linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid
@ 2021-04-12 16:25 Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 02/28] ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race Sasha Levin
                   ` (26 more replies)
  0 siblings, 27 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, syzbot+d4c07de0144f6f63be3a, Stefan Schmidt,
	Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 6f7f657f24405f426212c09260bf7fe8a52cef33 ]

This patch fixes a null pointer derefence for panid handle by move the
check for the netlink variable directly before accessing them.

Reported-by: syzbot+d4c07de0144f6f63be3a@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210228151817.95700-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl-mac.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/net/ieee802154/nl-mac.c b/net/ieee802154/nl-mac.c
index d3cbb3258718..c0930b9fe848 100644
--- a/net/ieee802154/nl-mac.c
+++ b/net/ieee802154/nl-mac.c
@@ -559,9 +559,7 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
 	desc->mode = nla_get_u8(info->attrs[IEEE802154_ATTR_LLSEC_KEY_MODE]);
 
 	if (desc->mode == IEEE802154_SCF_KEY_IMPLICIT) {
-		if (!info->attrs[IEEE802154_ATTR_PAN_ID] &&
-		    !(info->attrs[IEEE802154_ATTR_SHORT_ADDR] ||
-		      info->attrs[IEEE802154_ATTR_HW_ADDR]))
+		if (!info->attrs[IEEE802154_ATTR_PAN_ID])
 			return -EINVAL;
 
 		desc->device_addr.pan_id = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_PAN_ID]);
@@ -570,6 +568,9 @@ ieee802154_llsec_parse_key_id(struct genl_info *info,
 			desc->device_addr.mode = IEEE802154_ADDR_SHORT;
 			desc->device_addr.short_addr = nla_get_shortaddr(info->attrs[IEEE802154_ATTR_SHORT_ADDR]);
 		} else {
+			if (!info->attrs[IEEE802154_ATTR_HW_ADDR])
+				return -EINVAL;
+
 			desc->device_addr.mode = IEEE802154_ADDR_LONG;
 			desc->device_addr.extended_addr = nla_get_hwaddr(info->attrs[IEEE802154_ATTR_HW_ADDR]);
 		}
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 02/28] ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 03/28] ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 Sasha Levin
                   ` (25 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Tony Lindgren, Sasha Levin, linux-omap, devicetree

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 140a776833957539c84301dbdb4c3013876de118 ]

We have a duplicate legacy clock defined for sha2md5_fck that can
sometimes race with clk_disable() with the dts configured clock
for OMAP4_SHA2MD5_CLKCTRL when unused clocks are disabled during
boot causing an "Unhandled fault: imprecise external abort".

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap44xx-clocks.dtsi | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/arch/arm/boot/dts/omap44xx-clocks.dtsi b/arch/arm/boot/dts/omap44xx-clocks.dtsi
index 279ff2f419df..c654588f9e8c 100644
--- a/arch/arm/boot/dts/omap44xx-clocks.dtsi
+++ b/arch/arm/boot/dts/omap44xx-clocks.dtsi
@@ -773,14 +773,6 @@ per_abe_nc_fclk: per_abe_nc_fclk@108 {
 		ti,max-div = <2>;
 	};
 
-	sha2md5_fck: sha2md5_fck@15c8 {
-		#clock-cells = <0>;
-		compatible = "ti,gate-clock";
-		clocks = <&l3_div_ck>;
-		ti,bit-shift = <1>;
-		reg = <0x15c8>;
-	};
-
 	usb_phy_cm_clk32k: usb_phy_cm_clk32k@640 {
 		#clock-cells = <0>;
 		compatible = "ti,gate-clock";
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 03/28] ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 02/28] ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 04/28] lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message Sasha Levin
                   ` (24 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Tony Lindgren, Sasha Levin, linux-omap, devicetree

From: Tony Lindgren <tony@atomide.com>

[ Upstream commit 77335a040178a0456d4eabc8bf17a7ca3ee4a327 ]

Fix moving mmc devices with dts aliases as discussed on the lists.
Without this we now have internal eMMC mmc1 show up as mmc2 compared
to the earlier order of devices.

Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/boot/dts/omap4.dtsi | 5 +++++
 arch/arm/boot/dts/omap5.dtsi | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
index 8f907c235b02..046e77024567 100644
--- a/arch/arm/boot/dts/omap4.dtsi
+++ b/arch/arm/boot/dts/omap4.dtsi
@@ -25,6 +25,11 @@ aliases {
 		i2c1 = &i2c2;
 		i2c2 = &i2c3;
 		i2c3 = &i2c4;
+		mmc0 = &mmc1;
+		mmc1 = &mmc2;
+		mmc2 = &mmc3;
+		mmc3 = &mmc4;
+		mmc4 = &mmc5;
 		serial0 = &uart1;
 		serial1 = &uart2;
 		serial2 = &uart3;
diff --git a/arch/arm/boot/dts/omap5.dtsi b/arch/arm/boot/dts/omap5.dtsi
index 3c0bafe0fb05..cf66c374de4f 100644
--- a/arch/arm/boot/dts/omap5.dtsi
+++ b/arch/arm/boot/dts/omap5.dtsi
@@ -26,6 +26,11 @@ aliases {
 		i2c2 = &i2c3;
 		i2c3 = &i2c4;
 		i2c4 = &i2c5;
+		mmc0 = &mmc1;
+		mmc1 = &mmc2;
+		mmc2 = &mmc3;
+		mmc3 = &mmc4;
+		mmc4 = &mmc5;
 		serial0 = &uart1;
 		serial1 = &uart2;
 		serial2 = &uart3;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 04/28] lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 02/28] ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 03/28] ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 05/28] arc: kernel: Return -EFAULT if copy_to_user() fails Sasha Levin
                   ` (23 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Tetsuo Handa, Ingo Molnar, Sasha Levin

From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>

[ Upstream commit 3a85969e9d912d5dd85362ee37b5f81266e00e77 ]

Since this message is printed when dynamically allocated spinlocks (e.g.
kzalloc()) are used without initialization (e.g. spin_lock_init()),
suggest to developers to check whether initialization functions for objects
were called, before making developers wonder what annotation is missing.

