July 2019 - Linux-stable-mirror

[PATCH stable 4.4] tcp: reset sk_send_head in tcp_write_queue_purge

by Mao Wenan

From: Soheil Hassas Yeganeh <soheil(a)google.com> tcp_write_queue_purge clears all the SKBs in the write queue but does not reset the sk_send_head. As a result, we can have a NULL pointer dereference anywhere that we use tcp_send_head instead of the tcp_write_queue_tail. For example, after a27fd7a8ed38 (tcp: purge write queue upon RST), we can purge the write queue on RST. Prior to 75c119afe14f (tcp: implement rb-tree based retransmit queue), tcp_push will only check tcp_send_head and then accesses tcp_write_queue_tail to send the actual SKB. As a result, it will dereference a NULL pointer. This has been reported twice for 4.14 where we don't have 75c119afe14f: By Timofey Titovets: [ 422.081094] BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 [ 422.081254] IP: tcp_push+0x42/0x110 [ 422.081314] PGD 0 P4D 0 [ 422.081364] Oops: 0002 [#1] SMP PTI By Yongjian Xu: BUG: unable to handle kernel NULL pointer dereference at 0000000000000038 IP: tcp_push+0x48/0x120 PGD 80000007ff77b067 P4D 80000007ff77b067 PUD 7fd989067 PMD 0 Oops: 0002 [#18] SMP PTI Modules linked in: tcp_diag inet_diag tcp_bbr sch_fq iTCO_wdt iTCO_vendor_support pcspkr ixgbe mdio i2c_i801 lpc_ich joydev input_leds shpchp e1000e igb dca ptp pps_core hwmon mei_me mei ipmi_si ipmi_msghandler sg ses scsi_transport_sas enclosure ext4 jbd2 mbcache sd_mod ahci libahci megaraid_sas wmi ast ttm dm_mirror dm_region_hash dm_log dm_mod dax CPU: 6 PID: 14156 Comm: [ET_NET 6] Tainted: G D 4.14.26-1.el6.x86_64 #1 Hardware name: LENOVO ThinkServer RD440 /ThinkServer RD440, BIOS A0TS80A 09/22/2014 task: ffff8807d78d8140 task.stack: ffffc9000e944000 RIP: 0010:tcp_push+0x48/0x120 RSP: 0018:ffffc9000e947a88 EFLAGS: 00010246 RAX: 00000000000005b4 RBX: ffff880f7cce9c00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000040 RDI: ffff8807d00f5000 RBP: ffffc9000e947aa8 R08: 0000000000001c84 R09: 0000000000000000 R10: ffff8807d00f5158 R11: 0000000000000000 R12: ffff8807d00f5000 R13: 0000000000000020 R14: 00000000000256d4 R15: 0000000000000000 FS: 00007f5916de9700(0000) GS:ffff88107fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000038 CR3: 00000007f8226004 CR4: 00000000001606e0 Call Trace: tcp_sendmsg_locked+0x33d/0xe50 tcp_sendmsg+0x37/0x60 inet_sendmsg+0x39/0xc0 sock_sendmsg+0x49/0x60 sock_write_iter+0xb6/0x100 do_iter_readv_writev+0xec/0x130 ? rw_verify_area+0x49/0xb0 do_iter_write+0x97/0xd0 vfs_writev+0x7e/0xe0 ? __wake_up_common_lock+0x80/0xa0 ? __fget_light+0x2c/0x70 ? __do_page_fault+0x1e7/0x530 do_writev+0x60/0xf0 ? inet_shutdown+0xac/0x110 SyS_writev+0x10/0x20 do_syscall_64+0x6f/0x140 ? prepare_exit_to_usermode+0x8b/0xa0 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 RIP: 0033:0x3135ce0c57 RSP: 002b:00007f5916de4b00 EFLAGS: 00000293 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000003135ce0c57 RDX: 0000000000000002 RSI: 00007f5916de4b90 RDI: 000000000000606f RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f5916de8c38 R10: 0000000000000000 R11: 0000000000000293 R12: 00000000000464cc R13: 00007f5916de8c30 R14: 00007f58d8bef080 R15: 0000000000000002 Code: 48 8b 97 60 01 00 00 4c 8d 97 58 01 00 00 41 b9 00 00 00 00 41 89 f3 4c 39 d2 49 0f 44 d1 41 81 e3 00 80 00 00 0f 85 b0 00 00 00 <80> 4a 38 08 44 8b 8f 74 06 00 00 44 89 8f 7c 06 00 00 83 e6 01 RIP: tcp_push+0x48/0x120 RSP: ffffc9000e947a88 CR2: 0000000000000038 ---[ end trace 8d545c2e93515549 ]--- There is other scenario which found in stable 4.4: Allocated: [<ffffffff82f380a6>] __alloc_skb+0xe6/0x600 net/core/skbuff.c:218 [<ffffffff832466c3>] alloc_skb_fclone include/linux/skbuff.h:856 [inline] [<ffffffff832466c3>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833 [<ffffffff83249164>] tcp_sendmsg+0xd34/0x2b00 net/ipv4/tcp.c:1178 [<ffffffff83300ef3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755 Freed: [<ffffffff82f372fd>] __kfree_skb+0x1d/0x20 net/core/skbuff.c:676 [<ffffffff83288834>] sk_wmem_free_skb include/net/sock.h:1447 [inline] [<ffffffff83288834>] tcp_write_queue_purge include/net/tcp.h:1460 [inline] [<ffffffff83288834>] tcp_connect_init net/ipv4/tcp_output.c:3122 [inline] [<ffffffff83288834>] tcp_connect+0xb24/0x30c0 net/ipv4/tcp_output.c:3261 [<ffffffff8329b991>] tcp_v4_connect+0xf31/0x1890 net/ipv4/tcp_ipv4.c:246 BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:796 [inline] BUG: KASAN: use-after-free in tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline] BUG: KASAN: use-after-free in tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056 [<ffffffff81515cd5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408 [<ffffffff814f9784>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427 [<ffffffff83286582>] tcp_skb_pcount include/net/tcp.h:796 [inline] [<ffffffff83286582>] tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline] [<ffffffff83286582>] tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056 [<ffffffff83287a40>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2307 stable 4.4 and stable 4.9 don't have the commit abb4a8b870b5 ("tcp: purge write queue upon RST") which is referred in dbbf2d1e4077, in tcp_connect_init, it calls tcp_write_queue_purge, and does not reset sk_send_head, then UAF. stable 4.14 have the commit abb4a8b870b5 ("tcp: purge write queue upon RST"), in tcp_reset, it calls tcp_write_queue_purge(sk), and does not reset sk_send_head, then UAF. So this patch can be used to fix stable 4.4 and 4.9. Fixes: a27fd7a8ed38 (tcp: purge write queue upon RST) Reported-by: Timofey Titovets <nefelim4ag(a)gmail.com> Reported-by: Yongjian Xu <yongjianchn(a)gmail.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Soheil Hassas Yeganeh <soheil(a)google.com> Tested-by: Yongjian Xu <yongjianchn(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Mao Wenan <maowenan(a)huawei.com> --- include/net/tcp.h | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index bf8a0dae977a..77438a8406ec 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1443,6 +1443,11 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct sk_buff *skb, void tcp_fastopen_init_key_once(bool publish); #define TCP_FASTOPEN_KEY_LENGTH 16 +static inline void tcp_init_send_head(struct sock *sk) +{ + sk->sk_send_head = NULL; +} + /* Fastopen key context */ struct tcp_fastopen_context { struct crypto_cipher *tfm; @@ -1459,6 +1464,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) sk_wmem_free_skb(sk, skb); sk_mem_reclaim(sk); tcp_clear_all_retrans_hints(tcp_sk(sk)); + tcp_init_send_head(sk); inet_csk(sk)->icsk_backoff = 0; } @@ -1520,11 +1526,6 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli tcp_sk(sk)->highest_sack = NULL; } -static inline void tcp_init_send_head(struct sock *sk) -{ - sk->sk_send_head = NULL; -} - static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb) { __skb_queue_tail(&sk->sk_write_queue, skb); -- 2.20.1

