From: Sasha Levin Date: Sat, 26 Oct 2024 07:36:48 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v5.15.170~39 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=e8d7e9da379555570af168695a25a1dc18f92fbc;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/be2net-fix-potential-memory-leak-in-be_xmit.patch b/queue-4.19/be2net-fix-potential-memory-leak-in-be_xmit.patch new file mode 100644 index 00000000000..2707af2bc57 --- /dev/null +++ b/queue-4.19/be2net-fix-potential-memory-leak-in-be_xmit.patch @@ -0,0 +1,61 @@ +From 35a9398063e582b6fabb1dd114b323b00c04a85a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 22:48:02 +0800 +Subject: be2net: fix potential memory leak in be_xmit() + +From: Wang Hai + +[ Upstream commit e4dd8bfe0f6a23acd305f9b892c00899089bd621 ] + +The be_xmit() returns NETDEV_TX_OK without freeing skb +in case of be_xmit_enqueue() fails, add dev_kfree_skb_any() to fix it. + +Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.") +Signed-off-by: Wang Hai +Reviewed-by: Simon Horman +Reviewed-by: Kalesh AP +Message-ID: <20241015144802.12150-1-wanghai38@huawei.com> +Signed-off-by: Andrew Lunn +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_main.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index d0d9a420f557e..8215bd1ca022f 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1386,10 +1386,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + be_get_wrb_params_from_skb(adapter, skb, &wrb_params); + + wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); +- if (unlikely(!wrb_cnt)) { +- dev_kfree_skb_any(skb); +- goto drop; +- } ++ if (unlikely(!wrb_cnt)) ++ goto drop_skb; + + /* if os2bmc is enabled and if the pkt is destined to bmc, + * enqueue the pkt a 2nd time with mgmt bit set. +@@ -1398,7 +1396,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + BE_WRB_F_SET(wrb_params.features, OS2BMC, 1); + wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params); + if (unlikely(!wrb_cnt)) +- goto drop; ++ goto drop_skb; + else + skb_get(skb); + } +@@ -1412,6 +1410,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev) + be_xmit_flush(adapter, txo); + + return NETDEV_TX_OK; ++drop_skb: ++ dev_kfree_skb_any(skb); + drop: + tx_stats(txo)->tx_drv_drops++; + /* Flush the already enqueued tx requests */ +-- +2.43.0 + diff --git a/queue-4.19/dt-bindings-power-add-r8a774b1-sysc-power-domain-def.patch b/queue-4.19/dt-bindings-power-add-r8a774b1-sysc-power-domain-def.patch new file mode 100644 index 00000000000..ece9e1ab7dd --- /dev/null +++ b/queue-4.19/dt-bindings-power-add-r8a774b1-sysc-power-domain-def.patch @@ -0,0 +1,57 @@ +From 2e5d2f3b97c2f7f567150117cd72bddd73c9abb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Sep 2019 07:52:06 +0100 +Subject: dt-bindings: power: Add r8a774b1 SYSC power domain definitions + +From: Biju Das + +[ Upstream commit be67c41781cb4c06a4acb0b92db0cbb728e955e2 ] + +This patch adds power domain indices for the RZ/G2N (a.k.a r8a774b1) +SoC. + +Signed-off-by: Biju Das +Link: https://lore.kernel.org/r/1567666326-27373-1-git-send-email-biju.das@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Stable-dep-of: 8a7d12d674ac ("net: usb: usbnet: fix name regression") +Signed-off-by: Sasha Levin +--- + include/dt-bindings/power/r8a774b1-sysc.h | 26 +++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + create mode 100644 include/dt-bindings/power/r8a774b1-sysc.h + +diff --git a/include/dt-bindings/power/r8a774b1-sysc.h b/include/dt-bindings/power/r8a774b1-sysc.h +new file mode 100644 +index 0000000000000..373736402f048 +--- /dev/null ++++ b/include/dt-bindings/power/r8a774b1-sysc.h +@@ -0,0 +1,26 @@ ++/* SPDX-License-Identifier: GPL-2.0 ++ * ++ * Copyright (C) 2019 Renesas Electronics Corp. ++ */ ++#ifndef __DT_BINDINGS_POWER_R8A774B1_SYSC_H__ ++#define __DT_BINDINGS_POWER_R8A774B1_SYSC_H__ ++ ++/* ++ * These power domain indices match the numbers of the interrupt bits ++ * representing the power areas in the various Interrupt Registers ++ * (e.g. SYSCISR, Interrupt Status Register) ++ */ ++ ++#define R8A774B1_PD_CA57_CPU0 0 ++#define R8A774B1_PD_CA57_CPU1 1 ++#define R8A774B1_PD_A3VP 9 ++#define R8A774B1_PD_CA57_SCU 12 ++#define R8A774B1_PD_A3VC 14 ++#define R8A774B1_PD_3DG_A 17 ++#define R8A774B1_PD_3DG_B 18 ++#define R8A774B1_PD_A2VC1 26 ++ ++/* Always-on power area */ ++#define R8A774B1_PD_ALWAYS_ON 32 ++ ++#endif /* __DT_BINDINGS_POWER_R8A774B1_SYSC_H__ */ +-- +2.43.0 + diff --git a/queue-4.19/net-sun3_82586-fix-potential-memory-leak-in-sun3_825.patch b/queue-4.19/net-sun3_82586-fix-potential-memory-leak-in-sun3_825.patch new file mode 100644 index 00000000000..d5b1311741f --- /dev/null +++ b/queue-4.19/net-sun3_82586-fix-potential-memory-leak-in-sun3_825.patch @@ -0,0 +1,37 @@ +From 61c2c36c2d1e04ba0b5d4f4f50d8cdf19d2354f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Oct 2024 22:41:48 +0800 +Subject: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() + +From: Wang Hai + +[ Upstream commit 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8 ] + +The sun3_82586_send_packet() returns NETDEV_TX_OK without freeing skb +in case of skb->len being too long, add dev_kfree_skb() to fix it. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Wang Hai +Reviewed-by: Simon Horman +Message-ID: <20241015144148.7918-1-wanghai38@huawei.com> +Signed-off-by: Andrew Lunn +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/i825xx/sun3_82586.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/i825xx/sun3_82586.c b/drivers/net/ethernet/i825xx/sun3_82586.c +index e0c9fee4e1e65..7948d59b96282 100644 +--- a/drivers/net/ethernet/i825xx/sun3_82586.c ++++ b/drivers/net/ethernet/i825xx/sun3_82586.c +@@ -1015,6 +1015,7 @@ sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev) + if(skb->len > XMIT_BUFF_SIZE) + { + printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len); ++ dev_kfree_skb(skb); + return NETDEV_TX_OK; + } + +-- +2.43.0 + diff --git a/queue-4.19/net-usb-usbnet-fix-name-regression.patch b/queue-4.19/net-usb-usbnet-fix-name-regression.patch new file mode 100644 index 00000000000..0ab95fcd05b --- /dev/null +++ b/queue-4.19/net-usb-usbnet-fix-name-regression.patch @@ -0,0 +1,46 @@ +From 80d93d37e2bf40f3f8fbb1c8f9b8e43f254f4003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Oct 2024 09:18:37 +0200 +Subject: net: usb: usbnet: fix name regression + +From: Oliver Neukum + +[ Upstream commit 8a7d12d674ac6f2147c18f36d1e15f1a48060edf ] + +The fix for MAC addresses broke detection of the naming convention +because it gave network devices no random MAC before bind() +was called. This means that the check for the local assignment bit +was always negative as the address was zeroed from allocation, +instead of from overwriting the MAC with a unique hardware address. + +The correct check for whether bind() has altered the MAC is +done with is_zero_ether_addr + +Signed-off-by: Oliver Neukum +Reported-by: Greg Thelen +Diagnosed-by: John Sperbeck +Fixes: bab8eb0dd4cb9 ("usbnet: modern method to get random MAC") +Link: https://patch.msgid.link/20241017071849.389636-1-oneukum@suse.