From c98ab5a6fe250ade73a94409b8cf0fd0a080ad66 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 2 Aug 2021 13:53:32 +0200 Subject: [PATCH] 5.13-stable patches added patches: can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch i40e-add-additional-info-to-phy-type-error.patch octeontx2-af-remove-unnecessary-devm_kfree.patch perf-pmu-fix-alias-matching.patch --- ...e-clarify-lifetime-of-session-object.patch | 53 +++++++++ ...dd-additional-info-to-phy-type-error.patch | 34 ++++++ ...tx2-af-remove-unnecessary-devm_kfree.patch | 33 ++++++ queue-5.13/perf-pmu-fix-alias-matching.patch | 108 ++++++++++++++++++ queue-5.13/series | 4 + 5 files changed, 232 insertions(+) create mode 100644 queue-5.13/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch create mode 100644 queue-5.13/i40e-add-additional-info-to-phy-type-error.patch create mode 100644 queue-5.13/octeontx2-af-remove-unnecessary-devm_kfree.patch create mode 100644 queue-5.13/perf-pmu-fix-alias-matching.patch diff --git a/queue-5.13/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch b/queue-5.13/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch new file mode 100644 index 00000000000..1070f8fa6a7 --- /dev/null +++ b/queue-5.13/can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch @@ -0,0 +1,53 @@ +From 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 Mon Sep 17 00:00:00 2001 +From: Oleksij Rempel +Date: Wed, 14 Jul 2021 13:16:02 +0200 +Subject: can: j1939: j1939_session_deactivate(): clarify lifetime of session object + +From: Oleksij Rempel + +commit 0c71437dd50dd687c15d8ca80b3b68f10bb21d63 upstream. + +The j1939_session_deactivate() is decrementing the session ref-count and +potentially can free() the session. This would cause use-after-free +situation. + +However, the code calling j1939_session_deactivate() does always hold +another reference to the session, so that it would not be free()ed in +this code path. + +This patch adds a comment to make this clear and a WARN_ON, to ensure +that future changes will not violate this requirement. Further this +patch avoids dereferencing the session pointer as a precaution to avoid +use-after-free if the session is actually free()ed. + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Link: https://lore.kernel.org/r/20210714111602.24021-1-o.rempel@pengutronix.de +Reported-by: Xiaochen Zou +Signed-off-by: Oleksij Rempel +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Greg Kroah-Hartman +--- + net/can/j1939/transport.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1075,11 +1075,16 @@ static bool j1939_session_deactivate_loc + + static bool j1939_session_deactivate(struct j1939_session *session) + { ++ struct j1939_priv *priv = session->priv; + bool active; + +- j1939_session_list_lock(session->priv); ++ j1939_session_list_lock(priv); ++ /* This function should be called with a session ref-count of at ++ * least 2. ++ */ ++ WARN_ON_ONCE(kref_read(&session->kref) < 2); + active = j1939_session_deactivate_locked(session); +- j1939_session_list_unlock(session->priv); ++ j1939_session_list_unlock(priv); + + return active; + } diff --git a/queue-5.13/i40e-add-additional-info-to-phy-type-error.patch b/queue-5.13/i40e-add-additional-info-to-phy-type-error.patch new file mode 100644 index 00000000000..6e05d2c2941 --- /dev/null +++ b/queue-5.13/i40e-add-additional-info-to-phy-type-error.patch @@ -0,0 +1,34 @@ +From dc614c46178b0b89bde86ac54fc687a28580d2b7 Mon Sep 17 00:00:00 2001 +From: Lukasz Cieplicki +Date: Mon, 31 May 2021 16:55:49 +0000 +Subject: i40e: Add additional info to PHY type error + +From: Lukasz Cieplicki + +commit dc614c46178b0b89bde86ac54fc687a28580d2b7 upstream. + +In case of PHY type error occurs, the message was too generic. +Add additional info to PHY type error indicating that it can be +wrong cable connected. + +Fixes: 124ed15bf126 ("i40e: Add dual speed module support") +Signed-off-by: Lukasz Cieplicki +Signed-off-by: Michal Maloszewski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -980,7 +980,7 @@ static void i40e_get_settings_link_up(st + default: + /* if we got here and link is up something bad is afoot */ + netdev_info(netdev, +- "WARNING: Link is up but PHY type 0x%x is not recognized.