March 2022 - Linux-stable-mirror

[PATCH 5.10] ubsan: remove CONFIG_UBSAN_OBJECT_SIZE

by Tadeusz Struk

From: Kees Cook <keescook(a)chromium.org> Upstream commit: 69d0db01e210 ("ubsan: remove CONFIG_UBSAN_OBJECT_SIZE") The object-size sanitizer is redundant to -Warray-bounds, and inappropriately performs its checks at run-time when all information needed for the evaluation is available at compile-time, making it quite difficult to use: https://bugzilla.kernel.org/show_bug.cgi?id=214861 This run-time object-size checks also trigger false-positive errors, like the below, that make it quite difficult to test stable kernels in test automations like syzkaller: https://syzkaller.appspot.com/text?tag=Error&x=12b3aac3700000 With -Warray-bounds almost enabled globally, it doesn't make sense to keep this around. Link: https://lkml.kernel.org/r/20211203235346.110809-1-keescook@chromium.org Signed-off-by: Kees Cook <keescook(a)chromium.org> Reviewed-by: Marco Elver <elver(a)google.com> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Cc: Michal Marek <michal.lkml(a)markovi.net> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Andrey Ryabinin <ryabinin.a.a(a)gmail.com> Cc: "Peter Zijlstra (Intel)" <peterz(a)infradead.org> Cc: Stephen Rothwell <sfr(a)canb.auug.org.au> Cc: Arnd Bergmann <arnd(a)arndb.de> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Tadeusz Struk <tadeusz.struk(a)linaro.org> --- lib/test_ubsan.c | 11 ----------- scripts/Makefile.ubsan | 1 - 2 files changed, 12 deletions(-) diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c index 9ea10adf7a66..b1d0a6ecfe1b 100644 --- a/lib/test_ubsan.c +++ b/lib/test_ubsan.c @@ -89,16 +89,6 @@ static void test_ubsan_misaligned_access(void) *ptr = val; } -static void test_ubsan_object_size_mismatch(void) -{ - /* "((aligned(8)))" helps this not into be misaligned for ptr-access. */ - volatile int val __aligned(8) = 4; - volatile long long *ptr, val2; - - ptr = (long long *)&val; - val2 = *ptr; -} - static const test_ubsan_fp test_ubsan_array[] = { test_ubsan_add_overflow, test_ubsan_sub_overflow, @@ -110,7 +100,6 @@ static const test_ubsan_fp test_ubsan_array[] = { test_ubsan_load_invalid_value, //test_ubsan_null_ptr_deref, /* exclude it because there is a crash */ test_ubsan_misaligned_access, - test_ubsan_object_size_mismatch, }; static int __init test_ubsan_init(void) diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 9716dab06bc7..2156e18391a3 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -23,7 +23,6 @@ ifdef CONFIG_UBSAN_MISC CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow) - CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size) CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) endif -- 2.35.1

2 years, 11 months

2
2
0 0

[PATCH 5.10 000/105] 5.10.104-rc1 review

by Greg Kroah-Hartman

This is the start of the stable review cycle for the 5.10.104 release. There are 105 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know. Responses should be made by Wed, 09 Mar 2022 09:16:25 +0000. Anything received after that time might be too late. The whole patch series can be found in one patch at: https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.104-r… or in the git tree and branch at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y and the diffstat can be found below. thanks, greg k-h ------------- Pseudo-Shortlog of commits: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Linux 5.10.104-rc1 Jiri Bohac <jbohac(a)suse.cz> Revert "xfrm: xfrm_state_mtu should return at least 1280 for ipv6" Filipe Manana <fdmanana(a)suse.com> btrfs: add missing run of delayed items after unlink during log replay Sidong Yang <realwakka(a)gmail.com> btrfs: qgroup: fix deadlock between rescan worker and remove qgroup Filipe Manana <fdmanana(a)suse.com> btrfs: fix lost prealloc extents beyond eof after full fsync Randy Dunlap <rdunlap(a)infradead.org> tracing: Fix return value of __setup handlers Steven Rostedt (Google) <rostedt(a)goodmis.org> tracing/histogram: Fix sorting on old "cpu" value William Mahon <wmahon(a)chromium.org> HID: add mapping for KEY_ALL_APPLICATIONS William Mahon <wmahon(a)chromium.org> HID: add mapping for KEY_DICTATE David Gow <davidgow(a)google.com> Input: samsung-keypad - properly state IOMEM dependency Hans de Goede <hdegoede(a)redhat.com> Input: elan_i2c - fix regulator enable count imbalance after suspend/resume Hans de Goede <hdegoede(a)redhat.com> Input: elan_i2c - move regulator_[en|dis]able() out of elan_[en|dis]able_power() Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dcb: disable softirqs in dcbnl_flush_dev() Qiang Yu <qiang.yu(a)amd.com> drm/amdgpu: fix suspend/resume hang regression Jiasheng Jiang <jiasheng(a)iscas.ac.cn> nl80211: Handle nla_memdup failures in handle_nan_filter Mateusz Palczewski <mateusz.palczewski(a)intel.com> iavf: Refactor iavf state machine tracking Jia-Ju Bai <baijiaju1990(a)gmail.com> net: chelsio: cxgb3: check the return value of pci_find_capability() Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: complete init_done on transport events Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: define flush_reset_queue helper Thierry Reding <treding(a)nvidia.com> ARM: tegra: Move panels to AUX bus Jiasheng Jiang <jiasheng(a)iscas.ac.cn> soc: fsl: qe: Check of ioremap return value Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> soc: fsl: guts: Add a missing memory allocation failure check Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> soc: fsl: guts: Revert commit 3c0d64e867ed Anthoine Bourgeois <anthoine.bourgeois(a)gmail.com> ARM: dts: Use 32KiHz oscillator on devkit8000 Anthoine Bourgeois <anthoine.bourgeois(a)gmail.com> ARM: dts: switch timer config to common devkit8000 devicetree Heiko Carstens <hca(a)linux.ibm.com> s390/extable: fix exception table sorting Hugh Dickins <hughd(a)google.com> memfd: fix F_SEAL_WRITE after shmem huge page allocated Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: free reset-work-item when flushing Sasha Neftin <sasha.neftin(a)intel.com> igc: igc_write_phy_reg_gpy: drop premature return Samuel Holland <samuel(a)sholland.org> pinctrl: sunxi: Use unique lockdep classes for IRQs Amit Cohen <amcohen(a)nvidia.com> selftests: mlxsw: tc_police_scale: Make test more robust Randy Dunlap <rdunlap(a)infradead.org> ARM: 9182/1: mmu: fix returns from early_param() and __setup() functions Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> ARM: Fix kgdb breakpoint for Thumb2 Corinna Vinschen <vinschen(a)redhat.com> igc: igc_read_phy_reg_gpy: drop premature return Brian Norris <briannorris(a)chromium.org> arm64: dts: rockchip: Switch RK3399-Gru DP to SPDIF output Vincent Mailhol <mailhol.vincent(a)wanadoo.fr> can: gs_usb: change active_channels's type from atomic_t to u8 Fabio Estevam <festevam(a)denx.de> ASoC: cs4265: Fix the duplicated control name Alyssa Ross <hi(a)alyssa.is> firmware: arm_scmi: Remove space in MODULE_ALIAS name Jann Horn <jannh(a)google.com> efivars: Respect "block" flag in efivar_entry_set_safe() Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> ixgbe: xsk: change !netif_carrier_ok() handling in ixgbe_xmit_zc() Zheyu Ma <zheyuma97(a)gmail.com> net: arcnet: com20020: Fix null-ptr-deref in com20020pci_probe() Sukadev Bhattiprolu <sukadev(a)linux.ibm.com> ibmvnic: register netdev after init of adapter Randy Dunlap <rdunlap(a)infradead.org> net: sxgbe: fix return value of __setup handler Slawomir Laba <slawomirx.laba(a)intel.com> iavf: Fix missing check for running netdev Johannes Berg <johannes.berg(a)intel.com> mac80211: treat some SAE auth steps as final Randy Dunlap <rdunlap(a)infradead.org> net: stmmac: fix return value of __setup handler Nicolas Escande <nico.escande(a)gmail.com> mac80211: fix forwarded mesh frames AC & queue selection Valentin Schneider <valentin.schneider(a)arm.com> ia64: ensure proper NUMA distance and possible map initialization Dietmar Eggemann <dietmar.eggemann(a)arm.com> sched/topology: Fix sched_domain_topology_level alloc in sched_init_numa() Valentin Schneider <valentin.schneider(a)arm.com> sched/topology: Make sched_init_numa() use a set for the deduplicating sort Jacob Keller <jacob.e.keller(a)intel.com> ice: fix concurrent reset and removal of VFs Brett Creeley <brett.creeley(a)intel.com> ice: Fix race conditions between virtchnl handling and VF ndo ops Frederic Weisbecker <frederic(a)kernel.org> rcu/nocb: Fix missed nocb_timer requeue D. Wythe <alibuda(a)linux.alibaba.com> net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error cause by server D. Wythe <alibuda(a)linux.alibaba.com> net/smc: fix unexpected SMC_CLC_DECL_ERR_REGRMB error generated by client D. Wythe <alibuda(a)linux.alibaba.com> net/smc: fix connection leak Vladimir Oltean <vladimir.oltean(a)nxp.com> net: dcb: flush lingering app table entries for unregistered devices j.nixdorf(a)avm.de <j.nixdorf(a)avm.de> net: ipv6: ensure we call ipv6_mc_down() at most once Sven Eckelmann <sven(a)narfation.org> batman-adv: Don't expect inter-netns unique iflink indices Sven Eckelmann <sven(a)narfation.org> batman-adv: Request iflink once in batadv_get_real_netdevice Sven Eckelmann <sven(a)narfation.org> batman-adv: Request iflink once in batadv-on-batadv check Florian Westphal <fw(a)strlen.de> netfilter: nf_queue: handle socket prefetch Florian Westphal <fw(a)strlen.de> netfilter: nf_queue: fix possible use-after-free Florian Westphal <fw(a)strlen.de> netfilter: nf_queue: don't assume sk is full socket lena wang <lena.wang(a)mediatek.com> net: fix up skbs delta_truesize in UDP GRO frag_list Sasha Neftin <sasha.neftin(a)intel.com> e1000e: Correct NVM checksum verification flow Leon Romanovsky <leon(a)kernel.org> xfrm: enforce validity of offload input flags Antony Antony <antony.antony(a)secunet.com> xfrm: fix the if_id check in changelink Eric Dumazet <edumazet(a)google.com> bpf, sockmap: Do not ignore orig_len parameter Eric Dumazet <edumazet(a)google.com> netfilter: fix use-after-free in __nf_register_net_hook() Jiri Bohac <jbohac(a)suse.cz> xfrm: fix MTU regression Daniel Borkmann <daniel(a)iogearbox.net> mm: Consider __GFP_NOWARN flag for oversized kvmalloc() calls Dave Jiang <dave.jiang(a)intel.com> ntb: intel: fix port config status offset for SPR Nicolas Cavallari <nicolas.cavallari(a)green-communications.fr> thermal: core: Fix TZ_GET_TRIP NULL pointer dereference Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> xen/netfront: destroy queues before real_num_tx_queues is zeroed Ville Syrjälä <ville.syrjala(a)linux.intel.com> drm/i915: s/JSP2/ICP2/ PCH Lennert Buytenhek <buytenh(a)wantstofly.org> iommu/amd: Recover from event log overflow Marek Vasut <marex(a)denx.de> ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min Alexandre Ghiti <alexandre.ghiti(a)canonical.com> riscv: Fix config KASAN && DEBUG_VIRTUAL Alexandre Ghiti <alexandre.ghiti(a)canonical.com> riscv: Fix config KASAN && SPARSEMEM && !SPARSE_VMEMMAP Sunil V L <sunilvl(a)ventanamicro.com> riscv/efi_stub: Fix get_boot_hartid_from_fdt() return value Zhen Ni <nizhen(a)uniontech.com> ALSA: intel_hdmi: Fix reference to PCM buffer address Steven Rostedt <rostedt(a)goodmis.org> tracing: Add ustring operation to filtering string pointers Qiang Yu <qiang.yu(a)amd.com> drm/amdgpu: check vm ready by amdgpu_vm->evicting flag Sergey Shtylyov <s.shtylyov(a)omp.ru> ata: pata_hpt37x: fix PCI clock detection Valentin Caron <valentin.caron(a)foss.st.com> serial: stm32: prevent TDR register overwrite when sending x_char Steven Rostedt <rostedt(a)goodmis.org> tracing: Add test for user space strings when filtering on string pointers Christophe Vu-Brugier <christophe.vu-brugier(a)seagate.com> exfat: fix i_blocks for files truncated over 4 GiB Christophe Vu-Brugier <christophe.vu-brugier(a)seagate.com> exfat: reuse exfat_inode_info variable instead of calling EXFAT_I() Hangyu Hua <hbh25y(a)gmail.com> usb: gadget: clear related members when goto fail Hangyu Hua <hbh25y(a)gmail.com> usb: gadget: don't release an existing dev->buf Daniele Palmas <dnlplm(a)gmail.com> net: usb: cdc_mbim: avoid altsetting toggling for Telit FN990 Wolfram Sang <wsa(a)kernel.org> i2c: qup: allow COMPILE_TEST Wolfram Sang <wsa(a)kernel.org> i2c: cadence: allow COMPILE_TEST Yongzhi Liu <lyz_cs(a)pku.edu.cn> dmaengine: shdma: Fix runtime PM imbalance on error Sherry Yang <sherry.yang(a)oracle.com> selftests/seccomp: Fix seccomp failure by adding missing headers Ronnie Sahlberg <lsahlber(a)redhat.com> cifs: fix double free race when mount fails in cifs_get_root() Hangyu Hua <hbh25y(a)gmail.com> tipc: fix a bit overflow in tipc_crypto_key_rcv() Marc Zyngier <maz(a)kernel.org> KVM: arm64: vgic: Read HW interrupt pending state from the HW José Expósito <jose.exposito89(a)gmail.com> Input: clear BTN_RIGHT/MIDDLE on buttonpads Oliver Barta <oliver.barta(a)aptiv.com> regulator: core: fix false positive in regulator_late_cleanup() Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ASoC: rt5682: do not block workqueue if card is unbound Kai Vehmanen <kai.vehmanen(a)linux.intel.com> ASoC: rt5668: do not block workqueue if card is unbound Eric Anholt <eric(a)anholt.net> i2c: bcm2835: Avoid clock stretching timeouts JaeMan Park <jaeman(a)google.com> mac80211_hwsim: initialize ieee80211_tx_info at hw_scan_work Benjamin Beichler <benjamin.beichler(a)uni-rostock.de> mac80211_hwsim: report NOACK frames in tx_status ------------- Diffstat: Documentation/trace/events.rst | 19 ++++ Makefile | 4 +- arch/arm/boot/dts/omap3-devkit8000-common.dtsi | 18 ++++ arch/arm/boot/dts/omap3-devkit8000.dts | 33 ------- arch/arm/boot/dts/tegra124-nyan-big.dts | 15 +-- arch/arm/boot/dts/tegra124-nyan-blaze.dts | 15 +-- arch/arm/boot/dts/tegra124-venice2.dts | 14 +-- arch/arm/kernel/kgdb.c | 36 +++++-- arch/arm/mm/mmu.c | 2 + arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi | 17 +++- arch/arm64/kvm/vgic/vgic-mmio.c | 2 + arch/ia64/kernel/acpi.c | 7 +- arch/riscv/mm/Makefile | 3 + arch/riscv/mm/kasan_init.c | 3 +- arch/s390/include/asm/extable.h | 9 +- drivers/ata/pata_hpt37x.c | 4 +- drivers/clocksource/timer-ti-dm-systimer.c | 3 +- drivers/dma/sh/shdma-base.c | 4 +- drivers/firmware/arm_scmi/driver.c | 2 +- drivers/firmware/efi/libstub/riscv-stub.c | 17 ++-- drivers/firmware/efi/vars.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 10 +- drivers/gpu/drm/i915/intel_pch.c | 2 +- drivers/gpu/drm/i915/intel_pch.h | 2 +- drivers/hid/hid-debug.c | 5 +- drivers/hid/hid-input.c | 3 + drivers/i2c/busses/Kconfig | 4 +- drivers/i2c/busses/i2c-bcm2835.c | 11 +++ drivers/input/input.c | 6 ++ drivers/input/keyboard/Kconfig | 2 +- drivers/input/mouse/elan_i2c_core.c | 64 +++++------- drivers/iommu/amd/amd_iommu.h | 1 + drivers/iommu/amd/amd_iommu_types.h | 1 + drivers/iommu/amd/init.c | 10 ++ drivers/iommu/amd/iommu.c | 10 +- drivers/net/arcnet/com20020-pci.c | 3 + drivers/net/can/usb/gs_usb.c | 10 +- drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 2 + drivers/net/ethernet/ibm/ibmvnic.c | 39 ++++++-- drivers/net/ethernet/intel/e1000e/ich8lan.c | 4 +- drivers/net/ethernet/intel/iavf/iavf.h | 10 ++ drivers/net/ethernet/intel/iavf/iavf_main.c | 44 +++++---- drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 2 +- drivers/net/ethernet/intel/ice/ice_main.c | 2 + drivers/net/ethernet/intel/ice/ice_virtchnl_pf.c | 58 +++++++++-- drivers/net/ethernet/intel/ice/ice_virtchnl_pf.h | 5 + drivers/net/ethernet/intel/igc/igc_phy.c | 4 - drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 6 +- drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/wireless/mac80211_hwsim.c | 13 +++ drivers/net/xen-netfront.c | 39 +++++--- drivers/ntb/hw/intel/ntb_hw_gen4.c | 17 +++- drivers/ntb/hw/intel/ntb_hw_gen4.h | 16 +++ drivers/pinctrl/sunxi/pinctrl-sunxi.c | 9 ++ drivers/regulator/core.c | 13 +-- drivers/soc/fsl/guts.c | 14 ++- drivers/soc/fsl/qe/qe_io.c | 2 + drivers/thermal/thermal_netlink.c | 5 +- drivers/tty/serial/stm32-usart.c | 12 +++ drivers/usb/gadget/legacy/inode.c | 10 +- fs/btrfs/qgroup.c | 9 +- fs/btrfs/tree-log.c | 61 +++++++++--- fs/cifs/cifsfs.c | 1 + fs/exfat/file.c | 18 ++-- fs/exfat/inode.c | 13 ++- fs/exfat/namei.c | 6 +- fs/exfat/super.c | 10 +- include/linux/topology.h | 1 + include/net/netfilter/nf_queue.h | 2 +- include/net/xfrm.h | 1 - include/uapi/linux/input-event-codes.h | 4 +- include/uapi/linux/xfrm.h | 6 ++ kernel/rcu/tree_plugin.h | 7 +- kernel/sched/topology.c | 99 +++++++++---------- kernel/trace/trace.c | 4 +- kernel/trace/trace_events_filter.c | 107 +++++++++++++++++++-- kernel/trace/trace_events_hist.c | 6 +- kernel/trace/trace_kprobe.c | 2 +- mm/memfd.c | 40 +++++--- mm/util.c | 4 +- net/batman-adv/hard-interface.c | 29 ++++-- net/core/skbuff.c | 2 +- net/core/skmsg.c | 2 +- net/dcb/dcbnl.c | 44 +++++++++ net/ipv4/esp4.c | 2 +- net/ipv6/addrconf.c | 8 +- net/ipv6/esp6.c | 2 +- net/ipv6/ip6_output.c | 11 ++- net/mac80211/ieee80211_i.h | 2 +- net/mac80211/mlme.c | 16 ++- net/mac80211/rx.c | 4 +- net/netfilter/core.c | 5 +- net/netfilter/nf_queue.c | 36 ++++++- net/netfilter/nfnetlink_queue.c | 12 ++- net/smc/af_smc.c | 10 +- net/smc/smc_core.c | 5 +- net/tipc/crypto.c | 2 +- net/wireless/nl80211.c | 12 +++ net/xfrm/xfrm_device.c | 6 +- net/xfrm/xfrm_interface.c | 2 +- net/xfrm/xfrm_state.c | 14 +-- sound/soc/codecs/cs4265.c | 3 +- sound/soc/codecs/rt5668.c | 12 ++- sound/soc/codecs/rt5682.c | 12 ++- sound/soc/soc-ops.c | 4 +- sound/x86/intel_hdmi_audio.c | 2 +- .../selftests/drivers/net/mlxsw/tc_police_scale.sh | 3 +- tools/testing/selftests/seccomp/Makefile | 2 +- 110 files changed, 960 insertions(+), 424 deletions(-)

