* [PATCH AUTOSEL 4.14 2/7] cavium: Return negative value when pci_alloc_irq_vectors() fails
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 3/7] scsi: qla2xxx: Fix unmap of already freed sgl Sasha Levin
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheyu Ma, David S . Miller, Sasha Levin, sgoutham, kuba,
linux-arm-kernel, netdev
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 819f38a3225d..7f8ea16ad0d0 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1128,7 +1128,7 @@ static int nic_register_interrupts(struct nicpf *nic)
dev_err(&nic->pdev->dev,
"Request for #%d msix vectors failed, returned %d\n",
nic->num_vec, ret);
- return 1;
+ return ret;
}
/* Register mailbox interrupt handler */
--
2.33.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH AUTOSEL 4.14 2/7] cavium: Return negative value when pci_alloc_irq_vectors() fails
@ 2021-10-25 17:01 ` Sasha Levin
0 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheyu Ma, David S . Miller, Sasha Levin, sgoutham, kuba,
linux-arm-kernel, netdev
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit b2cddb44bddc1a9c5949a978bb454bba863264db ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nic_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nic_main.c b/drivers/net/ethernet/cavium/thunder/nic_main.c
index 819f38a3225d..7f8ea16ad0d0 100644
--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
@@ -1128,7 +1128,7 @@ static int nic_register_interrupts(struct nicpf *nic)
dev_err(&nic->pdev->dev,
"Request for #%d msix vectors failed, returned %d\n",
nic->num_vec, ret);
- return 1;
+ return ret;
}
/* Register mailbox interrupt handler */
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH AUTOSEL 4.14 3/7] scsi: qla2xxx: Fix unmap of already freed sgl
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
2021-10-25 17:01 ` Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
2021-10-25 17:01 ` Sasha Levin
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dmitry Bogdanov, Himanshu Madhani, Martin K . Petersen,
Sasha Levin, njavali, GR-QLogic-Storage-Upstream, jejb,
linux-scsi
From: Dmitry Bogdanov <d.bogdanov@yadro.com>
[ Upstream commit 4a8f71014b4d56c4fb287607e844c0a9f68f46d9 ]
The sgl is freed in the target stack in target_release_cmd_kref() before
calling qlt_free_cmd() but there is an unmap of sgl in qlt_free_cmd() that
causes a panic if sgl is not yet DMA unmapped:
NIP dma_direct_unmap_sg+0xdc/0x180
LR dma_direct_unmap_sg+0xc8/0x180
Call Trace:
ql_dbg_prefix+0x68/0xc0 [qla2xxx] (unreliable)
dma_unmap_sg_attrs+0x54/0xf0
qlt_unmap_sg.part.19+0x54/0x1c0 [qla2xxx]
qlt_free_cmd+0x124/0x1d0 [qla2xxx]
tcm_qla2xxx_release_cmd+0x4c/0xa0 [tcm_qla2xxx]
target_put_sess_cmd+0x198/0x370 [target_core_mod]
transport_generic_free_cmd+0x6c/0x1b0 [target_core_mod]
tcm_qla2xxx_complete_free+0x6c/0x90 [tcm_qla2xxx]
The sgl may be left unmapped in error cases of response sending. For
instance, qlt_rdy_to_xfer() maps sgl and exits when session is being
deleted keeping the sgl mapped.
This patch removes use-after-free of the sgl and ensures that the sgl is
unmapped for any command that was not sent to firmware.
Link: https://lore.kernel.org/r/20211018122650.11846-1-d.bogdanov@yadro.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_target.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
index bd8f9b03386a..cb2db1c1e9f2 100644
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -3095,8 +3095,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type,
"RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n",
vha->flags.online, qla2x00_reset_active(vha),
cmd->reset_count, qpair->chip_reset);
- spin_unlock_irqrestore(qpair->qp_lock_ptr, flags);
- return 0;
+ goto out_unmap_unlock;
}
/* Does F/W have an IOCBs for this request */
@@ -3218,10 +3217,6 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
prm.sg = NULL;
prm.req_cnt = 1;
- /* Calculate number of entries and segments required */
- if (qlt_pci_map_calc_cnt(&prm) != 0)
- return -EAGAIN;
-
if (!qpair->fw_started || (cmd->reset_count != qpair->chip_reset) ||
(cmd->sess && cmd->sess->deleted)) {
/*
@@ -3237,6 +3232,10 @@ int qlt_rdy_to_xfer(struct qla_tgt_cmd *cmd)
return 0;
}
+ /* Calculate number of entries and segments required */
+ if (qlt_pci_map_calc_cnt(&prm) != 0)
+ return -EAGAIN;
+
spin_lock_irqsave(qpair->qp_lock_ptr, flags);
/* Does F/W have an IOCBs for this request */
res = qlt_check_reserve_free_req(qpair, prm.req_cnt);
@@ -3671,9 +3670,6 @@ void qlt_free_cmd(struct qla_tgt_cmd *cmd)
BUG_ON(cmd->cmd_in_wq);
- if (cmd->sg_mapped)
- qlt_unmap_sg(cmd->vha, cmd);
-
if (!cmd->q_full)
qlt_decr_num_pend_cmds(cmd->vha);
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH AUTOSEL 4.14 4/7] cavium: Fix return values of the probe function
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 3/7] scsi: qla2xxx: Fix unmap of already freed sgl Sasha Levin
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheyu Ma, David S . Miller, Sasha Levin, sgoutham, kuba,
linux-arm-kernel, netdev
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 98734a37b6f6..df1c4ba7e0c9 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1152,7 +1152,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (ret < 0) {
netdev_err(nic->netdev,
"Req for #%d msix vectors failed\n", nic->num_vec);
- return 1;
+ return ret;
}
sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
@@ -1171,7 +1171,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (!nicvf_check_pf_ready(nic)) {
nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
nicvf_unregister_interrupts(nic);
- return 1;
+ return -EIO;
}
return 0;
--
2.33.0
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH AUTOSEL 4.14 4/7] cavium: Fix return values of the probe function
@ 2021-10-25 17:01 ` Sasha Levin
0 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Zheyu Ma, David S . Miller, Sasha Levin, sgoutham, kuba,
linux-arm-kernel, netdev
From: Zheyu Ma <zheyuma97@gmail.com>
[ Upstream commit c69b2f46876825c726bd8a97c7fa852d8932bc32 ]
During the process of driver probing, the probe function should return < 0
for failure, otherwise, the kernel will treat value > 0 as success.
Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cavium/thunder/nicvf_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 98734a37b6f6..df1c4ba7e0c9 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -1152,7 +1152,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (ret < 0) {
netdev_err(nic->netdev,
"Req for #%d msix vectors failed\n", nic->num_vec);
- return 1;
+ return ret;
}
sprintf(nic->irq_name[irq], "%s Mbox", "NICVF");
@@ -1171,7 +1171,7 @@ static int nicvf_register_misc_interrupt(struct nicvf *nic)
if (!nicvf_check_pf_ready(nic)) {
nicvf_disable_intr(nic, NICVF_INTR_MBOX, 0);
nicvf_unregister_interrupts(nic);
- return 1;
+ return -EIO;
}
return 0;
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread
* [PATCH AUTOSEL 4.14 5/7] sfc: Don't use netif_info before net_device setup
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
` (2 preceding siblings ...)
2021-10-25 17:01 ` Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 6/7] usbnet: sanity check for maxpacket Sasha Levin
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 7/7] hyperv/vmbus: include linux/bitops.h Sasha Levin
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Erik Ekman, Martin Habets, David S . Miller, Sasha Levin,
ecree.xilinx, kuba, netdev
From: Erik Ekman <erik@kryo.se>
[ Upstream commit bf6abf345dfa77786aca554bc58c64bd428ecb1d ]
Use pci_info instead to avoid unnamed/uninitialized noise:
[197088.688729] sfc 0000:01:00.0: Solarflare NIC detected
[197088.690333] sfc 0000:01:00.0: Part Number : SFN5122F
[197088.729061] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no SR-IOV VFs probed
[197088.729071] sfc 0000:01:00.0 (unnamed net_device) (uninitialized): no PTP support
Inspired by fa44821a4ddd ("sfc: don't use netif_info et al before
net_device is registered") from Heiner Kallweit.
Signed-off-by: Erik Ekman <erik@kryo.se>
Acked-by: Martin Habets <habetsm.xilinx@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/ptp.c | 4 ++--
drivers/net/ethernet/sfc/siena_sriov.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/sfc/ptp.c b/drivers/net/ethernet/sfc/ptp.c
index f22690792697..c50c1892e88d 100644
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -494,7 +494,7 @@ static int efx_ptp_get_attributes(struct efx_nic *efx)
} else if (rc == -EINVAL) {
fmt = MC_CMD_PTP_OUT_GET_ATTRIBUTES_SECONDS_NANOSECONDS;
} else if (rc == -EPERM) {
- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+ pci_info(efx->pci_dev, "no PTP support\n");
return rc;
} else {
efx_mcdi_display_error(efx, MC_CMD_PTP, sizeof(inbuf),
@@ -613,7 +613,7 @@ static int efx_ptp_disable(struct efx_nic *efx)
* should only have been called during probe.
*/
if (rc == -ENOSYS || rc == -EPERM)
- netif_info(efx, probe, efx->net_dev, "no PTP support\n");
+ pci_info(efx->pci_dev, "no PTP support\n");
else if (rc)
efx_mcdi_display_error(efx, MC_CMD_PTP,
MC_CMD_PTP_IN_DISABLE_LEN,
diff --git a/drivers/net/ethernet/sfc/siena_sriov.c b/drivers/net/ethernet/sfc/siena_sriov.c
index da7b94f34604..30d58f72725d 100644
--- a/drivers/net/ethernet/sfc/siena_sriov.c
+++ b/drivers/net/ethernet/sfc/siena_sriov.c
@@ -1059,7 +1059,7 @@ void efx_siena_sriov_probe(struct efx_nic *efx)
return;
if (efx_siena_sriov_cmd(efx, false, &efx->vi_scale, &count)) {
- netif_info(efx, probe, efx->net_dev, "no SR-IOV VFs probed\n");
+ pci_info(efx->pci_dev, "no SR-IOV VFs probed\n");
return;
}
if (count > 0 && count > max_vfs)
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH AUTOSEL 4.14 6/7] usbnet: sanity check for maxpacket
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
` (3 preceding siblings ...)
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 5/7] sfc: Don't use netif_info before net_device setup Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 7/7] hyperv/vmbus: include linux/bitops.h Sasha Levin
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Oliver Neukum, syzbot+76bb1d34ffa0adc03baa, Johan Hovold,
Jakub Kicinski, Sasha Levin, davem, netdev, linux-usb
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 397430b50a363d8b7bdda00522123f82df6adc5e ]
maxpacket of 0 makes no sense and oopses as we need to divide
by it. Give up.
V2: fixed typo in log and stylistic issues
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Reported-by: syzbot+76bb1d34ffa0adc03baa@syzkaller.appspotmail.com
Reviewed-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20211021122944.21816-1-oneukum@suse.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/usbnet.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index cb9a18eda798..1703da29bdee 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1788,6 +1788,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
if (!dev->rx_urb_size)
dev->rx_urb_size = dev->hard_mtu;
dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
+ if (dev->maxpacket == 0) {
+ /* that is a broken device */
+ goto out4;
+ }
/* let userspace know we have a random address */
if (ether_addr_equal(net->dev_addr, node_id))
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH AUTOSEL 4.14 7/7] hyperv/vmbus: include linux/bitops.h
2021-10-25 17:01 [PATCH AUTOSEL 4.14 1/7] scsi: core: Put LLD module refcnt after SCSI device is released Sasha Levin
` (4 preceding siblings ...)
2021-10-25 17:01 ` [PATCH AUTOSEL 4.14 6/7] usbnet: sanity check for maxpacket Sasha Levin
@ 2021-10-25 17:01 ` Sasha Levin
5 siblings, 0 replies; 9+ messages in thread
From: Sasha Levin @ 2021-10-25 17:01 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Arnd Bergmann, Wei Liu, Sasha Levin, kys, haiyangz, sthemmin,
decui, linux-hyperv
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 8017c99680fa65e1e8d999df1583de476a187830 ]
On arm64 randconfig builds, hyperv sometimes fails with this
error:
In file included from drivers/hv/hv_trace.c:3:
In file included from drivers/hv/hyperv_vmbus.h:16:
In file included from arch/arm64/include/asm/sync_bitops.h:5:
arch/arm64/include/asm/bitops.h:11:2: error: only <linux/bitops.h> can be included directly
In file included from include/asm-generic/bitops/hweight.h:5:
include/asm-generic/bitops/arch_hweight.h:9:9: error: implicit declaration of function '__sw_hweight32' [-Werror,-Wimplicit-function-declaration]
include/asm-generic/bitops/atomic.h:17:7: error: implicit declaration of function 'BIT_WORD' [-Werror,-Wimplicit-function-declaration]
Include the correct header first.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20211018131929.2260087-1-arnd@kernel.org
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hv/hyperv_vmbus.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h
index a166de6efd99..0996a246c80b 100644
--- a/drivers/hv/hyperv_vmbus.h
+++ b/drivers/hv/hyperv_vmbus.h
@@ -26,6 +26,7 @@
#define _HYPERV_VMBUS_H
#include <linux/list.h>
+#include <linux/bitops.h>
#include <asm/sync_bitops.h>
#include <linux/atomic.h>
#include <linux/hyperv.h>
--
2.33.0
^ permalink raw reply related [flat|nested] 9+ messages in thread