From 1b995a815ea11f825a041809cca7128672c55310 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Jul 2022 14:37:10 +0200 Subject: [PATCH] 5.15-stable patches added patches: hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch nfsd-restore-einval-error-translation-in-nfsd_commit.patch --- ...ap-command-overwriting-poll-response.patch | 154 ++++++++++++++++++ ...-__init-annotated-seg6_hmac_net_init.patch | 41 +++++ ...val-error-translation-in-nfsd_commit.patch | 43 +++++ queue-5.15/series | 3 + 4 files changed, 241 insertions(+) create mode 100644 queue-5.15/hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch create mode 100644 queue-5.15/net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch create mode 100644 queue-5.15/nfsd-restore-einval-error-translation-in-nfsd_commit.patch diff --git a/queue-5.15/hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch b/queue-5.15/hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch new file mode 100644 index 00000000000..0ad6027f20b --- /dev/null +++ b/queue-5.15/hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch @@ -0,0 +1,154 @@ +From 1bbb2809040a1f9c7c53c9f06c21aa83275ed27b Mon Sep 17 00:00:00 2001 +From: Eddie James +Date: Tue, 28 Jun 2022 15:30:29 -0500 +Subject: hwmon: (occ) Prevent power cap command overwriting poll response + +From: Eddie James + +commit 1bbb2809040a1f9c7c53c9f06c21aa83275ed27b upstream. + +Currently, the response to the power cap command overwrites the +first eight bytes of the poll response, since the commands use +the same buffer. This means that user's get the wrong data between +the time of sending the power cap and the next poll response update. +Fix this by specifying a different buffer for the power cap command +response. + +Fixes: 5b5513b88002 ("hwmon: Add On-Chip Controller (OCC) hwmon driver") +Signed-off-by: Eddie James +Link: https://lore.kernel.org/r/20220628203029.51747-1-eajames@linux.ibm.com +Signed-off-by: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hwmon/occ/common.c | 5 +++-- + drivers/hwmon/occ/common.h | 3 ++- + drivers/hwmon/occ/p8_i2c.c | 13 +++++++------ + drivers/hwmon/occ/p9_sbe.c | 7 +++---- + 4 files changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/hwmon/occ/common.c b/drivers/hwmon/occ/common.c +index ea070b91e5b9..157b73a3da29 100644 +--- a/drivers/hwmon/occ/common.c ++++ b/drivers/hwmon/occ/common.c +@@ -145,7 +145,7 @@ static int occ_poll(struct occ *occ) + cmd[6] = 0; /* checksum lsb */ + + /* mutex should already be locked if necessary */ +- rc = occ->send_cmd(occ, cmd, sizeof(cmd)); ++ rc = occ->send_cmd(occ, cmd, sizeof(cmd), &occ->resp, sizeof(occ->resp)); + if (rc) { + occ->last_error = rc; + if (occ->error_count++ > OCC_ERROR_COUNT_THRESHOLD) +@@ -182,6 +182,7 @@ static int occ_set_user_power_cap(struct occ *occ, u16 user_power_cap) + { + int rc; + u8 cmd[8]; ++ u8 resp[8]; + __be16 user_power_cap_be = cpu_to_be16(user_power_cap); + + cmd[0] = 0; /* sequence number */ +@@ -198,7 +199,7 @@ static int occ_set_user_power_cap(struct occ *occ, u16 user_power_cap) + if (rc) + return rc; + +- rc = occ->send_cmd(occ, cmd, sizeof(cmd)); ++ rc = occ->send_cmd(occ, cmd, sizeof(cmd), resp, sizeof(resp)); + + mutex_unlock(&occ->lock); + +diff --git a/drivers/hwmon/occ/common.h b/drivers/hwmon/occ/common.h +index 64d5ec7e169b..7ac4b2febce6 100644 +--- a/drivers/hwmon/occ/common.h ++++ b/drivers/hwmon/occ/common.h +@@ -96,7 +96,8 @@ struct occ { + + int powr_sample_time_us; /* average