4.13.6-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.13.6-stable review
This is the start of the stable review cycle for the 4.13.6 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Oct 12 19:05:14 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.13.6-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.13.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.13.6-rc1
Sudeep Holla <[email protected]>
base: arch_topology: fix section mismatch build warnings
Paolo Abeni <[email protected]>
udp: fix bcast packet reception
Paolo Abeni <[email protected]>
udp: perform source validation for mcast early demux
Marek Szyprowski <[email protected]>
clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
Peng Xu <[email protected]>
nl80211: Define policy for packet pattern attributes
Chanho Min <[email protected]>
mmc: core: add driver strength selection when selecting hs400es
Christoph Hellwig <[email protected]>
nvme-pci: Use PCI bus address for data/queues in CMB
Benjamin Block <[email protected]>
bsg-lib: fix use-after-free under memory-pressure
Jani Nikula <[email protected]>
drm/i915/bios: ignore HDMI on port A
Jani Nikula <[email protected]>
drm/i915: always update ELD connector type after get modes
Arend Van Spriel <[email protected]>
brcmfmac: setup passive scan if requested by user-space
Arend Van Spriel <[email protected]>
brcmfmac: add length check in brcmf_cfg80211_escan_handler()
Martin K. Petersen <[email protected]>
scsi: sd: Do not override max_sectors_kb sysfs setting
Martin K. Petersen <[email protected]>
scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
Luca Coelho <[email protected]>
iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
Boqun Feng <[email protected]>
kvm/x86: Avoid async PF preempting the kernel incorrectly
Sam Bobroff <[email protected]>
KVM: PPC: Book3S: Fix server always zero from kvmppc_xive_get_xive()
Jeffy Chen <[email protected]>
dm crypt: fix memory leak in crypt_ctr_cipher_old()
Mikulas Patocka <[email protected]>
dm ioctl: fix alignment of event number in the device list
Milan Broz <[email protected]>
dm crypt: reject sector_size feature if device length is not aligned to it
Arnd Bergmann <[email protected]>
netlink: fix nla_put_{u8,u16,u32} for KASANArnd Bergmann <[email protected]>
rocker: fix rocker_tlv_put_* functions for KASAN
Tsutomu Itoh <[email protected]>
Btrfs: fix overlap of fs_info::flags values
Goffredo Baroncelli <[email protected]>
btrfs: avoid overflow when sector_t is 32 bit
Ping Cheng <[email protected]>
HID: wacom: bits shifted too much for 9th and 10th buttons
Jason Gerecke <[email protected]>
HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
Jason Gerecke <[email protected]>
HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
Jason Gerecke <[email protected]>
HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
Jason Gerecke <[email protected]>
HID: wacom: Correct coordinate system of touchring and pen twist
Jason Gerecke <[email protected]>
HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
Aaron Armstrong Skomra <[email protected]>
HID: wacom: leds: Don't try to control the EKR's read-only LEDs
Adrian Salido <[email protected]>
HID: i2c-hid: allocate hid buffers for real worst case
Lyude <[email protected]>
HID: rmi: Make sure the HID device is opened on resume
Suzuki K Poulose <[email protected]>
arm64: Ensure the instruction emulation is ready for userspace
Baruch Siach <[email protected]>
arm64: dt marvell: Fix AP806 system controller size
Amir Goldstein <[email protected]>
ovl: fix regression caused by exclusive upper/work dir protection
Amir Goldstein <[email protected]>
ovl: fix missing unlock_rename() in ovl_do_copy_up()
Amir Goldstein <[email protected]>
ovl: fix dentry leak in ovl_indexdir_cleanup()
Amir Goldstein <[email protected]>
ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
Amir Goldstein <[email protected]>
ovl: fix error value printed in ovl_lookup_index()
Shu Wang <[email protected]>
ftrace: Fix kmemleak in unregister_ftrace_graph
Willy Tarreau <[email protected]>
auxdisplay: charlcd: properly restore atomic counter on error path
Alexander Shishkin <[email protected]>
stm class: Fix a use-after-free
Dexuan Cui <[email protected]>
vmbus: don't acquire the mutex in vmbus_hvsock_device_unregister()
Olaf Hering <[email protected]>
Drivers: hv: fcopy: restore correct transfer length
Waiman Long <[email protected]>
cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns
Nicolai Stange <[email protected]>
driver core: platform: Don't read past the end of "driver_override" buffer
Alexander Shishkin <[email protected]>
intel_th: pci: Add Lewisburg PCH support
Mark Rutland <[email protected]>
percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
Gustavo Romero <[email protected]>
powerpc/tm: Fix illegal TM state in signal handler
Cyril Bur <[email protected]>
powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
Jeremy Kerr <[email protected]>
powerpc: Fix action argument for cpufeatures-based TLB flush
Anton Blanchard <[email protected]>
powerpc/powernv: Increase memory block size to 1GB on radix
Takashi Iwai <[email protected]>
ALSA: usx2y: Suppress kernel warning at page allocation failures
Takashi Sakamoto <[email protected]>
Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
Guneshwor Singh <[email protected]>
ALSA: compress: Remove unused variable
Casey Schaufler <[email protected]>
lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
Sergey Senozhatsky <[email protected]>
lib/ratelimit.c: use deferred printk() version
Andrea Arcangeli <[email protected]>
userfaultfd: non-cooperative: fix fork use after free
Shaohua Li <[email protected]>
mm: fix data corruption caused by lazyfree page
Shaohua Li <[email protected]>
mm: avoid marking swap cached page as lazyfree
Christophe Leroy <[email protected]>
mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
Michal Hocko <[email protected]>
mm, oom_reaper: skip mm structs with mmu notifiers
Alexandru Moise <[email protected]>
mm, hugetlb, soft_offline: save compound page order before page migration
Kirill Tkhai <[email protected]>
ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
Stefan Wahren <[email protected]>
staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
Andrey Konovalov <[email protected]>
uwb: ensure that endpoint is interrupt
Andrey Konovalov <[email protected]>
uwb: properly check kthread_run return value
Lukas Wunner <[email protected]>
iio: adc: mcp320x: Fix oops on module unload
Lukas Wunner <[email protected]>
iio: adc: mcp320x: Fix readout of negative voltages
Fabrice Gasnier <[email protected]>
iio: adc: stm32: fix bad error check on max_channels
Dragos Bogdan <[email protected]>
iio: ad7793: Fix the serial interface reset
Fabrice Gasnier <[email protected]>
iio: trigger: stm32-timer: fix a corner case to write preset
Fabrice Gasnier <[email protected]>
iio: trigger: stm32-timer: preset shouldn't be buffered
Colin Parker <[email protected]>
IIO: BME280: Updates to Humidity readings need ctrl_reg write!
Matt Fornero <[email protected]>
iio: core: Return error for failed read_reg
Stefan Popa <[email protected]>
staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
Dragos Bogdan <[email protected]>
iio: ad_sigma_delta: Implement a dedicated reset function
Christophe JAILLET <[email protected]>
iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of 'twl4030_madc_probe()'
Christophe JAILLET <[email protected]>
iio: adc: twl4030: Fix an error handling path in 'twl4030_madc_probe()'
Kai-Heng Feng <[email protected]>
Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
Mathias Nyman <[email protected]>
xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
Mathias Nyman <[email protected]>
xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
Adam Wallis <[email protected]>
usb: host: xhci-plat: allow sysdev to inherit from ACPI
Mathias Nyman <[email protected]>
xhci: fix wrong endpoint ESIT value shown in tracing
Mathias Nyman <[email protected]>
xhci: fix finding correct bus_state structure for USB 3.1 hosts
Lu Baolu <[email protected]>
usb: xhci: Free the right ring in xhci_add_endpoint()
Greg Kroah-Hartman <[email protected]>
USB: fix out-of-bounds in usb_set_configuration
Dmitry Fleytman <[email protected]>
usb: Increase quirk delay for USB devices
Greg Kroah-Hartman <[email protected]>
USB: core: harden cdc_parse_cdc_header
Alan Stern <[email protected]>
USB: uas: fix bug in handling of alternate settings
Alan Stern <[email protected]>
USB: g_mass_storage: Fix deadlock when driver is unbound
Dan Carpenter <[email protected]>
USB: devio: Don't corrupt user memory
Dan Carpenter <[email protected]>
USB: devio: Prevent integer overflow in proc_do_submiturb()
Alan Stern <[email protected]>
USB: dummy-hcd: Fix erroneous synchronization change
Alan Stern <[email protected]>
USB: dummy-hcd: fix infinite-loop resubmission bug
Alan Stern <[email protected]>
USB: dummy-hcd: fix connection failures (wrong speed)
Bjørn Mork <[email protected]>
USB: cdc-wdm: ignore -EPIPE from GetEncapsulatedResponse
Jim Dickerson <[email protected]>
usb: pci-quirks.c: Corrected timeout values used in handshake
Takashi Iwai <[email protected]>
ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
Yoshihiro Shimoda <[email protected]>
usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
Alan Stern <[email protected]>
usb-storage: fix bogus hardware error messages for ATA pass-thru devices
Alan Stern <[email protected]>
usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
Yoshihiro Shimoda <[email protected]>
usb: gadget: udc: renesas_usb3: fix for no-data control transfer
Nicolas Ferre <[email protected]>
usb: gadget: udc: atmel: set vbus irqflags explicitly
Alan Stern <[email protected]>
USB: gadgetfs: fix copy_to_user while holding spinlock
Alan Stern <[email protected]>
USB: gadgetfs: Fix crash caused by inadequate synchronization
Roger Quadros <[email protected]>
usb: gadget: core: fix ->udc_set_speed() logic
Alexei Starovoitov <[email protected]>
bpf: fix bpf_tail_call() x64 JIT
Nikolay Aleksandrov <[email protected]>
net: rtnetlink: fix info leak in RTM_GETSTATS call
Eric Dumazet <[email protected]>
socket, bpf: fix possible use after free
Guillaume Nault <[email protected]>
l2tp: fix l2tp_eth module loading
Parthasarathy Bhuvaragan <[email protected]>
tipc: use only positive error codes in messages
Paolo Abeni <[email protected]>
IPv4: early demux can return an error code
Xin Long <[email protected]>
ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
Xin Long <[email protected]>
ip6_gre: ip6gre_tap device should keep dst
Jason A. Donenfeld <[email protected]>
netlink: do not proceed if dump's start() errs
Roi Dayan <[email protected]>
net/mlx5e: IPoIB, Fix access to invalid memory address
Christoph Paasch <[email protected]>
net: Set sk_prot_creator when cloning sockets to the right proto
Vivien Didelot <[email protected]>
net: dsa: mv88e6xxx: lock mutex when freeing IRQs
Willem de Bruijn <[email protected]>
packet: only test po->has_vnet_hdr once in packet_snd
Willem de Bruijn <[email protected]>
packet: in packet_do_bind, test fanout with bind_lock held
Florian Fainelli <[email protected]>
net: dsa: Fix network device registration order
Andrew Lunn <[email protected]>
net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
Alexander Potapenko <[email protected]>
tun: bail out from tun_get_user() if the skb is empty
Sabrina Dubroca <[email protected]>
l2tp: fix race condition in l2tp_tunnel_delete
Alexey Kodanev <[email protected]>
vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
Timur Tabi <[email protected]>
net: qcom/emac: specify the correct size when mapping a DMA buffer
Thomas Meyer <[email protected]>
net: stmmac: Cocci spatch "of_table"
Konstantin Khlebnikov <[email protected]>
net_sched: always reset qdisc backlog in qdisc_reset()
Meng Xu <[email protected]>
isdn/i4l: fetch the ppp_write buffer in one shot
Edward Cree <[email protected]>
net: change skb->mac_header when Generic XDP calls adjust_head
Yonghong Song <[email protected]>
bpf: one perf event close won't free bpf program attached by another perf event
Willem de Bruijn <[email protected]>
packet: hold bind lock when rebinding to fanout hook
Mike Manning <[email protected]>
net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
Christian Lamparter <[email protected]>
net: emac: Fix napi poll list corruption
Eric Dumazet <[email protected]>
tcp: fastopen: fix on syn-data transmit failure
Eric Dumazet <[email protected]>
bpf: do not disable/enable BH in bpf_map_free_id()
Eric Dumazet <[email protected]>
8139too: revisit napi_complete_done() usage
Davide Caratti <[email protected]>
net/sched: cls_matchall: fix crash when used with classful qdisc
Xin Long <[email protected]>
ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
Fahad Kunnathadi <[email protected]>
net: phy: Fix mask value write on gmii2rgmii converter speed register
Xin Long <[email protected]>
ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
Subash Abhinov Kasiviswanathan <[email protected]>
udpv6: Fix the checksum computation when HW checksum does not apply
Eric Dumazet <[email protected]>
tcp: fix data delivery rate
Edward Cree <[email protected]>
bpf/verifier: reject BPF_ALU64|BPF_END
Eric Dumazet <[email protected]>
tcp: update skb->skb_mstamp more carefully
Dan Carpenter <[email protected]>
sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
Jiri Pirko <[email protected]>
net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
Eric Dumazet <[email protected]>
net_sched: gen_estimator: fix scaling error in bytes/packets samples
Nikolay Aleksandrov <[email protected]>
net: bonding: fix tlb_dynamic_lb default value
Yuval Mintz <[email protected]>
mlxsw: spectrum: Prevent mirred-related crash on removal
Christophe JAILLET <[email protected]>
openvswitch: Fix an error handling path in 'ovs_nla_init_match_and_action()'
Kosuke Tatsukawa <[email protected]>
net: bonding: Fix transmit load balancing in balance-alb mode if specified by sysfs
Arkadi Sharshevsky <[email protected]>
mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
Felipe Balbi <[email protected]>
usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
Arnd Bergmann <[email protected]>
imx-media-of: avoid uninitialized variable warning
-------------
Diffstat:
Documentation/filesystems/overlayfs.txt | 5 +- Makefile | 4 +- arch/arm64/boot/dts/marvell/armada-ap806.dtsi | 4 +- arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/kernel/cpufeature.c | 2 +- arch/powerpc/kernel/dt_cpu_ftrs.c | 4 +- arch/powerpc/kernel/exceptions-64s.S | 24 ++++- arch/powerpc/kernel/signal_64.c | 13 ++- arch/powerpc/kvm/book3s_xive.c | 5 +- arch/powerpc/kvm/book3s_xive.h | 1 - arch/powerpc/platforms/powernv/setup.c | 10 +- arch/x86/include/asm/kvm_para.h | 4 +- arch/x86/kernel/kvm.c | 14 ++- arch/x86/kvm/mmu.c | 2 +- arch/x86/net/bpf_jit_comp.c | 4 +- block/bsg-lib.c | 27 +++-- drivers/auxdisplay/charlcd.c | 11 ++- drivers/auxdisplay/panel.c | 11 ++- drivers/base/arch_topology.c | 14 +-- drivers/base/platform.c | 3 +- drivers/clk/samsung/clk-exynos4.c | 15 +++ drivers/gpu/drm/i915/intel_audio.c | 5 - drivers/gpu/drm/i915/intel_bios.c | 7 ++ drivers/gpu/drm/i915/intel_modes.c | 17 ++++ drivers/hid/hid-rmi.c | 13 ++- drivers/hid/i2c-hid/i2c-hid.c | 3 +- drivers/hid/wacom_sys.c | 7 +- drivers/hid/wacom_wac.c | 110 +++++++++++++++++---- drivers/hv/channel_mgmt.c | 4 - drivers/hv/hv_fcopy.c | 4 + drivers/hwtracing/intel_th/pci.c | 5 + drivers/hwtracing/stm/core.c | 2 +- drivers/iio/adc/ad7793.c | 4 +- drivers/iio/adc/ad_sigma_delta.c | 28 ++++++ drivers/iio/adc/mcp320x.c | 25 +++-- drivers/iio/adc/stm32-adc.c | 2 +- drivers/iio/adc/twl4030-madc.c | 10 +- drivers/iio/industrialio-core.c | 4 +- drivers/iio/pressure/bmp280-core.c | 2 +- drivers/iio/trigger/stm32-timer-trigger.c | 4 +- drivers/isdn/i4l/isdn_ppp.c | 37 ++++--- drivers/md/dm-core.h | 1 + drivers/md/dm-crypt.c | 5 + drivers/md/dm-ioctl.c | 37 ++++--- drivers/md/dm.c | 10 +- drivers/mmc/core/mmc.c | 36 +++---- drivers/net/bonding/bond_main.c | 17 ++-- drivers/net/bonding/bond_options.c | 3 + drivers/net/dsa/mv88e6xxx/chip.c | 6 ++ drivers/net/ethernet/ibm/emac/mal.c | 3 +- .../net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 3 +- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 38 ++++--- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 3 +- drivers/net/ethernet/realtek/8139too.c | 5 +- drivers/net/ethernet/rocker/rocker_tlv.h | 48 +++++---- .../net/ethernet/stmicro/stmmac/stmmac_platform.c | 1 + drivers/net/phy/xilinx_gmii2rgmii.c | 2 +- drivers/net/tun.c | 8 +- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 37 +++---- .../broadcom/brcm80211/brcmfmac/fwil_types.h | 5 + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 10 +- drivers/nvme/host/pci.c | 14 +-- drivers/scsi/scsi_scan.c | 3 + drivers/scsi/sd.c | 35 +++++-- drivers/staging/iio/adc/ad7192.c | 4 +- drivers/staging/media/imx/imx-media-of.c | 2 +- .../interface/vchiq_arm/vchiq_2835_arm.c | 6 +- drivers/usb/class/cdc-wdm.c | 4 +- drivers/usb/core/config.c | 16 ++- drivers/usb/core/devio.c | 11 ++- drivers/usb/core/hub.c | 2 +- drivers/usb/core/message.c | 4 + drivers/usb/dwc3/ep0.c | 7 ++ drivers/usb/gadget/function/f_mass_storage.c | 27 ++--- drivers/usb/gadget/function/f_mass_storage.h | 14 --- drivers/usb/gadget/legacy/inode.c | 46 +++++++-- drivers/usb/gadget/legacy/mass_storage.c | 26 +---- drivers/usb/gadget/udc/atmel_usba_udc.c | 4 +- drivers/usb/gadget/udc/core.c | 3 +- drivers/usb/gadget/udc/dummy_hcd.c | 56 +++++++++-- drivers/usb/gadget/udc/renesas_usb3.c | 19 +++- drivers/usb/host/pci-quirks.c | 10 +- drivers/usb/host/xhci-hub.c | 14 ++- drivers/usb/host/xhci-pci.c | 12 --- drivers/usb/host/xhci-plat.c | 16 +-- drivers/usb/host/xhci.c | 3 +- drivers/usb/host/xhci.h | 10 +- drivers/usb/renesas_usbhs/fifo.c | 21 +++- drivers/usb/storage/transport.c | 14 ++- drivers/usb/storage/uas-detect.h | 15 +-- drivers/usb/storage/uas.c | 10 +- drivers/usb/storage/unusual_devs.h | 7 ++ drivers/uwb/hwa-rc.c | 2 + drivers/uwb/uwbd.c | 12 ++- fs/btrfs/ctree.h | 2 +- fs/btrfs/extent_io.c | 2 +- fs/overlayfs/copy_up.c | 6 +- fs/overlayfs/dir.c | 20 ---- fs/overlayfs/namei.c | 1 + fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/ovl_entry.h | 3 + fs/overlayfs/readdir.c | 6 +- fs/overlayfs/super.c | 27 +++-- fs/overlayfs/util.c | 24 ++++- fs/userfaultfd.c | 66 +++++++++++-- fs/xattr.c | 2 +- include/asm-generic/percpu.h | 24 ++++- include/linux/iio/adc/ad_sigma_delta.h | 3 + include/linux/mmu_notifier.h | 5 + include/linux/trace_events.h | 1 + include/net/netlink.h | 73 ++++++++++---- include/net/protocol.h | 4 +- include/net/route.h | 4 +- include/net/sctp/ulpevent.h | 6 +- include/net/tcp.h | 2 +- include/net/udp.h | 2 +- include/scsi/scsi_device.h | 1 + include/scsi/scsi_devinfo.h | 1 + include/uapi/linux/bpf.h | 2 +- include/uapi/linux/dm-ioctl.h | 4 +- include/uapi/linux/usb/ch9.h | 1 + kernel/bpf/core.c | 2 +- kernel/bpf/syscall.c | 6 +- kernel/bpf/verifier.c | 3 +- kernel/cgroup/cgroup.c | 8 ++ kernel/events/core.c | 3 +- kernel/trace/ftrace.c | 14 --- lib/ratelimit.c | 4 +- mm/ksm.c | 5 +- mm/madvise.c | 12 ++- mm/oom_kill.c | 16 +++ mm/rodata_test.c | 2 +- mm/swap.c | 4 +- mm/swap_state.c | 11 +++ net/core/dev.c | 1 + net/core/filter.c | 12 ++- net/core/gen_estimator.c | 4 +- net/core/rtnetlink.c | 3 + net/core/sock.c | 7 +- net/dsa/slave.c | 28 +++--- net/ipv4/ip_input.c | 25 +++-- net/ipv4/ip_vti.c | 3 +- net/ipv4/route.c | 46 +++++---- net/ipv4/tcp_ipv4.c | 9 +- net/ipv4/tcp_output.c | 33 +++++-- net/ipv4/udp.c | 36 ++++--- net/ipv6/addrconf.c | 5 +- net/ipv6/ip6_gre.c | 22 +++-- net/ipv6/ip6_tunnel.c | 8 +- net/ipv6/ip6_vti.c | 3 +- net/ipv6/udp.c | 1 + net/l2tp/l2tp_core.c | 10 +- net/l2tp/l2tp_core.h | 5 +- net/l2tp/l2tp_eth.c | 51 +--------- net/netlink/af_netlink.c | 7 +- net/openvswitch/datapath.c | 3 +- net/packet/af_packet.c | 28 ++++-- net/sched/act_api.c | 6 +- net/sched/cls_matchall.c | 1 + net/sched/sch_generic.c | 1 + net/tipc/msg.c | 2 +- net/wireless/nl80211.c | 14 ++- security/smack/smack_lsm.c | 55 +++++------ sound/core/compress_offload.c | 3 +- sound/pci/echoaudio/echoaudio.c | 6 +- sound/usb/card.c | 20 ++++ sound/usb/usx2y/usb_stream.c | 6 +- tools/testing/selftests/bpf/test_verifier.c | 16 +++ 168 files changed, 1390 insertions(+), 672 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/160 imx-media-of: avoid uninitialized variable warning
4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
Replaces upstream commit 0b2e9e7947e7 ("media: staging/imx: remove confusing IS_ERR_OR_NULL usage")
We get a harmless warning about a potential uninitialized variable use in the driver:
drivers/staging/media/imx/imx-media-of.c: In function 'of_parse_subdev':drivers/staging/media/imx/imx-media-of.c:216:4: warning: 'remote_np' may be used uninitialized in this function [-Wmaybe-uninitialized]
I reworked that code to be easier to understand by gcc in mainline, but that commit is too large to backport. This is a much simpler workaround, avoiding the warning by adding a fake initialization to the variable. The driver was only introduced in linux-4.13, so the workaround is not needed for earlier stable kernels.
--- drivers/staging/media/imx/imx-media-of.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/media/imx/imx-media-of.c +1 -1
@@ -167,7 +167,7 @@ of_parse_subdev(struct imx_media_dev *imof_parse_sensor (imxmd, imxsd, sd_np);for (i =0 ; i < num_pads; i++) { -struct device_node *epnode =NULL , *port, *remote_np; +struct device_node *epnode =NULL , *port, *remote_np =NULL ;struct imx_media_subdev *remote_imxsd;struct imx_media_pad *pad;int remote_pad;
Greg Kroah-Hartman
maintainerPATCH 2/160 usb: dwc3: ep0: fix DMA starvation by assigning req->trb on ep0
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 55168470835688e5da5828cdcf1b1498d7baadb1 upstream.
If we don't assign a TRB to ep0 requests, we won't be able to unmap the request later on resulting in starvation of DMA resources.
--- drivers/usb/dwc3/ep0.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/dwc3/ep0.c +7 -0
@@ -990,6 +990,8 @@ static void __dwc3_ep0_do_control_data(sDWC3_TRBCTL_CONTROL_DATA , true); + req->trb = &dwc->ep0_trb[dep->trb_enqueue -1 ]; +/* Now prepare one extra TRB to align transfer size */ dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr, maxpacket - rem,
@@ -1015,6 +1017,8 @@ static void __dwc3_ep0_do_control_data(sDWC3_TRBCTL_CONTROL_DATA , true); + req->trb = &dwc->ep0_trb[dep->trb_enqueue -1 ]; +/* Now prepare one extra TRB to align transfer size */ dwc3_ep0_prepare_one_trb(dep, dwc->bounce_addr, 0, DWC3_TRBCTL_CONTROL_DATA,
@@ -1029,6 +1033,9 @@ static void __dwc3_ep0_do_control_data(sdwc3_ep0_prepare_one_trb (dep, req->request.dma, req->request.length,DWC3_TRBCTL_CONTROL_DATA , false); + + req->trb = &dwc->ep0_trb[dep->trb_enqueue]; + ret =dwc3_ep0_start_trans (dep); }
Greg Kroah-Hartman
maintainerPATCH 3/160 mlxsw: spectrum: Fix EEPROM access in case of SFP/SFP+
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadi Sharshevsky <[email protected]>
[ Upstream commit 4400081b631af69abc63cea3352680e3d85e0c39 ]
The current code does not handle correctly the access to the upper page in case of SFP/SFP+ EEPROM. In that case the offset should be local and the I2C address should be changed.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +17 -2
@@ -2519,7 +2519,9 @@ out:return err; } -#define MLXSW_SP_QSFP_I2C_ADDR 0x50 +#define MLXSW_SP_I2C_ADDR_LOW 0x50 +#define MLXSW_SP_I2C_ADDR_HIGH 0x51 +#define MLXSW_SP_EEPROM_PAGE_LENGTH 256 static int mlxsw_sp_query_module_eeprom(struct mlxsw_sp_port *mlxsw_sp_port, u16 offset, u16 size, void *data,
@@ -2528,12 +2530,25 @@ static int mlxsw_sp_query_module_eeprom(struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp;char eeprom_tmp[MLXSW_SP_REG_MCIA_EEPROM_SIZE ];char mcia_pl[MLXSW_REG_MCIA_LEN ]; +u16 i2c_addr;int status;int err; size =min_t (u16, size,MLXSW_SP_REG_MCIA_EEPROM_SIZE ); + +if (offset <MLXSW_SP_EEPROM_PAGE_LENGTH && + offset + size >MLXSW_SP_EEPROM_PAGE_LENGTH ) +/* Cross pages read, read until offset 256 in low page */ + size =MLXSW_SP_EEPROM_PAGE_LENGTH - offset; + + i2c_addr =MLXSW_SP_I2C_ADDR_LOW ; +if (offset >=MLXSW_SP_EEPROM_PAGE_LENGTH ) { + i2c_addr =MLXSW_SP_I2C_ADDR_HIGH ; + offset -=MLXSW_SP_EEPROM_PAGE_LENGTH ; + } +mlxsw_reg_mcia_pack (mcia_pl, mlxsw_sp_port->mapping.module, -0 ,0 , offset, size,MLXSW_SP_QSFP_I2C_ADDR ); +0 ,0 , offset, size, i2c_addr); err =mlxsw_reg_query (mlxsw_sp->core,MLXSW_REG (mcia), mcia_pl);if (err)
Greg Kroah-Hartman
maintainerPATCH 4/160 net: bonding: Fix transmit load balancing in balance-alb mode if specified by sysfs
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kosuke Tatsukawa <[email protected]>
[ Upstream commit c6644d07eff6588b2dedf881279fb0d1c7783970 ]
Commit cbf5ecb30560 ("net: bonding: Fix transmit load balancing in balance-alb mode") tried to fix transmit dynamic load balancing in balance-alb mode, which wasn't working after commit 8b426dc54cf4 ("bonding: remove hardcoded value").
It turned out that my previous patch only fixed the case when balance-alb was specified as bonding module parameter, and not when balance-alb mode was set using /sys/class/net/*/bonding/mode (the most common usage). In the latter case, tlb_dynamic_lb was set up according to the default mode of the bonding interface, which happens to be balance-rr.
This additional patch addresses this issue by setting up tlb_dynamic_lb to 1 if "mode" is set to balance-alb through the sysfs interface.
I didn't add code to change tlb_balance_lb back to the default value for other modes, because "mode" is usually set up only once during initialization, and it's not worthwhile to change the static variable bonding_defaults in bond_main.c to a global variable just for this purpose.
Commit 8b426dc54cf4 also changes the value of tlb_dynamic_lb for balance-tlb mode if it is set up using the sysfs interface. I didn't change that behavior, because the value of tlb_balance_lb can be changed using the sysfs interface for balance-tlb, and I didn't like changing the default value back and forth for balance-tlb.
As for balance-alb, /sys/class/net/*/bonding/tlb_balance_lb cannot be written to. However, I think balance-alb with tlb_dynamic_lb set to 0 is not an intended usage, so there is little use making it writable at this moment.
--- drivers/net/bonding/bond_options.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/bonding/bond_options.c +3 -0
@@ -754,6 +754,9 @@ static int bond_option_mode_set(struct b bond->params.miimon); } +if (newval->value ==BOND_MODE_ALB ) + bond->params.tlb_dynamic_lb =1 ; +/* don't cache arp_validate between modes */ bond->params.arp_validate =BOND_ARP_VALIDATE_NONE ; bond->params.mode = newval->value;
Greg Kroah-Hartman
maintainerPATCH 5/160 openvswitch: Fix an error handling path in ovs_nla_init_match_and_action()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 5829e62ac17a40ab08c1b905565604a4b5fa7af6 ]
All other error handling paths in this function go through the 'error' label. This one should do the same.
--- net/openvswitch/datapath.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/openvswitch/datapath.c +2 -1
@@ -1126,7 +1126,8 @@ static int ovs_nla_init_match_and_actionif (!a[OVS_FLOW_ATTR_KEY ]) {OVS_NLERR (log,"Flow key attribute not present in set flow." ); -return -EINVAL ; + error = -EINVAL ; + goto error; } *acts = get_flow_actions(net, a[OVS_FLOW_ATTR_ACTIONS], key,
Greg Kroah-Hartman
maintainerPATCH 6/160 mlxsw: spectrum: Prevent mirred-related crash on removal
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuval Mintz <[email protected]>
[ Upstream commit 6399ebcccffa12e65bc15eda039d37673264ebce ]
When removing the offloading of mirred actions under matchall classifiers, mlxsw would find the destination port associated with the offloaded action and utilize it for undoing the configuration.
Depending on the order by which ports are removed, it's possible that the destination port would get removed before the source port. In such a scenario, when actions would be flushed for the source port mlxsw would perform an illegal dereference as the destination port is no longer listed.
Since the only item necessary for undoing the configuration on the destination side is the port-id and that in turn is already maintained by mlxsw on the source-port, simply stop trying to access the destination port and use the port-id directly instead.
--- drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/net/ethernet/mellanox/mlxsw/spectrum.c +9 -10
@@ -572,15 +572,14 @@ static void mlxsw_sp_span_entry_destroy( }static struct mlxsw_sp_span_entry * -mlxsw_sp_span_entry_find (struct mlxsw_sp_port *port) +mlxsw_sp_span_entry_find (struct mlxsw_sp *mlxsw_sp,u8 local_port) { -struct mlxsw_sp *mlxsw_sp = port->mlxsw_sp;int i;for (i =0 ; i < mlxsw_sp->span.entries_count; i++) {struct mlxsw_sp_span_entry *curr = &mlxsw_sp->span.entries[i]; -if (curr->used && curr->local_port == port->local_port) +if (curr->used && curr->local_port == local_port)return curr; }return NULL ;
@@ -591,7 +590,8 @@ static struct mlxsw_sp_span_entry {struct mlxsw_sp_span_entry *span_entry; - span_entry =mlxsw_sp_span_entry_find (port); + span_entry =mlxsw_sp_span_entry_find (port->mlxsw_sp, + port->local_port);if (span_entry) {/* Already exists, just take a reference */ span_entry->ref_count++;
@@ -780,12 +780,13 @@ err_port_bind: }static void mlxsw_sp_span_mirror_remove (struct mlxsw_sp_port *from, -struct mlxsw_sp_port *to, +u8 destination_port,enum mlxsw_sp_span_type type) {struct mlxsw_sp_span_entry *span_entry; - span_entry =mlxsw_sp_span_entry_find (to); + span_entry =mlxsw_sp_span_entry_find (from->mlxsw_sp, + destination_port);if (!span_entry) {netdev_err (from->dev,"no span entry found\n" );return ;
@@ -1560,14 +1561,12 @@ static void mlxsw_sp_port_del_cls_matchall_mirror(struct mlxsw_sp_port *mlxsw_sp_port, struct mlxsw_sp_port_mall_mirror_tc_entry *mirror) { - struct mlxsw_sp *mlxsw_sp = mlxsw_sp_port->mlxsw_sp; enum mlxsw_sp_span_type span_type; -struct mlxsw_sp_port *to_port; - to_port = mlxsw_sp->ports[mirror->to_local_port]; span_type = mirror->ingress ?MLXSW_SP_SPAN_INGRESS :MLXSW_SP_SPAN_EGRESS ; -mlxsw_sp_span_mirror_remove (mlxsw_sp_port, to_port, span_type); +mlxsw_sp_span_mirror_remove (mlxsw_sp_port, mirror->to_local_port, + span_type); } static int
Greg Kroah-Hartman
maintainerPATCH 7/160 net: bonding: fix tlb_dynamic_lb default value
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit f13ad104b4e886a03e75f130daf579ef9bf33dfc ]
Commit 8b426dc54cf4 ("bonding: remove hardcoded value") changed the default value for tlb_dynamic_lb which lead to either broken ALB mode (since tlb_dynamic_lb can be changed only in TLB) or setting TLB mode with tlb_dynamic_lb equal to 0.
The first issue was recently fixed by setting tlb_dynamic_lb to 1 always when switching to ALB mode, but the default value is still wrong and we'll enter TLB mode with tlb_dynamic_lb equal to 0 if the mode is changed via netlink or sysfs. In order to restore the previous behaviour and default value simply remove the mode check around the default param initialization for tlb_dynamic_lb which will always set it to 1 as before.
--- drivers/net/bonding/bond_main.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-)
drivers/net/bonding/bond_main.c +7 -10
@@ -4289,7 +4289,7 @@ static int bond_check_params(struct bondint bond_mode =BOND_MODE_ROUNDROBIN ;int xmit_hashtype =BOND_XMIT_POLICY_LAYER2 ;int lacp_fast =0 ; -int tlb_dynamic_lb =0 ; +int tlb_dynamic_lb;/* Convert string parameters. */ if (mode) {
@@ -4601,16 +4601,13 @@ static int bond_check_params(struct bond } ad_user_port_key = valptr->value; -if ((bond_mode ==BOND_MODE_TLB ) || (bond_mode ==BOND_MODE_ALB )) { -bond_opt_initstr (&newval,"default" ); - valptr =bond_opt_parse (bond_opt_get (BOND_OPT_TLB_DYNAMIC_LB ), - &newval); -if (!valptr) { -pr_err ("Error: No tlb_dynamic_lb default value" ); -return -EINVAL ; - } - tlb_dynamic_lb = valptr->value; +bond_opt_initstr (&newval,"default" ); + valptr =bond_opt_parse (bond_opt_get (BOND_OPT_TLB_DYNAMIC_LB ), &newval); +if (!valptr) { +pr_err ("Error: No tlb_dynamic_lb default value" ); +return -EINVAL ; } + tlb_dynamic_lb = valptr->value;if (lp_interval ==0 ) { pr_warn("Warning: ip_interval must be between 1 and %d, so it was reset to %d\n",
Greg Kroah-Hartman
maintainerPATCH 8/160 net_sched: gen_estimator: fix scaling error in bytes/packets samples
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ca558e185972d8ecd308760abf972f5d408bcff0 ]
Denys reported wrong rate estimations with HTB classes.
It appears the bug was added in linux-4.10, since my tests where using intervals of one second only.
HTB using 4 sec default rate estimators, reported rates were 4x higher.
We need to properly scale the bytes/packets samples before integrating them in EWMA.
Tested:
echo 1 >/sys/module/sch_htb/parameters/htb_rate_est
Setup HTB with one class with a rate/cail of 5Gbit
Generate traffic on this class
tc -s -d cl sh dev eth0 classid 7002:11
class htb 7002:11 parent 7002:1 prio 5 quantum 200000 rate 5Gbit ceil 5Gbit linklayer ethernet burst 80000b/1 mpu 0b cburst 80000b/1 mpu 0b level 0 rate_handle 1
Sent 1488215421648 bytes 982969243 pkt (dropped 0, overlimits 0
requeues 0)
rate 5Gbit 412814pps backlog 136260b 2p requeues 0
TCP pkts/rtx 982969327/45 bytes 1488215557414/68130
lended: 22732826 borrowed: 0 giants: 0
tokens: -1684 ctokens: -1684
--- net/core/gen_estimator.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/core/gen_estimator.c +2 -2
@@ -83,10 +83,10 @@ static void est_timer(unsigned long arg)u64 rate, brate;est_fetch_counters (est, &b); - brate = (b.bytes - est->last_bytes) << (8 - est->ewma_log); + brate = (b.bytes - est->last_bytes) << (10 - est->ewma_log - est->intvl_log); brate -= (est->avbps >> est->ewma_log); - rate = (u64)(b.packets - est->last_packets) << (8 - est->ewma_log); + rate = (u64)(b.packets - est->last_packets) << (10 - est->ewma_log - est->intvl_log); rate -= (est->avpps >> est->ewma_log);write_seqcount_begin (&est->seq);
Greg Kroah-Hartman
maintainerPATCH 9/160 net: sched: fix use-after-free in tcf_action_destroy and tcf_del_walker
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Pirko <[email protected]>
[ Upstream commit 255cd50f207ae8ec7b22663246c833407744e634 ]
Recent commit d7fb60b9cafb ("net_sched: get rid of tcfa_rcu") removed freeing in call_rcu, which changed already existing hard-to-hit race condition into 100% hit:
[ 598.599825] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [ 598.607782] IP: tcf_action_destroy+0xc0/0x140
Or:
[ 40.858924] BUG: unable to handle kernel NULL pointer dereference at 0000000000000030 [ 40.862840] IP: tcf_generic_walker+0x534/0x820
Fix this by storing the ops and use them directly for module_put call.
--- net/sched/act_api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/sched/act_api.c +4 -2
@@ -174,7 +174,7 @@ static int tcf_del_walker(struct tcf_hashlist_for_each_entry_safe (p, n, head, tcfa_head) { ret =__tcf_hash_release (p, false, true);if (ret ==ACT_P_DELETED ) { -module_put (p->ops->owner); +module_put (ops->owner); n_i++; }else if (ret <0 ) goto nla_put_failure;
@@ -506,13 +506,15 @@ EXPORT_SYMBOL(tcf_action_exec);int tcf_action_destroy (struct list_head *actions,int bind) { +const struct tc_action_ops *ops;struct tc_action *a, *tmp;int ret =0 ;list_for_each_entry_safe (a, tmp, actions, list) { + ops = a->ops; ret =__tcf_hash_release (a, bind, true);if (ret ==ACT_P_DELETED ) -module_put (a->ops->owner); +module_put (ops->owner);else if (ret <0 )return ret; }
Greg Kroah-Hartman
maintainerPATCH 10/160 sctp: potential read out of bounds in sctp_ulpevent_type_enabled()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
[ Upstream commit fa5f7b51fc3080c2b195fa87c7eca7c05e56f673 ]
This code causes a static checker warning because Smatch doesn't trust anything that comes from skb->data. I've reviewed this code and I do think skb->data can be controlled by the user here.
The sctp_event_subscribe struct has 13 __u8 fields and we want to see if ours is non-zero. sn_type can be any value in the 0-USHRT_MAX range. We're subtracting SCTP_SN_TYPE_BASE which is 1 << 15 so we could read either before the start of the struct or after the end.
This is a very old bug and it's surprising that it would go undetected for so long but my theory is that it just doesn't have a big impact so it would be hard to notice.
--- include/net/sctp/ulpevent.h | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
include/net/sctp/ulpevent.h +5 -1
@@ -153,8 +153,12 @@ __u16 sctp_ulpevent_get_notification_typstatic inline int sctp_ulpevent_type_enabled (__u16 sn_type,struct sctp_event_subscribe *mask) { +int offset = sn_type -SCTP_SN_TYPE_BASE ;char *amask = (char *) mask; -return amask[sn_type -SCTP_SN_TYPE_BASE ]; + +if (offset >=sizeof (struct sctp_event_subscribe )) +return 0 ; +return amask[offset]; }/* Given an event subscription, is this event enabled? */
Greg Kroah-Hartman
maintainerPATCH 11/160 tcp: update skb->skb_mstamp more carefully
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 8c72c65b426b47b3c166a8fef0d8927fe5e8a28d ]
liujian reported a problem in TCP_USER_TIMEOUT processing with a patch in tcp_probe_timer() :
https://www.spinics.net/lists/netdev/msg454496.html
After investigations, the root cause of the problem is that we update skb->skb_mstamp of skbs in write queue, even if the attempt to send a clone or copy of it failed. One reason being a routing problem.
