* [PATCH AUTOSEL 5.15 02/17] HID: uhid: Over-ride the default maximum data buffer value with our own
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 03/17] HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded Sasha Levin
` (14 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Lee Jones, Jiri Kosina, Sasha Levin, david.rheinsberg, jikos,
benjamin.tissoires, linux-input
From: Lee Jones <lee@kernel.org>
[ Upstream commit 1c5d4221240a233df2440fe75c881465cdf8da07 ]
The default maximum data buffer size for this interface is UHID_DATA_MAX
(4k). When data buffers are being processed, ensure this value is used
when ensuring the sanity, rather than a value between the user provided
value and HID_MAX_BUFFER_SIZE (16k).
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/uhid.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/uhid.c b/drivers/hid/uhid.c
index fc06d8bb42e0f..ba0ca652b9dab 100644
--- a/drivers/hid/uhid.c
+++ b/drivers/hid/uhid.c
@@ -395,6 +395,7 @@ struct hid_ll_driver uhid_hid_driver = {
.parse = uhid_hid_parse,
.raw_request = uhid_hid_raw_request,
.output_report = uhid_hid_output_report,
+ .max_buffer_size = UHID_DATA_MAX,
};
EXPORT_SYMBOL_GPL(uhid_hid_driver);
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 03/17] HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 02/17] HID: uhid: Over-ride the default maximum data buffer value with our own Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 04/17] ca8210: fix mac_len negative array access Sasha Levin
` (13 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Danny Kaehn, Benjamin Tissoires, Sasha Levin, jikos, linux-input
From: Danny Kaehn <kaehndan@gmail.com>
[ Upstream commit 37f5b858a66543b2b67c0288280af623985abc29 ]
The CP2112 generates interrupts from a polling routine on a thread,
and can only support threaded interrupts. This patch configures the
gpiochip irq chip with this flag, disallowing consumers to request
a hard IRQ from this driver, which resulted in a segfault previously.
Signed-off-by: Danny Kaehn <kaehndan@gmail.com>
Link: https://lore.kernel.org/r/20230210170044.11835-1-kaehndan@gmail.com
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-cp2112.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-cp2112.c b/drivers/hid/hid-cp2112.c
index 172f20e88c6c9..d902fe43cb818 100644
--- a/drivers/hid/hid-cp2112.c
+++ b/drivers/hid/hid-cp2112.c
@@ -1352,6 +1352,7 @@ static int cp2112_probe(struct hid_device *hdev, const struct hid_device_id *id)
girq->parents = NULL;
girq->default_type = IRQ_TYPE_NONE;
girq->handler = handle_simple_irq;
+ girq->threaded = true;
ret = gpiochip_add_data(&dev->gc, dev);
if (ret < 0) {
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 04/17] ca8210: fix mac_len negative array access
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 02/17] HID: uhid: Over-ride the default maximum data buffer value with our own Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 03/17] HID: cp2112: Fix driver not registering GPIO IRQ chip as threaded Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 05/17] HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Sasha Levin
` (12 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Alexander Aring, lianhui tang, Stefan Schmidt, Sasha Levin,
alex.aring, miquel.raynal, davem, edumazet, kuba, pabeni,
linux-wpan, netdev
From: Alexander Aring <aahringo@redhat.com>
[ Upstream commit 6c993779ea1d0cccdb3a5d7d45446dd229e610a3 ]
This patch fixes a buffer overflow access of skb->data if
ieee802154_hdr_peek_addrs() fails.
Reported-by: lianhui tang <bluetlh@gmail.com>
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Link: https://lore.kernel.org/r/20230217042504.3303396-1-aahringo@redhat.com
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ieee802154/ca8210.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 0362917fce7a9..e2322bc3a4e9a 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -1956,6 +1956,8 @@ static int ca8210_skb_tx(
* packet
*/
mac_len = ieee802154_hdr_peek_addrs(skb, &header);
+ if (mac_len < 0)
+ return mac_len;
secspec.security_level = header.sec.level;
secspec.key_id_mode = header.sec.key_id_mode;
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 05/17] HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (2 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 04/17] ca8210: fix mac_len negative array access Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 06/17] m68k: Only force 030 bus error if PC not in exception table Sasha Levin
` (11 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Reka Norman, Srinivas Pandruvada, Jiri Kosina, Sasha Levin,
jikos, benjamin.tissoires, liqiong, linux-input
From: Reka Norman <rekanorman@chromium.org>
[ Upstream commit 8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785 ]
When a reset notify IPC message is received, the ISR schedules a work
function and passes the ISHTP device to it via a global pointer
ishtp_dev. If ish_probe() fails, the devm-managed device resources
including ishtp_dev are freed, but the work is not cancelled, causing a
use-after-free when the work function tries to access ishtp_dev. Use
devm_work_autocancel() instead, so that the work is automatically
cancelled if probe fails.
Signed-off-by: Reka Norman <rekanorman@chromium.org>
Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/intel-ish-hid/ipc/ipc.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c
index 45e0c7b1c9ec6..6c942dd1abca2 100644
--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -5,6 +5,7 @@
* Copyright (c) 2014-2016, Intel Corporation.
*/
+#include <linux/devm-helpers.h>
#include <linux/sched.h>
#include <linux/spinlock.h>
#include <linux/delay.h>
@@ -621,7 +622,6 @@ static void recv_ipc(struct ishtp_device *dev, uint32_t doorbell_val)
case MNG_RESET_NOTIFY:
if (!ishtp_dev) {
ishtp_dev = dev;
- INIT_WORK(&fw_reset_work, fw_reset_work_fn);
}
schedule_work(&fw_reset_work);
break;
@@ -936,6 +936,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev)
{
struct ishtp_device *dev;
int i;
+ int ret;
dev = devm_kzalloc(&pdev->dev,
sizeof(struct ishtp_device) + sizeof(struct ish_hw),
@@ -971,6 +972,12 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev)
list_add_tail(&tx_buf->link, &dev->wr_free_list);
}
+ ret = devm_work_autocancel(&pdev->dev, &fw_reset_work, fw_reset_work_fn);
+ if (ret) {
+ dev_err(dev->devc, "Failed to initialise FW reset work\n");
+ return NULL;
+ }
+
dev->ops = &ish_hw_ops;
dev->devc = &pdev->dev;
dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr);
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 06/17] m68k: Only force 030 bus error if PC not in exception table
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (3 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 05/17] HID: intel-ish-hid: ipc: Fix potential use-after-free in work function Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 07/17] selftests/bpf: check that modifier resolves after pointer Sasha Levin
` (10 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Schmitz, Eero Tamminen, Geert Uytterhoeven, Sasha Levin,
laurent, linux-m68k
From: Michael Schmitz <schmitzmic@gmail.com>
[ Upstream commit e36a82bebbf7da814530d5a179bef9df5934b717 ]
__get_kernel_nofault() does copy data in supervisor mode when
forcing a task backtrace log through /proc/sysrq_trigger.
This is expected cause a bus error exception on e.g. NULL
pointer dereferencing when logging a kernel task has no
workqueue associated. This bus error ought to be ignored.
Our 030 bus error handler is ill equipped to deal with this:
Whenever ssw indicates a kernel mode access on a data fault,
we don't even attempt to handle the fault and instead always
send a SEGV signal (or panic). As a result, the check
for exception handling at the fault PC (buried in
send_sig_fault() which gets called from do_page_fault()
eventually) is never used.
In contrast, both 040 and 060 access error handlers do not
care whether a fault happened on supervisor mode access,
and will call do_page_fault() on those, ultimately honoring
the exception table.
Add a check in bus_error030 to call do_page_fault() in case
we do have an entry for the fault PC in our exception table.
I had attempted a fix for this earlier in 2019 that did rely
on testing pagefault_disabled() (see link below) to achieve
the same thing, but this patch should be more generic.
Tested on 030 Atari Falcon.
Reported-by: Eero Tamminen <oak@helsinkinet.fi>
Link: https://lore.kernel.org/r/alpine.LNX.2.21.1904091023540.25@nippy.intranet
Link: https://lore.kernel.org/r/63130691-1984-c423-c1f2-73bfd8d3dcd3@gmail.com
Signed-off-by: Michael Schmitz <schmitzmic@gmail.com>
Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org>
Link: https://lore.kernel.org/r/20230301021107.26307-1-schmitzmic@gmail.com
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/kernel/traps.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
index 59fc63feb0dcc..6f647742a6ca9 100644
--- a/arch/m68k/kernel/traps.c
+++ b/arch/m68k/kernel/traps.c
@@ -30,6 +30,7 @@
#include <linux/init.h>
#include <linux/ptrace.h>
#include <linux/kallsyms.h>
+#include <linux/extable.h>
#include <asm/setup.h>
#include <asm/fpu.h>
@@ -544,7 +545,8 @@ static inline void bus_error030 (struct frame *fp)
errorcode |= 2;
if (mmusr & (MMU_I | MMU_WP)) {
- if (ssw & 4) {
+ /* We might have an exception table for this PC */
+ if (ssw & 4 && !search_exception_tables(fp->ptregs.pc)) {
pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n",
ssw & RW ? "read" : "write",
fp->un.fmtb.daddr,
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 07/17] selftests/bpf: check that modifier resolves after pointer
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (4 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 06/17] m68k: Only force 030 bus error if PC not in exception table Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 08/17] scsi: target: iscsi: Fix an error message in iscsi_check_key() Sasha Levin
` (9 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Lorenz Bauer, Lorenz Bauer, Martin KaFai Lau, Sasha Levin, ast,
daniel, andrii, shuah, yhs, eddyz87, sdf, laoar.shao, memxor,
iii, bpf, linux-kselftest
From: Lorenz Bauer <lorenz.bauer@isovalent.com>
[ Upstream commit dfdd608c3b365f0fd49d7e13911ebcde06b9865b ]
Add a regression test that ensures that a VAR pointing at a
modifier which follows a PTR (or STRUCT or ARRAY) is resolved
correctly by the datasec validator.
Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
Link: https://lore.kernel.org/r/20230306112138.155352-3-lmb@isovalent.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/prog_tests/btf.c | 28 ++++++++++++++++++++
1 file changed, 28 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
index 50afa75bd45b1..2a04dbec510de 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -882,6 +882,34 @@ static struct btf_raw_test raw_tests[] = {
.btf_load_err = true,
.err_str = "Invalid elem",
},
+{
+ .descr = "var after datasec, ptr followed by modifier",
+ .raw_types = {
+ /* .bss section */ /* [1] */
+ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DATASEC, 0, 2),
+ sizeof(void*)+4),
+ BTF_VAR_SECINFO_ENC(4, 0, sizeof(void*)),
+ BTF_VAR_SECINFO_ENC(6, sizeof(void*), 4),
+ /* int */ /* [2] */
+ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),
+ /* int* */ /* [3] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_PTR, 0, 0), 2),
+ BTF_VAR_ENC(NAME_TBD, 3, 0), /* [4] */
+ /* const int */ /* [5] */
+ BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_CONST, 0, 0), 2),
+ BTF_VAR_ENC(NAME_TBD, 5, 0), /* [6] */
+ BTF_END_RAW,
+ },
+ .str_sec = "\0a\0b\0c\0",
+ .str_sec_size = sizeof("\0a\0b\0c\0"),
+ .map_type = BPF_MAP_TYPE_ARRAY,
+ .map_name = ".bss",
+ .key_size = sizeof(int),
+ .value_size = sizeof(void*)+4,
+ .key_type_id = 0,
+ .value_type_id = 1,
+ .max_entries = 1,
+},
/* Test member exceeds the size of struct.
*
* struct A {
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 08/17] scsi: target: iscsi: Fix an error message in iscsi_check_key()
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (5 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 07/17] selftests/bpf: check that modifier resolves after pointer Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 09/17] scsi: hisi_sas: Check devm_add_action() return value Sasha Levin
` (8 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Maurizio Lombardi, Mike Christie, Martin K . Petersen,
Sasha Levin, mgurtovoy, linux-scsi, target-devel
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit 6cc55c969b7ce8d85e09a636693d4126c3676c11 ]
The first half of the error message is printed by pr_err(), the second half
is printed by pr_debug(). The user will therefore see only the first part
of the message and will miss some useful information.
Link: https://lore.kernel.org/r/20230214141556.762047-1-mlombard@redhat.com
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/iscsi/iscsi_target_parameters.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c
index 6bc3aaf655fc4..62004e3fe1ccc 100644
--- a/drivers/target/iscsi/iscsi_target_parameters.c
+++ b/drivers/target/iscsi/iscsi_target_parameters.c
@@ -1262,18 +1262,20 @@ static struct iscsi_param *iscsi_check_key(
return param;
if (!(param->phase & phase)) {
- pr_err("Key \"%s\" may not be negotiated during ",
- param->name);
+ char *phase_name;
+
switch (phase) {
case PHASE_SECURITY:
- pr_debug("Security phase.\n");
+ phase_name = "Security";
break;
case PHASE_OPERATIONAL:
- pr_debug("Operational phase.\n");
+ phase_name = "Operational";
break;
default:
- pr_debug("Unknown phase.\n");
+ phase_name = "Unknown";
}
+ pr_err("Key \"%s\" may not be negotiated during %s phase.\n",
+ param->name, phase_name);
return NULL;
}
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 09/17] scsi: hisi_sas: Check devm_add_action() return value
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (6 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 08/17] scsi: target: iscsi: Fix an error message in iscsi_check_key() Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 10/17] scsi: ufs: core: Add soft dependency on governor_simpleondemand Sasha Levin
` (7 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Kang Chen, Xiang Chen, Martin K . Petersen, Sasha Levin, jejb,
linux-scsi
From: Kang Chen <void0red@gmail.com>
[ Upstream commit 06d1a90de60208054cca15ef200138cfdbb642a9 ]
In case devm_add_action() fails, check it in the caller of
interrupt_preinit_v3_hw().
Link: https://lore.kernel.org/r/20230227031030.893324-1-void0red@gmail.com
Signed-off-by: Kang Chen <void0red@gmail.com>
Acked-by: Xiang Chen <chenxiang66@hisilicon.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index fa22cb712be5a..9515ab66a7789 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2424,8 +2424,7 @@ static int interrupt_preinit_v3_hw(struct hisi_hba *hisi_hba)
hisi_hba->cq_nvecs = vectors - BASE_VECTORS_V3_HW;
shost->nr_hw_queues = hisi_hba->cq_nvecs;
- devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev);
- return 0;
+ return devm_add_action(&pdev->dev, hisi_sas_v3_free_vectors, pdev);
}
static int interrupt_init_v3_hw(struct hisi_hba *hisi_hba)
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 10/17] scsi: ufs: core: Add soft dependency on governor_simpleondemand
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (7 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 09/17] scsi: hisi_sas: Check devm_add_action() return value Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 11/17] scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() Sasha Levin
` (6 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Adrien Thierry, Martin K . Petersen, Sasha Levin, jejb, beanhuo,
bvanassche, avri.altman, andersson, kwmad.kim, linux-scsi
From: Adrien Thierry <athierry@redhat.com>
[ Upstream commit 2ebe16155dc8bd4e602cad5b5f65458d2eaa1a75 ]
The ufshcd driver uses simpleondemand governor for devfreq. Add it to the
list of ufshcd softdeps to allow userspace initramfs tools like dracut to
automatically pull the governor module into the initramfs together with UFS
drivers.
Link: https://lore.kernel.org/r/20230220140740.14379-1-athierry@redhat.com
Signed-off-by: Adrien Thierry <athierry@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index 120831428ec6f..bc2b16701a116 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -9734,5 +9734,6 @@ module_exit(ufshcd_core_exit);
MODULE_AUTHOR("Santosh Yaragnavi <santosh.sy@samsung.com>");
MODULE_AUTHOR("Vinayak Holikatti <h.vinayak@samsung.com>");
MODULE_DESCRIPTION("Generic UFS host controller driver Core");
+MODULE_SOFTDEP("pre: governor_simpleondemand");
MODULE_LICENSE("GPL");
MODULE_VERSION(UFSHCD_DRIVER_VERSION);
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 11/17] scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (8 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 10/17] scsi: ufs: core: Add soft dependency on governor_simpleondemand Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 12/17] scsi: lpfc: Avoid usage of list iterator variable after loop Sasha Levin
` (5 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Justin Tee, Kang Chen, Martin K . Petersen, Sasha Levin,
james.smart, dick.kennedy, jejb, linux-scsi
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit 312320b0e0ec21249a17645683fe5304d796aec1 ]
If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on
lpfc_read_object()'s routine to NULL check pdata.
Currently, an early return error is thrown from lpfc_read_object() to
protect us from NULL ptr dereference, but the errno code is -ENODEV.
Change the errno code to a more appropriate -ENOMEM.
Reported-by: Kang Chen <void0red@gmail.com>
Link: https://lore.kernel.org/all/20230226102338.3362585-1-void0red@gmail.com
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Link: https://lore.kernel.org/r/20230228044336.5195-1-justintee8345@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_init.c | 2 ++
drivers/scsi/lpfc/lpfc_sli.c | 4 ----
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c
index 855817f6fe671..f79299f6178cd 100644
--- a/drivers/scsi/lpfc/lpfc_init.c
+++ b/drivers/scsi/lpfc/lpfc_init.c
@@ -7056,6 +7056,8 @@ lpfc_sli4_cgn_params_read(struct lpfc_hba *phba)
/* Find out if the FW has a new set of congestion parameters. */
len = sizeof(struct lpfc_cgn_param);
pdata = kzalloc(len, GFP_KERNEL);
+ if (!pdata)
+ return -ENOMEM;
ret = lpfc_read_object(phba, (char *)LPFC_PORT_CFG_NAME,
pdata, len);
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 7d333167047f5..1f1d346adc038 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -22376,10 +22376,6 @@ lpfc_read_object(struct lpfc_hba *phba, char *rdobject, uint32_t *datap,
struct lpfc_dmabuf *pcmd;
u32 rd_object_name[LPFC_MBX_OBJECT_NAME_LEN_DW] = {0};
- /* sanity check on queue memory */
- if (!datap)
- return -ENODEV;
-
mbox = mempool_alloc(phba->mbox_mem_pool, GFP_KERNEL);
if (!mbox)
return -ENOMEM;
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 12/17] scsi: lpfc: Avoid usage of list iterator variable after loop
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (9 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 11/17] scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 13/17] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file Sasha Levin
` (4 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Jakob Koschel, Justin Tee, Martin K . Petersen, Sasha Levin,
james.smart, dick.kennedy, jejb, linux-scsi
From: Jakob Koschel <jkl820.git@gmail.com>
[ Upstream commit 2850b23e9f9ae3696e472d2883ea1b43aafa884e ]
If the &epd_pool->list is empty when executing
lpfc_get_io_buf_from_expedite_pool() the function would return an invalid
pointer. Even in the case if the list is guaranteed to be populated, the
iterator variable should not be used after the loop to be more robust for
future changes.
Linus proposed to avoid any use of the list iterator variable after the
loop, in the attempt to move the list iterator variable declaration into
the macro to avoid any potential misuse after the loop [1].
Link: https://lore.kernel.org/all/CAHk-=wgRr_D8CB-D9Kg-c=EHreAsk5SqXPwr9Y7k9sA6cWXJ6w@mail.gmail.com/ [1]
Signed-off-by: Jakob Koschel <jkl820.git@gmail.com>
Link: https://lore.kernel.org/r/20230301-scsi-lpfc-avoid-list-iterator-after-loop-v1-1-325578ae7561@gmail.com
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_sli.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
index 1f1d346adc038..30bc72324f068 100644
--- a/drivers/scsi/lpfc/lpfc_sli.c
+++ b/drivers/scsi/lpfc/lpfc_sli.c
@@ -22166,20 +22166,20 @@ lpfc_get_io_buf_from_private_pool(struct lpfc_hba *phba,
static struct lpfc_io_buf *
lpfc_get_io_buf_from_expedite_pool(struct lpfc_hba *phba)
{
- struct lpfc_io_buf *lpfc_ncmd;
+ struct lpfc_io_buf *lpfc_ncmd = NULL, *iter;
struct lpfc_io_buf *lpfc_ncmd_next;
unsigned long iflag;
struct lpfc_epd_pool *epd_pool;
epd_pool = &phba->epd_pool;
- lpfc_ncmd = NULL;
spin_lock_irqsave(&epd_pool->lock, iflag);
if (epd_pool->count > 0) {
- list_for_each_entry_safe(lpfc_ncmd, lpfc_ncmd_next,
+ list_for_each_entry_safe(iter, lpfc_ncmd_next,
&epd_pool->list, list) {
- list_del(&lpfc_ncmd->list);
+ list_del(&iter->list);
epd_pool->count--;
+ lpfc_ncmd = iter;
break;
}
}
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 13/17] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (10 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 12/17] scsi: lpfc: Avoid usage of list iterator variable after loop Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 14/17] platform/x86: ISST: Increase range of valid mail box commands Sasha Levin
` (3 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Michael Kelley, Martin K . Petersen, Sasha Levin, kys, haiyangz,
wei.liu, decui, jejb, linux-hyperv, linux-scsi
From: Michael Kelley <mikelley@microsoft.com>
[ Upstream commit 11d9874c4204a785f43d899a1ab12f9dc8d9de3e ]
Hyper-V uses a VHD or VHDX file on the host as the underlying storage for a
virtual disk. The VHD/VHDX file format is a sparse format where real disk
space on the host is assigned in chunks that the VHD/VHDX file format calls
the BlockSize. This BlockSize is not to be confused with the 512-byte (or
4096-byte) sector size of the underlying storage device. The default block
size for a new VHD/VHDX file is 32 Mbytes. When a guest VM touches any
disk space within a 32 Mbyte chunk of the VHD/VHDX file, Hyper-V allocates
32 Mbytes of real disk space for that section of the VHD/VHDX. Similarly,
if a discard operation is done that covers an entire 32 Mbyte chunk,
Hyper-V will free the real disk space for that portion of the VHD/VHDX.
This BlockSize is surfaced in Linux as the "discard_granularity" in
/sys/block/sd<x>/queue, which makes sense.
Hyper-V also has differencing disks that can overlay a VHD/VHDX file to
capture changes to the VHD/VHDX while preserving the original VHD/VHDX.
One example of this differencing functionality is for VM snapshots. When a
snapshot is created, a differencing disk is created. If the snapshot is
rolled back, Hyper-V can just delete the differencing disk, and the VM will
see the original disk contents at the time the snapshot was taken.
Differencing disks are used in other scenarios as well.
The BlockSize for a differencing disk defaults to 2 Mbytes, not 32 Mbytes.
The smaller default is used because changes to differencing disks are
typically scattered all over, and Hyper-V doesn't want to allocate 32
Mbytes of real disk space for a stray write here or there. The smaller
BlockSize provides more efficient use of real disk space.
When a differencing disk is added to a VHD/VHDX, Hyper-V reports
UNIT_ATTENTION with a sense code indicating "Operating parameters have
changed", because the value of discard_granularity should be changed to 2
Mbytes. When the differencing disk is removed, discard_granularity should
be changed back to 32 Mbytes. However, current code simply reports a
message from scsi_report_sense() and the value of
/sys/block/sd<x>/queue/discard_granularity is not updated. The message
isn't very actionable by a sysadmin.
Fix this by having the storvsc driver check for the sense code indicating
that the underly VHD/VHDX block size has changed, and do a rescan of the
device to pick up the new discard_granularity. With this change the entire
transition to/from differencing disks is handled automatically and
transparently, with no confusing messages being output.
Link: https://lore.kernel.org/r/1677516514-86060-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/storvsc_drv.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 6110dfd903f74..83a3d9f085d84 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1050,6 +1050,22 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb,
goto do_work;
}
+ /*
+ * Check for "Operating parameters have changed"
+ * due to Hyper-V changing the VHD/VHDX BlockSize
+ * when adding/removing a differencing disk. This
+ * causes discard_granularity to change, so do a
+ * rescan to pick up the new granularity. We don't
+ * want scsi_report_sense() to output a message
+ * that a sysadmin wouldn't know what to do with.
+ */
+ if ((asc == 0x3f) && (ascq != 0x03) &&
+ (ascq != 0x0e)) {
+ process_err_fn = storvsc_device_scan;
+ set_host_byte(scmnd, DID_REQUEUE);
+ goto do_work;
+ }
+
/*
* Otherwise, let upper layer deal with the
* error when sense message is present
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 14/17] platform/x86: ISST: Increase range of valid mail box commands
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (11 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 13/17] scsi: storvsc: Handle BlockSize change in Hyper-V VHD/VHDX file Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 15/17] net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 Sasha Levin
` (2 subsequent siblings)
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Srinivas Pandruvada, Hans de Goede, Sasha Levin, markgross,
platform-driver-x86
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
[ Upstream commit 95ecf90158522269749f1b7ce98b1eed66ca087b ]
A new command CONFIG_TDP_GET_RATIO_INFO is added, with sub command type
of 0x0C. The previous range of valid sub commands was from 0x00 to 0x0B.
Change the valid range from 0x00 to 0x0C.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Link: https://lore.kernel.org/r/20230227053504.2734214-1-srinivas.pandruvada@linux.intel.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/speed_select_if/isst_if_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
index e8424e70d81d2..1847564748420 100644
--- a/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
+++ b/drivers/platform/x86/intel/speed_select_if/isst_if_common.c
@@ -47,7 +47,7 @@ struct isst_cmd_set_req_type {
static const struct isst_valid_cmd_ranges isst_valid_cmds[] = {
{0xD0, 0x00, 0x03},
- {0x7F, 0x00, 0x0B},
+ {0x7F, 0x00, 0x0C},
{0x7F, 0x10, 0x12},
{0x7F, 0x20, 0x23},
{0x94, 0x03, 0x03},
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 15/17] net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (12 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 14/17] platform/x86: ISST: Increase range of valid mail box commands Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 16/17] net: usb: qmi_wwan: add Telit 0x1080 composition Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 17/17] sh: sanitize the flags on sigreturn Sasha Levin
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Enrico Sau, Paolo Abeni, Sasha Levin, oliver, davem, edumazet,
kuba, linux-usb, netdev
From: Enrico Sau <enrico.sau@gmail.com>
[ Upstream commit 418383e6ed6b4624a54ec05c535f13d184fbf33b ]
Add quirk CDC_MBIM_FLAG_AVOID_ALTSETTING_TOGGLE for Telit FE990
0x1081 composition in order to avoid bind error.
Signed-off-by: Enrico Sau <enrico.sau@gmail.com>
Link: https://lore.kernel.org/r/20230306115933.198259-1-enrico.sau@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/cdc_mbim.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index c0b8b4aa78f37..a3ccf0cee093c 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -664,6 +664,11 @@ static const struct usb_device_id mbim_devs[] = {
.driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
},
+ /* Telit FE990 */
+ { USB_DEVICE_AND_INTERFACE_INFO(0x1bc7, 0x1081, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+ .driver_info = (unsigned long)&cdc_mbim_info_avoid_altsetting_toggle,
+ },
+
/* default entry */
{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
.driver_info = (unsigned long)&cdc_mbim_info_zlp,
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 16/17] net: usb: qmi_wwan: add Telit 0x1080 composition
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (13 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 15/17] net: usb: cdc_mbim: avoid altsetting toggling for Telit FE990 Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 17/17] sh: sanitize the flags on sigreturn Sasha Levin
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Enrico Sau, Paolo Abeni, Sasha Levin, bjorn, davem, edumazet,
kuba, netdev, linux-usb
From: Enrico Sau <enrico.sau@gmail.com>
[ Upstream commit 382e363d5bed0cec5807b35761d14e55955eee63 ]
Add the following Telit FE990 composition:
0x1080: tty, adb, rmnet, tty, tty, tty, tty
Signed-off-by: Enrico Sau <enrico.sau@gmail.com>
Link: https://lore.kernel.org/r/20230306120528.198842-1-enrico.sau@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 7b358b896a6d7..8646c4d90361c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1358,6 +1358,7 @@ static const struct usb_device_id products[] = {
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */
{QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)}, /* Telit FN990 */
+ {QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */
{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */
{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */
{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread* [PATCH AUTOSEL 5.15 17/17] sh: sanitize the flags on sigreturn
2023-03-20 0:55 [PATCH AUTOSEL 5.15 01/17] drm/cirrus: NULL-check pipe->plane.state->fb in cirrus_pipe_update() Sasha Levin
` (14 preceding siblings ...)
2023-03-20 0:55 ` [PATCH AUTOSEL 5.15 16/17] net: usb: qmi_wwan: add Telit 0x1080 composition Sasha Levin
@ 2023-03-20 0:55 ` Sasha Levin
15 siblings, 0 replies; 17+ messages in thread
From: Sasha Levin @ 2023-03-20 0:55 UTC (permalink / raw)
To: linux-kernel, stable
Cc: Al Viro, Rich Felker, Linus Torvalds, Sasha Levin, ysato,
wangkefeng.wang, chenhuacai, catalin.marinas, akpm, mpe,
linux-sh
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit 573b22ccb7ce9ab7f0539a2e11a9d3609a8783f5 ]
We fetch %SR value from sigframe; it might have been modified by signal
handler, so we can't trust it with any bits that are not modifiable in
user mode.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: Rich Felker <dalias@libc.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/include/asm/processor_32.h | 1 +
arch/sh/kernel/signal_32.c | 3 +++
2 files changed, 4 insertions(+)
diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h
index aa92cc933889d..6c7966e627758 100644
--- a/arch/sh/include/asm/processor_32.h
+++ b/arch/sh/include/asm/processor_32.h
@@ -50,6 +50,7 @@
#define SR_FD 0x00008000
#define SR_MD 0x40000000
+#define SR_USER_MASK 0x00000303 // M, Q, S, T bits
/*
* DSP structure and data
*/
diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c
index dd3092911efad..dc13702003f0f 100644
--- a/arch/sh/kernel/signal_32.c
+++ b/arch/sh/kernel/signal_32.c
@@ -115,6 +115,7 @@ static int
restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p)
{
unsigned int err = 0;
+ unsigned int sr = regs->sr & ~SR_USER_MASK;
#define COPY(x) err |= __get_user(regs->x, &sc->sc_##x)
COPY(regs[1]);
@@ -130,6 +131,8 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc, int *r0_p
COPY(sr); COPY(pc);
#undef COPY
+ regs->sr = (regs->sr & SR_USER_MASK) | sr;
+
#ifdef CONFIG_SH_FPU
if (boot_cpu_data.flags & CPU_HAS_FPU) {
int owned_fp;
--
2.39.2
^ permalink raw reply [flat|nested] 17+ messages in thread