5 years, 2 months

1
0
0 0

[PATCH 1/2] crypto: ccree: use the full crypt length value

by Gilad Ben-Yossef

In case of AEAD decryption verifcation error we were using the wrong value to zero out the plaintext buffer leaving the end of the buffer with the false plaintext. Signed-off-by: Gilad Ben-Yossef <gilad(a)benyossef.com> Fixes: ff27e85a85bb ("crypto: ccree - add AEAD support") CC: stable(a)vger.kernel.org # v4.17+ --- drivers/crypto/ccree/cc_aead.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/ccree/cc_aead.c b/drivers/crypto/ccree/cc_aead.c index 19abb872329c..8a6c825d40e8 100644 --- a/drivers/crypto/ccree/cc_aead.c +++ b/drivers/crypto/ccree/cc_aead.c @@ -268,7 +268,7 @@ static void cc_aead_complete(struct device *dev, void *cc_req, int err) /* In case of payload authentication failure, MUST NOT * revealed the decrypted message --> zero its memory. */ - cc_zero_sgl(areq->dst, areq_ctx->cryptlen); + cc_zero_sgl(areq->dst, areq->cryptlen); err = -EBADMSG; } /*ENCRYPT*/ -- 2.21.0

5 years, 2 months

1
0
0 0

[PATCH] drm: mali-dp: Mark expected switch fall-through

by Anders Roxell

When fall-through warnings was enabled by default, commit d93512ef0f0e ("Makefile: Globally enable fall-through warning"), the following warnings was starting to show up: ../drivers/gpu/drm/arm/malidp_hw.c: In function ‘malidp_format_get_bpp’: ../drivers/gpu/drm/arm/malidp_hw.c:387:8: warning: this statement may fall through [-Wimplicit-fallthrough=] bpp = 30; ~~~~^~~~ ../drivers/gpu/drm/arm/malidp_hw.c:388:3: note: here case DRM_FORMAT_YUV420_10BIT: ^~~~ ../drivers/gpu/drm/arm/malidp_hw.c: In function ‘malidp_se_irq’: ../drivers/gpu/drm/arm/malidp_hw.c:1311:4: warning: this statement may fall through [-Wimplicit-fallthrough=] drm_writeback_signal_completion(&malidp->mw_connector, 0); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ../drivers/gpu/drm/arm/malidp_hw.c:1313:3: note: here case MW_START: ^~~~ Rework to add a 'break;' in a case that didn't have it so that the compiler doesn't warn about fall-through. Cc: stable(a)vger.kernel.org # v4.9+ Fixes: b8207562abdd ("drm/arm/malidp: Specified the rotation memory requirements for AFBC YUV formats") Signed-off-by: Anders Roxell <anders.roxell(a)linaro.org> --- drivers/gpu/drm/arm/malidp_hw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/arm/malidp_hw.c b/drivers/gpu/drm/arm/malidp_hw.c index 50af399d7f6f..dc5fff9af338 100644 --- a/drivers/gpu/drm/arm/malidp_hw.c +++ b/drivers/gpu/drm/arm/malidp_hw.c @@ -385,6 +385,7 @@ int malidp_format_get_bpp(u32 fmt) switch (fmt) { case DRM_FORMAT_VUY101010: bpp = 30; + break; case DRM_FORMAT_YUV420_10BIT: bpp = 15; break; @@ -1309,7 +1310,7 @@ static irqreturn_t malidp_se_irq(int irq, void *arg) break; case MW_RESTART: drm_writeback_signal_completion(&malidp->mw_connector, 0); - /* fall through to a new start */ + /* fall through */ case MW_START: /* writeback started, need to emulate one-shot mode */ hw->disable_memwrite(hwdev); -- 2.20.1

