From 187dce0e4cfd094e4e092fc14c4520cb3bae58b5 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 14 May 2020 15:14:58 -0400 Subject: [PATCH] Fixes for 4.4 Signed-off-by: Sasha Levin --- ...k-around-gcc-10-stringop-overflow-wa.patch | 73 +++++++++++++++++++ ...moxa-fix-a-potential-double-free_irq.patch | 36 +++++++++ ...resource-leak-in-an-error-handling-p.patch | 52 +++++++++++++ queue-4.4/series | 3 + 4 files changed, 164 insertions(+) create mode 100644 queue-4.4/drop_monitor-work-around-gcc-10-stringop-overflow-wa.patch create mode 100644 queue-4.4/net-moxa-fix-a-potential-double-free_irq.patch create mode 100644 queue-4.4/net-sonic-fix-a-resource-leak-in-an-error-handling-p.patch diff --git a/queue-4.4/drop_monitor-work-around-gcc-10-stringop-overflow-wa.patch b/queue-4.4/drop_monitor-work-around-gcc-10-stringop-overflow-wa.patch new file mode 100644 index 00000000000..39502676d7c --- /dev/null +++ b/queue-4.4/drop_monitor-work-around-gcc-10-stringop-overflow-wa.patch @@ -0,0 +1,73 @@ +From 85c9a009c50d53fd86577a891d14a6c3211197cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 23:30:49 +0200 +Subject: drop_monitor: work around gcc-10 stringop-overflow warning + +From: Arnd Bergmann + +[ Upstream commit dc30b4059f6e2abf3712ab537c8718562b21c45d ] + +The current gcc-10 snapshot produces a false-positive warning: + +net/core/drop_monitor.c: In function 'trace_drop_common.constprop': +cc1: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=] +In file included from net/core/drop_monitor.c:23: +include/uapi/linux/net_dropmon.h:36:8: note: at offset 0 to object 'entries' with size 4 declared here + 36 | __u32 entries; + | ^~~~~~~ + +I reported this in the gcc bugzilla, but in case it does not get +fixed in the release, work around it by using a temporary variable. + +Fixes: 9a8afc8d3962 ("Network Drop Monitor: Adding drop monitor implementation & Netlink protocol") +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94881 +Signed-off-by: Arnd Bergmann +Acked-by: Neil Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/drop_monitor.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c +index a2270188b8649..9bcc6fdade3eb 100644 +--- a/net/core/drop_monitor.c ++++ b/net/core/drop_monitor.c +@@ -159,6 +159,7 @@ static void sched_send_work(unsigned long _data) + static void trace_drop_common(struct sk_buff *skb, void *location) + { + struct net_dm_alert_msg *msg; ++ struct net_dm_drop_point *point; + struct nlmsghdr *nlh; + struct nlattr *nla; + int i; +@@ -177,11 +178,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + nlh = (struct nlmsghdr *)dskb->data; + nla = genlmsg_data(nlmsg_data(nlh)); + msg = nla_data(nla); ++ point = msg->points; + for (i = 0; i < msg->entries; i++) { +- if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) { +- msg->points[i].count++; ++ if (!memcmp(&location, &point->pc, sizeof(void *))) { ++ point->count++; + goto out; + } ++ point++; + } + if (msg->entries == dm_hit_limit) + goto out; +@@ -190,8 +193,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location) + */ + __nla_reserve_nohdr(dskb, sizeof(struct net_dm_drop_point)); + nla->nla_len += NLA_ALIGN(sizeof(struct net_dm_drop_point)); +- memcpy(msg->points[msg->entries].pc, &location, sizeof(void *)); +- msg->points[msg->entries].count = 1; ++ memcpy(point->pc, &location, sizeof(void *)); ++ point->count = 1; + msg->entries++; + + if (!timer_pending(&data->send_timer)) { +-- +2.20.1 + diff --git a/queue-4.4/net-moxa-fix-a-potential-double-free_irq.patch b/queue-4.4/net-moxa-fix-a-potential-double-free_irq.patch new file mode 100644 index 00000000000..411caf26112 --- /dev/null +++ b/queue-4.4/net-moxa-fix-a-potential-double-free_irq.patch @@ -0,0 +1,36 @@ +From 952294f6d7a7419cbf9a3b085f6d50f1657e2805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Apr 2020 22:59:21 +0200 +Subject: net: moxa: Fix a potential double 'free_irq()' + +From: Christophe JAILLET + +[ Upstream commit ee8d2267f0e39a1bfd95532da3a6405004114b27 ] + +Should an irq requested with 'devm_request_irq' be released explicitly, +it should be done by 'devm_free_irq()', not 'free_irq()'. + +Fixes: 6c821bd9edc9 ("net: Add MOXA ART SoCs ethernet driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/moxa/moxart_ether.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/moxa/moxart_ether.c b/drivers/net/ethernet/moxa/moxart_ether.c +index f1dde59c9fa6c..374e691b11da6 100644 +--- a/drivers/net/ethernet/moxa/moxart_ether.c ++++ b/drivers/net/ethernet/moxa/moxart_ether.c +@@ -541,7 +541,7 @@ static int moxart_remove(struct platform_device *pdev) + struct net_device *ndev = platform_get_drvdata(pdev); + + unregister_netdev(ndev); +- free_irq(ndev->irq, ndev); ++ devm_free_irq(&pdev->dev, ndev->irq, ndev); + moxart_mac_free_memory(ndev); + free_netdev(ndev); + +-- +2.20.1 + diff --git a/queue-4.4/net-sonic-fix-a-resource-leak-in-an-error-handling-p.patch b/queue-4.4/net-sonic-fix-a-resource-leak-in-an-error-handling-p.patch new file mode 100644 index 00000000000..97a45242558 --- /dev/null +++ b/queue-4.4/net-sonic-fix-a-resource-leak-in-an-error-handling-p.patch @@ -0,0 +1,52 @@ +From 240c2b3b2468e64c6b52a99e3264d1b3ef537b0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Apr 2020 08:18:03 +0200 +Subject: net/sonic: Fix a resource leak in an error handling path in + 'jazz_sonic_probe()' + +From: Christophe JAILLET + +[ Upstream commit 10e3cc180e64385edc9890c6855acf5ed9ca1339 ] + +A call to 'dma_alloc_coherent()' is hidden in 'sonic_alloc_descriptors()', +called from 'sonic_probe1()'. + +This is correctly freed in the remove function, but not in the error +handling path of the probe function. +Fix it and add the missing 'dma_free_coherent()' call. + +While at it, rename a label in order to be slightly more informative. + +Fixes: efcce839360f ("[PATCH] macsonic/jazzsonic network drivers update") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/jazzsonic.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/jazzsonic.c b/drivers/net/ethernet/natsemi/jazzsonic.c +index acf3f11e38cc1..68d2f31921ff8 100644 +--- a/drivers/net/ethernet/natsemi/jazzsonic.c ++++ b/drivers/net/ethernet/natsemi/jazzsonic.c +@@ -247,13 +247,15 @@ static int jazz_sonic_probe(struct platform_device *pdev) + goto out; + err = register_netdev(dev); + if (err) +- goto out1; ++ goto undo_probe1; + + printk("%s: MAC %pM IRQ %d\n", dev->name, dev->dev_addr, dev->irq); + + return 0; + +-out1: ++undo_probe1: ++ dma_free_coherent(lp->device, SIZEOF_SONIC_DESC * SONIC_BUS_SCALE(lp->dma_bitmode), ++ lp->descriptors, lp->descriptors_laddr); + release_mem_region(dev->base_addr, SONIC_MEM_SIZE); + out: + free_netdev(dev); +-- +2.20.1 + diff --git a/queue-4.4/series b/queue-4.4/series index ea7022e6bbd..3b6e87ba822 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -33,3 +33,6 @@ ptp-fix-pass-zero-to-err_ptr-in-ptp_clock_register.patch ptp-fix-the-race-between-the-release-of-ptp_clock-and-cdev.patch ptp-free-ptp-device-pin-descriptors-properly.patch net-handle-no-dst-on-skb-in-icmp6_send.patch +net-sonic-fix-a-resource-leak-in-an-error-handling-p.patch +net-moxa-fix-a-potential-double-free_irq.patch +drop_monitor-work-around-gcc-10-stringop-overflow-wa.patch -- 2.47.3