From: Greg Kroah-Hartman Date: Mon, 11 Apr 2022 08:26:52 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.310~69 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0d87680d59cf036132ea0bafef761b1d6fd3378a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: ata-sata_dwc_460ex-fix-crash-due-to-oob-write.patch irqchip-gic-v3-fix-gicr_ctlr.rwp-polling.patch perf-qcom_l2_pmu-fix-an-incorrect-null-check-on-list-iterator.patch --- diff --git a/queue-4.19/ata-sata_dwc_460ex-fix-crash-due-to-oob-write.patch b/queue-4.19/ata-sata_dwc_460ex-fix-crash-due-to-oob-write.patch new file mode 100644 index 00000000000..98b4ec9a595 --- /dev/null +++ b/queue-4.19/ata-sata_dwc_460ex-fix-crash-due-to-oob-write.patch @@ -0,0 +1,83 @@ +From 7aa8104a554713b685db729e66511b93d989dd6a Mon Sep 17 00:00:00 2001 +From: Christian Lamparter +Date: Sat, 19 Mar 2022 21:11:02 +0100 +Subject: ata: sata_dwc_460ex: Fix crash due to OOB write + +From: Christian Lamparter + +commit 7aa8104a554713b685db729e66511b93d989dd6a upstream. + +the driver uses libata's "tag" values from in various arrays. +Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32, +the value of the SATA_DWC_QCMD_MAX needs to account for that. + +Otherwise ATA_TAG_INTERNAL usage cause similar crashes like +this as reported by Tice Rex on the OpenWrt Forum and +reproduced (with symbols) here: + +| BUG: Kernel NULL pointer dereference at 0x00000000 +| Faulting instruction address: 0xc03ed4b8 +| Oops: Kernel access of bad area, sig: 11 [#1] +| BE PAGE_SIZE=4K PowerPC 44x Platform +| CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0 +| NIP: c03ed4b8 LR: c03d27e8 CTR: c03ed36c +| REGS: cfa59950 TRAP: 0300 Not tainted (5.4.163) +| MSR: 00021000 CR: 42000222 XER: 00000000 +| DEAR: 00000000 ESR: 00000000 +| GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...] +| [..] +| NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254 +| LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc +| Call Trace: +| [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable) +| [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc +| [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524 +| [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0 +| [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204 +| [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130 +| [...] + +This is because sata_dwc_dma_xfer_complete() NULLs the +dma_pending's next neighbour "chan" (a *dma_chan struct) in +this '32' case right here (line ~735): +> hsdevp->dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE; + +Then the next time, a dma gets issued; dma_dwc_xfer_setup() passes +the NULL'd hsdevp->chan to the dmaengine_slave_config() which then +causes the crash. + +With this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1. +This avoids the OOB. But please note, there was a worthwhile discussion +on what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not +be a "fake" 33 command-long queue size. + +Ideally, the dw driver should account for the ATA_TAG_INTERNAL. +In Damien Le Moal's words: "... having looked at the driver, it +is a bigger change than just faking a 33rd "tag" that is in fact +not a command tag at all." + +Fixes: 28361c403683c ("libata: add extra internal command") +Cc: stable@kernel.org # 4.18+ +BugLink: https://github.com/openwrt/openwrt/issues/9505 +Signed-off-by: Christian Lamparter +Signed-off-by: Damien Le Moal +Signed-off-by: Greg Kroah-Hartman +--- + drivers/ata/sata_dwc_460ex.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -149,7 +149,11 @@ struct sata_dwc_device { + #endif + }; + +-#define SATA_DWC_QCMD_MAX 32 ++/* ++ * Allow one extra special slot for commands and DMA management ++ * to account for libata internal commands. ++ */ ++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) + + struct sata_dwc_device_port { + struct sata_dwc_device *hsdev; diff --git a/queue-4.19/irqchip-gic-v3-fix-gicr_ctlr.rwp-polling.patch b/queue-4.19/irqchip-gic-v3-fix-gicr_ctlr.rwp-polling.patch new file mode 100644 index 00000000000..5d8da833ca7 --- /dev/null +++ b/queue-4.19/irqchip-gic-v3-fix-gicr_ctlr.rwp-polling.patch @@ -0,0 +1,61 @@ +From 0df6664531a12cdd8fc873f0cac0dcb40243d3e9 