5 years, 2 months

3
2
0 0

[PATCH 5.1 00/62] 5.1.21-stable review

by Greg Kroah-Hartman

Note, this will be the LAST 5.1.y kernel release. Everyone should move to the 5.2.y series at this point in time. This is the start of the stable review cycle for the 5.1.21 release. There are 62 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun 28 Jul 2019 03:21:13 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.1.21-rc1… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.1.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.1.21-rc1 Kuo-Hsin Yang <vovoy(a)chromium.org> mm: vmscan: scan anonymous pages on file refaults Damien Le Moal <damien.lemoal(a)wdc.com> block: Limit zone array allocation size Damien Le Moal <damien.lemoal(a)wdc.com> sd_zbc: Fix report zones buffer allocation Paolo Bonzini <pbonzini(a)redhat.com> Revert "kvm: x86: Use task structs fpu field for user" Jan Kiszka <jan.kiszka(a)siemens.com> KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested Paolo Bonzini <pbonzini(a)redhat.com> KVM: nVMX: do not use dangling shadow VMCS after guest reset Theodore Ts'o <tytso(a)mit.edu> ext4: allow directory holes Ross Zwisler <zwisler(a)chromium.org> ext4: use jbd2_inode dirty range scoping Ross Zwisler <zwisler(a)chromium.org> jbd2: introduce jbd2_inode dirty range scoping Ross Zwisler <zwisler(a)chromium.org> mm: add filemap_fdatawait_range_keep_errors() Theodore Ts'o <tytso(a)mit.edu> ext4: enforce the immutable flag on open files Darrick J. Wong <darrick.wong(a)oracle.com> ext4: don't allow any modifications to an immutable file Peter Zijlstra <peterz(a)infradead.org> perf/core: Fix race between close() and fork() Alexander Shishkin <alexander.shishkin(a)linux.intel.com> perf/core: Fix exclusive events' grouping Song Liu <songliubraving(a)fb.com> perf script: Assume native_arch for pipe mode Paul Cercueil <paul(a)crapouillou.net> MIPS: lb60: Fix pin mappings Keerthy <j-keerthy(a)ti.com> gpio: davinci: silence error prints in case of EPROBE_DEFER Nishka Dasgupta <nishkadg.linux(a)gmail.com> gpiolib: of: fix a memory leak in of_gpio_flags_quirks() Chris Wilson <chris(a)chris-wilson.co.uk> dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc Jérôme Glisse <jglisse(a)redhat.com> dma-buf: balance refcount inbalance Aya Levin <ayal(a)mellanox.com> net/mlx5e: Fix error flow in tx reporter diagnose Aya Levin <ayal(a)mellanox.com> net/mlx5e: Fix return value from timeout recover function Saeed Mahameed <saeedm(a)mellanox.com> net/mlx5e: Rx, Fix checksum calculation for new hardware Eli Britstein <elibr(a)mellanox.com> net/mlx5e: Fix port tunnel GRE entropy control Jakub Kicinski <jakub.kicinski(a)netronome.com> net/tls: reject offload of TLS 1.3 Jakub Kicinski <jakub.kicinski(a)netronome.com> net/tls: fix poll ignoring partially copied records Frank de Brabander <debrabander(a)gmail.com> selftests: txring_overwrite: fix incorrect test of mmap() return value Cong Wang <xiyou.wangcong(a)gmail.com> netrom: hold sock when setting skb->destructor Cong Wang <xiyou.wangcong(a)gmail.com> netrom: fix a memory leak in nr_rx_frame() Andreas Steinmetz <ast(a)domdv.de> macsec: fix checksumming after decryption Andreas Steinmetz <ast(a)domdv.de> macsec: fix use-after-free of skb during RX Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: stp: don't cache eth dest pointer before skb pull Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: don't cache ether dest pointer on input Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling Aya Levin <ayal(a)mellanox.com> net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn Peter Kosyh <p.kosyh(a)gmail.com> vrf: make sure skb->data contains ip header to make routing Christoph Paasch <cpaasch(a)apple.com> tcp: Reset bytes_acked and bytes_received when disconnecting Eric Dumazet <edumazet(a)google.com> tcp: fix tcp_set_congestion_control() use from bpf hook Eric Dumazet <edumazet(a)google.com> tcp: be more careful in tcp_fragment() Takashi Iwai <tiwai(a)suse.de> sky2: Disable MSI on ASUS P6T Xin Long <lucien.xin(a)gmail.com> sctp: not bind the socket in sctp_connect Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> sctp: fix error handling on stream scheduler initialization David Howells <dhowells(a)redhat.com> rxrpc: Fix send on a connected, but unbound socket Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix issue with confused RX unit after PHY power-down on RTL8411b Yang Wei <albin_yang(a)163.com> nfc: fix potential illegal memory access Jakub Kicinski <jakub.kicinski(a)netronome.com> net/tls: make sure offload also gets the keys wiped Jose Abreu <Jose.Abreu(a)synopsys.com> net: stmmac: Re-work the queue selection for TSO packets Cong Wang <xiyou.wangcong(a)gmail.com> net_sched: unset TCQ_F_CAN_BYPASS when adding filters Andrew Lunn <andrew(a)lunn.ch> net: phy: sfp: hwmon: Fix scaling of RX power John Hurley <john.hurley(a)netronome.com> net: openvswitch: fix csum updates for MPLS actions Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> net: neigh: fix multiple neigh timer scheduling Florian Westphal <fw(a)strlen.de> net: make skb_dst_force return true when dst is refcounted Baruch Siach <baruch(a)tkos.co.il> net: dsa: mv88e6xxx: wait after reset deactivation Justin Chen <justinpopo6(a)gmail.com> net: bcmgenet: use promisc for unsupported filters Ido Schimmel <idosch(a)mellanox.com> ipv6: Unlink sibling route in case of failure David Ahern <dsahern(a)gmail.com> ipv6: rt6_check should return NULL if 'from' is NULL Matteo Croce <mcroce(a)redhat.com> ipv4: don't set IPv6 only flags to IPv4 addresses Eric Dumazet <edumazet(a)google.com> igmp: fix memory leak in igmpv3_del_delrec() Haiyang Zhang <haiyangz(a)microsoft.com> hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() Taehee Yoo <ap420073(a)gmail.com> caif-hsi: fix possible deadlock in cfhsi_exit_module() Brian King <brking(a)linux.vnet.ibm.com> bnx2x: Prevent load reordering in tx completion processing ------------- Diffstat: Makefile | 4 +- arch/mips/jz4740/board-qi_lb60.c | 16 +-- arch/x86/include/asm/kvm_host.h | 7 +- arch/x86/kvm/vmx/nested.c | 10 +- arch/x86/kvm/x86.c | 4 +- block/blk-zoned.c | 46 ++++--- drivers/dma-buf/dma-buf.c | 1 + drivers/dma-buf/reservation.c | 4 + drivers/gpio/gpio-davinci.c | 5 +- drivers/gpio/gpiolib-of.c | 1 + drivers/net/caif/caif_hsi.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 2 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 57 ++++----- drivers/net/ethernet/marvell/sky2.c | 7 ++ drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + .../ethernet/mellanox/mlx5/core/en/reporter_tx.c | 10 +- drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 3 + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 9 +- .../net/ethernet/mellanox/mlx5/core/lib/port_tun.c | 23 +--- drivers/net/ethernet/realtek/r8169.c | 137 +++++++++++++++++++++ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 29 +++-- drivers/net/hyperv/netvsc_drv.c | 1 - drivers/net/macsec.c | 6 +- drivers/net/phy/sfp.c | 2 +- drivers/net/vrf.c | 58 +++++---- drivers/scsi/sd_zbc.c | 104 +++++++++++----- fs/ext4/dir.c | 19 ++- fs/ext4/ext4_jbd2.h | 12 +- fs/ext4/file.c | 4 + fs/ext4/inode.c | 24 +++- fs/ext4/ioctl.c | 46 ++++++- fs/ext4/move_extent.c | 3 +- fs/ext4/namei.c | 45 +++++-- fs/jbd2/commit.c | 23 +++- fs/jbd2/journal.c | 4 + fs/jbd2/transaction.c | 49 ++++---- include/linux/blkdev.h | 5 + include/linux/fs.h | 2 + include/linux/jbd2.h | 22 ++++ include/linux/mlx5/mlx5_ifc.h | 3 +- include/linux/perf_event.h | 5 + include/net/dst.h | 5 +- include/net/tcp.h | 8 +- include/net/tls.h | 1 + kernel/events/core.c | 83 ++++++++++--- mm/filemap.c | 22 ++++ mm/vmscan.c | 6 +- net/bridge/br_input.c | 8 +- net/bridge/br_multicast.c | 23 ++-- net/bridge/br_stp_bpdu.c | 3 +- net/core/filter.c | 2 +- net/core/neighbour.c | 2 + net/ipv4/devinet.c | 8 ++ net/ipv4/igmp.c | 8 +- net/ipv4/tcp.c | 6 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_output.c | 13 +- net/ipv6/ip6_fib.c | 18 ++- net/ipv6/route.c | 2 +- net/netfilter/nf_queue.c | 6 +- net/netrom/af_netrom.c | 4 +- net/nfc/nci/data.c | 2 +- net/openvswitch/actions.c | 6 +- net/rxrpc/af_rxrpc.c | 4 +- net/sched/cls_api.c | 1 + net/sched/sch_fq_codel.c | 2 - net/sched/sch_sfq.c | 2 - net/sctp/socket.c | 24 +--- net/sctp/stream.c | 9 +- net/tls/tls_device.c | 10 +- net/tls/tls_main.c | 4 +- net/tls/tls_sw.c | 3 +- tools/perf/builtin-script.c | 3 +- tools/testing/selftests/net/txring_overwrite.c | 2 +- 76 files changed, 816 insertions(+), 315 deletions(-)

