The patch below does not apply to the 5.15-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.15.y
git checkout FETCH_HEAD
git cherry-pick -x 8492bd91aa055907c67ef04f2b56f6dadd1f44bf
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052506-afternoon-exponent-b101@gregkh' --subject-prefix 'PATCH 5.15.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8492bd91aa055907c67ef04f2b56f6dadd1f44bf Mon Sep 17 00:00:00 2001
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Date: Tue, 30 Apr 2024 16:04:30 -0400
Subject: [PATCH] serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
prescaler
When using a high speed clock with a low baud rate, the 4x prescaler is
automatically selected if required. In that case, sc16is7xx_set_baud()
properly configures the chip registers, but returns an incorrect baud
rate by not taking into account the prescaler value. This incorrect baud
rate is then fed to uart_update_timeout().
For example, with an input clock of 80MHz, and a selected baud rate of 50,
sc16is7xx_set_baud() will return 200 instead of 50.
Fix this by first changing the prescaler variable to hold the selected
prescaler value instead of the MCR bitfield. Then properly take into
account the selected prescaler value in the return value computation.
Also add better documentation about the divisor value computation.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org>
Link: https://lore.kernel.org/r/20240430200431.4102923-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 929206a9a6e1..12915fffac27 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -554,16 +554,28 @@ static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg)
return reg == SC16IS7XX_RHR_REG;
}
+/*
+ * Configure programmable baud rate generator (divisor) according to the
+ * desired baud rate.
+ *
+ * From the datasheet, the divisor is computed according to:
+ *
+ * XTAL1 input frequency
+ * -----------------------
+ * prescaler
+ * divisor = ---------------------------
+ * baud-rate x sampling-rate
+ */
static int sc16is7xx_set_baud(struct uart_port *port, int baud)
{
struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
u8 lcr;
- u8 prescaler = 0;
+ unsigned int prescaler = 1;
unsigned long clk = port->uartclk, div = clk / 16 / baud;
if (div >= BIT(16)) {
- prescaler = SC16IS7XX_MCR_CLKSEL_BIT;
- div /= 4;
+ prescaler = 4;
+ div /= prescaler;
}
/* Enable enhanced features */
@@ -573,9 +585,10 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
SC16IS7XX_EFR_ENABLE_BIT);
sc16is7xx_efr_unlock(port);
+ /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
SC16IS7XX_MCR_CLKSEL_BIT,
- prescaler);
+ prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT);
/* Backup LCR and access special register set (DLL/DLH) */
lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
@@ -591,7 +604,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
/* Restore LCR and access to general register set */
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
- return DIV_ROUND_CLOSEST(clk / 16, div);
+ return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div);
}
static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
The patch below does not apply to the 6.1-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.1.y
git checkout FETCH_HEAD
git cherry-pick -x 8492bd91aa055907c67ef04f2b56f6dadd1f44bf
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052505-conceded-backstage-2637@gregkh' --subject-prefix 'PATCH 6.1.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8492bd91aa055907c67ef04f2b56f6dadd1f44bf Mon Sep 17 00:00:00 2001
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Date: Tue, 30 Apr 2024 16:04:30 -0400
Subject: [PATCH] serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
prescaler
When using a high speed clock with a low baud rate, the 4x prescaler is
automatically selected if required. In that case, sc16is7xx_set_baud()
properly configures the chip registers, but returns an incorrect baud
rate by not taking into account the prescaler value. This incorrect baud
rate is then fed to uart_update_timeout().
For example, with an input clock of 80MHz, and a selected baud rate of 50,
sc16is7xx_set_baud() will return 200 instead of 50.
Fix this by first changing the prescaler variable to hold the selected
prescaler value instead of the MCR bitfield. Then properly take into
account the selected prescaler value in the return value computation.
Also add better documentation about the divisor value computation.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org>
Link: https://lore.kernel.org/r/20240430200431.4102923-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 929206a9a6e1..12915fffac27 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -554,16 +554,28 @@ static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg)
return reg == SC16IS7XX_RHR_REG;
}
+/*
+ * Configure programmable baud rate generator (divisor) according to the
+ * desired baud rate.
+ *
+ * From the datasheet, the divisor is computed according to:
+ *
+ * XTAL1 input frequency
+ * -----------------------
+ * prescaler
+ * divisor = ---------------------------
+ * baud-rate x sampling-rate
+ */
static int sc16is7xx_set_baud(struct uart_port *port, int baud)
{
struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
u8 lcr;
- u8 prescaler = 0;
+ unsigned int prescaler = 1;
unsigned long clk = port->uartclk, div = clk / 16 / baud;
if (div >= BIT(16)) {
- prescaler = SC16IS7XX_MCR_CLKSEL_BIT;
- div /= 4;
+ prescaler = 4;
+ div /= prescaler;
}
/* Enable enhanced features */
@@ -573,9 +585,10 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
SC16IS7XX_EFR_ENABLE_BIT);
sc16is7xx_efr_unlock(port);
+ /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
SC16IS7XX_MCR_CLKSEL_BIT,
- prescaler);
+ prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT);
/* Backup LCR and access special register set (DLL/DLH) */
lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
@@ -591,7 +604,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
/* Restore LCR and access to general register set */
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
- return DIV_ROUND_CLOSEST(clk / 16, div);
+ return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div);
}
static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
The patch below does not apply to the 6.6-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.6.y
git checkout FETCH_HEAD
git cherry-pick -x 8492bd91aa055907c67ef04f2b56f6dadd1f44bf
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052504-hungrily-verdict-1471@gregkh' --subject-prefix 'PATCH 6.6.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 8492bd91aa055907c67ef04f2b56f6dadd1f44bf Mon Sep 17 00:00:00 2001
From: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Date: Tue, 30 Apr 2024 16:04:30 -0400
Subject: [PATCH] serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using
prescaler
When using a high speed clock with a low baud rate, the 4x prescaler is
automatically selected if required. In that case, sc16is7xx_set_baud()
properly configures the chip registers, but returns an incorrect baud
rate by not taking into account the prescaler value. This incorrect baud
rate is then fed to uart_update_timeout().
For example, with an input clock of 80MHz, and a selected baud rate of 50,
sc16is7xx_set_baud() will return 200 instead of 50.
Fix this by first changing the prescaler variable to hold the selected
prescaler value instead of the MCR bitfield. Then properly take into
account the selected prescaler value in the return value computation.
Also add better documentation about the divisor value computation.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable(a)vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve(a)dimonoff.com>
Reviewed-by: Jiri Slaby <jirislaby(a)kernel.org>
Link: https://lore.kernel.org/r/20240430200431.4102923-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
index 929206a9a6e1..12915fffac27 100644
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -554,16 +554,28 @@ static bool sc16is7xx_regmap_noinc(struct device *dev, unsigned int reg)
return reg == SC16IS7XX_RHR_REG;
}
+/*
+ * Configure programmable baud rate generator (divisor) according to the
+ * desired baud rate.
+ *
+ * From the datasheet, the divisor is computed according to:
+ *
+ * XTAL1 input frequency
+ * -----------------------
+ * prescaler
+ * divisor = ---------------------------
+ * baud-rate x sampling-rate
+ */
static int sc16is7xx_set_baud(struct uart_port *port, int baud)
{
struct sc16is7xx_one *one = to_sc16is7xx_one(port, port);
u8 lcr;
- u8 prescaler = 0;
+ unsigned int prescaler = 1;
unsigned long clk = port->uartclk, div = clk / 16 / baud;
if (div >= BIT(16)) {
- prescaler = SC16IS7XX_MCR_CLKSEL_BIT;
- div /= 4;
+ prescaler = 4;
+ div /= prescaler;
}
/* Enable enhanced features */
@@ -573,9 +585,10 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
SC16IS7XX_EFR_ENABLE_BIT);
sc16is7xx_efr_unlock(port);
+ /* If bit MCR_CLKSEL is set, the divide by 4 prescaler is activated. */
sc16is7xx_port_update(port, SC16IS7XX_MCR_REG,
SC16IS7XX_MCR_CLKSEL_BIT,
- prescaler);
+ prescaler == 1 ? 0 : SC16IS7XX_MCR_CLKSEL_BIT);
