5.4.268-rc1 review
Greg Kroah-Hartman
maintainerPATCH 1/194 f2fs: explicitly null-terminate the xattr list
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream.
When setting an xattr, explicitly null-terminate the xattr list. This eliminates the fragile assumption that the unused xattr space is always zeroed.
--- fs/f2fs/xattr.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/f2fs/xattr.c +6 -0
@@ -722,6 +722,12 @@ static int __f2fs_setxattr(struct inodememcpy (pval, value, size); last->e_value_size =cpu_to_le16 (size); new_hsize += newsize; +/* +* Explicitly add the null terminator. The unused xattr space +* is supposed to always be zeroed, which would make this +* unnecessary, but don't depend on that. +*/ + *(u32 *)((u8 *)last + newsize) =0 ; } error =write_all_xattrs (inode, new_hsize, base_addr, ipage);
Greg Kroah-Hartman
maintainerPATCH 2/194 pinctrl: lochnagar: Dont build on MIPS
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <[email protected]>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes with some register naming in the driver. Since there is currently no case for running this driver on MIPS devices simply cut off the build of this driver on MIPS.
--- drivers/pinctrl/cirrus/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/cirrus/Kconfig +2 -1
@@ -1,7 +1,8 @@ # SPDX-License-Identifier: GPL-2.0-only config PINCTRL_LOCHNAGAR tristate "Cirrus Logic Lochnagar pinctrl driver" - depends on MFD_LOCHNAGAR + # Avoid clash caused by MIPS defining RST, which is used in the driver + depends on MFD_LOCHNAGAR && !MIPS select GPIOLIB select PINMUX select PINCONF
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainercover 5.4.268-rc1 review
This is the start of the stable review cycle for the 5.4.268 release. There are 194 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.268-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.268-rc1
Tiezhu Yang <[email protected]>
perf top: Skip side-band event setup if HAVE_LIBBPF_SUPPORT is not set
Marek Szyprowski <[email protected]>
i2c: s3c24xx: fix transferring more than one message in polling mode
Marek Szyprowski <[email protected]>
i2c: s3c24xx: fix read transfers in polling mode
Amit Cohen <[email protected]>
mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
Christophe JAILLET <[email protected]>
kdb: Fix a potential buffer overflow in kdb_local()
Daniel Thompson <[email protected]>
kdb: Censor attempts to set PROMPT without ENABLE_MEM_READ
Fedor Pchelkin <[email protected]>
ipvs: avoid stat macros calls from preemptible context
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: skip dead set elements in netlink dump
Kunwu Chan <[email protected]>
net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
Nikita Yushchenko <[email protected]>
net: ravb: Fix dma_addr_t truncation in error case
Claudiu Beznea <[email protected]>
net: phy: micrel: populate .soft_reset for KSZ9131
Lin Ma <[email protected]>
net: qualcomm: rmnet: fix global oob in rmnet_policy
Niklas Schnelle <[email protected]>
s390/pci: fix max size calculation in zpci_memcpy_toio()
Siddharth Vadapalli <[email protected]>
PCI: keystone: Fix race condition when initializing PHYs
Maurizio Lombardi <[email protected]>
nvmet-tcp: Fix the H2C expected PDU len calculation
Christoph Niedermaier <[email protected]>
serial: imx: Correct clock error message in function probe()
Fedor Pchelkin <[email protected]>
apparmor: avoid crash when parsed profile name is empty
Ian Rogers <[email protected]>
perf env: Avoid recursively taking env->bpf_progs.lock
Arnaldo Carvalho de Melo <[email protected]>
perf bpf: Decouple creating the evlist from adding the SB event
Arnaldo Carvalho de Melo <[email protected]>
perf top: Move sb_evlist to 'struct perf_top'
Arnaldo Carvalho de Melo <[email protected]>
perf record: Move sb_evlist to 'struct record'
Jiri Olsa <[email protected]>
perf env: Add perf_env__numa_node()
Maurizio Lombardi <[email protected]>
nvmet-tcp: fix a crash in nvmet_req_complete()
Maurizio Lombardi <[email protected]>
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
Namhyung Kim <[email protected]>
perf genelf: Set ELF program header addresses properly
Sakari Ailus <[email protected]>
software node: Let args be NULL in software_node_get_reference_args
Sakari Ailus <[email protected]>
acpi: property: Let args be NULL in __acpi_node_get_property_reference
Martijn Coenen <[email protected]>
binder: print warnings when detecting oneway spamming.
Uwe Kleine-König <[email protected]>
serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
Christophe JAILLET <[email protected]>
MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
Christophe JAILLET <[email protected]>
MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
Serge Semin <[email protected]>
mips: Fix incorrect max_low_pfn adjustment
Jason Gerecke <[email protected]>
HID: wacom: Correct behavior when processing some confidence == false touches
Kirill A. Shutemov <[email protected]>
x86/kvm: Do not try to disable kvmclock if it was not enabled
David Lin <[email protected]>
wifi: mwifiex: configure BSSID consistently when starting AP
Ilpo Järvinen <[email protected]>
wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
Ilpo Järvinen <[email protected]>
wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
Stefan Berger <[email protected]>
rootfs: Fix support for rootfstype= when root= is given
Nam Cao <[email protected]>
fbdev: flush deferred work in fb_deferred_io_fsync()
Takashi Iwai <[email protected]>
ALSA: oxygen: Fix right channel of capture volume mixer
Gui-Dong Han <[email protected]>
usb: mon: Fix atomicity violation in mon_bin_vma_fault
RD Babiera <[email protected]>
usb: typec: class: fix typec_altmode_put_partner to put plugs
Heikki Krogerus <[email protected]>
Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
Xu Yang <[email protected]>
usb: chipidea: wait controller resume finished for wakeup irq
Thinh Nguyen <[email protected]>
Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
Thinh Nguyen <[email protected]>
Revert "usb: dwc3: Soft reset phy on probe for host"
Uttkarsh Aggarwal <[email protected]>
usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
Xu Yang <[email protected]>
usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
Heiko Carstens <[email protected]>
tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
Carlos Llamas <[email protected]>
binder: fix unused alloc->free_async_space
Carlos Llamas <[email protected]>
binder: fix race between mmput() and do_exit()
Jan Beulich <[email protected]>
xen-netback: don't produce zero-size SKB frags
Greg Kroah-Hartman <[email protected]>
Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
Hans de Goede <[email protected]>
Input: atkbd - use ab83 as id when skipping the getid command
Carlos Llamas <[email protected]>
binder: fix use-after-free in shinker's callback
Carlos Llamas <[email protected]>
binder: fix async space check for 0-sized buffers
Geert Uytterhoeven <[email protected]>
of: unittest: Fix of_count_phandle_with_args() expected value message
Christian A. Ehrhardt <[email protected]>
of: Fix double free in of_parse_phandle_with_args_map
Peter Robinson <[email protected]>
mmc: sdhci_omap: Fix TI SoC dependencies
Su Hui <[email protected]>
clk: si5341: fix an error code problem in si5341_output_clk_set_rate
Stefan Wahren <[email protected]>
watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
Jerry Hoemann <[email protected]>
watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
Curtis Klein <[email protected]>
watchdog: set cdev owner before adding
Jay Buddhabhatti <[email protected]>
drivers: clk: zynqmp: calculate closest mux rate
Zhipeng Lu <[email protected]>
gpu/drm/radeon: fix two memleaks in radeon_vm_init
Zhipeng Lu <[email protected]>
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
Zhipeng Lu <[email protected]>
drm/amd/pm: fix a double-free in si_dpm_init
Alex Deucher <[email protected]>
drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
Dan Carpenter <[email protected]>
media: dvbdev: drop refcount on error path in dvb_device_open()
Zhipeng Lu <[email protected]>
media: cx231xx: fix a memleak in cx231xx_init_isoc
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: Fix return value on error case
Zhipeng Lu <[email protected]>
drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
Zhipeng Lu <[email protected]>
drm/radeon/dpm: fix a memleak in sumo_parse_power_table
Yang Yingliang <[email protected]>
drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
Dmitry Baryshkov <[email protected]>
drm/drv: propagate errors from drm_modeset_register_all()
Konrad Dybcio <[email protected]>
drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
Dmitry Baryshkov <[email protected]>
drm/msm/mdp4: flush vblank event on disable
Linus Walleij <[email protected]>
ASoC: cs35l34: Fix GPIO name and drop legacy include
Linus Walleij <[email protected]>
ASoC: cs35l33: Fix GPIO name and drop legacy include
Nikita Zhandarovich <[email protected]>
drm/radeon: check return value of radeon_ring_lock()
Nikita Zhandarovich <[email protected]>
drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
Nikita Zhandarovich <[email protected]>
drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
Chao Yu <[email protected]>
f2fs: fix to avoid dirent corruption
Dario Binacchi <[email protected]>
drm/bridge: Fix typo in post_disable() description
Ricardo B. Marliere <[email protected]>
media: pvrusb2: fix use after free on context disconnection
Leon Romanovsky <[email protected]>
RDMA/usnic: Silence uninitialized symbol smatch warnings
Arnd Bergmann <[email protected]>
ARM: davinci: always select CONFIG_CPU_ARM926T
Eric Dumazet <[email protected]>
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
Francesco Dolcini <[email protected]>
Bluetooth: btmtkuart: fix recv_buf() return value
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
Florian Westphal <[email protected]>
netfilter: nf_tables: mark newset as dead on transaction abort
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
Colin Ian King <[email protected]>
rtlwifi: rtl8192de: make arrays static const, makes object smaller
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
Su Hui <[email protected]>
wifi: rtlwifi: add calculate_bit_shift()
Joakim Zhang <[email protected]>
dma-mapping: clear dev->dma_mem to NULL after freeing it
Arseniy Krasnov <[email protected]>
virtio/vsock: fix logic which reduces credit update messages
Hangbin Liu <[email protected]>
selftests/net: fix grep checking for fib_nexthop_multiprefix
Yihang Li <[email protected]>
scsi: hisi_sas: Replace with standard error code return value
Krzysztof Kozlowski <[email protected]>
arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
Artem Chernyshev <[email protected]>
scsi: fnic: Return error if vmalloc() failed
Su Hui <[email protected]>
wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
Joe Perches <[email protected]>
rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift
Christophe JAILLET <[email protected]>
firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
Peter Delevoryas <[email protected]>
net/ncsi: Fix netlink major/minor version numbers
Bhaskar Chowdhury <[email protected]>
ncsi: internal.h: Fix a spello
Dmitry Baryshkov <[email protected]>
ARM: dts: qcom: apq8064: correct XOADC register address
Arnd Bergmann <[email protected]>
wifi: libertas: stop selecting wext
Florian Lehner <[email protected]>
bpf, lpm: Fix check prefixlen before walking trie
Chih-Kang Chang <[email protected]>
wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
Trond Myklebust <[email protected]>
NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
Benjamin Coddington <[email protected]>
blocklayoutdriver: Fix reference leak of pnfs_device_node
Chengming Zhou <[email protected]>
crypto: scomp - fix req->dst buffer overflow
Ovidiu Panait <[email protected]>
crypto: sahara - do not resize req->src when doing hash operations
Ovidiu Panait <[email protected]>
crypto: sahara - fix processing hash requests with req->nbytes < sg->length
Ovidiu Panait <[email protected]>
crypto: sahara - improve error handling in sahara_sha_process()
Ovidiu Panait <[email protected]>
crypto: sahara - fix wait_for_completion_timeout() error handling
Ovidiu Panait <[email protected]>
crypto: sahara - fix ahash reqsize
wangyangxin <[email protected]>
crypto: virtio - Wait for tasklet to complete on device remove
Osama Muhammad <[email protected]>
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
Sergey Shtylyov <[email protected]>
pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
Ovidiu Panait <[email protected]>
crypto: sahara - fix error handling in sahara_hw_descriptor_create()
Ovidiu Panait <[email protected]>
crypto: sahara - fix processing requests with cryptlen < sg->length
Ovidiu Panait <[email protected]>
crypto: sahara - fix ahash selftest failure
Ovidiu Panait <[email protected]>
crypto: sahara - remove FLAGS_NEW_KEY logic
Herbert Xu <[email protected]>
crypto: af_alg - Disallow multiple in-flight AIO requests
Dinghao Liu <[email protected]>
crypto: ccp - fix memleak in ccp_init_dm_workarea
zhenwei pi <[email protected]>
virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
Ram Muthiah <[email protected]>
crypto: virtio - don't use 'default m'
Gonglei (Arei) <[email protected]>
crypto: virtio - Handle dataq logic with tasklet
Mickaël Salaün <[email protected]>
selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
ZhaoLong Wang <[email protected]>
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
Wolfram Sang <[email protected]>
spi: sh-msiof: Enforce fixed DTDL for R-Car H3
Gavrilov Ilia <[email protected]>
calipso: fix memory leak in netlbl_calipso_add_pass()
Zheng Yejian <[email protected]>
netlabel: remove unused parameter in netlbl_netlink_auditinfo()
Andrew Lunn <[email protected]>
net: netlabel: Fix kerneldoc warnings
Nikita Kiryushin <[email protected]>
ACPI: LPIT: Avoid u32 multiplication overflow
Nikita Kiryushin <[email protected]>
ACPI: video: check for error while searching for backlight device parent
Ronald Monthero <[email protected]>
mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
Kunwu Chan <[email protected]>
powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check in opal_powercap_init()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check in opal_event_init()
Kunwu Chan <[email protected]>
powerpc/powernv: Add a null pointer check to scom_debug_init_one()
Michael Ellerman <[email protected]>
selftests/powerpc: Fix error handling in FPU/VMX preemption tests
Nathan Lynch <[email protected]>
powerpc/pseries/memhp: Fix access beyond end of drmem array
Laurent Dufour <[email protected]>
powerpc/pseries/memhotplug: Quieten some DLPAR operations
Randy Dunlap <[email protected]>
powerpc/44x: select I2C for CURRITUCK
Masahiro Yamada <[email protected]>
powerpc: add crtsavres.o to always-y instead of extra-y
Arnd Bergmann <[email protected]>
EDAC/thunderx: Fix possible out-of-bounds string access
Colin Ian King <[email protected]>
x86/lib: Fix overflow when counting digits
James Clark <[email protected]>
coresight: etm4x: Fix width of CCITMIN field
Cameron Williams <[email protected]>
parport: parport_serial: Add Brainboxes device IDs and geometry
Cameron Williams <[email protected]>
parport: parport_serial: Add Brainboxes BAR details
Guanghui Feng <[email protected]>
uio: Fix use-after-free in uio_open
Carlos Llamas <[email protected]>
binder: fix comment on binder_alloc_new_buf() return value
Carlos Llamas <[email protected]>
binder: fix trivial typo of binder_free_buf_locked()
Carlos Llamas <[email protected]>
binder: use EPOLLERR from eventpoll.h
Hans de Goede <[email protected]>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Jani Nikula <[email protected]>
drm/crtc: fix uninitialized variable use
Stefan Wahren <[email protected]>
ARM: sun9i: smp: fix return code check of of_property_match_string
Matthew Wilcox (Oracle) <[email protected]>
ida: Fix crash in ida_free when the bitmap is empty
Luca Weiss <[email protected]>
Input: xpad - add Razer Wolverine V2 support
Vineet Gupta <[email protected]>
ARC: fix spare error
Vineeth Vijayan <[email protected]>
s390/scm: fix virtual vs physical address confusion
Esther Shimanovich <[email protected]>
Input: i8042 - add nomux quirk for Acer P459-G2-M
Hans de Goede <[email protected]>
Input: atkbd - skip ATKBD_CMD_GETID in translated mode
Krzysztof Kozlowski <[email protected]>
reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
Steven Rostedt (Google) <[email protected]>
ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
Steven Rostedt (Google) <[email protected]>
tracing: Add size check when printing trace_marker output
Steven Rostedt (Google) <[email protected]>
tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
Judy Hsiao <[email protected]>
neighbour: Don't let neigh_forced_gc() disable preemption for long
Ziqi Zhao <[email protected]>
drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
Zhang Yi <[email protected]>
jbd2: correct the printing of write_flags in jbd2_write_superblock()
Weihao Li <[email protected]>
clk: rockchip: rk3128: Fix HCLK_OTG gate register
Inki Dae <[email protected]>
drm/exynos: fix a wrong error checking
Xiang Yang <[email protected]>
drm/exynos: fix a potential error pointer dereference
Keith Busch <[email protected]>
nvme: introduce helper function to get ctrl state
David Rau <[email protected]>
ASoC: da7219: Support low DC impedance headset
Thinh Tran <[email protected]>
net/tg3: fix race condition in tg3_reset_task()
Dave Airlie <[email protected]>
nouveau/tu102: flush all pdbs on vmm flush
Shuming Fan <[email protected]>
ASoC: rt5650: add mutex to avoid the jack detection failure
Maciej Strozek <[email protected]>
ASoC: cs43130: Fix incorrect frame delay configuration
Maciej Strozek <[email protected]>
ASoC: cs43130: Fix the position of const qualifier
Kamil Duljas <[email protected]>
ASoC: Intel: Skylake: mem leak in skl register function
David Lin <[email protected]>
ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
Kamil Duljas <[email protected]>
ASoC: Intel: Skylake: Fix mem leak in few functions
Vasiliy Kovalev <[email protected]>
ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
Charles Keepax <[email protected]>
pinctrl: lochnagar: Don't build on MIPS
Eric Biggers <[email protected]>
f2fs: explicitly null-terminate the xattr list
-------------
Diffstat:
Makefile | 4 +- arch/arc/kernel/signal.c | 6 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- arch/arm/mach-davinci/Kconfig | 1 + arch/arm/mach-sunxi/mc_smp.c | 4 +- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- arch/mips/alchemy/devboards/db1200.c | 2 +- arch/mips/alchemy/devboards/db1550.c | 2 +- arch/mips/kernel/setup.c | 4 +- arch/powerpc/lib/Makefile | 2 +- arch/powerpc/perf/imc-pmu.c | 6 + arch/powerpc/platforms/44x/Kconfig | 1 + arch/powerpc/platforms/powernv/opal-irqchip.c | 2 + arch/powerpc/platforms/powernv/opal-powercap.c | 6 + arch/powerpc/platforms/powernv/opal-xscom.c | 5 + arch/powerpc/platforms/pseries/hotplug-memory.c | 21 ++-- arch/s390/include/asm/pci_io.h | 32 +++--- arch/s390/pci/pci_mmio.c | 12 +- arch/x86/kernel/kvmclock.c | 12 +- arch/x86/lib/misc.c | 2 +- crypto/af_alg.c | 14 ++- crypto/scompress.c | 6 + drivers/acpi/acpi_lpit.c | 2 +- drivers/acpi/acpi_video.c | 12 +- drivers/acpi/property.c | 4 + drivers/acpi/resource.c | 7 ++ drivers/android/binder.c | 4 +- drivers/android/binder_alloc.c | 84 +++++++++++--- drivers/android/binder_alloc.h | 5 +- drivers/android/binder_alloc_selftest.c | 2 +- drivers/base/swnode.c | 3 + drivers/bluetooth/btmtkuart.c | 11 +- drivers/clk/clk-si5341.c | 4 +- drivers/clk/rockchip/clk-rk3128.c | 2 +- drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +- drivers/crypto/ccp/ccp-ops.c | 5 +- drivers/crypto/sahara.c | 127 ++++++++------------- drivers/crypto/virtio/Kconfig | 1 - drivers/crypto/virtio/virtio_crypto_common.h | 2 + drivers/crypto/virtio/virtio_crypto_core.c | 26 +++-- drivers/edac/thunderx_edac.c | 10 +- drivers/firmware/ti_sci.c | 10 +- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 +- drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +- drivers/gpu/drm/amd/amdgpu/si_dpm.c | 5 +- drivers/gpu/drm/bridge/tc358767.c | 2 +- drivers/gpu/drm/drm_crtc.c | 8 +- drivers/gpu/drm/drm_drv.c | 10 +- drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 + drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 ++ drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- drivers/gpu/drm/radeon/r100.c | 4 +- drivers/gpu/drm/radeon/r600_cs.c | 4 +- drivers/gpu/drm/radeon/radeon_display.c | 7 +- drivers/gpu/drm/radeon/radeon_vm.c | 8 +- drivers/gpu/drm/radeon/si.c | 4 + drivers/gpu/drm/radeon/sumo_dpm.c | 4 +- drivers/gpu/drm/radeon/trinity_dpm.c | 4 +- drivers/hid/wacom_wac.c | 32 +----- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- drivers/i2c/busses/i2c-s3c2410.c | 40 ++++--- drivers/infiniband/hw/mthca/mthca_cmd.c | 4 +- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- drivers/input/joystick/xpad.c | 1 + drivers/input/keyboard/atkbd.c | 50 +++++++- drivers/input/serio/i8042-x86ia64io.h | 8 ++ drivers/media/dvb-core/dvbdev.c | 2 + drivers/media/usb/cx231xx/cx231xx-core.c | 2 + drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 +- drivers/mmc/host/Kconfig | 5 +- drivers/mtd/mtd_blkdevs.c | 4 +- drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- drivers/net/dsa/vitesse-vsc73xx-core.c | 2 + drivers/net/ethernet/broadcom/tg3.c | 11 +- .../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 8 +- drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +- drivers/net/ethernet/renesas/ravb_main.c | 2 +- drivers/net/phy/micrel.c | 1 + drivers/net/wireless/marvell/libertas/Kconfig | 2 - drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 + drivers/net/wireless/marvell/mwifiex/fw.h | 1 + drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 + drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 ++ drivers/net/wireless/realtek/rtlwifi/pci.c | 79 +++---------- drivers/net/wireless/realtek/rtlwifi/pci.h | 5 - .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 20 +--- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 16 +-- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - .../net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - .../net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 66 ++++------- .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 20 +--- .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 20 +--- .../realtek/rtlwifi/rtl8723com/phy_common.c | 8 +- .../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 19 ++- drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 ++ drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +- drivers/net/xen-netback/netback.c | 44 ++++++- drivers/nvme/host/nvme.h | 5 + drivers/nvme/target/tcp.c | 20 +++- drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 +- drivers/of/unittest.c | 74 +++++++----- drivers/parport/parport_serial.c | 64 +++++++++++ drivers/pci/controller/dwc/pci-keystone.c | 9 ++ drivers/pinctrl/cirrus/Kconfig | 3 +- drivers/reset/hisilicon/hi6220_reset.c | 2 +- drivers/s390/block/scm_blk.c | 7 +- drivers/scsi/fnic/fnic_debugfs.c | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 4 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- drivers/spi/spi-sh-msiof.c | 17 +++ drivers/tty/serial/8250/8250_omap.c | 2 +- drivers/tty/serial/imx.c | 2 +- drivers/uio/uio.c | 7 +- drivers/usb/chipidea/core.c | 7 ++ drivers/usb/dwc3/core.c | 39 +------ drivers/usb/dwc3/ep0.c | 5 +- drivers/usb/mon/mon_bin.c | 7 +- drivers/usb/phy/phy-mxs-usb.c | 3 +- drivers/usb/typec/class.c | 4 +- drivers/video/fbdev/core/fb_defio.c | 6 +- drivers/watchdog/bcm2835_wdt.c | 3 +- drivers/watchdog/hpwdt.c | 2 +- drivers/watchdog/watchdog_dev.c | 3 +- fs/f2fs/namei.c | 2 +- fs/f2fs/xattr.c | 6 + fs/gfs2/rgrp.c | 2 +- fs/jbd2/journal.c | 4 +- fs/nfs/blocklayout/blocklayout.c | 2 + fs/nfs/nfs4proc.c | 3 + fs/pstore/ram_core.c | 2 +- include/crypto/if_alg.h | 3 + include/drm/drm_bridge.h | 2 +- include/net/bluetooth/hci_core.h | 1 - include/uapi/linux/virtio_crypto.h | 1 + init/do_mounts.c | 9 +- kernel/bpf/lpm_trie.c | 3 + kernel/debug/kdb/kdb_main.c | 14 ++- kernel/dma/coherent.c | 4 +- kernel/time/tick-sched.c | 5 + kernel/trace/ring_buffer.c | 6 + kernel/trace/trace.c | 6 +- kernel/trace/trace_output.c | 6 +- lib/idr.c | 2 +- lib/test_ida.c | 40 +++++++ net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_event.c | 11 +- net/core/neighbour.c | 9 +- net/ipv6/ip6_tunnel.c | 26 ++--- net/ncsi/internal.h | 9 +- net/ncsi/ncsi-netlink.c | 4 +- net/ncsi/ncsi-pkt.h | 7 +- net/ncsi/ncsi-rsp.c | 26 ++++- net/netfilter/ipvs/ip_vs_xmit.c | 4 +- net/netfilter/nf_tables_api.c | 3 +- net/netlabel/netlabel_calipso.c | 52 +++++---- net/netlabel/netlabel_cipso_v4.c | 4 +- net/netlabel/netlabel_mgmt.c | 8 +- net/netlabel/netlabel_unlabeled.c | 10 +- net/netlabel/netlabel_user.h | 4 +- net/vmw_vsock/virtio_transport_common.c | 13 ++- security/apparmor/policy_unpack.c | 4 + security/selinux/hooks.c | 7 ++ sound/pci/hda/patch_realtek.c | 10 ++ sound/pci/oxygen/oxygen_mixer.c | 2 +- sound/soc/atmel/sam9g20_wm8731.c | 61 ++++++++++ sound/soc/codecs/cs35l33.c | 4 +- sound/soc/codecs/cs35l34.c | 4 +- sound/soc/codecs/cs43130.c | 6 +- sound/soc/codecs/da7219-aad.c | 2 +- sound/soc/codecs/nau8822.c | 9 +- sound/soc/codecs/rt5645.c | 10 +- sound/soc/intel/skylake/skl-pcm.c | 9 +- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +- tools/perf/builtin-record.c | 23 +++- tools/perf/builtin-top.c | 22 +++- tools/perf/util/bpf-event.c | 11 +- tools/perf/util/bpf-event.h | 19 ++- tools/perf/util/env.c | 90 ++++++++++++--- tools/perf/util/env.h | 10 ++ tools/perf/util/evlist.c | 21 +--- tools/perf/util/evlist.h | 2 +- tools/perf/util/genelf.c | 6 +- tools/perf/util/header.c | 8 +- tools/perf/util/top.h | 2 +- .../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 52 ++++++++- .../selftests/net/fib_nexthop_multiprefix.sh | 4 +- tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +- tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 +- 193 files changed, 1335 insertions(+), 801 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 4/194 ASoC: Intel: Skylake: Fix mem leak in few functions
5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <[email protected]>
[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ]
The resources should be freed when function return error.
--- sound/soc/intel/skylake/skl-pcm.c | 4 +++- sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++- 2 files changed, 6 insertions(+), 2 deletions(-)
sound/soc/intel/skylake/skl-pcm.c +3 -1
@@ -260,8 +260,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream,snd_pcm_set_sync (substream); mconfig =skl_tplg_fe_get_cpr_module (dai, substream->stream); -if (!mconfig) +if (!mconfig) { +kfree (dma_params);return -EINVAL ; + }skl_tplg_d0i3_get (skl, mconfig->d0i3_caps);
sound/soc/intel/skylake/skl-sst-ipc.c +3 -1
@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc, reply.size = (reply.header >>32 ) &IPC_DATA_OFFSET_SZ_MASK ; buf =krealloc (reply.data, reply.size,GFP_KERNEL ); -if (!buf) +if (!buf) { +kfree (reply.data);return -ENOMEM ; + } *payload = buf; *bytes = reply.size;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 13/194 nvme: introduce helper function to get ctrl state
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <[email protected]>
[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ]
The controller state is typically written by another CPU, so reading it should ensure no optimizations are taken. This is a repeated pattern in the driver, so start with adding a convenience function that returns the controller state with READ_ONCE().
--- drivers/nvme/host/nvme.h | 5 +++++ 1 file changed, 5 insertions(+)
drivers/nvme/host/nvme.h +5 -0
@@ -292,6 +292,11 @@ struct nvme_ctrl {struct nvme_fault_inject fault_inject; }; +static inline enum nvme_ctrl_state nvme_ctrl_state (struct nvme_ctrl *ctrl) +{ +return READ_ONCE (ctrl->state); +} +enum nvme_iopolicy {NVME_IOPOLICY_NUMA ,NVME_IOPOLICY_RR ,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 14/194 drm/exynos: fix a potential error pointer dereference
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Yang <[email protected]>
[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ]
Smatch reports the warning below:drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind()
error: 'crtc' dereferencing possible ERR_PTR()
The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV), which can not be used directly. Fix this by checking the return value before using it.
--- drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/exynos/exynos_hdmi.c +2 -0
@@ -1850,6 +1850,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)return ret; crtc =exynos_drm_crtc_get_by_type (drm_dev,EXYNOS_DISPLAY_TYPE_HDMI ); +if (IS_ERR (crtc)) +return PTR_ERR (crtc); crtc->pipe_clk = &hdata->phy_clk; ret =hdmi_create_connector (encoder);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 15/194 drm/exynos: fix a wrong error checking
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inki Dae <[email protected]>
[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ]
Fix a wrong error checking in exynos_drm_dma.c module.
In the exynos_drm_register_dma function, both arm_iommu_create_mapping() and iommu_get_domain_for_dev() functions are expected to return NULL as an error.
However, the error checking is performed using the statement if(IS_ERR(mapping)), which doesn't provide a suitable error value. So check if 'mapping' is NULL, and if it is, return -ENODEV.
This issue[1] was reported by Dan.
Changelog v1:
- fix build warning.
[1] https://lore.kernel.org/all/[email protected]/
--- drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/gpu/drm/exynos/exynos_drm_dma.c +3 -5
@@ -133,18 +133,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,return 0 ;if (!priv->mapping) { -void *mapping; +void *mapping =NULL ;if (IS_ENABLED (CONFIG_ARM_DMA_USE_IOMMU )) mapping =arm_iommu_create_mapping (&platform_bus_type,EXYNOS_DEV_ADDR_START ,EXYNOS_DEV_ADDR_SIZE );else if (IS_ENABLED (CONFIG_IOMMU_DMA )) mapping =iommu_get_domain_for_dev (priv->dma_dev); -else - mapping =ERR_PTR (-ENODEV ); -if (IS_ERR (mapping)) -return PTR_ERR (mapping); +if (!mapping) +return -ENODEV ; priv->mapping = mapping; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/194 clk: rockchip: rk3128: Fix HCLK_OTG gate register
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weihao Li <[email protected]>
[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ]
The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON.
--- drivers/clk/rockchip/clk-rk3128.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3128.c +1 -1
@@ -489,7 +489,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {GATE (HCLK_I2S_2CH ,"hclk_i2s_2ch" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (7 ),2 ,GFLAGS ),GATE (0 ,"hclk_usb_peri" ,"hclk_peri" ,CLK_IGNORE_UNUSED ,RK2928_CLKGATE_CON (9 ),13 ,GFLAGS ),GATE (HCLK_HOST2 ,"hclk_host2" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (7 ),3 ,GFLAGS ), -GATE (HCLK_OTG ,"hclk_otg" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), +GATE (HCLK_OTG ,"hclk_otg" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (5 ),13 ,GFLAGS ),GATE (0 ,"hclk_peri_ahb" ,"hclk_peri" ,CLK_IGNORE_UNUSED ,RK2928_CLKGATE_CON (9 ),14 ,GFLAGS ),GATE (HCLK_SPDIF ,"hclk_spdif" ,"hclk_peri" ,0 ,RK2928_CLKGATE_CON (10 ),9 ,GFLAGS ), GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/194 jbd2: correct the printing of write_flags in jbd2_write_superblock()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <[email protected]>
[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ]
The write_flags print in the trace of jbd2_write_superblock() is not real, so move the modification before the trace.
--- fs/jbd2/journal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/jbd2/journal.c +3 -1
@@ -1355,9 +1355,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)return -EIO ; } -trace_jbd2_write_superblock (journal, write_flags);if (!(journal->j_flags &JBD2_BARRIER )) write_flags &= ~(REQ_FUA |REQ_PREFLUSH ); + +trace_jbd2_write_superblock (journal, write_flags); +if (buffer_write_io_error (bh)) {/* * Oh, dear. A previous attempt to write the journal
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/194 drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziqi Zhao <[email protected]>
[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ]
The connector_set contains uninitialized values when allocated with kmalloc_array. However, in the "out" branch, the logic assumes that any element in connector_set would be equal to NULL if failed to initialize, which causes the bug reported by Syzbot. The fix is to use an extra variable to keep track of how many connectors are initialized indeed, and use that variable to decrease any refcounts in the "out" branch.
