stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier
@ 2023-09-08 18:21 Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 2/8] wifi: mwifiex: fix fortify warning Sasha Levin
                   ` (6 more replies)
  0 siblings, 7 replies; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Dongliang Mu, Toke Høiland-Jørgensen, Kalle Valo,
	Sasha Levin, kvalo, linux-wireless

From: Dongliang Mu <dzm91@hust.edu.cn>

[ Upstream commit 061115fbfb2ce5870c9a004d68dc63138c07c782 ]

Smatch reports:

ath_pci_probe() warn: argument 4 to %lx specifier is cast from pointer
ath_ahb_probe() warn: argument 4 to %lx specifier is cast from pointer

Fix it by modifying %lx to %p in the printk format string.

Note that with this change, the pointer address will be printed as a
hashed value by default. This is appropriate because the kernel
should not leak kernel pointers to user space in an informational
message. If someone wants to see the real address for debugging
purposes, this can be achieved with the no_hash_pointers kernel option.

Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230723040403.296723-1-dzm91@hust.edu.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/ath/ath9k/ahb.c | 4 ++--
 drivers/net/wireless/ath/ath9k/pci.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/ahb.c b/drivers/net/wireless/ath/ath9k/ahb.c
index 2bd982c3a479d..375628dc654e4 100644
--- a/drivers/net/wireless/ath/ath9k/ahb.c
+++ b/drivers/net/wireless/ath/ath9k/ahb.c
@@ -135,8 +135,8 @@ static int ath_ahb_probe(struct platform_device *pdev)
 
 	ah = sc->sc_ah;
 	ath9k_hw_name(ah, hw_name, sizeof(hw_name));
-	wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
-		   hw_name, (unsigned long)mem, irq);
+	wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
+		   hw_name, mem, irq);
 
 	return 0;
 
diff --git a/drivers/net/wireless/ath/ath9k/pci.c b/drivers/net/wireless/ath/ath9k/pci.c
index 2236063112613..7ab050cad4a20 100644
--- a/drivers/net/wireless/ath/ath9k/pci.c
+++ b/drivers/net/wireless/ath/ath9k/pci.c
@@ -975,8 +975,8 @@ static int ath_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	}
 
 	ath9k_hw_name(sc->sc_ah, hw_name, sizeof(hw_name));
-	wiphy_info(hw->wiphy, "%s mem=0x%lx, irq=%d\n",
-		   hw_name, (unsigned long)sc->mem, pdev->irq);
+	wiphy_info(hw->wiphy, "%s mem=0x%p, irq=%d\n",
+		   hw_name, sc->mem, pdev->irq);
 
 	return 0;
 
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 2/8] wifi: mwifiex: fix fortify warning
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 3/8] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Sasha Levin
                   ` (5 subsequent siblings)
  6 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Dmitry Antipov, Brian Norris, Kalle Valo, Sasha Levin,
	linux-wireless

From: Dmitry Antipov <dmantipov@yandex.ru>

[ Upstream commit dcce94b80a954a8968ff29fafcfb066d6197fa9a ]

When compiling with gcc 13.1 and CONFIG_FORTIFY_SOURCE=y,
I've noticed the following:

In function ‘fortify_memcpy_chk’,
    inlined from ‘mwifiex_construct_tdls_action_frame’ at drivers/net/wireless/marvell/mwifiex/tdls.c:765:3,
    inlined from ‘mwifiex_send_tdls_action_frame’ at drivers/net/wireless/marvell/mwifiex/tdls.c:856:6:
./include/linux/fortify-string.h:529:25: warning: call to ‘__read_overflow2_field’
declared with attribute warning: detected read beyond size of field (2nd parameter);
maybe use struct_group()? [-Wattribute-warning]
  529 |                         __read_overflow2_field(q_size_field, size);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The compiler actually complains on:

memmove(pos + ETH_ALEN, &mgmt->u.action.category,
	sizeof(mgmt->u.action.u.tdls_discover_resp));

and it happens because the fortification logic interprets this
as an attempt to overread 1-byte 'u.action.category' member of
'struct ieee80211_mgmt'. To silence this warning, it's enough
to pass an address of 'u.action' itself instead of an address
of its first member.

This also fixes an improper usage of 'sizeof()'. Since 'skb' is
extended with 'sizeof(mgmt->u.action.u.tdls_discover_resp) + 1'
bytes (where 1 is actually 'sizeof(mgmt->u.action.category)'),
I assume that the same number of bytes should be copied.

Suggested-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230629085115.180499-2-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/tdls.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
index 80d20fb6f3480..a69b4983747f3 100644
--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -737,6 +737,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 	int ret;
 	u16 capab;
 	struct ieee80211_ht_cap *ht_cap;
+	unsigned int extra;
 	u8 radio, *pos;
 
 	capab = priv->curr_bss_params.bss_descriptor.cap_info_bitmap;
@@ -755,7 +756,10 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 
 	switch (action_code) {
 	case WLAN_PUB_ACTION_TDLS_DISCOVER_RES:
-		skb_put(skb, sizeof(mgmt->u.action.u.tdls_discover_resp) + 1);
+		/* See the layout of 'struct ieee80211_mgmt'. */
+		extra = sizeof(mgmt->u.action.u.tdls_discover_resp) +
+			sizeof(mgmt->u.action.category);
+		skb_put(skb, extra);
 		mgmt->u.action.category = WLAN_CATEGORY_PUBLIC;
 		mgmt->u.action.u.tdls_discover_resp.action_code =
 					      WLAN_PUB_ACTION_TDLS_DISCOVER_RES;
@@ -764,8 +768,7 @@ mwifiex_construct_tdls_action_frame(struct mwifiex_private *priv,
 		mgmt->u.action.u.tdls_discover_resp.capability =
 							     cpu_to_le16(capab);
 		/* move back for addr4 */
-		memmove(pos + ETH_ALEN, &mgmt->u.action.category,
-			sizeof(mgmt->u.action.u.tdls_discover_resp));
+		memmove(pos + ETH_ALEN, &mgmt->u.action, extra);
 		/* init address 4 */
 		memcpy(pos, bc_addr, ETH_ALEN);
 
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 3/8] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 2/8] wifi: mwifiex: fix fortify warning Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 4/8] tpm_tis: Resend command to recover from data transfer errors Sasha Levin
                   ` (4 subsequent siblings)
  6 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable; +Cc: Mark O'Donovan, Herbert Xu, Sasha Levin, zohar

From: Mark O'Donovan <shiftee@posteo.net>

[ Upstream commit 9e47a758b70167c9301d2b44d2569f86c7796f2d ]

During NVMeTCP Authentication a controller can trigger a kernel
oops by specifying the 8192 bit Diffie Hellman group and passing
a correctly sized, but zeroed Diffie Hellamn value.
mpi_cmp_ui() was detecting this if the second parameter was 0,
but 1 is passed from dh_is_pubkey_valid(). This causes the null
pointer u->d to be dereferenced towards the end of mpi_cmp_ui()

Signed-off-by: Mark O'Donovan <shiftee@posteo.net>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 lib/mpi/mpi-cmp.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/lib/mpi/mpi-cmp.c b/lib/mpi/mpi-cmp.c
index d25e9e96c310f..ceaebe181cd70 100644
--- a/lib/mpi/mpi-cmp.c
+++ b/lib/mpi/mpi-cmp.c
@@ -25,8 +25,12 @@ int mpi_cmp_ui(MPI u, unsigned long v)
 	mpi_limb_t limb = v;
 
 	mpi_normalize(u);
-	if (!u->nlimbs && !limb)
-		return 0;
+	if (u->nlimbs == 0) {
+		if (v == 0)
+			return 0;
+		else
+			return -1;
+	}
 	if (u->sign)
 		return -1;
 	if (u->nlimbs > 1)
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 4/8] tpm_tis: Resend command to recover from data transfer errors
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 2/8] wifi: mwifiex: fix fortify warning Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 3/8] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 5/8] alx: fix OOB-read compiler warning Sasha Levin
                   ` (3 subsequent siblings)
  6 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Alexander Steffen, Jarkko Sakkinen, Sasha Levin, peterhuewe,
	linux-integrity