[ mingo: Minor tweaks to the message. ]

Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20210321064913.4619-1-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/locking/lockdep.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 8a1758b094b7..126c6d524a0f 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -722,7 +722,8 @@ static bool assign_lock_key(struct lockdep_map *lock)
 		/* Debug-check: all keys must be persistent! */
 		debug_locks_off();
 		pr_err("INFO: trying to register non-static key.\n");
-		pr_err("the code is fine but needs lockdep annotation.\n");
+		pr_err("The code is fine but needs lockdep annotation, or maybe\n");
+		pr_err("you didn't initialize this object before use?\n");
 		pr_err("turning off the locking correctness validator.\n");
 		dump_stack();
 		return false;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 05/28] arc: kernel: Return -EFAULT if copy_to_user() fails
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (2 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 04/28] lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 06/28] neighbour: Disregard DEAD dst in neigh_update Sasha Levin
                   ` (22 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Wang Qing, Vineet Gupta, Sasha Levin, linux-snps-arc

From: Wang Qing <wangqing@vivo.com>

[ Upstream commit 46e152186cd89d940b26726fff11eb3f4935b45a ]

The copy_to_user() function returns the number of bytes remaining to be
copied, but we want to return -EFAULT if the copy doesn't complete.

Signed-off-by: Wang Qing <wangqing@vivo.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arc/kernel/signal.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index 48685445002e..da243420bcb5 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -99,7 +99,7 @@ stash_usr_regs(struct rt_sigframe __user *sf, struct pt_regs *regs,
 			     sizeof(sf->uc.uc_mcontext.regs.scratch));
 	err |= __copy_to_user(&sf->uc.uc_sigmask, set, sizeof(sigset_t));
 
-	return err;
+	return err ? -EFAULT : 0;
 }
 
 static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
@@ -113,7 +113,7 @@ static int restore_usr_regs(struct pt_regs *regs, struct rt_sigframe __user *sf)
 				&(sf->uc.uc_mcontext.regs.scratch),
 				sizeof(sf->uc.uc_mcontext.regs.scratch));
 	if (err)
-		return err;
+		return -EFAULT;
 
 	set_current_blocked(&set);
 	regs->bta	= uregs.scratch.bta;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 06/28] neighbour: Disregard DEAD dst in neigh_update
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (3 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 05/28] arc: kernel: Return -EFAULT if copy_to_user() fails Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 07/28] ARM: keystone: fix integer overflow warning Sasha Levin
                   ` (21 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Tong Zhu, David S . Miller, Sasha Levin, netdev

From: Tong Zhu <zhutong@amazon.com>

[ Upstream commit d47ec7a0a7271dda08932d6208e4ab65ab0c987c ]

After a short network outage, the dst_entry is timed out and put
in DST_OBSOLETE_DEAD. We are in this code because arp reply comes
from this neighbour after network recovers. There is a potential
race condition that dst_entry is still in DST_OBSOLETE_DEAD.
With that, another neighbour lookup causes more harm than good.

In best case all packets in arp_queue are lost. This is
counterproductive to the original goal of finding a better path
for those packets.

I observed a worst case with 4.x kernel where a dst_entry in
DST_OBSOLETE_DEAD state is associated with loopback net_device.
It leads to an ethernet header with all zero addresses.
A packet with all zero source MAC address is quite deadly with
mac80211, ath9k and 802.11 block ack.  It fails
ieee80211_find_sta_by_ifaddr in ath9k (xmit.c). Ath9k flushes tx
queue (ath_tx_complete_aggr). BAW (block ack window) is not
updated. BAW logic is damaged and ath9k transmission is disabled.

Signed-off-by: Tong Zhu <zhutong@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/core/neighbour.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 6e890f51b7d8..e471c32e448f 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1271,7 +1271,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 			 * we can reinject the packet there.
 			 */
 			n2 = NULL;
-			if (dst) {
+			if (dst && dst->obsolete != DST_OBSOLETE_DEAD) {
 				n2 = dst_neigh_lookup_skb(dst, skb);
 				if (n2)
 					n1 = n2;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 07/28] ARM: keystone: fix integer overflow warning
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (4 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 06/28] neighbour: Disregard DEAD dst in neigh_update Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 08/28] drivers: net: fix memory leak in atusb_probe Sasha Levin
                   ` (20 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Arnd Bergmann, Nathan Chancellor, Santosh Shilimkar, Sasha Levin,
	linux-arm-kernel, clang-built-linux

From: Arnd Bergmann <arnd@arndb.de>

[ Upstream commit 844b85dda2f569943e1e018fdd63b6f7d1d6f08e ]

clang warns about an impossible condition when building with 32-bit
phys_addr_t:

arch/arm/mach-keystone/keystone.c:79:16: error: result of comparison of constant 51539607551 with expression of type 'phys_addr_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
            mem_end   > KEYSTONE_HIGH_PHYS_END) {
            ~~~~~~~   ^ ~~~~~~~~~~~~~~~~~~~~~~
arch/arm/mach-keystone/keystone.c:78:16: error: result of comparison of constant 34359738368 with expression of type 'phys_addr_t' (aka 'unsigned int') is always true [-Werror,-Wtautological-constant-out-of-range-compare]
        if (mem_start < KEYSTONE_HIGH_PHYS_START ||
            ~~~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~~~~~~~

Change the temporary variable to a fixed-size u64 to avoid the warning.

