]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 5.10
authorSasha Levin <sashal@kernel.org>
Thu, 30 Mar 2023 11:50:35 +0000 (07:50 -0400)
committerSasha Levin <sashal@kernel.org>
Thu, 30 Mar 2023 11:50:35 +0000 (07:50 -0400)
Signed-off-by: Sasha Levin <sashal@kernel.org>
13 files changed:
queue-5.10/alsa-asihpi-check-pao-in-control_message.patch [new file with mode: 0644]
queue-5.10/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch [new file with mode: 0644]
queue-5.10/fbdev-au1200fb-fix-potential-divide-by-zero.patch [new file with mode: 0644]
queue-5.10/fbdev-intelfb-fix-potential-divide-by-zero.patch [new file with mode: 0644]
queue-5.10/fbdev-lxfb-fix-potential-divide-by-zero.patch [new file with mode: 0644]
queue-5.10/fbdev-nvidia-fix-potential-divide-by-zero.patch [new file with mode: 0644]
queue-5.10/fbdev-tgafb-fix-potential-divide-by-zero.patch [new file with mode: 0644]
queue-5.10/md-avoid-signed-overflow-in-slot_store.patch [new file with mode: 0644]
queue-5.10/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch [new file with mode: 0644]
queue-5.10/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch [new file with mode: 0644]
queue-5.10/series
queue-5.10/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch [new file with mode: 0644]
queue-5.10/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch [new file with mode: 0644]

diff --git a/queue-5.10/alsa-asihpi-check-pao-in-control_message.patch b/queue-5.10/alsa-asihpi-check-pao-in-control_message.patch
new file mode 100644 (file)
index 0000000..f578211
--- /dev/null
@@ -0,0 +1,72 @@
+From f49c121d6a26e2f0c33f58b85fcb91896462b41e Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 00:49:24 +0000
+Subject: ALSA: asihpi: check pao in control_message()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 9026c0bf233db53b86f74f4c620715e94eb32a09 ]
+
+control_message() might be called with pao = NULL.
+Here indicates control_message() as sample.
+
+(B)    static void control_message(struct hpi_adapter_obj *pao, ...)
+       {                                                   ^^^
+               struct hpi_hw_obj *phw = pao->priv;
+               ...                      ^^^
+       }
+
+(A)    void _HPI_6205(struct hpi_adapter_obj *pao, ...)
+       {                                      ^^^
+               ...
+               case HPI_OBJ_CONTROL:
+(B)                    control_message(pao, phm, phr);
+                       break;          ^^^
+               ...
+       }
+
+       void HPI_6205(...)
+       {
+               ...
+(A)            _HPI_6205(NULL, phm, phr);
+               ...       ^^^^
+       }
+
+Therefore, We will get too many warning via cppcheck, like below
+
+       sound/pci/asihpi/hpi6205.c:238:27: warning: Possible null pointer dereference: pao [nullPointer]
+                struct hpi_hw_obj *phw = pao->priv;
+                                         ^
+       sound/pci/asihpi/hpi6205.c:433:13: note: Calling function '_HPI_6205', 1st argument 'NULL' value is 0
+                 _HPI_6205(NULL, phm, phr);
+                           ^
+       sound/pci/asihpi/hpi6205.c:401:20: note: Calling function 'control_message', 1st argument 'pao' value is 0
+          control_message(pao, phm, phr);
+                          ^
+Set phr->error like many functions doing, and don't call _HPI_6205()
+with NULL.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87ttypeaqz.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/asihpi/hpi6205.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/sound/pci/asihpi/hpi6205.c b/sound/pci/asihpi/hpi6205.c
+index 3d6914c64c4a8..4cdaeefeb6885 100644
+--- a/sound/pci/asihpi/hpi6205.c
++++ b/sound/pci/asihpi/hpi6205.c
+@@ -430,7 +430,7 @@ void HPI_6205(struct hpi_message *phm, struct hpi_response *phr)
+               pao = hpi_find_adapter(phm->adapter_index);
+       } else {
+               /* subsys messages don't address an adapter */
+-              _HPI_6205(NULL, phm, phr);
++              phr->error = HPI_ERROR_INVALID_OBJ_INDEX;
+               return;
+       }
+-- 
+2.39.2
+
diff --git a/queue-5.10/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch b/queue-5.10/alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch
new file mode 100644 (file)
index 0000000..d30de3b
--- /dev/null
@@ -0,0 +1,62 @@
+From 4229f853e3721de040402e00c64fbb765f5735fb Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 13 Mar 2023 00:50:28 +0000
+Subject: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
+
+From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+
+[ Upstream commit 98e5eb110095ec77cb6d775051d181edbf9cd3cf ]
+
+tuning_ctl_set() might have buffer overrun at (X) if it didn't break
+from loop by matching (A).
