From: Sasha Levin Date: Mon, 20 Nov 2023 14:23:35 +0000 (-0500) Subject: Fixes for 4.14 X-Git-Tag: v4.14.331~148 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=16eb44e5418f286fd33650cd3947969f9626b1e9;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.14 Signed-off-by: Sasha Levin --- diff --git a/queue-4.14/alsa-hda-fix-possible-null-ptr-deref-when-assigning-.patch b/queue-4.14/alsa-hda-fix-possible-null-ptr-deref-when-assigning-.patch new file mode 100644 index 00000000000..8271b3fb95a --- /dev/null +++ b/queue-4.14/alsa-hda-fix-possible-null-ptr-deref-when-assigning-.patch @@ -0,0 +1,42 @@ +From 0bbe695ced8d4fa43a9a94e3246c245689cb6ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Oct 2023 12:28:55 +0200 +Subject: ALSA: hda: Fix possible null-ptr-deref when assigning a stream + +From: Cezary Rojewski + +[ Upstream commit f93dc90c2e8ed664985e366aa6459ac83cdab236 ] + +While AudioDSP drivers assign streams exclusively of HOST or LINK type, +nothing blocks a user to attempt to assign a COUPLED stream. As +supplied substream instance may be a stub, what is the case when +code-loading, such scenario ends with null-ptr-deref. + +Signed-off-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20231006102857.749143-2-cezary.rojewski@intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/hda/hdac_stream.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/hda/hdac_stream.c b/sound/hda/hdac_stream.c +index e1472c7ab6c17..609dc5133fba9 100644 +--- a/sound/hda/hdac_stream.c ++++ b/sound/hda/hdac_stream.c +@@ -241,8 +241,10 @@ struct hdac_stream *snd_hdac_stream_assign(struct hdac_bus *bus, + struct hdac_stream *res = NULL; + + /* make a non-zero unique key for the substream */ +- int key = (substream->pcm->device << 16) | (substream->number << 2) | +- (substream->stream + 1); ++ int key = (substream->number << 2) | (substream->stream + 1); ++ ++ if (substream->pcm) ++ key |= (substream->pcm->device << 16); + + list_for_each_entry(azx_dev, &bus->stream_list, list) { + if (azx_dev->direction != substream->stream) +-- +2.42.0 + diff --git a/queue-4.14/atm-iphase-do-pci-error-checks-on-own-line.patch b/queue-4.14/atm-iphase-do-pci-error-checks-on-own-line.patch new file mode 100644 index 00000000000..83ad331f8a4 --- /dev/null +++ b/queue-4.14/atm-iphase-do-pci-error-checks-on-own-line.patch @@ -0,0 +1,68 @@ +From 4538fbd0059b8e64e380e7944f10fc24419e3de3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Sep 2023 15:53:51 +0300 +Subject: atm: iphase: Do PCI error checks on own line +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit c28742447ca9879b52fbaf022ad844f0ffcd749c ] + +In get_esi() PCI errors are checked inside line-split "if" conditions (in +addition to the file not following the coding style). To make the code in +get_esi() more readable, fix the coding style and use the usual error +handling pattern with a separate variable. + +In addition, initialization of 'error' variable at declaration is not +needed. + +No functional changes intended. + +Link: https://lore.kernel.org/r/20230911125354.25501-4-ilpo.jarvinen@linux.intel.com +Signed-off-by: Ilpo Järvinen +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/atm/iphase.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c +index 16eb0266a59ab..7ab8fa3478484 100644 +--- a/drivers/atm/iphase.c ++++ b/drivers/atm/iphase.c +@@ -2290,19 +2290,21 @@ static int get_esi(struct atm_dev *dev) + static int reset_sar(struct atm_dev *dev) + { + IADEV *iadev; +- int i, error = 1; ++ int i, error; + unsigned int pci[64]; + + iadev = INPH_IA_DEV(dev); +- for(i=0; i<64; i++) +- if ((error = pci_read_config_dword(iadev->pci, +- i*4, &pci[i])) != PCIBIOS_SUCCESSFUL) +- return error; ++ for (i = 0; i < 64; i++) { ++ error = pci_read_config_dword(iadev->pci, i * 4, &pci[i]); ++ if (error != PCIBIOS_SUCCESSFUL) ++ return error; ++ } + writel(0, iadev->reg+IPHASE5575_EXT_RESET); +- for(i=0; i<64; i++) +- if ((error = pci_write_config_dword(iadev->pci, +- i*4, pci[i])) != PCIBIOS_SUCCESSFUL) +- return error; ++ for (i = 0; i < 64; i++) { ++ error = pci_write_config_dword(iadev->pci, i * 4, pci[i]); ++ if (error != PCIBIOS_SUCCESSFUL) ++ return error; ++ } + udelay(5); + return 0; + } +-- +2.42.0 + diff --git a/queue-4.14/clocksource-drivers-timer-atmel-tcb-fix-initializati.patch b/queue-4.14/clocksource-drivers-timer-atmel-tcb-fix-initializati.patch new file mode 100644 index 00000000000..50ba846382a --- /dev/null +++ b/queue-4.14/clocksource-drivers-timer-atmel-tcb-fix-initializati.patch @@ -0,0 +1,56 @@ +From 9205c181f48d35b7725d0bf1b625b1bcbcff66d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Oct 2023 18:17:13 +0200 +Subject: clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 + hardware + +From: Ronald Wahl + +[ Upstream commit 6d3bc4c02d59996d1d3180d8ed409a9d7d5900e0 ] + +On SAM9 hardware two cascaded 16 bit timers are used to form a 32 bit +high resolution timer that is used as scheduler clock when the kernel +has been configured that way (CONFIG_ATMEL_CLOCKSOURCE_TCB). + +The driver initially triggers a reset-to-zero of the two timers but this +reset is only performed on the next rising clock. For the first timer +this is ok - it will be in the next 60ns (16MHz clock). For the chained +second timer this will only happen after the first timer overflows, i.e. +after 2^16 clocks (~4ms with a 16MHz clock). So with other words the +scheduler clock resets to 0 after the first 2^16 clock cycles. + +It looks like that the scheduler does not like this and behaves wrongly +over its lifetime, e.g. some tasks are scheduled with a long delay. Why +that is and if there are additional requirements for this behaviour has +not been further analysed. + +There is a simple fix for resetting the second timer as well when the +first timer is reset and this is to set the ATMEL_TC_ASWTRG_SET bit in +the Channel Mode register (CMR) of the first timer. This will also rise +the TIOA line (clock input of the second timer) when a software trigger +respective SYNC is issued. + +Signed-off-by: Ronald Wahl +Acked-by: Alexandre Belloni +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20231007161803.31342-1-rwahl@gmx.de +Signed-off-by: Sasha Levin +--- + drivers/clocksource/tcb_clksrc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clocksource/tcb_clksrc.c b/drivers/clocksource/tcb_clksrc.c +index 9de47d4d2d9ef..e489730331a23 100644 +--- a/drivers/clocksource/tcb_clksrc.c ++++ b/drivers/clocksource/tcb_clksrc.c +@@ -294,6 +294,7 @@ static void __init tcb_setup_dual_chan(struct atmel_tc *tc, int mck_divisor_idx) + writel(mck_divisor_idx /* likely divide-by-8 */ + | ATMEL_TC_WAVE + | ATMEL_TC_WAVESEL_UP /* free-run */ ++ | ATMEL_TC_ASWTRG_SET /* TIOA0 rises at software trigger */ + | ATMEL_TC_ACPA_SET /* TIOA0 rises at 0 */ + | ATMEL_TC_ACPC_CLEAR, /* (duty cycle 50%) */ + tcaddr + ATMEL_TC_REG(0, CMR)); +-- +2.42.0 + diff --git a/queue-4.14/clocksource-drivers-timer-imx-gpt-fix-potential-memo.patch b/queue-4.14/clocksource-drivers-timer-imx-gpt-fix-potential-memo.patch new file mode 100644 index 00000000000..ba30a47541d --- /dev/null +++ b/queue-4.14/clocksource-drivers-timer-imx-gpt-fix-potential-memo.patch @@ -0,0 +1,66 @@ +From fb8c322d7bd14d21cfadf155f88d4c2010ae4e52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Oct 2023 16:39:22 +0800 +Subject: clocksource/drivers/timer-imx-gpt: Fix potential memory leak + +From: Jacky Bai + +[ Upstream commit 8051a993ce222a5158bccc6ac22ace9253dd71cb ] + +Fix coverity Issue CID 250382: Resource leak (RESOURCE_LEAK). +Add kfree when error return. + +Signed-off-by: Jacky Bai +Reviewed-by: Peng Fan +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20231009083922.1942971-1-ping.bai@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-imx-gpt.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/clocksource/timer-imx-gpt.c b/drivers/clocksource/timer-imx-gpt.c +index 6ec6d79b237ce..fcc12f72e907f 100644 +--- a/drivers/clocksource/timer-imx-gpt.c ++++ b/drivers/clocksource/timer-imx-gpt.c +@@ -489,12 +489,16 @@ static int __init mxc_timer_init_dt(struct device_node *np, enum imx_gpt_type t + return -ENOMEM; + + imxtm->base = of_iomap(np, 0); +- if (!imxtm->base) +- return -ENXIO; ++ if (!imxtm->base) { ++ ret = -ENXIO; ++ goto err_kfree; ++ } + + imxtm->irq = irq_of_parse_and_map(np, 0); +- if (imxtm->irq <= 0) +- return -EINVAL; ++ if (imxtm->irq <= 0) { ++ ret = -EINVAL; ++ goto err_kfree; ++ } + + imxtm->clk_ipg = of_clk_get_by_name(np, "ipg"); + +@@ -507,11 +511,15 @@ static int __init mxc_timer_init_dt(struct device_node *np, enum imx_gpt_type t + + ret = _mxc_timer_init(imxtm); + if (ret) +- return ret; ++ goto err_kfree; + + initialized = 1; + + return 0; ++ ++err_kfree: ++ kfree(imxtm); ++ return ret; + } + + static int __init imx1_timer_init_dt(struct device_node *np) +-- +2.42.0 + diff --git a/queue-4.14/crypto-pcrypt-fix-hungtask-for-padata_reset.patch b/queue-4.14/crypto-pcrypt-fix-hungtask-for-padata_reset.patch new file mode 100644 index 00000000000..ead5df10d09 --- /dev/null +++ b/queue-4.14/crypto-pcrypt-fix-hungtask-for-padata_reset.patch @@ -0,0 +1,106 @@ +From 19129510e3dbf084ac680159f6e7ee183bdec52f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Sep 2023 13:33:41 +0000 +Subject: crypto: pcrypt - Fix hungtask for PADATA_RESET + +From: Lu Jialin + +[ Upstream commit 8f4f68e788c3a7a696546291258bfa5fdb215523 ] + +We found a hungtask bug in test_aead_vec_cfg as follows: + +INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. +"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. +Call trace: + __switch_to+0x98/0xe0 + __schedule+0x6c4/0xf40 + schedule+0xd8/0x1b4 + schedule_timeout+0x474/0x560 + wait_for_common+0x368/0x4e0 + wait_for_completion+0x20/0x30 + wait_for_completion+0x20/0x30 + test_aead_vec_cfg+0xab4/0xd50 + test_aead+0x144/0x1f0 + alg_test_aead+0xd8/0x1e0 + alg_test+0x634/0x890 + cryptomgr_test+0x40/0x70 + kthread+0x1e0/0x220 + ret_from_fork+0x10/0x18 + Kernel panic - not syncing: hung_task: blocked tasks + +For padata_do_parallel, when the return err is 0 or -EBUSY, it will call +wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal +case, aead_request_complete() will be called in pcrypt_aead_serial and the +return err is 0 for padata_do_parallel. But, when pinst->flags is +PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it +won't call aead_request_complete(). Therefore, test_aead_vec_cfg will +hung at wait_for_completion(&wait->completion), which will cause +hungtask. + +The problem comes as following: +(padata_do_parallel) | + rcu_read_lock_bh(); | + err = -EINVAL; | (padata_replace) + | pinst->flags |= PADATA_RESET; + err = -EBUSY | + if (pinst->flags & PADATA_RESET) | + rcu_read_unlock_bh() | + return err + +In order to resolve the problem, we replace the return err -EBUSY with +-EAGAIN, which means parallel_data is changing, and the caller should call +it again. + +v3: +remove retry and just change the return err. +v2: +introduce padata_try_do_parallel() in pcrypt_aead_encrypt and +pcrypt_aead_decrypt to solve the hungtask. + +Signed-off-by: Lu Jialin +Signed-off-by: Guo Zihua +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/pcrypt.c | 4 ++++ + kernel/padata.c | 2 +- + 2 files changed, 5 insertions(+), 1 deletion(-) + +diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c +index 62e11835f220e..1e9de81ef84fa 100644 +--- a/crypto/pcrypt.c ++++ b/crypto/pcrypt.c +@@ -174,6 +174,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req) + err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pencrypt); + if (!err) + return -EINPROGRESS; ++ if (err == -EBUSY) ++ return -EAGAIN; + + return err; + } +@@ -218,6 +220,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req) + err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pdecrypt); + if (!err) + return -EINPROGRESS; ++ if (err == -EBUSY) ++ return -EAGAIN; + + return err; + } +diff --git a/kernel/padata.c b/kernel/padata.c +index f56ec63f60ba8..82f6d5bf5cb45 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -120,7 +120,7 @@ int padata_do_parallel(struct padata_instance *pinst, + if (!cpumask_test_cpu(cb_cpu, pd->cpumask.cbcpu)) + goto out; + +- err = -EBUSY; ++ err = -EBUSY; + if ((pinst->flags & PADATA_RESET)) + goto out; + +-- +2.42.0 + diff --git a/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-pola.patch b/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-pola.patch new file mode 100644 index 00000000000..c53da93c72f --- /dev/null +++ b/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-pola.patch @@ -0,0 +1,81 @@ +From 69a8379e6f9c5373bb1fb1e89677bbaa4271624a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 15:46:44 -0500 +Subject: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga + +From: Mario Limonciello + +[ Upstream commit 0f0e59075b5c22f1e871fbd508d6e4f495048356 ] + +For pptable structs that use flexible array sizes, use flexible arrays. + +Link: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2036742 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h +index d5a4a08c6d392..0c61e2bc14cde 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h +@@ -164,7 +164,7 @@ typedef struct _ATOM_Tonga_State { + typedef struct _ATOM_Tonga_State_Array { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_State entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_State entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_State_Array; + + typedef struct _ATOM_Tonga_MCLK_Dependency_Record { +@@ -210,7 +210,7 @@ typedef struct _ATOM_Polaris_SCLK_Dependency_Record { + typedef struct _ATOM_Polaris_SCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Polaris_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Polaris_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Polaris_SCLK_Dependency_Table; + + typedef struct _ATOM_Tonga_PCIE_Record { +@@ -222,7 +222,7 @@ typedef struct _ATOM_Tonga_PCIE_Record { + typedef struct _ATOM_Tonga_PCIE_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_PCIE_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_PCIE_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_PCIE_Table; + + typedef struct _ATOM_Polaris10_PCIE_Record { +@@ -235,7 +235,7 @@ typedef struct _ATOM_Polaris10_PCIE_Record { + typedef struct _ATOM_Polaris10_PCIE_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Polaris10_PCIE_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Polaris10_PCIE_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Polaris10_PCIE_Table; + + +@@ -252,7 +252,7 @@ typedef struct _ATOM_Tonga_MM_Dependency_Record { + typedef struct _ATOM_Tonga_MM_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_MM_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_MM_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_MM_Dependency_Table; + + typedef struct _ATOM_Tonga_Voltage_Lookup_Record { +@@ -265,7 +265,7 @@ typedef struct _ATOM_Tonga_Voltage_Lookup_Record { + typedef struct _ATOM_Tonga_Voltage_Lookup_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_Voltage_Lookup_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_Voltage_Lookup_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_Voltage_Lookup_Table; + + typedef struct _ATOM_Tonga_Fan_Table { +-- +2.42.0 + diff --git a/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-smu7.patch b/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-smu7.patch new file mode 100644 index 00000000000..84e4f3ea13c --- /dev/null +++ b/queue-4.14/drm-amd-fix-ubsan-array-index-out-of-bounds-for-smu7.patch @@ -0,0 +1,69 @@ +From 59f1cdb31ab1ed4540dbef98c9c42f75ac85b4f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 15:22:52 -0500 +Subject: drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 + +From: Mario Limonciello + +[ Upstream commit 760efbca74a405dc439a013a5efaa9fadc95a8c3 ] + +For pptable structs that use flexible array sizes, use flexible arrays. + +Suggested-by: Felix Held +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2874 +Signed-off-by: Mario Limonciello +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/include/pptable.h | 4 ++-- + drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/include/pptable.h b/drivers/gpu/drm/amd/include/pptable.h +index 0b6a057e0a4c4..5aac8d545bdc6 100644 +--- a/drivers/gpu/drm/amd/include/pptable.h ++++ b/drivers/gpu/drm/amd/include/pptable.h +@@ -78,7 +78,7 @@ typedef struct _ATOM_PPLIB_THERMALCONTROLLER + typedef struct _ATOM_PPLIB_STATE + { + UCHAR ucNonClockStateIndex; +- UCHAR ucClockStateIndices[1]; // variable-sized ++ UCHAR ucClockStateIndices[]; // variable-sized + } ATOM_PPLIB_STATE; + + +@@ -473,7 +473,7 @@ typedef struct _ATOM_PPLIB_STATE_V2 + /** + * Driver will read the first ucNumDPMLevels in this array + */ +- UCHAR clockInfoIndex[1]; ++ UCHAR clockInfoIndex[]; + } ATOM_PPLIB_STATE_V2; + + typedef struct _StateArray{ +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h +index 1e870f58dd12a..d5a4a08c6d392 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/pptable_v1_0.h +@@ -179,7 +179,7 @@ typedef struct _ATOM_Tonga_MCLK_Dependency_Record { + typedef struct _ATOM_Tonga_MCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_MCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_MCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_MCLK_Dependency_Table; + + typedef struct _ATOM_Tonga_SCLK_Dependency_Record { +@@ -194,7 +194,7 @@ typedef struct _ATOM_Tonga_SCLK_Dependency_Record { + typedef struct _ATOM_Tonga_SCLK_Dependency_Table { + UCHAR ucRevId; + UCHAR ucNumEntries; /* Number of entries. */ +- ATOM_Tonga_SCLK_Dependency_Record entries[1]; /* Dynamically allocate entries. */ ++ ATOM_Tonga_SCLK_Dependency_Record entries[]; /* Dynamically allocate entries. */ + } ATOM_Tonga_SCLK_Dependency_Table; + + typedef struct _ATOM_Polaris_SCLK_Dependency_Record { +-- +2.42.0 + diff --git a/queue-4.14/fs-jfs-add-check-for-negative-db_l2nbperpage.patch b/queue-4.14/fs-jfs-add-check-for-negative-db_l2nbperpage.patch new file mode 100644 index 00000000000..7c9a6272f53 --- /dev/null +++ b/queue-4.14/fs-jfs-add-check-for-negative-db_l2nbperpage.patch @@ -0,0 +1,46 @@ +From 2a865e9418c08f855ed0dcf51bffba1bc5f6daba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Oct 2023 17:56:58 +0800 +Subject: fs/jfs: Add check for negative db_l2nbperpage + +From: Juntong Deng + +[ Upstream commit 525b861a008143048535011f3816d407940f4bfa ] + +l2nbperpage is log2(number of blks per page), and the minimum legal +value should be 0, not negative. + +In the case of l2nbperpage being negative, an error will occur +when subsequently used as shift exponent. + +Syzbot reported this bug: + +UBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12 +shift exponent -16777216 is negative + +Reported-by: syzbot+debee9ab7ae2b34b0307@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=debee9ab7ae2b34b0307 +Signed-off-by: Juntong Deng +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 95e8f031c3f11..070638718be32 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -193,7 +193,8 @@ int dbMount(struct inode *ipbmap) + bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); + + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); +- if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE) { ++ if (bmp->db_l2nbperpage > L2PSIZE - L2MINBLOCKSIZE || ++ bmp->db_l2nbperpage < 0) { + err = -EINVAL; + goto err_release_metapage; + } +-- +2.42.0 + diff --git a/queue-4.14/fs-jfs-add-validity-check-for-db_maxag-and-db_agpref.patch b/queue-4.14/fs-jfs-add-validity-check-for-db_maxag-and-db_agpref.patch new file mode 100644 index 00000000000..0060851c3f9 --- /dev/null +++ b/queue-4.14/fs-jfs-add-validity-check-for-db_maxag-and-db_agpref.patch @@ -0,0 +1,50 @@ +From 7962cd4519a3d8617684e23367e42310b1cecab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 02:06:41 +0800 +Subject: fs/jfs: Add validity check for db_maxag and db_agpref + +From: Juntong Deng + +[ Upstream commit 64933ab7b04881c6c18b21ff206c12278341c72e ] + +Both db_maxag and db_agpref are used as the index of the +db_agfree array, but there is currently no validity check for +db_maxag and db_agpref, which can lead to errors. + +The following is related bug reported by Syzbot: + +UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:639:20 +index 7936 is out of range for type 'atomic_t[128]' + +Add checking that the values of db_maxag and db_agpref are valid +indexes for the db_agfree array. + +Reported-by: syzbot+38e876a8aa44b7115c76@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=38e876a8aa44b7115c76 +Signed-off-by: Juntong Deng +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 070638718be32..713f11dee52aa 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -208,6 +208,12 @@ int dbMount(struct inode *ipbmap) + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); + bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); + bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); ++ if (bmp->db_maxag >= MAXAG || bmp->db_maxag < 0 || ++ bmp->db_agpref >= MAXAG || bmp->db_agpref < 0) { ++ err = -EINVAL; ++ goto err_release_metapage; ++ } ++ + bmp->db_aglevel = le32_to_cpu(dbmp_le->dn_aglevel); + bmp->db_agheight = le32_to_cpu(dbmp_le->dn_agheight); + bmp->db_agwidth = le32_to_cpu(dbmp_le->dn_agwidth); +-- +2.42.0 + diff --git a/queue-4.14/gfs2-ignore-negated-quota-changes.patch b/queue-4.14/gfs2-ignore-negated-quota-changes.patch new file mode 100644 index 00000000000..585d9940405 --- /dev/null +++ b/queue-4.14/gfs2-ignore-negated-quota-changes.patch @@ -0,0 +1,91 @@ +From 90be2db821debcd53b91d18d2ebc85b5fef30d8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Sep 2023 08:46:43 -0500 +Subject: gfs2: ignore negated quota changes + +From: Bob Peterson + +[ Upstream commit 4c6a08125f2249531ec01783a5f4317d7342add5 ] + +When lots of quota changes are made, there may be cases in which an +inode's quota information is increased and then decreased, such as when +blocks are added to a file, then deleted from it. If the timing is +right, function do_qc can add pending quota changes to a transaction, +then later, another call to do_qc can negate those changes, resulting +in a net gain of 0. The quota_change information is recorded in the qc +buffer (and qd element of the inode as well). The buffer is added to the +transaction by the first call to do_qc, but a subsequent call changes +the value from non-zero back to zero. At that point it's too late to +remove the buffer_head from the transaction. Later, when the quota sync +code is called, the zero-change qd element is discovered and flagged as +an assert warning. If the fs is mounted with errors=panic, the kernel +will panic. + +This is usually seen when files are truncated and the quota changes are +negated by punch_hole/truncate which uses gfs2_quota_hold and +gfs2_quota_unhold rather than block allocations that use gfs2_quota_lock +and gfs2_quota_unlock which automatically do quota sync. + +This patch solves the problem by adding a check to qd_check_sync such +that net-zero quota changes already added to the transaction are no +longer deemed necessary to be synced, and skipped. + +In this case references are taken for the qd and the slot from do_qc +so those need to be put. The normal sequence of events for a normal +non-zero quota change is as follows: + +gfs2_quota_change + do_qc + qd_hold + slot_hold + +Later, when the changes are to be synced: + +gfs2_quota_sync + qd_fish + qd_check_sync + gets qd ref via lockref_get_not_dead + do_sync + do_qc(QC_SYNC) + qd_put + lockref_put_or_lock + qd_unlock + qd_put + lockref_put_or_lock + +In the net-zero change case, we add a check to qd_check_sync so it puts +the qd and slot references acquired in gfs2_quota_change and skip the +unneeded sync. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/quota.