Fixes for 5.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-5.4/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch b/queue-5.4/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
new file mode 100644 (file)
index 0000000..7b0a056
--- /dev/null
+++ b/queue-5.4/net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
@@ -0,0 +1,37 @@
+From 5a9b222c5f6e5ce44fb1a6e5635c9831e53cef52 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Fri, 25 Feb 2022 04:37:27 -0800
+Subject: net: chelsio: cxgb3: check the return value of pci_find_capability()
+
+From: Jia-Ju Bai <baijiaju1990@gmail.com>
+
+[ Upstream commit 767b9825ed1765894e569a3d698749d40d83762a ]
+
+The function pci_find_capability() in t3_prep_adapter() can fail, so its
+return value should be checked.
+
+Fixes: 4d22de3e6cc4 ("Add support for the latest 1G/10G Chelsio adapter, T3")
+Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
+Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/chelsio/cxgb3/t3_hw.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+index 0a9f2c596624..d3e11fe1eabc 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/t3_hw.c
+@@ -3677,6 +3677,8 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
+           MAC_STATS_ACCUM_SECS : (MAC_STATS_ACCUM_SECS * 10);
+       adapter->params.pci.vpd_cap_addr =
+           pci_find_capability(adapter->pdev, PCI_CAP_ID_VPD);
++      if (!adapter->params.pci.vpd_cap_addr)
++              return -ENODEV;
+       ret = get_vpd_params(adapter, &adapter->params.vpd);
+       if (ret < 0)
+               return ret;
+-- 
+2.34.1
+

diff --git a/queue-5.4/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch b/queue-5.4/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch
new file mode 100644 (file)
index 0000000..7f365a0
--- /dev/null
+++ b/queue-5.4/nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch
@@ -0,0 +1,54 @@
+From 9b14188279ec0ec1d226589e5e1c59e317176245 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Tue, 1 Mar 2022 18:00:20 +0800
+Subject: nl80211: Handle nla_memdup failures in handle_nan_filter
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit 6ad27f522cb3b210476daf63ce6ddb6568c0508b ]
+
+As there's potential for failure of the nla_memdup(),
+check the return value.
+
+Fixes: a442b761b24b ("cfg80211: add add_nan_func / del_nan_func")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Link: https://lore.kernel.org/r/20220301100020.3801187-1-jiasheng@iscas.ac.cn
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/wireless/nl80211.c | 12 ++++++++++++
+ 1 file changed, 12 insertions(+)
+
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7633d6a74bc2..f2bc465de284 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -12320,6 +12320,9 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+       i = 0;
+       nla_for_each_nested(attr, attr_filter, rem) {
+               filter[i].filter = nla_memdup(attr, GFP_KERNEL);
++              if (!filter[i].filter)
++                      goto err;
++
+               filter[i].len = nla_len(attr);
+               i++;
+       }
+@@ -12332,6 +12335,15 @@ static int handle_nan_filter(struct nlattr *attr_filter,
+       }
+ 
+       return 0;
++
++err:
++      i = 0;
++      nla_for_each_nested(attr, attr_filter, rem) {
++              kfree(filter[i].filter);
++              i++;
++      }
++      kfree(filter);
++      return -ENOMEM;
+ }
+ 
+ static int nl80211_nan_add_func(struct sk_buff *skb,
+-- 
+2.34.1
+

diff --git a/queue-5.4/series b/queue-5.4/series
index 738ba849ad373a7012ec30a009bcab3269299483..abeb59e3603ab26399e9af6f7522b052d8006968 100644 (file)
--- a/queue-5.4/series
+++ b/queue-5.4/series
@@ -48,3 +48,6 @@ arm-9182-1-mmu-fix-returns-from-early_param-and-__setup-functions.patch
 igc-igc_write_phy_reg_gpy-drop-premature-return.patch
 ibmvnic-free-reset-work-item-when-flushing.patch
 memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch
+soc-fsl-qe-check-of-ioremap-return-value.patch
+net-chelsio-cxgb3-check-the-return-value-of-pci_find.patch
+nl80211-handle-nla_memdup-failures-in-handle_nan_fil.patch

diff --git a/queue-5.4/soc-fsl-qe-check-of-ioremap-return-value.patch b/queue-5.4/soc-fsl-qe-check-of-ioremap-return-value.patch
new file mode 100644 (file)
index 0000000..7ba4ed0
--- /dev/null
+++ b/queue-5.4/soc-fsl-qe-check-of-ioremap-return-value.patch
@@ -0,0 +1,43 @@
+From 844298df2b71ef529e68086e65db015c7f0c07d4 Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 30 Dec 2021 09:45:43 +0800
+Subject: soc: fsl: qe: Check of ioremap return value
+
+From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+
+[ Upstream commit a222fd8541394b36b13c89d1698d9530afd59a9c ]
+
+As the possible failure of the ioremap(), the par_io could be NULL.
+Therefore it should be better to check it and return error in order to
+guarantee the success of the initiation.
+But, I also notice that all the caller like mpc85xx_qe_par_io_init() in
+`arch/powerpc/platforms/85xx/common.c` don't check the return value of
+the par_io_init().
+Actually, par_io_init() needs to check to handle the potential error.
+I will submit another patch to fix that.
+Anyway, par_io_init() itsely should be fixed.
+
+Fixes: 7aa1aa6ecec2 ("QE: Move QE from arch/powerpc to drivers/soc")
+Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
+Signed-off-by: Li Yang <leoyang.li@nxp.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/soc/fsl/qe/qe_io.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/drivers/soc/fsl/qe/qe_io.c b/drivers/soc/fsl/qe/qe_io.c
+index 3657e296a8a2..058c2fec9a4b 100644
+--- a/drivers/soc/fsl/qe/qe_io.c
++++ b/drivers/soc/fsl/qe/qe_io.c
+@@ -37,6 +37,8 @@ int par_io_init(struct device_node *np)
+       if (ret)
+               return ret;
+       par_io = ioremap(res.start, resource_size(&res));
++      if (!par_io)
++              return -ENOMEM;
+ 
+       num_ports = of_get_property(np, "num-ports", NULL);
+       if (num_ports)
+-- 
+2.34.1
+