From: Sasha Levin Date: Sat, 25 Dec 2021 21:31:51 +0000 (-0500) Subject: Fixes for 4.9 X-Git-Tag: v4.4.297~46 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=de5f163a72db8897252f3147c60df4d140dd0fb8;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch b/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch new file mode 100644 index 00000000000..5b1282b8786 --- /dev/null +++ b/queue-4.9/bonding-fix-ad_actor_system-option-setting-to-defaul.patch @@ -0,0 +1,65 @@ +From 2d2142471313e69e2ca78a067db18608af4ea13c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 12:13:45 +0100 +Subject: bonding: fix ad_actor_system option setting to default + +From: Fernando Fernandez Mancera + +[ Upstream commit 1c15b05baea71a5ff98235783e3e4ad227760876 ] + +When 802.3ad bond mode is configured the ad_actor_system option is set to +"00:00:00:00:00:00". But when trying to set the all-zeroes MAC as actors' +system address it was failing with EINVAL. + +An all-zeroes ethernet address is valid, only multicast addresses are not +valid values. + +Fixes: 171a42c38c6e ("bonding: add netlink support for sys prio, actor sys mac, and port key") +Signed-off-by: Fernando Fernandez Mancera +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20211221111345.2462-1-ffmancera@riseup.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/networking/bonding.txt | 11 ++++++----- + drivers/net/bonding/bond_options.c | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt +index 57f52cdce32e4..07b53b2b13df8 100644 +--- a/Documentation/networking/bonding.txt ++++ b/Documentation/networking/bonding.txt +@@ -191,11 +191,12 @@ ad_actor_sys_prio + ad_actor_system + + In an AD system, this specifies the mac-address for the actor in +- protocol packet exchanges (LACPDUs). The value cannot be NULL or +- multicast. It is preferred to have the local-admin bit set for this +- mac but driver does not enforce it. If the value is not given then +- system defaults to using the masters' mac address as actors' system +- address. ++ protocol packet exchanges (LACPDUs). The value cannot be a multicast ++ address. If the all-zeroes MAC is specified, bonding will internally ++ use the MAC of the bond itself. It is preferred to have the ++ local-admin bit set for this mac but driver does not enforce it. If ++ the value is not given then system defaults to using the masters' ++ mac address as actors' system address. + + This parameter has effect only in 802.3ad mode and is available through + SysFs interface. +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 258cb3999b0e3..5c6a962363096 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -1408,7 +1408,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond, + mac = (u8 *)&newval->value; + } + +- if (!is_valid_ether_addr(mac)) ++ if (is_multicast_ether_addr(mac)) + goto err; + + netdev_info(bond->dev, "Setting ad_actor_system to %pM\n", mac); +-- +2.34.1 + diff --git a/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch b/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch new file mode 100644 index 00000000000..457d6d93dc4 --- /dev/null +++ b/queue-4.9/drivers-net-smc911x-check-for-error-irq.patch @@ -0,0 +1,40 @@ +From e8cb85376babbc56287d7f368d88b954428ce088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 15:41:12 +0800 +Subject: drivers: net: smc911x: Check for error irq + +From: Jiasheng Jiang + +[ Upstream commit cb93b3e11d405f20a405a07482d01147ef4934a3 ] + +Because platform_get_irq() could fail and return error irq. +Therefore, it might be better to check it if order to avoid the use of +error irq. + +Fixes: ae150435b59e ("smsc: Move the SMC (SMSC) drivers") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/smsc/smc911x.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c +index d0cf971aa4ebe..4237bd311e0e6 100644 +--- a/drivers/net/ethernet/smsc/smc911x.c ++++ b/drivers/net/ethernet/smsc/smc911x.c +@@ -2088,6 +2088,11 @@ static int smc911x_drv_probe(struct platform_device *pdev) + + ndev->dma = (unsigned char)-1; + ndev->irq = platform_get_irq(pdev, 0); ++ if (ndev->irq < 0) { ++ ret = ndev->irq; ++ goto release_both; ++ } ++ + lp = netdev_priv(ndev); + lp->netdev = ndev; + #ifdef SMC_DYNAMIC_BUS_CONFIG +-- +2.34.1 + diff --git a/queue-4.9/fjes-check-for-error-irq.patch b/queue-4.9/fjes-check-for-error-irq.patch new file mode 100644 index 00000000000..f0b4fbde0e8 --- /dev/null +++ b/queue-4.9/fjes-check-for-error-irq.patch @@ -0,0 +1,41 @@ +From b0941b09115d590ecd130acb05f8956045f8b89d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 15:12:07 +0800 +Subject: fjes: Check for error irq + +From: Jiasheng Jiang + +[ Upstream commit db6d6afe382de5a65d6ccf51253ab48b8e8336c3 ] + +I find that platform_get_irq() will not always succeed. +It will return error irq in case of the failure. +Therefore, it might be better to check it if order to avoid the use of +error irq. + +Fixes: 658d439b2292 ("fjes: Introduce FUJITSU Extended Socket Network Device driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/fjes/fjes_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c +index 440047a239f57..26bb43a675131 100644 +--- a/drivers/net/fjes/fjes_main.c ++++ b/drivers/net/fjes/fjes_main.c +@@ -1219,6 +1219,11 @@ static int fjes_probe(struct platform_device *plat_dev) + hw->hw_res.start = res->start; + hw->hw_res.size = resource_size(res); + hw->hw_res.irq = platform_get_irq(plat_dev, 0); ++ if (hw->hw_res.irq < 0) { ++ err = hw->hw_res.irq; ++ goto err_free_control_wq; ++ } ++ + err = fjes_hw_init(&adapter->hw); + if (err) + goto err_free_control_wq; +-- +2.34.1 + diff --git a/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch b/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch new file mode 100644 index 00000000000..64912aa267d --- /dev/null +++ b/queue-4.9/ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch @@ -0,0 +1,42 @@ +From b3e4cb488e3002c4baa3d897f173041c0f902bca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 18:52:38 +0100 +Subject: IB/qib: Fix memory leak in qib_user_sdma_queue_pkts() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit bee90911e0138c76ee67458ac0d58b38a3190f65 ] + +The wrong goto label was used for the error case and missed cleanup of the +pkt allocation. + +Fixes: d39bf40e55e6 ("IB/qib: Protect from buffer overflow in struct qib_user_sdma_pkt fields") +Link: https://lore.kernel.org/r/20211208175238.29983-1-jose.exposito89@gmail.com +Addresses-Coverity-ID: 1493352 ("Resource leak") +Signed-off-by: José Expósito +Acked-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qib/qib_user_sdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c +index 0dc15f95e7626..2d0b992579d6f 100644 +--- a/drivers/infiniband/hw/qib/qib_user_sdma.c ++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c +@@ -946,7 +946,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd, + &addrlimit) || + addrlimit > type_max(typeof(pkt->addrlimit))) { + ret = -EINVAL; +- goto free_pbc; ++ goto free_pkt; + } + pkt->addrlimit = addrlimit; + +-- +2.34.1 + diff --git a/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch b/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch new file mode 100644 index 00000000000..b0038746a7e --- /dev/null +++ b/queue-4.9/qlcnic-potential-dereference-null-pointer-of-rx_queu.patch @@ -0,0 +1,103 @@ +From 9e666320f8a90b23c2ef3e3c26de6cf843f61532 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Dec 2021 17:39:11 +0800 +Subject: qlcnic: potential dereference null pointer of rx_queue->page_ring + +From: Jiasheng Jiang + +[ Upstream commit 60ec7fcfe76892a1479afab51ff17a4281923156 ] + +The return value of kcalloc() needs to be checked. +To avoid dereference of null pointer in case of the failure of alloc. +Therefore, it might be better to change the return type of +qlcnic_sriov_alloc_vlans() and return -ENOMEM when alloc fails and +return 0 the others. +Also, qlcnic_sriov_set_guest_vlan_mode() and __qlcnic_pci_sriov_enable() +should deal with the return value of qlcnic_sriov_alloc_vlans(). + +Fixes: 154d0c810c53 ("qlcnic: VLAN enhancement for 84XX adapters") +Signed-off-by: Jiasheng Jiang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h | 2 +- + .../net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 12 +++++++++--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c | 4 +++- + 3 files changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +index 5f327659efa7a..85b688f60b876 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h +@@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *, + struct qlcnic_info *, u16); + int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8); + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *); +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *); + bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *); + void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *, + struct qlcnic_vf_info *, u16); +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index c58180f408448..44caa7c2077ec 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + struct qlcnic_cmd_args *cmd) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; +- int i, num_vlans; ++ int i, num_vlans, ret; + u16 *vlans; + + if (sriov->allowed_vlans) +@@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter, + dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n", + sriov->num_allowed_vlans); + +- qlcnic_sriov_alloc_vlans(adapter); ++ ret = qlcnic_sriov_alloc_vlans(adapter); ++ if (ret) ++ return ret; + + if (!sriov->any_vlan) + return 0; +@@ -2164,7 +2166,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter) + return err; + } + +-void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) ++int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + { + struct qlcnic_sriov *sriov = adapter->ahw->sriov; + struct qlcnic_vf_info *vf; +@@ -2174,7 +2176,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter) + vf = &sriov->vf_info[i]; + vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans, + sizeof(*vf->sriov_vlans), GFP_KERNEL); ++ if (!vf->sriov_vlans) ++ return -ENOMEM; + } ++ ++ return 0; + } + + void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter) +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +index 50eaafa3eaba3..c9f2cd2462230 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c +@@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter, + if (err) + goto del_flr_queue; + +- qlcnic_sriov_alloc_vlans(adapter); ++ err = qlcnic_sriov_alloc_vlans(adapter); ++ if (err) ++ goto del_flr_queue; + + return err; + +-- +2.34.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 9f87a9b2c38..50807eeda22 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1,3 +1,8 @@ net-usb-lan78xx-add-allied-telesis-at29m2-af.patch can-kvaser_usb-get-can-clock-frequency-from-device.patch hid-holtek-fix-mouse-probing.patch +ib-qib-fix-memory-leak-in-qib_user_sdma_queue_pkts.patch +qlcnic-potential-dereference-null-pointer-of-rx_queu.patch +bonding-fix-ad_actor_system-option-setting-to-defaul.patch +fjes-check-for-error-irq.patch +drivers-net-smc911x-check-for-error-irq.patch