]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
Fixes for 4.14
authorSasha Levin <sashal@kernel.org>
Sun, 26 Feb 2023 15:46:07 +0000 (10:46 -0500)
committerSasha Levin <sashal@kernel.org>
Sun, 26 Feb 2023 15:46:07 +0000 (10:46 -0500)
Signed-off-by: Sasha Levin <sashal@kernel.org>
queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch [new file with mode: 0644]
queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch [new file with mode: 0644]
queue-4.14/ib-hfi1-assign-npages-earlier.patch [new file with mode: 0644]
queue-4.14/series [new file with mode: 0644]

diff --git a/queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch b/queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch
new file mode 100644 (file)
index 0000000..5182d68
--- /dev/null
@@ -0,0 +1,36 @@
+From cd3910ec89b9ff4f29b87d065e55dcf567efb99f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 28 Dec 2022 21:17:32 +0100
+Subject: ARM: dts: rockchip: add power-domains property to dp node on rk3288
+
+From: Johan Jonker <jbx6244@gmail.com>
+
+[ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ]
+
+The clocks in the Rockchip rk3288 DisplayPort node are
+included in the power-domain@RK3288_PD_VIO logic, but the
+power-domains property in the dp node is missing, so fix it.
+
+Signed-off-by: Johan Jonker <jbx6244@gmail.com>
+Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/arm/boot/dts/rk3288.dtsi | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi
+index 872e4e690beb4..c3440adc763ce 100644
+--- a/arch/arm/boot/dts/rk3288.dtsi
++++ b/arch/arm/boot/dts/rk3288.dtsi
+@@ -1096,6 +1096,7 @@ edp: dp@ff970000 {
+               clock-names = "dp", "pclk";
+               phys = <&edp_phy>;
+               phy-names = "dp";
++              power-domains = <&power RK3288_PD_VIO>;
+               resets = <&cru SRST_EDP>;
+               reset-names = "dp";
+               rockchip,grf = <&grf>;
+-- 
+2.39.0
+
diff --git a/queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch b/queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch
new file mode 100644 (file)
index 0000000..1db30de
--- /dev/null
@@ -0,0 +1,44 @@
+From 4b0b282be1d536a5aa6e0cacf61b6294050d1a48 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 24 Jan 2023 20:32:10 +0100
+Subject: btrfs: send: limit number of clones and allocated memory size
+
+From: David Sterba <dsterba@suse.com>
+
+[ Upstream commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 ]
+
+The arg->clone_sources_count is u64 and can trigger a warning when a
+huge value is passed from user space and a huge array is allocated.
+Limit the allocated memory to 8MiB (can be increased if needed), which
+in turn limits the number of clone sources to 8M / sizeof(struct
+clone_root) = 8M / 40 = 209715.  Real world number of clones is from
+tens to hundreds, so this is future proof.
+
+Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ fs/btrfs/send.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
+index efab9446eac87..b08e7fcd8c34d 100644
+--- a/fs/btrfs/send.c
++++ b/fs/btrfs/send.c
+@@ -6646,10 +6646,10 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_)
+       /*
+        * Check that we don't overflow at later allocations, we request
+        * clone_sources_count + 1 items, and compare to unsigned long inside
+-       * access_ok.
++       * access_ok. Also set an upper limit for allocation size so this can't
++       * easily exhaust memory. Max number of clone sources is about 200K.
+        */
+-      if (arg->clone_sources_count >
+-          ULONG_MAX / sizeof(struct clone_root) - 1) {
++      if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) {
+               ret = -EINVAL;
+               goto out;
+       }
+-- 
+2.39.0
+
diff --git a/queue-4.14/ib-hfi1-assign-npages-earlier.patch b/queue-4.14/ib-hfi1-assign-npages-earlier.patch
new file mode 100644 (file)
index 0000000..d00f41d
--- /dev/null
@@ -0,0 +1,64 @@
+From 87b49a180348b1097316f07b46a3286c4a995346 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Mon, 9 Jan 2023 14:04:08 -0500
+Subject: IB/hfi1: Assign npages earlier
+
+From: Dean Luick <dean.luick@cornelisnetworks.com>
+
+[ Upstream commit f9c47b2caa7ffc903ec950b454b59c209afe3182 ]
+
+Improve code clarity and enable earlier use of
+tidbuf->npages by moving its assignment to
+structure creation time.
+
+Signed-off-by: Dean Luick <dean.luick@cornelisnetworks.com>
+Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
+Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+index b17c1fc59f7e4..1987bb8412a23 100644
+--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c
++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c
+@@ -213,16 +213,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd,
+ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+ {
+       int pinned;
+-      unsigned int npages;
++      unsigned int npages = tidbuf->npages;
+       unsigned long vaddr = tidbuf->vaddr;
+       struct page **pages = NULL;
+       struct hfi1_devdata *dd = fd->uctxt->dd;
+-      /* Get the number of pages the user buffer spans */
+-      npages = num_user_pages(vaddr, tidbuf->length);
+-      if (!npages)
+-              return -EINVAL;
+-
+       if (npages > fd->uctxt->expected_count) {
+               dd_dev_err(dd, "Expected buffer too big\n");
+               return -EINVAL;
+@@ -256,7 +251,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf)
+               return pinned;
+       }
+       tidbuf->pages = pages;
+-      tidbuf->npages = npages;
+       fd->tid_n_pinned += pinned;
+       return pinned;
+ }
+@@ -332,6 +326,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd,
+       tidbuf->vaddr = tinfo->vaddr;
+       tidbuf->length = tinfo->length;
++      tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length);
+       tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets),
+                               GFP_KERNEL);
+       if (!tidbuf->psets) {
+-- 
+2.39.0
+
diff --git a/queue-4.14/series b/queue-4.14/series
new file mode 100644 (file)
index 0000000..ed8db85
--- /dev/null
@@ -0,0 +1,3 @@
+arm-dts-rockchip-add-power-domains-property-to-dp-no.patch
+btrfs-send-limit-number-of-clones-and-allocated-memo.patch
+ib-hfi1-assign-npages-earlier.patch