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Santosh Shilimkar <ssantosh@kernel.org>
Link: https://lore.kernel.org/r/20210323131814.2751750-1-arnd@kernel.org'
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/arm/mach-keystone/keystone.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mach-keystone/keystone.c b/arch/arm/mach-keystone/keystone.c
index 84613abf35a3..79ff5b953431 100644
--- a/arch/arm/mach-keystone/keystone.c
+++ b/arch/arm/mach-keystone/keystone.c
@@ -65,7 +65,7 @@ static void __init keystone_init(void)
 static long long __init keystone_pv_fixup(void)
 {
 	long long offset;
-	phys_addr_t mem_start, mem_end;
+	u64 mem_start, mem_end;
 
 	mem_start = memblock_start_of_DRAM();
 	mem_end = memblock_end_of_DRAM();
@@ -78,7 +78,7 @@ static long long __init keystone_pv_fixup(void)
 	if (mem_start < KEYSTONE_HIGH_PHYS_START ||
 	    mem_end   > KEYSTONE_HIGH_PHYS_END) {
 		pr_crit("Invalid address space for memory (%08llx-%08llx)\n",
-		        (u64)mem_start, (u64)mem_end);
+		        mem_start, mem_end);
 		return 0;
 	}
 
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 08/28] drivers: net: fix memory leak in atusb_probe
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (5 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 07/28] ARM: keystone: fix integer overflow warning Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 09/28] drivers: net: fix memory leak in peak_usb_create_dev Sasha Levin
                   ` (19 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Pavel Skripkin, syzbot+28a246747e0a465127f3, David S . Miller,
	Sasha Levin, linux-wpan, netdev

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 6b9fbe16955152626557ec6f439f3407b7769941 ]

syzbot reported memory leak in atusb_probe()[1].
The problem was in atusb_alloc_urbs().
Since urb is anchored, we need to release the reference
to correctly free the urb

backtrace:
    [<ffffffff82ba0466>] kmalloc include/linux/slab.h:559 [inline]
    [<ffffffff82ba0466>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
    [<ffffffff82ad3888>] atusb_alloc_urbs drivers/net/ieee802154/atusb.c:362 [inline][2]
    [<ffffffff82ad3888>] atusb_probe+0x158/0x820 drivers/net/ieee802154/atusb.c:1038 [1]

Reported-by: syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ieee802154/atusb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 078027bbe002..a2b876abb03b 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -368,6 +368,7 @@ static int atusb_alloc_urbs(struct atusb *atusb, int n)
 			return -ENOMEM;
 		}
 		usb_anchor_urb(urb, &atusb->idle_urbs);
+		usb_free_urb(urb);
 		n--;
 	}
 	return 0;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 09/28] drivers: net: fix memory leak in peak_usb_create_dev
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (6 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 08/28] drivers: net: fix memory leak in atusb_probe Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 10/28] drm/msm: Fix a5xx/a6xx timestamps Sasha Levin
                   ` (18 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Pavel Skripkin, syzbot+91adee8d9ebb9193d22d, David S . Miller,
	Sasha Levin, linux-can, netdev

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit a0b96b4a62745397aee662670cfc2157bac03f55 ]

syzbot reported memory leak in peak_usb.
The problem was in case of failure after calling
->dev_init()[2] in peak_usb_create_dev()[1]. The data
allocated int dev_init() wasn't freed, so simple
->dev_free() call fix this problem.

backtrace:
    [<0000000079d6542a>] kmalloc include/linux/slab.h:552 [inline]
    [<0000000079d6542a>] kzalloc include/linux/slab.h:682 [inline]
    [<0000000079d6542a>] pcan_usb_fd_init+0x156/0x210 drivers/net/can/usb/peak_usb/pcan_usb_fd.c:868   [2]
    [<00000000c09f9057>] peak_usb_create_dev drivers/net/can/usb/peak_usb/pcan_usb_core.c:851 [inline] [1]
    [<00000000c09f9057>] peak_usb_probe+0x389/0x490 drivers/net/can/usb/peak_usb/pcan_usb_core.c:949

Reported-by: syzbot+91adee8d9ebb9193d22d@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/can/usb/peak_usb/pcan_usb_core.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
index f7d653d48a1e..c235d1e6bc52 100644
--- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
@@ -864,7 +864,7 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
 	if (dev->adapter->dev_set_bus) {
 		err = dev->adapter->dev_set_bus(dev, 0);
 		if (err)
-			goto lbl_unregister_candev;
+			goto adap_dev_free;
 	}
 
 	/* get device number early */
@@ -876,6 +876,10 @@ static int peak_usb_create_dev(const struct peak_usb_adapter *peak_usb_adapter,
 
 	return 0;
 
+adap_dev_free:
+	if (dev->adapter->dev_free)
+		dev->adapter->dev_free(dev);
+
 lbl_unregister_candev:
 	unregister_candev(netdev);
 
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 10/28] drm/msm: Fix a5xx/a6xx timestamps
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (7 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 09/28] drivers: net: fix memory leak in peak_usb_create_dev Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 11/28] ASoC: fsl_esai: Fix TDM slot setup for I2S mode Sasha Levin
                   ` (17 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Rob Clark, Jordan Crouse, Sasha Levin, linux-arm-msm, dri-devel,
	freedreno

From: Rob Clark <robdclark@chromium.org>

[ Upstream commit 9fbd3088351b92e8c2cef6e37a39decb12a8d5bb ]

They were reading a counter that was configured to ALWAYS_COUNT (ie.
cycles that the GPU is doing something) rather than ALWAYS_ON.  This
isn't the thing that userspace is looking for.

Signed-off-by: Rob Clark <robdclark@chromium.org>
Acked-by: Jordan Crouse <jordan@cosmicpenguin.net>
Message-Id: <20210325012358.1759770-2-robdclark@gmail.com>
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 ++--
 drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
index 776bbe9775e9..ba513018534e 100644
--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c
@@ -1194,8 +1194,8 @@ static int a5xx_pm_suspend(struct msm_gpu *gpu)
 
 static int a5xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
 {
-	*value = gpu_read64(gpu, REG_A5XX_RBBM_PERFCTR_CP_0_LO,
-		REG_A5XX_RBBM_PERFCTR_CP_0_HI);
+	*value = gpu_read64(gpu, REG_A5XX_RBBM_ALWAYSON_COUNTER_LO,
+		REG_A5XX_RBBM_ALWAYSON_COUNTER_HI);
 
 	return 0;
 }
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
index c629f742a1d1..c280fdc44939 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c
@@ -713,8 +713,8 @@ static int a6xx_get_timestamp(struct msm_gpu *gpu, uint64_t *value)
 	/* Force the GPU power on so we can read this register */
 	a6xx_gmu_set_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
 
-	*value = gpu_read64(gpu, REG_A6XX_RBBM_PERFCTR_CP_0_LO,
-		REG_A6XX_RBBM_PERFCTR_CP_0_HI);
+	*value = gpu_read64(gpu, REG_A6XX_CP_ALWAYS_ON_COUNTER_LO,
+		REG_A6XX_CP_ALWAYS_ON_COUNTER_HI);
 
 	a6xx_gmu_clear_oob(&a6xx_gpu->gmu, GMU_OOB_GPU_SET);
 	return 0;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 11/28] ASoC: fsl_esai: Fix TDM slot setup for I2S mode
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (8 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 10/28] drm/msm: Fix a5xx/a6xx timestamps Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 12/28] scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state Sasha Levin
                   ` (16 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Shiyan, Nicolin Chen, Mark Brown, Sasha Levin,
	alsa-devel, linuxppc-dev

From: Alexander Shiyan <shc_work@mail.ru>

[ Upstream commit e7a48c710defa0e0fef54d42b7d9e4ab596e2761 ]

When using the driver in I2S TDM mode, the fsl_esai_startup()
function rewrites the number of slots previously set by the
fsl_esai_set_dai_tdm_slot() function to 2.
To fix this, let's use the saved slot count value or, if TDM
is not used and the number of slots is not set, the driver will use
the default value (2), which is set by fsl_esai_probe().

Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Acked-by: Nicolin Chen <nicoleotsuka@gmail.com>
Link: https://lore.kernel.org/r/20210402081405.9892-1-shc_work@mail.ru
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 sound/soc/fsl/fsl_esai.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index ff96db91f818..baa76337c33f 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -497,11 +497,13 @@ static int fsl_esai_startup(struct snd_pcm_substream *substream,
 				   ESAI_SAICR_SYNC, esai_priv->synchronous ?
 				   ESAI_SAICR_SYNC : 0);
 
-		/* Set a default slot number -- 2 */
+		/* Set slots count */
 		regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
-				   ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
+				   ESAI_xCCR_xDC_MASK,
+				   ESAI_xCCR_xDC(esai_priv->slots));
 		regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
-				   ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(2));
+				   ESAI_xCCR_xDC_MASK,
+				   ESAI_xCCR_xDC(esai_priv->slots));
 	}
 
 	return 0;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 12/28] scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (9 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 11/28] ASoC: fsl_esai: Fix TDM slot setup for I2S mode Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 13/28] net: ieee802154: forbid monitor for set llsec params Sasha Levin
                   ` (15 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Martin Wilck, Bart Van Assche, Martin K . Petersen, Sasha Levin,
	linux-scsi

From: Martin Wilck <mwilck@suse.com>

[ Upstream commit 5cd0f6f57639c5afbb36100c69281fee82c95ee7 ]

rport_dev_loss_timedout() sets the rport state to SRP_PORT_LOST and the
SCSI target state to SDEV_TRANSPORT_OFFLINE. If this races with
srp_reconnect_work(), a warning is printed:

Mar 27 18:48:07 ictm1604s01h4 kernel: dev_loss_tmo expired for SRP port-18:1 / host18.
Mar 27 18:48:07 ictm1604s01h4 kernel: ------------[ cut here ]------------
Mar 27 18:48:07 ictm1604s01h4 kernel: scsi_internal_device_block(18:0:0:100) failed: ret = -22
Mar 27 18:48:07 ictm1604s01h4 kernel: Call Trace:
Mar 27 18:48:07 ictm1604s01h4 kernel:  ? scsi_target_unblock+0x50/0x50 [scsi_mod]
Mar 27 18:48:07 ictm1604s01h4 kernel:  starget_for_each_device+0x80/0xb0 [scsi_mod]
Mar 27 18:48:07 ictm1604s01h4 kernel:  target_block+0x24/0x30 [scsi_mod]
Mar 27 18:48:07 ictm1604s01h4 kernel:  device_for_each_child+0x57/0x90
Mar 27 18:48:07 ictm1604s01h4 kernel:  srp_reconnect_rport+0xe4/0x230 [scsi_transport_srp]
Mar 27 18:48:07 ictm1604s01h4 kernel:  srp_reconnect_work+0x40/0xc0 [scsi_transport_srp]

Avoid this by not trying to block targets for rports in SRP_PORT_LOST
state.

Link: https://lore.kernel.org/r/20210401091105.8046-1-mwilck@suse.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin Wilck <mwilck@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/scsi/scsi_transport_srp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c
index 2aaf1b710398..9ac89462a8e0 100644
--- a/drivers/scsi/scsi_transport_srp.c
+++ b/drivers/scsi/scsi_transport_srp.c
@@ -555,7 +555,7 @@ int srp_reconnect_rport(struct srp_rport *rport)
 	res = mutex_lock_interruptible(&rport->mutex);
 	if (res)
 		goto out;
-	if (rport->state != SRP_RPORT_FAIL_FAST)
+	if (rport->state != SRP_RPORT_FAIL_FAST && rport->state != SRP_RPORT_LOST)
 		/*
 		 * sdev state must be SDEV_TRANSPORT_OFFLINE, transition
 		 * to SDEV_BLOCK is illegal. Calling scsi_target_unblock()
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 13/28] net: ieee802154: forbid monitor for set llsec params
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (10 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 12/28] scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 14/28] net: ieee802154: stop dump llsec keys for monitors Sasha Levin
                   ` (14 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, syzbot+8b6719da8a04beeafcc3, Stefan Schmidt,
	Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 88c17855ac4291fb462e13a86b7516773b6c932e ]

This patch forbids to set llsec params for monitor interfaces which we
don't support yet.

Reported-by: syzbot+8b6719da8a04beeafcc3@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-3-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 99f6c254ea77..e07624fd8b3b 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1402,6 +1402,9 @@ static int nl802154_set_llsec_params(struct sk_buff *skb,
 	u32 changed = 0;
 	int ret;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (info->attrs[NL802154_ATTR_SEC_ENABLED]) {
 		u8 enabled;
 
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 14/28] net: ieee802154: stop dump llsec keys for monitors
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (11 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 13/28] net: ieee802154: forbid monitor for set llsec params Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 15/28] net: ieee802154: stop dump llsec devs " Sasha Levin
                   ` (13 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit fb3c5cdf88cd504ef11d59e8d656f4bc896c6922 ]

This patch stops dumping llsec keys for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-4-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index e07624fd8b3b..8ca3a83b260a 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1511,6 +1511,11 @@ nl802154_dump_llsec_key(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 15/28] net: ieee802154: stop dump llsec devs for monitors
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (12 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 14/28] net: ieee802154: stop dump llsec keys for monitors Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 16/28] net: ieee802154: forbid monitor for add llsec dev Sasha Levin
                   ` (12 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 5582d641e6740839c9b83efd1fbf9bcd00b6f5fc ]

This patch stops dumping llsec devs for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-7-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 8ca3a83b260a..3b870791075c 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1686,6 +1686,11 @@ nl802154_dump_llsec_dev(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 16/28] net: ieee802154: forbid monitor for add llsec dev
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (13 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 15/28] net: ieee802154: stop dump llsec devs " Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 17/28] net: ieee802154: stop dump llsec devkeys for monitors Sasha Levin
                   ` (11 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 5303f956b05a2886ff42890908156afaec0f95ac ]

This patch forbids to add llsec dev for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-8-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 3b870791075c..10858c31cb47 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1778,6 +1778,9 @@ static int nl802154_add_llsec_dev(struct sk_buff *skb, struct genl_info *info)
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_device dev_desc;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (ieee802154_llsec_parse_device(info->attrs[NL802154_ATTR_SEC_DEVICE],
 					  &dev_desc) < 0)
 		return -EINVAL;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 17/28] net: ieee802154: stop dump llsec devkeys for monitors
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (14 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 16/28] net: ieee802154: forbid monitor for add llsec dev Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 18/28] net: ieee802154: forbid monitor for add llsec devkey Sasha Levin
                   ` (10 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 080d1a57a94d93e70f84b7a360baa351388c574f ]

This patch stops dumping llsec devkeys for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-10-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 10858c31cb47..b770837b3379 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1866,6 +1866,11 @@ nl802154_dump_llsec_devkey(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 18/28] net: ieee802154: forbid monitor for add llsec devkey
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (15 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 17/28] net: ieee802154: stop dump llsec devkeys for monitors Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 19/28] net: ieee802154: stop dump llsec seclevels for monitors Sasha Levin
                   ` (9 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit a347b3b394868fef15b16f143719df56184be81d ]

This patch forbids to add llsec devkey for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-11-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index b770837b3379..07139905e63e 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -1928,6 +1928,9 @@ static int nl802154_add_llsec_devkey(struct sk_buff *skb, struct genl_info *info
 	struct ieee802154_llsec_device_key key;
 	__le64 extended_addr;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (!info->attrs[NL802154_ATTR_SEC_DEVKEY] ||
 	    nla_parse_nested(attrs, NL802154_DEVKEY_ATTR_MAX,
 			     info->attrs[NL802154_ATTR_SEC_DEVKEY],
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 19/28] net: ieee802154: stop dump llsec seclevels for monitors
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (16 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 18/28] net: ieee802154: forbid monitor for add llsec devkey Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 20/28] net: ieee802154: forbid monitor for add llsec seclevel Sasha Levin
                   ` (8 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 4c9b4f55ad1f5a4b6206ac4ea58f273126d21925 ]

This patch stops dumping llsec seclevels for monitors which we don't
support yet. Otherwise we will access llsec mib which isn't initialized
for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-13-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 07139905e63e..c47f83bd21df 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2039,6 +2039,11 @@ nl802154_dump_llsec_seclevel(struct sk_buff *skb, struct netlink_callback *cb)
 	if (err)
 		return err;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR) {
+		err = skb->len;
+		goto out_err;
+	}
+
 	if (!wpan_dev->netdev) {
 		err = -EINVAL;
 		goto out_err;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 20/28] net: ieee802154: forbid monitor for add llsec seclevel
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (17 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 19/28] net: ieee802154: stop dump llsec seclevels for monitors Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 21/28] net: ieee802154: forbid monitor for del " Sasha Levin
                   ` (7 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 9ec87e322428d4734ac647d1a8e507434086993d ]

This patch forbids to add llsec seclevel for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-14-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index c47f83bd21df..8cf71f637ead 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2129,6 +2129,9 @@ static int nl802154_add_llsec_seclevel(struct sk_buff *skb,
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_seclevel sl;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
 				 &sl) < 0)
 		return -EINVAL;
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 21/28] net: ieee802154: forbid monitor for del llsec seclevel
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (18 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 20/28] net: ieee802154: forbid monitor for add llsec seclevel Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 22/28] net: ieee802154: stop dump llsec params for monitors Sasha Levin
                   ` (6 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, syzbot+fbf4fc11a819824e027b, Stefan Schmidt,
	Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 9dde130937e95b72adfae64ab21d6e7e707e2dac ]

This patch forbids to del llsec seclevel for monitor interfaces which we
don't support yet. Otherwise we will access llsec mib which isn't
initialized for monitors.

Reported-by: syzbot+fbf4fc11a819824e027b@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-15-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 8cf71f637ead..138aa41fb6f7 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -2147,6 +2147,9 @@ static int nl802154_del_llsec_seclevel(struct sk_buff *skb,
 	struct wpan_dev *wpan_dev = dev->ieee802154_ptr;
 	struct ieee802154_llsec_seclevel sl;
 
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		return -EOPNOTSUPP;
+
 	if (!info->attrs[NL802154_ATTR_SEC_LEVEL] ||
 	    llsec_parse_seclevel(info->attrs[NL802154_ATTR_SEC_LEVEL],
 				 &sl) < 0)
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 22/28] net: ieee802154: stop dump llsec params for monitors
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (19 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 21/28] net: ieee802154: forbid monitor for del " Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 23/28] net: mac802154: Fix general protection fault Sasha Levin
                   ` (5 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Aring, syzbot+cde43a581a8e5f317bc2, Stefan Schmidt,
	Sasha Levin, linux-wpan, netdev

From: Alexander Aring <aahringo@redhat.com>

[ Upstream commit 1534efc7bbc1121e92c86c2dabebaf2c9dcece19 ]

This patch stops dumping llsec params for monitors which we don't support
yet. Otherwise we will access llsec mib which isn't initialized for
monitors.

Reported-by: syzbot+cde43a581a8e5f317bc2@syzkaller.appspotmail.com
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210405003054.256017-16-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/ieee802154/nl802154.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ieee802154/nl802154.c b/net/ieee802154/nl802154.c
index 138aa41fb6f7..f2ddeb73c3ef 100644
--- a/net/ieee802154/nl802154.c
+++ b/net/ieee802154/nl802154.c
@@ -836,8 +836,13 @@ nl802154_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 		goto nla_put_failure;
 
 #ifdef CONFIG_IEEE802154_NL802154_EXPERIMENTAL
+	if (wpan_dev->iftype == NL802154_IFTYPE_MONITOR)
+		goto out;
+
 	if (nl802154_get_llsec_params(msg, rdev, wpan_dev) < 0)
 		goto nla_put_failure;
+
+out:
 #endif /* CONFIG_IEEE802154_NL802154_EXPERIMENTAL */
 
 	genlmsg_end(msg, hdr);
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 23/28] net: mac802154: Fix general protection fault
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (20 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 22/28] net: ieee802154: stop dump llsec params for monitors Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 24/28] pcnet32: Use pci_resource_len to validate PCI resource Sasha Levin
                   ` (4 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Pavel Skripkin, syzbot+9ec037722d2603a9f52e, Alexander Aring,
	Stefan Schmidt, Sasha Levin, linux-wpan, netdev

From: Pavel Skripkin <paskripkin@gmail.com>

[ Upstream commit 1165affd484889d4986cf3b724318935a0b120d8 ]

syzbot found general protection fault in crypto_destroy_tfm()[1].
It was caused by wrong clean up loop in llsec_key_alloc().
If one of the tfm array members is in IS_ERR() range it will
cause general protection fault in clean up function [1].

Call Trace:
 crypto_free_aead include/crypto/aead.h:191 [inline] [1]
 llsec_key_alloc net/mac802154/llsec.c:156 [inline]
 mac802154_llsec_key_add+0x9e0/0xcc0 net/mac802154/llsec.c:249
 ieee802154_add_llsec_key+0x56/0x80 net/mac802154/cfg.c:338
 rdev_add_llsec_key net/ieee802154/rdev-ops.h:260 [inline]
 nl802154_add_llsec_key+0x3d3/0x560 net/ieee802154/nl802154.c:1584
 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:739
 genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
 genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:800
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
 netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:674
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2404
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Reported-by: syzbot+9ec037722d2603a9f52e@syzkaller.appspotmail.com
Acked-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20210304152125.1052825-1-paskripkin@gmail.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac802154/llsec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mac802154/llsec.c b/net/mac802154/llsec.c
index 2fb703d70803..d742e635ad07 100644
--- a/net/mac802154/llsec.c
+++ b/net/mac802154/llsec.c
@@ -160,7 +160,7 @@ llsec_key_alloc(const struct ieee802154_llsec_key *template)
 	crypto_free_skcipher(key->tfm0);
 err_tfm:
 	for (i = 0; i < ARRAY_SIZE(key->tfm); i++)
-		if (key->tfm[i])
+		if (!IS_ERR_OR_NULL(key->tfm[i]))
 			crypto_free_aead(key->tfm[i]);
 
 	kzfree(key);
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 24/28] pcnet32: Use pci_resource_len to validate PCI resource
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (21 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 23/28] net: mac802154: Fix general protection fault Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 25/28] net/rds: Avoid potential use after free in rds_send_remove_from_sock Sasha Levin
                   ` (3 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Guenter Roeck, David S . Miller, Sasha Levin, netdev, linux-riscv

From: Guenter Roeck <linux@roeck-us.net>

[ Upstream commit 66c3f05ddc538ee796321210c906b6ae6fc0792a ]

pci_resource_start() is not a good indicator to determine if a PCI
resource exists or not, since the resource may start at address 0.
This is seen when trying to instantiate the driver in qemu for riscv32
or riscv64.

pci 0000:00:01.0: reg 0x10: [io  0x0000-0x001f]
pci 0000:00:01.0: reg 0x14: [mem 0x00000000-0x0000001f]
...
pcnet32: card has no PCI IO resources, aborting

Use pci_resouce_len() instead.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/amd/pcnet32.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/amd/pcnet32.c b/drivers/net/ethernet/amd/pcnet32.c
index f5ad12c10934..da84660ceae1 100644
--- a/drivers/net/ethernet/amd/pcnet32.c
+++ b/drivers/net/ethernet/amd/pcnet32.c
@@ -1548,8 +1548,7 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
 	}
 	pci_set_master(pdev);
 
-	ioaddr = pci_resource_start(pdev, 0);
-	if (!ioaddr) {
+	if (!pci_resource_len(pdev, 0)) {
 		if (pcnet32_debug & NETIF_MSG_PROBE)
 			pr_err("card has no PCI IO resources, aborting\n");
 		err = -ENODEV;
@@ -1562,6 +1561,8 @@ pcnet32_probe_pci(struct pci_dev *pdev, const struct pci_device_id *ent)
 			pr_err("architecture does not support 32bit PCI busmaster DMA\n");
 		goto err_disable_dev;
 	}
+
+	ioaddr = pci_resource_start(pdev, 0);
 	if (!request_region(ioaddr, PCNET32_TOTAL_SIZE, "pcnet32_probe_pci")) {
 		if (pcnet32_debug & NETIF_MSG_PROBE)
 			pr_err("io address range already allocated\n");
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 25/28] net/rds: Avoid potential use after free in rds_send_remove_from_sock
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (22 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 24/28] pcnet32: Use pci_resource_len to validate PCI resource Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 26/28] net: tipc: Fix spelling errors in net/tipc module Sasha Levin
                   ` (2 subsequent siblings)
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Aditya Pakki, Santosh Shilimkar, David S . Miller, Sasha Levin,
	netdev, linux-rdma, rds-devel

From: Aditya Pakki <pakki001@umn.edu>

[ Upstream commit 0c85a7e87465f2d4cbc768e245f4f45b2f299b05 ]

In case of rs failure in rds_send_remove_from_sock(), the 'rm' resource
is freed and later under spinlock, causing potential use-after-free.
Set the free pointer to NULL to avoid undefined behavior.

Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/rds/message.c | 1 +
 net/rds/send.c    | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/rds/message.c b/net/rds/message.c
index 4b00b1152a5f..e35c9c914df0 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -180,6 +180,7 @@ void rds_message_put(struct rds_message *rm)
 		rds_message_purge(rm);
 
 		kfree(rm);
+		rm = NULL;
 	}
 }
 EXPORT_SYMBOL_GPL(rds_message_put);
diff --git a/net/rds/send.c b/net/rds/send.c
index 26e2c2305f7a..f480a447a432 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -655,7 +655,7 @@ static void rds_send_remove_from_sock(struct list_head *messages, int status)
 unlock_and_drop:
 		spin_unlock_irqrestore(&rm->m_rs_lock, flags);
 		rds_message_put(rm);
-		if (was_on_sock)
+		if (was_on_sock && rm)
 			rds_message_put(rm);
 	}
 
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 26/28] net: tipc: Fix spelling errors in net/tipc module
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (23 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 25/28] net/rds: Avoid potential use after free in rds_send_remove_from_sock Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 27/28] mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 28/28] cfg80211: remove WARN_ON() in cfg80211_sme_connect Sasha Levin
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Zheng Yongjun, Hulk Robot, David S . Miller, Sasha Levin, netdev,
	tipc-discussion

From: Zheng Yongjun <zhengyongjun3@huawei.com>

[ Upstream commit a79ace4b312953c5835fafb12adc3cb6878b26bd ]

These patches fix a series of spelling errors in net/tipc module.

Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Zheng Yongjun <zhengyongjun3@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/tipc/bearer.h | 6 +++---
 net/tipc/net.c    | 2 +-
 net/tipc/node.c   | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index 394290cbbb1d..00bf28a65057 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -149,9 +149,9 @@ struct tipc_media {
  * care of initializing all other fields.
  */
 struct tipc_bearer {
-	void __rcu *media_ptr;			/* initalized by media */
-	u32 mtu;				/* initalized by media */
-	struct tipc_media_addr addr;		/* initalized by media */
+	void __rcu *media_ptr;			/* initialized by media */
+	u32 mtu;				/* initialized by media */
+	struct tipc_media_addr addr;		/* initialized by media */
 	char name[TIPC_MAX_BEARER_NAME];
 	struct tipc_media *media;
 	struct tipc_media_addr bcast_addr;
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 2e2e938fe4b7..18bcf2393afe 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -89,7 +89,7 @@
  *     - A spin lock to protect the registry of kernel/driver users (reg.c)
  *     - A global spin_lock (tipc_port_lock), which only task is to ensure
  *       consistency where more than one port is involved in an operation,
- *       i.e., whe a port is part of a linked list of ports.
+ *       i.e., when a port is part of a linked list of ports.
  *       There are two such lists; 'port_list', which is used for management,
  *       and 'wait_list', which is used to queue ports during congestion.
  *
diff --git a/net/tipc/node.c b/net/tipc/node.c
index a188c2590137..201ef25fb30b 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1406,7 +1406,7 @@ int tipc_node_xmit(struct net *net, struct sk_buff_head *list,
 }
 
 /* tipc_node_xmit_skb(): send single buffer to destination
- * Buffers sent via this functon are generally TIPC_SYSTEM_IMPORTANCE
+ * Buffers sent via this function are generally TIPC_SYSTEM_IMPORTANCE
  * messages, which will not be rejected
  * The only exception is datagram messages rerouted after secondary
  * lookup, which are rare and safe to dispose of anyway.
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 27/28] mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (24 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 26/28] net: tipc: Fix spelling errors in net/tipc module Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 28/28] cfg80211: remove WARN_ON() in cfg80211_sme_connect Sasha Levin
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Seevalamuthu Mariappan, Johannes Berg, Sasha Levin,
	linux-wireless, netdev

From: Seevalamuthu Mariappan <seevalam@codeaurora.org>

[ Upstream commit dd0b45538146cb6a54d6da7663b8c3afd16ebcfd ]

In some race conditions, with more clients and traffic configuration,
below crash is seen when making the interface down. sta->fast_rx wasn't
cleared when STA gets removed from 4-addr AP_VLAN interface. The crash is
due to try accessing 4-addr AP_VLAN interface's net_device (fast_rx->dev)
which has been deleted already.

Resolve this by clearing sta->fast_rx pointer when STA removes
from a 4-addr VLAN.

