From 5ef253b5dd0f7da11a6958961a6e84d0de2d1ad9 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 10 Apr 2022 19:23:06 -0400 Subject: [PATCH] Fixes for 4.19 Signed-off-by: Sasha Levin --- ...e-after-free-bugs-in-get_initial_sta.patch | 344 ++++++++++++++++++ ...-fix-potential-crash-on-module-unloa.patch | 58 +++ ...off-by-one-in-amdgpu_gfx_kiq_acquire.patch | 37 ++ ...ry-leak-in-imx_pd_connector_get_mode.patch | 44 +++ ...don-t-send-internal-clone-attribute-.patch | 79 ++++ ...nset-max_speed-difference-between-dt.patch | 56 +++ ...onfirm-skb-is-allocated-before-using.patch | 42 +++ .../rxrpc-fix-a-race-in-rxrpc_exit_net.patch | 91 +++++ ...x-a-resource-leak-in-zorro7xx_remove.patch | 40 ++ queue-4.19/series | 10 + ...-mspi-only-access-with-bcm_qspi_exec.patch | 47 +++ 11 files changed, 848 insertions(+) create mode 100644 queue-4.19/drbd-fix-five-use-after-free-bugs-in-get_initial_sta.patch create mode 100644 queue-4.19/drivers-hv-vmbus-fix-potential-crash-on-module-unloa.patch create mode 100644 queue-4.19/drm-amdgpu-fix-off-by-one-in-amdgpu_gfx_kiq_acquire.patch create mode 100644 queue-4.19/drm-imx-fix-memory-leak-in-imx_pd_connector_get_mode.patch create mode 100644 queue-4.19/net-openvswitch-don-t-send-internal-clone-attribute-.patch create mode 100644 queue-4.19/net-stmmac-fix-unset-max_speed-difference-between-dt.patch create mode 100644 queue-4.19/qede-confirm-skb-is-allocated-before-using.patch create mode 100644 queue-4.19/rxrpc-fix-a-race-in-rxrpc_exit_net.patch create mode 100644 queue-4.19/scsi-zorro7xx-fix-a-resource-leak-in-zorro7xx_remove.patch create mode 100644 queue-4.19/spi-bcm-qspi-fix-mspi-only-access-with-bcm_qspi_exec.patch diff --git a/queue-4.19/drbd-fix-five-use-after-free-bugs-in-get_initial_sta.patch b/queue-4.19/drbd-fix-five-use-after-free-bugs-in-get_initial_sta.patch new file mode 100644 index 00000000000..cd6f3249d78 --- /dev/null +++ b/queue-4.19/drbd-fix-five-use-after-free-bugs-in-get_initial_sta.patch @@ -0,0 +1,344 @@ +From 15120883052e553d3c60b697c884428bd1daa425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 21:04:43 +0200 +Subject: drbd: Fix five use after free bugs in get_initial_state +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lv Yunlong + +[ Upstream commit aadb22ba2f656581b2f733deb3a467c48cc618f6 ] + +In get_initial_state, it calls notify_initial_state_done(skb,..) if +cb->args[5]==1. If genlmsg_put() failed in notify_initial_state_done(), +the skb will be freed by nlmsg_free(skb). +Then get_initial_state will goto out and the freed skb will be used by +return value skb->len, which is a uaf bug. + +What's worse, the same problem goes even further: skb can also be +freed in the notify_*_state_change -> notify_*_state calls below. +Thus 4 additional uaf bugs happened. + +My patch lets the problem callee functions: notify_initial_state_done +and notify_*_state_change return an error code if errors happen. +So that the error codes could be propagated and the uaf bugs can be avoid. + +v2 reports a compilation warning. This v3 fixed this warning and built +successfully in my local environment with no additional warnings. +v2: https://lore.kernel.org/patchwork/patch/1435218/ + +Fixes: a29728463b254 ("drbd: Backport the "events2" command") +Signed-off-by: Lv Yunlong +Reviewed-by: Christoph Böhmwalder +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_int.h | 8 ++--- + drivers/block/drbd/drbd_nl.c | 41 ++++++++++++++++---------- + drivers/block/drbd/drbd_state.c | 18 +++++------ + drivers/block/drbd/drbd_state_change.h | 8 ++--- + 4 files changed, 42 insertions(+), 33 deletions(-) + +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index e35a234b0a8f..4f66cf6879fd 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1688,22 +1688,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 5b15ffd0c7f5..5a80453be553 