--- drivers/gpu/drm/drm_crtc.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/drm_crtc.c +5 -4
@@ -535,8 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,struct drm_mode_set set;uint32_t __user *set_connectors_ptr;struct drm_modeset_acquire_ctx ctx; -int ret; -int i; +int ret, i, num_connectors;if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EOPNOTSUPP ;
@@ -674,6 +673,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } + num_connectors =0 ;for (i =0 ; i < crtc_req->count_connectors; i++) { connector_set[i] =NULL ; set_connectors_ptr = (uint32_t __user *)(unsigned long )crtc_req->set_connectors_ptr;
@@ -694,6 +694,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, connector->name); connector_set[i] = connector; + num_connectors++; } }
@@ -702,7 +703,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, set.y = crtc_req->y; set.mode = mode; set.connectors = connector_set; - set.num_connectors = crtc_req->count_connectors; + set.num_connectors = num_connectors; set.fb = fb;if (drm_drv_uses_atomic_modeset (dev))
@@ -715,7 +716,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,drm_framebuffer_put (fb);if (connector_set) { -for (i =0 ; i < crtc_req->count_connectors; i++) { +for (i =0 ; i < num_connectors; i++) {if (connector_set[i])drm_connector_put (connector_set[i]); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/194 neighbour: Dont let neigh_forced_gc() disable preemption for long
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judy Hsiao <[email protected]>
[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ]
We are seeing cases where neigh_cleanup_and_release() is called by neigh_forced_gc() many times in a row with preemption turned off. When running on a low powered CPU at a low CPU frequency, this has been measured to keep preemption off for ~10 ms. That's not great on a system with HZ=1000 which expects tasks to be able to schedule in with ~1ms latency.
--- net/core/neighbour.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
net/core/neighbour.c +8 -1
@@ -226,9 +226,11 @@ static int neigh_forced_gc(struct neigh_table *tbl) {int max_clean =atomic_read (&tbl->gc_entries) -READ_ONCE (tbl->gc_thresh2); +u64 tmax =ktime_get_ns () +NSEC_PER_MSEC ;unsigned long tref = jiffies -5 *HZ ;struct neighbour *n, *tmp;int shrunk =0 ; +int loop =0 ;NEIGH_CACHE_STAT_INC (tbl, forced_gc_runs);
@@ -251,11 +253,16 @@ static int neigh_forced_gc(struct neigh_table *tbl) shrunk++;if (shrunk >= max_clean)break ; +if (++loop ==16 ) { +if (ktime_get_ns () > tmax) + goto unlock; + loop =0 ; + } } }WRITE_ONCE (tbl->last_flush, jiffies); - +unlock:write_unlock_bh (&tbl->lock);return shrunk;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/194 tracing: Have large events show up as [LINE TOO BIG] instead of nothing
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ]
If a large event was added to the ring buffer that is larger than what the trace_seq can handle, it just drops the output:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234Instead, catch this case and add some context:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG]
<...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234This now emulates the same output as trace_pipe.
--- kernel/trace/trace.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
kernel/trace/trace.c +5 -1
@@ -4078,7 +4078,11 @@ static int s_show(struct seq_file *m, void *v) iter->leftover = ret; }else { -print_trace_line (iter); + ret =print_trace_line (iter); +if (ret ==TRACE_TYPE_PARTIAL_LINE ) { + iter->seq.full =0 ; +trace_seq_puts (&iter->seq,"[LINE TOO BIG]\n" ); + } ret =trace_print_seq (m, &iter->seq);/* * If we overflow the seq_file buffer, then it will
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/194 tracing: Add size check when printing trace_marker output
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ]
If for some reason the trace_marker write does not have a nul byte for the string, it will overflow the print:
trace_seq_printf(s, ": %s", field->buf);
The field->buf could be missing the nul byte. To prevent overflow, add the max size that the buf can be by using the event size and the field location.
int max = iter->ent_size - offsetof(struct print_entry, buf); trace_seq_printf(s, ": %*.s", max, field->buf);
--- kernel/trace/trace_output.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/trace/trace_output.c +4 -2
@@ -1291,11 +1291,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter, {struct print_entry *field;struct trace_seq *s = &iter->seq; +int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent);seq_print_ip_sym (s, field->ip, flags); -trace_seq_printf (s,": %s" , field->buf); +trace_seq_printf (s,": %.*s" , max, field->buf);return trace_handle_return (s); }
@@ -1304,10 +1305,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags, struct trace_event *event) {struct print_entry *field; +int max = iter->ent_size - offsetof(struct print_entry , buf);trace_assign_type (field, iter->ent); -trace_seq_printf (&iter->seq,"# %lx %s" , field->ip, field->buf); +trace_seq_printf (&iter->seq,"# %lx %.*s" , field->ip, max, field->buf);return trace_handle_return (&iter->seq); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/194 ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <[email protected]>
[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ]
As the ring buffer recording requires cmpxchg() to work, if the architecture does not support cmpxchg in NMI, then do not do any recording within an NMI.
--- kernel/trace/ring_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/trace/ring_buffer.c +6 -0
@@ -2976,6 +2976,12 @@ rb_reserve_next_event(struct ring_buffer *buffer,int nr_loops =0 ;u64 diff; +/* ring buffer does cmpxchg, make sure it is safe in NMI context */ +if (!IS_ENABLED (CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG ) && + (unlikely (in_nmi ()))) { +return NULL ; + } +rb_start_commit (cpu_buffer);#ifdef CONFIG_RING_BUFFER_ALLOW_SWAP
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/194 ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lin <[email protected]>
[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ]
This issue is reproduced when W=1 build in compiler gcc-12. The following are sparse warnings:
sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16 sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
--- sound/soc/codecs/nau8822.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/codecs/nau8822.c +6 -3
@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,struct soc_bytes_ext *params = (void *)kcontrol->private_value;int i, reg;u16 reg_val, *val; +__be16 tmp; val = (u16 *)ucontrol->value.bytes.data; reg =NAU8822_REG_EQ1 ;
@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,/* conversion of 16-bit integers between native CPU format * and big endian format */ - reg_val =cpu_to_be16 (reg_val); -memcpy (val + i, ®_val,sizeof (reg_val)); + tmp =cpu_to_be16 (reg_val); +memcpy (val + i, &tmp,sizeof (tmp)); }return 0 ;
@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,void *data;u16 *val, value;int i, reg, ret; +__be16 *tmp; data =kmemdup (ucontrol->value.bytes.data, params->max,GFP_KERNEL |GFP_DMA );
@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,/* conversion of 16-bit integers between native CPU format * and big endian format */ - value =be16_to_cpu (*(val + i)); + tmp = (__be16 *)(val + i); + value =be16_to_cpup (tmp); ret =snd_soc_component_write (component, reg + i, value);if (ret) { dev_err(component->dev,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/194 reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ]
'type' is an enum, thus cast of pointer on 64-bit compile test with W=1 causes:
hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
--- drivers/reset/hisilicon/hi6220_reset.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/reset/hisilicon/hi6220_reset.c +1 -1
@@ -104,7 +104,7 @@ static int hi6220_reset_probe(struct platform_device *pdev)if (!data)return -ENOMEM ; - type = (enum hi6220_reset_ctrl_type )of_device_get_match_data (dev); + type = (uintptr_t )of_device_get_match_data (dev); regmap =syscon_node_to_regmap (np);if (IS_ERR (regmap)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/194 Input: atkbd - skip ATKBD_CMD_GETID in translated mode
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ]
There have been multiple reports of keyboard issues on recent laptop models which can be worked around by setting i8042.dumbkbd, with the downside being this breaks the capslock LED.
It seems that these issues are caused by recent laptops getting confused by ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode.
The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2 mice/touchpads and those are never used in translated mode.
Examples of laptop models which benefit from skipping ATKBD_CMD_GETID:
* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx" models the kbd stops working for the first 2 - 5 minutes after boot (waiting for EC watchdog reset?)
* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard
* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see:
https://github.com/yescallop/atkbd-nogetid
This has been tested on:
1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not in translated mode when no keyboard is plugged in and with a ps/2 kbd a "AT Translated Set 2 keyboard" /dev/input/event# node shows up
2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard)
--- drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++--- 1 file changed, 42 insertions(+), 4 deletions(-)
drivers/input/keyboard/atkbd.c +42 -4
@@ -715,6 +715,44 @@ static void atkbd_deactivate(struct atkbd *atkbd) ps2dev->serio->phys); } +#ifdef CONFIG_X86 +static bool atkbd_is_portable_device (void ) +{ +static const char *const chassis_types[] = { +"8" ,/* Portable */ +"9" ,/* Laptop */ +"10" ,/* Notebook */ +"14" ,/* Sub-Notebook */ +"31" ,/* Convertible */ +"32" ,/* Detachable */ + }; +int i; + +for (i =0 ; i <ARRAY_SIZE (chassis_types); i++) +if (dmi_match (DMI_CHASSIS_TYPE , chassis_types[i])) +return true; + +return false; +} + +/* +* On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops +* the controller is always in translated mode. In this mode mice/touchpads will +* not work. So in this case simply assume a keyboard is connected to avoid +* confusing some laptop keyboards. +* +* Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is +* ok in translated mode, only atkbd_select_set() checks atkbd->id and in +* translated mode that is a no-op. +*/ +static bool atkbd_skip_getid (struct atkbd *atkbd) +{ +return atkbd->translated &&atkbd_is_portable_device (); +} +#else +static inline bool atkbd_skip_getid (struct atkbd *atkbd) {return false; } +#endif +/* * atkbd_probe() probes for an AT keyboard on a serio port. */
@@ -744,12 +782,12 @@ static int atkbd_probe(struct atkbd *atkbd)*/ param[0 ] = param[1 ] =0xa5 ;/* initialize with invalid values */ -if (ps2_command (ps2dev, param,ATKBD_CMD_GETID )) { +if (atkbd_skip_getid (atkbd) ||ps2_command (ps2dev, param,ATKBD_CMD_GETID )) {/* -* If the get ID command failed, we check if we can at least set the LEDs on -* the keyboard. This should work on every keyboard out there. It also turns -* the LEDs off, which we want anyway. +* If the get ID command was skipped or failed, we check if we can at least set +* the LEDs on the keyboard. This should work on every keyboard out there. +* It also turns the LEDs off, which we want anyway. */ param[0 ] =0 ;if (ps2_command (ps2dev, param,ATKBD_CMD_SETLEDS ))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/194 Input: i8042 - add nomux quirk for Acer P459-G2-M
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esther Shimanovich <[email protected]>
[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ]
After the laptop lid is opened, and the device resumes from S3 deep sleep, if the user presses a keyboard key while the screen is still black, the mouse and keyboard become unusable.
Enabling this quirk prevents this behavior from occurring.
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +8 -0
@@ -351,6 +351,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_DRITEK) }, + { +/* Acer TravelMate P459-G2-M */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Amoi M636/A737 */ .matches = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/194 s390/scm: fix virtual vs physical address confusion
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <[email protected]>
[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ]
Fix virtual vs physical address confusion (which currently are the same).
--- drivers/s390/block/scm_blk.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/s390/block/scm_blk.c +4 -3
@@ -18,6 +18,7 @@#include <linux/genhd.h> #include <linux/slab.h> #include <linux/list.h> +#include <linux/io.h> #include <asm/eadm.h> #include "scm_blk.h"
@@ -131,7 +132,7 @@ static void scm_request_done(struct scm_request *scmrq)for (i =0 ; i < nr_requests_per_io && scmrq->request[i]; i++) { msb = &scmrq->aob->msb[i]; - aidaw = msb->data_addr; + aidaw = (u64 )phys_to_virt (msb->data_addr);if ((msb->flags &MSB_FLAG_IDA ) && aidaw &&IS_ALIGNED (aidaw,PAGE_SIZE ))
@@ -196,12 +197,12 @@ static int scm_request_prepare(struct scm_request *scmrq) msb->scm_addr = scmdev->address + ((u64 )blk_rq_pos (req) <<9 ); msb->oc = (rq_data_dir (req) ==READ ) ?MSB_OC_READ :MSB_OC_WRITE ; msb->flags |=MSB_FLAG_IDA ; - msb->data_addr = (u64 ) aidaw; + msb->data_addr = (u64 )virt_to_phys (aidaw);rq_for_each_segment (bv, req, iter) {WARN_ON (bv.bv_offset); msb->blk_count += bv.bv_len >>12 ; - aidaw->data_addr = (u64 )page_address (bv.bv_page); + aidaw->data_addr =virt_to_phys (page_address (bv.bv_page)); aidaw++; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 27/194 ARC: fix spare error
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <[email protected]>
[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ]
--- arch/arc/kernel/signal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arc/kernel/signal.c +3 -3
@@ -61,7 +61,7 @@ struct rt_sigframe {unsigned int sigret_magic; }; -static int save_arcv2_regs (struct sigcontext *mctx,struct pt_regs *regs) +static int save_arcv2_regs (struct sigcontext __user *mctx,struct pt_regs *regs) {int err =0 ;#ifndef CONFIG_ISA_ARCOMPACT
@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)#else v2abi.r58 = v2abi.r59 =0 ;#endif - err =__copy_to_user (&mctx->v2abi, &v2abi,sizeof (v2abi)); + err =__copy_to_user (&mctx->v2abi, (void const *)&v2abi,sizeof (v2abi));#endif return err; } -static int restore_arcv2_regs (struct sigcontext *mctx,struct pt_regs *regs) +static int restore_arcv2_regs (struct sigcontext __user *mctx,struct pt_regs *regs) {int err =0 ;#ifndef CONFIG_ISA_ARCOMPACT
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 28/194 Input: xpad - add Razer Wolverine V2 support
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <[email protected]>
[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ]
Add the VID and PID of Razer Wolverine V2 to xpad_device.
--- drivers/input/joystick/xpad.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/joystick/xpad.c +1 -0
@@ -266,6 +266,7 @@ static const struct xpad_device { { 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, { 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE }, { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, + { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE }, { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/194 ida: Fix crash in ida_free when the bitmap is empty
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <[email protected]>
[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]
The IDA usually detects double-frees, but that detection failed to consider the case when there are no nearby IDs allocated and so we have a NULL bitmap rather than simply having a clear bit. Add some tests to the test-suite to be sure we don't inadvertently reintroduce this problem. Unfortunately they're quite noisy so include a message to disregard the warnings.
--- lib/idr.c | 2 +- lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 41 insertions(+), 1 deletion(-)
lib/idr.c +1 -1
@@ -506,7 +506,7 @@ void ida_free(struct ida *ida, unsigned int id) goto delete;xas_store (&xas,xa_mk_value (v)); }else { -if (!test_bit (bit, bitmap->bitmap)) +if (!bitmap || !test_bit (bit, bitmap->bitmap)) goto err;__clear_bit (bit, bitmap->bitmap);xas_set_mark (&xas,XA_FREE_MARK );
lib/test_ida.c +40 -0
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)IDA_BUG_ON (ida, !ida_is_empty (ida)); } +/* +* Check various situations where we attempt to free an ID we don't own. +*/ +static void ida_check_bad_free (struct ida *ida) +{ +unsigned long i; + +printk ("vvv Ignore \"not allocated\" warnings\n" ); +/* IDA is empty; all of these will fail */ +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a single value entry */ +IDA_BUG_ON (ida,ida_alloc_min (ida,3 ,GFP_KERNEL ) !=3 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a single bitmap */ +IDA_BUG_ON (ida,ida_alloc_min (ida,1023 ,GFP_KERNEL ) !=1023 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); + +/* IDA contains a tree */ +IDA_BUG_ON (ida,ida_alloc_min (ida, (1 <<20 ) -1 ,GFP_KERNEL ) != (1 <<20 ) -1 ); +ida_free (ida,0 ); +for (i =0 ; i <31 ; i++) +ida_free (ida,1 << i); +printk ("^^^ \"not allocated\" warnings over\n" ); + +ida_free (ida,3 ); +ida_free (ida,1023 ); +ida_free (ida, (1 <<20 ) -1 ); + +IDA_BUG_ON (ida, !ida_is_empty (ida)); +} +static DEFINE_IDA (ida);static int ida_checks (void )
@@ -162,6 +201,7 @@ static int ida_checks(void)ida_check_leaf (&ida,1024 *64 );ida_check_max (&ida);ida_check_conv (&ida); +ida_check_bad_free (&ida);printk ("IDA: %u of %u tests passed\n" , tests_passed, tests_run);return (tests_run != tests_passed) ?0 : -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/194 ASoC: Intel: Skylake: mem leak in skl register function
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <[email protected]>
[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ]
skl_platform_register() uses krealloc. When krealloc is fail, then previous memory is not freed. The leak is also when soc component registration failed.
--- sound/soc/intel/skylake/skl-pcm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/intel/skylake/skl-pcm.c +4 -1
@@ -1492,6 +1492,7 @@ int skl_platform_register(struct device *dev) dais =krealloc (skl->dais,sizeof (skl_fe_dai) +sizeof (skl_platform_dai),GFP_KERNEL );if (!dais) { +kfree (skl->dais); ret = -ENOMEM ; goto err; }
@@ -1504,8 +1505,10 @@ int skl_platform_register(struct device *dev) ret =devm_snd_soc_register_component (dev, &skl_component, skl->dais, num_dais); -if (ret) +if (ret) { +kfree (skl->dais);dev_err (dev,"soc component registration failed %d\n" , ret); + } err:return ret; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/194 ASoC: cs43130: Fix the position of const qualifier
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <[email protected]>
[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ]
--- sound/soc/codecs/cs43130.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/soc/codecs/cs43130.c +2 -2
@@ -1683,7 +1683,7 @@ static ssize_t cs43130_show_dc_r(struct device *dev,return cs43130_show_dc (dev, buf,HP_RIGHT ); } -static u16 const cs43130_ac_freq[CS43130_AC_FREQ ] = { +static const u16 cs43130_ac_freq[CS43130_AC_FREQ ] = {24 ,43 ,93 ,
@@ -2364,7 +2364,7 @@ static const struct regmap_config cs43130_regmap = { .use_single_write = true, }; -static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD ] = { +static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD ] = {50 ,120 , };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/194 ASoC: cs43130: Fix incorrect frame delay configuration
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <[email protected]>
[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ]
--- sound/soc/codecs/cs43130.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/cs43130.c +1 -1
@@ -578,7 +578,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,break ;case SND_SOC_DAIFMT_LEFT_J : hi_size = bitwidth_sclk; - frm_delay =2 ; + frm_delay =0 ; frm_phase =1 ;break ;case SND_SOC_DAIFMT_DSP_A :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 9/194 ASoC: rt5650: add mutex to avoid the jack detection failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <[email protected]>
[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ]
This patch adds the jd_mutex to protect the jack detection control flow. And only the headset type could check the button status.
--- sound/soc/codecs/rt5645.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/soc/codecs/rt5645.c +9 -1
@@ -421,6 +421,7 @@ struct rt5645_priv {struct regulator_bulk_data supplies[ARRAY_SIZE (rt5645_supply_names)];struct rt5645_eq_param_s *eq_param;struct timer_list btn_check_timer; +struct mutex jd_mutex;int codec_type;int sysclk;
@@ -3179,6 +3180,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_insert5645_enable_push_button_irq (component, true); } }else { +if (rt5645->en_button_func) +rt5645_enable_push_button_irq (component, false);snd_soc_dapm_disable_pin (dapm,"Mic Det Power" );snd_soc_dapm_sync (dapm); rt5645->jack_type =SND_JACK_HEADPHONE ;
@@ -3259,6 +3262,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)if (!rt5645->component)return ; +mutex_lock (&rt5645->jd_mutex); +switch (rt5645->pdata.jd_mode) {case 0 :/* Not using rt5645 JD */ if (rt5645->gpiod_hp_det) {
@@ -3283,7 +3288,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)if (!val && (rt5645->jack_type ==0 )) {/* jack in */ report =rt5645_jack_detect (rt5645->component,1 ); - }else if (!val && rt5645->jack_type !=0 ) { + }else if (!val && rt5645->jack_type ==SND_JACK_HEADSET ) {/* for push button and jack out */ btn_type =0 ;if (snd_soc_component_read32 (rt5645->component,RT5645_INT_IRQ_ST ) &0x4 ) {
@@ -3339,6 +3344,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)rt5645_jack_detect (rt5645->component,0 ); } +mutex_unlock (&rt5645->jd_mutex); +snd_soc_jack_report (rt5645->hp_jack, report,SND_JACK_HEADPHONE );snd_soc_jack_report (rt5645->mic_jack, report,SND_JACK_MICROPHONE );if (rt5645->en_button_func)
@@ -4041,6 +4048,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c, }timer_setup (&rt5645->btn_check_timer, rt5645_btn_check_callback,0 ); +mutex_init (&rt5645->jd_mutex);INIT_DELAYED_WORK (&rt5645->jack_detect_work, rt5645_jack_detect_work);INIT_DELAYED_WORK (&rt5645->rcclock_work, rt5645_rcclock_work);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/194 nouveau/tu102: flush all pdbs on vmm flush
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <[email protected]>
[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ]
This is a hack around a bug exposed with the GSP code, I'm not sure what is happening exactly, but it appears some of our flushes don't result in proper tlb invalidation for out BAR2 and we get a BAR2 fault from GSP and it all dies.
--- drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c +1 -1
@@ -32,7 +32,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth) type =0x00000001 ;/* PAGE_ALL */ if (atomic_read (&vmm->engref[NVKM_SUBDEV_BAR ])) - type |=0x00000004 ;/* HUB_ONLY */ + type |=0x00000006 ;/* HUB_ONLY | ALL PDB (hack) */ mutex_lock (&subdev->mutex);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/194 net/tg3: fix race condition in tg3_reset_task()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Tran <[email protected]>
[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ]
When an EEH error is encountered by a PCI adapter, the EEH driver modifies the PCI channel's state as shown below:
enum {
/* I/O channel is in normal state */ pci_channel_io_normal = (__force pci_channel_state_t) 1,
/* I/O to channel is blocked */ pci_channel_io_frozen = (__force pci_channel_state_t) 2,
/* PCI card is dead */
pci_channel_io_perm_failure = (__force pci_channel_state_t) 3,
};
If the same EEH error then causes the tg3 driver's transmit timeout logic to execute, the tg3_tx_timeout() function schedules a reset task via tg3_reset_task_schedule(), which may cause a race condition between the tg3 and EEH driver as both attempt to recover the HW via a reset action.
EEH driver gets error event
--> eeh_set_channel_state()
and set device to one of
error state above scheduler: tg3_reset_task() get
returned error from tg3_init_hw()
--> dev_close() shuts down the interfacetg3_io_slot_reset() andtg3_io_resume() fail to
reset/resume the device
To resolve this issue, we avoid the race condition by checking the PCI channel state in the tg3_reset_task() function and skip the tg3 driver initiated reset when the PCI channel is not in the normal state. (The driver has no access to tg3 device registers at this point and cannot even complete the reset task successfully without external assistance.) We'll leave the reset procedure to be managed by the EEH driver which calls the tg3_io_error_detected(), tg3_io_slot_reset() and tg3_io_resume() functions as appropriate.
Adding the same checking in tg3_dump_state() to avoid dumping all device registers when the PCI channel is not in the normal state.
--- drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/broadcom/tg3.c +10 -1
@@ -6460,6 +6460,14 @@ static void tg3_dump_state(struct tg3 *tp)int i;u32 *regs; +/* If it is a PCI error, all registers will be 0xffff, +* we don't dump them out, just report the error and return +*/ +if (tp->pdev->error_state != pci_channel_io_normal) { +netdev_err (tp->dev,"PCI channel ERROR!\n" ); +return ; + } + regs =kzalloc (TG3_REG_BLK_SIZE ,GFP_ATOMIC );if (!regs)return ;
@@ -11205,7 +11213,8 @@ static void tg3_reset_task(struct work_struct *work)rtnl_lock ();tg3_full_lock (tp,0 ); -if (tp->pcierr_recovery || !netif_running (tp->dev)) { +if (tp->pcierr_recovery || !netif_running (tp->dev) || + tp->pdev->error_state != pci_channel_io_normal) {tg3_flag_clear (tp,RESET_TASK_PENDING );tg3_full_unlock (tp);rtnl_unlock ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 12/194 ASoC: da7219: Support low DC impedance headset
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rau <[email protected]>
[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ]
Change the default MIC detection impedance threshold to 200ohm to support low mic DC impedance headset.
--- sound/soc/codecs/da7219-aad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/codecs/da7219-aad.c +1 -1
@@ -655,7 +655,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct snd_soc_component aad_pdata->mic_det_thr =da7219_aad_fw_mic_det_thr (component, fw_val32); else - aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS; + aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS;if (fwnode_property_read_u32 (aad_np,"dlg,jack-ins-deb" , &fw_val32) >=0 ) aad_pdata->jack_ins_deb =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/194 ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <[email protected]>
[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ]
This patch corrected the speaker and headset mic pin config to the more appropriate values.
--- sound/pci/hda/patch_realtek.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
sound/pci/hda/patch_realtek.c +10 -0
@@ -6398,6 +6398,7 @@ enum {ALC290_FIXUP_SUBWOOFER_HSJACK ,ALC269_FIXUP_THINKPAD_ACPI ,ALC269_FIXUP_DMIC_THINKPAD_ACPI , +ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ,ALC255_FIXUP_ACER_MIC_NO_PRESENCE ,ALC255_FIXUP_ASUS_MIC_NO_PRESENCE , ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -6645,6 +6646,14 @@ static const struct hda_fixup alc269_fixups[] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_U7x7_headset_mic, }, + [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x18 ,0x03a19020 },/* headset mic */ + {0x1b ,0x90170150 },/* speaker */ + { } + }, + }, [ALC269_FIXUP_AMIC] = { .type = HDA_FIXUP_PINS, .v.pins = (const struct hda_pintbl []) {
@@ -8481,6 +8490,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {SND_PCI_QUIRK (0x1d72 ,0x1901 ,"RedmiBook 14" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1945 ,"Redmi G" ,ALC256_FIXUP_ASUS_HEADSET_MIC ),SND_PCI_QUIRK (0x1d72 ,0x1947 ,"RedmiBook Air" ,ALC255_FIXUP_XIAOMI_HEADSET_MIC ), +SND_PCI_QUIRK (0x2782 ,0x0232 ,"CHUWI CoreBook XPro" ,ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO ),SND_PCI_QUIRK (0x8086 ,0x2074 ,"Intel NUC 8" ,ALC233_FIXUP_INTEL_NUC8_DMIC ),SND_PCI_QUIRK (0x8086 ,0x2080 ,"Intel NUC 8 Rugged" ,ALC256_FIXUP_INTEL_NUC8_RUGGED ), SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/194 drm/crtc: fix uninitialized variable use
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <[email protected]>
[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ]
Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc") was supposed to fix use of an uninitialized variable, but introduced another.
num_connectors is only initialized if crtc_req->count_connectors > 0, but it's used regardless. Fix it.
--- drivers/gpu/drm/drm_crtc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/gpu/drm/drm_crtc.c +1 -2
@@ -535,7 +535,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,struct drm_mode_set set;uint32_t __user *set_connectors_ptr;struct drm_modeset_acquire_ctx ctx; -int ret, i, num_connectors; +int ret, i, num_connectors =0 ;if (!drm_core_check_feature (dev,DRIVER_MODESET ))return -EOPNOTSUPP ;
@@ -673,7 +673,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data, goto out; } - num_connectors =0 ;for (i =0 ; i < crtc_req->count_connectors; i++) { connector_set[i] =NULL ; set_connectors_ptr = (uint32_t __user *)(unsigned long )crtc_req->set_connectors_ptr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/194 x86/lib: Fix overflow when counting digits
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ]
tl;dr: The num_digits() function has a theoretical overflow issue. But it doesn't affect any actual in-tree users. Fix it by using a larger type for one of the local variables.
Long version:
There is an overflow in variable m in function num_digits when val is >= 1410065408 which leads to the digit calculation loop to iterate more times than required. This results in either more digits being counted or in some cases (for example where val is 1932683193) the value of m eventually overflows to zero and the while loop spins forever).
Currently the function num_digits is currently only being used for small values of val in the SMP boot stage for digit counting on the number of cpus and NUMA nodes, so the overflow is never encountered. However it is useful to fix the overflow issue in case the function is used for other purposes in the future. (The issue was discovered while investigating the digit counting performance in various kernel helper functions rather than any real-world use-case).
The simplest fix is to make m a long long, the overhead in multiplication speed for a long long is very minor for small values of val less than 10000 on modern processors. The alternative fix is to replace the multiplication with a constant division by 10 loop (this compiles down to an multiplication and shift) without needing to make m a long long, but this is slightly slower than the fix in this commit when measured on a range of x86 processors).
[ dhansen: subject and changelog tweaks ]
--- arch/x86/lib/misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/lib/misc.c +1 -1
@@ -6,7 +6,7 @@*/ int num_digits (int val) { -int m =10 ; +long long m =10 ;int d =1 ;if (val <0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/194 EDAC/thunderx: Fix possible out-of-bounds string access
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]
Enabling -Wstringop-overflow globally exposes a warning for a common bug in the usage of strncat():
drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
1136 | strncat(msg, other, OCX_MESSAGE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
1145 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
1150 | strncat(msg, other, OCX_MESSAGE_SIZE);...
Apparently the author of this driver expected strncat() to behave the way that strlcat() does, which uses the size of the destination buffer as its third argument rather than the length of the source buffer. The result is that there is no check on the size of the allocated buffer.
Change it to strlcat().
[ bp: Trim compiler output, fixup commit message. ]
--- drivers/edac/thunderx_edac.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/edac/thunderx_edac.c +5 -5
@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)decode_register (other,OCX_OTHER_SIZE , ocx_com_errors, ctx->reg_com_int); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );for (lane =0 ; lane <OCX_RX_LANES ; lane++)if (ctx->reg_com_int &BIT (lane)) {
@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id) lane, ctx->reg_lane_int[lane], lane, ctx->reg_lane_stat11[lane]); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );decode_register (other,OCX_OTHER_SIZE , ocx_lane_errors, ctx->reg_lane_int[lane]); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE ); }if (ctx->reg_com_int &OCX_COM_INT_CE )
@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)decode_register (other,OCX_OTHER_SIZE , ocx_com_link_errors, ctx->reg_com_link_int); -strncat (msg, other,OCX_MESSAGE_SIZE ); +strlcat (msg, other,OCX_MESSAGE_SIZE );if (ctx->reg_com_link_int &OCX_COM_LINK_INT_UE )edac_device_handle_ue (ocx->edac_dev,0 ,0 , msg);
@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)decode_register (other,L2C_OTHER_SIZE , l2_errors, ctx->reg_int); -strncat (msg, other,L2C_MESSAGE_SIZE ); +strlcat (msg, other,L2C_MESSAGE_SIZE );if (ctx->reg_int & mask_ue)edac_device_handle_ue (l2c->edac_dev,0 ,0 , msg);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/194 powerpc: add crtsavres.o to always-y instead of extra-y
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ]
crtsavres.o is linked to modules. However, as explained in commit d0e628cd817f ("kbuild: doc: clarify the difference between extra-y and always-y"), 'make modules' does not build extra-y.
For example, the following command fails:
$ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules
[snip]
LD [M] arch/powerpc/platforms/cell/spufs/spufs.ko
ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory
make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1
make[2]: *** [Makefile:1844: modules] Error 2
make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2
make: *** [Makefile:234: __sub-make] Error 2--- arch/powerpc/lib/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/lib/Makefile +1 -1
@@ -35,7 +35,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o # so it is only needed for modules, and only for older linkers which # do not support --save-restore-funcs ifeq ($(call ld-ifversion, -lt, 225000000, y),y) -extra-$(CONFIG_PPC64) += crtsavres.o +always-$(CONFIG_PPC64) += crtsavres.o endif obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/194 powerpc/44x: select I2C for CURRITUCK
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ]
Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is not set). Fixes these build errors:
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system':
ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data'
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe':
ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver'
--- arch/powerpc/platforms/44x/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/44x/Kconfig +1 -0
@@ -178,6 +178,7 @@ config ISS4xx config CURRITUCK bool "IBM Currituck (476fpe) Support" depends on PPC_47x + select I2C select SWIOTLB select 476FPE select FORCE_PCI
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/194 powerpc/pseries/memhotplug: Quieten some DLPAR operations
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Dufour <[email protected]>
[ Upstream commit 20e9de85edae3a5866f29b6cce87c9ec66d62a1b ]
When attempting to remove by index a set of LMBs a lot of messages are displayed on the console, even when everything goes fine:
pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 8000002d Offlined Pages 4096
pseries-hotplug-mem: Memory at 2d0000000 was hot-removed
The 2 messages prefixed by "pseries-hotplug-mem" are not really helpful for the end user, they should be debug outputs.
