The patch below does not apply to the 5.9-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable(a)vger.kernel.org>.
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From e1483ac030fb4c57734289742f1c1d38dca61e22 Mon Sep 17 00:00:00 2001
From: Lukas Wunner <lukas(a)wunner.de>
Date: Wed, 11 Nov 2020 20:07:20 +0100
Subject: [PATCH] spi: bcm2835: Fix use-after-free on unbind
bcm2835_spi_remove() accesses the driver's private data after calling
spi_unregister_controller() even though that function releases the last
reference on the spi_controller and thereby frees the private data.
Fix by switching over to the new devm_spi_alloc_master() helper which
keeps the private data accessible until the driver has unbound.
Fixes: f8043872e796 ("spi: add driver for BCM2835")
Reported-by: Sascha Hauer <s.hauer(a)pengutronix.de>
Reported-by: Florian Fainelli <f.fainelli(a)gmail.com>
Signed-off-by: Lukas Wunner <lukas(a)wunner.de>
Cc: <stable(a)vger.kernel.org> # v3.10+: 123456789abc: spi: Introduce device-managed SPI controller allocation
Cc: <stable(a)vger.kernel.org> # v3.10+
Cc: Vladimir Oltean <olteanv(a)gmail.com>
Tested-by: Florian Fainelli <f.fainelli(a)gmail.com>
Acked-by: Florian Fainelli <f.fainelli(a)gmail.com>
Link: https://lore.kernel.org/r/ad66e0a0ad96feb848814842ecf5b6a4539ef35c.16051210…
Signed-off-by: Mark Brown <broonie(a)kernel.org>
diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
index 7104cf17b848..197485f2c2b2 100644
--- a/drivers/spi/spi-bcm2835.c
+++ b/drivers/spi/spi-bcm2835.c
@@ -1278,7 +1278,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
struct bcm2835_spi *bs;
int err;
- ctlr = spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
+ ctlr = devm_spi_alloc_master(&pdev->dev, ALIGN(sizeof(*bs),
dma_get_cache_alignment()));
if (!ctlr)
return -ENOMEM;
@@ -1299,23 +1299,17 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
bs->ctlr = ctlr;
bs->regs = devm_platform_ioremap_resource(pdev, 0);
- if (IS_ERR(bs->regs)) {
- err = PTR_ERR(bs->regs);
- goto out_controller_put;
- }
+ if (IS_ERR(bs->regs))
+ return PTR_ERR(bs->regs);
bs->clk = devm_clk_get(&pdev->dev, NULL);
- if (IS_ERR(bs->clk)) {
- err = dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
- "could not get clk\n");
- goto out_controller_put;
- }
+ if (IS_ERR(bs->clk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(bs->clk),
+ "could not get clk\n");
bs->irq = platform_get_irq(pdev, 0);
- if (bs->irq <= 0) {
- err = bs->irq ? bs->irq : -ENODEV;
- goto out_controller_put;
- }
+ if (bs->irq <= 0)
+ return bs->irq ? bs->irq : -ENODEV;
clk_prepare_enable(bs->clk);
@@ -1349,8 +1343,6 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
bcm2835_dma_release(ctlr, bs);
out_clk_disable:
clk_disable_unprepare(bs->clk);
-out_controller_put:
- spi_controller_put(ctlr);
return err;
}
If the auto-negotiation fails to establish a gigabit link, the phy
can try to 'down-shift': it resets the bits in MII_CTRL1000 to
stop advertising 1Gbps and retries the negotiation at 100Mbps.
>From commit 5502b218e001 ("net: phy: use phy_resolve_aneg_linkmode
in genphy_read_status") the content of MII_CTRL1000 is not checked
anymore at the end of the negotiation, preventing the detection of
phy 'down-shift'.
In case of 'down-shift' phydev->advertising gets out-of-sync wrt
MII_CTRL1000 and still includes modes that the phy have already
dropped. The link partner could still advertise higher speeds,
while the link is established at one of the common lower speeds.
The logic 'and' in phy_resolve_aneg_linkmode() between
phydev->advertising and phydev->lp_advertising will report an
incorrect mode.
Issue detected with a local phy rtl8211f connected with a gigabit
capable router through a two-pairs network cable.
After auto-negotiation, read back MII_CTRL1000 and mask-out from
phydev->advertising the modes that have been eventually discarded
due to the 'down-shift'.
Fixes: 5502b218e001 ("net: phy: use phy_resolve_aneg_linkmode in genphy_read_status")
Cc: stable(a)vger.kernel.org # v5.1+
Signed-off-by: Antonio Borneo <antonio.borneo(a)st.com>
Link: https://lore.kernel.org/r/478f871a-583d-01f1-9cc5-2eea56d8c2a7@huawei.com
---
To: Andrew Lunn <andrew(a)lunn.ch>
To: Heiner Kallweit <hkallweit1(a)gmail.com>
To: Russell King <linux(a)armlinux.org.uk>
To: "David S. Miller" <davem(a)davemloft.net>
To: Jakub Kicinski <kuba(a)kernel.org>
To: netdev(a)vger.kernel.org
To: Yonglong Liu <liuyonglong(a)huawei.com>
Cc: linuxarm(a)huawei.com
Cc: Salil Mehta <salil.mehta(a)huawei.com>
Cc: linux-stm32(a)st-md-mailman.stormreply.com
Cc: linux-kernel(a)vger.kernel.org
Cc: Antonio Borneo <antonio.borneo(a)st.com>
drivers/net/phy/phy_device.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 5dab6be6fc38..5d1060aa1b25 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -2331,7 +2331,7 @@ EXPORT_SYMBOL(genphy_read_status_fixed);
*/
int genphy_read_status(struct phy_device *phydev)
{
- int err, old_link = phydev->link;
+ int adv, err, old_link = phydev->link;
/* Update the link, but return if there was an error */
err = genphy_update_link(phydev);
@@ -2356,6 +2356,14 @@ int genphy_read_status(struct phy_device *phydev)
return err;
if (phydev->autoneg == AUTONEG_ENABLE && phydev->autoneg_complete) {
+ if (phydev->is_gigabit_capable) {
+ adv = phy_read(phydev, MII_CTRL1000);
+ if (adv < 0)
+ return adv;
+ /* update advertising in case of 'down-shift' */
+ mii_ctrl1000_mod_linkmode_adv_t(phydev->advertising,
+ adv);
+ }
phy_resolve_aneg_linkmode(phydev);
} else if (phydev->autoneg == AUTONEG_DISABLE) {
err = genphy_read_status_fixed(phydev);
base-commit: d549699048b4b5c22dd710455bcdb76966e55aa3
--
2.29.2
I'm announcing the release of the 4.14.209 kernel.
All users of the 4.14 kernel series must upgrade.
The updated 4.14.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-4.14.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2
arch/arm/boot/dts/imx50-evk.dts | 2
arch/arm/boot/dts/imx6qdl-udoo.dtsi | 2
arch/arm64/kernel/psci.c | 5 -
arch/mips/alchemy/common/clock.c | 9 ++
arch/mips/mm/tlb-r4k.c | 1
arch/powerpc/include/asm/book3s/64/kup-radix.h | 1
arch/s390/kernel/perf_cpum_sf.c | 2
arch/x86/kernel/cpu/microcode/intel.c | 63 ++----------------
arch/xtensa/mm/cache.c | 14 ++++
drivers/atm/nicstar.c | 2
drivers/iio/accel/kxcjk-1013.c | 51 +++++++++++++-
drivers/input/misc/adxl34x.c | 2
drivers/net/can/dev.c | 2
drivers/net/can/m_can/m_can.c | 4 -
drivers/net/can/ti_hecc.c | 13 ++-
drivers/net/can/usb/mcba_usb.c | 4 -
drivers/net/can/usb/peak_usb/pcan_usb_core.c | 4 -
drivers/net/dsa/mv88e6xxx/global1_vtu.c | 59 ++++++++++++++--
drivers/net/ethernet/broadcom/b44.c | 3
drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2
drivers/net/ethernet/faraday/ftgmac100.c | 4 +
drivers/net/ethernet/mellanox/mlx4/fw.c | 6 -
drivers/net/ethernet/mellanox/mlx4/fw.h | 4 -
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 15 ++--
drivers/net/ethernet/mellanox/mlxsw/core.c | 3
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3
drivers/net/usb/qmi_wwan.c | 2
drivers/pinctrl/pinctrl-rockchip.c | 2
drivers/regulator/core.c | 38 ++++++----
drivers/regulator/ti-abb-regulator.c | 12 +++
drivers/s390/block/dasd.c | 6 +
drivers/staging/rtl8723bs/os_dep/sdio_intf.c | 1
drivers/staging/speakup/spk_ttyio.c | 9 ++
drivers/tty/serial/imx.c | 20 -----
fs/efivarfs/super.c | 1
fs/ext4/ext4.h | 3
fs/libfs.c | 6 +
fs/super.c | 33 +--------
fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++--
net/bridge/br_device.c | 1
net/can/af_can.c | 38 ++++++++--
net/core/devlink.c | 6 +
net/core/netpoll.c | 22 +++++-
net/ipv4/inet_diag.c | 4 -
net/ipv4/tcp_bbr.c | 2
net/ipv6/ah6.c | 3
net/mac80211/rc80211_minstrel.c | 27 +------
net/mac80211/rc80211_minstrel.h | 1
net/mac80211/sta_info.c | 14 +---
net/netlabel/netlabel_unlabeled.c | 17 +++-
net/sctp/input.c | 4 -
net/sctp/sm_sideeffect.c | 4 -
net/sctp/transport.c | 2
net/x25/af_x25.c | 1
sound/core/control.c | 2
sound/pci/mixart/mixart_core.c | 5 -
sound/soc/qcom/lpass-platform.c | 5 +
tools/perf/builtin-lock.c | 2
59 files changed, 342 insertions(+), 249 deletions(-)
Alejandro Concepcion Rodriguez (1):
can: dev: can_restart(): post buffer from the right context
