kernel: bump 6.6 to 6.6.48

Changelog: https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.6.48

Removed upstreamed:
	generic/backport-6.6/752-04-v6.6-net-ethernet-mtk_wed-check-update_wo_rx_stats-in-mtk.patch[1]
	generic/pending-6.6/601-udp-fix-receiving-fraglist-GSO_packets.patch[2]
	mediatek/patches-6.6/951-net-ethernet-mtk_wed-fix-use-after-free-panic-in-mtk.patch[3]
	rockchip/patches-6.6/302-mmc-allow-probe-to-defer-if-clock-is-not-ready.patch[4]

Manually rebased:
	bcm27xx/patches-6.6/950-0058-Revert-Bluetooth-Always-request-for-user-confirmatio.patch

All other patches automatically rebased.

1. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=7ede6ef04c9ffc466844a297d3d68bea8a06093d
2. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=cfa692e7e71b22d35174a796d10b9111bafa0686
3. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=326a89321f9d5fe399fe6f9ff7c0fc766582a6a0
4. https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=v6.6.48&id=7bbf8f8b8861dd2a6215f1aded425c66e6c376a0

Build system: x86/64
Build-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3
Run-tested: x86/64/AMD Cezanne, flogic/xiaomi_redmi-router-ax6000-ubootmod, ramips/tplink_archer-a6-v3

Signed-off-by: John Audia <therealgraysky@proton.me>
Link: https://github.com/openwrt/openwrt/pull/16282
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
This commit is contained in:
John Audia 2024-08-29 13:38:03 -04:00 committed by Hauke Mehrtens
parent 8b2f7beb07
commit 93cca95434
23 changed files with 45 additions and 181 deletions

View File

@ -1,2 +1,2 @@
LINUX_VERSION-6.6 = .47
LINUX_KERNEL_HASH-6.6.47 = d43376c9e9eaa92bb1b926054bd160d329c58a62d64bd65fe1222c11c6564f50
LINUX_VERSION-6.6 = .48
LINUX_KERNEL_HASH-6.6.48 = 6b16df7b2aba3116b78fdfd8aea0b6cd7abe8f0cb699b04a66d3169141772029

View File

@ -751,7 +751,7 @@ SVN-Revision: 35130
EXPORT_SYMBOL(xfrm_parse_spi);
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4225,14 +4225,16 @@ static bool tcp_parse_aligned_timestamp(
@@ -4221,14 +4221,16 @@ static bool tcp_parse_aligned_timestamp(
{
const __be32 *ptr = (const __be32 *)(th + 1);

View File

@ -24,16 +24,16 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2221,7 +2221,7 @@ mackey_and_ltk:
@@ -2222,7 +2222,7 @@ mackey_and_ltk:
if (err)
return SMP_UNSPECIFIED;
- if (smp->method == REQ_OOB) {
+ if (smp->method == JUST_WORKS || smp->method == REQ_OOB) {
if (hcon->out) {
if (test_bit(SMP_FLAG_INITIATOR, &smp->flags)) {
sc_dhkey_check(smp);
SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
@@ -2236,9 +2236,6 @@ mackey_and_ltk:
@@ -2237,9 +2237,6 @@ mackey_and_ltk:
confirm_hint = 0;
confirm:

View File

@ -17583,7 +17583,7 @@ Signed-off-by: Phil Elwell <phil@raspberrypi.com>
* For devices with more than one control interface, we assume the
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -2189,6 +2189,8 @@ static const struct usb_audio_quirk_flag
@@ -2191,6 +2191,8 @@ static const struct usb_audio_quirk_flag
QUIRK_FLAG_ALIGN_TRANSFER),
DEVICE_FLG(0x534d, 0x2109, /* MacroSilicon MS2109 */
QUIRK_FLAG_ALIGN_TRANSFER),

