From: Stefan Hajnoczi <stefanha(a)redhat.com>
[ Upstream commit b8e0792449928943c15d1af9f63816911d139267 ]
Commit 4e0400525691 ("virtio-blk: support polling I/O") triggers the
following gcc 13 W=1 warnings:
drivers/block/virtio_blk.c: In function ‘init_vq’:
drivers/block/virtio_blk.c:1077:68: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 7 [-Wformat-truncation=]
1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
| ^~
drivers/block/virtio_blk.c:1077:58: note: directive argument in the range [-2147483648, 65534]
1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
| ^~~~~~~~~~~~~
drivers/block/virtio_blk.c:1077:17: note: ‘snprintf’ output between 11 and 21 bytes into a destination of size 16
1077 | snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This is a false positive because the lower bound -2147483648 is
incorrect. The true range of i is [0, num_vqs - 1] where 0 < num_vqs <
65536.
The code mixes int, unsigned short, and unsigned int types in addition
to using "%d" for an unsigned value. Use unsigned short and "%u"
consistently to solve the compiler warning.
Cc: Suwan Kim <suwan.kim027(a)gmail.com>
Reported-by: kernel test robot <lkp(a)intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202312041509.DIyvEt9h-lkp@intel.com/
Signed-off-by: Stefan Hajnoczi <stefanha(a)redhat.com>
Message-Id: <20231204140743.1487843-1-stefanha(a)redhat.com>
Signed-off-by: Michael S. Tsirkin <mst(a)redhat.com>
Signed-off-by: Sasha Levin <sashal(a)kernel.org>
---
drivers/block/virtio_blk.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 4a4b9bad551e8..225c86c74d4e9 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -1021,12 +1021,12 @@ static void virtblk_config_changed(struct virtio_device *vdev)
static int init_vq(struct virtio_blk *vblk)
{
int err;
- int i;
+ unsigned short i;
vq_callback_t **callbacks;
const char **names;
struct virtqueue **vqs;
unsigned short num_vqs;
- unsigned int num_poll_vqs;
+ unsigned short num_poll_vqs;
struct virtio_device *vdev = vblk->vdev;
struct irq_affinity desc = { 0, };
@@ -1070,13 +1070,13 @@ static int init_vq(struct virtio_blk *vblk)
for (i = 0; i < num_vqs - num_poll_vqs; i++) {
callbacks[i] = virtblk_done;
- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%d", i);
+ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req.%u", i);
names[i] = vblk->vqs[i].name;
}
for (; i < num_vqs; i++) {
callbacks[i] = NULL;
- snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%d", i);
+ snprintf(vblk->vqs[i].name, VQ_NAME_LEN, "req_poll.%u", i);
names[i] = vblk->vqs[i].name;
}
--
2.43.0
This is the start of the stable review cycle for the 5.4.266 release.