This patch prevents this, solving liujian issue.
It also removes a potential RTT miscalculation, since __tcp_retransmit_skb() is not OR-ing TCP_SKB_CB(skb)->sacked with TCPCB_EVER_RETRANS if a failure happens, but skb->skb_mstamp has been changed.
A future ACK would then lead to a very small RTT sample and min_rtt would then be lowered to this too small value.
Tested:
# cat user_timeout.pkt --local_ip=192.168.102.64
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 +0 bind(3, ..., ...) = 0
+0 listen(3, 1) = 0
+0 ifconfig tun0 192.168.102.64/16; ip ro add 192.0.2.1 dev tun0
+0 < S 0:0(0) win 0 <mss 1460>
+0 > S. 0:0(0) ack 1 <mss 1460>
+.1 < . 1:1(0) ack 1 win 65530
+0 accept(3, ..., ...) = 4
+0 setsockopt(4, SOL_TCP, TCP_USER_TIMEOUT, [3000], 4) = 0 +0 write(4, ..., 24) = 24
+0 > P. 1:25(24) ack 1 win 29200
+.1 < . 1:1(0) ack 25 win 65530
//change the ipaddress
+1 ifconfig tun0 192.168.0.10/16
+1 write(4, ..., 24) = 24
+1 write(4, ..., 24) = 24
+1 write(4, ..., 24) = 24
+1 write(4, ..., 24) = 24
+0 ifconfig tun0 192.168.102.64/16
+0 < . 1:2(1) ack 25 win 65530
+0 ifconfig tun0 192.168.0.10/16
+3 write(4, ..., 24) = -1
# ./packetdrill user_timeout.pkt
--- net/ipv4/tcp_output.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
net/ipv4/tcp_output.c +12 -7
@@ -991,6 +991,7 @@ static int tcp_transmit_skb(struct sockstruct tcp_skb_cb *tcb;struct tcp_out_options opts;unsigned int tcp_options_size, tcp_header_size; +struct sk_buff *oskb =NULL ;struct tcp_md5sig_key *md5;struct tcphdr *th;int err;
@@ -998,12 +999,12 @@ static int tcp_transmit_skb(struct sockBUG_ON (!skb || !tcp_skb_pcount (skb)); tp =tcp_sk (sk); - skb->skb_mstamp = tp->tcp_mstamp;if (clone_it) {TCP_SKB_CB (skb)->tx.in_flight =TCP_SKB_CB (skb)->end_seq - tp->snd_una;tcp_rate_skb_sent (sk, skb); + oskb = skb;if (unlikely (skb_cloned (skb))) skb =pskb_copy (skb, gfp_mask);else
@@ -1011,6 +1012,7 @@ static int tcp_transmit_skb(struct sockif (unlikely (!skb))return -ENOBUFS ; } + skb->skb_mstamp = tp->tcp_mstamp; inet =inet_sk (sk); tcb =TCP_SKB_CB (skb);
@@ -1122,12 +1124,14 @@ static int tcp_transmit_skb(struct sock err = icsk->icsk_af_ops->queue_xmit (sk, skb, &inet->cork.fl); -if (likely (err <=0 )) -return err; - -tcp_enter_cwr (sk); +if (unlikely (err >0 )) { +tcp_enter_cwr (sk); + err =net_xmit_eval (err); + } +if (!err && oskb) + oskb->skb_mstamp = tp->tcp_mstamp; -return net_xmit_eval (err); +return err; }/* This routine just queues the buffer for sending.
@@ -2866,10 +2870,11 @@ int __tcp_retransmit_skb(struct sock *sk skb_headroom(skb) >= 0xFFFF)) {struct sk_buff *nskb; - skb->skb_mstamp = tp->tcp_mstamp; nskb =__pskb_copy (skb,MAX_TCP_HEADER ,GFP_ATOMIC ); err = nskb ?tcp_transmit_skb (sk, nskb,0 ,GFP_ATOMIC ) : -ENOBUFS ; +if (!err) + skb->skb_mstamp = tp->tcp_mstamp; } else { err =tcp_transmit_skb (sk, skb,1 ,GFP_ATOMIC ); }
Greg Kroah-Hartman
maintainerPATCH 12/160 bpf/verifier: reject BPF_ALU64|BPF_END
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Cree <[email protected]>
[ Upstream commit e67b8a685c7c984e834e3181ef4619cd7025a136 ]
Neither ___bpf_prog_run nor the JITs accept it. Also adds a new test case.
--- kernel/bpf/verifier.c | 3 ++- tools/testing/selftests/bpf/test_verifier.c | 16 ++++++++++++++++ 2 files changed, 18 insertions(+), 1 deletion(-)
kernel/bpf/verifier.c +2 -1
@@ -1978,7 +1978,8 @@ static int check_alu_op(struct bpf_verif } }else {if (insn->src_reg !=BPF_REG_0 || insn->off !=0 || - (insn->imm !=16 && insn->imm !=32 && insn->imm !=64 )) { + (insn->imm !=16 && insn->imm !=32 && insn->imm !=64 ) || +BPF_CLASS (insn->code) ==BPF_ALU64 ) {verbose ("BPF_END uses reserved fields\n" );return -EINVAL ; }
tools/testing/selftests/bpf/test_verifier.c +16 -0
@@ -6009,6 +6009,22 @@ static struct bpf_test tests[] = { .result = REJECT, .result_unpriv = REJECT, }, + { + "invalid 64-bit BPF_END", + .insns = { + BPF_MOV32_IMM(BPF_REG_0, 0), + { + .code = BPF_ALU64 | BPF_END | BPF_TO_LE, + .dst_reg = BPF_REG_0, + .src_reg = 0, + .off = 0, + .imm =32 , + }, + BPF_EXIT_INSN(), + }, + .errstr ="BPF_END uses reserved fields" , + .result = REJECT, + }, };static int probe_filter_length (const struct bpf_insn *fp)
Greg Kroah-Hartman
maintainerPATCH 13/160 tcp: fix data delivery rate
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit fc22579917eb7e13433448a342f1cb1592920940 ]
Now skb->mstamp_skb is updated later, we also need to call tcp_rate_skb_sent() after the update is done.
--- net/ipv4/tcp_output.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
net/ipv4/tcp_output.c +3 -4
@@ -1002,8 +1002,6 @@ static int tcp_transmit_skb(struct sockif (clone_it) {TCP_SKB_CB (skb)->tx.in_flight =TCP_SKB_CB (skb)->end_seq - tp->snd_una; -tcp_rate_skb_sent (sk, skb); - oskb = skb;if (unlikely (skb_cloned (skb))) skb =pskb_copy (skb, gfp_mask);
@@ -1128,9 +1126,10 @@ static int tcp_transmit_skb(struct socktcp_enter_cwr (sk); err =net_xmit_eval (err); } -if (!err && oskb) +if (!err && oskb) { oskb->skb_mstamp = tp->tcp_mstamp; - +tcp_rate_skb_sent (sk, oskb); + }return err; }
Greg Kroah-Hartman
maintainerPATCH 14/160 udpv6: Fix the checksum computation when HW checksum does not apply
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Subash Abhinov Kasiviswanathan <[email protected]>
[ Upstream commit 63ecc3d9436f8012e49dc846d6cb0a85a3433517 ]
While trying an ESP transport mode encryption for UDPv6 packets of datagram size 1436 with MTU 1500, checksum error was observed in the secondary fragment.
This error occurs due to the UDP payload checksum being missed out when computing the full checksum for these packets in udp6_hwcsum_outgoing().
--- net/ipv6/udp.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/udp.c +1 -0
@@ -1011,6 +1011,7 @@ static void udp6_hwcsum_outgoing(struct*/ offset =skb_transport_offset (skb); skb->csum =skb_checksum (skb, offset, skb->len - offset,0 ); + csum = skb->csum; skb->ip_summed =CHECKSUM_NONE ;
Greg Kroah-Hartman
maintainerPATCH 15/160 ip6_gre: skb_push ipv6hdr before packing the header in ip6gre_header
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 76cc0d3282d4b933fa144fa41fbc5318e0fdca24 ]
Now in ip6gre_header before packing the ipv6 header, it skb_push t->hlen which only includes encap_hlen + tun_hlen. It means greh and inner header would be over written by ipv6 stuff and ipv6h might have no chance to set up.
Jianlin found this issue when using remote any on ip6_gre, the packets he captured on gre dev are truncated:
22:50:26.210866 Out ethertype IPv6 (0x86dd), length 120: truncated-ip6 -\
8128 bytes missing!(flowlabel 0x92f40, hlim 0, next-header Options (0) \
payload length: 8192) ::1:2000:0 > ::1:0:86dd: HBH [trunc] ip-proto-128 \
8184
It should also skb_push ipv6hdr so that ipv6h points to the right position to set ipv6 stuff up.
This patch is to skb_push hlen + sizeof(*ipv6h) and also fix some indents in ip6gre_header.
--- net/ipv6/ip6_gre.c | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-)
net/ipv6/ip6_gre.c +11 -10
@@ -940,24 +940,25 @@ done: }static int ip6gre_header (struct sk_buff *skb,struct net_device *dev, -unsigned short type, -const void *daddr,const void *saddr,unsigned int len) +unsigned short type,const void *daddr, +const void *saddr,unsigned int len) {struct ip6_tnl *t =netdev_priv (dev); -struct ipv6hdr *ipv6h =skb_push (skb, t->hlen); -__be16 *p = (__be16 *)(ipv6h+1 ); +struct ipv6hdr *ipv6h; +__be16 *p; -ip6_flow_hdr (ipv6h,0 , -ip6_make_flowlabel (dev_net (dev), skb, - t->fl.u.ip6.flowlabel, true, - &t->fl.u.ip6)); + ipv6h =skb_push (skb, t->hlen +sizeof (*ipv6h)); +ip6_flow_hdr (ipv6h,0 ,ip6_make_flowlabel (dev_net (dev), skb, + t->fl.u.ip6.flowlabel, + true, &t->fl.u.ip6)); ipv6h->hop_limit = t->parms.hop_limit; ipv6h->nexthdr =NEXTHDR_GRE ; ipv6h->saddr = t->parms.laddr; ipv6h->daddr = t->parms.raddr; - p[0 ] = t->parms.o_flags; - p[1 ] =htons (type); + p = (__be16 *)(ipv6h +1 ); + p[0 ] = t->parms.o_flags; + p[1 ] =htons (type);/* * Set the source hardware address.
Greg Kroah-Hartman
maintainerPATCH 16/160 net: phy: Fix mask value write on gmii2rgmii converter speed register
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fahad Kunnathadi <[email protected]>
[ Upstream commit f2654a4781318dc7ab8d6cde66f1fa39eab980a9 ]
To clear Speed Selection in MDIO control register(0x10), ie, clear bits 6 and 13 to zero while keeping other bits same. Before AND operation,The Mask value has to be perform with bitwise NOT operation (ie, ~ operator)
This patch clears current speed selection before writing the new speed settings to gmii2rgmii converter
--- drivers/net/phy/xilinx_gmii2rgmii.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/xilinx_gmii2rgmii.c +1 -1
@@ -44,7 +44,7 @@ static int xgmiitorgmii_read_status(stru priv->phy_drv->read_status (phydev); val =mdiobus_read (phydev->mdio.bus, priv->addr,XILINX_GMII2RGMII_REG ); - val &=XILINX_GMII2RGMII_SPEED_MASK ; + val &= ~XILINX_GMII2RGMII_SPEED_MASK ;if (phydev->speed ==SPEED_1000 ) val |=BMCR_SPEED1000 ;
Greg Kroah-Hartman
maintainerPATCH 17/160 ip6_tunnel: do not allow loading ip6_tunnel if ipv6 is disabled in cmdline
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 8c22dab03ad072e45060c299c70d02a4f6fc4aab ]
If ipv6 has been disabled from cmdline since kernel started, it makes no sense to allow users to create any ip6 tunnel. Otherwise, it could some potential problem.
Jianlin found a kernel crash caused by this in ip6_gre when he set ipv6.disable=1 in grub:
[ 209.588865] Unable to handle kernel paging request for data at address 0x00000080 [ 209.588872] Faulting instruction address: 0xc000000000a3aa6c [ 209.588879] Oops: Kernel access of bad area, sig: 11 [#1] [ 209.589062] NIP [c000000000a3aa6c] fib_rules_lookup+0x4c/0x260 [ 209.589071] LR [c000000000b9ad90] fib6_rule_lookup+0x50/0xb0 [ 209.589076] Call Trace: [ 209.589097] fib6_rule_lookup+0x50/0xb0 [ 209.589106] rt6_lookup+0xc4/0x110 [ 209.589116] ip6gre_tnl_link_config+0x214/0x2f0 [ip6_gre] [ 209.589125] ip6gre_newlink+0x138/0x3a0 [ip6_gre] [ 209.589134] rtnl_newlink+0x798/0xb80 [ 209.589142] rtnetlink_rcv_msg+0xec/0x390 [ 209.589151] netlink_rcv_skb+0x138/0x150 [ 209.589159] rtnetlink_rcv+0x48/0x70 [ 209.589169] netlink_unicast+0x538/0x640 [ 209.589175] netlink_sendmsg+0x40c/0x480 [ 209.589184] ___sys_sendmsg+0x384/0x4e0 [ 209.589194] SyS_sendmsg+0xd4/0x140 [ 209.589201] SyS_socketcall+0x3e0/0x4f0 [ 209.589209] system_call+0x38/0xe0
This patch is to return -EOPNOTSUPP in ip6_tunnel_init if ipv6 has been disabled from cmdline.
--- net/ipv6/ip6_tunnel.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv6/ip6_tunnel.c +3 -0
@@ -2258,6 +2258,9 @@ static int __init ip6_tunnel_init(void) {int err; +if (!ipv6_mod_enabled ()) +return -EOPNOTSUPP ; + err =register_pernet_device (&ip6_tnl_net_ops);if (err <0 ) goto out_pernet;
Greg Kroah-Hartman
maintainerPATCH 18/160 net/sched: cls_matchall: fix crash when used with classful qdisc
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <[email protected]>
[ Upstream commit 3ff4cbec87da48b0ec1f7b6196607b034de0c680 ]
this script, edited from Linux Advanced Routing and Traffic Control guide
tc q a dev en0 root handle 1: htb default a
tc c a dev en0 parent 1: classid 1:1 htb rate 6mbit burst 15k tc c a dev en0 parent 1:1 classid 1:a htb rate 5mbit ceil 6mbit burst 15k tc c a dev en0 parent 1:1 classid 1:b htb rate 1mbit ceil 6mbit burst 15k tc f a dev en0 parent 1:0 prio 1 $clsname $clsargs classid 1:b ping $address -c1
tc -s c s dev en0
classifies traffic to 1:b or 1:a, depending on whether the packet matches or not the pattern $clsargs of filter $clsname. However, when $clsname is 'matchall', a systematic crash can be observed in htb_classify(). HTB and classful qdiscs don't assign initial value to struct tcf_result, but then they expect it to contain valid values after filters have been run. Thus, current 'matchall' ignores the TCA_MATCHALL_CLASSID attribute, configured by user, and makes HTB (and classful qdiscs) dereference random pointers.
By assigning head->res to *res in mall_classify(), before the actions are invoked, we fix this crash and enable TCA_MATCHALL_CLASSID functionality, that had no effect on 'matchall' classifier since its first introduction.
--- net/sched/cls_matchall.c | 1 + 1 file changed, 1 insertion(+)
net/sched/cls_matchall.c +1 -0
@@ -32,6 +32,7 @@ static int mall_classify(struct sk_buffif (tc_skip_sw (head->flags))return -1 ; + *res = head->res;return tcf_exts_exec (skb, &head->exts, res); }
Greg Kroah-Hartman
maintainerPATCH 20/160 bpf: do not disable/enable BH in bpf_map_free_id()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 930651a75bf1ba6893a8b8475270664ebdb6cf4a ]
syzkaller reported following splat [1]
Since hard irq are disabled by the caller, bpf_map_free_id() should not try to enable/disable BH.
Another solution would be to change htab_map_delete_elem() to defer the free_htab_elem() call after raw_spin_unlock_irqrestore(&b->lock, flags), but this might be not enough to cover other code paths.
[1]
WARNING: CPU: 1 PID: 8052 at kernel/softirq.c:161 __local_bh_enable_ip +0x1e/0x160 kernel/softirq.c:161 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 8052 Comm: syz-executor1 Not tainted 4.13.0-next-20170915+ #23 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 panic+0x1e4/0x417 kernel/panic.c:181 __warn+0x1c4/0x1d9 kernel/panic.c:542 report_bug+0x211/0x2d0 lib/bug.c:183 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:178 do_trap_no_signal arch/x86/kernel/traps.c:212 [inline] do_trap+0x260/0x390 arch/x86/kernel/traps.c:261 do_error_trap+0x120/0x390 arch/x86/kernel/traps.c:298 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:311 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:905 RIP: 0010:__local_bh_enable_ip+0x1e/0x160 kernel/softirq.c:161 RSP: 0018:ffff8801cdcd7748 EFLAGS: 00010046 RAX: 0000000000000082 RBX: 0000000000000201 RCX: 0000000000000000 RDX: 1ffffffff0b5933c RSI: 0000000000000201 RDI: ffffffff85ac99e0 RBP: ffff8801cdcd7758 R08: ffffffff85b87158 R09: 1ffff10039b9aec6 R10: ffff8801c99f24c0 R11: 0000000000000002 R12: ffffffff817b0b47 R13: dffffc0000000000 R14: ffff8801cdcd77e8 R15: 0000000000000001 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:207 spin_unlock_bh include/linux/spinlock.h:361 [inline] bpf_map_free_id kernel/bpf/syscall.c:197 [inline] __bpf_map_put+0x267/0x320 kernel/bpf/syscall.c:227 bpf_map_put+0x1a/0x20 kernel/bpf/syscall.c:235 bpf_map_fd_put_ptr+0x15/0x20 kernel/bpf/map_in_map.c:96 free_htab_elem+0xc3/0x1b0 kernel/bpf/hashtab.c:658 htab_map_delete_elem+0x74d/0x970 kernel/bpf/hashtab.c:1063 map_delete_elem kernel/bpf/syscall.c:633 [inline] SYSC_bpf kernel/bpf/syscall.c:1479 [inline] SyS_bpf+0x2188/0x46a0 kernel/bpf/syscall.c:1451 entry_SYSCALL_64_fastpath+0x1f/0xbe
--- kernel/bpf/syscall.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
kernel/bpf/syscall.c +4 -2
@@ -144,15 +144,17 @@ static int bpf_map_alloc_id(struct bpf_mstatic void bpf_map_free_id (struct bpf_map *map,bool do_idr_lock) { +unsigned long flags; +if (do_idr_lock) -spin_lock_bh (&map_idr_lock); +spin_lock_irqsave (&map_idr_lock, flags);else __acquire (&map_idr_lock);idr_remove (&map_idr, map->id);if (do_idr_lock) -spin_unlock_bh (&map_idr_lock); +spin_unlock_irqrestore (&map_idr_lock, flags);else __release (&map_idr_lock); }
Greg Kroah-Hartman
maintainerPATCH 21/160 tcp: fastopen: fix on syn-data transmit failure
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b5b7db8d680464b1d631fd016f5e093419f0bfd9 ]
Our recent change exposed a bug in TCP Fastopen Client that syzkaller found right away [1]
When we prepare skb with SYN+DATA, we attempt to transmit it, and we update socket state as if the transmit was a success.
In socket RTX queue we have two skbs, one with the SYN alone, and a second one containing the DATA.
When (malicious) ACK comes in, we now complain that second one had no skb_mstamp.
The proper fix is to make sure that if the transmit failed, we do not pretend we sent the DATA skb, and make it our send_head.
When 3WHS completes, we can now send the DATA right away, without having to wait for a timeout.