In case of error, because some of the LMB's pages couldn't be offlined, the following is displayed on the console:
pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 8000003e
pseries-hotplug-mem: Failed to hot-remove memory at 3e0000000
dlpar: Could not handle DLPAR request "memory remove index 0x8000003e"
Again, the 2 messages prefixed by "pseries-hotplug-mem" are useless, and the generic DLPAR prefixed message should be enough.
These 2 first changes are mainly triggered by the changes introduced in drmgr:
https://groups.google.com/g/powerpc-utils-devel/c/Y6ef4NB3EzM/m/9cu5JHRxAQAJ
Also, when adding a bunch of LMBs, a message is displayed in the console per LMB like these ones:
pseries-hotplug-mem: Memory at 7e0000000 (drc index 8000007e) was hot-added
pseries-hotplug-mem: Memory at 7f0000000 (drc index 8000007f) was hot-added
pseries-hotplug-mem: Memory at 800000000 (drc index 80000080) was hot-added
pseries-hotplug-mem: Memory at 810000000 (drc index 80000081) was hot-added
When adding 1TB of memory and LMB size is 256MB, this leads to 4096 messages to be displayed on the console. These messages are not really helpful for the end user, so moving them to the DEBUG level.
Stable-dep-of: bd68ffce69f6 ("powerpc/pseries/memhp: Fix access beyond end of drmem array")
--- arch/powerpc/platforms/pseries/hotplug-memory.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/powerpc/platforms/pseries/hotplug-memory.c +6 -6
@@ -496,7 +496,7 @@ static int dlpar_memory_remove_by_index(u32 drc_index)int lmb_found;int rc; -pr_info ("Attempting to hot-remove LMB, drc index %x\n" , drc_index); +pr_debug ("Attempting to hot-remove LMB, drc index %x\n" , drc_index); lmb_found =0 ;for_each_drmem_lmb (lmb) {
@@ -514,10 +514,10 @@ static int dlpar_memory_remove_by_index(u32 drc_index) rc = -EINVAL ;if (rc) -pr_info ("Failed to hot-remove memory at %llx\n" , - lmb->base_addr); +pr_debug ("Failed to hot-remove memory at %llx\n" , + lmb->base_addr);else -pr_info ("Memory at %llx was hot-removed\n" , lmb->base_addr); +pr_debug ("Memory at %llx was hot-removed\n" , lmb->base_addr);return rc; }
@@ -770,8 +770,8 @@ static int dlpar_memory_add_by_count(u32 lmbs_to_add)if (!drmem_lmb_reserved (lmb))continue ; -pr_info ("Memory at %llx (drc index %x) was hot-added\n" , - lmb->base_addr, lmb->drc_index); +pr_debug ("Memory at %llx (drc index %x) was hot-added\n" , + lmb->base_addr, lmb->drc_index);drmem_remove_lmb_reservation (lmb); } rc =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/194 powerpc/pseries/memhp: Fix access beyond end of drmem array
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ]
dlpar_memory_remove_by_index() may access beyond the bounds of the drmem lmb array when the LMB lookup fails to match an entry with the given DRC index. When the search fails, the cursor is left pointing to &drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the last valid entry in the array. The debug message at the end of the function then dereferences this pointer:
pr_debug("Failed to hot-remove memory at %llx\n",
lmb->base_addr);
This was found by inspection and confirmed with KASAN:
pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234
==================================================================
BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658 Read of size 8 at addr c000000364e97fd0 by task bash/949 dump_stack_lvl+0xa4/0xfc (unreliable) print_report+0x214/0x63c kasan_report+0x140/0x2e0 __asan_load8+0xa8/0xe0 dlpar_memory+0x298/0x1658 handle_dlpar_errorlog+0x130/0x1d0 dlpar_store+0x18c/0x3e0 kobj_attr_store+0x68/0xa0 sysfs_kf_write+0xc4/0x110 kernfs_fop_write_iter+0x26c/0x390 vfs_write+0x2d4/0x4e0 ksys_write+0xac/0x1a0 system_call_exception+0x268/0x530 system_call_vectored_common+0x15c/0x2ec Allocated by task 1: kasan_save_stack+0x48/0x80 kasan_set_track+0x34/0x50 kasan_save_alloc_info+0x34/0x50 __kasan_kmalloc+0xd0/0x120 __kmalloc+0x8c/0x320 kmalloc_array.constprop.0+0x48/0x5c drmem_init+0x2a0/0x41c do_one_initcall+0xe0/0x5c0 kernel_init_freeable+0x4ec/0x5a0 kernel_init+0x30/0x1e0 ret_from_kernel_user_thread+0x14/0x1c The buggy address belongs to the object at c000000364e80000 which belongs to the cache kmalloc-128k of size 131072 The buggy address is located 0 bytes to the right of allocated 98256-byte region [c000000364e80000, c000000364e97fd0)
==================================================================
pseries-hotplug-mem: Failed to hot-remove memory at 0
Log failed lookups with a separate message and dereference the cursor only when it points to a valid entry.
--- arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/powerpc/platforms/pseries/hotplug-memory.c +5 -4
@@ -510,14 +510,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index) } } -if (!lmb_found) +if (!lmb_found) { +pr_debug ("Failed to look up LMB for drc index %x\n" , drc_index); rc = -EINVAL ; - -if (rc) + }else if (rc) {pr_debug ("Failed to hot-remove memory at %llx\n" , lmb->base_addr); -else + }else {pr_debug ("Memory at %llx was hot-removed\n" , lmb->base_addr); + }return rc; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/194 selftests/powerpc: Fix error handling in FPU/VMX preemption tests
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ]
The FPU & VMX preemption tests do not check for errors returned by the low-level asm routines, preempt_fpu() / preempt_vsx() respectively. That means any register corruption detected by the asm routines does not result in a test failure.
Fix it by returning the return value of the asm routines from the pthread child routines.
--- tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +++++---- tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++---- 2 files changed, 11 insertions(+), 8 deletions(-)
tools/testing/selftests/powerpc/math/fpu_preempt.c +5 -4
@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,int threads_starting;int running; -extern void preempt_fpu (double *darray,int *threads_starting,int *running); +extern int preempt_fpu (double *darray,int *threads_starting,int *running);void *preempt_fpu_c (void *p) { +long rc;int i; +srand (pthread_self ());for (i =0 ; i <21 ; i++) darray[i] =rand (); -/* Test failed if it ever returns */ -preempt_fpu (darray, &threads_starting, &running); + rc =preempt_fpu (darray, &threads_starting, &running); -return p; +return (void *)rc; }int test_preempt_fpu (void )
tools/testing/selftests/powerpc/math/vmx_preempt.c +6 -4
@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},int threads_starting;int running; -extern void preempt_vmx(vector int *varray, int *threads_starting, int *running); +extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);void *preempt_vmx_c (void *p) {int i, j; +long rc; +srand (pthread_self ());for (i =0 ; i <12 ; i++)for (j =0 ; j <4 ; j++) varray[i][j] =rand (); -/* Test fails if it ever returns */ -preempt_vmx (varray, &threads_starting, &running); -return p; + rc =preempt_vmx (varray, &threads_starting, &running); + +return (void *)rc; }int test_preempt_vmx (void )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/194 powerpc/powernv: Add a null pointer check to scom_debug_init_one()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
Add a null pointer check, and release 'ent' to avoid memory leaks.
--- arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/platforms/powernv/opal-xscom.c +5 -0
@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn, ent->chip = chip;snprintf (ent->name,16 ,"%08x" , chip); ent->path.data = (void *)kasprintf (GFP_KERNEL ,"%pOF" , dn); +if (!ent->path.data) { +kfree (ent); +return -ENOMEM ; + } + ent->path.size =strlen ((char *)ent->path.data); dir =debugfs_create_dir (ent->name, root);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/194 powerpc/powernv: Add a null pointer check in opal_event_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powernv/opal-irqchip.c +2 -0
@@ -278,6 +278,8 @@ int __init opal_event_init(void)else name =kasprintf (GFP_KERNEL ,"opal" ); +if (!name) +continue ;/* Install interrupt handler */ rc =request_irq (r->start, opal_interrupt, r->flags &IRQD_TRIGGER_MASK , name,NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/194 powerpc/powernv: Add a null pointer check in opal_powercap_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/platforms/powernv/opal-powercap.c +6 -0
@@ -196,6 +196,12 @@ void __init opal_powercap_init(void) j =0 ; pcaps[i].pg.name =kasprintf (GFP_KERNEL ,"%pOFn" , node); +if (!pcaps[i].pg.name) { +kfree (pcaps[i].pattrs); +kfree (pcaps[i].pg.attrs); + goto out_pcaps_pattrs; + } +if (has_min) {powercap_add_attr (min,"powercap-min" , &pcaps[i].pattrs[j]);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/194 ACPI: resource: Add another DMI match for the TongFang GMxXGxx
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit df0cced74159c79e36ce7971f0bf250673296d93 upstream.
The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work, is also sold as the Eluktronics RP-15 which does not use the standard TongFang GMxXGxx DMI board_name.
Add an entry for this laptop to the irq1_edge_low_force_override[] DMI table to make the internal keyboard functional.
--- drivers/acpi/resource.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/acpi/resource.c +7 -0
@@ -456,6 +456,13 @@ static const struct dmi_system_id asus_l }, }, { +/* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Eluktronics Inc." ), + DMI_MATCH(DMI_BOARD_NAME, "RP-15"), + }, + }, + {/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */ .matches = { DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
Greg Kroah-Hartman
maintainerPATCH 50/194 powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <[email protected]>
[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ]
kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure.
--- arch/powerpc/perf/imc-pmu.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/powerpc/perf/imc-pmu.c +6 -0
@@ -292,6 +292,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attr_group->attrs = attrs; do { ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value); + if (!ev_val_str) + continue; dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str); if (!dev_str) continue;
@@ -299,6 +301,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu) attrs[j++] = dev_str;if (pmu->events[i].scale) { ev_scale_str =kasprintf (GFP_KERNEL ,"%s.scale" , pmu->events[i].name); +if (!ev_scale_str) +continue ; dev_str =device_str_attr_create (ev_scale_str, pmu->events[i].scale);if (!dev_str)continue ;
@@ -308,6 +312,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)if (pmu->events[i].unit) { ev_unit_str =kasprintf (GFP_KERNEL ,"%s.unit" , pmu->events[i].name); +if (!ev_unit_str) +continue ; dev_str =device_str_attr_create (ev_unit_str, pmu->events[i].unit);if (!dev_str)continue ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/194 mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Monthero <[email protected]>
[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ]
Under heavy load it is likely that the controller is done with its own task but the thread unlocking the wait is not scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the controller to respond within allowable timeslice of 1 sec.
fsl,ifc-nand 7e800000.nand: Controller is not responding
[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a) [<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c) [<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c) [<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0)
--- drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/raw/fsl_ifc_nand.c +1 -1
@@ -21,7 +21,7 @@#define ERR_BYTE 0xFF/* Value returned for read bytes when read failed */ -#define IFC_TIMEOUT_MSECS 500/* Maximum number of mSecs to wait +#define IFC_TIMEOUT_MSECS 1000/* Maximum timeout to wait for IFC NAND Machine */ struct fsl_ifc_ctrl ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/194 ACPI: video: check for error while searching for backlight device parent
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ]
If acpi_get_parent() called in acpi_video_dev_register_backlight() fails, for example, because acpi_ut_acquire_mutex() fails inside acpi_get_parent), this can lead to incorrect (uninitialized) acpi_parent handle being passed to acpi_get_pci_dev() for detecting the parent pci device.
Check acpi_get_parent() result and set parent device only in case of success.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpi_video.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/acpi/acpi_video.c +6 -6
@@ -1784,12 +1784,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)return ; count++; -acpi_get_parent (device->dev->handle, &acpi_parent); - - pdev =acpi_get_pci_dev (acpi_parent); -if (pdev) { - parent = &pdev->dev; -pci_dev_put (pdev); +if (ACPI_SUCCESS (acpi_get_parent (device->dev->handle, &acpi_parent))) { + pdev =acpi_get_pci_dev (acpi_parent); +if (pdev) { + parent = &pdev->dev; +pci_dev_put (pdev); + } }memset (&props,0 ,sizeof (struct backlight_properties ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/194 ACPI: LPIT: Avoid u32 multiplication overflow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <[email protected]>
[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]
In lpit_update_residency() there is a possibility of overflow in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).
Change multiplication to mul_u32_u32().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/acpi_lpit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/acpi_lpit.c +1 -1
@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info, struct acpi_lpit_native *lpit_native) { info->frequency = lpit_native->counter_frequency ? - lpit_native->counter_frequency : tsc_khz *1000 ; + lpit_native->counter_frequency :mul_u32_u32 (tsc_khz,1000U );if (!info->frequency) info->frequency =1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/194 net: netlabel: Fix kerneldoc warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit 294ea29113104487a905d0f81c00dfd64121b3d9 ]
net/netlabel/netlabel_calipso.c:376: warning: Function parameter or member 'ops' not described in 'netlbl_calipso_ops_register'
Stable-dep-of: ec4e9d630a64 ("calipso: fix memory leak in netlbl_calipso_add_pass()")
--- net/netlabel/netlabel_calipso.c | 1 + 1 file changed, 1 insertion(+)
net/netlabel/netlabel_calipso.c +1 -0
@@ -366,6 +366,7 @@ static const struct netlbl_calipso_ops *calipso_ops;/** * netlbl_calipso_ops_register - Register the CALIPSO operations +* @ops: ops to register * * Description: * Register the CALIPSO packet engine operations.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/194 netlabel: remove unused parameter in netlbl_netlink_auditinfo()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit f7e0318a314f9271b0f0cdd4bfdc691976976d8c ]
loginuid/sessionid/secid have been read from 'current' instead of struct netlink_skb_parms, the parameter 'skb' seems no longer needed.
Stable-dep-of: ec4e9d630a64 ("calipso: fix memory leak in netlbl_calipso_add_pass()")
--- net/netlabel/netlabel_calipso.c | 4 ++-- net/netlabel/netlabel_cipso_v4.c | 4 ++-- net/netlabel/netlabel_mgmt.c | 8 ++++---- net/netlabel/netlabel_unlabeled.c | 10 +++++----- net/netlabel/netlabel_user.h | 4 +--- 5 files changed, 14 insertions(+), 16 deletions(-)
net/netlabel/netlabel_calipso.c +2 -2
@@ -105,7 +105,7 @@ static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info) !info->attrs[NLBL_CALIPSO_A_MTYPE])return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);switch (nla_get_u32 (info->attrs[NLBL_CALIPSO_A_MTYPE ])) {case CALIPSO_MAP_PASS : ret_val =netlbl_calipso_add_pass (info, &audit_info);
@@ -287,7 +287,7 @@ static int netlbl_calipso_remove(struct sk_buff *skb, struct genl_info *info)if (!info->attrs[NLBL_CALIPSO_A_DOI ])return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); cb_arg.doi =nla_get_u32 (info->attrs[NLBL_CALIPSO_A_DOI ]); cb_arg.audit_info = &audit_info; ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
net/netlabel/netlabel_cipso_v4.c +2 -2
@@ -410,7 +410,7 @@ static int netlbl_cipsov4_add(struct sk_buff *skb, struct genl_info *info) !info->attrs[NLBL_CIPSOV4_A_MTYPE])return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);switch (nla_get_u32 (info->attrs[NLBL_CIPSOV4_A_MTYPE ])) {case CIPSO_V4_MAP_TRANS : ret_val =netlbl_cipsov4_add_std (info, &audit_info);
@@ -709,7 +709,7 @@ static int netlbl_cipsov4_remove(struct sk_buff *skb, struct genl_info *info)if (!info->attrs[NLBL_CIPSOV4_A_DOI ])return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); cb_arg.doi =nla_get_u32 (info->attrs[NLBL_CIPSOV4_A_DOI ]); cb_arg.audit_info = &audit_info; ret_val = netlbl_domhsh_walk(&skip_bkt, &skip_chain,
net/netlabel/netlabel_mgmt.c +4 -4
@@ -435,7 +435,7 @@ static int netlbl_mgmt_add(struct sk_buff *skb, struct genl_info *info) (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) return -EINVAL; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);return netlbl_mgmt_add_common (info, &audit_info); }
@@ -458,7 +458,7 @@ static int netlbl_mgmt_remove(struct sk_buff *skb, struct genl_info *info)if (!info->attrs[NLBL_MGMT_A_DOMAIN ])return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); domain =nla_data (info->attrs[NLBL_MGMT_A_DOMAIN ]);return netlbl_domhsh_remove (domain,AF_UNSPEC , &audit_info);
@@ -558,7 +558,7 @@ static int netlbl_mgmt_adddef(struct sk_buff *skb, struct genl_info *info) (info->attrs[NLBL_MGMT_A_IPV6MASK] != NULL))) return -EINVAL; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);return netlbl_mgmt_add_common (info, &audit_info); }
@@ -577,7 +577,7 @@ static int netlbl_mgmt_removedef(struct sk_buff *skb, struct genl_info *info) {struct netlbl_audit audit_info; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);return netlbl_domhsh_remove_default (AF_UNSPEC , &audit_info); }
net/netlabel/netlabel_unlabeled.c +5 -5
@@ -813,7 +813,7 @@ static int netlbl_unlabel_accept(struct sk_buff *skb, struct genl_info *info)if (info->attrs[NLBL_UNLABEL_A_ACPTFLG ]) { value =nla_get_u8 (info->attrs[NLBL_UNLABEL_A_ACPTFLG ]);if (value ==1 || value ==0 ) { -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info);netlbl_unlabel_acceptflg_set (value, &audit_info);return 0 ; }
@@ -896,7 +896,7 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb, !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); ret_val =netlbl_unlabel_addrinfo_get (info, &addr, &mask, &addr_len);if (ret_val !=0 )
@@ -946,7 +946,7 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb, !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); ret_val =netlbl_unlabel_addrinfo_get (info, &addr, &mask, &addr_len);if (ret_val !=0 )
@@ -993,7 +993,7 @@ static int netlbl_unlabel_staticremove(struct sk_buff *skb, !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); ret_val =netlbl_unlabel_addrinfo_get (info, &addr, &mask, &addr_len);if (ret_val !=0 )
@@ -1033,7 +1033,7 @@ static int netlbl_unlabel_staticremovedef(struct sk_buff *skb, !info->attrs[NLBL_UNLABEL_A_IPV6MASK])))return -EINVAL ; -netlbl_netlink_auditinfo (skb, &audit_info); +netlbl_netlink_auditinfo (&audit_info); ret_val =netlbl_unlabel_addrinfo_get (info, &addr, &mask, &addr_len);if (ret_val !=0 )
net/netlabel/netlabel_user.h +1 -3
@@ -28,11 +28,9 @@/** * netlbl_netlink_auditinfo - Fetch the audit information from a NETLINK msg -* @skb: the packet * @audit_info: NetLabel audit information */ -static inline void netlbl_netlink_auditinfo (struct sk_buff *skb, -struct netlbl_audit *audit_info) +static inline void netlbl_netlink_auditinfo (struct netlbl_audit *audit_info) {security_task_getsecid (current, &audit_info->secid); audit_info->loginuid =audit_get_loginuid (current);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/194 calipso: fix memory leak in netlbl_calipso_add_pass()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <[email protected]>
[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ]
If IPv6 support is disabled at boot (ipv6.disable=1),
the calipso_init() -> netlbl_calipso_ops_register() function isn't called, and the netlbl_calipso_ops_get() function always returns NULL. In this case, the netlbl_calipso_add_pass() function allocates memory for the doi_def variable but doesn't free it with the calipso_doi_free().
BUG: memory leak
unreferenced object 0xffff888011d68180 (size 64):
comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
hex dump (first 32 bytes):
00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<...>] kmalloc include/linux/slab.h:552 [inline]
[<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
[<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
[<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
[<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
[<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
[<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
[<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
[<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
[<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
[<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
[<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
[<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
[<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
[<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
[<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
[<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with Syzkaller
--- net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++---------------- 1 file changed, 26 insertions(+), 23 deletions(-)
net/netlabel/netlabel_calipso.c +26 -23
@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = { [NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 }, }; +static const struct netlbl_calipso_ops *calipso_ops; + +/** +* netlbl_calipso_ops_register - Register the CALIPSO operations +* @ops: ops to register +* +* Description: +* Register the CALIPSO packet engine operations. +* +*/ +const struct netlbl_calipso_ops * +netlbl_calipso_ops_register (const struct netlbl_calipso_ops *ops) +{ +return xchg (&calipso_ops, ops); +} +EXPORT_SYMBOL (netlbl_calipso_ops_register); + +static const struct netlbl_calipso_ops *netlbl_calipso_ops_get (void ) +{ +return READ_ONCE (calipso_ops); +} +/* NetLabel Command Handlers */ /**
@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info,* */ static int netlbl_calipso_add (struct sk_buff *skb,struct genl_info *info) - {int ret_val = -EINVAL ;struct netlbl_audit audit_info; +const struct netlbl_calipso_ops *ops =netlbl_calipso_ops_get ();if (!info->attrs[NLBL_CALIPSO_A_DOI ] || !info->attrs[NLBL_CALIPSO_A_MTYPE ])return -EINVAL ; +if (!ops) +return -EOPNOTSUPP ; +netlbl_netlink_auditinfo (&audit_info);switch (nla_get_u32 (info->attrs[NLBL_CALIPSO_A_MTYPE ])) {case CALIPSO_MAP_PASS :
@@ -362,28 +387,6 @@ int __init netlbl_calipso_genl_init(void)return genl_register_family (&netlbl_calipso_gnl_family); } -static const struct netlbl_calipso_ops *calipso_ops; - -/** -* netlbl_calipso_ops_register - Register the CALIPSO operations -* @ops: ops to register -* -* Description: -* Register the CALIPSO packet engine operations. -* -*/ -const struct netlbl_calipso_ops * -netlbl_calipso_ops_register (const struct netlbl_calipso_ops *ops) -{ -return xchg (&calipso_ops, ops); -} -EXPORT_SYMBOL (netlbl_calipso_ops_register); - -static const struct netlbl_calipso_ops *netlbl_calipso_ops_get (void ) -{ -return READ_ONCE (calipso_ops); -} -/** * calipso_doi_add - Add a new DOI to the CALIPSO protocol engine * @doi_def: the DOI structure
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/194 spi: sh-msiof: Enforce fixed DTDL for R-Car H3
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ]
Documentation says only DTDL of 200 is allowed for this SoC.
--- drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/spi/spi-sh-msiof.c +17 -0
@@ -32,12 +32,15 @@#include <asm/unaligned.h> +#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0) +struct sh_msiof_chipdata {u32 bits_per_word_mask;u16 tx_fifo_size;u16 rx_fifo_size;u16 ctlr_flags;u16 min_div_pow; +u32 flags; };struct sh_msiof_spi_priv {
@@ -1072,6 +1075,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = { .min_div_pow = 1, }; +static const struct sh_msiof_chipdata rcar_r8a7795_data = { + .bits_per_word_mask =SPI_BPW_MASK (8 ) |SPI_BPW_MASK (16 ) | +SPI_BPW_MASK (24 ) |SPI_BPW_MASK (32 ), + .tx_fifo_size =64 , + .rx_fifo_size =64 , + .ctlr_flags =SPI_CONTROLLER_MUST_TX , + .min_div_pow =1 , + .flags =SH_MSIOF_FLAG_FIXED_DTDL_200 , +}; +static const struct of_device_id sh_msiof_match[] = { { .compatible ="renesas,sh-mobile-msiof" , .data = &sh_data }, { .compatible ="renesas,msiof-r8a7743" , .data = &rcar_gen2_data },
@@ -1082,6 +1095,7 @@ static const struct of_device_id sh_msiof_match[] = { { .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data }, { .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data }, { .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data }, + { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data }, { .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data }, { .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data }, { .compatible = "renesas,sh-msiof", .data = &sh_data }, /* Deprecated */
@@ -1317,6 +1331,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)return -ENXIO ; } +if (chipdata->flags &SH_MSIOF_FLAG_FIXED_DTDL_200 ) + info->dtdl =200 ; +if (info->mode ==MSIOF_SPI_SLAVE ) ctlr =spi_alloc_slave (&pdev->dev,sizeof (struct sh_msiof_spi_priv ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/194 mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoLong Wang <[email protected]>
[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
If both ftl.ko and gluebi.ko are loaded, the notifier of ftl triggers NULL pointer dereference when trying to access ‘gluebi->desc’ in gluebi_read().
ubi_gluebi_init
ubi_register_volume_notifier
ubi_enumerate_volumes
ubi_notify_all
gluebi_notify nb->notifier_call()
gluebi_create
mtd_device_register
mtd_device_parse_register
add_mtd_device
blktrans_notify_add not->add()
ftl_add_mtd tr->add_mtd()
scan_header
mtd_read
mtd_read_oob
mtd_read_oob_std
gluebi_read mtd->read()
gluebi->desc - NULLDetailed reproduction information available at the Link [1],
In the normal case, obtain gluebi->desc in the gluebi_get_device(), and access gluebi->desc in the gluebi_read(). However, gluebi_get_device() is not executed in advance in the ftl_add_mtd() process, which leads to NULL pointer dereference.
The solution for the gluebi module is to run jffs2 on the UBI volume without considering working with ftl or mtdblock [2]. Therefore, this problem can be avoided by preventing gluebi from creating the mtdblock device after creating mtd partition of the type MTD_UBIVOLUME.
--- drivers/mtd/mtd_blkdevs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mtd/mtd_blkdevs.c +2 -2
@@ -533,7 +533,7 @@ static void blktrans_notify_add(struct mtd_info *mtd) {struct mtd_blktrans_ops *tr; -if (mtd->type ==MTD_ABSENT ) +if (mtd->type ==MTD_ABSENT || mtd->type ==MTD_UBIVOLUME )return ;list_for_each_entry (tr, &blktrans_majors, list)
@@ -576,7 +576,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)list_add (&tr->list, &blktrans_majors);mtd_for_each_device (mtd) -if (mtd->type !=MTD_ABSENT ) +if (mtd->type !=MTD_ABSENT && mtd->type !=MTD_UBIVOLUME ) tr->add_mtd (tr, mtd);mutex_unlock (&mtd_table_mutex);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/194 selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ]
The IPv6 network stack first checks the sockaddr length (-EINVAL error) before checking the family (-EAFNOSUPPORT error).
This was discovered thanks to commit a549d055a22e ("selftests/landlock:
Add network tests").
--- security/selinux/hooks.c | 7 +++++++ 1 file changed, 7 insertions(+)
security/selinux/hooks.c +7 -0
@@ -4625,6 +4625,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, inreturn -EINVAL ; addr4 = (struct sockaddr_in *)address;if (family_sa ==AF_UNSPEC ) { +if (family ==PF_INET6 ) { +/* Length check from inet6_bind_sk() */ +if (addrlen <SIN6_LEN_RFC2133 ) +return -EINVAL ; +/* Family check from __inet6_bind() */ + goto err_af; + }/* see __inet_bind(), we only want to allow * AF_UNSPEC if the address is INADDR_ANY */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/194 binder: use EPOLLERR from eventpoll.h
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream.
Use EPOLLERR instead of POLLERR to make sure it is cast to the correct __poll_t type. This fixes the following sparse issue:
drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
drivers/android/binder.c:5030:24: expected restricted __poll_t
drivers/android/binder.c:5030:24: got int
--- drivers/android/binder.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder.c +1 -1
@@ -5177,7 +5177,7 @@ static __poll_t binder_poll(struct file thread =binder_get_thread (proc);if (!thread) -return POLLERR ; +return EPOLLERR ;binder_inner_proc_lock (thread->proc); thread->looper |=BINDER_LOOPER_STATE_POLL ;
Greg Kroah-Hartman
maintainerPATCH 60/194 crypto: virtio - Handle dataq logic with tasklet
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gonglei (Arei) <[email protected]>
[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ]
Doing ipsec produces a spinlock recursion warning.
This is due to crypto_finalize_request() being called in the upper half. Move virtual data queue processing of virtio-crypto driver to tasklet.
--- drivers/crypto/virtio/virtio_crypto_common.h | 2 ++ drivers/crypto/virtio/virtio_crypto_core.c | 23 +++++++++++--------- 2 files changed, 15 insertions(+), 10 deletions(-)
drivers/crypto/virtio/virtio_crypto_common.h +2 -0
@@ -10,6 +10,7 @@#include <linux/virtio.h> #include <linux/crypto.h> #include <linux/spinlock.h> +#include <linux/interrupt.h> #include <crypto/aead.h> #include <crypto/aes.h> #include <crypto/engine.h>
@@ -27,6 +28,7 @@ struct data_queue {char name[32 ];struct crypto_engine *engine; +struct tasklet_struct done_task; };struct virtio_crypto {
drivers/crypto/virtio/virtio_crypto_core.c +13 -10
@@ -22,27 +22,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req) } } -static void virtcrypto_dataq_callback (struct virtqueue *vq) +static void virtcrypto_done_task (unsigned long data) { -struct virtio_crypto *vcrypto = vq->vdev->priv; +struct data_queue *data_vq = (struct data_queue *)data; +struct virtqueue *vq = data_vq->vq;struct virtio_crypto_request *vc_req; -unsigned long flags;unsigned int len; -unsigned int qid = vq->index; -spin_lock_irqsave (&vcrypto->data_vq[qid].lock, flags);do {virtqueue_disable_cb (vq);while ((vc_req =virtqueue_get_buf (vq, &len)) !=NULL ) { -spin_unlock_irqrestore ( - &vcrypto->data_vq[qid].lock, flags);if (vc_req->alg_cb) vc_req->alg_cb (vc_req, len); -spin_lock_irqsave ( - &vcrypto->data_vq[qid].lock, flags); } }while (!virtqueue_enable_cb (vq)); -spin_unlock_irqrestore (&vcrypto->data_vq[qid].lock, flags); +} + +static void virtcrypto_dataq_callback (struct virtqueue *vq) +{ +struct virtio_crypto *vcrypto = vq->vdev->priv; +struct data_queue *dq = &vcrypto->data_vq[vq->index]; + +tasklet_schedule (&dq->done_task); }static int virtcrypto_find_vqs (struct virtio_crypto *vi)
@@ -99,6 +100,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi) ret = -ENOMEM ; goto err_engine; } +tasklet_init (&vi->data_vq[i].done_task, virtcrypto_done_task, + (unsigned long )&vi->data_vq[i]); }kfree (names);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/194 crypto: virtio - dont use default m
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ram Muthiah <[email protected]>
[ Upstream commit b1a5c9a620f2b1792e51ae3961b16943e4f874f2 ]
Drivers shouldn't be enabled by default unless there is a very good reason to do so. There doesn't seem to be any such reason for the virtio crypto driver, so change it to the default of 'n'.
Stable-dep-of: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
--- drivers/crypto/virtio/Kconfig | 1 - 1 file changed, 1 deletion(-)
drivers/crypto/virtio/Kconfig +0 -1
@@ -5,7 +5,6 @@ config CRYPTO_DEV_VIRTIO select CRYPTO_AEAD select CRYPTO_BLKCIPHER select CRYPTO_ENGINE - default m help This driver provides support for virtio crypto device. If you choose 'M' here, this module will be called virtio_crypto.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/194 virtio_crypto: Introduce VIRTIO_CRYPTO_NOSPC
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhenwei pi <[email protected]>
[ Upstream commit 13d640a3e9a3ac7ec694843d3d3b785e85fb8cb8 ]
Base on the lastest virtio crypto spec, define VIRTIO_CRYPTO_NOSPC.
Stable-dep-of: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
--- include/uapi/linux/virtio_crypto.h | 1 + 1 file changed, 1 insertion(+)
include/uapi/linux/virtio_crypto.h +1 -0
@@ -408,6 +408,7 @@ struct virtio_crypto_op_data_req {#define VIRTIO_CRYPTO_BADMSG 2#define VIRTIO_CRYPTO_NOTSUPP 3#define VIRTIO_CRYPTO_INVSESS 4/* Invalid session id */ +#define VIRTIO_CRYPTO_NOSPC 5/* no free session ID */ /* The accelerator hardware is ready */ #define VIRTIO_CRYPTO_S_HW_READY (1 << 0)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/194 crypto: ccp - fix memleak in ccp_init_dm_workarea
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <[email protected]>
[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ]
When dma_map_single() fails, wa->address is supposed to be freed by the callers of ccp_init_dm_workarea() through ccp_dm_free(). However, many of the call spots don't expect to have to call ccp_dm_free() on failure of ccp_init_dm_workarea(), which may lead to a memleak. Let's free wa->address in ccp_init_dm_workarea() when dma_map_single() fails.