5 years, 2 months

6
67
0 0

[PATCH 4.19 00/50] 4.19.62-stable review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 4.19.62 release. There are 50 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Sun 28 Jul 2019 03:21:13 PM UTC. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.62-rc… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 4.19.62-rc1 Kuo-Hsin Yang <vovoy(a)chromium.org> mm: vmscan: scan anonymous pages on file refaults Jan Kiszka <jan.kiszka(a)siemens.com> KVM: nVMX: Clear pending KVM_REQ_GET_VMCS12_PAGES when leaving nested Paolo Bonzini <pbonzini(a)redhat.com> KVM: nVMX: do not use dangling shadow VMCS after guest reset Theodore Ts'o <tytso(a)mit.edu> ext4: allow directory holes Ross Zwisler <zwisler(a)chromium.org> ext4: use jbd2_inode dirty range scoping Ross Zwisler <zwisler(a)chromium.org> jbd2: introduce jbd2_inode dirty range scoping Ross Zwisler <zwisler(a)chromium.org> mm: add filemap_fdatawait_range_keep_errors() Theodore Ts'o <tytso(a)mit.edu> ext4: enforce the immutable flag on open files Darrick J. Wong <darrick.wong(a)oracle.com> ext4: don't allow any modifications to an immutable file Peter Zijlstra <peterz(a)infradead.org> perf/core: Fix race between close() and fork() Alexander Shishkin <alexander.shishkin(a)linux.intel.com> perf/core: Fix exclusive events' grouping Paul Cercueil <paul(a)crapouillou.net> MIPS: lb60: Fix pin mappings Keerthy <j-keerthy(a)ti.com> gpio: davinci: silence error prints in case of EPROBE_DEFER Chris Wilson <chris(a)chris-wilson.co.uk> dma-buf: Discard old fence_excl on retrying get_fences_rcu for realloc Jérôme Glisse <jglisse(a)redhat.com> dma-buf: balance refcount inbalance Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: stp: don't cache eth dest pointer before skb pull Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: don't cache ether dest pointer on input Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: mcast: fix stale ipv6 hdr pointer when handling v6 query Nikolay Aleksandrov <nikolay(a)cumulusnetworks.com> net: bridge: mcast: fix stale nsrcs pointer in igmp3/mld2 report handling Xin Long <lucien.xin(a)gmail.com> sctp: not bind the socket in sctp_connect Jakub Kicinski <jakub.kicinski(a)netronome.com> net/tls: make sure offload also gets the keys wiped Cong Wang <xiyou.wangcong(a)gmail.com> net_sched: unset TCQ_F_CAN_BYPASS when adding filters Cong Wang <xiyou.wangcong(a)gmail.com> netrom: hold sock when setting skb->destructor Cong Wang <xiyou.wangcong(a)gmail.com> netrom: fix a memory leak in nr_rx_frame() Andreas Steinmetz <ast(a)domdv.de> macsec: fix checksumming after decryption Andreas Steinmetz <ast(a)domdv.de> macsec: fix use-after-free of skb during RX Aya Levin <ayal(a)mellanox.com> net/mlx5e: IPoIB, Add error path in mlx5_rdma_setup_rn Peter Kosyh <p.kosyh(a)gmail.com> vrf: make sure skb->data contains ip header to make routing Christoph Paasch <cpaasch(a)apple.com> tcp: Reset bytes_acked and bytes_received when disconnecting Eric Dumazet <edumazet(a)google.com> tcp: fix tcp_set_congestion_control() use from bpf hook Eric Dumazet <edumazet(a)google.com> tcp: be more careful in tcp_fragment() Takashi Iwai <tiwai(a)suse.de> sky2: Disable MSI on ASUS P6T Marcelo Ricardo Leitner <marcelo.leitner(a)gmail.com> sctp: fix error handling on stream scheduler initialization David Howells <dhowells(a)redhat.com> rxrpc: Fix send on a connected, but unbound socket Heiner Kallweit <hkallweit1(a)gmail.com> r8169: fix issue with confused RX unit after PHY power-down on RTL8411b Yang Wei <albin_yang(a)163.com> nfc: fix potential illegal memory access Jose Abreu <Jose.Abreu(a)synopsys.com> net: stmmac: Re-work the queue selection for TSO packets Andrew Lunn <andrew(a)lunn.ch> net: phy: sfp: hwmon: Fix scaling of RX power John Hurley <john.hurley(a)netronome.com> net: openvswitch: fix csum updates for MPLS actions Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com> net: neigh: fix multiple neigh timer scheduling Florian Westphal <fw(a)strlen.de> net: make skb_dst_force return true when dst is refcounted Baruch Siach <baruch(a)tkos.co.il> net: dsa: mv88e6xxx: wait after reset deactivation Justin Chen <justinpopo6(a)gmail.com> net: bcmgenet: use promisc for unsupported filters Ido Schimmel <idosch(a)mellanox.com> ipv6: Unlink sibling route in case of failure David Ahern <dsahern(a)gmail.com> ipv6: rt6_check should return NULL if 'from' is NULL Matteo Croce <mcroce(a)redhat.com> ipv4: don't set IPv6 only flags to IPv4 addresses Eric Dumazet <edumazet(a)google.com> igmp: fix memory leak in igmpv3_del_delrec() Haiyang Zhang <haiyangz(a)microsoft.com> hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() Taehee Yoo <ap420073(a)gmail.com> caif-hsi: fix possible deadlock in cfhsi_exit_module() Brian King <brking(a)linux.vnet.ibm.com> bnx2x: Prevent load reordering in tx completion processing ------------- Diffstat: Makefile | 4 +- arch/mips/jz4740/board-qi_lb60.c | 16 +-- arch/x86/kvm/vmx.c | 10 +- drivers/dma-buf/dma-buf.c | 1 + drivers/dma-buf/reservation.c | 4 + drivers/gpio/gpio-davinci.c | 5 +- drivers/net/caif/caif_hsi.c | 2 +- drivers/net/dsa/mv88e6xxx/chip.c | 2 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 57 ++++----- drivers/net/ethernet/marvell/sky2.c | 7 ++ .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 9 +- drivers/net/ethernet/realtek/r8169.c | 137 +++++++++++++++++++++ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 29 +++-- drivers/net/hyperv/netvsc_drv.c | 1 - drivers/net/macsec.c | 6 +- drivers/net/phy/sfp.c | 2 +- drivers/net/vrf.c | 58 +++++---- fs/ext4/dir.c | 19 ++- fs/ext4/ext4_jbd2.h | 12 +- fs/ext4/file.c | 4 + fs/ext4/inode.c | 24 +++- fs/ext4/ioctl.c | 46 ++++++- fs/ext4/move_extent.c | 3 +- fs/ext4/namei.c | 45 +++++-- fs/jbd2/commit.c | 23 +++- fs/jbd2/journal.c | 4 + fs/jbd2/transaction.c | 49 ++++---- include/linux/fs.h | 2 + include/linux/jbd2.h | 22 ++++ include/linux/perf_event.h | 5 + include/net/dst.h | 5 +- include/net/tcp.h | 8 +- include/net/tls.h | 1 + kernel/events/core.c | 83 ++++++++++--- mm/filemap.c | 22 ++++ mm/vmscan.c | 6 +- net/bridge/br_input.c | 8 +- net/bridge/br_multicast.c | 32 ++--- net/bridge/br_stp_bpdu.c | 3 +- net/core/filter.c | 2 +- net/core/neighbour.c | 2 + net/ipv4/devinet.c | 8 ++ net/ipv4/igmp.c | 8 +- net/ipv4/tcp.c | 6 +- net/ipv4/tcp_cong.c | 6 +- net/ipv4/tcp_output.c | 13 +- net/ipv6/ip6_fib.c | 18 ++- net/ipv6/route.c | 2 +- net/netfilter/nf_queue.c | 6 +- net/netrom/af_netrom.c | 4 +- net/nfc/nci/data.c | 2 +- net/openvswitch/actions.c | 6 +- net/rxrpc/af_rxrpc.c | 4 +- net/sched/cls_api.c | 1 + net/sched/sch_fq_codel.c | 2 - net/sched/sch_sfq.c | 2 - net/sctp/socket.c | 20 +-- net/sctp/stream.c | 9 +- net/tls/tls_device.c | 2 +- net/tls/tls_main.c | 2 +- 61 files changed, 669 insertions(+), 235 deletions(-)

5 years, 2 months

6
55
0 0

nosmp build errors in v4.14.y-queue

by Guenter Roeck

Just in case it has't been reported. x86/x86_64 allnoconfig, tinyconfig: Error log: arch/x86/events/amd/uncore.c: In function 'amd_uncore_event_init': events/amd/uncore.c:222:7: error: 'smp_num_siblings' undeclared "#include <asm/smp.h>" is missing. Added upstream with commit 812af433038f9 ("perf/events/amd/uncore: Fix amd_uncore_llc ID to use pre-defined cpu_llc_id"). Guenter

5 years, 2 months

3
2
0 0

Re: [PATCH 4.4 stable net] net: tcp: Fix use-after-free in tcp_write_xmit

by Greg KH

On Wed, Jul 24, 2019 at 05:17:15PM +0800, Mao Wenan wrote: > There is one report about tcp_write_xmit use-after-free with version 4.4.136: > > BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:796 [inline] > BUG: KASAN: use-after-free in tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline] > BUG: KASAN: use-after-free in tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056 > Read of size 2 at addr ffff8801d6fc87b0 by task syz-executor408/4195 > > CPU: 0 PID: 4195 Comm: syz-executor408 Not tainted 4.4.136-gfb7e319 #59 > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 > 0000000000000000 7d8f38ecc03be946 ffff8801d73b7710 ffffffff81e0edad > ffffea00075bf200 ffff8801d6fc87b0 0000000000000000 ffff8801d6fc87b0 > dffffc0000000000 ffff8801d73b7748 ffffffff815159b6 ffff8801d6fc87b0 > Call Trace: > [<ffffffff81e0edad>] __dump_stack lib/dump_stack.c:15 [inline] > [<ffffffff81e0edad>] dump_stack+0xc1/0x124 lib/dump_stack.c:51 > [<ffffffff815159b6>] print_address_description+0x6c/0x216 mm/kasan/report.c:252 > [<ffffffff81515cd5>] kasan_report_error mm/kasan/report.c:351 [inline] > [<ffffffff81515cd5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408 > [<ffffffff814f9784>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427 > [<ffffffff83286582>] tcp_skb_pcount include/net/tcp.h:796 [inline] > [<ffffffff83286582>] tcp_init_tso_segs net/ipv4/tcp_output.c:1619 [inline] > [<ffffffff83286582>] tcp_write_xmit+0x3fc2/0x4cb0 net/ipv4/tcp_output.c:2056 > [<ffffffff83287a40>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2307 > [<ffffffff8328e966>] tcp_send_fin+0x176/0xab0 net/ipv4/tcp_output.c:2883 > [<ffffffff8324c0d0>] tcp_close+0xca0/0xf70 net/ipv4/tcp.c:2112 > [<ffffffff832f8d0f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435 > [<ffffffff82f1a156>] sock_release+0x96/0x1c0 net/socket.c:586 > [<ffffffff82f1a296>] sock_close+0x16/0x20 net/socket.c:1037 > [<ffffffff81522da5>] __fput+0x235/0x6f0 fs/file_table.c:208 > [<ffffffff815232e5>] ____fput+0x15/0x20 fs/file_table.c:244 > [<ffffffff8118bd7f>] task_work_run+0x10f/0x190 kernel/task_work.c:115 > [<ffffffff81135285>] exit_task_work include/linux/task_work.h:21 [inline] > [<ffffffff81135285>] do_exit+0x9e5/0x26b0 kernel/exit.c:759 > [<ffffffff8113b1d1>] do_group_exit+0x111/0x330 kernel/exit.c:889 > [<ffffffff8115e5cc>] get_signal+0x4ec/0x14b0 kernel/signal.c:2321 > [<ffffffff8100e02b>] do_signal+0x8b/0x1d30 arch/x86/kernel/signal.c:712 > [<ffffffff8100360a>] exit_to_usermode_loop+0x11a/0x160 arch/x86/entry/common.c:248 > [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:283 [inline] > [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:348 > [<ffffffff838c29b5>] int_ret_from_sys_call+0x25/0xa3 > > Allocated by task 4194: > [<ffffffff810341d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 > [<ffffffff814f8873>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 > [<ffffffff814f8b57>] set_track mm/kasan/kasan.c:524 [inline] > [<ffffffff814f8b57>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616 > [<ffffffff814f9122>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 > [<ffffffff814f4c1e>] slab_post_alloc_hook mm/slub.c:1349 [inline] > [<ffffffff814f4c1e>] slab_alloc_node mm/slub.c:2615 [inline] > [<ffffffff814f4c1e>] slab_alloc mm/slub.c:2623 [inline] > [<ffffffff814f4c1e>] kmem_cache_alloc+0xbe/0x2a0 