power sample time */ + u8 poll_cmd_data; /* to perform OCC poll command */ +- int (*send_cmd)(struct occ *occ, u8 *cmd, size_t len); ++ int (*send_cmd)(struct occ *occ, u8 *cmd, size_t len, void *resp, ++ size_t resp_len); + + unsigned long next_update; + struct mutex lock; /* lock OCC access */ +diff --git a/drivers/hwmon/occ/p8_i2c.c b/drivers/hwmon/occ/p8_i2c.c +index da39ea28df31..b221be1f35f3 100644 +--- a/drivers/hwmon/occ/p8_i2c.c ++++ b/drivers/hwmon/occ/p8_i2c.c +@@ -111,7 +111,8 @@ static int p8_i2c_occ_putscom_be(struct i2c_client *client, u32 address, + be32_to_cpu(data1)); + } + +-static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) ++static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len, ++ void *resp, size_t resp_len) + { + int i, rc; + unsigned long start; +@@ -120,7 +121,7 @@ static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) + const long wait_time = msecs_to_jiffies(OCC_CMD_IN_PRG_WAIT_MS); + struct p8_i2c_occ *ctx = to_p8_i2c_occ(occ); + struct i2c_client *client = ctx->client; +- struct occ_response *resp = &occ->resp; ++ struct occ_response *or = (struct occ_response *)resp; + + start = jiffies; + +@@ -151,7 +152,7 @@ static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) + return rc; + + /* wait for OCC */ +- if (resp->return_status == OCC_RESP_CMD_IN_PRG) { ++ if (or->return_status == OCC_RESP_CMD_IN_PRG) { + rc = -EALREADY; + + if (time_after(jiffies, start + timeout)) +@@ -163,7 +164,7 @@ static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) + } while (rc); + + /* check the OCC response */ +- switch (resp->return_status) { ++ switch (or->return_status) { + case OCC_RESP_CMD_IN_PRG: + rc = -ETIMEDOUT; + break; +@@ -192,8 +193,8 @@ static int p8_i2c_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) + if (rc < 0) + return rc; + +- data_length = get_unaligned_be16(&resp->data_length); +- if (data_length > OCC_RESP_DATA_BYTES) ++ data_length = get_unaligned_be16(&or->data_length); ++ if ((data_length + 7) > resp_len) + return -EMSGSIZE; + + /* fetch the rest of the response data */ +diff --git a/drivers/hwmon/occ/p9_sbe.c b/drivers/hwmon/occ/p9_sbe.c +index 42fc7b97bb34..a91937e28e12 100644 +--- a/drivers/hwmon/occ/p9_sbe.c ++++ b/drivers/hwmon/occ/p9_sbe.c +@@ -78,11 +78,10 @@ static bool p9_sbe_occ_save_ffdc(struct p9_sbe_occ *ctx, const void *resp, + return notify; + } + +-static int p9_sbe_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) ++static int p9_sbe_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len, ++ void *resp, size_t resp_len) + { +- struct occ_response *resp = &occ->resp; + struct p9_sbe_occ *ctx = to_p9_sbe_occ(occ); +- size_t resp_len = sizeof(*resp); + int rc; + + rc = fsi_occ_submit(ctx->sbe, cmd, len, resp, &resp_len); +@@ -96,7 +95,7 @@ static int p9_sbe_occ_send_cmd(struct occ *occ, u8 *cmd, size_t len) + return rc; + } + +- switch (resp->return_status) { ++ switch (((struct occ_response *)resp)->return_status) { + case OCC_RESP_CMD_IN_PRG: + rc = -ETIMEDOUT; + break; +-- +2.37.0 + diff --git a/queue-5.15/net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch b/queue-5.15/net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch new file mode 100644 index 00000000000..38b5ff3c695 --- /dev/null +++ b/queue-5.15/net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch @@ -0,0 +1,41 @@ +From 53ad46169fe2996fe1b623ba6c9c4fa33847876f Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Tue, 28 Jun 2022 11:31:34 +0800 +Subject: net: ipv6: unexport __init-annotated seg6_hmac_net_init() + +From: YueHaibing + +commit 53ad46169fe2996fe1b623ba6c9c4fa33847876f upstream. + +As of commit 5801f064e351 ("net: ipv6: unexport __init-annotated seg6_hmac_init()"), +EXPORT_SYMBOL and __init is a bad combination because the .init.text +section is freed up after the initialization. Hence, modules cannot +use symbols annotated __init. The access to a freed symbol may end up +with kernel panic. + +This remove the EXPORT_SYMBOL to fix modpost warning: + +WARNING: modpost: vmlinux.o(___ksymtab+seg6_hmac_net_init+0x0): Section mismatch in reference from the variable __ksymtab_seg6_hmac_net_init to the function .init.text:seg6_hmac_net_init() +The symbol seg6_hmac_net_init is exported and annotated __init +Fix this by removing the __init annotation of seg6_hmac_net_init or drop the export. + +Fixes: bf355b8d2c30 ("ipv6: sr: add core files for SR HMAC support") +Reported-by: Hulk Robot +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20220628033134.21088-1-yuehaibing@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + net/ipv6/seg6_hmac.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/net/ipv6/seg6_hmac.c ++++ b/net/ipv6/seg6_hmac.c +@@ -408,7 +408,6 @@ int __net_init seg6_hmac_net_init(struct + + return 0; + } +-EXPORT_SYMBOL(seg6_hmac_net_init); + + void seg6_hmac_exit(void) + { diff --git a/queue-5.15/nfsd-restore-einval-error-translation-in-nfsd_commit.patch b/queue-5.15/nfsd-restore-einval-error-translation-in-nfsd_commit.patch new file mode 100644 index 00000000000..034a20f059b --- /dev/null +++ b/queue-5.15/nfsd-restore-einval-error-translation-in-nfsd_commit.patch @@ -0,0 +1,43 @@ +From 8a9ffb8c857c2c99403bd6483a5a005fed5c0773 Mon Sep 17 00:00:00 2001 +From: Alexey Khoroshilov +Date: Sat, 25 Jun 2022 23:52:43 +0300 +Subject: NFSD: restore EINVAL error translation in nfsd_commit() + +From: Alexey Khoroshilov + +commit 8a9ffb8c857c2c99403bd6483a5a005fed5c0773 upstream. + +commit 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t") +incidentally broke translation of -EINVAL to nfserr_notsupp. +The patch restores that. + +Found by Linux Verification Center (linuxtesting.org) with SVACE. + +Signed-off-by: Alexey Khoroshilov +Fixes: 555dbf1a9aac ("nfsd: Replace use of rwsem with errseq_t") +Signed-off-by: Chuck Lever +Signed-off-by: Greg Kroah-Hartman +--- + fs/nfsd/vfs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -1142,6 +1142,7 @@ nfsd_commit(struct svc_rqst *rqstp, stru + nfsd_net_id)); + err2 = filemap_check_wb_err(nf->nf_file->f_mapping, + since); ++ err = nfserrno(err2); + break; + case -EINVAL: + err = nfserr_notsupp; +@@ -1149,8 +1150,8 @@ nfsd_commit(struct svc_rqst *rqstp, stru + default: + nfsd_reset_boot_verifier(net_generic(nf->nf_net, + nfsd_net_id)); ++ err = nfserrno(err2); + } +- err = nfserrno(err2); + } else + nfsd_copy_boot_verifier(verf, net_generic(nf->nf_net, + nfsd_net_id)); diff --git a/queue-5.15/series b/queue-5.15/series index 779e0d28312..530934cf14e 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -30,3 +30,6 @@ linux-dim-fix-divide-by-0-in-rdma-dim.patch net-usb-asix-do-not-force-pause-frames-support.patch usbnet-fix-memory-allocation-in-helpers.patch selftests-mptcp-more-stable-diag-tests.patch +net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch +nfsd-restore-einval-error-translation-in-nfsd_commit.patch +hwmon-occ-prevent-power-cap-command-overwriting-poll-response.patch -- 2.47.3