--- drivers/crypto/ccp/ccp-ops.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/ccp/ccp-ops.c +4 -1
@@ -178,8 +178,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa, wa->dma.address =dma_map_single (wa->dev, wa->address, len, dir); -if (dma_mapping_error (wa->dev, wa->dma.address)) +if (dma_mapping_error (wa->dev, wa->dma.address)) { +kfree (wa->address); + wa->address =NULL ;return -ENOMEM ; + } wa->dma.length = len; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/194 binder: fix trivial typo of binder_free_buf_locked()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream.
Fix minor misspelling of the function in the comment section.
No functional changes in this patch.
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -662,7 +662,7 @@ void binder_alloc_free_buf(struct binder/* * We could eliminate the call to binder_alloc_clear_buf() * from binder_alloc_deferred_release() by moving this to -* binder_alloc_free_buf_locked(). However, that could +* binder_free_buf_locked(). However, that could * increase contention for the alloc mutex if clear_on_free * is used frequently for large buffers. The mutex is not * needed for correctness here.
Greg Kroah-Hartman
maintainerPATCH 35/194 binder: fix comment on binder_alloc_new_buf() return value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream.
Update the comments of binder_alloc_new_buf() to reflect that the return value of the function is now ERR_PTR(-errno) on failure.
No functional changes in this patch.
--- drivers/android/binder_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/android/binder_alloc.c +1 -1
@@ -515,7 +515,7 @@ err_alloc_buf_struct_failed:* is the sum of the three given sizes (each rounded up to * pointer-sized boundary) * -* Return: The allocated buffer or %NULL if error +* Return: The allocated buffer or %ERR_PTR(-errno) if error */ struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc, size_t data_size,
Greg Kroah-Hartman
maintainerPATCH 36/194 uio: Fix use-after-free in uio_open
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Feng <[email protected]>
commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream.
core-1 core-2
-------------------------------------------------------uio_unregister_device uio_open
idev = idr_find()device_unregister(&idev->dev)put_device(&idev->dev)uio_device_release
get_device(&idev->dev) kfree(idev) uio_free_minor(minor) uio_release put_device(&idev->dev) kfree(idev)
-------------------------------------------------------
In the core-1 uio_unregister_device(), the device_unregister will kfree idev when the idev->dev kobject ref is 1. But after core-1 device_unregister, put_device and before doing kfree, the core-2 may get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double freed.
To address this issue, we can get idev atomic & inc idev reference with minor_lock.
--- drivers/uio/uio.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/uio/uio.c +3 -4
@@ -464,13 +464,13 @@ static int uio_open(struct inode *inode,mutex_lock (&minor_lock); idev =idr_find (&uio_idr,iminor (inode)); -mutex_unlock (&minor_lock);if (!idev) { ret = -ENODEV ; +mutex_unlock (&minor_lock); goto out; } -get_device (&idev->dev); +mutex_unlock (&minor_lock);if (!try_module_get (idev->owner)) { ret = -ENODEV ;
@@ -1024,9 +1024,8 @@ void uio_unregister_device(struct uio_inwake_up_interruptible (&idev->wait);kill_fasync (&idev->async_queue,SIGIO ,POLL_HUP ); -device_unregister (&idev->dev); -uio_free_minor (minor); +device_unregister (&idev->dev);return ; }
Greg Kroah-Hartman
maintainerPATCH 37/194 parport: parport_serial: Add Brainboxes BAR details
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit 65fde134b0a4ffe838729f9ee11b459a2f6f2815 upstream.
Add BAR/enum entries for Brainboxes serial/parallel cards.
--- drivers/parport/parport_serial.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/parport/parport_serial.c +8 -0
@@ -65,6 +65,10 @@ enum parport_pc_pci_cards { sunix_5069a, sunix_5079a, sunix_5099a, + brainboxes_uc257, + brainboxes_is300, + brainboxes_uc414, + brainboxes_px263, };/* each element directly indexed from enum list, above */
@@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = { /* sunix_5069a */ { 1, { { 1, 2 }, } }, /* sunix_5079a */ { 1, { { 1, 2 }, } }, /* sunix_5099a */ { 1, { { 1, 2 }, } }, + /* brainboxes_uc257 */ { 1, { { 3, -1 }, } }, + /* brainboxes_is300 */ { 1, { { 3, -1 }, } }, + /* brainboxes_uc414 */ { 1, { { 3, -1 }, } }, + /* brainboxes_px263 */ { 1, { { 3, -1 }, } }, }; static struct pci_device_id parport_serial_pci_tbl[] = {
Greg Kroah-Hartman
maintainerPATCH 38/194 parport: parport_serial: Add Brainboxes device IDs and geometry
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <[email protected]>
commit 6aa1fc5a8085bbc01687aa708dcf2dbe637a5ee3 upstream.
Add device IDs for the Brainboxes UC-203, UC-257, UC-414, UC-475, IS-300/IS-500 and PX-263/PX-295 and define the relevant "geometry" for the cards.
This patch requires part 1 of this series.
--- drivers/parport/parport_serial.c | 56 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+)
drivers/parport/parport_serial.c +56 -0
@@ -285,6 +285,38 @@ static struct pci_device_id parport_seri {PCI_VENDOR_ID_SUNIX ,PCI_DEVICE_ID_SUNIX_1999 ,PCI_VENDOR_ID_SUNIX , 0x0104, 0, 0, sunix_5099a }, +/* Brainboxes UC-203 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0bc1, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0bc2, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes UC-257 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0861, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0862, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0863, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes UC-414 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0e61, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc414 }, + +/* Brainboxes UC-475 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0981, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + { PCI_VENDOR_ID_INTASHIELD, 0x0982, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 }, + +/* Brainboxes IS-300/IS-500 */ + { PCI_VENDOR_ID_INTASHIELD, 0x0da0, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_is300 }, + +/* Brainboxes PX-263/PX-295 */ + { PCI_VENDOR_ID_INTASHIELD, 0x402c, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px263 }, + { 0, } /* terminate list */ };MODULE_DEVICE_TABLE (pci,parport_serial_pci_tbl);
@@ -550,6 +582,30 @@ static struct pciserial_board pci_parpor .base_baud = 921600, .uart_offset = 0x8, }, + [brainboxes_uc257] = { + .flags = FL_BASE2, + .num_ports = 2, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_is300] = { + .flags = FL_BASE2, + .num_ports = 1, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_uc414] = { + .flags = FL_BASE2, + .num_ports = 4, + .base_baud = 115200, + .uart_offset = 8, + }, + [brainboxes_px263] = { + .flags = FL_BASE2, + .num_ports = 4, + .base_baud = 921600, + .uart_offset = 8, + }, };struct parport_serial_private {
Greg Kroah-Hartman
maintainerPATCH 39/194 coresight: etm4x: Fix width of CCITMIN field
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <[email protected]>
commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream.
CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16. This probably wasn't an issue previously because values higher than 255 never occurred.
But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN on errata affected cpus"), a comparison with 256 was done to enable the errata, generating the following W=1 build error:
coresight-etm4x-core.c:1188:24: error: result of comparison of constant 256 with expression of type 'u8' (aka 'unsigned char') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (drvdata->ccitmin == 256)
--- drivers/hwtracing/coresight/coresight-etm4x.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-etm4x.h +1 -1
@@ -361,7 +361,7 @@ struct etmv4_drvdata {u8 ctxid_size;u8 vmid_size;u8 ccsize; -u8 ccitmin; +u16 ccitmin;u8 s_ex_level;u8 ns_ex_level;u8 q_support;
Greg Kroah-Hartman
maintainerPATCH 30/194 ARM: sun9i: smp: fix return code check of of_property_match_string
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ]
of_property_match_string returns an int; either an index from 0 or greater if successful or negative on failure. Even it's very unlikely that the DT CPU node contains multiple enable-methods these checks should be fixed.
This patch was inspired by the work of Nick Desaulniers.
--- arch/arm/mach-sunxi/mc_smp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-sunxi/mc_smp.c +2 -2
@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void)for (i =0 ; i <ARRAY_SIZE (sunxi_mc_smp_data); i++) { ret =of_property_match_string (node,"enable-method" , sunxi_mc_smp_data[i].enable_method); -if (!ret) +if (ret >=0 )break ; }of_node_put (node); -if (ret) +if (ret <0 )return -ENODEV ; is_a83t = sunxi_mc_smp_data[i].is_a83t;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/194 crypto: sahara - remove FLAGS_NEW_KEY logic
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ]
Remove the FLAGS_NEW_KEY logic as it has the following issues:
- the wrong key may end up being used when there are multiple data streams:
t1 t2
setkey()
encrypt()
setkey()
encrypt()
encrypt() <--- key from t2 is used
- switching between encryption and decryption with the same key is not possible, as the hdr flags are only updated when a new setkey() is performed
With this change, the key is always sent along with the cryptdata when performing encryption/decryption operations.
--- drivers/crypto/sahara.c | 34 +++++++++++++--------------------- 1 file changed, 13 insertions(+), 21 deletions(-)
drivers/crypto/sahara.c +13 -21
@@ -43,7 +43,6 @@#define FLAGS_MODE_MASK 0x000f#define FLAGS_ENCRYPT BIT(0)#define FLAGS_CBC BIT(1) -#define FLAGS_NEW_KEY BIT(3)#define SAHARA_HDR_BASE 0x00800000#define SAHARA_HDR_SKHA_ALG_AES 0
@@ -141,8 +140,6 @@ struct sahara_hw_link { };struct sahara_ctx { -unsigned long flags; -/* AES-specific context */ int keylen;u8 key[AES_KEYSIZE_128 ];
@@ -446,26 +443,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)int i, j;int idx =0 ; -/* Copy new key if necessary */ -if (ctx->flags &FLAGS_NEW_KEY ) { -memcpy (dev->key_base, ctx->key, ctx->keylen); - ctx->flags &= ~FLAGS_NEW_KEY ; +memcpy (dev->key_base, ctx->key, ctx->keylen); -if (dev->flags &FLAGS_CBC ) { - dev->hw_desc[idx]->len1 =AES_BLOCK_SIZE ; - dev->hw_desc[idx]->p1 = dev->iv_phys_base; - }else { - dev->hw_desc[idx]->len1 =0 ; - dev->hw_desc[idx]->p1 =0 ; - } - dev->hw_desc[idx]->len2 = ctx->keylen; - dev->hw_desc[idx]->p2 = dev->key_phys_base; - dev->hw_desc[idx]->next = dev->hw_phys_desc[1 ]; +if (dev->flags &FLAGS_CBC ) { + dev->hw_desc[idx]->len1 =AES_BLOCK_SIZE ; + dev->hw_desc[idx]->p1 = dev->iv_phys_base; + }else { + dev->hw_desc[idx]->len1 =0 ; + dev->hw_desc[idx]->p1 =0 ; + } + dev->hw_desc[idx]->len2 = ctx->keylen; + dev->hw_desc[idx]->p2 = dev->key_phys_base; + dev->hw_desc[idx]->next = dev->hw_phys_desc[1 ]; + dev->hw_desc[idx]->hdr =sahara_aes_key_hdr (dev); - dev->hw_desc[idx]->hdr =sahara_aes_key_hdr (dev); + idx++; - idx++; - } dev->nb_in_sg =sg_nents_for_len (dev->in_sg, dev->total);if (dev->nb_in_sg <0 ) {
@@ -608,7 +601,6 @@ static int sahara_aes_setkey(struct crypto_ablkcipher *tfm, const u8 *key,/* SAHARA only supports 128bit keys */ if (keylen ==AES_KEYSIZE_128 ) {memcpy (ctx->key, key, keylen); - ctx->flags |=FLAGS_NEW_KEY ;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/194 crypto: sahara - improve error handling in sahara_sha_process()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ]
sahara_sha_hw_data_descriptor_create() returns negative error codes on failure, so make sure the errors are correctly handled / propagated.
--- drivers/crypto/sahara.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/crypto/sahara.c +8 -2
@@ -1003,7 +1003,10 @@ static int sahara_sha_process(struct ahash_request *req)return ret;if (rctx->first) { -sahara_sha_hw_data_descriptor_create (dev, rctx, req,0 ); + ret =sahara_sha_hw_data_descriptor_create (dev, rctx, req,0 ); +if (ret) +return ret; + dev->hw_desc[0 ]->next =0 ; rctx->first =0 ; }else {
@@ -1011,7 +1014,10 @@ static int sahara_sha_process(struct ahash_request *req)sahara_sha_hw_context_descriptor_create (dev, rctx, req,0 ); dev->hw_desc[0 ]->next = dev->hw_phys_desc[1 ]; -sahara_sha_hw_data_descriptor_create (dev, rctx, req,1 ); + ret =sahara_sha_hw_data_descriptor_create (dev, rctx, req,1 ); +if (ret) +return ret; + dev->hw_desc[1 ]->next =0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/194 crypto: sahara - fix processing hash requests with req->nbytes < sg->length
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ]
It's not always the case that the entire sg entry needs to be processed. Currently, when nbytes is less than sg->length, "Descriptor length" errors are encountered.
To fix this, take the actual request size into account when populating the hw links.
--- drivers/crypto/sahara.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/crypto/sahara.c +4 -1
@@ -792,6 +792,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev, int start) {struct scatterlist *sg; +unsigned int len;unsigned int i;int ret;
@@ -813,12 +814,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,if (!ret)return -EFAULT ; + len = rctx->total;for (i = start; i < dev->nb_in_sg + start; i++) { - dev->hw_link[i]->len = sg->length; + dev->hw_link[i]->len =min (len, sg->length); dev->hw_link[i]->p = sg->dma_address;if (i == (dev->nb_in_sg + start -1 )) { dev->hw_link[i]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[i]->next = dev->hw_phys_link[i +1 ]; sg =sg_next (sg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/194 crypto: sahara - do not resize req->src when doing hash operations
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ]
When testing sahara sha256 speed performance with tcrypt (mode=404) on imx53-qsrb board, multiple "Invalid numbers of src SG." errors are reported. This was traced to sahara_walk_and_recalc() resizing req->src and causing the subsequent dma_map_sg() call to fail.
Now that the previous commit fixed sahara_sha_hw_links_create() to take into account the actual request size, rather than relying on sg->length values, the resize operation is no longer necessary.
Therefore, remove sahara_walk_and_recalc() and simplify associated logic.
--- drivers/crypto/sahara.c | 38 ++------------------------------------ 1 file changed, 2 insertions(+), 36 deletions(-)
drivers/crypto/sahara.c +2 -36
@@ -902,24 +902,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,return 0 ; } -static int sahara_walk_and_recalc (struct scatterlist *sg,unsigned int nbytes) -{ -if (!sg || !sg->length) -return nbytes; - -while (nbytes && sg) { -if (nbytes <= sg->length) { - sg->length = nbytes; -sg_mark_end (sg); -break ; - } - nbytes -= sg->length; - sg =sg_next (sg); - } - -return nbytes; -} -static int sahara_sha_prepare_request (struct ahash_request *req) {struct crypto_ahash *tfm =crypto_ahash_reqtfm (req);
@@ -956,36 +938,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req) hash_later, 0); } -/* nbytes should now be multiple of blocksize */ - req->nbytes = req->nbytes - hash_later; - -sahara_walk_and_recalc (req->src, req->nbytes); - + rctx->total = len - hash_later;/* have data from previous operation and current */ if (rctx->buf_cnt && req->nbytes) {sg_init_table (rctx->in_sg_chain,2 );sg_set_buf (rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt); -sg_chain (rctx->in_sg_chain,2 , req->src); - - rctx->total = req->nbytes + rctx->buf_cnt; rctx->in_sg = rctx->in_sg_chain; - - req->src = rctx->in_sg_chain;/* only data from previous operation */ }else if (rctx->buf_cnt) { -if (req->src) - rctx->in_sg = req->src; -else - rctx->in_sg = rctx->in_sg_chain; -/* buf was copied into rembuf above */ + rctx->in_sg = rctx->in_sg_chain;sg_init_one (rctx->in_sg, rctx->rembuf, rctx->buf_cnt); - rctx->total = rctx->buf_cnt;/* no data from previous operation */ }else { rctx->in_sg = req->src; - rctx->total = req->nbytes; - req->src = rctx->in_sg; }/* on next call, we only have the remaining data in the buffer */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/194 crypto: scomp - fix req->dst buffer overflow
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengming Zhou <[email protected]>
[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]
The req->dst buffer size should be checked before copying from the scomp_scratch->dst to avoid req->dst buffer overflow problem.
--- crypto/scompress.c | 6 ++++++ 1 file changed, 6 insertions(+)
crypto/scompress.c +6 -0
@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)struct crypto_scomp *scomp = *tfm_ctx;void **ctx =acomp_request_ctx (req);struct scomp_scratch *scratch; +unsigned int dlen;int ret;if (!req->src || !req->slen || req->slen >SCOMP_SCRATCH_SIZE )
@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)if (!req->dlen || req->dlen >SCOMP_SCRATCH_SIZE ) req->dlen =SCOMP_SCRATCH_SIZE ; + dlen = req->dlen; + scratch =raw_cpu_ptr (&scomp_scratch);spin_lock (&scratch->lock);
@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir) ret = -ENOMEM ; goto out; } + }else if (req->dlen > dlen) { + ret = -ENOSPC ; + goto out; }scatterwalk_map_and_copy (scratch->dst, req->dst,0 , req->dlen,1 );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/194 blocklayoutdriver: Fix reference leak of pnfs_device_node
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ]
The error path for blocklayout's device lookup is missing a reference drop for the case where a lookup finds the device, but the device is marked with NFS_DEVICEID_UNAVAILABLE.
--- fs/nfs/blocklayout/blocklayout.c | 2 ++ 1 file changed, 2 insertions(+)
fs/nfs/blocklayout/blocklayout.c +2 -0
@@ -604,6 +604,8 @@ bl_find_get_deviceid(struct nfs_server *server,nfs4_delete_deviceid (node->ld, node->nfs_client, id); goto retry; } + +nfs4_put_deviceid_node (node);return ERR_PTR (-ENODEV ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/194 NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ]
Once the client has processed the CB_LAYOUTRECALL, but has not yet successfully returned the layout, the server is supposed to switch to returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle that return value correctly.
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -168,6 +168,7 @@ static int nfs4_map_errors(int err)case -NFS4ERR_RESOURCE :case -NFS4ERR_LAYOUTTRYLATER :case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT :return -EREMOTEIO ;case -NFS4ERR_WRONGSEC :case -NFS4ERR_WRONG_CRED :
@@ -552,6 +553,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,case -NFS4ERR_GRACE :case -NFS4ERR_LAYOUTTRYLATER :case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT : exception->delay =1 ;return 0 ;
@@ -9159,6 +9161,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task, status = -EBUSY ;break ;case -NFS4ERR_RECALLCONFLICT : +case -NFS4ERR_RETURNCONFLICT : status = -ERECALLCONFLICT ;break ;case -NFS4ERR_DELEG_REVOKED :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/194 wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <[email protected]>
[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ]
The broadcast packets will be filtered in the FIF_ALLMULTI flag in the original code, which causes beacon packets to be filtered out and disconnection. Therefore, we fix it.
--- drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtw88/mac80211.c +2 -2
@@ -206,9 +206,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw,if (changed_flags &FIF_ALLMULTI ) {if (*new_flags &FIF_ALLMULTI ) - rtwdev->hal.rcr |=BIT_AM |BIT_AB ; + rtwdev->hal.rcr |=BIT_AM ;else - rtwdev->hal.rcr &= ~(BIT_AM |BIT_AB ); + rtwdev->hal.rcr &= ~(BIT_AM ); }if (changed_flags &FIF_FCSFAIL ) {if (*new_flags &FIF_FCSFAIL )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/194 bpf, lpm: Fix check prefixlen before walking trie
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Lehner <[email protected]>
[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ]
When looking up an element in LPM trie, the condition 'matchlen == trie->max_prefixlen' will never return true, if key->prefixlen is larger than trie->max_prefixlen. Consequently all elements in the LPM trie will be visited and no element is returned in the end.
To resolve this, check key->prefixlen first before walking the LPM trie.
--- kernel/bpf/lpm_trie.c | 3 +++ 1 file changed, 3 insertions(+)
kernel/bpf/lpm_trie.c +3 -0
@@ -230,6 +230,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)struct lpm_trie_node *node, *found =NULL ;struct bpf_lpm_trie_key *key = _key; +if (key->prefixlen > trie->max_prefixlen) +return NULL ; +/* Start walking the trie from the root node ... */ for (node =rcu_dereference (trie->root); node;) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/194 wifi: libertas: stop selecting wext
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ]
Libertas no longer references the iw_handler infrastructure or wext_spy, so neither of the 'select' statements are used any more.
--- drivers/net/wireless/marvell/libertas/Kconfig | 2 -- 1 file changed, 2 deletions(-)
drivers/net/wireless/marvell/libertas/Kconfig +0 -2
@@ -2,8 +2,6 @@ config LIBERTAS tristate "Marvell 8xxx Libertas WLAN driver support" depends on CFG80211 - select WIRELESS_EXT - select WEXT_SPY select LIB80211 select FW_LOADER ---help---
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/194 ARM: dts: qcom: apq8064: correct XOADC register address
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ]
The XOADC is present at the address 0x197 rather than just 197. It doesn't change a lot (since the driver hardcodes all register addresses), but the DT should present correct address anyway.
--- arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/qcom-apq8064.dtsi +1 -1
@@ -759,7 +759,7 @@ pwrkey@1c { xoadc: xoadc@197 { compatible = "qcom,pm8921-adc"; - reg = <197>; + reg = <0x197>; interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>; #address-cells = <2>; #size-cells = <0>;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/194 crypto: sahara - fix ahash selftest failure
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ]
update() calls should not modify the result buffer, so add an additional check for "rctx->last" to make sure that only the final hash value is copied into the buffer.
Fixes the following selftest failure:
alg: ahash: sahara-sha256 update() used result buffer on test vector 3, cfg="init+update+final aligned buffer"
--- drivers/crypto/sahara.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/sahara.c +1 -1
@@ -1031,7 +1031,7 @@ static int sahara_sha_process(struct ahash_request *req)memcpy (rctx->context, dev->context_base, rctx->context_size); -if (req->result) +if (req->result && rctx->last)memcpy (req->result, rctx->context, rctx->digest_size);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/194 ncsi: internal.h: Fix a spello
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bhaskar Chowdhury <[email protected]>
[ Upstream commit 195a8ec4033b4124f6864892e71dcef24ba74a5a ]
s/Firware/Firmware/
Stable-dep-of: 3084b58bfd0b ("net/ncsi: Fix netlink major/minor version numbers")
--- net/ncsi/internal.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ncsi/internal.h +1 -1
@@ -83,7 +83,7 @@ enum {struct ncsi_channel_version {u32 version;/* Supported BCD encoded NCSI version */ u32 alpha2;/* Supported BCD encoded NCSI version */ -u8 fw_name[12 ];/* Firware name string */ +u8 fw_name[12 ];/* Firmware name string */ u32 fw_version;/* Firmware version */ u16 pci_ids[4 ];/* PCI identification */ u32 mf_id;/* Manufacture ID */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/194 net/ncsi: Fix netlink major/minor version numbers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Delevoryas <[email protected]>
[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]
The netlink interface for major and minor version numbers doesn't actually return the major and minor version numbers.
It reports a u32 that contains the (major, minor, update, alpha1) components as the major version number, and then alpha2 as the minor version number.
For whatever reason, the u32 byte order was reversed (ntohl): maybe it was assumed that the encoded value was a single big-endian u32, and alpha2 was the minor version.
The correct way to get the supported NC-SI version from the network controller is to parse the Get Version ID response as described in 8.4.44 of the NC-SI spec[1].
Get Version ID Response Packet Format
Bits
+--------+--------+--------+--------+
Bytes | 31..24 | 23..16 | 15..8 | 7..0 |
+-------+--------+--------+--------+--------+
| 0..15 | NC-SI Header |
+-------+--------+--------+--------+--------+
| 16..19| Response code | Reason code |
+-------+--------+--------+--------+--------+
|20..23 | Major | Minor | Update | Alpha1 |
+-------+--------+--------+--------+--------+
|24..27 | reserved | Alpha2 |
+-------+--------+--------+--------+--------+
| .... other stuff .... |The major, minor, and update fields are all binary-coded decimal (BCD) encoded [2]. The spec provides examples below the Get Version ID response format in section 8.4.44.1, but for practical purposes, this is an example from a live network card:
root@bmc:~# ncsi-util 0x15
NC-SI Command Response:
cmd: GET_VERSION_ID(0x15)
Response: COMMAND_COMPLETED(0x0000) Reason: NO_ERROR(0x0000)
Payload length = 40 20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)
28: 0x6d 0x6c 0x78 0x30
32: 0x2e 0x31 0x00 0x00
36: 0x00 0x00 0x00 0x00
40: 0x16 0x1d 0x07 0xd2
44: 0x10 0x1d 0x15 0xb3
48: 0x00 0x17 0x15 0xb3
52: 0x00 0x00 0x81 0x19This should be parsed as "1.1.0".
"f" in the upper-nibble means to ignore it, contributing zero.
If both nibbles are "f", I think the whole field is supposed to be ignored. Major and minor are "required", meaning they're not supposed to be "ff", but the update field is "optional" so I think it can be ff. I think the simplest thing to do is just set the major and minor to zero instead of juggling some conditional logic or something.
bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9, so I've provided a custom BCD decoding function.
Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII characters as far as I can tell, although the full encoding table for non-alphabetic characters is slightly different (I think).
I imagine the alpha fields are just supposed to be alphabetic characters, but I haven't seen any network cards actually report a non-zero value for either.
If people wrote software against this netlink behavior, and were parsing the major and minor versions themselves from the u32, then this would definitely break their code.
[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1
--- net/ncsi/internal.h | 7 +++++-- net/ncsi/ncsi-netlink.c | 4 ++-- net/ncsi/ncsi-pkt.h | 7 +++++-- net/ncsi/ncsi-rsp.c | 26 ++++++++++++++++++++++++-- 4 files changed, 36 insertions(+), 8 deletions(-)
net/ncsi/internal.h +5 -2
@@ -81,8 +81,11 @@ enum {struct ncsi_channel_version { -u32 version;/* Supported BCD encoded NCSI version */ -u32 alpha2;/* Supported BCD encoded NCSI version */ +u8 major;/* NCSI version major */ +u8 minor;/* NCSI version minor */ +u8 update;/* NCSI version update */ +char alpha1;/* NCSI version alpha1 */ +char alpha2;/* NCSI version alpha2 */ u8 fw_name[12 ];/* Firmware name string */ u32 fw_version;/* Firmware version */ u16 pci_ids[4 ];/* PCI identification */
net/ncsi/ncsi-netlink.c +2 -2
@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,if (nc == nc->package->preferred_channel)nla_put_flag (skb,NCSI_CHANNEL_ATTR_FORCED ); -nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MAJOR , nc->version.version); -nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MINOR , nc->version.alpha2); +nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MAJOR , nc->version.major); +nla_put_u32 (skb,NCSI_CHANNEL_ATTR_VERSION_MINOR , nc->version.minor);nla_put_string (skb,NCSI_CHANNEL_ATTR_VERSION_STR , nc->version.fw_name); vid_nest =nla_nest_start_noflag (skb,NCSI_CHANNEL_ATTR_VLAN_LIST );
net/ncsi/ncsi-pkt.h +5 -2
@@ -191,9 +191,12 @@ struct ncsi_rsp_gls_pkt {/* Get Version ID */ struct ncsi_rsp_gvi_pkt {struct ncsi_rsp_pkt_hdr rsp;/* Response header */ -__be32 ncsi_version;/* NCSI version */ +unsigned char major;/* NCSI version major */ +unsigned char minor;/* NCSI version minor */ +unsigned char update;/* NCSI version update */ +unsigned char alpha1;/* NCSI version alpha1 */ unsigned char reserved[3 ];/* Reserved */ -unsigned char alpha2;/* NCSI version */ +unsigned char alpha2;/* NCSI version alpha2 */ unsigned char fw_name[12 ];/* f/w name string */ __be32 fw_version;/* f/w version */ __be16 pci_ids[4 ];/* PCI IDs */
net/ncsi/ncsi-rsp.c +24 -2
@@ -19,6 +19,19 @@#include "ncsi-pkt.h" #include "ncsi-netlink.h" +/* Nibbles within [0xA, 0xF] add zero "0" to the returned value. +* Optional fields (encoded as 0xFF) will default to zero. +*/ +static u8 decode_bcd_u8 (u8 x) +{ +int lo = x &0xF ; +int hi = x >>4 ; + + lo = lo <0xA ? lo :0 ; + hi = hi <0xA ? hi :0 ; +return lo + hi *10 ; +} +static int ncsi_validate_rsp_pkt (struct ncsi_request *nr,unsigned short payload) {
@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)if (!nc)return -ENODEV ; -/* Update to channel's version info */ +/* Update channel's version info +* +* Major, minor, and update fields are supposed to be +* unsigned integers encoded as packed BCD. +* +* Alpha1 and alpha2 are ISO/IEC 8859-1 characters. +*/ ncv = &nc->version; - ncv->version =ntohl (rsp->ncsi_version); + ncv->major =decode_bcd_u8 (rsp->major); + ncv->minor =decode_bcd_u8 (rsp->minor); + ncv->update =decode_bcd_u8 (rsp->update); + ncv->alpha1 = rsp->alpha1; ncv->alpha2 = rsp->alpha2;memcpy (ncv->fw_name, rsp->fw_name,12 ); ncv->fw_version =ntohl (rsp->fw_version);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/194 firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ]
The ending NULL is not taken into account by strncat(), so switch to snprintf() to correctly build 'debug_name'.
Using snprintf() also makes the code more readable.
--- drivers/firmware/ti_sci.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/firmware/ti_sci.c +5 -5
@@ -179,7 +179,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev, {struct device *dev = &pdev->dev;struct resource *res; -char debug_name[50 ] ="ti_sci_debug@" ; +char debug_name[50 ];/* Debug region is optional */ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -196,10 +196,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,/* Setup NULL termination */ info->debug_buffer[info->debug_region_size] =0 ; - info->d =debugfs_create_file (strncat (debug_name,dev_name (dev), -sizeof (debug_name) - -sizeof ("ti_sci_debug@" )), -0444 ,NULL , info, &ti_sci_debug_fops); +snprintf (debug_name,sizeof (debug_name),"ti_sci_debug@%s" , +dev_name (dev)); + info->d =debugfs_create_file (debug_name,0444 ,NULL , info, + &ti_sci_debug_fops);if (IS_ERR (info->d))return PTR_ERR (info->d);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/194 rtlwifi: Use ffs in <foo>_phy_calculate_bit_shift
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Perches <[email protected]>
[ Upstream commit 6c1d61913570d4255548ac598cfbef6f1e3c3eee ]
Remove the loop and use the generic ffs instead.