mm/slub.c:2628 > [<ffffffff82f380a6>] kmem_cache_alloc_node include/linux/slab.h:350 [inline] > [<ffffffff82f380a6>] __alloc_skb+0xe6/0x600 net/core/skbuff.c:218 > [<ffffffff832466c3>] alloc_skb_fclone include/linux/skbuff.h:856 [inline] > [<ffffffff832466c3>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833 > [<ffffffff83249164>] tcp_sendmsg+0xd34/0x2b00 net/ipv4/tcp.c:1178 > [<ffffffff83300ef3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755 > [<ffffffff82f1e1fc>] sock_sendmsg_nosec net/socket.c:625 [inline] > [<ffffffff82f1e1fc>] sock_sendmsg+0xcc/0x110 net/socket.c:635 > [<ffffffff82f1eedc>] SYSC_sendto+0x21c/0x370 net/socket.c:1665 > [<ffffffff82f21560>] SyS_sendto+0x40/0x50 net/socket.c:1633 > [<ffffffff838c2825>] entry_SYSCALL_64_fastpath+0x22/0x9e > > Freed by task 4194: > [<ffffffff810341d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 > [<ffffffff814f8873>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 > [<ffffffff814f91a2>] set_track mm/kasan/kasan.c:524 [inline] > [<ffffffff814f91a2>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 > [<ffffffff814f632e>] slab_free_hook mm/slub.c:1383 [inline] > [<ffffffff814f632e>] slab_free_freelist_hook mm/slub.c:1405 [inline] > [<ffffffff814f632e>] slab_free mm/slub.c:2859 [inline] > [<ffffffff814f632e>] kmem_cache_free+0xbe/0x340 mm/slub.c:2881 > [<ffffffff82f3527f>] kfree_skbmem+0xcf/0x100 net/core/skbuff.c:635 > [<ffffffff82f372fd>] __kfree_skb+0x1d/0x20 net/core/skbuff.c:676 > [<ffffffff83288834>] sk_wmem_free_skb include/net/sock.h:1447 [inline] > [<ffffffff83288834>] tcp_write_queue_purge include/net/tcp.h:1460 [inline] > [<ffffffff83288834>] tcp_connect_init net/ipv4/tcp_output.c:3122 [inline] > [<ffffffff83288834>] tcp_connect+0xb24/0x30c0 net/ipv4/tcp_output.c:3261 > [<ffffffff8329b991>] tcp_v4_connect+0xf31/0x1890 net/ipv4/tcp_ipv4.c:246 > [<ffffffff832f9ca9>] __inet_stream_connect+0x2a9/0xc30 net/ipv4/af_inet.c:615 > [<ffffffff832fa685>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676 > [<ffffffff82f1eb78>] SYSC_connect+0x1b8/0x300 net/socket.c:1557 > [<ffffffff82f214b4>] SyS_connect+0x24/0x30 net/socket.c:1538 > [<ffffffff838c2825>] entry_SYSCALL_64_fastpath+0x22/0x9e > > Syzkaller reproducer(): > r0 = socket$packet(0x11, 0x3, 0x300) > r1 = socket$inet_tcp(0x2, 0x1, 0x0) > bind$inet(r1, &(0x7f0000000300)={0x2, 0x4e21, @multicast1}, 0x10) > connect$inet(r1, &(0x7f0000000140)={0x2, 0x1000004e21, @loopback}, 0x10) > recvmmsg(r1, &(0x7f0000001e40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/88, 0x58}], 0x1}}], 0x1, 0x40000000, 0x0) > sendto$inet(r1, &(0x7f0000000000)="e2f7ad5b661c761edf", 0x9, 0x8080, 0x0, 0x0) > r2 = fcntl$dupfd(r1, 0x0, r0) > connect$unix(r2, &(0x7f00000001c0)=@file={0x0, './file0\x00'}, 0x6e) > > C repro link: https://syzkaller.appspot.com/text?tag=ReproC&x=14db474f800000 > > This is because when tcp_connect_init call tcp_write_queue_purge, it will > kfree all the skb in the write_queue, but the sk->sk_send_head forget to set NULL, > then tcp_write_xmit try to send skb, which has freed in tcp_write_queue_purge, UAF happens. > > Signed-off-by: Mao Wenan <maowenan(a)huawei.com> > --- > include/net/tcp.h | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/include/net/tcp.h b/include/net/tcp.h > index bf8a0dae977a..8f8aace28cf8 100644 > --- a/include/net/tcp.h > +++ b/include/net/tcp.h > @@ -1457,6 +1457,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) > > while ((skb = __skb_dequeue(&sk->sk_write_queue)) != NULL) > sk_wmem_free_skb(sk, skb); > + sk->sk_send_head = NULL; > sk_mem_reclaim(sk); > tcp_clear_all_retrans_hints(tcp_sk(sk)); > inet_csk(sk)->icsk_backoff = 0; Does this corrispond with a specific commit that is already in Linus's tree? If not, why, did we change/mess something up when doing backports, or is the code just that different? Also, is this needed in 4.9.y, 4.14.y, 4.19.y, and/or 5.2.y? Why just 4.4.y? thanks, greg k-h