From: Alexander Steffen <Alexander.Steffen@infineon.com>

[ Upstream commit 280db21e153d8810ce3b93640c63ae922bcb9e8e ]

Similar to the transmission of TPM responses, also the transmission of TPM
commands may become corrupted. Instead of aborting when detecting such
issues, try resending the command again.

Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/char/tpm/tpm_tis_core.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index 3255815585096..9d731e2655949 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -364,10 +364,17 @@ static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len)
 	int rc;
 	u32 ordinal;
 	unsigned long dur;
-
-	rc = tpm_tis_send_data(chip, buf, len);
-	if (rc < 0)
-		return rc;
+	unsigned int try;
+
+	for (try = 0; try < TPM_RETRY; try++) {
+		rc = tpm_tis_send_data(chip, buf, len);
+		if (rc >= 0)
+			/* Data transfer done successfully */
+			break;
+		else if (rc != -EIO)
+			/* Data transfer failed, not recoverable */
+			return rc;
+	}
 
 	/* go and do it */
 	rc = tpm_tis_write8(priv, TPM_STS(priv->locality), TPM_STS_GO);
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 5/8] alx: fix OOB-read compiler warning
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
                   ` (2 preceding siblings ...)
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 4/8] tpm_tis: Resend command to recover from data transfer errors Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
                   ` (2 subsequent siblings)
  6 siblings, 0 replies; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: GONG, Ruiqi, GONG, Simon Horman, Paolo Abeni, Sasha Levin,
	chris.snook, davem, edumazet, kuba, netdev

From: "GONG, Ruiqi" <gongruiqi1@huawei.com>

[ Upstream commit 3a198c95c95da10ad844cbeade2fe40bdf14c411 ]

The following message shows up when compiling with W=1:

In function ‘fortify_memcpy_chk’,
    inlined from ‘alx_get_ethtool_stats’ at drivers/net/ethernet/atheros/alx/ethtool.c:297:2:
./include/linux/fortify-string.h:592:4: error: call to ‘__read_overflow2_field’
declared with attribute warning: detected read beyond size of field (2nd parameter);
maybe use struct_group()? [-Werror=attribute-warning]
  592 |    __read_overflow2_field(q_size_field, size);
      |    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

In order to get alx stats altogether, alx_get_ethtool_stats() reads
beyond hw->stats.rx_ok. Fix this warning by directly copying hw->stats,
and refactor the unnecessarily complicated BUILD_BUG_ON btw.

Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230821013218.1614265-1-gongruiqi@huaweicloud.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/ethernet/atheros/alx/ethtool.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/atheros/alx/ethtool.c b/drivers/net/ethernet/atheros/alx/ethtool.c
index 2f4eabf652e80..51e5aa2c74b34 100644
--- a/drivers/net/ethernet/atheros/alx/ethtool.c
+++ b/drivers/net/ethernet/atheros/alx/ethtool.c
@@ -281,9 +281,8 @@ static void alx_get_ethtool_stats(struct net_device *netdev,
 	spin_lock(&alx->stats_lock);
 
 	alx_update_hw_stats(hw);
-	BUILD_BUG_ON(sizeof(hw->stats) - offsetof(struct alx_hw_stats, rx_ok) <
-		     ALX_NUM_STATS * sizeof(u64));
-	memcpy(data, &hw->stats.rx_ok, ALX_NUM_STATS * sizeof(u64));
+	BUILD_BUG_ON(sizeof(hw->stats) != ALX_NUM_STATS * sizeof(u64));
+	memcpy(data, &hw->stats, sizeof(hw->stats));
 
 	spin_unlock(&alx->stats_lock);
 }
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt()
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
                   ` (3 preceding siblings ...)
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 5/8] alx: fix OOB-read compiler warning Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-11  9:36   ` Pavel Machek
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming Sasha Levin
  6 siblings, 1 reply; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: GONG, Ruiqi, GONG, Gustavo A . R . Silva, Kees Cook,
	Florian Westphal, Sasha Levin, pablo, kadlec, roopa, razor, davem,
	edumazet, kuba, pabeni, netfilter-devel, coreteam, bridge, netdev