[  239.449529] Unable to handle kernel NULL pointer dereference at virtual address 00000004
[  239.449531] pgd = 80204000
...
[  239.481496] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.60 #227
[  239.481591] Hardware name: Generic DT based system
[  239.487665] task: be05b700 ti: be08e000 task.ti: be08e000
[  239.492360] PC is at get_rps_cpu+0x2d4/0x31c
[  239.497823] LR is at 0xbe08fc54
...
[  239.778574] [<80739740>] (get_rps_cpu) from [<8073cb10>] (netif_receive_skb_internal+0x8c/0xac)
[  239.786722] [<8073cb10>] (netif_receive_skb_internal) from [<8073d578>] (napi_gro_receive+0x48/0xc4)
[  239.795267] [<8073d578>] (napi_gro_receive) from [<c7b83e8c>] (ieee80211_mark_rx_ba_filtered_frames+0xbcc/0x12d4 [mac80211])
[  239.804776] [<c7b83e8c>] (ieee80211_mark_rx_ba_filtered_frames [mac80211]) from [<c7b84d4c>] (ieee80211_rx_napi+0x7b8/0x8c8 [mac8
            0211])
[  239.815857] [<c7b84d4c>] (ieee80211_rx_napi [mac80211]) from [<c7f63d7c>] (ath11k_dp_process_rx+0x7bc/0x8c8 [ath11k])
[  239.827757] [<c7f63d7c>] (ath11k_dp_process_rx [ath11k]) from [<c7f5b6c4>] (ath11k_dp_service_srng+0x2c0/0x2e0 [ath11k])
[  239.838484] [<c7f5b6c4>] (ath11k_dp_service_srng [ath11k]) from [<7f55b7dc>] (ath11k_ahb_ext_grp_napi_poll+0x20/0x84 [ath11k_ahb]
            )
[  239.849419] [<7f55b7dc>] (ath11k_ahb_ext_grp_napi_poll [ath11k_ahb]) from [<8073ce1c>] (net_rx_action+0xe0/0x28c)
[  239.860945] [<8073ce1c>] (net_rx_action) from [<80324868>] (__do_softirq+0xe4/0x228)
[  239.871269] [<80324868>] (__do_softirq) from [<80324c48>] (irq_exit+0x98/0x108)
[  239.879080] [<80324c48>] (irq_exit) from [<8035c59c>] (__handle_domain_irq+0x90/0xb4)
[  239.886114] [<8035c59c>] (__handle_domain_irq) from [<8030137c>] (gic_handle_irq+0x50/0x94)
[  239.894100] [<8030137c>] (gic_handle_irq) from [<803024c0>] (__irq_svc+0x40/0x74)

Signed-off-by: Seevalamuthu Mariappan <seevalam@codeaurora.org>
Link: https://lore.kernel.org/r/1616163532-3881-1-git-send-email-seevalam@codeaurora.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/mac80211/cfg.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index f484f9fc62ca..6804cdd43bef 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1548,8 +1548,10 @@ static int ieee80211_change_station(struct wiphy *wiphy,
 		}
 
 		if (sta->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
-		    sta->sdata->u.vlan.sta)
+		    sta->sdata->u.vlan.sta) {
+			ieee80211_clear_fast_rx(sta);
 			RCU_INIT_POINTER(sta->sdata->u.vlan.sta, NULL);
+		}
 
 		if (test_sta_flag(sta, WLAN_STA_AUTHORIZED))
 			ieee80211_vif_dec_num_mcast(sta->sdata);
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

* [PATCH AUTOSEL 4.19 28/28] cfg80211: remove WARN_ON() in cfg80211_sme_connect
  2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
                   ` (25 preceding siblings ...)
  2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 27/28] mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN Sasha Levin
@ 2021-04-12 16:25 ` Sasha Levin
  26 siblings, 0 replies; 28+ messages in thread
From: Sasha Levin @ 2021-04-12 16:25 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Du Cheng, syzbot+5f9392825de654244975, Johannes Berg,
	Sasha Levin, linux-wireless, netdev

From: Du Cheng <ducheng2@gmail.com>

[ Upstream commit 1b5ab825d9acc0f27d2f25c6252f3526832a9626 ]

A WARN_ON(wdev->conn) would trigger in cfg80211_sme_connect(), if multiple
send_msg(NL80211_CMD_CONNECT) system calls are made from the userland, which
should be anticipated and handled by the wireless driver. Remove this WARN_ON()
to prevent kernel panic if kernel is configured to "panic_on_warn".

Bug reported by syzbot.

Reported-by: syzbot+5f9392825de654244975@syzkaller.appspotmail.com
Signed-off-by: Du Cheng <ducheng2@gmail.com>
Link: https://lore.kernel.org/r/20210407162756.6101-1-ducheng2@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/sme.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index f455b9af6815..9d8b106deb0b 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -530,7 +530,7 @@ static int cfg80211_sme_connect(struct wireless_dev *wdev,
 		cfg80211_sme_free(wdev);
 	}
 
-	if (WARN_ON(wdev->conn))
+	if (wdev->conn)
 		return -EINPROGRESS;
 
 	wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
-- 
2.30.2


^ permalink raw reply related	[flat|nested] 28+ messages in thread

end of thread, other threads:[~2021-04-12 16:48 UTC | newest]

Thread overview: 28+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-12 16:25 [PATCH AUTOSEL 4.19 01/28] net: ieee802154: nl-mac: fix check on panid Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 02/28] ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 03/28] ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 04/28] lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 05/28] arc: kernel: Return -EFAULT if copy_to_user() fails Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 06/28] neighbour: Disregard DEAD dst in neigh_update Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 07/28] ARM: keystone: fix integer overflow warning Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 08/28] drivers: net: fix memory leak in atusb_probe Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 09/28] drivers: net: fix memory leak in peak_usb_create_dev Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 10/28] drm/msm: Fix a5xx/a6xx timestamps Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 11/28] ASoC: fsl_esai: Fix TDM slot setup for I2S mode Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 12/28] scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 13/28] net: ieee802154: forbid monitor for set llsec params Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 14/28] net: ieee802154: stop dump llsec keys for monitors Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 15/28] net: ieee802154: stop dump llsec devs " Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 16/28] net: ieee802154: forbid monitor for add llsec dev Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 17/28] net: ieee802154: stop dump llsec devkeys for monitors Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 18/28] net: ieee802154: forbid monitor for add llsec devkey Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 19/28] net: ieee802154: stop dump llsec seclevels for monitors Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 20/28] net: ieee802154: forbid monitor for add llsec seclevel Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 21/28] net: ieee802154: forbid monitor for del " Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 22/28] net: ieee802154: stop dump llsec params for monitors Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 23/28] net: mac802154: Fix general protection fault Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 24/28] pcnet32: Use pci_resource_len to validate PCI resource Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 25/28] net/rds: Avoid potential use after free in rds_send_remove_from_sock Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 26/28] net: tipc: Fix spelling errors in net/tipc module Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 27/28] mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN Sasha Levin
2021-04-12 16:25 ` [PATCH AUTOSEL 4.19 28/28] cfg80211: remove WARN_ON() in cfg80211_sme_connect Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).