Anant Thazhemadam (2):
can: af_can: prevent potential access of uninitialized member in can_rcv()
can: af_can: prevent potential access of uninitialized member in canfd_rcv()
Aya Levin (1):
net/mlx4_core: Fix init_hca fields offset
Brian O'Keefe (1):
staging: rtl8723bs: Add 024c:0627 to the list of SDIO device-ids
Chen Yu (1):
x86/microcode/intel: Check patch signature before saving microcode for early loading
Colin Ian King (1):
can: peak_usb: fix potential integer overflow on shift of a int
Dan Carpenter (1):
Input: adxl34x - clean up a data type in adxl34x_probe()
Daniel Axtens (1):
powerpc/uaccess-flush: fix missing includes in kup-radix.h
Darrick J. Wong (2):
vfs: remove lockdep bogosity in __sb_start_write
xfs: revert "xfs: fix rmap key and record comparison functions"
Edwin Peer (1):
bnxt_en: read EEPROM A2h address using page 0
Fabio Estevam (1):
ARM: dts: imx50-evk: Fix the chip select 1 IOMUX
Felix Fietkau (2):
mac80211: minstrel: remove deferred sampling code
mac80211: minstrel: fix tx status processing corner case
Filip Moc (1):
net: usb: qmi_wwan: Set DTR quirk for MR400
Florian Fainelli (1):
net: Have netpoll bring-up DSA management interface
Fugang Duan (1):
tty: serial: imx: keep console clocks always on
Greg Kroah-Hartman (1):
Linux 4.14.209
Hans de Goede (2):
iio: accel: kxcjk1013: Replace is_smo8500_device with an acpi_type enum
iio: accel: kxcjk1013: Add support for KIOX010A ACPI DSM for setting tablet-mode
Heiner Kallweit (1):
net: bridge: add missing counters to ndo_get_stats64 callback
Ido Schimmel (1):
mlxsw: core: Use variable timeout for EMAD retries
Jan Kara (1):
ext4: fix bogus warning in ext4_update_dx_flag()
Jianqun Xu (1):
pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
Joel Stanley (1):
net: ftgmac100: Fix crash when removing driver
Johannes Berg (1):
mac80211: free sta in sta_info_insert_finish() on errors
Leo Yan (1):
perf lock: Don't free "lock_seq_stat" if read_count isn't zero
Marc Kleine-Budde (1):
can: mcba_usb: mcba_usb_start_xmit(): first fill skb, then pass to can_put_echo_skb()
Max Filippov (1):
xtensa: disable preemption around cache alias management calls
Michał Mirosław (3):
regulator: fix memory leak with repeated set_machine_constraints()
regulator: avoid resolve_supply() infinite recursion
regulator: workaround self-referent regulators
Nishanth Menon (1):
regulator: ti-abb: Fix array out of bound read access on the first transition
Paul Moore (2):
netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
Randy Dunlap (1):
MIPS: export has_transparent_hugepage() for modules
Ryan Sharpelletti (1):
tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate
Samuel Thibault (1):
speakup: Do not let the line discipline be used several times
Sebastian Andrzej Siewior (1):
atm: nicstar: Unmap DMA on send error
Sergey Matyukevich (1):
arm: dts: imx6qdl-udoo: fix rgmii phy-mode for ksz9031 phy
Srinivasa Rao Mandadapu (1):
ASoC: qcom: lpass-platform: Fix memory leak
Stefan Haberland (1):
s390/dasd: fix null pointer dereference for ERP requests
Takashi Iwai (1):
ALSA: mixart: Fix mutex deadlock
Takashi Sakamoto (1):
ALSA: ctl: fix error path at adding user-defined element set
Thomas Richter (1):
s390/cpum_sf.c: fix file permission for cpum_sfb_size
Tobias Waldekranz (1):
net: dsa: mv88e6xxx: Avoid VTU corruption on 6097
Vamshi K Sthambamkadi (1):
efivarfs: fix memory leak in efivarfs_create()
Vladyslav Tarasiuk (1):
net/mlx5: Disable QoS when min_rates on all VFs are zero
Wang Hai (2):
devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill()
inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill()
Will Deacon (1):
arm64: psci: Avoid printing in cpu_psci_cpu_die()
Wu Bo (1):
can: m_can: m_can_handle_state_change(): fix state change
Xie He (1):
net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
Xin Long (1):
sctp: change to hold/put transport for proto_unreach_timer
Yicong Yang (1):
libfs: fix error cast of negative value in simple_attr_write()
Zhang Changzhong (3):
ah6: fix error return code in ah6_input()
net: b44: fix error return code in b44_init_one()
qlcnic: fix error return code in qlcnic_83xx_restart_hw()
Zhang Qilong (2):
can: ti_hecc: Fix memleak in ti_hecc_probe
MIPS: Alchemy: Fix memleak in alchemy_clk_setup_cpu