From e2115effbb9f79692e06fa481e01c4cdd19cedf0 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 15 Jan 2021 10:59:22 +0100 Subject: [PATCH] 5.10-stable patches added patches: hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch ionic-start-queues-before-announcing-link-up.patch scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch --- ...memory-leakage-caused-by-kfifo_alloc.patch | 108 ++++++++++++++++++ ...art-queues-before-announcing-link-up.patch | 50 ++++++++ ...t-used-in-lpfc_sli4_abts_err_handler.patch | 41 +++++++ queue-5.10/series | 3 + 4 files changed, 202 insertions(+) create mode 100644 queue-5.10/hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch create mode 100644 queue-5.10/ionic-start-queues-before-announcing-link-up.patch create mode 100644 queue-5.10/scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch diff --git a/queue-5.10/hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch b/queue-5.10/hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch new file mode 100644 index 00000000000..185c6c7cda4 --- /dev/null +++ b/queue-5.10/hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch @@ -0,0 +1,108 @@ +From 37309f47e2f5674f3e86cb765312ace42cfcedf5 Mon Sep 17 00:00:00 2001 +From: Ping Cheng +Date: Wed, 9 Dec 2020 20:52:30 -0800 +Subject: HID: wacom: Fix memory leakage caused by kfifo_alloc + +From: Ping Cheng + +commit 37309f47e2f5674f3e86cb765312ace42cfcedf5 upstream. + +As reported by syzbot below, kfifo_alloc'd memory would not be freed +if a non-zero return value is triggered in wacom_probe. This patch +creates and uses devm_kfifo_alloc to allocate and free itself. + +BUG: memory leak +unreferenced object 0xffff88810dc44a00 (size 512): + comm "kworker/1:2", pid 3674, jiffies 4294943617 (age 14.100s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000023e1afac>] kmalloc_array include/linux/slab.h:592 [inline] + [<0000000023e1afac>] __kfifo_alloc+0xad/0x100 lib/kfifo.c:43 + [<00000000c477f737>] wacom_probe+0x1a1/0x3b0 drivers/hid/wacom_sys.c:2727 + [<00000000b3109aca>] hid_device_probe+0x16b/0x210 drivers/hid/hid-core.c:2281 + [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554 + [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738 + [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844 + [<00000000efb7c59e>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:431 + [<0000000024ab1590>] __device_attach+0x122/0x250 drivers/base/dd.c:912 + [<000000004c7ac048>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:491 + [<00000000b93050a3>] device_add+0x5ac/0xc30 drivers/base/core.c:2936 + [<00000000e5b46ea5>] hid_add_device+0x151/0x390 drivers/hid/hid-core.c:2437 + [<00000000c6add147>] usbhid_probe+0x412/0x560 drivers/hid/usbhid/hid-core.c:1407 + [<00000000c33acdb4>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 + [<00000000aff7c640>] really_probe+0x159/0x480 drivers/base/dd.c:554 + [<00000000778d0bc3>] driver_probe_device+0x84/0x100 drivers/base/dd.c:738 + [<000000005108dbb5>] __device_attach_driver+0xee/0x110 drivers/base/dd.c:844 + +https://syzkaller.appspot.com/bug?extid=5b49c9695968d7250a26 + +Reported-by: syzbot+5b49c9695968d7250a26@syzkaller.appspotmail.com +Signed-off-by: Ping Cheng +Reviewed-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/wacom_sys.c | 35 ++++++++++++++++++++++++++++++++--- + 1 file changed, 32 insertions(+), 3 deletions(-) + +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -1270,6 +1270,37 @@ static int wacom_devm_sysfs_create_group + group); + } + ++static void wacom_devm_kfifo_release(struct device *dev, void *res) ++{ ++ struct kfifo_rec_ptr_2 *devres = res; ++ ++ kfifo_free(devres); ++} ++ ++static int wacom_devm_kfifo_alloc(struct wacom *wacom) ++{ ++ struct wacom_wac *wacom_wac = &wacom->wacom_wac; ++ struct kfifo_rec_ptr_2 *pen_fifo = &wacom_wac->pen_fifo; ++ int error; ++ ++ pen_fifo = devres_alloc(wacom_devm_kfifo_release, ++ sizeof(struct kfifo_rec_ptr_2), ++ GFP_KERNEL); ++ ++ if (!pen_fifo) ++ return -ENOMEM; ++ ++ error = kfifo_alloc(pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL); ++ if (error) { ++ devres_free(pen_fifo); ++ return error; ++ } ++ ++ devres_add(&wacom->hdev->dev, pen_fifo); ++ ++ return 0; ++} ++ + enum led_brightness wacom_leds_brightness_get(struct