From: Greg Kroah-Hartman Date: Mon, 24 Jan 2022 12:45:58 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.300~62 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=98f4cf3d443a1fc525d09cb63195cfa5de8d5bf3;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch clk-si5341-fix-clock-hw-provider-cleanup.patch f2fs-fix-to-reserve-space-for-io-align-feature.patch ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch --- diff --git a/queue-5.4/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch b/queue-5.4/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch new file mode 100644 index 00000000000..d5c086f093d --- /dev/null +++ b/queue-5.4/af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch @@ -0,0 +1,128 @@ +From 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Fri, 14 Jan 2022 08:43:28 -0800 +Subject: af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress + +From: Eric Dumazet + +commit 9d6d7f1cb67cdee15f1a0e85aacfb924e0e02435 upstream. + +wait_for_unix_gc() reads unix_tot_inflight & gc_in_progress +without synchronization. + +Adds READ_ONCE()/WRITE_ONCE() and their associated comments +to better document the intent. + +BUG: KCSAN: data-race in unix_inflight / wait_for_unix_gc + +write to 0xffffffff86e2b7c0 of 4 bytes by task 9380 on cpu 0: + unix_inflight+0x1e8/0x260 net/unix/scm.c:63 + unix_attach_fds+0x10c/0x1e0 net/unix/scm.c:121 + unix_scm_to_skb net/unix/af_unix.c:1674 [inline] + unix_dgram_sendmsg+0x679/0x16b0 net/unix/af_unix.c:1817 + unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 + __do_sys_sendmmsg net/socket.c:2578 [inline] + __se_sys_sendmmsg net/socket.c:2575 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffffffff86e2b7c0 of 4 bytes by task 9375 on cpu 1: + wait_for_unix_gc+0x24/0x160 net/unix/garbage.c:196 + unix_dgram_sendmsg+0x8e/0x16b0 net/unix/af_unix.c:1772 + unix_seqpacket_sendmsg+0xcc/0x110 net/unix/af_unix.c:2258 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg net/socket.c:724 [inline] + ____sys_sendmsg+0x39a/0x510 net/socket.c:2409 + ___sys_sendmsg net/socket.c:2463 [inline] + __sys_sendmmsg+0x267/0x4c0 net/socket.c:2549 + __do_sys_sendmmsg net/socket.c:2578 [inline] + __se_sys_sendmmsg net/socket.c:2575 [inline] + __x64_sys_sendmmsg+0x53/0x60 net/socket.c:2575 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x44/0xd0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00000002 -> 0x00000004 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 9375 Comm: syz-executor.1 Not tainted 5.16.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: 9915672d4127 ("af_unix: limit unix_tot_inflight") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20220114164328.2038499-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/unix/garbage.c | 14 +++++++++++--- + net/unix/scm.c | 6 ++++-- + 2 files changed, 15 insertions(+), 5 deletions(-) + +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -192,8 +192,11 @@ void wait_for_unix_gc(void) + { + /* If number of inflight sockets is insane, + * force a garbage collect right now. ++ * Paired with the WRITE_ONCE() in unix_inflight(), ++ * unix_notinflight() and gc_in_progress(). + */ +- if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress) ++ if (READ_ONCE(unix_tot_inflight) > UNIX_INFLIGHT_TRIGGER_GC && ++ !READ_ONCE(gc_in_progress)) + unix_gc(); + wait_event(unix_gc_wait, gc_in_progress == false); + } +@@ -213,7 +216,9 @@ void unix_gc(void) + if (gc_in_progress) + goto out; + +- gc_in_progress = true; ++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ ++ WRITE_ONCE(gc_in_progress, true); ++ + /* First, select candidates for garbage collection. Only + * in-flight sockets are considered, and from those only ones + * which don't have any external reference. +@@ -299,7 +304,10 @@ void unix_gc(void) + + /* All candidates should have been detached by now. */ + BUG_ON(!list_empty(&gc_candidates)); +- gc_in_progress = false; ++ ++ /* Paired with READ_ONCE() in wait_for_unix_gc(). */ ++ WRITE_ONCE(gc_in_progress, false); ++ + wake_up(&unix_gc_wait); + + out: +--- a/net/unix/scm.c ++++ b/net/unix/scm.c +@@ -59,7 +59,8 @@ void unix_inflight(struct user_struct *u + } else { + BUG_ON(list_empty(&u->link)); + } +- unix_tot_inflight++; ++ /* Paired with READ_ONCE() in wait_for_unix_gc() */ ++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1); + } + user->unix_inflight++; + spin_unlock(&unix_gc_lock); +@@ -79,7 +80,8 @@ void unix_notinflight(struct user_struct + + if (atomic_long_dec_and_test(&u->inflight)) + list_del_init(&u->link); +- unix_tot_inflight--; ++ /* Paired with READ_ONCE() in wait_for_unix_gc() */ ++ WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1); + } + user->unix_inflight--; + spin_unlock(&unix_gc_lock); diff --git a/queue-5.4/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch b/queue-5.4/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch new file mode 100644 index 00000000000..b4b5744c020 --- /dev/null +++ b/queue-5.4/bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch @@ -0,0 +1,41 @@ +From 48f5aef4c458c19ab337eed8c95a6486cc014aa3 Mon Sep 17 00:00:00 2001 +From: Quentin Monnet +Date: Wed, 10 Nov 2021 11:46:28 +0000 +Subject: bpftool: Remove inclusion of utilities.mak from Makefiles + +From: Quentin Monnet + +commit 48f5aef4c458c19ab337eed8c95a6486cc014aa3 upstream. + +Bpftool's Makefile, and the Makefile for its documentation, both include +scripts/utilities.mak, but they use none of the items defined in this +file. Remove the includes. + +Fixes: 71bb428fe2c1 ("tools: bpf: add bpftool") +Signed-off-by: Quentin Monnet +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20211110114632.24537-3-quentin@isovalent.com +Signed-off-by: Greg Kroah-Hartman +--- + tools/bpf/bpftool/Documentation/Makefile | 1 - + tools/bpf/bpftool/Makefile | 1 - + 2 files changed, 2 deletions(-) + +--- a/tools/bpf/bpftool/Documentation/Makefile ++++ b/tools/bpf/bpftool/Documentation/Makefile +@@ -1,6 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only + include ../../../scripts/Makefile.include +-include ../../../scripts/utilities.mak + + INSTALL ?= install + RM ?= rm -f +--- a/tools/bpf/bpftool/Makefile ++++ b/tools/bpf/bpftool/Makefile +@@ -1,6 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only + include ../../scripts/Makefile.include +-include ../../scripts/utilities.mak + + ifeq ($(srctree),) + srctree := $(patsubst %/,%,$(dir $(CURDIR))) diff --git a/queue-5.4/clk-si5341-fix-clock-hw-provider-cleanup.patch b/queue-5.4/clk-si5341-fix-clock-hw-provider-cleanup.patch new file mode 100644 index 00000000000..71de1041671 --- /dev/null +++ b/queue-5.4/clk-si5341-fix-clock-hw-provider-cleanup.patch @@ -0,0 +1,34 @@ +From 49a8f2bc8d88702783c7e163ec84374e9a022f71 Mon Sep 17 00:00:00 2001 +From: Robert Hancock +Date: Wed, 12 Jan 2022 14:38:16 -0600 +Subject: clk: si5341: Fix clock HW provider cleanup + +From: Robert Hancock + +commit 49a8f2bc8d88702783c7e163ec84374e9a022f71 upstream. + +The call to of_clk_add_hw_provider was not undone on remove or on probe +failure, which could cause an oops on a subsequent attempt to retrieve +clocks for the removed device. Switch to the devm version of the +function to avoid this issue. + +Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20220112203816.1784610-1-robert.hancock@calian.com +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman +--- + drivers/clk/clk-si5341.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -1303,7 +1303,7 @@ static int si5341_probe(struct i2c_clien + clk_prepare(data->clk[i].hw.clk); + } + +- err = of_clk_add_hw_provider(client->dev.of_node, of_clk_si5341_get, ++ err = devm_of_clk_add_hw_provider(&client->dev, of_clk_si5341_get, + data); + if (err) { + dev_err(&client->dev, "unable to add clk provider\n"); diff --git a/queue-5.4/f2fs-fix-to-reserve-space-for-io-align-feature.patch b/queue-5.4/f2fs-fix-to-reserve-space-for-io-align-feature.patch new file mode 100644 index 00000000000..9490e1906ea --- /dev/null +++ b/queue-5.4/f2fs-fix-to-reserve-space-for-io-align-feature.patch @@ -0,0 +1,155 @@ +From 300a842937fbcfb5a189cea9ba15374fdb0b5c6b Mon Sep 17 00:00:00 2001 +From: Chao Yu +Date: Sat, 11 Dec 2021 21:27:36 +0800 +Subject: f2fs: fix to reserve space for IO align feature + +From: Chao Yu + +commit 300a842937fbcfb5a189cea9ba15374fdb0b5c6b upstream. + +https://bugzilla.kernel.org/show_bug.cgi?id=204137 + +With below script, we will hit panic during new segment allocation: + +DISK=bingo.img +MOUNT_DIR=/mnt/f2fs + +dd if=/dev/zero of=$DISK bs=1M count=105 +mkfs.f2fe -a 1 -o 19 -t 1 -z 1 -f -q $DISK + +mount -t f2fs $DISK $MOUNT_DIR -o "noinline_dentry,flush_merge,noextent_cache,mode=lfs,io_bits=7,fsync_mode=strict" + +for (( i = 0; i < 4096; i++ )); do + name=`head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10` + mkdir $MOUNT_DIR/$name +done + +umount $MOUNT_DIR +rm $DISK + +--- + fs/f2fs/f2fs.h | 11 +++++++++++ + fs/f2fs/segment.h | 3 ++- + fs/f2fs/super.c | 44 ++++++++++++++++++++++++++++++++++++++++++++ + fs/f2fs/sysfs.c | 4 +++- + 4 files changed, 60 insertions(+), 2 deletions(-) + +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -931,6 +931,7 @@ struct f2fs_sm_info { + unsigned int segment_count; /* total # of segments */ + unsigned int main_segments; /* # of segments in main area */ + unsigned int reserved_segments; /* # of reserved segments */ ++ unsigned int additional_reserved_segments;/* reserved segs for IO align feature */ + unsigned int ovp_segments; /* # of overprovision segments */ + + /* a threshold to reclaim prefree segments */ +@@ -1800,6 +1801,11 @@ static inline int inc_valid_block_count( + + if (!__allow_reserved_blocks(sbi, inode, true)) + avail_user_block_count -= F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (F2FS_IO_ALIGNED(sbi)) ++ avail_user_block_count -= sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments; ++ + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) { + if (avail_user_block_count > sbi->unusable_block_count) + avail_user_block_count -= sbi->unusable_block_count; +@@ -2045,6 +2051,11 @@ static inline int inc_valid_node_count(s + + if (!