5 years, 2 months

2
5
0 0

[PATCH AUTOSEL 4.4 01/35] drm/panel: simple: Fix panel_simple_dsi_probe

by Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi(a)ti.com> [ Upstream commit 7ad9db66fafb0f0ad53fd2a66217105da5ddeffe ] In case mipi_dsi_attach() fails remove the registered panel to avoid added panel without corresponding device. Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com> Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190226081153.31334-1-peter.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/panel/panel-simple.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c index f418c002d323..ecad4d7c6cd1 100644 --- a/drivers/gpu/drm/panel/panel-simple.c +++ b/drivers/gpu/drm/panel/panel-simple.c @@ -1389,7 +1389,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi) dsi->format = desc->format; dsi->lanes = desc->lanes; - return mipi_dsi_attach(dsi); + err = mipi_dsi_attach(dsi); + if (err) { + struct panel_simple *panel = dev_get_drvdata(&dsi->dev); + + drm_panel_remove(&panel->base); + } + + return err; } static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi) -- 2.20.1

5 years, 2 months

4
38
0 0

[PATCH AUTOSEL 4.14 01/60] drm/panel: simple: Fix panel_simple_dsi_probe

by Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi(a)ti.com> [ Upstream commit 7ad9db66fafb0f0ad53fd2a66217105da5ddeffe ] In case mipi_dsi_attach() fails remove the registered panel to avoid added panel without corresponding device. Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com> Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190226081153.31334-1-peter.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/panel/panel-simple.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c index fc56d033febe..7a0fd4e4e78d 100644 --- a/drivers/gpu/drm/panel/panel-simple.c +++ b/drivers/gpu/drm/panel/panel-simple.c @@ -2371,7 +2371,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi) dsi->format = desc->format; dsi->lanes = desc->lanes; - return mipi_dsi_attach(dsi); + err = mipi_dsi_attach(dsi); + if (err) { + struct panel_simple *panel = dev_get_drvdata(&dsi->dev); + + drm_panel_remove(&panel->base); + } + + return err; } static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi) -- 2.20.1

5 years, 2 months

4
65
0 0

[PATCH AUTOSEL 5.1 001/141] drm/panel: simple: Fix panel_simple_dsi_probe

by Sasha Levin

From: Peter Ujfalusi <peter.ujfalusi(a)ti.com> [ Upstream commit 7ad9db66fafb0f0ad53fd2a66217105da5ddeffe ] In case mipi_dsi_attach() fails remove the registered panel to avoid added panel without corresponding device. Signed-off-by: Peter Ujfalusi <peter.ujfalusi(a)ti.com> Signed-off-by: Thierry Reding <treding(a)nvidia.com> Link: https://patchwork.freedesktop.org/patch/msgid/20190226081153.31334-1-peter.… Signed-off-by: Sasha Levin <sashal(a)kernel.org> --- drivers/gpu/drm/panel/panel-simple.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c index 9e8218f6a3f2..a82358e8fd73 100644 --- a/drivers/gpu/drm/panel/panel-simple.c +++ b/drivers/gpu/drm/panel/panel-simple.c @@ -3038,7 +3038,14 @@ static int panel_simple_dsi_probe(struct mipi_dsi_device *dsi) dsi->format = desc->format; dsi->lanes = desc->lanes; - return mipi_dsi_attach(dsi); + err = mipi_dsi_attach(dsi); + if (err) { + struct panel_simple *panel = dev_get_drvdata(&dsi->dev); + + drm_panel_remove(&panel->base); + } + + return err; } static int panel_simple_dsi_remove(struct mipi_dsi_device *dsi) -- 2.20.1

5 years, 2 months

2
142
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2019