3.18.64-stable review - take 2
Subsystems (2)
Greg Kroah-Hartman
maintainercover 3.18.64-stable review - take 2
This is the second start of the stable review cycle for the 3.18.64 release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.64-rc2.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.18.64-rc2
zheng li <[email protected]>
ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
Ard Biesheuvel <[email protected]>
mm: don't dereference struct page fields of invalid pages
Jamie Iles <[email protected]>
signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
Sudip Mukherjee <[email protected]>
lib/Kconfig.debug: fix frv build failure
Michal Hocko <[email protected]>
mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
Rabin Vincent <[email protected]>
ARM: 8632/1: ftrace: fix syscall name matching
Milan P. Gandhi <[email protected]>
scsi: qla2xxx: Get mutex lock before checking optrom_state
Nicholas Mc Guire <[email protected]>
x86/boot: Add missing declaration of string functions
Michael Chan <[email protected]>
tg3: Fix race condition in tg3_get_stats64().
Sergei Shtylyov <[email protected]>
sh_eth: R8A7740 supports packet shecksumming
Arnd Bergmann <[email protected]>
wext: handle NULL extra data in iwe_stream_add_point better
Wei Liu <[email protected]>
xen-netback: correctly schedule rate-limited queues
Florian Fainelli <[email protected]>
net: phy: Correctly process PHY_HALTED in phy_stop_machine()
Xin Long <[email protected]>
sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
Alexander Potapenko <[email protected]>
sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
Xin Long <[email protected]>
dccp: fix a memleak for dccp_feat_init err process
WANG Cong <[email protected]>
packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
Thomas Jarosch <[email protected]>
mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
WANG Cong <[email protected]>
rtnetlink: allocate more memory for dev_set_mac_address()
Mahesh Bandewar <[email protected]>
ipv4: initialize fib_trie prior to register_netdev_notifier call.
Sabrina Dubroca <[email protected]>
ipv6: avoid overflow of offset in ip6_find_1stfragopt
David S. Miller <[email protected]>
net: Zero terminate ifr_name in dev_ifname().
Jin Qian <[email protected]>
f2fs: sanity check checkpoint segno and blkoff
Nicholas Bellinger <[email protected]>
iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
Nicholas Bellinger <[email protected]>
iscsi-target: Fix initial login PDU asynchronous socket close OOPs
Nicholas Bellinger <[email protected]>
iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
Jiang Yi <[email protected]>
iscsi-target: Always wait for kthread_should_stop() before kthread exit
Nicholas Bellinger <[email protected]>
target: Avoid mappedlun symlink creation during lun shutdown
Prabhakar Lad <[email protected]>
media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
Jerry Lee <[email protected]>
ext4: fix overflow caused by missing cast in ext4_resize_fs()
Jan Kara <[email protected]>
ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
Josh Poimboeuf <[email protected]>
mm/page_alloc: Remove kernel address exposure in free_reserved_area()
Wanpeng Li <[email protected]>
KVM: async_pf: make rcu irq exit if not triggered from idle task
Banajit Goswami <[email protected]>
ASoC: do not close shared backend dailink
Sergei A. Trusov <[email protected]>
ALSA: hda - Fix speaker output from VAIO VPCL14M1R
Tejun Heo <[email protected]>
workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
Dan Carpenter <[email protected]>
libata: array underflow in ata_find_dev()
Chris Metcalf <[email protected]>
tile: use global strscpy() rather than private copy
Chris Metcalf <[email protected]>
arch/powerpc: provide zero_bytemask() for big-endian
Chris Metcalf <[email protected]>
Make asm/word-at-a-time.h available on all architectures
Chris Metcalf <[email protected]>
word-at-a-time.h: support zero_bytemask() on alpha and tile
Chris Metcalf <[email protected]>
tile: add <asm/word-at-a-time.h> and enable support functions
Steffen Klassert <[email protected]>
xfrm: Don't use sk_family for socket policy lookups
Mike Manning <[email protected]>
vlan: Propagate MAC address to VLANs
Phil Reid <[email protected]>
spi: dw: Make debugfs name unique between instances
Peter Ujfalusi <[email protected]>
ASoC: tlv320aic3x: Mark the RESET register as volatile
Arnd Bergmann <[email protected]>
vfio-pci: use 32-bit comparisons for register address for gcc-4.5
Jordan Crouse <[email protected]>
drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
Jordan Crouse <[email protected]>
drm/msm: Ensure that the hardware write pointer is valid
Leon Romanovsky <[email protected]>
net/mlx4: Remove BUG_ON from ICM allocation routine
Zheng Li <[email protected]>
ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
Pali Rohár <[email protected]>
ARM: dts: n900: Mark eMMC slot with no-sdio and no-sd flags
Chun-Hao Lin <[email protected]>
r8169: add support for RTL8168 series add-on card.
Thomas Gleixner <[email protected]>
x86/mce/AMD: Make the init code more robust
Jarkko Sakkinen <[email protected]>
tpm: fix a kernel memory leak in tpm-sysfs.c
Eric Dumazet <[email protected]>
net: skb_needs_check() accepts CHECKSUM_NONE for tx
Kees Cook <[email protected]>
pstore: Use dynamic spinlock initializer
Kees Cook <[email protected]>
pstore: Correctly initialize spinlock and flags
Joel Fernandes <[email protected]>
pstore: Allow prz to control need for locking
Andrzej Hajda <[email protected]>
v4l: s5c73m3: fix negation operator
Al Viro <[email protected]>
dentry name snapshots
Valentin Vidic <[email protected]>
ipmi/watchdog: fix watchdog timeout set on reboot
Daniel Borkmann <[email protected]>
net, sched: fix soft lockup in tc_classify
Ben Hutchings <[email protected]>
sh_eth: Fix ethtool operation crash when net device is down
Daniel Borkmann <[email protected]>
net: sctp: fix race for one-to-many sockets in sendmsg's auto associate
Jan Stancek <[email protected]>
ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc
Oliver Neukum <[email protected]>
kaweth: fix oops upon failed memory allocation
Oliver Neukum <[email protected]>
kaweth: fix firmware download
Calvin Owens <[email protected]>
mpt3sas: Don't overreach ioc->reply_post[] during initialization
Sudeep Holla <[email protected]>
mailbox: handle empty message in tx_tick
Sudeep Holla <[email protected]>
mailbox: skip complete wait event if timer expired
Sudeep Holla <[email protected]>
mailbox: always wait in mbox_send_message for blocking Tx mode
Lior David <[email protected]>
wil6210: fix deadlock when using fw_no_recovery option
Annie Cherkaev <[email protected]>
isdn/i4l: fix buffer overflow
Chris Metcalf <[email protected]>
strscpy: zero any trailing garbage bytes in the destination
Chris Metcalf <[email protected]>
string: provide strscpy()
Jia-Ju Bai <[email protected]>
isdn: Fix a sleep-in-atomic bug
Florian Fainelli <[email protected]>
net: phy: Do not perform software reset for Generic PHY
Al Viro <[email protected]>
Bluetooth: cmtp: cmtp_add_connection() should verify that it's dealing with l2cap socket
Johan Hedberg <[email protected]>
Bluetooth: Fix potential NULL dereference
Al Viro <[email protected]>
Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket
Cheah Kok Cheong <[email protected]>
Staging: comedi: comedi_fops: Avoid orphaned proc entry
Greg Kroah-Hartman <[email protected]>
Revert "powerpc/numa: Fix percpu allocations to be NUMA aware"
Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Save/restore host values of debug registers
Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Reload HTM registers explicitly
Paul Mackerras <[email protected]>
KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
Sinclair Yeh <[email protected]>
drm/vmwgfx: Fix gcc-7.1.1 warning
Ofer Heifetz <[email protected]>
md/raid5: add thread_group worker async_tx_issue_pending_all
Laurent Vivier <[email protected]>
powerpc/pseries: Fix of_node_put() underflow during reconfig remove
Eric Dumazet <[email protected]>
net: reduce skb_warn_bad_offload() noise
Joel Fernandes <[email protected]>
pstore: Make spinlock per zone instead of global
Yuejie Shi <[email protected]>
af_key: Add lock to key dump
-------------
Diffstat:
Makefile | 4 +- arch/alpha/include/asm/word-at-a-time.h | 2 + arch/arc/include/asm/Kbuild | 1 + arch/arm/boot/dts/omap3-n900.dts | 2 + arch/arm/include/asm/ftrace.h | 18 +++ arch/avr32/include/asm/Kbuild | 1 + arch/blackfin/include/asm/Kbuild | 1 + arch/c6x/include/asm/Kbuild | 1 + arch/cris/include/asm/Kbuild | 1 + arch/frv/include/asm/Kbuild | 1 + arch/hexagon/include/asm/Kbuild | 1 + arch/ia64/include/asm/Kbuild | 1 + arch/m32r/include/asm/Kbuild | 1 + arch/metag/include/asm/Kbuild | 1 + arch/microblaze/include/asm/Kbuild | 1 + arch/mips/include/asm/Kbuild | 1 + arch/mn10300/include/asm/Kbuild | 1 + arch/powerpc/include/asm/Kbuild | 1 + arch/powerpc/include/asm/topology.h | 14 -- arch/powerpc/include/asm/word-at-a-time.h | 5 + arch/powerpc/kernel/setup_64.c | 4 +- arch/powerpc/kvm/book3s_hv.c | 29 +++- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 37 ++++- arch/powerpc/platforms/pseries/reconfig.c | 1 - arch/s390/include/asm/Kbuild | 1 + arch/score/include/asm/Kbuild | 1 + arch/tile/Kconfig | 2 + arch/tile/gxio/mpipe.c | 33 +--- arch/tile/include/asm/Kbuild | 1 + arch/tile/include/asm/uaccess.h | 66 ++------ arch/tile/include/asm/word-at-a-time.h | 42 ++++++ arch/tile/lib/exports.c | 2 - arch/tile/lib/usercopy_32.S | 46 ------ arch/tile/lib/usercopy_64.S | 46 ------ arch/um/include/asm/Kbuild | 1 + arch/unicore32/include/asm/Kbuild | 1 + arch/x86/boot/string.c | 1 + arch/x86/boot/string.h | 9 ++ arch/x86/kernel/cpu/mcheck/mce_amd.c | 3 + arch/x86/kernel/kvm.c | 6 +- arch/xtensa/include/asm/Kbuild | 1 + drivers/ata/libata-scsi.c | 6 +- drivers/char/ipmi/ipmi_watchdog.c | 7 +- drivers/char/tpm/tpm-sysfs.c | 2 + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 +- drivers/gpu/drm/msm/msm_gem_submit.c | 3 +- drivers/gpu/drm/msm/msm_ringbuffer.c | 3 +- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- drivers/isdn/i4l/isdn_common.c | 1 + drivers/isdn/i4l/isdn_net.c | 5 +- drivers/isdn/i4l/isdn_ppp.c | 2 +- drivers/mailbox/mailbox.c | 13 +- drivers/md/raid5.c | 2 + drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c | 2 +- drivers/media/platform/davinci/vpfe_capture.c | 22 +-- drivers/net/ethernet/broadcom/tg3.c | 3 + drivers/net/ethernet/mellanox/mlx4/icm.c | 7 +- drivers/net/ethernet/realtek/r8169.c | 1 + drivers/net/ethernet/renesas/sh_eth.c | 11 ++ drivers/net/irda/mcs7780.c | 16 +- drivers/net/phy/phy.c | 3 + drivers/net/phy/phy_device.c | 2 +- drivers/net/usb/kaweth.c | 10 +- drivers/net/wireless/ath/wil6210/main.c | 15 +- drivers/net/xen-netback/common.h | 1 + drivers/net/xen-netback/interface.c | 6 +- drivers/net/xen-netback/netback.c | 6 +- drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++-- drivers/scsi/qla2xxx/qla_attr.c | 18 ++- drivers/spi/spi-dw.c | 5 +- drivers/staging/comedi/comedi_fops.c | 6 +- drivers/target/iscsi/iscsi_target.c | 38 ++++- drivers/target/iscsi/iscsi_target_core.h | 1 + drivers/target/iscsi/iscsi_target_erl0.c | 6 +- drivers/target/iscsi/iscsi_target_erl0.h | 2 +- drivers/target/iscsi/iscsi_target_login.c | 4 + drivers/target/iscsi/iscsi_target_nego.c | 208 +++++++++++++++++--------- drivers/target/target_core_fabric_configfs.c | 5 + drivers/target/target_core_tpg.c | 3 + drivers/vfio/pci/vfio_pci_rdwr.c | 5 +- fs/dcache.c | 27 ++++ fs/debugfs/inode.c | 10 +- fs/ext4/file.c | 3 + fs/ext4/resize.c | 3 +- fs/f2fs/super.c | 16 ++ fs/namei.c | 8 +- fs/notify/fsnotify.c | 8 +- fs/pstore/ram.c | 5 +- fs/pstore/ram_core.c | 25 ++-- include/asm-generic/word-at-a-time.h | 80 +++++++++- include/linux/dcache.h | 7 + include/linux/fsnotify.h | 31 ---- include/linux/phy.h | 4 + include/linux/pstore_ram.h | 11 +- include/linux/sched.h | 10 ++ include/linux/slab.h | 4 +- include/linux/string.h | 3 + include/net/iw_handler.h | 3 +- include/net/sctp/sctp.h | 4 + include/target/target_core_base.h | 1 + kernel/signal.c | 4 +- kernel/workqueue.c | 10 ++ lib/Kconfig.debug | 2 +- lib/string.c | 89 +++++++++++ mm/page_alloc.c | 10 +- net/8021q/vlan.c | 5 + net/8021q/vlan.h | 2 + net/8021q/vlan_dev.c | 20 ++- net/bluetooth/bnep/core.c | 10 +- net/bluetooth/cmtp/core.c | 3 + net/core/dev.c | 19 ++- net/core/dev_ioctl.c | 1 + net/core/rtnetlink.c | 3 +- net/dccp/feat.c | 7 +- net/ipv4/fib_frontend.c | 9 +- net/ipv4/ip_output.c | 2 +- net/ipv6/ip6_flowlabel.c | 4 +- net/ipv6/ip6_output.c | 2 +- net/ipv6/output_core.c | 8 +- net/key/af_key.c | 46 +++++- net/packet/af_packet.c | 2 +- net/sched/cls_api.c | 4 +- net/sctp/socket.c | 8 +- net/xfrm/xfrm_policy.c | 9 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tlv320aic3x.c | 13 ++ sound/soc/soc-pcm.c | 4 + 127 files changed, 960 insertions(+), 486 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/92 af_key: Add lock to key dump
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuejie Shi <[email protected]>
commit 89e357d83c06b6fac581c3ca7f0ee3ae7e67109e upstream.
A dump may come in the middle of another dump, modifying its dump structure members. This race condition will result in NULL pointer dereference in kernel. So add a lock to prevent that race.
--- net/key/af_key.c | 46 ++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 38 insertions(+), 8 deletions(-)
net/key/af_key.c +38 -8
@@ -63,6 +63,7 @@ struct pfkey_sock { } u;struct sk_buff *skb; } dump; +struct mutex dump_lock; }; static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len,
@@ -143,6 +144,7 @@ static int pfkey_create(struct net *net, {struct netns_pfkey *net_pfkey =net_generic (net, pfkey_net_id);struct sock *sk; +struct pfkey_sock *pfk;int err;if (!ns_capable (net->user_ns,CAP_NET_ADMIN ))
@@ -157,6 +159,9 @@ static int pfkey_create(struct net *net,if (sk ==NULL ) goto out; + pfk =pfkey_sk (sk); +mutex_init (&pfk->dump_lock); + sock->ops = &pfkey_ops;sock_init_data (sock, sk);
@@ -285,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sostruct sadb_msg *hdr;int rc; +mutex_lock (&pfk->dump_lock); +if (!pfk->dump.dump) { + rc =0 ; + goto out; + } + rc = pfk->dump.dump (pfk); -if (rc == -ENOBUFS ) -return 0 ; +if (rc == -ENOBUFS ) { + rc =0 ; + goto out; + }if (pfk->dump.skb) { -if (!pfkey_can_dump (&pfk->sk)) -return 0 ; +if (!pfkey_can_dump (&pfk->sk)) { + rc =0 ; + goto out; + } hdr = (struct sadb_msg *) pfk->dump.skb->data; hdr->sadb_msg_seq =0 ;
@@ -302,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_so }pfkey_terminate_dump (pfk); + +out: +mutex_unlock (&pfk->dump_lock);return rc; }
@@ -1805,19 +1823,26 @@ static int pfkey_dump(struct sock *sk, sstruct xfrm_address_filter *filter =NULL ;struct pfkey_sock *pfk =pfkey_sk (sk); -if (pfk->dump.dump !=NULL ) +mutex_lock (&pfk->dump_lock); +if (pfk->dump.dump !=NULL ) { +mutex_unlock (&pfk->dump_lock);return -EBUSY ; + } proto =pfkey_satype2proto (hdr->sadb_msg_satype); -if (proto ==0 ) +if (proto ==0 ) { +mutex_unlock (&pfk->dump_lock);return -EINVAL ; + }if (ext_hdrs[SADB_X_EXT_FILTER -1 ]) {struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER -1 ]; filter =kmalloc (sizeof (*filter),GFP_KERNEL ); -if (filter ==NULL ) +if (filter ==NULL ) { +mutex_unlock (&pfk->dump_lock);return -ENOMEM ; + }memcpy (&filter->saddr, &xfilter->sadb_x_filter_saddr,sizeof (xfrm_address_t));
@@ -1833,6 +1858,7 @@ static int pfkey_dump(struct sock *sk, s pfk->dump.dump = pfkey_dump_sa; pfk->dump.done = pfkey_dump_sa_done;xfrm_state_walk_init (&pfk->dump.u.state, proto, filter); +mutex_unlock (&pfk->dump_lock);return pfkey_do_dump (pfk); }
@@ -2692,14 +2718,18 @@ static int pfkey_spddump(struct sock *sk {struct pfkey_sock *pfk =pfkey_sk (sk); -if (pfk->dump.dump !=NULL ) +mutex_lock (&pfk->dump_lock); +if (pfk->dump.dump !=NULL ) { +mutex_unlock (&pfk->dump_lock);return -EBUSY ; + } pfk->dump.msg_version = hdr->sadb_msg_version; pfk->dump.msg_portid = hdr->sadb_msg_pid; pfk->dump.dump = pfkey_dump_sp; pfk->dump.done = pfkey_dump_sp_done;xfrm_policy_walk_init (&pfk->dump.u.policy,XFRM_POLICY_TYPE_MAIN ); +mutex_unlock (&pfk->dump_lock);return pfkey_do_dump (pfk); }
Greg Kroah-Hartman
maintainerPATCH 2/92 pstore: Make spinlock per zone instead of global
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes <[email protected]>
commit 109704492ef637956265ec2eb72ae7b3b39eb6f4 upstream.
Currently pstore has a global spinlock for all zones. Since the zones are independent and modify different areas of memory, there's no need to have a global lock, so we should use a per-zone lock as introduced here. Also, when ramoops's ftrace use-case has a FTRACE_PER_CPU flag introduced later, which splits the ftrace memory area into a single zone per CPU, it will eliminate the need for locking. In preparation for this, make the locking optional.
--- fs/pstore/ram_core.c | 11 +++++------ include/linux/pstore_ram.h | 1 + 2 files changed, 6 insertions(+), 6 deletions(-)
fs/pstore/ram_core.c +5 -6
@@ -80,8 +80,6 @@ static void buffer_size_add_atomic(struc }while (atomic_cmpxchg (&prz->buffer->size, old, new) != old); } -static DEFINE_RAW_SPINLOCK (buffer_lock); -/* increase and wrap the start pointer, returning the old value */ static size_t buffer_start_add_locked (struct persistent_ram_zone *prz,size_t a) {
@@ -89,7 +87,7 @@ static size_t buffer_start_add_locked(stint new;unsigned long flags; -raw_spin_lock_irqsave (&buffer_lock, flags); +raw_spin_lock_irqsave (&prz->buffer_lock, flags); old =atomic_read (&prz->buffer->start); new = old + a;
@@ -97,7 +95,7 @@ static size_t buffer_start_add_locked(st new -= prz->buffer_size;atomic_set (&prz->buffer->start, new); -raw_spin_unlock_irqrestore (&buffer_lock, flags); +raw_spin_unlock_irqrestore (&prz->buffer_lock, flags);return old; }
@@ -109,7 +107,7 @@ static void buffer_size_add_locked(strucsize_t new;unsigned long flags; -raw_spin_lock_irqsave (&buffer_lock, flags); +raw_spin_lock_irqsave (&prz->buffer_lock, flags); old =atomic_read (&prz->buffer->size);if (old == prz->buffer_size)
@@ -121,7 +119,7 @@ static void buffer_size_add_locked(strucatomic_set (&prz->buffer->size, new); exit: -raw_spin_unlock_irqrestore (&buffer_lock, flags); +raw_spin_unlock_irqrestore (&prz->buffer_lock, flags); }static size_t (*buffer_start_add)(struct persistent_ram_zone *,size_t ) = buffer_start_add_atomic;
@@ -489,6 +487,7 @@ static int persistent_ram_post_init(stru prz->buffer->sig = sig;persistent_ram_zap (prz); + prz->buffer_lock =__RAW_SPIN_LOCK_UNLOCKED (buffer_lock);return 0 ; }
include/linux/pstore_ram.h +1 -0
@@ -39,6 +39,7 @@ struct persistent_ram_zone {void *vaddr;struct persistent_ram_buffer *buffer;size_t buffer_size; +raw_spinlock_t buffer_lock;/* ECC correction */ char *par_buffer;
Greg Kroah-Hartman
maintainerPATCH 3/92 net: reduce skb_warn_bad_offload() noise
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit b2504a5dbef3305ef41988ad270b0e8ec289331c upstream.
Dmitry reported warnings occurring in __skb_gso_segment() [1]
All SKB_GSO_DODGY producers can allow user space to feed packets that trigger the current check.
We could prevent them from doing so, rejecting packets, but this might add regressions to existing programs.
It turns out our SKB_GSO_DODGY handlers properly set up checksum information that is needed anyway when packets needs to be segmented.
By checking again skb_needs_check() after skb_mac_gso_segment(), we should remove these pesky warnings, at a very minor cost.
With help from Willem de Bruijn
[1]
WARNING: CPU: 1 PID: 6768 at net/core/dev.c:2439 skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434 lo: caps=(0x000000a2803b7c69, 0x0000000000000000) len=138 data_len=0 gso_size=15883 gso_type=4 ip_summed=0 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 6768 Comm: syz-executor1 Not tainted 4.9.0 #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801c063ecd8 ffffffff82346bdf ffffffff00000001 1ffff100380c7d2e ffffed00380c7d26 0000000041b58ab3 ffffffff84b37e38 ffffffff823468f1 ffffffff84820740 ffffffff84f289c0 dffffc0000000000 ffff8801c063ee20 Call Trace: [<ffffffff82346bdf>] __dump_stack lib/dump_stack.c:15 [inline] [<ffffffff82346bdf>] dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 [<ffffffff81827e34>] panic+0x1fb/0x412 kernel/panic.c:179 [<ffffffff8141f704>] __warn+0x1c4/0x1e0 kernel/panic.c:542 [<ffffffff8141f7e5>] warn_slowpath_fmt+0xc5/0x100 kernel/panic.c:565 [<ffffffff8356cbaf>] skb_warn_bad_offload+0x2af/0x390 net/core/dev.c:2434 [<ffffffff83585cd2>] __skb_gso_segment+0x482/0x780 net/core/dev.c:2706 [<ffffffff83586f19>] skb_gso_segment include/linux/netdevice.h:3985 [inline] [<ffffffff83586f19>] validate_xmit_skb+0x5c9/0xc20 net/core/dev.c:2969 [<ffffffff835892bb>] __dev_queue_xmit+0xe6b/0x1e70 net/core/dev.c:3383 [<ffffffff8358a2d7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3424 [<ffffffff83ad161d>] packet_snd net/packet/af_packet.c:2930 [inline] [<ffffffff83ad161d>] packet_sendmsg+0x32ed/0x4d30 net/packet/af_packet.c:2955 [<ffffffff834f0aaa>] sock_sendmsg_nosec net/socket.c:621 [inline] [<ffffffff834f0aaa>] sock_sendmsg+0xca/0x110 net/socket.c:631 [<ffffffff834f329a>] ___sys_sendmsg+0x8fa/0x9f0 net/socket.c:1954 [<ffffffff834f5e58>] __sys_sendmsg+0x138/0x300 net/socket.c:1988 [<ffffffff834f604d>] SYSC_sendmsg net/socket.c:1999 [inline] [<ffffffff834f604d>] SyS_sendmsg+0x2d/0x50 net/socket.c:1995 [<ffffffff84371941>] entry_SYSCALL_64_fastpath+0x1f/0xc2
--- net/core/dev.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
net/core/dev.c +9 -3
@@ -2454,11 +2454,12 @@ static inline bool skb_needs_check(strucstruct sk_buff *__skb_gso_segment (struct sk_buff *skb,netdev_features_t features,bool tx_path) { +struct sk_buff *segs; +if (unlikely (skb_needs_check (skb, tx_path))) {int err; -skb_warn_bad_offload (skb); - +/* We're going to init ->check field in TCP or UDP header */ err =skb_cow_head (skb,0 );if (err <0 )return ERR_PTR (err);
@@ -2470,7 +2471,12 @@ struct sk_buff *__skb_gso_segment(structskb_reset_mac_header (skb);skb_reset_mac_len (skb); -return skb_mac_gso_segment (skb, features); + segs =skb_mac_gso_segment (skb, features); + +if (unlikely (skb_needs_check (skb, tx_path))) +skb_warn_bad_offload (skb); + +return segs; }EXPORT_SYMBOL (__skb_gso_segment);
Greg Kroah-Hartman
maintainerPATCH 4/92 powerpc/pseries: Fix of_node_put() underflow during reconfig remove
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Vivier <[email protected]>
commit 4fd1bd443e80b12f0a01a45fb9a793206b41cb72 upstream.
As for commit 68baf692c435 ("powerpc/pseries: Fix of_node_put() underflow during DLPAR remove"), the call to of_node_put() must be removed from pSeries_reconfig_remove_node().
dlpar_detach_node() and pSeries_reconfig_remove_node() both call of_detach_node(), and thus the node should not be released in both cases.
--- arch/powerpc/platforms/pseries/reconfig.c | 1 - 1 file changed, 1 deletion(-)
arch/powerpc/platforms/pseries/reconfig.c +0 -1
@@ -112,7 +112,6 @@ static int pSeries_reconfig_remove_node(of_detach_node (np);of_node_put (parent); -of_node_put (np);/* Must decrement the refcount */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 5/92 md/raid5: add thread_group worker async_tx_issue_pending_all
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ofer Heifetz <[email protected]>
commit 7e96d559634b73a8158ee99a7abece2eacec2668 upstream.
Since thread_group worker and raid5d kthread are not in sync, if worker writes stripe before raid5d then requests will be waiting for issue_pendig.
Issue observed when building raid5 with ext4, in some build runs jbd2 would get hung and requests were waiting in the HW engine waiting to be issued.
Fix this by adding a call to async_tx_issue_pending_all in the raid5_do_work.
--- drivers/md/raid5.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/raid5.c +2 -0
@@ -5224,6 +5224,8 @@ static void raid5_do_work(struct work_stpr_debug ("%d stripes handled\n" , handled);spin_unlock_irq (&conf->device_lock); + +async_tx_issue_pending_all ();blk_finish_plug (&plug);pr_debug ("--- raid5worker inactive\n" );
Greg Kroah-Hartman
maintainerPATCH 6/92 drm/vmwgfx: Fix gcc-7.1.1 warning
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <[email protected]>
commit fcfffdd8f98ac305285dca568b5065ef86be6458 upstream.
The current code does not look correct, and the reason for it is probably lost. Since this now generates a compiler warning, fix it to what makes sense.
--- drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +1 -1
@@ -285,7 +285,7 @@ static int vmw_cmd_invalid(struct vmw_prstruct vmw_sw_context *sw_context, SVGA3dCmdHeader *header) { - return capable(CAP_SYS_ADMIN) ? : -EINVAL; + return -EINVAL; } static int vmw_cmd_ok(struct vmw_private *dev_priv,
Greg Kroah-Hartman
maintainerPATCH 7/92 KVM: PPC: Book3S HV: Restore critical SPRs to host values on guest exit
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <[email protected]>
commit 4c3bb4ccd074e1a0552078c0bf94c662367a1658 upstream.
This restores several special-purpose registers (SPRs) to sane values on guest exit that were missed before.
TAR and VRSAVE are readable and writable by userspace, and we need to save and restore them to prevent the guest from potentially affecting userspace execution (not that TAR or VRSAVE are used by any known program that run uses the KVM_RUN ioctl). We save/restore these in kvmppc_vcpu_run_hv() rather than on every guest entry/exit.
FSCR affects userspace execution in that it can prohibit access to certain facilities by userspace. We restore it to the normal value for the task on exit from the KVM_RUN ioctl.
IAMR is normally 0, and is restored to 0 on guest exit. However, with a radix host on POWER9, it is set to a value that prevents the kernel from executing user-accessible memory. On POWER9, we save IAMR on guest entry and restore it on guest exit to the saved value rather than 0. On POWER8 we continue to set it to 0 on guest exit.
PSPB is normally 0. We restore it to 0 on guest exit to prevent userspace taking advantage of the guest having set it non-zero (which would allow userspace to set its SMT priority to high).
UAMOR is normally 0. We restore it to 0 on guest exit to prevent the AMR from being used as a covert channel between userspace processes, since the AMR is not context-switched at present.
[[email protected] - removed IAMR bits that are only needed on POWER9;
adjusted FSCR save/restore for lack of fscr field in thread_struct.]
--- arch/powerpc/kvm/book3s_hv.c | 13 +++++++++++-- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 2 ++ 2 files changed, 13 insertions(+), 2 deletions(-)
arch/powerpc/kvm/book3s_hv.c +11 -2
@@ -1951,6 +1951,9 @@ static int kvmppc_vcpu_run_hv(struct kvmint r;int srcu_idx;unsigned long ebb_regs[3 ] = {};/* shut up GCC */ +unsigned long user_tar =0 ; +unsigned long proc_fscr =0 ; +unsigned int user_vrsave;if (!vcpu->arch.sane) { run->exit_reason =KVM_EXIT_INTERNAL_ERROR ;
@@ -2001,12 +2004,15 @@ static int kvmppc_vcpu_run_hv(struct kvmflush_altivec_to_thread (current);flush_vsx_to_thread (current); -/* Save userspace EBB register values */ +/* Save userspace EBB and other register values */ if (cpu_has_feature (CPU_FTR_ARCH_207S )) { ebb_regs[0 ] =mfspr (SPRN_EBBHR ); ebb_regs[1 ] =mfspr (SPRN_EBBRR ); ebb_regs[2 ] =mfspr (SPRN_BESCR ); + user_tar =mfspr (SPRN_TAR ); + proc_fscr =mfspr (SPRN_FSCR ); } + user_vrsave =mfspr (SPRN_VRSAVE ); vcpu->arch.wqp = &vcpu->arch.vcore->wq; vcpu->arch.pgdir = current->mm->pgd;
@@ -2027,12 +2033,15 @@ static int kvmppc_vcpu_run_hv(struct kvm } }while (is_kvmppc_resume_guest (r)); -/* Restore userspace EBB register values */ +/* Restore userspace EBB and other register values */ if (cpu_has_feature (CPU_FTR_ARCH_207S )) {mtspr (SPRN_EBBHR , ebb_regs[0 ]);mtspr (SPRN_EBBRR , ebb_regs[1 ]);mtspr (SPRN_BESCR , ebb_regs[2 ]); +mtspr (SPRN_TAR , user_tar); +mtspr (SPRN_FSCR , proc_fscr); } +mtspr (SPRN_VRSAVE , user_vrsave); out: vcpu->arch.state =KVMPPC_VCPU_NOTREADY ;
arch/powerpc/kvm/book3s_hv_rmhandlers.S +2 -0
@@ -1182,6 +1182,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) mtspr SPRN_IAMR, r0 mtspr SPRN_CIABR, r0 mtspr SPRN_DAWRX, r0 + mtspr SPRN_PSPB, r0 mtspr SPRN_TCSCR, r0 mtspr SPRN_WORT, r0 /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */
@@ -1198,6 +1199,7 @@ BEGIN_FTR_SECTION std r6,VCPU_UAMOR(r9) li r6,0 mtspr SPRN_AMR,r6 + mtspr SPRN_UAMOR, r6 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) /* Switch DSCR back to host value */
Greg Kroah-Hartman
maintainerPATCH 8/92 KVM: PPC: Book3S HV: Reload HTM registers explicitly
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <[email protected]>
Commit 46a704f8409f ("KVM: PPC: Book3S HV: Preserve userspace HTM state properly", 2017-06-15) added code which assumes that the kernel is able to handle a TM (transactional memory) unavailable interrupt from userspace by reloading the TM-related registers and enabling TM for the process. That ability was added in the 4.9 kernel; earlier kernel versions simply panic on getting the TM unavailable interrupt.
Since commit 46a704f8409f has been backported to the 3.18 stable tree as commit 0b423daba180, 3.18.59 and subsequent versions are vulnerable to a userspace-triggerable panic.
This patch fixes the problem by explicitly reloading the TM-related registers before returning to userspace, rather than disabling TM for the process.
Commit 46a704f8409f also failed to enable TM for the kernel, leading to a TM unavailable interrupt in the kernel, causing an oops. This fixes that problem too, by enabling TM before accessing the TM registers. That problem is fixed upstream by the patch "KVM: PPC:
Book3S HV: Enable TM before accessing TM registers".
--- arch/powerpc/kvm/book3s_hv.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
arch/powerpc/kvm/book3s_hv.c +15 -1
@@ -1974,10 +1974,11 @@ static int kvmppc_vcpu_run_hv(struct kvm run->fail_entry.hardware_entry_failure_reason =0 ;return -EINVAL ; } +/* Enable TM so we can read the TM SPRs */ +mtmsr (mfmsr () |MSR_TM ); current->thread.tm_tfhar =mfspr (SPRN_TFHAR ); current->thread.tm_tfiar =mfspr (SPRN_TFIAR ); current->thread.tm_texasr =mfspr (SPRN_TEXASR ); - current->thread.regs->msr &= ~MSR_TM ; }#endif
@@ -2043,6 +2044,19 @@ static int kvmppc_vcpu_run_hv(struct kvm }mtspr (SPRN_VRSAVE , user_vrsave); +/* +* Since we don't do lazy TM reload, we need to reload +* the TM registers here. +*/ +#ifdef CONFIG_PPC_TRANSACTIONAL_MEM +if (cpu_has_feature (CPU_FTR_TM ) && current->thread.regs && + (current->thread.regs->msr &MSR_TM )) { +mtspr (SPRN_TFHAR , current->thread.tm_tfhar); +mtspr (SPRN_TFIAR , current->thread.tm_tfiar); +mtspr (SPRN_TEXASR , current->thread.tm_texasr); + } +#endif + out: vcpu->arch.state =KVMPPC_VCPU_NOTREADY ;atomic_dec (&vcpu->kvm->arch.vcpus_running);
Greg Kroah-Hartman
maintainerPATCH 9/92 KVM: PPC: Book3S HV: Save/restore host values of debug registers
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Mackerras <[email protected]>
commit 7ceaa6dcd8c6f59588428cec37f3c8093dd1011f upstream.
At present, HV KVM on POWER8 and POWER9 machines loses any instruction or data breakpoint set in the host whenever a guest is run. Instruction breakpoints are currently only used by xmon, but ptrace and the perf_event subsystem can set data breakpoints as well as xmon.
To fix this, we save the host values of the debug registers (CIABR, DAWR and DAWRX) before entering the guest and restore them on exit. To provide space to save them in the stack frame, we expand the stack frame allocated by kvmppc_hv_entry() from 112 to 144 bytes.
[[email protected] - Adjusted stack offsets since we aren't saving
POWER9-specific registers.]
--- arch/powerpc/kvm/book3s_hv_rmhandlers.S | 35 +++++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-)
arch/powerpc/kvm/book3s_hv_rmhandlers.S +30 -5
@@ -36,6 +36,12 @@ #define NAPPING_CEDE 1 #define NAPPING_NOVCPU 2 +/* Stack frame offsets for kvmppc_hv_entry */ +#define SFS 112 +#define STACK_SLOT_CIABR (SFS-16) +#define STACK_SLOT_DAWR (SFS-24) +#define STACK_SLOT_DAWRX (SFS-32) + /* * Call kvmppc_hv_entry in real mode. * Must be called with interrupts hard-disabled.
@@ -360,7 +366,7 @@ kvmppc_hv_entry: */ mflr r0 std r0, PPC_LR_STKOFF(r1) - stdu r1, -112(r1) + stdu r1, -SFS(r1) /* Save R1 in the PACA */ std r1, HSTATE_HOST_R1(r13)
@@ -618,6 +624,16 @@ BEGIN_FTR_SECTION mtspr SPRN_SPURR,r8 END_FTR_SECTION_IFSET(CPU_FTR_ARCH_206) + /* Save host values of some registers */ +BEGIN_FTR_SECTION + mfspr r5, SPRN_CIABR + mfspr r6, SPRN_DAWR + mfspr r7, SPRN_DAWRX + std r5, STACK_SLOT_CIABR(r1) + std r6, STACK_SLOT_DAWR(r1) + std r7, STACK_SLOT_DAWRX(r1) +END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) + BEGIN_FTR_SECTION /* Set partition DABR */ /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */
@@ -1180,8 +1196,6 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) */ li r0, 0 mtspr SPRN_IAMR, r0 - mtspr SPRN_CIABR, r0 - mtspr SPRN_DAWRX, r0 mtspr SPRN_PSPB, r0 mtspr SPRN_TCSCR, r0 mtspr SPRN_WORT, r0
@@ -1358,6 +1372,17 @@ hdec_soon: /* r12 = trap, r13 = paca * BEGIN_FTR_SECTION b 32f END_FTR_SECTION_IFSET(CPU_FTR_ARCH_201) + + /* Restore host values of some registers */ +BEGIN_FTR_SECTION + ld r5, STACK_SLOT_CIABR(r1) + ld r6, STACK_SLOT_DAWR(r1) + ld r7, STACK_SLOT_DAWRX(r1) + mtspr SPRN_CIABR, r5 + mtspr SPRN_DAWR, r6 + mtspr SPRN_DAWRX, r7 +END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) + /* * POWER7 guest -> host partition switch code. * We don't have to lock against tlbies but we do
@@ -1584,8 +1609,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) li r0, KVM_GUEST_MODE_NONE stb r0, HSTATE_IN_GUEST(r13) - ld r0, 112+PPC_LR_STKOFF(r1) - addi r1, r1, 112 + ld r0, SFS+PPC_LR_STKOFF(r1) + addi r1, r1, SFS mtlr r0 blr
Greg Kroah-Hartman
maintainerPATCH 10/92 Revert "powerpc/numa: Fix percpu allocations to be NUMA aware"
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 138bb14846a5856747694ae9ef565c9eb4533a1e which is commit ba4a648f12f4cd0a8003dd229b6ca8a53348ee4b upstream.
Michal Hocko writes:
JFYI. We have encountered a regression after applying this patch on a large ppc machine. While the patch is the right thing to do it doesn't work well with the current vmalloc area size on ppc and large machines where NUMA nodes are very far from each other. Just for the reference the boot fails on such a machine with bunch of warning preceeding it. See http://lkml.kernel.org/r/[email protected]
It seems the right thing to do is to enlarge the vmalloc space on ppc but this is not the case in the upstream kernel yet AFAIK. It is also questionable whether that is a stable material but I will decision on you here.
We have reverted this patch from our 4.4 based kernel.
Newer kernels do not have enlarged vmalloc space yet AFAIK so they won't work properly eiter. This bug is quite rare though because you need a specific HW configuration to trigger the issue - namely NUMA nodes have to be far away from each other in the physical memory space.
--- arch/powerpc/include/asm/topology.h | 14 -------------- arch/powerpc/kernel/setup_64.c | 4 ++-- 2 files changed, 2 insertions(+), 16 deletions(-)
arch/powerpc/include/asm/topology.h +0 -14
@@ -44,22 +44,8 @@ extern void __init dump_numa_cpu_topologextern int sysfs_add_device_to_node (struct device *dev,int nid);extern void sysfs_remove_device_from_node (struct device *dev,int nid); -static inline int early_cpu_to_node (int cpu) -{ -int nid; - - nid = numa_cpu_lookup_table[cpu]; - -/* -* Fall back to node 0 if nid is unset (it should be, except bugs). -* This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)). -*/ -return (nid <0 ) ?0 : nid; -}#else -static inline int early_cpu_to_node (int cpu) {return 0 ; } -static inline void dump_numa_cpu_topology (void ) {}static inline int sysfs_add_device_to_node (struct device *dev,int nid)
arch/powerpc/kernel/setup_64.c +2 -2
@@ -754,7 +754,7 @@ void ppc64_boot_msg(unsigned int src, costatic void *__init pcpu_fc_alloc (unsigned int cpu,size_t size,size_t align) { -return __alloc_bootmem_node (NODE_DATA (early_cpu_to_node (cpu)), size, align, +return __alloc_bootmem_node (NODE_DATA (cpu_to_node (cpu)), size, align,__pa (MAX_DMA_ADDRESS )); }
@@ -765,7 +765,7 @@ static void __init pcpu_fc_free(void *ptstatic int pcpu_cpu_distance (unsigned int from,unsigned int to) { -if (early_cpu_to_node (from) ==early_cpu_to_node (to)) +if (cpu_to_node (from) ==cpu_to_node (to))return LOCAL_DISTANCE ;else return REMOTE_DISTANCE ;
Greg Kroah-Hartman
maintainerPATCH 11/92 Staging: comedi: comedi_fops: Avoid orphaned proc entry
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cheah Kok Cheong <[email protected]>
commit bf279ece37d2a3eaaa9813fcd7a1d8a81eb29c20 upstream.
Move comedi_proc_init to the end to avoid orphaned proc entry if module loading failed.
--- drivers/staging/comedi/comedi_fops.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/staging/comedi/comedi_fops.c +3 -3
@@ -2590,9 +2590,6 @@ static int __init comedi_init(void) comedi_class->dev_groups = comedi_dev_groups; -/* XXX requires /proc interface */ -comedi_proc_init (); -/* create devices files for legacy/manual use */ for (i =0 ; i < comedi_num_legacy_minors; i++) {struct comedi_device *dev;
@@ -2610,6 +2607,9 @@ static int __init comedi_init(void)mutex_unlock (&dev->mutex); } +/* XXX requires /proc interface */ +comedi_proc_init (); +return 0 ; }module_init (comedi_init);
Greg Kroah-Hartman
maintainerPATCH 12/92 Bluetooth: bnep: bnep_add_connection() should verify that its dealing with l2cap socket
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 71bb99a02b32b4cc4265118e85f6035ca72923f0 upstream.
same story as cmtp
--- net/bluetooth/bnep/core.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/bnep/core.c +3 -0
@@ -533,6 +533,9 @@ int bnep_add_connection(struct bnep_connBT_DBG ("" ); +if (!l2cap_is_socket (sock)) +return -EBADFD ; +baswap ((void *) dst, &l2cap_pi (sock->sk)->chan->dst);baswap ((void *) src, &l2cap_pi (sock->sk)->chan->src);
Greg Kroah-Hartman
maintainerPATCH 13/92 Bluetooth: Fix potential NULL dereference
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hedberg <[email protected]>
commit 88d9077c27d0c1a7c022d9dc987640beecf23560 upstream.
The bnep_get_device function may be triggered by an ioctl just after a connection has gone down. In such a case the respective L2CAP chan->conn pointer will get set to NULL (by l2cap_chan_del). This patch adds a missing NULL check for this case in the bnep_get_device() function.
--- net/bluetooth/bnep/core.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/bluetooth/bnep/core.c +3 -4
@@ -511,13 +511,12 @@ static int bnep_session(void *arg)static struct device *bnep_get_device (struct bnep_session *session) { -struct hci_conn *conn; +struct l2cap_conn *conn =l2cap_pi (session->sock->sk)->chan->conn; - conn =l2cap_pi (session->sock->sk)->chan->conn->hcon; -if (!conn) +if (!conn || !conn->hcon)return NULL ; -return &conn->dev; +return &conn->hcon->dev; }static struct device_type bnep_type = {
Greg Kroah-Hartman
maintainerPATCH 14/92 Bluetooth: cmtp: cmtp_add_connection() should verify that its dealing with l2cap socket
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 96c26653ce65bf84f3212f8b00d4316c1efcbf4c upstream.
... rather than relying on ciptool(8) never passing it anything else. Give it e.g. an AF_UNIX connected socket (from socketpair(2)) and it'll oops, trying to evaluate &l2cap_pi(sock->sk)->chan->dst...
--- net/bluetooth/cmtp/core.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/cmtp/core.c +3 -0
@@ -334,6 +334,9 @@ int cmtp_add_connection(struct cmtp_connBT_DBG ("" ); +if (!l2cap_is_socket (sock)) +return -EBADFD ; + session =kzalloc (sizeof (struct cmtp_session ),GFP_KERNEL );if (!session)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 15/92 net: phy: Do not perform software reset for Generic PHY
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit 0878fff1f42c18e448ab5b8b4f6a3eb32365b5b6 upstream.
The Generic PHY driver is a catch-all PHY driver and it should preserve whatever prior initialization has been done by boot loader or firmware agents. For specific PHY device configuration it is expected that a specialized PHY driver would take over that role.
Resetting the generic PHY was a bad idea that has lead to several complaints and downstream workarounds e.g: in OpenWrt/LEDE so restore the behavior prior to 87aa9f9c61ad ("net: phy: consolidate PHY reset in phy_init_hw()").
--- drivers/net/phy/phy_device.c | 2 +- include/linux/phy.h | 4 ++++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/net/phy/phy_device.c +1 -1
@@ -1341,7 +1341,7 @@ static struct phy_driver genphy_driver[] .phy_id = 0xffffffff, .phy_id_mask = 0xffffffff, .name = "Generic PHY", - .soft_reset = genphy_soft_reset, + .soft_reset = genphy_no_soft_reset, .config_init = genphy_config_init, .features =PHY_GBIT_FEATURES |SUPPORTED_MII | SUPPORTED_AUI | SUPPORTED_FIBRE |
include/linux/phy.h +4 -0
@@ -737,6 +737,10 @@ int genphy_read_status(struct phy_deviceint genphy_suspend (struct phy_device *phydev);int genphy_resume (struct phy_device *phydev);int genphy_soft_reset (struct phy_device *phydev); +static inline int genphy_no_soft_reset (struct phy_device *phydev) +{ +return 0 ; +}void phy_driver_unregister (struct phy_driver *drv);void phy_drivers_unregister (struct phy_driver *drv,int n);int phy_driver_register (struct phy_driver *new_driver);
Greg Kroah-Hartman
maintainerPATCH 16/92 isdn: Fix a sleep-in-atomic bug
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jia-Ju Bai <[email protected]>
commit e8f4ae85439f34bec3b0ab69223a41809dab28c9 upstream.
The driver may sleep under a spin lock, the function call path is:isdn_ppp_mp_receive (acquire the lock)
isdn_ppp_mp_reassembly
isdn_ppp_push_higher
isdn_ppp_decompress
isdn_ppp_ccp_reset_trans
isdn_ppp_ccp_reset_alloc_state
kzalloc(GFP_KERNEL) --> may sleepTo fixed it, the "GFP_KERNEL" is replaced with "GFP_ATOMIC".
--- drivers/isdn/i4l/isdn_ppp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/isdn/i4l/isdn_ppp.c +1 -1
@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn id);return NULL ; }else { - rs =kzalloc (sizeof (struct ippp_ccp_reset_state ),GFP_KERNEL ); + rs =kzalloc (sizeof (struct ippp_ccp_reset_state ),GFP_ATOMIC );if (!rs)return NULL ; rs->state = CCPResetIdle;
Greg Kroah-Hartman
maintainerPATCH 17/92 string: provide strscpy()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 30035e45753b708e7d47a98398500ca005e02b86 upstream.
The strscpy() API is intended to be used instead of strlcpy(), and instead of most uses of strncpy().
- Unlike strlcpy(), it doesn't read from memory beyond (src + size).
- Unlike strlcpy() or strncpy(), the API provides an easy way to check for destination buffer overflow: an -E2BIG error return value.
- The provided implementation is robust in the face of the source buffer being asynchronously changed during the copy, unlike the current implementation of strlcpy().
- Unlike strncpy(), the destination buffer will be NUL-terminated if the string in the source buffer is too long.
- Also unlike strncpy(), the destination buffer will not be updated beyond the NUL termination, avoiding strncpy's behavior of zeroing the entire tail end of the destination buffer. (A memset() after the strscpy() can be used if this behavior is desired.)
- The implementation should be reasonably performant on all platforms since it uses the asm/word-at-a-time.h API rather than simple byte copy. Kernel-to-kernel string copy is not considered to be performance critical in any case.
--- include/linux/string.h | 3 + lib/string.c | 88 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+)
include/linux/string.h +3 -0
@@ -25,6 +25,9 @@ extern char * strncpy(char *,const char#ifndef __HAVE_ARCH_STRLCPYsize_t strlcpy (char *,const char *,size_t );#endif +#ifndef __HAVE_ARCH_STRSCPY +ssize_t __must_check strscpy (char *,const char *,size_t ); +#endif #ifndef __HAVE_ARCH_STRCATextern char *strcat (char *,const char *);#endif
lib/string.c +88 -0
100 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 18/92 strscpy: zero any trailing garbage bytes in the destination
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 990486c8af044f89bddfbde1d1cf9fde449bedbf upstream.
It's possible that the destination can be shadowed in userspace (as, for example, the perf buffers are now). So we should take care not to leak data that could be inspected by userspace.
--- lib/string.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
lib/string.c +2 -1
@@ -211,12 +211,13 @@ ssize_t strscpy(char *dest, const char *unsigned long c, data; c = *(unsigned long *)(src+res); - *(unsigned long *)(dest+res) = c;if (has_zero (c, &data, &constants)) { data =prep_zero_mask (c, data, &constants); data =create_zero_mask (data); + *(unsigned long *)(dest+res) = c &zero_bytemask (data);return res +find_zero (data); } + *(unsigned long *)(dest+res) = c; res +=sizeof (unsigned long ); count -=sizeof (unsigned long ); max -=sizeof (unsigned long );
Greg Kroah-Hartman
maintainerPATCH 19/92 isdn/i4l: fix buffer overflow
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Annie Cherkaev <[email protected]>
commit 9f5af546e6acc30f075828cb58c7f09665033967 upstream.
This fixes a potential buffer overflow in isdn_net.c caused by an unbounded strcpy.
[ ISDN seems to be effectively unmaintained, and the I4L driver in
particular is long deprecated, but in case somebody uses this..
- Linus ]
--- drivers/isdn/i4l/isdn_common.c | 1 + drivers/isdn/i4l/isdn_net.c | 5 ++--- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/isdn/i4l/isdn_common.c +1 -0
@@ -1379,6 +1379,7 @@ isdn_ioctl(struct file *file, uint cmd,if (arg) {if (copy_from_user (bname, argp,sizeof (bname) -1 ))return -EFAULT ; + bname[sizeof (bname)-1 ] =0 ; }else return -EINVAL ; ret =mutex_lock_interruptible (&dev->mtx);
drivers/isdn/i4l/isdn_net.c +2 -3
@@ -2644,10 +2644,9 @@ isdn_net_newslave(char *parm)char newname[10 ];if (p) { -/* Slave-Name MUST not be empty */ -if (!strlen (p +1 )) +/* Slave-Name MUST not be empty or overflow 'newname' */ +if (strscpy (newname, p +1 ,sizeof (newname)) <=0 )return NULL ; -strcpy (newname, p +1 ); *p =0 ;/* Master must already exist */ if (!(n =isdn_net_findif (parm)))
Greg Kroah-Hartman
maintainerPATCH 20/92 wil6210: fix deadlock when using fw_no_recovery option
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lior David <[email protected]>
commit dfb5b098e0f40b68aa07f2ec55f4dd762efefbfa upstream.
When FW crashes with no_fw_recovery option, driver waits for manual recovery with wil->mutex held, this can easily create deadlocks.
Fix the problem by moving the wait outside the lock.
--- drivers/net/wireless/ath/wil6210/main.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
drivers/net/wireless/ath/wil6210/main.c +8 -7
@@ -240,18 +240,19 @@ static void wil_fw_error_worker(struct w wil->last_fw_recovery = jiffies; +wil_info (wil,"fw error recovery requested (try %d)...\n" , + wil->recovery_count); +if (!no_fw_recovery) + wil->recovery_state = fw_recovery_running; +if (wil_wait_for_recovery (wil) !=0 ) +return ; +mutex_lock (&wil->mutex);switch (wdev->iftype) {case NL80211_IFTYPE_STATION :case NL80211_IFTYPE_P2P_CLIENT :case NL80211_IFTYPE_MONITOR : -wil_info (wil,"fw error recovery requested (try %d)...\n" , - wil->recovery_count); -if (!no_fw_recovery) - wil->recovery_state = fw_recovery_running; -if (0 !=wil_wait_for_recovery (wil)) -break ; - +/* silent recovery, upper layers will see disconnect */ __wil_down (wil);__wil_up (wil);break ;
Greg Kroah-Hartman
maintainerPATCH 21/92 mailbox: always wait in mbox_send_message for blocking Tx mode
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit c61b781ee084e69855477d23dd33e7e6caad652c upstream.
There exists a race when msg_submit return immediately as there was an active request being processed which may have completed just before it's checked again in mbox_send_message. This will result in return to the caller without waiting in mbox_send_message even when it's blocking Tx.
This patch fixes the issue by waiting for the completion always if Tx is in blocking mode.
--- drivers/mailbox/mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/mailbox.c +1 -1
@@ -255,7 +255,7 @@ int mbox_send_message(struct mbox_chan *if (chan->txdone_method ==TXDONE_BY_POLL )poll_txdone ((unsigned long )chan->mbox); -if (chan->cl->tx_block && chan->active_req) { +if (chan->cl->tx_block) {unsigned long wait;int ret;
Greg Kroah-Hartman
maintainerPATCH 22/92 mailbox: skip complete wait event if timer expired
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit cc6eeaa3029a6dbcb4ad41b1f92876483bd88965 upstream.
If a wait_for_completion_timeout() call returns due to a timeout, complete() can get called after returning from the wait which is incorrect and can cause subsequent transmissions on a channel to fail. Since the wait_for_completion_timeout() sees the completion variable is non-zero caused by the erroneous/spurious complete() call, and it immediately returns without waiting for the time as expected by the client.
This patch fixes the issue by skipping complete() call for the timer expiry.
--- drivers/mailbox/mailbox.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mailbox/mailbox.c +3 -3
@@ -103,7 +103,7 @@ static void tx_tick(struct mbox_chan *chif (mssg && chan->cl->tx_done) chan->cl->tx_done (chan->cl, mssg, r); -if (chan->cl->tx_block) +if (r != -ETIME && chan->cl->tx_block)complete (&chan->tx_complete); }
@@ -266,8 +266,8 @@ int mbox_send_message(struct mbox_chan * ret =wait_for_completion_timeout (&chan->tx_complete, wait);if (ret ==0 ) { - t = -EIO ; -tx_tick (chan, -EIO ); + t = -ETIME ; +tx_tick (chan, t); } }
Greg Kroah-Hartman
maintainerPATCH 23/92 mailbox: handle empty message in tx_tick
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit cb710ab1d8a23f68ff8f45aedf3e552bb90e70de upstream.
We already check if the message is empty before calling the client tx_done callback. Calling completion on a wait event is also invalid if the message is empty.
This patch moves the existing empty message check earlier.
--- drivers/mailbox/mailbox.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/mailbox/mailbox.c +4 -1
@@ -99,8 +99,11 @@ static void tx_tick(struct mbox_chan *ch/* Submit next message */ msg_submit (chan); +if (!mssg) +return ; +/* Notify the client */ -if (mssg && chan->cl->tx_done) +if (chan->cl->tx_done) chan->cl->tx_done (chan->cl, mssg, r);if (r != -ETIME && chan->cl->tx_block)
Greg Kroah-Hartman
maintainerPATCH 24/92 mpt3sas: Dont overreach ioc->reply_post[] during initialization
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Calvin Owens <[email protected]>
commit 5ec8a1753bc29efa7e4b1391d691c9c719b30257 upstream.
In _base_make_ioc_operational(), we walk ioc->reply_queue_list and pull a pointer out of successive elements of ioc->reply_post[] for each entry in that list if RDPQ is enabled.
Since the code pulls the pointer for the next iteration at the bottom of the loop, it triggers the a KASAN dump on the final iteration:
BUG: KASAN: slab-out-of-bounds in _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas] at addr ffff880754816ab0
Read of size 8 by task modprobe/305
<snip>
Call Trace:
[<ffffffff81dfc591>] dump_stack+0x4d/0x6c
[<ffffffff814c9689>] print_trailer+0xf9/0x150
[<ffffffff814ceda4>] object_err+0x34/0x40
[<ffffffff814d1231>] kasan_report_error+0x221/0x530
[<ffffffff814d1673>] __asan_report_load8_noabort+0x43/0x50
[<ffffffffa0043637>] _base_make_ioc_operational+0x47b7/0x47e0 [mpt3sas]
[<ffffffffa0049a51>] mpt3sas_base_attach+0x1991/0x2120 [mpt3sas]
[<ffffffffa0053c93>] _scsih_probe+0xeb3/0x16b0 [mpt3sas]
[<ffffffff81ebd047>] local_pci_probe+0xc7/0x170
[<ffffffff81ebf2cf>] pci_device_probe+0x20f/0x290
[<ffffffff820d50cd>] really_probe+0x17d/0x600
[<ffffffff820d56a3>] __driver_attach+0x153/0x190
[<ffffffff820cffac>] bus_for_each_dev+0x11c/0x1a0
[<ffffffff820d421d>] driver_attach+0x3d/0x50
[<ffffffff820d378a>] bus_add_driver+0x44a/0x5f0
[<ffffffff820d666c>] driver_register+0x18c/0x3b0
[<ffffffff81ebcb76>] __pci_register_driver+0x156/0x200
[<ffffffffa00c8135>] _mpt3sas_init+0x135/0x1000 [mpt3sas]
[<ffffffff81000423>] do_one_initcall+0x113/0x2b0
[<ffffffff813caa5a>] do_init_module+0x1d0/0x4d8
[<ffffffff81273909>] load_module+0x6729/0x8dc0
[<ffffffff81276123>] SYSC_init_module+0x183/0x1a0
[<ffffffff8127625e>] SyS_init_module+0xe/0x10
[<ffffffff828fe7d7>] entry_SYSCALL_64_fastpath+0x12/0x6aFix this by pulling the value at the beginning of the loop.
--- drivers/scsi/mpt3sas/mpt3sas_base.c | 33 ++++++++++++++++----------------- 1 file changed, 16 insertions(+), 17 deletions(-)
drivers/scsi/mpt3sas/mpt3sas_base.c +16 -17
@@ -4378,14 +4378,13 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPstatic int _base_make_ioc_operational (struct MPT3SAS_ADAPTER *ioc,int sleep_flag) { -int r, i; +int r, i, index;unsigned long flags;u32 reply_address;u16 smid;struct _tr_list *delayed_tr, *delayed_tr_next;struct adapter_reply_queue *reply_q; -long reply_post_free; -u32 reply_post_free_sz, index =0 ; +Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig;dinitprintk (ioc,pr_info (MPT3SAS_FMT "%s\n" , ioc->name, __func__));
@@ -4456,27 +4455,27 @@ _base_make_ioc_operational(struct MPT3SA_base_assign_reply_queues (ioc);/* initialize Reply Post Free Queue */ - reply_post_free_sz = ioc->reply_post_queue_depth * -sizeof (Mpi2DefaultReplyDescriptor_t); - reply_post_free = (long )ioc->reply_post[index].reply_post_free; + index =0 ; + reply_post_free_contig = ioc->reply_post[0 ].reply_post_free;list_for_each_entry (reply_q, &ioc->reply_queue_list, list) { +/* +* If RDPQ is enabled, switch to the next allocation. +* Otherwise advance within the contiguous region. +*/ +if (ioc->rdpq_array_enable) { + reply_q->reply_post_free = + ioc->reply_post[index++].reply_post_free; + }else { + reply_q->reply_post_free = reply_post_free_contig; + reply_post_free_contig += ioc->reply_post_queue_depth; + } + reply_q->reply_post_host_index =0 ; - reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *) - reply_post_free;for (i =0 ; i < ioc->reply_post_queue_depth; i++) reply_q->reply_post_free[i].Words =cpu_to_le64 (ULLONG_MAX );if (!_base_is_controller_msix_enabled (ioc)) goto skip_init_reply_post_free_queue; -/* -* If RDPQ is enabled, switch to the next allocation. -* Otherwise advance within the contiguous region. -*/ -if (ioc->rdpq_array_enable) - reply_post_free = (long ) - ioc->reply_post[++index].reply_post_free; -else - reply_post_free += reply_post_free_sz; } skip_init_reply_post_free_queue:
Greg Kroah-Hartman
maintainerPATCH 25/92 kaweth: fix firmware download
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 60bcabd080f53561efa9288be45c128feda1a8bb upstream.
This fixes the oops discovered by the Umap2 project and Alan Stern. The intf member needs to be set before the firmware is downloaded.
--- drivers/net/usb/kaweth.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/usb/kaweth.c +1 -2
@@ -1029,6 +1029,7 @@ static int kaweth_probe( kaweth =netdev_priv (netdev); kaweth->dev = udev; kaweth->net = netdev; + kaweth->intf = intf;spin_lock_init (&kaweth->device_lock);init_waitqueue_head (&kaweth->term_wait);
@@ -1139,8 +1140,6 @@ err_fw:dev_dbg (dev,"Initializing net device.\n" ); - kaweth->intf = intf; - kaweth->tx_urb =usb_alloc_urb (0 ,GFP_KERNEL );if (!kaweth->tx_urb) goto err_free_netdev;
Greg Kroah-Hartman
maintainerPATCH 26/92 kaweth: fix oops upon failed memory allocation
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 575ced7f8090c1a4e91e2daf8da9352a6a1fc7a7 upstream.
Just return an error upon failure.
--- drivers/net/usb/kaweth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/usb/kaweth.c +6 -1
@@ -1009,6 +1009,7 @@ static int kaweth_probe(struct net_device *netdev;const eth_addr_t bcast_addr = {0xFF ,0xFF ,0xFF ,0xFF ,0xFF ,0xFF };int result =0 ; +int rv = -EIO ; dev_dbg(dev, "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n",
@@ -1049,6 +1050,10 @@ static int kaweth_probe(/* Download the firmware */ dev_info (dev,"Downloading firmware...\n" ); kaweth->firmware_buf = (__u8 *)__get_free_page (GFP_KERNEL ); +if (!kaweth->firmware_buf) { + rv = -ENOMEM ; + goto err_free_netdev; + } if ((result = kaweth_download_firmware(kaweth, "kaweth/new_code.bin", 100,
@@ -1209,7 +1214,7 @@ err_only_tx: err_free_netdev:free_netdev (netdev); -return -EIO ; +return rv; }/****************************************************************
Greg Kroah-Hartman
maintainerPATCH 27/92 ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Stancek <[email protected]>
commit 4762fb980465463734f02c67c67f40beb8903f73 upstream.
Use spin_lock_bh in ip6_fl_purge() to prevent following potentially deadlock scenario between ip6_fl_purge() and ip6_fl_gc() timer.
=================================
[ INFO: inconsistent lock state ]
3.19.0 #1 Not tainted
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/5/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
(ip6_fl_lock){+.?...}, at: [<ffffffff8171155d>] ip6_fl_gc+0x2d/0x180
{SOFTIRQ-ON-W} state was registered at:
[<ffffffff810ee9a0>] __lock_acquire+0x4a0/0x10b0
[<ffffffff810efd54>] lock_acquire+0xc4/0x2b0
[<ffffffff81751d2d>] _raw_spin_lock+0x3d/0x80
[<ffffffff81711798>] ip6_flowlabel_net_exit+0x28/0x110
[<ffffffff815f9759>] ops_exit_list.isra.1+0x39/0x60
[<ffffffff815fa320>] cleanup_net+0x100/0x1e0
[<ffffffff810ad80a>] process_one_work+0x20a/0x830
[<ffffffff810adf4b>] worker_thread+0x11b/0x460
[<ffffffff810b42f4>] kthread+0x104/0x120
[<ffffffff81752bfc>] ret_from_fork+0x7c/0xb0
irq event stamp: 84640
hardirqs last enabled at (84640): [<ffffffff81752080>] _raw_spin_unlock_irq+0x30/0x50
hardirqs last disabled at (84639): [<ffffffff81751eff>] _raw_spin_lock_irq+0x1f/0x80
softirqs last enabled at (84628): [<ffffffff81091ad1>] _local_bh_enable+0x21/0x50
softirqs last disabled at (84629): [<ffffffff81093b7d>] irq_exit+0x12d/0x150other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(ip6_fl_lock);
<Interrupt>
lock(ip6_fl_lock);*** DEADLOCK ***
--- net/ipv6/ip6_flowlabel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ip6_flowlabel.c +2 -2
@@ -172,7 +172,7 @@ static void __net_exit ip6_fl_purge(stru {int i; -spin_lock (&ip6_fl_lock); +spin_lock_bh (&ip6_fl_lock);for (i =0 ; i <=FL_HASH_MASK ; i++) {struct ip6_flowlabel *fl;struct ip6_flowlabel __rcu **flp;
@@ -190,7 +190,7 @@ static void __net_exit ip6_fl_purge(stru flp = &fl->next; } } -spin_unlock (&ip6_fl_lock); +spin_unlock_bh (&ip6_fl_lock); } static struct ip6_flowlabel *fl_intern(struct net *net,
Greg Kroah-Hartman
maintainerPATCH 28/92 net: sctp: fix race for one-to-many sockets in sendmsgs auto associate
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 2061dcd6bff8b774b4fac8b0739b6be3f87bc9f2 upstream.
I.e. one-to-many sockets in SCTP are not required to explicitly call into connect(2) or sctp_connectx(2) prior to data exchange. Instead, they can directly invoke sendmsg(2) and the SCTP stack will automatically trigger connection establishment through 4WHS via sctp_primitive_ASSOCIATE(). However, this in its current implementation is racy: INIT is being sent out immediately (as it cannot be bundled anyway) and the rest of the DATA chunks are queued up for later xmit when connection is established, meaning sendmsg(2) will return successfully. This behaviour can result in an undesired side-effect that the kernel made the application think the data has already been transmitted, although none of it has actually left the machine, worst case even after close(2)'ing the socket.
Instead, when the association from client side has been shut down e.g. first gracefully through SCTP_EOF and then close(2), the client could afterwards still receive the server's INIT_ACK due to a connection with higher latency. This INIT_ACK is then considered out of the blue and hence responded with ABORT as there was no alive assoc found anymore. This can be easily reproduced f.e. with sctp_test application from lksctp. One way to fix this race is to wait for the handshake to actually complete.
The fix defers waiting after sctp_primitive_ASSOCIATE() and sctp_primitive_SEND() succeeded, so that DATA chunks cooked up from sctp_sendmsg() have already been placed into the output queue through the side-effect interpreter, and therefore can then be bundeled together with COOKIE_ECHO control chunks.
strace from example application (shortened):
socket(PF_INET, SOCK_SEQPACKET, IPPROTO_SCTP) = 3
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5
sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(1)=[{"hello", 5}], msg_controllen=0, msg_flags=0}, 0) = 5sendmsg(3, {msg_name(28)={sa_family=AF_INET, sin_port=htons(8888), sin_addr=inet_addr("192.168.1.115")},
msg_iov(0)=[], msg_controllen=48, {cmsg_len=48, cmsg_level=0x84 /* SOL_??? */, cmsg_type=, ...}, msg_flags=0}, 0) = 0 // graceful shutdown for SOCK_SEQPACKET via SCTP_EOF
close(3) = 0
tcpdump before patch (fooling the application):
22:33:36.306142 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 3879023686] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3139201684] 22:33:36.316619 IP 192.168.1.115.8888 > 192.168.1.114.41462: sctp (1) [INIT ACK] [init tag: 3345394793] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 3380109591] 22:33:36.317600 IP 192.168.1.114.41462 > 192.168.1.115.8888: sctp (1) [ABORT]
tcpdump after patch:
14:28:58.884116 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [INIT] [init tag: 438593213] [rwnd: 106496] [OS: 10] [MIS: 65535] [init TSN: 3092969729] 14:28:58.888414 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [INIT ACK] [init tag: 381429855] [rwnd: 106496] [OS: 10] [MIS: 10] [init TSN: 2141904492] 14:28:58.888638 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [COOKIE ECHO] , (2) [DATA] (B)(E) [TSN: 3092969729] [...] 14:28:58.893278 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [COOKIE ACK] , (2) [SACK] [cum ack 3092969729] [a_rwnd 106491] [#gap acks 0] [#dup tsns 0] 14:28:58.893591 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969730] [...]
14:28:59.096963 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969730] [a_rwnd 106496] [#gap acks 0] [#dup tsns 0] 14:28:59.097086 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [DATA] (B)(E) [TSN: 3092969731] [...] , (2) [DATA] (B)(E) [TSN: 3092969732] [...] 14:28:59.103218 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SACK] [cum ack 3092969732] [a_rwnd 106486] [#gap acks 0] [#dup tsns 0] 14:28:59.103330 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN]
14:28:59.107793 IP 192.168.1.115.8888 > 192.168.1.114.35846: sctp (1) [SHUTDOWN ACK]
14:28:59.107890 IP 192.168.1.114.35846 > 192.168.1.115.8888: sctp (1) [SHUTDOWN COMPLETE]
Looks like this bug is from the pre-git history museum. ;)
--- net/sctp/socket.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/sctp/socket.c +7 -1
@@ -1604,7 +1604,7 @@ static int sctp_sendmsg(struct kiocb *iosctp_assoc_t associd =0 ;sctp_cmsgs_t cmsgs = {NULL };sctp_scope_t scope; -bool fill_sinfo_ttl = false; +bool fill_sinfo_ttl = false, wait_connect = false;struct sctp_datamsg *datamsg;int msg_flags = msg->msg_flags;__u16 sinfo_flags =0 ;
@@ -1944,6 +1944,7 @@ static int sctp_sendmsg(struct kiocb *ioif (err <0 ) goto out_free; + wait_connect = true;pr_debug ("%s: we associated primitively\n" , __func__); }
@@ -1981,6 +1982,11 @@ static int sctp_sendmsg(struct kiocb *iosctp_datamsg_put (datamsg); err = msg_len; +if (unlikely (wait_connect)) { + timeo =sock_sndtimeo (sk, msg_flags &MSG_DONTWAIT ); +sctp_wait_for_connect (asoc, &timeo); + } +/* If we are already past ASSOCIATE, the lower * layers are responsible for association cleanup. */
Greg Kroah-Hartman
maintainerPATCH 29/92 sh_eth: Fix ethtool operation crash when net device is down
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <[email protected]>
commit 4f9dce230b32eec45cec8c28cae61efdfa2f7d57 upstream.
The driver connects and disconnects the PHY device whenever the net device is brought up and down. The ethtool get_settings, set_settings and nway_reset operations will dereference a null or dangling pointer if called while it is down.
I think it would be preferable to keep the PHY connected, but there may be good reasons not to.
As an immediate fix for this bug:
- Set the phydev pointer to NULL after disconnecting the PHY
- Change those three operations to return -ENODEV while the PHY is not connected
--- drivers/net/ethernet/renesas/sh_eth.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/ethernet/renesas/sh_eth.c +10 -0
@@ -1832,6 +1832,9 @@ static int sh_eth_get_settings(struct neunsigned long flags;int ret; +if (!mdp->phydev) +return -ENODEV ; +spin_lock_irqsave (&mdp->lock, flags); ret =phy_ethtool_gset (mdp->phydev, ecmd);spin_unlock_irqrestore (&mdp->lock, flags);
@@ -1846,6 +1849,9 @@ static int sh_eth_set_settings(struct neunsigned long flags;int ret; +if (!mdp->phydev) +return -ENODEV ; +spin_lock_irqsave (&mdp->lock, flags);/* disable tx and rx */
@@ -1880,6 +1886,9 @@ static int sh_eth_nway_reset(struct net_unsigned long flags;int ret; +if (!mdp->phydev) +return -ENODEV ; +spin_lock_irqsave (&mdp->lock, flags); ret =phy_start_aneg (mdp->phydev);spin_unlock_irqrestore (&mdp->lock, flags);
@@ -2189,6 +2198,7 @@ static int sh_eth_close(struct net_devicif (mdp->phydev) {phy_stop (mdp->phydev);phy_disconnect (mdp->phydev); + mdp->phydev =NULL ; }free_irq (ndev->irq, ndev);
Greg Kroah-Hartman
maintainerPATCH 30/92 net, sched: fix soft lockup in tc_classify
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
commit 628185cfddf1dfb701c4efe2cfd72cf5b09f5702 upstream.
Shahar reported a soft lockup in tc_classify(), where we run into an endless loop when walking the classifier chain due to tp->next == tp which is a state we should never run into. The issue only seems to trigger under load in the tc control path.
What happens is that in tc_ctl_tfilter(), thread A allocates a new tp, initializes it, sets tp_created to 1, and calls into tp->ops->change() with it. In that classifier callback we had to unlock/lock the rtnl mutex and returned with -EAGAIN. One reason why we need to drop there is, for example, that we need to request an action module to be loaded.
This happens via tcf_exts_validate() -> tcf_action_init/_1() meaning after we loaded and found the requested action, we need to redo the whole request so we don't race against others. While we had to unlock rtnl in that time, thread B's request was processed next on that CPU. Thread B added a new tp instance successfully to the classifier chain. When thread A returned grabbing the rtnl mutex again, propagating -EAGAIN and destroying its tp instance which never got linked, we goto replay and redo A's request.
This time when walking the classifier chain in tc_ctl_tfilter() for checking for existing tp instances we had a priority match and found the tp instance that was created and linked by thread B. Now calling again into tp->ops->change() with that tp was successful and returned without error.
tp_created was never cleared in the second round, thus kernel thinks that we need to link it into the classifier chain (once again). tp and *back point to the same object due to the match we had earlier on. Thus for thread B's already public tp, we reset tp->next to tp itself and link it into the chain, which eventually causes the mentioned endless loop in tc_classify() once a packet hits the data path.
