From 3265e82b9f735113c6d9886cd4dcfa097aa70684 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Feb 2023 10:46:07 -0500 Subject: [PATCH] Fixes for 4.14 Signed-off-by: Sasha Levin --- ...-add-power-domains-property-to-dp-no.patch | 36 +++++++++++ ...-number-of-clones-and-allocated-memo.patch | 44 +++++++++++++ .../ib-hfi1-assign-npages-earlier.patch | 64 +++++++++++++++++++ queue-4.14/series | 3 + 4 files changed, 147 insertions(+) create mode 100644 queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch create mode 100644 queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch create mode 100644 queue-4.14/ib-hfi1-assign-npages-earlier.patch create mode 100644 queue-4.14/series diff --git a/queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch b/queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch new file mode 100644 index 00000000000..5182d683b7f --- /dev/null +++ b/queue-4.14/arm-dts-rockchip-add-power-domains-property-to-dp-no.patch @@ -0,0 +1,36 @@ +From cd3910ec89b9ff4f29b87d065e55dcf567efb99f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Dec 2022 21:17:32 +0100 +Subject: ARM: dts: rockchip: add power-domains property to dp node on rk3288 + +From: Johan Jonker + +[ Upstream commit 80422339a75088322b4d3884bd12fa0fe5d11050 ] + +The clocks in the Rockchip rk3288 DisplayPort node are +included in the power-domain@RK3288_PD_VIO logic, but the +power-domains property in the dp node is missing, so fix it. + +Signed-off-by: Johan Jonker +Link: https://lore.kernel.org/r/dab85bfb-9f55-86a1-5cd5-7388c43e0ec5@gmail.com +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/rk3288.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 872e4e690beb4..c3440adc763ce 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -1096,6 +1096,7 @@ edp: dp@ff970000 { + clock-names = "dp", "pclk"; + phys = <&edp_phy>; + phy-names = "dp"; ++ power-domains = <&power RK3288_PD_VIO>; + resets = <&cru SRST_EDP>; + reset-names = "dp"; + rockchip,grf = <&grf>; +-- +2.39.0 + diff --git a/queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch b/queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch new file mode 100644 index 00000000000..1db30de6462 --- /dev/null +++ b/queue-4.14/btrfs-send-limit-number-of-clones-and-allocated-memo.patch @@ -0,0 +1,44 @@ +From 4b0b282be1d536a5aa6e0cacf61b6294050d1a48 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Jan 2023 20:32:10 +0100 +Subject: btrfs: send: limit number of clones and allocated memory size + +From: David Sterba + +[ Upstream commit 33e17b3f5ab74af12aca58c515bc8424ff69a343 ] + +The arg->clone_sources_count is u64 and can trigger a warning when a +huge value is passed from user space and a huge array is allocated. +Limit the allocated memory to 8MiB (can be increased if needed), which +in turn limits the number of clone sources to 8M / sizeof(struct +clone_root) = 8M / 40 = 209715. Real world number of clones is from +tens to hundreds, so this is future proof. + +Reported-by: syzbot+4376a9a073770c173269@syzkaller.appspotmail.com +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/send.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index efab9446eac87..b08e7fcd8c34d 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -6646,10 +6646,10 @@ long btrfs_ioctl_send(struct file *mnt_file, void __user *arg_) + /* + * Check that we don't overflow at later allocations, we request + * clone_sources_count + 1 items, and compare to unsigned long inside +- * access_ok. ++ * access_ok. Also set an upper limit for allocation size so this can't ++ * easily exhaust memory. Max number of clone sources is about 200K. + */ +- if (arg->clone_sources_count > +- ULONG_MAX / sizeof(struct clone_root) - 1) { ++ if (arg->clone_sources_count > SZ_8M / sizeof(struct clone_root)) { + ret = -EINVAL; + goto out; + } +-- +2.39.0 + diff --git a/queue-4.14/ib-hfi1-assign-npages-earlier.patch b/queue-4.14/ib-hfi1-assign-npages-earlier.patch new file mode 100644 index 00000000000..d00f41d14ef --- /dev/null +++ b/queue-4.14/ib-hfi1-assign-npages-earlier.patch @@ -0,0 +1,64 @@ +From 87b49a180348b1097316f07b46a3286c4a995346 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Jan 2023 14:04:08 -0500 +Subject: IB/hfi1: Assign npages earlier + +From: Dean Luick + +[ Upstream commit f9c47b2caa7ffc903ec950b454b59c209afe3182 ] + +Improve code clarity and enable earlier use of +tidbuf->npages by moving its assignment to +structure creation time. + +Signed-off-by: Dean Luick +Signed-off-by: Dennis Dalessandro +Link: https://lore.kernel.org/r/167329104884.1472990.4639750192433251493.stgit@awfm-02.cornelisnetworks.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/user_exp_rcv.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/user_exp_rcv.c b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +index b17c1fc59f7e4..1987bb8412a23 100644 +--- a/drivers/infiniband/hw/hfi1/user_exp_rcv.c ++++ b/drivers/infiniband/hw/hfi1/user_exp_rcv.c +@@ -213,16 +213,11 @@ static void unpin_rcv_pages(struct hfi1_filedata *fd, + static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + { + int pinned; +- unsigned int npages; ++ unsigned int npages = tidbuf->npages; + unsigned long vaddr = tidbuf->vaddr; + struct page **pages = NULL; + struct hfi1_devdata *dd = fd->uctxt->dd; + +- /* Get the number of pages the user buffer spans */ +- npages = num_user_pages(vaddr, tidbuf->length); +- if (!npages) +- return -EINVAL; +- + if (npages > fd->uctxt->expected_count) { + dd_dev_err(dd, "Expected buffer too big\n"); + return -EINVAL; +@@ -256,7 +251,6 @@ static int pin_rcv_pages(struct hfi1_filedata *fd, struct tid_user_buf *tidbuf) + return pinned; + } + tidbuf->pages = pages; +- tidbuf->npages = npages; + fd->tid_n_pinned += pinned; + return pinned; + } +@@ -332,6 +326,7 @@ int hfi1_user_exp_rcv_setup(struct hfi1_filedata *fd, + + tidbuf->vaddr = tinfo->vaddr; + tidbuf->length = tinfo->length; ++ tidbuf->npages = num_user_pages(tidbuf->vaddr, tidbuf->length); + tidbuf->psets = kcalloc(uctxt->expected_count, sizeof(*tidbuf->psets), + GFP_KERNEL); + if (!tidbuf->psets) { +-- +2.39.0 + diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..ed8db85a35c --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,3 @@ +arm-dts-rockchip-add-power-domains-property-to-dp-no.patch +btrfs-send-limit-number-of-clones-and-allocated-memo.patch +ib-hfi1-assign-npages-earlier.patch -- 2.47.3