During an eeh a kernel-oops is reported if no vPHB to allocated to the
AFU. This happens as during AFU init, an error in creation of vPHB is
a non-fatal error. Hence afu->phb should always be checked for NULL
before iterating over it for the virtual AFU pci devices.
This patch fixes the kenel-oops by adding a NULL pointer check for
afu->phb before it is dereferenced.
Fixes: 9e8df8a2196("cxl: EEH support")
Cc: stable(a)vger.kernel.org
Signed-off-by: Vaibhav Jain <vaibhav(a)linux.vnet.ibm.com>
---
Changelog:
Resend -> Added the 'Fixes' info and marking the patch to stable tree [Mpe]
v2 -> Added the vphb NULL check to cxl_vphb_error_detected() [Andrew]
---
drivers/misc/cxl/pci.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c
index bb7fd3f4edab..18773343ab3e 100644
--- a/drivers/misc/cxl/pci.c
+++ b/drivers/misc/cxl/pci.c
@@ -2083,6 +2083,9 @@ static pci_ers_result_t cxl_vphb_error_detected(struct cxl_afu *afu,
/* There should only be one entry, but go through the list
* anyway
*/
+ if (afu->phb == NULL)
+ return result;
+
list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
if (!afu_dev->driver)
continue;
@@ -2124,8 +2127,7 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev,
* Tell the AFU drivers; but we don't care what they
* say, we're going away.
*/
- if (afu->phb != NULL)
- cxl_vphb_error_detected(afu, state);
+ cxl_vphb_error_detected(afu, state);
}
return PCI_ERS_RESULT_DISCONNECT;
}
@@ -2265,6 +2267,9 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev)
if (cxl_afu_select_best_mode(afu))
goto err;
+ if (afu->phb == NULL)
+ continue;
+
list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
/* Reset the device context.
* TODO: make this less disruptive
@@ -2327,6 +2332,9 @@ static void cxl_pci_resume(struct pci_dev *pdev)
for (i = 0; i < adapter->slices; i++) {
afu = adapter->afu[i];
+ if (afu->phb != NULL)
+ continue;
+
list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) {
if (afu_dev->driver && afu_dev->driver->err_handler &&
afu_dev->driver->err_handler->resume)
--
2.14.3
On Wed, Nov 15, 2017 at 03:39:22PM +0000, Moore, Robert wrote:
>> -----Original Message-----
>> From: alexander.levin(a)verizon.com [mailto:alexander.levin@verizon.com]
>> Sent: Tuesday, November 14, 2017 6:46 PM
>> To: linux-kernel(a)vger.kernel.org; stable(a)vger.kernel.org
>> Cc: Moore, Robert <robert.moore(a)intel.com>; Zheng, Lv
>> <lv.zheng(a)intel.com>; Wysocki, Rafael J <rafael.j.wysocki(a)intel.com>;
>> alexander.levin(a)verizon.com
>> Subject: [PATCH AUTOSEL for 4.9 01/56] ACPICA: Resources: Not a valid
>> resource if buffer length too long
>>
>> From: Bob Moore <robert.moore(a)intel.com>
>>
>> [ Upstream commit 57707a9a7780fab426b8ae9b4c7b65b912a748b3 ]
>>
>> ACPICA commit 9f76de2d249b18804e35fb55d14b1c2604d627a1
>> ACPICA commit b2e89d72ef1e9deefd63c3fd1dee90f893575b3a
>> ACPICA commit 23b5bbe6d78afd3c5abf3adb91a1b098a3000b2e
>>
>> The declared buffer length must be the same as the length of the byte
>> initializer list, otherwise not a valid resource descriptor.
[snip]
>[Moore, Robert]
>
>Please explain what you are doing here.
Proposing this commit for the 4.9 LTS tree.
--
Thanks,
Sasha
From: Peter Ujfalusi <peter.ujfalusi(a)ti.com>
[ Upstream commit 657279778af54f35e54b07b6687918f254a2992c ]
OMAP1510, OMAP5910 and OMAP310 have only 9 logical channels.
OMAP1610, OMAP5912, OMAP1710, OMAP730, and OMAP850 have 16 logical channels
available.
The wired 17 for the lch_count must have been used to cover the 16 + 1
dedicated LCD channel, in reality we can only use 9 or 16 channels.
The d->chan_count is not used by the omap-dma stack, so we can skip the
setup. chan_count was configured to the number of logical channels and not
the actual number of physical channels anyways.
Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com>
Acked-by: Aaro Koskinen <aaro.koskinen(a)iki.fi>
Signed-off-by: Tony Lindgren <tony(a)atomide.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
---
arch/arm/mach-omap1/dma.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/arch/arm/mach-omap1/dma.c b/arch/arm/mach-omap1/dma.c
index 4be601b638d7..8129e5f9c94d 100644
--- a/arch/arm/mach-omap1/dma.c
+++ b/arch/arm/mach-omap1/dma.c
@@ -31,7 +31,6 @@
#include <mach/irqs.h>
#define OMAP1_DMA_BASE (0xfffed800)
-#define OMAP1_LOGICAL_DMA_CH_COUNT 17
static u32 enable_1510_mode;
@@ -311,8 +310,6 @@ static int __init omap1_system_dma_init(void)
goto exit_iounmap;
}
- d->lch_count = OMAP1_LOGICAL_DMA_CH_COUNT;
-
/* Valid attributes for omap1 plus processors */
if (cpu_is_omap15xx())
d->dev_caps = ENABLE_1510_MODE;
@@ -329,13 +326,14 @@ static int __init omap1_system_dma_init(void)
d->dev_caps |= CLEAR_CSR_ON_READ;
d->dev_caps |= IS_WORD_16;
- if (cpu_is_omap15xx())
- d->chan_count = 9;
- else if (cpu_is_omap16xx() || cpu_is_omap7xx()) {
- if (!(d->dev_caps & ENABLE_1510_MODE))
- d->chan_count = 16;
+ /* available logical channels */
+ if (cpu_is_omap15xx()) {
+ d->lch_count = 9;
+ } else {
+ if (d->dev_caps & ENABLE_1510_MODE)
+ d->lch_count = 9;
else
- d->chan_count = 9;
+ d->lch_count = 16;
}
p = dma_plat_info;
--
2.11.0
From: Florian Fainelli <f.fainelli(a)gmail.com>
[ Upstream commit bb7da333d0a9f3bddc08f84187b7579a3f68fd24 ]
Since we need to pad our packets, utilize skb_put_padto() which
increases skb->len by how much we need to pad, allowing us to eliminate
the test on skb->len right below.
Signed-off-by: Florian Fainelli <f.fainelli(a)gmail.com>
Signed-off-by: David S. Miller <davem(a)davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
---
drivers/net/ethernet/broadcom/bcmsysport.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c
index 8860e74aa28f..fae1a1ff53ab 100644
--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1061,13 +1061,12 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb,
* (including FCS and tag) because the length verification is done after
* the Broadcom tag is stripped off the ingress packet.
*/
- if (skb_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) {
+ if (skb_put_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) {
ret = NETDEV_TX_OK;
goto out;
}
- skb_len = skb->len < ETH_ZLEN + ENET_BRCM_TAG_LEN ?
- ETH_ZLEN + ENET_BRCM_TAG_LEN : skb->len;
+ skb_len = skb->len;
mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
if (dma_mapping_error(kdev, mapping)) {
--
2.11.0
From: Bob Moore <robert.moore(a)intel.com>
[ Upstream commit 57707a9a7780fab426b8ae9b4c7b65b912a748b3 ]
ACPICA commit 9f76de2d249b18804e35fb55d14b1c2604d627a1
ACPICA commit b2e89d72ef1e9deefd63c3fd1dee90f893575b3a
ACPICA commit 23b5bbe6d78afd3c5abf3adb91a1b098a3000b2e
The declared buffer length must be the same as the length of the
byte initializer list, otherwise not a valid resource descriptor.
Link: https://github.com/acpica/acpica/commit/9f76de2d
Link: https://github.com/acpica/acpica/commit/b2e89d72
Link: https://github.com/acpica/acpica/commit/23b5bbe6
Signed-off-by: Bob Moore <robert.moore(a)intel.com>
Signed-off-by: Lv Zheng <lv.zheng(a)intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki(a)intel.com>
Signed-off-by: Sasha Levin <alexander.levin(a)verizon.com>
---
drivers/acpi/acpica/utresrc.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/acpi/acpica/utresrc.c b/drivers/acpi/acpica/utresrc.c
index 1de3376da66a..2ad99ea3d496 100644
--- a/drivers/acpi/acpica/utresrc.c
+++ b/drivers/acpi/acpica/utresrc.c
@@ -421,8 +421,10 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
ACPI_FUNCTION_TRACE(ut_walk_aml_resources);
- /* The absolute minimum resource template is one end_tag descriptor */
-
+ /*
+ * The absolute minimum resource template is one end_tag descriptor.
+ * However, we will treat a lone end_tag as just a simple buffer.
