From 6f826c7e5b24fd3f5184269053cf9bfc3c43ea57 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 24 Dec 2023 19:41:25 -0500 Subject: [PATCH] Fixes for 4.19 Signed-off-by: Sasha Levin --- ...050-fix-an-error-code-problem-in-inv.patch | 45 +++++++++++++++ ...-keys-add-error-handling-for-devm_km.patch | 40 ++++++++++++++ ...fc-fix-skb-double-free-in-bnx2fc_rcv.patch | 55 +++++++++++++++++++ ...emove-set-but-not-used-variable-oxid.patch | 47 ++++++++++++++++ queue-4.19/series | 4 ++ 5 files changed, 191 insertions(+) create mode 100644 queue-4.19/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch create mode 100644 queue-4.19/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch create mode 100644 queue-4.19/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch create mode 100644 queue-4.19/scsi-bnx2fc-remove-set-but-not-used-variable-oxid.patch diff --git a/queue-4.19/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch b/queue-4.19/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch new file mode 100644 index 00000000000..800ecc7eca3 --- /dev/null +++ b/queue-4.19/iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch @@ -0,0 +1,45 @@ +From 0534b4a5185d0e9048abd9ba245221bc83b845de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Oct 2023 10:02:19 +0800 +Subject: iio: imu: inv_mpu6050: fix an error code problem in + inv_mpu6050_read_raw + +From: Su Hui + +[ Upstream commit c3df0e29fb7788c4b3ddf37d5ed87dda2b822943 ] + +inv_mpu6050_sensor_show() can return -EINVAL or IIO_VAL_INT. Return the +true value rather than only return IIO_VAL_INT. + +Fixes: d5098447147c ("iio: imu: mpu6050: add calibration offset support") +Signed-off-by: Su Hui +Link: https://lore.kernel.org/r/20231030020218.65728-1-suhui@nfschina.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +index 6b560d99f3851..351032e4eaadc 100644 +--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c ++++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c +@@ -508,13 +508,13 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev, + ret = inv_mpu6050_sensor_show(st, st->reg->gyro_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + case IIO_ACCEL: + mutex_lock(&st->lock); + ret = inv_mpu6050_sensor_show(st, st->reg->accl_offset, + chan->channel2, val); + mutex_unlock(&st->lock); +- return IIO_VAL_INT; ++ return ret; + + default: + return -EINVAL; +-- +2.43.0 + diff --git a/queue-4.19/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch b/queue-4.19/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch new file mode 100644 index 00000000000..b4179560e5c --- /dev/null +++ b/queue-4.19/input-ipaq-micro-keys-add-error-handling-for-devm_km.patch @@ -0,0 +1,40 @@ +From 0fb3a48fb4e478a6a3cffba50fddc2eb1e1f33c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Dec 2023 19:00:23 +0000 +Subject: Input: ipaq-micro-keys - add error handling for devm_kmemdup + +From: Haoran Liu + +[ Upstream commit 59b6a747e2d39227ac2325c5e29d6ab3bb070c2a ] + +Check the return value of i2c_add_adapter. Static analysis revealed that +the function did not properly handle potential failures of +i2c_add_adapter, which could lead to partial initialization of the I2C +adapter and unstable operation. + +Signed-off-by: Haoran Liu +Link: https://lore.kernel.org/r/20231203164653.38983-1-liuhaoran14@163.com +Fixes: d7535ffa427b ("Input: driver for microcontroller keys on the iPaq h3xxx") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/ipaq-micro-keys.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/input/keyboard/ipaq-micro-keys.c b/drivers/input/keyboard/ipaq-micro-keys.c +index 602900d1f9378..2d0d09ee9ab08 100644 +--- a/drivers/input/keyboard/ipaq-micro-keys.c ++++ b/drivers/input/keyboard/ipaq-micro-keys.c +@@ -108,6 +108,9 @@ static int micro_key_probe(struct platform_device *pdev) + keys->codes = devm_kmemdup(&pdev->dev, micro_keycodes, + keys->input->keycodesize * keys->input->keycodemax, + GFP_KERNEL); ++ if (!keys->codes) ++ return -ENOMEM; ++ + keys->input->keycode = keys->codes; + + __set_bit(EV_KEY, keys->input->evbit); +-- +2.43.0 + diff --git