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c +index a833e2e071675..9cef9f1ab63fa 100644 +--- a/fs/gfs2/quota.c ++++ b/fs/gfs2/quota.c +@@ -434,6 +434,17 @@ static int qd_check_sync(struct gfs2_sbd *sdp, struct gfs2_quota_data *qd, + (sync_gen && (qd->qd_sync_gen >= *sync_gen))) + return 0; + ++ /* ++ * If qd_change is 0 it means a pending quota change was negated. ++ * We should not sync it, but we still have a qd reference and slot ++ * reference taken by gfs2_quota_change -> do_qc that need to be put. ++ */ ++ if (!qd->qd_change && test_and_clear_bit(QDF_CHANGE, &qd->qd_flags)) { ++ slot_put(qd); ++ qd_put(qd); ++ return 0; ++ } ++ + if (!lockref_get_not_dead(&qd->qd_lockref)) + return 0; + +-- +2.42.0 + diff --git a/queue-4.14/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch b/queue-4.14/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch new file mode 100644 index 00000000000..b74df6b2ca7 --- /dev/null +++ b/queue-4.14/i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch @@ -0,0 +1,39 @@ +From 6801dc92555a666d9ac18a886597f16fda46af03 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Apr 2016 08:54:30 +0800 +Subject: i2c: sun6i-p2wi: Prevent potential division by zero + +From: Axel Lin + +[ Upstream commit 5ac61d26b8baff5b2e5a9f3dc1ef63297e4b53e7 ] + +Make sure we don't OOPS in case clock-frequency is set to 0 in a DT. The +variable set here is later used as a divisor. + +Signed-off-by: Axel Lin +Acked-by: Boris Brezillon +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sun6i-p2wi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/i2c/busses/i2c-sun6i-p2wi.c b/drivers/i2c/busses/i2c-sun6i-p2wi.c +index 7c07ce116e384..540c33f4e3500 100644 +--- a/drivers/i2c/busses/i2c-sun6i-p2wi.c ++++ b/drivers/i2c/busses/i2c-sun6i-p2wi.c +@@ -202,6 +202,11 @@ static int p2wi_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ if (clk_freq == 0) { ++ dev_err(dev, "clock-frequency is set to 0 in DT\n"); ++ return -EINVAL; ++ } ++ + if (of_get_child_count(np) > 1) { + dev_err(dev, "P2WI only supports one slave device\n"); + return -EINVAL; +-- +2.42.0 + diff --git a/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dbfindleaf.patch b/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dbfindleaf.patch new file mode 100644 index 00000000000..f68a8927006 --- /dev/null +++ b/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dbfindleaf.patch @@ -0,0 +1,87 @@ +From 44d7fafc167531bcbfa54134a9769731d927f9dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 11:17:18 +0530 +Subject: jfs: fix array-index-out-of-bounds in dbFindLeaf + +From: Manas Ghandat + +[ Upstream commit 22cad8bc1d36547cdae0eef316c47d917ce3147c ] + +Currently while searching for dmtree_t for sufficient free blocks there +is an array out of bounds while getting element in tp->dm_stree. To add +the required check for out of bound we first need to determine the type +of dmtree. Thus added an extra parameter to dbFindLeaf so that the type +of tree can be determined and the required check can be applied. + +Reported-by: syzbot+aea1ad91e854d0a83e04@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=aea1ad91e854d0a83e04 +Signed-off-by: Manas Ghandat +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 713f11dee52aa..ed7989d7b2ba4 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -100,7 +100,7 @@ static int dbAllocCtl(struct bmap * bmp, s64 nblocks, int l2nb, s64 blkno, + static int dbExtend(struct inode *ip, s64 blkno, s64 nblocks, s64 addnblocks); + static int dbFindBits(u32 word, int l2nb); + static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno); +-static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx); ++static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl); + static int dbFreeBits(struct bmap * bmp, struct dmap * dp, s64 blkno, + int nblocks); + static int dbFreeDmap(struct bmap * bmp, struct dmap * dp, s64 blkno, +@@ -1798,7 +1798,7 @@ static int dbFindCtl(struct bmap * bmp, int l2nb, int level, s64 * blkno) + * dbFindLeaf() returns the index of the leaf at which + * free space was found. + */ +- rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx); ++ rc = dbFindLeaf((dmtree_t *) dcp, l2nb, &leafidx, true); + + /* release the buffer. + */ +@@ -2045,7 +2045,7 @@ dbAllocDmapLev(struct bmap * bmp, + * free space. if sufficient free space is found, dbFindLeaf() + * returns the index of the leaf at which free space was found. + */ +- if (dbFindLeaf((dmtree_t *) & dp->tree, l2nb, &leafidx)) ++ if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false)) + return -ENOSPC; + + if (leafidx < 0) +@@ -3005,14 +3005,18 @@ static void dbAdjTree(dmtree_t * tp, int leafno, int newval) + * leafidx - return pointer to be set to the index of the leaf + * describing at least l2nb free blocks if sufficient + * free blocks are found. ++ * is_ctl - determines if the tree is of type ctl + * + * RETURN VALUES: + * 0 - success + * -ENOSPC - insufficient free blocks. + */ +-static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx) ++static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl) + { + int ti, n = 0, k, x = 0; ++ int max_size; ++ ++ max_size = is_ctl ? CTLTREESIZE : TREESIZE; + + /* first check the root of the tree to see if there is + * sufficient free space. +@@ -3033,6 +3037,8 @@ static int dbFindLeaf(dmtree_t * tp, int l2nb, int *leafidx) + /* sufficient free space found. move to the next + * level (or quit if this is the last level). + */ ++ if (x + n > max_size) ++ return -ENOSPC; + if (l2nb <= tp->dmt_stree[x + n]) + break; + } +-- +2.42.0 + diff --git a/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dialloc.patch b/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dialloc.patch new file mode 100644 index 00000000000..b122b07ceb9 --- /dev/null +++ b/queue-4.14/jfs-fix-array-index-out-of-bounds-in-dialloc.patch @@ -0,0 +1,48 @@ +From a0ad79228f6d911aab45f6e0441c5f96781c8e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Oct 2023 13:10:40 +0530 +Subject: jfs: fix array-index-out-of-bounds in diAlloc + +From: Manas Ghandat + +[ Upstream commit 05d9ea1ceb62a55af6727a69269a4fd310edf483 ] + +Currently there is not check against the agno of the iag while +allocating new inodes to avoid fragmentation problem. Added the check +which is required. + +Reported-by: syzbot+79d792676d8ac050949f@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=79d792676d8ac050949f +Signed-off-by: Manas Ghandat +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_imap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/jfs/jfs_imap.c b/fs/jfs/jfs_imap.c +index 12fc016244581..131dce5316ac9 100644 +--- a/fs/jfs/jfs_imap.c ++++ b/fs/jfs/jfs_imap.c +@@ -1341,7 +1341,7 @@ diInitInode(struct inode *ip, int iagno, int ino, int extno, struct iag * iagp) + int diAlloc(struct inode *pip, bool dir, struct inode *ip) + { + int rc, ino, iagno, addext, extno, bitno, sword; +- int nwords, rem, i, agno; ++ int nwords, rem, i, agno, dn_numag; + u32 mask, inosmap, extsmap; + struct inode *ipimap; + struct metapage *mp; +@@ -1377,6 +1377,9 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip) + + /* get the ag number of this iag */ + agno = BLKTOAG(JFS_IP(pip)->agstart, JFS_SBI(pip->i_sb)); ++ dn_numag = JFS_SBI(pip->i_sb)->bmap->db_numag; ++ if (agno < 0 || agno > dn_numag) ++ return -EIO; + + if (atomic_read(&JFS_SBI(pip->i_sb)->bmap->db_active[agno])) { + /* +-- +2.42.0 + diff --git a/queue-4.14/locking-ww_mutex-test-fix-potential-workqueue-corrup.patch b/queue-4.14/locking-ww_mutex-test-fix-potential-workqueue-corrup.patch new file mode 100644 index 00000000000..ba6d7db2f58 --- /dev/null +++ b/queue-4.14/locking-ww_mutex-test-fix-potential-workqueue-corrup.patch @@ -0,0 +1,119 @@ +From 51fc8482c08007be1ad4d4fde894f3d7c1fa210c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 Sep 2023 04:36:00 +0000 +Subject: locking/ww_mutex/test: Fix potential workqueue corruption + +From: John Stultz + +[ Upstream commit bccdd808902f8c677317cec47c306e42b93b849e ] + +In some cases running with the test-ww_mutex code, I was seeing +odd behavior where sometimes it seemed flush_workqueue was +returning before all the work threads were finished. + +Often this would cause strange crashes as the mutexes would be +freed while they were being used. + +Looking at the code, there is a lifetime problem as the +controlling thread that spawns the work allocates the +"struct stress" structures that are passed to the workqueue +threads. Then when the workqueue threads are finished, +they free the stress struct that was passed to them. + +Unfortunately the workqueue work_struct node is in the stress +struct. Which means the work_struct is freed before the work +thread returns and while flush_workqueue is waiting. + +It seems like a better idea to have the controlling thread +both allocate and free the stress structures, so that we can +be sure we don't corrupt the workqueue by freeing the structure +prematurely. + +So this patch reworks the test to do so, and with this change +I no longer see the early flush_workqueue returns. + +Signed-off-by: John Stultz +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20230922043616.19282-3-jstultz@google.com +Signed-off-by: Sasha Levin +--- + kernel/locking/test-ww_mutex.