From 5c613febddb7853c8e7aaddf22de994c92f71740 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 4 Jul 2022 15:25:00 +0200 Subject: [PATCH] 4.14-stable patches added patches: caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch net-bonding-fix-possible-null-deref-in-rlb-code.patch net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch --- ...een-virtio_device_ready-and-ndo_open.patch | 54 +++++++ ...-fix-possible-null-deref-in-rlb-code.patch | 140 ++++++++++++++++++ ...fter-free-after-802.3ad-slave-unbind.patch | 63 ++++++++ ...ement-counter-when-failing-to-update.patch | 44 ++++++ ...ix-irq_of_parse_and_map-return-value.patch | 52 +++++++ ...-issue-a-zero-length-i2c_master_read.patch | 36 +++++ queue-4.14/series | 6 + 7 files changed, 395 insertions(+) create mode 100644 queue-4.14/caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch create mode 100644 queue-4.14/net-bonding-fix-possible-null-deref-in-rlb-code.patch create mode 100644 queue-4.14/net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch create mode 100644 queue-4.14/netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch create mode 100644 queue-4.14/nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch create mode 100644 queue-4.14/nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch diff --git a/queue-4.14/caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch b/queue-4.14/caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch new file mode 100644 index 00000000000..2e7f75eb029 --- /dev/null +++ b/queue-4.14/caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch @@ -0,0 +1,54 @@ +From 11a37eb66812ce6a06b79223ad530eb0e1d7294d Mon Sep 17 00:00:00 2001 +From: Jason Wang +Date: Mon, 20 Jun 2022 13:11:14 +0800 +Subject: caif_virtio: fix race between virtio_device_ready() and ndo_open() + +From: Jason Wang + +commit 11a37eb66812ce6a06b79223ad530eb0e1d7294d upstream. + +We currently depend on probe() calling virtio_device_ready() - +which happens after netdev +registration. Since ndo_open() can be called immediately +after register_netdev, this means there exists a race between +ndo_open() and virtio_device_ready(): the driver may start to use the +device (e.g. TX) before DRIVER_OK which violates the spec. + +Fix this by switching to use register_netdevice() and protect the +virtio_device_ready() with rtnl_lock() to make sure ndo_open() can +only be called after virtio_device_ready(). + +Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") +Signed-off-by: Jason Wang +Message-Id: <20220620051115.3142-3-jasowang@redhat.com> +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/caif/caif_virtio.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/net/caif/caif_virtio.c ++++ b/drivers/net/caif/caif_virtio.c +@@ -727,13 +727,21 @@ static int cfv_probe(struct virtio_devic + /* Carrier is off until netdevice is opened */ + netif_carrier_off(netdev); + ++ /* serialize netdev register + virtio_device_ready() with ndo_open() */ ++ rtnl_lock(); ++ + /* register Netdev */ +- err = register_netdev(netdev); ++ err = register_netdevice(netdev); + if (err) { ++ rtnl_unlock(); + dev_err(&vdev->dev, "Unable to register netdev (%d)\n", err); + goto err; + } + ++ virtio_device_ready(vdev); ++ ++ rtnl_unlock(); ++ + debugfs_init(cfv); + + return 0; diff --git a/queue-4.14/net-bonding-fix-possible-null-deref-in-rlb-code.patch b/queue-4.14/net-bonding-fix-possible-null-deref-in-rlb-code.patch new file mode 100644 index 00000000000..3fa8b526183 --- /dev/null +++ b/queue-4.14/net-bonding-fix-possible-null-deref-in-rlb-code.patch @@ -0,0 +1,140 @@ +From ab84db251c04d38b8dc7ee86e13d4050bedb1c88 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Mon, 27 Jun 2022 10:28:13 +0000 +Subject: net: bonding: fix possible NULL deref in rlb code + +From: Eric Dumazet + +commit ab84db251c04d38b8dc7ee86e13d4050bedb1c88 upstream. + +syzbot has two reports involving the same root cause. + +bond_alb_initialize() must not set bond->alb_info.rlb_enabled +if a memory allocation error is detected. + +Report 1: + +general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] +CPU: 0 PID: 12276 Comm: kworker/u4:10 Not tainted 5.19.0-rc3-syzkaller-00132-g3b89b511ea0c #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Workqueue: netns cleanup_net +RIP: 0010:rlb_clear_slave+0x10e/0x690 drivers/net/bonding/bond_alb.c:393 +Code: 8e fc 83 fb ff 0f 84 74 02 00 00 e8 cc 2a 8e fc 48 8b 44 24 08 89 dd 48 c1 e5 06 4c 8d 34 28 