There are 45 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 08 Jan 2024 08:39:59 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.266-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.266-rc2
Sarthak Kukreti <sarthakkukreti(a)chromium.org>
block: Don't invalidate pagecache for invalid falloc modes
Steven Rostedt (Google) <rostedt(a)goodmis.org>
ring-buffer: Fix wake ups when buffer_percent is set to 100
Paulo Alcantara <pc(a)manguebit.com>
smb: client: fix OOB in smbCalcSize()
Dan Carpenter <dan.carpenter(a)linaro.org>
usb: fotg210-hcd: delete an incorrect bounds test
Thomas Gleixner <tglx(a)linutronix.de>
x86/alternatives: Sync core before enabling interrupts
Rouven Czerwinski <r.czerwinski(a)pengutronix.de>
net: rfkill: gpio: set GPIO direction
Fedor Pchelkin <pchelkin(a)ispras.ru>
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
Reinhard Speyerer <rspmn(a)arcor.de>
USB: serial: option: add Quectel RM500Q R13 firmware support
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add Foxconn T99W265 with new baseline
Alper Ak <alperyasinak1(a)gmail.com>
USB: serial: option: add Quectel EG912Y module support
Mark Glover <mark.glover(a)actisense.com>
USB: serial: ftdi_sio: update Actisense PIDs constant names
Johannes Berg <johannes.berg(a)intel.com>
wifi: cfg80211: fix certs build to not depend on file order
Chen-Yu Tsai <wens(a)kernel.org>
wifi: cfg80211: Add my certificate
Wadim Egorov <w.egorov(a)phytec.de>
iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
Wei Yongjun <weiyongjun1(a)huawei.com>
scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
Haoran Liu <liuhaoran14(a)163.com>
Input: ipaq-micro-keys - add error handling for devm_kmemdup
Su Hui <suhui(a)nfschina.com>
iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
Mike Tipton <quic_mdtipton(a)quicinc.com>
interconnect: Treat xlate() returning NULL node as an error
Josef Bacik <josef(a)toxicpanda.com>
btrfs: do not allow non subvolume root targets for snapshot
Paulo Alcantara <pc(a)manguebit.com>
smb: client: fix NULL deref in asn1_ber_decoder()
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
Kai Vehmanen <kai.vehmanen(a)linux.intel.com>
ALSA: hda/hdmi: Add quirk to force pin connectivity on NUC10
Alexis Lothoré <alexis.lothore(a)bootlin.com>
pinctrl: at91-pio4: use dedicated lock class for IRQ
Quan Nguyen <quan(a)os.amperecomputing.com>
i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
David Howells <dhowells(a)redhat.com>
afs: Fix overwriting of result of DNS query
Eric Dumazet <edumazet(a)google.com>
net: check dev->gso_max_size in gso_features_check()
Heiner Kallweit <hkallweit1(a)gmail.com>
net: warn if gso_type isn't set for a GSO SKB
David Howells <dhowells(a)redhat.com>
afs: Fix dynamic root lookup DNS check
David Howells <dhowells(a)redhat.com>
afs: Fix the dynamic root's d_delete to always delete unused dentries
Liu Jian <liujian56(a)huawei.com>
net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
Eric Dumazet <edumazet(a)google.com>
net/rose: fix races in rose_kill_by_device()
Zhipeng Lu <alexious(a)zju.edu.cn>
ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
Eric Dumazet <edumazet(a)google.com>
net: sched: ife: fix potential use-after-free
Rahul Rameshbabu <rrameshbabu(a)nvidia.com>
net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: Fix fw tracer first block check
Hu Haowen <xianfengting221(a)163.com>
net/mlx5: improve some comments
Vlad Buslov <vladbu(a)nvidia.com>
Revert "net/mlx5e: fix double free of encap_header"
Johannes Berg <johannes.berg(a)intel.com>
wifi: mac80211: mesh_plink: fix matches_local logic
Heiko Carstens <hca(a)linux.ibm.com>
s390/vx: fix save/restore of fpu kernel context
Geert Uytterhoeven <geert+renesas(a)glider.be>
reset: Fix crash when freeing non-existent optional resets
Kunwu Chan <chentao(a)kylinos.cn>
ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
Bin Li <bin.li(a)canonical.com>
ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-omap2/id.c | 5 ++
arch/s390/include/asm/fpu/api.h | 2 +-
arch/x86/kernel/alternative.c | 2 +-
drivers/i2c/busses/i2c-aspeed.c | 48 ++++++++----
drivers/iio/adc/ti_am335x_adc.c | 4 +-
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
drivers/input/keyboard/ipaq-micro-keys.c | 3 +
drivers/interconnect/core.c | 3 +
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 4 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 ++-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +-
drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++
drivers/reset/core.c | 3 +
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +--
drivers/usb/host/fotg210-hcd.c | 3 -
drivers/usb/serial/ftdi_sio.c | 6 +-
drivers/usb/serial/ftdi_sio_ids.h | 6 +-
drivers/usb/serial/option.c | 5 ++
fs/afs/cell.c | 6 +-
fs/afs/dynroot.c | 31 ++++----
fs/block_dev.c | 9 ++-
fs/btrfs/ioctl.c | 9 +++
fs/cifs/misc.c | 4 +
fs/cifs/smb2misc.c | 26 +++----
fs/cifs/smb2pdu.h | 2 +-
kernel/trace/ring_buffer.c | 9 ++-
net/8021q/vlan_core.c | 9 ++-
net/9p/protocol.c | 17 ++++-
net/bluetooth/hci_event.c | 3 +-
net/core/dev.c | 8 ++
net/ife/ife.c | 1 +
net/mac80211/mesh_plink.c | 10 +--
net/rfkill/rfkill-gpio.c | 8 ++
net/rose/af_rose.c | 39 ++++++++--
net/wireless/certs/wens.hex | 87 ++++++++++++++++++++++
sound/pci/hda/patch_hdmi.c | 2 +
sound/pci/hda/patch_realtek.c | 1 +
40 files changed, 320 insertions(+), 101 deletions(-)
This is the start of the stable review cycle for the 4.19.304 release.
There are 41 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sun, 07 Jan 2024 14:38:02 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.304-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.19.304-rc1
Sarthak Kukreti <sarthakkukreti(a)chromium.org>
block: Don't invalidate pagecache for invalid falloc modes
Mikulas Patocka <mpatocka(a)redhat.com>
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
Paulo Alcantara <pc(a)manguebit.com>
smb: client: fix OOB in smbCalcSize()
Dan Carpenter <dan.carpenter(a)linaro.org>
usb: fotg210-hcd: delete an incorrect bounds test
Thomas Petazzoni <thomas.petazzoni(a)bootlin.com>
usb: musb: fix MUSB_QUIRK_B_DISCONNECT_99 handling
Thomas Gleixner <tglx(a)linutronix.de>
x86/alternatives: Sync core before enabling interrupts
Rouven Czerwinski <r.czerwinski(a)pengutronix.de>
net: rfkill: gpio: set GPIO direction
Fedor Pchelkin <pchelkin(a)ispras.ru>
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
Reinhard Speyerer <rspmn(a)arcor.de>
USB: serial: option: add Quectel RM500Q R13 firmware support
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add Foxconn T99W265 with new baseline
Alper Ak <alperyasinak1(a)gmail.com>
USB: serial: option: add Quectel EG912Y module support
Mark Glover <mark.glover(a)actisense.com>
USB: serial: ftdi_sio: update Actisense PIDs constant names
Johannes Berg <johannes.berg(a)intel.com>
wifi: cfg80211: fix certs build to not depend on file order
Chen-Yu Tsai <wens(a)kernel.org>
wifi: cfg80211: Add my certificate
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
Wei Yongjun <weiyongjun1(a)huawei.com>
scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
YueHaibing <yuehaibing(a)huawei.com>
scsi: bnx2fc: Remove set but not used variable 'oxid'
Haoran Liu <liuhaoran14(a)163.com>
Input: ipaq-micro-keys - add error handling for devm_kmemdup
Su Hui <suhui(a)nfschina.com>
iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
Josef Bacik <josef(a)toxicpanda.com>
btrfs: do not allow non subvolume root targets for snapshot
Paulo Alcantara <pc(a)manguebit.com>
smb: client: fix NULL deref in asn1_ber_decoder()
Alexis Lothoré <alexis.lothore(a)bootlin.com>
pinctrl: at91-pio4: use dedicated lock class for IRQ
Eric Dumazet <edumazet(a)google.com>
net: check dev->gso_max_size in gso_features_check()
Heiner Kallweit <hkallweit1(a)gmail.com>
net: warn if gso_type isn't set for a GSO SKB
David Howells <dhowells(a)redhat.com>
afs: Fix the dynamic root's d_delete to always delete unused dentries
Liu Jian <liujian56(a)huawei.com>
net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
Eric Dumazet <edumazet(a)google.com>
net/rose: fix races in rose_kill_by_device()
Zhipeng Lu <alexious(a)zju.edu.cn>
ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
Eric Dumazet <edumazet(a)google.com>
net: sched: ife: fix potential use-after-free
Moshe Shemesh <moshe(a)nvidia.com>
net/mlx5: Fix fw tracer first block check
Hu Haowen <xianfengting221(a)163.com>
net/mlx5: improve some comments
Johannes Berg <johannes.berg(a)intel.com>
wifi: mac80211: mesh_plink: fix matches_local logic
Heiko Carstens <hca(a)linux.ibm.com>
s390/vx: fix save/restore of fpu kernel context
Geert Uytterhoeven <geert+renesas(a)glider.be>
reset: Fix crash when freeing non-existent optional resets
Kunwu Chan <chentao(a)kylinos.cn>
ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
Namjae Jeon <linkinjeon(a)kernel.org>
ksmbd: fix wrong name of SMB2_CREATE_ALLOCATION_SIZE
Bin Li <bin.li(a)canonical.com>
ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
Bin Li <bin.li(a)canonical.com>
ALSA: hda/realtek: Enable headset onLenovo M70/M90
Edward Pacman <edward(a)edward-p.xyz>
ALSA: hda/realtek: Add quirk for Lenovo TianYi510Pro-14IOB
AngeloGioacchino Del Regno <angelogioacchino.delregno(a)collabora.com>
arm64: dts: mediatek: mt8173-evb: Fix regulator-fixed node names
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-omap2/id.c | 5 ++
arch/arm64/boot/dts/mediatek/mt8173-evb.dts | 4 +-
arch/s390/include/asm/fpu/api.h | 2 +-
arch/x86/kernel/alternative.c | 2 +-
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
drivers/input/keyboard/ipaq-micro-keys.c | 3 +
drivers/md/dm-integrity.c | 11 +--
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 4 +-
drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++
drivers/reset/core.c | 3 +
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 12 +--
drivers/usb/host/fotg210-hcd.c | 3 -
drivers/usb/musb/musb_core.c | 3 +-
drivers/usb/serial/ftdi_sio.c | 6 +-
drivers/usb/serial/ftdi_sio_ids.h | 6 +-
drivers/usb/serial/option.c | 5 ++
fs/afs/dynroot.c | 13 +---
fs/block_dev.c | 9 ++-
fs/btrfs/ioctl.c | 9 +++
fs/cifs/misc.c | 4 +
fs/cifs/smb2misc.c | 26 +++----
fs/cifs/smb2pdu.h | 2 +-
net/8021q/vlan_core.c | 9 ++-
net/9p/protocol.c | 17 ++++-
net/bluetooth/hci_event.c | 3 +-
net/core/dev.c | 8 ++
net/ife/ife.c | 1 +
net/mac80211/mesh_plink.c | 10 +--
net/rfkill/rfkill-gpio.c | 8 ++
net/rose/af_rose.c | 41 ++++++++--
net/wireless/certs/wens.hex | 87 ++++++++++++++++++++++
sound/pci/hda/patch_realtek.c | 30 ++++++++
35 files changed, 285 insertions(+), 86 deletions(-)
This is the start of the stable review cycle for the 4.14.335 release.
There are 19 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 09 Jan 2024 12:38:13 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.335-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.335-rc3
Sarthak Kukreti <sarthakkukreti(a)chromium.org>
block: Don't invalidate pagecache for invalid falloc modes
Mikulas Patocka <mpatocka(a)redhat.com>
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
Rouven Czerwinski <r.czerwinski(a)pengutronix.de>
net: rfkill: gpio: set GPIO direction
Fedor Pchelkin <pchelkin(a)ispras.ru>
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
Reinhard Speyerer <rspmn(a)arcor.de>
USB: serial: option: add Quectel RM500Q R13 firmware support
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add Foxconn T99W265 with new baseline
Alper Ak <alperyasinak1(a)gmail.com>
USB: serial: option: add Quectel EG912Y module support
Mark Glover <mark.glover(a)actisense.com>
USB: serial: ftdi_sio: update Actisense PIDs constant names
Johannes Berg <johannes.berg(a)intel.com>
wifi: cfg80211: fix certs build to not depend on file order
Chen-Yu Tsai <wens(a)kernel.org>
wifi: cfg80211: Add my certificate
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
Haoran Liu <liuhaoran14(a)163.com>
Input: ipaq-micro-keys - add error handling for devm_kmemdup
Su Hui <suhui(a)nfschina.com>
iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
Zhipeng Lu <alexious(a)zju.edu.cn>
ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
Eric Dumazet <edumazet(a)google.com>
net: sched: ife: fix potential use-after-free
Johannes Berg <johannes.berg(a)intel.com>
wifi: mac80211: mesh_plink: fix matches_local logic
Heiko Carstens <hca(a)linux.ibm.com>
s390/vx: fix save/restore of fpu kernel context
Kunwu Chan <chentao(a)kylinos.cn>
ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-omap2/id.c | 5 ++
arch/s390/include/asm/fpu/api.h | 2 +-
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
drivers/input/keyboard/ipaq-micro-keys.c | 3 +
drivers/md/dm-integrity.c | 11 ++--
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
drivers/usb/serial/ftdi_sio.c | 6 +-
drivers/usb/serial/ftdi_sio_ids.h | 6 +-
drivers/usb/serial/option.c | 5 ++
fs/block_dev.c | 9 ++-
net/9p/protocol.c | 17 +++--
net/bluetooth/hci_event.c | 3 +-
net/ife/ife.c | 1 +
net/mac80211/mesh_plink.c | 10 +--
net/rfkill/rfkill-gpio.c | 8 +++
net/wireless/certs/wens.hex | 87 +++++++++++++++++++++++++
18 files changed, 159 insertions(+), 31 deletions(-)
Hello Murray,
thanks for looking into this!
> > > On Thu, 2023-09-28 at 00:13 -0400, Zack Rusin wrote:
> > > > From: Zack Rusin <zackr(a)vmware.com>
> > > >
> > > > Surfaces can be backed (i.e. stored in) memory objects (mob's) which
> > > > are created and managed by the userspace as GEM buffers. Surfaces
> > > > grab only a ttm reference which means that the gem object can
> > > > be deleted underneath us, especially in cases where prime buffer
> > > > export is used.
> > > >
> > > > Make sure that all userspace surfaces which are backed by gem objects
> > > > hold a gem reference to make sure they're not deleted before vmw
> > > > surfaces are done with them, which fixes:
> > > > ------------[ cut here ]------------
> > > > refcount_t: underflow; use-after-free.
> > > > WARNING: CPU: 2 PID: 2632 at lib/refcount.c:28 refcount_warn_saturate+0xfb/0x150
[]
> > > > ---[ end trace 0000000000000000 ]---
> > > >
> > > > A lot of the analyis on the bug was done by Murray McAllister and
> > > > Ian Forbes.
> > > >
> > > > Reported-by: Murray McAllister <murray.mcallister(a)gmail.com>
> > > > Cc: Ian Forbes <iforbes(a)vmware.com>
> > > > Signed-off-by: Zack Rusin <zackr(a)vmware.com>
> > > > Fixes: a950b989ea29 ("drm/vmwgfx: Do not drop the reference to the handle too soon")
> > > > Cc: <stable(a)vger.kernel.org> # v6.2+
> > >
> > > Do you remember the particular reason this was marked 6.2+?
> >
> > That's because that's the kernel release where the commit this one is
> > fixing first landed.
> >
> > > We see this on Debian 6.1.67 (which at least has the mentioned
> > > "drm/vmwgfx: Do not drop the reference to the handle too soon"):
> >
> > The original had to be backported there. I'll ask someone on my team
> > to check the branches the original was backported to see if this
> > change even applies on those and then we'll see what we can do. In the
> > meantime if you know anyone on the Debian kernel team suggesting this
> > as a cherry-pick might also be a good idea.