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4845,7 +4849,7 @@ void notify_helper(enum drbd_notification_type type, + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4938,7 +4944,10 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index b452359b6aae..1474250f9440 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *uninitialized_var(last_arg); + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6ab..d5b0479bc9a6 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); +-- +2.35.1 + diff --git a/queue-4.19/drivers-hv-vmbus-fix-potential-crash-on-module-unloa.patch b/queue-4.19/drivers-hv-vmbus-fix-potential-crash-on-module-unloa.patch new file mode 100644 index 00000000000..23fc6a603d2 --- /dev/null +++ b/queue-4.19/drivers-hv-vmbus-fix-potential-crash-on-module-unloa.patch @@ -0,0 +1,58 @@ +From 0d3fe66c0daf6339e5788bb97dd26152b092778c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 17:35:35 -0300 +Subject: Drivers: hv: vmbus: Fix potential crash on module unload + +From: Guilherme G. Piccoli + +[ Upstream commit 792f232d57ff28bbd5f9c4abe0466b23d5879dc8 ] + +The vmbus driver relies on the panic notifier infrastructure to perform +some operations when a panic event is detected. Since vmbus can be built +as module, it is required that the driver handles both registering and +unregistering such panic notifier callback. + +After commit 74347a99e73a ("x86/Hyper-V: Unload vmbus channel in hv panic callback") +though, the panic notifier registration is done unconditionally in the module +initialization routine whereas the unregistering procedure is conditionally +guarded and executes only if HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE capability +is set. + +This patch fixes that by unconditionally unregistering the panic notifier +in the module's exit routine as well. + +Fixes: 74347a99e73a ("x86/Hyper-V: Unload vmbus channel in hv panic callback") +Signed-off-by: Guilherme G. Piccoli +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220315203535.682306-1-gpiccoli@igalia.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/vmbus_drv.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 51fe219c91fc..0c17743b4a65 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2062,10 +2062,15 @@ static void __exit vmbus_exit(void) + if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { + kmsg_dump_unregister(&hv_kmsg_dumper); + unregister_die_notifier(&hyperv_die_block); +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &hyperv_panic_block); + } + ++ /* ++ * The panic notifier is always registered, hence we should ++ * also unconditionally unregister it here as well. ++ */ ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &hyperv_panic_block); ++ + free_page((unsigned long)hv_panic_page); + unregister_sysctl_table(hv_ctl_table_hdr); + hv_ctl_table_hdr = NULL; +-- +2.35.1 + diff --git a/queue-4.19/drm-amdgpu-fix-off-by-one-in-amdgpu_gfx_kiq_acquire.patch b/queue-4.19/drm-amdgpu-fix-off-by-one-in-amdgpu_gfx_kiq_acquire.patch new file mode 100644 index 00000000000..620fcdcc71d --- /dev/null +++ b/queue-4.19/drm-amdgpu-fix-off-by-one-in-amdgpu_gfx_kiq_acquire.patch @@ -0,0 +1,37 @@ +From 00c987278d19904e5aeaddb753d0cac056ea4e8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 11:41:48 +0300 +Subject: drm/amdgpu: fix off by one in amdgpu_gfx_kiq_acquire() + +From: Dan Carpenter + +[ Upstream commit 1647b54ed55d4d48c7199d439f8834626576cbe9 ] + +This post-op should be a pre-op so that we do not pass -1 as the bit +number to test_bit(). The current code will loop downwards from 63 to +-1. After changing to a pre-op, it loops from 63 to 0. + +Fixes: 71c37505e7ea ("drm/amdgpu/gfx: move more common KIQ code to amdgpu_gfx.c") +Signed-off-by: Dan Carpenter +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 239bf2a4b3c6..eeaa2e825858 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -173,7 +173,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, + * adev->gfx.mec.num_pipe_per_mec + * adev->gfx.mec.num_queue_per_pipe; + +- while (queue_bit-- >= 0) { ++ while (--queue_bit >= 0) { + if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) + continue; + +-- +2.35.1 + diff --git a/queue-4.19/drm-imx-fix-memory-leak-in-imx_pd_connector_get_mode.patch b/queue-4.19/drm-imx-fix-memory-leak-in-imx_pd_connector_get_mode.patch new file mode 100644 index 00000000000..6c1498d792e --- /dev/null +++ b/queue-4.19/drm-imx-fix-memory-leak-in-imx_pd_connector_get_mode.patch @@ -0,0 +1,44 @@ +From ecffd770e61c5fea212dbe5970ea7f853e911ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jan 2022 17:52:30 +0100 +Subject: drm/imx: Fix memory leak in imx_pd_connector_get_modes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit bce81feb03a20fca7bbdd1c4af16b4e9d5c0e1d3 ] + +Avoid leaking the display mode variable if of_get_drm_display_mode +fails. + +Fixes: 76ecd9c9fb24 ("drm/imx: parallel-display: check return code from of_get_drm_display_mode()") +Addresses-Coverity-ID: 1443943 ("Resource leak") +Signed-off-by: José Expósito +Signed-off-by: Philipp Zabel +Link: https://lore.kernel.org/r/20220108165230.44610-1-jose.exposito89@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/parallel-display.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index aefd04e18f93..e9dff31b377c 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ drm_mode_destroy(connector->dev, mode); + return ret; ++ } + + drm_mode_copy(mode, &imxpd->mode); + mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, +-- +2.35.1 + diff --git a/queue-4.19/net-openvswitch-don-t-send-internal-clone-attribute-.patch b/queue-4.19/net-openvswitch-don-t-send-internal-clone-attribute-.patch new file mode 100644 index 00000000000..f38ac10b6b9 --- /dev/null +++ b/queue-4.19/net-openvswitch-don-t-send-internal-clone-attribute-.patch @@ -0,0 +1,79 @@ +From 5068084e9b7c190221310e79d22e1eaa187ca308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 12:41:50 +0200 +Subject: net: openvswitch: don't send internal clone attribute to the + userspace. + +From: Ilya Maximets + +[ Upstream commit 3f2a3050b4a3e7f32fc0ea3c9b0183090ae00522 ] + +'OVS_CLONE_ATTR_EXEC' is an internal attribute that is used for +performance optimization inside the kernel. It's added by the kernel +while parsing user-provided actions and should not be sent during the +flow dump as it's not part of the uAPI. + +The issue doesn't cause any significant problems to the ovs-vswitchd +process, because reported actions are not really used in the +application lifecycle and only supposed to be shown to a human via +ovs-dpctl flow dump. However, the action list is still incorrect +and causes the following error if the user wants to look at the +datapath flows: + + # ovs-dpctl add-dp system@ovs-system + # ovs-dpctl add-flow "" "clone(ct(commit),0)" + # ovs-dpctl dump-flows + , packets:0, bytes:0, used:never, + actions:clone(bad length 4, expected -1 for: action0(01 00 00 00), + ct(commit),0) + +With the fix: + + # ovs-dpctl dump-flows + , packets:0, bytes:0, used:never, + actions:clone(ct(commit),0) + +Additionally fixed an incorrect attribute name in the comment. + +Fixes: b233504033db ("openvswitch: kernel datapath clone action") +Signed-off-by: Ilya Maximets +Acked-by: Aaron Conole +Link: https://lore.kernel.org/r/20220404104150.2865736-1-i.maximets@ovn.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/actions.c | 2 +- + net/openvswitch/flow_netlink.c | 4 +++- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 100cc09c100d..8b75afe41284 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1098,7 +1098,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, + int rem = nla_len(attr); + bool dont_clone_flow_key; + +- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ ++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ + clone_arg = nla_data(attr); + dont_clone_flow_key = nla_get_u32(clone_arg); + actions = nla_next(clone_arg, &rem); +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index fb69978f50ec..4413ffdc1e03 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -3173,7 +3173,9 @@ static int clone_action_to_attr(const struct nlattr *attr, + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); ++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ ++ attr = nla_next(nla_data(attr), &rem); ++ err = ovs_nla_put_actions(attr, rem, skb); + + if (err) + nla_nest_cancel(skb, start); +-- +2.35.1 + diff --git a/queue-4.19/net-stmmac-fix-unset-max_speed-difference-between-dt.patch b/queue-4.19/net-stmmac-fix-unset-max_speed-difference-between-dt.patch new file mode 100644 index 00000000000..3a467c5a9e5 --- /dev/null +++ b/queue-4.19/net-stmmac-fix-unset-max_speed-difference-between-dt.patch @@ -0,0 +1,56 @@ +From 8e4d54cc90963cc745cc7ed65f28b5cd10f58f2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Apr 2022 02:48:32 +0800 +Subject: net: stmmac: Fix unset max_speed difference between DT and non-DT + platforms + +From: Chen-Yu Tsai + +[ Upstream commit c21cabb0fd0b54b8b54235fc1ecfe1195a23bcb2 ] + +In commit 9cbadf094d9d ("net: stmmac: support max-speed device tree +property"), when DT platforms don't set "max-speed", max_speed is set to +-1; for non-DT platforms, it stays the default 0. + +Prior to commit eeef2f6b9f6e ("net: stmmac: Start adding phylink support"), +the check for a valid max_speed setting was to check if it was greater +than zero. This commit got it right, but subsequent patches just checked +for non-zero, which is incorrect for DT platforms. + +In commit 92c3807b9ac3 ("net: stmmac: convert to phylink_get_linkmodes()") +the conversion switched completely to checking for non-zero value as a +valid value, which caused 1000base-T to stop getting advertised by +default. + +Instead of trying to fix all the checks, simply leave max_speed alone if +DT property parsing fails. + +Fixes: 9cbadf094d9d ("net: stmmac: support max-speed device tree property") +Fixes: 92c3807b9ac3 ("net: stmmac: convert to phylink_get_linkmodes()") +Signed-off-by: Chen-Yu Tsai +Acked-by: Russell King (Oracle) +Reviewed-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220331184832.16316-1-wens@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 05f5084158bf..9762e687fc73 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -398,8 +398,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->interface = of_get_phy_mode(np); + + /* Get max speed of operation from device tree */ +- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) +- plat->max_speed = -1; ++ of_property_read_u32(np, "max-speed", &plat->max_speed); + + plat->bus_id = of_alias_get_id(np, "ethernet"); + if (plat->bus_id < 0) +-- +2.35.1 + diff --git a/queue-4.19/qede-confirm-skb-is-allocated-before-using.patch b/queue-4.19/qede-confirm-skb-is-allocated-before-using.patch new file mode 100644 index 00000000000..771fb3ac857 --- /dev/null +++ b/queue-4.19/qede-confirm-skb-is-allocated-before-using.patch @@ -0,0 +1,42 @@ +From 8f59966fc8254163c5e093ea3081ef77362b1786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Apr 2022 21:19:19 +1000 +Subject: qede: confirm skb is allocated before using + +From: Jamie Bainbridge + +[ Upstream commit 4e910dbe36508654a896d5735b318c0b88172570 ] + +qede_build_skb() assumes build_skb() always works and goes straight +to skb_reserve(). However, build_skb() can fail under memory pressure. +This results in a kernel panic because the skb to reserve is NULL. + +Add a check in case build_skb() failed to allocate and return NULL. + +The NULL return is handled correctly in callers to qede_build_skb(). + +Fixes: 8a8633978b842 ("qede: Add