Fixes for 4.14

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.14/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch b/queue-4.14/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
new file mode 100644 (file)
index 0000000..74693da
--- /dev/null
+++ b/queue-4.14/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
@@ -0,0 +1,37 @@
+From a1b97a2c447851e41abb6ee37157d9fdab6f3630 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 04:37:27 -0800
+Subject: net: chelsio: cxgb3: check the return value of pci_find_capability()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 767b9825ed1765894e569a3d698749d40d83762a ]
+
+The function pci_find_capability() in t3_prep_adapter() can fail, so its
+return value should be checked.
+
+Fixes: 4d22de3e6cc4 ("Add support for the latest 1G/10G Chelsio adapter, T3")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+index a89721fad633..29220141e4e4 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+@@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
+           MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10);
+       adapter->params.pci.vpd_cap_addr =
+           pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD);
++      if (!adapter->params.pci.vpd_cap_addr)
++              return -ENODEV;
+       ret = get_vpd_params(adapter, &adapter->params.vpd);
+       if (ret < 0)
+               return ret;
+-- 
+2.34.1
+

diff --git a/queue-4.14/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch b/queue-4.14/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch
new file mode 100644 (file)
index 0000000..90fb16e
--- /dev/null
+++ b/queue-4.14/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch
@@ -0,0 +1,54 @@
+From 284ec59d273d03d3efd223dfb19805413bfcfcda Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 18:00:20 +0800
+Subject: nl80211: Handle nla_memdup failures in handle_nan_filter
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 6ad27f522cb3b210476daf63ce6ddb6568c0508b ]
+
+As there's potential for failure of the nla_memdup(),
+check the return value.
+
+Fixes: a442b761b24b ("cfg80211: add add_nan_func / del_nan_func")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301100020.3801187-1-jiasheng@iscas.ac.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index f630fa2e3164..bbc3c876a5d8 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -11257,6 +11257,9 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+       i = 0;
+       nla_for_each_nested(attr, attr_filter, rem) {
+               filter[i].filter = nla_memdup(attr, GFP_KERNEL);
++              if (!filter[i].filter)
++                      goto err;
++
+               filter[i].len = nla_len(attr);
+               i++;
+       }
+@@ -11269,6 +11272,15 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+       }
+ 
+       return 0;
++
++err:
++      i = 0;
++      nla_for_each_nested(attr, attr_filter, rem) {
++              kfree(filter[i].filter);
++              i++;
++      }
++      kfree(filter);
++      return -ENOMEM;
+ }
+ 
+ static int nl80211_nan_add_func(struct sk_buff *skb,
+-- 
+2.34.1
+

diff --git a/queue-4.14/series b/queue-4.14/series
index 3ab81ce4dac5ca31486de632225ecb9a78187043..5ad025420e08a6ac8ecb00471c058b6cac5bdc39 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -32,3 +32,6 @@ net-arcnet-com20020-fix-null-ptr-deref-in-com20020pci_probe.patch
 efivars-respect-block-flag-in-efivar_entry_set_safe.patch
 can-gs_usb-change-active_channels-s-type-from-atomic_t-to-u8.patch
 arm-9182-1-mmu-fix-returns-from-early_param-and-__setup-functions.patch
+soc-fsl-qe-check-of-ioremap-return-value.patch
+net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
+nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch

diff --git a/queue-4.14/soc-fsl-qe-check-of-ioremap-return-value.patch b/queue-4.14/soc-fsl-qe-check-of-ioremap-return-value.patch
new file mode 100644 (file)
index 0000000..d28be76
--- /dev/null
+++ b/queue-4.14/soc-fsl-qe-check-of-ioremap-return-value.patch
@@ -0,0 +1,43 @@
+From 3858fb9ef13aa751f3da14de695cf053c93e99f1 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 09:45:43 +0800
+Subject: soc: fsl: qe: Check of ioremap return value
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit a222fd8541394b36b13c89d1698d9530afd59a9c ]
+
+As the possible failure of the ioremap(), the par_io could be NULL.
+Therefore it should be better to check it and return error in order to
+guarantee the success of the initiation.
+But, I also notice that all the caller like mpc85xx_qe_par_io_init() in
+`arch/powerpc/platforms/85xx/common.c` don't check the return value of
+the par_io_init().
+Actually, par_io_init() needs to check to handle the potential error.
+I will submit another patch to fix that.
+Anyway, par_io_init() itsely should be fixed.
+
+Fixes: 7aa1aa6ecec2 ("QE: Move QE from arch/powerpc to drivers/soc")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c
+index 7ae59abc7863..127a4a836e67 100644
+--- a/drivers/soc/fsl/qe/qe_io.c
++++ b/drivers/soc/fsl/qe/qe_io.c
+@@ -41,6 +41,8 @@ int par_io_init(struct device_node *np)
+       if (ret)
+               return ret;
+       par_io = ioremap(res.start, resource_size(&res));
++      if (!par_io)
++              return -ENOMEM;
+ 
+       num_ports = of_get_property(np, "num-ports", NULL);
+       if (num_ports)
+-- 
+2.34.1
+