a/queue-4.19/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch b/queue-4.19/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch new file mode 100644 index 00000000000..787731f7bd1 --- /dev/null +++ b/queue-4.19/scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch @@ -0,0 +1,55 @@ +From 945b7616fd2853dc51b7c7bafd006e23dcece996 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Nov 2022 11:06:26 +0000 +Subject: scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() + +From: Wei Yongjun + +[ Upstream commit 08c94d80b2da481652fb633e79cbc41e9e326a91 ] + +skb_share_check() already drops the reference to the skb when returning +NULL. Using kfree_skb() in the error handling path leads to an skb double +free. + +Fix this by removing the variable tmp_skb, and return directly when +skb_share_check() returns NULL. + +Fixes: 01a4cc4d0cd6 ("bnx2fc: do not add shared skbs to the fcoe_rx_list") +Signed-off-by: Wei Yongjun +Link: https://lore.kernel.org/r/20221114110626.526643-1-weiyongjun@huaweicloud.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index 9f6a60bd64448..2ab1fbf12ae1f 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -435,7 +435,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + struct fc_frame_header *fh; + struct fcoe_rcv_info *fr; + struct fcoe_percpu_s *bg; +- struct sk_buff *tmp_skb; + + interface = container_of(ptype, struct bnx2fc_interface, + fcoe_packet_type); +@@ -447,11 +446,9 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + goto err; + } + +- tmp_skb = skb_share_check(skb, GFP_ATOMIC); +- if (!tmp_skb) +- goto err; +- +- skb = tmp_skb; ++ skb = skb_share_check(skb, GFP_ATOMIC); ++ if (!skb) ++ return -1; + + if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) { + printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n"); +-- +2.43.0 + diff --git a/queue-4.19/scsi-bnx2fc-remove-set-but-not-used-variable-oxid.patch b/queue-4.19/scsi-bnx2fc-remove-set-but-not-used-variable-oxid.patch new file mode 100644 index 00000000000..2c5fa85db85 --- /dev/null +++ b/queue-4.19/scsi-bnx2fc-remove-set-but-not-used-variable-oxid.patch @@ -0,0 +1,47 @@ +From ee26427ddcaf4fa6060b65ecb67a6528c72d714d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Sep 2018 02:50:52 +0000 +Subject: scsi: bnx2fc: Remove set but not used variable 'oxid' + +From: YueHaibing + +[ Upstream commit efcbe99818ac9bd93ac41e8cf954e9aa64dd9971 ] + +Fixes gcc '-Wunused-but-set-variable' warning: + +drivers/scsi/bnx2fc/bnx2fc_fcoe.c: In function 'bnx2fc_rcv': +drivers/scsi/bnx2fc/bnx2fc_fcoe.c:435:17: warning: + variable 'oxid' set but not used [-Wunused-but-set-variable] + +Signed-off-by: YueHaibing +Signed-off-by: Martin K. Petersen +Stable-dep-of: 08c94d80b2da ("scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()") +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +index ea2c601da8e15..9f6a60bd64448 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c +@@ -436,7 +436,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + struct fcoe_rcv_info *fr; + struct fcoe_percpu_s *bg; + struct sk_buff *tmp_skb; +- unsigned short oxid; + + interface = container_of(ptype, struct bnx2fc_interface, + fcoe_packet_type); +@@ -470,8 +469,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev, + skb_set_transport_header(skb, sizeof(struct fcoe_hdr)); + fh = (struct fc_frame_header *) skb_transport_header(skb); + +- oxid = ntohs(fh->fh_ox_id); +- + fr = fcoe_dev_from_skb(skb); + fr->fr_dev = lport; + +-- +2.43.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 9e45ed19dc0..9d39a7f0e02 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -19,3 +19,7 @@ net-check-dev-gso_max_size-in-gso_features_check.patch pinctrl-at91-pio4-use-dedicated-lock-class-for-irq.patch smb-client-fix-null-deref-in-asn1_ber_decoder.patch btrfs-do-not-allow-non-subvolume-root-targets-for-sn.patch +iio-imu-inv_mpu6050-fix-an-error-code-problem-in-inv.patch +input-ipaq-micro-keys-add-error-handling-for-devm_km.patch +scsi-bnx2fc-remove-set-but-not-used-variable-oxid.patch +scsi-bnx2fc-fix-skb-double-free-in-bnx2fc_rcv.patch -- 2.47.3