[1]
WARNING: CPU: 0 PID: 100189 at net/ipv4/tcp_input.c:3117 tcp_clean_rtx_queue+0x2057/0x2ab0 net/ipv4/tcp_input.c:3117()
WARN_ON_ONCE(last_ackt == 0);
Modules linked in: CPU: 0 PID: 100189 Comm: syz-executor1 Not tainted Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 ffff8800b35cb1d8 ffffffff81cad00d 0000000000000000 ffffffff828a4347 ffff88009f86c080 ffffffff8316eb20 0000000000000d7f ffff8800b35cb220 ffffffff812c33c2 ffff8800baad2440 00000009d46575c0 Call Trace: [<ffffffff81cad00d>] __dump_stack [<ffffffff81cad00d>] dump_stack+0xc1/0x124 [<ffffffff812c33c2>] warn_slowpath_common+0xe2/0x150 [<ffffffff812c361e>] warn_slowpath_null+0x2e/0x40 [<ffffffff828a4347>] tcp_clean_rtx_queue+0x2057/0x2ab0 n [<ffffffff828ae6fd>] tcp_ack+0x151d/0x3930 [<ffffffff828baa09>] tcp_rcv_state_process+0x1c69/0x4fd0 [<ffffffff828efb7f>] tcp_v4_do_rcv+0x54f/0x7c0 [<ffffffff8258aacb>] sk_backlog_rcv [<ffffffff8258aacb>] __release_sock+0x12b/0x3a0 [<ffffffff8258ad9e>] release_sock+0x5e/0x1c0 [<ffffffff8294a785>] inet_wait_for_connect [<ffffffff8294a785>] __inet_stream_connect+0x545/0xc50 [<ffffffff82886f08>] tcp_sendmsg_fastopen [<ffffffff82886f08>] tcp_sendmsg+0x2298/0x35a0 [<ffffffff82952515>] inet_sendmsg+0xe5/0x520 [<ffffffff8257152f>] sock_sendmsg_nosec [<ffffffff8257152f>] sock_sendmsg+0xcf/0x110
--- net/ipv4/tcp_output.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/ipv4/tcp_output.c +9 -0
@@ -3420,6 +3420,10 @@ static int tcp_send_syn_data(struct sock goto done; } +/* data was not sent, this is our new send_head */ + sk->sk_send_head = syn_data; + tp->packets_out -=tcp_skb_pcount (syn_data); + fallback:/* Send a regular SYN with Fast Open cookie request option */ if (fo->cookie.len >0 )
@@ -3472,6 +3476,11 @@ int tcp_connect(struct sock *sk)*/ tp->snd_nxt = tp->write_seq; tp->pushed_seq = tp->write_seq; + buff =tcp_send_head (sk); +if (unlikely (buff)) { + tp->snd_nxt =TCP_SKB_CB (buff)->seq; + tp->pushed_seq =TCP_SKB_CB (buff)->seq; + }TCP_INC_STATS (sock_net (sk),TCP_MIB_ACTIVEOPENS );/* Timer for repeating the SYN until an answer. */
Greg Kroah-Hartman
maintainerPATCH 22/160 net: emac: Fix napi poll list corruption
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
[ Upstream commit f55956065ec94e3e9371463d693a1029c4cc3007 ]
This patch is pretty much a carbon copy of
commit 3079c652141f ("caif: Fix napi poll list corruption") with "caif" replaced by "emac".
The commit d75b1ade567f ("net: less interrupt masking in NAPI") breaks emac.
It is now required that if the entire budget is consumed when poll returns, the napi poll_list must remain empty. However, like some other drivers emac tries to do a last-ditch check and if there is more work it will call napi_reschedule and then immediately process some of this new work. Should the entire budget be consumed while processing such new work then we will violate the new caller contract.
This patch fixes this by not touching any work when we reschedule in emac.
--- drivers/net/ethernet/ibm/emac/mal.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/ibm/emac/mal.c +1 -2
@@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *unsigned long flags;MAL_DBG2 (mal,"poll(%d)" NL , budget); - again: +/* Process TX skbs */ list_for_each (l, &mal->poll_list) { struct mal_commac *mc =
@@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *spin_lock_irqsave (&mal->lock, flags);mal_disable_eob_irq (mal);spin_unlock_irqrestore (&mal->lock, flags); - goto again; } mc->ops->poll_tx (mc->dev); }
Greg Kroah-Hartman
maintainerPATCH 23/160 net: ipv6: fix regression of no RTM_DELADDR sent after DAD failure
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Manning <[email protected]>
[ Upstream commit 6819a14ecbe2e089e5c5bb74edecafdde2028a00 ]
Commit f784ad3d79e5 ("ipv6: do not send RTM_DELADDR for tentative addresses") incorrectly assumes that no RTM_NEWADDR are sent for addresses in tentative state, as this does happen for the standard IPv6 use-case of DAD failure, see the call to ipv6_ifa_notify() in addconf_dad_stop(). So as a result of this change, no RTM_DELADDR is sent after DAD failure for a link-local when strict DAD (accept_dad=2) is configured, or on the next admin down in other cases. The absence of this notification breaks backwards compatibility and causes problems after DAD failure if this notification was being relied on. The solution is to allow RTM_DELADDR to still be sent after DAD failure.
--- net/ipv6/addrconf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv6/addrconf.c +3 -2
@@ -4982,9 +4982,10 @@ static void inet6_ifa_notify(int event,/* Don't send DELADDR notification for TENTATIVE address, * since NEWADDR notification is sent only after removing -* TENTATIVE flag. +* TENTATIVE flag, if DAD has not failed. */ -if (ifa->flags &IFA_F_TENTATIVE && event ==RTM_DELADDR ) +if (ifa->flags &IFA_F_TENTATIVE && !(ifa->flags &IFA_F_DADFAILED ) && + event ==RTM_DELADDR )return ; skb =nlmsg_new (inet6_ifaddr_msgsize (),GFP_ATOMIC );
Greg Kroah-Hartman
maintainerPATCH 24/160 packet: hold bind lock when rebinding to fanout hook
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 008ba2a13f2d04c947adc536d19debb8fe66f110 ]
Packet socket bind operations must hold the po->bind_lock. This keeps po->running consistent with whether the socket is actually on a ptype list to receive packets.
fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then binds the fanout object to receive through packet_rcv_fanout.
Make it hold the po->bind_lock when testing po->running and rebinding. Else, it can race with other rebind operations, such as that in packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates can result in a socket being added to a fanout group twice, causing use-after-free KASAN bug reports, among others.
Reported independently by both trinity and syzkaller. Verified that the syzkaller reproducer passes after this patch.
--- net/packet/af_packet.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
net/packet/af_packet.c +11 -5
@@ -1686,10 +1686,6 @@ static int fanout_add(struct sock *sk, umutex_lock (&fanout_mutex); - err = -EINVAL ; -if (!po->running) - goto out; - err = -EALREADY ;if (po->fanout) goto out;
@@ -1751,7 +1747,10 @@ static int fanout_add(struct sock *sk, ulist_add (&match->list, &fanout_list); } err = -EINVAL ; -if (match->type == type && + +spin_lock (&po->bind_lock); +if (po->running && + match->type == type && match->prot_hook.type == po->prot_hook.type && match->prot_hook.dev == po->prot_hook.dev) { err = -ENOSPC ;
@@ -1763,6 +1762,13 @@ static int fanout_add(struct sock *sk, u err =0 ; } } +spin_unlock (&po->bind_lock); + +if (err && !refcount_read (&match->sk_ref)) { +list_del (&match->list); +kfree (match); + } + out:if (err && rollover) {kfree (rollover);
Greg Kroah-Hartman
maintainerPATCH 25/160 bpf: one perf event close wont free bpf program attached by another perf event
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonghong Song <[email protected]>
[ Upstream commit ec9dd352d591f0c90402ec67a317c1ed4fb2e638 ]
This patch fixes a bug exhibited by the following scenario:
1. fd1 = perf_event_open with attr.config = ID1
2. attach bpf program prog1 to fd1
3. fd2 = perf_event_open with attr.config = ID1
<this will be successful>
4. user program closes fd2 and prog1 is detached from the tracepoint.
5. user program with fd1 does not work properly as tracepoint no output any more.
The issue happens at step 4. Multiple perf_event_open can be called successfully, but only one bpf prog pointer in the tp_event. In the current logic, any fd release for the same tp_event will free the tp_event->prog.
The fix is to free tp_event->prog only when the closing fd corresponds to the one which registered the program.
--- include/linux/trace_events.h | 1 + kernel/events/core.c | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-)
include/linux/trace_events.h +1 -0
@@ -277,6 +277,7 @@ struct trace_event_call {int perf_refcount;struct hlist_head __percpu *perf_events;struct bpf_prog *prog; +struct perf_event *bpf_prog_owner;int (*perf_perm)(struct trace_event_call *,struct perf_event *);
kernel/events/core.c +2 -1
@@ -8121,6 +8121,7 @@ static int perf_event_set_bpf_prog(struc } } event->tp_event->prog = prog; + event->tp_event->bpf_prog_owner = event;return 0 ; }
@@ -8135,7 +8136,7 @@ static void perf_event_free_bpf_prog(strreturn ; prog = event->tp_event->prog; -if (prog) { +if (prog && event->tp_event->bpf_prog_owner == event) { event->tp_event->prog =NULL ;bpf_prog_put (prog); }
Greg Kroah-Hartman
maintainerPATCH 26/160 net: change skb->mac_header when Generic XDP calls adjust_head
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Cree <[email protected]>
[ Upstream commit 92dd5452c1be873a1193561f4f691763103d22ac ]
Since XDP's view of the packet includes the MAC header, moving the start-
of-packet with bpf_xdp_adjust_head needs to also update the offset of the MAC header (which is relative to skb->head, not to the skb->data that was changed).
Without this, tcpdump sees packets starting from the old MAC header rather
than the new one, at least in my tests on the loopback device.
--- net/core/dev.c | 1 + 1 file changed, 1 insertion(+)
net/core/dev.c +1 -0
@@ -4408,6 +4408,7 @@ static u32 netif_receive_generic_xdp(str__skb_pull (skb, off); else if (off < 0) __skb_push(skb, -off); + skb->mac_header += off;switch (act) {case XDP_TX :
Greg Kroah-Hartman
maintainerPATCH 27/160 isdn/i4l: fetch the ppp_write buffer in one shot
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meng Xu <[email protected]>
[ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ]
In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is fetched twice from userspace. The first fetch is used to peek at the protocol of the message and reset the huptimer if necessary; while the second fetch copies in the whole buffer. However, given that buf resides in userspace memory, a user process can race to change its memory content across fetches. By doing so, we can either avoid resetting the huptimer for any type of packets (by first setting proto to PPP_LCP and later change to the actual type) or force resetting the huptimer for LCP packets.
This patch changes this double-fetch behavior into two single fetches decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0). A more detailed discussion can be found at
https://marc.info/?l=linux-kernel&m=150586376926123&w=2
--- drivers/isdn/i4l/isdn_ppp.c | 37 +++++++++++++++++++++++++------------ 1 file changed, 25 insertions(+), 12 deletions(-)
drivers/isdn/i4l/isdn_ppp.c +25 -12
@@ -825,7 +825,6 @@ isdn_ppp_write(int min, struct file *filisdn_net_local *lp;struct ippp_struct *is;int proto; -unsigned char protobuf[4 ]; is = file->private_data;
@@ -839,24 +838,28 @@ isdn_ppp_write(int min, struct file *filif (!lp)printk (KERN_DEBUG "isdn_ppp_write: lp == NULL\n" );else { -/* -* Don't reset huptimer for -* LCP packets. (Echo requests). -*/ -if (copy_from_user (protobuf, buf,4 )) -return -EFAULT ; - proto =PPP_PROTOCOL (protobuf); -if (proto !=PPP_LCP ) - lp->huptimer =0 ; +if (lp->isdn_device <0 || lp->isdn_channel <0 ) { +unsigned char protobuf[4 ]; +/* +* Don't reset huptimer for +* LCP packets. (Echo requests). +*/ +if (copy_from_user (protobuf, buf,4 )) +return -EFAULT ; + + proto =PPP_PROTOCOL (protobuf); +if (proto !=PPP_LCP ) + lp->huptimer =0 ; -if (lp->isdn_device <0 || lp->isdn_channel <0 )return 0 ; + }if ((dev->drv[lp->isdn_device]->flags &DRV_FLAG_RUNNING ) && lp->dialstate ==0 && (lp->flags &ISDN_NET_CONNECTED )) {unsigned short hl;struct sk_buff *skb; +unsigned char *cpy_buf;/* * we need to reserve enough space in front of * sk_buff. old call to dev_alloc_skb only reserved
@@ -869,11 +872,21 @@ isdn_ppp_write(int min, struct file *filreturn count; }skb_reserve (skb, hl); -if (copy_from_user (skb_put (skb, count), buf, count)) + cpy_buf =skb_put (skb, count); +if (copy_from_user (cpy_buf, buf, count)) {kfree_skb (skb);return -EFAULT ; } + +/* +* Don't reset huptimer for +* LCP packets. (Echo requests). +*/ + proto =PPP_PROTOCOL (cpy_buf); +if (proto !=PPP_LCP ) + lp->huptimer =0 ; +if (is->debug &0x40 ) {printk (KERN_DEBUG "ppp xmit: len %d\n" , (int ) skb->len);isdn_ppp_frame_log ("xmit" , skb->data, skb->len,32 , is->unit, lp->ppp_slot);
Greg Kroah-Hartman
maintainerPATCH 28/160 net_sched: always reset qdisc backlog in qdisc_reset()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
[ Upstream commit c8e1812960eeae42e2183154927028511c4bc566 ]
SKB stored in qdisc->gso_skb also counted into backlog.
Some qdiscs don't reset backlog to zero in ->reset(), for example sfq just dequeue and free all queued skb.
--- net/sched/sch_generic.c | 1 + 1 file changed, 1 insertion(+)
net/sched/sch_generic.c +1 -0
@@ -681,6 +681,7 @@ void qdisc_reset(struct Qdisc *qdisc) qdisc->gso_skb =NULL ; } qdisc->q.qlen =0 ; + qdisc->qstats.backlog =0 ; }EXPORT_SYMBOL (qdisc_reset);
Greg Kroah-Hartman
maintainerPATCH 29/160 net: stmmac: Cocci spatch "of_table"
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Meyer <[email protected]>
[ Upstream commit f0ef1f4f2b772c0a1c8b35a6ae3edf974cc110dd ]
Make sure (of/i2c/platform)_device_id tables are NULL terminated. Found by coccinelle spatch "misc/of_table.cocci"
--- drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +1 -0
@@ -315,6 +315,7 @@ static int stmmac_dt_phy(struct plat_stm { .compatible = "allwinner,sun8i-h3-emac" }, { .compatible = "allwinner,sun8i-v3s-emac" }, { .compatible = "allwinner,sun50i-a64-emac" }, + {}, };/* If phy-handle property is passed from DT, use it as the PHY */
Greg Kroah-Hartman
maintainerPATCH 30/160 net: qcom/emac: specify the correct size when mapping a DMA buffer
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Timur Tabi <[email protected]>
[ Upstream commit a93ad944f4ff9a797abff17c73fc4b1e4a1d9141 ]
When mapping the RX DMA buffers, the driver was accidentally specifying zero for the buffer length. Under normal circumstances, SWIOTLB does not need to allocate a bounce buffer, so the address is just mapped without checking the size field. This is why the error was not detected earlier.
--- drivers/net/ethernet/qualcomm/emac/emac-mac.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/emac/emac-mac.c +2 -1
@@ -876,7 +876,8 @@ static void emac_mac_rx_descs_refill(str curr_rxbuf->dma_addr =dma_map_single (adpt->netdev->dev.parent, skb->data, - curr_rxbuf->length,DMA_FROM_DEVICE ); + adpt->rxbuf_size,DMA_FROM_DEVICE ); + ret =dma_mapping_error (adpt->netdev->dev.parent, curr_rxbuf->dma_addr);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 31/160 vti: fix use after free in vti_tunnel_xmit/vti6_tnl_xmit
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <[email protected]>
[ Upstream commit 36f6ee22d2d66046e369757ec6bbe1c482957ba6 ]
When running LTP IPsec tests, KASan might report:
BUG: KASAN: use-after-free in vti_tunnel_xmit+0xeee/0xff0 [ip_vti] Read of size 4 at addr ffff880dc6ad1980 by task swapper/0/0 ... Call Trace: <IRQ> dump_stack+0x63/0x89 print_address_description+0x7c/0x290 kasan_report+0x28d/0x370 ? vti_tunnel_xmit+0xeee/0xff0 [ip_vti] __asan_report_load4_noabort+0x19/0x20 vti_tunnel_xmit+0xeee/0xff0 [ip_vti] ? vti_init_net+0x190/0x190 [ip_vti] ? save_stack_trace+0x1b/0x20 ? save_stack+0x46/0xd0 dev_hard_start_xmit+0x147/0x510 ? icmp_echo.part.24+0x1f0/0x210 __dev_queue_xmit+0x1394/0x1c60 ... Freed by task 0: save_stack_trace+0x1b/0x20 save_stack+0x46/0xd0 kasan_slab_free+0x70/0xc0 kmem_cache_free+0x81/0x1e0 kfree_skbmem+0xb1/0xe0 kfree_skb+0x75/0x170 kfree_skb_list+0x3e/0x60 __dev_queue_xmit+0x1298/0x1c60 dev_queue_xmit+0x10/0x20 neigh_resolve_output+0x3a8/0x740 ip_finish_output2+0x5c0/0xe70 ip_finish_output+0x4ba/0x680 ip_output+0x1c1/0x3a0 xfrm_output_resume+0xc65/0x13d0 xfrm_output+0x1e4/0x380 xfrm4_output_finish+0x5c/0x70
Can be fixed if we get skb->len before dst_output().
--- net/ipv4/ip_vti.c | 3 ++- net/ipv6/ip6_vti.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/ipv4/ip_vti.c +2 -1
@@ -168,6 +168,7 @@ static netdev_tx_t vti_xmit(struct sk_bustruct ip_tunnel_parm *parms = &tunnel->parms;struct dst_entry *dst =skb_dst (skb);struct net_device *tdev;/* Device to other host */ +int pkt_len = skb->len;int err;int mtu;
@@ -229,7 +230,7 @@ static netdev_tx_t vti_xmit(struct sk_bu err =dst_output (tunnel->net, skb->sk, skb);if (net_xmit_eval (err) ==0 ) - err = skb->len; + err = pkt_len;iptunnel_xmit_stats (dev, err);return NETDEV_TX_OK ;
net/ipv6/ip6_vti.c +2 -1
@@ -445,6 +445,7 @@ vti6_xmit(struct sk_buff *skb, struct nestruct dst_entry *dst =skb_dst (skb);struct net_device *tdev;struct xfrm_state *x; +int pkt_len = skb->len;int err =-1 ;int mtu;
@@ -502,7 +503,7 @@ vti6_xmit(struct sk_buff *skb, struct nestruct pcpu_sw_netstats *tstats =this_cpu_ptr (dev->tstats);u64_stats_update_begin (&tstats->syncp); - tstats->tx_bytes += skb->len; + tstats->tx_bytes += pkt_len; tstats->tx_packets++;u64_stats_update_end (&tstats->syncp); }else {
Greg Kroah-Hartman
maintainerPATCH 32/160 l2tp: fix race condition in l2tp_tunnel_delete
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <[email protected]>
[ Upstream commit 62b982eeb4589b2e6d7c01a90590e3a4c2b2ca19 ]
If we try to delete the same tunnel twice, the first delete operation does a lookup (l2tp_tunnel_get), finds the tunnel, calls l2tp_tunnel_delete, which queues it for deletion by l2tp_tunnel_del_work.
The second delete operation also finds the tunnel and calls l2tp_tunnel_delete. If the workqueue has already fired and started running l2tp_tunnel_del_work, then l2tp_tunnel_delete will queue the same tunnel a second time, and try to free the socket again.
Add a dead flag to prevent firing the workqueue twice. Then we can remove the check of queue_work's result that was meant to prevent that race but doesn't.