wacom_led *led) + { + struct wacom *wacom = led->wacom; +@@ -2724,7 +2755,7 @@ static int wacom_probe(struct hid_device + if (features->check_for_hid_type && features->hid_type != hdev->type) + return -ENODEV; + +- error = kfifo_alloc(&wacom_wac->pen_fifo, WACOM_PKGLEN_MAX, GFP_KERNEL); ++ error = wacom_devm_kfifo_alloc(wacom); + if (error) + return error; + +@@ -2786,8 +2817,6 @@ static void wacom_remove(struct hid_devi + + if (wacom->wacom_wac.features.type != REMOTE) + wacom_release_resources(wacom); +- +- kfifo_free(&wacom_wac->pen_fifo); + } + + #ifdef CONFIG_PM diff --git a/queue-5.10/ionic-start-queues-before-announcing-link-up.patch b/queue-5.10/ionic-start-queues-before-announcing-link-up.patch new file mode 100644 index 00000000000..53316ee50ec --- /dev/null +++ b/queue-5.10/ionic-start-queues-before-announcing-link-up.patch @@ -0,0 +1,50 @@ +From 8f56bc4dc1011be6e2a53198b615fdc588b4ef6a Mon Sep 17 00:00:00 2001 +From: Shannon Nelson +Date: Thu, 12 Nov 2020 10:22:01 -0800 +Subject: ionic: start queues before announcing link up + +From: Shannon Nelson + +commit 8f56bc4dc1011be6e2a53198b615fdc588b4ef6a upstream. + +Change the order of operations in the link_up handling to be +sure that the queues are up and ready before we announce that +the link is up. + +Signed-off-by: Shannon Nelson +Reviewed-by: Saeed Mahameed +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -123,6 +123,12 @@ static void ionic_link_status_check(stru + link_up = link_status == IONIC_PORT_OPER_STATUS_UP; + + if (link_up) { ++ if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) { ++ mutex_lock(&lif->queue_lock); ++ ionic_start_queues(lif); ++ mutex_unlock(&lif->queue_lock); ++ } ++ + if (!netif_carrier_ok(netdev)) { + u32 link_speed; + +@@ -132,12 +138,6 @@ static void ionic_link_status_check(stru + link_speed / 1000); + netif_carrier_on(netdev); + } +- +- if (lif->netdev->flags & IFF_UP && netif_running(lif->netdev)) { +- mutex_lock(&lif->queue_lock); +- ionic_start_queues(lif); +- mutex_unlock(&lif->queue_lock); +- } + } else { + if (netif_carrier_ok(netdev)) { + netdev_info(netdev, "Link down\n"); diff --git a/queue-5.10/scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch b/queue-5.10/scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch new file mode 100644 index 00000000000..4fec7353fe0 --- /dev/null +++ b/queue-5.10/scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch @@ -0,0 +1,41 @@ +From 6998ff4e21619d47ebf4f5eb4cafa65c65856221 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Thu, 19 Nov 2020 12:34:07 -0800 +Subject: scsi: lpfc: Fix variable 'vport' set but not used in lpfc_sli4_abts_err_handler() + +From: James Smart + +commit 6998ff4e21619d47ebf4f5eb4cafa65c65856221 upstream. + +Remove vport variable that is assigned but not used in +lpfc_sli4_abts_err_handler(). + +Link: https://lore.kernel.org/r/20201119203407.121913-1-james.smart@broadcom.com +Fixes: e7dab164a9aa ("scsi: lpfc: Fix scheduling call while in softirq context in lpfc_unreg_rpi") +Reported-by: kernel test robot +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/lpfc/lpfc_sli.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -10459,7 +10459,6 @@ lpfc_sli4_abts_err_handler(struct lpfc_h + struct lpfc_nodelist *ndlp, + struct sli4_wcqe_xri_aborted *axri) + { +- struct lpfc_vport *vport; + uint32_t ext_status = 0; + + if (!ndlp || !NLP_CHK_NODE_ACT(ndlp)) { +@@ -10469,7 +10468,6 @@ lpfc_sli4_abts_err_handler(struct lpfc_h + return; + } + +- vport = ndlp->vport; + lpfc_printf_log(phba, KERN_WARNING, LOG_SLI, + "3116 Port generated FCP XRI ABORT event on " + "vpi %d rpi %d xri x%x status 0x%x parameter x%x\n", diff --git a/queue-5.10/series b/queue-5.10/series index 362831e4f95..c4e813cfaed 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -45,3 +45,6 @@ net-mlx5-use-port_num-1-instead-of-0-when-delete-a-roce-address.patch net-mlx5e-ethtool-fix-restriction-of-autoneg-with-56g.patch net-mlx5e-in-skb-build-skip-setting-mark-in-switchdev-mode.patch net-mlx5-check-if-lag-is-supported-before-creating-one.patch +scsi-lpfc-fix-variable-vport-set-but-not-used-in-lpfc_sli4_abts_err_handler.patch +ionic-start-queues-before-announcing-link-up.patch +hid-wacom-fix-memory-leakage-caused-by-kfifo_alloc.patch -- 2.47.3