From a00eb0714c52560cac10c06bf5c782e311bf1c16 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 12 Jul 2020 23:22:00 -0400 Subject: [PATCH] Fixes for 4.9 Signed-off-by: Sasha Levin --- ...s-fix-partial_drain-completion-state.patch | 90 ++++++++++++++ ...-single-step-exception-handling-oops.patch | 115 ++++++++++++++++++ ...-dereference-in-case-sr-iov-configur.patch | 93 ++++++++++++++ ...fix-return-error-value-in-t4_prep_fw.patch | 58 +++++++++ ...vice-wake-capable-when-magic-packet-.patch | 50 ++++++++ queue-4.9/series | 7 ++ ...x-avoid-memory-leak-in-smsc95xx_bind.patch | 39 ++++++ ...check-return-value-of-smsc95xx_reset.patch | 48 ++++++++ 8 files changed, 500 insertions(+) create mode 100644 queue-4.9/alsa-compress-fix-partial_drain-completion-state.patch create mode 100644 queue-4.9/arm64-kgdb-fix-single-step-exception-handling-oops.patch create mode 100644 queue-4.9/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch create mode 100644 queue-4.9/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch create mode 100644 queue-4.9/net-macb-mark-device-wake-capable-when-magic-packet-.patch create mode 100644 queue-4.9/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch create mode 100644 queue-4.9/smsc95xx-check-return-value-of-smsc95xx_reset.patch diff --git a/queue-4.9/alsa-compress-fix-partial_drain-completion-state.patch b/queue-4.9/alsa-compress-fix-partial_drain-completion-state.patch new file mode 100644 index 00000000000..6cd9b6f0482 --- /dev/null +++ b/queue-4.9/alsa-compress-fix-partial_drain-completion-state.patch @@ -0,0 +1,90 @@ +From f4a8168e2a6fd7142758e88123c39ddf602daf20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 19:17:37 +0530 +Subject: ALSA: compress: fix partial_drain completion state + +From: Vinod Koul + +[ Upstream commit f79a732a8325dfbd570d87f1435019d7e5501c6d ] + +On partial_drain completion we should be in SNDRV_PCM_STATE_RUNNING +state, so set that for partially draining streams in +snd_compr_drain_notify() and use a flag for partially draining streams + +While at it, add locks for stream state change in +snd_compr_drain_notify() as well. + +Fixes: f44f2a5417b2 ("ALSA: compress: fix drain calls blocking other compress functions (v6)") +Reviewed-by: Srinivas Kandagatla +Tested-by: Srinivas Kandagatla +Reviewed-by: Charles Keepax +Tested-by: Charles Keepax +Signed-off-by: Vinod Koul +Link: https://lore.kernel.org/r/20200629134737.105993-4-vkoul@kernel.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + include/sound/compress_driver.h | 10 +++++++++- + sound/core/compress_offload.c | 4 ++++ + 2 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/include/sound/compress_driver.h b/include/sound/compress_driver.h +index 49482080311a1..b3b06478cf2ba 100644 +--- a/include/sound/compress_driver.h ++++ b/include/sound/compress_driver.h +@@ -72,6 +72,7 @@ struct snd_compr_runtime { + * @direction: stream direction, playback/recording + * @metadata_set: metadata set flag, true when set + * @next_track: has userspace signal next track transition, true when set ++ * @partial_drain: undergoing partial_drain for stream, true when set + * @private_data: pointer to DSP private data + */ + struct snd_compr_stream { +@@ -83,6 +84,7 @@ struct snd_compr_stream { + enum snd_compr_direction direction; + bool metadata_set; + bool next_track; ++ bool partial_drain; + void *private_data; + }; + +@@ -185,7 +187,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream) + if (snd_BUG_ON(!stream)) + return; + +- stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ /* for partial_drain case we are back to running state on success */ ++ if (stream->partial_drain) { ++ stream->runtime->state = SNDRV_PCM_STATE_RUNNING; ++ stream->partial_drain = false; /* clear this flag as well */ ++ } else { ++ stream->runtime->state = SNDRV_PCM_STATE_SETUP; ++ } + + wake_up(&stream->runtime->sleep); + } +diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c +index 7ae8e24dc1e61..81624f6e3f330 100644 +--- a/sound/core/compress_offload.c ++++ b/sound/core/compress_offload.c +@@ -723,6 +723,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) + + retval = stream->ops->trigger(stream, SNDRV_PCM_TRIGGER_STOP); + if (!retval) { ++ /* clear flags and stop any drain wait */ ++ stream->partial_drain = false; ++ stream->metadata_set = false; + snd_compr_drain_notify(stream); + stream->runtime->total_bytes_available = 0; + stream->runtime->total_bytes_transferred = 0; +@@ -880,6 +883,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream) + if (stream->next_track == false) + return -EPERM; + ++ stream->partial_drain = true; + retval = stream->ops->trigger(stream, SND_COMPR_TRIGGER_PARTIAL_DRAIN); + if (retval) { + pr_debug("Partial drain returned failure\n"); +-- +2.25.1 + diff --git a/queue-4.9/arm64-kgdb-fix-single-step-exception-handling-oops.patch b/queue-4.9/arm64-kgdb-fix-single-step-exception-handling-oops.patch new file mode 100644 index 00000000000..fdb582d6ca0 --- /dev/null +++ b/queue-4.9/arm64-kgdb-fix-single-step-exception-handling-oops.patch @@ -0,0 +1,115 @@ +From 52d32439e1927473144f880e78625d34f5a3b6b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 May 2020 05:41:56 +0800 +Subject: arm64: kgdb: Fix single-step exception handling oops + +From: Wei Li + +[ Upstream commit 8523c006264df65aac7d77284cc69aac46a6f842 ] + +After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will +delay installing breakpoints, do single-step first), it won't work +correctly, and it will enter kdb due to oops. + +It's because the reason gotten in kdb_stub() is not as expected, and it +seems that the ex_vector for single-step should be 0, like what arch +powerpc/sh/parisc has implemented. + +Before the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc +[3]kdb> ss + +Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null) +due to oops @ 0xffff800010082ab8 +CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6 +Hardware name: linux,dummy-virt (DT) +pstate: 00000085 (nzcv daIf -PAN -UAO) +pc : el1_irq+0x78/0x180 +lr : __handle_sysrq+0x80/0x190 +sp : ffff800015003bf0 +x29: ffff800015003d20 x28: ffff0000fa878040 +x27: 0000000000000000 x26: ffff80001126b1f0 +x25: ffff800011b6a0d8 x24: 0000000000000000 +x23: 0000000080200005 x22: ffff8000101486cc +x21: ffff800015003d30 x20: 0000ffffffffffff +x19: ffff8000119f2000 x18: 0000000000000000 +x17: 0000000000000000 x16: 0000000000000000 +x15: 0000000000000000 x14: 0000000000000000 +x13: 0000000000000000 x12: 0000000000000000 +x11: 0000000000000000 x10: 0000000000000000 +x9 : 0000000000000000 x8 : ffff800015003e50 +x7 : 0000000000000002 x6 : 00000000380b9990 +x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0 +x3 : 0000ffffffffffff x2 : ffff800011b6a0d8 +x1 : ffff800011b6a000 x0 : ffff80001130c9d8 +Call trace: + el1_irq+0x78/0x180 + printk+0x0/0x84 + write_sysrq_trigger+0xb0/0x118 + proc_reg_write+0xb4/0xe0 + __vfs_write+0x18/0x40 + vfs_write+0xb0/0x1b8 + ksys_write+0x64/0xf0 + __arm64_sys_write+0x14/0x20 + el0_svc_common.constprop.2+0xb0/0x168 + do_el0_svc+0x20/0x98 + el0_sync_handler+0xec/0x1a8 + el0_sync+0x140/0x180 + +[3]kdb> + +After the patch: +Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry +[0]kdb> bp printk +Instruction(i) BP #0 at 0xffff8000101486cc (printk) + is enabled addr at ffff8000101486cc, hardtype=0 installed=0 + +[0]kdb> g + +/ # echo h > /proc/sysrq-trigger + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> g + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc +[0]kdb> ss + +Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8 +[0]kdb> + +Fixes: 44679a4f142b ("arm64: KGDB: Add step debugging support") +Signed-off-by: Wei Li +Tested-by: Douglas Anderson +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200509214159.19680-2-liwei391@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/kgdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c +index 72a660a74ff9d..44d757308e472 100644 +--- a/arch/arm64/kernel/kgdb.c ++++ b/arch/arm64/kernel/kgdb.c +@@ -256,7 +256,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr) + if (user_mode(regs)) + return DBG_HOOK_ERROR; + +- kgdb_handle_exception(1, SIGTRAP, 0, regs); ++ kgdb_handle_exception(0, SIGTRAP, 0, regs); + return DBG_HOOK_HANDLED; + } + NOKPROBE_SYMBOL(kgdb_step_brk_fn); +-- +2.25.1 + diff --git a/queue-4.9/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch b/queue-4.9/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch new file mode 100644 index 00000000000..6e499bd5b4a --- /dev/null +++ b/queue-4.9/bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch @@ -0,0 +1,93 @@ +From 7c6cf751209261e1b590522ed3e02ec7fb11a4dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 12:55:08 +0200 +Subject: bnxt_en: fix NULL dereference in case SR-IOV configuration fails + +From: Davide Caratti + +[ Upstream commit c8b1d7436045d3599bae56aef1682813ecccaad7 ] + +we need to set 'active_vfs' back to 0, if something goes wrong during the +allocation of SR-IOV resources: otherwise, further VF configurations will +wrongly assume that bp->pf.vf[x] are valid memory locations, and commands +like the ones in the following sequence: + + # echo 2 >/sys/bus/pci/devices/${ADDR}/sriov_numvfs + # ip link set dev ens1f0np0 up + # ip link set dev ens1f0np0 vf 0 trust on + +will cause a kernel crash similar to this: + + bnxt_en 0000:3b:00.0: not enough MMIO resources for SR-IOV + BUG: kernel NULL pointer dereference, address: 0000000000000014 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + CPU: 43 PID: 2059 Comm: ip Tainted: G I 5.8.0-rc2.upstream+ #871 + Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 2.2.11 06/13/2019 + RIP: 0010:bnxt_set_vf_trust+0x5b/0x110 [bnxt_en] + Code: 44 24 58 31 c0 e8 f5 fb ff ff 85 c0 0f 85 b6 00 00 00 48 8d 1c 5b 41 89 c6 b9 0b 00 00 00 48 c1 e3 04 49 03 9c 24 f0 0e 00 00 <8b> 43 14 89 c2 83 c8 10 83 e2 ef 45 84 ed 49 89 e5 0f 44 c2 4c 89 + RSP: 0018:ffffac6246a1f570 EFLAGS: 00010246 + RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000b + RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff98b28f538900 + RBP: ffff98b28f538900 R08: 0000000000000000 R09: 0000000000000008 + R10: ffffffffb9515be0 R11: ffffac6246a1f678 R12: ffff98b28f538000 + R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffc05451e0 + FS: 00007fde0f688800(0000) GS:ffff98baffd40000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000014 CR3: 000000104bb0a003 CR4: 00000000007606e0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + PKRU: 55555554 + Call Trace: + do_setlink+0x994/0xfe0 + __rtnl_newlink+0x544/0x8d0 + rtnl_newlink+0x47/0x70 + rtnetlink_rcv_msg+0x29f/0x350 + netlink_rcv_skb+0x4a/0x110 + netlink_unicast+0x21d/0x300 + netlink_sendmsg+0x329/0x450 + sock_sendmsg+0x5b/0x60 + ____sys_sendmsg+0x204/0x280 + ___sys_sendmsg+0x88/0xd0 + __sys_sendmsg+0x5e/0xa0 + do_syscall_64+0x47/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.") +Reported-by: Fei Liu +CC: Jonathan Toppins +CC: Michael Chan +Signed-off-by: Davide Caratti +Reviewed-by: Michael Chan +Acked-by: Jonathan Toppins +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index 393cce3bf2fc6..1d6cb5f0ffeb5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -342,6 +342,7 @@ static void bnxt_free_vf_resources(struct bnxt *bp) + } + } + ++ bp->pf.active_vfs = 0; + kfree(bp->pf.vf); + bp->pf.vf = NULL; + } +@@ -590,7 +591,6 @@ void bnxt_sriov_disable(struct bnxt *bp) + + bnxt_free_vf_resources(bp); + +- bp->pf.active_vfs = 0; + /* Reclaim all resources for the