diff --git a/patches.suse/drivers-net-qlcnic-Fix-potential-memory-leak-in-qlcn.patch b/patches.suse/drivers-net-qlcnic-Fix-potential-memory-leak-in-qlcn.patch new file mode 100644 index 0000000..391948c --- /dev/null +++ b/patches.suse/drivers-net-qlcnic-Fix-potential-memory-leak-in-qlcn.patch @@ -0,0 +1,37 @@ +From b9b6752e5fd333fb88023cb5de4c1e6c0ce9d4e2 Mon Sep 17 00:00:00 2001 +From: Yuan Can +Date: Wed, 7 Dec 2022 08:54:10 +0000 +Subject: [PATCH 1/3] drivers: net: qlcnic: Fix potential memory leak in + qlcnic_sriov_init() +Patch-mainline: v6.2-rc1 +Git-commit: 01de1123322e4fe1bbd0fcdf0982511b55519c03 +References: jsc#PED-1523 + +If vp alloc failed in qlcnic_sriov_init(), all previously allocated vp +needs to be freed. + +Fixes: f197a7aa6288 ("qlcnic: VF-PF communication channel implementation") +Signed-off-by: Yuan Can +Reviewed-by: Leon Romanovsky +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +index 9282321c2e7f..f9dd50152b1e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c +@@ -221,6 +221,8 @@ int qlcnic_sriov_init(struct qlcnic_adapter *adapter, int num_vfs) + return 0; + + qlcnic_destroy_async_wq: ++ while (i--) ++ kfree(sriov->vf_info[i].vp); + destroy_workqueue(bc->bc_async_wq); + + qlcnic_destroy_trans_wq: +-- +2.16.4 + diff --git a/patches.suse/qlcnic-Clean-up-some-inconsistent-indenting.patch b/patches.suse/qlcnic-Clean-up-some-inconsistent-indenting.patch new file mode 100644 index 0000000..714f9f6 --- /dev/null +++ b/patches.suse/qlcnic-Clean-up-some-inconsistent-indenting.patch @@ -0,0 +1,38 @@ +From 9b9727caf629320b93afefc019ccfd644b609a81 Mon Sep 17 00:00:00 2001 +From: Jiapeng Chong +Date: Mon, 12 Dec 2022 13:58:13 +0800 +Subject: [PATCH 2/3] qlcnic: Clean up some inconsistent indenting +Patch-mainline: v6.2-rc1 +Git-commit: 02abf84aa52da86586ec6323969afa158ec6e4aa +References: jsc#PED-1523 + +No functional modification involved. + +drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c:714 qlcnic_validate_ring_count() warn: inconsistent indenting. + +Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3419 +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Link: https://lore.kernel.org/r/20221212055813.91154-1-jiapeng.chong@linux.alibaba.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +index 1ee491f78c6b..c1436e1554de 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c +@@ -711,7 +711,7 @@ static int qlcnic_validate_ring_count(struct qlcnic_adapter *adapter, + } + } + +- if (tx_ring != 0) { ++ if (tx_ring != 0) { + if (tx_ring > adapter->max_tx_rings) { + netdev_err(adapter->netdev, + "Invalid ring count, Tx ring count %d should not be greater than max %d driver Tx rings.\n", +-- +2.16.4 + diff --git a/patches.suse/qlcnic-prevent-dcb-use-after-free-on-qlcnic_dcb_enab.patch b/patches.suse/qlcnic-prevent-dcb-use-after-free-on-qlcnic_dcb_enab.patch new file mode 100644 index 0000000..efed019 --- /dev/null +++ b/patches.suse/qlcnic-prevent-dcb-use-after-free-on-qlcnic_dcb_enab.patch @@ -0,0 +1,103 @@ +From 6766b4ae84648a778c2c3f8b2e0c4561eb1ba37c Mon Sep 17 00:00:00 2001 +From: Daniil Tatianin +Date: Thu, 22 Dec 2022 14:52:28 +0300 +Subject: [PATCH 3/3] qlcnic: prevent ->dcb use-after-free on + qlcnic_dcb_enable() failure +Patch-mainline: v6.2-rc3 +Git-commit: 13a7c8964afcd8ca43c0b6001ebb0127baa95362 +References: jsc#PED-1523 + +adapter->dcb would get silently freed inside qlcnic_dcb_enable() in +case qlcnic_dcb_attach() would return an error, which always happens +under OOM conditions. This would lead to use-after-free because both +of the existing callers invoke qlcnic_dcb_get_info() on the obtained +pointer, which is potentially freed at that point. + +Propagate errors from qlcnic_dcb_enable(), and instead free the dcb +pointer at callsite using qlcnic_dcb_free(). This also removes the now +unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around +kfree() also causing memory leaks for partially initialized dcb. + +Found by Linux Verification Center (linuxtesting.org) with the SVACE +static analysis tool. + +Fixes: 3c44bba1d270 ("qlcnic: Disable DCB operations from SR-IOV VFs") +Reviewed-by: Michal Swiatkowski +Signed-off-by: Daniil Tatianin +Signed-off-by: David S. Miller +Signed-off-by: Denis Kirjanov +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 8 +++++++- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h | 10 ++-------- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 8 +++++++- + 3 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +index dbb800769cb6..c95d56e56c59 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +@@ -2505,7 +2505,13 @@ int qlcnic_83xx_init(struct qlcnic_adapter *adapter) + goto disable_mbx_intr; + + qlcnic_83xx_clear_function_resources(adapter); +- qlcnic_dcb_enable(adapter->dcb); ++ ++ err = qlcnic_dcb_enable(adapter->dcb); ++ if (err) { ++ qlcnic_dcb_free(adapter->dcb); ++ goto disable_mbx_intr; ++ } ++ + qlcnic_83xx_initialize_nic(adapter, 1); + qlcnic_dcb_get_info(adapter->dcb); + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +index 7519773eaca6..22afa2be85fd 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +@@ -41,11 +41,6 @@ struct qlcnic_dcb { + unsigned long state; + }; + +-static inline void qlcnic_clear_dcb_ops(struct qlcnic_dcb *dcb) +-{ +- kfree(dcb); +-} +- + static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb) + { + if (dcb && dcb->ops->get_hw_capability) +@@ -112,9 +107,8 @@ static inline void qlcnic_dcb_init_dcbnl_ops(struct qlcnic_dcb *dcb) + dcb->ops->init_dcbnl_ops(dcb); + } + +-static inline void qlcnic_dcb_enable(struct qlcnic_dcb *dcb) ++static inline int qlcnic_dcb_enable(struct qlcnic_dcb *dcb) + { +- if (dcb && qlcnic_dcb_attach(dcb)) +- qlcnic_clear_dcb_ops(dcb); ++ return dcb ? qlcnic_dcb_attach(dcb) : 0; + } + #endif +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +index 28476b982bab..44dac3c0908e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +@@ -2599,7 +2599,13 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + "Device does not support MSI interrupts\n"); + + if (qlcnic_82xx_check(adapter)) { +- qlcnic_dcb_enable(adapter->dcb); ++ err = qlcnic_dcb_enable(adapter->dcb); ++ if (err) { ++ qlcnic_dcb_free(adapter->dcb); ++ dev_err(&pdev->dev, "Failed to enable DCB\n"); ++ goto err_out_free_hw; ++ } ++ + qlcnic_dcb_get_info(adapter->dcb); + err = qlcnic_setup_intr(adapter); + +-- +2.16.4 + diff --git a/series.conf b/series.conf index 0aa9a6c..6fcf335 100644 --- a/series.conf +++ b/series.conf @@ -36414,6 +36414,8 @@ patches.suse/Bluetooth-hci_bcsp-don-t-call-kfree_skb-under-spin_l.patch patches.suse/Bluetooth-hci_core-don-t-call-kfree_skb-under-spin_l.patch patches.suse/Bluetooth-RFCOMM-don-t-call-kfree_skb-under-spin_loc.patch + patches.suse/qlcnic-Clean-up-some-inconsistent-indenting.patch + patches.suse/drivers-net-qlcnic-Fix-potential-memory-leak-in-qlcn.patch patches.suse/hamradio-don-t-call-dev_kfree_skb-under-spin_lock_ir.patch patches.suse/af_unix-call-proto_unregister-in-the-error-path-in-a.patch patches.suse/ipvs-fix-type-warning-in-do_div-on-32-bit.patch @@ -36710,6 +36712,7 @@ patches.suse/gpio-sifive-Fix-refcount-leak-in-sifive_gpio_probe.patch patches.suse/vmxnet3-correctly-report-csum_level-for-encapsulated.patch patches.suse/net-sched-fix-memory-leak-in-tcindex_set_parms.patch + patches.suse/qlcnic-prevent-dcb-use-after-free-on-qlcnic_dcb_enab.patch patches.suse/nfc-Fix-potential-resource-leaks.patch patches.suse/net-phy-xgmiitorgmii-Fix-refcount-leak-in-xgmiitorgm.patch patches.suse/dt-bindings-net-sun8i-emac-Add-phy-supply-property.patch