* [PATCH AUTOSEL 5.10 02/13] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe()
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 03/13] rxrpc: Fix local destruction being repeated Sasha Levin
` (10 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Xiaolei Wang, Mark Brown, Sasha Levin, lgirdwood
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit 78e1e867f44e6bdc72c0e6a2609a3407642fb30b ]
The pfuze_chip::regulator_descs is an array of size
PFUZE100_MAX_REGULATOR, the pfuze_chip::pfuze_regulators
is the pointer to the real regulators of a specific device.
The number of real regulator is supposed to be less than
the PFUZE100_MAX_REGULATOR, so we should use the size of
'regulator_num * sizeof(struct pfuze_regulator)' in memcpy().
This fixes the out of bounds access bug reported by KASAN.
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Link: https://lore.kernel.org/r/20220825111922.1368055-1-xiaolei.wang@windriver.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/pfuze100-regulator.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c
index 0a19500d3725e..44a8e500fb304 100644
--- a/drivers/regulator/pfuze100-regulator.c
+++ b/drivers/regulator/pfuze100-regulator.c
@@ -791,7 +791,7 @@ static int pfuze100_regulator_probe(struct i2c_client *client,
((pfuze_chip->chip_id == PFUZE3000) ? "3000" : "3001"))));
memcpy(pfuze_chip->regulator_descs, pfuze_chip->pfuze_regulators,
- sizeof(pfuze_chip->regulator_descs));
+ regulator_num * sizeof(struct pfuze_regulator));
ret = pfuze_parse_regulators_dt(pfuze_chip);
if (ret)
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 03/13] rxrpc: Fix local destruction being repeated
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 02/13] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 04/13] rxrpc: Fix calc of resend age Sasha Levin
` (9 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Howells, Sasha Levin, marc.dionne, davem, edumazet, kuba,
pabeni, linux-afs, netdev
From: David Howells <dhowells@redhat.com>
[ Upstream commit d3d863036d688313f8d566b87acd7d99daf82749 ]
If the local processor work item for the rxrpc local endpoint gets requeued
by an event (such as an incoming packet) between it getting scheduled for
destruction and the UDP socket being closed, the rxrpc_local_destroyer()
function can get run twice. The second time it can hang because it can end
up waiting for cleanup events that will never happen.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rxrpc/local_object.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c
index 8c2881054266d..ebbf1b03b62cf 100644
--- a/net/rxrpc/local_object.c
+++ b/net/rxrpc/local_object.c
@@ -424,6 +424,9 @@ static void rxrpc_local_processor(struct work_struct *work)
container_of(work, struct rxrpc_local, processor);
bool again;
+ if (local->dead)
+ return;
+
trace_rxrpc_local(local->debug_id, rxrpc_local_processing,
atomic_read(&local->usage), NULL);
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 04/13] rxrpc: Fix calc of resend age
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 02/13] regulator: pfuze100: Fix the global-out-of-bounds access in pfuze100_regulator_probe() Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 03/13] rxrpc: Fix local destruction being repeated Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 05/13] wifi: mac80211_hwsim: check length for virtio packets Sasha Levin
` (8 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Howells, Sasha Levin, marc.dionne, davem, edumazet, kuba,
pabeni, linux-afs, netdev
From: David Howells <dhowells@redhat.com>
[ Upstream commit 214a9dc7d852216e83acac7b75bc18f01ce184c2 ]
Fix the calculation of the resend age to add a microsecond value as
microseconds, not nanoseconds.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rxrpc/call_event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index f8ecad2b730e8..2a93e7b5fbd05 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -166,7 +166,7 @@ static void rxrpc_resend(struct rxrpc_call *call, unsigned long now_j)
_enter("{%d,%d}", call->tx_hard_ack, call->tx_top);
now = ktime_get_real();
- max_age = ktime_sub(now, jiffies_to_usecs(call->peer->rto_j));
+ max_age = ktime_sub_us(now, jiffies_to_usecs(call->peer->rto_j));
spin_lock_bh(&call->lock);
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 05/13] wifi: mac80211_hwsim: check length for virtio packets
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (2 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 04/13] rxrpc: Fix calc of resend age Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 06/13] ALSA: hda/sigmatel: Keep power up while beep is enabled Sasha Levin
` (7 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Soenke Huster, Johannes Berg, Sasha Levin, johannes, kvalo,
davem, edumazet, kuba, pabeni, linux-wireless, netdev
From: Soenke Huster <soenke.huster@eknoes.de>
[ Upstream commit 8c0427842aaef161a38ac83b7e8d8fe050b4be04 ]
An invalid packet with a length shorter than the specified length in the
netlink header can lead to use-after-frees and slab-out-of-bounds in the
processing of the netlink attributes, such as the following:
BUG: KASAN: slab-out-of-bounds in __nla_validate_parse+0x1258/0x2010
Read of size 2 at addr ffff88800ac7952c by task kworker/0:1/12
Workqueue: events hwsim_virtio_rx_work
Call Trace:
<TASK>
dump_stack_lvl+0x45/0x5d
print_report.cold+0x5e/0x5e5
kasan_report+0xb1/0x1c0
__nla_validate_parse+0x1258/0x2010
__nla_parse+0x22/0x30
hwsim_virtio_handle_cmd.isra.0+0x13f/0x2d0
hwsim_virtio_rx_work+0x1b2/0x370
process_one_work+0x8df/0x1530
worker_thread+0x575/0x11a0
kthread+0x29d/0x340
ret_from_fork+0x22/0x30
</TASK>
Discarding packets with an invalid length solves this.
Therefore, skb->len must be set at reception.
Change-Id: Ieaeb9a4c62d3beede274881a7c2722c6c6f477b6
Signed-off-by: Soenke Huster <soenke.huster@eknoes.de>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mac80211_hwsim.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index 8e412125a49c1..50190ded7edc7 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -4209,6 +4209,10 @@ static int hwsim_virtio_handle_cmd(struct sk_buff *skb)
nlh = nlmsg_hdr(skb);
gnlh = nlmsg_data(nlh);
+
+ if (skb->len < nlh->nlmsg_len)
+ return -EINVAL;
+
err = genlmsg_parse(nlh, &hwsim_genl_family, tb, HWSIM_ATTR_MAX,
hwsim_genl_policy, NULL);
if (err) {
@@ -4251,7 +4255,8 @@ static void hwsim_virtio_rx_work(struct work_struct *work)
spin_unlock_irqrestore(&hwsim_virtio_lock, flags);
skb->data = skb->head;
- skb_set_tail_pointer(skb, len);
+ skb_reset_tail_pointer(skb);
+ skb_put(skb, len);
hwsim_virtio_handle_cmd(skb);
spin_lock_irqsave(&hwsim_virtio_lock, flags);
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 06/13] ALSA: hda/sigmatel: Keep power up while beep is enabled
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (3 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 05/13] wifi: mac80211_hwsim: check length for virtio packets Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 07/13] ALSA: hda/tegra: Align BDL entry to 4KB boundary Sasha Levin
` (6 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: Takashi Iwai, Sasha Levin, perex, tiwai, alsa-devel
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 414d38ba871092aeac4ed097ac4ced89486646f7 ]
It seems that the beep playback doesn't work well on IDT codec devices
when the codec auto-pm is enabled. Keep the power on while the beep
switch is enabled.
Link: https://bugzilla.suse.com/show_bug.cgi?id=1200544
Link: https://lore.kernel.org/r/20220904072750.26164-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_sigmatel.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index c662431bf13a5..e9d0b0a30b99d 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -209,6 +209,7 @@ struct sigmatel_spec {
/* beep widgets */
hda_nid_t anabeep_nid;
+ bool beep_power_on;
/* SPDIF-out mux */
const char * const *spdif_labels;
@@ -4447,6 +4448,26 @@ static int stac_suspend(struct hda_codec *codec)
stac_shutup(codec);
return 0;
}
+
+static int stac_check_power_status(struct hda_codec *codec, hda_nid_t nid)
+{
+ struct sigmatel_spec *spec = codec->spec;
+ int ret = snd_hda_gen_check_power_status(codec, nid);
+
+#ifdef CONFIG_SND_HDA_INPUT_BEEP
+ if (nid == spec->gen.beep_nid && codec->beep) {
+ if (codec->beep->enabled != spec->beep_power_on) {
+ spec->beep_power_on = codec->beep->enabled;
+ if (spec->beep_power_on)
+ snd_hda_power_up_pm(codec);
+ else
+ snd_hda_power_down_pm(codec);
+ }
+ ret |= spec->beep_power_on;
+ }
+#endif
+ return ret;
+}
#else
#define stac_suspend NULL
#endif /* CONFIG_PM */
@@ -4459,6 +4480,7 @@ static const struct hda_codec_ops stac_patch_ops = {
.unsol_event = snd_hda_jack_unsol_event,
#ifdef CONFIG_PM
.suspend = stac_suspend,
+ .check_power_status = stac_check_power_status,
#endif
.reboot_notify = stac_shutup,
};
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 07/13] ALSA: hda/tegra: Align BDL entry to 4KB boundary
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (4 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 06/13] ALSA: hda/sigmatel: Keep power up while beep is enabled Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 08/13] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Sasha Levin
` (5 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Mohan Kumar, Takashi Iwai, Sasha Levin, perex, tiwai,
thierry.reding, jonathanh, spujar, digetx, alsa-devel,
linux-tegra
From: Mohan Kumar <mkumard@nvidia.com>
[ Upstream commit 8d44e6044a0e885acdd01813768a0b27906d64fd ]
AZA HW may send a burst read/write request crossing 4K memory boundary.
The 4KB boundary is not guaranteed by Tegra HDA HW. Make SW change to
include the flag AZX_DCAPS_4K_BDLE_BOUNDARY to align BDLE to 4K
boundary.
Signed-off-by: Mohan Kumar <mkumard@nvidia.com>
Link: https://lore.kernel.org/r/20220905172420.3801-1-mkumard@nvidia.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/hda_tegra.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
index 07787698b9738..1e44e337986e8 100644
--- a/sound/pci/hda/hda_tegra.c
+++ b/sound/pci/hda/hda_tegra.c
@@ -479,7 +479,8 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match);
static int hda_tegra_probe(struct platform_device *pdev)
{
const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR |
- AZX_DCAPS_PM_RUNTIME;
+ AZX_DCAPS_PM_RUNTIME |
+ AZX_DCAPS_4K_BDLE_BOUNDARY;
struct snd_card *card;
struct azx *chip;
struct hda_tegra *hda;
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 08/13] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (5 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 07/13] ALSA: hda/tegra: Align BDL entry to 4KB boundary Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 09/13] net: usb: qmi_wwan: add Quectel RM520N Sasha Levin
` (4 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Dongxiang Ke, Takashi Iwai, Sasha Levin, perex, tiwai, alsa-devel
From: Dongxiang Ke <kdx.glider@gmail.com>
[ Upstream commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf ]
There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and
the number of it's interfaces less than 4, an out-of-bounds read bug occurs
when parsing the interface descriptor for this device.
Fix this by checking the number of interfaces.
Signed-off-by: Dongxiang Ke <kdx.glider@gmail.com>
Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/stream.c b/sound/usb/stream.c
index 2f6d39c2ba7c8..7711184a0d0bf 100644
--- a/sound/usb/stream.c
+++ b/sound/usb/stream.c
@@ -1106,7 +1106,7 @@ static int __snd_usb_parse_audio_interface(struct snd_usb_audio *chip,
* Dallas DS4201 workaround: It presents 5 altsettings, but the last
* one misses syncpipe, and does not produce any sound.
*/
- if (chip->usb_id == USB_ID(0x04fa, 0x4201))
+ if (chip->usb_id == USB_ID(0x04fa, 0x4201) && num >= 4)
num = 4;
for (i = 0; i < num; i++) {
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 09/13] net: usb: qmi_wwan: add Quectel RM520N
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (6 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 08/13] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 10/13] afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked Sasha Levin
` (3 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: jerry.meng, Bjørn Mork, Paolo Abeni, Sasha Levin, davem,
edumazet, kuba, netdev, linux-usb
From: "jerry.meng" <jerry-meng@foxmail.com>
[ Upstream commit e1091e226a2bab4ded1fe26efba2aee1aab06450 ]
add support for Quectel RM520N which is based on Qualcomm SDX62 chip.
0x0801: DIAG + NMEA + AT + MODEM + RMNET
T: Bus=03 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 10 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=0801 Rev= 5.04
S: Manufacturer=Quectel
S: Product=RM520N-GL
S: SerialNumber=384af524
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: jerry.meng <jerry-meng@foxmail.com>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/tencent_E50CA8A206904897C2D20DDAE90731183C05@qq.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 48e8b94e4a7c5..1502069f3a4e2 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1024,6 +1024,7 @@ static const struct usb_device_id products[] = {
{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */
{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0620)}, /* Quectel EM160R-GL */
{QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */
+ {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0801)}, /* Quectel RM520N */
/* 3. Combined interface devices matching on interface number */
{QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 10/13] afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (7 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 09/13] net: usb: qmi_wwan: add Quectel RM520N Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 11/13] scsi: mpt3sas: Fix use-after-free warning Sasha Levin
` (2 subsequent siblings)
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: David Howells, Jeffrey E Altman, Marc Dionne, linux-afs,
Linus Torvalds, Sasha Levin
From: David Howells <dhowells@redhat.com>
[ Upstream commit 0066f1b0e27556381402db3ff31f85d2a2265858 ]
When trying to get a file lock on an AFS file, the server may return
UAEAGAIN to indicate that the lock is already held. This is currently
translated by the default path to -EREMOTEIO.
Translate it instead to -EAGAIN so that we know we can retry it.
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey E Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Link: https://lore.kernel.org/r/166075761334.3533338.2591992675160918098.stgit@warthog.procyon.org.uk/
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/misc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/afs/misc.c b/fs/afs/misc.c
index 1d1a8debe4723..f1dc2162900a4 100644
--- a/fs/afs/misc.c
+++ b/fs/afs/misc.c
@@ -69,6 +69,7 @@ int afs_abort_to_error(u32 abort_code)
/* Unified AFS error table */
case UAEPERM: return -EPERM;
case UAENOENT: return -ENOENT;
+ case UAEAGAIN: return -EAGAIN;
case UAEACCES: return -EACCES;
case UAEBUSY: return -EBUSY;
case UAEEXIST: return -EEXIST;
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 11/13] scsi: mpt3sas: Fix use-after-free warning
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (8 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 10/13] afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 12/13] MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 13/13] mksysmap: Fix the mismatch of 'L0' symbols in System.map Sasha Levin
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Sreekanth Reddy, Martin K . Petersen, Sasha Levin,
sathya.prakash, suganath-prabu.subramani, jejb,
MPT-FusionLinux.pdl, linux-scsi
From: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
[ Upstream commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 ]
Fix the following use-after-free warning which is observed during
controller reset:
refcount_t: underflow; use-after-free.
WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6/0xf0
Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broadcom.com
Signed-off-by: Sreekanth Reddy <sreekanth.reddy@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
index 8418b59b3743b..c3a5978b0efac 100644
--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c
@@ -3501,6 +3501,7 @@ static struct fw_event_work *dequeue_next_fw_event(struct MPT3SAS_ADAPTER *ioc)
fw_event = list_first_entry(&ioc->fw_event_list,
struct fw_event_work, list);
list_del_init(&fw_event->list);
+ fw_event_work_put(fw_event);
}
spin_unlock_irqrestore(&ioc->fw_event_lock, flags);
@@ -3559,7 +3560,6 @@ _scsih_fw_event_cleanup_queue(struct MPT3SAS_ADAPTER *ioc)
if (cancel_work_sync(&fw_event->work))
fw_event_work_put(fw_event);
- fw_event_work_put(fw_event);
}
ioc->fw_events_cleanup = 0;
}
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 12/13] MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping()
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (9 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 11/13] scsi: mpt3sas: Fix use-after-free warning Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 13/13] mksysmap: Fix the mismatch of 'L0' symbols in System.map Sasha Levin
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexander Sverdlin, Thomas Bogendoerfer, Sasha Levin, maz,
Julia.Lawall, rikard.falkeborn, samuel, mark.rutland, linux-mips
From: Alexander Sverdlin <alexander.sverdlin@nokia.com>
[ Upstream commit ba912afbd611d3a5f22af247721a071ad1d5b9e0 ]
For irq_domain_associate() to work the virq descriptor has to be
pre-allocated in advance. Otherwise the following happens:
WARNING: CPU: 0 PID: 0 at .../kernel/irq/irqdomain.c:527 irq_domain_associate+0x298/0x2e8
error: virq128 is not allocated
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.19.78-... #1
...
Call Trace:
[<ffffffff801344c4>] show_stack+0x9c/0x130
[<ffffffff80769550>] dump_stack+0x90/0xd0
[<ffffffff801576d0>] __warn+0x118/0x130
[<ffffffff80157734>] warn_slowpath_fmt+0x4c/0x70
[<ffffffff801b83c0>] irq_domain_associate+0x298/0x2e8
[<ffffffff80a43bb8>] octeon_irq_init_ciu+0x4c8/0x53c
[<ffffffff80a76cbc>] of_irq_init+0x1e0/0x388
[<ffffffff80a452cc>] init_IRQ+0x4c/0xf4
[<ffffffff80a3cc00>] start_kernel+0x404/0x698
Use irq_alloc_desc_at() to avoid the above problem.
Signed-off-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/cavium-octeon/octeon-irq.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c
index 6501a842c41a5..191bcaf565138 100644
--- a/arch/mips/cavium-octeon/octeon-irq.c
+++ b/arch/mips/cavium-octeon/octeon-irq.c
@@ -127,6 +127,16 @@ static void octeon_irq_free_cd(struct irq_domain *d, unsigned int irq)
static int octeon_irq_force_ciu_mapping(struct irq_domain *domain,
int irq, int line, int bit)
{
+ struct device_node *of_node;
+ int ret;
+
+ of_node = irq_domain_get_of_node(domain);
+ if (!of_node)
+ return -EINVAL;
+ ret = irq_alloc_desc_at(irq, of_node_to_nid(of_node));
+ if (ret < 0)
+ return ret;
+
return irq_domain_associate(domain, irq, line << 6 | bit);
}
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread* [PATCH AUTOSEL 5.10 13/13] mksysmap: Fix the mismatch of 'L0' symbols in System.map
2022-09-14 9:03 [PATCH AUTOSEL 5.10 01/13] ASoC: nau8824: Fix semaphore unbalance at error paths Sasha Levin
` (10 preceding siblings ...)
2022-09-14 9:03 ` [PATCH AUTOSEL 5.10 12/13] MIPS: OCTEON: irq: Fix octeon_irq_force_ciu_mapping() Sasha Levin
@ 2022-09-14 9:03 ` Sasha Levin
11 siblings, 0 replies; 13+ messages in thread
From: Sasha Levin @ 2022-09-14 9:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Youling Tang, Masahiro Yamada, Sasha Levin, michal.lkml, linux-kbuild
From: Youling Tang <tangyouling@loongson.cn>
[ Upstream commit c17a2538704f926ee4d167ba625e09b1040d8439 ]
When System.map was generated, the kernel used mksysmap to filter the
kernel symbols, we need to filter "L0" symbols in LoongArch architecture.
$ cat System.map | grep L0
9000000000221540 t L0
The L0 symbol exists in System.map, but not in .tmp_System.map. When
"cmp -s System.map .tmp_System.map" will show "Inconsistent kallsyms
data" error message in link-vmlinux.sh script.
Signed-off-by: Youling Tang <tangyouling@loongson.cn>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/mksysmap | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/mksysmap b/scripts/mksysmap
index 9aa23d15862a0..ad8bbc52267d0 100755
--- a/scripts/mksysmap
+++ b/scripts/mksysmap
@@ -41,4 +41,4 @@
# so we just ignore them to let readprofile continue to work.
# (At least sparc64 has __crc_ in the middle).
-$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)' > $2
+$NM -n $1 | grep -v '\( [aNUw] \)\|\(__crc_\)\|\( \$[adt]\)\|\( \.L\)\|\( L0\)' > $2
--
2.35.1
^ permalink raw reply [flat|nested] 13+ messages in thread