Stable-dep-of: bc8263083af6 ("wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior")
--- .../wireless/realtek/rtlwifi/rtl8188ee/phy.c | 18 ++++++------------ .../realtek/rtlwifi/rtl8192c/phy_common.c | 8 ++------ .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 9 ++------- .../wireless/realtek/rtlwifi/rtl8192ee/phy.c | 8 ++------ .../wireless/realtek/rtlwifi/rtl8192se/phy.c | 9 ++------- .../realtek/rtlwifi/rtl8723com/phy_common.c | 8 ++------ .../wireless/realtek/rtlwifi/rtl8821ae/phy.c | 18 ++++++------------ 7 files changed, 22 insertions(+), 56 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c +6 -12
@@ -16,7 +16,12 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,static void _rtl88e_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); -static u32 _rtl88e_phy_calculate_bit_shift (u32 bitmask); +static u32 _rtl88e_phy_calculate_bit_shift (u32 bitmask) +{ +u32 i =ffs (bitmask); + +return i ? i -1 :32 ; +}static bool _rtl88e_phy_bb8188e_config_parafile (struct ieee80211_hw *hw);static bool _rtl88e_phy_config_mac_with_headerfile (struct ieee80211_hw *hw); static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
@@ -210,17 +215,6 @@ static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw, rfpath, pphyreg->rf3wire_offset, data_and_addr); } -static u32 _rtl88e_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i; - -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } -return i; -} -bool rtl88e_phy_mac_config (struct ieee80211_hw *hw) {struct rtl_priv *rtlpriv =rtl_priv (hw);
drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c +2 -6
@@ -145,13 +145,9 @@ EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask) { -u32 i; +u32 i =ffs (bitmask); -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } -return i; +return i ? i -1 :32 ; }EXPORT_SYMBOL (_rtl92c_phy_calculate_bit_shift);
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +2 -7
@@ -162,14 +162,9 @@ static u32 targetchnl_2g[TARGET_CHNL_NUM_2G] = {static u32 _rtl92d_phy_calculate_bit_shift (u32 bitmask) { -u32 i; - -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } +u32 i =ffs (bitmask); -return i; +return i ? i -1 :32 ; }u32 rtl92d_phy_query_bb_reg (struct ieee80211_hw *hw,u32 regaddr,u32 bitmask)
drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c +2 -6
@@ -206,13 +206,9 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,static u32 _rtl92ee_phy_calculate_bit_shift (u32 bitmask) { -u32 i; +u32 i =ffs (bitmask); -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } -return i; +return i ? i -1 :32 ; }bool rtl92ee_phy_mac_config (struct ieee80211_hw *hw)
drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +2 -7
@@ -16,14 +16,9 @@static u32 _rtl92s_phy_calculate_bit_shift (u32 bitmask) { -u32 i; - -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } +u32 i =ffs (bitmask); -return i; +return i ? i -1 :32 ; }u32 rtl92s_phy_query_bb_reg (struct ieee80211_hw *hw,u32 regaddr,u32 bitmask)
drivers/net/wireless/realtek/rtlwifi/rtl8723com/phy_common.c +2 -6
@@ -53,13 +53,9 @@ EXPORT_SYMBOL_GPL(rtl8723_phy_set_bb_reg);u32 rtl8723_phy_calculate_bit_shift (u32 bitmask) { -u32 i; +u32 i =ffs (bitmask); -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } -return i; +return i ? i -1 :32 ; }EXPORT_SYMBOL_GPL (rtl8723_phy_calculate_bit_shift);
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +6 -12
@@ -27,7 +27,12 @@ static u32 _rtl8821ae_phy_rf_serial_read(struct ieee80211_hw *hw,static void _rtl8821ae_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); -static u32 _rtl8821ae_phy_calculate_bit_shift (u32 bitmask); +static u32 _rtl8821ae_phy_calculate_bit_shift (u32 bitmask) +{ +u32 i =ffs (bitmask); + +return i ? i -1 :32 ; +}static bool _rtl8821ae_phy_bb8821a_config_parafile (struct ieee80211_hw *hw);/*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/ static bool _rtl8821ae_phy_config_mac_with_headerfile (struct ieee80211_hw *hw);
@@ -274,17 +279,6 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, rfpath, pphyreg->rf3wire_offset, data_and_addr); } -static u32 _rtl8821ae_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i; - -for (i =0 ; i <=31 ; i++) { -if (((bitmask >> i) &0x1 ) ==1 ) -break ; - } -return i; -} -bool rtl8821ae_phy_mac_config (struct ieee80211_hw *hw) {bool rtstatus =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/194 wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ]
Clang static checker warns:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49:
The result of the left shift is undefined due to shifting by '32', which is greater or equal to the width of type 'u32'. [core.UndefinedBinaryOperatorResult]
If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined.[1][2]
For example, when using different gcc's compilation optimization options (-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s return value less than 32 to fix this problem. Warn if bitmask is zero.
[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type
[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
--- drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c +3 -2
@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw, u32 data);static u32 _rtl8821ae_phy_calculate_bit_shift (u32 bitmask) { -u32 i =ffs (bitmask); +if (WARN_ON_ONCE (!bitmask)) +return 0 ; -return i ? i -1 :32 ; +return __ffs (bitmask); }static bool _rtl8821ae_phy_bb8821a_config_parafile (struct ieee80211_hw *hw);/*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/194 scsi: fnic: Return error if vmalloc() failed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <[email protected]>
[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ]
In fnic_init_module() exists redundant check for return value from fnic_debugfs_init(), because at moment it only can return zero. It make sense to process theoretical vmalloc() failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/scsi/fnic/fnic_debugfs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/scsi/fnic/fnic_debugfs.c +2 -1
@@ -67,9 +67,10 @@ int fnic_debugfs_init(void) fc_trc_flag->fnic_trace =2 ; fc_trc_flag->fc_trace =3 ; fc_trc_flag->fc_clear =4 ; +return 0 ; } -return 0 ; +return -ENOMEM ; }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/194 arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ]
There is no "panic-indicator" default trigger but a property with that name:
sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
--- arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/qcom/sdm845-db845c.dts +1 -1
@@ -53,8 +53,8 @@ leds { user4 { label = "green:user4"; gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>; - linux,default-trigger = "panic-indicator"; default-state = "off"; + panic-indicator; }; wlan {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/194 scsi: hisi_sas: Replace with standard error code return value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <[email protected]>
[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ]
In function hisi_sas_controller_prereset(), -ENOSYS (Function not implemented) should be returned if the driver does not support .soft_reset. Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is already be set.
In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is already be set.
--- drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/hisi_sas/hisi_sas_main.c +2 -2
@@ -1577,10 +1577,10 @@ static int hisi_sas_controller_reset(struct hisi_hba *hisi_hba)queue_work (hisi_hba->wq, &hisi_hba->debugfs_work);if (!hisi_hba->hw->soft_reset) -return -1 ; +return -ENOENT ;if (test_and_set_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) -return -1 ; +return -EPERM ;dev_info (dev,"controller resetting...\n" );hisi_sas_controller_reset_prepare (hisi_hba);
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +1 -1
@@ -3365,7 +3365,7 @@ static int hisi_sas_v3_suspend(struct pci_dev *pdev, pm_message_t state) }if (test_and_set_bit (HISI_SAS_RESET_BIT , &hisi_hba->flags)) -return -1 ; +return -EPERM ;scsi_block_requests (shost);set_bit (HISI_SAS_REJECT_CMD_BIT , &hisi_hba->flags);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/194 selftests/net: fix grep checking for fib_nexthop_multiprefix
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ]
When running fib_nexthop_multiprefix test I saw all IPv6 test failed. e.g.
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [FAIL]
With -v it shows
COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1 PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes
From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300
--- 2001:db8:101::1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
Route get
2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium Searching for:
2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300
The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will not put RTA_SRC info. After fix:
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [ OK ]
--- tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/testing/selftests/net/fib_nexthop_multiprefix.sh +2 -2
@@ -209,12 +209,12 @@ validate_v6_exception() echo "Route get" ip -netns h0 -6 ro get ${dst} echo "Searching for:" - echo " ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + echo " ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" echo fi ip -netns h0 -6 ro get ${dst} | \ - grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" + grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}" rc=$? log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}"
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/194 virtio/vsock: fix logic which reduces credit update messages
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <[email protected]>
[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ]
Add one more condition for sending credit update during dequeue from stream socket: when number of bytes in the rx queue is smaller than SO_RCVLOWAT value of the socket. This is actual for non-default value of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data transmission, because we need at least SO_RCVLOWAT bytes in our rx queue to wake up user for reading data (in corner case it is also possible to stuck both tx and rx sides, this is why 'Fixes' is used).
--- net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/vmw_vsock/virtio_transport_common.c +10 -3
@@ -276,6 +276,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,struct virtio_vsock_pkt *pkt;size_t bytes, total =0 ;u32 free_space; +u32 fwd_cnt_delta; +bool low_rx_bytes;int err = -EFAULT ;spin_lock_bh (&vvs->rx_lock);
@@ -307,7 +309,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk, } } - free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt); + fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt; + free_space = vvs->buf_alloc - fwd_cnt_delta; + low_rx_bytes = (vvs->rx_bytes < +sock_rcvlowat (sk_vsock (vsk),0 ,INT_MAX ));spin_unlock_bh (&vvs->rx_lock);
@@ -317,9 +322,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,* too high causes extra messages. Too low causes transmitter * stalls. As stalls are in theory more expensive than extra * messages, we set the limit to a high value. TODO: experiment -* with different values. +* with different values. Also send credit update message when +* number of bytes in rx queue is not enough to wake up reader. */ -if (free_space <VIRTIO_VSOCK_MAX_PKT_BUF_SIZE ) { +if (fwd_cnt_delta && + (free_space <VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes)) {virtio_transport_send_credit_update (vsk,VIRTIO_VSOCK_TYPE_STREAM ,NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/194 crypto: sahara - fix processing requests with cryptlen < sg->length
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ]
It's not always the case that the entire sg entry needs to be processed. Currently, when cryptlen is less than sg->legth, "Descriptor length" errors are encountered.
The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized input data. To fix this, take the actual request size into account when populating the hw links.
--- drivers/crypto/sahara.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/crypto/sahara.c +7 -2
@@ -442,6 +442,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)int ret;int i, j;int idx =0 ; +u32 len;memcpy (dev->key_base, ctx->key, ctx->keylen);
@@ -492,12 +493,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)/* Create input links */ dev->hw_desc[idx]->p1 = dev->hw_phys_link[0 ]; sg = dev->in_sg; + len = dev->total;for (i =0 ; i < dev->nb_in_sg; i++) { - dev->hw_link[i]->len = sg->length; + dev->hw_link[i]->len =min (len, sg->length); dev->hw_link[i]->p = sg->dma_address;if (i == (dev->nb_in_sg -1 )) { dev->hw_link[i]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[i]->next = dev->hw_phys_link[i +1 ]; sg =sg_next (sg); }
@@ -506,12 +509,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)/* Create output links */ dev->hw_desc[idx]->p2 = dev->hw_phys_link[i]; sg = dev->out_sg; + len = dev->total;for (j = i; j < dev->nb_out_sg + i; j++) { - dev->hw_link[j]->len = sg->length; + dev->hw_link[j]->len =min (len, sg->length); dev->hw_link[j]->p = sg->dma_address;if (j == (dev->nb_out_sg + i -1 )) { dev->hw_link[j]->next =0 ; }else { + len -=min (len, sg->length); dev->hw_link[j]->next = dev->hw_phys_link[j +1 ]; sg =sg_next (sg); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/194 dma-mapping: clear dev->dma_mem to NULL after freeing it
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Zhang <[email protected]>
[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ]
Reproduced with below sequence:
dma_declare_coherent_memory()->dma_release_coherent_memory() ->dma_declare_coherent_memory()->"return -EBUSY" error
It will return -EBUSY from the dma_assign_coherent_memory() in dma_declare_coherent_memory(), the reason is that dev->dma_mem pointer has not been set to NULL after it's freed.
--- kernel/dma/coherent.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/dma/coherent.c +3 -1
@@ -323,8 +323,10 @@ static int rmem_dma_device_init(struct reserved_mem *rmem, struct device *dev)static void rmem_dma_device_release (struct reserved_mem *rmem,struct device *dev) { -if (dev) +if (dev) { dev->dma_mem =NULL ; + dev->dma_mem =NULL ; + } }static const struct reserved_mem_ops rmem_dma_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/194 wifi: rtlwifi: add calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ]
There are many same functions like _rtl88e_phy_calculate_bit_shift(), _rtl92c_phy_calculate_bit_shift() and so on. And these functions can cause undefined bitwise shift behavior. Add calculate_bit_shift() to replace them and fix undefined behavior in subsequent patches.
Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()")
--- drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/wireless/realtek/rtlwifi/wifi.h +7 -0
@@ -3230,4 +3230,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw, return ieee80211_find_sta(mac->vif, mac_addr); } +static inline u32 calculate_bit_shift (u32 bitmask) +{ +if (WARN_ON_ONCE (!bitmask)) +return 0 ; + +return __ffs (bitmask); +}#endif
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/194 wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ]
Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c +4 -10
@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,static void _rtl88e_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); -static u32 _rtl88e_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -}static bool _rtl88e_phy_bb8188e_config_parafile (struct ieee80211_hw *hw);static bool _rtl88e_phy_config_mac_with_headerfile (struct ieee80211_hw *hw); static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)RT_TRACE (rtlpriv,COMP_RF ,DBG_TRACE ,"regaddr(%#x), bitmask(%#x)\n" , regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -100,7 +94,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw, original_value =_rtl88e_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock_irqrestore (&rtlpriv->locks.rf_lock, flags);
@@ -129,7 +123,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl88e_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl88e_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/194 wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 ++---------- .../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 - 2 files changed, 2 insertions(+), 11 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c +2 -10
@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)RT_TRACE (rtlpriv,COMP_RF ,DBG_TRACE ,"regaddr(%#x), bitmask(%#x)\n" , regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw, }EXPORT_SYMBOL (_rtl92c_phy_rf_serial_write); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -} -EXPORT_SYMBOL (_rtl92c_phy_calculate_bit_shift); -static void _rtl92c_phy_bb_config_1t (struct ieee80211_hw *hw) {rtl_set_bbreg (hw,RFPGA0_TXINFO ,0x3 ,0x2 );
drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h +0 -1
@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,void rtl92ce_phy_set_rf_on (struct ieee80211_hw *hw);void rtl92c_phy_set_io (struct ieee80211_hw *hw);void rtl92c_bb_block_on (struct ieee80211_hw *hw); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask);long _rtl92c_phy_txpwr_idx_to_dbm (struct ieee80211_hw *hw,enum wireless_mode wirelessmode,u8 txpwridx);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/194 wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix an undefined bitwise shift behavior problem.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c +3 -3
@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); } - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/194 wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++--- drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 - 2 files changed, 3 insertions(+), 4 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c +3 -3
@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw, rfpath, regaddr); } - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw, original_value =_rtl92c_phy_fw_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92c_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift));
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h +0 -1
@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath, u32 offset);u32 _rtl92c_phy_fw_rf_serial_read (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset); -u32 _rtl92c_phy_calculate_bit_shift (u32 bitmask);void _rtl92c_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/194 crypto: sahara - fix error handling in sahara_hw_descriptor_create()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ]
Do not call dma_unmap_sg() for scatterlists that were not mapped successfully.
--- drivers/crypto/sahara.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/crypto/sahara.c +3 -5
@@ -481,13 +481,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev) DMA_TO_DEVICE);if (ret != dev->nb_in_sg) {dev_err (dev->device,"couldn't map in sg\n" ); - goto unmap_in; +return -EINVAL ; } + ret =dma_map_sg (dev->device, dev->out_sg, dev->nb_out_sg,DMA_FROM_DEVICE );if (ret != dev->nb_out_sg) {dev_err (dev->device,"couldn't map out sg\n" ); - goto unmap_out; + goto unmap_in; }/* Create input links */
@@ -535,9 +536,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)return 0 ; -unmap_out: -dma_unmap_sg (dev->device, dev->out_sg, dev->nb_out_sg, -DMA_FROM_DEVICE ); unmap_in:dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/194 pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return 64-bit value since persistent_ram_zone::buffer_size has type size_t which is derived from the 64-bit *unsigned long*, while the ecc_blocks variable this value gets assigned to has (always 32-bit) *int* type. Even if that value fits into *int* type, an overflow is still possible when calculating the size_t typed ecc_total variable further below since there's no cast to any 64-bit type before multiplication. Declaring the ecc_blocks variable as *size_t* should fix this mess...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
--- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/pstore/ram_core.c +1 -1
@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz, {int numerr;struct persistent_ram_buffer *buffer = prz->buffer; -int ecc_blocks; +size_t ecc_blocks;size_t ecc_total;if (!ecc_info || !ecc_info->ecc_size)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/194 gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <[email protected]>
[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ]
Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in gfs2_rgrp_dump() to prevent that.
--- fs/gfs2/rgrp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/rgrp.c +1 -1
@@ -2275,7 +2275,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_glock *gl, (unsigned long long )rgd->rd_addr, rgd->rd_flags, rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes, rgd->rd_reserved, rgd->rd_extfail_pt); -if (rgd->rd_sbd->sd_args.ar_rgrplvb) { +if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) {struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl; gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/194 crypto: virtio - Wait for tasklet to complete on device remove
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangyangxin <[email protected]>
[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ]
The scheduled tasklet needs to be executed on device remove.
--- drivers/crypto/virtio/virtio_crypto_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/crypto/virtio/virtio_crypto_core.c +3 -0
@@ -434,11 +434,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)static void virtcrypto_remove (struct virtio_device *vdev) {struct virtio_crypto *vcrypto = vdev->priv; +int i;dev_info (&vdev->dev,"Start virtcrypto_remove.\n" );if (virtcrypto_dev_started (vcrypto))virtcrypto_dev_stop (vcrypto); +for (i =0 ; i < vcrypto->max_data_queues; i++) +tasklet_kill (&vcrypto->data_vq[i].done_task); vdev->config->reset (vdev);virtcrypto_free_unused_reqs (vcrypto);virtcrypto_clear_crypto_engines (vcrypto);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/194 crypto: sahara - fix ahash reqsize
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ]
Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the extra space is not needed.
--- drivers/crypto/sahara.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/crypto/sahara.c +1 -2
@@ -1178,8 +1178,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)static int sahara_sha_cra_init (struct crypto_tfm *tfm) {crypto_ahash_set_reqsize (__crypto_ahash_cast (tfm), -sizeof (struct sahara_sha_reqctx ) + -SHA_BUFFER_LEN +SHA256_BLOCK_SIZE ); +sizeof (struct sahara_sha_reqctx ));return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/194 crypto: sahara - fix wait_for_completion_timeout() error handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <[email protected]>
[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ]
The sg lists are not unmapped in case of timeout errors. Fix this.
--- drivers/crypto/sahara.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
drivers/crypto/sahara.c +10 -8
@@ -580,16 +580,17 @@ static int sahara_aes_process(struct ablkcipher_request *req) timeout =wait_for_completion_timeout (&dev->dma_completion,msecs_to_jiffies (SAHARA_TIMEOUT_MS )); -if (!timeout) { -dev_err (dev->device,"AES timeout\n" ); -return -ETIMEDOUT ; - }dma_unmap_sg (dev->device, dev->out_sg, dev->nb_out_sg,DMA_FROM_DEVICE );dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE ); +if (!timeout) { +dev_err (dev->device,"AES timeout\n" ); +return -ETIMEDOUT ; + } +return 0 ; }
@@ -1023,15 +1024,16 @@ static int sahara_sha_process(struct ahash_request *req) timeout =wait_for_completion_timeout (&dev->dma_completion,msecs_to_jiffies (SAHARA_TIMEOUT_MS )); -if (!timeout) { -dev_err (dev->device,"SHA timeout\n" ); -return -ETIMEDOUT ; - }if (rctx->sg_in_idx)dma_unmap_sg (dev->device, dev->in_sg, dev->nb_in_sg,DMA_TO_DEVICE ); +if (!timeout) { +dev_err (dev->device,"SHA timeout\n" ); +return -ETIMEDOUT ; + } +memcpy (rctx->context, dev->context_base, rctx->context_size);if (req->result && rctx->last)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/194 crypto: af_alg - Disallow multiple in-flight AIO requests
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ]
Having multiple in-flight AIO requests results in unpredictable output because they all share the same IV. Fix this by only allowing one request at a time.
--- crypto/af_alg.c | 14 +++++++++++++- include/crypto/if_alg.h | 3 +++ 2 files changed, 16 insertions(+), 1 deletion(-)
crypto/af_alg.c +13 -1
@@ -1029,9 +1029,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);void af_alg_free_resources (struct af_alg_async_req *areq) {struct sock *sk = areq->sk; +struct af_alg_ctx *ctx;af_alg_free_areq_sgls (areq);sock_kfree_s (sk, areq, areq->areqlen); + + ctx =alg_sk (sk)->private; + ctx->inflight = false; }EXPORT_SYMBOL_GPL (af_alg_free_resources);
@@ -1095,11 +1099,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);struct af_alg_async_req *af_alg_alloc_areq (struct sock *sk,unsigned int areqlen) { -struct af_alg_async_req *areq =sock_kmalloc (sk, areqlen,GFP_KERNEL ); +struct af_alg_ctx *ctx =alg_sk (sk)->private; +struct af_alg_async_req *areq; + +/* Only one AIO request can be in flight. */ +if (ctx->inflight) +return ERR_PTR (-EBUSY ); + areq =sock_kmalloc (sk, areqlen,GFP_KERNEL );if (unlikely (!areq))return ERR_PTR (-ENOMEM ); + ctx->inflight = true; + areq->areqlen = areqlen; areq->sk = sk; areq->last_rsgl =NULL ;
include/crypto/if_alg.h +3 -0
@@ -137,6 +137,7 @@ struct af_alg_async_req {* recvmsg is invoked. * @init: True if metadata has been sent. * @len: Length of memory allocated for this data structure. +* @inflight: Non-zero when AIO requests are in flight. */ struct af_alg_ctx {struct list_head tsgl_list;
@@ -155,6 +156,8 @@ struct af_alg_ctx {bool init;unsigned int len; + +unsigned int inflight; };int af_alg_register_type (const struct af_alg_type *type);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/194 wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ]
Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +4 -11
@@ -169,13 +169,6 @@ static const u8 channel_all[59] = { 157, 159, 161, 163, 165 }; -static u32 _rtl92d_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -} -u32 rtl92d_phy_query_bb_reg (struct ieee80211_hw *hw,u32 regaddr,u32 bitmask) {struct rtl_priv *rtlpriv =rtl_priv (hw);
@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) }else { originalvalue =rtl_read_dword (rtlpriv, regaddr); } - bitshift =_rtl92d_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw, dbi_direct); else originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92d_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
@@ -318,7 +311,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw, regaddr, rfpath, bitmask);spin_lock_irqsave (&rtlpriv->locks.rf_lock, flags); original_value =_rtl92d_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92d_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock_irqrestore (&rtlpriv->locks.rf_lock, flags); RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -345,7 +338,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,if (bitmask !=RFREG_OFFSET_MASK ) { original_value =_rtl92d_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92d_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 110/194 media: pvrusb2: fix use after free on context disconnection
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marliere <[email protected]>
[ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ]
Upon module load, a kthread is created targeting the pvr2_context_thread_func function, which may call pvr2_context_destroy and thus call kfree() on the context object. However, that might happen before the usb hub_event handler is able to notify the driver. This patch adds a sanity check before the invalid read reported by syzbot, within the context disconnection call stack.
--- drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/media/usb/pvrusb2/pvrusb2-context.c +2 -1
@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp) {pvr2_hdw_disconnect (mp->hdw); mp->disconnect_flag = !0 ; -pvr2_context_notify (mp); +if (!pvr2_context_shutok ()) +pvr2_context_notify (mp); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 111/194 drm/bridge: Fix typo in post_disable() description
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dario Binacchi <[email protected]>
[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ]
s/singals/signals/
--- include/drm/drm_bridge.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/drm/drm_bridge.h +1 -1
@@ -162,7 +162,7 @@ struct drm_bridge_funcs {* or &drm_encoder_helper_funcs.dpms hook. * * The bridge must assume that the display pipe (i.e. clocks and timing -* singals) feeding it is no longer running when this callback is +* signals) feeding it is no longer running when this callback is * called. * * The post_disable callback is optional.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 112/194 f2fs: fix to avoid dirent corruption
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout) f2fs_set_link(old_inode, old_dir_entry, old_dir_page, new_dir); else f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory rename does move the source to new parent, even if you'd been asked to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
--- fs/f2fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/namei.c +1 -1
@@ -1009,7 +1009,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry, }if (old_dir_entry) { -if (old_dir != new_dir && !whiteout) +if (old_dir != new_dir)f2fs_set_link (old_inode, old_dir_entry, old_dir_page, new_dir);else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 113/194 drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ]
While improbable, there may be a chance of hitting integer overflow when the result of radeon_get_ib_value() gets shifted left.
Avoid it by casting one of the operands to larger data type (u64).
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/r600_cs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/r600_cs.c +2 -2
@@ -1278,7 +1278,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)return -EINVAL ; } tmp = (reg -CB_COLOR0_BASE ) /4 ; - track->cb_color_bo_offset[tmp] =radeon_get_ib_value (p, idx) <<8 ; + track->cb_color_bo_offset[tmp] = (u64 )radeon_get_ib_value (p, idx) <<8 ; ib[idx] += (u32)((reloc->gpu_offset >>8 ) &0xffffffff ); track->cb_color_base_last[tmp] = ib[idx]; track->cb_color_bo[tmp] = reloc->robj;
@@ -1305,7 +1305,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx) "0x%04X\n", reg);return -EINVAL ; } - track->htile_offset =radeon_get_ib_value (p, idx) <<8 ; + track->htile_offset = (u64 )radeon_get_ib_value (p, idx) <<8 ; ib[idx] += (u32)((reloc->gpu_offset >>8 ) &0xffffffff ); track->htile_bo = reloc->robj; track->db_dirty = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 114/194 drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ]
It may be possible, albeit unlikely, to encounter integer overflow during the multiplication of several unsigned int variables, the result being assigned to a variable 'size' of wider type.
Prevent this potential behaviour by converting one of the multiples to unsigned long.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/r100.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/r100.c +2 -2
@@ -2313,7 +2313,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)switch (prim_walk) {case 1 :for (i =0 ; i < track->num_arrays; i++) { - size = track->arrays[i].esize * track->max_indx *4 ; + size = track->arrays[i].esize * track->max_indx *4UL ;if (track->arrays[i].robj ==NULL ) {DRM_ERROR ("(PW %u) Vertex array %u no buffer " "bound\n" , prim_walk, i);
@@ -2332,7 +2332,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)break ;case 2 :for (i =0 ; i < track->num_arrays; i++) { - size = track->arrays[i].esize * (nverts -1 ) *4 ; + size = track->arrays[i].esize * (nverts -1 ) *4UL ;if (track->arrays[i].robj ==NULL ) {DRM_ERROR ("(PW %u) Vertex array %u no buffer " "bound\n" , prim_walk, i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 115/194 drm/radeon: check return value of radeon_ring_lock()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ]
In the unlikely event of radeon_ring_lock() failing, its errno return value should be processed. This patch checks said return value and prints a debug message in case of an error.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/si.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/radeon/si.c +4 -0
@@ -3616,6 +3616,10 @@ static int si_cp_start(struct radeon_device *rdev)for (i =RADEON_RING_TYPE_GFX_INDEX ; i <=CAYMAN_RING_TYPE_CP2_INDEX ; ++i) { ring = &rdev->ring[i]; r =radeon_ring_lock (rdev, ring,2 ); +if (r) { +DRM_ERROR ("radeon: cp failed to lock ring (%d).\n" , r); +return r; + }/* clear the compute context state */ radeon_ring_write (ring,PACKET3_COMPUTE (PACKET3_CLEAR_STATE ,0 ));
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 116/194 ASoC: cs35l33: Fix GPIO name and drop legacy include
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ]
This driver includes the legacy GPIO APIs <linux/gpio.h> and <linux/of_gpio.h> but does not use any symbols from any of them.
Drop the includes.
Further the driver is requesting "reset-gpios" rather than just "reset" from the GPIO framework. This is wrong because the gpiolib core will add "-gpios" before processing the request from e.g. device tree. Drop the suffix.
The last problem means that the optional RESET GPIO has never been properly retrieved and used even if it existed, but nobody noticed.
--- sound/soc/codecs/cs35l33.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/codecs/cs35l33.c +1 -3
@@ -22,13 +22,11 @@#include <sound/soc-dapm.h> #include <sound/initval.h> #include <sound/tlv.h> -#include <linux/gpio.h> #include <linux/gpio/consumer.h> #include <sound/cs35l33.h> #include <linux/pm_runtime.h> #include <linux/regulator/consumer.h> #include <linux/regulator/machine.h> -#include <linux/of_gpio.h> #include <linux/of.h> #include <linux/of_device.h> #include <linux/of_irq.h>
@@ -1168,7 +1166,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,/* We could issue !RST or skip it based on AMP topology */ cs35l33->reset_gpio =devm_gpiod_get_optional (&i2c_client->dev, -"reset-gpios" ,GPIOD_OUT_HIGH ); +"reset" ,GPIOD_OUT_HIGH );if (IS_ERR (cs35l33->reset_gpio)) {dev_err (&i2c_client->dev,"%s ERROR: Can't get reset GPIO\n" , __func__);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 117/194 ASoC: cs35l34: Fix GPIO name and drop legacy include
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ]
This driver includes the legacy GPIO APIs <linux/gpio.h> and <linux/of_gpio.h> but does not use any symbols from any of them.
Drop the includes.
Further the driver is requesting "reset-gpios" rather than just "reset" from the GPIO framework. This is wrong because the gpiolib core will add "-gpios" before processing the request from e.g. device tree. Drop the suffix.
The last problem means that the optional RESET GPIO has never been properly retrieved and used even if it existed, but nobody noticed.
--- sound/soc/codecs/cs35l34.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
sound/soc/codecs/cs35l34.c +1 -3
@@ -20,14 +20,12 @@#include <linux/regulator/machine.h> #include <linux/pm_runtime.h> #include <linux/of_device.h> -#include <linux/of_gpio.h> #include <linux/of_irq.h> #include <sound/core.h> #include <sound/pcm.h> #include <sound/pcm_params.h> #include <sound/soc.h> #include <sound/soc-dapm.h> -#include <linux/gpio.h> #include <linux/gpio/consumer.h> #include <sound/initval.h> #include <sound/tlv.h>
@@ -1058,7 +1056,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client,dev_err (&i2c_client->dev,"Failed to request IRQ: %d\n" , ret); cs35l34->reset_gpio =devm_gpiod_get_optional (&i2c_client->dev, -"reset-gpios" ,GPIOD_OUT_LOW ); +"reset" ,GPIOD_OUT_LOW );if (IS_ERR (cs35l34->reset_gpio))return PTR_ERR (cs35l34->reset_gpio);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 118/194 drm/msm/mdp4: flush vblank event on disable
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ]
Flush queued events when disabling the crtc. This avoids timeouts when we come back and wait for dependencies (like the previous frame's flip_done).
Patchwork: https://patchwork.freedesktop.org/patch/569127/
--- drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c +9 -0
@@ -268,6 +268,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc, {struct mdp4_crtc *mdp4_crtc =to_mdp4_crtc (crtc);struct mdp4_kms *mdp4_kms =get_kms (crtc); +unsigned long flags;DBG ("%s" , mdp4_crtc->name);
@@ -280,6 +281,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,mdp_irq_unregister (&mdp4_kms->base, &mdp4_crtc->err);mdp4_disable (mdp4_kms); +if (crtc->state->event && !crtc->state->active) { +WARN_ON (mdp4_crtc->event); +spin_lock_irqsave (&mdp4_kms->dev->event_lock, flags); +drm_crtc_send_vblank_event (crtc, crtc->state->event); + crtc->state->event =NULL ; +spin_unlock_irqrestore (&mdp4_kms->dev->event_lock, flags); + } + mdp4_crtc->enabled = false; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 119/194 drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <[email protected]>
[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ]
This helper has been introduced to avoid programmer errors (missing _put calls leading to dangling refcnt) when using pm_runtime_get, use it.
While at it, start checking the return value.
Patchwork: https://patchwork.freedesktop.org/patch/543350/
--- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +3 -1
@@ -464,7 +464,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy)struct device *dev = &phy->pdev->dev;int ret; -pm_runtime_get_sync (dev); + ret =pm_runtime_resume_and_get (dev); +if (ret) +return ret; ret =clk_prepare_enable (phy->ahb_clk);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/194 wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ]
Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c +4 -12
@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,static void _rtl92ee_phy_rf_serial_write (struct ieee80211_hw *hw,enum radio_path rfpath,u32 offset,u32 data); -static u32 _rtl92ee_phy_calculate_bit_shift (u32 bitmask);static bool _rtl92ee_phy_bb8192ee_config_parafile (struct ieee80211_hw *hw);static bool _rtl92ee_phy_config_mac_with_headerfile (struct ieee80211_hw *hw); static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)RT_TRACE (rtlpriv,COMP_RF ,DBG_TRACE ,"regaddr(%#x), bitmask(%#x)\n" , regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92ee_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE,
@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92ee_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -93,7 +92,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,spin_lock_irqsave (&rtlpriv->locks.rf_lock, flags); original_value =_rtl92ee_phy_rf_serial_read (hw , rfpath, regaddr); - bitshift =_rtl92ee_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock_irqrestore (&rtlpriv->locks.rf_lock, flags);
@@ -121,7 +120,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,if (bitmask !=RFREG_OFFSET_MASK ) { original_value =_rtl92ee_phy_rf_serial_read (hw, rfpath, addr); - bitshift =_rtl92ee_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = (original_value & (~bitmask)) | (data << bitshift); }
@@ -204,13 +203,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw, pphyreg->rf3wire_offset, data_and_addr); } -static u32 _rtl92ee_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -} -bool rtl92ee_phy_mac_config (struct ieee80211_hw *hw) {return _rtl92ee_phy_config_mac_with_headerfile (hw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 120/194 drm/drv: propagate errors from drm_modeset_register_all()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <[email protected]>
[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ]
In case the drm_modeset_register_all() function fails, its error code will be ignored. Instead make the drm_dev_register() bail out in case of such an error.
