John David Anglin f8f519d7df parisc: Fix data TLB miss in sba_unmap_sg ... commit b7d6f44a0f upstream. Rolf Eike Beer reported the following bug: [1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 [1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 [1274934.746891] Hardware name: 9000/785/C8000 [1274934.746891] [1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI [1274934.746891] PSW: 00001000000001001111111000001110 Not tainted [1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 [1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 [1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 [1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 [1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 [1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 [1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 [1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 [1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 [1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [1274934.746891] [1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec [1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 [1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff [1274934.746891] ORIG_R28: 0000000040acdd58 [1274934.746891] IAOQ[0]: sba_unmap_sg+0xb0/0x118 [1274934.746891] IAOQ[1]: sba_unmap_sg+0xb4/0x118 [1274934.746891] RP(r2): sba_unmap_sg+0xac/0x118 [1274934.746891] Backtrace: [1274934.746891] [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70 [1274934.746891] [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60 [1274934.746891] [<00000000407a3488>] mptscsih_io_done+0x150/0xd70 [1274934.746891] [<0000000040798600>] mpt_interrupt+0x168/0xa68 [1274934.746891] [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278 [1274934.746891] [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8 [1274934.746891] [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0 [1274934.746891] [<00000000402548e0>] generic_handle_irq+0x50/0x70 [1274934.746891] [<000000004019a254>] call_on_stack+0x18/0x24 [1274934.746891] [1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?) The bug is caused by overrunning the sglist and incorrectly testing sg_dma_len(sglist) before nents. Normally this doesn't cause a crash, but in this case sglist crossed a page boundary. This occurs in the following code: while (sg_dma_len(sglist) && nents--) { The fix is simply to test nents first and move the decrement of nents into the loop. Reported-by: Rolf Eike Beer <eike-kernel@sf-tec.de> Signed-off-by: John David Anglin <dave.anglin@bell.net> Cc: stable@vger.kernel.org Signed-off-by: Helge Deller <deller@gmx.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-02-23 12:00:57 +01:00
..
accessibility	speakup-dectlk: Restore pitch setting	2022-02-16 12:54:30 +01:00
acpi	ACPI: PM: s2idle: Cancel wakeup before dispatching EC GPE	2022-02-16 12:54:24 +01:00
amba	ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"	2021-11-06 14:10:09 +01:00
android	binder: fix handling of error during copy	2022-01-27 10:54:06 +01:00
ata	libata: if T_LENGTH is zero, dma direction should be DMA_NONE	2021-12-22 09:30:58 +01:00
atm
auxdisplay	auxdisplay: ht16k33: Fix frame buffer device blanking	2021-11-18 14:04:24 +01:00
base	PM: s2idle: ACPI: Fix wakeup interrupts handling	2022-02-16 12:54:22 +01:00
bcma	bcma: Fix memory leak for internally-handled cores	2021-09-15 09:50:45 +02:00
block	floppy: Add max size check for user space request	2022-01-27 10:54:14 +01:00
bluetooth	Bluetooth: vhci: Set HCI_QUIRK_VALID_LE_STATES	2022-01-27 10:54:18 +01:00
bus	Revert "drivers: bus: simple-pm-bus: Add support for probing simple bus only devices"	2022-02-05 12:37:55 +01:00
cdrom
char	tpm: fix NPE on probe for missing device	2022-01-27 10:54:24 +01:00
clk	clk: si5341: Fix clock HW provider cleanup	2022-01-27 10:54:31 +01:00
clocksource	ARM: dts: Fix timer regression for beagleboard revision c	2022-02-16 12:54:22 +01:00
connector
counter	counter: stm32-lptimer-cnt: remove iio counter abi	2022-01-27 10:54:08 +01:00
cpufreq	cpufreq: Fix initialization of min and max frequency QoS requests	2022-01-27 10:54:17 +01:00
cpuidle	cpuidle: Fix kobject memory leaks in error paths	2021-11-18 14:04:05 +01:00
crypto	crypto: caam - replace this_cpu_ptr with raw_cpu_ptr	2022-01-27 10:54:24 +01:00
dax
dca
devfreq
dio
dma	dmaengine: at_xdmac: Fix at_xdmac_lld struct definition	2022-01-27 10:54:34 +01:00
dma-buf	dma-buf: heaps: Fix potential spectre v1 gadget	2022-02-08 18:30:36 +01:00
edac	EDAC/xgene: Fix deferred probing	2022-02-08 18:30:40 +01:00
eisa
extcon
firewire
firmware	efi/libstub: arm64: Fix image check alignment at entry	2022-02-01 17:25:46 +01:00
fpga	fpga: machxo2-spi: Fix missing error code in machxo2_write_complete()	2021-09-30 10:11:04 +02:00
fsi
gnss
gpio	gpio: sifive: use the correct register to read output values	2022-02-16 12:54:24 +01:00
gpu	drm/nouveau/pmu/gm200-: use alternate falcon reset sequence	2022-02-23 12:00:56 +01:00
greybus
hid	HID:Add support for UGTABLET WP5540	2022-02-23 12:00:57 +01:00
hsi	HSI: core: Fix return freed object in hsi_new_client	2022-01-27 10:54:12 +01:00
hv	hyperv/vmbus: include linux/bitops.h	2021-11-18 14:03:42 +01:00
hwmon	hwmon: (dell-smm) Speed up setting of fan speed	2022-02-16 12:54:30 +01:00
hwspinlock
hwtracing	coresight: cti: Correct the parameter for pm_runtime_put	2021-11-18 14:03:51 +01:00
i2c	i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters	2022-01-27 10:54:23 +01:00
i3c
ide
idle
iio	iio: adc: ti-adc081c: Partial revert of removal of ACPI IDs	2022-01-27 10:53:43 +01:00
infiniband	RDMA/mlx4: Don't continue event handler after memory allocation failure	2022-02-08 18:30:36 +01:00
input	Input: zinitix - make sure the IRQ is allocated before it gets enabled	2022-01-11 15:25:02 +01:00
interconnect	treewide: Change list_sort to use const pointers	2021-09-30 10:11:04 +02:00
iommu	iommu: Fix potential use-after-free during probe	2022-02-16 12:54:31 +01:00
ipack	ipack: ipoctal: fix module reference leak	2021-10-06 15:56:01 +02:00
irqchip	irqchip/gic-v4: Disable redistributors' view of the VPE table at boot time	2022-01-27 10:54:23 +01:00
isdn	mISDN: change function names to avoid conflicts	2022-01-11 15:25:02 +01:00
leds	leds: trigger: audio: Add an activate callback to ensure the initial brightness is set	2021-09-15 09:50:36 +02:00
lightnvm
macintosh
mailbox	soc: mediatek: cmdq: add address shift in jump	2021-09-18 13:40:16 +02:00
mcb	mcb: fix error handling in mcb_alloc_bus()	2021-09-30 10:11:00 +02:00
md	dm: fix alloc_dax error handling in alloc_dev	2022-01-27 10:54:22 +01:00
media	media: venus: core: Drop second v4l2 device unregister	2022-02-01 17:25:38 +01:00
memory	memory: renesas-rpc-if: Return error in case devm_ioremap_resource() fails	2022-01-27 10:53:48 +01:00
memstick	memstick: jmb38x_ms: use appropriate free function in jmb38x_ms_alloc_host()	2021-11-18 14:04:07 +01:00
message
mfd	mfd: atmel-flexcom: Use .resume_noirq	2022-01-27 10:53:51 +01:00
misc	eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX	2022-02-16 12:54:27 +01:00
mmc	mmc: sdhci-of-esdhc: Check for error num after setting mask	2022-02-16 12:54:16 +01:00
most	most: fix control-message timeouts	2021-11-18 14:03:51 +01:00
mtd	mtd: rawnand: mpc5121: Remove unused variable in ads5121_select_chip()	2022-02-01 17:25:48 +01:00
mux
net	net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup	2022-02-16 12:54:28 +01:00
nfc	NFC: st21nfca: Fix memory leak in device probe and remove	2022-01-05 12:40:31 +01:00
ntb	NTB: perf: Fix an error code in perf_setup_inbuf()	2021-09-22 12:28:02 +02:00
