From: Greg Kroah-Hartman Date: Sun, 30 May 2021 14:47:06 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.271~58 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4948feac328c9098bf34014a00317408c2bdaefa;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch net-dsa-fix-a-crash-if-get_sset_count-fails.patch net-dsa-mt7530-fix-vlan-traffic-leaks.patch net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch perf-jevents-fix-getting-maximum-number-of-fds.patch --- diff --git a/queue-5.4/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch b/queue-5.4/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch new file mode 100644 index 00000000000..91ebec93a9b --- /dev/null +++ b/queue-5.4/i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch @@ -0,0 +1,56 @@ +From e4d8716c3dcec47f1557024add24e1f3c09eb24b Mon Sep 17 00:00:00 2001 +From: Jean Delvare +Date: Tue, 25 May 2021 17:03:36 +0200 +Subject: i2c: i801: Don't generate an interrupt on bus reset + +From: Jean Delvare + +commit e4d8716c3dcec47f1557024add24e1f3c09eb24b upstream. + +Now that the i2c-i801 driver supports interrupts, setting the KILL bit +in a attempt to recover from a timed out transaction triggers an +interrupt. Unfortunately, the interrupt handler (i801_isr) is not +prepared for this situation and will try to process the interrupt as +if it was signaling the end of a successful transaction. In the case +of a block transaction, this can result in an out-of-range memory +access. + +This condition was reproduced several times by syzbot: +https://syzkaller.appspot.com/bug?extid=ed71512d469895b5b34e +https://syzkaller.appspot.com/bug?extid=8c8dedc0ba9e03f6c79e +https://syzkaller.appspot.com/bug?extid=c8ff0b6d6c73d81b610e +https://syzkaller.appspot.com/bug?extid=33f6c360821c399d69eb +https://syzkaller.appspot.com/bug?extid=be15dc0b1933f04b043a +https://syzkaller.appspot.com/bug?extid=b4d3fd1dfd53e90afd79 + +So disable interrupts while trying to reset the bus. Interrupts will +be enabled again for the following transaction. + +Fixes: 636752bcb517 ("i2c-i801: Enable IRQ for SMBus transactions") +Reported-by: syzbot+b4d3fd1dfd53e90afd79@syzkaller.appspotmail.com +Signed-off-by: Jean Delvare +Acked-by: Andy Shevchenko +Cc: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-i801.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -379,11 +379,9 @@ static int i801_check_post(struct i801_p + dev_err(&priv->pci_dev->dev, "Transaction timeout\n"); + /* try to stop the current command */ + dev_dbg(&priv->pci_dev->dev, "Terminating the current operation\n"); +- outb_p(inb_p(SMBHSTCNT(priv)) | SMBHSTCNT_KILL, +- SMBHSTCNT(priv)); ++ outb_p(SMBHSTCNT_KILL, SMBHSTCNT(priv)); + usleep_range(1000, 2000); +- outb_p(inb_p(SMBHSTCNT(priv)) & (~SMBHSTCNT_KILL), +- SMBHSTCNT(priv)); ++ outb_p(0, SMBHSTCNT(priv)); + + /* Check if it worked */ + status = inb_p(SMBHSTSTS(priv)); diff --git a/queue-5.4/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch b/queue-5.4/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch new file mode 100644 index 00000000000..e6396d8b932 --- /dev/null +++ b/queue-5.4/i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch @@ -0,0 +1,67 @@ +From 24990423267ec283b9d86f07f362b753eb9b0ed5 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Wed, 26 May 2021 08:39:37 -0400 +Subject: i2c: s3c2410: fix possible NULL pointer deref on read message after write + +From: Krzysztof Kozlowski + +commit 24990423267ec283b9d86f07f362b753eb9b0ed5 upstream. + +Interrupt handler processes multiple message write requests one after +another, till the driver message queue is drained. However if driver +encounters a read message without preceding START, it stops the I2C +transfer as it is an invalid condition for the controller. At least the +comment describes a requirement "the controller forces us to send a new +START when we change direction". This stop results in clearing the +message queue (i2c->msg = NULL). + +The code however immediately jumped back to label "retry_write" which +dereferenced the "i2c->msg" making it a possible NULL pointer +dereference. + +The Coverity analysis: +1. Condition !is_msgend(i2c), taking false branch. + if (!is_msgend(i2c)) { + +2. Condition !is_lastmsg(i2c), taking true branch. + } else if (!is_lastmsg(i2c)) { + +3. Condition i2c->msg->flags & 1, taking true branch. + if (i2c->msg->flags & I2C_M_RD) { + +4. write_zero_model: Passing i2c to s3c24xx_i2c_stop, which sets i2c->msg to NULL. + s3c24xx_i2c_stop(i2c, -EINVAL); + +5. Jumping to label retry_write. + goto retry_write; + +6. var_deref_model: Passing i2c to is_msgend, which dereferences null i2c->msg. + if (!is_msgend(i2c)) {" + +All previous calls to s3c24xx_i2c_stop() in this interrupt service +routine are followed by jumping to end of function (acknowledging +the interrupt and returning). This seems a reasonable choice also here +since message buffer was entirely emptied. + +Addresses-Coverity: Explicit null dereferenced +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-s3c2410.