View File

@ -125,7 +125,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.org>
* non-error returns are a promise to giveback() the urb later
* we drop ownership so next owner (or urb unlink) can get it
*/
@@ -5326,6 +5429,7 @@ static const struct hc_driver xhci_hc_dr
@@ -5328,6 +5431,7 @@ static const struct hc_driver xhci_hc_dr
.endpoint_reset = xhci_endpoint_reset,
.check_bandwidth = xhci_check_bandwidth,
.reset_bandwidth = xhci_reset_bandwidth,

View File

@ -212,7 +212,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
},
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1181,6 +1181,24 @@ static void dwc3_config_threshold(struct
@@ -1194,6 +1194,24 @@ static void dwc3_config_threshold(struct
}
}
@ -237,7 +237,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
/**
* dwc3_core_init - Low-level initialization of DWC3 Core
* @dwc: Pointer to our controller context structure
@@ -1246,6 +1264,8 @@ static int dwc3_core_init(struct dwc3 *d
@@ -1259,6 +1277,8 @@ static int dwc3_core_init(struct dwc3 *d
dwc3_set_incr_burst_type(dwc);
@ -246,7 +246,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
ret = dwc3_phy_power_on(dwc);
if (ret)
goto err_exit_phy;
@@ -1320,6 +1340,24 @@ static int dwc3_core_init(struct dwc3 *d
@@ -1333,6 +1353,24 @@ static int dwc3_core_init(struct dwc3 *d
dwc3_config_threshold(dwc);
@ -271,7 +271,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
return 0;
err_power_off_phy:
@@ -1463,6 +1501,7 @@ static void dwc3_get_properties(struct d
@@ -1476,6 +1514,7 @@ static void dwc3_get_properties(struct d
u8 tx_thr_num_pkt_prd = 0;
u8 tx_max_burst_prd = 0;
u8 tx_fifo_resize_max_num;
@ -279,7 +279,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
const char *usb_psy_name;
int ret;
@@ -1485,6 +1524,9 @@ static void dwc3_get_properties(struct d
@@ -1498,6 +1537,9 @@ static void dwc3_get_properties(struct d
*/
tx_fifo_resize_max_num = 6;
@ -289,7 +289,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
dwc->maximum_speed = usb_get_maximum_speed(dev);
dwc->max_ssp_rate = usb_get_maximum_ssp_rate(dev);
dwc->dr_mode = usb_get_dr_mode(dev);
@@ -1606,6 +1648,9 @@ static void dwc3_get_properties(struct d
@@ -1619,6 +1661,9 @@ static void dwc3_get_properties(struct d
dwc->dis_split_quirk = device_property_read_bool(dev,
"snps,dis-split-quirk");
@ -299,7 +299,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
dwc->lpm_nyet_threshold = lpm_nyet_threshold;
dwc->tx_de_emphasis = tx_de_emphasis;
@@ -1623,6 +1668,8 @@ static void dwc3_get_properties(struct d
@@ -1636,6 +1681,8 @@ static void dwc3_get_properties(struct d
dwc->tx_thr_num_pkt_prd = tx_thr_num_pkt_prd;
dwc->tx_max_burst_prd = tx_max_burst_prd;
@ -308,7 +308,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
dwc->imod_interval = 0;
dwc->tx_fifo_resize_max_num = tx_fifo_resize_max_num;
@@ -1898,6 +1945,12 @@ static int dwc3_probe(struct platform_de
@@ -1911,6 +1958,12 @@ static int dwc3_probe(struct platform_de
dwc3_get_properties(dwc);

View File

@ -16,7 +16,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -1330,6 +1330,9 @@ static int dwc3_core_init(struct dwc3 *d
@@ -1343,6 +1343,9 @@ static int dwc3_core_init(struct dwc3 *d
if (dwc->parkmode_disable_hs_quirk)
reg |= DWC3_GUCTL1_PARKMODE_DISABLE_HS;
@ -26,7 +26,7 @@ Signed-off-by: Jonathan Bell <jonathan@raspberrypi.com>
if (DWC3_VER_IS_WITHIN(DWC3, 290A, ANY) &&
(dwc->maximum_speed == USB_SPEED_HIGH ||
dwc->maximum_speed == USB_SPEED_FULL))
@@ -1628,6 +1631,8 @@ static void dwc3_get_properties(struct d
@@ -1641,6 +1644,8 @@ static void dwc3_get_properties(struct d
"snps,parkmode-disable-ss-quirk");
dwc->parkmode_disable_hs_quirk = device_property_read_bool(dev,
"snps,parkmode-disable-hs-quirk");