PF. */ + bnxt_hwrm_func_qcaps(bp); + } +-- +2.25.1 + diff --git a/queue-4.9/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch b/queue-4.9/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch new file mode 100644 index 00000000000..588605dbe21 --- /dev/null +++ b/queue-4.9/net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch @@ -0,0 +1,58 @@ +From a5b28384bf87ac776ec1a7dedb25479d996c0342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 18:49:51 +0800 +Subject: net: cxgb4: fix return error value in t4_prep_fw + +From: Li Heng + +[ Upstream commit 8a259e6b73ad8181b0b2ef338b35043433db1075 ] + +t4_prep_fw goto bye tag with positive return value when something +bad happened and which can not free resource in adap_init0. +so fix it to return negative value. + +Fixes: 16e47624e76b ("cxgb4: Add new scheme to update T4/T5 firmware") +Reported-by: Hulk Robot +Signed-off-by: Li Heng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 62bc2af9cde70..9a2edc4d4fe83 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -3152,7 +3152,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + drv_fw = &fw_info->fw_hdr; + + /* Read the header of the firmware on the card */ +- ret = -t4_read_flash(adap, FLASH_FW_START, ++ ret = t4_read_flash(adap, FLASH_FW_START, + sizeof(*card_fw) / sizeof(uint32_t), + (uint32_t *)card_fw, 1); + if (ret == 0) { +@@ -3181,8 +3181,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + should_install_fs_fw(adap, card_fw_usable, + be32_to_cpu(fs_fw->fw_ver), + be32_to_cpu(card_fw->fw_ver))) { +- ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, +- fw_size, 0); ++ ret = t4_fw_upgrade(adap, adap->mbox, fw_data, ++ fw_size, 0); + if (ret != 0) { + dev_err(adap->pdev_dev, + "failed to install firmware: %d\n", ret); +@@ -3213,7 +3213,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); +- ret = EINVAL; ++ ret = -EINVAL; + goto bye; + } + +-- +2.25.1 + diff --git a/queue-4.9/net-macb-mark-device-wake-capable-when-magic-packet-.patch b/queue-4.9/net-macb-mark-device-wake-capable-when-magic-packet-.patch new file mode 100644 index 00000000000..d667147599d --- /dev/null +++ b/queue-4.9/net-macb-mark-device-wake-capable-when-magic-packet-.patch @@ -0,0 +1,50 @@ +From 7acfa72972a73ecc515f046096007db39bfd8a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 14:46:42 +0200 +Subject: net: macb: mark device wake capable when "magic-packet" property + present + +From: Nicolas Ferre + +[ Upstream commit ced4799d06375929e013eea04ba6908207afabbe ] + +Change the way the "magic-packet" DT property is handled in the +macb_probe() function, matching DT binding documentation. +Now we mark the device as "wakeup capable" instead of calling the +device_init_wakeup() function that would enable the wakeup source. + +For Ethernet WoL, enabling the wakeup_source is done by +using ethtool and associated macb_set_wol() function that +already calls device_set_wakeup_enable() for this purpose. + +That would reduce power consumption by cutting more clocks if +"magic-packet" property is set but WoL is not configured by ethtool. + +Fixes: 3e2a5e153906 ("net: macb: add wake-on-lan support via magic packet") +Cc: Claudiu Beznea +Cc: Harini Katakam +Cc: Sergio Prado +Reviewed-by: Florian Fainelli +Signed-off-by: Nicolas Ferre +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c +index 30e93041bf835..f20718b730e5b 100644 +--- a/drivers/net/ethernet/cadence/macb.c ++++ b/drivers/net/ethernet/cadence/macb.c +@@ -3024,7 +3024,7 @@ static int macb_probe(struct platform_device *pdev) + bp->wol = 0; + if (of_get_property(np, "magic-packet", NULL)) + bp->wol |= MACB_WOL_HAS_MAGIC_PACKET; +- device_init_wakeup(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET); ++ device_set_wakeup_capable(&pdev->dev, bp->wol & MACB_WOL_HAS_MAGIC_PACKET); + + #ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT + if (GEM_BFEXT(DBWDEF, gem_readl(bp, DCFG1)) > GEM_DBW32) +-- +2.25.