build_skb() support.") +Signed-off-by: Jamie Bainbridge +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qede/qede_fp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 9d5c2e31dfe9..6a1a7d37dfd7 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq, + buf = page_address(bd->data) + bd->page_offset; + skb = build_skb(buf, rxq->rx_buf_seg_size); + ++ if (unlikely(!skb)) ++ return NULL; ++ + skb_reserve(skb, pad); + skb_put(skb, len); + +-- +2.35.1 + diff --git a/queue-4.19/rxrpc-fix-a-race-in-rxrpc_exit_net.patch b/queue-4.19/rxrpc-fix-a-race-in-rxrpc_exit_net.patch new file mode 100644 index 00000000000..d5c6359b714 --- /dev/null +++ b/queue-4.19/rxrpc-fix-a-race-in-rxrpc_exit_net.patch @@ -0,0 +1,91 @@ +From ae97bad7bd18d99526704facf738fabe27c64cdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 11:34:39 -0700 +Subject: rxrpc: fix a race in rxrpc_exit_net() + +From: Eric Dumazet + +[ Upstream commit 1946014ca3b19be9e485e780e862c375c6f98bad ] + +Current code can lead to the following race: + +CPU0 CPU1 + +rxrpc_exit_net() + rxrpc_peer_keepalive_worker() + if (rxnet->live) + + rxnet->live = false; + del_timer_sync(&rxnet->peer_keepalive_timer); + + timer_reduce(&rxnet->peer_keepalive_timer, jiffies + delay); + + cancel_work_sync(&rxnet->peer_keepalive_work); + +rxrpc_exit_net() exits while peer_keepalive_timer is still armed, +leading to use-after-free. + +syzbot report was: + +ODEBUG: free active (active state 0) object type: timer_list hint: rxrpc_peer_keepalive_timeout+0x0/0xb0 +WARNING: CPU: 0 PID: 3660 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Modules linked in: +CPU: 0 PID: 3660 Comm: kworker/u4:6 Not tainted 5.17.0-syzkaller-13993-g88e6c0207623 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: netns cleanup_net +RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd 00 1c 26 8a 4c 89 ee 48 c7 c7 00 10 26 8a e8 b1 e7 28 05 <0f> 0b 83 05 15 eb c5 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 +RSP: 0018:ffffc9000353fb00 EFLAGS: 00010082 +RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 +RDX: ffff888029196140 RSI: ffffffff815efad8 RDI: fffff520006a7f52 +RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffff815ea4ae R11: 0000000000000000 R12: ffffffff89ce23e0 +R13: ffffffff8a2614e0 R14: ffffffff816628c0 R15: dffffc0000000000 +FS: 0000000000000000(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007fe1f2908924 CR3: 0000000043720000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + __debug_check_no_obj_freed lib/debugobjects.c:992 [inline] + debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1023 + kfree+0xd6/0x310 mm/slab.c:3809 + ops_free_list.part.0+0x119/0x370 net/core/net_namespace.c:176 + ops_free_list net/core/net_namespace.c:174 [inline] + cleanup_net+0x591/0xb00 net/core/net_namespace.c:598 + process_one_work+0x996/0x1610 kernel/workqueue.c:2289 + worker_thread+0x665/0x1080 kernel/workqueue.c:2436 + kthread+0x2e9/0x3a0 kernel/kthread.c:376 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 + + +Fixes: ace45bec6d77 ("rxrpc: Fix firewall route keepalive") +Signed-off-by: Eric Dumazet +Cc: David Howells +Cc: Marc Dionne +Cc: linux-afs@lists.infradead.org +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rxrpc/net_ns.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c +index 417d80867c4f..1b403c2573da 100644 +--- a/net/rxrpc/net_ns.c ++++ b/net/rxrpc/net_ns.c +@@ -117,8 +117,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) + struct rxrpc_net *rxnet = rxrpc_net(net); + + rxnet->live = false; +- del_timer_sync(&rxnet->peer_keepalive_timer); + cancel_work_sync(&rxnet->peer_keepalive_work); ++ del_timer_sync(&rxnet->peer_keepalive_timer); + rxrpc_destroy_all_calls(rxnet); + rxrpc_destroy_all_connections(rxnet); + rxrpc_destroy_all_peers(rxnet); +-- +2.35.1 + diff --git a/queue-4.19/scsi-zorro7xx-fix-a-resource-leak-in-zorro7xx_remove.patch