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/i2c/busses/i2c-s3c2410.c ++++ b/drivers/i2c/busses/i2c-s3c2410.c +@@ -484,7 +484,10 @@ static int i2c_s3c_irq_nextbyte(struct s + * forces us to send a new START + * when we change direction + */ ++ dev_dbg(i2c->dev, ++ "missing START before write->read\n"); + s3c24xx_i2c_stop(i2c, -EINVAL); ++ break; + } + + goto retry_write; diff --git a/queue-5.4/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch b/queue-5.4/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch new file mode 100644 index 00000000000..e509b67e3ed --- /dev/null +++ b/queue-5.4/i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch @@ -0,0 +1,33 @@ +From c4740e293c93c747e65d53d9aacc2ba8521d1489 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Thu, 6 May 2021 13:15:40 +0200 +Subject: i2c: sh_mobile: Use new clock calculation formulas for RZ/G2E + +From: Geert Uytterhoeven + +commit c4740e293c93c747e65d53d9aacc2ba8521d1489 upstream. + +When switching the Gen3 SoCs to the new clock calculation formulas, the +match entry for RZ/G2E added in commit 51243b73455f2d12 ("i2c: +sh_mobile: Add support for r8a774c0 (RZ/G2E)") was forgotten. + +Fixes: e8a27567509b2439 ("i2c: sh_mobile: use new clock calculation formulas for Gen3") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Fabrizio Castro +Signed-off-by: Wolfram Sang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/i2c/busses/i2c-sh_mobile.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -813,7 +813,7 @@ static const struct sh_mobile_dt_config + static const struct of_device_id sh_mobile_i2c_dt_ids[] = { + { .compatible = "renesas,iic-r8a73a4", .data = &fast_clock_dt_config }, + { .compatible = "renesas,iic-r8a7740", .data = &r8a7740_dt_config }, +- { .compatible = "renesas,iic-r8a774c0", .data = &fast_clock_dt_config }, ++ { .compatible = "renesas,iic-r8a774c0", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7790", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7791", .data = &v2_freq_calc_dt_config }, + { .compatible = "renesas,iic-r8a7792", .data = &v2_freq_calc_dt_config }, diff --git a/queue-5.4/net-dsa-fix-a-crash-if-get_sset_count-fails.patch b/queue-5.4/net-dsa-fix-a-crash-if-get_sset_count-fails.patch new file mode 100644 index 00000000000..2f0c2df787c --- /dev/null +++ b/queue-5.4/net-dsa-fix-a-crash-if-get_sset_count-fails.patch @@ -0,0 +1,49 @@ +From a269333fa5c0c8e53c92b5a28a6076a28cde3e83 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Sat, 8 May 2021 16:30:35 +0300 +Subject: net: dsa: fix a crash if ->get_sset_count() fails + +From: Dan Carpenter + +commit a269333fa5c0c8e53c92b5a28a6076a28cde3e83 upstream. + +If ds->ops->get_sset_count() fails then it "count" is a negative error +code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative +error code is type promoted to a very high value and the loop will +corrupt memory until the system crashes. + +Fix this by checking for error codes and changing the type of "i" to +just int. + +Fixes: badf3ada60ab ("net: dsa: Provide CPU port statistics to master netdev") +Signed-off-by: Dan Carpenter +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/dsa/master.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/net/dsa/master.c ++++ b/net/dsa/master.c +@@ -147,8 +147,7 @@ static void dsa_master_get_strings(struc + struct dsa_switch *ds = cpu_dp->ds; + int port = cpu_dp->index; + int len = ETH_GSTRING_LEN; +- int mcount = 0, count; +- unsigned int i; ++ int mcount = 0, count, i; + uint8_t pfx[4]; + uint8_t *ndata; + +@@ -178,6 +177,8 @@ static void dsa_master_get_strings(struc + */ + ds->ops->get_strings(ds, port, stringset, ndata); + count = ds->ops->get_sset_count(ds, port, stringset); ++ if (count < 0) ++ return; + for (i = 0; i < count; i++) { + memmove(ndata + (i * len + sizeof(pfx)), + ndata + i * len, len - sizeof(pfx)); diff --git a/queue-5.4/net-dsa-mt7530-fix-vlan-traffic-leaks.patch b/queue-5.4/net-dsa-mt7530-fix-vlan-traffic-leaks.patch new file mode 100644 index 00000000000..e0865efe0d3 --- /dev/null +++ b/queue-5.4/net-dsa-mt7530-fix-vlan-traffic-leaks.patch @@ -0,0 +1,49 @@ +From 474a2ddaa192777522a7499784f1d60691cd831a Mon Sep 17 00:00:00 2001 +From: DENG Qingfang +Date: Sun, 23 May 2021 22:51:54 +0800 +Subject: net: dsa: mt7530: fix VLAN traffic leaks + +From: DENG Qingfang + +commit 474a2ddaa192777522a7499784f1d60691cd831a upstream. + +PCR_MATRIX field was set to all 1's when VLAN filtering is enabled, but +was not reset when it