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/usb/usbnet.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 938335f4738df..ec3a7cea8c8a8 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1746,7 +1746,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod) + // can rename the link if it knows better. + if ((dev->driver_info->flags & FLAG_ETHER) != 0 && + ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 || +- (net->dev_addr [0] & 0x02) == 0)) ++ /* somebody touched it*/ ++ !is_zero_ether_addr(net->dev_addr))) + strscpy(net->name, "eth%d", sizeof(net->name)); + /* WLAN devices should always be named "wlan%d" */ + if ((dev->driver_info->flags & FLAG_WLAN) != 0) +-- +2.43.0 + diff --git a/queue-4.19/posix-clock-posix-clock-fix-unbalanced-locking-in-pc.patch b/queue-4.19/posix-clock-posix-clock-fix-unbalanced-locking-in-pc.patch new file mode 100644 index 00000000000..2d5ce662037 --- /dev/null +++ b/queue-4.19/posix-clock-posix-clock-fix-unbalanced-locking-in-pc.patch @@ -0,0 +1,58 @@ +From c56f307a00c257eff931000c77f14df7972bdd33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Oct 2024 18:07:48 +0800 +Subject: posix-clock: posix-clock: Fix unbalanced locking in + pc_clock_settime() + +From: Jinjie Ruan + +[ Upstream commit 6e62807c7fbb3c758d233018caf94dfea9c65dbd ] + +If get_clock_desc() succeeds, it calls fget() for the clockid's fd, +and get the clk->rwsem read lock, so the error path should release +the lock to make the lock balance and fput the clockid's fd to make +the refcount balance and release the fd related resource. + +However the below commit left the error path locked behind resulting in +unbalanced locking. Check timespec64_valid_strict() before +get_clock_desc() to fix it, because the "ts" is not changed +after that. + +Fixes: d8794ac20a29 ("posix-clock: Fix missing timespec64 check in pc_clock_settime()") +Acked-by: Richard Cochran +Signed-off-by: Jinjie Ruan +Acked-by: Anna-Maria Behnsen +[pabeni@redhat.com: fixed commit message typo] +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + kernel/time/posix-clock.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c +index cda319c7529e5..c1e5feff8185d 100644 +--- a/kernel/time/posix-clock.c ++++ b/kernel/time/posix-clock.c +@@ -303,6 +303,9 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) + struct posix_clock_desc cd; + int err; + ++ if (!timespec64_valid_strict(ts)) ++ return -EINVAL; ++ + err = get_clock_desc(id, &cd); + if (err) + return err; +@@ -312,9 +315,6 @@ static int pc_clock_settime(clockid_t id, const struct timespec64 *ts) + goto out; + } + +- if (!timespec64_valid_strict(ts)) +- return -EINVAL; +- + if (cd.clk->ops.clock_settime) + err = cd.clk->ops.clock_settime(cd.clk, ts); + else +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index b271011e371..309d1df831d 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -307,3 +307,8 @@ kvm-s390-gaccess-cleanup-access-to-guest-pages.patch kvm-s390-gaccess-check-if-guest-address-is-in-memslo.patch udf-fix-uninit-value-use-in-udf_get_fileshortad.patch jfs-fix-sanity-check-in-dbmount.patch +net-sun3_82586-fix-potential-memory-leak-in-sun3_825.patch +be2net-fix-potential-memory-leak-in-be_xmit.patch +dt-bindings-power-add-r8a774b1-sysc-power-domain-def.patch +net-usb-usbnet-fix-name-regression.patch +posix-clock-posix-clock-fix-unbalanced-locking-in-pc.patch