Reproducer:
ip l2tp add tunnel tunnel_id 3000 peer_tunnel_id 4000 local 192.168.0.2 remote 192.168.0.1 encap udp udp_sport 5000 udp_dport 6000 ip l2tp add session name l2tp1 tunnel_id 3000 session_id 1000 peer_session_id 2000
ip link set l2tp1 up
ip l2tp del tunnel tunnel_id 3000
ip l2tp del tunnel tunnel_id 3000
--- net/l2tp/l2tp_core.c | 10 ++++------ net/l2tp/l2tp_core.h | 5 ++++- 2 files changed, 8 insertions(+), 7 deletions(-)
net/l2tp/l2tp_core.c +4 -6
@@ -1665,14 +1665,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);/* This function is used by the netlink TUNNEL_DELETE command. */ -int l2tp_tunnel_delete (struct l2tp_tunnel *tunnel) +void l2tp_tunnel_delete (struct l2tp_tunnel *tunnel) { -l2tp_tunnel_inc_refcount (tunnel); -if (false ==queue_work (l2tp_wq, &tunnel->del_work)) { -l2tp_tunnel_dec_refcount (tunnel); -return 1 ; +if (!test_and_set_bit (0 , &tunnel->dead)) { +l2tp_tunnel_inc_refcount (tunnel); +queue_work (l2tp_wq, &tunnel->del_work); } -return 0 ; }EXPORT_SYMBOL_GPL (l2tp_tunnel_delete);
net/l2tp/l2tp_core.h +4 -1
@@ -160,6 +160,9 @@ struct l2tp_tunnel_cfg {struct l2tp_tunnel {int magic;/* Should be L2TP_TUNNEL_MAGIC */ + +unsigned long dead; +struct rcu_head rcu;rwlock_t hlist_lock;/* protect session_hlist */ struct hlist_head session_hlist[L2TP_HASH_SIZE ];
@@ -248,7 +251,7 @@ int l2tp_tunnel_create(struct net *net, u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, struct l2tp_tunnel **tunnelp);void l2tp_tunnel_closeall (struct l2tp_tunnel *tunnel); -int l2tp_tunnel_delete (struct l2tp_tunnel *tunnel); +void l2tp_tunnel_delete (struct l2tp_tunnel *tunnel); struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunnel, u32 session_id, u32 peer_session_id,
Greg Kroah-Hartman
maintainerPATCH 33/160 tun: bail out from tun_get_user() if the skb is empty
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <[email protected]>
[ Upstream commit 2580c4c17aee3ad58e9751012bad278dd074ccae ]
KMSAN (https://github.com/google/kmsan) reported accessing uninitialized skb->data[0] in the case the skb is empty (i.e. skb->len is 0):
================================================
BUG: KMSAN: use of uninitialized memory in tun_get_user+0x19ba/0x3770 CPU: 0 PID: 3051 Comm: probe Not tainted 4.13.0+ #3140 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: ... __msan_warning_32+0x66/0xb0 mm/kmsan/kmsan_instr.c:477 tun_get_user+0x19ba/0x3770 drivers/net/tun.c:1301 tun_chr_write_iter+0x19f/0x300 drivers/net/tun.c:1365 call_write_iter ./include/linux/fs.h:1743 new_sync_write fs/read_write.c:457 __vfs_write+0x6c3/0x7f0 fs/read_write.c:470 vfs_write+0x3e4/0x770 fs/read_write.c:518 SYSC_write+0x12f/0x2b0 fs/read_write.c:565 SyS_write+0x55/0x80 fs/read_write.c:557 do_syscall_64+0x242/0x330 arch/x86/entry/common.c:284 entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:245 ... origin: ... kmsan_poison_shadow+0x6e/0xc0 mm/kmsan/kmsan.c:211 slab_alloc_node mm/slub.c:2732 __kmalloc_node_track_caller+0x351/0x370 mm/slub.c:4351 __kmalloc_reserve net/core/skbuff.c:138 __alloc_skb+0x26a/0x810 net/core/skbuff.c:231 alloc_skb ./include/linux/skbuff.h:903 alloc_skb_with_frags+0x1d7/0xc80 net/core/skbuff.c:4756 sock_alloc_send_pskb+0xabf/0xfe0 net/core/sock.c:2037 tun_alloc_skb drivers/net/tun.c:1144 tun_get_user+0x9a8/0x3770 drivers/net/tun.c:1274 tun_chr_write_iter+0x19f/0x300 drivers/net/tun.c:1365 call_write_iter ./include/linux/fs.h:1743 new_sync_write fs/read_write.c:457 __vfs_write+0x6c3/0x7f0 fs/read_write.c:470 vfs_write+0x3e4/0x770 fs/read_write.c:518 SYSC_write+0x12f/0x2b0 fs/read_write.c:565 SyS_write+0x55/0x80 fs/read_write.c:557 do_syscall_64+0x242/0x330 arch/x86/entry/common.c:284 return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:245 ================================================
Make sure tun_get_user() doesn't touch skb->data[0] unless there is actual data.
C reproducer below:
==========================
// autogenerated by syzkaller (http://github.com/google/syzkaller) #define _GNU_SOURCE #include <fcntl.h> #include <linux/if_tun.h> #include <netinet/ip.h> #include <net/if.h> #include <string.h> #include <sys/ioctl.h> int main() { int sock = socket(PF_INET, SOCK_STREAM, IPPROTO_IP); int tun_fd = open("/dev/net/tun", O_RDWR); struct ifreq req; memset(&req, 0, sizeof(struct ifreq)); strcpy((char*)&req.ifr_name, "gre0"); req.ifr_flags = IFF_UP | IFF_MULTICAST; ioctl(tun_fd, TUNSETIFF, &req); ioctl(sock, SIOCSIFFLAGS, "gre0"); write(tun_fd, "hi", 0); return 0; }
==========================
--- drivers/net/tun.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/tun.c +5 -3
@@ -1298,11 +1298,13 @@ static ssize_t tun_get_user(struct tun_sswitch (tun->flags &TUN_TYPE_MASK ) {case IFF_TUN :if (tun->flags &IFF_NO_PI ) { -switch (skb->data[0 ] &0xf0 ) { -case 0x40 : +u8 ip_version = skb->len ? (skb->data[0 ] >>4 ) :0 ; + +switch (ip_version) { +case 4 : pi.proto =htons (ETH_P_IP );break ; -case 0x60 : +case 6 : pi.proto =htons (ETH_P_IPV6 );break ;default :
Greg Kroah-Hartman
maintainerPATCH 34/160 net: dsa: mv88e6xxx: Allow dsa and cpu ports in multiple vlans
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit db06ae41945b14feb7f696dcafe8048cc37e8a20 ]
Ports with the same VLAN must all be in the same bridge. However the CPU and DSA ports need to be in multiple VLANs spread over multiple bridges. So exclude them when performing this test.
--- drivers/net/dsa/mv88e6xxx/chip.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +4 -0
@@ -1184,6 +1184,10 @@ static int mv88e6xxx_port_check_hw_vlan( };int i, err; +/* DSA and CPU ports have to be members of multiple vlans */ +if (dsa_is_dsa_port (ds, port) ||dsa_is_cpu_port (ds, port)) +return 0 ; +if (!vid_begin)return -EOPNOTSUPP ;
Greg Kroah-Hartman
maintainerPATCH 35/160 net: dsa: Fix network device registration order
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
[ Upstream commit e804441cfe0b60f6c430901946a69c01eac09df1 ]
We cannot be registering the network device first, then setting its carrier off and finally connecting it to a PHY, doing that leaves a window during which the carrier is at best inconsistent, and at worse the device is not usable without a down/up sequence since the network device is visible to user space with possibly no PHY device attached.
Re-order steps so that they make logical sense. This fixes some devices where the port was not usable after e.g: an unbind then bind of the driver.
--- net/dsa/slave.c | 28 +++++++++++++++++----------- 1 file changed, 17 insertions(+), 11 deletions(-)
net/dsa/slave.c +17 -11
@@ -1180,26 +1180,32 @@ int dsa_slave_create(struct dsa_switch * p->old_duplex =-1 ; ds->ports[port].netdev = slave_dev; - ret =register_netdev (slave_dev); -if (ret) { -netdev_err (master,"error %d registering interface %s\n" , - ret, slave_dev->name); - ds->ports[port].netdev =NULL ; -free_netdev (slave_dev); -return ret; - }netif_carrier_off (slave_dev); ret =dsa_slave_phy_setup (p, slave_dev);if (ret) {netdev_err (master,"error %d setting up slave phy\n" , ret); -unregister_netdev (slave_dev); -free_netdev (slave_dev); -return ret; + goto out_free; + } + + ret =register_netdev (slave_dev); +if (ret) { +netdev_err (master,"error %d registering interface %s\n" , + ret, slave_dev->name); + goto out_phy; }return 0 ; + +out_phy: +phy_disconnect (p->phy); +if (of_phy_is_fixed_link (p->dp->dn)) +of_phy_deregister_fixed_link (p->dp->dn); +out_free: +free_netdev (slave_dev); + ds->ports[port].netdev =NULL ; +return ret; }void dsa_slave_destroy (struct net_device *slave_dev)
Greg Kroah-Hartman
maintainerPATCH 36/160 packet: in packet_do_bind, test fanout with bind_lock held
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit 4971613c1639d8e5f102c4e797c3bf8f83a5a69e ]
Once a socket has po->fanout set, it remains a member of the group until it is destroyed. The prot_hook must be constant and identical across sockets in the group.
If fanout_add races with packet_do_bind between the test of po->fanout and taking the lock, the bind call may make type or dev inconsistent with that of the fanout group.
Hold po->bind_lock when testing po->fanout to avoid this race.
I had to introduce artificial delay (local_bh_enable) to actually observe the race.
--- net/packet/af_packet.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/packet/af_packet.c +5 -3
@@ -3071,13 +3071,15 @@ static int packet_do_bind(struct sock *sint ret =0 ;bool unlisted = false; -if (po->fanout) -return -EINVAL ; -lock_sock (sk);spin_lock (&po->bind_lock);rcu_read_lock (); +if (po->fanout) { + ret = -EINVAL ; + goto out_unlock; + } +if (name) { dev =dev_get_by_name_rcu (sock_net (sk), name);if (!dev) {
Greg Kroah-Hartman
maintainerPATCH 37/160 packet: only test po->has_vnet_hdr once in packet_snd
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
[ Upstream commit da7c9561015e93d10fe6aab73e9288e0d09d65a6 ]
Packet socket option po->has_vnet_hdr can be updated concurrently with other operations if no ring is attached.
Do not test the option twice in packet_snd, as the value may change in between calls. A race on setsockopt disable may cause a packet > mtu to be sent without having GSO options set.
--- net/packet/af_packet.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/packet/af_packet.c +3 -1
@@ -2842,6 +2842,7 @@ static int packet_snd(struct socket *socstruct virtio_net_hdr vnet_hdr = {0 };int offset =0 ;struct packet_sock *po =pkt_sk (sk); +bool has_vnet_hdr = false;int hlen, tlen, linear;int extra_len =0 ;
@@ -2885,6 +2886,7 @@ static int packet_snd(struct socket *soc err =packet_snd_vnet_parse (msg, &len, &vnet_hdr);if (err) goto out_unlock; + has_vnet_hdr = true; }if (unlikely (sock_flag (sk,SOCK_NOFCS ))) {
@@ -2943,7 +2945,7 @@ static int packet_snd(struct socket *soc skb->priority = sk->sk_priority; skb->mark = sockc.mark; -if (po->has_vnet_hdr) { +if (has_vnet_hdr) { err =virtio_net_hdr_to_skb (skb, &vnet_hdr,vio_le ());if (err) goto out_free;
Greg Kroah-Hartman
maintainerPATCH 38/160 net: dsa: mv88e6xxx: lock mutex when freeing IRQs
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vivien Didelot <[email protected]>
[ Upstream commit b32ca44a88def4bf92626d8777494c6f14638c42 ]
mv88e6xxx_g2_irq_free locks the registers mutex, but not mv88e6xxx_g1_irq_free, which results in a stack trace from assert_reg_lock when unloading the mv88e6xxx module. Fix this.
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/dsa/mv88e6xxx/chip.c +2 -0
@@ -4019,7 +4019,9 @@ static void mv88e6xxx_remove(struct mdioif (chip->irq >0 ) {if (mv88e6xxx_has (chip,MV88E6XXX_FLAG_G2_INT ))mv88e6xxx_g2_irq_free (chip); +mutex_lock (&chip->reg_lock);mv88e6xxx_g1_irq_free (chip); +mutex_unlock (&chip->reg_lock); } }
Greg Kroah-Hartman
maintainerPATCH 39/160 net: Set sk_prot_creator when cloning sockets to the right proto
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <[email protected]>
[ Upstream commit 9d538fa60bad4f7b23193c89e843797a1cf71ef3 ]
sk->sk_prot and sk->sk_prot_creator can differ when the app uses IPV6_ADDRFORM (transforming an IPv6-socket to an IPv4-one). Which is why sk_prot_creator is there to make sure that sk_prot_free() does the kmem_cache_free() on the right kmem_cache slab.
Now, if such a socket gets transformed back to a listening socket (using connect() with AF_UNSPEC) we will allocate an IPv4 tcp_sock through sk_clone_lock() when a new connection comes in. But sk_prot_creator will still point to the IPv6 kmem_cache (as everything got copied in sk_clone_lock()). When freeing, we will thus put this
memory back into the IPv6 kmem_cache although it was allocated in the IPv4 cache. I have seen memory corruption happening because of this.
With slub-debugging and MEMCG_KMEM enabled this gives the warning
"cache_from_obj: Wrong slab cache. TCPv6 but object is from TCP"
A C-program to trigger this:
void main(void)
{
int fd = socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP);
int new_fd, newest_fd, client_fd;
struct sockaddr_in6 bind_addr;
struct sockaddr_in bind_addr4, client_addr1, client_addr2;
struct sockaddr unsp;
int val;
memset(&bind_addr, 0, sizeof(bind_addr));
bind_addr.sin6_family = AF_INET6;
bind_addr.sin6_port = ntohs(42424);
memset(&client_addr1, 0, sizeof(client_addr1));
client_addr1.sin_family = AF_INET;
client_addr1.sin_port = ntohs(42424);
client_addr1.sin_addr.s_addr = inet_addr("127.0.0.1");
memset(&client_addr2, 0, sizeof(client_addr2));
client_addr2.sin_family = AF_INET;
client_addr2.sin_port = ntohs(42421);
client_addr2.sin_addr.s_addr = inet_addr("127.0.0.1");
memset(&unsp, 0, sizeof(unsp));
unsp.sa_family = AF_UNSPEC;
bind(fd, (struct sockaddr *)&bind_addr, sizeof(bind_addr));
listen(fd, 5);
client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
connect(client_fd, (struct sockaddr *)&client_addr1, sizeof(client_addr1));
new_fd = accept(fd, NULL, NULL);
close(fd);
val = AF_INET;
setsockopt(new_fd, SOL_IPV6, IPV6_ADDRFORM, &val, sizeof(val));
connect(new_fd, &unsp, sizeof(unsp));
memset(&bind_addr4, 0, sizeof(bind_addr4));
bind_addr4.sin_family = AF_INET;
bind_addr4.sin_port = ntohs(42421);
bind(new_fd, (struct sockaddr *)&bind_addr4, sizeof(bind_addr4));
listen(new_fd, 5);
client_fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
connect(client_fd, (struct sockaddr *)&client_addr2, sizeof(client_addr2));
newest_fd = accept(new_fd, NULL, NULL);
close(new_fd);
close(client_fd);
close(new_fd);
}As far as I can see, this bug has been there since the beginning of the git-days.
--- net/core/sock.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/sock.c +2 -0
@@ -1646,6 +1646,8 @@ struct sock *sk_clone_lock(const structsock_copy (newsk, sk); + newsk->sk_prot_creator = sk->sk_prot; +/* SANITY */ if (likely (newsk->sk_net_refcnt))get_net (sock_net (newsk));
Greg Kroah-Hartman
maintainerPATCH 40/160 net/mlx5e: IPoIB, Fix access to invalid memory address
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roi Dayan <[email protected]>
[ Upstream commit 38e8a5c040d3ec99a8351c688dcdf0f549611565 ]
When cleaning rdma netdevice we need to save the mdev pointer because priv is released when we release netdev.
This bug was found using the kernel address sanitizer (KASAN). use-after-free in mlx5_rdma_netdev_free+0xe3/0x100 [mlx5_core]
--- drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +2 -1
@@ -572,12 +572,13 @@ void mlx5_rdma_netdev_free(struct net_de {struct mlx5e_priv *priv =mlx5i_epriv (netdev);const struct mlx5e_profile *profile = priv->profile; +struct mlx5_core_dev *mdev = priv->mdev;mlx5e_detach_netdev (priv); profile->cleanup (priv);destroy_workqueue (priv->wq);free_netdev (netdev); -mlx5e_destroy_mdev_resources (priv->mdev); +mlx5e_destroy_mdev_resources (mdev); }EXPORT_SYMBOL (mlx5_rdma_netdev_free);
Greg Kroah-Hartman
maintainerPATCH 41/160 netlink: do not proceed if dumps start() errs
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Jason A. Donenfeld" <[email protected]>
[ Upstream commit fef0035c0f31322d417d1954bba5ab959bf91183 ]
Drivers that use the start method for netlink dumping rely on dumpit not being called if start fails. For example, ila_xlat.c allocates memory and assigns it to cb->args[0] in its start() function. It might fail to do that and return -ENOMEM instead. However, even when returning an error, dumpit will be called, which, in the example above, quickly dereferences the memory in cb->args[0], which will OOPS the kernel. This is but one example of how this goes wrong.
Since start() has always been a function with an int return type, it therefore makes sense to use it properly, rather than ignoring it. This patch thus returns early and does not call dumpit() when start() fails.
--- net/netlink/af_netlink.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
net/netlink/af_netlink.c +5 -2
@@ -2262,10 +2262,13 @@ int __netlink_dump_start(struct sock *ssmutex_unlock (nlk->cb_mutex); + ret =0 ;if (cb->start) - cb->start (cb); + ret = cb->start (cb); + +if (!ret) + ret =netlink_dump (sk); - ret =netlink_dump (sk);sock_put (sk);if (ret)
Greg Kroah-Hartman
maintainerPATCH 42/160 ip6_gre: ip6gre_tap device should keep dst
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 2d40557cc702ed8e5edd9bd422233f86652d932e ]
The patch 'ip_gre: ipgre_tap device should keep dst' fixed a issue that ipgre_tap mtu couldn't be updated in tx path.
The same fix is needed for ip6gre_tap as well.
--- net/ipv6/ip6_gre.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/ip6_gre.c +1 -0
@@ -1311,6 +1311,7 @@ static void ip6gre_tap_setup(struct net_ dev->features |=NETIF_F_NETNS_LOCAL ; dev->priv_flags &= ~IFF_TX_SKB_SHARING ; dev->priv_flags |=IFF_LIVE_ADDR_CHANGE ; +netif_keep_dst (dev); } static bool ip6gre_netlink_encap_parms(struct nlattr *data[],
Greg Kroah-Hartman
maintainerPATCH 43/160 ip6_tunnel: update mtu properly for ARPHRD_ETHER tunnel device in tx path
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit d41bb33ba33b8f8debe54ed36be6925eb496e354 ]
Now when updating mtu in tx path, it doesn't consider ARPHRD_ETHER tunnel device, like ip6gre_tap tunnel, for which it should also subtract ether header to get the correct mtu.
--- net/ipv6/ip6_tunnel.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv6/ip6_tunnel.c +3 -2
@@ -1043,6 +1043,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, ststruct dst_entry *dst =NULL , *ndst =NULL ;struct net_device *tdev;int mtu; +unsigned int eth_hlen = t->dev->type ==ARPHRD_ETHER ?ETH_HLEN :0 ;unsigned int psh_hlen =sizeof (struct ipv6hdr ) + t->encap_hlen;unsigned int max_headroom = psh_hlen;bool use_cache = false;
@@ -1124,7 +1125,7 @@ route_lookup: t->parms.name); goto tx_err_dst_release; } - mtu =dst_mtu (dst) - psh_hlen - t->tun_hlen; + mtu =dst_mtu (dst) - eth_hlen - psh_hlen - t->tun_hlen;if (encap_limit >=0 ) { max_headroom +=8 ; mtu -=8 ;
@@ -1133,7 +1134,7 @@ route_lookup: mtu =IPV6_MIN_MTU ;if (skb_dst (skb) && !t->parms.collect_md)skb_dst (skb)->ops->update_pmtu (skb_dst (skb),NULL , skb, mtu); -if (skb->len - t->tun_hlen > mtu && !skb_is_gso (skb)) { +if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso (skb)) { *pmtu = mtu; err = -EMSGSIZE ; goto tx_err_dst_release;
Greg Kroah-Hartman
maintainerPATCH 44/160 IPv4: early demux can return an error code
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit 7487449c86c65202b3b725c4524cb48dd65e4e6f ]
Currently no error is emitted, but this infrastructure will used by the next patch to allow source address validation for mcast sockets.
Since early demux can do a route lookup and an ipv4 route lookup can return an error code this is consistent with the current ipv4 route infrastructure.
--- include/net/protocol.h | 4 ++-- include/net/tcp.h | 2 +- include/net/udp.h | 2 +- net/ipv4/ip_input.c | 25 +++++++++++++++---------- net/ipv4/tcp_ipv4.c | 9 +++++---- net/ipv4/udp.c | 11 ++++++----- 6 files changed, 30 insertions(+), 23 deletions(-)
include/net/protocol.h +2 -2
@@ -39,8 +39,8 @@/* This is used to register protocols. */ struct net_protocol { -void (*early_demux)(struct sk_buff *skb); -void (*early_demux_handler)(struct sk_buff *skb); +int (*early_demux)(struct sk_buff *skb); +int (*early_demux_handler)(struct sk_buff *skb);int (*handler)(struct sk_buff *skb);void (*err_handler)(struct sk_buff *skb,u32 info); unsigned int no_policy:1,
include/net/tcp.h +1 -1
@@ -347,7 +347,7 @@ void tcp_v4_err(struct sk_buff *skb, u32void tcp_shutdown (struct sock *sk,int how); -void tcp_v4_early_demux (struct sk_buff *skb); +int tcp_v4_early_demux (struct sk_buff *skb);int tcp_v4_rcv (struct sk_buff *skb);int tcp_v4_tw_remember_stamp (struct inet_timewait_sock *tw);
include/net/udp.h +1 -1
@@ -259,7 +259,7 @@ static inline struct sk_buff *skb_recv_ureturn __skb_recv_udp (sk, flags, noblock, &peeked, &off, err); } -void udp_v4_early_demux (struct sk_buff *skb); +int udp_v4_early_demux (struct sk_buff *skb);bool udp_sk_rx_dst_set (struct sock *sk,struct dst_entry *dst); int udp_get_port(struct sock *sk, unsigned short snum, int (*saddr_cmp)(const struct sock *,
net/ipv4/ip_input.c +15 -10
@@ -311,9 +311,10 @@ drop:static int ip_rcv_finish (struct net *net,struct sock *sk,struct sk_buff *skb) {const struct iphdr *iph =ip_hdr (skb); -struct rtable *rt; +int (*edemux)(struct sk_buff *skb);struct net_device *dev = skb->dev; -void (*edemux)(struct sk_buff *skb); +struct rtable *rt; +int err;/* if ingress device is enslaved to an L3 master device pass the * skb to its handler for processing
@@ -331,7 +332,9 @@ static int ip_rcv_finish(struct net *net ipprot =rcu_dereference (inet_protos[protocol]);if (ipprot && (edemux =READ_ONCE (ipprot->early_demux))) { -edemux (skb); + err =edemux (skb); +if (unlikely (err)) + goto drop_error;/* must reload iph, skb->head might have changed */ iph =ip_hdr (skb); }
@@ -342,13 +345,10 @@ static int ip_rcv_finish(struct net *net* how the packet travels inside Linux networking. */ if (!skb_valid_dst (skb)) { -int err =ip_route_input_noref (skb, iph->daddr, iph->saddr, - iph->tos, dev); -if (unlikely (err)) { -if (err == -EXDEV ) -__NET_INC_STATS (net,LINUX_MIB_IPRPFILTER ); - goto drop; - } + err =ip_route_input_noref (skb, iph->daddr, iph->saddr, + iph->tos, dev); +if (unlikely (err)) + goto drop_error; }#ifdef CONFIG_IP_ROUTE_CLASSID
@@ -399,6 +399,11 @@ static int ip_rcv_finish(struct net *net drop:kfree_skb (skb);return NET_RX_DROP ; + +drop_error: +if (err == -EXDEV ) +__NET_INC_STATS (net,LINUX_MIB_IPRPFILTER ); + goto drop; }/*
net/ipv4/tcp_ipv4.c +5 -4
@@ -1504,23 +1504,23 @@ csum_err: }EXPORT_SYMBOL (tcp_v4_do_rcv); -void tcp_v4_early_demux (struct sk_buff *skb) +int tcp_v4_early_demux (struct sk_buff *skb) {const struct iphdr *iph;const struct tcphdr *th;struct sock *sk;if (skb->pkt_type !=PACKET_HOST ) -return ; +return 0 ;if (!pskb_may_pull (skb,skb_transport_offset (skb) +sizeof (struct tcphdr ))) -return ; +return 0 ; iph =ip_hdr (skb); th =tcp_hdr (skb);if (th->doff <sizeof (struct tcphdr ) /4 ) -return ; +return 0 ; sk = __inet_lookup_established(dev_net(skb->dev), &tcp_hashinfo, iph->saddr, th->source,
@@ -1539,6 +1539,7 @@ void tcp_v4_early_demux(struct sk_buff *skb_dst_set_noref (skb, dst); } } +return 0 ; }/* Packet is added to VJ-style prequeue for processing in process
net/ipv4/udp.c +6 -5
@@ -2217,7 +2217,7 @@ static struct sock *__udp4_lib_demux_looreturn NULL ; } -void udp_v4_early_demux (struct sk_buff *skb) +int udp_v4_early_demux (struct sk_buff *skb) {struct net *net =dev_net (skb->dev);const struct iphdr *iph;
@@ -2229,7 +2229,7 @@ void udp_v4_early_demux(struct sk_buff */* validate the packet */ if (!pskb_may_pull (skb,skb_transport_offset (skb) +sizeof (struct udphdr ))) -return ; +return 0 ; iph =ip_hdr (skb); uh =udp_hdr (skb);
@@ -2239,14 +2239,14 @@ void udp_v4_early_demux(struct sk_buff *struct in_device *in_dev =__in_dev_get_rcu (skb->dev);if (!in_dev) -return ; +return 0 ;/* we are supposed to accept bcast packets */ if (skb->pkt_type ==PACKET_MULTICAST ) { ours =ip_check_mc_rcu (in_dev, iph->daddr, iph->saddr, iph->protocol);if (!ours) -return ; +return 0 ; } sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
@@ -2257,7 +2257,7 @@ void udp_v4_early_demux(struct sk_buff * }if (!sk || !refcount_inc_not_zero (&sk->sk_refcnt)) -return ; +return 0 ; skb->sk = sk; skb->destructor = sock_efree;
@@ -2272,6 +2272,7 @@ void udp_v4_early_demux(struct sk_buff **/ skb_dst_set_noref (skb, dst); } +return 0 ; }int udp_rcv (struct sk_buff *skb)
Greg Kroah-Hartman
maintainerPATCH 45/160 tipc: use only positive error codes in messages
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parthasarathy Bhuvaragan <[email protected]>
[ Upstream commit aad06212d36cf34859428a0a279e5c14ee5c9e26 ]
In commit e3a77561e7d32 ("tipc: split up function tipc_msg_eval()"), we have updated the function tipc_msg_lookup_dest() to set the error codes to negative values at destination lookup failures. Thus when the function sets the error code to -TIPC_ERR_NO_NAME, its inserted into the 4 bit error field of the message header as 0xf instead of TIPC_ERR_NO_NAME (1). The value 0xf is an unknown error code.
In this commit, we set only positive error code.
--- net/tipc/msg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/tipc/msg.c +1 -1
@@ -551,7 +551,7 @@ bool tipc_msg_lookup_dest(struct net *nereturn false;if (msg_errcode (msg))return false; - *err = -TIPC_ERR_NO_NAME ; + *err =TIPC_ERR_NO_NAME ;if (skb_linearize (skb))return false; msg =buf_msg (skb);
Greg Kroah-Hartman
maintainerPATCH 46/160 l2tp: fix l2tp_eth module loading
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 9f775ead5e570e7e19015b9e4e2f3dd6e71a5935 ]
The l2tp_eth module crashes if its netlink callbacks are run when the pernet data aren't initialised.
We should normally register_pernet_device() before the genl callbacks. However, the pernet data only maintain a list of l2tpeth interfaces, and this list is never used. So let's just drop pernet handling instead.
--- net/l2tp/l2tp_eth.c | 51 ++------------------------------------------------- 1 file changed, 2 insertions(+), 49 deletions(-)
net/l2tp/l2tp_eth.c +2 -49
@@ -44,7 +44,6 @@ struct l2tp_eth {struct net_device *dev;struct sock *tunnel_sock;struct l2tp_session *session; -struct list_head list;atomic_long_t tx_bytes;atomic_long_t tx_packets;atomic_long_t tx_dropped;
@@ -58,17 +57,6 @@ struct l2tp_eth_sess {struct net_device *dev; }; -/* per-net private data for this module */ -static unsigned int l2tp_eth_net_id; -struct l2tp_eth_net { -struct list_head l2tp_eth_dev_list; -spinlock_t l2tp_eth_lock; -}; - -static inline struct l2tp_eth_net *l2tp_eth_pernet (struct net *net) -{ -return net_generic (net, l2tp_eth_net_id); -}static int l2tp_eth_dev_init (struct net_device *dev) {
@@ -84,12 +72,6 @@ static int l2tp_eth_dev_init(struct net_static void l2tp_eth_dev_uninit (struct net_device *dev) { -struct l2tp_eth *priv =netdev_priv (dev); -struct l2tp_eth_net *pn =l2tp_eth_pernet (dev_net (dev)); - -spin_lock (&pn->l2tp_eth_lock); -list_del_init (&priv->list); -spin_unlock (&pn->l2tp_eth_lock);dev_put (dev); }
@@ -272,7 +254,6 @@ static int l2tp_eth_create(struct net *nstruct l2tp_eth *priv;struct l2tp_eth_sess *spriv;int rc; -struct l2tp_eth_net *pn; tunnel =l2tp_tunnel_find (net, tunnel_id);if (!tunnel) {
@@ -310,7 +291,6 @@ static int l2tp_eth_create(struct net *n priv =netdev_priv (dev); priv->dev = dev; priv->session = session; -INIT_LIST_HEAD (&priv->list); priv->tunnel_sock = tunnel->sock; session->recv_skb = l2tp_eth_dev_recv;
@@ -331,10 +311,6 @@ static int l2tp_eth_create(struct net *nstrlcpy (session->ifname, dev->name,IFNAMSIZ );dev_hold (dev); - pn =l2tp_eth_pernet (dev_net (dev)); -spin_lock (&pn->l2tp_eth_lock); -list_add (&priv->list, &pn->l2tp_eth_dev_list); -spin_unlock (&pn->l2tp_eth_lock);return 0 ;
@@ -347,22 +323,6 @@ out:return rc; } -static __net_init int l2tp_eth_init_net (struct net *net) -{ -struct l2tp_eth_net *pn =net_generic (net, l2tp_eth_net_id); - -INIT_LIST_HEAD (&pn->l2tp_eth_dev_list); -spin_lock_init (&pn->l2tp_eth_lock); - -return 0 ; -} - -static struct pernet_operations l2tp_eth_net_ops = { - .init = l2tp_eth_init_net, - .id = &l2tp_eth_net_id, - .size =sizeof (struct l2tp_eth_net ), -}; -static const struct l2tp_nl_cmd_ops l2tp_eth_nl_cmd_ops = { .session_create = l2tp_eth_create,
@@ -376,25 +336,18 @@ static int __init l2tp_eth_init(void) err =l2tp_nl_register_ops (L2TP_PWTYPE_ETH , &l2tp_eth_nl_cmd_ops);if (err) - goto out; - - err =register_pernet_device (&l2tp_eth_net_ops); -if (err) - goto out_unreg; + goto err;pr_info ("L2TP ethernet pseudowire support (L2TPv3)\n" );return 0 ; -out_unreg: -l2tp_nl_unregister_ops (L2TP_PWTYPE_ETH ); -out: +err:return err; } static void __exit l2tp_eth_exit(void) { -unregister_pernet_device (&l2tp_eth_net_ops);l2tp_nl_unregister_ops (L2TP_PWTYPE_ETH ); }
Greg Kroah-Hartman
maintainerPATCH 47/160 socket, bpf: fix possible use after free
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit eefca20eb20c66b06cf5ed09b49b1a7caaa27b7b ]
Starting from linux-4.4, 3WHS no longer takes the listener lock.
Since this time, we might hit a use-after-free in sk_filter_charge(), if the filter we got in the memcpy() of the listener content just happened to be replaced by a thread changing listener BPF filter.
To fix this, we need to make sure the filter refcount is not already zero before incrementing it again.
--- net/core/filter.c | 12 ++++++++---- net/core/sock.c | 5 ++++- 2 files changed, 12 insertions(+), 5 deletions(-)
net/core/filter.c +8 -4
@@ -975,10 +975,14 @@ static bool __sk_filter_charge(struct sobool sk_filter_charge (struct sock *sk,struct sk_filter *fp) { -bool ret =__sk_filter_charge (sk, fp); -if (ret) -refcount_inc (&fp->refcnt); -return ret; +if (!refcount_inc_not_zero (&fp->refcnt)) +return false; + +if (!__sk_filter_charge (sk, fp)) { +sk_filter_release (fp); +return false; + } +return true; }static struct bpf_prog *bpf_migrate_filter (struct bpf_prog *fp)
net/core/sock.c +4 -1
@@ -1675,13 +1675,16 @@ struct sock *sk_clone_lock(const structsock_reset_flag (newsk,SOCK_DONE ); - filter =rcu_dereference_protected (newsk->sk_filter,1 ); +rcu_read_lock (); + filter =rcu_dereference (sk->sk_filter);if (filter !=NULL )/* though it's an empty new sock, the charging may fail * if sysctl_optmem_max was changed between creation of * original socket and cloning */ is_charged =sk_filter_charge (newsk, filter); +RCU_INIT_POINTER (newsk->sk_filter, filter); +rcu_read_unlock ();if (unlikely (!is_charged ||xfrm_sk_clone_policy (newsk, sk))) {/* We need to make sure that we don't uncharge the new
Greg Kroah-Hartman
maintainerPATCH 48/160 net: rtnetlink: fix info leak in RTM_GETSTATS call
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <[email protected]>
[ Upstream commit ce024f42c2e28b6bce4ecc1e891b42f57f753892 ]
When RTM_GETSTATS was added the fields of its header struct were not all initialized when returning the result thus leaking 4 bytes of information to user-space per rtnl_fill_statsinfo call, so initialize them now. Thanks to Alexander Potapenko for the detailed report and bisection.
--- net/core/rtnetlink.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/rtnetlink.c +3 -0
@@ -3867,6 +3867,9 @@ static int rtnl_fill_statsinfo(struct skreturn -EMSGSIZE ; ifsm =nlmsg_data (nlh); + ifsm->family =PF_UNSPEC ; + ifsm->pad1 =0 ; + ifsm->pad2 =0 ; ifsm->ifindex = dev->ifindex; ifsm->filter_mask = filter_mask;
Greg Kroah-Hartman
maintainerPATCH 49/160 bpf: fix bpf_tail_call() x64 JIT
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Starovoitov <[email protected]>
[ Upstream commit 90caccdd8cc0215705f18b92771b449b01e2474a ]
- bpf prog_array just like all other types of bpf array accepts 32-bit index. Clarify that in the comment.
- fix x64 JIT of bpf_tail_call which was incorrectly loading 8 instead of 4 bytes
- tighten corresponding check in the interpreter to stay consistent
The JIT bug can be triggered after introduction of BPF_F_NUMA_NODE flag in commit 96eabe7a40aa in 4.14. Before that the map_flags would stay zero and though JIT code is wrong it will check bounds correctly.
Hence two fixes tags. All other JITs don't have this problem.
--- arch/x86/net/bpf_jit_comp.c | 4 ++-- include/uapi/linux/bpf.h | 2 +- kernel/bpf/core.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
arch/x86/net/bpf_jit_comp.c +2 -2
@@ -282,9 +282,9 @@ static void emit_bpf_tail_call(u8 **ppro/* if (index >= array->map.max_entries) * goto out; */ -EMIT4 (0x48 ,0x8B ,0x46 ,/* mov rax, qword ptr [rsi + 16] */ +EMIT2 (0x89 ,0xD2 );/* mov edx, edx */ +EMIT3 (0x39 ,0x56 ,/* cmp dword ptr [rsi + 16], edx */ offsetof(struct bpf_array, map.max_entries)); -EMIT3 (0x48 ,0x39 ,0xD0 );/* cmp rax, rdx */ #define OFFSET1 47/* number of bytes to jump */ EMIT2 (X86_JBE ,OFFSET1 );/* jbe out */ label1 = cnt;
include/uapi/linux/bpf.h +1 -1
@@ -294,7 +294,7 @@ union bpf_attr {* jump into another BPF program * @ctx: context pointer passed to next program * @prog_array_map: pointer to map which type is BPF_MAP_TYPE_PROG_ARRAY -* @index: index inside array that selects specific program to run +* @index: 32-bit index inside array that selects specific program to run * Return: 0 on success or negative error * * int bpf_clone_redirect(skb, ifindex, flags)
kernel/bpf/core.c +1 -1
@@ -1010,7 +1010,7 @@ select_insn:struct bpf_map *map = (struct bpf_map *) (unsigned long )BPF_R2 ; struct bpf_array *array = container_of(map, struct bpf_array, map);struct bpf_prog *prog; -u64 index =BPF_R3 ; +u32 index =BPF_R3 ;if (unlikely (index >= array->map.max_entries)) goto out;
Greg Kroah-Hartman
maintainerPATCH 50/160 usb: gadget: core: fix ->udc_set_speed() logic
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Quadros <[email protected]>
commit 97e133d54c1ca8948b191e5721a145a76c4db33d upstream.
Consider the following case: udc controller supports SuperSpeed. If we first load a HighSpeed gadget followed by a SuperSpeed gadget, the SuperSpeed gadget will be limited to HighSpeed as UDC core driver doesn't call ->udc_set_speed() in the second case.
Call ->udc_set_speed() unconditionally to fix this issue.
This will also fix the case for dwc3 controller driver when SuperSpeed gadget is loaded first and works in HighSpeed only as udc_set_speed() was never being called.
--- drivers/usb/gadget/udc/core.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/usb/gadget/udc/core.c +1 -2
@@ -1314,8 +1314,7 @@ static int udc_bind_to_driver(struct usb udc->dev.driver = &driver->driver; udc->gadget->dev.driver = &driver->driver; -if (driver->max_speed < udc->gadget->max_speed) -usb_gadget_udc_set_speed (udc, driver->max_speed); +usb_gadget_udc_set_speed (udc, driver->max_speed); ret = driver->bind (udc->gadget, driver);if (ret)
Greg Kroah-Hartman
maintainerPATCH 51/160 USB: gadgetfs: Fix crash caused by inadequate synchronization
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 520b72fc64debf8a86c3853b8e486aa5982188f0 upstream.
The gadgetfs driver (drivers/usb/gadget/legacy/inode.c) was written before the UDC and composite frameworks were adopted; it is a legacy driver. As such, it expects that once bound to a UDC controller, it will not be unbound until it unregisters itself.
However, the UDC framework does unbind function drivers while they are still registered. When this happens, it can cause the gadgetfs driver to misbehave or crash. For example, userspace can cause a crash by opening the device file and doing an ioctl call before setting up a configuration (found by Andrey Konovalov using the syzkaller fuzzer).
This patch adds checks and synchronization to prevent these bad behaviors. It adds a udc_usage counter that the driver increments at times when it is using a gadget interface without holding the private spinlock. The unbind routine waits for this counter to go to 0 before returning, thereby ensuring that the UDC is no longer in use.
The patch also adds a check in the dev_ioctl() routine to make sure the driver is bound to a UDC before dereferencing the gadget pointer, and it makes destroy_ep_files() synchronize with the endpoint I/O routines, to prevent the user from accessing an endpoint data structure after it has been removed.