/* Backup LCR and access special register set (DLL/DLH) */
lcr = sc16is7xx_port_read(port, SC16IS7XX_LCR_REG);
@@ -591,7 +604,7 @@ static int sc16is7xx_set_baud(struct uart_port *port, int baud)
/* Restore LCR and access to general register set */
sc16is7xx_port_write(port, SC16IS7XX_LCR_REG, lcr);
- return DIV_ROUND_CLOSEST(clk / 16, div);
+ return DIV_ROUND_CLOSEST((clk / prescaler) / 16, div);
}
static void sc16is7xx_handle_rx(struct uart_port *port, unsigned int rxlen,
The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-4.19.y
git checkout FETCH_HEAD
git cherry-pick -x 47388e807f85948eefc403a8a5fdc5b406a65d5a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052539-pacific-rejoin-8bca@gregkh' --subject-prefix 'PATCH 4.19.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 47388e807f85948eefc403a8a5fdc5b406a65d5a Mon Sep 17 00:00:00 2001
From: Daniel Starke <daniel.starke(a)siemens.com>
Date: Wed, 24 Apr 2024 07:48:41 +0200
Subject: [PATCH] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after
reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
Reported-by: j51569436(a)gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708
Tested-by: j51569436(a)gmail.com
Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com>
Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 4036566febcb..72b82bf1c280 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2913,7 +2913,10 @@ static void gsm0_receive(struct gsm_mux *gsm, u8 c)
break;
case GSM_DATA: /* Data */
gsm->buf[gsm->count++] = c;
- if (gsm->count == gsm->len) {
+ if (gsm->count >= MAX_MRU) {
+ gsm->bad_size++;
+ gsm->state = GSM_SEARCH;
+ } else if (gsm->count >= gsm->len) {
/* Calculate final FCS for UI frames over all data */
if ((gsm->control & ~PF) != UIH) {
gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf,
@@ -3026,7 +3029,7 @@ static void gsm1_receive(struct gsm_mux *gsm, u8 c)
gsm->state = GSM_DATA;
break;
case GSM_DATA: /* Data */
- if (gsm->count > gsm->mru) { /* Allow one for the FCS */
+ if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */
gsm->state = GSM_OVERRUN;
gsm->bad_size++;
} else
The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.4.y
git checkout FETCH_HEAD
git cherry-pick -x 47388e807f85948eefc403a8a5fdc5b406a65d5a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052538-octagon-unleash-663f@gregkh' --subject-prefix 'PATCH 5.4.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 47388e807f85948eefc403a8a5fdc5b406a65d5a Mon Sep 17 00:00:00 2001
From: Daniel Starke <daniel.starke(a)siemens.com>
Date: Wed, 24 Apr 2024 07:48:41 +0200
Subject: [PATCH] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after
reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
Reported-by: j51569436(a)gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708
Tested-by: j51569436(a)gmail.com
Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com>
Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 4036566febcb..72b82bf1c280 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2913,7 +2913,10 @@ static void gsm0_receive(struct gsm_mux *gsm, u8 c)
break;
case GSM_DATA: /* Data */
gsm->buf[gsm->count++] = c;
- if (gsm->count == gsm->len) {
+ if (gsm->count >= MAX_MRU) {
+ gsm->bad_size++;
+ gsm->state = GSM_SEARCH;
+ } else if (gsm->count >= gsm->len) {
/* Calculate final FCS for UI frames over all data */
if ((gsm->control & ~PF) != UIH) {
gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf,
@@ -3026,7 +3029,7 @@ static void gsm1_receive(struct gsm_mux *gsm, u8 c)
gsm->state = GSM_DATA;
break;
case GSM_DATA: /* Data */
- if (gsm->count > gsm->mru) { /* Allow one for the FCS */
+ if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */
gsm->state = GSM_OVERRUN;
gsm->bad_size++;
} else
The patch below does not apply to the 5.10-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
To reproduce the conflict and resubmit, you may use the following commands:
git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-5.10.y
git checkout FETCH_HEAD
git cherry-pick -x 47388e807f85948eefc403a8a5fdc5b406a65d5a
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable(a)vger.kernel.org>' --in-reply-to '2024052537-payday-enjoyably-a5a8@gregkh' --subject-prefix 'PATCH 5.10.y' HEAD^..