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/kernel/locking/test-ww_mutex.c b/kernel/locking/test-ww_mutex.c +index 654977862b06b..8489a01f943e8 100644 +--- a/kernel/locking/test-ww_mutex.c ++++ b/kernel/locking/test-ww_mutex.c +@@ -439,7 +439,6 @@ static void stress_inorder_work(struct work_struct *work) + } while (!time_after(jiffies, stress->timeout)); + + kfree(order); +- kfree(stress); + } + + struct reorder_lock { +@@ -504,7 +503,6 @@ static void stress_reorder_work(struct work_struct *work) + list_for_each_entry_safe(ll, ln, &locks, link) + kfree(ll); + kfree(order); +- kfree(stress); + } + + static void stress_one_work(struct work_struct *work) +@@ -525,8 +523,6 @@ static void stress_one_work(struct work_struct *work) + break; + } + } while (!time_after(jiffies, stress->timeout)); +- +- kfree(stress); + } + + #define STRESS_INORDER BIT(0) +@@ -537,15 +533,24 @@ static void stress_one_work(struct work_struct *work) + static int stress(int nlocks, int nthreads, unsigned int flags) + { + struct ww_mutex *locks; +- int n; ++ struct stress *stress_array; ++ int n, count; + + locks = kmalloc_array(nlocks, sizeof(*locks), GFP_KERNEL); + if (!locks) + return -ENOMEM; + ++ stress_array = kmalloc_array(nthreads, sizeof(*stress_array), ++ GFP_KERNEL); ++ if (!stress_array) { ++ kfree(locks); ++ return -ENOMEM; ++ } ++ + for (n = 0; n < nlocks; n++) + ww_mutex_init(&locks[n], &ww_class); + ++ count = 0; + for (n = 0; nthreads; n++) { + struct stress *stress; + void (*fn)(struct work_struct *work); +@@ -569,9 +574,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) + if (!fn) + continue; + +- stress = kmalloc(sizeof(*stress), GFP_KERNEL); +- if (!stress) +- break; ++ stress = &stress_array[count++]; + + INIT_WORK(&stress->work, fn); + stress->locks = locks; +@@ -586,6 +589,7 @@ static int stress(int nlocks, int nthreads, unsigned int flags) + + for (n = 0; n < nlocks; n++) + ww_mutex_destroy(&locks[n]); ++ kfree(stress_array); + kfree(locks); + + return 0; +-- +2.42.0 + diff --git a/queue-4.14/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch b/queue-4.14/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch new file mode 100644 index 00000000000..4138a531717 --- /dev/null +++ b/queue-4.14/media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch @@ -0,0 +1,53 @@ +From 76af8efa4083bada73429e6cecda587a604a19ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Aug 2023 13:14:01 +0530 +Subject: media: gspca: cpia1: shift-out-of-bounds in set_flicker + +From: Rajeshwar R Shinde + +[ Upstream commit 099be1822d1f095433f4b08af9cc9d6308ec1953 ] + +Syzkaller reported the following issue: +UBSAN: shift-out-of-bounds in drivers/media/usb/gspca/cpia1.c:1031:27 +shift exponent 245 is too large for 32-bit type 'int' + +When the value of the variable "sd->params.exposure.gain" exceeds the +number of bits in an integer, a shift-out-of-bounds error is reported. It +is triggered because the variable "currentexp" cannot be left-shifted by +more than the number of bits in an integer. In order to avoid invalid +range during left-shift, the conditional expression is added. + +Reported-by: syzbot+e27f3dbdab04e43b9f73@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/all/20230818164522.12806-1-coolrrsh@gmail.com +Link: https://syzkaller.appspot.com/bug?extid=e27f3dbdab04e43b9f73 +Signed-off-by: Rajeshwar R Shinde +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/cpia1.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c +index e91d00762e94b..bf34479a87cc5 100644 +--- a/drivers/media/usb/gspca/cpia1.c ++++ b/drivers/media/usb/gspca/cpia1.c +@@ -28,6 +28,7 @@ + + #include + #include ++#include + + #include "gspca.h" + +@@ -1032,6 +1033,8 @@ static int set_flicker(struct gspca_dev *gspca_dev, int on, int apply) + sd->params.exposure.expMode = 2; + sd->exposure_status = EXPOSURE_NORMAL; + } ++ if (sd->params.exposure.gain >= BITS_PER_TYPE(currentexp)) ++ return -EINVAL; + currentexp = currentexp << sd->params.exposure.gain; + sd->params.exposure.gain = 0; + /* round down current exposure to nearest value */ +-- +2.42.0 + diff --git a/queue-4.14/media-vivid-avoid-integer-overflow.patch b/queue-4.14/media-vivid-avoid-integer-overflow.patch new file mode 100644 index 00000000000..55ce29c3fcc --- /dev/null +++ b/queue-4.14/media-vivid-avoid-integer-overflow.patch @@ -0,0 +1,47 @@ +From bd03fd7b13d7a4dce8a1f0e810933060682e46c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 23 Sep 2023 17:20:48 +0200 +Subject: media: vivid: avoid integer overflow + +From: Hans Verkuil + +[ Upstream commit 4567ebf8e8f9546b373e78e3b7d584cc30b62028 ] + +Fixes these compiler warnings: + +drivers/media/test-drivers/vivid/vivid-rds-gen.c: In function 'vivid_rds_gen_fill': +drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:56: warning: '.' directive output may be truncated writing 1 byte into a region of size between 0 and 3 [-Wformat-truncation=] + 147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d", + | ^ +drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:52: note: directive argument in the range [0, 9] + 147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d", + | ^~~~~~~~~ +drivers/media/test-drivers/vivid/vivid-rds-gen.c:147:9: note: 'snprintf' output between 9 and 12 bytes into a destination of size 9 + 147 | snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d", + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 148 | freq / 16, ((freq & 0xf) * 10) / 16); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Hans Verkuil +Acked-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vivid/vivid-rds-gen.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/vivid/vivid-rds-gen.c b/drivers/media/platform/vivid/vivid-rds-gen.c +index 53c7777dc0019..d2b014336f9c4 100644 +--- a/drivers/media/platform/vivid/vivid-rds-gen.c ++++ b/drivers/media/platform/vivid/vivid-rds-gen.c +@@ -157,7 +157,7 @@ void vivid_rds_gen_fill(struct vivid_rds_gen *rds, unsigned freq, + rds->ta = alt; + rds->ms = true; + snprintf(rds->psname, sizeof(rds->psname), "%6d.%1d", +- freq / 16, ((freq & 0xf) * 10) / 16); ++ (freq / 16) % 1000000, (((freq & 0xf) * 10) / 16) % 10); + if (alt) + strlcpy(rds->radiotext, + " The Radio Data System can switch between different Radio Texts ", +-- +2.42.0 + diff --git a/queue-4.14/net-annotate-data-races-around-sk-sk_dst_pending_con.patch b/queue-4.14/net-annotate-data-races-around-sk-sk_dst_pending_con.patch new file mode 100644 index 00000000000..0d4c8c894be --- /dev/null +++ b/queue-4.14/net-annotate-data-races-around-sk-sk_dst_pending_con.patch @@ -0,0 +1,82 @@ +From 78009963710877092a23e1d72cc3aea4de6a07bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Sep 2023 20:28:18 +0000 +Subject: net: annotate data-races around sk->sk_dst_pending_confirm + +From: Eric Dumazet + +[ Upstream commit eb44ad4e635132754bfbcb18103f1dcb7058aedd ] + +This field can be read or written without socket lock being held. + +Add annotations to avoid load-store tearing. + +Signed-off-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sock.h | 6 +++--- + net/core/sock.c | 2 +- + net/ipv4/tcp_output.c | 2 +- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/include/net/sock.h b/include/net/sock.h +index 7b42ddca4decb..f974b548e1199 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1804,7 +1804,7 @@ static inline void dst_negative_advice(struct sock *sk) + if (ndst != dst) { + rcu_assign_pointer(sk->sk_dst_cache, ndst); + sk_tx_queue_clear(sk); +- sk->sk_dst_pending_confirm = 0; ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + } + } + } +@@ -1815,7 +1815,7 