+ */
if (aml_length < sizeof(struct aml_resource_end_tag)) {
return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
}
@@ -454,9 +456,8 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
/* Invoke the user function */
if (user_function) {
- status =
- user_function(aml, length, offset, resource_index,
- context);
+ status = user_function(aml, length, offset,
+ resource_index, context);
if (ACPI_FAILURE(status)) {
return_ACPI_STATUS(status);
}
@@ -480,6 +481,12 @@ acpi_ut_walk_aml_resources(struct acpi_walk_state *walk_state,
*context = aml;
}
+ /* Check if buffer is defined to be longer than the resource length */
+
+ if (aml_length > (offset + length)) {
+ return_ACPI_STATUS(AE_AML_NO_RESOURCE_END_TAG);
+ }
+
/* Normal exit */
return_ACPI_STATUS(AE_OK);
--
2.11.0
This is the start of the stable review cycle for the 3.18.84 release.
There are 12 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri Nov 24 10:10:45 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.84-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 3.18.84-rc1
Jan Harkes <jaharkes(a)cs.cmu.edu>
coda: fix 'kernel memory exposure attempt' in fsync
Corey Minyard <cminyard(a)mvista.com>
ipmi: fix unsigned long underflow
alex chen <alex.chen(a)huawei.com>
ocfs2: should wait dio before inode lock in ocfs2_setattr()
Roberto Sassu <roberto.sassu(a)huawei.com>
ima: do not update security.ima if appraisal status is not INTEGRITY_PASS
Cong Wang <xiyou.wangcong(a)gmail.com>
vlan: fix a use-after-free in vlan_device_event()
Jason A. Donenfeld <Jason(a)zx2c4.com>
af_netlink: ensure that NLMSG_DONE never fails in dumps
Huacai Chen <chenhc(a)lemote.com>
fealnx: Fix building error on MIPS
Xin Long <lucien.xin(a)gmail.com>
sctp: do not peel off an assoc from one netns to another one
Ye Yin <hustcat(a)gmail.com>
netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed
Eric Dumazet <edumazet(a)google.com>
tcp: do not mangle skb->cb[] in tcp_make_synack()
Eric W. Biederman <ebiederm(a)xmission.com>
net/sctp: Always set scope_id in sctp_inet6_skb_msgname
WANG Cong <xiyou.wangcong(a)gmail.com>
ipv6/dccp: do not inherit ipv6_mc_list from parent
-------------
Diffstat:
Makefile | 4 ++--
drivers/char/ipmi/ipmi_msghandler.c | 10 ++++++----
drivers/net/ethernet/fealnx.c | 6 +++---
fs/coda/upcall.c | 3 +--
fs/ocfs2/file.c | 9 +++++++--
include/linux/skbuff.h | 7 +++++++
net/8021q/vlan.c | 6 +++---
net/core/skbuff.c | 1 +
net/dccp/ipv6.c | 7 +++++++
net/ipv4/tcp_output.c | 9 ++-------
net/ipv6/tcp_ipv6.c | 2 ++
net/netlink/af_netlink.c | 17 +++++++++++------
net/netlink/af_netlink.h | 1 +
net/sctp/ipv6.c | 2 ++
net/sctp/socket.c | 4 ++++
security/integrity/ima/ima_appraise.c | 3 +++
16 files changed, 62 insertions(+), 29 deletions(-)
This is the start of the stable review cycle for the 4.14.1 release.