Possible dependencies:
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
From 47388e807f85948eefc403a8a5fdc5b406a65d5a Mon Sep 17 00:00:00 2001
From: Daniel Starke <daniel.starke(a)siemens.com>
Date: Wed, 24 Apr 2024 07:48:41 +0200
Subject: [PATCH] tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after
reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
Reported-by: j51569436(a)gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218708
Tested-by: j51569436(a)gmail.com
Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Cc: stable(a)vger.kernel.org
Signed-off-by: Daniel Starke <daniel.starke(a)siemens.com>
Link: https://lore.kernel.org/r/20240424054842.7741-1-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 4036566febcb..72b82bf1c280 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2913,7 +2913,10 @@ static void gsm0_receive(struct gsm_mux *gsm, u8 c)
break;
case GSM_DATA: /* Data */
gsm->buf[gsm->count++] = c;
- if (gsm->count == gsm->len) {
+ if (gsm->count >= MAX_MRU) {
+ gsm->bad_size++;
+ gsm->state = GSM_SEARCH;
+ } else if (gsm->count >= gsm->len) {
/* Calculate final FCS for UI frames over all data */
if ((gsm->control & ~PF) != UIH) {
gsm->fcs = gsm_fcs_add_block(gsm->fcs, gsm->buf,
@@ -3026,7 +3029,7 @@ static void gsm1_receive(struct gsm_mux *gsm, u8 c)
gsm->state = GSM_DATA;
break;
case GSM_DATA: /* Data */
- if (gsm->count > gsm->mru) { /* Allow one for the FCS */
+ if (gsm->count > gsm->mru || gsm->count > MAX_MRU) { /* Allow one for the FCS */
gsm->state = GSM_OVERRUN;
gsm->bad_size++;
} else
I'm announcing the release of the 6.8.11 kernel.
All users of the 6.8 kernel series must upgrade.
The updated 6.8.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.8.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/stable/sysfs-block | 10 +
Documentation/admin-guide/hw-vuln/core-scheduling.rst | 4
Documentation/admin-guide/mm/damon/usage.rst | 2
Documentation/sphinx/kernel_include.py | 1
Makefile | 2
block/genhd.c | 15 +-
block/partitions/core.c | 5
drivers/android/binder.c | 2
drivers/android/binder_internal.h | 2
drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 7 -
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 22 +--
drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 3
drivers/net/ethernet/micrel/ks8851_common.c | 18 --
drivers/net/usb/ax88179_178a.c | 37 +++--
drivers/remoteproc/mtk_scp.c | 10 +
drivers/tty/serial/kgdboc.c | 30 ++++
drivers/usb/dwc3/gadget.c | 4
drivers/usb/typec/tipd/core.c | 51 +++++--
drivers/usb/typec/tipd/tps6598x.h | 11 +
drivers/usb/typec/ucsi/displayport.c | 4
fs/erofs/internal.h | 7 -
fs/erofs/super.c | 124 +++++++-----------
include/linux/blkdev.h | 13 +
include/net/bluetooth/hci.h | 9 +
include/net/bluetooth/hci_core.h | 1
net/bluetooth/hci_conn.c | 71 +++++++---
net/bluetooth/hci_event.c | 31 ++--
net/bluetooth/iso.c | 2
net/bluetooth/l2cap_core.c | 38 +----
net/bluetooth/sco.c | 6
security/keys/trusted-keys/trusted_tpm2.c | 25 ++-
31 files changed, 338 insertions(+), 229 deletions(-)
Akira Yokosawa (1):
docs: kernel_include.py: Cope with docutils 0.21
AngeloGioacchino Del Regno (1):
remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
Baokun Li (1):
erofs: get rid of erofs_fs_context
Carlos Llamas (1):
binder: fix max_thread type inconsistency
Christian Brauner (1):
erofs: reliably distinguish block based and fscache mode
Christoph Hellwig (2):
block: add a disk_has_partscan helper
block: add a partscan sysfs attribute for disks
Daniel Thompson (1):
serial: kgdboc: Fix NMI-safety problems from keyboard reset code
Greg Kroah-Hartman (1):
Linux 6.8.11
Heikki Krogerus (1):
usb: typec: ucsi: displayport: Fix potential deadlock
Jacob Keller (2):
ice: pass VSI pointer into ice_vc_isvalid_q_id
ice: remove unnecessary duplicate checks for VF VSI ID
Jarkko Sakkinen (2):
KEYS: trusted: Fix memory leak in tpm2_key_encode()
KEYS: trusted: Do not use WARN when encode fails
Javier Carrasco (2):
usb: typec: tipd: fix event checking for tps25750
usb: typec: tipd: fix event checking for tps6598x
Jose Fernandez (1):
drm/amd/display: Fix division by zero in setup_dsc_config
Jose Ignacio Tornos Martinez (1):
net: usb: ax88179_178a: fix link status when link is set to down/up
Prashanth K (1):
usb: dwc3: Wait unconditionally after issuing EndXfer command
Ronald Wahl (1):
net: ks8851: Fix another TX stall caused by wrong ISR flag handling
SeongJae Park (1):
Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file
Sungwoo Kim (2):
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
Thomas Weißschuh (1):
admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
I'm announcing the release of the 6.6.32 kernel.
