--- /dev/null
+From 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 Mon Sep 17 00:00:00 2001
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+Date: Wed, 14 Jul 2021 13:16:02 +0200
+Subject: can: j1939: j1939_session_deactivate(): clarify lifetime of session object
+
+From: Oleksij Rempel <o.rempel@pengutronix.de>
+
+commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 upstream.
+
+The j1939_session_deactivate() is decrementing the session ref-count and
+potentially can free() the session. This would cause use-after-free
+situation.
+
+However, the code calling j1939_session_deactivate() does always hold
+another reference to the session, so that it would not be free()ed in
+this code path.
+
+This patch adds a comment to make this clear and a WARN_ON, to ensure
+that future changes will not violate this requirement. Further this
+patch avoids dereferencing the session pointer as a precaution to avoid
+use-after-free if the session is actually free()ed.
+
+Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol")
+Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de
+Reported-by: Xiaochen Zou <xzou017@ucr.edu>
+Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/can/j1939/transport.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/net/can/j1939/transport.c
++++ b/net/can/j1939/transport.c
+@@ -1075,11 +1075,16 @@ static bool j1939_session_deactivate_loc
+
+ static bool j1939_session_deactivate(struct j1939_session *session)
+ {
++ struct j1939_priv *priv = session->priv;
+ bool active;
+
+- j1939_session_list_lock(session->priv);
++ j1939_session_list_lock(priv);
++ /* This function should be called with a session ref-count of at
++ * least 2.
++ */
++ WARN_ON_ONCE(kref_read(&session->kref) < 2);
+ active = j1939_session_deactivate_locked(session);
+- j1939_session_list_unlock(session->priv);
++ j1939_session_list_unlock(priv);
+
+ return active;
+ }
--- /dev/null
+From dc614c46178b0b89bde86ac54fc687a28580d2b7 Mon Sep 17 00:00:00 2001
+From: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+Date: Mon, 31 May 2021 16:55:49 +0000
+Subject: i40e: Add additional info to PHY type error
+
+From: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+
+commit dc614c46178b0b89bde86ac54fc687a28580d2b7 upstream.
+
+In case of PHY type error occurs, the message was too generic.
+Add additional info to PHY type error indicating that it can be
+wrong cable connected.
+
+Fixes: 124ed15bf126 ("i40e: Add dual speed module support")
+Signed-off-by: Lukasz Cieplicki <lukaszx.cieplicki@intel.com>
+Signed-off-by: Michal Maloszewski <michal.maloszewski@intel.com>
+Tested-by: Tony Brelinski <tonyx.brelinski@intel.com>
+Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c
+@@ -980,7 +980,7 @@ static void i40e_get_settings_link_up(st
+ default:
+ /* if we got here and link is up something bad is afoot */
+ netdev_info(netdev,
+- "WARNING: Link is up but PHY type 0x%x is not recognized.\n",
++ "WARNING: Link is up but PHY type 0x%x is not recognized, or incorrect cable is in use\n",
+ hw_link_info->phy_type);
+ }
+
--- /dev/null
+From d72e91efcae12f2f24ced984d00d60517c677857 Mon Sep 17 00:00:00 2001
+From: Sunil Goutham <sgoutham@marvell.com>
+Date: Thu, 22 Jul 2021 18:15:51 +0530
+Subject: octeontx2-af: Remove unnecessary devm_kfree
+
+From: Sunil Goutham <sgoutham@marvell.com>
+
+commit d72e91efcae12f2f24ced984d00d60517c677857 upstream.
+
+Remove devm_kfree of memory where VLAN entry to RVU PF mapping
+info is saved. This will be freed anyway at driver exit.
+Having this could result in warning from devm_kfree() if
+the memory is not allocated due to errors in rvu_nix_block_init()
+before nix_setup_txvlan().