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 0ad97058e85..84f6b20a79b 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -7,3 +7,10 @@ s390-kasan-fix-early-pgm-check-handler-execution.patch cifs-update-ctime-and-mtime-during-truncate.patch arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch scsi-mptscsih-fix-read-sense-data-size.patch +net-cxgb4-fix-return-error-value-in-t4_prep_fw.patch +smsc95xx-check-return-value-of-smsc95xx_reset.patch +smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch +alsa-compress-fix-partial_drain-completion-state.patch +arm64-kgdb-fix-single-step-exception-handling-oops.patch +bnxt_en-fix-null-dereference-in-case-sr-iov-configur.patch +net-macb-mark-device-wake-capable-when-magic-packet-.patch diff --git a/queue-4.9/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch b/queue-4.9/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch new file mode 100644 index 00000000000..ea1ba6a5312 --- /dev/null +++ b/queue-4.9/smsc95xx-avoid-memory-leak-in-smsc95xx_bind.patch @@ -0,0 +1,39 @@ +From da211189a2b0694bceeb2cc3e8023dda57a1a7a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 10:39:35 +0200 +Subject: smsc95xx: avoid memory leak in smsc95xx_bind + +From: Andre Edich + +[ Upstream commit 3ed58f96a70b85ef646d5427258f677f1395b62f ] + +In a case where the ID_REV register read is failed, the memory for a +private data structure has to be freed before returning error from the +function smsc95xx_bind. + +Fixes: bbd9f9ee69242 ("smsc95xx: add wol support for more frame types") +Signed-off-by: Andre Edich +Signed-off-by: Parthiban Veerasooran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 6ecae631a6307..3e6bf6bd0a684 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1298,7 +1298,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + /* detect device revision as different features may be available */ + ret = smsc95xx_read_reg(dev, ID_REV, &val); + if (ret < 0) +- return ret; ++ goto free_pdata; ++ + val >>= 16; + pdata->chip_id = val; + pdata->mdix_ctrl = get_mdix_status(dev->net); +-- +2.25.1 + diff --git a/queue-4.9/smsc95xx-check-return-value-of-smsc95xx_reset.patch b/queue-4.9/smsc95xx-check-return-value-of-smsc95xx_reset.patch new file mode 100644 index 00000000000..39950a9aa13 --- /dev/null +++ b/queue-4.9/smsc95xx-check-return-value-of-smsc95xx_reset.patch @@ -0,0 +1,48 @@ +From d3cb021443a2843642338ef7ecdc71aacf098f41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Jul 2020 10:39:34 +0200 +Subject: smsc95xx: check return value of smsc95xx_reset + +From: Andre Edich + +[ Upstream commit 7c8b1e855f94f88a0c569be6309fc8d5c8844cd1 ] + +The return value of the function smsc95xx_reset() must be checked +to avoid returning false success from the function smsc95xx_bind(). + +Fixes: 2f7ca802bdae2 ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver") +Signed-off-by: Andre Edich +Signed-off-by: Parthiban Veerasooran +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/smsc95xx.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c +index 6852ebafd4d3b..6ecae631a6307 100644 +--- a/drivers/net/usb/smsc95xx.c ++++ b/drivers/net/usb/smsc95xx.c +@@ -1292,6 +1292,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + + /* Init all registers */ + ret = smsc95xx_reset(dev); ++ if (ret) ++ goto free_pdata; + + /* detect device revision as different features may be available */ + ret = smsc95xx_read_reg(dev, ID_REV, &val); +@@ -1320,6 +1322,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) + schedule_delayed_work(&pdata->carrier_check, CARRIER_CHECK_DELAY); + + return 0; ++ ++free_pdata: ++ kfree(pdata); ++ return ret; + } + + static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf) +-- +2.25.1 + -- 2.47.3