--- /dev/null
+From 37309f47e2f5674f3e86cb765312ace42cfcedf5 Mon Sep 17 00:00:00 2001
+From: Ping Cheng <pinglinux@gmail.com>
+Date: Wed, 9 Dec 2020 20:52:30 -0800
+Subject: HID: wacom: Fix memory leakage caused by kfifo_alloc
+
+From: Ping Cheng <pinglinux@gmail.com>
+
+commit 37309f47e2f5674f3e86cb765312ace42cfcedf5 upstream.
+
+As reported by syzbot below, kfifo_alloc'd memory would not be freed
+if a non-zero return value is triggered in wacom_probe. This patch
+creates and uses devm_kfifo_alloc to allocate and free itself.
+
+BUG: memory leak
+unreferenced object 0xffff88810dc44a00 (size 512):
+ comm "kworker/1:2", pid 3674, jiffies 4294943617 (age 14.100s)
+ hex dump (first 32 bytes):
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
+ backtrace:
+ [<0000000023e1afac>] kmalloc_array include/linux/slab.h:592 [inline]
+ [<0000000023e1afac>] __kfifo_alloc+0xad/0x100 lib/kfifo.c:43
+ [<00000000c477f737>] wacom_probe+0x1a1/0x3b0 drivers/hid/wacom_sys.c:2727
+ [<00000000b3109aca>] hid_device_probe+0x16b/0x210 drivers/hid/hid-core.c:2281
+ [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554
+ [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
+ [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
+ [<00000000efb7c59e>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431
+ [<0000000024ab1590>] __device_attach+0x122/0x250 drivers/base/dd.c:912
+ [<000000004c7ac048>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491
+ [<00000000b93050a3>] device_add+0x5ac/0xc30 drivers/base/core.c:2936
+ [<00000000e5b46ea5>] hid_add_device+0x151/0x390 drivers/hid/hid-core.c:2437
+ [<00000000c6add147>] usbhid_probe+0x412/0x560 drivers/hid/usbhid/hid-core.c:1407
+ [<00000000c33acdb4>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
+ [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554
+ [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738
+ [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844
+
+https://syzkaller.appspot.com/bug?extid=5b49c9695968d7250a26
+
+Reported-by: syzbot+5b49c9695968d7250a26@syzkaller.appspotmail.com
+Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
+Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hid/wacom_sys.c | 35 ++++++++++++++++++++++++++++++++---
+ 1 file changed, 32 insertions(+), 3 deletions(-)
+
+--- a/drivers/hid/wacom_sys.c
++++ b/drivers/hid/wacom_sys.c
+@@ -1270,6 +1270,37 @@ static int wacom_devm_sysfs_create_group
+ group);
+ }
+
++static void wacom_devm_kfifo_release(struct device *dev, void *res)
++{
++ struct kfifo_rec_ptr_2 *devres = res;
++
++ kfifo_free(devres);
++}
++
++static int wacom_devm_kfifo_alloc(struct wacom *wacom)
++{
++ struct wacom_wac *wacom_wac = &wacom->wacom_wac;
++ struct kfifo_rec_ptr_2 *pen_fifo = &wacom_wac->pen_fifo;
++ int error;
++
++ pen_fifo = devres_alloc(wacom_devm_kfifo_release,
++ sizeof(struct kfifo_rec_ptr_2),
++ GFP_KERNEL);
++
++ if (!pen_fifo)
++ return -ENOMEM;
++
++ error = kfifo_alloc(pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
++ if (error) {
++ devres_free(pen_fifo);
++ return error;
++ }
++
++ devres_add(&wacom->hdev->dev, pen_fifo);
++
++ return 0;
++}
++
+ enum led_brightness wacom_leds_brightness_get(struct wacom_led *led)
+ {
+ struct wacom *wacom = led->wacom;
+@@ -2724,7 +2755,7 @@ static int wacom_probe(struct hid_device
+ if (features->check_for_hid_type && features->hid_type != hdev->type)
+ return -ENODEV;
+
+- error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL);
++ error = wacom_devm_kfifo_alloc(wacom);
+ if (error)
+ return error;
+
+@@ -2786,8 +2817,6 @@ static void wacom_remove(struct hid_devi
+
+ if (wacom->wacom_wac.features.type != REMOTE)
+ wacom_release_resources(wacom);
+-
+- kfifo_free(&wacom_wac->pen_fifo);
+ }
+
+ #ifdef CONFIG_PM
--- /dev/null
+From 8f56bc4dc1011be6e2a53198b615fdc588b4ef6a Mon Sep 17 00:00:00 2001
+From: Shannon Nelson <snelson@pensando.io>
+Date: Thu, 12 Nov 2020 10:22:01 -0800
+Subject: ionic: start queues before announcing link up
+
+From: Shannon Nelson <snelson@pensando.io>
+
+commit 8f56bc4dc1011be6e2a53198b615fdc588b4ef6a upstream.