b/queue-4.19/scsi-zorro7xx-fix-a-resource-leak-in-zorro7xx_remove.patch new file mode 100644 index 00000000000..5463d399d03 --- /dev/null +++ b/queue-4.19/scsi-zorro7xx-fix-a-resource-leak-in-zorro7xx_remove.patch @@ -0,0 +1,40 @@ +From 317ffc64bd7b384456ee8297694aed82d34ae4b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 08:01:24 +0100 +Subject: scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one() + +From: Christophe JAILLET + +[ Upstream commit 16ed828b872d12ccba8f07bcc446ae89ba662f9c ] + +The error handling path of the probe releases a resource that is not freed +in the remove function. In some cases, a ioremap() must be undone. + +Add the missing iounmap() call in the remove function. + +Link: https://lore.kernel.org/r/247066a3104d25f9a05de8b3270fc3c848763bcc.1647673264.git.christophe.jaillet@wanadoo.fr +Fixes: 45804fbb00ee ("[SCSI] 53c700: Amiga Zorro NCR53c710 SCSI") +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/zorro7xx.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index aff31991aea9..ee6d97473853 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -158,6 +158,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); +-- +2.35.1 + diff --git a/queue-4.19/series b/queue-4.19/series index ccedb8cc1c9..5dac328addb 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -301,3 +301,13 @@ parisc-fix-cpu-affinity-for-lasi-wax-and-dino-chips.patch net-add-missing-sof_timestamping_opt_id-support.patch mm-fix-race-between-madv_free-reclaim-and-blkdev-dir.patch kvm-arm64-check-arm64_get_bp_hardening_data-didn-t-r.patch +drm-amdgpu-fix-off-by-one-in-amdgpu_gfx_kiq_acquire.patch +drivers-hv-vmbus-fix-potential-crash-on-module-unloa.patch +scsi-zorro7xx-fix-a-resource-leak-in-zorro7xx_remove.patch +net-stmmac-fix-unset-max_speed-difference-between-dt.patch +drm-imx-fix-memory-leak-in-imx_pd_connector_get_mode.patch +net-openvswitch-don-t-send-internal-clone-attribute-.patch +rxrpc-fix-a-race-in-rxrpc_exit_net.patch +qede-confirm-skb-is-allocated-before-using.patch +spi-bcm-qspi-fix-mspi-only-access-with-bcm_qspi_exec.patch +drbd-fix-five-use-after-free-bugs-in-get_initial_sta.patch diff --git a/queue-4.19/spi-bcm-qspi-fix-mspi-only-access-with-bcm_qspi_exec.patch b/queue-4.19/spi-bcm-qspi-fix-mspi-only-access-with-bcm_qspi_exec.patch new file mode 100644 index 00000000000..cd0692221cc --- /dev/null +++ b/queue-4.19/spi-bcm-qspi-fix-mspi-only-access-with-bcm_qspi_exec.patch @@ -0,0 +1,47 @@ +From 2aa3011d1ea1de393625f5a8b8f8bc90c276facf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 10:24:42 -0400 +Subject: spi: bcm-qspi: fix MSPI only access with bcm_qspi_exec_mem_op() + +From: Kamal Dasu + +[ Upstream commit 2c7d1b281286c46049cd22b43435cecba560edde ] + +This fixes case where MSPI controller is used to access spi-nor +flash and BSPI block is not present. + +Fixes: 5f195ee7d830 ("spi: bcm-qspi: Implement the spi_mem interface") +Signed-off-by: Kamal Dasu +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220328142442.7553-1-kdasu.kdev@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm-qspi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 82c24c85f45b..3f291db7b39a 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -970,7 +970,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + addr = op->addr.val; + len = op->data.nbytes; + +- if (bcm_qspi_bspi_ver_three(qspi) == true) { ++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { + /* + * The address coming into this function is a raw flash offset. + * But for BSPI <= V3, we need to convert it to a remapped BSPI +@@ -989,7 +989,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + len < 4) + mspi_read = true; + +- if (mspi_read) ++ if (!has_bspi(qspi) || mspi_read) + return bcm_qspi_mspi_exec_mem_op(spi, op); + + ret = bcm_qspi_bspi_set_mode(qspi, op, 0); +-- +2.35.1 + -- 2.47.3