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst) + struct dst_entry *old_dst; + + sk_tx_queue_clear(sk); +- sk->sk_dst_pending_confirm = 0; ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + old_dst = rcu_dereference_protected(sk->sk_dst_cache, + lockdep_sock_is_held(sk)); + rcu_assign_pointer(sk->sk_dst_cache, dst); +@@ -1828,7 +1828,7 @@ sk_dst_set(struct sock *sk, struct dst_entry *dst) + struct dst_entry *old_dst; + + sk_tx_queue_clear(sk); +- sk->sk_dst_pending_confirm = 0; ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + old_dst = xchg((__force struct dst_entry **)&sk->sk_dst_cache, dst); + dst_release(old_dst); + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 5b9f51a27dc0d..e8b5742d91492 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -534,7 +534,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie) + + if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) { + sk_tx_queue_clear(sk); +- sk->sk_dst_pending_confirm = 0; ++ WRITE_ONCE(sk->sk_dst_pending_confirm, 0); + RCU_INIT_POINTER(sk->sk_dst_cache, NULL); + dst_release(dst); + return NULL; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 8b2d49120ce23..67636017f275a 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1059,7 +1059,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, + skb_set_hash_from_sk(skb, sk); + refcount_add(skb->truesize, &sk->sk_wmem_alloc); + +- skb_set_dst_pending_confirm(skb, sk->sk_dst_pending_confirm); ++ skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm)); + + /* Build TCP header and checksum it. */ + th = (struct tcphdr *)skb->data; +-- +2.42.0 + diff --git a/queue-4.14/pwm-fix-double-shift-bug.patch b/queue-4.14/pwm-fix-double-shift-bug.patch new file mode 100644 index 00000000000..01bace19b6a --- /dev/null +++ b/queue-4.14/pwm-fix-double-shift-bug.patch @@ -0,0 +1,45 @@ +From 87b27f0842aeb009aee60d4ea84dede0bcde70a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Oct 2023 14:58:18 +0300 +Subject: pwm: Fix double shift bug +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dan Carpenter + +[ Upstream commit d27abbfd4888d79dd24baf50e774631046ac4732 ] + +These enums are passed to set/test_bit(). The set/test_bit() functions +take a bit number instead of a shifted value. Passing a shifted value +is a double shift bug like doing BIT(BIT(1)). The double shift bug +doesn't cause a problem here because we are only checking 0 and 1 but +if the value was 5 or above then it can lead to a buffer overflow. + +Signed-off-by: Dan Carpenter +Reviewed-by: Uwe Kleine-König +Reviewed-by: Sam Protsenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + include/linux/pwm.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/pwm.h b/include/linux/pwm.h +index bd7d611d63e91..c6e981035c3fd 100644 +--- a/include/linux/pwm.h ++++ b/include/linux/pwm.h +@@ -44,8 +44,8 @@ struct pwm_args { + }; + + enum { +- PWMF_REQUESTED = 1 << 0, +- PWMF_EXPORTED = 1 << 1, ++ PWMF_REQUESTED = 0, ++ PWMF_EXPORTED = 1, + }; + + /* +-- +2.42.0 + diff --git a/queue-4.14/rdma-hfi1-use-field_get-to-extract-link-width.patch b/queue-4.14/rdma-hfi1-use-field_get-to-extract-link-width.patch new file mode 100644 index 00000000000..dc5c6240b51 --- /dev/null +++ b/queue-4.14/rdma-hfi1-use-field_get-to-extract-link-width.patch @@ -0,0 +1,63 @@ +From 07291e934d3eea7cb8367488059da7d5fd969537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Sep 2023 15:56:41 +0300 +Subject: RDMA/hfi1: Use FIELD_GET() to extract Link Width +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ilpo Järvinen + +[ Upstream commit 8bf7187d978610b9e327a3d92728c8864a575ebd ] + +Use FIELD_GET() to extract PCIe Negotiated Link Width field instead of +custom masking and shifting, and remove extract_width() which only +wraps that FIELD_GET(). + +Signed-off-by: Ilpo Järvinen +Link: https://lore.kernel.org/r/20230919125648.1920-2-ilpo.jarvinen@linux.intel.com +Reviewed-by: Jonathan Cameron +Reviewed-by: Dean Luick +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/pcie.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c +index fd9ae23c480ec..c77abf7542e3f 100644 +--- a/drivers/infiniband/hw/hfi1/pcie.c ++++ b/drivers/infiniband/hw/hfi1/pcie.c +@@ -45,6 +45,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -269,12 +270,6 @@ static u32 extract_speed(u16 linkstat) + return speed; + } + +-/* return the PCIe link speed from the given link status */ +-static u32 extract_width(u16 linkstat) +-{ +- return (linkstat & PCI_EXP_LNKSTA_NLW) >> PCI_EXP_LNKSTA_NLW_SHIFT; +-} +- + /* read the link status and set dd->{lbus_width,lbus_speed,lbus_info} */ + static void update_lbus_info(struct hfi1_devdata *dd) + { +@@ -287,7 +282,7 @@ static void update_lbus_info(struct hfi1_devdata *dd) + return; + } + +- dd->lbus_width = extract_width(linkstat); ++ dd->lbus_width = FIELD_GET(PCI_EXP_LNKSTA_NLW, linkstat); + dd->lbus_speed = extract_speed(linkstat); + snprintf(dd->lbus_info, sizeof(dd->lbus_info), + "PCIe,%uMHz,x%u", dd->lbus_speed, dd->lbus_width); +-- +2.42.0 + diff --git a/queue-4.14/scsi-libfc-fix-potential-null-pointer-dereference-in.patch b/queue-4.14/scsi-libfc-fix-potential-null-pointer-dereference-in.patch new file mode 100644 index 00000000000..047bd766e05 --- /dev/null +++ b/queue-4.14/scsi-libfc-fix-potential-null-pointer-dereference-in.patch @@ -0,0 +1,44 @@ +From 57eef9b76817974dca3063e1fa1b617fe2289538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Oct 2023 21:03:50 +0800 +Subject: scsi: libfc: Fix potential NULL pointer dereference in + fc_lport_ptp_setup() + +From: Wenchao Hao + +[ Upstream commit 4df105f0ce9f6f30cda4e99f577150d23f0c9c5f ] + +fc_lport_ptp_setup() did not check the return value of fc_rport_create() +which can return NULL and would cause a NULL pointer dereference. Address +this issue by checking return value of fc_rport_create() and log error +message on fc_rport_create() failed. + +Signed-off-by: Wenchao Hao +Link: https://lore.kernel.org/r/20231011130350.819571-1-haowenchao2@huawei.com +Reviewed-by: Simon Horman +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libfc/fc_lport.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c +index 5c0aa2c5fd558..cb22c7afa3cdc 100644 +--- a/drivers/scsi/libfc/fc_lport.c ++++ b/drivers/scsi/libfc/fc_lport.c +@@ -251,6 +251,12 @@ static void fc_lport_ptp_setup(struct fc_lport *lport, + } + mutex_lock(&lport->disc.disc_mutex); + lport->ptp_rdata = fc_rport_create(lport, remote_fid); ++ if (!lport->ptp_rdata) { ++ printk(KERN_WARNING "libfc: Failed to setup lport 0x%x\n", ++ lport->port_id); ++ mutex_unlock(&lport->disc.disc_mutex); ++ return; ++ } + kref_get(&lport->ptp_rdata->kref); + lport->ptp_rdata->ids.port_name = remote_wwpn; + lport->ptp_rdata->ids.node_name = remote_wwnn; +-- +2.42.0 + diff --git a/queue-4.14/selftests-efivarfs-create-read-fix-a-resource-leak.patch b/queue-4.14/selftests-efivarfs-create-read-fix-a-resource-leak.patch new file mode 100644 index 00000000000..5ddd8857cd3 --- /dev/null +++ b/queue-4.14/selftests-efivarfs-create-read-fix-a-resource-leak.patch @@ -0,0 +1,37 @@ +From 91ec29990594cb7e1d4684346abe29580bf792c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Oct 2023 18:59:21 -0700 +Subject: selftests/efivarfs: create-read: fix a resource leak + +From: zhujun2 + +[ Upstream commit 3f6f8a8c5e11a9b384a36df4f40f0c9a653b6975 ] + +The opened file should be closed in main(), otherwise resource +leak will occur that this problem was discovered by code reading + +Signed-off-by: zhujun2 +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/efivarfs/create-read.