5.4-stable patches

added patches:
	can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch
	i40e-add-additional-info-to-phy-type-error.patch

diff --git a/queue-5.4/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch b/queue-5.4/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch
new file mode 100644 (file)
index 0000000..1070f8f
--- /dev/null
+++ b/queue-5.4/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch
@@ -0,0 +1,53 @@
+From 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Wed, 14 Jul 2021 13:16:02 +0200
+Subject: can: j1939: j1939_session_deactivate(): clarify lifetime of session object
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 upstream.
+
+The j1939_session_deactivate() is decrementing the session ref-count and
+potentially can free() the session. This would cause use-after-free
+situation.
+
+However, the code calling j1939_session_deactivate() does always hold
+another reference to the session, so that it would not be free()ed in
+this code path.
+
+This patch adds a comment to make this clear and a WARN_ON, to ensure
+that future changes will not violate this requirement. Further this
+patch avoids dereferencing the session pointer as a precaution to avoid
+use-after-free if the session is actually free()ed.
+
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
+Reported-by: Xiaochen Zou <xzou017@ucr.edu>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c |    9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1075,11 +1075,16 @@ static bool j1939_session_deactivate_loc
+ 
+ static bool j1939_session_deactivate(struct j1939_session *session)
+ {
++      struct j1939_priv *priv = session->priv;
+       bool active;
+ 
+-      j1939_session_list_lock(session->priv);
++      j1939_session_list_lock(priv);
++      /* This function should be called with a session ref-count of at
++       * least 2.
++       */
++      WARN_ON_ONCE(kref_read(&session->kref) < 2);
+       active = j1939_session_deactivate_locked(session);
+-      j1939_session_list_unlock(session->priv);
++      j1939_session_list_unlock(priv);
+ 
+       return active;
+ }

diff --git a/queue-5.4/i40e-add-additional-info-to-phy-type-error.patch b/queue-5.4/i40e-add-additional-info-to-phy-type-error.patch
new file mode 100644 (file)
index 0000000..592eb7e
--- /dev/null
+++ b/queue-5.4/i40e-add-additional-info-to-phy-type-error.patch
@@ -0,0 +1,34 @@
+From dc614c46178b0b89bde86ac54fc687a28580d2b7 Mon Sep 17 00:00:00 2001
+From: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+Date: Mon, 31 May 2021 16:55:49 +0000
+Subject: i40e: Add additional info to PHY type error
+
+From: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+
+commit dc614c46178b0b89bde86ac54fc687a28580d2b7 upstream.
+
+In case of PHY type error occurs, the message was too generic.
+Add additional info to PHY type error indicating that it can be
+wrong cable connected.
+
+Fixes: 124ed15bf126 ("i40e: Add dual speed module support")
+Signed-off-by: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+Signed-off-by: Michal Maloszewski <michal.maloszewski@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -977,7 +977,7 @@ static void i40e_get_settings_link_up(st
+       default:
+               /* if we got here and link is up something bad is afoot */
+               netdev_info(netdev,
+-                          "WARNING: Link is up but PHY type 0x%x is not recognized.\n",
++                          "WARNING: Link is up but PHY type 0x%x is not recognized, or incorrect cable is in use\n",
+                           hw_link_info->phy_type);
+       }
+ 

diff --git a/queue-5.4/series b/queue-5.4/series
index 5d611e8d84d3fedea0ab25b56cf7968e338e8f17..61f9e09303cc0365066165e5a8b82c6bdeb8c1c1 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -37,3 +37,5 @@ bpf-verifier-allocate-idmap-scratch-in-verifier-env.patch
 pci-mvebu-setup-bar0-in-order-to-fix-msi.patch
 powerpc-pseries-fix-regression-while-building-external-modules.patch
 revert-perf-map-fix-dso-nsinfo-refcounting.patch
+i40e-add-additional-info-to-phy-type-error.patch
+can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch