From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Lorenzo Bianconi <lorenzo@kernel.org>,
Felix Fietkau <nbd@nbd.name>, Sasha Levin <sashal@kernel.org>,
lorenzo.bianconi83@gmail.com, ryder.lee@mediatek.com,
kvalo@kernel.org, davem@davemloft.net, kuba@kernel.org,
pabeni@redhat.com, matthias.bgg@gmail.com,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-mediatek@lists.infradead.org
Subject: [PATCH AUTOSEL 5.16 030/109] mt76: dma: initialize skip_unmap in mt76_dma_rx_fill
Date: Fri, 1 Apr 2022 10:31:37 -0400 [thread overview]
Message-ID: <20220401143256.1950537-30-sashal@kernel.org> (raw)
In-Reply-To: <20220401143256.1950537-1-sashal@kernel.org>
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 577298ec55dfc8b9aece54520f0258c3f93a6573 ]
Even if it is only a false-positive since skip_buf0/skip_buf1 are only
used in mt76_dma_tx_cleanup_idx routine, initialize skip_unmap in
mt76_dma_rx_fill in order to fix the following UBSAN report:
[ 13.924906] UBSAN: invalid-load in linux-5.15.0/drivers/net/wireless/mediatek/mt76/dma.c:162:13
[ 13.924909] load of value 225 is not a valid value for type '_Bool'
[ 13.924912] CPU: 9 PID: 672 Comm: systemd-udevd Not tainted 5.15.0-18-generic #18-Ubuntu
[ 13.924914] Hardware name: LENOVO 21A0000CMX/21A0000CMX, BIOS R1MET43W (1.13 ) 11/05/2021
[ 13.924915] Call Trace:
[ 13.924917] <TASK>
[ 13.924920] show_stack+0x52/0x58
[ 13.924925] dump_stack_lvl+0x4a/0x5f
[ 13.924931] dump_stack+0x10/0x12
[ 13.924932] ubsan_epilogue+0x9/0x45
[ 13.924934] __ubsan_handle_load_invalid_value.cold+0x44/0x49
[ 13.924935] ? __iommu_dma_map+0x84/0xf0
[ 13.924939] mt76_dma_add_buf.constprop.0.cold+0x23/0x85 [mt76]
[ 13.924949] mt76_dma_rx_fill.isra.0+0x102/0x1f0 [mt76]
[ 13.924954] mt76_dma_init+0xc9/0x150 [mt76]
[ 13.924959] ? mt7921_dma_enable+0x110/0x110 [mt7921e]
[ 13.924966] mt7921_dma_init+0x1e3/0x260 [mt7921e]
[ 13.924970] mt7921_register_device+0x29d/0x510 [mt7921e]
[ 13.924975] mt7921_pci_probe.part.0+0x17f/0x1b0 [mt7921e]
[ 13.924980] mt7921_pci_probe+0x43/0x60 [mt7921e]
[ 13.924984] local_pci_probe+0x4b/0x90
[ 13.924987] pci_device_probe+0x115/0x1f0
[ 13.924989] really_probe+0x21e/0x420
[ 13.924992] __driver_probe_device+0x115/0x190
[ 13.924994] driver_probe_device+0x23/0xc0
[ 13.924996] __driver_attach+0xbd/0x1d0
[ 13.924998] ? __device_attach_driver+0x110/0x110
[ 13.924999] bus_for_each_dev+0x7e/0xc0
[ 13.925001] driver_attach+0x1e/0x20
[ 13.925003] bus_add_driver+0x135/0x200
[ 13.925005] driver_register+0x95/0xf0
[ 13.925008] ? 0xffffffffc0766000
[ 13.925010] __pci_register_driver+0x68/0x70
[ 13.925011] mt7921_pci_driver_init+0x23/0x1000 [mt7921e]
[ 13.925015] do_one_initcall+0x48/0x1d0
[ 13.925019] ? kmem_cache_alloc_trace+0x19e/0x2e0
[ 13.925022] do_init_module+0x62/0x280
[ 13.925025] load_module+0xac9/0xbb0
[ 13.925027] __do_sys_finit_module+0xbf/0x120
[ 13.925029] __x64_sys_finit_module+0x18/0x20
[ 13.925030] do_syscall_64+0x5c/0xc0
[ 13.925033] ? do_syscall_64+0x69/0xc0
[ 13.925034] ? sysvec_reschedule_ipi+0x78/0xe0
[ 13.925036] ? asm_sysvec_reschedule_ipi+0xa/0x20
[ 13.925039] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 13.925040] RIP: 0033:0x7fbf2b90f94d
[ 13.925045] RSP: 002b:00007ffe2ec7e5d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
[ 13.925047] RAX: ffffffffffffffda RBX: 000056106b0634e0 RCX: 00007fbf2b90f94d
[ 13.925048] RDX: 0000000000000000 RSI: 00007fbf2baa3441 RDI: 0000000000000013
[ 13.925049] RBP: 0000000000020000 R08: 0000000000000000 R09: 0000000000000002
[ 13.925050] R10: 0000000000000013 R11: 0000000000000246 R12: 00007fbf2baa3441
[ 13.925051] R13: 000056106b062620 R14: 000056106b0610c0 R15: 000056106b0640d0
[ 13.925053] </TASK>
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 5e1c1506a4c6..7aecde35cb9a 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -465,6 +465,7 @@ mt76_dma_rx_fill(struct mt76_dev *dev, struct mt76_queue *q)
qbuf.addr = addr + offset;
qbuf.len = len - offset;
+ qbuf.skip_unmap = false;
mt76_dma_add_buf(dev, q, &qbuf, 1, 0, buf, NULL);
frames++;
}
--
2.34.1
next prev parent reply other threads:[~2022-04-01 14:49 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220401143256.1950537-1-sashal@kernel.org>