49 8d 7e 14 48 89 f8 48 c1 e8 03 <42> 0f b6 14 20 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 +RSP: 0018:ffffc90018a8f678 EFLAGS: 00010203 +RAX: 0000000000000002 RBX: 0000000000000000 RCX: 0000000000000000 +RDX: ffff88803375bb00 RSI: ffffffff84ec4ac4 RDI: 0000000000000014 +RBP: 0000000000000000 R08: 0000000000000005 R09: 00000000ffffffff +R10: 0000000000000000 R11: 0000000000000000 R12: dffffc0000000000 +R13: ffff8880ac889000 R14: 0000000000000000 R15: ffff88815a668c80 +FS: 0000000000000000(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00005597077e10b0 CR3: 0000000026668000 CR4: 00000000003506f0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +bond_alb_deinit_slave+0x43c/0x6b0 drivers/net/bonding/bond_alb.c:1663 +__bond_release_one.cold+0x383/0xd53 drivers/net/bonding/bond_main.c:2370 +bond_slave_netdev_event drivers/net/bonding/bond_main.c:3778 [inline] +bond_netdev_event+0x993/0xad0 drivers/net/bonding/bond_main.c:3889 +notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 +call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 +call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] +call_netdevice_notifiers net/core/dev.c:1997 [inline] +unregister_netdevice_many+0x948/0x18b0 net/core/dev.c:10839 +default_device_exit_batch+0x449/0x590 net/core/dev.c:11333 +ops_exit_list+0x125/0x170 net/core/net_namespace.c:167 +cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:594 +process_one_work+0x996/0x1610 kernel/workqueue.c:2289 +worker_thread+0x665/0x1080 kernel/workqueue.c:2436 +kthread+0x2e9/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 + + +Report 2: + +general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] +CPU: 1 PID: 5206 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-12108-g58f9d52ff689 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:rlb_req_update_slave_clients+0x109/0x2f0 drivers/net/bonding/bond_alb.c:502 +Code: 5d 18 8f fc 41 80 3e 00 0f 85 a5 01 00 00 89 d8 48 c1 e0 06 49 03 84 24 68 01 00 00 48 8d 78 30 49 89 c7 48 89 fa 48 c1 ea 03 <80> 3c 2a 00 0f 85 98 01 00 00 4d 39 6f 30 75 83 e8 22 18 8f fc 49 +RSP: 0018:ffffc9000300ee80 EFLAGS: 00010206 +RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90016c11000 +RDX: 0000000000000006 RSI: ffffffff84eb6bf3 RDI: 0000000000000030 +RBP: dffffc0000000000 R08: 0000000000000005 R09: 00000000ffffffff +R10: 0000000000000000 R11: 0000000000000000 R12: ffff888027c80c80 +R13: ffff88807d7ff800 R14: ffffed1004f901bd R15: 0000000000000000 +FS: 00007f6f46c58700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000020010000 CR3: 00000000516cc000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + alb_fasten_mac_swap+0x886/0xa80 drivers/net/bonding/bond_alb.c:1070 + bond_alb_handle_active_change+0x624/0x1050 drivers/net/bonding/bond_alb.c:1765 + bond_change_active_slave+0xfa1/0x29b0 drivers/net/bonding/bond_main.c:1173 + bond_select_active_slave+0x23f/0xa50 drivers/net/bonding/bond_main.c:1253 + bond_enslave+0x3b34/0x53b0 drivers/net/bonding/bond_main.c:2159 + do_set_master+0x1c8/0x220 net/core/rtnetlink.c:2577 + rtnl_newlink_create net/core/rtnetlink.c:3380 [inline] + __rtnl_newlink+0x13ac/0x17e0 net/core/rtnetlink.c:3580 + rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593 + rtnetlink_rcv_msg+0x43a/0xc90 net/core/rtnetlink.c:6089 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 + netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] + netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 + netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:734 + ____sys_sendmsg+0x6eb/0x810 net/socket.c:2492 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2546 + __sys_sendmsg net/socket.c:2575 [inline] + __do_sys_sendmsg net/socket.c:2584 [inline] + __se_sys_sendmsg net/socket.c:2582 [inline] + __x64_sys_sendmsg+0x132/0x220 net/socket.c:2582 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7f6f45a89109 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f6f46c58168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f6f45b9c030 RCX: 00007f6f45a89109 +RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000006 +RBP: 00007f6f45ae308d R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007ffed99029af R14: 00007f6f46c58300 R15: 0000000000022000 + + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Jay Vosburgh +Cc: Veaceslav Falico +Cc: Andy Gospodarek +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20220627102813.126264-1-edumazet@google.com +Signed-off-by: Paolo Abeni +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_alb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -1296,12 +1296,12 @@ int bond_alb_initialize(struct bonding * + return res; + + if (rlb_enabled) { +- bond->alb_info.rlb_enabled = 1; + res = rlb_initialize(bond); + if (res) { + tlb_deinitialize(bond); + return res; + } ++ bond->alb_info.rlb_enabled = 1; + } else { + bond->alb_info.rlb_enabled = 0; + } diff --git a/queue-4.14/net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch b/queue-4.14/net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch new file mode 100644 index 00000000000..10d3a03d95a --- /dev/null +++ b/queue-4.14/net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch @@ -0,0 +1,63 @@ +From 050133e1aa2cb49bb17be847d48a4431598ef562 Mon Sep 17 00:00:00 2001 +From: Yevhen Orlov +Date: Wed, 29 Jun 2022 04:29:14 +0300 +Subject: net: bonding: fix use-after-free after 802.3ad slave unbind + +From: Yevhen Orlov + +commit 050133e1aa2cb49bb17be847d48a4431598ef562 upstream. + +commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection"), +resolve case, when there is several aggregation groups in the same bond. +bond_3ad_unbind_slave will invalidate (clear) aggregator when +__agg_active_ports return zero. So, ad_clear_agg can be executed even, when +num_of_ports!=0. Than bond_3ad_unbind_slave can be executed again for, +previously cleared aggregator. NOTE: at this time bond_3ad_unbind_slave +will not update slave ports list, because lag_ports==NULL. So, here we +got slave ports, pointing to freed aggregator memory. + +Fix with checking actual number of ports in group (as was before +commit 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") ), +before ad_clear_agg(). + +The KASAN logs are as follows: + +[ 767.617392] ================================================================== +[ 767.630776] BUG: KASAN: use-after-free in bond_3ad_state_machine_handler+0x13dc/0x1470 +[ 767.638764] Read of size 2 at addr ffff00011ba9d430 by task kworker/u8:7/767 +[ 767.647361] CPU: 3 PID: 767 Comm: kworker/u8:7 Tainted: G O 5.15.11 #15 +[ 767.655329] Hardware name: DNI AmazonGo1 A7040 board (DT) +[ 767.660760] Workqueue: lacp_1 bond_3ad_state_machine_handler +[ 767.666468] Call trace: +[ 767.668930] dump_backtrace+0x0/0x2d0 +[ 767.672625] show_stack+0x24/0x30 +[ 767.675965] dump_stack_lvl+0x68/0x84 +[ 767.679659] print_address_description.constprop.0+0x74/0x2b8 +[ 767.685451] kasan_report+0x1f0/0x260 +[ 767.689148] __asan_load2+0x94/0xd0 +[ 767.692667] bond_3ad_state_machine_handler+0x13dc/0x1470 + +Fixes: 0622cab0341c ("bonding: fix 802.3ad aggregator reselection") +Co-developed-by: Maksym Glubokiy +Signed-off-by: Maksym Glubokiy +Signed-off-by: Yevhen Orlov +Acked-by: Jay Vosburgh +Link: https://lore.kernel.org/r/20220629012914.361-1-yevhen.orlov@plvision.eu +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/bonding/bond_3ad.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/bonding/bond_3ad.c ++++ b/drivers/net/bonding/bond_3ad.c +@@ -2199,7 +2199,8 @@ void bond_3ad_unbind_slave(struct slave + temp_aggregator->num_of_ports--; + if (__agg_active_ports(temp_aggregator) == 0) { + select_new_active_agg = temp_aggregator->is_active; +- ad_clear_agg(temp_aggregator); ++ if (temp_aggregator->num_of_ports == 0) ++ ad_clear_agg(temp_aggregator); + if (select_new_active_agg) { + netdev_info(bond->dev, "Removing an active aggregator\n"); + /* select new active aggregator */ diff --git a/queue-4.14/netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch b/queue-4.14/netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch new file mode 100644 index 00000000000..db9b6478892 --- /dev/null +++ b/queue-4.14/netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch @@ -0,0 +1,44 @@ +From 05907f10e235680cc7fb196810e4ad3215d5e648 Mon Sep 17 00:00:00 2001 +From: Pablo Neira Ayuso +Date: Tue, 21 Jun 2022 14:01:41 +0200 +Subject: netfilter: nft_dynset: restore set element counter when failing to update + +From: Pablo Neira Ayuso + +commit 05907f10e235680cc7fb196810e4ad3215d5e648 upstream. + +This patch fixes a race condition. + +nft_rhash_update() might fail for two reasons: + +- Element already exists in the hashtable. +- Another packet won race to insert an entry in the hashtable. + +In both cases, new() has already bumped the counter via atomic_add_unless(), +therefore, decrement the set element counter. + +Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman +--- + net/netfilter/nft_set_hash.