]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
5.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 21 Mar 2021 12:37:19 +0000 (13:37 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 21 Mar 2021 12:37:19 +0000 (13:37 +0100)
added patches:
scsi-lpfc-fix-some-error-codes-in-debugfs.patch
scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch

queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch [new file with mode: 0644]
queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch [new file with mode: 0644]
queue-5.4/series

diff --git a/queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch b/queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch
new file mode 100644 (file)
index 0000000..9eb88ed
--- /dev/null
@@ -0,0 +1,41 @@
+From 19f1bc7edf0f97186810e13a88f5b62069d89097 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 12 Mar 2021 10:42:11 +0300
+Subject: scsi: lpfc: Fix some error codes in debugfs
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 19f1bc7edf0f97186810e13a88f5b62069d89097 upstream.
+
+If copy_from_user() or kstrtoull() fail then the correct behavior is to
+return a negative error code.
+
+Link: https://lore.kernel.org/r/YEsbU/UxYypVrC7/@mwanda
+Fixes: f9bb2da11db8 ("[SCSI] lpfc 8.3.27: T10 additions for SLI4")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/lpfc/lpfc_debugfs.c |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_debugfs.c
++++ b/drivers/scsi/lpfc/lpfc_debugfs.c
+@@ -2217,7 +2217,7 @@ lpfc_debugfs_dif_err_write(struct file *
+       memset(dstbuf, 0, 33);
+       size = (nbytes < 32) ? nbytes : 32;
+       if (copy_from_user(dstbuf, buf, size))
+-              return 0;
++              return -EFAULT;
+       if (dent == phba->debug_InjErrLBA) {
+               if ((buf[0] == 'o') && (buf[1] == 'f') && (buf[2] == 'f'))
+@@ -2225,7 +2225,7 @@ lpfc_debugfs_dif_err_write(struct file *
+       }
+       if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp)))
+-              return 0;
++              return -EINVAL;
+       if (dent == phba->debug_writeGuard)
+               phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp;
diff --git a/queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch b/queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch
new file mode 100644 (file)
index 0000000..50cf7e7
--- /dev/null
@@ -0,0 +1,37 @@
+From 2bb817712e2f77486d6ee17e7efaf91997a685f8 Mon Sep 17 00:00:00 2001
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Date: Wed, 10 Mar 2021 22:30:05 -0800
+Subject: scsi: myrs: Fix a double free in myrs_cleanup()
+
+From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+
+commit 2bb817712e2f77486d6ee17e7efaf91997a685f8 upstream.
+
+In myrs_cleanup(), cs->mmio_base will be freed twice by iounmap().
+
+Link: https://lore.kernel.org/r/20210311063005.9963-1-lyl2019@mail.ustc.edu.cn
+Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)")
+Reviewed-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/scsi/myrs.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/myrs.c
++++ b/drivers/scsi/myrs.c
+@@ -2274,12 +2274,12 @@ static void myrs_cleanup(struct myrs_hba
+       if (cs->mmio_base) {
+               cs->disable_intr(cs);
+               iounmap(cs->mmio_base);
++              cs->mmio_base = NULL;
+       }
+       if (cs->irq)
+               free_irq(cs->irq, cs);
+       if (cs->io_addr)
+               release_region(cs->io_addr, 0x80);
+-      iounmap(cs->mmio_base);
+       pci_set_drvdata(pdev, NULL);
+       pci_disable_device(pdev);
+       scsi_host_put(cs->host);
index b231ef09f6a7ef5d2c77f5e8f97345a8df7d97d7..bb0e26c328fdacadc582635e760f3d350f0d5be8 100644 (file)
@@ -27,3 +27,5 @@ sunrpc-fix-refcount-leak-for-rpc-auth-modules.patch
 net-qrtr-fix-__netdev_alloc_skb-call.patch
 kbuild-fix-linux-version.h-for-empty-sublevel-or-patchlevel-again.patch
 riscv-correct-sparsemem-configuration.patch
+scsi-lpfc-fix-some-error-codes-in-debugfs.patch
+scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch