Patches contributed by University of Minnesota

<<Prev 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18[19]20 21 22 23 24 25 26 27 28 29 30 Next>>

commit f37d8e67f39e6d3eaf4cc5471e8a3d21209843c6
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Wed Mar 13 11:55:41 2019 -0500

    spi : spi-topcliff-pch: Fix to handle empty DMA buffers
    
    pch_alloc_dma_buf allocated tx, rx DMA buffers which can fail. Further,
    these buffers are used without a check. The patch checks for these
    failures and sends the error upstream.
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c
index e7e8ea1edcce..fa730a871d25 100644
--- a/drivers/spi/spi-topcliff-pch.c
+++ b/drivers/spi/spi-topcliff-pch.c
@@ -1300,18 +1300,27 @@ static void pch_free_dma_buf(struct pch_spi_board_data *board_dat,
 				  dma->rx_buf_virt, dma->rx_buf_dma);
 }
 
-static void pch_alloc_dma_buf(struct pch_spi_board_data *board_dat,
+static int pch_alloc_dma_buf(struct pch_spi_board_data *board_dat,
 			      struct pch_spi_data *data)
 {
 	struct pch_spi_dma_ctrl *dma;
+	int ret;
 
 	dma = &data->dma;
+	ret = 0;
 	/* Get Consistent memory for Tx DMA */
 	dma->tx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev,
 				PCH_BUF_SIZE, &dma->tx_buf_dma, GFP_KERNEL);
+	if (!dma->tx_buf_virt)
+		ret = -ENOMEM;
+
 	/* Get Consistent memory for Rx DMA */
 	dma->rx_buf_virt = dma_alloc_coherent(&board_dat->pdev->dev,
 				PCH_BUF_SIZE, &dma->rx_buf_dma, GFP_KERNEL);
+	if (!dma->rx_buf_virt)
+		ret = -ENOMEM;
+
+	return ret;
 }
 
 static int pch_spi_pd_probe(struct platform_device *plat_dev)
@@ -1388,7 +1397,9 @@ static int pch_spi_pd_probe(struct platform_device *plat_dev)
 
 	if (use_dma) {
 		dev_info(&plat_dev->dev, "Use DMA for data transfers\n");
-		pch_alloc_dma_buf(board_dat, data);
+		ret = pch_alloc_dma_buf(board_dat, data);
+		if (ret)
+			goto err_spi_register_master;
 	}
 
 	ret = spi_register_master(master);

commit d6cb77228e3ae070061195a6fff6ba7c3c0b8e47
Author: Aditya Pakki <pakki001@umn.edu>
Date:   Tue Mar 12 10:05:52 2019 -0500

    pinctrl: baytrail: Fix potential NULL pointer dereference
    
    saved-context in byt_gpio_probe is allocated via devm_kcalloc and is
    used without checking for NULL in later functions. This patch avoids
    such a scenario.
    
    Signed-off-by: Aditya Pakki <pakki001@umn.edu>
    Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c
index 241384ead4ed..18d9ad504194 100644
--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
+++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
@@ -1710,6 +1710,8 @@ static int byt_gpio_probe(struct byt_gpio *vg)
 #ifdef CONFIG_PM_SLEEP
 	vg->saved_context = devm_kcalloc(&vg->pdev->dev, gc->ngpio,
 				       sizeof(*vg->saved_context), GFP_KERNEL);
+	if (!vg->saved_context)
+		return -ENOMEM;
 #endif
 	ret = devm_gpiochip_add_data(&vg->pdev->dev, gc, vg);
 	if (ret) {

commit 517ccc2aa50dbd7767a9eb8e1d9987a3ed7ced3e
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Sat Mar 16 16:46:05 2019 -0500

    net: tipc: fix a missing check for nla_nest_start
    
    nla_nest_start may fail. The fix check its status and returns
    -EMSGSIZE in case it fails.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3274ef625dba..d6b26862b34e 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -3255,6 +3255,8 @@ static int __tipc_nl_add_sk_con(struct sk_buff *skb, struct tipc_sock *tsk)
 	peer_port = tsk_peer_port(tsk);
 
 	nest = nla_nest_start(skb, TIPC_NLA_SOCK_CON);
+	if (!nest)
+		return -EMSGSIZE;
 
 	if (nla_put_u32(skb, TIPC_NLA_CON_NODE, peer_node))
 		goto msg_full;

commit 4589e28db46ee4961edfd794c5bb43887d38c8e5
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Fri Mar 15 12:11:59 2019 -0500

    net: tipc: fix a missing check of nla_nest_start
    
    nla_nest_start could fail and requires a check. The fix returns
    -EMSGSIZE if it fails.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/tipc/group.c b/net/tipc/group.c
index 06fee142f09f..63f39201e41e 100644
--- a/net/tipc/group.c
+++ b/net/tipc/group.c
@@ -919,6 +919,9 @@ int tipc_group_fill_sock_diag(struct tipc_group *grp, struct sk_buff *skb)
 {
 	struct nlattr *group = nla_nest_start(skb, TIPC_NLA_SOCK_GROUP);
 
+	if (!group)
+		return -EMSGSIZE;
+
 	if (nla_put_u32(skb, TIPC_NLA_SOCK_GROUP_ID,
 			grp->type) ||
 	    nla_put_u32(skb, TIPC_NLA_SOCK_GROUP_INSTANCE,

commit 07660ca679da3007d3231938e2dfb415d3440716
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Fri Mar 15 01:14:33 2019 -0500

    net: ncsi: fix a missing check for nla_nest_start
    
    nla_nest_start may fail and thus deserves a check.
    
    The fix returns -EMSGSIZE in case it fails.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 5d782445d2fc..bad17bba8ba7 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -251,6 +251,10 @@ static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
 	}
 
 	attr = nla_nest_start(skb, NCSI_ATTR_PACKAGE_LIST);
+	if (!attr) {
+		rc = -EMSGSIZE;
+		goto err;
+	}
 	rc = ncsi_write_package_info(skb, ndp, package->id);
 	if (rc) {
 		nla_nest_cancel(skb, attr);

commit 0fff9bd47e1341b5c4db862cc39fc68ce45f165d
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Fri Mar 15 01:11:22 2019 -0500

    net: openvswitch: fix missing checks for nla_nest_start
    
    nla_nest_start may fail and thus deserves a check.
    The fix returns -EMSGSIZE when it fails.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 45d1469308b0..9dd158ab51b3 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -464,6 +464,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 
 	if (upcall_info->egress_tun_info) {
 		nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_EGRESS_TUN_KEY);
+		if (!nla) {
+			err = -EMSGSIZE;
+			goto out;
+		}
 		err = ovs_nla_put_tunnel_info(user_skb,
 					      upcall_info->egress_tun_info);
 		BUG_ON(err);
@@ -472,6 +476,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 
 	if (upcall_info->actions_len) {
 		nla = nla_nest_start(user_skb, OVS_PACKET_ATTR_ACTIONS);
+		if (!nla) {
+			err = -EMSGSIZE;
+			goto out;
+		}
 		err = ovs_nla_put_actions(upcall_info->actions,
 					  upcall_info->actions_len,
 					  user_skb);

commit 6f19893b644a9454d85e593b5e90914e7a72b7dd
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Thu Mar 14 23:20:16 2019 -0500

    net: openvswitch: fix a NULL pointer dereference
    
    upcall is dereferenced even when genlmsg_put fails. The fix
    goto out to avoid the NULL pointer dereference in this case.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index 6679e96ab1dc..45d1469308b0 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -448,6 +448,10 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
 
 	upcall = genlmsg_put(user_skb, 0, 0, &dp_packet_genl_family,
 			     0, upcall_info->cmd);
+	if (!upcall) {
+		err = -EINVAL;
+		goto out;
+	}
 	upcall->dp_ifindex = dp_ifindex;
 
 	err = ovs_nla_put_key(key, key, OVS_PACKET_ATTR_KEY, false, user_skb);

commit dcd0feac9bab901d5739de51b3f69840851f8919
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Thu Mar 14 23:04:14 2019 -0500

    ALSA: sb8: add a check for request_region
    
    In case request_region fails, the fix returns an error code to
    avoid NULL pointer dereference.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index aa2a83eb81a9..dc27a480c2d9 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int dev)
 
 	/* block the 0x388 port to avoid PnP conflicts */
 	acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+	if (!acard->fm_res) {
+		err = -EBUSY;
+		goto _err;
+	}
 
 	if (port[dev] != SNDRV_AUTO_PORT) {
 		if ((err = snd_sbdsp_create(card, port[dev], irq[dev],

commit 6ade657d6125ec3ec07f95fa51e28138aef6208f
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Thu Mar 14 22:58:29 2019 -0500

    ALSA: echoaudio: add a check for ioremap_nocache
    
    In case ioremap_nocache fails, the fix releases chip and returns
    an error code upstream to avoid NULL pointer dereference.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index ea876b0b02b9..dc0084dc8550 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -1952,6 +1952,11 @@ static int snd_echo_create(struct snd_card *card,
 	}
 	chip->dsp_registers = (volatile u32 __iomem *)
 		ioremap_nocache(chip->dsp_registers_phys, sz);
+	if (!chip->dsp_registers) {
+		dev_err(chip->card->dev, "ioremap failed\n");
+		snd_echo_free(chip);
+		return -ENOMEM;
+	}
 
 	if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
 			KBUILD_MODNAME, chip)) {

commit 228cd2dba27cee9956c1af97e6445be056881e41
Author: Kangjie Lu <kjlu@umn.edu>
Date:   Thu Mar 14 23:12:06 2019 -0500

    net: strparser: fix a missing check for create_singlethread_workqueue
    
    In case create_singlethread_workqueue fails, the check returns
    an error to callers to avoid potential NULL pointer dereferences.
    
    Signed-off-by: Kangjie Lu <kjlu@umn.edu>
    Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
index da1a676860ca..860dcfb95ee4 100644
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -550,6 +550,8 @@ EXPORT_SYMBOL_GPL(strp_check_rcv);
 static int __init strp_mod_init(void)
 {
 	strp_wq = create_singlethread_workqueue("kstrp");
+	if (unlikely(!strp_wq))
+		return -ENOMEM;
 
 	return 0;
 }

<<Prev 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18[19]20 21 22 23 24 25 26 27 28 29 30 Next>>