *get_tap_skb_array (struct file *file) {struct skb_array *array; -struct file *file =fget (fd); - -if (!file) -return NULL ; array =tun_get_skb_array (file);if (!IS_ERR (array)) goto out;
@@ -1062,7 +1058,6 @@ static struct skb_array *get_tap_skb_arr goto out; array =NULL ; out: -fput (file);return array; }
@@ -1143,8 +1138,12 @@ static long vhost_net_set_backend(structvhost_net_disable_vq (n, vq); vq->private_data = sock;vhost_net_buf_unproduce (nvq); -if (index ==VHOST_NET_VQ_RX ) - nvq->rx_array =get_tap_skb_array (fd); +if (index ==VHOST_NET_VQ_RX ) { +if (sock) + nvq->rx_array =get_tap_skb_array (sock->file); +else + nvq->rx_array =NULL ; + } r =vhost_vq_init_access (vq);if (r) goto err_used;
Greg Kroah-Hartman
maintainerPATCH 61/61 wifi: rtlwifi: 8192de: correct checking of IQK reload
In reply to Greg Kroah-HartmanFrom: Ping-Ke Shih <[email protected]>
commit 93fbc1ebd978cf408ef5765e9c1630fce9a8621b upstream.
Since IQK could spend time, we make a cache of IQK result matrix that looks like iqk_matrix[channel_idx].val[x][y], and we can reload the matrix if we have made a cache. To determine a cache is made, we check iqk_matrix[channel_idx].val[0][0].
The initial commit 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines") make a mistake that checks incorrect iqk_matrix[channel_idx].val[0] that is always true, and this mistake is found by commit ee3db469dd31 ("wifi: rtlwifi: remove always-true condition pointed out by GCC 12"), so I recall the vendor driver to find fix and apply the correctness.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +4 -5
@@ -2414,11 +2414,10 @@ void rtl92d_phy_reload_iqk_setting(strucRT_TRACE (rtlpriv,COMP_SCAN ,DBG_LOUD ,"Just Read IQK Matrix reg for channel:%d....\n" , channel); -_rtl92d_phy_patha_fill_iqk_matrix (hw, true, - rtlphy->iqk_matrix[ - indexforchannel].value,0 , - (rtlphy->iqk_matrix[ - indexforchannel].value[0 ][2 ] ==0 )); +if (rtlphy->iqk_matrix[indexforchannel].value[0 ][0 ] !=0 ) +_rtl92d_phy_patha_fill_iqk_matrix (hw, true, + rtlphy->iqk_matrix[indexforchannel].value,0 , + rtlphy->iqk_matrix[indexforchannel].value[0 ][2 ] ==0 );if (IS_92D_SINGLEPHY (rtlhal->version)) {if ((rtlphy->iqk_matrix[ indexforchannel].value[0][4] != 0)
Hello Greg,
Quoted 10 lines
From: Greg Kroah-Hartman <[email protected]>
Sent: Wednesday, June 7, 2023 9:15 PMThis is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
CIP configurations built and booted okay with Linux 4.14.317-rc1 (c6b4cc5cb549):
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/893073846
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/commits/linux-4.14.y
Kind regards, Chris
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
No problems seen on aarch64.
Thanks,
Harshit
Quoted 9 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.317-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.317-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.14.317-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-4.14.y
* git commit: c6b4cc5cb5498210544f2c9b6c92148228e1aedb
* git describe: v4.14.316-62-gc6b4cc5cb549
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.316-62-gc6b4cc5cb549
## Test Regressions (compared to v4.14.316)
## Metric Regressions (compared to v4.14.316)
## Test Fixes (compared to v4.14.316)
## Metric Fixes (compared to v4.14.316)
## Test result summary
total: 55275, pass: 48369, fail: 1937, skip: 4890, xfail: 79
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 108 total, 104 passed, 4 failed
* arm64: 35 total, 31 passed, 4 failed
* i386: 21 total, 18 passed, 3 failed
* mips: 21 total, 21 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 8 total, 7 passed, 1 failed
* s390: 6 total, 5 passed, 1 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 27 total, 23 passed, 4 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-net
* kselftest-net-forwarding
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-x86
* kselftest-zram
* kunit
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-crypto
* ltp-cve
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
Build results:
total: 168 pass: 167 fail: 1 Failed builds: x86_64:tools/perf Qemu test results: total: 430 pass: 430 fail: 0
I don't know what causes the perf build failure; there has been no change. I suspect it is because I recently switched from Ubuntu 20.04 to 22.04. I don't think it is worth bothering; I'll just stop build testing perf on that branch.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.317 release. There are 61 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.317-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.14.317-rc1-gc6b4cc5cb549
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon