提交 · ebcabe604b42a3a4d2cb9337a9a8a8001bb861e2 · openeuler / Kernel

25 7月, 2023 40 次提交

net: arcnet: Fix RESET flag handling · ebcabe60

由 Ahmed S. Darwish 提交于 1月 28, 2021

stable inclusion
from stable-v5.10.157
commit 4d2be0cf27d9b7b508bf9d7b524cfb79e31a6311
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=4d2be0cf27d9b7b508bf9d7b524cfb79e31a6311

--------------------------------

[ Upstream commit 01365633 ]

The main arcnet interrupt handler calls arcnet_close() then
arcnet_open(), if the RESET status flag is encountered.

This is invalid:

  1) In general, interrupt handlers should never call ->ndo_stop() and
     ->ndo_open() functions. They are usually full of blocking calls and
     other methods that are expected to be called only from drivers
     init and exit code paths.

  2) arcnet_close() contains a del_timer_sync(). If the irq handler
     interrupts the to-be-deleted timer, del_timer_sync() will just loop
     forever.

  3) arcnet_close() also calls tasklet_kill(), which has a warning if
     called from irq context.

  4) For device reset, the sequence "arcnet_close(); arcnet_open();" is
     not complete.  Some children arcnet drivers have special init/exit
     code sequences, which then embed a call to arcnet_open() and
     arcnet_close() accordingly. Check drivers/net/arcnet/com20020.c.

Run the device RESET sequence from a scheduled workqueue instead.
Signed-off-by: NAhmed S. Darwish <a.darwish@linutronix.de>
Signed-off-by: NSebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://lore.kernel.org/r/20210128194802.727770-1-a.darwish@linutronix.deSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Stable-dep-of: 1c40cde6 ("arcnet: fix potential memory leak in com20020_probe()")
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

ebcabe60

s390/dasd: fix no record found for raw_track_access · 1c33cd0c

由 Stefan Haberland 提交于 11月 23, 2022

stable inclusion
from stable-v5.10.157
commit e61b00374a6e45c2a13b00d06e09d0000b3386ca
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e61b00374a6e45c2a13b00d06e09d0000b3386ca

--------------------------------

[ Upstream commit 590ce6d9 ]

For DASD devices in raw_track_access mode only full track images are
read and written.
For this purpose it is not necessary to do search operation in the
locate record extended function. The documentation even states that
this might fail if the searched record is not found on a track.

Currently the driver sets a value of 1 in the search field for the first
record after record zero. This is the default for disks not in
raw_track_access mode but record 1 might be missing on a completely
empty track.

There has not been any problem with this on IBM storage servers but it
might lead to errors with DASD devices on other vendors storage servers.

Fix this by setting the search field to 0. Record zero is always available
even on a completely empty track.

Fixes: e4dbb0f2 ("[S390] dasd: Add support for raw ECKD access.")
Signed-off-by: NStefan Haberland <sth@linux.ibm.com>
Reviewed-by: NJan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20221123160719.3002694-4-sth@linux.ibm.comSigned-off-by: NJens Axboe <axboe@kernel.dk>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

1c33cd0c

ipv4: Fix error return code in fib_table_insert() · 542c5b06

由 Ziyang Xuan 提交于 11月 20, 2022

stable inclusion
from stable-v5.10.157
commit aeebb074997251c150d042a33a8673bfea53c247
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aeebb074997251c150d042a33a8673bfea53c247

--------------------------------

[ Upstream commit 568fe849 ]

In fib_table_insert(), if the alias was already inserted, but node not
exist, the error code should be set before return from error handling path.

Fixes: a6c76c17 ("ipv4: Notify route after insertion to the routing table")
Signed-off-by: NZiyang Xuan <william.xuanziyang@huawei.com>
Link: https://lore.kernel.org/r/20221120072838.2167047-1-william.xuanziyang@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

542c5b06

dccp/tcp: Reset saddr on failure after inet6?_hash_connect(). · 33868231

由 Kuniyuki Iwashima 提交于 11月 18, 2022

stable inclusion
from stable-v5.10.157
commit c0af4d005a260a5f93b5784d6dc26e2cd2ef18dd
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c0af4d005a260a5f93b5784d6dc26e2cd2ef18dd

--------------------------------

[ Upstream commit 77934dc6 ]

When connect() is called on a socket bound to the wildcard address,
we change the socket's saddr to a local address.  If the socket
fails to connect() to the destination, we have to reset the saddr.

However, when an error occurs after inet_hash6?_connect() in
(dccp|tcp)_v[46]_conect(), we forget to reset saddr and leave
the socket bound to the address.

From the user's point of view, whether saddr is reset or not varies
with errno.  Let's fix this inconsistent behaviour.

Note that after this patch, the repro [0] will trigger the WARN_ON()
in inet_csk_get_port() again, but this patch is not buggy and rather
fixes a bug papering over the bhash2's bug for which we need another
fix.

