From: Greg Kroah-Hartman Date: Sun, 5 Dec 2021 13:15:40 +0000 (+0100) Subject: 4.4-stable patches X-Git-Tag: v4.4.294~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=957d2dc12e3ec47b7c8a70c4e4856f5715c1c813;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: natsemi-xtensa-fix-section-mismatch-warnings.patch net-qlogic-qlcnic-fix-a-null-pointer-dereference-in-qlcnic_83xx_add_rings.patch siphash-use-_unaligned-version-by-default.patch --- diff --git a/queue-4.4/natsemi-xtensa-fix-section-mismatch-warnings.patch b/queue-4.4/natsemi-xtensa-fix-section-mismatch-warnings.patch new file mode 100644 index 00000000000..0c507a0c03e --- /dev/null +++ b/queue-4.4/natsemi-xtensa-fix-section-mismatch-warnings.patch @@ -0,0 +1,51 @@ +From b0f38e15979fa8851e88e8aa371367f264e7b6e9 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 29 Nov 2021 22:39:47 -0800 +Subject: natsemi: xtensa: fix section mismatch warnings + +From: Randy Dunlap + +commit b0f38e15979fa8851e88e8aa371367f264e7b6e9 upstream. + +Fix section mismatch warnings in xtsonic. The first one appears to be +bogus and after fixing the second one, the first one is gone. + +WARNING: modpost: vmlinux.o(.text+0x529adc): Section mismatch in reference from the function sonic_get_stats() to the function .init.text:set_reset_devices() +The function sonic_get_stats() references +the function __init set_reset_devices(). +This is often because sonic_get_stats lacks a __init +annotation or the annotation of set_reset_devices is wrong. + +WARNING: modpost: vmlinux.o(.text+0x529b3b): Section mismatch in reference from the function xtsonic_probe() to the function .init.text:sonic_probe1() +The function xtsonic_probe() references +the function __init sonic_probe1(). +This is often because xtsonic_probe lacks a __init +annotation or the annotation of sonic_probe1 is wrong. + +Fixes: 74f2a5f0ef64 ("xtensa: Add support for the Sonic Ethernet device for the XT2000 board.") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Christophe JAILLET +Cc: Finn Thain +Cc: Chris Zankel +Cc: linux-xtensa@linux-xtensa.org +Cc: Thomas Bogendoerfer +Acked-by: Max Filippov +Link: https://lore.kernel.org/r/20211130063947.7529-1-rdunlap@infradead.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/natsemi/xtsonic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/natsemi/xtsonic.c ++++ b/drivers/net/ethernet/natsemi/xtsonic.c +@@ -128,7 +128,7 @@ static const struct net_device_ops xtson + .ndo_set_mac_address = eth_mac_addr, + }; + +-static int __init sonic_probe1(struct net_device *dev) ++static int sonic_probe1(struct net_device *dev) + { + static unsigned version_printed = 0; + unsigned int silicon_revision; diff --git a/queue-4.4/net-qlogic-qlcnic-fix-a-null-pointer-dereference-in-qlcnic_83xx_add_rings.patch b/queue-4.4/net-qlogic-qlcnic-fix-a-null-pointer-dereference-in-qlcnic_83xx_add_rings.patch new file mode 100644 index 00000000000..a5608da666a --- /dev/null +++ b/queue-4.4/net-qlogic-qlcnic-fix-a-null-pointer-dereference-in-qlcnic_83xx_add_rings.patch @@ -0,0 +1,59 @@ +From e2dabc4f7e7b60299c20a36d6a7b24ed9bf8e572 Mon Sep 17 00:00:00 2001 +From: Zhou Qingyang +Date: Tue, 30 Nov 2021 19:08:48 +0800 +Subject: net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() + +From: Zhou Qingyang + +commit e2dabc4f7e7b60299c20a36d6a7b24ed9bf8e572 upstream. + +In qlcnic_83xx_add_rings(), the indirect function of +ahw->hw_ops->alloc_mbx_args will be called to allocate memory for +cmd.req.arg, and there is a dereference of it in qlcnic_83xx_add_rings(), +which could lead to a NULL pointer dereference on failure of the +indirect function like qlcnic_83xx_alloc_mbx_args(). + +Fix this bug by adding a check of alloc_mbx_args(), this patch +imitates the logic of mbx_cmd()'s failure handling. + +This bug was found by a static analyzer. The analysis employs +differential checking to identify inconsistent security operations +(e.g., checks or kfrees) between two code paths and confirms that the +inconsistent