All users of the 6.6 kernel series must upgrade.
The updated 6.6.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-6.6.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Documentation/ABI/stable/sysfs-block | 10
Documentation/admin-guide/hw-vuln/core-scheduling.rst | 4
Documentation/admin-guide/mm/damon/usage.rst | 2
Documentation/sphinx/kernel_include.py | 1
Makefile | 2
block/genhd.c | 15
block/partitions/core.c | 5
drivers/android/binder.c | 2
drivers/android/binder_internal.h | 2
drivers/gpu/drm/amd/amdgpu/amdgpu_ras.c | 3
drivers/gpu/drm/amd/display/dc/dsc/dc_dsc.c | 7
drivers/mmc/core/mmc.c | 9
drivers/net/ethernet/intel/ice/ice_virtchnl.c | 22
drivers/net/ethernet/intel/ice/ice_virtchnl_fdir.c | 3
drivers/net/ethernet/micrel/ks8851_common.c | 18
drivers/net/usb/ax88179_178a.c | 37
drivers/remoteproc/mtk_scp.c | 10
drivers/tty/serial/kgdboc.c | 30
drivers/usb/dwc3/gadget.c | 4
drivers/usb/typec/tipd/core.c | 45
drivers/usb/typec/tipd/tps6598x.h | 11
drivers/usb/typec/ucsi/displayport.c | 4
fs/erofs/internal.h | 7
fs/erofs/super.c | 124 -
fs/smb/client/Makefile | 2
fs/smb/client/cached_dir.c | 24
fs/smb/client/cifs_debug.c | 38
fs/smb/client/cifsfs.c | 10
fs/smb/client/cifsglob.h | 93 -
fs/smb/client/cifsproto.h | 39
fs/smb/client/cifssmb.c | 18
fs/smb/client/connect.c | 57
fs/smb/client/dir.c | 14
fs/smb/client/file.c | 39
fs/smb/client/fs_context.c | 43
fs/smb/client/fs_context.h | 13
fs/smb/client/fscache.c | 7
fs/smb/client/inode.c | 235 +--
fs/smb/client/ioctl.c | 6
fs/smb/client/link.c | 41
fs/smb/client/misc.c | 47
fs/smb/client/ntlmssp.h | 4
fs/smb/client/readdir.c | 32
fs/smb/client/reparse.c | 532 ++++++
fs/smb/client/reparse.h | 113 +
fs/smb/client/sess.c | 73
fs/smb/client/smb1ops.c | 80 -
fs/smb/client/smb2glob.h | 27
fs/smb/client/smb2inode.c | 1396 +++++++++++-------
fs/smb/client/smb2maperror.c | 2
fs/smb/client/smb2misc.c | 10
fs/smb/client/smb2ops.c | 589 ++-----
fs/smb/client/smb2pdu.c | 336 +++-
fs/smb/client/smb2pdu.h | 46
fs/smb/client/smb2proto.h | 37
fs/smb/client/smb2status.h | 2
fs/smb/client/smb2transport.c | 2
fs/smb/client/smbdirect.c | 4
fs/smb/client/smbencrypt.c | 7
fs/smb/client/trace.h | 137 +
fs/smb/common/smb2pdu.h | 116 -
fs/smb/common/smbfsctl.h | 6
fs/smb/server/auth.c | 14
fs/smb/server/ksmbd_netlink.h | 36
fs/smb/server/mgmt/user_session.c | 28
fs/smb/server/mgmt/user_session.h | 3
fs/smb/server/misc.c | 1
fs/smb/server/oplock.c | 96 +
fs/smb/server/oplock.h | 7
fs/smb/server/smb2misc.c | 26
fs/smb/server/smb2ops.c | 6
fs/smb/server/smb2pdu.c | 338 +++-
fs/smb/server/smb2pdu.h | 31
fs/smb/server/transport_tcp.c | 2
fs/smb/server/vfs.c | 28
fs/smb/server/vfs_cache.c | 137 +
fs/smb/server/vfs_cache.h | 9
include/linux/blkdev.h | 13
include/linux/bpf_types.h | 3
include/net/bluetooth/hci.h | 9
include/net/bluetooth/hci_core.h | 1
net/bluetooth/hci_conn.c | 71
net/bluetooth/hci_event.c | 31
net/bluetooth/iso.c | 2
net/bluetooth/l2cap_core.c | 38
net/bluetooth/sco.c | 6
security/keys/trusted-keys/trusted_tpm2.c | 25
tools/testing/selftests/kselftest.h | 14
88 files changed, 3907 insertions(+), 1722 deletions(-)
Akira Yokosawa (1):
docs: kernel_include.py: Cope with docutils 0.21
Alexey Dobriyan (1):
smb: client: delete "true", "false" defines
AngeloGioacchino Del Regno (1):
remoteproc: mediatek: Make sure IPI buffer fits in L2TCM
Baokun Li (1):
erofs: get rid of erofs_fs_context
Bharath SM (2):
cifs: defer close file handles having RH lease
cifs: remove redundant variable assignment
Carlos Llamas (1):
binder: fix max_thread type inconsistency
Christian Brauner (1):
erofs: reliably distinguish block based and fscache mode
Christoph Hellwig (2):
block: add a disk_has_partscan helper
block: add a partscan sysfs attribute for disks
Colin Ian King (2):
cifs: remove redundant variable tcon_exist
ksmbd: Fix spelling mistake "connction" -> "connection"
Dan Carpenter (1):
smb: client: Fix a NULL vs IS_ERR() check in wsl_set_xattrs()
Daniel Thompson (1):
serial: kgdboc: Fix NMI-safety problems from keyboard reset code
David Howells (2):
cifs: Pass unbyteswapped eof value into SMB2_set_eof()
cifs: Add tracing for the cifs_tcon struct refcounting
Enzo Matsumiya (3):
smb: client: negotiate compression algorithms
smb: common: fix fields sizes in compression_pattern_payload_v1
smb: common: simplify compression headers
Eric Biggers (1):
smb: use crypto_shash_digest() in symlink_hash()
Greg Kroah-Hartman (1):
Linux 6.6.32
Gustavo A. R. Silva (1):
smb: smb2pdu.h: Avoid -Wflex-array-member-not-at-end warnings
Heikki Krogerus (1):
usb: typec: ucsi: displayport: Fix potential deadlock
Jacob Keller (2):
ice: pass VSI pointer into ice_vc_isvalid_q_id
ice: remove unnecessary duplicate checks for VF VSI ID
Jarkko Sakkinen (2):
KEYS: trusted: Fix memory leak in tpm2_key_encode()
KEYS: trusted: Do not use WARN when encode fails
Javier Carrasco (1):
usb: typec: tipd: fix event checking for tps6598x
Jiri Olsa (1):
bpf: Add missing BPF_LINK_TYPE invocations
Jose Fernandez (1):
drm/amd/display: Fix division by zero in setup_dsc_config
Jose Ignacio Tornos Martinez (1):
net: usb: ax88179_178a: fix link status when link is set to down/up
Marios Makassikis (1):
ksmbd: fix possible null-deref in smb_lazy_parent_lease_break_close
Mark Brown (1):
kselftest: Add a ksft_perror() helper
Markus Elfring (1):
smb3: Improve exception handling in allocate_mr_list()
Meetakshi Setiya (4):
cifs: Add client version details to NTLM authenticate message
smb: client: reuse file lease key in compound operations
smb: client: retry compound request without reusing lease
cifs: fixes for get_inode_info
Mengqi Zhang (1):
mmc: core: Add HS400 tuning in HS400es initialization
Namjae Jeon (5):
ksmbd: mark SMB2_SESSION_EXPIRED to session when destroying previous session
ksmbd: add support for durable handles v1/v2
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
ksmbd: fix potencial out-of-bounds when buffer offset is invalid
ksmbd: add continuous availability share parameter
Paulo Alcantara (17):
smb: client: allow creating symlinks via reparse points
smb: client: cleanup smb2_query_reparse_point()
smb: client: handle special files and symlinks in SMB3 POSIX
cifs: get rid of dup length check in parse_reparse_point()