Fix is to clear tp_created at the beginning of each request, also when we replay it. On the paths that can cause -EAGAIN we already destroy the original tp instance we had and on replay we really need to start from scratch. It seems that this issue was first introduced in commit 12186be7d2e1 ("net_cls: fix unconfigured struct tcf_proto keeps chaining and avoid kernel panic when we use cls_cgroup").
--- net/sched/cls_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sched/cls_api.c +3 -1
@@ -137,13 +137,15 @@ static int tc_ctl_tfilter(struct sk_buffunsigned long cl;unsigned long fh;int err; -int tp_created =0 ; +int tp_created;if ((n->nlmsg_type !=RTM_GETTFILTER ) && !netlink_ns_capable (skb, net->user_ns,CAP_NET_ADMIN ))return -EPERM ; replay: + tp_created =0 ; + err =nlmsg_parse (n,sizeof (*t), tca,TCA_MAX ,NULL );if (err <0 )return err;
Greg Kroah-Hartman
maintainerPATCH 31/92 ipmi/watchdog: fix watchdog timeout set on reboot
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valentin Vidic <[email protected]>
commit 860f01e96981a68553f3ca49f574ff14fe955e72 upstream.
systemd by default starts watchdog on reboot and sets the timer to ShutdownWatchdogSec=10min. Reboot handler in ipmi_watchdog than reduces the timer to 120s which is not enough time to boot a Xen machine with a lot of RAM. As a result the machine is rebooted the second time during the long run of (XEN) Scrubbing Free RAM.....
Fix this by setting the timer to 120s only if it was previously set to a low value.
--- drivers/char/ipmi/ipmi_watchdog.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/char/ipmi/ipmi_watchdog.c +4 -3
@@ -1156,10 +1156,11 @@ static int wdog_reboot_handler(struct no ipmi_watchdog_state =WDOG_TIMEOUT_NONE ;ipmi_set_timeout (IPMI_SET_TIMEOUT_NO_HB ); }else if (ipmi_watchdog_state !=WDOG_TIMEOUT_NONE ) { -/* Set a long timer to let the reboot happens, but -reboot if it hangs, but only if the watchdog +/* Set a long timer to let the reboot happen or +reset if it hangs, but only if the watchdog timer was already running. */ - timeout =120 ; +if (timeout <120 ) + timeout =120 ; pretimeout =0 ; ipmi_watchdog_state =WDOG_TIMEOUT_RESET ;ipmi_set_timeout (IPMI_SET_TIMEOUT_NO_HB );
Greg Kroah-Hartman
maintainerPATCH 32/92 dentry name snapshots
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 49d31c2f389acfe83417083e1208422b4091cd9e upstream.
take_dentry_name_snapshot() takes a safe snapshot of dentry name; if the name is a short one, it gets copied into caller-supplied structure, otherwise an extra reference to external name is grabbed (those are never modified). In either case the pointer to stable string is stored into the same structure.
dentry must be held by the caller of take_dentry_name_snapshot(), but may be freely dropped afterwards - the snapshot will stay until destroyed by release_dentry_name_snapshot().
Intended use:
struct name_snapshot s; take_dentry_name_snapshot(&s, dentry); ... access s.name ... release_dentry_name_snapshot(&s);
Replaces fsnotify_oldname_...(), gets used in fsnotify to obtain the name to pass down with event.
--- fs/dcache.c | 27 +++++++++++++++++++++++++++ fs/debugfs/inode.c | 10 +++++----- fs/namei.c | 8 ++++---- fs/notify/fsnotify.c | 8 ++++++-- include/linux/dcache.h | 7 +++++++ include/linux/fsnotify.h | 31 ------------------------------- 6 files changed, 49 insertions(+), 42 deletions(-)
fs/dcache.c +27 -0
@@ -3549,3 +3549,30 @@ void __init vfs_caches_init(unsigned lonbdev_cache_init ();chrdev_init (); } + +void take_dentry_name_snapshot (struct name_snapshot *name,struct dentry *dentry) +{ +spin_lock (&dentry->d_lock); +if (unlikely (dname_external (dentry))) { +struct external_name *p =external_name (dentry); +atomic_inc (&p->u.count); +spin_unlock (&dentry->d_lock); + name->name = p->name; + }else { +memcpy (name->inline_name, dentry->d_iname,DNAME_INLINE_LEN ); +spin_unlock (&dentry->d_lock); + name->name = name->inline_name; + } +} +EXPORT_SYMBOL (take_dentry_name_snapshot); + +void release_dentry_name_snapshot (struct name_snapshot *name) +{ +if (unlikely (name->name != name->inline_name)) { +struct external_name *p; + p = container_of(name->name, struct external_name, name[0]); +if (unlikely (atomic_dec_and_test (&p->u.count))) +kfree_rcu (p, u.head); + } +} +EXPORT_SYMBOL (release_dentry_name_snapshot);
fs/debugfs/inode.c +5 -5
@@ -620,7 +620,7 @@ struct dentry *debugfs_rename(struct den {int error;struct dentry *dentry =NULL , *trap; -const char *old_name; +struct name_snapshot old_name; trap =lock_rename (new_dir, old_dir);/* Source or destination directories don't exist? */
@@ -635,19 +635,19 @@ struct dentry *debugfs_rename(struct denif (IS_ERR (dentry) || dentry == trap || dentry->d_inode) goto exit; - old_name =fsnotify_oldname_init (old_dentry->d_name.name); +take_dentry_name_snapshot (&old_name, old_dentry); error =simple_rename (old_dir->d_inode, old_dentry, new_dir->d_inode, dentry);if (error) { -fsnotify_oldname_free (old_name); +release_dentry_name_snapshot (&old_name); goto exit; }d_move (old_dentry, dentry); -fsnotify_move (old_dir->d_inode, new_dir->d_inode, old_name, +fsnotify_move (d_inode (old_dir),d_inode (new_dir), old_name.name,S_ISDIR (old_dentry->d_inode->i_mode),NULL , old_dentry); -fsnotify_oldname_free (old_name); +release_dentry_name_snapshot (&old_name);unlock_rename (new_dir, old_dir);dput (dentry);return old_dentry;
fs/namei.c +4 -4
@@ -4088,11 +4088,11 @@ int vfs_rename(struct inode *old_dir, st {int error;bool is_dir =d_is_dir (old_dentry); -const unsigned char *old_name;struct inode *source = old_dentry->d_inode;struct inode *target = new_dentry->d_inode;bool new_is_dir = false;unsigned max_links = new_dir->i_sb->s_max_links; +struct name_snapshot old_name;if (source == target)return 0 ;
@@ -4142,7 +4142,7 @@ int vfs_rename(struct inode *old_dir, stif (error)return error; - old_name =fsnotify_oldname_init (old_dentry->d_name.name); +take_dentry_name_snapshot (&old_name, old_dentry);dget (new_dentry);if (!is_dir || (flags &RENAME_EXCHANGE ))lock_two_nondirectories (source, target);
@@ -4203,14 +4203,14 @@ out:mutex_unlock (&target->i_mutex);dput (new_dentry);if (!error) { -fsnotify_move (old_dir, new_dir, old_name, is_dir, +fsnotify_move (old_dir, new_dir, old_name.name, is_dir, !(flags &RENAME_EXCHANGE ) ? target :NULL , old_dentry);if (flags &RENAME_EXCHANGE ) {fsnotify_move (new_dir, old_dir, old_dentry->d_name.name, new_is_dir,NULL , new_dentry); } } -fsnotify_oldname_free (old_name); +release_dentry_name_snapshot (&old_name);return error; }
fs/notify/fsnotify.c +6 -2
@@ -105,16 +105,20 @@ int __fsnotify_parent(struct path *path,if (unlikely (!fsnotify_inode_watches_children (p_inode)))__fsnotify_update_child_dentry_flags (p_inode);else if (p_inode->i_fsnotify_mask & mask) { +struct name_snapshot name; +/* we are notifying a parent so come up with the new mask which * specifies these are events which came from a child. */ mask |=FS_EVENT_ON_CHILD ; +take_dentry_name_snapshot (&name, dentry);if (path) ret =fsnotify (p_inode, mask, path,FSNOTIFY_EVENT_PATH , - dentry->d_name.name,0 ); + name.name,0 );else ret =fsnotify (p_inode, mask, dentry->d_inode,FSNOTIFY_EVENT_INODE , - dentry->d_name.name,0 ); + name.name,0 ); +release_dentry_name_snapshot (&name); }dput (parent);
include/linux/dcache.h +7 -0
@@ -527,4 +527,11 @@ static inline struct dentry *d_backing_d return upper; } +struct name_snapshot { +const char *name; +char inline_name[DNAME_INLINE_LEN ]; +}; +void take_dentry_name_snapshot (struct name_snapshot *,struct dentry *); +void release_dentry_name_snapshot (struct name_snapshot *); +#endif /* __LINUX_DCACHE_H */
include/linux/fsnotify.h +0 -31
@@ -310,35 +310,4 @@ static inline void fsnotify_change(struc } } -#if defined(CONFIG_FSNOTIFY )/* notify helpers */ - -/* -* fsnotify_oldname_init - save off the old filename before we change it -*/ -static inline const unsigned char *fsnotify_oldname_init (const unsigned char *name) -{ -return kstrdup (name,GFP_KERNEL ); -} - -/* -* fsnotify_oldname_free - free the name we got from fsnotify_oldname_init -*/ -static inline void fsnotify_oldname_free (const unsigned char *old_name) -{ -kfree (old_name); -} - -#else /* CONFIG_FSNOTIFY */ - -static inline const char *fsnotify_oldname_init (const unsigned char *name) -{ -return NULL ; -} - -static inline void fsnotify_oldname_free (const unsigned char *old_name) -{ -} - -#endif /* CONFIG_FSNOTIFY */ -#endif /* _LINUX_FS_NOTIFY_H */
Greg Kroah-Hartman
maintainerPATCH 33/92 v4l: s5c73m3: fix negation operator
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrzej Hajda <[email protected]>
commit a2370ba2752538404e363346b339869c9973aeac upstream.
Bool values should be negated using logical operators. Using bitwise operators results in unexpected and possibly incorrect results.
--- drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c +1 -1
@@ -211,7 +211,7 @@ static int s5c73m3_3a_lock(struct s5c73m }if ((ctrl->val ^ ctrl->cur.val) &V4L2_LOCK_FOCUS ) - ret =s5c73m3_af_run (state, ~af_lock); + ret =s5c73m3_af_run (state, !af_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 34/92 pstore: Allow prz to control need for locking
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Fernandes <[email protected]>
commit 663deb47880f2283809669563c5a52ac7c6aef1a upstream.
In preparation of not locking at all for certain buffers depending on if there's contention, make locking optional depending on the initialization of the prz.
--- fs/pstore/ram.c | 5 +++-- fs/pstore/ram_core.c | 24 +++++++++++++++--------- include/linux/pstore_ram.h | 10 +++++++++- 3 files changed, 27 insertions(+), 12 deletions(-)
fs/pstore/ram.c +3 -2
@@ -365,7 +365,7 @@ static int ramoops_init_przs(struct devi cxt->przs[i] =persistent_ram_new (*paddr, sz,0 , &cxt->ecc_info, - cxt->memtype); + cxt->memtype,0 );if (IS_ERR (cxt->przs[i])) { err =PTR_ERR (cxt->przs[i]); dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n",
@@ -395,7 +395,8 @@ static int ramoops_init_prz(struct devicreturn -ENOMEM ; } - *prz =persistent_ram_new (*paddr, sz, sig, &cxt->ecc_info, cxt->memtype); + *prz =persistent_ram_new (*paddr, sz, sig, &cxt->ecc_info, + cxt->memtype,0 );if (IS_ERR (*prz)) {int err =PTR_ERR (*prz);
fs/pstore/ram_core.c +15 -9
@@ -85,9 +85,10 @@ static size_t buffer_start_add_locked(st {int old;int new; -unsigned long flags; +unsigned long flags =0 ; -raw_spin_lock_irqsave (&prz->buffer_lock, flags); +if (!(prz->flags &PRZ_FLAG_NO_LOCK )) +raw_spin_lock_irqsave (&prz->buffer_lock, flags); old =atomic_read (&prz->buffer->start); new = old + a;
@@ -95,7 +96,8 @@ static size_t buffer_start_add_locked(st new -= prz->buffer_size;atomic_set (&prz->buffer->start, new); -raw_spin_unlock_irqrestore (&prz->buffer_lock, flags); +if (!(prz->flags &PRZ_FLAG_NO_LOCK )) +raw_spin_unlock_irqrestore (&prz->buffer_lock, flags);return old; }
@@ -105,9 +107,10 @@ static void buffer_size_add_locked(struc {size_t old;size_t new; -unsigned long flags; +unsigned long flags =0 ; -raw_spin_lock_irqsave (&prz->buffer_lock, flags); +if (!(prz->flags &PRZ_FLAG_NO_LOCK )) +raw_spin_lock_irqsave (&prz->buffer_lock, flags); old =atomic_read (&prz->buffer->size);if (old == prz->buffer_size)
@@ -119,7 +122,8 @@ static void buffer_size_add_locked(strucatomic_set (&prz->buffer->size, new); exit: -raw_spin_unlock_irqrestore (&prz->buffer_lock, flags); +if (!(prz->flags &PRZ_FLAG_NO_LOCK )) +raw_spin_unlock_irqrestore (&prz->buffer_lock, flags); }static size_t (*buffer_start_add)(struct persistent_ram_zone *,size_t ) = buffer_start_add_atomic;
@@ -459,7 +463,8 @@ static int persistent_ram_buffer_map(phy }static int persistent_ram_post_init (struct persistent_ram_zone *prz,u32 sig, -struct persistent_ram_ecc_info *ecc_info) +struct persistent_ram_ecc_info *ecc_info, +unsigned long flags) {int ret;
@@ -488,6 +493,7 @@ static int persistent_ram_post_init(stru prz->buffer->sig = sig;persistent_ram_zap (prz); prz->buffer_lock =__RAW_SPIN_LOCK_UNLOCKED (buffer_lock); + prz->flags = flags;return 0 ; }
@@ -512,7 +518,7 @@ void persistent_ram_free(struct persistestruct persistent_ram_zone *persistent_ram_new (phys_addr_t start,size_t size,u32 sig,struct persistent_ram_ecc_info *ecc_info, -unsigned int memtype) +unsigned int memtype,u32 flags) {struct persistent_ram_zone *prz;int ret = -ENOMEM ;
@@ -527,7 +533,7 @@ struct persistent_ram_zone *persistent_rif (ret) goto err; - ret =persistent_ram_post_init (prz, sig, ecc_info); + ret =persistent_ram_post_init (prz, sig, ecc_info, flags);if (ret) goto err;
include/linux/pstore_ram.h +9 -1
@@ -23,6 +23,13 @@#include <linux/types.h> #include <linux/init.h> +/* +* Choose whether access to the RAM zone requires locking or not. If a zone +* can be written to from different CPUs like with ftrace for example, then +* PRZ_FLAG_NO_LOCK is used. For all other cases, locking is required. +*/ +#define PRZ_FLAG_NO_LOCK BIT(0) +struct persistent_ram_buffer ;struct rs_control ;
@@ -39,6 +46,7 @@ struct persistent_ram_zone {void *vaddr;struct persistent_ram_buffer *buffer;size_t buffer_size; +u32 flags;raw_spinlock_t buffer_lock;/* ECC correction */
@@ -55,7 +63,7 @@ struct persistent_ram_zone {struct persistent_ram_zone *persistent_ram_new (phys_addr_t start,size_t size,u32 sig,struct persistent_ram_ecc_info *ecc_info, -unsigned int memtype); +unsigned int memtype,u32 flags);void persistent_ram_free (struct persistent_ram_zone *prz);void persistent_ram_zap (struct persistent_ram_zone *prz);
Greg Kroah-Hartman
maintainerPATCH 35/92 pstore: Correctly initialize spinlock and flags
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit 76d5692a58031696e282384cbd893832bc92bd76 upstream.
The ram backend wasn't always initializing its spinlock correctly. Since it was coming from kzalloc memory, though, it was harmless on architectures that initialize unlocked spinlocks to 0 (at least x86 and ARM). This also fixes a possibly ignored flag setting too.
When running under CONFIG_DEBUG_SPINLOCK, the following Oops was visible:
[ 0.760836] persistent_ram: found existing buffer, size 29988, start 29988 [ 0.765112] persistent_ram: found existing buffer, size 30105, start 30105 [ 0.769435] persistent_ram: found existing buffer, size 118542, start 118542 [ 0.785960] persistent_ram: found existing buffer, size 0, start 0 [ 0.786098] persistent_ram: found existing buffer, size 0, start 0 [ 0.786131] pstore: using zlib compression [ 0.790716] BUG: spinlock bad magic on CPU#0, swapper/0/1 [ 0.790729] lock: 0xffffffc0d1ca9bb0, .magic: 00000000, .owner: <none>/-1, .owner_cpu: 0 [ 0.790742] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc2+ #913 [ 0.790747] Hardware name: Google Kevin (DT) [ 0.790750] Call trace: [ 0.790768] [<ffffff900808ae88>] dump_backtrace+0x0/0x2bc [ 0.790780] [<ffffff900808b164>] show_stack+0x20/0x28 [ 0.790794] [<ffffff9008460ee0>] dump_stack+0xa4/0xcc [ 0.790809] [<ffffff9008113cfc>] spin_dump+0xe0/0xf0 [ 0.790821] [<ffffff9008113d3c>] spin_bug+0x30/0x3c [ 0.790834] [<ffffff9008113e28>] do_raw_spin_lock+0x50/0x1b8 [ 0.790846] [<ffffff9008a2d2ec>] _raw_spin_lock_irqsave+0x54/0x6c [ 0.790862] [<ffffff90083ac3b4>] buffer_size_add+0x48/0xcc [ 0.790875] [<ffffff90083acb34>] persistent_ram_write+0x60/0x11c [ 0.790888] [<ffffff90083aab1c>] ramoops_pstore_write_buf+0xd4/0x2a4 [ 0.790900] [<ffffff90083a9d3c>] pstore_console_write+0xf0/0x134 [ 0.790912] [<ffffff900811c304>] console_unlock+0x48c/0x5e8 [ 0.790923] [<ffffff900811da18>] register_console+0x3b0/0x4d4 [ 0.790935] [<ffffff90083aa7d0>] pstore_register+0x1a8/0x234 [ 0.790947] [<ffffff90083ac250>] ramoops_probe+0x6b8/0x7d4 [ 0.790961] [<ffffff90085ca548>] platform_drv_probe+0x7c/0xd0 [ 0.790972] [<ffffff90085c76ac>] driver_probe_device+0x1b4/0x3bc [ 0.790982] [<ffffff90085c7ac8>] __device_attach_driver+0xc8/0xf4 [ 0.790996] [<ffffff90085c4bfc>] bus_for_each_drv+0xb4/0xe4 [ 0.791006] [<ffffff90085c7414>] __device_attach+0xd0/0x158 [ 0.791016] [<ffffff90085c7b18>] device_initial_probe+0x24/0x30 [ 0.791026] [<ffffff90085c648c>] bus_probe_device+0x50/0xe4 [ 0.791038] [<ffffff90085c35b8>] device_add+0x3a4/0x76c [ 0.791051] [<ffffff90087d0e84>] of_device_add+0x74/0x84 [ 0.791062] [<ffffff90087d19b8>] of_platform_device_create_pdata+0xc0/0x100 [ 0.791073] [<ffffff90087d1a2c>] of_platform_device_create+0x34/0x40 [ 0.791086] [<ffffff900903c910>] of_platform_default_populate_init+0x58/0x78 [ 0.791097] [<ffffff90080831fc>] do_one_initcall+0x88/0x160 [ 0.791109] [<ffffff90090010ac>] kernel_init_freeable+0x264/0x31c [ 0.791123] [<ffffff9008a25bd0>] kernel_init+0x18/0x11c [ 0.791133] [<ffffff9008082ec0>] ret_from_fork+0x10/0x50 [ 0.793717] console [pstore-1] enabled [ 0.797845] pstore: Registered ramoops as persistent store backend [ 0.804647] ramoops: attached 0x100000@0xf7edc000, ecc: 0/0
--- fs/pstore/ram_core.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/pstore/ram_core.c +7 -5
@@ -463,8 +463,7 @@ static int persistent_ram_buffer_map(phy }static int persistent_ram_post_init (struct persistent_ram_zone *prz,u32 sig, -struct persistent_ram_ecc_info *ecc_info, -unsigned long flags) +struct persistent_ram_ecc_info *ecc_info) {int ret;
@@ -490,10 +489,9 @@ static int persistent_ram_post_init(stru prz->buffer->sig); } +/* Rewind missing or invalid memory area. */ prz->buffer->sig = sig;persistent_ram_zap (prz); - prz->buffer_lock =__RAW_SPIN_LOCK_UNLOCKED (buffer_lock); - prz->flags = flags;return 0 ; }
@@ -529,11 +527,15 @@ struct persistent_ram_zone *persistent_r goto err; } +/* Initialize general buffer state. */ + prz->buffer_lock =__RAW_SPIN_LOCK_UNLOCKED (buffer_lock); + prz->flags = flags; + ret =persistent_ram_buffer_map (start, size, prz, memtype);if (ret) goto err; - ret =persistent_ram_post_init (prz, sig, ecc_info, flags); + ret =persistent_ram_post_init (prz, sig, ecc_info);if (ret) goto err;
Greg Kroah-Hartman
maintainerPATCH 36/92 pstore: Use dynamic spinlock initializer
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit e9a330c4289f2ba1ca4bf98c2b430ab165a8931b upstream.
The per-prz spinlock should be using the dynamic initializer so that lockdep can correctly track it. Without this, under lockdep, we get a warning at boot that the lock is in non-static memory.
--- fs/pstore/ram_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/pstore/ram_core.c +1 -1
@@ -528,7 +528,7 @@ struct persistent_ram_zone *persistent_r }/* Initialize general buffer state. */ - prz->buffer_lock =__RAW_SPIN_LOCK_UNLOCKED (buffer_lock); +raw_spin_lock_init (&prz->buffer_lock); prz->flags = flags; ret =persistent_ram_buffer_map (start, size, prz, memtype);
Greg Kroah-Hartman
maintainerPATCH 37/92 net: skb_needs_check() accepts CHECKSUM_NONE for tx
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 6e7bc478c9a006c701c14476ec9d389a484b4864 upstream.
My recent change missed fact that UFO would perform a complete UDP checksum before segmenting in frags.
In this case skb->ip_summed is set to CHECKSUM_NONE.
We need to add this valid case to skb_needs_check()
--- net/core/dev.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/core/dev.c +4 -3
@@ -2435,9 +2435,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment);static inline bool skb_needs_check (struct sk_buff *skb,bool tx_path) {if (tx_path) -return skb->ip_summed !=CHECKSUM_PARTIAL ; -else -return skb->ip_summed ==CHECKSUM_NONE ; +return skb->ip_summed !=CHECKSUM_PARTIAL && + skb->ip_summed !=CHECKSUM_NONE ; + +return skb->ip_summed ==CHECKSUM_NONE ; }/**
Greg Kroah-Hartman
maintainerPATCH 38/92 tpm: fix a kernel memory leak in tpm-sysfs.c
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jarkko Sakkinen <[email protected]>
commit 13b47cfcfc60495cde216eef4c01040d76174cbe upstream.
While cleaning up sysfs callback that prints EK we discovered a kernel memory leak. This commit fixes the issue by zeroing the buffer used for TPM command/response.
The leak happen when we use either tpm_vtpm_proxy, tpm_ibmvtpm or xen-tpmfront.
--- drivers/char/tpm/tpm-sysfs.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/char/tpm/tpm-sysfs.c +2 -0
@@ -57,6 +57,8 @@ static ssize_t pubek_show(struct devicestruct tpm_chip *chip =dev_get_drvdata (dev); +memset (&tpm_cmd,0 ,sizeof (tpm_cmd)); + tpm_cmd.header.in = tpm_readpubek_header; err =transmit_cmd (chip, &tpm_cmd,READ_PUBEK_RESULT_SIZE ,"attempting to read the PUBEK" );
Greg Kroah-Hartman
maintainerPATCH 39/92 x86/mce/AMD: Make the init code more robust
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit 0dad3a3014a0b9e72521ff44f17e0054f43dcdea ]
If mce_device_init() fails then the mce device pointer is NULL and the AMD mce code happily dereferences it.
Add a sanity check.
--- arch/x86/kernel/cpu/mcheck/mce_amd.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/cpu/mcheck/mce_amd.c +3 -0
@@ -573,6 +573,9 @@ static int threshold_create_bank(unsigneconst char *name = th_names[bank];int err =0 ; +if (!dev) +return -ENODEV ; +if (is_shared_bank (bank)) { nb =node_to_amd_nb (amd_get_nb_id (cpu));
Greg Kroah-Hartman
maintainerPATCH 40/92 r8169: add support for RTL8168 series add-on card.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chun-Hao Lin <[email protected]>
[ Upstream commit 610c908773d30907c950ca3b2ee8ac4b2813537b ]
This chip is the same as RTL8168, but its device id is 0x8161.