2 years, 11 months

6
118
0 0

[PATCH] dpu1: dpu_encoder: fix a missing check on list iterator

by Xiaomeng Tong

The bug is here: cstate = to_dpu_crtc_state(drm_crtc->state); For the drm_for_each_crtc(), just like list_for_each_entry(), the list iterator 'drm_crtc' will point to a bogus position containing HEAD if the list is empty or no element is found. This case must be checked before any use of the iterator, otherwise it will lead to a invalid memory access. To fix this bug, use a new variable 'iter' as the list iterator, while use the origin variable 'drm_crtc' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: b107603b4ad0f ("drm/msm/dpu: map mixer/ctl hw blocks in encoder modeset") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c index 1e648db439f9..d3fdb18e96f9 100644 --- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c @@ -965,7 +965,7 @@ static void dpu_encoder_virt_mode_set(struct drm_encoder *drm_enc, struct dpu_kms *dpu_kms; struct list_head *connector_list; struct drm_connector *conn = NULL, *conn_iter; - struct drm_crtc *drm_crtc; + struct drm_crtc *drm_crtc = NULL, *iter; struct dpu_crtc_state *cstate; struct dpu_global_state *global_state; struct dpu_hw_blk *hw_pp[MAX_CHANNELS_PER_ENC]; @@ -1007,9 +1007,14 @@ static void dpu_encoder_virt_mode_set(struct drm_encoder *drm_enc, return; } - drm_for_each_crtc(drm_crtc, drm_enc->dev) - if (drm_crtc->state->encoder_mask & drm_encoder_mask(drm_enc)) + drm_for_each_crtc(iter, drm_enc->dev) + if (iter->state->encoder_mask & drm_encoder_mask(drm_enc)) { + drm_crtc = iter; break; + } + + if (!drm_crtc) + return; /* Query resource that have been reserved in atomic check step. */ num_pp = dpu_rm_get_assigned_resources(&dpu_kms->rm, global_state, -- 2.17.1

2 years, 11 months

2
2
0 0

[PATCH] usb: cdns3: Fix issue for clear halt endpoint

by Pawel Laszczak

Path fixes bug which occurs during resetting endpoint in __cdns3_gadget_ep_clear_halt function. During resetting endpoint controller will change HW/DMA owned TRB. It set Abort flag in trb->control and will change trb->length field. If driver want to use the aborted trb it must update the changed field in TRB. Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver") cc: <stable(a)vger.kernel.org> Signed-off-by: Pawel Laszczak <pawell(a)cadence.com> --- drivers/usb/cdns3/cdns3-gadget.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c index 80aaab159e58..3a9f0968fd24 100644 --- a/drivers/usb/cdns3/cdns3-gadget.c +++ b/drivers/usb/cdns3/cdns3-gadget.c @@ -2682,6 +2682,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) struct usb_request *request; struct cdns3_request *priv_req; struct cdns3_trb *trb = NULL; + struct cdns3_trb trb_tmp; int ret; int val; @@ -2691,8 +2692,10 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) if (request) { priv_req = to_cdns3_request(request); trb = priv_req->trb; - if (trb) + if (trb) { + trb_tmp = *trb; trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); + } } writel(EP_CMD_CSTALL | EP_CMD_EPRST, &priv_dev->regs->ep_cmd); @@ -2707,7 +2710,7 @@ int __cdns3_gadget_ep_clear_halt(struct cdns3_endpoint *priv_ep) if (request) { if (trb) - trb->control = trb->control ^ cpu_to_le32(TRB_CYCLE); + *trb = trb_tmp; cdns3_rearm_transfer(priv_ep, 1); } -- 2.25.1