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 002/109] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 013/109] ptp: replace snprintf with sysfs_emit Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 014/109] selftests, xsk: Fix bpf_res cleanup test Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 019/109] ath11k: fix kernel panic during unload/load ath11k modules Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 020/109] ath11k: pci: fix crash on suspend if board file is not found Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 021/109] ath11k: mhi: use mhi_sync_power_up() Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 022/109] net/smc: Send directly when TCP_CORK is cleared Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 024/109] bpf: Make dst_port field in struct bpf_sock 16-bit wide Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 029/109] mt76: mt7921: fix crash when startup fails Sasha Levin
2022-04-01 14:31 ` Sasha Levin [this message]
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 031/109] cfg80211: don't add non transmitted BSS to 6GHz scanned channels Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 032/109] libbpf: Fix build issue with llvm-readelf Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 033/109] ipv6: make mc_forwarding atomic Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 034/109] net: initialize init_net earlier Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 044/109] tcp: Don't acquire inet_listen_hashbucket::lock with disabled BH Sasha Levin
2022-04-01 14:31 ` [PATCH AUTOSEL 5.16 051/109] net/mlx5e: Disable TX queues before registering the netdev Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 053/109] iwlwifi: mvm: Correctly set fragmented EBS Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 054/109] iwlwifi: mvm: Passively scan non PSC channels only when requested so Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 055/109] iwlwifi: fix small doc mistake for iwl_fw_ini_addr_val Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 056/109] iwlwifi: mvm: move only to an enabled channel Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 058/109] rtw89: fix RCU usage in rtw89_core_txq_push() Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 059/109] ipv4: Invalidate neighbour for broadcast address upon address addition Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 069/109] mt76: mt7915: fix injected MPDU transmission to not use HW A-MSDU Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 072/109] mt76: mt7615: Fix assigning negative values to unsigned variable Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 076/109] net/smc: correct settings of RMB window update limit Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 078/109] macvtap: advertise link netns via netlink Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 079/109] tuntap: add sanity checks about msg_controllen in sendmsg Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 081/109] Bluetooth: Fix not checking for valid hdev on bt_dev_{info,warn,err,dbg} Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 082/109] Bluetooth: use memset avoid memory leaks Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 083/109] bnxt_en: Eliminate unintended link toggle during FW reset Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 086/109] powerpc/64e: Tie PPC_BOOK3E_64 to PPC_FSL_BOOK3E Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 089/109] can: isotp: set default value for N_As to 50 micro seconds Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 090/109] can: etas_es58x: es58x_fd_rx_event_msg(): initialize rx_event_msg before calling es58x_check_msg_len() Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 092/109] net: account alternate interface name memory Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 093/109] net: limit altnames to 64k total Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 094/109] net/mlx5e: Remove overzealous validations in netlink EEPROM query Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 097/109] net: sfp: add 2500base-X quirk for Lantech SFP module Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 099/109] mt76: fix monitor mode crash with sdio driver Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 102/109] Bluetooth: Fix use after free in hci_send_acl Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 103/109] netfilter: conntrack: revisit gc autotuning Sasha Levin
2022-04-01 14:32 ` [PATCH AUTOSEL 5.16 104/109] netlabel: fix out-of-bounds memory accesses Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401143256.1950537-30-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=kuba@kernel.org \
--cc=kvalo@kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mediatek@lists.infradead.org \
--cc=linux-wireless@vger.kernel.org \
--cc=lorenzo.bianconi83@gmail.com \
--cc=lorenzo@kernel.org \
--cc=matthias.bgg@gmail.com \
--cc=nbd@nbd.name \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=ryder.lee@mediatek.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).