nubus
nvdimm	libnvdimm/pmem: Fix crash triggered when I/O in-flight during unbind	2021-09-18 13:40:36 +02:00
nvme	nvme-tcp: fix bogus request completion when failing to send AER	2022-02-16 12:54:22 +01:00
nvmem	nvmem: core: set size for sysfs bin file	2022-01-27 10:54:22 +01:00
of	of: base: Improve argument length mismatch error	2022-01-27 10:54:28 +01:00
opp	opp: Fix return in _opp_add_static_v2()	2021-11-18 14:04:22 +01:00
oprofile
parisc	parisc: Fix data TLB miss in sba_unmap_sg	2022-02-23 12:00:57 +01:00
parport	parport: remove non-zero check on count	2021-09-18 13:40:34 +02:00
pci	PCI: pciehp: Fix infinite loop in IRQ handler upon power fault	2022-02-05 12:37:54 +01:00
pcmcia	pcmcia: fix setting of kthread task states	2022-01-27 10:54:03 +01:00
perf
phy	phy: ti: Fix missing sentinel for clk_div_table	2022-02-16 12:54:30 +01:00
pinctrl	pinctrl: bcm2835: Fix a few error paths	2022-02-08 18:30:39 +01:00
platform	platform/x86: apple-gmux: use resource_size() with res	2022-01-05 12:40:29 +01:00
pnp
power	power: reset: mt6397: Check for null res pointer	2022-01-27 10:54:00 +01:00
powercap
pps
ps3
ptp	ptp_pch: Load module automatically if ID matches	2021-10-13 10:04:27 +02:00
pwm	pwm: stm32-lp: Don't modify HW state in .remove() callback	2021-09-26 14:09:01 +02:00
rapidio
ras
regulator	regulator: qcom_smd: Align probe function with rpmh-regulator	2022-01-27 10:54:20 +01:00
remoteproc	remoteproc: qcom: pil_info: Don't memcpy_toio more than is provided	2022-01-20 09:17:50 +01:00
reset	reset: socfpga: add empty driver allowing consumers to probe	2021-11-18 14:03:42 +01:00
rpmsg	rpmsg: char: Fix race between the release of rpmsg_eptdev and cdev	2022-02-01 17:25:43 +01:00
rtc	rtc: cmos: Evaluate century appropriate	2022-02-08 18:30:39 +01:00
s390	scsi: zfcp: Fix failed recovery on gone remote port with non-NPIV FCP devices	2022-02-01 17:25:39 +01:00
sbus
scsi	scsi: lpfc: Fix mailbox command failure during driver initialization	2022-02-23 12:00:57 +01:00
sfi
sh	maple: fix wrong return value of maple_bus_init().	2021-11-26 10:39:12 +01:00
siox
slimbus	slimbus: ngd: reset dma setup during runtime pm	2021-08-26 08:35:55 -04:00
soc	Revert "ASoC: mediatek: Check for error clk pointer"	2022-02-08 18:30:36 +01:00
soundwire	soundwire: debugfs: use controller id and link_id for debugfs	2021-11-18 14:04:16 +01:00
spi	spi: uniphier: fix reference count leak in uniphier_spi_probe()	2022-02-08 18:30:37 +01:00
spmi
ssb
staging	staging: fbtft: Fix error path in fbtft_driver_module_init()	2022-02-16 12:54:23 +01:00
target	scsi: target: iscsi: Make sure the np under each tpg is unique	2022-02-16 12:54:19 +01:00
tc
tee	tee: fix put order in teedev_close_context()	2022-01-27 10:53:49 +01:00
thermal	thermal/drivers/imx8mm: Enable ADC when enabling monitor	2022-01-27 10:53:52 +01:00
thunderbolt	thunderbolt: Runtime PM activate both ends of the device link	2022-01-27 10:54:14 +01:00
tty	serial: parisc: GSC: fix build when IOSAPIC is not set	2022-02-23 12:00:57 +01:00
uio
usb	USB: serial: cp210x: add CPI Bulk Coin Recycler id	2022-02-16 12:54:29 +01:00
vdpa	vdpa/mlx5: Fix wrong configuration of virtio_version_1_0	2022-01-27 10:54:33 +01:00
vfio	vfio: Use config not menuconfig for VFIO_NOIOMMU	2021-09-18 13:40:12 +02:00
vhost	vdpa: check that offsets are within bounds	2021-12-22 09:30:51 +01:00
video	fbcon: Add option to enable legacy hardware acceleration	2022-02-08 18:30:40 +01:00
virt
virtio	virtio_ring: mark ring unused on error	2022-01-27 10:54:33 +01:00
visorbus
vlynq
vme
w1	w1: Misuse of get_user()/put_user() reported by sparse	2022-01-27 10:54:22 +01:00
watchdog	ar7: fix kernel builds for compiler test	2021-11-18 14:04:24 +01:00
xen	xen/gntdev: fix unmap notification order	2022-01-27 10:54:24 +01:00
zorro
Kconfig
Makefile