For the record, the repro causes -EADDRNOTAVAIL in inet_hash6_connect()
by this sequence:

  s1 = socket()
  s1.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
  s1.bind(('127.0.0.1', 10000))
  s1.sendto(b'hello', MSG_FASTOPEN, (('127.0.0.1', 10000)))
  # or s1.connect(('127.0.0.1', 10000))

  s2 = socket()
  s2.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)
  s2.bind(('0.0.0.0', 10000))
  s2.connect(('127.0.0.1', 10000))  # -EADDRNOTAVAIL

  s2.listen(32)  # WARN_ON(inet_csk(sk)->icsk_bind2_hash != tb2);

[0]: https://syzkaller.appspot.com/bug?extid=015d756bbd1f8b5c8f09

Fixes: 3df80d93 ("[DCCP]: Introduce DCCPv6")
Fixes: 7c657876 ("[DCCP]: Initial implementation")
Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: NKuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: NJoanne Koong <joannelkoong@gmail.com>
Reviewed-by: NEric Dumazet <edumazet@google.com>
Signed-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

33868231

netfilter: flowtable_offload: add missing locking · 502916a4

由 Felix Fietkau 提交于 11月 21, 2022

stable inclusion
from stable-v5.10.157
commit b8e494240e69f91517256adcd6fda62d0671772d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b8e494240e69f91517256adcd6fda62d0671772d

--------------------------------

[ Upstream commit bcd9e3c1 ]

nf_flow_table_block_setup and the driver TC_SETUP_FT call can modify the flow
block cb list while they are being traversed elsewhere, causing a crash.
Add a write lock around the calls to protect readers

Fixes: c29f74e0 ("netfilter: nf_flow_table: hardware offload support")
Reported-by: NChad Monroe <chad.monroe@smartrg.com>
Signed-off-by: NFelix Fietkau <nbd@nbd.name>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

502916a4

dma-buf: fix racing conflict of dma_heap_add() · 157a92e7

由 Dawei Li 提交于 11月 05, 2022

stable inclusion
from stable-v5.10.157
commit af9de5cdcb1088b1f9b61814bfa8752f39c13b97
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=af9de5cdcb1088b1f9b61814bfa8752f39c13b97

--------------------------------

[ Upstream commit 432e2590 ]

Racing conflict could be:
task A                 task B
list_for_each_entry
strcmp(h->name))
                       list_for_each_entry
                       strcmp(h->name)
kzalloc                kzalloc
......                 .....
device_create          device_create
list_add
                       list_add

The root cause is that task B has no idea about the fact someone
else(A) has inserted heap with same name when it calls list_add,
so a potential collision occurs.

Fixes: c02a81fb ("dma-buf: Add dma-buf heaps framework")
Signed-off-by: NDawei Li <set_pte_at@outlook.com>
Acked-by: NAndrew Davis <afd@ti.com>
Acked-by: NChristian König <christian.koenig@amd.com>
Signed-off-by: NSumit Semwal <sumit.semwal@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/TYCP286MB2323873BBDF88020781FB986CA3B9@TYCP286MB2323.JPNP286.PROD.OUTLOOK.COMSigned-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

157a92e7

bnx2x: fix pci device refcount leak in bnx2x_vf_is_pcie_pending() · 33feb629

由 Yang Yingliang 提交于 11月 19, 2022

stable inclusion
from stable-v5.10.157
commit c40b76dfa7e4b27e861ac7722d1a9f974997d0f0
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c40b76dfa7e4b27e861ac7722d1a9f974997d0f0

--------------------------------

[ Upstream commit 3637a29c ]

As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). Call pci_dev_put() before returning from
bnx2x_vf_is_pcie_pending() to avoid refcount leak.

Fixes: b56e9670 ("bnx2x: Prepare device and initialize VF database")
Suggested-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NLeon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/20221119070202.1407648-1-yangyingliang@huawei.comSigned-off-by: NPaolo Abeni <pabeni@redhat.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

33feb629

regulator: twl6030: re-add TWL6032_SUBCLASS · 4082e20f

由 Andreas Kemnade 提交于 11月 20, 2022

stable inclusion
from stable-v5.10.157
commit f81e9c0510b02e5f096c16c2f419248f48f647f0
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f81e9c0510b02e5f096c16c2f419248f48f647f0

--------------------------------

[ Upstream commit 3d6c982b ]

In former times, info->feature was populated via the parent driver
by pdata/regulator_init_data->driver_data for all regulators when
USB_PRODUCT_ID_LSB indicates a TWL6032.
Today, the information is not set, so re-add it at the regulator
definitions.

Fixes: 25d82337 ("regulator: twl: make driver DT only")
Signed-off-by: NAndreas Kemnade <andreas@kemnade.info>
Link: https://lore.kernel.org/r/20221120221208.3093727-2-andreas@kemnade.infoSigned-off-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

4082e20f

NFC: nci: fix memory leak in nci_rx_data_packet() · 703ce310

由 Liu Shixin 提交于 11月 18, 2022

stable inclusion
from stable-v5.10.157
commit 32b944b9c4b25227ec8d983c27532d4f4a65d8a4
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=32b944b9c4b25227ec8d983c27532d4f4a65d8a4

--------------------------------

[ Upstream commit 53270fb0 ]

Syzbot reported a memory leak about skb:

unreferenced object 0xffff88810e144e00 (size 240):
  comm "syz-executor284", pid 3701, jiffies 4294952403 (age 12.620s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<ffffffff83ab79a9>] __alloc_skb+0x1f9/0x270 net/core/skbuff.c:497
    [<ffffffff82a5cf64>] alloc_skb include/linux/skbuff.h:1267 [inline]
    [<ffffffff82a5cf64>] virtual_ncidev_write+0x24/0xe0 drivers/nfc/virtual_ncidev.c:116
    [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:759 [inline]
    [<ffffffff815f6503>] do_loop_readv_writev fs/read_write.c:743 [inline]
    [<ffffffff815f6503>] do_iter_write+0x253/0x300 fs/read_write.c:863
    [<ffffffff815f66ed>] vfs_writev+0xdd/0x240 fs/read_write.c:934
    [<ffffffff815f68f6>] do_writev+0xa6/0x1c0 fs/read_write.c:977
    [<ffffffff848802d5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
    [<ffffffff848802d5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
    [<ffffffff84a00087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd

In nci_rx_data_packet(), if we don't get a valid conn_info, we will return
directly but forget to release the skb.

Reported-by: syzbot+cdb9a427d1bc08815104@syzkaller.appspotmail.com
Fixes: 4aeee687 ("NFC: nci: Add dynamic logical connections support")
Signed-off-by: NLiu Shixin <liushixin2@huawei.com>
Link: https://lore.kernel.org/r/20221118082419.239475-1-liushixin2@huawei.comSigned-off-by: NPaolo Abeni <pabeni@redhat.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

703ce310

net: sched: allow act_ct to be built without NF_NAT · d5f45f6b

由 Xin Long 提交于 11月 18, 2022

stable inclusion
from stable-v5.10.157
commit 68a7aec3f4b55caae63a77881dff2c07a2a8f883
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=68a7aec3f4b55caae63a77881dff2c07a2a8f883

--------------------------------

[ Upstream commit 8427fd10 ]

In commit f11fe1da ("net/sched: Make NET_ACT_CT depends on NF_NAT"),
it fixed the build failure when NF_NAT is m and NET_ACT_CT is y by
adding depends on NF_NAT for NET_ACT_CT. However, it would also cause
NET_ACT_CT cannot be built without NF_NAT, which is not expected. This
patch fixes it by changing to use "(!NF_NAT || NF_NAT)" as the depend.

Fixes: f11fe1da ("net/sched: Make NET_ACT_CT depends on NF_NAT")
Signed-off-by: NXin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/b6386f28d1ba34721795fb776a91cbdabb203447.1668807183.git.lucien.xin@gmail.comSigned-off-by: NPaolo Abeni <pabeni@redhat.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

d5f45f6b

sfc: fix potential memleak in __ef100_hard_start_xmit() · ff54b4e8

由 Zhang Changzhong 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 8e2664e12bc6fa8d2aa642a7027d6a5c2810a674
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8e2664e12bc6fa8d2aa642a7027d6a5c2810a674

--------------------------------

[ Upstream commit aad98abd ]

The __ef100_hard_start_xmit() returns NETDEV_TX_OK without freeing skb
in error handling case, add dev_kfree_skb_any() to fix it.

Fixes: 51b35a45 ("sfc: skeleton EF100 PF driver")
Signed-off-by: NZhang Changzhong <zhangchangzhong@huawei.com>
Acked-by: NMartin Habets <habetsm.xilinx@gmail.com>
Reviewed-by: NLeon Romanovsky <leonro@nvidia.com>
Link: https://lore.kernel.org/r/1668671409-10909-1-git-send-email-zhangchangzhong@huawei.comSigned-off-by: NPaolo Abeni <pabeni@redhat.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

ff54b4e8

xfrm: Fix ignored return value in xfrm6_init() · c45f897b

由 Chen Zhongjin 提交于 11月 03, 2022

stable inclusion
from stable-v5.10.157
commit 6b638a16ead12e3759d80322ab8cabebfd4d7165
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6b638a16ead12e3759d80322ab8cabebfd4d7165

--------------------------------

[ Upstream commit 40781bfb ]

When IPv6 module initializing in xfrm6_init(), register_pernet_subsys()
is possible to fail but its return value is ignored.

If IPv6 initialization fails later and xfrm6_fini() is called,
removing uninitialized list in xfrm6_net_ops will cause null-ptr-deref:

KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 1 PID: 330 Comm: insmod
RIP: 0010:unregister_pernet_operations+0xc9/0x450
Call Trace:
 <TASK>
 unregister_pernet_subsys+0x31/0x3e
 xfrm6_fini+0x16/0x30 [ipv6]
 ip6_route_init+0xcd/0x128 [ipv6]
 inet6_init+0x29c/0x602 [ipv6]
 ...

Fix it by catching the error return value of register_pernet_subsys().

Fixes: 8d068875 ("xfrm: make gc_thresh configurable in all namespaces")
Signed-off-by: NChen Zhongjin <chenzhongjin@huawei.com>
Reviewed-by: NLeon Romanovsky <leonro@nvidia.com>
Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

c45f897b

tipc: check skb_linearize() return value in tipc_disc_rcv() · 0e4a77c0

由 YueHaibing 提交于 11月 19, 2022

stable inclusion
from stable-v5.10.157
commit c7788361a645708a51924d8aa63ead223923a5a8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=c7788361a645708a51924d8aa63ead223923a5a8

--------------------------------

[ Upstream commit cd0f6421 ]

If skb_linearize() fails in tipc_disc_rcv(), we need to free the skb instead of
handle it.

Fixes: 25b0b9c4 ("tipc: handle collisions of 32-bit node address hash values")
Signed-off-by: NYueHaibing <yuehaibing@huawei.com>
Acked-by: NJon Maloy <jmaloy@redhat.com>
Link: https://lore.kernel.org/r/20221119072832.7896-1-yuehaibing@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

0e4a77c0

net/mlx5: Fix handling of entry refcount when command is not issued to FW · fb8d3d4b

由 Moshe Shemesh 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 891daa95b0bb3e739bcea577b6956567ad11005d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=891daa95b0bb3e739bcea577b6956567ad11005d

--------------------------------

[ Upstream commit aaf2e65c ]

In case command interface is down, or the command is not allowed, driver
did not increment the entry refcount, but might have decrement as part
of forced completion handling.

Fix that by always increment and decrement the refcount to make it
symmetric for all flows.