+
+       static int tuning_ctl_set(...)
+       {
+               for (i = 0; i < TUNING_CTLS_COUNT; i++)
+(A)                    if (nid == ca0132_tuning_ctls[i].nid)
+                               break;
+
+               snd_hda_power_up(...);
+(X)            dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...);
+               snd_hda_power_down(...);                ^
+
+               return 1;
+       }
+
+We will get below error by cppcheck
+
+       sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
+        for (i = 0; i < TUNING_CTLS_COUNT; i++)
+        ^
+       sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
+        dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
+                                                  ^
+This patch cares non match case.
+
+Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
+Link: https://lore.kernel.org/r/87sfe9eap7.wl-kuninori.morimoto.gx@renesas.com
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ sound/pci/hda/patch_ca0132.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 24c2638cde376..6057084da4cf8 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -4108,8 +4108,10 @@ static int tuning_ctl_set(struct hda_codec *codec, hda_nid_t nid,
+       for (i = 0; i < TUNING_CTLS_COUNT; i++)
+               if (nid == ca0132_tuning_ctls[i].nid)
+-                      break;
++                      goto found;
++      return -EINVAL;
++found:
+       snd_hda_power_up(codec);
+       dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
+                       ca0132_tuning_ctls[i].req,
+-- 
+2.39.2
+
diff --git a/queue-5.10/fbdev-au1200fb-fix-potential-divide-by-zero.patch b/queue-5.10/fbdev-au1200fb-fix-potential-divide-by-zero.patch
new file mode 100644 (file)
index 0000000..8213c05
--- /dev/null
@@ -0,0 +1,39 @@
+From 0af8c67096cba14b27262aed44e423b09aa61794 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 09:22:54 +0000
+Subject: fbdev: au1200fb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 44a3b36b42acfc433aaaf526191dd12fbb919fdb ]
+
+var->pixclock can be assigned to zero by user. Without
+proper check, divide by zero would occur when invoking
+macro PICOS2KHZ in au1200fb_fb_check_var.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/au1200fb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c
+index c00e01a173685..a8a0a448cdb5e 100644
+--- a/drivers/video/fbdev/au1200fb.c
++++ b/drivers/video/fbdev/au1200fb.c
+@@ -1040,6 +1040,9 @@ static int au1200fb_fb_check_var(struct fb_var_screeninfo *var,
+       u32 pixclock;
+       int screen_size, plane;
++      if (!var->pixclock)
++              return -EINVAL;
++
+       plane = fbdev->plane;
+       /* Make sure that the mode respect all LCD controller and
+-- 
+2.39.2
+
diff --git a/queue-5.10/fbdev-intelfb-fix-potential-divide-by-zero.patch b/queue-5.10/fbdev-intelfb-fix-potential-divide-by-zero.patch
new file mode 100644 (file)
index 0000000..4ae9ab9
--- /dev/null
@@ -0,0 +1,39 @@
+From d2cbf20bc0bb6fa6a77d521265e395c2129647a9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 08:33:47 +0000
+Subject: fbdev: intelfb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit d823685486a3446d061fed7c7d2f80af984f119a ]
+
+Variable var->pixclock is controlled by user and can be assigned
+to zero. Without proper check, divide by zero would occur in
+intelfbhw_validate_mode and intelfbhw_mode_to_hw.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/intelfb/intelfbdrv.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c
+index a9579964eaba8..8a703adfa9360 100644
+--- a/drivers/video/fbdev/intelfb/intelfbdrv.c
++++ b/drivers/video/fbdev/intelfb/intelfbdrv.c
+@@ -1214,6 +1214,9 @@ static int intelfb_check_var(struct fb_var_screeninfo *var,
+       dinfo = GET_DINFO(info);
++      if (!var->pixclock)
++              return -EINVAL;
++
+       /* update the pitch */
+       if (intelfbhw_validate_mode(dinfo, var) != 0)
+               return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/fbdev-lxfb-fix-potential-divide-by-zero.patch b/queue-5.10/fbdev-lxfb-fix-potential-divide-by-zero.patch
new file mode 100644 (file)
index 0000000..f9ed7af
--- /dev/null
@@ -0,0 +1,38 @@
+From f927d5b679ddf57f9b920b1c2ef89217a7817ea9 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 09:05:18 +0000
+Subject: fbdev: lxfb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 61ac4b86a4c047c20d5cb423ddd87496f14d9868 ]
+
+var->pixclock can be assigned to zero by user. Without proper
+check, divide by zero would occur in lx_set_clock.
+
+Error out if var->pixclock is zero.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/geode/lxfb_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/geode/lxfb_core.c b/drivers/video/fbdev/geode/lxfb_core.c
+index 66c81262d18f8..6c6b6efb49f69 100644
+--- a/drivers/video/fbdev/geode/lxfb_core.c
++++ b/drivers/video/fbdev/geode/lxfb_core.c
+@@ -234,6 +234,9 @@ static void get_modedb(struct fb_videomode **modedb, unsigned int *size)
+ static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
++      if (!var->pixclock)
++              return -EINVAL;
++
+       if (var->xres > 1920 || var->yres > 1440)
+               return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/fbdev-nvidia-fix-potential-divide-by-zero.patch b/queue-5.10/fbdev-nvidia-fix-potential-divide-by-zero.patch
new file mode 100644 (file)
index 0000000..6d5c98a
--- /dev/null
@@ -0,0 +1,40 @@
+From 1f664eacf7a6d45d0e8e9c750c8c1c7e724d49ba Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 15 Mar 2023 07:18:31 +0000
+Subject: fbdev: nvidia: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit 92e2a00f2987483e1f9253625828622edd442e61 ]
+
+variable var->pixclock can be set by user. In case it
+equals to zero, divide by zero would occur in nvidiafb_set_par.
+
+Similar crashes have happened in other fbdev drivers. There
+is no check and modification on var->pixclock along the call
+chain to nvidia_check_var and nvidiafb_set_par. We believe it
+could also be triggered in driver nvidia from user site.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/nvidia/nvidia.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c
+index a372a183c1f01..f9c388a8c10e3 100644
+--- a/drivers/video/fbdev/nvidia/nvidia.c
++++ b/drivers/video/fbdev/nvidia/nvidia.c
+@@ -763,6 +763,8 @@ static int nvidiafb_check_var(struct fb_var_screeninfo *var,
+       int pitch, err = 0;
+       NVTRACE_ENTER();
++      if (!var->pixclock)
++              return -EINVAL;
+       var->transp.offset = 0;
+       var->transp.length = 0;
+-- 
+2.39.2
+
diff --git a/queue-5.10/fbdev-tgafb-fix-potential-divide-by-zero.patch b/queue-5.10/fbdev-tgafb-fix-potential-divide-by-zero.patch
new file mode 100644 (file)
index 0000000..bc4e0d7
--- /dev/null
@@ -0,0 +1,44 @@
+From 0d0f084379301b0767d45d899258a5a684e86a20 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 13:08:56 +0000
+Subject: fbdev: tgafb: Fix potential divide by zero
+
+From: Wei Chen <harperchen1110@gmail.com>
+
+[ Upstream commit f90bd245de82c095187d8c2cabb8b488a39eaecc ]
+
+fb_set_var would by called when user invokes ioctl with cmd
+FBIOPUT_VSCREENINFO. User-provided data would finally reach
+tgafb_check_var. In case var->pixclock is assigned to zero,
+divide by zero would occur when checking whether reciprocal
+of var->pixclock is too high.
+
+Similar crashes have happened in other fbdev drivers. There
+is no check and modification on var->pixclock along the call
+chain to tgafb_check_var. We believe it could also be triggered
+in driver tgafb from user site.
+
+Signed-off-by: Wei Chen <harperchen1110@gmail.com>
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/video/fbdev/tgafb.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c
+index 666fbe2f671c9..98a2977fd4271 100644
+--- a/drivers/video/fbdev/tgafb.c
++++ b/drivers/video/fbdev/tgafb.c
+@@ -166,6 +166,9 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ {
+       struct tga_par *par = (struct tga_par *)info->par;
++      if (!var->pixclock)
++              return -EINVAL;
++
+       if (par->tga_type == TGA_TYPE_8PLANE) {
+               if (var->bits_per_pixel != 8)
+                       return -EINVAL;
+-- 
+2.39.2
+
diff --git a/queue-5.10/md-avoid-signed-overflow-in-slot_store.patch b/queue-5.10/md-avoid-signed-overflow-in-slot_store.patch
new file mode 100644 (file)
index 0000000..b8ef4a7
--- /dev/null
@@ -0,0 +1,44 @@
+From c31bc9a25c4c2e010fc670d030ab68f208db2daf Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 6 Mar 2023 09:36:25 +1100
+Subject: md: avoid signed overflow in slot_store()
+
+From: NeilBrown <neilb@suse.de>
+
+[ Upstream commit 3bc57292278a0b6ac4656cad94c14f2453344b57 ]
+
+slot_store() uses kstrtouint() to get a slot number, but stores the
+result in an "int" variable (by casting a pointer).
+This can result in a negative slot number if the unsigned int value is
+very large.
+
+A negative number means that the slot is empty, but setting a negative
+slot number this way will not remove the device from the array.  I don't
+think this is a serious problem, but it could cause confusion and it is
+best to fix it.
+
+Reported-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Song Liu <song@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/md/md.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index c0b34637bd667..1553c2495841b 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -3207,6 +3207,9 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
+               err = kstrtouint(buf, 10, (unsigned int *)&slot);
+               if (err < 0)
+                       return err;
++              if (slot < 0)
++                      /* overflow */
++                      return -ENOSPC;
+       }
+       if (rdev->mddev->pers && slot == -1) {
+               /* Setting 'slot' on an active array requires also
+-- 
+2.39.2
+
diff --git a/queue-5.10/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch b/queue-5.10/net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch
new file mode 100644 (file)
index 0000000..718ab44
--- /dev/null
@@ -0,0 +1,40 @@
+From d0005d7ed0c128361e56ed0f82fa5f659817c3ff Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 7 Mar 2023 14:32:29 +0100
+Subject: net: hsr: Don't log netdev_err message on unknown prp dst node
+
+From: Kristian Overskeid <koverskeid@gmail.com>
+
+[ Upstream commit 28e8cabe80f3e6e3c98121576eda898eeb20f1b1 ]
+
+If no frames has been exchanged with a node for HSR_NODE_FORGET_TIME, the
+node will be deleted from the node_db list. If a frame is sent to the node
+after it is deleted, a netdev_err message for each slave interface is
+produced. This should not happen with dan nodes because of supervision
+frames, but can happen often with san nodes, which clutters the kernel
+log. Since the hsr protocol does not support sans, this is only relevant
+for the prp protocol.
+
+Signed-off-by: Kristian Overskeid <koverskeid@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/hsr/hsr_framereg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
+index 20cb6b7dbc694..08627c8368848 100644
+--- a/net/hsr/hsr_framereg.c
++++ b/net/hsr/hsr_framereg.c
+@@ -380,7 +380,7 @@ void hsr_addr_subst_dest(struct hsr_node *node_src, struct sk_buff *skb,
+       node_dst = find_node_by_addr_A(&port->hsr->node_db,
+                                      eth_hdr(skb)->h_dest);
+       if (!node_dst) {
+-              if (net_ratelimit())
++              if (net_ratelimit() && port->hsr->prot_version != PRP_V1)
+                       netdev_err(skb->dev, "%s: Unknown node\n", __func__);
+               return;
+       }
+-- 
+2.39.2
+
diff --git a/queue-5.10/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch b/queue-5.10/sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch
new file mode 100644 (file)
index 0000000..6663666
--- /dev/null
@@ -0,0 +1,82 @@
+From 74f1f71657bb4dc2cfe71d03dd7fda3f2e997f10 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 14 Mar 2023 19:32:38 -0700
+Subject: sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+[ Upstream commit 6015b1aca1a233379625385feb01dd014aca60b5 ]
+
+The getaffinity() system call uses 'cpumask_size()' to decide how big
+the CPU mask is - so far so good.  It is indeed the allocation size of a
+cpumask.
+
+But the code also assumes that the whole allocation is initialized
+without actually doing so itself.  That's wrong, because we might have
+fixed-size allocations (making copying and clearing more efficient), but
+not all of it is then necessarily used if 'nr_cpu_ids' is smaller.
+
+Having checked other users of 'cpumask_size()', they all seem to be ok,
+either using it purely for the allocation size, or explicitly zeroing
+the cpumask before using the size in bytes to copy it.
+
+See for example the ublk_ctrl_get_queue_affinity() function that uses
+the proper 'zalloc_cpumask_var()' to make sure that the whole mask is
+cleared, whether the storage is on the stack or if it was an external
+allocation.
+
+Fix this by just zeroing the allocation before using it.  Do the same
+for the compat version of sched_getaffinity(), which had the same logic.
+
+Also, for consistency, make sched_getaffinity() use 'cpumask_bits()' to
+access the bits.  For a cpumask_var_t, it ends up being a pointer to the
+same data either way, but it's just a good idea to treat it like you
+would a 'cpumask_t'.  The compat case already did that.
+
+Reported-by: Ryan Roberts <ryan.roberts@arm.com>
+Link: https://lore.kernel.org/lkml/7d026744-6bd6-6827-0471-b5e8eae0be3f@arm.com/
+Cc: Yury Norov <yury.norov@gmail.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/compat.c     | 2 +-
+ kernel/sched/core.c | 4 ++--
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/kernel/compat.c b/kernel/compat.c
+index 05adfd6fa8bf9..f9f7a79e07c5f 100644
+--- a/kernel/compat.c
++++ b/kernel/compat.c
+@@ -152,7 +152,7 @@ COMPAT_SYSCALL_DEFINE3(sched_getaffinity, compat_pid_t,  pid, unsigned int, len,
+       if (len & (sizeof(compat_ulong_t)-1))
+               return -EINVAL;
+-      if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++      if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+               return -ENOMEM;
+       ret = sched_getaffinity(pid, mask);
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index abea8fb7bdd16..b4bd02d68185e 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -6067,14 +6067,14 @@ SYSCALL_DEFINE3(sched_getaffinity, pid_t, pid, unsigned int, len,
+       if (len & (sizeof(unsigned long)-1))
+               return -EINVAL;
+-      if (!alloc_cpumask_var(&mask, GFP_KERNEL))
++      if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+               return -ENOMEM;
+       ret = sched_getaffinity(pid, mask);
+       if (ret == 0) {
+               unsigned int retlen = min(len, cpumask_size());
+-              if (copy_to_user(user_mask_ptr, mask, retlen))
++              if (copy_to_user(user_mask_ptr, cpumask_bits(mask), retlen))
+                       ret = -EFAULT;
+               else
+                       ret = retlen;
+-- 
+2.39.2
+
index e8b5b4ec5a093b0160302f129da095f324259786..19bff609317461b79fcbcc7265b1017fcfd35775 100644 (file)
@@ -110,3 +110,15 @@ drm-meson-fix-missing-component-unbind-on-bind-error.patch
 bus-imx-weim-fix-branch-condition-evaluates-to-a-gar.patch
 dm-crypt-avoid-accessing-uninitialized-tasklet.patch
 fsverity-don-t-drop-pagecache-at-end-of-fs_ioc_enabl.patch
+md-avoid-signed-overflow-in-slot_store.patch
+net-hsr-don-t-log-netdev_err-message-on-unknown-prp-.patch
+alsa-asihpi-check-pao-in-control_message.patch
+alsa-hda-ca0132-fixup-buffer-overrun-at-tuning_ctl_s.patch
+fbdev-tgafb-fix-potential-divide-by-zero.patch
+sched_getaffinity-don-t-assume-cpumask_size-is-fully.patch
+fbdev-nvidia-fix-potential-divide-by-zero.patch
+fbdev-intelfb-fix-potential-divide-by-zero.patch
+fbdev-lxfb-fix-potential-divide-by-zero.patch
+fbdev-au1200fb-fix-potential-divide-by-zero.patch
+tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch
+tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch
diff --git a/queue-5.10/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch b/queue-5.10/tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch
new file mode 100644 (file)
index 0000000..2a5430f
--- /dev/null
@@ -0,0 +1,58 @@
+From 0287e07af6fde5525c90648256e858427caf5d53 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 15 Dec 2022 10:18:16 -0500
+Subject: tools/power turbostat: Fix /dev/cpu_dma_latency warnings
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+[ Upstream commit 40aafc7d58d3544f152a863a0e9863014b6d5d8c ]
+
+When running as non-root the following error is seen in turbostat:
+
+turbostat: fopen /dev/cpu_dma_latency
+: Permission denied
+
+turbostat and the man page have information on how to avoid other
+permission errors, so these can be fixed the same way.
+
+Provide better /dev/cpu_dma_latency warnings that provide instructions on
+how to avoid the error, and update the man page.
+
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Cc: linux-pm@vger.kernel.org
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ tools/power/x86/turbostat/turbostat.8 | 2 ++
+ tools/power/x86/turbostat/turbostat.c | 2 +-
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
+index f6b7e85b121ce..71e3f3a68b9df 100644
+--- a/tools/power/x86/turbostat/turbostat.8
++++ b/tools/power/x86/turbostat/turbostat.8
+@@ -294,6 +294,8 @@ Alternatively, non-root users can be enabled to run turbostat this way:
+ # chmod +r /dev/cpu/*/msr
++# chmod +r /dev/cpu_dma_latency
++
+ .B "turbostat "
+ reads hardware counters, but doesn't write them.
+ So it will not interfere with the OS or other programs, including
+diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
+index ef65f7eed1ec9..d33c9d427e573 100644
+--- a/tools/power/x86/turbostat/turbostat.c
++++ b/tools/power/x86/turbostat/turbostat.c
+@@ -5004,7 +5004,7 @@ void print_dev_latency(void)
+       retval = read(fd, (void *)&value, sizeof(int));
+       if (retval != sizeof(int)) {
+-              warn("read %s\n", path);
++              warn("read failed %s\n", path);
+               close(fd);
+               return;
+       }
+-- 
+2.39.2
+
diff --git a/queue-5.10/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch b/queue-5.10/tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch
new file mode 100644 (file)
index 0000000..08b91f0
--- /dev/null
@@ -0,0 +1,53 @@
+From aa3d106b413dd6890b5deaa823a91eb19296615c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 31 Jan 2023 10:58:18 +0300
+Subject: tracing: Fix wrong return in kprobe_event_gen_test.c
+
+From: Anton Gusev <aagusev@ispras.ru>
+
+[ Upstream commit bc4f359b3b607daac0290d0038561237a86b38cb ]
+
+Overwriting the error code with the deletion result may cause the
+function to return 0 despite encountering an error. Commit b111545d26c0
+("tracing: Remove the useless value assignment in
+test_create_synth_event()") solves a similar issue by
+returning the original error code, so this patch does the same.
+
+Found by Linux Verification Center (linuxtesting.org) with SVACE.
+
+Link: https://lore.kernel.org/linux-trace-kernel/20230131075818.5322-1-aagusev@ispras.ru
+
+Signed-off-by: Anton Gusev <aagusev@ispras.ru>
+Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ kernel/trace/kprobe_event_gen_test.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/kernel/trace/kprobe_event_gen_test.c b/kernel/trace/kprobe_event_gen_test.c
+index c736487fc0e48..e0c420eb0b2b4 100644
+--- a/kernel/trace/kprobe_event_gen_test.c
++++ b/kernel/trace/kprobe_event_gen_test.c
+@@ -146,7 +146,7 @@ static int __init test_gen_kprobe_cmd(void)
+       if (trace_event_file_is_valid(gen_kprobe_test))
+               gen_kprobe_test = NULL;
+       /* We got an error after creating the event, delete it */
+-      ret = kprobe_event_delete("gen_kprobe_test");
++      kprobe_event_delete("gen_kprobe_test");
+       goto out;
+ }
+@@ -211,7 +211,7 @@ static int __init test_gen_kretprobe_cmd(void)
+       if (trace_event_file_is_valid(gen_kretprobe_test))
+               gen_kretprobe_test = NULL;
+       /* We got an error after creating the event, delete it */
+-      ret = kprobe_event_delete("gen_kretprobe_test");
++      kprobe_event_delete("gen_kretprobe_test");
+       goto out;
+ }
+-- 
+2.39.2
+