+
+Change the order of operations in the link_up handling to be
+sure that the queues are up and ready before we announce that
+the link is up.
+
+Signed-off-by: Shannon Nelson <snelson@pensando.io>
+Reviewed-by: Saeed Mahameed <saeedm@nvidia.com>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
+@@ -123,6 +123,12 @@ static void ionic_link_status_check(stru
+ link_up = link_status == IONIC_PORT_OPER_STATUS_UP;
+
+ if (link_up) {
++ if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) {
++ mutex_lock(&lif->queue_lock);
++ ionic_start_queues(lif);
++ mutex_unlock(&lif->queue_lock);
++ }
++
+ if (!netif_carrier_ok(netdev)) {
+ u32 link_speed;
+
+@@ -132,12 +138,6 @@ static void ionic_link_status_check(stru
+ link_speed / 1000);
+ netif_carrier_on(netdev);
+ }
+-
+- if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) {
+- mutex_lock(&lif->queue_lock);
+- ionic_start_queues(lif);
+- mutex_unlock(&lif->queue_lock);
+- }
+ } else {
+ if (netif_carrier_ok(netdev)) {
+ netdev_info(netdev, "Link down\n");
--- /dev/null
+From 6998ff4e21619d47ebf4f5eb4cafa65c65856221 Mon Sep 17 00:00:00 2001
+From: James Smart <james.smart@broadcom.com>
+Date: Thu, 19 Nov 2020 12:34:07 -0800
+Subject: scsi: lpfc: Fix variable 'vport' set but not used in lpfc_sli4_abts_err_handler()
+
+From: James Smart <james.smart@broadcom.com>
+
+commit 6998ff4e21619d47ebf4f5eb4cafa65c65856221 upstream.
+
+Remove vport variable that is assigned but not used in
+lpfc_sli4_abts_err_handler().
+
+Link: https://lore.kernel.org/r/20201119203407.121913-1-james.smart@broadcom.com
+Fixes: e7dab164a9aa ("scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi")
+Reported-by: kernel test robot <lkp@intel.com>
+Signed-off-by: James Smart <james.smart@broadcom.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_sli.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -10459,7 +10459,6 @@ lpfc_sli4_abts_err_handler(struct lpfc_h
+ struct lpfc_nodelist *ndlp,
+ struct sli4_wcqe_xri_aborted *axri)
+ {
+- struct lpfc_vport *vport;
+ uint32_t ext_status = 0;
+
+ if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) {
+@@ -10469,7 +10468,6 @@ lpfc_sli4_abts_err_handler(struct lpfc_h
+ return;
+ }
+
+- vport = ndlp->vport;
+ lpfc_printf_log(phba, KERN_WARNING, LOG_SLI,
+ "3116 Port generated FCP XRI ABORT event on "
+ "vpi %d rpi %d xri x%x status 0x%x parameter x%x\n",
projects / thirdparty / kernel / stable-queue.git / commitdiff
