From: Greg Kroah-Hartman Date: Sun, 21 Mar 2021 12:37:19 +0000 (+0100) Subject: 5.4-stable patches X-Git-Tag: v4.4.263~55 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b70cf799aed37d84d648f4aa834ae1050cc8cba8;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: scsi-lpfc-fix-some-error-codes-in-debugfs.patch scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch --- diff --git a/queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch b/queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch new file mode 100644 index 00000000000..9eb88ed703a --- /dev/null +++ b/queue-5.4/scsi-lpfc-fix-some-error-codes-in-debugfs.patch @@ -0,0 +1,41 @@ +From 19f1bc7edf0f97186810e13a88f5b62069d89097 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 12 Mar 2021 10:42:11 +0300 +Subject: scsi: lpfc: Fix some error codes in debugfs + +From: Dan Carpenter + +commit 19f1bc7edf0f97186810e13a88f5b62069d89097 upstream. + +If copy_from_user() or kstrtoull() fail then the correct behavior is to +return a negative error code. + +Link: https://lore.kernel.org/r/YEsbU/UxYypVrC7/@mwanda +Fixes: f9bb2da11db8 ("[SCSI] lpfc 8.3.27: T10 additions for SLI4") +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_debugfs.c ++++ b/drivers/scsi/lpfc/lpfc_debugfs.c +@@ -2217,7 +2217,7 @@ lpfc_debugfs_dif_err_write(struct file * + memset(dstbuf, 0, 33); + size = (nbytes < 32) ? nbytes : 32; + if (copy_from_user(dstbuf, buf, size)) +- return 0; ++ return -EFAULT; + + if (dent == phba->debug_InjErrLBA) { + if ((buf[0] == 'o') && (buf[1] == 'f') && (buf[2] == 'f')) +@@ -2225,7 +2225,7 @@ lpfc_debugfs_dif_err_write(struct file * + } + + if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) +- return 0; ++ return -EINVAL; + + if (dent == phba->debug_writeGuard) + phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; diff --git a/queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch b/queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch new file mode 100644 index 00000000000..50cf7e78a4f --- /dev/null +++ b/queue-5.4/scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch @@ -0,0 +1,37 @@ +From 2bb817712e2f77486d6ee17e7efaf91997a685f8 Mon Sep 17 00:00:00 2001 +From: Lv Yunlong +Date: Wed, 10 Mar 2021 22:30:05 -0800 +Subject: scsi: myrs: Fix a double free in myrs_cleanup() + +From: Lv Yunlong + +commit 2bb817712e2f77486d6ee17e7efaf91997a685f8 upstream. + +In myrs_cleanup(), cs->mmio_base will be freed twice by iounmap(). + +Link: https://lore.kernel.org/r/20210311063005.9963-1-lyl2019@mail.ustc.edu.cn +Fixes: 77266186397c ("scsi: myrs: Add Mylex RAID controller (SCSI interface)") +Reviewed-by: Hannes Reinecke +Signed-off-by: Lv Yunlong +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/myrs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/myrs.c ++++ b/drivers/scsi/myrs.c +@@ -2274,12 +2274,12 @@ static void myrs_cleanup(struct myrs_hba + if (cs->mmio_base) { + cs->disable_intr(cs); + iounmap(cs->mmio_base); ++ cs->mmio_base = NULL; + } + if (cs->irq) + free_irq(cs->irq, cs); + if (cs->io_addr) + release_region(cs->io_addr, 0x80); +- iounmap(cs->mmio_base); + pci_set_drvdata(pdev, NULL); + pci_disable_device(pdev); + scsi_host_put(cs->host); diff --git a/queue-5.4/series b/queue-5.4/series index b231ef09f6a..bb0e26c328f 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -27,3 +27,5 @@ sunrpc-fix-refcount-leak-for-rpc-auth-modules.patch net-qrtr-fix-__netdev_alloc_skb-call.patch kbuild-fix-linux-version.h-for-empty-sublevel-or-patchlevel-again.patch riscv-correct-sparsemem-configuration.patch +scsi-lpfc-fix-some-error-codes-in-debugfs.patch +scsi-myrs-fix-a-double-free-in-myrs_cleanup.patch