> >
> > z
>
> Hi Alexander,
>
> I think the backport might already be on Debian's radar for your version:
>
> https://security-tracker.debian.org/tracker/CVE-2023-5633
Sorry, my reference to Debian was irrelevant, the patch-to-be-fixed
is actually in the upstream kernel:
$ git log --grep "drm/vmwgfx: Do not drop the reference to the handle too soon" v6.1.67
commit 0a127ac972404600c99eb141c8d5b5348e53ee4f
Author: Zack Rusin <zackr(a)vmware.com>
Date: Sat Feb 11 00:05:14 2023 -0500
drm/vmwgfx: Do not drop the reference to the handle too soon
commit a950b989ea29ab3b38ea7f6e3d2540700a3c54e8 upstream.
So it was merely a hint for Stable Team to pick the Subject path into v6.1.x.
--
Alexander Sverdlin
Siemens AG
www.siemens.com
This is the start of the stable review cycle for the 4.14.335 release.
There are 20 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 08 Jan 2024 08:40:01 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.335-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.335-rc2
Sarthak Kukreti <sarthakkukreti(a)chromium.org>
block: Don't invalidate pagecache for invalid falloc modes
Mikulas Patocka <mpatocka(a)redhat.com>
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
Rouven Czerwinski <r.czerwinski(a)pengutronix.de>
net: rfkill: gpio: set GPIO direction
Fedor Pchelkin <pchelkin(a)ispras.ru>
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com>
Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
Reinhard Speyerer <rspmn(a)arcor.de>
USB: serial: option: add Quectel RM500Q R13 firmware support
Slark Xiao <slark_xiao(a)163.com>
USB: serial: option: add Foxconn T99W265 with new baseline
Alper Ak <alperyasinak1(a)gmail.com>
USB: serial: option: add Quectel EG912Y module support
Mark Glover <mark.glover(a)actisense.com>
USB: serial: ftdi_sio: update Actisense PIDs constant names
Johannes Berg <johannes.berg(a)intel.com>
wifi: cfg80211: fix certs build to not depend on file order
Chen-Yu Tsai <wens(a)kernel.org>
wifi: cfg80211: Add my certificate
Javier Carrasco <javier.carrasco.cruz(a)gmail.com>
iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
Haoran Liu <liuhaoran14(a)163.com>
Input: ipaq-micro-keys - add error handling for devm_kmemdup
Su Hui <suhui(a)nfschina.com>
iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
Liu Jian <liujian56(a)huawei.com>
net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
Zhipeng Lu <alexious(a)zju.edu.cn>
ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
Eric Dumazet <edumazet(a)google.com>
net: sched: ife: fix potential use-after-free
Johannes Berg <johannes.berg(a)intel.com>
wifi: mac80211: mesh_plink: fix matches_local logic
Heiko Carstens <hca(a)linux.ibm.com>
s390/vx: fix save/restore of fpu kernel context
Kunwu Chan <chentao(a)kylinos.cn>
ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
-------------
Diffstat:
Makefile | 4 +-
arch/arm/mach-omap2/id.c | 5 ++
arch/s390/include/asm/fpu/api.h | 2 +-
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
drivers/input/keyboard/ipaq-micro-keys.c | 3 +
drivers/md/dm-integrity.c | 11 ++--
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
drivers/usb/serial/ftdi_sio.c | 6 +-
drivers/usb/serial/ftdi_sio_ids.h | 6 +-
drivers/usb/serial/option.c | 5 ++
fs/block_dev.c | 9 ++-
net/8021q/vlan_core.c | 9 ++-
net/9p/protocol.c | 17 +++--
net/bluetooth/hci_event.c | 3 +-
net/ife/ife.c | 1 +
net/mac80211/mesh_plink.c | 10 +--
net/rfkill/rfkill-gpio.c | 8 +++
net/wireless/certs/wens.hex | 87 +++++++++++++++++++++++++
19 files changed, 167 insertions(+), 32 deletions(-)