__allow_reserved_blocks(sbi, inode, false)) + valid_block_count += F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (F2FS_IO_ALIGNED(sbi)) ++ valid_block_count += sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments; ++ + user_block_count = sbi->user_block_count; + if (unlikely(is_sbi_flag_set(sbi, SBI_CP_DISABLED))) + user_block_count -= sbi->unusable_block_count; +--- a/fs/f2fs/segment.h ++++ b/fs/f2fs/segment.h +@@ -508,7 +508,8 @@ static inline unsigned int free_segments + + static inline int reserved_segments(struct f2fs_sb_info *sbi) + { +- return SM_I(sbi)->reserved_segments; ++ return SM_I(sbi)->reserved_segments + ++ SM_I(sbi)->additional_reserved_segments; + } + + static inline unsigned int free_sections(struct f2fs_sb_info *sbi) +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -277,6 +277,46 @@ static inline void limit_reserve_root(st + F2FS_OPTION(sbi).s_resgid)); + } + ++static inline int adjust_reserved_segment(struct f2fs_sb_info *sbi) ++{ ++ unsigned int sec_blks = sbi->blocks_per_seg * sbi->segs_per_sec; ++ unsigned int avg_vblocks; ++ unsigned int wanted_reserved_segments; ++ block_t avail_user_block_count; ++ ++ if (!F2FS_IO_ALIGNED(sbi)) ++ return 0; ++ ++ /* average valid block count in section in worst case */ ++ avg_vblocks = sec_blks / F2FS_IO_SIZE(sbi); ++ ++ /* ++ * we need enough free space when migrating one section in worst case ++ */ ++ wanted_reserved_segments = (F2FS_IO_SIZE(sbi) / avg_vblocks) * ++ reserved_segments(sbi); ++ wanted_reserved_segments -= reserved_segments(sbi); ++ ++ avail_user_block_count = sbi->user_block_count - ++ sbi->current_reserved_blocks - ++ F2FS_OPTION(sbi).root_reserved_blocks; ++ ++ if (wanted_reserved_segments * sbi->blocks_per_seg > ++ avail_user_block_count) { ++ f2fs_err(sbi, "IO align feature can't grab additional reserved segment: %u, available segments: %u", ++ wanted_reserved_segments, ++ avail_user_block_count >> sbi->log_blocks_per_seg); ++ return -ENOSPC; ++ } ++ ++ SM_I(sbi)->additional_reserved_segments = wanted_reserved_segments; ++ ++ f2fs_info(sbi, "IO align feature needs additional reserved segment: %u", ++ wanted_reserved_segments); ++ ++ return 0; ++} ++ + static inline void adjust_unusable_cap_perc(struct f2fs_sb_info *sbi) + { + if (!F2FS_OPTION(sbi).unusable_cap_perc) +@@ -3450,6 +3490,10 @@ try_onemore: + goto free_nm; + } + ++ err = adjust_reserved_segment(sbi); ++ if (err) ++ goto free_nm; ++ + /* For write statistics */ + if (sb->s_bdev->bd_part) + sbi->sectors_written_start = +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -262,7 +262,9 @@ out: + if (a->struct_type == RESERVED_BLOCKS) { + spin_lock(&sbi->stat_lock); + if (t > (unsigned long)(sbi->user_block_count - +- F2FS_OPTION(sbi).root_reserved_blocks)) { ++ F2FS_OPTION(sbi).root_reserved_blocks - ++ sbi->blocks_per_seg * ++ SM_I(sbi)->additional_reserved_segments)) { + spin_unlock(&sbi->stat_lock); + return -EINVAL; + } diff --git a/queue-5.4/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch b/queue-5.4/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch new file mode 100644 index 00000000000..349e66f84a0 --- /dev/null +++ b/queue-5.4/ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch @@ -0,0 +1,139 @@ +From d07418afea8f1d9896aaf9dc5ae47ac4f45b220c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Wed, 19 Jan 2022 02:04:12 -0800 +Subject: ipv4: avoid quadratic behavior in netns dismantle + +From: Eric Dumazet + +commit d07418afea8f1d9896aaf9dc5ae47ac4f45b220c upstream. + +net/ipv4/fib_semantics.c uses an hash table of 256 slots, +keyed by device ifindexes: fib_info_devhash[DEVINDEX_HASHSIZE] + +Problem is that with network namespaces, devices tend +to use the same ifindex. + +lo device for instance has a fixed ifindex of one, +for all network namespaces. + +This means that hosts with thousands of netns spend +a lot of time looking at some hash buckets