From: "GONG, Ruiqi" <gongruiqi1@huawei.com>

[ Upstream commit a7ed3465daa240bdf01a5420f64336fee879c09d ]

When compiling with gcc 13 and CONFIG_FORTIFY_SOURCE=y, the following
warning appears:

In function ‘fortify_memcpy_chk’,
    inlined from ‘size_entry_mwt’ at net/bridge/netfilter/ebtables.c:2118:2:
./include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’
declared with attribute warning: detected read beyond size of field (2nd parameter);
maybe use struct_group()? [-Werror=attribute-warning]
  592 |                         __read_overflow2_field(q_size_field, size);
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

The compiler is complaining:

memcpy(&offsets[1], &entry->watchers_offset,
                       sizeof(offsets) - sizeof(offsets[0]));

where memcpy reads beyong &entry->watchers_offset to copy
{watchers,target,next}_offset altogether into offsets[]. Silence the
warning by wrapping these three up via struct_group().

Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 include/uapi/linux/netfilter_bridge/ebtables.h | 14 ++++++++------
 net/bridge/netfilter/ebtables.c                |  3 +--
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/uapi/linux/netfilter_bridge/ebtables.h b/include/uapi/linux/netfilter_bridge/ebtables.h
index 9ff57c0a01990..43db01c05c4d5 100644
--- a/include/uapi/linux/netfilter_bridge/ebtables.h
+++ b/include/uapi/linux/netfilter_bridge/ebtables.h
@@ -172,12 +172,14 @@ struct ebt_entry {
 	unsigned char sourcemsk[ETH_ALEN];
 	unsigned char destmac[ETH_ALEN];
 	unsigned char destmsk[ETH_ALEN];
-	/* sizeof ebt_entry + matches */
-	unsigned int watchers_offset;
-	/* sizeof ebt_entry + matches + watchers */
-	unsigned int target_offset;
-	/* sizeof ebt_entry + matches + watchers + target */
-	unsigned int next_offset;
+	__struct_group(/* no tag */, offsets, /* no attrs */,
+		/* sizeof ebt_entry + matches */
+		unsigned int watchers_offset;
+		/* sizeof ebt_entry + matches + watchers */
+		unsigned int target_offset;
+		/* sizeof ebt_entry + matches + watchers + target */
+		unsigned int next_offset;
+	);
 	unsigned char elems[0] __attribute__ ((aligned (__alignof__(struct ebt_replace))));
 };
 
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84d4b4a0b0536..b5fb880c8a093 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -2071,8 +2071,7 @@ static int size_entry_mwt(const struct ebt_entry *entry, const unsigned char *ba
 		return ret;
 
 	offsets[0] = sizeof(struct ebt_entry); /* matches come first */
-	memcpy(&offsets[1], &entry->watchers_offset,
-			sizeof(offsets) - sizeof(offsets[0]));
+	memcpy(&offsets[1], &entry->offsets, sizeof(entry->offsets));
 
 	if (state->buf_kern_start) {
 		buf_start = state->buf_kern_start + state->buf_kern_offset;
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
                   ` (4 preceding siblings ...)
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-11  9:38   ` Pavel Machek
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming Sasha Levin
  6 siblings, 1 reply; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Johannes Berg, syzbot+09d1cd2f71e6dd3bfd2c, Sasha Levin, johannes,
	davem, edumazet, kuba, pabeni, linux-wireless, netdev

From: Johannes Berg <johannes.berg@intel.com>

[ Upstream commit abc76cf552e13cfa88a204b362a86b0e08e95228 ]

If there's no OCB state, don't ask the driver/mac80211 to
leave, since that's just confusing. Since set/clear the
chandef state, that's a simple check.

Reported-by: syzbot+09d1cd2f71e6dd3bfd2c@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 net/wireless/ocb.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/wireless/ocb.c b/net/wireless/ocb.c
index e64dbf16330c4..73dd44e77a1a3 100644
--- a/net/wireless/ocb.c
+++ b/net/wireless/ocb.c
@@ -70,6 +70,9 @@ int __cfg80211_leave_ocb(struct cfg80211_registered_device *rdev,
 	if (!rdev->ops->leave_ocb)
 		return -EOPNOTSUPP;
 
+	if (!wdev->u.ocb.chandef.chan)
+		return -ENOTCONN;
+
 	err = rdev_leave_ocb(rdev, dev);
 	if (!err)
 		memset(&wdev->chandef, 0, sizeof(wdev->chandef));
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming
  2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
                   ` (5 preceding siblings ...)
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
@ 2023-09-08 18:21 ` Sasha Levin
  2023-09-11  9:40   ` Pavel Machek
  6 siblings, 1 reply; 11+ messages in thread
From: Sasha Levin @ 2023-09-08 18:21 UTC (permalink / raw)
  To: linux-kernel, stable
  Cc: Bastien Nocera, Paul Menzel, Luiz Augusto von Dentz, Sasha Levin,
	marcel, johan.hedberg, luiz.dentz, linux-bluetooth

From: Bastien Nocera <hadess@hadess.net>

[ Upstream commit d831e3612111d385e8629104af5429808ef26e25 ]

The quirks table was named "blacklist_table" which isn't a good
description for that table as devices detected using it weren't ignored
by the driver.

Rename the table to match what it actually does.

Signed-off-by: Bastien Nocera <hadess@hadess.net>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/bluetooth/btusb.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 27d26ef70dcc1..4904c00fbebe2 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -186,7 +186,7 @@ static const struct usb_device_id btusb_table[] = {
 
 MODULE_DEVICE_TABLE(usb, btusb_table);
 
-static const struct usb_device_id blacklist_table[] = {
+static const struct usb_device_id quirks_table[] = {
 	/* CSR BlueCore devices */
 	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
 
@@ -2963,7 +2963,7 @@ static int btusb_probe(struct usb_interface *intf,
 	if (!id->driver_info) {
 		const struct usb_device_id *match;
 
-		match = usb_match_id(intf, blacklist_table);
+		match = usb_match_id(intf, quirks_table);
 		if (match)
 			id = match;
 	}
-- 
2.40.1


^ permalink raw reply related	[flat|nested] 11+ messages in thread

* Re: [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt()
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
@ 2023-09-11  9:36   ` Pavel Machek
  0 siblings, 0 replies; 11+ messages in thread
From: Pavel Machek @ 2023-09-11  9:36 UTC (permalink / raw)
  To: Sasha Levin
  Cc: linux-kernel, stable, GONG, Ruiqi, GONG, Gustavo A . R . Silva,
	Kees Cook, Florian Westphal, pablo, kadlec, roopa, razor, davem,
	edumazet, kuba, pabeni, netfilter-devel, coreteam, bridge, netdev

[-- Attachment #1: Type: text/plain, Size: 886 bytes --]

Hi!

> [ Upstream commit a7ed3465daa240bdf01a5420f64336fee879c09d ]
> 
> When compiling with gcc 13 and CONFIG_FORTIFY_SOURCE=y, the following
> warning appears:
> 
> In function ‘fortify_memcpy_chk’,
>     inlined from ‘size_entry_mwt’ at net/bridge/netfilter/ebtables.c:2118:2:
> ./include/linux/fortify-string.h:592:25: error: call to ‘__read_overflow2_field’
> declared with attribute warning: detected read beyond size of field (2nd parameter);
> maybe use struct_group()? [-Werror=attribute-warning]
>   592 |                         __read_overflow2_field(q_size_field, size);
>       |
> ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This is not queued for 4.19. Mistake?