operations are not recovered in the current function or +the callers, so they constitute bugs. + +Note that, as a bug found by static analysis, it can be a false +positive or hard to trigger. Multiple researchers have cross-reviewed +the bug. + +Builds with CONFIG_QLCNIC=m show no new warnings, and our +static analyzer no longer warns about this code. + +Fixes: 7f9664525f9c ("qlcnic: 83xx memory map and HW access routine") +Signed-off-by: Zhou Qingyang +Link: https://lore.kernel.org/r/20211130110848.109026-1-zhou1615@umn.edu +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -1076,8 +1076,14 @@ static int qlcnic_83xx_add_rings(struct + sds_mbx_size = sizeof(struct qlcnic_sds_mbx); + context_id = recv_ctx->context_id; + num_sds = adapter->drv_sds_rings - QLCNIC_MAX_SDS_RINGS; +- ahw->hw_ops->alloc_mbx_args(&cmd, adapter, +- QLCNIC_CMD_ADD_RCV_RINGS); ++ err = ahw->hw_ops->alloc_mbx_args(&cmd, adapter, ++ QLCNIC_CMD_ADD_RCV_RINGS); ++ if (err) { ++ dev_err(&adapter->pdev->dev, ++ "Failed to alloc mbx args %d\n", err); ++ return err; ++ } ++ + cmd.req.arg[1] = 0 | (num_sds << 8) | (context_id << 16); + + /* set up status rings, mbx 2-81 */ diff --git a/queue-4.4/series b/queue-4.4/series index 70cc12836b5..9491ba1cfaf 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -43,3 +43,6 @@ sata_fsl-fix-uaf-in-sata_fsl_port_stop-when-rmmod-sata_fsl.patch sata_fsl-fix-warning-in-remove_proc_entry-when-rmmod-sata_fsl.patch fs-add-fget_many-and-fput_many.patch fget-check-that-the-fd-still-exists-after-getting-a-ref-to-it.patch +natsemi-xtensa-fix-section-mismatch-warnings.patch +net-qlogic-qlcnic-fix-a-null-pointer-dereference-in-qlcnic_83xx_add_rings.patch +siphash-use-_unaligned-version-by-default.patch diff --git a/queue-4.4/siphash-use-_unaligned-version-by-default.patch b/queue-4.4/siphash-use-_unaligned-version-by-default.patch new file mode 100644 index 00000000000..2a07f2712a3 --- /dev/null +++ b/queue-4.4/siphash-use-_unaligned-version-by-default.patch @@ -0,0 +1,185 @@ +From f7e5b9bfa6c8820407b64eabc1f29c9a87e8993d Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 29 Nov 2021 10:39:29 -0500 +Subject: siphash: use _unaligned version by default + +From: Arnd Bergmann + +commit f7e5b9bfa6c8820407b64eabc1f29c9a87e8993d upstream. + +On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +because the ordinary load/store instructions (ldr, ldrh, ldrb) can +tolerate any misalignment of the memory address. However, load/store +double and load/store multiple instructions (ldrd, ldm) may still only +be used on memory addresses that are 32-bit aligned, and so we have to +use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we +may end up with a severe performance hit due to alignment traps that +require fixups by the kernel. Testing shows that this currently happens +with clang-13 but not gcc-11. In theory, any compiler version can +produce this bug or other problems, as we are dealing with undefined +behavior in C99 even on architectures that support this in hardware, +see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363. + +Fortunately, the get_unaligned() accessors do the right thing: when +building for ARMv6 or later, the compiler will emit unaligned accesses +using the ordinary load/store instructions (but avoid the ones that +require 32-bit alignment). When building for older ARM, those accessors +will emit the appropriate sequence of ldrb/mov/orr instructions. And on +architectures that can truly tolerate any kind of misalignment, the +get_unaligned() accessors resolve to the leXX_to_cpup accessors that +operate on aligned addresses. + +Since the compiler will in fact emit ldrd or ldm instructions when +building this code for ARM v6 or later, the solution is to use the +unaligned accessors unconditionally on architectures where this is +known to be fast. The _aligned version of the hash function is +however still needed to get the best performance on architectures +that cannot do any unaligned access in