Fixes: 50b2412b ("net/mlx5: Avoid possible free of command entry while timeout comp handler")
Signed-off-by: NEran Ben Elisha <eranbe@nvidia.com>
Signed-off-by: NMoshe Shemesh <moshe@nvidia.com>
Reported-by: NJack Wang <jinpu.wang@ionos.com>
Tested-by: NJack Wang <jinpu.wang@ionos.com>
Signed-off-by: NSaeed Mahameed <saeedm@nvidia.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

fb8d3d4b

net/mlx5: Fix FW tracer timestamp calculation · 4880a6b2

由 Moshe Shemesh 提交于 10月 20, 2022

stable inclusion
from stable-v5.10.157
commit e06ff9f8fedfc523d4f925ee1c0f06e26e1cefd6
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e06ff9f8fedfc523d4f925ee1c0f06e26e1cefd6

--------------------------------

[ Upstream commit 61db3d7b ]

Fix a bug in calculation of FW tracer timestamp. Decreasing one in the
calculation should effect only bits 52_7 and not effect bits 6_0 of the
timestamp, otherwise bits 6_0 are always set in this calculation.

Fixes: 70dd6fdb ("net/mlx5: FW tracer, parse traces and kernel tracing support")
Signed-off-by: NMoshe Shemesh <moshe@nvidia.com>
Reviewed-by: NFeras Daoud <ferasda@nvidia.com>
Signed-off-by: NSaeed Mahameed <saeedm@nvidia.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

4880a6b2

netfilter: ipset: regression in ip_set_hash_ip.c · d8289cf4

由 Vishwanath Pai 提交于 9月 28, 2022

stable inclusion
from stable-v5.10.157
commit 5689eba90a20646ec3d7dd50360e28c7d5fdbbfe
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5689eba90a20646ec3d7dd50360e28c7d5fdbbfe

--------------------------------

[ Upstream commit c7aa1a76 ]

This patch introduced a regression: commit 48596a8d ("netfilter:
ipset: Fix adding an IPv4 range containing more than 2^31 addresses")

The variable e.ip is passed to adtfn() function which finally adds the
ip address to the set. The patch above refactored the for loop and moved
e.ip = htonl(ip) to the end of the for loop.

What this means is that if the value of "ip" changes between the first
assignement of e.ip and the forloop, then e.ip is pointing to a
different ip address than "ip".

Test case:
$ ipset create jdtest_tmp hash:ip family inet hashsize 2048 maxelem 100000
$ ipset add jdtest_tmp 10.0.1.1/31
ipset v6.21.1: Element cannot be added to the set: it's already added

The value of ip gets updated inside the  "else if (tb[IPSET_ATTR_CIDR])"
block but e.ip is still pointing to the old value.

Fixes: 48596a8d ("netfilter: ipset: Fix adding an IPv4 range containing more than 2^31 addresses")
Reviewed-by: NJoshua Hunt <johunt@akamai.com>
Signed-off-by: NVishwanath Pai <vpai@akamai.com>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

d8289cf4

netfilter: ipset: Limit the maximal range of consecutive elements to add/delete · 64ab09fc

由 Jozsef Kadlecsik 提交于 7月 28, 2021

stable inclusion
from stable-v5.10.157
commit e62e62ea912a49f7230620f1bdc20410b943a44c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=e62e62ea912a49f7230620f1bdc20410b943a44c

--------------------------------

[ Upstream commit 5f7b51bf ]

The range size of consecutive elements were not limited. Thus one could
define a huge range which may result soft lockup errors due to the long
execution time. Now the range size is limited to 2^20 entries.
Reported-by: NBrad Spengler <spender@grsecurity.net>
Signed-off-by: NJozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: c7aa1a76 ("netfilter: ipset: regression in ip_set_hash_ip.c")
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

64ab09fc

Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register() · e7bcd74f

由 Yang Yingliang 提交于 11月 19, 2022

stable inclusion
from stable-v5.10.157
commit 8dca384970acd94dd88aee60b1264e81e48d4ad1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8dca384970acd94dd88aee60b1264e81e48d4ad1

--------------------------------

[ Upstream commit 25c94b05 ]

If device_register() returns error in vmbus_device_register(),
the name allocated by dev_set_name() must be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup().

Fixes: 09d50ff8 ("Staging: hv: make the Hyper-V virtual bus code build")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NMichael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20221119081135.1564691-3-yangyingliang@huawei.comSigned-off-by: NWei Liu <wei.liu@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

e7bcd74f

Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work() · 3ccdf3ad

由 Yang Yingliang 提交于 11月 19, 2022

stable inclusion
from stable-v5.10.157
commit 909186cf34de7d761833d064cd58c64cf6884e00
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=909186cf34de7d761833d064cd58c64cf6884e00

--------------------------------

[ Upstream commit f92a4b50 ]

In the error path of vmbus_device_register(), device_unregister()
is called, which calls vmbus_device_release().  The latter frees
the struct hv_device that was passed in to vmbus_device_register().
So remove the kfree() in vmbus_add_channel_work() to avoid a double
free.

Fixes: c2e5df61 ("vmbus: add per-channel sysfs info")
Suggested-by: NMichael Kelley <mikelley@microsoft.com>
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NMichael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/20221119081135.1564691-2-yangyingliang@huawei.comSigned-off-by: NWei Liu <wei.liu@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

3ccdf3ad

macsec: Fix invalid error code set · a3a750ad

由 YueHaibing 提交于 11月 18, 2022

stable inclusion
from stable-v5.10.157
commit f42802e14a8752cebb434954c41f5aa123242996
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f42802e14a8752cebb434954c41f5aa123242996

--------------------------------

[ Upstream commit 7cef6b73 ]

'ret' is defined twice in macsec_changelink(), when it is set in macsec_is_offloaded
case, it will be invalid before return.