+
+Fixes: 9a946def264d ("octeontx2-af: Modify nix_vtag_cfg mailbox to support TX VTAG entries")
+Signed-off-by: Sunil Goutham <sgoutham@marvell.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
+@@ -3587,7 +3587,6 @@ static void rvu_nix_block_freemem(struct
+ vlan = &nix_hw->txvlan;
+ kfree(vlan->rsrc.bmap);
+ mutex_destroy(&vlan->rsrc_lock);
+- devm_kfree(rvu->dev, vlan->entry2pfvf_map);
+
+ mcast = &nix_hw->mcast;
+ qmem_free(rvu->dev, mcast->mce_ctx);
--- /dev/null
+From c07d5c9226980ca5ae21c6a2714baa95be2ce164 Mon Sep 17 00:00:00 2001
+From: John Garry <john.garry@huawei.com>
+Date: Tue, 20 Jul 2021 23:10:19 +0800
+Subject: perf pmu: Fix alias matching
+
+From: John Garry <john.garry@huawei.com>
+
+commit c07d5c9226980ca5ae21c6a2714baa95be2ce164 upstream.
+
+Commit c47a5599eda324ba ("perf tools: Fix pattern matching for same
+substring in different PMU type"), may have fixed some alias matching,
+but has broken some others.
+
+Firstly it cannot handle the simple scenario of PMU name in form
+pmu_name{digits} - it can only handle pmu_name_{digits}.
+
+Secondly it cannot handle more complex matching in the case where we
+have multiple tokens. In this scenario, the code failed to realise that
+we may examine multiple substrings in the PMU name.
+
+Fix in two ways:
+
+- Change perf_pmu__valid_suffix() to accept a PMU name without '_' in the
+ suffix
+
+- Only pay attention to perf_pmu__valid_suffix() for the final token
+
+Also add const qualifiers as necessary to avoid casting.
+
+Fixes: c47a5599eda324ba ("perf tools: Fix pattern matching for same substring in different PMU type")
+Signed-off-by: John Garry <john.garry@huawei.com>
+Tested-by: Jin Yao <yao.jin@linux.intel.com>
+Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
+Cc: Ian Rogers <irogers@google.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Kajol Jain <kjain@linux.ibm.com>
+Cc: Mark Rutland <mark.rutland@arm.com>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Link: http://lore.kernel.org/lkml/1626793819-79090-1-git-send-email-john.garry@huawei.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/perf/util/pmu.c | 33 ++++++++++++++++++++++++---------
+ 1 file changed, 24 insertions(+), 9 deletions(-)
+
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -742,9 +742,13 @@ struct pmu_events_map *__weak pmu_events
+ return perf_pmu__find_map(NULL);
+ }
+
+-static bool perf_pmu__valid_suffix(char *pmu_name, char *tok)
++/*
++ * Suffix must be in form tok_{digits}, or tok{digits}, or same as pmu_name
++ * to be valid.
++ */
++static bool perf_pmu__valid_suffix(const char *pmu_name, char *tok)
+ {
+- char *p;
++ const char *p;
+
+ if (strncmp(pmu_name, tok, strlen(tok)))
+ return false;
+@@ -753,12 +757,16 @@ static bool perf_pmu__valid_suffix(char
+ if (*p == 0)
+ return true;
+
+- if (*p != '_')
+- return false;
++ if (*p == '_')
++ ++p;
+
+- ++p;
+- if (*p == 0 || !isdigit(*p))
+- return false;
++ /* Ensure we end in a number */
++ while (1) {
++ if (!isdigit(*p))
++ return false;
++ if (*(++p) == 0)
++ break;
++ }
+
+ return true;
+ }
+@@ -789,12 +797,19 @@ bool pmu_uncore_alias_match(const char *
+ * match "socket" in "socketX_pmunameY" and then "pmuname" in
+ * "pmunameY".
+ */
+- for (; tok; name += strlen(tok), tok = strtok_r(NULL, ",", &tmp)) {
++ while (1) {
++ char *next_tok = strtok_r(NULL, ",", &tmp);
++
+ name = strstr(name, tok);
+- if (!name || !perf_pmu__valid_suffix((char *)name, tok)) {
++ if (!name ||
++ (!next_tok && !perf_pmu__valid_suffix(name, tok))) {
+ res = false;
+ goto out;
+ }
++ if (!next_tok)
++ break;
++ tok = next_tok;
++ name += strlen(tok);
+ }
+
+ res = true;
powerpc-pseries-fix-regression-while-building-external-modules.patch
revert-perf-map-fix-dso-nsinfo-refcounting.patch
io_uring-fix-race-in-unified-task_work-running.patch
+i40e-add-additional-info-to-phy-type-error.patch
+can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch
+perf-pmu-fix-alias-matching.patch
+octeontx2-af-remove-unnecessary-devm_kfree.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