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
@ 2023-09-11  9:38   ` Pavel Machek
  0 siblings, 0 replies; 11+ messages in thread
From: Pavel Machek @ 2023-09-11  9:38 UTC (permalink / raw)
  To: Sasha Levin
  Cc: linux-kernel, stable, Johannes Berg, syzbot+09d1cd2f71e6dd3bfd2c,
	johannes, davem, edumazet, kuba, pabeni, linux-wireless, netdev

[-- Attachment #1: Type: text/plain, Size: 388 bytes --]

Hi!

> If there's no OCB state, don't ask the driver/mac80211 to
> leave, since that's just confusing. Since set/clear the
> chandef state, that's a simple check.

This is not queued for 5.10. Mistake?

Best regards,
								Pavel
-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread

* Re: [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming
  2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming Sasha Levin
@ 2023-09-11  9:40   ` Pavel Machek
  0 siblings, 0 replies; 11+ messages in thread
From: Pavel Machek @ 2023-09-11  9:40 UTC (permalink / raw)
  To: Sasha Levin
  Cc: linux-kernel, stable, Bastien Nocera, Paul Menzel,
	Luiz Augusto von Dentz, marcel, johan.hedberg, luiz.dentz,
	linux-bluetooth

[-- Attachment #1: Type: text/plain, Size: 1245 bytes --]

Hi!

> From: Bastien Nocera <hadess@hadess.net>
> 
> [ Upstream commit d831e3612111d385e8629104af5429808ef26e25 ]
> 
> The quirks table was named "blacklist_table" which isn't a good
> description for that table as devices detected using it weren't ignored
> by the driver.
> 
> Rename the table to match what it actually does.

Cleanup, not a bugfix. Don't need it in stable.

Best regards,
							Pavel

> +++ b/drivers/bluetooth/btusb.c
> @@ -186,7 +186,7 @@ static const struct usb_device_id btusb_table[] = {
>  
>  MODULE_DEVICE_TABLE(usb, btusb_table);
>  
> -static const struct usb_device_id blacklist_table[] = {
> +static const struct usb_device_id quirks_table[] = {
>  	/* CSR BlueCore devices */
>  	{ USB_DEVICE(0x0a12, 0x0001), .driver_info = BTUSB_CSR },
>  
> @@ -2963,7 +2963,7 @@ static int btusb_probe(struct usb_interface *intf,
>  	if (!id->driver_info) {
>  		const struct usb_device_id *match;
>  
> -		match = usb_match_id(intf, blacklist_table);
> +		match = usb_match_id(intf, quirks_table);
>  		if (match)
>  			id = match;
>  	}

-- 
DENX Software Engineering GmbH,        Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

^ permalink raw reply	[flat|nested] 11+ messages in thread

end of thread, other threads:[~2023-09-11 22:59 UTC | newest]

Thread overview: 11+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-08 18:21 [PATCH AUTOSEL 4.14 1/8] wifi: ath9k: fix printk specifier Sasha Levin
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 2/8] wifi: mwifiex: fix fortify warning Sasha Levin
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 3/8] crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() Sasha Levin
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 4/8] tpm_tis: Resend command to recover from data transfer errors Sasha Levin
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 5/8] alx: fix OOB-read compiler warning Sasha Levin
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 6/8] netfilter: ebtables: fix fortify warnings in size_entry_mwt() Sasha Levin
2023-09-11  9:36   ` Pavel Machek
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 7/8] wifi: cfg80211: ocb: don't leave if not joined Sasha Levin
2023-09-11  9:38   ` Pavel Machek
2023-09-08 18:21 ` [PATCH AUTOSEL 4.14 8/8] Bluetooth: btusb: Fix quirks table naming Sasha Levin
2023-09-11  9:40   ` Pavel Machek

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).