View File

@ -65,7 +65,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
}
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -361,6 +361,14 @@ struct sk_buff *__udp_gso_segment(struct
@@ -362,6 +362,14 @@ struct sk_buff *__udp_gso_segment(struct
else
uh->check = gso_make_checksum(seg, ~check) ? : CSUM_MANGLED_0;

View File

@ -71,8 +71,8 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org>
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -282,6 +282,12 @@ struct sk_buff *__udp_gso_segment(struct
skb_transport_header(gso_skb)))
@@ -283,6 +283,12 @@ struct sk_buff *__udp_gso_segment(struct
!(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
return ERR_PTR(-EINVAL);
+ /* We don't know if egress device can segment and checksum the packet

View File

@ -1,26 +0,0 @@
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Tue, 12 Sep 2023 10:28:00 +0200
Subject: [PATCH] net: ethernet: mtk_wed: check update_wo_rx_stats in
mtk_wed_update_rx_stats()
Check if update_wo_rx_stats function pointer is properly set in
mtk_wed_update_rx_stats routine before accessing it.
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/b0d233386e059bccb59f18f69afb79a7806e5ded.1694507226.git.lorenzo@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
--- a/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed_mcu.c
@@ -68,6 +68,9 @@ mtk_wed_update_rx_stats(struct mtk_wed_d
struct mtk_wed_wo_rx_stats *stats;
int i;
+ if (!wed->wlan.update_wo_rx_stats)
+ return;
+
if (count * sizeof(*stats) > skb->len - sizeof(u32))
return;

View File

@ -168,7 +168,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
ext_mask |= MTK_WED_EXT_INT_STATUS_TX_DRV_R_RESP_ERR;
else
ext_mask |= MTK_WED_EXT_INT_STATUS_RX_FBUF_LO_TH |
@@ -1840,7 +1840,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
@@ -1842,7 +1842,7 @@ mtk_wed_setup_tc(struct mtk_wed_device *
{
struct mtk_wed_hw *hw = wed->hw;
@ -177,7 +177,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
return -EOPNOTSUPP;
switch (type) {
@@ -1914,9 +1914,9 @@ void mtk_wed_add_hw(struct device_node *
@@ -1916,9 +1916,9 @@ void mtk_wed_add_hw(struct device_node *
hw->wdma = wdma;
hw->index = index;
hw->irq = irq;

View File

@ -142,7 +142,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
return -ENOMEM;
wdma_w32(dev, MTK_WDMA_RING_TX(idx) + MTK_WED_RING_OFS_BASE,
@@ -1928,7 +1935,12 @@ void mtk_wed_add_hw(struct device_node *
@@ -1930,7 +1937,12 @@ void mtk_wed_add_hw(struct device_node *
hw->irq = irq;
hw->version = eth->soc->version;
@ -156,7 +156,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
hw->mirror = syscon_regmap_lookup_by_phandle(eth_np,
"mediatek,pcie-mirror");
hw->hifsys = syscon_regmap_lookup_by_phandle(eth_np,
@@ -1942,6 +1954,8 @@ void mtk_wed_add_hw(struct device_node *
@@ -1944,6 +1956,8 @@ void mtk_wed_add_hw(struct device_node *
regmap_write(hw->mirror, 0, 0);
regmap_write(hw->mirror, 4, 0);
}

View File

@ -759,7 +759,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
val = wed_r32(dev, MTK_WED_EXT_INT_STATUS);
wed_w32(dev, MTK_WED_EXT_INT_STATUS, val);
@@ -1939,6 +2130,9 @@ void mtk_wed_add_hw(struct device_node *
@@ -1941,6 +2132,9 @@ void mtk_wed_add_hw(struct device_node *
case 2:
hw->soc = &mt7986_data;
break;

View File

@ -364,7 +364,7 @@ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
{
int i;
@@ -2212,6 +2503,10 @@ void mtk_wed_add_hw(struct device_node *
@@ -2214,6 +2505,10 @@ void mtk_wed_add_hw(struct device_node *
.detach = mtk_wed_detach,
.ppe_check = mtk_wed_ppe_check,
.setup_tc = mtk_wed_setup_tc,

View File

@ -10,7 +10,7 @@ Subject: [PATCH] Kconfig: add tristate for OID and ASNI string
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1990,7 +1990,7 @@ config PADATA
@@ -1993,7 +1993,7 @@ config PADATA
bool
config ASN1

View File

@ -131,7 +131,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
struct gpio_desc *desc)
--- a/drivers/gpio/gpiolib-sysfs.c
+++ b/drivers/gpio/gpiolib-sysfs.c
@@ -557,7 +557,7 @@ static struct class gpio_class = {
@@ -558,7 +558,7 @@ static struct class gpio_class = {
*
* Returns zero on success, else an error.
*/
@ -140,7 +140,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
{
struct gpio_chip *chip;
struct gpio_device *gdev;
@@ -619,6 +619,8 @@ int gpiod_export(struct gpio_desc *desc,
@@ -620,6 +620,8 @@ int gpiod_export(struct gpio_desc *desc,
offset = gpio_chip_hwgpio(desc);
if (chip->names && chip->names[offset])
ioname = chip->names[offset];
@ -149,7 +149,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
dev = device_create_with_groups(&gpio_class, &gdev->dev,
MKDEV(0, 0), data, gpio_groups,
@@ -640,8 +642,21 @@ err_unlock:
@@ -641,8 +643,21 @@ err_unlock:
gpiod_dbg(desc, "%s: status %d\n", __func__, status);
return status;
}

View File

@ -235,7 +235,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
if (!pe)
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -4455,6 +4455,8 @@ static const struct seq_operations vmall
@@ -4448,6 +4448,8 @@ static const struct seq_operations vmall
static int __init proc_vmalloc_init(void)
{

View File

@ -1,26 +0,0 @@
From 32412565c27d63e15f25e76d86ee04c29b201b96 Mon Sep 17 00:00:00 2001
From: Felix Fietkau <nbd@nbd.name>
Date: Mon, 19 Aug 2024 15:20:42 +0200
Subject: [PATCH] udp: fix receiving fraglist GSO packets
When assembling fraglist GSO packets, udp4_gro_complete does not set
skb->csum_start, which makes the extra validation in __udp_gso_segment fail.
Fixes: 89add40066f9 ("net: drop bad gso csum_start and offset in virtio_net_hdr")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
net/ipv4/udp_offload.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -279,7 +279,8 @@ struct sk_buff *__udp_gso_segment(struct
return ERR_PTR(-EINVAL);
if (unlikely(skb_checksum_start(gso_skb) !=
- skb_transport_header(gso_skb)))
+ skb_transport_header(gso_skb) &&
+ !(skb_shinfo(gso_skb)->gso_type & SKB_GSO_FRAGLIST)))
return ERR_PTR(-EINVAL);
/* We don't know if egress device can segment and checksum the packet

View File

@ -338,7 +338,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6))
return -1;
@@ -1543,6 +1704,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
@@ -1544,6 +1705,14 @@ ip6_tnl_change(struct ip6_tnl *t, const
t->parms.link = p->link;
t->parms.proto = p->proto;
t->parms.fwmark = p->fwmark;
@ -353,7 +353,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
dst_cache_reset(&t->dst_cache);
ip6_tnl_link_config(t);
}
@@ -1577,6 +1746,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
@@ -1578,6 +1747,7 @@ ip6_tnl_parm_from_user(struct __ip6_tnl_
p->flowinfo = u->flowinfo;
p->link = u->link;
p->proto = u->proto;
@ -361,7 +361,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
memcpy(p->name, u->name, sizeof(u->name));
}
@@ -1964,6 +2134,15 @@ static int ip6_tnl_validate(struct nlatt
@@ -1966,6 +2136,15 @@ static int ip6_tnl_validate(struct nlatt
return 0;
}
@ -377,7 +377,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
static void ip6_tnl_netlink_parms(struct nlattr *data[],
struct __ip6_tnl_parm *parms)
{
@@ -2001,6 +2180,46 @@ static void ip6_tnl_netlink_parms(struct
@@ -2003,6 +2182,46 @@ static void ip6_tnl_netlink_parms(struct
if (data[IFLA_IPTUN_FWMARK])
parms->fwmark = nla_get_u32(data[IFLA_IPTUN_FWMARK]);
@ -424,7 +424,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
}
static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev,
@@ -2084,6 +2303,12 @@ static void ip6_tnl_dellink(struct net_d
@@ -2086,6 +2305,12 @@ static void ip6_tnl_dellink(struct net_d
static size_t ip6_tnl_get_size(const struct net_device *dev)
{
@ -437,7 +437,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
return
/* IFLA_IPTUN_LINK */
nla_total_size(4) +
@@ -2113,6 +2338,24 @@ static size_t ip6_tnl_get_size(const str
@@ -2115,6 +2340,24 @@ static size_t ip6_tnl_get_size(const str
nla_total_size(0) +
/* IFLA_IPTUN_FWMARK */
nla_total_size(4) +
@ -462,7 +462,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
0;
}
@@ -2120,6 +2363,9 @@ static int ip6_tnl_fill_info(struct sk_b
@@ -2122,6 +2365,9 @@ static int ip6_tnl_fill_info(struct sk_b
{
struct ip6_tnl *tunnel = netdev_priv(dev);
struct __ip6_tnl_parm *parm = &tunnel->parms;
@ -472,7 +472,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
if (nla_put_u32(skb, IFLA_IPTUN_LINK, parm->link) ||
nla_put_in6_addr(skb, IFLA_IPTUN_LOCAL, &parm->laddr) ||
@@ -2129,9 +2375,27 @@ static int ip6_tnl_fill_info(struct sk_b
@@ -2131,9 +2377,27 @@ static int ip6_tnl_fill_info(struct sk_b
nla_put_be32(skb, IFLA_IPTUN_FLOWINFO, parm->flowinfo) ||
nla_put_u32(skb, IFLA_IPTUN_FLAGS, parm->flags) ||
nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->proto) ||
@ -501,7 +501,7 @@ Signed-off-by: Steven Barth <cyrus@openwrt.org>
if (nla_put_u16(skb, IFLA_IPTUN_ENCAP_TYPE, tunnel->encap.type) ||
nla_put_be16(skb, IFLA_IPTUN_ENCAP_SPORT, tunnel->encap.sport) ||
nla_put_be16(skb, IFLA_IPTUN_ENCAP_DPORT, tunnel->encap.dport) ||
@@ -2171,6 +2435,7 @@ static const struct nla_policy ip6_tnl_p
@@ -2173,6 +2437,7 @@ static const struct nla_policy ip6_tnl_p
[IFLA_IPTUN_ENCAP_DPORT] = { .type = NLA_U16 },
[IFLA_IPTUN_COLLECT_METADATA] = { .type = NLA_FLAG },
[IFLA_IPTUN_FWMARK] = { .type = NLA_U32 },

View File

@ -18,7 +18,7 @@ Signed-off-by: Felix Fietkau <nbd@nbd.name>
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -8279,7 +8279,7 @@ static int nft_register_flowtable_net_ho
@@ -8322,7 +8322,7 @@ static int nft_register_flowtable_net_ho
err = flowtable->data.type->setup(&flowtable->data,
hook->ops.dev,
FLOW_BLOCK_BIND);

View File

@ -1,59 +0,0 @@
From 3da41fe88ff52c578f3155550bcbe0ecf388f079 Mon Sep 17 00:00:00 2001
From: Zheng Zhang <everything411@qq.com>
Date: Sat, 10 Aug 2024 12:01:56 +0800
Subject: [PATCH] net: ethernet: mtk_wed: fix use-after-free panic in
mtk_wed_setup_tc_block_cb()
When there are multiple ap interfaces on one band and with WED on,
turning the interface down will cause a kernel panic on MT798X.
Previously, cb_priv was freed in mtk_wed_setup_tc_block() without
marking NULL,and mtk_wed_setup_tc_block_cb() didn't check the value, too.
Assign NULL after free cb_priv in mtk_wed_setup_tc_block() and check NULL
in mtk_wed_setup_tc_block_cb().
----------
Unable to handle kernel paging request at virtual address 0072460bca32b4f5
Call trace:
mtk_wed_setup_tc_block_cb+0x4/0x38
0xffffffc0794084bc
tcf_block_playback_offloads+0x70/0x1e8
tcf_block_unbind+0x6c/0xc8
...
---------
Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
Signed-off-by: Zheng Zhang <everything411@qq.com>
---
drivers/net/ethernet/mediatek/mtk_wed.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/mediatek/mtk_wed.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed.c
@@ -2685,14 +2685,15 @@ mtk_wed_setup_tc_block_cb(enum tc_setup_
{
struct mtk_wed_flow_block_priv *priv = cb_priv;
struct flow_cls_offload *cls = type_data;
- struct mtk_wed_hw *hw = priv->hw;
+ struct mtk_wed_hw *hw = NULL;
- if (!tc_can_offload(priv->dev))
+ if (!priv || !tc_can_offload(priv->dev))
return -EOPNOTSUPP;
if (type != TC_SETUP_CLSFLOWER)
return -EOPNOTSUPP;
+ hw = priv->hw;
return mtk_flow_offload_cmd(hw->eth, cls, hw->index);
}
@@ -2748,6 +2749,7 @@ mtk_wed_setup_tc_block(struct mtk_wed_hw
flow_block_cb_remove(block_cb, f);
list_del(&block_cb->driver_list);
kfree(block_cb->cb_priv);
+ block_cb->cb_priv = NULL;
}
return 0;
default:

View File

@ -18,7 +18,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -818,8 +818,20 @@ static int dwc3_clk_enable(struct dwc3 *
@@ -831,8 +831,20 @@ static int dwc3_clk_enable(struct dwc3 *
if (ret)
goto disable_ref_clk;
@ -39,7 +39,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
disable_ref_clk:
clk_disable_unprepare(dwc->ref_clk);
disable_bus_clk:
@@ -829,6 +841,8 @@ disable_bus_clk:
@@ -842,6 +854,8 @@ disable_bus_clk:
static void dwc3_clk_disable(struct dwc3 *dwc)
{
@ -48,7 +48,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
clk_disable_unprepare(dwc->susp_clk);
clk_disable_unprepare(dwc->ref_clk);
clk_disable_unprepare(dwc->bus_clk);
@@ -1842,6 +1856,20 @@ static int dwc3_get_clocks(struct dwc3 *
@@ -1855,6 +1869,20 @@ static int dwc3_get_clocks(struct dwc3 *
}
}

View File

@ -1,25 +0,0 @@
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -3294,6 +3294,10 @@ int dw_mci_probe(struct dw_mci *host)
host->biu_clk = devm_clk_get(host->dev, "biu");
if (IS_ERR(host->biu_clk)) {
dev_dbg(host->dev, "biu clock not available\n");
+ ret = PTR_ERR(host->biu_clk);
+ if (ret == -EPROBE_DEFER) {
+ return ret;
+ }
} else {
ret = clk_prepare_enable(host->biu_clk);
if (ret) {
@@ -3305,6 +3309,11 @@ int dw_mci_probe(struct dw_mci *host)
host->ciu_clk = devm_clk_get(host->dev, "ciu");
if (IS_ERR(host->ciu_clk)) {
dev_dbg(host->dev, "ciu clock not available\n");
+ ret = PTR_ERR(host->ciu_clk);
+ if (ret == -EPROBE_DEFER) {
+ goto err_clk_biu;
+ }
+
host->bus_hz = host->pdata->bus_hz;
} else {
ret = clk_prepare_enable(host->ciu_clk);