\n", ++ "WARNING: Link is up but PHY type 0x%x is not recognized, or incorrect cable is in use\n", + hw_link_info->phy_type); + } + diff --git a/queue-5.13/octeontx2-af-remove-unnecessary-devm_kfree.patch b/queue-5.13/octeontx2-af-remove-unnecessary-devm_kfree.patch new file mode 100644 index 00000000000..1c3922b1c60 --- /dev/null +++ b/queue-5.13/octeontx2-af-remove-unnecessary-devm_kfree.patch @@ -0,0 +1,33 @@ +From d72e91efcae12f2f24ced984d00d60517c677857 Mon Sep 17 00:00:00 2001 +From: Sunil Goutham +Date: Thu, 22 Jul 2021 18:15:51 +0530 +Subject: octeontx2-af: Remove unnecessary devm_kfree + +From: Sunil Goutham + +commit d72e91efcae12f2f24ced984d00d60517c677857 upstream. + +Remove devm_kfree of memory where VLAN entry to RVU PF mapping +info is saved. This will be freed anyway at driver exit. +Having this could result in warning from devm_kfree() if +the memory is not allocated due to errors in rvu_nix_block_init() +before nix_setup_txvlan(). + +Fixes: 9a946def264d ("octeontx2-af: Modify nix_vtag_cfg mailbox to support TX VTAG entries") +Signed-off-by: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c +@@ -3587,7 +3587,6 @@ static void rvu_nix_block_freemem(struct + vlan = &nix_hw->txvlan; + kfree(vlan->rsrc.bmap); + mutex_destroy(&vlan->rsrc_lock); +- devm_kfree(rvu->dev, vlan->entry2pfvf_map); + + mcast = &nix_hw->mcast; + qmem_free(rvu->dev, mcast->mce_ctx); diff --git a/queue-5.13/perf-pmu-fix-alias-matching.patch b/queue-5.13/perf-pmu-fix-alias-matching.patch new file mode 100644 index 00000000000..4d517ff8212 --- /dev/null +++ b/queue-5.13/perf-pmu-fix-alias-matching.patch @@ -0,0 +1,108 @@ +From c07d5c9226980ca5ae21c6a2714baa95be2ce164 Mon Sep 17 00:00:00 2001 +From: John Garry +Date: Tue, 20 Jul 2021 23:10:19 +0800 +Subject: perf pmu: Fix alias matching + +From: John Garry + +commit c07d5c9226980ca5ae21c6a2714baa95be2ce164 upstream. + +Commit c47a5599eda324ba ("perf tools: Fix pattern matching for same +substring in different PMU type"), may have fixed some alias matching, +but has broken some others. + +Firstly it cannot handle the simple scenario of PMU name in form +pmu_name{digits} - it can only handle pmu_name_{digits}. + +Secondly it cannot handle more complex matching in the case where we +have multiple tokens. In this scenario, the code failed to realise that +we may examine multiple substrings in the PMU name. + +Fix in two ways: + +- Change perf_pmu__valid_suffix() to accept a PMU name without '_' in the + suffix + +- Only pay attention to perf_pmu__valid_suffix() for the final token + +Also add const qualifiers as necessary to avoid casting. + +Fixes: c47a5599eda324ba ("perf tools: Fix pattern matching for same substring in different PMU type") +Signed-off-by: John Garry +Tested-by: Jin Yao +Cc: Alexander Shishkin +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Kajol Jain +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/1626793819-79090-1-git-send-email-john.garry@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/util/pmu.c | 33 ++++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -742,9 +742,13 @@ struct pmu_events_map *__weak pmu_events + return perf_pmu__find_map(NULL); + } + +-static bool perf_pmu__valid_suffix(char *pmu_name, char *tok) ++/* ++ * Suffix must be in form tok_{digits}, or tok{digits}, or same as pmu_name ++ * to be valid. ++ */ ++static bool perf_pmu__valid_suffix(const char *pmu_name, char *tok) + { +- char *p; ++ const char *p; + + if (strncmp(pmu_name, tok, strlen(tok))) + return false; +@@ -753,12 +757,16 @@ static bool perf_pmu__valid_suffix(char + if (*p == 0) + return true; + +- if (*p != '_') +- return false; ++ if (*p == '_') ++ ++p; + +- ++p; +- if (*p == 0 || !isdigit(*p)) +- return false; ++ /* Ensure we end in a number */ ++ while (1) { ++ if (!isdigit(*p)) ++ return false; ++ if (*(++p) == 0) ++ break; ++ } + + return true; + } +@@ -789,12 +797,19 @@ bool pmu_uncore_alias_match(const char * + * match "socket" in "socketX_pmunameY" and then "pmuname" in + * "pmunameY". + */ +- for (; tok; name += strlen(tok), tok = strtok_r(NULL, ",", &tmp)) { ++ while (1) { ++ char *next_tok = strtok_r(NULL, ",", &tmp); ++ + name = strstr(name, tok); +- if (!name || !perf_pmu__valid_suffix((char *)name, tok)) { ++ if (!name || ++ (!next_tok && !perf_pmu__valid_suffix(name, tok))) { + res = false; + goto out; + } ++ if (!next_tok) ++ break; ++ tok = next_tok; ++ name += strlen(tok); + } + + res = true; diff --git a/queue-5.13/series b/queue-5.13/series index e27458127b7..d04e2328796 100644 --- a/queue-5.13/series +++ b/queue-5.13/series @@ -98,3 +98,7 @@ powerpc-vdso-don-t-use-r30-to-avoid-breaking-go-lang.patch powerpc-pseries-fix-regression-while-building-external-modules.patch revert-perf-map-fix-dso-nsinfo-refcounting.patch io_uring-fix-race-in-unified-task_work-running.patch +i40e-add-additional-info-to-phy-type-error.patch +can-j1939-j1939_session_deactivate-clarify-lifetime-of-session-object.patch +perf-pmu-fix-alias-matching.patch +octeontx2-af-remove-unnecessary-devm_kfree.patch -- 2.47.3