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/efivarfs/create-read.c b/tools/testing/selftests/efivarfs/create-read.c +index 9674a19396a32..7bc7af4eb2c17 100644 +--- a/tools/testing/selftests/efivarfs/create-read.c ++++ b/tools/testing/selftests/efivarfs/create-read.c +@@ -32,8 +32,10 @@ int main(int argc, char **argv) + rc = read(fd, buf, sizeof(buf)); + if (rc != 0) { + fprintf(stderr, "Reading a new var should return EOF\n"); ++ close(fd); + return EXIT_FAILURE; + } + ++ close(fd); + return EXIT_SUCCESS; + } +-- +2.42.0 + diff --git a/queue-4.14/series b/queue-4.14/series new file mode 100644 index 00000000000..b8b7a9616d7 --- /dev/null +++ b/queue-4.14/series @@ -0,0 +1,26 @@ +locking-ww_mutex-test-fix-potential-workqueue-corrup.patch +clocksource-drivers-timer-imx-gpt-fix-potential-memo.patch +clocksource-drivers-timer-atmel-tcb-fix-initializati.patch +x86-mm-drop-the-4-mb-restriction-on-minimal-numa-nod.patch +wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch +wifi-ath9k-fix-clang-specific-fortify-warnings.patch +wifi-ath10k-fix-clang-specific-fortify-warning.patch +net-annotate-data-races-around-sk-sk_dst_pending_con.patch +drm-amd-fix-ubsan-array-index-out-of-bounds-for-smu7.patch +drm-amd-fix-ubsan-array-index-out-of-bounds-for-pola.patch +selftests-efivarfs-create-read-fix-a-resource-leak.patch +crypto-pcrypt-fix-hungtask-for-padata_reset.patch +rdma-hfi1-use-field_get-to-extract-link-width.patch +fs-jfs-add-check-for-negative-db_l2nbperpage.patch +fs-jfs-add-validity-check-for-db_maxag-and-db_agpref.patch +jfs-fix-array-index-out-of-bounds-in-dbfindleaf.patch +jfs-fix-array-index-out-of-bounds-in-dialloc.patch +alsa-hda-fix-possible-null-ptr-deref-when-assigning-.patch +atm-iphase-do-pci-error-checks-on-own-line.patch +scsi-libfc-fix-potential-null-pointer-dereference-in.patch +tty-vcc-add-check-for-kstrdup-in-vcc_probe.patch +i2c-sun6i-p2wi-prevent-potential-division-by-zero.patch +media-gspca-cpia1-shift-out-of-bounds-in-set_flicker.patch +media-vivid-avoid-integer-overflow.patch +gfs2-ignore-negated-quota-changes.patch +pwm-fix-double-shift-bug.patch diff --git a/queue-4.14/tty-vcc-add-check-for-kstrdup-in-vcc_probe.patch b/queue-4.14/tty-vcc-add-check-for-kstrdup-in-vcc_probe.patch new file mode 100644 index 00000000000..2b766945321 --- /dev/null +++ b/queue-4.14/tty-vcc-add-check-for-kstrdup-in-vcc_probe.patch @@ -0,0 +1,76 @@ +From c88e02719aa19c0184a9bec7c6df40e9ec058591 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Sep 2023 11:52:20 +0800 +Subject: tty: vcc: Add check for kstrdup() in vcc_probe() + +From: Yi Yang + +[ Upstream commit d81ffb87aaa75f842cd7aa57091810353755b3e6 ] + +Add check for the return value of kstrdup() and return the error, if it +fails in order to avoid NULL pointer dereference. + +Signed-off-by: Yi Yang +Reviewed-by: Jiri Slaby +Link: https://lore.kernel.org/r/20230904035220.48164-1-yiyang13@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/vcc.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c +index 4e795353192bc..67f528cf1056d 100644 +--- a/drivers/tty/vcc.c ++++ b/drivers/tty/vcc.c +@@ -594,18 +594,22 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) + return -ENOMEM; + + name = kstrdup(dev_name(&vdev->dev), GFP_KERNEL); ++ if (!name) { ++ rv = -ENOMEM; ++ goto free_port; ++ } + + rv = vio_driver_init(&port->vio, vdev, VDEV_CONSOLE_CON, vcc_versions, + ARRAY_SIZE(vcc_versions), NULL, name); + if (rv) +- goto free_port; ++ goto free_name; + + port->vio.debug = vcc_dbg_vio; + vcc_ldc_cfg.debug = vcc_dbg_ldc; + + rv = vio_ldc_alloc(&port->vio, &vcc_ldc_cfg, port); + if (rv) +- goto free_port; ++ goto free_name; + + spin_lock_init(&port->lock); + +@@ -639,6 +643,11 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) + goto unreg_tty; + } + port->domain = kstrdup(domain, GFP_KERNEL); ++ if (!port->domain) { ++ rv = -ENOMEM; ++ goto unreg_tty; ++ } ++ + + mdesc_release(hp); + +@@ -673,8 +682,9 @@ static int vcc_probe(struct vio_dev *vdev, const struct vio_device_id *id) + vcc_table_remove(port->index); + free_ldc: + vio_ldc_free(&port->vio); +-free_port: ++free_name: + kfree(name); ++free_port: + kfree(port); + + return rv; +-- +2.42.0 + diff --git a/queue-4.14/wifi-ath10k-fix-clang-specific-fortify-warning.patch b/queue-4.14/wifi-ath10k-fix-clang-specific-fortify-warning.patch new file mode 100644 index 00000000000..8bf3f359d71 --- /dev/null +++ b/queue-4.14/wifi-ath10k-fix-clang-specific-fortify-warning.patch @@ -0,0 +1,62 @@ +From 18bd40749682ea13e26ad20334685bad5864baf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 12:36:02 +0300 +Subject: wifi: ath10k: fix clang-specific fortify warning + +From: Dmitry Antipov + +[ Upstream commit cb4c132ebfeac5962f7258ffc831caa0c4dada1a ] + +When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've +noticed the following (somewhat confusing due to absence of an actual +source code location): + +In file included from drivers/net/wireless/ath/ath10k/debug.c:8: +In file included from ./include/linux/module.h:13: +In file included from ./include/linux/stat.h:19: +In file included from ./include/linux/time.h:60: +In file included from ./include/linux/time32.h:13: +In file included from ./include/linux/timex.h:67: +In file included from ./arch/x86/include/asm/timex.h:5: +In file included from ./arch/x86/include/asm/processor.h:23: +In file included from ./arch/x86/include/asm/msr.h:11: +In file included from ./arch/x86/include/asm/cpumask.h:5: +In file included from ./include/linux/cpumask.h:12: +In file included from ./include/linux/bitmap.h:11: +In file included from ./include/linux/string.h:254: +./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' +declared with 'warning' attribute: detected read beyond size of field (2nd +parameter); maybe use struct_group()? [-Wattribute-warning] + __read_overflow2_field(q_size_field, size); + +The compiler actually complains on 'ath10k_debug_get_et_strings()' where +fortification logic inteprets call to 'memcpy()' as an attempt to copy +the whole 'ath10k_gstrings_stats' array from it's first member and so +issues an overread warning. This warning may be silenced by passing +an address of the whole array and not the first member to 'memcpy()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230829093652.234537-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/debug.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/debug.c b/drivers/net/wireless/ath/ath10k/debug.c +index 22003895f8548..591d0b9c0be3c 100644 +--- a/drivers/net/wireless/ath/ath10k/debug.c ++++ b/drivers/net/wireless/ath/ath10k/debug.c +@@ -1411,7 +1411,7 @@ void ath10k_debug_get_et_strings(struct ieee80211_hw *hw, + u32 sset, u8 *data) + { + if (sset == ETH_SS_STATS) +- memcpy(data, *ath10k_gstrings_stats, ++ memcpy(data, ath10k_gstrings_stats, + sizeof(ath10k_gstrings_stats)); + } + +-- +2.42.0 + diff --git a/queue-4.14/wifi-ath9k-fix-clang-specific-fortify-warnings.patch b/queue-4.14/wifi-ath9k-fix-clang-specific-fortify-warnings.patch new file mode 100644 index 00000000000..37b3057431c --- /dev/null +++ b/queue-4.14/wifi-ath9k-fix-clang-specific-fortify-warnings.patch @@ -0,0 +1,102 @@ +From 392a8483f72b0ca731e3aba74346921eb2eaad58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Aug 2023 12:38:12 +0300 +Subject: wifi: ath9k: fix clang-specific fortify warnings +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dmitry Antipov + +[ Upstream commit 95f97fe0ac974467ab4da215985a32b2fdf48af0 ] + +When compiling with clang 16.0.6 and CONFIG_FORTIFY_SOURCE=y, I've +noticed the following (somewhat confusing due to absence of an actual +source code location): + +In file included from drivers/net/wireless/ath/ath9k/debug.c:17: +In file included from ./include/linux/slab.h:16: +In file included from ./include/linux/gfp.h:7: +In file included from ./include/linux/mmzone.h:8: +In file included from ./include/linux/spinlock.h:56: +In file included from ./include/linux/preempt.h:79: +In file included from ./arch/x86/include/asm/preempt.h:9: +In file included from ./include/linux/thread_info.h:60: +In file included from ./arch/x86/include/asm/thread_info.h:53: +In file included from ./arch/x86/include/asm/cpufeature.h:5: +In file included from ./arch/x86/include/asm/processor.h:23: +In file included from ./arch/x86/include/asm/msr.h:11: +In file included from ./arch/x86/include/asm/cpumask.h:5: +In file included from ./include/linux/cpumask.h:12: +In file included from ./include/linux/bitmap.h:11: +In file included from ./include/linux/string.h:254: +./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' +declared with 'warning' attribute: detected read beyond size of field (2nd +parameter); maybe use