hardware. + +This new version avoids the undefined behavior and should produce +the fastest hash on all architectures we support. + +Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/ +Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/ +Reported-by: Ard Biesheuvel +Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF") +Signed-off-by: Arnd Bergmann +Reviewed-by: Jason A. Donenfeld +Acked-by: Ard Biesheuvel +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + include/linux/siphash.h | 14 ++++---------- + lib/siphash.c | 12 ++++++------ + 2 files changed, 10 insertions(+), 16 deletions(-) + +--- a/include/linux/siphash.h ++++ b/include/linux/siphash.h +@@ -27,9 +27,7 @@ static inline bool siphash_key_is_zero(c + } + + u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key); +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key); +-#endif + + u64 siphash_1u64(const u64 a, const siphash_key_t *key); + u64 siphash_2u64(const u64 a, const u64 b, const siphash_key_t *key); +@@ -82,10 +80,9 @@ static inline u64 ___siphash_aligned(con + static inline u64 siphash(const void *data, size_t len, + const siphash_key_t *key) + { +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +- if (!IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT)) ++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) || ++ !IS_ALIGNED((unsigned long)data, SIPHASH_ALIGNMENT)) + return __siphash_unaligned(data, len, key); +-#endif + return ___siphash_aligned(data, len, key); + } + +@@ -96,10 +93,8 @@ typedef struct { + + u32 __hsiphash_aligned(const void *data, size_t len, + const hsiphash_key_t *key); +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key); +-#endif + + u32 hsiphash_1u32(const u32 a, const hsiphash_key_t *key); + u32 hsiphash_2u32(const u32 a, const u32 b, const hsiphash_key_t *key); +@@ -135,10 +130,9 @@ static inline u32 ___hsiphash_aligned(co + static inline u32 hsiphash(const void *data, size_t len, + const hsiphash_key_t *key) + { +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS +- if (!IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT)) ++ if (IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) || ++ !IS_ALIGNED((unsigned long)data, HSIPHASH_ALIGNMENT)) + return __hsiphash_unaligned(data, len, key); +-#endif + return ___hsiphash_aligned(data, len, key); + } + +--- a/lib/siphash.c ++++ b/lib/siphash.c +@@ -49,6 +49,7 @@ + SIPROUND; \ + return (v0 ^ v1) ^ (v2 ^ v3); + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -80,8 +81,8 @@ u64 __siphash_aligned(const void *data, + POSTAMBLE + } + EXPORT_SYMBOL(__siphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -113,7 +114,6 @@ u64 __siphash_unaligned(const void *data + POSTAMBLE + } + EXPORT_SYMBOL(__siphash_unaligned); +-#endif + + /** + * siphash_1u64 - compute 64-bit siphash PRF value of a u64 +@@ -250,6 +250,7 @@ EXPORT_SYMBOL(siphash_3u32); + HSIPROUND; \ + return (v0 ^ v1) ^ (v2 ^ v3); + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u64)); +@@ -280,8 +281,8 @@ u32 __hsiphash_aligned(const void *data, + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key) + { +@@ -313,7 +314,6 @@ u32 __hsiphash_unaligned(const void *dat + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_unaligned); +-#endif + + /** + * hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32 +@@ -418,6 +418,7 @@ EXPORT_SYMBOL(hsiphash_4u32); + HSIPROUND; \ + return v1 ^ v3; + ++#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key) + { + const u8 *end = data + len - (len % sizeof(u32)); +@@ -438,8 +439,8 @@ u32 __hsiphash_aligned(const void *data, + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_aligned); ++#endif + +-#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS + u32 __hsiphash_unaligned(const void *data, size_t len, + const hsiphash_key_t *key) + { +@@ -461,7 +462,6 @@ u32 __hsiphash_unaligned(const void *dat + HPOSTAMBLE + } + EXPORT_SYMBOL(__hsiphash_unaligned); +-#endif + + /** + * hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32