From: Greg Kroah-Hartman Date: Mon, 4 Oct 2021 11:22:08 +0000 (+0200) Subject: 5.4-stable patches X-Git-Tag: v4.4.286~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f9d3af382f28dbb13a615f7bacac4b3891df1d6c;p=thirdparty%2Fkernel%2Fstable-queue.git 5.4-stable patches added patches: hso-fix-bailout-in-error-case-of-probe.patch usb-hso-fix-error-handling-code-of-hso_create_net_device.patch usb-hso-remove-the-bailout-parameter.patch --- diff --git a/queue-5.4/hso-fix-bailout-in-error-case-of-probe.patch b/queue-5.4/hso-fix-bailout-in-error-case-of-probe.patch new file mode 100644 index 00000000000..849b09ec118 --- /dev/null +++ b/queue-5.4/hso-fix-bailout-in-error-case-of-probe.patch @@ -0,0 +1,61 @@ +From 5fcfb6d0bfcda17f0d0656e4e5b3710af2bbaae5 Mon Sep 17 00:00:00 2001 +From: Oliver Neukum +Date: Wed, 5 Aug 2020 14:07:07 +0200 +Subject: hso: fix bailout in error case of probe + +From: Oliver Neukum + +commit 5fcfb6d0bfcda17f0d0656e4e5b3710af2bbaae5 upstream. + +The driver tries to reuse code for disconnect in case +of a failed probe. +If resources need to be freed after an error in probe, the +netdev must not be freed because it has never been registered. +Fix it by telling the helper which path we are in. + +Signed-off-by: Oliver Neukum +Signed-off-by: David S. Miller +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/hso.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2354,7 +2354,7 @@ static int remove_net_device(struct hso_ + } + + /* Frees our network device */ +-static void hso_free_net_device(struct hso_device *hso_dev) ++static void hso_free_net_device(struct hso_device *hso_dev, bool bailout) + { + int i; + struct hso_net *hso_net = dev2net(hso_dev); +@@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct h + kfree(hso_net->mux_bulk_tx_buf); + hso_net->mux_bulk_tx_buf = NULL; + +- if (hso_net->net) ++ if (hso_net->net && !bailout) + free_netdev(hso_net->net); + + kfree(hso_dev); +@@ -2553,7 +2553,7 @@ static struct hso_device *hso_create_net + + return hso_dev; + exit: +- hso_free_net_device(hso_dev); ++ hso_free_net_device(hso_dev, true); + return NULL; + } + +@@ -3120,7 +3120,7 @@ static void hso_free_interface(struct us + rfkill_unregister(rfk); + rfkill_destroy(rfk); + } +- hso_free_net_device(network_table[i]); ++ hso_free_net_device(network_table[i], false); + } + } + } diff --git a/queue-5.4/series b/queue-5.4/series index dc8b7cf703e..f367b0ea8fd 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -46,3 +46,6 @@ net-udp-annotate-data-race-around-udp_sk-sk-corkflag.patch net-stmmac-don-t-attach-interface-until-resume-finishes.patch pci-fix-pci_host_bridge-struct-device-release-free-handling.patch libnvdimm-pmem-fix-crash-triggered-when-i-o-in-flight-during-unbind.patch +hso-fix-bailout-in-error-case-of-probe.patch +usb-hso-fix-error-handling-code-of-hso_create_net_device.patch +usb-hso-remove-the-bailout-parameter.patch diff --git a/queue-5.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch b/queue-5.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch new file mode 100644 index 00000000000..7dd68088b12 --- /dev/null +++ b/queue-5.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch @@ -0,0 +1,111 @@ +From a6ecfb39ba9d7316057cea823b196b734f6b18ca Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Wed, 14 Jul 2021 17:13:22 +0800 +Subject: usb: hso: fix error handling code of hso_create_net_device + +From: Dongliang Mu + +commit a6ecfb39ba9d7316057cea823b196b734f6b18ca upstream. + +The current error handling code of hso_create_net_device is +hso_free_net_device, no matter which errors lead to. For example, +WARNING in hso_free_net_device [1]. + +Fix this by refactoring the error handling code of +hso_create_net_device by handling different errors by different code. + +[1] https://syzkaller.appspot.com/bug?id=66eff8d49af1b28370ad342787413e35bbe76efe + +Reported-by: syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com +Fixes: 5fcfb6d0bfcd ("hso: fix bailout in error case of probe") +Signed-off-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/hso.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2497,7 +2497,7 @@ static struct hso_device *hso_create_net + hso_net_init); + if (!net) { + dev_err(&interface->dev, "Unable to create ethernet device\n"); +- goto exit; ++ goto err_hso_dev; + } + + hso_net = netdev_priv(net); +@@ -2510,13 +2510,13 @@ static struct hso_device *hso_create_net + USB_DIR_IN); + if (!hso_net->in_endp) { + dev_err(&interface->dev, "Can't find BULK IN endpoint\n"); +- goto exit; ++ goto err_net; + } + hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, + USB_DIR_OUT); + if (!hso_net->out_endp) { + dev_err(&interface->dev, "Can't find BULK OUT endpoint\n"); +- goto exit; ++ goto err_net; + } + SET_NETDEV_DEV(net, &interface->dev); + SET_NETDEV_DEVTYPE(net, &hso_type); +@@ -2525,18 +2525,18 @@ static struct hso_device *hso_create_net + for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { + hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_rx_urb_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE, + GFP_KERNEL); + if (!hso_net->mux_bulk_rx_buf_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_urb) +- goto exit; ++ goto err_mux_bulk_rx; + hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_buf) +- goto exit; ++ goto err_free_tx_urb; + + add_net_device(hso_dev); + +@@ -2544,7 +2544,7 @@ static struct hso_device *hso_create_net + result = register_netdev(net); + if (result) { + dev_err(&interface->dev, "Failed to register device\n"); +- goto exit; ++ goto err_free_tx_buf; + } + + hso_log_port(hso_dev); +@@ -2552,8 +2552,21 @@ static struct hso_device *hso_create_net + hso_create_rfkill(hso_dev, interface); + + return hso_dev; +-exit: +- hso_free_net_device(hso_dev, true); ++ ++err_free_tx_buf: ++ remove_net_device(hso_dev); ++ kfree(hso_net->mux_bulk_tx_buf); ++err_free_tx_urb: ++ usb_free_urb(hso_net->mux_bulk_tx_urb); ++err_mux_bulk_rx: ++ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { ++ usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]); ++ kfree(hso_net->mux_bulk_rx_buf_pool[i]); ++ } ++err_net: ++ free_netdev(net); ++err_hso_dev: ++ kfree(hso_dev); + return NULL; + } + diff --git a/queue-5.4/usb-hso-remove-the-bailout-parameter.patch b/queue-5.4/usb-hso-remove-the-bailout-parameter.patch new file mode 100644 index 00000000000..68d9a50f129 --- /dev/null +++ b/queue-5.4/usb-hso-remove-the-bailout-parameter.patch @@ -0,0 +1,51 @@ +From dcb713d53e2eadf42b878c12a471e74dc6ed3145 Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Wed, 21 Jul 2021 16:14:57 +0800 +Subject: usb: hso: remove the bailout parameter + +From: Dongliang Mu + +commit dcb713d53e2eadf42b878c12a471e74dc6ed3145 upstream. + +There are two invocation sites of hso_free_net_device. After +refactoring hso_create_net_device, this parameter is useless. +Remove the bailout in the hso_free_net_device and change the invocation +sites of this function. + +Signed-off-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/hso.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2354,7 +2354,7 @@ static int remove_net_device(struct hso_ + } + + /* Frees our network device */ +-static void hso_free_net_device(struct hso_device *hso_dev, bool bailout) ++static void hso_free_net_device(struct hso_device *hso_dev) + { + int i; + struct hso_net *hso_net = dev2net(hso_dev); +@@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct h + kfree(hso_net->mux_bulk_tx_buf); + hso_net->mux_bulk_tx_buf = NULL; + +- if (hso_net->net && !bailout) ++ if (hso_net->net) + free_netdev(hso_net->net); + + kfree(hso_dev); +@@ -3133,7 +3133,7 @@ static void hso_free_interface(struct us + rfkill_unregister(rfk); + rfkill_destroy(rfk); + } +- hso_free_net_device(network_table[i], false); ++ hso_free_net_device(network_table[i]); + } + } + }