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/netfilter/nft_set_hash.c ++++ b/net/netfilter/nft_set_hash.c +@@ -127,6 +127,7 @@ static bool nft_rhash_update(struct nft_ + /* Another cpu may race to insert the element with the same key */ + if (prev) { + nft_set_elem_destroy(set, he, true); ++ atomic_dec(&set->nelems); + he = prev; + } + +@@ -136,6 +137,7 @@ out: + + err2: + nft_set_elem_destroy(set, he, true); ++ atomic_dec(&set->nelems); + err1: + return false; + } diff --git a/queue-4.14/nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch b/queue-4.14/nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch new file mode 100644 index 00000000000..579daf19143 --- /dev/null +++ b/queue-4.14/nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch @@ -0,0 +1,52 @@ +From 5a478a653b4cca148d5c89832f007ec0809d7e6d Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 27 Jun 2022 14:40:48 +0200 +Subject: nfc: nfcmrvl: Fix irq_of_parse_and_map() return value + +From: Krzysztof Kozlowski + +commit 5a478a653b4cca148d5c89832f007ec0809d7e6d upstream. + +The irq_of_parse_and_map() returns 0 on failure, not a negative ERRNO. + +Reported-by: Lv Ruyi +Fixes: caf6e49bf6d0 ("NFC: nfcmrvl: add spi driver") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220627124048.296253-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/nfcmrvl/i2c.c | 6 +++--- + drivers/nfc/nfcmrvl/spi.c | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/nfc/nfcmrvl/i2c.c ++++ b/drivers/nfc/nfcmrvl/i2c.c +@@ -186,9 +186,9 @@ static int nfcmrvl_i2c_parse_dt(struct d + pdata->irq_polarity = IRQF_TRIGGER_RISING; + + ret = irq_of_parse_and_map(node, 0); +- if (ret < 0) { +- pr_err("Unable to get irq, error: %d\n", ret); +- return ret; ++ if (!ret) { ++ pr_err("Unable to get irq\n"); ++ return -EINVAL; + } + pdata->irq = ret; + +--- a/drivers/nfc/nfcmrvl/spi.c ++++ b/drivers/nfc/nfcmrvl/spi.c +@@ -129,9 +129,9 @@ static int nfcmrvl_spi_parse_dt(struct d + } + + ret = irq_of_parse_and_map(node, 0); +- if (ret < 0) { +- pr_err("Unable to get irq, error: %d\n", ret); +- return ret; ++ if (!ret) { ++ pr_err("Unable to get irq\n"); ++ return -EINVAL; + } + pdata->irq = ret; + diff --git a/queue-4.14/nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch b/queue-4.14/nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch new file mode 100644 index 00000000000..50a8ef6fdb6 --- /dev/null +++ b/queue-4.14/nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch @@ -0,0 +1,36 @@ +From eddd95b9423946aaacb55cac6a9b2cea8ab944fc Mon Sep 17 00:00:00 2001 +From: Michael Walle +Date: Mon, 27 Jun 2022 19:06:42 +0200 +Subject: NFC: nxp-nci: Don't issue a zero length i2c_master_read() + +From: Michael Walle + +commit eddd95b9423946aaacb55cac6a9b2cea8ab944fc upstream. + +There are packets which doesn't have a payload. In that case, the second +i2c_master_read() will have a zero length. But because the NFC +controller doesn't have any data left, it will NACK the I2C read and +-ENXIO will be returned. In case there is no payload, just skip the +second i2c master read. + +Fixes: 6be88670fc59 ("NFC: nxp-nci_i2c: Add I2C support to NXP NCI driver") +Signed-off-by: Michael Walle +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/nfc/nxp-nci/i2c.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/nfc/nxp-nci/i2c.c ++++ b/drivers/nfc/nxp-nci/i2c.c +@@ -178,6 +178,9 @@ static int nxp_nci_i2c_nci_read(struct n + + skb_put_data(*skb, (void *)&header, NCI_CTRL_HDR_SIZE); + ++ if (!header.plen) ++ return 0; ++ + r = i2c_master_recv(client, skb_put(*skb, header.plen), header.plen); + if (r != header.plen) { + nfc_err(&client->dev, diff --git a/queue-4.14/series b/queue-4.14/series index 463bf630b39..79e8d981a1e 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -8,3 +8,9 @@ net-usb-ax88179_178a-fix-packet-receiving.patch rdma-qedr-fix-reporting-qp-timeout-attribute.patch usbnet-fix-memory-allocation-in-helpers.patch net-ipv6-unexport-__init-annotated-seg6_hmac_net_init.patch +caif_virtio-fix-race-between-virtio_device_ready-and-ndo_open.patch +netfilter-nft_dynset-restore-set-element-counter-when-failing-to-update.patch +net-bonding-fix-possible-null-deref-in-rlb-code.patch +net-bonding-fix-use-after-free-after-802.3ad-slave-unbind.patch +nfc-nfcmrvl-fix-irq_of_parse_and_map-return-value.patch +nfc-nxp-nci-don-t-issue-a-zero-length-i2c_master_read.patch -- 2.47.3