Fixes: 3cf3227a ("net: macsec: hardware offloading infrastructure")
Signed-off-by: NYueHaibing <yuehaibing@huawei.com>
Reviewed-by: NSaeed Mahameed <saeed@kernel.org>
Reviewed-by: NAntoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20221118011249.48112-1-yuehaibing@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

a3a750ad

nfp: add port from netdev validation for EEPROM access · 669a927e

由 Jaco Coetzee 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 72be055615e0d8170ade2a0f750a7171b53fd37c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=72be055615e0d8170ade2a0f750a7171b53fd37c

--------------------------------

[ Upstream commit 0873016d ]

Setting of the port flag `NFP_PORT_CHANGED`, introduced
to ensure the correct reading of EEPROM data, causes a
fatal kernel NULL pointer dereference in cases where
the target netdev type cannot be determined.

Add validation of port struct pointer before attempting
to set the `NFP_PORT_CHANGED` flag. Return that operation
is not supported if the netdev type cannot be determined.

Fixes: 4ae97cae ("nfp: ethtool: fix the display error of `ethtool -m DEVNAME`")
Signed-off-by: NJaco Coetzee <jaco.coetzee@corigine.com>
Reviewed-by: NLouis Peens <louis.peens@corigine.com>
Signed-off-by: NSimon Horman <simon.horman@corigine.com>
Signed-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

669a927e

nfp: fill splittable of devlink_port_attrs correctly · 34173751

由 Diana Wang 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit ce41e03cacaa1f15539785a381ef0a27cf6d25da
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ce41e03cacaa1f15539785a381ef0a27cf6d25da

--------------------------------

[ Upstream commit 4abd9600 ]

The error is reflected in that it shows wrong splittable status of
port when executing "devlink port show".
The reason which leads the error is that the assigned operation of
splittable is just a simple negation operation of split and it does
not consider port lanes quantity. A splittable port should have
several lanes that can be split(lanes quantity > 1).
If without the judgement, it will show wrong message for some
firmware, such as 2x25G, 2x10G.

Fixes: a0f49b54 ("devlink: Add a new devlink port split ability attribute and pass to netlink")
Signed-off-by: NDiana Wang <na.wang@corigine.com>
Reviewed-by: NLouis Peens <louis.peens@corigine.com>
Reviewed-by: NNiklas Söderlund <niklas.soderlund@corigine.com>
Signed-off-by: NSimon Horman <simon.horman@corigine.com>
Signed-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

34173751

net: pch_gbe: fix pci device refcount leak while module exiting · c7265df4

由 Yang Yingliang 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 0b553ded34500fd9752ebee18dcabb18c062efb4
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0b553ded34500fd9752ebee18dcabb18c062efb4

--------------------------------

[ Upstream commit 56195372 ]

As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put().

In pch_gbe_probe(), pci_get_domain_bus_and_slot() is called,
so in error path in probe() and remove() function, pci_dev_put()
should be called to avoid refcount leak. Compile tested only.

Fixes: 1a0bdadb ("net/pch_gbe: supports eg20t ptp clock")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221117135148.301014-1-yangyingliang@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

c7265df4

net/qla3xxx: fix potential memleak in ql3xxx_send() · 2daabe21

由 Zhang Changzhong 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 2c59ef9ab63df1ece9b53a3bd1d3779adcb006a4
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c59ef9ab63df1ece9b53a3bd1d3779adcb006a4

--------------------------------

[ Upstream commit 62a7311f ]

The ql3xxx_send() returns NETDEV_TX_OK without freeing skb in error
handling case, add dev_kfree_skb_any() to fix it.

Fixes: bd36b0ac ("qla3xxx: Add support for Qlogic 4032 chip.")
Signed-off-by: NZhang Changzhong <zhangchangzhong@huawei.com>
Link: https://lore.kernel.org/r/1668675039-21138-1-git-send-email-zhangchangzhong@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

2daabe21

net/mlx4: Check retval of mlx4_bitmap_init · 5304c0cb

由 Peter Kosyh 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit a24d5f6c8b7bf0f1551573e45dfeb1958d852a91
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a24d5f6c8b7bf0f1551573e45dfeb1958d852a91

--------------------------------

[ Upstream commit 594c61ff ]

If mlx4_bitmap_init fails, mlx4_bitmap_alloc_range will dereference
the NULL pointer (bitmap->table).

Make sure, that mlx4_bitmap_alloc_range called in no error case.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d57febe1 ("net/mlx4: Add A0 hybrid steering")
Reviewed-by: NTariq Toukan <tariqt@nvidia.com>
Signed-off-by: NPeter Kosyh <pkosyh@yandex.ru>
Link: https://lore.kernel.org/r/20221117152806.278072-1-pkosyh@yandex.ruSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

5304c0cb

net: ethernet: mtk_eth_soc: fix error handling in mtk_open() · fc3fa39c

由 Liu Jian 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit da86a63479e5743d8d631bd813a6f0b45423d4ef
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=da86a63479e5743d8d631bd813a6f0b45423d4ef

--------------------------------

[ Upstream commit f7007414 ]

If mtk_start_dma() fails, invoke phylink_disconnect_phy() to perform
cleanup. phylink_disconnect_phy() contains the put_device action. If
phylink_disconnect_phy is not performed, the Kref of netdev will leak.

Fixes: b8fc9f30 ("net: ethernet: mediatek: Add basic PHYLINK support")
Signed-off-by: NLiu Jian <liujian56@huawei.com>
Reviewed-by: NRussell King (Oracle) <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/20221117111356.161547-1-liujian56@huawei.comSigned-off-by: NJakub Kicinski <kuba@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

fc3fa39c

ARM: dts: imx6q-prti6q: Fix ref/tcxo-clock-frequency properties · e2759b68

由 Fabio Estevam 提交于 11月 18, 2022

stable inclusion
from stable-v5.10.157
commit 756534f7cf53f35e9e098c15a6e341f27b5888d9
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=756534f7cf53f35e9e098c15a6e341f27b5888d9

--------------------------------

[ Upstream commit e68be7b3 ]

make dtbs_check gives the following errors:

ref-clock-frequency: size (9) error for type uint32
tcxo-clock-frequency: size (9) error for type uint32

Fix it by passing the frequencies inside < > as documented in
Documentation/devicetree/bindings/net/wireless/ti,wlcore.yaml.
Signed-off-by: NFabio Estevam <festevam@denx.de>
Fixes: 0d446a50 ("ARM: dts: add Protonic PRTI6Q board")
Signed-off-by: NShawn Guo <shawnguo@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

e2759b68

ARM: mxs: fix memory leak in mxs_machine_init() · c6282829

由 Zheng Yongjun 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 290a71ff721b072356c18be0e9bfa505935463d9
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=290a71ff721b072356c18be0e9bfa505935463d9

--------------------------------

[ Upstream commit f31e3c20 ]

If of_property_read_string() failed, 'soc_dev_attr' should be
freed before return. Otherwise there is a memory leak.

Fixes: 2046338d ("ARM: mxs: Use soc bus infrastructure")
Signed-off-by: NZheng Yongjun <zhengyongjun3@huawei.com>
Reviewed-by: NMarco Felsch <m.felsch@pengutronix.de>
Signed-off-by: NShawn Guo <shawnguo@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

c6282829

netfilter: conntrack: Fix data-races around ct mark · a0fb21ed

由 Daniel Xu 提交于 11月 09, 2022

stable inclusion
from stable-v5.10.157
commit 5c97af75f53c626283afd8a800a4bd57614f761f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=5c97af75f53c626283afd8a800a4bd57614f761f

--------------------------------

[ Upstream commit 52d1aa8b ]

nf_conn:mark can be read from and written to in parallel. Use
READ_ONCE()/WRITE_ONCE() for reads and writes to prevent unwanted
compiler optimizations.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: NDaniel Xu <dxu@dxuuu.xyz>
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

a0fb21ed

9p/fd: fix issue of list_del corruption in p9_fd_cancel() · 821aa74c

由 Zhengchao Shao 提交于 11月 10, 2022

stable inclusion
from stable-v5.10.157
commit 459332f8dbfb99d9fb95c0f37c7015d36687fc6d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=459332f8dbfb99d9fb95c0f37c7015d36687fc6d

--------------------------------

[ Upstream commit 11c10956 ]

Syz reported the following issue:
kernel BUG at lib/list_debug.c:53!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
RIP: 0010:__list_del_entry_valid.cold+0x5c/0x72
Call Trace:
<TASK>
p9_fd_cancel+0xb1/0x270
p9_client_rpc+0x8ea/0xba0
p9_client_create+0x9c0/0xed0
v9fs_session_init+0x1e0/0x1620
v9fs_mount+0xba/0xb80
legacy_get_tree+0x103/0x200
vfs_get_tree+0x89/0x2d0
path_mount+0x4c0/0x1ac0
__x64_sys_mount+0x33b/0x430
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
</TASK>

The process is as follows:
Thread A:                       Thread B:
p9_poll_workfn()                p9_client_create()
...                                 ...
    p9_conn_cancel()                p9_fd_cancel()
        list_del()                      ...
        ...                             list_del()  //list_del
                                                      corruption
There is no lock protection when deleting list in p9_conn_cancel(). After
deleting list in Thread A, thread B will delete the same list again. It
will cause issue of list_del corruption.

Setting req->status to REQ_STATUS_ERROR under lock prevents other
cleanup paths from trying to manipulate req_list.
The other thread can safely check req->status because it still holds a
reference to req at this point.

Link: https://lkml.kernel.org/r/20221110122606.383352-1-shaozhengchao@huawei.com
Fixes: 52f1c45d ("9p: trans_fd/p9_conn_cancel: drop client lock earlier")
Reported-by: syzbot+9b69b8d10ab4a7d88056@syzkaller.appspotmail.com
Signed-off-by: NZhengchao Shao <shaozhengchao@huawei.com>
[Dominique: add description of the fix in commit message]
Signed-off-by: NDominique Martinet <asmadeus@codewreck.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

821aa74c

net: pch_gbe: fix potential memleak in pch_gbe_tx_queue() · b226251b

由 Wang Hai 提交于 11月 17, 2022

stable inclusion
from stable-v5.10.157
commit 26bb8f6aaae303d890265f38c51a3f378d4a57af
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=26bb8f6aaae303d890265f38c51a3f378d4a57af

--------------------------------

[ Upstream commit 2360f9b8 ]

In pch_gbe_xmit_frame(), NETDEV_TX_OK will be returned whether
pch_gbe_tx_queue() sends data successfully or not, so pch_gbe_tx_queue()
needs to free skb before returning. But pch_gbe_tx_queue() returns without
freeing skb in case of dma_map_single() fails. Add dev_kfree_skb_any()
to fix it.

Fixes: 77555ee7 ("net: Add Gigabit Ethernet driver of Topcliff PCH")
Signed-off-by: NWang Hai <wanghai38@huawei.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

b226251b

nfc/nci: fix race with opening and closing · 19efef6a

由 Lin Ma 提交于 11月 16, 2022

stable inclusion
from stable-v5.10.157
commit 398a860a44297245ed4cb7ff59b37fef89c379f8
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=398a860a44297245ed4cb7ff59b37fef89c379f8

--------------------------------

[ Upstream commit 0ad6bded ]

Previously we leverage NCI_UNREG and the lock inside nci_close_device to
prevent the race condition between opening a device and closing a
device. However, it still has problem because a failed opening command
will erase the NCI_UNREG flag and allow another opening command to
bypass the status checking.

This fix corrects that by making sure the NCI_UNREG is held.

Reported-by: syzbot+43475bf3cfbd6e41f5b7@syzkaller.appspotmail.com
Fixes: 48b71a9e ("NFC: add NCI_UNREG flag to eliminate the race")
Signed-off-by: NLin Ma <linma@zju.edu.cn>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

19efef6a

rxrpc: Use refcount_t rather than atomic_t · 1fb5b184

由 David Howells 提交于 5月 21, 2022

stable inclusion
from stable-v5.10.157
commit 23c03ee0eec4424a54a5619b23954d9069bac026
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=23c03ee0eec4424a54a5619b23954d9069bac026

--------------------------------

[ Upstream commit a0575429 ]

Move to using refcount_t rather than atomic_t for refcounts in rxrpc.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Stable-dep-of: 3bcd6c7e ("rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]")
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

Conflicts:
	net/rxrpc/ar-internal.h
	net/rxrpc/conn_client.c

1fb5b184

rxrpc: Allow list of in-use local UDP endpoints to be viewed in /proc · 5a317796

由 David Howells 提交于 5月 21, 2022

stable inclusion
from stable-v5.10.157
commit bddde342c62ee741a5417df6da93c0701b020e86
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=bddde342c62ee741a5417df6da93c0701b020e86

--------------------------------

[ Upstream commit 33912c26 ]

Allow the list of in-use local UDP endpoints in the current network
namespace to be viewed in /proc.

To aid with this, the endpoint list is converted to an hlist and RCU-safe
manipulation is used so that the list can be read with only the RCU
read lock held.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Stable-dep-of: 3bcd6c7e ("rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975]")
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

5a317796

net: liquidio: simplify if expression · e3fd7f36

由 Leon Romanovsky 提交于 11月 15, 2022

stable inclusion
from stable-v5.10.157
commit a2d5dba2fc694957d564944bb74671c68a2c4d24
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a2d5dba2fc694957d564944bb74671c68a2c4d24

--------------------------------

[ Upstream commit 733d4bbf ]

Fix the warning reported by kbuild:

cocci warnings: (new ones prefixed by >>)
>> drivers/net/ethernet/cavium/liquidio/lio_main.c:1797:54-56: WARNING !A || A && B is equivalent to !A || B
   drivers/net/ethernet/cavium/liquidio/lio_main.c:1827:54-56: WARNING !A || A && B is equivalent to !A || B

Fixes: 8979f428 ("net: liquidio: release resources when liquidio driver open failed")
Reported-by: Nkernel test robot <lkp@intel.com>
Signed-off-by: NLeon Romanovsky <leonro@nvidia.com>
Reviewed-by: NSaeed Mahameed <saeed@kernel.org>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

e3fd7f36

ARM: dts: at91: sam9g20ek: enable udc vbus gpio pinctrl · dbf46277

由 Michael Grzeschik 提交于 11月 14, 2022

stable inclusion
from stable-v5.10.157
commit 8124a02e17175e82e0e9350894775e5f36f3710e
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8124a02e17175e82e0e9350894775e5f36f3710e

--------------------------------

[ Upstream commit 40a2226e ]

We set the PIOC to GPIO mode. This way the pin becomes an
input signal will be usable by the controller. Without
this change the udc on the 9g20ek does not work.

Cc: nicolas.ferre@microchip.com
Cc: ludovic.desroches@microchip.com
Cc: alexandre.belloni@bootlin.com
Cc: linux-arm-kernel@lists.infradead.org
Cc: kernel@pengutronix.de
Fixes: 5cb4e735 ("ARM: at91: add at91sam9g20ek boards dt support")
Signed-off-by: NMichael Grzeschik <m.grzeschik@pengutronix.de>
Signed-off-by: NClaudiu Beznea <claudiu.beznea@microchip.com>
Link: https://lore.kernel.org/r/20221114185923.1023249-3-m.grzeschik@pengutronix.deSigned-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

dbf46277

tee: optee: fix possible memory leak in optee_register_device() · 0a6acbcc

由 Yang Yingliang 提交于 11月 09, 2022

stable inclusion
from stable-v5.10.157
commit b547bf71fa7e35e22dd6494588a71ebd318aae09
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b547bf71fa7e35e22dd6494588a71ebd318aae09

--------------------------------

[ Upstream commit cce616e0 ]

If device_register() returns error in optee_register_device(),
the name allocated by dev_set_name() need be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup(),
and optee_device is freed in optee_release_device().

Fixes: c3fa24af ("tee: optee: add TEE bus device enumeration support")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: NSumit Garg <sumit.garg@linaro.org>
Signed-off-by: NJens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

0a6acbcc

bus: sunxi-rsb: Support atomic transfers · 614ac925

由 Samuel Holland 提交于 11月 13, 2022

stable inclusion
from stable-v5.10.157
commit b76c5a99f44a9bcf78df7abf1fcb74dda6c1d10f
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b76c5a99f44a9bcf78df7abf1fcb74dda6c1d10f

--------------------------------

[ Upstream commit 077686da ]

When communicating with a PMIC during system poweroff (pm_power_off()),
IRQs are disabled and we are in a RCU read-side critical section, so we
cannot use wait_for_completion_io_timeout(). Instead, poll the status
register for transfer completion.

Fixes: d787dcdb ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus")
Signed-off-by: NSamuel Holland <samuel@sholland.org>
Reviewed-by: NJernej Skrabec <jernej.skrabec@gmail.com>
Link: https://lore.kernel.org/r/20221114015749.28490-3-samuel@sholland.orgSigned-off-by: NJernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

614ac925

regulator: core: fix UAF in destroy_regulator() · 2806cbb4

由 Yang Yingliang 提交于 11月 16, 2022

stable inclusion
from stable-v5.10.157
commit 0c059b7d2a6b7ddb75d9e579456f597ff697aca0
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0c059b7d2a6b7ddb75d9e579456f597ff697aca0

--------------------------------

[ Upstream commit 1f386d68 ]

I got a UAF report as following:

==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x935/0x2060
Read of size 8 at addr ffff88810e838220 by task python3/268
Call Trace:
 <TASK>
 dump_stack_lvl+0x67/0x83
 print_report+0x178/0x4b0
 kasan_report+0x90/0x190
 __lock_acquire+0x935/0x2060
 lock_acquire+0x156/0x400
 _raw_spin_lock+0x2a/0x40
 lockref_get+0x11/0x30
 simple_recursive_removal+0x41/0x440
 debugfs_remove.part.12+0x32/0x50
 debugfs_remove+0x29/0x30
 _regulator_put.cold.54+0x3e/0x27f
 regulator_put+0x1f/0x30
 release_nodes+0x6a/0xa0
 devres_release_all+0xf8/0x150

Allocated by task 37:
 kasan_save_stack+0x1c/0x40
 kasan_set_track+0x21/0x30
 __kasan_slab_alloc+0x5d/0x70
 slab_post_alloc_hook+0x62/0x510
 kmem_cache_alloc_lru+0x222/0x5a0
 __d_alloc+0x31/0x440
 d_alloc+0x30/0xf0
 d_alloc_parallel+0xc4/0xd20
 __lookup_slow+0x15e/0x2f0
 lookup_one_len+0x13a/0x150
 start_creating+0xea/0x190
 debugfs_create_dir+0x1e/0x210
 create_regulator+0x254/0x4e0
 _regulator_get+0x2a1/0x467
 _devm_regulator_get+0x5a/0xb0
 regulator_virtual_probe+0xb9/0x1a0

Freed by task 30:
 kasan_save_stack+0x1c/0x40
 kasan_set_track+0x21/0x30
 kasan_save_free_info+0x2a/0x50
 __kasan_slab_free+0x102/0x190
 kmem_cache_free+0xf6/0x600
 rcu_core+0x54c/0x12b0
 __do_softirq+0xf2/0x5e3

Last potentially related work creation:
 kasan_save_stack+0x1c/0x40
 __kasan_record_aux_stack+0x98/0xb0
 call_rcu+0x42/0x700
 dentry_free+0x6c/0xd0
 __dentry_kill+0x23b/0x2d0
 dput.part.31+0x431/0x780
 simple_recursive_removal+0xa9/0x440
 debugfs_remove.part.12+0x32/0x50
 debugfs_remove+0x29/0x30
 regulator_unregister+0xe3/0x230
 release_nodes+0x6a/0xa0

==================================================================

Here is how happened:

processor A					processor B
regulator_register()
  rdev_init_debugfs()
    rdev->debugfs = debugfs_create_dir()
						devm_regulator_get()
						  rdev = regulator_dev_lookup()
						  create_regulator(rdev)
						    // using rdev->debugfs as parent
						    debugfs_create_dir(rdev->debugfs)

mfd_remove_devices_fn()
  release_nodes()
    regulator_unregister()
      // free rdev->debugfs
      debugfs_remove_recursive(rdev->debugfs)
						release_nodes()
						  destroy_regulator()
						    debugfs_remove_recursive() <- causes UAF

In devm_regulator_get(), after getting rdev, the refcount
is get, so fix this by moving debugfs_remove_recursive()
to regulator_dev_release(), then it can be proctected by
the refcount, the 'rdev->debugfs' can not be freed until
the refcount is 0.

Fixes: 5de70519 ("regulator: Add basic per consumer debugfs")
Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
Link: https://lore.kernel.org/r/20221116033706.3595812-1-yangyingliang@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

2806cbb4

spi: dw-dma: decrease reference count in dw_spi_dma_init_mfld() · 9480b3be

由 Xiongfeng Wang 提交于 11月 16, 2022

stable inclusion
from stable-v5.10.157
commit fcb2d286362b19c07d5ea85878738e48422067ce
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I7MU59

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fcb2d286362b19c07d5ea85878738e48422067ce

--------------------------------

[ Upstream commit 804313b6 ]

pci_get_device() will increase the reference count for the returned
pci_dev. Since 'dma_dev' is only used to filter the channel in
dw_spi_dma_chan_filer() after using it we need to call pci_dev_put() to
decrease the reference count. Also add pci_dev_put() for the error case.

Fixes: 7063c0d9 ("spi/dw_spi: add DMA support")
Signed-off-by: NXiongfeng Wang <wangxiongfeng2@huawei.com>
Acked-by: NSerge Semin <fancer.lancer@gmail.com>
Link: https://lore.kernel.org/r/20221116093204.46700-1-wangxiongfeng2@huawei.comSigned-off-by: NMark Brown <broonie@kernel.org>
Signed-off-by: NSasha Levin <sashal@kernel.org>
Signed-off-by: Nsanglipeng <sanglipeng1@jd.com>

9480b3be

openeuler / Kernel 1 年多 前同步成功

openeuler / Kernel
1 年多前同步成功