with thousands +of elements, notably at netns dismantle. + +Simply add a per netns perturbation (net_hash_mix()) +to spread elements more uniformely. + +Also change fib_devindex_hashfn() to use more entropy. + +Fixes: aa79e66eee5d ("net: Make ifindex generation per-net namespace") +Signed-off-by: Eric Dumazet +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv4/fib_semantics.c | 36 +++++++++++++++++------------------- + 1 file changed, 17 insertions(+), 19 deletions(-) + +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -318,11 +319,15 @@ static inline int nh_comp(struct fib_inf + + static inline unsigned int fib_devindex_hashfn(unsigned int val) + { +- unsigned int mask = DEVINDEX_HASHSIZE - 1; ++ return hash_32(val, DEVINDEX_HASHBITS); ++} ++ ++static struct hlist_head * ++fib_info_devhash_bucket(const struct net_device *dev) ++{ ++ u32 val = net_hash_mix(dev_net(dev)) ^ dev->ifindex; + +- return (val ^ +- (val >> DEVINDEX_HASHBITS) ^ +- (val >> (DEVINDEX_HASHBITS * 2))) & mask; ++ return &fib_info_devhash[fib_devindex_hashfn(val)]; + } + + static unsigned int fib_info_hashfn_1(int init_val, u8 protocol, u8 scope, +@@ -432,12 +437,11 @@ int ip_fib_check_default(__be32 gw, stru + { + struct hlist_head *head; + struct fib_nh *nh; +- unsigned int hash; + + spin_lock(&fib_info_lock); + +- hash = fib_devindex_hashfn(dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(dev); ++ + hlist_for_each_entry(nh, head, nh_hash) { + if (nh->fib_nh_dev == dev && + nh->fib_nh_gw4 == gw && +@@ -1594,12 +1598,10 @@ link_it: + } else { + change_nexthops(fi) { + struct hlist_head *head; +- unsigned int hash; + + if (!nexthop_nh->fib_nh_dev) + continue; +- hash = fib_devindex_hashfn(nexthop_nh->fib_nh_dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(nexthop_nh->fib_nh_dev); + hlist_add_head(&nexthop_nh->nh_hash, head); + } endfor_nexthops(fi) + } +@@ -1940,8 +1942,7 @@ void fib_nhc_update_mtu(struct fib_nh_co + + void fib_sync_mtu(struct net_device *dev, u32 orig_mtu) + { +- unsigned int hash = fib_devindex_hashfn(dev->ifindex); +- struct hlist_head *head = &fib_info_devhash[hash]; ++ struct hlist_head *head = fib_info_devhash_bucket(dev); + struct fib_nh *nh; + + hlist_for_each_entry(nh, head, nh_hash) { +@@ -1960,12 +1961,11 @@ void fib_sync_mtu(struct net_device *dev + */ + int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force) + { +- int ret = 0; +- int scope = RT_SCOPE_NOWHERE; ++ struct hlist_head *head = fib_info_devhash_bucket(dev); + struct fib_info *prev_fi = NULL; +- unsigned int hash = fib_devindex_hashfn(dev->ifindex); +- struct hlist_head *head = &fib_info_devhash[hash]; ++ int scope = RT_SCOPE_NOWHERE; + struct fib_nh *nh; ++ int ret = 0; + + if (force) + scope = -1; +@@ -2110,7 +2110,6 @@ out: + int fib_sync_up(struct net_device *dev, unsigned char nh_flags) + { + struct fib_info *prev_fi; +- unsigned int hash; + struct hlist_head *head; + struct fib_nh *nh; + int ret; +@@ -2126,8 +2125,7 @@ int fib_sync_up(struct net_device *dev, + } + + prev_fi = NULL; +- hash = fib_devindex_hashfn(dev->ifindex); +- head = &fib_info_devhash[hash]; ++ head = fib_info_devhash_bucket(dev); + ret = 0; + + hlist_for_each_entry(nh, head, nh_hash) { diff --git a/queue-5.4/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch b/queue-5.4/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch new file mode 100644 index 00000000000..29482d6a8d0 --- /dev/null +++ b/queue-5.4/net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch @@ -0,0 +1,36 @@ +From 3f7c239c7844d2044ed399399d97a5f1c6008e1b Mon Sep 17 00:00:00 2001 +From: Tobias Waldekranz +Date: Tue, 18 Jan 2022 22:50:53 +0100 +Subject: net/fsl: xgmac_mdio: Fix incorrect iounmap when removing module + +From: Tobias Waldekranz + +commit 3f7c239c7844d2044ed399399d97a5f1c6008e1b upstream. + +As reported by sparse: In the remove path, the driver would attempt to +unmap its own priv pointer - instead of the io memory that it mapped +in probe. + +Fixes: 9f35a7342cff ("net/fsl: introduce Freescale 10G MDIO driver") +Signed-off-by: Tobias Waldekranz +Reviewed-by: Andrew Lunn +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/freescale/xgmac_mdio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/freescale/xgmac_mdio.c ++++ b/drivers/net/ethernet/freescale/xgmac_mdio.c +@@ -301,9 +301,10 @@ err_ioremap: + static int xgmac_mdio_remove(struct platform_device *pdev) + { + struct mii_bus *bus = platform_get_drvdata(pdev); ++ struct mdio_fsl_priv *priv = bus->priv; + + mdiobus_unregister(bus); +- iounmap(bus->priv); ++ iounmap(priv->mdio_base); + mdiobus_free(bus); + + return 0; diff --git a/queue-5.4/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch b/queue-5.4/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch new file mode 100644 index 00000000000..6b7b6274ab0 --- /dev/null +++ b/queue-5.4/parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch @@ -0,0 +1,42 @@ +From d24846a4246b6e61ecbd036880a4adf61681d241 Mon Sep 17 00:00:00 2001 +From: Miaoqian Lin +Date: Thu, 20 Jan 2022 12:18:12 +0000 +Subject: parisc: pdc_stable: Fix memory leak in pdcs_register_pathentries +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Miaoqian Lin + +commit d24846a4246b6e61ecbd036880a4adf61681d241 upstream. + +kobject_init_and_add() takes reference even when it fails. +According to the doc of kobject_init_and_add()： + + If this function returns an error, kobject_put() must be called to + properly clean up the memory associated with the object. + +Fix memory leak by calling kobject_put(). + +Fixes: 73f368cf679b ("Kobject: change drivers/parisc/pdc_stable.c to use kobject_init_and_add") +Signed-off-by: Miaoqian Lin +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/pdc_stable.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/pdc_stable.c ++++ b/drivers/parisc/pdc_stable.c +@@ -979,8 +979,10 @@ pdcs_register_pathentries(void) + entry->kobj.kset = paths_kset; + err = kobject_init_and_add(&entry->kobj, &ktype_pdcspath, NULL, + "%s", entry->name); +- if (err) ++ if (err) { ++ kobject_put(&entry->kobj); + return err; ++ } + + /* kobject is now registered */ + write_lock(&entry->rw_lock); diff --git a/queue-5.4/series b/queue-5.4/series index b8cbbd25062..d88c8eca8d1 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -286,3 +286,10 @@ dmaengine-stm32-mdma-fix-stm32_mdma_ctbr_tsel_mask.patch revert-net-mlx5-add-retry-mechanism-to-the-command-entry-index-allocation.patch powerpc-cell-fix-clang-wimplicit-fallthrough-warning.patch powerpc-fsl-dts-enable-wa-for-erratum-a-009885-on-fman3l-mdio-buses.patch +bpftool-remove-inclusion-of-utilities.mak-from-makefiles.patch +ipv4-avoid-quadratic-behavior-in-netns-dismantle.patch +net-fsl-xgmac_mdio-fix-incorrect-iounmap-when-removing-module.patch +parisc-pdc_stable-fix-memory-leak-in-pdcs_register_pathentries.patch +f2fs-fix-to-reserve-space-for-io-align-feature.patch +af_unix-annote-lockless-accesses-to-unix_tot_inflight-gc_in_progress.patch +clk-si5341-fix-clock-hw-provider-cleanup.patch