--- drivers/gpu/drm/drm_drv.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/drm_drv.c +8 -2
@@ -984,8 +984,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) goto err_minors; } -if (drm_core_check_feature (dev,DRIVER_MODESET )) -drm_modeset_register_all (dev); +if (drm_core_check_feature (dev,DRIVER_MODESET )) { + ret =drm_modeset_register_all (dev); +if (ret) + goto err_unload; + } ret =0 ;
@@ -997,6 +1000,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags) goto out_unlock; +err_unload: +if (dev->driver->unload) + dev->driver->unload (dev); err_minors:remove_compat_control_link (dev);drm_minor_unregister (dev,DRM_MINOR_PRIMARY );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 121/194 drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ]
check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref.
--- drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_display.c +6 -1
@@ -682,11 +682,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)if (radeon_crtc ==NULL )return ; + radeon_crtc->flip_queue =alloc_workqueue ("radeon-crtc" ,WQ_HIGHPRI ,0 ); +if (!radeon_crtc->flip_queue) { +kfree (radeon_crtc); +return ; + } +drm_crtc_init (dev, &radeon_crtc->base, &radeon_crtc_funcs);drm_mode_crtc_set_gamma_size (&radeon_crtc->base,256 ); radeon_crtc->crtc_id = index; - radeon_crtc->flip_queue =alloc_workqueue ("radeon-crtc" ,WQ_HIGHPRI ,0 ); rdev->mode_info.crtcs[index] = radeon_crtc;if (rdev->family >=CHIP_BONAIRE ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/194 drm/radeon/dpm: fix a memleak in sumo_parse_power_table
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ]
The rdev->pm.dpm.ps allocated by kcalloc should be freed in every following error-handling path. However, in the error-handling of rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, resulting in a memleak in this function.
--- drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/sumo_dpm.c +3 -1
@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev) non_clock_array_index = power_state->v2.nonClockInfoIndex; non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; -if (!rdev->pm.power_state[i].clock_info) +if (!rdev->pm.power_state[i].clock_info) { +kfree (rdev->pm.dpm.ps);return -EINVAL ; + } ps =kzalloc (sizeof (struct sumo_ps ),GFP_KERNEL );if (ps ==NULL ) {kfree (rdev->pm.dpm.ps);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/194 drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ]
The rdev->pm.dpm.ps allocated by kcalloc should be freed in every following error-handling path. However, in the error-handling of rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed, resulting in a memleak in this function.
--- drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/trinity_dpm.c +3 -1
@@ -1771,8 +1771,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev) non_clock_array_index = power_state->v2.nonClockInfoIndex; non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; -if (!rdev->pm.power_state[i].clock_info) +if (!rdev->pm.power_state[i].clock_info) { +kfree (rdev->pm.dpm.ps);return -EINVAL ; + } ps =kzalloc (sizeof (struct sumo_ps ),GFP_KERNEL );if (ps ==NULL ) {kfree (rdev->pm.dpm.ps);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/194 drm/bridge: tc358767: Fix return value on error case
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <[email protected]>
[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ]
If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains 0, instead of an error value.
Return -EINVAL instead.
--- drivers/gpu/drm/bridge/tc358767.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358767.c +1 -1
@@ -1574,7 +1574,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id) }else {if (tc->hpd_pin <0 || tc->hpd_pin >1 ) {dev_err (dev,"failed to parse HPD number\n" ); -return ret; +return -EINVAL ; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/194 media: cx231xx: fix a memleak in cx231xx_init_isoc
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ]
The dma_q->p_left_data alloced by kzalloc should be freed in all the following error handling paths. However, it hasn't been freed in the allocation error paths of dev->video_mode.isoc_ctl.urb and dev->video_mode.isoc_ctl.transfer_buffer.
On the other hand, the dma_q->p_left_data did be freed in the error-handling paths after that of dev->video_mode.isoc_ctl.urb and dev->video_mode.isoc_ctl.transfer_buffer, by calling cx231xx_uninit_isoc(dev). So the same free operation should be done in error-handling paths of those two allocation.
--- drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/cx231xx/cx231xx-core.c +2 -0
@@ -1028,6 +1028,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,if (!dev->video_mode.isoc_ctl.urb) {dev_err (dev->dev,"cannot alloc memory for usb buffers\n" ); +kfree (dma_q->p_left_data);return -ENOMEM ; }
@@ -1037,6 +1038,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,dev_err (dev->dev,"cannot allocate memory for usbtransfer\n" );kfree (dev->video_mode.isoc_ctl.urb); +kfree (dma_q->p_left_data);return -ENOMEM ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/194 media: dvbdev: drop refcount on error path in dvb_device_open()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]
If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).
--- drivers/media/dvb-core/dvbdev.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/dvb-core/dvbdev.c +2 -0
@@ -114,6 +114,8 @@ static int dvb_device_open(struct inode *inode, struct file *file) err = file->f_op->open (inode, file);up_read (&minor_rwsem);mutex_unlock (&dvbdev_mutex); +if (err) +dvb_device_put (dvbdev);return err; } fail:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/194 drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ]
Should be -EOPNOTSUPP.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c +2 -2
@@ -393,7 +393,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,int r;if (!adev->smc_rreg) -return -EPERM ; +return -EOPNOTSUPP ;if (size &0x3 || *pos &0x3 )return -EINVAL ;
@@ -435,7 +435,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *int r;if (!adev->smc_wreg) -return -EPERM ; +return -EOPNOTSUPP ;if (size &0x3 || *pos &0x3 )return -EINVAL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/194 wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ]
Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift(). And fix the undefined bitwise shift behavior problem.
--- .../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c +4 -11
@@ -14,13 +14,6 @@#include "hw.h" #include "table.h" -static u32 _rtl92s_phy_calculate_bit_shift (u32 bitmask) -{ -u32 i =ffs (bitmask); - -return i ? i -1 :32 ; -} -u32 rtl92s_phy_query_bb_reg (struct ieee80211_hw *hw,u32 regaddr,u32 bitmask) {struct rtl_priv *rtlpriv =rtl_priv (hw);
@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask) regaddr, bitmask); originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92s_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); returnvalue = (originalvalue & bitmask) >> bitshift; RT_TRACE(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,if (bitmask !=MASKDWORD ) { originalvalue =rtl_read_dword (rtlpriv, regaddr); - bitshift =_rtl92s_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((originalvalue & (~bitmask)) | (data << bitshift)); }
@@ -160,7 +153,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath, original_value =_rtl92s_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92s_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); readback_value = (original_value & bitmask) >> bitshift;spin_unlock (&rtlpriv->locks.rf_lock);
@@ -191,7 +184,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,if (bitmask !=RFREG_OFFSET_MASK ) { original_value =_rtl92s_phy_rf_serial_read (hw, rfpath, regaddr); - bitshift =_rtl92s_phy_calculate_bit_shift (bitmask); + bitshift =calculate_bit_shift (bitmask); data = ((original_value & (~bitmask)) | (data << bitshift)); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/194 netfilter: nf_tables: mark newset as dead on transaction abort
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ]
If a transaction is aborted, we should mark the to-be-released NEWSET dead, just like commit path does for DEL and DESTROYSET commands.
In both cases all remaining elements will be released via set->ops->destroy().
The existing abort code does NOT post the actual release to the work queue. Also the entire __nf_tables_abort() function is wrapped in gc_seq begin/end pair.
Therefore, async gc worker will never try to release the pending set elements, as gc sequence is always stale.
It might be possible to speed up transaction aborts via work queue too, this would result in a race and a possible use-after-free.
So fix this before it becomes an issue.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -7604,6 +7604,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)nft_trans_destroy (trans);break ; } +nft_trans_set (trans)->dead =1 ;list_del_rcu (&nft_trans_set (trans)->list);break ;case NFT_MSG_DELSET :
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/194 Bluetooth: Fix bogus check for re-auth no supported with non-ssp
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ]
This reverts 19f8def031bfa50c579149b200bfeeb919727b27 "Bluetooth: Fix auth_complete_evt for legacy units" which seems to be working around a bug on a broken controller rather then any limitation imposed by the Bluetooth spec, in fact if there ws not possible to re-auth the command shall fail not succeed.
--- include/net/bluetooth/hci_core.h | 1 - net/bluetooth/hci_conn.c | 8 +++----- net/bluetooth/hci_event.c | 11 ++--------- 3 files changed, 5 insertions(+), 15 deletions(-)
include/net/bluetooth/hci_core.h +0 -1
@@ -673,7 +673,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);/* ----- HCI Connections ----- */ enum {HCI_CONN_AUTH_PEND , -HCI_CONN_REAUTH_PEND ,HCI_CONN_ENCRYPT_PEND ,HCI_CONN_RSWITCH_PEND ,HCI_CONN_MODE_CHANGE_PEND ,
net/bluetooth/hci_conn.c +3 -5
@@ -1341,12 +1341,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)hci_send_cmd (conn->hdev,HCI_OP_AUTH_REQUESTED ,sizeof (cp), &cp); -/* If we're already encrypted set the REAUTH_PEND flag, -* otherwise set the ENCRYPT_PEND. +/* Set the ENCRYPT_PEND to trigger encryption after +* authentication. */ -if (test_bit (HCI_CONN_ENCRYPT , &conn->flags)) -set_bit (HCI_CONN_REAUTH_PEND , &conn->flags); -else +if (!test_bit (HCI_CONN_ENCRYPT , &conn->flags))set_bit (HCI_CONN_ENCRYPT_PEND , &conn->flags); }
net/bluetooth/hci_event.c +2 -9
@@ -2806,14 +2806,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)if (!ev->status) {clear_bit (HCI_CONN_AUTH_FAILURE , &conn->flags); - -if (!hci_conn_ssp_enabled (conn) && -test_bit (HCI_CONN_REAUTH_PEND , &conn->flags)) { -bt_dev_info (hdev,"re-auth of legacy device is not possible." ); - }else { -set_bit (HCI_CONN_AUTH , &conn->flags); - conn->sec_level = conn->pending_sec_level; - } +set_bit (HCI_CONN_AUTH , &conn->flags); + conn->sec_level = conn->pending_sec_level; }else {if (ev->status ==HCI_ERROR_PIN_OR_KEY_MISSING )set_bit (HCI_CONN_AUTH_FAILURE , &conn->flags);
@@ -2822,7 +2816,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb) }clear_bit (HCI_CONN_AUTH_PEND , &conn->flags); -clear_bit (HCI_CONN_REAUTH_PEND , &conn->flags);if (conn->state ==BT_CONFIG ) {if (!ev->status &&hci_conn_ssp_enabled (conn)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 106/194 Bluetooth: btmtkuart: fix recv_buf() return value
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <[email protected]>
[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ]
Serdev recv_buf() callback is supposed to return the amount of bytes consumed, therefore an int in between 0 and count.
Do not return negative number in case of issue, just print an error and return count. This fixes a WARN in ttyport_receive_buf().
--- drivers/bluetooth/btmtkuart.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
drivers/bluetooth/btmtkuart.c +3 -8
@@ -471,7 +471,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count,return data; } -static int btmtkuart_recv (struct hci_dev *hdev,const u8 *data,size_t count) +static void btmtkuart_recv (struct hci_dev *hdev,const u8 *data,size_t count) {struct btmtkuart_dev *bdev =hci_get_drvdata (hdev);const unsigned char *p_left = data, *p_h4;
@@ -510,25 +510,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)bt_dev_err (bdev->hdev,"Frame reassembly failed (%d)" , err); bdev->rx_skb =NULL ; -return err; +return ; } sz_left -= sz_h4; p_left += sz_h4; } - -return 0 ; }static int btmtkuart_receive_buf (struct serdev_device *serdev,const u8 *data,size_t count) {struct btmtkuart_dev *bdev =serdev_device_get_drvdata (serdev); -int err; - err =btmtkuart_recv (bdev->hdev, data, count); -if (err <0 ) -return err; +btmtkuart_recv (bdev->hdev, data, count); bdev->hdev->stat.byte_rx += count;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 107/194 ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ]
syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.
Reading frag_off can only be done if we pulled enough bytes to skb->head. Currently we might access garbage.
[1]
BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768 slab_alloc_node mm/slub.c:3478 [inline] __kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027 kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582 pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098 __pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655 pskb_may_pull_reason include/linux/skbuff.h:2673 [inline] pskb_may_pull include/linux/skbuff.h:2681 [inline] ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline] ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432 __netdev_start_xmit include/linux/netdevice.h:4940 [inline] netdev_start_xmit include/linux/netdevice.h:4954 [inline] xmit_one net/core/dev.c:3548 [inline] dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564 __dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349 dev_queue_xmit include/linux/netdevice.h:3134 [inline] neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137 ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:451 [inline] ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155 ip6_send_skb net/ipv6/ip6_output.c:1952 [inline] ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972 rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582 rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920 inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg net/socket.c:745 [inline] ____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584 ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638 __sys_sendmsg net/socket.c:2667 [inline] __do_sys_sendmsg net/socket.c:2676 [inline] __se_sys_sendmsg net/socket.c:2674 [inline] __x64_sys_sendmsg+0x307/0x490 net/socket.c:2674 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
--- net/ipv6/ip6_tunnel.c | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-)
net/ipv6/ip6_tunnel.c +13 -13
@@ -399,7 +399,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;unsigned int nhoff = raw - skb->data;unsigned int off = nhoff +sizeof (*ipv6h); -u8 next, nexthdr = ipv6h->nexthdr; +u8 nexthdr = ipv6h->nexthdr;while (ipv6_ext_hdr (nexthdr) && nexthdr !=NEXTHDR_NONE ) {struct ipv6_opt_hdr *hdr;
@@ -410,25 +410,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) hdr = (struct ipv6_opt_hdr *)(skb->data + off);if (nexthdr ==NEXTHDR_FRAGMENT ) { -struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; -if (frag_hdr->frag_off) -break ; optlen =8 ; }else if (nexthdr ==NEXTHDR_AUTH ) { optlen =ipv6_authlen (hdr); }else { optlen =ipv6_optlen (hdr); } -/* cache hdr->nexthdr, since pskb_may_pull() might -* invalidate hdr -*/ - next = hdr->nexthdr; -if (nexthdr ==NEXTHDR_DEST ) { -u16 i =2 ; -/* Remember : hdr is no longer valid at this point. */ -if (!pskb_may_pull (skb, off + optlen)) +if (!pskb_may_pull (skb, off + optlen)) +break ; + + hdr = (struct ipv6_opt_hdr *)(skb->data + off); +if (nexthdr ==NEXTHDR_FRAGMENT ) { +struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr; + +if (frag_hdr->frag_off)break ; + } +if (nexthdr ==NEXTHDR_DEST ) { +u16 i =2 ;while (1 ) {struct ipv6_tlv_tnl_enc_lim *tel;
@@ -449,7 +449,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) i++; } } - nexthdr = next; + nexthdr = hdr->nexthdr; off += optlen; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 108/194 ARM: davinci: always select CONFIG_CPU_ARM926T
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ]
The select was lost by accident during the multiplatform conversion. Any davinci-only
arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH':
(.text+0x168): undefined reference to `arm926_flush_kern_cache_all'
--- arch/arm/mach-davinci/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-davinci/Kconfig +1 -0
@@ -3,6 +3,7 @@ menuconfig ARCH_DAVINCI bool "TI DaVinci" depends on ARCH_MULTI_V5 + select CPU_ARM926T select DAVINCI_TIMER select ZONE_DMA select PM_GENERIC_DOMAINS if PM
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 109/194 RDMA/usnic: Silence uninitialized symbol smatch warnings
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ]
The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005 (linux-next), leads to the following Smatch static checker warning:
drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN()
error: uninitialized symbol 'out'.
drivers/infiniband/hw/mthca/mthca_cmd.c
636 int mthca_SYS_EN(struct mthca_dev *dev)
637 {
638 u64 out;
639 int ret;
640
641 ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);We pass out here and it gets used without being initialized.
err = mthca_cmd_post(dev, in_param,
out_param ? *out_param : 0,
^^^^^^^^^^
in_modifier, op_modifier,
op, context->token, 1);It's the same in mthca_cmd_wait() and mthca_cmd_poll().
--- drivers/infiniband/hw/mthca/mthca_cmd.c | 4 ++-- drivers/infiniband/hw/mthca/mthca_main.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/infiniband/hw/mthca/mthca_cmd.c +2 -2
@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)int mthca_SYS_EN (struct mthca_dev *dev) { -u64 out; +u64 out =0 ;int ret; ret =mthca_cmd_imm (dev,0 , &out,0 ,0 ,CMD_SYS_EN ,CMD_TIME_CLASS_D );
@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,int mthca_MGID_HASH (struct mthca_dev *dev,struct mthca_mailbox *mailbox,u16 *hash) { -u64 imm; +u64 imm =0 ;int err; err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,
drivers/infiniband/hw/mthca/mthca_main.c +1 -1
@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev, struct mthca_init_hca_param *init_hca, u64 icm_size) { -u64 aux_pages; +u64 aux_pages =0 ;int err; err =mthca_SET_ICM_SIZE (mdev, icm_size, &aux_pages);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/194 rtlwifi: rtl8192de: make arrays static const, makes object smaller
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
[ Upstream commit b05897ca8c821a16ac03850c4704fe460b3f21a0 ]
Don't populate arrays the stack but instead make them static const. Replace array channel_info with channel_all since it contains the same data as channel_all. Makes object code smaller by 961 bytes.
Before:
text data bss dec hex filename
128147 44250 1024 173421 2a56d ../realtek/rtlwifi/rtl8192de/phy.o
After
text data bss dec hex filename
127122 44314 1024 172460 2a1ac ../realtek/rtlwifi/rtl8192de/phy.o
(gcc version 10.2.0)
Stable-dep-of: b8b2baad2e65 ("wifi: rtlwifi: rtl8192de: using calculate_bit_shift()")
--- .../wireless/realtek/rtlwifi/rtl8192de/phy.c | 48 ++++++++----------- 1 file changed, 20 insertions(+), 28 deletions(-)
drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c +20 -28
@@ -160,6 +160,15 @@ static u32 targetchnl_2g[TARGET_CHNL_NUM_2G] = { 25711, 25658, 25606, 25554, 25502, 25451, 25328 }; +static const u8 channel_all[59 ] = { +1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 , +36 ,38 ,40 ,42 ,44 ,46 ,48 ,50 ,52 ,54 ,56 ,58 , +60 ,62 ,64 ,100 ,102 ,104 ,106 ,108 ,110 ,112 , +114 ,116 ,118 ,120 ,122 ,124 ,126 ,128 ,130 , +132 ,134 ,136 ,138 ,140 ,149 ,151 ,153 ,155 , +157 ,159 ,161 ,163 ,165 +}; +static u32 _rtl92d_phy_calculate_bit_shift (u32 bitmask) {u32 i =ffs (bitmask);
@@ -1356,14 +1365,6 @@ static void _rtl92d_phy_switch_rf_setting(struct ieee80211_hw *hw, u8 channel)u8 rtl92d_get_rightchnlplace_for_iqk (u8 chnl) { -u8 channel_all[59 ] = { -1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 , -36 ,38 ,40 ,42 ,44 ,46 ,48 ,50 ,52 ,54 ,56 ,58 , -60 ,62 ,64 ,100 ,102 ,104 ,106 ,108 ,110 ,112 , -114 ,116 ,118 ,120 ,122 ,124 ,126 ,128 ,130 , -132 ,134 ,136 ,138 ,140 ,149 ,151 ,153 ,155 , -157 ,159 ,161 ,163 ,165 - };u8 place = chnl;if (chnl >14 ) {
@@ -3218,37 +3219,28 @@ void rtl92d_phy_config_macphymode_info(struct ieee80211_hw *hw)u8 rtl92d_get_chnlgroup_fromarray (u8 chnl) {u8 group; -u8 channel_info[59 ] = { -1 ,2 ,3 ,4 ,5 ,6 ,7 ,8 ,9 ,10 ,11 ,12 ,13 ,14 , -36 ,38 ,40 ,42 ,44 ,46 ,48 ,50 ,52 ,54 ,56 , -58 ,60 ,62 ,64 ,100 ,102 ,104 ,106 ,108 , -110 ,112 ,114 ,116 ,118 ,120 ,122 ,124 , -126 ,128 ,130 ,132 ,134 ,136 ,138 ,140 , -149 ,151 ,153 ,155 ,157 ,159 ,161 ,163 , -165 - }; -if (channel_info[chnl] <=3 ) +if (channel_all[chnl] <=3 ) group =0 ; -else if (channel_info[chnl] <=9 ) +else if (channel_all[chnl] <=9 ) group =1 ; -else if (channel_info[chnl] <=14 ) +else if (channel_all[chnl] <=14 ) group =2 ; -else if (channel_info[chnl] <=44 ) +else if (channel_all[chnl] <=44 ) group =3 ; -else if (channel_info[chnl] <=54 ) +else if (channel_all[chnl] <=54 ) group =4 ; -else if (channel_info[chnl] <=64 ) +else if (channel_all[chnl] <=64 ) group =5 ; -else if (channel_info[chnl] <=112 ) +else if (channel_all[chnl] <=112 ) group =6 ; -else if (channel_info[chnl] <=126 ) +else if (channel_all[chnl] <=126 ) group =7 ; -else if (channel_info[chnl] <=140 ) +else if (channel_all[chnl] <=140 ) group =8 ; -else if (channel_info[chnl] <=153 ) +else if (channel_all[chnl] <=153 ) group =9 ; -else if (channel_info[chnl] <=159 ) +else if (channel_all[chnl] <=159 ) group =10 ;else group =11 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/194 drivers/amd/pm: fix a use-after-free in kv_parse_power_table
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]
When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the control flow goes through the following call chains:
kv_parse_power_table
|-> kv_dpm_init
|-> kv_dpm_sw_init |-> kv_dpm_fini
The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its first free in kv_parse_power_table and causes a use-after-free bug.
--- drivers/gpu/drm/amd/amdgpu/kv_dpm.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/kv_dpm.c +1 -3
@@ -2733,10 +2733,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev) non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *) &non_clock_info_array->nonClockInfo[non_clock_array_index]; ps =kzalloc (sizeof (struct kv_ps ),GFP_KERNEL ); -if (ps ==NULL ) { -kfree (adev->pm.dpm.ps); +if (ps ==NULL )return -ENOMEM ; - } adev->pm.dpm.ps[i].ps_priv = ps; k =0 ; idx = (u8 *)&power_state->v2.clockInfoIndex[0 ];
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/194 of: unittest: Fix of_count_phandle_with_args() expected value message
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <[email protected]>
[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ]
The expected result value for the call to of_count_phandle_with_args() was updated from 7 to 8, but the accompanying error message was forgotten.
--- drivers/of/unittest.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/of/unittest.c +1 -1
@@ -500,7 +500,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void) } rc =of_count_phandle_with_args (np,"phandle-list" ,"#phandle-cells" ); -unittest (rc ==8 ,"of_count_phandle_with_args() returned %i, expected 7\n" , rc); +unittest (rc ==8 ,"of_count_phandle_with_args() returned %i, expected 8\n" , rc);for (i =0 ; i <9 ; i++) {bool passed = true;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/194 binder: fix async space check for 0-sized buffers
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream.
Move the padding of 0-sized buffers to an earlier stage to account for this round up during the alloc->free_async_space check.
--- drivers/android/binder_alloc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/android/binder_alloc.c +4 -3
@@ -378,6 +378,10 @@ static struct binder_buffer *binder_allo alloc->pid, extra_buffers_size);return ERR_PTR (-EINVAL ); } + +/* Pad 0-size buffers so they get assigned unique addresses */ + size =max (size,sizeof (void *)); +if (is_async && alloc->free_async_space < size +sizeof (struct binder_buffer )) { binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
@@ -386,9 +390,6 @@ static struct binder_buffer *binder_alloreturn ERR_PTR (-ENOSPC ); } -/* Pad 0-size buffers so they get assigned unique addresses */ - size =max (size,sizeof (void *)); -while (n) { buffer = rb_entry(n, struct binder_buffer, rb_node);BUG_ON (!buffer->free);
Greg Kroah-Hartman
maintainerPATCH 140/194 binder: fix use-after-free in shinkers callback
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream.
The mmap read lock is used during the shrinker's callback, which means that using alloc->vma pointer isn't safe as it can race with munmap(). As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap") the mmap lock is downgraded after the vma has been isolated.
I was able to reproduce this issue by manually adding some delays and triggering page reclaiming through the shrinker's debug sysfs. The following KASAN report confirms the UAF:
==================================================================
BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8 Read of size 8 at addr ffff356ed50e50f0 by task bash/478 CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70 Hardware name: linux,dummy-virt (DT) Call trace: zap_page_range_single+0x470/0x4b8 binder_alloc_free_page+0x608/0xadc __list_lru_walk_one+0x130/0x3b0 list_lru_walk_node+0xc4/0x22c binder_shrink_scan+0x108/0x1dc shrinker_debugfs_scan_write+0x2b4/0x500 full_proxy_write+0xd4/0x140 vfs_write+0x1ac/0x758 ksys_write+0xf0/0x1dc __arm64_sys_write+0x6c/0x9c Allocated by task 492: kmem_cache_alloc+0x130/0x368 vm_area_alloc+0x2c/0x190 mmap_region+0x258/0x18bc do_mmap+0x694/0xa60 vm_mmap_pgoff+0x170/0x29c ksys_mmap_pgoff+0x290/0x3a0 __arm64_sys_mmap+0xcc/0x144 Freed by task 491: kmem_cache_free+0x17c/0x3c8 vm_area_free_rcu_cb+0x74/0x98 rcu_core+0xa38/0x26d4 rcu_core_si+0x10/0x1c __do_softirq+0x2fc/0xd24 Last potentially related work creation: __call_rcu_common.constprop.0+0x6c/0xba0 call_rcu+0x10/0x1c vm_area_free+0x18/0x24 remove_vma+0xe4/0x118 do_vmi_align_munmap.isra.0+0x718/0xb5c do_vmi_munmap+0xdc/0x1fc __vm_munmap+0x10c/0x278 __arm64_sys_munmap+0x58/0x7c
Fix this issue by performing instead a vma_lookup() which will fail to find the vma that was isolated before the mmap lock downgrade. Note that this option has better performance than upgrading to a mmap write lock which would increase contention. Plus, mmap_write_trylock() has been recently removed anyway.
[cmllamas: use find_vma() instead of vma_lookup() as commit ce6d42f2e4a2
is missing in v5.4. This only works because we check the vma against our cached alloc->vma pointer. Also, unlock via up_read() instead of mmap_read_unlock() as commit d8ed45c5dcd4 is also missing in v5.4.]
--- drivers/android/binder_alloc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/android/binder_alloc.c +5 -1
@@ -954,7 +954,9 @@ enum lru_status binder_alloc_free_page(s goto err_mmget;if (!down_read_trylock (&mm->mmap_sem)) goto err_down_read_mmap_sem_failed; - vma =binder_alloc_get_vma (alloc); + vma =find_vma (mm, page_addr); +if (vma && vma !=binder_alloc_get_vma (alloc)) + goto err_invalid_vma;list_lru_isolate (lru, item);spin_unlock (lock);
@@ -980,6 +982,8 @@ enum lru_status binder_alloc_free_page(smutex_unlock (&alloc->mutex);return LRU_REMOVED_RETRY ; +err_invalid_vma: +up_read (&mm->mmap_sem); err_down_read_mmap_sem_failed:mmput_async (mm); err_mmget:
Greg Kroah-Hartman
maintainerPATCH 141/194 Input: atkbd - use ab83 as id when skipping the getid command
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit 58f65f9db7e0de366a5a115c2e2c0703858bba69 upstream.
Barnabás reported that the change to skip the getid command when the controller is in translated mode on laptops caused the Version field of his "AT Translated Set 2 keyboard" input device to change from ab83 to abba, breaking a custom hwdb entry for this keyboard.
Use the standard ab83 id for keyboards when getid is skipped (rather then that getid fails) to avoid reporting a different Version to userspace then before skipping the getid.
--- drivers/input/keyboard/atkbd.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/input/keyboard/atkbd.c +7 -5
@@ -741,9 +741,9 @@ static bool atkbd_is_portable_device(voi* not work. So in this case simply assume a keyboard is connected to avoid * confusing some laptop keyboards. * -* Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is -* ok in translated mode, only atkbd_select_set() checks atkbd->id and in -* translated mode that is a no-op. +* Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard +* 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id +* and in translated mode that is a no-op. */ static bool atkbd_skip_getid (struct atkbd *atkbd) {
@@ -761,6 +761,7 @@ static int atkbd_probe(struct atkbd *atk {struct ps2dev *ps2dev = &atkbd->ps2dev;unsigned char param[2 ]; +bool skip_getid;/* * Some systems, where the bit-twiddling when testing the io-lines of the
@@ -782,7 +783,8 @@ static int atkbd_probe(struct atkbd *atk*/ param[0 ] = param[1 ] =0xa5 ;/* initialize with invalid values */ -if (atkbd_skip_getid (atkbd) ||ps2_command (ps2dev, param,ATKBD_CMD_GETID )) { + skip_getid =atkbd_skip_getid (atkbd); +if (skip_getid ||ps2_command (ps2dev, param,ATKBD_CMD_GETID )) {/* * If the get ID command was skipped or failed, we check if we can at least set
@@ -792,7 +794,7 @@ static int atkbd_probe(struct atkbd *atk param[0 ] =0 ;if (ps2_command (ps2dev, param,ATKBD_CMD_SETLEDS ))return -1 ; - atkbd->id =0xabba ; + atkbd->id = skip_getid ?0xab83 :0xabba ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 142/194 Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 6a20bf46c6254e4e99613309c334519a5f54be53 which is commit c775cbf62ed4911e4f0f23880f01815753123690 upstream.
It is reported to cause problems, so drop it from the 5.4.y tree for now.
--- sound/soc/atmel/sam9g20_wm8731.c | 61 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 61 insertions(+)
sound/soc/atmel/sam9g20_wm8731.c +61 -0
@@ -46,6 +46,35 @@*/ #undef ENABLE_MIC_INPUT +static struct clk *mclk; + +static int at91sam9g20ek_set_bias_level (struct snd_soc_card *card, +struct snd_soc_dapm_context *dapm, +enum snd_soc_bias_level level) +{ +static int mclk_on; +int ret =0 ; + +switch (level) { +case SND_SOC_BIAS_ON : +case SND_SOC_BIAS_PREPARE : +if (!mclk_on) + ret =clk_enable (mclk); +if (ret ==0 ) + mclk_on =1 ; +break ; + +case SND_SOC_BIAS_OFF : +case SND_SOC_BIAS_STANDBY : +if (mclk_on) +clk_disable (mclk); + mclk_on =0 ; +break ; + } + +return ret; +} +static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = {SND_SOC_DAPM_MIC ("Int Mic" ,NULL ),SND_SOC_DAPM_SPK ("Ext Spk" ,NULL ),
@@ -106,6 +135,7 @@ static struct snd_soc_card snd_soc_at91s .owner = THIS_MODULE, .dai_link = &at91sam9g20ek_dai, .num_links = 1, + .set_bias_level = at91sam9g20ek_set_bias_level, .dapm_widgets = at91sam9g20ek_dapm_widgets, .num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets),
@@ -118,6 +148,7 @@ static int at91sam9g20ek_audio_probe(str {struct device_node *np = pdev->dev.of_node;struct device_node *codec_np, *cpu_np; +struct clk *pllb;struct snd_soc_card *card = &snd_soc_at91sam9g20ek;int ret;
@@ -131,6 +162,31 @@ static int at91sam9g20ek_audio_probe(strreturn -EINVAL ; } +/* +* Codec MCLK is supplied by PCK0 - set it up. +*/ + mclk =clk_get (NULL ,"pck0" ); +if (IS_ERR (mclk)) { +dev_err (&pdev->dev,"Failed to get MCLK\n" ); + ret =PTR_ERR (mclk); + goto err; + } + + pllb =clk_get (NULL ,"pllb" ); +if (IS_ERR (pllb)) { +dev_err (&pdev->dev,"Failed to get PLLB\n" ); + ret =PTR_ERR (pllb); + goto err_mclk; + } + ret =clk_set_parent (mclk, pllb); +clk_put (pllb); +if (ret !=0 ) { +dev_err (&pdev->dev,"Failed to set MCLK parent\n" ); + goto err_mclk; + } + +clk_set_rate (mclk,MCLK_RATE ); + card->dev = &pdev->dev;/* Parse device node info */
@@ -174,6 +230,9 @@ static int at91sam9g20ek_audio_probe(strreturn ret; +err_mclk: +clk_put (mclk); + mclk =NULL ; err:atmel_ssc_put_audio (0 );return ret;
@@ -183,6 +242,8 @@ static int at91sam9g20ek_audio_remove(st {struct snd_soc_card *card =platform_get_drvdata (pdev); +clk_disable (mclk); + mclk =NULL ;snd_soc_unregister_card (card);atmel_ssc_put_audio (0 );
Greg Kroah-Hartman
maintainerPATCH 143/194 xen-netback: dont produce zero-size SKB frags
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <[email protected]>
commit c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a upstream.