smb: client: don't clobber ->i_rdev from cached reparse points
smb: client: handle path separator of created SMB symlinks
smb: client: get rid of smb311_posix_query_path_info()
smb: client: introduce reparse mount option
smb: client: move most of reparse point handling code to common file
smb: client: fix potential broken compound request
smb: client: reduce number of parameters in smb2_compound_op()
smb: client: add support for WSL reparse points
smb: client: parse uid, gid, mode and dev from WSL reparse points
smb: client: set correct d_type for reparse DFS/DFSR and mount point
smb: client: return reparse type in /proc/mounts
smb: client: fix NULL ptr deref in cifs_mark_open_handles_for_deleted_file()
smb: client: instantiate when creating SFU files
Pierre Mariani (1):
smb: client: Fix minor whitespace errors and warnings
Prashanth K (1):
usb: dwc3: Wait unconditionally after issuing EndXfer command
Randy Dunlap (2):
ksmbd: auth: fix most kernel-doc warnings
ksmbd: vfs: fix all kernel-doc warnings
Ritvik Budhiraja (1):
cifs: fix use after free for iface while disabling secondary channels
Ronald Wahl (1):
net: ks8851: Fix another TX stall caused by wrong ISR flag handling
SeongJae Park (1):
Docs/admin-guide/mm/damon/usage: fix wrong example of DAMOS filter matching sysfs file
Shyam Prasad N (6):
cifs: print server capabilities in DebugData
cifs: pick channel for tcon and tdis
cifs: new nt status codes from MS-SMB2
cifs: new mount option called retrans
cifs: commands that are retried should have replay flag set
cifs: set replay flag for retries of write command
Srinivasan Shanmugam (1):
drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()
Steve French (23):
SMB3: clarify some of the unused CreateOption flags
Add definition for new smb3.1.1 command type
smb3: minor RDMA cleanup
smb3: more minor cleanups for session handling routines
smb3: minor cleanup of session handling code
Missing field not being returned in ioctl CIFS_IOC_GET_MNT_INFO
smb: client: introduce cifs_sfu_make_node()
smb: client: extend smb2_compound_op() to accept more commands
smb: client: allow creating special files via reparse points
smb: client: optimise reparse point querying
cifs: fix in logging in cifs_chan_update_iface
cifs: remove unneeded return statement
cifs: minor comment cleanup
cifs: update the same create_guid on replay
smb3: update allocation size more accurately on write completion
smb: client: parse owner/group when creating reparse points
smb: client: do not defer close open handles to deleted files
smb: client: introduce SMB2_OP_QUERY_WSL_EA
smb3: add dynamic trace point for ioctls
cifs: Move some extern decls from .c files to .h
smb311: correct incorrect offset field in compression header
smb311: additional compression flag defined in updated protocol spec
smb3: add trace event for mknod
Sungwoo Kim (2):
Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect()
Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
Thomas Weißschuh (1):
admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET
Yang Li (2):
smb: Fix some kernel-doc comments
ksmbd: Add kernel-doc for ksmbd_extract_sharename() function