2 years, 11 months

2
1
0 0

Linux 5.10.109

by Greg Kroah-Hartman

I'm announcing the release of the 5.10.109 kernel. All users of the 5.10 kernel series must upgrade. The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary thanks, greg k-h ------------ Makefile | 2 arch/nds32/include/asm/uaccess.h | 22 ++++- arch/x86/kernel/acpi/boot.c | 24 +++++ drivers/acpi/battery.c | 12 ++ drivers/acpi/video_detect.c | 75 +++++++++++++++++ drivers/char/tpm/tpm-dev-common.c | 8 + drivers/char/tpm/tpm2-space.c | 8 - drivers/crypto/qat/qat_common/qat_crypto.c | 8 + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 12 +- drivers/net/wireless/ath/regd.c | 10 +- drivers/net/wireless/ath/wcn36xx/main.c | 3 drivers/net/wireless/ath/wcn36xx/wcn36xx.h | 1 drivers/nfc/st21nfca/se.c | 10 ++ drivers/staging/fbtft/fb_st7789v.c | 2 fs/exfat/super.c | 2 include/sound/pcm.h | 1 kernel/cgroup/cgroup-internal.h | 19 ++++ kernel/cgroup/cgroup-v1.c | 32 ++++--- kernel/cgroup/cgroup.c | 84 +++++++++++++------ kernel/rcu/tree_plugin.h | 9 +- net/ipv6/ip6_output.c | 4 net/llc/af_llc.c | 49 +++++++---- net/mac80211/cfg.c | 3 net/netfilter/nf_tables_core.c | 2 sound/core/oss/pcm_oss.c | 12 +- sound/core/oss/pcm_plugin.c | 5 - sound/core/pcm.c | 2 sound/core/pcm_lib.c | 4 sound/core/pcm_memory.c | 11 +- sound/core/pcm_native.c | 97 ++++++++++++++--------- sound/pci/ac97/ac97_codec.c | 4 sound/pci/cmipci.c | 3 sound/pci/hda/patch_realtek.c | 4 sound/soc/sti/uniperif_player.c | 6 - sound/soc/sti/uniperif_reader.c | 2 sound/usb/mixer_maps.c | 10 ++ sound/usb/mixer_quirks.c | 7 - 37 files changed, 421 insertions(+), 148 deletions(-) Arnd Bergmann (1): nds32: fix access_ok() checks in get/put_user Brian Norris (1): Revert "ath: add support for special 0x0 regulatory domain" Bryan O'Donoghue (1): wcn36xx: Differentiate wcn3660 from wcn3620 Chen Li (1): exfat: avoid incorrectly releasing for root inode Eric Dumazet (2): llc: fix netdevice reference leaks in llc_ui_bind() llc: only change llc->dev when bind() succeeds Giacomo Guiduzzi (1): ALSA: pci: fix reading of swapped values from pcmreg in AC97 codec Giovanni Cabiddu (1): crypto: qat - disable registration of algorithms Greg Kroah-Hartman (1): Linux 5.10.109 James Bottomley (1): tpm: use try_get_ops() in tpm-space.c Jason Zheng (1): ALSA: hda/realtek: Add quirk for ASUS GA402 Jonathan Teh (1): ALSA: cmipci: Restore aux vol on suspend/resume Jordy Zomer (1): nfc: st21nfca: Fix potential buffer overflows in EVT_TRANSACTION Lars-Peter Clausen (1): ALSA: usb-audio: Add mute TLV for playback volumes on RODE NT-USB Linus Lüssing (1): mac80211: fix potential double free on mesh join Mark Cilissen (1): ACPI / x86: Work around broken XSDT on Advantech DAC-BJ01 board Maximilian Luz (1): ACPI: battery: Add device HID and quirk for Microsoft Surface Go 3 Michal Koutný (1): cgroup-v1: Correct privileges check in release_agent writes Oliver Graute (1): staging: fbtft: fb_st7789v: reset display before initialization Pablo Neira Ayuso (1): netfilter: nf_tables: initialize registers in nft_do_chain() Paul E. McKenney (1): rcu: Don't deboost before reporting expedited quiescent state Reza Jahanbakhshi (1): ALSA: usb-audio: add mapping for new Corsair Virtuoso SE Stephane Graber (1): drivers: net: xgene: Fix regression in CRC stripping Tadeusz Struk (2): net: ipv6: fix skb_over_panic in __ip6_append_data tpm: Fix error handling in async work Takashi Iwai (7): ASoC: sti: Fix deadlock via snd_pcm_stop_xrun() call ALSA: oss: Fix PCM OSS buffer allocation overflow ALSA: pcm: Fix races among concurrent hw_params and hw_free calls ALSA: pcm: Fix races among concurrent read/write and buffer changes ALSA: pcm: Fix races among concurrent prepare and hw_params/hw_free calls ALSA: pcm: Fix races among concurrent prealloc proc writes ALSA: pcm: Add stream lock during PCM reset ioctl operations Tejun Heo (2): cgroup: Allocate cgroup_file_ctx for kernfs_open_file->priv cgroup: Use open-time cgroup namespace for process migration perm checks Tim Crawford (2): ALSA: hda/realtek: Add quirk for Clevo NP70PNJ ALSA: hda/realtek: Add quirk for Clevo NP50PNJ Werner Sembach (1): ACPI: video: Force backlight native for Clevo NL5xRU and NL5xNU huangwenhui (1): ALSA: hda/realtek - Fix headset mic problem for a HP machine with alc671

2 years, 11 months

3
6
0 0

[PATCH] md: fix an incorrect NULL check in md_reload_sb

by Xiaomeng Tong

The bug is here: if (!rdev || rdev->desc_nr != nr) { The list iterator value 'rdev' will *always* be set and non-NULL by rdev_for_each_rcu(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element found (In fact, it will be a bogus pointer to an invalid struct object containing the HEAD). Otherwise it will bypass the check and lead to invalid memory access passing the check. To fix the bug, use a new variable 'iter' as the list iterator, while using the original variable 'pdev' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 70bcecdb1534 ("amd-cluster: Improve md_reload_sb to be less error prone") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- changes from v1: - rephrase the subject (Guoqing Jiang) v1:https://lore.kernel.org/lkml/20220327080111.12028-1-xiam0nd.tong@gmail.c… --- drivers/md/md.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 7476fc204172..f156678c08bc 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -9794,16 +9794,18 @@ static int read_rdev(struct mddev *mddev, struct md_rdev *rdev) void md_reload_sb(struct mddev *mddev, int nr) { - struct md_rdev *rdev; + struct md_rdev *rdev = NULL, *iter; int err; /* Find the rdev */ - rdev_for_each_rcu(rdev, mddev) { - if (rdev->desc_nr == nr) + rdev_for_each_rcu(iter, mddev) { + if (iter->desc_nr == nr) { + rdev = iter; break; + } } - if (!rdev || rdev->desc_nr != nr) { + if (!rdev) { pr_warn("%s: %d Could not find rdev with nr %d\n", __func__, __LINE__, nr); return; } -- 2.17.1

2 years, 11 months

2
2
0 0

[PATCH v2] md: fix an incorrect NULL check in sync_sbs

by Xiaomeng Tong

The bug is here: if (!rdev) The list iterator value 'rdev' will *always* be set and non-NULL by rdev_for_each(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element found. Otherwise it will bypass the NULL check and lead to invalid memory access passing the check. To fix the bug, use a new variable 'iter' as the list iterator, while using the original variable 'pdev' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 2aa82191ac36c ("md-cluster: Perform a lazy update") Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- changes since v1: - rephrase the subject (Guoqing Jiang) - add Acked-by: for Guoqing Jiang v1:https://lore.kernel.org/lkml/20220327080002.11923-1-xiam0nd.tong@gmail.c… --- drivers/md/md.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 4d38bd7dadd6..7476fc204172 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -2629,14 +2629,16 @@ static void sync_sbs(struct mddev *mddev, int nospares) static bool does_sb_need_changing(struct mddev *mddev) { - struct md_rdev *rdev; + struct md_rdev *rdev = NULL, *iter; struct mdp_superblock_1 *sb; int role; /* Find a good rdev */ - rdev_for_each(rdev, mddev) - if ((rdev->raid_disk >= 0) && !test_bit(Faulty, &rdev->flags)) + rdev_for_each(iter, mddev) + if ((iter->raid_disk >= 0) && !test_bit(Faulty, &iter->flags)) { + rdev = iter; break; + } /* No good device found. */ if (!rdev) -- 2.17.1

2 years, 11 months

2
2
0 0

[PATCH] i2c: at91: use dma safe buffers

by Michael Walle

The supplied buffer might be on the stack and we get the following error message: [ 3.312058] at91_i2c e0070600.i2c: rejecting DMA map of vmalloc memory Use i2c_{get,put}_dma_safe_msg_buf() to get a DMA-able memory region if necessary. Cc: stable(a)vger.kernel.org Signed-off-by: Michael Walle <michael(a)walle.cc> --- I'm not sure if or which Fixes: tag I should add to this patch. The issue seems to be since a very long time, but nobody seem to have triggered it. FWIW, I'm using the sff,sfp driver, which triggers this. drivers/i2c/busses/i2c-at91-master.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/i2c/busses/i2c-at91-master.c b/drivers/i2c/busses/i2c-at91-master.c index b0eae94909f4..a7a22fedbaba 100644 --- a/drivers/i2c/busses/i2c-at91-master.c +++ b/drivers/i2c/busses/i2c-at91-master.c @@ -656,6 +656,7 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num) unsigned int_addr_flag = 0; struct i2c_msg *m_start = msg; bool is_read; + u8 *dma_buf; dev_dbg(&adap->dev, "at91_xfer: processing %d messages:\n", num); @@ -703,7 +704,18 @@ static int at91_twi_xfer(struct i2c_adapter *adap, struct i2c_msg *msg, int num) dev->msg = m_start; dev->recv_len_abort = false; + if (dev->use_dma) { + dma_buf = i2c_get_dma_safe_msg_buf(m_start, 1); + if (!dma_buf) { + ret = -ENOMEM; + goto out; + } + dev->buf = dma_buf; + } + + ret = at91_do_twi_transfer(dev); + i2c_put_dma_safe_msg_buf(dma_buf, m_start, !ret); ret = (ret < 0) ? ret : num; out: -- 2.30.2

2 years, 11 months

4
13
0 0

[PATCH] stm: ltdc: fix two incorrect NULL checks on list iterator

by Xiaomeng Tong

The two bugs are here: if (encoder) { if (bridge && bridge->timings) The list iterator value 'encoder/bridge' will *always* be set and non-NULL by drm_for_each_encoder()/list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found. To fix the bug, use a new variable '*_iter' as the list iterator, while use the old variable 'encoder/bridge' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 99e360442f223 ("drm/stm: Fix bus_flags handling") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/gpu/drm/stm/ltdc.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/gpu/drm/stm/ltdc.c b/drivers/gpu/drm/stm/ltdc.c index dbdee954692a..d6124aa873e5 100644 --- a/drivers/gpu/drm/stm/ltdc.c +++ b/drivers/gpu/drm/stm/ltdc.c @@ -528,8 +528,8 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) struct drm_device *ddev = crtc->dev; struct drm_connector_list_iter iter; struct drm_connector *connector = NULL; - struct drm_encoder *encoder = NULL; - struct drm_bridge *bridge = NULL; + struct drm_encoder *encoder = NULL, *en_iter; + struct drm_bridge *bridge = NULL, *br_iter; struct drm_display_mode *mode = &crtc->state->adjusted_mode; u32 hsync, vsync, accum_hbp, accum_vbp, accum_act_w, accum_act_h; u32 total_width, total_height; @@ -538,15 +538,19 @@ static void ltdc_crtc_mode_set_nofb(struct drm_crtc *crtc) int ret; /* get encoder from crtc */ - drm_for_each_encoder(encoder, ddev) - if (encoder->crtc == crtc) + drm_for_each_encoder(en_iter, ddev) + if (en_iter->crtc == crtc) { + encoder = en_iter; break; + } if (encoder) { /* get bridge from encoder */ - list_for_each_entry(bridge, &encoder->bridge_chain, chain_node) - if (bridge->encoder == encoder) + list_for_each_entry(br_iter, &encoder->bridge_chain, chain_node) + if (br_iter->encoder == encoder) { + bridge = br_iter; break; + } /* Get the connector from encoder */ drm_connector_list_iter_begin(ddev, &iter); -- 2.17.1

2 years, 11 months

3
2
0 0

[PATCH] i40e: i40e_main: fix a missing check on list iterator

by Xiaomeng Tong

The bug is here: ret = i40e_add_macvlan_filter(hw, ch->seid, vdev->dev_addr, &aq_err); The list iterator 'ch' will point to a bogus position containing HEAD if the list is empty or no element is found. This case must be checked before any use of the iterator, otherwise it will lead to a invalid memory access. To fix this bug, use a new variable 'iter' as the list iterator, while use the origin variable 'ch' as a dedicated pointer to point to the found element. Cc: stable(a)vger.kernel.org Fixes: 1d8d80b4e4ff6 ("i40e: Add macvlan support on i40e") Signed-off-by: Xiaomeng Tong <xiam0nd.tong(a)gmail.com> --- drivers/net/ethernet/intel/i40e/i40e_main.c | 27 +++++++++++---------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c index 31b03fe78d3b..6224c98d275f 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c @@ -7536,41 +7536,42 @@ static int i40e_fwd_ring_up(struct i40e_vsi *vsi, struct net_device *vdev, struct i40e_fwd_adapter *fwd) { int ret = 0, num_tc = 1, i, aq_err; - struct i40e_channel *ch, *ch_tmp; + struct i40e_channel *ch = NULL, *ch_tmp, *iter; struct i40e_pf *pf = vsi->back; struct i40e_hw *hw = &pf->hw; - if (list_empty(&vsi->macvlan_list)) - return -EINVAL; - /* Go through the list and find an available channel */ - list_for_each_entry_safe(ch, ch_tmp, &vsi->macvlan_list, list) { - if (!i40e_is_channel_macvlan(ch)) { - ch->fwd = fwd; + list_for_each_entry_safe(iter, ch_tmp, &vsi->macvlan_list, list) { + if (!i40e_is_channel_macvlan(iter)) { + iter->fwd = fwd; /* record configuration for macvlan interface in vdev */ for (i = 0; i < num_tc; i++) netdev_bind_sb_channel_queue(vsi->netdev, vdev, i, - ch->num_queue_pairs, - ch->base_queue); - for (i = 0; i < ch->num_queue_pairs; i++) { + iter->num_queue_pairs, + iter->base_queue); + for (i = 0; i < iter->num_queue_pairs; i++) { struct i40e_ring *tx_ring, *rx_ring; u16 pf_q; - pf_q = ch->base_queue + i; + pf_q = iter->base_queue + i; /* Get to TX ring ptr */ tx_ring = vsi->tx_rings[pf_q]; - tx_ring->ch = ch; + tx_ring->ch = iter; /* Get the RX ring ptr */ rx_ring = vsi->rx_rings[pf_q]; - rx_ring->ch = ch; + rx_ring->ch = iter; } + ch = iter; break; } } + if (!ch) + return -EINVAL; + /* Guarantee all rings are updated before we update the * MAC address filter. */ -- 2.17.1

2 years, 11 months

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror March 2022