struct_group()? [-Wattribute-warning] + __read_overflow2_field(q_size_field, size); + +In file included from drivers/net/wireless/ath/ath9k/htc_drv_debug.c:17: +In file included from drivers/net/wireless/ath/ath9k/htc.h:20: +In file included from ./include/linux/module.h:13: +In file included from ./include/linux/stat.h:19: +In file included from ./include/linux/time.h:60: +In file included from ./include/linux/time32.h:13: +In file included from ./include/linux/timex.h:67: +In file included from ./arch/x86/include/asm/timex.h:5: +In file included from ./arch/x86/include/asm/processor.h:23: +In file included from ./arch/x86/include/asm/msr.h:11: +In file included from ./arch/x86/include/asm/cpumask.h:5: +In file included from ./include/linux/cpumask.h:12: +In file included from ./include/linux/bitmap.h:11: +In file included from ./include/linux/string.h:254: +./include/linux/fortify-string.h:592:4: warning: call to '__read_overflow2_field' +declared with 'warning' attribute: detected read beyond size of field (2nd +parameter); maybe use struct_group()? [-Wattribute-warning] + __read_overflow2_field(q_size_field, size); + +The compiler actually complains on 'ath9k_get_et_strings()' and +'ath9k_htc_get_et_strings()' due to the same reason: fortification logic +inteprets call to 'memcpy()' as an attempt to copy the whole array from +it's first member and so issues an overread warning. These warnings may +be silenced by passing an address of the whole array and not the first +member to 'memcpy()'. + +Signed-off-by: Dmitry Antipov +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20230829093856.234584-1-dmantipov@yandex.ru +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/debug.c | 2 +- + drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c +index e05be0eb3f349..efaac08cd0caa 100644 +--- a/drivers/net/wireless/ath/ath9k/debug.c ++++ b/drivers/net/wireless/ath/ath9k/debug.c +@@ -1297,7 +1297,7 @@ void ath9k_get_et_strings(struct ieee80211_hw *hw, + u32 sset, u8 *data) + { + if (sset == ETH_SS_STATS) +- memcpy(data, *ath9k_gstrings_stats, ++ memcpy(data, ath9k_gstrings_stats, + sizeof(ath9k_gstrings_stats)); + } + +diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +index b711b2e1ce93e..957d818b16cfc 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c ++++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c +@@ -428,7 +428,7 @@ void ath9k_htc_get_et_strings(struct ieee80211_hw *hw, + u32 sset, u8 *data) + { + if (sset == ETH_SS_STATS) +- memcpy(data, *ath9k_htc_gstrings_stats, ++ memcpy(data, ath9k_htc_gstrings_stats, + sizeof(ath9k_htc_gstrings_stats)); + } + +-- +2.42.0 + diff --git a/queue-4.14/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch b/queue-4.14/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch new file mode 100644 index 00000000000..86d7c600eb6 --- /dev/null +++ b/queue-4.14/wifi-mac80211-don-t-return-unset-power-in-ieee80211_.patch @@ -0,0 +1,58 @@ +From 40cafec97ae4bc7f74ad41b74e464aff5ce8d908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Feb 2023 10:36:36 +0800 +Subject: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() + +From: Ping-Ke Shih + +[ Upstream commit e160ab85166e77347d0cbe5149045cb25e83937f ] + +We can get a UBSAN warning if ieee80211_get_tx_power() returns the +INT_MIN value mac80211 internally uses for "unset power level". + + UBSAN: signed-integer-overflow in net/wireless/nl80211.c:3816:5 + -2147483648 * 100 cannot be represented in type 'int' + CPU: 0 PID: 20433 Comm: insmod Tainted: G WC OE + Call Trace: + dump_stack+0x74/0x92 + ubsan_epilogue+0x9/0x50 + handle_overflow+0x8d/0xd0 + __ubsan_handle_mul_overflow+0xe/0x10 + nl80211_send_iface+0x688/0x6b0 [cfg80211] + [...] + cfg80211_register_wdev+0x78/0xb0 [cfg80211] + cfg80211_netdev_notifier_call+0x200/0x620 [cfg80211] + [...] + ieee80211_if_add+0x60e/0x8f0 [mac80211] + ieee80211_register_hw+0xda5/0x1170 [mac80211] + +In this case, simply return an error instead, to indicate +that no data is available. + +Cc: Zong-Zhe Yang +Signed-off-by: Ping-Ke Shih +Link: https://lore.kernel.org/r/20230203023636.4418-1-pkshih@realtek.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 94293b57f1b23..05e74004376fb 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2428,6 +2428,10 @@ static int ieee80211_get_tx_power(struct wiphy *wiphy, + else + *dbm = sdata->vif.bss_conf.txpower; + ++ /* INT_MIN indicates no power level was set yet */ ++ if (*dbm == INT_MIN) ++ return -EINVAL; ++ + return 0; + } + +-- +2.42.0 + diff --git a/queue-4.14/x86-mm-drop-the-4-mb-restriction-on-minimal-numa-nod.patch b/queue-4.14/x86-mm-drop-the-4-mb-restriction-on-minimal-numa-nod.patch new file mode 100644 index 00000000000..932d2aa617a --- /dev/null +++ b/queue-4.14/x86-mm-drop-the-4-mb-restriction-on-minimal-numa-nod.patch @@ -0,0 +1,112 @@ +From b5efde7235ef93834f560222e8e5087c9d819334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Oct 2023 12:42:50 +0200 +Subject: x86/mm: Drop the 4 MB restriction on minimal NUMA node memory size + +From: Mike Rapoport (IBM) + +[ Upstream commit a1e2b8b36820d8c91275f207e77e91645b7c6836 ] + +Qi Zheng reported crashes in a production environment and provided a +simplified example as a reproducer: + + | For example, if we use Qemu to start a two NUMA node kernel, + | one of the nodes has 2M memory (less than NODE_MIN_SIZE), + | and the other node has 2G, then we will encounter the + | following panic: + | + | BUG: kernel NULL pointer dereference, address: 0000000000000000 + | <...> + | RIP: 0010:_raw_spin_lock_irqsave+0x22/0x40 + | <...> + | Call Trace: + | + | deactivate_slab() + | bootstrap() + | kmem_cache_init() + | start_kernel() + | secondary_startup_64_no_verify() + +The crashes happen because of inconsistency between the nodemask that +has nodes with less than 4MB as memoryless, and the actual memory fed +into the core mm. + +The commit: + + 9391a3f9c7f1 ("[PATCH] x86_64: Clear more state when ignoring empty node in SRAT parsing") + +... that introduced minimal size of a NUMA node does not explain why +a node size cannot be less than 4MB and what boot failures this +restriction might fix. + +Fixes have been submitted to the core MM code to tighten up the +memory topologies it accepts and to not crash on weird input: + + mm: page_alloc: skip memoryless nodes entirely + mm: memory_hotplug: drop memoryless node from fallback lists + +Andrew has accepted them into the -mm tree, but there are no +stable SHA1's yet. + +This patch drops the limitation for minimal node size on x86: + + - which works around the crash without the fixes to the core MM. + - makes x86 topologies less weird, + - removes an arbitrary and undocumented limitation on NUMA topologies. + +[ mingo: Improved changelog clarity. ] + +Reported-by: Qi Zheng +Tested-by: Mario Casquero +Signed-off-by: Mike Rapoport (IBM) +Signed-off-by: Ingo Molnar +Acked-by: David Hildenbrand +Acked-by: Michal Hocko +Cc: Dave Hansen +Cc: Rik van Riel +Link: https://lore.kernel.org/r/ZS+2qqjEO5/867br@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/numa.h | 7 ------- + arch/x86/mm/numa.c | 7 ------- + 2 files changed, 14 deletions(-) + +diff --git a/arch/x86/include/asm/numa.h b/arch/x86/include/asm/numa.h +index bbfde3d2662f4..4bcd9d0c7bee7 100644 +--- a/arch/x86/include/asm/numa.h ++++ b/arch/x86/include/asm/numa.h +@@ -11,13 +11,6 @@ + + #define NR_NODE_MEMBLKS (MAX_NUMNODES*2) + +-/* +- * Too small node sizes may confuse the VM badly. Usually they +- * result from BIOS bugs. So dont recognize nodes as standalone +- * NUMA entities that have less than this amount of RAM listed: +- */ +-#define NODE_MIN_SIZE (4*1024*1024) +- + extern int numa_off; + + /* +diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c +index 15661129794c0..53b733b2fba10 100644 +--- a/arch/x86/mm/numa.c ++++ b/arch/x86/mm/numa.c +@@ -585,13 +585,6 @@ static int __init numa_register_memblks(struct numa_meminfo *mi) + if (start >= end) + continue; + +- /* +- * Don't confuse VM with a node that doesn't have the +- * minimum amount of memory: +- */ +- if (end && (end - start) < NODE_MIN_SIZE) +- continue; +- + alloc_node_data(nid); + } + +-- +2.42.0 +