While frontends may submit zero-size requests (wasting a precious slot), core networking code as of at least 3ece782693c4b ("sock: skb_copy_ubufs support for compound pages") can't deal with SKBs when they have all zero-size fragments. Respond to empty requests right when populating fragments; all further processing is fragment based and hence won't encounter these empty requests anymore.
In a way this should have been that way from the beginning: When no data is to be transferred for a particular request, there's not even a point in validating the respective grant ref. That's no different from e.g. passing NULL into memcpy() when at the same time the size is 0.
This is XSA-448 / CVE-2023-46838.
--- drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++++++++------ 1 file changed, 38 insertions(+), 6 deletions(-)
drivers/net/xen-netback/netback.c +38 -6
@@ -456,12 +456,25 @@ static void xenvif_get_requests(struct x }for (shinfo->nr_frags =0 ; nr_slots >0 && shinfo->nr_frags <MAX_SKB_FRAGS ; - shinfo->nr_frags++, gop++, nr_slots--) { + nr_slots--) { +if (unlikely (!txp->size)) { +unsigned long flags; + +spin_lock_irqsave (&queue->response_lock, flags); +make_tx_response (queue, txp,0 ,XEN_NETIF_RSP_OKAY ); +push_tx_responses (queue); +spin_unlock_irqrestore (&queue->response_lock, flags); + ++txp; +continue ; + } + index =pending_index (queue->pending_cons++); pending_idx = queue->pending_ring[index];xenvif_tx_create_map_op (queue, pending_idx, txp, txp == first ? extra_count :0 , gop);frag_set_pending_idx (&frags[shinfo->nr_frags], pending_idx); + ++shinfo->nr_frags; + ++gop;if (txp == first) txp = txfrags;
@@ -474,20 +487,39 @@ static void xenvif_get_requests(struct x shinfo =skb_shinfo (nskb); frags = shinfo->frags; -for (shinfo->nr_frags =0 ; shinfo->nr_frags < nr_slots; - shinfo->nr_frags++, txp++, gop++) { +for (shinfo->nr_frags =0 ; shinfo->nr_frags < nr_slots; ++txp) { +if (unlikely (!txp->size)) { +unsigned long flags; + +spin_lock_irqsave (&queue->response_lock, flags); +make_tx_response (queue, txp,0 , +XEN_NETIF_RSP_OKAY ); +push_tx_responses (queue); +spin_unlock_irqrestore (&queue->response_lock, + flags); +continue ; + } + index =pending_index (queue->pending_cons++); pending_idx = queue->pending_ring[index];xenvif_tx_create_map_op (queue, pending_idx, txp,0 , gop);frag_set_pending_idx (&frags[shinfo->nr_frags], pending_idx); + ++shinfo->nr_frags; + ++gop; } -skb_shinfo (skb)->frag_list = nskb; - }else if (nskb) { +if (shinfo->nr_frags) { +skb_shinfo (skb)->frag_list = nskb; + nskb =NULL ; + } + } + +if (nskb) {/* A frag_list skb was allocated but it is no longer needed -* because enough slots were converted to copy ops above. +* because enough slots were converted to copy ops above or some +* were empty. */ kfree_skb (nskb); }
Greg Kroah-Hartman
maintainerPATCH 144/194 binder: fix race between mmput() and do_exit()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream.
Task A calls binder_update_page_range() to allocate and insert pages on a remote address space from Task B. For this, Task A pins the remote mm via mmget_not_zero() first. This can race with Task B do_exit() and the final mmput() refcount decrement will come from Task A.
Task A | Task B
------------------+------------------
mmget_not_zero() |
| do_exit()
| exit_mm()
| mmput()
mmput() |
exit_mmap() |
remove_vma() |
fput() |In this case, the work of ____fput() from Task B is queued up in Task A as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup work gets executed. However, Task A instead sleep, waiting for a reply from Task B that never comes (it's dead).
This means the binder_deferred_release() is blocked until an unrelated binder event forces Task A to go back to userspace. All the associated death notifications will also be delayed until then.
In order to fix this use mmput_async() that will schedule the work in the corresponding mm->async_put_work WQ instead of Task A.
--- drivers/android/binder_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/android/binder_alloc.c +2 -2
@@ -272,7 +272,7 @@ static int binder_update_page_range(stru }if (mm) {up_write (&mm->mmap_sem); -mmput (mm); +mmput_async (mm); }return 0 ;
@@ -305,7 +305,7 @@ err_page_ptr_cleared: err_no_vma:if (mm) {up_write (&mm->mmap_sem); -mmput (mm); +mmput_async (mm); }return vma ? -ENOMEM : -ESRCH ; }
Greg Kroah-Hartman
maintainerPATCH 145/194 binder: fix unused alloc->free_async_space
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <[email protected]>
commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream.
Each transaction is associated with a 'struct binder_buffer' that stores the metadata about its buffer area. Since commit 74310e06be4d ("android:
binder: Move buffer out of area shared with user space") this struct is no longer embedded within the buffer itself but is instead allocated on the heap to prevent userspace access to this driver-exclusive info.
Unfortunately, the space of this struct is still being accounted for in the total buffer size calculation, specifically for async transactions. This results in an additional 104 bytes added to every async buffer request, and this area is never used.
This wasted space can be substantial. If we consider the maximum mmap buffer space of SZ_4M, the driver will reserve half of it for async transactions, or 0x200000. This area should, in theory, accommodate up to 262,144 buffers of the minimum 8-byte size. However, after adding the extra 'sizeof(struct binder_buffer)', the total number of buffers drops to only 18,724, which is a sad 7.14% of the actual capacity.
This patch fixes the buffer size calculation to enable the utilization of the entire async buffer space. This is expected to reduce the number of -ENOSPC errors that are seen on the field.
--- drivers/android/binder_alloc.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
drivers/android/binder_alloc.c +3 -5
@@ -382,8 +382,7 @@ static struct binder_buffer *binder_allo/* Pad 0-size buffers so they get assigned unique addresses */ size =max (size,sizeof (void *)); -if (is_async && - alloc->free_async_space < size +sizeof (struct binder_buffer )) { +if (is_async && alloc->free_async_space < size) {binder_alloc_debug (BINDER_DEBUG_BUFFER_ALLOC ,"%d: binder_alloc_buf size %zd failed, no async space left\n" , alloc->pid, size);
@@ -489,7 +488,7 @@ static struct binder_buffer *binder_allo buffer->async_transaction = is_async; buffer->extra_buffers_size = extra_buffers_size;if (is_async) { - alloc->free_async_space -= size +sizeof (struct binder_buffer ); + alloc->free_async_space -= size;binder_alloc_debug (BINDER_DEBUG_BUFFER_ALLOC_ASYNC ,"%d: binder_alloc_buf size %zd async free %zd\n" , alloc->pid, size, alloc->free_async_space);
@@ -614,8 +613,7 @@ static void binder_free_buf_locked(strucBUG_ON (buffer->user_data > alloc->buffer + alloc->buffer_size);if (buffer->async_transaction) { - alloc->free_async_space += buffer_size +sizeof (struct binder_buffer ); - + alloc->free_async_space += buffer_size;binder_alloc_debug (BINDER_DEBUG_BUFFER_ALLOC_ASYNC ,"%d: binder_free_buf size %zd async free %zd\n" , alloc->pid, size, alloc->free_async_space);
Greg Kroah-Hartman
maintainerPATCH 146/194 tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <[email protected]>
commit 71fee48fb772ac4f6cfa63dbebc5629de8b4cc09 upstream.
When offlining and onlining CPUs the overall reported idle and iowait times as reported by /proc/stat jump backward and forward:
cpu 132 0 176 225249 47 6 6 21 0 0
cpu0 80 0 115 112575 33 3 4 18 0 0
cpu1 52 0 60 112673 13 3 1 2 0 0
cpu 133 0 177 226681 47 6 6 21 0 0
cpu0 80 0 116 113387 33 3 4 18 0 0
cpu 133 0 178 114431 33 6 6 21 0 0 <---- jump backward cpu0 80 0 116 114247 33 3 4 18 0 0
cpu1 52 0 61 183 0 3 1 2 0 0 <---- idle + iowait start with 0
cpu 133 0 178 228956 47 6 6 21 0 0 <---- jump forward cpu0 81 0 117 114929 33 3 4 18 0 0
Reason for this is that get_idle_time() in fs/proc/stat.c has different sources for both values depending on if a CPU is online or offline:
- if a CPU is online the values may be taken from its per cpu tick_cpu_sched structure
- if a CPU is offline the values are taken from its per cpu cpustat structure
The problem is that the per cpu tick_cpu_sched structure is set to zero on CPU offline. See tick_cancel_sched_timer() in kernel/time/tick-sched.c.
Therefore when a CPU is brought offline and online afterwards both its idle and iowait sleeptime will be zero, causing a jump backward in total system idle and iowait sleeptime. In a similar way if a CPU is then brought offline again the total idle and iowait sleeptimes will jump forward.
It looks like this behavior was introduced with commit 4b0c0f294f60 ("tick: Cleanup NOHZ per cpu data on cpu down").
This was only noticed now on s390, since we switched to generic idle time reporting with commit be76ea614460 ("s390/idle: remove arch_cpu_idle_time() and corresponding code").
Fix this by preserving the values of idle_sleeptime and iowait_sleeptime members of the per-cpu tick_sched structure on CPU hotplug.
--- kernel/time/tick-sched.c | 5 +++++ 1 file changed, 5 insertions(+)
kernel/time/tick-sched.c +5 -0
@@ -1397,13 +1397,18 @@ void tick_setup_sched_timer(void)void tick_cancel_sched_timer (int cpu) {struct tick_sched *ts = &per_cpu (tick_cpu_sched, cpu); +ktime_t idle_sleeptime, iowait_sleeptime;# ifdef CONFIG_HIGH_RES_TIMERS if (ts->sched_timer.base)hrtimer_cancel (&ts->sched_timer);# endif + idle_sleeptime = ts->idle_sleeptime; + iowait_sleeptime = ts->iowait_sleeptime;memset (ts,0 ,sizeof (*ts)); + ts->idle_sleeptime = idle_sleeptime; + ts->iowait_sleeptime = iowait_sleeptime; }#endif
Greg Kroah-Hartman
maintainerPATCH 147/194 usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit ff2b89de471da942a4d853443688113a44fd35ed upstream.
When CONFIG_USB_OTG is not set, mxs_phy_is_otg_host() will always return false. This behaviour is wrong. Since phy.last_event will always be set for either host or device mode. Therefore, CONFIG_USB_OTG condition can be removed.
--- drivers/usb/phy/phy-mxs-usb.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/phy/phy-mxs-usb.c +1 -2
@@ -388,8 +388,7 @@ static void __mxs_phy_disconnect_line(ststatic bool mxs_phy_is_otg_host (struct mxs_phy *mxs_phy) { -return IS_ENABLED (CONFIG_USB_OTG ) && - mxs_phy->phy.last_event ==USB_EVENT_ID ; +return mxs_phy->phy.last_event ==USB_EVENT_ID ; }static void mxs_phy_disconnect_line (struct mxs_phy *mxs_phy,bool on)
Greg Kroah-Hartman
maintainerPATCH 130/194 gpu/drm/radeon: fix two memleaks in radeon_vm_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ]
When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables allocated before need to be freed. However, neither radeon_vm_init itself nor its caller have done such deallocation.
--- drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/radeon_vm.c +6 -2
@@ -1206,13 +1206,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm) r =radeon_bo_create (rdev, pd_size, align, true,RADEON_GEM_DOMAIN_VRAM ,0 ,NULL ,NULL , &vm->page_directory); -if (r) +if (r) { +kfree (vm->page_tables); + vm->page_tables =NULL ;return r; - + } r =radeon_vm_clear_bo (rdev, vm->page_directory);if (r) {radeon_bo_unref (&vm->page_directory); vm->page_directory =NULL ; +kfree (vm->page_tables); + vm->page_tables =NULL ;return r; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/194 usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uttkarsh Aggarwal <[email protected]>
commit e9d40b215e38480fd94c66b06d79045717a59e9c upstream.
Current implementation blocks the running operations when Plug-out and Plug-In is performed continuously, process gets stuck in dwc3_thread_interrupt().
Code Flow:
CPU1 ->Gadget_start ->dwc3_interrupt ->dwc3_thread_interrupt ->dwc3_process_event_buf ->dwc3_process_event_entry ->dwc3_endpoint_interrupt ->dwc3_ep0_interrupt ->dwc3_ep0_inspect_setup ->dwc3_ep0_stall_and_restart
By this time if pending_list is not empty, it will get the next request on the given list and calls dwc3_gadget_giveback which will unmap request and call its complete() callback to notify upper layers that it has completed. Currently dwc3_gadget_giveback status is set to -ECONNRESET, whereas it should be -ESHUTDOWN based on condition if not dwc->connected is true.
--- drivers/usb/dwc3/ep0.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/dwc3/ep0.c +4 -1
@@ -236,7 +236,10 @@ static void dwc3_ep0_stall_and_restart(sstruct dwc3_request *req; req =next_request (&dep->pending_list); -dwc3_gadget_giveback (dep, req, -ECONNRESET ); +if (!dwc->connected) +dwc3_gadget_giveback (dep, req, -ESHUTDOWN ); +else +dwc3_gadget_giveback (dep, req, -ECONNRESET ); } dwc->ep0state =EP0_SETUP_PHASE ;
Greg Kroah-Hartman
maintainerPATCH 149/194 Revert "usb: dwc3: Soft reset phy on probe for host"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit 7059fbebcb00554c3f31e5b5d93ef6d2d96dc7b4 upstream.
This reverts commit 8bea147dfdf823eaa8d3baeccc7aeb041b41944b.
The phy soft reset GUSB2PHYCFG.PHYSOFTRST only applies to UTMI phy, not ULPI. This fix is incomplete.
--- drivers/usb/dwc3/core.c | 39 +-------------------------------------- 1 file changed, 1 insertion(+), 38 deletions(-)
drivers/usb/dwc3/core.c +1 -38
@@ -250,46 +250,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw* XHCI driver will reset the host block. If dwc3 was configured for * host-only mode or current role is host, then we can return early. */ -if (dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST ) +if (dwc->dr_mode ==USB_DR_MODE_HOST || dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST )return 0 ; -/* -* If the dr_mode is host and the dwc->current_dr_role is not the -* corresponding DWC3_GCTL_PRTCAP_HOST, then the dwc3_core_init_mode -* isn't executed yet. Ensure the phy is ready before the controller -* updates the GCTL.PRTCAPDIR or other settings by soft-resetting -* the phy. -* -* Note: GUSB3PIPECTL[n] and GUSB2PHYCFG[n] are port settings where n -* is port index. If this is a multiport host, then we need to reset -* all active ports. -*/ -if (dwc->dr_mode ==USB_DR_MODE_HOST ) { -u32 usb3_port; -u32 usb2_port; - - usb3_port =dwc3_readl (dwc->regs,DWC3_GUSB3PIPECTL (0 )); - usb3_port |=DWC3_GUSB3PIPECTL_PHYSOFTRST ; -dwc3_writel (dwc->regs,DWC3_GUSB3PIPECTL (0 ), usb3_port); - - usb2_port =dwc3_readl (dwc->regs,DWC3_GUSB2PHYCFG (0 )); - usb2_port |=DWC3_GUSB2PHYCFG_PHYSOFTRST ; -dwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), usb2_port); - -/* Small delay for phy reset assertion */ -usleep_range (1000 ,2000 ); - - usb3_port &= ~DWC3_GUSB3PIPECTL_PHYSOFTRST ; -dwc3_writel (dwc->regs,DWC3_GUSB3PIPECTL (0 ), usb3_port); - - usb2_port &= ~DWC3_GUSB2PHYCFG_PHYSOFTRST ; -dwc3_writel (dwc->regs,DWC3_GUSB2PHYCFG (0 ), usb2_port); - -/* Wait for clock synchronization */ -msleep (50 ); -return 0 ; - } - reg =dwc3_readl (dwc->regs,DWC3_DCTL ); reg |=DWC3_DCTL_CSFTRST ;dwc3_writel (dwc->regs,DWC3_DCTL , reg);
Greg Kroah-Hartman
maintainerPATCH 150/194 Revert "usb: dwc3: dont reset device side if dwc3 was configured as host-only"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit afe28cd686aeb77e8d9140d50fb1cf06a7ecb731 upstream.
This reverts commit e835c0a4e23c38531dcee5ef77e8d1cf462658c7.
Don't omit soft-reset. During initialization, the driver may need to perform a soft reset to ensure the phy is ready when the controller updates the GCTL.PRTCAPDIR or other settings by issuing phy soft-reset. Many platforms often have access to DCTL register for soft-reset despite being host-only. If there are actual reported issues from the platforms that don't expose DCTL registers, then we will need to revisit (perhaps to teach dwc3 to perform xhci's soft-reset USBCMD.HCRST).
--- drivers/usb/dwc3/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +2 -2
@@ -248,9 +248,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw/* * We're resetting only the device side because, if we're in host mode, * XHCI driver will reset the host block. If dwc3 was configured for -* host-only mode or current role is host, then we can return early. +* host-only mode, then we can return early. */ -if (dwc->dr_mode ==USB_DR_MODE_HOST || dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST ) +if (dwc->current_dr_role ==DWC3_GCTL_PRTCAP_HOST )return 0 ; reg =dwc3_readl (dwc->regs,DWC3_DCTL );
Greg Kroah-Hartman
maintainerPATCH 151/194 usb: chipidea: wait controller resume finished for wakeup irq
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <[email protected]>
commit 128d849074d05545becf86e713715ce7676fc074 upstream.
After the chipidea driver introduce extcon for id and vbus, it's able to wakeup from another irq source, in case the system with extcon ID cable, wakeup from usb ID cable and device removal, the usb device disconnect irq may come firstly before the extcon notifier while system resume, so we will get 2 "wakeup" irq, one for usb device disconnect; and one for extcon ID cable change(real wakeup event), current driver treat them as 2 successive wakeup irq so can't handle it correctly, then finally the usb irq can't be enabled. This patch adds a check to bypass further usb events before controller resume finished to fix it.
--- drivers/usb/chipidea/core.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/chipidea/core.c +7 -0
@@ -541,6 +541,13 @@ static irqreturn_t ci_irq_handler(int iru32 otgsc =0 ;if (ci->in_lpm) { +/* +* If we already have a wakeup irq pending there, +* let's just return to wait resume finished firstly. +*/ +if (ci->wakeup_int) +return IRQ_HANDLED ; +disable_irq_nosync (irq); ci->wakeup_int = true;pm_runtime_get (ci->dev);
Greg Kroah-Hartman
maintainerPATCH 152/194 Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <[email protected]>
commit 9c6b789e954fae73c548f39332bcc56bdf0d4373 upstream.
This reverts commit b17b7fe6dd5c6ff74b38b0758ca799cdbb79e26e.
That commit messed up the reference counting, so it needs to be rethought.
--- drivers/usb/typec/class.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/usb/typec/class.c +2 -3
@@ -193,7 +193,7 @@ static void typec_altmode_put_partner(stif (!partner)return ; - adev = &altmode->adev; + adev = &partner->adev;if (is_typec_plug (adev->dev.parent)) {struct typec_plug *plug =to_typec_plug (adev->dev.parent);
@@ -465,8 +465,7 @@ static void typec_altmode_release(struct {struct altmode *alt =to_altmode (to_typec_altmode (dev)); -if (!is_typec_port (dev->parent)) -typec_altmode_put_partner (alt); +typec_altmode_put_partner (alt);altmode_id_remove (alt->adev.dev.parent, alt->id);kfree (alt);
Greg Kroah-Hartman
maintainerPATCH 153/194 usb: typec: class: fix typec_altmode_put_partner to put plugs
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <[email protected]>
commit 5962ded777d689cd8bf04454273e32228d7fb71f upstream.
When typec_altmode_put_partner is called by a plug altmode upon release, the port altmode the plug belongs to will not remove its reference to the plug. The check to see if the altmode being released is a plug evaluates against the released altmode's partner instead of the calling altmode, so change adev in typec_altmode_put_partner to properly refer to the altmode being released.
Because typec_altmode_set_partner calls get_device() on the port altmode, add partner_adev that points to the port altmode in typec_put_partner to call put_device() on. typec_altmode_set_partner is not called for port altmodes, so add a check in typec_altmode_release to prevent typec_altmode_put_partner() calls on port altmode release.
--- drivers/usb/typec/class.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/usb/typec/class.c +6 -3
@@ -189,11 +189,13 @@ static void typec_altmode_put_partner(st {struct altmode *partner = altmode->partner;struct typec_altmode *adev; +struct typec_altmode *partner_adev;if (!partner)return ; - adev = &partner->adev; + adev = &altmode->adev; + partner_adev = &partner->adev;if (is_typec_plug (adev->dev.parent)) {struct typec_plug *plug =to_typec_plug (adev->dev.parent);
@@ -202,7 +204,7 @@ static void typec_altmode_put_partner(st }else { partner->partner =NULL ; } -put_device (&adev->dev); +put_device (&partner_adev->dev); }static void *typec_port_match (struct device_connection *con,int ep,void *data)
@@ -465,7 +467,8 @@ static void typec_altmode_release(struct {struct altmode *alt =to_altmode (to_typec_altmode (dev)); -typec_altmode_put_partner (alt); +if (!is_typec_port (dev->parent)) +typec_altmode_put_partner (alt);altmode_id_remove (alt->adev.dev.parent, alt->id);kfree (alt);
Greg Kroah-Hartman
maintainerPATCH 154/194 usb: mon: Fix atomicity violation in mon_bin_vma_fault
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <[email protected]>
commit 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c upstream.
In mon_bin_vma_fault():
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= rp->b_size)
return VM_FAULT_SIGBUS;
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;The code is executed without holding any lock.
In mon_bin_vma_close():
spin_lock_irqsave(&rp->b_lock, flags);
rp->mmap_active--;
spin_unlock_irqrestore(&rp->b_lock, flags);In mon_bin_ioctl():
spin_lock_irqsave(&rp->b_lock, flags);
if (rp->mmap_active) {
...
} else {
...
kfree(rp->b_vec);
rp->b_vec = vec;
rp->b_size = size;
...
}
spin_unlock_irqrestore(&rp->b_lock, flags);Concurrent execution of mon_bin_vma_fault() with mon_bin_vma_close() and mon_bin_ioctl() could lead to atomicity violations. mon_bin_vma_fault() accesses rp->b_size and rp->b_vec without locking, risking array out-of-bounds access or use-after-free bugs due to possible modifications in mon_bin_ioctl().
This possible bug is found by an experimental static analysis tool developed by our team, BassCheck[1]. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations. The above possible bug is reported when our tool analyzes the source code of Linux 6.2.
To address this issue, it is proposed to add a spin lock pair in mon_bin_vma_fault() to ensure atomicity. With this patch applied, our tool never reports the possible bug, with the kernel configuration allyesconfig for x86_64. Due to the lack of associated hardware, we cannot test the patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
--- drivers/usb/mon/mon_bin.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/mon/mon_bin.c +6 -1
@@ -1247,14 +1247,19 @@ static vm_fault_t mon_bin_vma_fault(strustruct mon_reader_bin *rp = vmf->vma->vm_private_data;unsigned long offset, chunk_idx;struct page *pageptr; +unsigned long flags; +spin_lock_irqsave (&rp->b_lock, flags); offset = vmf->pgoff <<PAGE_SHIFT ; -if (offset >= rp->b_size) +if (offset >= rp->b_size) { +spin_unlock_irqrestore (&rp->b_lock, flags);return VM_FAULT_SIGBUS ; + } chunk_idx = offset /CHUNK_SIZE ; pageptr = rp->b_vec[chunk_idx].pg;get_page (pageptr); vmf->page = pageptr; +spin_unlock_irqrestore (&rp->b_lock, flags);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 131/194 drivers: clk: zynqmp: calculate closest mux rate
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Buddhabhatti <[email protected]>
[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ]
Currently zynqmp clock driver is not calculating closest mux rate and because of that Linux is not setting proper frequency for CPU and not able to set given frequency for dynamic frequency scaling.
E.g., In current logic initial acpu clock parent and frequency as below
apll1 0 0 0 2199999978 0 0 50000 Y
acpu0_mux 0 0 0 2199999978 0 0 50000 Y
acpu0_idiv1 0 0 0 2199999978 0 0 50000 Y
acpu0 0 0 0 2199999978 0 0 50000 YAfter changing acpu frequency to 549999994 Hz using CPU freq scaling its selecting incorrect parent which is not closest frequency.
rpll_to_xpd 0 0 0 1599999984 0 0 50000 Y
acpu0_mux 0 0 0 1599999984 0 0 50000 Y
acpu0_div1 0 0 0 533333328 0 0 50000 Y
acpu0 0 0 0 533333328 0 0 50000 YParent should remain same since 549999994 = 2199999978 / 4.
So use __clk_mux_determine_rate_closest() generic function to calculate closest rate for mux clock. After this change its selecting correct parent and correct clock rate.
apll1 0 0 0 2199999978 0 0 50000 Y
acpu0_mux 0 0 0 2199999978 0 0 50000 Y
acpu0_div1 0 0 0 549999995 0 0 50000 Y
acpu0 0 0 0 549999995 0 0 50000 Y--- drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/zynqmp/clk-mux-zynqmp.c +1 -1
@@ -85,7 +85,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index)static const struct clk_ops zynqmp_clk_mux_ops = { .get_parent = zynqmp_clk_mux_get_parent, .set_parent = zynqmp_clk_mux_set_parent, - .determine_rate = __clk_mux_determine_rate, + .determine_rate = __clk_mux_determine_rate_closest, };static const struct clk_ops zynqmp_clk_mux_ro_ops = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 132/194 watchdog: set cdev owner before adding
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Curtis Klein <[email protected]>
[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ]
When the new watchdog character device is registered, it becomes available for opening. This creates a race where userspace may open the device before the character device's owner is set. This results in an imbalance in module_get calls as the cdev_get in cdev_open will not increment the reference count on the watchdog driver module.
This causes problems when the watchdog character device is released as the module loader's reference will also be released. This makes it impossible to open the watchdog device later on as it now appears that the module is being unloaded. The open will fail with -ENXIO from chrdev_open.
The legacy watchdog device will fail with -EBUSY from the try_module_get in watchdog_open because it's module owner is the watchdog core module so it can still be opened but it will fail to get a refcount on the underlying watchdog device driver.
--- drivers/watchdog/watchdog_dev.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/watchdog/watchdog_dev.c +1 -2
@@ -1007,6 +1007,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)/* Fill in the data structures */ cdev_init (&wd_data->cdev, &watchdog_fops); + wd_data->cdev.owner = wdd->ops->owner;/* Add the device */ err =cdev_device_add (&wd_data->cdev, &wd_data->dev);
@@ -1021,8 +1022,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)return err; } - wd_data->cdev.owner = wdd->ops->owner; -/* Record time of most recent heartbeat as 'just before now'. */ wd_data->last_hw_keepalive =ktime_sub (ktime_get (),1 );watchdog_set_open_deadline (wd_data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/194 watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <[email protected]>
[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ]
Avoid unnecessary crashes by claiming only NMIs that are due to ERROR signalling or generated by the hpwdt hardware device.
The code does this, but only for iLO5.
The intent was to preserve legacy, Gen9 and earlier, semantics of using hpwdt for error containtment as hardware/firmware would signal fatal IO errors as an NMI with the expectation of hpwdt crashing the system. Howerver, these IO errors should be received by hpwdt as an NMI_IO_CHECK. So the test is overly permissive and should not be limited to only ilo5.
We need to enable this protection for future iLOs not matching the current PCI IDs.
--- drivers/watchdog/hpwdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/hpwdt.c +1 -1
@@ -174,7 +174,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)"3. OA Forward Progress Log\n" "4. iLO Event Log" ; -if (ilo5 && ulReason ==NMI_UNKNOWN && !mynmi) +if (ulReason ==NMI_UNKNOWN && !mynmi)return NMI_DONE ;if (ilo5 && !pretimeout && !mynmi)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/194 watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ]
Users report about the unexpected behavior for setting timeouts above 15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations. But looking at the code shows that max_timeout based on the register value PM_WDOG_TIME_SET, which is the maximum.
Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core") the watchdog core is able to handle this problem.
This fix has been tested with watchdog-test from selftests.
--- drivers/watchdog/bcm2835_wdt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/watchdog/bcm2835_wdt.c +2 -1
@@ -42,6 +42,7 @@#define SECS_TO_WDOG_TICKS (x) ((x) << 16)#define WDOG_TICKS_TO_SECS (x) ((x) >> 16) +#define WDOG_TICKS_TO_MSECS (x) ((x) * 1000 >> 16)struct bcm2835_wdt {void __iomem *base;
@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = { .info = &bcm2835_wdt_info, .ops = &bcm2835_wdt_ops, .min_timeout = 1, - .max_timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), + .max_hw_heartbeat_ms = WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET), .timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET), };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/194 clk: si5341: fix an error code problem in si5341_output_clk_set_rate
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <[email protected]>
[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ]
regmap_bulk_write() return zero or negative error code, return the value of regmap_bulk_write() rather than '0'.
--- drivers/clk/clk-si5341.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/clk/clk-si5341.c +1 -3
@@ -732,10 +732,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate, r[0 ] = r_div ? (r_div &0xff ) :1 ; r[1 ] = (r_div >>8 ) &0xff ; r[2 ] = (r_div >>16 ) &0xff ; - err =regmap_bulk_write (output->data->regmap, +return regmap_bulk_write (output->data->regmap,SI5341_OUT_R_REG (output), r,3 ); - -return 0 ; }static int si5341_output_reparent (struct clk_si5341_output *output,u8 index)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/194 mmc: sdhci_omap: Fix TI SoC dependencies
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <[email protected]>
[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ]
The sdhci_omap is specific to older TI SoCs, update the dependencies for those SoCs and compile testing. While we're at it update the text to reflect the wider range of supported TI SoCS the driver now supports.
--- drivers/mmc/host/Kconfig | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mmc/host/Kconfig +3 -2
@@ -996,13 +996,14 @@ config MMC_SDHCI_XENON config MMC_SDHCI_OMAP tristate "TI SDHCI Controller Support" + depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST depends on MMC_SDHCI_PLTFM && OF select THERMAL imply TI_SOC_THERMAL help This selects the Secure Digital Host Controller Interface (SDHCI) - support present in TI's DRA7 SOCs. The controller supports - SD/MMC/SDIO devices. + support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller + supports SD/MMC/SDIO devices. If you have a controller with this interface, say Y or M here.
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/194 of: Fix double free in of_parse_phandle_with_args_map
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian A. Ehrhardt <[email protected]>
[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ]
In of_parse_phandle_with_args_map() the inner loop that iterates through the map entries calls of_node_put(new) to free the reference acquired by the previous iteration of the inner loop. This assumes that the value of "new" is NULL on the first iteration of the inner loop.
Make sure that this is true in all iterations of the outer loop by setting "new" to NULL after its value is assigned to "cur".
Extend the unittest to detect the double free and add an additional test case that actually triggers this path.
--- drivers/of/base.c | 1 + drivers/of/unittest-data/tests-phandle.dtsi | 10 ++- drivers/of/unittest.c | 74 ++++++++++++--------- 3 files changed, 53 insertions(+), 32 deletions(-)
drivers/of/base.c +1 -0
@@ -1744,6 +1744,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np, out_args->np = new;of_node_put (cur); cur = new; + new =NULL ; } put:of_node_put (cur);
drivers/of/unittest-data/tests-phandle.dtsi +9 -1
@@ -38,6 +38,13 @@ provider4: provider4 { phandle-map-pass-thru = <0x0 0xf0>; }; + provider5: provider5 { + #phandle-cells = <2>; + phandle-map = <2 7 &provider4 2 3>; + phandle-map-mask = <0xff 0xf>; + phandle-map-pass-thru = <0x0 0xf0>; + }; + consumer-a { phandle-list = <&provider1 1>, <&provider2 2 0>,
@@ -64,7 +71,8 @@ consumer-b { <&provider4 4 0x100>, <&provider4 0 0x61>, <&provider0>, - <&provider4 19 0x20>; + <&provider4 19 0x20>, + <&provider5 2 7>; phandle-list-bad-phandle = <12345678 0 0>; phandle-list-bad-args = <&provider2 1 0>, <&provider4 0>;
drivers/of/unittest.c +43 -31
144 lines not on this page · raw message
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/194 drm/amd/pm: fix a double-free in si_dpm_init
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <[email protected]>
[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ]
When the allocation of adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails, amdgpu_free_extended_power_table is called to free some fields of adev. However, when the control flow returns to si_dpm_sw_init, it goes to label dpm_failed and calls si_dpm_fini, which calls amdgpu_free_extended_power_table again and free those fields again. Thus a double-free is triggered.
--- drivers/gpu/drm/amd/amdgpu/si_dpm.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/si_dpm.c +2 -3
@@ -7349,10 +7349,9 @@ static int si_dpm_init(struct amdgpu_device *adev)kcalloc (4 ,sizeof (struct amdgpu_clock_voltage_dependency_entry ),GFP_KERNEL ); -if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) { -amdgpu_free_extended_power_table (adev); +if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)return -ENOMEM ; - } + adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count =4 ; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0 ].clk =0 ; adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0 ].v =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 156/194 fbdev: flush deferred work in fb_deferred_io_fsync()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <[email protected]>
commit 15e4c1f462279b4e128f27de48133e0debe9e0df upstream.
The driver's fsync() is supposed to flush any pending operation to hardware. It is implemented in this driver by cancelling the queued deferred IO first, then schedule it for "immediate execution" by calling schedule_delayed_work() again with delay=0. However, setting delay=0 only means the work is scheduled immediately, it does not mean the work is executed immediately. There is no guarantee that the work is finished after schedule_delayed_work() returns. After this driver's fsync() returns, there can still be pending work. Furthermore, if close() is called by users immediately after fsync(), the pending work gets cancelled and fsync() may do nothing.
To ensure that the deferred IO completes, use flush_delayed_work() instead. Write operations to this driver either write to the device directly, or invoke schedule_delayed_work(); so by flushing the workqueue, it can be guaranteed that all previous writes make it to the device.
--- drivers/video/fbdev/core/fb_defio.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
drivers/video/fbdev/core/fb_defio.c +1 -5
@@ -78,11 +78,7 @@ int fb_deferred_io_fsync(struct file *fireturn 0 ;inode_lock (inode); -/* Kill off the delayed work */ -cancel_delayed_work_sync (&info->deferred_work); - -/* Run it immediately */ -schedule_delayed_work (&info->deferred_work,0 ); +flush_delayed_work (&info->deferred_work);inode_unlock (inode);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 165/194 MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 3c1e5abcda64bed0c7bffa65af2316995f269a61 ]
When calling spi_register_board_info(),
--- arch/mips/alchemy/devboards/db1550.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/alchemy/devboards/db1550.c +1 -1
@@ -588,7 +588,7 @@ int __init db1550_dev_setup(void)i2c_register_board_info (0 , db1550_i2c_devs,ARRAY_SIZE (db1550_i2c_devs));spi_register_board_info (db1550_spi_devs, -ARRAY_SIZE (db1550_i2c_devs)); +ARRAY_SIZE (db1550_spi_devs)); c =clk_get (NULL ,"psc0_intclk" );if (!IS_ERR (c)) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 166/194 serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <[email protected]>
[ Upstream commit ad90d0358bd3b4554f243a425168fc7cebe7d04e ]
Returning an error code from .remove() makes the driver core emit the little helpful error message:
remove callback returned a non-zero value. This will be ignored.
and then remove the device anyhow. So all resources that were not freed are leaked in this case. Skipping serial8250_unregister_port() has the potential to keep enough of the UART around to trigger a use-after-free.
So replace the error return (and with it the little helpful error message) by a more useful error message and continue to cleanup.
--- drivers/tty/serial/8250/8250_omap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_omap.c +1 -1
@@ -1278,7 +1278,7 @@ static int omap8250_remove(struct platform_device *pdev) err =pm_runtime_resume_and_get (&pdev->dev);if (err) -return err; +dev_err (&pdev->dev,"Failed to resume hardware\n" );pm_runtime_dont_use_autosuspend (&pdev->dev);pm_runtime_put_sync (&pdev->dev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 167/194 binder: print warnings when detecting oneway spamming.
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martijn Coenen <[email protected]>
[ Upstream commit 261e7818f06ec51e488e007f787ccd7e77272918 ]
The most common cause of the binder transaction buffer filling up is a client rapidly firing oneway transactions into a process, before it has a chance to handle them. Yet the root cause of this is often hard to debug, because either the system or the app will stop, and by that time binder debug information we dump in bugreports is no longer relevant.
This change warns as soon as a process dips below 80% of its oneway space (less than 100kB available in the configuration), when any one process is responsible for either more than 50 transactions, or more than 50% of the oneway space.
Stable-dep-of: c6d05e0762ab ("binder: fix unused alloc->free_async_space")
--- drivers/android/binder.c | 2 +- drivers/android/binder_alloc.c | 55 +++++++++++++++++++++++-- drivers/android/binder_alloc.h | 5 ++- drivers/android/binder_alloc_selftest.c | 2 +- 4 files changed, 58 insertions(+), 6 deletions(-)
drivers/android/binder.c +1 -1
@@ -3425,7 +3425,7 @@ static void binder_transaction(struct binder_proc *proc, t->buffer =binder_alloc_new_buf (&target_proc->alloc, tr->data_size, tr->offsets_size, extra_buffers_size, - !reply && (t->flags &TF_ONE_WAY )); + !reply && (t->flags &TF_ONE_WAY ), current->tgid);if (IS_ERR (t->buffer)) {/* * -ESRCH indicates VMA cleared. The target is dying.
drivers/android/binder_alloc.c +52 -3
94 lines not on this page · raw message
drivers/android/binder_alloc.h +4 -1
@@ -33,6 +33,7 @@ struct binder_transaction;* @offsets_size: size of array of offsets * @extra_buffers_size: size of space for other objects (like sg lists) * @user_data: user pointer to base of buffer space +* @pid: pid to attribute the buffer to (caller) * * Bookkeeping structure for binder transaction buffers */
@@ -53,6 +54,7 @@ struct binder_buffer {size_t offsets_size;size_t extra_buffers_size;void __user *user_data; +int pid; };/**
@@ -119,7 +121,8 @@ extern struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,size_t data_size, size_t offsets_size, size_t extra_buffers_size, - int is_async); + int is_async, + int pid);extern void binder_alloc_init (struct binder_alloc *alloc);extern int binder_alloc_shrinker_init (void );extern void binder_alloc_shrinker_exit (void );
drivers/android/binder_alloc_selftest.c +1 -1
@@ -119,7 +119,7 @@ static void binder_selftest_alloc_buf(struct binder_alloc *alloc,int i;for (i =0 ; i <BUFFER_NUM ; i++) { - buffers[i] =binder_alloc_new_buf (alloc, sizes[i],0 ,0 ,0 ); + buffers[i] =binder_alloc_new_buf (alloc, sizes[i],0 ,0 ,0 ,0 );if (IS_ERR (buffers[i]) || !check_buffer_pages_allocated (alloc, buffers[i], sizes[i])) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 168/194 acpi: property: Let args be NULL in __acpi_node_get_property_reference
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit bef52aa0f3de1b7d8c258c13b16e577361dabf3a ]
fwnode_get_property_reference_args() may not be called with args argument NULL on ACPI, OF already supports this. Add the missing NULL checks and document this.
The purpose is to be able to count the references.
--- drivers/acpi/property.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/acpi/property.c +4 -0
@@ -646,6 +646,7 @@ acpi_fwnode_get_named_child_node(const struct fwnode_handle *fwnode,* @index: Index of the reference to return * @num_args: Maximum number of arguments after each reference * @args: Location to store the returned reference with optional arguments +* (may be NULL) * * Find property with @name, verifify that it is a package containing at least * one object reference and if so, store the ACPI device object pointer to the
@@ -704,6 +705,9 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,if (ret)return ret == -ENODEV ? -EINVAL : ret; +if (!args) +return 0 ; + args->fwnode =acpi_fwnode_handle (device); args->nargs =0 ;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 169/194 software node: Let args be NULL in software_node_get_reference_args
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
[ Upstream commit 1eaea4b3604eb9ca7d9a1e73d88fc121bb4061f5 ]
fwnode_get_property_reference_args() may not be called with args argument NULL and while OF already supports this. Add the missing NULL check.
The purpose is to be able to count the references.
--- drivers/base/swnode.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/base/swnode.c +3 -0
@@ -604,6 +604,9 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,if (nargs >NR_FWNODE_REFERENCE_ARGS )return -EINVAL ; +if (!args) +return 0 ; + args->fwnode =software_node_get (refnode); args->nargs = nargs;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 170/194 perf genelf: Set ELF program header addresses properly
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <[email protected]>
[ Upstream commit 1af478903fc48c1409a8dd6b698383b62387adf1 ]
The text section starts after the ELF headers so PHDR.p_vaddr and others should have the correct addresses.
--- tools/perf/util/genelf.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/perf/util/genelf.c +3 -3
@@ -296,9 +296,9 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,*/ phdr =elf_newphdr (e,1 ); phdr[0 ].p_type =PT_LOAD ; - phdr[0 ].p_offset =0 ; - phdr[0 ].p_vaddr =0 ; - phdr[0 ].p_paddr =0 ; + phdr[0 ].p_offset =GEN_ELF_TEXT_OFFSET ; + phdr[0 ].p_vaddr =GEN_ELF_TEXT_OFFSET ; + phdr[0 ].p_paddr =GEN_ELF_TEXT_OFFSET ; phdr[0 ].p_filesz = csize; phdr[0 ].p_memsz = csize; phdr[0 ].p_flags =PF_X |PF_R ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 171/194 nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <[email protected]>
[ Upstream commit efa56305908ba20de2104f1b8508c6a7401833be ]
If the host sends an H2CData command with an invalid DATAL, the kernel may crash in nvmet_tcp_build_pdu_iovec().
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp] Call trace: process_one_work+0x174/0x3c8 worker_thread+0x2d0/0x3e8 kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent with the packet size.
Also, the PDU length should never exceed the MAXH2CDATA parameter which has been communicated to the host in nvmet_tcp_handle_icreq().
--- drivers/nvme/target/tcp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/nvme/target/tcp.c +12 -1
@@ -18,6 +18,7 @@#include "nvmet.h" #define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE) +#define NVMET_TCP_MAXH2CDATA 0x400000/* 16M arbitrary limit */ #define NVMET_TCP_RECV_BUDGET 8#define NVMET_TCP_SEND_BUDGET 8
@@ -818,7 +819,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) icresp->hdr.pdo =0 ; icresp->hdr.plen =cpu_to_le32 (icresp->hdr.hlen); icresp->pfv =cpu_to_le16 (NVME_TCP_PFV_1_0 ); - icresp->maxdata =cpu_to_le32 (0x400000 );/* 16M arbitrary limit */ + icresp->maxdata =cpu_to_le32 (NVMET_TCP_MAXH2CDATA ); icresp->cpda =0 ;if (queue->hdr_digest) icresp->digest |=NVME_TCP_HDR_DIGEST_ENABLE ;
@@ -866,6 +867,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue) {struct nvme_tcp_data_pdu *data = &queue->pdu.data;struct nvmet_tcp_cmd *cmd; +unsigned int plen;if (likely (queue->nr_cmds)) {if (unlikely (data->ttag >= queue->nr_cmds)) {
@@ -889,7 +891,16 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)return -EPROTO ; } + plen =le32_to_cpu (data->hdr.plen); cmd->pdu_len =le32_to_cpu (data->data_length); +if (unlikely (cmd->pdu_len != (plen -sizeof (*data)) || + cmd->pdu_len ==0 || + cmd->pdu_len >NVMET_TCP_MAXH2CDATA )) { +pr_err ("H2CData PDU len %u is invalid\n" , cmd->pdu_len); +/* FIXME: use proper transport errors */ +nvmet_tcp_fatal_error (queue); +return -EPROTO ; + } cmd->pdu_recv =0 ;nvmet_tcp_map_pdu_iovec (cmd); queue->cmd = cmd;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 173/194 perf env: Add perf_env__numa_node()
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
[ Upstream commit 389799a7a1e86c55f38897e679762efadcc9dedd ]
To speed up cpu to node lookup, add perf_env__numa_node(), that creates cpu array on the first lookup, that holds numa nodes for each stored cpu.
Stable-dep-of: 9c51f8788b5d ("perf env: Avoid recursively taking env->bpf_progs.lock")
--- tools/perf/util/env.c | 40 ++++++++++++++++++++++++++++++++++++++++ tools/perf/util/env.h | 6 ++++++ 2 files changed, 46 insertions(+)
tools/perf/util/env.c +40 -0
@@ -183,6 +183,7 @@ void perf_env__exit(struct perf_env *env)zfree (&env->sibling_threads);zfree (&env->pmu_mappings);zfree (&env->cpu); +zfree (&env->numa_map);for (i =0 ; i < env->nr_numa_nodes; i++)perf_cpu_map__put (env->numa_nodes[i].map);
@@ -342,3 +343,42 @@ const char *perf_env__arch(struct perf_env *env)return normalize_arch (arch_name); } + + +int perf_env__numa_node (struct perf_env *env,int cpu) +{ +if (!env->nr_numa_map) { +struct numa_node *nn; +int i, nr =0 ; + +for (i =0 ; i < env->nr_numa_nodes; i++) { + nn = &env->numa_nodes[i]; + nr =max (nr,perf_cpu_map__max (nn->map)); + } + + nr++; + +/* +* We initialize the numa_map array to prepare +* it for missing cpus, which return node -1 +*/ + env->numa_map =malloc (nr *sizeof (int )); +if (!env->numa_map) +return -1 ; + +for (i =0 ; i < nr; i++) + env->numa_map[i] =-1 ; + + env->nr_numa_map = nr; + +for (i =0 ; i < env->nr_numa_nodes; i++) { +int tmp, j; + + nn = &env->numa_nodes[i]; +perf_cpu_map__for_each_cpu (j, tmp, nn->map) + env->numa_map[j] = i; + } + } + +return cpu >=0 && cpu < env->nr_numa_map ? env->numa_map[cpu] :-1 ; +}
tools/perf/util/env.h +6 -0
@@ -87,6 +87,10 @@ struct perf_env {struct rb_root btfs;u32 btfs_cnt; } bpf_progs; + +/* For fast cpu to numa node lookup via perf_env__numa_node */ +int *numa_map; +int nr_numa_map; };enum perf_compress_type {
@@ -119,4 +123,6 @@ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, __u32 prog_id);bool perf_env__insert_btf (struct perf_env *env,struct btf_node *btf_node);struct btf_node *perf_env__find_btf (struct perf_env *env,__u32 btf_id); + +int perf_env__numa_node (struct perf_env *env,int cpu);#endif /* __PERF_ENV_H */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 174/194 perf record: Move sb_evlist to struct record
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit bc477d7983e345262757568ec27be0395dc2fe73 ]
Where state related to a 'perf record' session is grouped.
Stable-dep-of: 9c51f8788b5d ("perf env: Avoid recursively taking env->bpf_progs.lock")
--- tools/perf/builtin-record.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/perf/builtin-record.c +4 -4
@@ -80,6 +80,7 @@ struct record {struct auxtrace_record *itr;struct evlist *evlist;struct perf_session *session; +struct evlist *sb_evlist;int realtime_prio;bool no_buildid;bool no_buildid_set;
@@ -1343,7 +1344,6 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)struct perf_data *data = &rec->data;struct perf_session *session;bool disabled = false, draining = false; -struct evlist *sb_evlist =NULL ;int fd;float ratio =0 ;
@@ -1455,9 +1455,9 @@ static int __cmd_record(struct record *rec, int argc, const char **argv) }if (!opts->no_bpf_event) -bpf_event__add_sb_event (&sb_evlist, &session->header.env); +bpf_event__add_sb_event (&rec->sb_evlist, &session->header.env); -if (perf_evlist__start_sb_thread (sb_evlist, &rec->opts.target)) { +if (perf_evlist__start_sb_thread (rec->sb_evlist, &rec->opts.target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" ); opts->no_bpf_event = true; }
@@ -1731,7 +1731,7 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)perf_session__delete (session);if (!opts->no_bpf_event) -perf_evlist__stop_sb_thread (sb_evlist); +perf_evlist__stop_sb_thread (rec->sb_evlist);return status; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 157/194 rootfs: Fix support for rootfstype= when root= is given
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Berger <[email protected]>
commit 21528c69a0d8483f7c6345b1a0bc8d8975e9a172 upstream.
Documentation/filesystems/ramfs-rootfs-initramfs.rst states:
If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by default. To force ramfs, add "rootfstype=ramfs" to the kernel command line.
This currently does not work when root= is provided since then saved_root_name contains a string and rootfstype= is ignored. Therefore, ramfs is currently always chosen when root= is provided.
The current behavior for rootfs's filesystem is:
root= | rootfstype= | chosen rootfs filesystem
------------+-------------+--------------------------
unspecified | unspecified | tmpfs
unspecified | tmpfs | tmpfs
unspecified | ramfs | ramfs
provided | ignored | ramfsrootfstype= should be respected regardless whether root= is given, as shown below:
root= | rootfstype= | chosen rootfs filesystem
------------+-------------+--------------------------
unspecified | unspecified | tmpfs (as before)
unspecified | tmpfs | tmpfs (as before)
unspecified | ramfs | ramfs (as before)
provided | unspecified | ramfs (compatibility with before)
provided | tmpfs | tmpfs (new)
provided | ramfs | ramfs (new)This table represents the new behavior.
--- init/do_mounts.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
init/do_mounts.c +6 -3
@@ -643,7 +643,10 @@ struct file_system_type rootfs_fs_type =void __init init_rootfs (void ) { -if (IS_ENABLED (CONFIG_TMPFS ) && !saved_root_name[0 ] && - (!root_fs_names ||strstr (root_fs_names,"tmpfs" ))) - is_tmpfs = true; +if (IS_ENABLED (CONFIG_TMPFS )) { +if (!saved_root_name[0 ] && !root_fs_names) + is_tmpfs = true; +else if (root_fs_names && !!strstr (root_fs_names,"tmpfs" )) + is_tmpfs = true; + } }
Greg Kroah-Hartman
maintainerPATCH 175/194 perf top: Move sb_evlist to struct perf_top
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit ca6c9c8b107f9788662117587cd24bbb19cea94d ]
Where state related to a 'perf top' session is grouped.
Stable-dep-of: 9c51f8788b5d ("perf env: Avoid recursively taking env->bpf_progs.lock")
--- tools/perf/builtin-top.c | 7 +++---- tools/perf/util/top.h | 2 +- 2 files changed, 4 insertions(+), 5 deletions(-)
tools/perf/builtin-top.c +3 -4
@@ -1542,7 +1542,6 @@ int cmd_top(int argc, const char **argv)OPTS_EVSWITCH (&top.evswitch),OPT_END () }; -struct evlist *sb_evlist =NULL ;const char *const top_usage[] = {"perf top [<options>]" , NULL
@@ -1684,9 +1683,9 @@ int cmd_top(int argc, const char **argv) }if (!top.record_opts.no_bpf_event) -bpf_event__add_sb_event (&sb_evlist, &perf_env); +bpf_event__add_sb_event (&top.sb_evlist, &perf_env); -if (perf_evlist__start_sb_thread (sb_evlist, target)) { +if (perf_evlist__start_sb_thread (top.sb_evlist, target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" ); opts->no_bpf_event = true; }
@@ -1694,7 +1693,7 @@ int cmd_top(int argc, const char **argv) status =__cmd_top (&top);if (!opts->no_bpf_event) -perf_evlist__stop_sb_thread (sb_evlist); +perf_evlist__stop_sb_thread (top.sb_evlist); out_delete_evlist:evlist__delete (top.evlist);
tools/perf/util/top.h +1 -1
@@ -18,7 +18,7 @@ struct perf_session;struct perf_top {struct perf_tool tool; -struct evlist *evlist; +struct evlist *evlist, *sb_evlist;struct record_opts record_opts;struct annotation_options annotation_opts;struct evswitch evswitch;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 176/194 perf bpf: Decouple creating the evlist from adding the SB event
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit b38d85ef49cf6af9d1deaaf01daf0986d47e6c7a ]
Renaming bpf_event__add_sb_event() to evlist__add_sb_event() and requiring that the evlist be allocated beforehand.
This will allow using the same side band thread and evlist to be used for multiple purposes in addition to react to PERF_RECORD_BPF_EVENT soon after they are generated.
Stable-dep-of: 9c51f8788b5d ("perf env: Avoid recursively taking env->bpf_progs.lock")
--- tools/perf/builtin-record.c | 17 ++++++++++++++--- tools/perf/builtin-top.c | 15 +++++++++++++-- tools/perf/util/bpf-event.c | 3 +-- tools/perf/util/bpf-event.h | 7 +++---- tools/perf/util/evlist.c | 21 ++++----------------- tools/perf/util/evlist.h | 2 +- 6 files changed, 36 insertions(+), 29 deletions(-)
tools/perf/builtin-record.c +14 -3
@@ -1446,16 +1446,27 @@ static int __cmd_record(struct record *rec, int argc, const char **argv) goto out_child; } + err =-1 ;if (!rec->no_buildid && !perf_header__has_feat (&session->header,HEADER_BUILD_ID )) {pr_err ("Couldn't generate buildids. " "Use --no-buildid to profile anyway.\n" ); - err =-1 ; goto out_child; } -if (!opts->no_bpf_event) -bpf_event__add_sb_event (&rec->sb_evlist, &session->header.env); +if (!opts->no_bpf_event) { + rec->sb_evlist =evlist__new (); + +if (rec->sb_evlist ==NULL ) { +pr_err ("Couldn't create side band evlist.\n." ); + goto out_child; + } + +if (evlist__add_bpf_sb_event (rec->sb_evlist, &session->header.env)) { +pr_err ("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n." ); + goto out_child; + } + }if (perf_evlist__start_sb_thread (rec->sb_evlist, &rec->opts.target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" );
tools/perf/builtin-top.c +13 -2
@@ -1682,8 +1682,19 @@ int cmd_top(int argc, const char **argv) goto out_delete_evlist; } -if (!top.record_opts.no_bpf_event) -bpf_event__add_sb_event (&top.sb_evlist, &perf_env); +if (!top.record_opts.no_bpf_event) { + top.sb_evlist =evlist__new (); + +if (top.sb_evlist ==NULL ) { +pr_err ("Couldn't create side band evlist.\n." ); + goto out_delete_evlist; + } + +if (evlist__add_bpf_sb_event (top.sb_evlist, &perf_env)) { +pr_err ("Couldn't ask for PERF_RECORD_BPF_EVENT side band events.\n." ); + goto out_delete_evlist; + } + }if (perf_evlist__start_sb_thread (top.sb_evlist, target)) {pr_debug ("Couldn't start the BPF side band thread:\nBPF programs starting from now on won't be annotatable\n" );
tools/perf/util/bpf-event.c +1 -2
@@ -422,8 +422,7 @@ static int bpf_event__sb_cb(union perf_event *event, void *data)return 0 ; } -int bpf_event__add_sb_event (struct evlist **evlist, -struct perf_env *env) +int evlist__add_bpf_sb_event (struct evlist *evlist,struct perf_env *env) {struct perf_event_attr attr = { .type =PERF_TYPE_SOFTWARE ,
tools/perf/util/bpf-event.h +3 -4
@@ -33,8 +33,7 @@ struct btf_node {#ifdef HAVE_LIBBPF_SUPPORT int machine__process_bpf (struct machine *machine,union perf_event *event,struct perf_sample *sample); -int bpf_event__add_sb_event (struct evlist **evlist, -struct perf_env *env); +int evlist__add_bpf_sb_event (struct evlist *evlist,struct perf_env *env);void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info,struct perf_env *env,FILE *fp);
@@ -46,8 +45,8 @@ static inline int machine__process_bpf(struct machine *machine __maybe_unused,return 0 ; } -static inline int bpf_event__add_sb_event (struct evlist **evlist__maybe_unused , -struct perf_env *env__maybe_unused ) +static inline int evlist__add_bpf_sb_event (struct evlist *evlist__maybe_unused , +struct perf_env *env__maybe_unused ) {return 0 ; }
tools/perf/util/evlist.c +4 -17
@@ -1672,39 +1672,26 @@ struct evsel *perf_evlist__reset_weak_group(struct evlist *evsel_list,return leader; } -int perf_evlist__add_sb_event (struct evlist **evlist, +int perf_evlist__add_sb_event (struct evlist *evlist,struct perf_event_attr *attr,perf_evsel__sb_cb_t cb,void *data) {struct evsel *evsel; -bool new_evlist = (*evlist) ==NULL ; - -if (*evlist ==NULL ) - *evlist =evlist__new (); -if (*evlist ==NULL ) -return -1 ;if (!attr->sample_id_all) {pr_warning ("enabling sample_id_all for all side band events\n" ); attr->sample_id_all =1 ; } - evsel =perf_evsel__new_idx (attr, (*evlist)->core.nr_entries); + evsel =perf_evsel__new_idx (attr, evlist->core.nr_entries);if (!evsel) - goto out_err; +return -1 ; evsel->side_band.cb = cb; evsel->side_band.data = data; -evlist__add (*evlist, evsel); +evlist__add (evlist, evsel);return 0 ; - -out_err: -if (new_evlist) { -evlist__delete (*evlist); - *evlist =NULL ; - } -return -1 ; }static void *perf_evlist__poll_thread (void *arg)
tools/perf/util/evlist.h +1 -1
@@ -107,7 +107,7 @@ int __perf_evlist__add_default_attrs(struct evlist *evlist,int perf_evlist__add_dummy (struct evlist *evlist); -int perf_evlist__add_sb_event (struct evlist **evlist, +int perf_evlist__add_sb_event (struct evlist *evlist,struct perf_event_attr *attr,perf_evsel__sb_cb_t cb,void *data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 177/194 perf env: Avoid recursively taking env->bpf_progs.lock
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 9c51f8788b5d4e9f46afbcf563255cfd355690b3 ]
Add variants of perf_env__insert_bpf_prog_info(), perf_env__insert_btf() and perf_env__find_btf prefixed with __ to indicate the env->bpf_progs.lock is assumed held.
Call these variants when the lock is held to avoid recursively taking it and potentially having a thread deadlock with itself.
--- tools/perf/util/bpf-event.c | 8 +++--- tools/perf/util/bpf-event.h | 12 ++++----- tools/perf/util/env.c | 50 ++++++++++++++++++++++++------------- tools/perf/util/env.h | 4 +++ tools/perf/util/header.c | 8 +++--- 5 files changed, 50 insertions(+), 32 deletions(-)
tools/perf/util/bpf-event.c +4 -4
@@ -442,9 +442,9 @@ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)return perf_evlist__add_sb_event (evlist, &attr, bpf_event__sb_cb, env); } -void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, -struct perf_env *env, -FILE *fp) +void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, +struct perf_env *env, +FILE *fp) {__u32 *prog_lens = (__u32 *)(uintptr_t )(info->jited_func_lens);__u64 *prog_addrs = (__u64 *)(uintptr_t )(info->jited_ksyms);
@@ -460,7 +460,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,if (info->btf_id) {struct btf_node *node; - node =perf_env__find_btf (env, info->btf_id); + node =__perf_env__find_btf (env, info->btf_id);if (node) btf =btf__new ((__u8 *)(node->data), node->data_size);
tools/perf/util/bpf-event.h +6 -6
@@ -34,9 +34,9 @@ struct btf_node {int machine__process_bpf (struct machine *machine,union perf_event *event,struct perf_sample *sample);int evlist__add_bpf_sb_event (struct evlist *evlist,struct perf_env *env); -void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, -struct perf_env *env, -FILE *fp); +void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info, +struct perf_env *env, +FILE *fp);#else static inline int machine__process_bpf(struct machine *machine __maybe_unused, union perf_event *event __maybe_unused,
@@ -51,9 +51,9 @@ static inline int evlist__add_bpf_sb_event(struct evlist *evlist __maybe_unused,return 0 ; } -static inline void bpf_event__print_bpf_prog_info (struct bpf_prog_info *info__maybe_unused , -struct perf_env *env__maybe_unused , -FILE *fp__maybe_unused ) +static inline void __bpf_event__print_bpf_prog_info (struct bpf_prog_info *info__maybe_unused , +struct perf_env *env__maybe_unused , +FILE *fp__maybe_unused ) { }
tools/perf/util/env.c +32 -18
112 lines not on this page · raw message
tools/perf/util/env.h +4 -0
@@ -117,12 +117,16 @@ const char *perf_env__raw_arch(struct perf_env *env);int perf_env__nr_cpus_avail (struct perf_env *env);void perf_env__init (struct perf_env *env); +void __perf_env__insert_bpf_prog_info (struct perf_env *env, +struct bpf_prog_info_node *info_node);void perf_env__insert_bpf_prog_info (struct perf_env *env,struct bpf_prog_info_node *info_node);struct bpf_prog_info_node *perf_env__find_bpf_prog_info (struct perf_env *env,__u32 prog_id);bool perf_env__insert_btf (struct perf_env *env,struct btf_node *btf_node); +bool __perf_env__insert_btf (struct perf_env *env,struct btf_node *btf_node);struct btf_node *perf_env__find_btf (struct perf_env *env,__u32 btf_id); +struct btf_node *__perf_env__find_btf (struct perf_env *env,__u32 btf_id);int perf_env__numa_node (struct perf_env *env,int cpu);#endif /* __PERF_ENV_H */
tools/perf/util/header.c +4 -4
@@ -1546,8 +1546,8 @@ static void print_bpf_prog_info(struct feat_fd *ff, FILE *fp) node = rb_entry(next, struct bpf_prog_info_node, rb_node); next =rb_next (&node->rb_node); -bpf_event__print_bpf_prog_info (&node->info_linear->info, - env, fp); +__bpf_event__print_bpf_prog_info (&node->info_linear->info, + env, fp); }up_read (&env->bpf_progs.lock);
@@ -2724,7 +2724,7 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)/* after reading from file, translate offset to address */ bpf_program__bpil_offs_to_addr (info_linear); info_node->info_linear = info_linear; -perf_env__insert_bpf_prog_info (env, info_node); +__perf_env__insert_bpf_prog_info (env, info_node); }up_write (&env->bpf_progs.lock);
@@ -2777,7 +2777,7 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)if (__do_read (ff, node->data, data_size)) goto out; -perf_env__insert_btf (env, node); +__perf_env__insert_btf (env, node); node =NULL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 178/194 apparmor: avoid crash when parsed profile name is empty
In reply to Greg Kroah-Hartman5.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <[email protected]>
[ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ]
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then passed to aa_splitn_fqname().
aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace. Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later aa_alloc_profile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014 RIP: 0010:strlen+0x1e/0xa0 Call Trace: <TASK> ? strlen+0x1e/0xa0 aa_policy_init+0x1bb/0x230 aa_alloc_profile+0xb1/0x480 unpack_profile+0x3bc/0x4960 aa_unpack+0x309/0x15e0 aa_replace_profiles+0x213/0x33c0 policy_update+0x261/0x370 profile_replace+0x20e/0x2a0 vfs_write+0x2af/0xe00 ksys_write+0x126/0x250 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK> ---[ end trace 0000000000000000 ]--- RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aa_splitn_fqname() is expected and checked in other places where it is called (e.g. aa_remove_profiles). Well, there is an explicit comment "a ns name without a following profile is allowed" inside.
AFAICS, nothing can prevent unpacked "name" to be in form like ":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
--- security/apparmor/policy_unpack.c | 4 ++++ 1 file changed, 4 insertions(+)
security/apparmor/policy_unpack.c +4 -0
@@ -693,6 +693,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name) tmpname =aa_splitn_fqname (name,strlen (name), &tmpns, &ns_len);if (tmpns) { +if (!tmpname) { + info ="empty profile name" ; + goto fail; + } *ns_name =kstrndup (tmpns, ns_len,GFP_KERNEL );if (!*ns_name) { info ="out of memory" ;
Signature · 1 line
2.43.0