is disabled, which may cause traffic leaks: + + ip link add br0 type bridge vlan_filtering 1 + ip link add br1 type bridge vlan_filtering 1 + ip link set swp0 master br0 + ip link set swp1 master br1 + ip link set br0 type bridge vlan_filtering 0 + ip link set br1 type bridge vlan_filtering 0 + # traffic in br0 and br1 will start leaking to each other + +As port_bridge_{add,del} have set up PCR_MATRIX properly, remove the +PCR_MATRIX write from mt7530_port_set_vlan_aware. + +Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530") +Signed-off-by: DENG Qingfang +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/mt7530.c | 8 -------- + 1 file changed, 8 deletions(-) + +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -809,14 +809,6 @@ mt7530_port_set_vlan_aware(struct dsa_sw + { + struct mt7530_priv *priv = ds->priv; + +- /* The real fabric path would be decided on the membership in the +- * entry of VLAN table. PCR_MATRIX set up here with ALL_MEMBERS +- * means potential VLAN can be consisting of certain subset of all +- * ports. +- */ +- mt7530_rmw(priv, MT7530_PCR_P(port), +- PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS)); +- + /* Trapped into security mode allows packet forwarding through VLAN + * table lookup. CPU port is set to fallback mode to let untagged + * frames pass through. diff --git a/queue-5.4/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch b/queue-5.4/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch new file mode 100644 index 00000000000..c27cbb99072 --- /dev/null +++ b/queue-5.4/net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch @@ -0,0 +1,30 @@ +From 6729188d2646709941903052e4b78e1d82c239b9 Mon Sep 17 00:00:00 2001 +From: Vladimir Oltean +Date: Mon, 24 May 2021 12:25:25 +0300 +Subject: net: dsa: sja1105: error out on unsupported PHY mode + +From: Vladimir Oltean + +commit 6729188d2646709941903052e4b78e1d82c239b9 upstream. + +The driver continues probing when a port is configured for an +unsupported PHY interface type, instead it should stop. + +Fixes: 8aa9ebccae87 ("net: dsa: Introduce driver for NXP SJA1105 5-port L2 switch") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/dsa/sja1105/sja1105_main.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -178,6 +178,7 @@ static int sja1105_init_mii_settings(str + default: + dev_err(dev, "Unsupported PHY mode %s!\n", + phy_modes(ports[i].phy_mode)); ++ return -EINVAL; + } + + mii->phy_mac[i] = ports[i].role; diff --git a/queue-5.4/perf-jevents-fix-getting-maximum-number-of-fds.patch b/queue-5.4/perf-jevents-fix-getting-maximum-number-of-fds.patch new file mode 100644 index 00000000000..b8129275a70 --- /dev/null +++ b/queue-5.4/perf-jevents-fix-getting-maximum-number-of-fds.patch @@ -0,0 +1,41 @@ +From 75ea44e356b5de8c817f821c9dd68ae329e82add Mon Sep 17 00:00:00 2001 +From: Felix Fietkau +Date: Tue, 25 May 2021 18:07:58 +0200 +Subject: perf jevents: Fix getting maximum number of fds + +From: Felix Fietkau + +commit 75ea44e356b5de8c817f821c9dd68ae329e82add upstream. + +On some hosts, rlim.rlim_max can be returned as RLIM_INFINITY. +By casting it to int, it is interpreted as -1, which will cause get_maxfds +to return 0, causing "Invalid argument" errors in nftw() calls. +Fix this by casting the second argument of min() to rlim_t instead. + +Fixes: 80eeb67fe577 ("perf jevents: Program to convert JSON file") +Signed-off-by: Felix Fietkau +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sukadev Bhattiprolu +Link: http://lore.kernel.org/lkml/20210525160758.97829-1-nbd@nbd.name +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Greg Kroah-Hartman +--- + tools/perf/pmu-events/jevents.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -862,7 +862,7 @@ static int get_maxfds(void) + struct rlimit rlim; + + if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) +- return min((int)rlim.rlim_max / 2, 512); ++ return min(rlim.rlim_max / 2, (rlim_t)512); + + return 512; + } diff --git a/queue-5.4/series b/queue-5.4/series index 667583dea13..987a37d8e56 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -76,3 +76,10 @@ revert-net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch tipc-wait-and-exit-until-all-work-queues-are-done.patch tipc-skb_linearize-the-head-skb-when-reassembling-msgs.patch spi-spi-fsl-dspi-fix-a-resource-leak-in-an-error-handling-path.patch +net-dsa-mt7530-fix-vlan-traffic-leaks.patch +net-dsa-fix-a-crash-if-get_sset_count-fails.patch +net-dsa-sja1105-error-out-on-unsupported-phy-mode.patch +i2c-s3c2410-fix-possible-null-pointer-deref-on-read-message-after-write.patch +i2c-i801-don-t-generate-an-interrupt-on-bus-reset.patch +i2c-sh_mobile-use-new-clock-calculation-formulas-for-rz-g2e.patch +perf-jevents-fix-getting-maximum-number-of-fds.patch