--- drivers/net/ethernet/realtek/r8169.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/realtek/r8169.c +1 -0
@@ -326,6 +326,7 @@ enum cfg_version {static const struct pci_device_id rtl8169_pci_tbl[] = { {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8129 ),0 ,0 ,RTL_CFG_0 }, {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8136 ),0 ,0 ,RTL_CFG_2 }, + {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8161 ),0 ,0 ,RTL_CFG_1 }, {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8167 ),0 ,0 ,RTL_CFG_0 }, {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8168 ),0 ,0 ,RTL_CFG_1 }, {PCI_DEVICE (PCI_VENDOR_ID_REALTEK ,0x8169 ),0 ,0 ,RTL_CFG_0 },
Greg Kroah-Hartman
maintainerPATCH 42/92 ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Li <[email protected]>
[ Upstream commit e4c5e13aa45c23692e4acf56f0b3533f328199b2 ]
There is an inconsistent conditional judgement between __ip6_append_data and ip6_finish_output functions, the variable length in __ip6_append_data just include the length of application's payload and udp6 header, don't include the length of ipv6 header, but in ip6_finish_output use (skb->len > ip6_skb_dst_mtu(skb)) as judgement, and skb->len include the length of ipv6 header.
That causes some particular application's udp6 payloads whose length are between (MTU - IPv6 Header) and MTU were fragmented by ip6_fragment even though the rst->dev support UFO feature.
Add the length of ipv6 header to length in __ip6_append_data to keep consistent conditional judgement as ip6_finish_output for ip6 fragment.
--- net/ipv6/ip6_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/ip6_output.c +1 -1
@@ -1305,7 +1305,7 @@ emsgsize: skb =skb_peek_tail (&sk->sk_write_queue); cork->length += length; - if (((length > mtu) || + if ((((length + fragheaderlen) > mtu) || (skb && skb_is_gso(skb))) && (sk->sk_protocol == IPPROTO_UDP) && (rt->dst.dev->features & NETIF_F_UFO) &&
Greg Kroah-Hartman
maintainerPATCH 43/92 net/mlx4: Remove BUG_ON from ICM allocation routine
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
[ Upstream commit c1d5f8ff80ea84768f5fae1ca9d1abfbb5e6bbaa ]
This patch removes BUG_ON() macro from mlx4_alloc_icm_coherent() by checking DMA address alignment in advance and performing proper folding in case of error.
--- drivers/net/ethernet/mellanox/mlx4/icm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/icm.c +6 -1
@@ -117,8 +117,13 @@ static int mlx4_alloc_icm_coherent(strucif (!buf)return -ENOMEM ; +if (offset_in_page (buf)) { +dma_free_coherent (dev,PAGE_SIZE << order, + buf,sg_dma_address (mem)); +return -ENOMEM ; + } +sg_set_buf (mem, buf,PAGE_SIZE << order); -BUG_ON (mem->offset);sg_dma_len (mem) =PAGE_SIZE << order;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 44/92 drm/msm: Ensure that the hardware write pointer is valid
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Crouse <[email protected]>
[ Upstream commit 88b333b0ed790f9433ff542b163bf972953b74d3 ]
Currently the value written to CP_RB_WPTR is calculated on the fly as (rb->next - rb->start). But as the code is designed rb->next is wrapped before writing the commands so if a series of commands happened to fit perfectly in the ringbuffer, rb->next would end up being equal to rb->size / 4 and thus result in an out of bounds address to CP_RB_WPTR.
The easiest way to fix this is to mask WPTR when writing it to the hardware; it makes the hardware happy and the rest of the ringbuffer math appears to work and there isn't any point in upsetting anything.
--- drivers/gpu/drm/msm/adreno/adreno_gpu.c | 9 ++++++++- drivers/gpu/drm/msm/msm_ringbuffer.c | 3 ++- 2 files changed, 10 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/adreno_gpu.c +8 -1
@@ -199,7 +199,14 @@ void adreno_flush(struct msm_gpu *gpu)void adreno_idle (struct msm_gpu *gpu) {struct adreno_gpu *adreno_gpu =to_adreno_gpu (gpu); -uint32_t wptr =get_wptr (gpu->rb); +uint32_t wptr; + +/* +* Mask wptr value that we calculate to fit in the HW range. This is +* to account for the possibility that the last command fit exactly into +* the ringbuffer and rb->next hasn't wrapped to zero yet +*/ + wptr =get_wptr (gpu->rb) & ((gpu->rb->size /4 ) -1 );/* wait for CP to drain ringbuffer: */ if (spin_until (adreno_gpu->memptrs->rptr == wptr))
drivers/gpu/drm/msm/msm_ringbuffer.c +2 -1
@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_nestruct msm_ringbuffer *ring;int ret; - size =ALIGN (size,4 );/* size should be dword aligned */ +if (WARN_ON (!is_power_of_2 (size))) +return ERR_PTR (-EINVAL ); ring =kzalloc (sizeof (*ring),GFP_KERNEL );if (!ring) {
Greg Kroah-Hartman
maintainerPATCH 45/92 drm/msm: Verify that MSM_SUBMIT_BO_FLAGS are set
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Crouse <[email protected]>
[ Upstream commit a6cb3b864b21b7345f824a4faa12b723c8aaf099 ]
For every submission buffer object one of MSM_SUBMIT_BO_WRITE and MSM_SUBMIT_BO_READ must be set (and nothing else). If we allowed zero then the buffer object would never get queued to be unreferenced.
--- drivers/gpu/drm/msm/msm_gem_submit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_gem_submit.c +2 -1
@@ -90,7 +90,8 @@ static int submit_lookup_objects(structpagefault_disable (); } -if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS ) { +if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS ) || + !(submit_bo.flags &MSM_SUBMIT_BO_FLAGS )) {DRM_ERROR ("invalid flags: %x\n" , submit_bo.flags); ret = -EINVAL ; goto out_unlock;
Greg Kroah-Hartman
maintainerPATCH 46/92 vfio-pci: use 32-bit comparisons for register address for gcc-4.5
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
[ Upstream commit 45e869714489431625c569d21fc952428d761476 ]
Using ancient compilers (gcc-4.5 or older) on ARM, we get a link failure with the vfio-pci driver:
ERROR: "__aeabi_lcmp" [drivers/vfio/pci/vfio-pci.ko] undefined!
The reason is that the compiler tries to do a comparison of a 64-bit range. This changes it to convert to a 32-bit number explicitly first, as newer compilers do for themselves.
--- drivers/vfio/pci/vfio_pci_rdwr.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/vfio/pci/vfio_pci_rdwr.c +4 -1
@@ -190,7 +190,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_if (!vdev->has_vga)return -EINVAL ; -switch (pos) { +if (pos >0xbfffful ) +return -EINVAL ; + +switch ((u32 )pos) { case 0xa0000 ... 0xbffff: count =min (count, (size_t )(0xc0000 - pos)); iomem =ioremap_nocache (0xa0000 ,0xbffff -0xa0000 +1 );
Greg Kroah-Hartman
maintainerPATCH 47/92 ASoC: tlv320aic3x: Mark the RESET register as volatile
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Ujfalusi <[email protected]>
[ Upstream commit 63c3194b82530bd71fd49db84eb7ab656b8d404a ]
The RESET register only have one self clearing bit and it should not be cached. If it is cached, when we sync the registers back to the chip we will initiate a software reset as well, which is not desirable.
--- sound/soc/codecs/tlv320aic3x.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
sound/soc/codecs/tlv320aic3x.c +13 -0
@@ -122,6 +122,16 @@ static const struct reg_default aic3x_re { 108, 0x00 }, { 109, 0x00 }, }; +static bool aic3x_volatile_reg (struct device *dev,unsigned int reg) +{ +switch (reg) { +case AIC3X_RESET : +return true; +default : +return false; + } +} +static const struct regmap_config aic3x_regmap = { .reg_bits =8 , .val_bits = 8,
@@ -129,6 +139,9 @@ static const struct regmap_config aic3x_ .max_register = DAC_ICC_ADJ, .reg_defaults = aic3x_reg, .num_reg_defaults = ARRAY_SIZE(aic3x_reg), + + .volatile_reg = aic3x_volatile_reg, + .cache_type = REGCACHE_RBTREE, };
Greg Kroah-Hartman
maintainerPATCH 48/92 spi: dw: Make debugfs name unique between instances
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Reid <[email protected]>
[ Upstream commit 13288bdf4adbaa6bd1267f10044c1bc25d90ce7f ]
Some system have multiple dw devices. Currently the driver uses a fixed name for the debugfs dir. Append dev name to the debugfs dir name to make it unique.
--- drivers/spi/spi-dw.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/spi/spi-dw.c +4 -1
@@ -118,7 +118,10 @@ static const struct file_operations dw_sstatic int dw_spi_debugfs_init (struct dw_spi *dws) { - dws->debugfs =debugfs_create_dir ("dw_spi" ,NULL ); +char name[128 ]; + +snprintf (name,128 ,"dw_spi-%s" ,dev_name (&dws->master->dev)); + dws->debugfs =debugfs_create_dir (name,NULL );if (!dws->debugfs)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 49/92 vlan: Propagate MAC address to VLANs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Manning <[email protected]>
commit 308453aa9156a3b8ee382c0949befb507a32b0c1 upstream.
The MAC address of the physical interface is only copied to the VLAN when it is first created, resulting in an inconsistency after MAC address changes of only newly created VLANs having an up-to-date MAC.
The VLANs should continue inheriting the MAC address of the physical interface until the VLAN MAC address is explicitly set to any value. This allows IPv6 EUI64 addresses for the VLAN to reflect any changes to the MAC of the physical interface and thus for DAD to behave as expected.
--- net/8021q/vlan.c | 5 +++++ net/8021q/vlan.h | 2 ++ net/8021q/vlan_dev.c | 20 +++++++++++++++++--- 3 files changed, 24 insertions(+), 3 deletions(-)
net/8021q/vlan.c +5 -0
@@ -292,6 +292,10 @@ static void vlan_sync_address(struct netif (ether_addr_equal (vlan->real_dev_addr, dev->dev_addr))return ; +/* vlan continues to inherit address of lower device */ +if (vlan_dev_inherit_address (vlandev, dev)) + goto out; +/* vlan address was different from the old address and is equal to * the new address */ if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) &&
@@ -304,6 +308,7 @@ static void vlan_sync_address(struct net !ether_addr_equal(vlandev->dev_addr, dev->dev_addr))dev_uc_add (dev, vlandev->dev_addr); +out:ether_addr_copy (vlan->real_dev_addr, dev->dev_addr); }
net/8021q/vlan.h +2 -0
@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_devicvoid vlan_setup (struct net_device *dev);int register_vlan_dev (struct net_device *dev);void unregister_vlan_dev (struct net_device *dev,struct list_head *head); +bool vlan_dev_inherit_address (struct net_device *dev, +struct net_device *real_dev);static inline u32 vlan_get_ingress_priority (struct net_device *dev,u16 vlan_tci)
net/8021q/vlan_dev.c +17 -3
@@ -276,6 +276,17 @@ void vlan_dev_get_realdev_name(const strstrncpy (result,vlan_dev_priv (dev)->real_dev->name,23 ); } +bool vlan_dev_inherit_address (struct net_device *dev, +struct net_device *real_dev) +{ +if (dev->addr_assign_type !=NET_ADDR_STOLEN ) +return false; + +ether_addr_copy (dev->dev_addr, real_dev->dev_addr); +call_netdevice_notifiers (NETDEV_CHANGEADDR , dev); +return true; +} +static int vlan_dev_open (struct net_device *dev) {struct vlan_dev_priv *vlan =vlan_dev_priv (dev);
@@ -286,7 +297,8 @@ static int vlan_dev_open(struct net_devi !(vlan->flags & VLAN_FLAG_LOOSE_BINDING))return -ENETDOWN ; -if (!ether_addr_equal (dev->dev_addr, real_dev->dev_addr)) { +if (!ether_addr_equal (dev->dev_addr, real_dev->dev_addr) && + !vlan_dev_inherit_address (dev, real_dev)) { err =dev_uc_add (real_dev, dev->dev_addr);if (err <0 ) goto out;
@@ -591,8 +603,10 @@ static int vlan_dev_init(struct net_devi/* ipv6 shared card related stuff */ dev->dev_id = real_dev->dev_id; -if (is_zero_ether_addr (dev->dev_addr)) -eth_hw_addr_inherit (dev, real_dev); +if (is_zero_ether_addr (dev->dev_addr)) { +ether_addr_copy (dev->dev_addr, real_dev->dev_addr); + dev->addr_assign_type =NET_ADDR_STOLEN ; + }if (is_zero_ether_addr (dev->broadcast))memcpy (dev->broadcast, real_dev->broadcast, dev->addr_len);
Greg Kroah-Hartman
maintainerPATCH 50/92 xfrm: Dont use sk_family for socket policy lookups
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
commit 4c86d77743a54fb2d8a4d18a037a074c892bb3be upstream.
On IPv4-mapped IPv6 addresses sk_family is AF_INET6, but the flow informations are created based on AF_INET. So the routing set up 'struct flowi4' but we try to access 'struct flowi6' what leads to an out of bounds access. Fix this by using the family we get with the dst_entry, like we do it for the standard policy lookup.
--- net/xfrm/xfrm_policy.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/xfrm/xfrm_policy.c +4 -5
@@ -1211,15 +1211,14 @@ static inline int policy_to_flow_dir(int }static struct xfrm_policy *xfrm_sk_policy_lookup (struct sock *sk,int dir, -const struct flowi *fl) +const struct flowi *fl,u16 family) {struct xfrm_policy *pol;struct net *net =sock_net (sk);read_lock_bh (&net->xfrm.xfrm_policy_lock);if ((pol = sk->sk_policy[dir]) !=NULL ) { -bool match =xfrm_selector_match (&pol->selector, fl, - sk->sk_family); +bool match =xfrm_selector_match (&pol->selector, fl, family);int err =0 ;if (match) {
@@ -2150,7 +2149,7 @@ struct dst_entry *xfrm_lookup(struct netif (sk && sk->sk_policy[XFRM_POLICY_OUT ]) { num_pols =1 ; - pols[0 ] =xfrm_sk_policy_lookup (sk,XFRM_POLICY_OUT , fl); + pols[0 ] =xfrm_sk_policy_lookup (sk,XFRM_POLICY_OUT , fl, family); err =xfrm_expand_policies (fl, family, pols, &num_pols, &num_xfrms);if (err <0 )
@@ -2428,7 +2427,7 @@ int __xfrm_policy_check(struct sock *sk, pol =NULL ;if (sk && sk->sk_policy[dir]) { - pol =xfrm_sk_policy_lookup (sk, dir, &fl); + pol =xfrm_sk_policy_lookup (sk, dir, &fl, family);if (IS_ERR (pol)) {XFRM_INC_STATS (net,LINUX_MIB_XFRMINPOLERROR );return 0 ;
Greg Kroah-Hartman
maintainerPATCH 51/92 tile: add <asm/word-at-a-time.h> and enable support functions
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 5bf6c07a1843813d0065feaaecba622d49148d7e upstream.
This change enables the generic strncpy_from_user() and strnlen_user() using word-at-a-time.h. The tile implementation is trivial since both tilepro and tilegx have SIMD operations that do byte-wise comparisons against immediate zero for each byte, and return an 0x01 byte in each position where there is a 0x00 byte.
--- arch/tile/Kconfig | 2 + arch/tile/include/asm/uaccess.h | 66 +++++---------------------------- arch/tile/include/asm/word-at-a-time.h | 36 ++++++++++++++++++ arch/tile/lib/exports.c | 2 - arch/tile/lib/usercopy_32.S | 46 ----------------------- arch/tile/lib/usercopy_64.S | 46 ----------------------- 6 files changed, 48 insertions(+), 150 deletions(-)
arch/tile/Kconfig +2 -0
@@ -27,6 +27,8 @@ config TILE select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE select HAVE_DEBUG_STACKOVERFLOW select ARCH_WANT_FRAME_POINTERS + select GENERIC_STRNCPY_FROM_USER + select GENERIC_STRNLEN_USER # FIXME: investigate whether we need/want these options. # select HAVE_IOREMAP_PROT
arch/tile/include/asm/uaccess.h +10 -56
78 lines not on this page · raw message
arch/tile/include/asm/word-at-a-time.h new file +36 -0
@@ -0,0 +1,36 @@ +#ifndef _ASM_WORD_AT_A_TIME_H +#define _ASM_WORD_AT_A_TIME_H + +#include <asm/byteorder.h> + +struct word_at_a_time {/* unused */ }; +#define WORD_AT_A_TIME_CONSTANTS {} + +/* Generate 0x01 byte values for non-zero bytes using a SIMD instruction. */ +static inline unsigned long has_zero (unsigned long val,unsigned long *data, +const struct word_at_a_time *c) +{ +#ifdef __tilegx__ +unsigned long mask =__insn_v1cmpeqi (val,0 ); +#else /* tilepro */ +unsigned long mask =__insn_seqib (val,0 ); +#endif + *data = mask; +return mask; +} + +/* These operations are both nops. */ +#define prep_zero_mask (val, data, c) (data) +#define create_zero_mask (data) (data) + +/* And this operation just depends on endianness. */ +static inline long find_zero (unsigned long mask) +{ +#ifdef __BIG_ENDIAN +return __builtin_clzl (mask) >>3 ; +#else +return __builtin_ctzl (mask) >>3 ; +#endif +} + +#endif /* _ASM_WORD_AT_A_TIME_H */
arch/tile/lib/exports.c +0 -2
@@ -18,8 +18,6 @@/* arch/tile/lib/usercopy.S */ #include <linux/uaccess.h> -EXPORT_SYMBOL (strnlen_user_asm); -EXPORT_SYMBOL (strncpy_from_user_asm);EXPORT_SYMBOL (clear_user_asm);EXPORT_SYMBOL (flush_user_asm);EXPORT_SYMBOL (finv_user_asm);
arch/tile/lib/usercopy_32.S +0 -46
52 lines not on this page · raw message
arch/tile/lib/usercopy_64.S +0 -46
52 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 52/92 word-at-a-time.h: support zero_bytemask() on alpha and tile
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit c753bf34c94e5ac901e625e52f47320eeec4de2d upstream.
Both alpha and tile needed implementations of zero_bytemask.
The alpha version is untested.
--- arch/alpha/include/asm/word-at-a-time.h | 2 ++ arch/tile/include/asm/word-at-a-time.h | 8 +++++++- 2 files changed, 9 insertions(+), 1 deletion(-)
arch/alpha/include/asm/word-at-a-time.h +2 -0
@@ -52,4 +52,6 @@ static inline unsigned long find_zero(un #endif } +#define zero_bytemask (mask) ((2ul << (find_zero(mask) * 8)) - 1) +#endif /* _ASM_WORD_AT_A_TIME_H */
arch/tile/include/asm/word-at-a-time.h +7 -1
@@ -6,7 +6,7 @@struct word_at_a_time {/* unused */ };#define WORD_AT_A_TIME_CONSTANTS {} -/* Generate 0x01 byte values for non-zero bytes using a SIMD instruction. */ +/* Generate 0x01 byte values for zero bytes using a SIMD instruction. */ static inline unsigned long has_zero (unsigned long val,unsigned long *data,const struct word_at_a_time *c) {
@@ -33,4 +33,10 @@ static inline long find_zero(unsigned lo #endif } +#ifdef __BIG_ENDIAN +#define zero_bytemask (mask) (~1ul << (63 - __builtin_clzl(mask))) +#else +#define zero_bytemask (mask) ((2ul << __builtin_ctzl(mask)) - 1) +#endif +#endif /* _ASM_WORD_AT_A_TIME_H */
Greg Kroah-Hartman
maintainerPATCH 53/92 Make asm/word-at-a-time.h available on all architectures
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit a6e2f029ae34f41adb6ae3812c32c5d326e1abd2 upstream.
Added the x86 implementation of word-at-a-time to the generic version, which previously only supported big-endian.
Omitted the x86-specific load_unaligned_zeropad(), which in any case is also not present for the existing BE-only implementation of a word-at-a-time, and is only used under CONFIG_DCACHE_WORD_ACCESS.
Added as a "generic-y" to the Kbuilds of all architectures that didn't previously have it.
--- arch/arc/include/asm/Kbuild | 1 arch/avr32/include/asm/Kbuild | 1 arch/blackfin/include/asm/Kbuild | 1 arch/c6x/include/asm/Kbuild | 1 arch/cris/include/asm/Kbuild | 1 arch/frv/include/asm/Kbuild | 1 arch/hexagon/include/asm/Kbuild | 1 arch/ia64/include/asm/Kbuild | 1 arch/m32r/include/asm/Kbuild | 1 arch/metag/include/asm/Kbuild | 1 arch/microblaze/include/asm/Kbuild | 1 arch/mips/include/asm/Kbuild | 1 arch/mn10300/include/asm/Kbuild | 1 arch/powerpc/include/asm/Kbuild | 1 arch/s390/include/asm/Kbuild | 1 arch/score/include/asm/Kbuild | 1 arch/tile/include/asm/Kbuild | 1 arch/um/include/asm/Kbuild | 1 arch/unicore32/include/asm/Kbuild | 1 arch/xtensa/include/asm/Kbuild | 1 include/asm-generic/word-at-a-time.h | 80 +++++++++++++++++++++++++++++++---- 21 files changed, 92 insertions(+), 8 deletions(-)
arch/arc/include/asm/Kbuild +1 -0
@@ -50,4 +50,5 @@ generic-y += types.h generic-y += ucontext.h generic-y += user.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/avr32/include/asm/Kbuild +1 -0
@@ -21,4 +21,5 @@ generic-y += sections.h generic-y += topology.h generic-y += trace_clock.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/blackfin/include/asm/Kbuild +1 -0
@@ -47,4 +47,5 @@ generic-y += types.h generic-y += ucontext.h generic-y += unaligned.h generic-y += user.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/c6x/include/asm/Kbuild +1 -0
@@ -59,4 +59,5 @@ generic-y += types.h generic-y += ucontext.h generic-y += user.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/cris/include/asm/Kbuild +1 -0
@@ -18,4 +18,5 @@ generic-y += scatterlist.h generic-y += sections.h generic-y += trace_clock.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/frv/include/asm/Kbuild +1 -0
@@ -8,3 +8,4 @@ generic-y += mcs_spinlock.h generic-y += preempt.h generic-y += scatterlist.h generic-y += trace_clock.h +generic-y += word-at-a-time.h
arch/hexagon/include/asm/Kbuild +1 -0
@@ -59,4 +59,5 @@ generic-y += types.h generic-y += ucontext.h generic-y += unaligned.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/ia64/include/asm/Kbuild +1 -0
@@ -9,3 +9,4 @@ generic-y += preempt.h generic-y += scatterlist.h generic-y += trace_clock.h generic-y += vtime.h +generic-y += word-at-a-time.h
arch/m32r/include/asm/Kbuild +1 -0
@@ -10,3 +10,4 @@ generic-y += preempt.h generic-y += scatterlist.h generic-y += sections.h generic-y += trace_clock.h +generic-y += word-at-a-time.h
arch/metag/include/asm/Kbuild +1 -0
@@ -55,4 +55,5 @@ generic-y += ucontext.h generic-y += unaligned.h generic-y += user.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/microblaze/include/asm/Kbuild +1 -0
@@ -11,3 +11,4 @@ generic-y += preempt.h generic-y += scatterlist.h generic-y += syscalls.h generic-y += trace_clock.h +generic-y += word-at-a-time.h
arch/mips/include/asm/Kbuild +1 -0
@@ -18,4 +18,5 @@ generic-y += serial.h generic-y += trace_clock.h generic-y += ucontext.h generic-y += user.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/mn10300/include/asm/Kbuild +1 -0
@@ -10,3 +10,4 @@ generic-y += preempt.h generic-y += scatterlist.h generic-y += sections.h generic-y += trace_clock.h +generic-y += word-at-a-time.h
arch/powerpc/include/asm/Kbuild +1 -0
@@ -8,3 +8,4 @@ generic-y += rwsem.h generic-y += scatterlist.h generic-y += trace_clock.h generic-y += vtime.h +generic-y += word-at-a-time.h
arch/s390/include/asm/Kbuild +1 -0
@@ -7,3 +7,4 @@ generic-y += mcs_spinlock.h generic-y += preempt.h generic-y += scatterlist.h generic-y += trace_clock.h +generic-y += word-at-a-time.h
arch/score/include/asm/Kbuild +1 -0
@@ -14,3 +14,4 @@ generic-y += sections.h generic-y += trace_clock.h generic-y += xor.h generic-y += serial.h +generic-y += word-at-a-time.h
arch/tile/include/asm/Kbuild +1 -0
@@ -41,4 +41,5 @@ generic-y += termbits.h generic-y += termios.h generic-y += trace_clock.h generic-y += types.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/um/include/asm/Kbuild +1 -0
@@ -27,4 +27,5 @@ generic-y += sections.h generic-y += switch_to.h generic-y += topology.h generic-y += trace_clock.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/unicore32/include/asm/Kbuild +1 -0
@@ -63,4 +63,5 @@ generic-y += ucontext.h generic-y += unaligned.h generic-y += user.h generic-y += vga.h +generic-y += word-at-a-time.h generic-y += xor.h
arch/xtensa/include/asm/Kbuild +1 -0
@@ -30,4 +30,5 @@ generic-y += statfs.h generic-y += termios.h generic-y += topology.h generic-y += trace_clock.h +generic-y += word-at-a-time.h generic-y += xor.h
include/asm-generic/word-at-a-time.h +72 -8
91 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 54/92 arch/powerpc: provide zero_bytemask() for big-endian
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 7a5692e6e533fd379081ab06fb58f3f5ee4d80bc upstream.
For some reason, only the little-endian flavor of powerpc provided the zero_bytemask() implementation.
--- arch/powerpc/include/asm/word-at-a-time.h | 5 +++++ 1 file changed, 5 insertions(+)
arch/powerpc/include/asm/word-at-a-time.h +5 -0
@@ -40,6 +40,11 @@ static inline bool has_zero(unsigned lon return (val + c->high_bits) & ~rhs; } +static inline unsigned long zero_bytemask (unsigned long mask) +{ +return ~1ul <<__fls (mask); +} +#else #ifdef CONFIG_64BIT
Greg Kroah-Hartman
maintainerPATCH 55/92 tile: use global strscpy() rather than private copy
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Metcalf <[email protected]>
commit 30059d494a72603d066baf55c748803df968aa08 upstream.
Now that strscpy() is a standard API, remove the local copy.
--- arch/tile/gxio/mpipe.c | 33 ++++----------------------------- 1 file changed, 4 insertions(+), 29 deletions(-)
arch/tile/gxio/mpipe.c +4 -29
@@ -19,6 +19,7 @@#include <linux/errno.h> #include <linux/io.h> #include <linux/module.h> +#include <linux/string.h> #include <gxio/iorpc_globals.h> #include <gxio/iorpc_mpipe.h>
@@ -29,32 +30,6 @@/* HACK: Avoid pointless "shadow" warnings. */ #define link link_shadow -/** -* strscpy - Copy a C-string into a sized buffer, but only if it fits -* @dest: Where to copy the string to -* @src: Where to copy the string from -* @size: size of destination buffer -* -* Use this routine to avoid copying too-long strings. -* The routine returns the total number of bytes copied -* (including the trailing NUL) or zero if the buffer wasn't -* big enough. To ensure that programmers pay attention -* to the return code, the destination has a single NUL -* written at the front (if size is non-zero) when the -* buffer is not big enough. -*/ -static size_t strscpy (char *dest,const char *src,size_t size) -{ -size_t len =strnlen (src, size) +1 ; -if (len > size) { -if (size) - dest[0 ] ='\0' ; -return 0 ; - } -memcpy (dest, src, len); -return len; -} -int gxio_mpipe_init (gxio_mpipe_context_t *context,unsigned int mpipe_index) {char file[32 ];
@@ -537,7 +512,7 @@ int gxio_mpipe_link_instance(const charif (!context)return GXIO_ERR_NO_DEVICE ; -if (strscpy (name.name, link_name,sizeof (name.name)) ==0 ) +if (strscpy (name.name, link_name,sizeof (name.name)) <0 )return GXIO_ERR_NO_DEVICE ;return gxio_mpipe_info_instance_aux (context, name);
@@ -555,7 +530,7 @@ int gxio_mpipe_link_enumerate_mac(int id rv =gxio_mpipe_info_enumerate_aux (context, idx, &name, &mac);if (rv >=0 ) { -if (strscpy (link_name, name.name,sizeof (name.name)) ==0 ) +if (strscpy (link_name, name.name,sizeof (name.name)) <0 )return GXIO_ERR_INVAL_MEMORY_SIZE ;memcpy (link_mac, mac.mac,sizeof (mac.mac)); }
@@ -572,7 +547,7 @@ int gxio_mpipe_link_open(gxio_mpipe_link_gxio_mpipe_link_name_t name;int rv; -if (strscpy (name.name, link_name,sizeof (name.name)) ==0 ) +if (strscpy (name.name, link_name,sizeof (name.name)) <0 )return GXIO_ERR_NO_DEVICE ; rv =gxio_mpipe_link_open_aux (context, name, flags);
Greg Kroah-Hartman
maintainerPATCH 56/92 libata: array underflow in ata_find_dev()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 59a5e266c3f5c1567508888dd61a45b86daed0fa upstream.
My static checker complains that "devno" can be negative, meaning that we read before the start of the loop. I've looked at the code, and I think the warning is right. This come from /proc so it's root only or it would be quite a quite a serious bug. The call tree looks like this:
proc_scsi_write() <- gets id and channel from simple_strtoul() -> scsi_add_single_device() <- calls shost->transportt->user_scan()
-> ata_scsi_user_scan()
-> ata_find_dev()
--- drivers/ata/libata-scsi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/ata/libata-scsi.c +4 -2
@@ -2798,10 +2798,12 @@ static unsigned int atapi_xlat(struct atstatic struct ata_device *ata_find_dev (struct ata_port *ap,int devno) {if (!sata_pmp_attached (ap)) { -if (likely (devno <ata_link_max_devices (&ap->link))) +if (likely (devno >=0 && + devno <ata_link_max_devices (&ap->link)))return &ap->link.device[devno]; }else { -if (likely (devno < ap->nr_pmp_links)) +if (likely (devno >=0 && + devno < ap->nr_pmp_links))return &ap->pmp_link[devno].device[0 ]; }
Greg Kroah-Hartman
maintainerPATCH 57/92 workqueue: restore WQ_UNBOUND/max_active==1 to be ordered
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 5c0338c68706be53b3dc472e4308961c36e4ece1 upstream.
The combination of WQ_UNBOUND and max_active == 1 used to imply ordered execution. After NUMA affinity 4c16bd327c74 ("workqueue:
implement NUMA affinity for unbound workqueues"), this is no longer true due to per-node worker pools.
While the right way to create an ordered workqueue is alloc_ordered_workqueue(), the documentation has been misleading for a long time and people do use WQ_UNBOUND and max_active == 1 for ordered workqueues which can lead to subtle bugs which are very difficult to trigger.
It's unlikely that we'd see noticeable performance impact by enforcing ordering on WQ_UNBOUND / max_active == 1 workqueues. Let's automatically set __WQ_ORDERED for those workqueues.
--- kernel/workqueue.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
kernel/workqueue.c +10 -0
@@ -4075,6 +4075,16 @@ struct workqueue_struct *__alloc_workquestruct workqueue_struct *wq;struct pool_workqueue *pwq; +/* +* Unbound && max_active == 1 used to imply ordered, which is no +* longer the case on NUMA machines due to per-node pools. While +* alloc_ordered_workqueue() is the right way to create an ordered +* workqueue, keep the previous behavior to avoid subtle breakages +* on NUMA. +*/ +if ((flags &WQ_UNBOUND ) && max_active ==1 ) + flags |= __WQ_ORDERED; +/* see the comment above the definition of WQ_POWER_EFFICIENT */ if ((flags &WQ_POWER_EFFICIENT ) && wq_power_efficient) flags |=WQ_UNBOUND ;
Greg Kroah-Hartman
maintainerPATCH 58/92 ALSA: hda - Fix speaker output from VAIO VPCL14M1R
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei A. Trusov <[email protected]>
commit 3f3c371421e601fa93b6cb7fb52da9ad59ec90b4 upstream.
Sony VAIO VPCL14M1R needs the quirk to make the speaker working properly.
--- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_realtek.c +1 -0
@@ -2203,6 +2203,7 @@ static const struct snd_pci_quirk alc882SND_PCI_QUIRK (0x1043 ,0x84bc ,"ASUS ET2700" ,ALC887_FIXUP_ASUS_BASS ),SND_PCI_QUIRK (0x104d ,0x9047 ,"Sony Vaio TT" ,ALC889_FIXUP_VAIO_TT ),SND_PCI_QUIRK (0x104d ,0x905a ,"Sony Vaio Z" ,ALC882_FIXUP_NO_PRIMARY_HP ), +SND_PCI_QUIRK (0x104d ,0x9060 ,"Sony Vaio VPCL14M1R" ,ALC882_FIXUP_NO_PRIMARY_HP ),SND_PCI_QUIRK (0x104d ,0x9043 ,"Sony Vaio VGC-LN51JGB" ,ALC882_FIXUP_NO_PRIMARY_HP ), SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP),
Greg Kroah-Hartman
maintainerPATCH 59/92 ASoC: do not close shared backend dailink
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Banajit Goswami <[email protected]>
commit b1cd2e34c69a2f3988786af451b6e17967c293a0 upstream.
Multiple frontend dailinks may be connected to a backend dailink at the same time. When one of frontend dailinks is closed, the associated backend dailink should not be closed if it is connected to other active frontend dailinks. Change ensures that backend dailink is closed only after all connected frontend dailinks are closed.
--- sound/soc/soc-pcm.c | 4 ++++ 1 file changed, 4 insertions(+)
sound/soc/soc-pcm.c +4 -0
@@ -163,6 +163,10 @@ int dpcm_dapm_stream_event(struct snd_sodev_dbg (be->dev,"ASoC: BE %s event %d dir %d\n" , be->dai_link->name, event, dir); +if ((event ==SND_SOC_DAPM_STREAM_STOP ) && + (be->dpcm[dir].users >=1 )) +continue ; +snd_soc_dapm_stream_event (be, dir, event); }
Greg Kroah-Hartman
maintainerPATCH 61/92 mm/page_alloc: Remove kernel address exposure in free_reserved_area()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <[email protected]>
commit adb1fe9ae2ee6ef6bc10f3d5a588020e7664dfa7 upstream.
Linus suggested we try to remove some of the low-hanging fruit related to kernel address exposure in dmesg. The only leaks I see on my local system are:
Freeing SMP alternatives memory: 32K (ffffffff9e309000 - ffffffff9e311000) Freeing initrd memory: 10588K (ffffa0b736b42000 - ffffa0b737599000) Freeing unused kernel memory: 3592K (ffffffff9df87000 - ffffffff9e309000) Freeing unused kernel memory: 1352K (ffffa0b7288ae000 - ffffa0b728a00000) Freeing unused kernel memory: 632K (ffffa0b728d62000 - ffffa0b728e00000)
Linus says:
"I suspect we should just remove [the addresses in the 'Freeing'
messages]. I'm sure they are useful in theory, but I suspect they were more useful back when the whole "free init memory" was originally done.
These days, if we have a use-after-free, I suspect the init-mem situation is the easiest situation by far. Compared to all the dynamic allocations which are much more likely to show it anyway. So having debug output for that case is likely not all that productive."
With this patch the freeing messages now look like this:
Freeing SMP alternatives memory: 32K
Freeing initrd memory: 10588K
Freeing unused kernel memory: 3592K
Freeing unused kernel memory: 1352K
Freeing unused kernel memory: 632K
--- mm/page_alloc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/page_alloc.c +2 -2
@@ -5467,8 +5467,8 @@ unsigned long free_reserved_area(void *s }if (pages && s) -pr_info ("Freeing %s memory: %ldK (%p - %p)\n" , - s, pages << (PAGE_SHIFT -10 ), start, end); +pr_info ("Freeing %s memory: %ldK\n" , + s, pages << (PAGE_SHIFT -10 ));return pages; }
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>
Greg Kroah-Hartman
maintainerPATCH 62/92 ext4: fix SEEK_HOLE/SEEK_DATA for blocksize < pagesize
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit fcf5ea10992fbac3c7473a1db33d56a139333cd1 upstream.
ext4_find_unwritten_pgoff() does not properly handle a situation when starting index is in the middle of a page and blocksize < pagesize. The following command shows the bug on filesystem with 1k blocksize:
xfs_io -f -c "falloc 0 4k" \
-c "pwrite 1k 1k" \
-c "pwrite 3k 1k" \
-c "seek -a -r 0" fooIn this example, neither lseek(fd, 1024, SEEK_HOLE) nor lseek(fd, 2048, SEEK_DATA) will return the correct result.
Fix the problem by neglecting buffers in a page before starting offset.
--- fs/ext4/file.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ext4/file.c +3 -0
@@ -340,6 +340,8 @@ static int ext4_find_unwritten_pgoff(str lastoff =page_offset (page); bh = head =page_buffers (page); do { + if (lastoff + bh->b_size <= startoff) + goto next; if (buffer_uptodate(bh) || buffer_unwritten(bh)) { if (whence == SEEK_DATA)
@@ -354,6 +356,7 @@ static int ext4_find_unwritten_pgoff(strunlock_page (page); goto out; } +next: lastoff += bh->b_size; bh = bh->b_this_page; }while (bh != head);
Greg Kroah-Hartman
maintainerPATCH 63/92 ext4: fix overflow caused by missing cast in ext4_resize_fs()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Lee <[email protected]>
commit aec51758ce10a9c847a62a48a168f8c804c6e053 upstream.
On a 32-bit platform, the value of n_blcoks_count may be wrong during the file system is resized to size larger than 2^32 blocks. This may caused the superblock being corrupted with zero blocks count.
--- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/resize.c +2 -1
@@ -1929,7 +1929,8 @@ retry: n_desc_blocks = o_desc_blocks +le16_to_cpu (es->s_reserved_gdt_blocks); n_group = n_desc_blocks *EXT4_DESC_PER_BLOCK (sb); - n_blocks_count = n_group *EXT4_BLOCKS_PER_GROUP (sb); + n_blocks_count = (ext4_fsblk_t )n_group * +EXT4_BLOCKS_PER_GROUP (sb); n_group--;/* set to last group number */ }
Greg Kroah-Hartman
maintainerPATCH 64/92 media: platform: davinci: return -EINVAL for VPFE_CMD_S_CCDC_RAW_PARAMS ioctl
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prabhakar Lad <[email protected]>
commit da05d52d2f0f6bd61094a0cd045fed94bf7d673a upstream.
this patch makes sure VPFE_CMD_S_CCDC_RAW_PARAMS ioctl no longer works for vpfe_capture driver with a minimal patch suitable for backporting.
- This ioctl was never in public api and was only defined in kernel header.
- The function set_params constantly mixes up pointers and phys_addr_t numbers.
- This is part of a 'VPFE_CMD_S_CCDC_RAW_PARAMS' ioctl command that is described as an 'experimental ioctl that will change in future kernels'.
- The code to allocate the table never gets called after we copy_from_user the user input over the kernel settings, and then compare them for inequality.
- We then go on to use an address provided by user space as both the __user pointer for input and pass it through phys_to_virt to come up with a kernel pointer to copy the data to. This looks like a trivially exploitable root hole.
Due to these reasons we make sure this ioctl now returns -EINVAL and backport this patch as far as possible.
--- drivers/media/platform/davinci/vpfe_capture.c | 22 ++-------------------- 1 file changed, 2 insertions(+), 20 deletions(-)
drivers/media/platform/davinci/vpfe_capture.c +2 -20
@@ -1706,27 +1706,9 @@ static long vpfe_param_handler(struct fiswitch (cmd) {case VPFE_CMD_S_CCDC_RAW_PARAMS : + ret = -EINVAL ;v4l2_warn (&vpfe_dev->v4l2_dev, -"VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n" ); -if (ccdc_dev->hw_ops.set_params) { - ret = ccdc_dev->hw_ops.set_params (param); -if (ret) { -v4l2_dbg (1 , debug, &vpfe_dev->v4l2_dev, -"Error setting parameters in CCDC\n" ); - goto unlock_out; - } - ret =vpfe_get_ccdc_image_format (vpfe_dev, - &vpfe_dev->fmt); -if (ret <0 ) { -v4l2_dbg (1 , debug, &vpfe_dev->v4l2_dev, -"Invalid image format at CCDC\n" ); - goto unlock_out; - } - }else { - ret = -EINVAL ; -v4l2_dbg (1 , debug, &vpfe_dev->v4l2_dev, -"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n" ); - } +"VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n" );break ;default : ret = -ENOTTY ;
Greg Kroah-Hartman
maintainerPATCH 65/92 target: Avoid mappedlun symlink creation during lun shutdown
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 49cb77e297dc611a1b795cfeb79452b3002bd331 upstream.
This patch closes a race between se_lun deletion during configfs unlink in target_fabric_port_unlink() -> core_dev_del_lun() -> core_tpg_remove_lun(), when transport_clear_lun_ref() blocks waiting for percpu_ref RCU grace period to finish, but a new NodeACL mappedlun is added before the RCU grace period has completed.
This can happen in target_fabric_mappedlun_link() because it only checks for se_lun->lun_se_dev, which is not cleared until after transport_clear_lun_ref() percpu_ref RCU grace period finishes.
This bug originally manifested as NULL pointer dereference OOPsen in target_stat_scsi_att_intr_port_show_attr_dev() on v4.1.y code, because it dereferences lun->lun_se_dev without a explicit NULL pointer check.
In post v4.1 code with target-core RCU conversion, the code in target_stat_scsi_att_intr_port_show_attr_dev() no longer uses se_lun->lun_se_dev, but the same race still exists.
To address the bug, go ahead and set se_lun>lun_shutdown as early as possible in core_tpg_remove_lun(), and ensure new NodeACL mappedlun creation in target_fabric_mappedlun_link() fails during se_lun shutdown.
--- drivers/target/target_core_fabric_configfs.c | 5 +++++ drivers/target/target_core_tpg.c | 3 +++ include/target/target_core_base.h | 1 + 3 files changed, 9 insertions(+)
drivers/target/target_core_fabric_configfs.c +5 -0
@@ -84,6 +84,11 @@ static int target_fabric_mappedlun_link( "_tpg does not exist\n");return -EINVAL ; } +if (lun->lun_shutdown) { +pr_err ("Unable to create mappedlun symlink because" +" lun->lun_shutdown=true\n" ); +return -EINVAL ; + } se_tpg = lun->lun_sep->sep_tpg; nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item;
drivers/target/target_core_tpg.c +3 -0
@@ -843,6 +843,8 @@ void core_tpg_remove_lun(struct se_portal_group *tpg, struct se_lun *lun) { + lun->lun_shutdown = true; +core_clear_lun_from_tpg (lun, tpg);transport_clear_lun_ref (lun);
@@ -850,6 +852,7 @@ void core_tpg_remove_lun(spin_lock (&tpg->tpg_lun_lock); lun->lun_status =TRANSPORT_LUN_STATUS_FREE ; + lun->lun_shutdown = false;spin_unlock (&tpg->tpg_lun_lock);percpu_ref_exit (&lun->lun_ref);
include/target/target_core_base.h +1 -0
@@ -719,6 +719,7 @@ struct se_lun {u32 lun_access;u32 lun_flags;u32 unpacked_lun; +bool lun_shutdown;atomic_t lun_acl_count;spinlock_t lun_acl_lock;spinlock_t lun_sep_lock;
Greg Kroah-Hartman
maintainerPATCH 66/92 iscsi-target: Always wait for kthread_should_stop() before kthread exit
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiang Yi <[email protected]>
commit 5e0cf5e6c43b9e19fc0284f69e5cd2b4a47523b0 upstream.
There are three timing problems in the kthread usages of iscsi_target_mod:
- np_thread of struct iscsi_np
- rx_thread and tx_thread of struct iscsi_conn
In iscsit_close_connection(), it calls
send_sig(SIGINT, conn->tx_thread, 1);
kthread_stop(conn->tx_thread);
In conn->tx_thread, which is iscsi_target_tx_thread(), when it receive SIGINT the kthread will exit without checking the return value of kthread_should_stop().
So if iscsi_target_tx_thread() exit right between send_sig(SIGINT...) and kthread_stop(...), the kthread_stop() will try to stop an already stopped kthread.
This is invalid according to the documentation of kthread_stop().
(Fix -ECONNRESET logout handling in iscsi_target_tx_thread and
early iscsi_target_rx_thread failure case - nab)
--- drivers/target/iscsi/iscsi_target.c | 28 ++++++++++++++++++++++------ drivers/target/iscsi/iscsi_target_erl0.c | 6 +++++- drivers/target/iscsi/iscsi_target_erl0.h | 2 +- drivers/target/iscsi/iscsi_target_login.c | 4 ++++ 4 files changed, 32 insertions(+), 8 deletions(-)
drivers/target/iscsi/iscsi_target.c +22 -6
@@ -3931,6 +3931,8 @@ int iscsi_target_tx_thread(void *arg) {int ret =0 ;struct iscsi_conn *conn = arg; +bool conn_freed = false; +/* * Allow ourselves to be interrupted by SIGINT so that a * connection recovery / failure event can be triggered externally.
@@ -3956,12 +3958,14 @@ get_immediate: goto transport_err; ret =iscsit_handle_response_queue (conn); -if (ret ==1 ) +if (ret ==1 ) { goto get_immediate; -else if (ret == -ECONNRESET ) + }else if (ret == -ECONNRESET ) { + conn_freed = true; goto out; -else if (ret <0 ) + }else if (ret <0 ) { goto transport_err; + } } transport_err:
@@ -3971,8 +3975,13 @@ transport_err:* responsible for cleaning up the early connection failure. */ if (conn->conn_state !=TARG_CONN_STATE_IN_LOGIN ) -iscsit_take_action_for_connection_exit (conn); +iscsit_take_action_for_connection_exit (conn, &conn_freed); out: +if (!conn_freed) { +while (!kthread_should_stop ()) { +msleep (100 ); + } + }return 0 ; }
@@ -4073,6 +4082,7 @@ int iscsi_target_rx_thread(void *arg)u32 checksum =0 , digest =0 ;struct iscsi_conn *conn = arg;struct kvec iov; +bool conn_freed = false;/* * Allow ourselves to be interrupted by SIGINT so that a * connection recovery / failure event can be triggered externally.
@@ -4084,7 +4094,7 @@ int iscsi_target_rx_thread(void *arg)*/ rc =wait_for_completion_interruptible (&conn->rx_login_comp);if (rc <0 ||iscsi_target_check_conn_state (conn)) -return 0 ; + goto out;if (conn->conn_transport->transport_type ==ISCSI_INFINIBAND ) {struct completion comp;
@@ -4169,7 +4179,13 @@ int iscsi_target_rx_thread(void *arg) transport_err:if (!signal_pending (current))atomic_set (&conn->transport_failed,1 ); -iscsit_take_action_for_connection_exit (conn); +iscsit_take_action_for_connection_exit (conn, &conn_freed); +out: +if (!conn_freed) { +while (!kthread_should_stop ()) { +msleep (100 ); + } + }return 0 ; }
drivers/target/iscsi/iscsi_target_erl0.c +5 -1
@@ -931,8 +931,10 @@ static void iscsit_handle_connection_cle } } -void iscsit_take_action_for_connection_exit (struct iscsi_conn *conn) +void iscsit_take_action_for_connection_exit (struct iscsi_conn *conn,bool *conn_freed) { + *conn_freed = false; +spin_lock_bh (&conn->state_lock);if (atomic_read (&conn->connection_exit)) {spin_unlock_bh (&conn->state_lock);
@@ -943,6 +945,7 @@ void iscsit_take_action_for_connection_eif (conn->conn_state ==TARG_CONN_STATE_IN_LOGOUT ) {spin_unlock_bh (&conn->state_lock);iscsit_close_connection (conn); + *conn_freed = true;return ; }
@@ -956,6 +959,7 @@ void iscsit_take_action_for_connection_espin_unlock_bh (&conn->state_lock);iscsit_handle_connection_cleanup (conn); + *conn_freed = true; }/*
drivers/target/iscsi/iscsi_target_erl0.h +1 -1
@@ -9,7 +9,7 @@ extern int iscsit_stop_time2retain_timerextern void iscsit_connection_reinstatement_rcfr (struct iscsi_conn *);extern void iscsit_cause_connection_reinstatement (struct iscsi_conn *,int );extern void iscsit_fall_back_to_erl0 (struct iscsi_session *); -extern void iscsit_take_action_for_connection_exit (struct iscsi_conn *); +extern void iscsit_take_action_for_connection_exit (struct iscsi_conn *,bool *);extern int iscsit_recover_from_unknown_opcode (struct iscsi_conn *);#endif /*** ISCSI_TARGET_ERL0_H ***/
drivers/target/iscsi/iscsi_target_login.c +4 -0
@@ -1492,5 +1492,9 @@ int iscsi_target_login_thread(void *arg)break ; } +while (!kthread_should_stop ()) { +msleep (100 ); + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 67/92 iscsi-target: Fix early sk_data_ready LOGIN_FLAGS_READY race
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 8f0dfb3d8b1120c61f6e2cc3729290db10772b2d upstream.
There is a iscsi-target/tcp login race in LOGIN_FLAGS_READY state assignment that can result in frequent errors during iscsi discovery:
"iSCSI Login negotiation failed."
To address this bug, move the initial LOGIN_FLAGS_READY assignment ahead of iscsi_target_do_login() when handling the initial iscsi_target_start_negotiation() request PDU during connection login.
As iscsi_target_do_login_rx() work_struct callback is clearing LOGIN_FLAGS_READ_ACTIVE after subsequent calls to iscsi_target_do_login(), the early sk_data_ready ahead of the first iscsi_target_do_login() expects LOGIN_FLAGS_READY to also be set for the initial login request PDU.
As reported by Maged, this was first obsered using an MSFT initiator running across multiple VMWare host virtual machines with iscsi-target/tcp.
--- drivers/target/iscsi/iscsi_target_nego.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/target/iscsi/iscsi_target_nego.c +9 -9
@@ -1251,16 +1251,16 @@ int iscsi_target_start_negotiation( {int ret; - ret =iscsi_target_do_login (conn, login); -if (!ret) { -if (conn->sock) { -struct sock *sk = conn->sock->sk; +if (conn->sock) { +struct sock *sk = conn->sock->sk; -write_lock_bh (&sk->sk_callback_lock); -set_bit (LOGIN_FLAGS_READY , &conn->login_flags); -write_unlock_bh (&sk->sk_callback_lock); - } - }else if (ret <0 ) { +write_lock_bh (&sk->sk_callback_lock); +set_bit (LOGIN_FLAGS_READY , &conn->login_flags); +write_unlock_bh (&sk->sk_callback_lock); + } + + ret =iscsi_target_do_login (conn, login); +if (ret <0 ) {cancel_delayed_work_sync (&conn->login_work);cancel_delayed_work_sync (&conn->login_cleanup_work);iscsi_target_restore_sock_callbacks (conn);
Greg Kroah-Hartman
maintainerPATCH 68/92 iscsi-target: Fix initial login PDU asynchronous socket close OOPs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 25cdda95fda78d22d44157da15aa7ea34be3c804 upstream.
This patch fixes a OOPs originally introduced by:
commit bb048357dad6d604520c91586334c9c230366a14
Author: Nicholas Bellinger <[email protected]>
Date: Thu Sep 5 14:54:04 2013 -0700
iscsi-target: Add sk->sk_state_change to cleanup after TCP failure
which would trigger a NULL pointer dereference when a TCP connection was closed asynchronously via iscsi_target_sk_state_change(), but only when the initial PDU processing in iscsi_target_do_login() from iscsi_np process context was blocked waiting for backend I/O to complete.
To address this issue, this patch makes the following changes.
First, it introduces some common helper functions used for checking socket closing state, checking login_flags, and atomically checking socket closing state + setting login_flags.
Second, it introduces a LOGIN_FLAGS_INITIAL_PDU bit to know when a TCP connection has dropped via iscsi_target_sk_state_change(), but the initial PDU processing within iscsi_target_do_login() in iscsi_np context is still running. For this case, it sets LOGIN_FLAGS_CLOSED, but doesn't invoke schedule_delayed_work().
The original NULL pointer dereference case reported by MNC is now handled by iscsi_target_do_login() doing a iscsi_target_sk_check_close() before transitioning to FFP to determine when the socket has already closed, or iscsi_target_start_negotiation() if the login needs to exchange more PDUs (eg: iscsi_target_do_login returned 0) but the socket has closed. For both of these cases, the cleanup up of remaining connection resources will occur in iscsi_target_start_negotiation() from iscsi_np process context once the failure is detected.
Finally, to handle to case where iscsi_target_sk_state_change() is called after the initial PDU procesing is complete, it now invokes conn->login_work -> iscsi_target_do_login_rx() to perform cleanup once existing iscsi_target_sk_check_close() checks detect connection failure. For this case, the cleanup of remaining connection resources will occur in iscsi_target_do_login_rx() from delayed workqueue process context once the failure is detected.
--- drivers/target/iscsi/iscsi_target_core.h | 1 drivers/target/iscsi/iscsi_target_nego.c | 204 ++++++++++++++++++++----------- 2 files changed, 138 insertions(+), 67 deletions(-)
drivers/target/iscsi/iscsi_target_core.h +1 -0
@@ -562,6 +562,7 @@ struct iscsi_conn {#define LOGIN_FLAGS_READ_ACTIVE 1#define LOGIN_FLAGS_CLOSED 2#define LOGIN_FLAGS_READY 4 +#define LOGIN_FLAGS_INITIAL_PDU 8unsigned long login_flags;struct delayed_work login_work;struct delayed_work login_cleanup_work;
drivers/target/iscsi/iscsi_target_nego.c +137 -67
288 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 69/92 iscsi-target: Fix delayed logout processing greater than SECONDS_FOR_LOGOUT_COMP
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Bellinger <[email protected]>
commit 105fa2f44e504c830697b0c794822112d79808dc upstream.
This patch fixes a BUG() in iscsit_close_session() that could be triggered when iscsit_logout_post_handler() execution from within tx thread context was not run for more than SECONDS_FOR_LOGOUT_COMP (15 seconds), and the TCP connection didn't already close before then forcing tx thread context to automatically exit.
This would manifest itself during explicit logout as:
[33206.974254] 1 connection(s) still exist for iSCSI session to iqn.1993-08.org.debian:01:3f5523242179 [33206.980184] INFO: NMI handler (kgdb_nmi_handler) took too long to run: 2100.772 msecs [33209.078643] ------------[ cut here ]------------ [33209.078646] kernel BUG at drivers/target/iscsi/iscsi_target.c:4346!
Normally when explicit logout attempt fails, the tx thread context exits and iscsit_close_connection() from rx thread context does the extra cleanup once it detects conn->conn_logout_remove has not been cleared by the logout type specific post handlers.
To address this special case, if the logout post handler in tx thread context detects conn->tx_thread_active has already been cleared, simply return and exit in order for existing iscsit_close_connection() logic from rx thread context do failed logout cleanup.
--- drivers/target/iscsi/iscsi_target.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/target/iscsi/iscsi_target.c +8 -2
@@ -4561,8 +4561,11 @@ static void iscsit_logout_post_handler_c* always sleep waiting for RX/TX thread shutdown to complete * within iscsit_close_connection(). */ -if (conn->conn_transport->transport_type ==ISCSI_TCP ) +if (conn->conn_transport->transport_type ==ISCSI_TCP ) { sleep =cmpxchg (&conn->tx_thread_active, true, false); +if (!sleep) +return ; + }atomic_set (&conn->conn_logout_remove,0 );complete (&conn->conn_logout_comp);
@@ -4578,8 +4581,11 @@ static void iscsit_logout_post_handler_s {int sleep =1 ; -if (conn->conn_transport->transport_type ==ISCSI_TCP ) +if (conn->conn_transport->transport_type ==ISCSI_TCP ) { sleep =cmpxchg (&conn->tx_thread_active, true, false); +if (!sleep) +return ; + }atomic_set (&conn->conn_logout_remove,0 );complete (&conn->conn_logout_comp);
Greg Kroah-Hartman
maintainerPATCH 70/92 f2fs: sanity check checkpoint segno and blkoff
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jin Qian <[email protected]>
commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream.
Make sure segno and blkoff read from raw image are valid.
--- fs/f2fs/super.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/f2fs/super.c +16 -0
@@ -932,6 +932,8 @@ static int sanity_check_ckpt(struct f2fsunsigned int total, fsmeta;struct f2fs_super_block *raw_super =F2FS_RAW_SUPER (sbi);struct f2fs_checkpoint *ckpt =F2FS_CKPT (sbi); +unsigned int main_segs, blocks_per_seg; +int i; total =le32_to_cpu (raw_super->segment_count); fsmeta =le32_to_cpu (raw_super->segment_count_ckpt);
@@ -943,6 +945,20 @@ static int sanity_check_ckpt(struct f2fsif (unlikely (fsmeta >= total))return 1 ; + main_segs =le32_to_cpu (raw_super->segment_count_main); + blocks_per_seg = sbi->blocks_per_seg; + +for (i =0 ; i <NR_CURSEG_NODE_TYPE ; i++) { +if (le32_to_cpu (ckpt->cur_node_segno[i]) >= main_segs || +le16_to_cpu (ckpt->cur_node_blkoff[i]) >= blocks_per_seg) +return 1 ; + } +for (i =0 ; i <NR_CURSEG_DATA_TYPE ; i++) { +if (le32_to_cpu (ckpt->cur_data_segno[i]) >= main_segs || +le16_to_cpu (ckpt->cur_data_blkoff[i]) >= blocks_per_seg) +return 1 ; + } +if (unlikely (f2fs_cp_error (sbi))) {f2fs_msg (sbi->sb,KERN_ERR ,"A bug case: need to run fsck" );return 1 ;
Greg Kroah-Hartman
maintainerPATCH 71/92 net: Zero terminate ifr_name in dev_ifname().
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <[email protected]>
[ Upstream commit 63679112c536289826fec61c917621de95ba2ade ]
The ifr.ifr_name is passed around and assumed to be NULL terminated.
--- net/core/dev_ioctl.c | 1 + 1 file changed, 1 insertion(+)
net/core/dev_ioctl.c +1 -0
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, sif (copy_from_user (&ifr, arg,sizeof (struct ifreq )))return -EFAULT ; + ifr.ifr_name[IFNAMSIZ -1 ] =0 ; error =netdev_get_name (net, ifr.ifr_name, ifr.ifr_ifindex);if (error)
Greg Kroah-Hartman
maintainerPATCH 72/92 ipv6: avoid overflow of offset in ip6_find_1stfragopt
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 6399f1fae4ec29fab5ec76070435555e256ca3a6 ]
In some cases, offset can overflow and can cause an infinite loop in ip6_find_1stfragopt(). Make it unsigned int to prevent the overflow, and cap it at IPV6_MAXPLEN, since packets larger than that should be invalid.
This problem has been here since before the beginning of git history.
--- net/ipv6/output_core.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/ipv6/output_core.c +6 -2
@@ -44,7 +44,7 @@ EXPORT_SYMBOL_GPL(ipv6_proxy_select_idenint ip6_find_1stfragopt (struct sk_buff *skb,u8 **nexthdr) { -u16 offset =sizeof (struct ipv6hdr ); +unsigned int offset =sizeof (struct ipv6hdr );unsigned int packet_len =skb_tail_pointer (skb) -skb_network_header (skb);int found_rhdr =0 ;
@@ -52,6 +52,7 @@ int ip6_find_1stfragopt(struct sk_buff *while (offset <= packet_len) {struct ipv6_opt_hdr *exthdr; +unsigned int len;switch (**nexthdr) {
@@ -77,7 +78,10 @@ int ip6_find_1stfragopt(struct sk_buff * exthdr = (struct ipv6_opt_hdr *)(skb_network_header (skb) + offset); - offset +=ipv6_optlen (exthdr); + len =ipv6_optlen (exthdr); +if (len + offset >=IPV6_MAXPLEN ) +return -EINVAL ; + offset += len; *nexthdr = &exthdr->nexthdr; }
Greg Kroah-Hartman
maintainerPATCH 73/92 ipv4: initialize fib_trie prior to register_netdev_notifier call.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <[email protected]>
[ Upstream commit 8799a221f5944a7d74516ecf46d58c28ec1d1f75 ]
Net stack initialization currently initializes fib-trie after the first call to netdevice_notifier() call. In fact fib_trie initialization needs to happen before first rtnl_register(). It does not cause any problem since there are no devices UP at this moment, but trying to bring 'lo' UP at initialization would make this assumption wrong and exposes the issue.
Fixes following crash
Call Trace: ? alternate_node_alloc+0x76/0xa0 fib_table_insert+0x1b7/0x4b0 fib_magic.isra.17+0xea/0x120 fib_add_ifaddr+0x7b/0x190 fib_netdev_event+0xc0/0x130 register_netdevice_notifier+0x1c1/0x1d0 ip_fib_init+0x72/0x85 ip_rt_init+0x187/0x1e9 ip_init+0xe/0x1a inet_init+0x171/0x26c ? ipv4_offload_init+0x66/0x66 do_one_initcall+0x43/0x160 kernel_init_freeable+0x191/0x219 ? rest_init+0x80/0x80 kernel_init+0xe/0x150 ret_from_fork+0x22/0x30 Code: f6 46 23 04 74 86 4c 89 f7 e8 ae 45 01 00 49 89 c7 4d 85 ff 0f 85 7b ff ff ff 31 db eb 08 4c 89 ff e8 16 47 01 00 48 8b 44 24 38 <45> 8b 6e 14 4d 63 76 74 48 89 04 24 0f 1f 44 00 00 48 83 c4 08 RIP: kmem_cache_alloc+0xcf/0x1c0 RSP: ffff9b1500017c28 CR2: 0000000000000014
--- net/ipv4/fib_frontend.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
net/ipv4/fib_frontend.c +5 -4
@@ -1174,13 +1174,14 @@ static struct pernet_operations fib_net_void __init ip_fib_init (void ) { -rtnl_register (PF_INET ,RTM_NEWROUTE , inet_rtm_newroute,NULL ,NULL ); -rtnl_register (PF_INET ,RTM_DELROUTE , inet_rtm_delroute,NULL ,NULL ); -rtnl_register (PF_INET ,RTM_GETROUTE ,NULL , inet_dump_fib,NULL ); +fib_trie_init ();register_pernet_subsys (&fib_net_ops); +register_netdevice_notifier (&fib_netdev_notifier);register_inetaddr_notifier (&fib_inetaddr_notifier); -fib_trie_init (); +rtnl_register (PF_INET ,RTM_NEWROUTE , inet_rtm_newroute,NULL ,NULL ); +rtnl_register (PF_INET ,RTM_DELROUTE , inet_rtm_delroute,NULL ,NULL ); +rtnl_register (PF_INET ,RTM_GETROUTE ,NULL , inet_dump_fib,NULL ); }
Greg Kroah-Hartman
maintainerPATCH 74/92 rtnetlink: allocate more memory for dev_set_mac_address()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
[ Upstream commit 153711f9421be5dbc973dc57a4109dc9d54c89b1 ]
virtnet_set_mac_address() interprets mac address as struct sockaddr, but upper layer only allocates dev->addr_len which is ETH_ALEN + sizeof(sa_family_t) in this case.
We lack a unified definition for mac address, so just fix the upper layer, this also allows drivers to interpret it to struct sockaddr freely.
--- net/core/rtnetlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/core/rtnetlink.c +2 -1
@@ -1554,7 +1554,8 @@ static int do_setlink(const struct sk_bustruct sockaddr *sa;int len; - len =sizeof (sa_family_t) + dev->addr_len; + len =sizeof (sa_family_t) +max_t (size_t, dev->addr_len, +sizeof (*sa)); sa =kmalloc (len,GFP_KERNEL );if (!sa) { err = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 75/92 mcs7780: Fix initialization when CONFIG_VMAP_STACK is enabled
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Jarosch <[email protected]>
[ Upstream commit 9476d393667968b4a02afbe9d35a3558482b943e ]
DMA transfers are not allowed to buffers that are on the stack. Therefore allocate a buffer to store the result of usb_control_message().
Fixes these bugreports:
https://bugzilla.kernel.org/show_bug.cgi?id=195217
https://bugzilla.redhat.com/show_bug.cgi?id=1421387
https://bugzilla.redhat.com/show_bug.cgi?id=1427398
Shortened kernel backtrace from 4.11.9-200.fc25.x86_64:
kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 3 PID: 2957 at drivers/usb/core/hcd.c:1587
kernel: transfer buffer not dma capable
kernel: Call Trace:
kernel: dump_stack+0x63/0x86
kernel: __warn+0xcb/0xf0
kernel: warn_slowpath_fmt+0x5a/0x80
kernel: usb_hcd_map_urb_for_dma+0x37f/0x570
kernel: ? try_to_del_timer_sync+0x53/0x80
kernel: usb_hcd_submit_urb+0x34e/0xb90
kernel: ? schedule_timeout+0x17e/0x300
kernel: ? del_timer_sync+0x50/0x50
kernel: ? __slab_free+0xa9/0x300
kernel: usb_submit_urb+0x2f4/0x560
kernel: ? urb_destroy+0x24/0x30
kernel: usb_start_wait_urb+0x6e/0x170
kernel: usb_control_msg+0xdc/0x120
kernel: mcs_get_reg+0x36/0x40 [mcs7780]
kernel: mcs_net_open+0xb5/0x5c0 [mcs7780]
...
Regression goes back to 4.9, so it's a good candidate for -stable. Though it's the decision of the maintainer.
Thanks to Dan Williams for adding the "transfer buffer not dma capable" warning in the first place. It instantly pointed me in the right direction.
Patch has been tested with transferring data from a Polar watch.
--- drivers/net/irda/mcs7780.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
drivers/net/irda/mcs7780.c +13 -3
@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcstatic int mcs_get_reg (struct mcs_cb *mcs,__u16 reg,__u16 * val) {struct usb_device *dev = mcs->usbdev; -int ret =usb_control_msg (dev,usb_rcvctrlpipe (dev,0 ),MCS_RDREQ , -MCS_RD_RTYPE ,0 , reg, val,2 , -msecs_to_jiffies (MCS_CTRL_TIMEOUT )); +void *dmabuf; +int ret; + + dmabuf =kmalloc (sizeof (__u16),GFP_KERNEL ); +if (!dmabuf) +return -ENOMEM ; + + ret =usb_control_msg (dev,usb_rcvctrlpipe (dev,0 ),MCS_RDREQ , +MCS_RD_RTYPE ,0 , reg, dmabuf,2 , +msecs_to_jiffies (MCS_CTRL_TIMEOUT )); + +memcpy (val, dmabuf,sizeof (__u16)); +kfree (dmabuf);return ret; }
Greg Kroah-Hartman
maintainerPATCH 76/92 packet: fix use-after-free in prb_retire_rx_blk_timer_expired()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <[email protected]>
[ Upstream commit c800aaf8d869f2b9b47b10c5c312fe19f0a94042 ]
There are multiple reports showing we have a use-after-free in the timer prb_retire_rx_blk_timer_expired(), where we use struct tpacket_kbdq_core::pkbdq, a pg_vec, after it gets freed by free_pg_vec().
The interesting part is it is not freed via packet_release() but via packet_setsockopt(), which means we are not closing the socket. Looking into the big and fat function packet_set_ring(), this could happen if we satisfy the following conditions:
1. closing == 0, not on packet_release() path
2. req->tp_block_nr == 0, we don't allocate a new pg_vec
3. rx_ring->pg_vec is already set as V3, which means we already called packet_set_ring() wtih req->tp_block_nr > 0 previously
4. req->tp_frame_nr == 0, pass sanity check
5. po->mapped == 0, never called mmap()
In this scenario we are clearing the old rx_ring->pg_vec, so we need to free this pg_vec, but we don't stop the timer on this path because of closing==0.
The timer has to be stopped as long as we need to free pg_vec, therefore the check on closing!=0 is wrong, we should check pg_vec!=NULL instead.
Thanks to liujian for testing different fixes.
--- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/packet/af_packet.c +1 -1
@@ -3895,7 +3895,7 @@ static int packet_set_ring(struct sock *register_prot_hook (sk); }spin_unlock (&po->bind_lock); -if (closing && (po->tp_version >TPACKET_V2 )) { +if (pg_vec && (po->tp_version >TPACKET_V2 )) {/* Because we don't support block-based V3 on tx-ring */ if (!tx_ring)prb_shutdown_retire_blk_timer (po, tx_ring, rb_queue);
Greg Kroah-Hartman
maintainerPATCH 77/92 dccp: fix a memleak for dccp_feat_init err process
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit e90ce2fc27cad7e7b1e72b9e66201a7a4c124c2b ]
In dccp_feat_init, when ccid_get_builtin_ccids failsto alloc memory for rx.val, it should free tx.val before returning an error.
--- net/dccp/feat.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/dccp/feat.c +5 -2
@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)* singleton values (which always leads to failure). * These settings can still (later) be overridden via sockopts. */ -if (ccid_get_builtin_ccids (&tx.val, &tx.len) || -ccid_get_builtin_ccids (&rx.val, &rx.len)) +if (ccid_get_builtin_ccids (&tx.val, &tx.len))return -ENOBUFS ; +if (ccid_get_builtin_ccids (&rx.val, &rx.len)) { +kfree (tx.val); +return -ENOBUFS ; + }if (!dccp_feat_prefer (sysctl_dccp_tx_ccid, tx.val, tx.len) || !dccp_feat_prefer (sysctl_dccp_rx_ccid, rx.val, rx.len))
Greg Kroah-Hartman
maintainerPATCH 78/92 sctp: dont dereference ptr before leaving _sctp_walk_{params, errors}()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit b1f5bfc27a19f214006b9b4db7b9126df2dfdf5a ]
If the length field of the iterator (|pos.p| or |err|) is past the end of the chunk, we shouldn't access it.
This bug has been detected by KMSAN. For the following pair of system calls:
socket(PF_INET6, SOCK_STREAM, 0x84 /* IPPROTO_??? */) = 3 sendto(3, "A", 1, MSG_OOB, {sa_family=AF_INET6, sin6_port=htons(0),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, 28) = 1the tool has reported a use of uninitialized memory:
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_rcv+0x17b8/0x43b0 CPU: 1 PID: 2940 Comm: probe Not tainted 4.11.0-rc5+ #2926 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 dump_stack+0x172/0x1c0 lib/dump_stack.c:52 kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927 __msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469 __sctp_rcv_init_lookup net/sctp/input.c:1074 __sctp_rcv_lookup_harder net/sctp/input.c:1233 __sctp_rcv_lookup net/sctp/input.c:1255 sctp_rcv+0x17b8/0x43b0 net/sctp/input.c:170 sctp6_rcv+0x32/0x70 net/sctp/ipv6.c:984 ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279 NF_HOOK ./include/linux/netfilter.h:257 ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322 dst_input ./include/net/dst.h:492 ip6_rcv_finish net/ipv6/ip6_input.c:69 NF_HOOK ./include/linux/netfilter.h:257 ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203 __netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208 __netif_receive_skb net/core/dev.c:4246 process_backlog+0x667/0xba0 net/core/dev.c:4866 napi_poll net/core/dev.c:5268 net_rx_action+0xc95/0x1590 net/core/dev.c:5333 __do_softirq+0x485/0x942 kernel/softirq.c:284 do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902 </IRQ> do_softirq kernel/softirq.c:328 __local_bh_enable_ip+0x25b/0x290 kernel/softirq.c:181 local_bh_enable+0x37/0x40 ./include/linux/bottom_half.h:31 rcu_read_unlock_bh ./include/linux/rcupdate.h:931 ip6_finish_output2+0x19b2/0x1cf0 net/ipv6/ip6_output.c:124 ip6_finish_output+0x764/0x970 net/ipv6/ip6_output.c:149 NF_HOOK_COND ./include/linux/netfilter.h:246 ip6_output+0x456/0x520 net/ipv6/ip6_output.c:163 dst_output ./include/net/dst.h:486 NF_HOOK ./include/linux/netfilter.h:257 ip6_xmit+0x1841/0x1c00 net/ipv6/ip6_output.c:261 sctp_v6_xmit+0x3b7/0x470 net/sctp/ipv6.c:225 sctp_packet_transmit+0x38cb/0x3a20 net/sctp/output.c:632 sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885 sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750 sctp_side_effects net/sctp/sm_sideeffect.c:1773 sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88 sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954 inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 SYSC_sendto+0x608/0x710 net/socket.c:1696 SyS_sendto+0x8a/0xb0 net/socket.c:1664 do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285 entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246 RIP: 0033:0x401133 RSP: 002b:00007fff6d99cd38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401133 RDX: 0000000000000001 RSI: 0000000000494088 RDI: 0000000000000003 RBP: 00007fff6d99cd90 R08: 00007fff6d99cd50 R09: 000000000000001c R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000 R13: 00000000004063d0 R14: 0000000000406460 R15: 0000000000000000 origin: save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59 kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302 kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198 kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:211 slab_alloc_node mm/slub.c:2743 __kmalloc_node_track_caller+0x200/0x360 mm/slub.c:4351 __kmalloc_reserve net/core/skbuff.c:138 __alloc_skb+0x26b/0x840 net/core/skbuff.c:231 alloc_skb ./include/linux/skbuff.h:933 sctp_packet_transmit+0x31e/0x3a20 net/sctp/output.c:570 sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885 sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750 sctp_side_effects net/sctp/sm_sideeffect.c:1773 sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88 sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954 inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg net/socket.c:643 SYSC_sendto+0x608/0x710 net/socket.c:1696 SyS_sendto+0x8a/0xb0 net/socket.c:1664 do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285 return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246 ==================================================================
--- include/net/sctp/sctp.h | 4 ++++ 1 file changed, 4 insertions(+)
include/net/sctp/sctp.h +4 -0
@@ -441,6 +441,8 @@ _sctp_walk_params((pos), (chunk), ntohs(#define _sctp_walk_params (pos, chunk, end, member)\ for (pos.v = chunk->member;\ + (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\ + (void *)chunk + end) &&\ pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\ pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -451,6 +453,8 @@ _sctp_walk_errors((err), (chunk_hdr), nt#define _sctp_walk_errors (err, chunk_hdr, end)\ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ sizeof(sctp_chunkhdr_t));\ + ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\ + (void *)chunk_hdr + end) &&\ (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ ntohs(err->length) >= sizeof(sctp_errhdr_t); \ err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
Greg Kroah-Hartman
maintainerPATCH 79/92 sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 6b84202c946cd3da3a8daa92c682510e9ed80321 ]
Commit b1f5bfc27a19 ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()") tried to fix the issue that it may overstep the chunk end for _sctp_walk_{params, errors} with 'chunk_end > offset(length) + sizeof(length)'.
But it introduced a side effect: When processing INIT, it verifies the chunks with 'param.v == chunk_end' after iterating all params by sctp_walk_params(). With the check 'chunk_end > offset(length)
+ sizeof(length)', it would return when the last param is not yet accessed. Because the last param usually is fwdtsn supported param whose size is 4 and 'chunk_end == offset(length) + sizeof(length)'
This is a badly issue even causing sctp couldn't process 4-shakes. Client would always get abort when connecting to server, due to the failure of INIT chunk verification on server.
The patch is to use 'chunk_end <= offset(length) + sizeof(length)' instead of 'chunk_end < offset(length) + sizeof(length)' for both _sctp_walk_params and _sctp_walk_errors.
--- include/net/sctp/sctp.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/net/sctp/sctp.h +2 -2
@@ -441,7 +441,7 @@ _sctp_walk_params((pos), (chunk), ntohs(#define _sctp_walk_params (pos, chunk, end, member)\ for (pos.v = chunk->member;\ - (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\ + (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\ (void *)chunk + end) &&\ pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
@@ -453,7 +453,7 @@ _sctp_walk_errors((err), (chunk_hdr), nt#define _sctp_walk_errors (err, chunk_hdr, end)\ for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ sizeof(sctp_chunkhdr_t));\ - ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\ + ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\ (void *)chunk_hdr + end) &&\ (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ ntohs(err->length) >= sizeof(sctp_errhdr_t); \
Greg Kroah-Hartman
maintainerPATCH 80/92 net: phy: Correctly process PHY_HALTED in phy_stop_machine()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit 7ad813f208533cebfcc32d3d7474dc1677d1b09a ]
Marc reported that he was not getting the PHY library adjust_link() callback function to run when calling phy_stop() + phy_disconnect() which does not indeed happen because we set the state machine to PHY_HALTED but we don't get to run it to process this state past that point.
Fix this with a synchronous call to phy_state_machine() in order to have the state machine actually act on PHY_HALTED, set the PHY device's link down, turn the network device's carrier off and finally call the adjust_link() function.
--- drivers/net/phy/phy.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/phy/phy.c +3 -0
@@ -509,6 +509,9 @@ void phy_stop_machine(struct phy_deviceif (phydev->state >PHY_UP && phydev->state !=PHY_HALTED ) phydev->state =PHY_UP ;mutex_unlock (&phydev->lock); + +/* Now we can run the state machine synchronously */ +phy_state_machine (&phydev->state_queue.work); }/**
Greg Kroah-Hartman
maintainerPATCH 81/92 xen-netback: correctly schedule rate-limited queues
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Liu <[email protected]>
[ Upstream commit dfa523ae9f2542bee4cddaea37b3be3e157f6e6b ]
Add a flag to indicate if a queue is rate-limited. Test the flag in NAPI poll handler and avoid rescheduling the queue if true, otherwise we risk locking up the host. The rescheduling will be done in the timer callback function.
--- drivers/net/xen-netback/common.h | 1 + drivers/net/xen-netback/interface.c | 6 +++++- drivers/net/xen-netback/netback.c | 6 +++++- 3 files changed, 11 insertions(+), 2 deletions(-)
drivers/net/xen-netback/common.h +1 -0
@@ -195,6 +195,7 @@ struct xenvif_queue { /* Per-queue dataunsigned long remaining_credit;struct timer_list credit_timeout;u64 credit_window_start; +bool rate_limited;/* Statistics */ struct xenvif_stats stats;
drivers/net/xen-netback/interface.c +5 -1
@@ -99,7 +99,11 @@ int xenvif_poll(struct napi_struct *napiif (work_done < budget) {napi_complete (napi); -xenvif_napi_schedule_or_enable_events (queue); +/* If the queue is rate-limited, it shall be +* rescheduled in the timer callback. +*/ +if (likely (!queue->rate_limited)) +xenvif_napi_schedule_or_enable_events (queue); }return work_done;
drivers/net/xen-netback/netback.c +5 -1
@@ -819,6 +819,7 @@ static void tx_add_credit(struct xenvif_ max_credit =ULONG_MAX ;/* wrapped: clamp to ULONG_MAX */ queue->remaining_credit =min (max_credit, max_burst); + queue->rate_limited = false; }static void tx_credit_callback (unsigned long data)
@@ -1336,8 +1337,10 @@ static bool tx_credit_exceeded(struct xemsecs_to_jiffies (queue->credit_usec /1000 );/* Timer could already be pending in rare cases. */ -if (timer_pending (&queue->credit_timeout)) +if (timer_pending (&queue->credit_timeout)) { + queue->rate_limited = true;return true; + }/* Passed the point where we can replenish credit? */ if (time_after_eq64 (now, next_credit)) {
@@ -1354,6 +1357,7 @@ static bool tx_credit_exceeded(struct xemod_timer (&queue->credit_timeout, next_credit); queue->credit_window_start = next_credit; + queue->rate_limited = true;return true; }
Greg Kroah-Hartman
maintainerPATCH 82/92 wext: handle NULL extra data in iwe_stream_add_point better
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 93be2b74279c15c2844684b1a027fdc71dd5d9bf upstream.
gcc-7 complains that wl3501_cs passes NULL into a function that then uses the argument as the input for memcpy:
drivers/net/wireless/wl3501_cs.c: In function 'wl3501_get_scan':include/net/iw_handler.h:559:3: error: argument 2 null where non-null expected [-Werror=nonnull]
memcpy(stream + point_len, extra, iwe->u.data.length);
This works fine here because iwe->u.data.length is guaranteed to be 0 and the memcpy doesn't actually have an effect.
Making the length check explicit avoids the warning and should have no other effect here.
Also check the pointer itself, since otherwise we get warnings elsewhere in the code.
--- include/net/iw_handler.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/iw_handler.h +2 -1
@@ -545,7 +545,8 @@ iwe_stream_add_point(struct iw_request_imemcpy (stream + lcp_len, ((char *) &iwe->u) +IW_EV_POINT_OFF ,IW_EV_POINT_PK_LEN -IW_EV_LCP_PK_LEN ); -memcpy (stream + point_len, extra, iwe->u.data.length); +if (iwe->u.data.length && extra) +memcpy (stream + point_len, extra, iwe->u.data.length); stream += event_len; }return stream;
Greg Kroah-Hartman
maintainerPATCH 83/92 sh_eth: R8A7740 supports packet shecksumming
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
[ Upstream commit 0f1f9cbc04dbb3cc310f70a11cba0cf1f2109d9c ]
The R8A7740 GEther controller supports the packet checksum offloading but the 'hw_crc' (bad name, I'll fix it) flag isn't set in the R8A7740 data, thus CSMR isn't cleared...
--- drivers/net/ethernet/renesas/sh_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/renesas/sh_eth.c +1 -0
@@ -781,6 +781,7 @@ static struct sh_eth_cpu_data r8a7740_da .rpadir_value = 2 << 16, .no_trimd = 1, .no_ade = 1, + .hw_crc = 1, .tsu = 1, .select_mii = 1, .shift_rd0 = 1,
Greg Kroah-Hartman
maintainerPATCH 84/92 tg3: Fix race condition in tg3_get_stats64().
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit f5992b72ebe0dde488fa8f706b887194020c66fc ]
The driver's ndo_get_stats64() method is not always called under RTNL. So it can race with driver close or ethtool reconfigurations. Fix the race condition by taking tp->lock spinlock in tg3_free_consistent() when freeing the tp->hw_stats memory block. tg3_get_stats64() is already taking tp->lock.
--- drivers/net/ethernet/broadcom/tg3.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/broadcom/tg3.c +3 -0
@@ -8705,11 +8705,14 @@ static void tg3_free_consistent(struct ttg3_mem_rx_release (tp);tg3_mem_tx_release (tp); +/* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ +tg3_full_lock (tp,0 );if (tp->hw_stats) {dma_free_coherent (&tp->pdev->dev,sizeof (struct tg3_hw_stats ), tp->hw_stats, tp->stats_mapping); tp->hw_stats =NULL ; } +tg3_full_unlock (tp); }/*
Greg Kroah-Hartman
maintainerPATCH 85/92 x86/boot: Add missing declaration of string functions
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <[email protected]>
[ Upstream commit fac69d0efad08fc15e4dbfc116830782acc0dc9a ]
Add the missing declarations of basic string functions to string.h to allow a clean build.
--- arch/x86/boot/string.c | 1 + arch/x86/boot/string.h | 9 +++++++++ 2 files changed, 10 insertions(+)
arch/x86/boot/string.c +1 -0
@@ -14,6 +14,7 @@#include <linux/types.h> #include "ctype.h" +#include "string.h" int memcmp (const void *s1,const void *s2,size_t len) {
arch/x86/boot/string.h +9 -0
@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s#define memset (d,c,l) __builtin_memset(d,c,l)#define memcmp __builtin_memcmp +extern int strcmp (const char *str1,const char *str2); +extern int strncmp (const char *cs,const char *ct,size_t count); +extern size_t strlen (const char *s); +extern char *strstr (const char *s1,const char *s2); +extern size_t strnlen (const char *s,size_t maxlen); +extern unsigned int atou (const char *s); +extern unsigned long long simple_strtoull (const char *cp,char **endp, +unsigned int base); +#endif /* BOOT_STRING_H */
Greg Kroah-Hartman
maintainerPATCH 86/92 scsi: qla2xxx: Get mutex lock before checking optrom_state
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Milan P. Gandhi" <[email protected]>
[ Upstream commit c7702b8c22712a06080e10f1d2dee1a133ec8809 ]
There is a race condition with qla2xxx optrom functions where one thread might modify optrom buffer, optrom_state while other thread is still reading from it.
In couple of crashes, it was found that we had successfully passed the following 'if' check where we confirm optrom_state to be QLA_SREADING. But by the time we acquired mutex lock to proceed with memory_read_from_buffer function, some other thread/process had already modified that option rom buffer and optrom_state from QLA_SREADING to QLA_SWAITING. Then we got ha->optrom_buffer 0x0 and crashed the system:
if (ha->optrom_state != QLA_SREADING)
return 0;
mutex_lock(&ha->optrom_mutex);
rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer,
ha->optrom_region_size);
mutex_unlock(&ha->optrom_mutex);With current optrom function we get following crash due to a race condition:
[ 1479.466679] BUG: unable to handle kernel NULL pointer dereference at (null) [ 1479.466707] IP: [<ffffffff81326756>] memcpy+0x6/0x110 [...] [ 1479.473673] Call Trace: [ 1479.474296] [<ffffffff81225cbc>] ? memory_read_from_buffer+0x3c/0x60 [ 1479.474941] [<ffffffffa01574dc>] qla2x00_sysfs_read_optrom+0x9c/0xc0 [qla2xxx] [ 1479.475571] [<ffffffff8127e76b>] read+0xdb/0x1f0 [ 1479.476206] [<ffffffff811fdf9e>] vfs_read+0x9e/0x170 [ 1479.476839] [<ffffffff811feb6f>] SyS_read+0x7f/0xe0 [ 1479.477466] [<ffffffff816964c9>] system_call_fastpath+0x16/0x1b
Below patch modifies qla2x00_sysfs_read_optrom, qla2x00_sysfs_write_optrom functions to get the mutex_lock before checking ha->optrom_state to avoid similar crashes.
The patch was applied and tested and same crashes were no longer observed again.
--- drivers/scsi/qla2xxx/qla_attr.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
drivers/scsi/qla2xxx/qla_attr.c +13 -5
@@ -329,12 +329,15 @@ qla2x00_sysfs_read_optrom(struct file *fstruct qla_hw_data *ha = vha->hw;ssize_t rval =0 ; +mutex_lock (&ha->optrom_mutex); +if (ha->optrom_state !=QLA_SREADING ) -return 0 ; + goto out; -mutex_lock (&ha->optrom_mutex); rval =memory_read_from_buffer (buf, count, &off, ha->optrom_buffer, ha->optrom_region_size); + +out:mutex_unlock (&ha->optrom_mutex);return rval;
@@ -349,14 +352,19 @@ qla2x00_sysfs_write_optrom(struct file * struct device, kobj)));struct qla_hw_data *ha = vha->hw; -if (ha->optrom_state !=QLA_SWRITING ) +mutex_lock (&ha->optrom_mutex); + +if (ha->optrom_state !=QLA_SWRITING ) { +mutex_unlock (&ha->optrom_mutex);return -EINVAL ; -if (off > ha->optrom_region_size) + } +if (off > ha->optrom_region_size) { +mutex_unlock (&ha->optrom_mutex);return -ERANGE ; + }if (off + count > ha->optrom_region_size) count = ha->optrom_region_size - off; -mutex_lock (&ha->optrom_mutex);memcpy (&ha->optrom_buffer[off], buf, count);mutex_unlock (&ha->optrom_mutex);
Greg Kroah-Hartman
maintainerPATCH 87/92 ARM: 8632/1: ftrace: fix syscall name matching
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rabin Vincent <[email protected]>
[ Upstream commit 270c8cf1cacc69cb8d99dea812f06067a45e4609 ]
ARM has a few system calls (most notably mmap) for which the names of the functions which are referenced in the syscall table do not match the names of the syscall tracepoints. As a consequence of this, these tracepoints are not made available. Implement arch_syscall_match_sym_name to fix this and allow tracing even these system calls.
--- arch/arm/include/asm/ftrace.h | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
arch/arm/include/asm/ftrace.h +18 -0
@@ -54,6 +54,24 @@ static inline void *return_address(unsig#define ftrace_return_address (n) return_address(n) +#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME + +static inline bool arch_syscall_match_sym_name (const char *sym, +const char *name) +{ +if (!strcmp (sym,"sys_mmap2" )) + sym ="sys_mmap_pgoff" ; +else if (!strcmp (sym,"sys_statfs64_wrapper" )) + sym ="sys_statfs64" ; +else if (!strcmp (sym,"sys_fstatfs64_wrapper" )) + sym ="sys_fstatfs64" ; +else if (!strcmp (sym,"sys_arm_fadvise64_64" )) + sym ="sys_fadvise64_64" ; + +/* Ignore case since sym may start with "SyS" instead of "sys" */ +return !strcasecmp (sym, name); +} +#endif /* ifndef __ASSEMBLY__ */ #endif /* _ASM_ARM_FTRACE */
Greg Kroah-Hartman
maintainerPATCH 88/92 mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
[ Upstream commit bb1107f7c6052c863692a41f78c000db792334bf ]
Andrey Konovalov has reported the following warning triggered by the syzkaller fuzzer.
WARNING: CPU: 1 PID: 9935 at mm/page_alloc.c:3511 __alloc_pages_nodemask+0x159c/0x1e20
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 9935 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #34
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
__alloc_pages_slowpath mm/page_alloc.c:3511
__alloc_pages_nodemask+0x159c/0x1e20 mm/page_alloc.c:3781
alloc_pages_current+0x1c7/0x6b0 mm/mempolicy.c:2072
alloc_pages include/linux/gfp.h:469
kmalloc_order+0x1f/0x70 mm/slab_common.c:1015
kmalloc_order_trace+0x1f/0x160 mm/slab_common.c:1026
kmalloc_large include/linux/slab.h:422
__kmalloc+0x210/0x2d0 mm/slub.c:3723
kmalloc include/linux/slab.h:495
ep_write_iter+0x167/0xb50 drivers/usb/gadget/legacy/inode.c:664
new_sync_write fs/read_write.c:499
__vfs_write+0x483/0x760 fs/read_write.c:512
vfs_write+0x170/0x4e0 fs/read_write.c:560
SYSC_write fs/read_write.c:607
SyS_write+0xfb/0x230 fs/read_write.c:599
entry_SYSCALL_64_fastpath+0x1f/0xc2The issue is caused by a lack of size check for the request size in ep_write_iter which should be fixed. It, however, points to another problem, that SLUB defines KMALLOC_MAX_SIZE too large because the its KMALLOC_SHIFT_MAX is (MAX_ORDER + PAGE_SHIFT) which means that the resulting page allocator request might be MAX_ORDER which is too large (see __alloc_pages_slowpath).
The same applies to the SLOB allocator which allows even larger sizes. Make sure that they are capped properly and never request more than MAX_ORDER order.
--- include/linux/slab.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/slab.h +2 -2
@@ -186,7 +186,7 @@ size_t ksize(const void *);* (PAGE_SIZE*2). Larger requests are passed to the page allocator. */ #define KMALLOC_SHIFT_HIGH (PAGE_SHIFT + 1) -#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT) +#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1)#ifndef KMALLOC_SHIFT_LOW #define KMALLOC_SHIFT_LOW 3#endif
@@ -199,7 +199,7 @@ size_t ksize(const void *);* be allocated from the same page. */ #define KMALLOC_SHIFT_HIGH PAGE_SHIFT -#define KMALLOC_SHIFT_MAX 30 +#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1)#ifndef KMALLOC_SHIFT_LOW #define KMALLOC_SHIFT_LOW 3#endif
Greg Kroah-Hartman
maintainerPATCH 89/92 lib/Kconfig.debug: fix frv build failure
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudip Mukherjee <[email protected]>
[ Upstream commit da0510c47519fe0999cffe316e1d370e29f952be ]
The build of frv allmodconfig was failing with the errors like:
/tmp/cc0JSPc3.s: Assembler messages:
/tmp/cc0JSPc3.s:1839: Error: symbol .LSLT0' is already defined /tmp/cc0JSPc3.s:1842: Error: symbol .LASLTP0' is already defined /tmp/cc0JSPc3.s:1969: Error: symbol .LELTP0' is already defined /tmp/cc0JSPc3.s:1970: Error: symbol .LELT0' is already defined
Commit 866ced950bcd ("kbuild: Support split debug info v4") introduced splitting the debug info and keeping that in a separate file. Somehow, the frv-linux gcc did not like that and I am guessing that instead of splitting it started copying. The first report about this is at:
https://lists.01.org/pipermail/kbuild-all/2015-July/010527.html.
I will try and see if this can work with frv and if still fails I will open a bug report with gcc. But meanwhile this is the easiest option to solve build failure of frv.
--- lib/Kconfig.debug | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/Kconfig.debug +1 -1
@@ -145,7 +145,7 @@ config DEBUG_INFO_REDUCED config DEBUG_INFO_SPLIT bool "Produce split debuginfo in .dwo files" - depends on DEBUG_INFO + depends on DEBUG_INFO && !FRV help Generate debug info into separate .dwo files. This significantly reduces the build directory size for builds with DEBUG_INFO,
Greg Kroah-Hartman
maintainerPATCH 90/92 signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamie Iles <[email protected]>
[ Upstream commit 2d39b3cd34e6d323720d4c61bd714f5ae202c022 ]
Since commit 00cd5c37afd5 ("ptrace: permit ptracing of /sbin/init") we can now trace init processes. init is initially protected with SIGNAL_UNKILLABLE which will prevent fatal signals such as SIGSTOP, but there are a number of paths during tracing where SIGNAL_UNKILLABLE can be implicitly cleared.
This can result in init becoming stoppable/killable after tracing. For example, running:
while true; do kill -STOP 1; done &
strace -p 1
and then stopping strace and the kill loop will result in init being left in state TASK_STOPPED. Sending SIGCONT to init will resume it, but init will now respond to future SIGSTOP signals rather than ignoring them.
Make sure that when setting SIGNAL_STOP_CONTINUED/SIGNAL_STOP_STOPPED that we don't clear SIGNAL_UNKILLABLE.
--- include/linux/sched.h | 10 ++++++++++ kernel/signal.c | 4 ++-- 2 files changed, 12 insertions(+), 2 deletions(-)
include/linux/sched.h +10 -0
@@ -729,6 +729,16 @@ struct signal_struct {#define SIGNAL_UNKILLABLE 0x00000040/* for init: ignore fatal signals */ +#define SIGNAL_STOP_MASK (SIGNAL_CLD_MASK | SIGNAL_STOP_STOPPED | \ + SIGNAL_STOP_CONTINUED) + +static inline void signal_set_stop_flags (struct signal_struct *sig, +unsigned int flags) +{ +WARN_ON (sig->flags & (SIGNAL_GROUP_EXIT |SIGNAL_GROUP_COREDUMP )); + sig->flags = (sig->flags & ~SIGNAL_STOP_MASK ) | flags; +} +/* If true, all threads except ->group_exit_task have pending SIGKILL */ static inline int signal_group_exit (const struct signal_struct *sig) {
kernel/signal.c +2 -2
@@ -346,7 +346,7 @@ static bool task_participate_group_stop(* fresh group stop. Read comment in do_signal_stop() for details. */ if (!sig->group_stop_count && !(sig->flags &SIGNAL_STOP_STOPPED )) { - sig->flags =SIGNAL_STOP_STOPPED ; +signal_set_stop_flags (sig,SIGNAL_STOP_STOPPED );return true; }return false;
@@ -896,7 +896,7 @@ static bool prepare_signal(int sig, stru* will take ->siglock, notice SIGNAL_CLD_MASK, and * notify its parent. See get_signal_to_deliver(). */ - signal->flags = why |SIGNAL_STOP_CONTINUED ; +signal_set_stop_flags (signal, why |SIGNAL_STOP_CONTINUED ); signal->group_stop_count =0 ; signal->group_exit_code =0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/92 mm: dont dereference struct page fields of invalid pages
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <[email protected]>
[ Upstream commit f073bdc51771f5a5c7a8d1191bfc3ae371d44de7 ]
The VM_BUG_ON() check in move_freepages() checks whether the node id of a page matches the node id of its zone. However, it does this before having checked whether the struct page pointer refers to a valid struct page to begin with. This is guaranteed in most cases, but may not be the case if CONFIG_HOLES_IN_ZONE=y.
So reorder the VM_BUG_ON() with the pfn_valid_within() check.
--- mm/page_alloc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/page_alloc.c +3 -3
@@ -1029,14 +1029,14 @@ int move_freepages(struct zone *zone,#endif for (page = start_page; page <= end_page;) { -/* Make sure we are not inadvertently changing nodes */ -VM_BUG_ON_PAGE (page_to_nid (page) !=zone_to_nid (zone), page); -if (!pfn_valid_within (page_to_pfn (page))) { page++;continue ; } +/* Make sure we are not inadvertently changing nodes */ +VM_BUG_ON_PAGE (page_to_nid (page) !=zone_to_nid (zone), page); +if (!PageBuddy (page)) { page++;continue ;
Greg Kroah-Hartman
maintainerPATCH 92/92 ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: zheng li <[email protected]>
[ Upstream commit 0a28cfd51e17f4f0a056bcf66bfbe492c3b99f38 ]
There is an inconsistent conditional judgement in __ip_append_data and ip_finish_output functions, the variable length in __ip_append_data just include the length of application's payload and udp header, don't include the length of ip header, but in ip_finish_output use (skb->len > ip_skb_dst_mtu(skb)) as judgement, and skb->len include the length of ip header.
That causes some particular application's udp payload whose length is between (MTU - IP Header) and MTU were fragmented by ip_fragment even though the rst->dev support UFO feature.
Add the length of ip header to length in __ip_append_data to keep consistent conditional judgement as ip_finish_output for ip fragment.
--- net/ipv4/ip_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/ip_output.c +1 -1
@@ -888,7 +888,7 @@ static int __ip_append_data(struct sock csummode =CHECKSUM_PARTIAL ; cork->length += length; -if (((length > mtu) || (skb &&skb_is_gso (skb))) && +if ((((length + fragheaderlen) > mtu) || (skb &&skb_is_gso (skb))) && (sk->sk_protocol ==IPPROTO_UDP ) && (rt->dst.dev->features &NETIF_F_UFO ) && !rt->dst.header_len && (sk->sk_type ==SOCK_DGRAM )) {
Quoted 11 lines · Greg Kroah-Hartman
This is the second start of the stable review cycle for the 3.18.64 release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.64-rc2.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-3.18.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 17 lines · Shuah Khan
Quoted 16 lines · Greg Kroah-Hartman
This is the second start of the stable review cycle for the 3.18.64 release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.64-rc2.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-3.18.y
and the diffstat can be found below.
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
Thanks for testing all of these and letting me know.
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the second start of the stable review cycle for the 3.18.64 release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017. Anything received after that time might be too late.
Build results:
total: 136 pass: 136 fail: 0 Qemu test results: total: 109 pass: 109 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 12 lines · Guenter Roeck
Quoted 10 lines · Greg Kroah-Hartman
This is the second start of the stable review cycle for the 3.18.64 release (the first try had too many problems...)
There are 92 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Aug 11 20:21:39 UTC 2017. Anything received after that time might be too late.
Quoted 6 lines
Build results:
total: 136 pass: 136 fail: 0 Qemu test results: total: 109 pass: 109 fail: 0Details are available at http://kerneltests.org/builders.
Yeah, finally! :)
thanks for testing this and letting me know.
greg k-h