There are 31 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue Nov 21 14:59:32 UTC 2017.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.1-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.1-rc1
Johan Hovold <johan(a)kernel.org>
spi: fix use-after-free at controller deregistration
Hans de Goede <hdegoede(a)redhat.com>
staging: rtl8188eu: Revert 4 commits breaking ARP
Hans de Goede <hdegoede(a)redhat.com>
staging: vboxvideo: Fix reporting invalid suggested-offset-properties
Johan Hovold <johan(a)kernel.org>
staging: greybus: spilib: fix use-after-free after deregistration
Gilad Ben-Yossef <gilad(a)benyossef.com>
staging: ccree: fix 64 bit scatter/gather DMA ops
Huacai Chen <chenhc(a)lemote.com>
staging: sm750fb: Fix parameter mistake in poke32
Aditya Shankar <aditya.shankar(a)microchip.com>
staging: wilc1000: Fix bssid buffer offset in Txq
Bjorn Andersson <bjorn.andersson(a)linaro.org>
rpmsg: glink: Add missing MODULE_LICENSE
Jason Gerecke <killertofu(a)gmail.com>
HID: wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection
Sébastien Szymanski <sebastien.szymanski(a)armadeus.com>
HID: cp2112: add HIDRAW dependency
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: peaq_wmi: Fix missing terminating entry for peaq_dmi_table
Hans de Goede <hdegoede(a)redhat.com>
platform/x86: peaq-wmi: Add DMI check before binding to the WMI interface
Yazen Ghannam <yazen.ghannam(a)amd.com>
x86/MCE/AMD: Always give panic severity for UC errors in kernel context
Andy Lutomirski <luto(a)kernel.org>
selftests/x86/protection_keys: Fix syscall NR redefinition warnings
Johan Hovold <johan(a)kernel.org>
USB: serial: garmin_gps: fix memory leak on probe errors
Johan Hovold <johan(a)kernel.org>
USB: serial: garmin_gps: fix I/O after failed probe and remove
Douglas Fischer <douglas.fischer(a)outlook.com>
USB: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update
Lu Baolu <baolu.lu(a)linux.intel.com>
USB: serial: Change DbC debug device binding ID
Johan Hovold <johan(a)kernel.org>
USB: serial: metro-usb: stop I/O after failed open
Andrew Gabbasov <andrew_gabbasov(a)mentor.com>
usb: gadget: f_fs: Fix use-after-free in ffs_free_inst
Bernhard Rosenkraenzer <bernhard.rosenkranzer(a)linaro.org>
USB: Add delay-init quirk for Corsair K70 LUX keyboards
Alan Stern <stern(a)rowland.harvard.edu>
USB: usbfs: compute urb->actual_length for isochronous
Lu Baolu <baolu.lu(a)linux.intel.com>
USB: early: Use new USB product ID and strings for DbC device
raveendra padasalagi <raveendra.padasalagi(a)broadcom.com>
crypto: brcm - Explicity ACK mailbox message
Eric Biggers <ebiggers(a)google.com>
crypto: dh - Don't permit 'key' or 'g' size longer than 'p'
Eric Biggers <ebiggers(a)google.com>
crypto: dh - Don't permit 'p' to be 0
Eric Biggers <ebiggers(a)google.com>
crypto: dh - Fix double free of ctx->p
Andrey Konovalov <andreyknvl(a)google.com>
media: dib0700: fix invalid dvb_detach argument
Arvind Yadav <arvind.yadav.cs(a)gmail.com>
media: imon: Fix null-ptr-deref in imon_probe
Adam Wallis <awallis(a)codeaurora.org>
dmaengine: dmatest: warn user when dma test times out
Qiuxu Zhuo <qiuxu.zhuo(a)intel.com>
EDAC, sb_edac: Don't create a second memory controller if HA1 is not present
-------------
Diffstat:
Makefile | 4 +-
arch/x86/kernel/cpu/mcheck/mce-severity.c | 7 +-
crypto/dh.c | 33 ++++-----
crypto/dh_helper.c | 16 ++++
drivers/crypto/bcm/cipher.c | 101 ++++++++++++--------------
drivers/dma/dmatest.c | 1 +
drivers/edac/sb_edac.c | 9 ++-
drivers/hid/Kconfig | 2 +-
drivers/hid/wacom_wac.h | 1 +
drivers/media/rc/imon.c | 5 ++
drivers/media/usb/dvb-usb/dib0700_devices.c | 24 +++---
drivers/platform/x86/peaq-wmi.c | 19 +++++
drivers/rpmsg/qcom_glink_native.c | 3 +
drivers/spi/spi.c | 5 +-
drivers/staging/ccree/cc_lli_defs.h | 2 +-
drivers/staging/greybus/spilib.c | 8 +-
drivers/staging/rtl8188eu/core/rtw_recv.c | 83 ++++++++++++---------
drivers/staging/rtl8188eu/os_dep/mon.c | 34 ++-------
drivers/staging/sm750fb/ddk750_chip.h | 2 +-
drivers/staging/vboxvideo/vbox_drv.h | 8 +-
drivers/staging/vboxvideo/vbox_irq.c | 4 +-
drivers/staging/vboxvideo/vbox_mode.c | 26 +++++--
drivers/staging/wilc1000/wilc_wlan.c | 2 +-
drivers/usb/core/devio.c | 14 ++++
drivers/usb/core/quirks.c | 3 +
drivers/usb/early/xhci-dbc.h | 6 +-
drivers/usb/gadget/function/f_fs.c | 1 +
drivers/usb/serial/garmin_gps.c | 22 +++++-
drivers/usb/serial/metro-usb.c | 11 ++-
drivers/usb/serial/qcserial.c | 1 +
drivers/usb/serial/usb_debug.c | 4 +-
tools/testing/selftests/x86/protection_keys.c | 24 ++++--
32 files changed, 289 insertions(+), 196 deletions(-)