Mon Sep 17 00:00:00 2001 +From: Marc Zyngier +Date: Tue, 15 Mar 2022 16:50:32 +0000 +Subject: irqchip/gic-v3: Fix GICR_CTLR.RWP polling + +From: Marc Zyngier + +commit 0df6664531a12cdd8fc873f0cac0dcb40243d3e9 upstream. + +It turns out that our polling of RWP is totally wrong when checking +for it in the redistributors, as we test the *distributor* bit index, +whereas it is a different bit number in the RDs... Oopsie boo. + +This is embarassing. Not only because it is wrong, but also because +it took *8 years* to notice the blunder... + +Just fix the damn thing. + +Fixes: 021f653791ad ("irqchip: gic-v3: Initial support for GICv3") +Signed-off-by: Marc Zyngier +Cc: stable@vger.kernel.org +Reviewed-by: Andre Przywara +Reviewed-by: Lorenzo Pieralisi +Link: https://lore.kernel.org/r/20220315165034.794482-2-maz@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/irqchip/irq-gic-v3.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -95,11 +95,11 @@ static inline void __iomem *gic_dist_bas + return NULL; + } + +-static void gic_do_wait_for_rwp(void __iomem *base) ++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) + { + u32 count = 1000000; /* 1s! */ + +- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { ++ while (readl_relaxed(base + GICD_CTLR) & bit) { + count--; + if (!count) { + pr_err_ratelimited("RWP timeout, gone fishing\n"); +@@ -113,13 +113,13 @@ static void gic_do_wait_for_rwp(void __i + /* Wait for completion of a distributor change */ + static void gic_dist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data.dist_base); ++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); + } + + /* Wait for completion of a redistributor change */ + static void gic_redist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); ++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); + } + + #ifdef CONFIG_ARM64 diff --git a/queue-4.19/perf-qcom_l2_pmu-fix-an-incorrect-null-check-on-list-iterator.patch b/queue-4.19/perf-qcom_l2_pmu-fix-an-incorrect-null-check-on-list-iterator.patch new file mode 100644 index 00000000000..a20453819bc --- /dev/null +++ b/queue-4.19/perf-qcom_l2_pmu-fix-an-incorrect-null-check-on-list-iterator.patch @@ -0,0 +1,53 @@ +From 2012a9e279013933885983cbe0a5fe828052563b Mon Sep 17 00:00:00 2001 +From: Xiaomeng Tong +Date: Sun, 27 Mar 2022 13:57:33 +0800 +Subject: perf: qcom_l2_pmu: fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +commit 2012a9e279013933885983cbe0a5fe828052563b upstream. + +The bug is here: + return cluster; + +The list iterator value 'cluster' will *always* be set and non-NULL +by list_for_each_entry(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty or no element +is found. + +To fix the bug, return 'cluster' when found, otherwise return NULL. + +Cc: stable@vger.kernel.org +Fixes: 21bdbb7102ed ("perf: add qcom l2 cache perf events driver") +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220327055733.4070-1-xiam0nd.tong@gmail.com +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + drivers/perf/qcom_l2_pmu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -797,7 +797,7 @@ static struct cluster_pmu *l2_cache_asso + { + u64 mpidr; + int cpu_cluster_id; +- struct cluster_pmu *cluster = NULL; ++ struct cluster_pmu *cluster; + + /* + * This assumes that the cluster_id is in MPIDR[aff1] for +@@ -819,10 +819,10 @@ static struct cluster_pmu *l2_cache_asso + cluster->cluster_id); + cpumask_set_cpu(cpu, &cluster->cluster_cpus); + *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; +- break; ++ return cluster; + } + +- return cluster; ++ return NULL; + } + + static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) diff --git a/queue-4.19/series b/queue-4.19/series index 46d5947e2ff..67f2a6f28ab 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -319,3 +319,6 @@ x86-pm-save-the-msr-validity-status-at-context-setup.patch x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch btrfs-fix-qgroup-reserve-overflow-the-qgroup-limit.patch arm64-patch_text-fixup-last-cpu-should-be-master.patch +ata-sata_dwc_460ex-fix-crash-due-to-oob-write.patch +perf-qcom_l2_pmu-fix-an-incorrect-null-check-on-list-iterator.patch +irqchip-gic-v3-fix-gicr_ctlr.rwp-polling.patch