--- drivers/usb/gadget/legacy/inode.c | 41 +++++++++++++++++++++++++++++++++----- 1 file changed, 36 insertions(+), 5 deletions(-)
drivers/usb/gadget/legacy/inode.c +36 -5
@@ -28,7 +28,7 @@#include <linux/aio.h> #include <linux/uio.h> #include <linux/refcount.h> - +#include <linux/delay.h> #include <linux/device.h> #include <linux/moduleparam.h>
@@ -116,6 +116,7 @@ enum ep0_state {struct dev_data {spinlock_t lock;refcount_t count; +int udc_usage;enum ep0_state state;/* P: lock */ struct usb_gadgetfs_event event [N_EVENT ];unsigned ev_next;
@@ -513,9 +514,9 @@ static void ep_aio_complete(struct usb_eINIT_WORK (&priv->work, ep_user_copy_worker);schedule_work (&priv->work); } -spin_unlock (&epdata->dev->lock);usb_ep_free_request (ep, req); +spin_unlock (&epdata->dev->lock);put_ep (epdata); }
@@ -939,9 +940,11 @@ ep0_read (struct file *fd, char __user *struct usb_request *req = dev->req;if ((retval =setup_req (ep, req,0 )) ==0 ) { + ++dev->udc_usage;spin_unlock_irq (&dev->lock); retval =usb_ep_queue (ep, req,GFP_KERNEL );spin_lock_irq (&dev->lock); + --dev->udc_usage; } dev->state =STATE_DEV_CONNECTED ;
@@ -1131,6 +1134,7 @@ ep0_write (struct file *fd, const char _ retval =setup_req (dev->gadget->ep0, dev->req, len);if (retval ==0 ) { dev->state =STATE_DEV_CONNECTED ; + ++dev->udc_usage;spin_unlock_irq (&dev->lock);if (copy_from_user (dev->req->buf, buf, len)) retval = -EFAULT ;
@@ -1142,6 +1146,7 @@ ep0_write (struct file *fd, const char _ GFP_KERNEL); }spin_lock_irq (&dev->lock); + --dev->udc_usage;if (retval <0 ) {clean_req (dev->gadget->ep0, dev->req); }else
@@ -1243,9 +1248,21 @@ static long dev_ioctl (struct file *fd,struct usb_gadget *gadget = dev->gadget;long ret = -ENOTTY ; -if (gadget->ops->ioctl) +spin_lock_irq (&dev->lock); +if (dev->state ==STATE_DEV_OPENED || + dev->state ==STATE_DEV_UNBOUND ) { +/* Not bound to a UDC */ + }else if (gadget->ops->ioctl) { + ++dev->udc_usage; +spin_unlock_irq (&dev->lock); + ret = gadget->ops->ioctl (gadget, code, value); +spin_lock_irq (&dev->lock); + --dev->udc_usage; + } +spin_unlock_irq (&dev->lock); +return ret; }
@@ -1463,10 +1480,12 @@ delegate:if (value <0 )break ; + ++dev->udc_usage;spin_unlock (&dev->lock); value =usb_ep_queue (gadget->ep0, dev->req,GFP_KERNEL );spin_lock (&dev->lock); + --dev->udc_usage;if (value <0 ) {clean_req (gadget->ep0, dev->req);break ;
@@ -1490,8 +1509,12 @@ delegate: req->length = value; req->zero = value < w_length; + ++dev->udc_usage;spin_unlock (&dev->lock); value =usb_ep_queue (gadget->ep0, req,GFP_KERNEL ); +spin_lock (&dev->lock); + --dev->udc_usage; +spin_unlock (&dev->lock);if (value <0 ) {DBG (dev,"ep_queue --> %d\n" , value); req->status =0 ;
@@ -1518,21 +1541,24 @@ static void destroy_ep_files (struct dev/* break link to FS */ ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles);list_del_init (&ep->epfiles); +spin_unlock_irq (&dev->lock); + dentry = ep->dentry; ep->dentry =NULL ; parent =d_inode (dentry->d_parent);/* break link to controller */ +mutex_lock (&ep->lock);if (ep->state ==STATE_EP_ENABLED ) (void )usb_ep_disable (ep->ep); ep->state =STATE_EP_UNBOUND ;usb_ep_free_request (ep->ep, ep->req); ep->ep =NULL ; +mutex_unlock (&ep->lock); +wake_up (&ep->wait);put_ep (ep); -spin_unlock_irq (&dev->lock); -/* break link to dcache */ inode_lock (parent);d_delete (dentry);
@@ -1603,6 +1629,11 @@ gadgetfs_unbind (struct usb_gadget *gadgspin_lock_irq (&dev->lock); dev->state =STATE_DEV_UNBOUND ; +while (dev->udc_usage >0 ) { +spin_unlock_irq (&dev->lock); +usleep_range (1000 ,2000 ); +spin_lock_irq (&dev->lock); + }spin_unlock_irq (&dev->lock);destroy_ep_files (dev);
Greg Kroah-Hartman
maintainerPATCH 52/160 USB: gadgetfs: fix copy_to_user while holding spinlock
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 6e76c01e71551cb221c1f3deacb9dcd9a7346784 upstream.
The gadgetfs driver as a long-outstanding FIXME, regarding a call of copy_to_user() made while holding a spinlock. This patch fixes the issue by dropping the spinlock and using the dev->udc_usage mechanism introduced by another recent patch to guard against status changes while the lock isn't held.
--- drivers/usb/gadget/legacy/inode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/inode.c +4 -1
@@ -986,11 +986,14 @@ ep0_read (struct file *fd, char __user * retval = -EIO ; else { len =min (len, (size_t )dev->req->actual); -// FIXME don't call this with the spinlock held ... + ++dev->udc_usage; +spin_unlock_irq (&dev->lock);if (copy_to_user (buf, dev->req->buf, len)) retval = -EFAULT ;else retval = len; +spin_lock_irq (&dev->lock); + --dev->udc_usage;clean_req (dev->gadget->ep0, dev->req);/* NOTE userspace can't yet choose to stall */ }
Greg Kroah-Hartman
maintainerPATCH 53/160 usb: gadget: udc: atmel: set vbus irqflags explicitly
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit 6baeda120d90aa637b08f7604de104ab00ce9126 upstream.
The driver triggers actions on both edges of the vbus signal.
The former PIO controller was triggering IRQs on both falling and rising edges by default. Newer PIO controller don't, so it's better to set it explicitly to IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING.
Without this patch we may trigger the connection with host but only on some bouncing signal conditions and thus lose connecting events.
--- drivers/usb/gadget/udc/atmel_usba_udc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/atmel_usba_udc.c +3 -1
@@ -29,6 +29,8 @@#include <linux/of_gpio.h> #include "atmel_usba_udc.h" +#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ + | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING)#ifdef CONFIG_USB_GADGET_DEBUG_FS #include <linux/debugfs.h>
@@ -2361,7 +2363,7 @@ static int usba_udc_probe(struct platfor IRQ_NOAUTOEN); ret =devm_request_threaded_irq (&pdev->dev,gpio_to_irq (udc->vbus_pin),NULL , - usba_vbus_irq_thread,IRQF_ONESHOT , + usba_vbus_irq_thread,USBA_VBUS_IRQFLAGS ,"atmel_usba_udc" , udc);if (ret) { udc->vbus_pin = -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 54/160 usb: gadget: udc: renesas_usb3: fix for no-data control transfer
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 4dcf4bab4a409e81284b8202137e4a85b96b34de upstream.
When bRequestType & USB_DIR_IN is false and req.length is 0 in control transfer, since it means non-data, this driver should not set the mode as control write. So, this patch fixes it.
--- drivers/usb/gadget/udc/renesas_usb3.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/renesas_usb3.c +2 -1
@@ -1144,7 +1144,8 @@ static void usb3_start_pipe0(struct reneusb3_set_p0_con_for_ctrl_read_data (usb3); }else {usb3_clear_bit (usb3,P0_MOD_DIR ,USB3_P0_MOD ); -usb3_set_p0_con_for_ctrl_write_data (usb3); +if (usb3_req->req.length) +usb3_set_p0_con_for_ctrl_write_data (usb3); }usb3_p0_xfer (usb3_ep, usb3_req);
Greg Kroah-Hartman
maintainerPATCH 55/160 usb: gadget: udc: renesas_usb3: fix Pn_RAMMAP.Pn_MPKT value
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 73f2f5745f18b4ccfe9484deac4e84a1378d19fd upstream.
According to the datasheet of R-Car Gen3, the Pn_RAMMAP.Pn_MPKT should be set to one of 8, 16, 32, 64, 512 and 1024. Otherwise, when a gadget driver uses an interrupt endpoint, unexpected behavior happens. So, this patch fixes it.
--- drivers/usb/gadget/udc/renesas_usb3.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/renesas_usb3.c +10 -1
@@ -2048,7 +2048,16 @@ static u32 usb3_calc_ramarea(int ram_sizstatic u32 usb3_calc_rammap_val (struct renesas_usb3_ep *usb3_ep,const struct usb_endpoint_descriptor *desc) { -return usb3_ep->rammap_val |PN_RAMMAP_MPKT (usb_endpoint_maxp (desc)); +int i; +const u32 max_packet_array[] = {8 ,16 ,32 ,64 ,512 }; +u32 mpkt =PN_RAMMAP_MPKT (1024 ); + +for (i =0 ; i <ARRAY_SIZE (max_packet_array); i++) { +if (usb_endpoint_maxp (desc) <= max_packet_array[i]) + mpkt =PN_RAMMAP_MPKT (max_packet_array[i]); + } + +return usb3_ep->rammap_val | mpkt; } static int usb3_enable_pipe_n(struct renesas_usb3_ep *usb3_ep,
Greg Kroah-Hartman
maintainerPATCH 56/160 usb: gadget: udc: renesas_usb3: Fix return value of usb3_write_pipe()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 447b8a01b84f048d93d43bfe1fcaa4fcc56595cc upstream.
This patch fixes an issue that this driver cannot go status stage in control read when the req.zero is set to 1 and the len in usb3_write_pipe() is set to 0. Otherwise, if we use g_ncm driver, usb enumeration takes long time (5 seconds or more).
--- drivers/usb/gadget/udc/renesas_usb3.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/renesas_usb3.c +3 -2
@@ -1032,7 +1032,7 @@ static int usb3_write_pipe(struct renesa usb3_ep->ep.maxpacket);u8 *buf = usb3_req->req.buf + usb3_req->req.actual;u32 tmp =0 ; -bool is_last; +bool is_last = !len ? true : false;if (usb3_wait_pipe_status (usb3_ep,PX_STA_BUFSTS ) <0 )return -EBUSY ;
@@ -1053,7 +1053,8 @@ static int usb3_write_pipe(struct renesausb3_write (usb3, tmp, fifo_reg); } - is_last =usb3_is_transfer_complete (usb3_ep, usb3_req); +if (!is_last) + is_last =usb3_is_transfer_complete (usb3_ep, usb3_req);/* Send the data */ usb3_set_px_con_send (usb3_ep, len, is_last);
Greg Kroah-Hartman
maintainerPATCH 57/160 usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 113f6eb6d50cfa5e2a1cdcf1678b12661fa272ab upstream.
Kris Lindgren reports that without the NO_WP_DETECT flag, his Seagate external disk drive fails all write accesses. This regresssion dates back approximately to the start of the 4.x kernel releases.
--- drivers/usb/storage/unusual_devs.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_devs.h +7 -0
@@ -1459,6 +1459,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0 USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_SANE_SENSE ), +/* Reported by Kris Lindgren <[email protected]> */ +UNUSUAL_DEV (0x0bc2 ,0x3332 ,0x0000 ,0x9999 , +"Seagate" , +"External" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_NO_WP_DETECT ), + UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, "Maxtor", "USB to SATA",
Greg Kroah-Hartman
maintainerPATCH 58/160 usb-storage: fix bogus hardware error messages for ATA pass-thru devices
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit a4fd4a724d6c30ad671046d83be2e9be2f11d275 upstream.
Ever since commit a621bac3044e ("scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands"), people have been getting bogus error messages for USB disk drives using ATA pass-thru. For example:
[ 1344.880193] sd 6:0:0:0: [sdb] Attached SCSI disk [ 1345.069152] sd 6:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_SENSE [ 1345.069159] sd 6:0:0:0: [sdb] tag#0 Sense Key : Hardware Error [current] [descriptor] [ 1345.069162] sd 6:0:0:0: [sdb] tag#0 Add. Sense: No additional sense information [ 1345.069168] sd 6:0:0:0: [sdb] tag#0 CDB: ATA command pass through(16) 85 06 20 00 00 00 00 00 00 00 00 00 00 00 e5 00 [ 1345.172252] sd 6:0:0:0: [sdb] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_SENSE [ 1345.172258] sd 6:0:0:0: [sdb] tag#0 Sense Key : Hardware Error [current] [descriptor] [ 1345.172261] sd 6:0:0:0: [sdb] tag#0 Add. Sense: No additional sense information [ 1345.172266] sd 6:0:0:0: [sdb] tag#0 CDB: ATA command pass through(12)/Blank a1 06 20 da 00 00 4f c2 00 b0 00 00
These messages can be quite annoying, because programs like udisks2 provoke them every 10 minutes or so. Other programs can also have this effect, such as those in smartmontools.
I don't fully understand how that commit induced the SCSI core to log these error messages, but the underlying cause for them is code added to usb-storage by commit f1a0743bc0e7 ("USB: storage: When a device returns no sense data, call it a Hardware Error"). At the time it was necessary to do this, in order to prevent an infinite retry loop with some not-so-great mass storage devices.
However, the ATA pass-thru protocol uses SCSI sense data to return command status values, and some devices always report Check Condition status for ATA pass-thru commands to ensure that the host retrieves the sense data, even if the command succeeded. This violates the USB mass-storage protocol (Check Condition status is supposed to mean the command failed), but we can't help that.
This patch attempts to mitigate the problem of these bogus error reports by changing usb-storage. The HARDWARE ERROR sense key will be inserted only for commands that aren't ATA pass-thru.
Thanks to Ewan Milne for pointing out that this mechanism was present in usb-storage. 8 years after writing it, I had completely forgotten its existence.
Ref: https://bugzilla.redhat.com/show_bug.cgi?id=1351305
--- drivers/usb/storage/transport.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/usb/storage/transport.c +13 -1
@@ -834,13 +834,25 @@ Retry_Sense:if (result ==USB_STOR_TRANSPORT_GOOD ) { srb->result =SAM_STAT_GOOD ; srb->sense_buffer[0 ] =0x0 ; + } + +/* +* ATA-passthru commands use sense data to report +* the command completion status, and often devices +* return Check Condition status when nothing is +* wrong. +*/ +else if (srb->cmnd[0 ] ==ATA_16 || + srb->cmnd[0 ] ==ATA_12 ) { +/* leave the data alone */ + }/* * If there was a problem, report an unspecified * hardware error to prevent the higher layers from * entering an infinite retry loop. */ - }else { +else { srb->result =DID_ERROR <<16 ;if ((sshdr.response_code &0x72 ) ==0x72 ) srb->sense_buffer[1 ] =HARDWARE_ERROR ;
Greg Kroah-Hartman
maintainerPATCH 59/160 usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 6124607acc88fffeaadf3aacfeb3cc1304c87387 upstream.
This patch fixes an issue that the driver sets the BCLR bit of {C,Dn}FIFOCTR register to 1 even when it's non-DCP pipe and the FRDY bit of {C,Dn}FIFOCTR register is set to 1.
--- drivers/usb/renesas_usbhs/fifo.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/usb/renesas_usbhs/fifo.c +8 -2
@@ -282,11 +282,17 @@ static void usbhsf_fifo_clear(struct usb struct usbhs_fifo *fifo) {struct usbhs_priv *priv =usbhs_pipe_to_priv (pipe); +int ret =0 ;if (!usbhs_pipe_is_dcp (pipe)) -usbhsf_fifo_barrier (priv, fifo); + ret =usbhsf_fifo_barrier (priv, fifo); -usbhs_write (priv, fifo->ctr,BCLR ); +/* +* if non-DCP pipe, this driver should set BCLR when +* usbhsf_fifo_barrier() returns 0. +*/ +if (!ret) +usbhs_write (priv, fifo->ctr,BCLR ); } static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
Greg Kroah-Hartman
maintainerPATCH 60/160 usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <[email protected]>
commit 0a2ce62b61f2c76d0213edf4e37aaf54a8ddf295 upstream.
This patch fixes an issue that the usbhsf_fifo_clear() is possible to cause 10 msec delay if the pipe is RX direction and empty because the FRDY bit will never be set to 1 in such case.
--- drivers/usb/renesas_usbhs/fifo.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/usb/renesas_usbhs/fifo.c +11 -2
@@ -284,8 +284,17 @@ static void usbhsf_fifo_clear(struct usbstruct usbhs_priv *priv =usbhs_pipe_to_priv (pipe);int ret =0 ; -if (!usbhs_pipe_is_dcp (pipe)) - ret =usbhsf_fifo_barrier (priv, fifo); +if (!usbhs_pipe_is_dcp (pipe)) { +/* +* This driver checks the pipe condition first to avoid -EBUSY +* from usbhsf_fifo_barrier() with about 10 msec delay in +* the interrupt handler if the pipe is RX direction and empty. +*/ +if (usbhs_pipe_is_dir_in (pipe)) + ret =usbhs_pipe_is_accessible (pipe); +if (!ret) + ret =usbhsf_fifo_barrier (priv, fifo); + }/* * if non-DCP pipe, this driver should set BCLR when
Greg Kroah-Hartman
maintainerPATCH 61/160 ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991 upstream.
When a USB-audio device receives a maliciously adjusted or corrupted buffer descriptor, the USB-audio driver may access an out-of-bounce value at its parser. This was detected by syzkaller, something like:
BUG: KASAN: slab-out-of-bounds in usb_audio_probe+0x27b2/0x2ab0 Read of size 1 at addr ffff88006b83a9e8 by task kworker/0:1/24 CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #224 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x395 lib/dump_stack.c:52 print_address_description+0x78/0x280 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 kasan_report+0x22f/0x340 mm/kasan/report.c:409 __asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427 snd_usb_create_streams sound/usb/card.c:248 usb_audio_probe+0x27b2/0x2ab0 sound/usb/card.c:605 usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:413 driver_probe_device+0x610/0xa00 drivers/base/dd.c:557 __device_attach_driver+0x230/0x290 drivers/base/dd.c:653 bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463 __device_attach+0x26e/0x3d0 drivers/base/dd.c:710 device_initial_probe+0x1f/0x30 drivers/base/dd.c:757 bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523 device_add+0xd0b/0x1660 drivers/base/core.c:1835 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4903 hub_port_connect_change drivers/usb/core/hub.c:5009 port_event drivers/usb/core/hub.c:5115 hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195 process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119 worker_thread+0x221/0x1850 kernel/workqueue.c:2253 kthread+0x3a1/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
This patch adds the checks of out-of-bounce accesses at appropriate places and bails out when it goes out of the given buffer.
--- sound/usb/card.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
sound/usb/card.c +20 -0
@@ -221,6 +221,7 @@ static int snd_usb_create_streams(structstruct usb_interface_descriptor *altsd;void *control_header;int i, protocol; +int rest_bytes;/* find audiocontrol interface */ host_iface = &usb_ifnum_to_if (dev, ctrlif)->altsetting[0 ];
@@ -235,6 +236,15 @@ static int snd_usb_create_streams(structreturn -EINVAL ; } + rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - + control_header; + +/* just to be sure -- this shouldn't hit at all */ +if (rest_bytes <=0 ) { +dev_err (&dev->dev,"invalid control header\n" ); +return -EINVAL ; + } +switch (protocol) {default : dev_warn(&dev->dev,
@@ -245,11 +255,21 @@ static int snd_usb_create_streams(structcase UAC_VERSION_1 : {struct uac1_ac_header_descriptor *h1 = control_header; +if (rest_bytes <sizeof (*h1)) { +dev_err (&dev->dev,"too short v1 buffer descriptor\n" ); +return -EINVAL ; + } +if (!h1->bInCollection) {dev_info (&dev->dev,"skipping empty audio interface (v1)\n" );return -EINVAL ; } +if (rest_bytes < h1->bLength) { +dev_err (&dev->dev,"invalid buffer length (v1)\n" ); +return -EINVAL ; + } +if (h1->bLength <sizeof (*h1) + h1->bInCollection) {dev_err (&dev->dev,"invalid UAC_HEADER (v1)\n" );return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 62/160 usb: pci-quirks.c: Corrected timeout values used in handshake
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Dickerson <[email protected]>
commit 114ec3a6f9096d211a4aff4277793ba969a62c73 upstream.
Servers were emitting failed handoff messages but were not waiting the full 1 second as designated in section 4.22.1 of the eXtensible Host Controller Interface specifications. The handshake was using wrong units so calls were made with milliseconds not microseconds. Comments referenced 5 seconds not 1 second as in specs.
The wrong units were also corrected in a second handshake call.
--- drivers/usb/host/pci-quirks.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/usb/host/pci-quirks.c +4 -4
@@ -1022,7 +1022,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports* * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. * It signals to the BIOS that the OS wants control of the host controller, -* and then waits 5 seconds for the BIOS to hand over control. +* and then waits 1 second for the BIOS to hand over control. * If we timeout, assume the BIOS is broken and take control anyway. */ static void quirk_usb_handoff_xhci (struct pci_dev *pdev)
@@ -1069,9 +1069,9 @@ static void quirk_usb_handoff_xhci(strucif (val &XHCI_HC_BIOS_OWNED ) {writel (val |XHCI_HC_OS_OWNED , base + ext_cap_offset); -/* Wait for 5 seconds with 10 microsecond polling interval */ +/* Wait for 1 second with 10 microsecond polling interval */ timeout =handshake (base + ext_cap_offset,XHCI_HC_BIOS_OWNED , -0 ,5000 ,10 ); +0 ,1000000 ,10 );/* Assume a buggy BIOS and take HC ownership anyway */ if (timeout) {
@@ -1100,7 +1100,7 @@ hc_init:* operational or runtime registers. Wait 5 seconds and no more. */ timeout =handshake (op_reg_base +XHCI_STS_OFFSET ,XHCI_STS_CNR ,0 , -5000 ,10 ); +5000000 ,10 );/* Assume a buggy HC and start HC initialization anyway */ if (timeout) { val =readl (op_reg_base +XHCI_STS_OFFSET );
Greg Kroah-Hartman
maintainerPATCH 64/160 USB: dummy-hcd: fix connection failures (wrong speed)
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit fe659bcc9b173bcfdd958ce2aec75e47651e74e1 upstream.
The dummy-hcd UDC driver is not careful about the way it handles connection speeds. It ignores the module parameter that is supposed to govern the maximum connection speed and it doesn't set the HCD flags properly for the case where it ends up running at full speed.
The result is that in many cases, gadget enumeration over dummy-hcd fails because the bMaxPacketSize byte in the device descriptor is set incorrectly. For example, the default settings call for a high-speed connection, but the maxpacket value for ep0 ends up being set for a Super-Speed connection.
This patch fixes the problem by initializing the gadget's max_speed and the HCD flags correctly.
--- drivers/usb/gadget/udc/dummy_hcd.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +11 -4
@@ -1037,7 +1037,12 @@ static int dummy_udc_probe(struct platfomemzero_explicit (&dum->gadget,sizeof (struct usb_gadget )); dum->gadget.name = gadget_name; dum->gadget.ops = &dummy_ops; - dum->gadget.max_speed =USB_SPEED_SUPER ; +if (mod_data.is_super_speed) + dum->gadget.max_speed =USB_SPEED_SUPER ; +else if (mod_data.is_high_speed) + dum->gadget.max_speed =USB_SPEED_HIGH ; +else + dum->gadget.max_speed =USB_SPEED_FULL ; dum->gadget.dev.parent = &pdev->dev;init_dummy_udc_hw (dum);
@@ -2561,8 +2566,6 @@ static struct hc_driver dummy_hcd = { .product_desc = "Dummy host controller", .hcd_priv_size = sizeof(struct dummy_hcd), - .flags = HCD_USB3 | HCD_SHARED, - .reset = dummy_setup, .start = dummy_start, .stop = dummy_stop,
@@ -2591,8 +2594,12 @@ static int dummy_hcd_probe(struct platfodev_info (&pdev->dev,"%s, driver " DRIVER_VERSION "\n" , driver_desc); dum = *((void **)dev_get_platdata (&pdev->dev)); -if (!mod_data.is_super_speed) +if (mod_data.is_super_speed) + dummy_hcd.flags =HCD_USB3 |HCD_SHARED ; +else if (mod_data.is_high_speed) dummy_hcd.flags =HCD_USB2 ; +else + dummy_hcd.flags =HCD_USB11 ; hs_hcd =usb_create_hcd (&dummy_hcd, &pdev->dev,dev_name (&pdev->dev));if (!hs_hcd)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 65/160 USB: dummy-hcd: fix infinite-loop resubmission bug
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 0173a68bfb0ad1c72a6ee39cc485aa2c97540b98 upstream.
The dummy-hcd HCD/UDC emulator tries not to do too much work during each timer interrupt. But it doesn't try very hard; currently all it does is limit the total amount of bulk data transferred. Other transfer types aren't limited, and URBs that transfer no data (because of an error, perhaps) don't count toward the limit, even though on a real USB bus they would consume at least a minimum overhead.
This means it's possible to get the driver stuck in an infinite loop, for example, if the host class driver resubmits an URB every time it completes (which is common for interrupt URBs). Each time the URB is resubmitted it gets added to the end of the pending-URBs list, and dummy-hcd doesn't stop until that list is empty. Andrey Konovalov was able to trigger this failure mode using the syzkaller fuzzer.
This patch fixes the infinite-loop problem by restricting the URBs handled during each timer interrupt to those that were already on the pending list when the interrupt routine started. Newly added URBs won't be processed until the next timer interrupt. The problem of properly accounting for non-bulk bandwidth (as well as packet and transaction overhead) is not addressed here.
--- drivers/usb/gadget/udc/dummy_hcd.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/usb/gadget/udc/dummy_hcd.c +9 -0
@@ -237,6 +237,8 @@ struct dummy_hcd {struct usb_device *udev;struct list_head urbp_list; +struct urbp *next_frame_urbp; +u32 stream_en_ep;u8 num_stream[30 /2 ];
@@ -1251,6 +1253,8 @@ static int dummy_urb_enqueue(list_add_tail (&urbp->urbp_list, &dum_hcd->urbp_list); urb->hcpriv = urbp; +if (!dum_hcd->next_frame_urbp) + dum_hcd->next_frame_urbp = urbp;if (usb_pipetype (urb->pipe) ==PIPE_CONTROL ) urb->error_count =1 ;/* mark as a new urb */
@@ -1767,6 +1771,7 @@ static void dummy_timer(unsigned long _dspin_unlock_irqrestore (&dum->lock, flags);return ; } + dum_hcd->next_frame_urbp =NULL ;for (i =0 ; i <DUMMY_ENDPOINTS ; i++) {if (!ep_info[i].name)
@@ -1783,6 +1788,10 @@ restart:int type;int status = -EINPROGRESS ; +/* stop when we reach URBs queued after the timer interrupt */ +if (urbp == dum_hcd->next_frame_urbp) +break ; + urb = urbp->urb;if (urb->unlinked) goto return_urb;
Greg Kroah-Hartman
maintainerPATCH 66/160 USB: dummy-hcd: Fix erroneous synchronization change
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 7dbd8f4cabd96db5a50513de9d83a8105a5ffc81 upstream.
A recent change to the synchronization in dummy-hcd was incorrect. The issue was that dummy_udc_stop() contained no locking and therefore could race with various gadget driver callbacks, and the fix was to add locking and issue the callbacks with the private spinlock held.
UDC drivers aren't supposed to do this. Gadget driver callback routines are allowed to invoke functions in the UDC driver, and these functions will generally try to acquire the private spinlock. This would deadlock the driver.
The correct solution is to drop the spinlock before issuing callbacks, and avoid races by emulating the synchronize_irq() call that all real UDC drivers must perform in their ->udc_stop() routines after disabling interrupts. This involves adding a flag to dummy-hcd's private structure to keep track of whether interrupts are supposed to be enabled, and adding a counter to keep track of ongoing callbacks so that dummy_udc_stop() can wait for them all to finish.
A real UDC driver won't receive disconnect, reset, suspend, resume, or setup events once it has disabled interrupts. dummy-hcd will receive them but won't try to issue any gadget driver callbacks, which should be just as good.
--- drivers/usb/gadget/udc/dummy_hcd.c | 32 ++++++++++++++++++++++++++++++-- 1 file changed, 30 insertions(+), 2 deletions(-)
drivers/usb/gadget/udc/dummy_hcd.c +30 -2
@@ -255,11 +255,13 @@ struct dummy {*/ struct dummy_ep ep[DUMMY_ENDPOINTS ];int address; +int callback_usage;struct usb_gadget gadget;struct usb_gadget_driver *driver;struct dummy_request fifo_req;u8 fifo_buf[FIFO_SIZE ];u16 devstatus; + unsigned ints_enabled:1; unsigned udc_suspended:1; unsigned pullup:1;
@@ -442,18 +444,27 @@ static void set_link_state(struct dummy_ (~dum_hcd->old_status) & dum_hcd->port_status;/* Report reset and disconnect events to the driver */ -if (dum->driver && (disconnect || reset)) { +if (dum->ints_enabled && (disconnect || reset)) {stop_activity (dum); + ++dum->callback_usage; +spin_unlock (&dum->lock);if (reset)usb_gadget_udc_reset (&dum->gadget, dum->driver);else dum->driver->disconnect (&dum->gadget); +spin_lock (&dum->lock); + --dum->callback_usage; } - }else if (dum_hcd->active != dum_hcd->old_active) { + }else if (dum_hcd->active != dum_hcd->old_active && + dum->ints_enabled) { + ++dum->callback_usage; +spin_unlock (&dum->lock);if (dum_hcd->old_active && dum->driver->suspend) dum->driver->suspend (&dum->gadget);else if (!dum_hcd->old_active && dum->driver->resume) dum->driver->resume (&dum->gadget); +spin_lock (&dum->lock); + --dum->callback_usage; } dum_hcd->old_status = dum_hcd->port_status;
@@ -974,8 +985,11 @@ static int dummy_udc_start(struct usb_ga* can't enumerate without help from the driver we're binding. */ +spin_lock_irq (&dum->lock); dum->devstatus =0 ; dum->driver = driver; + dum->ints_enabled =1 ; +spin_unlock_irq (&dum->lock);return 0 ; }
@@ -986,6 +1000,16 @@ static int dummy_udc_stop(struct usb_gadstruct dummy *dum = dum_hcd->dum;spin_lock_irq (&dum->lock); + dum->ints_enabled =0 ; +stop_activity (dum); + +/* emulate synchronize_irq(): wait for callbacks to finish */ +while (dum->callback_usage >0 ) { +spin_unlock_irq (&dum->lock); +usleep_range (1000 ,2000 ); +spin_lock_irq (&dum->lock); + } + dum->driver =NULL ;spin_unlock_irq (&dum->lock);
@@ -1530,6 +1554,8 @@ static struct dummy_ep *find_endpoint(stif (!is_active ((dum->gadget.speed ==USB_SPEED_SUPER ? dum->ss_hcd : dum->hs_hcd)))return NULL ; +if (!dum->ints_enabled) +return NULL ;if ((address & ~USB_DIR_IN ) ==0 )return &dum->ep[0 ];for (i =1 ; i <DUMMY_ENDPOINTS ; i++) {
@@ -1871,10 +1897,12 @@ restart:* until setup() returns; no reentrancy issues etc. */ if (value >0 ) { + ++dum->callback_usage;spin_unlock (&dum->lock); value = dum->driver->setup (&dum->gadget, &setup);spin_lock (&dum->lock); + --dum->callback_usage;if (value >=0 ) {/* no delays (max 64KB data stage) */
Greg Kroah-Hartman
maintainerPATCH 67/160 USB: devio: Prevent integer overflow in proc_do_submiturb()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 57999d1107c1e60c2ca7088f2ac0f819e2f554b3 upstream.
There used to be an integer overflow check in proc_do_submiturb() but we removed it. It turns out that it's still required. The uurb->buffer_length variable is a signed integer and it's controlled by the user. It can lead to an integer overflow when we do:
num_sgs = DIV_ROUND_UP(uurb->buffer_length, USB_SG_SIZE);
If we strip away the macro then that line looks like this:
num_sgs = (uurb->buffer_length + USB_SG_SIZE - 1) / USB_SG_SIZE;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^It's the first addition which can overflow.
--- drivers/usb/core/devio.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/core/devio.c +5 -0
@@ -140,6 +140,9 @@ module_param(usbfs_memory_mb, uint, 0644MODULE_PARM_DESC (usbfs_memory_mb,"maximum MB allowed for usbfs buffers (0 = no limit)" ); +/* Hard limit, necessary to avoid arithmetic overflow */ +#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) +static atomic64_t usbfs_memory_usage;/* Total memory currently allocated */ /* Check whether it's okay to allocate more memory for a transfer */
@@ -1460,6 +1463,8 @@ static int proc_do_submiturb(struct usb_USBDEVFS_URB_ZERO_PACKET | USBDEVFS_URB_NO_INTERRUPT)) return -EINVAL; +if ((unsigned int )uurb->buffer_length >=USBFS_XFER_MAX ) +return -EINVAL ;if (uurb->buffer_length >0 && !uurb->buffer)return -EINVAL ; if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&
Greg Kroah-Hartman
maintainerPATCH 68/160 USB: devio: Dont corrupt user memory
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit fa1ed74eb1c233be6131ec92df21ab46499a15b6 upstream.
The user buffer has "uurb->buffer_length" bytes. If the kernel has more information than that, we should truncate it instead of writing past the end of the user's buffer. I added a WARN_ONCE() to help the user debug the issue.
--- drivers/usb/core/devio.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/core/devio.c +5 -1
@@ -1576,7 +1576,11 @@ static int proc_do_submiturb(struct usb_ totlen += isopkt[u].length; } u *=sizeof (struct usb_iso_packet_descriptor ); - uurb->buffer_length = totlen; +if (totlen <= uurb->buffer_length) + uurb->buffer_length = totlen; +else +WARN_ONCE (1 ,"uurb->buffer_length is too short %d vs %d" , + totlen, uurb->buffer_length);break ;default :
Greg Kroah-Hartman
maintainerPATCH 69/160 USB: g_mass_storage: Fix deadlock when driver is unbound
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 1fbbb78f25d1291274f320462bf6908906f538db upstream.
As a holdover from the old g_file_storage gadget, the g_mass_storage legacy gadget driver attempts to unregister itself when its main operating thread terminates (if it hasn't been unregistered already). This is not strictly necessary; it was never more than an attempt to have the gadget fail cleanly if something went wrong and the main thread was killed.
However, now that the UDC core manages gadget drivers independently of UDC drivers, this scheme doesn't work any more. A simple test:
modprobe dummy-hcd
modprobe g-mass-storage file=...
rmmod dummy-hcd
ends up in a deadlock with the following backtrace:
sysrq: SysRq : Show Blocked State
task PC stack pid father
file-storage D 0 1130 2 0x00000000
Call Trace: __schedule+0x53e/0x58c schedule+0x6e/0x77 schedule_preempt_disabled+0xd/0xf __mutex_lock.isra.1+0x129/0x224 ? _raw_spin_unlock_irqrestore+0x12/0x14 __mutex_lock_slowpath+0x12/0x14 mutex_lock+0x28/0x2b usb_gadget_unregister_driver+0x29/0x9b [udc_core] usb_composite_unregister+0x10/0x12 [libcomposite] msg_cleanup+0x1d/0x20 [g_mass_storage] msg_thread_exits+0xd/0xdd7 [g_mass_storage] fsg_main_thread+0x1395/0x13d6 [usb_f_mass_storage] ? __schedule+0x573/0x58c kthread+0xd9/0xdb ? do_set_interface+0x25c/0x25c [usb_f_mass_storage] ? init_completion+0x1e/0x1e ret_from_fork+0x19/0x24 rmmod D 0 1155 683 0x00000000 Call Trace: __schedule+0x53e/0x58c schedule+0x6e/0x77 schedule_timeout+0x26/0xbc ? __schedule+0x573/0x58c do_wait_for_common+0xb3/0x128 ? usleep_range+0x81/0x81 ? wake_up_q+0x3f/0x3f wait_for_common+0x2e/0x45 wait_for_completion+0x17/0x19 fsg_common_put+0x34/0x81 [usb_f_mass_storage] fsg_free_inst+0x13/0x1e [usb_f_mass_storage] usb_put_function_instance+0x1a/0x25 [libcomposite] msg_unbind+0x2a/0x42 [g_mass_storage] __composite_unbind+0x4a/0x6f [libcomposite] composite_unbind+0x12/0x14 [libcomposite] usb_gadget_remove_driver+0x4f/0x77 [udc_core] usb_del_gadget_udc+0x52/0xcc [udc_core] dummy_udc_remove+0x27/0x2c [dummy_hcd] platform_drv_remove+0x1d/0x31 device_release_driver_internal+0xe9/0x16d device_release_driver+0x11/0x13 bus_remove_device+0xd2/0xe2 device_del+0x19f/0x221 ? selinux_capable+0x22/0x27 platform_device_del+0x21/0x63 platform_device_unregister+0x10/0x1a cleanup+0x20/0x817 [dummy_hcd] SyS_delete_module+0x10c/0x197 ? ____fput+0xd/0xf ? task_work_run+0x55/0x62 ? prepare_exit_to_usermode+0x65/0x75 do_fast_syscall_32+0x86/0xc3 entry_SYSENTER_32+0x4e/0x7c
What happens is that removing the dummy-hcd driver causes the UDC core to unbind the gadget driver, which it does while holding the udc_lock mutex. The unbind routine in g_mass_storage tells the main thread to exit and waits for it to terminate.
But as mentioned above, when the main thread exits it tries to unregister the mass-storage function driver. Via the composite framework this ends up calling usb_gadget_unregister_driver(), which tries to acquire the udc_lock mutex. The result is deadlock.
The simplest way to fix the problem is not to be so clever: The main thread doesn't have to unregister the function driver. The side effects won't be so terrible; if the gadget is still attached to a USB host when the main thread is killed, it will appear to the host as though the gadget's firmware has crashed -- a reasonably accurate interpretation, and an all-too-common occurrence for USB mass-storage devices.
In fact, the code to unregister the driver when the main thread exits is specific to g-mass-storage; it is not used when f-mass-storage is included as a function in a larger composite device. Therefore the entire mechanism responsible for this (the fsg_operations structure with its ->thread_exits method, the fsg_common_set_ops() routine, and the msg_thread_exits() callback routine) can all be eliminated. Even the msg_registered bitflag can be removed, because now the driver is unregistered in only one place rather than in two places.
--- drivers/usb/gadget/function/f_mass_storage.c | 29 +++++++-------------------- drivers/usb/gadget/function/f_mass_storage.h | 14 ------------- drivers/usb/gadget/legacy/mass_storage.c | 26 ++---------------------- 3 files changed, 11 insertions(+), 58 deletions(-)
drivers/usb/gadget/function/f_mass_storage.c +8 -21
@@ -307,8 +307,6 @@ struct fsg_common {struct completion thread_notifier;struct task_struct *thread_task; -/* Callback functions. */ -const struct fsg_operations *ops;/* Gadget's private data. */ void *private_data;
@@ -2440,6 +2438,7 @@ static void handle_exception(struct fsg_static int fsg_main_thread (void *common_) {struct fsg_common *common = common_; +int i;/* * Allow the thread to be killed by a signal, but set the signal mask
@@ -2485,21 +2484,16 @@ static int fsg_main_thread(void *common_ common->thread_task =NULL ;spin_unlock_irq (&common->lock); -if (!common->ops || !common->ops->thread_exits - || common->ops->thread_exits (common) <0 ) { -int i; - -down_write (&common->filesem); -for (i =0 ; i <ARRAY_SIZE (common->luns); i++) { -struct fsg_lun *curlun = common->luns[i]; -if (!curlun || !fsg_lun_is_open (curlun)) -continue ; +/* Eject media from all LUNs */ +down_write (&common->filesem); +for (i =0 ; i <ARRAY_SIZE (common->luns); i++) { +struct fsg_lun *curlun = common->luns[i]; + +if (curlun &&fsg_lun_is_open (curlun))fsg_lun_close (curlun); - curlun->unit_attention_data =SS_MEDIUM_NOT_PRESENT ; - } -up_write (&common->filesem); } +up_write (&common->filesem);/* Let fsg_unbind() know the thread has exited */ complete_and_exit (&common->thread_notifier,0 );
@@ -2690,13 +2684,6 @@ void fsg_common_remove_luns(struct fsg_c }EXPORT_SYMBOL_GPL (fsg_common_remove_luns); -void fsg_common_set_ops (struct fsg_common *common, -const struct fsg_operations *ops) -{ - common->ops = ops; -} -EXPORT_SYMBOL_GPL (fsg_common_set_ops); -void fsg_common_free_buffers (struct fsg_common *common) {_fsg_common_free_buffers (common->buffhds, common->fsg_num_buffers);
drivers/usb/gadget/function/f_mass_storage.h +0 -14
@@ -60,17 +60,6 @@ struct fsg_module_parameters {struct fsg_common ;/* FSF callback functions */ -struct fsg_operations { -/* -* Callback function to call when thread exits. If no -* callback is set or it returns value lower then zero MSF -* will force eject all LUNs it operates on (including those -* marked as non-removable or with prevent_medium_removal flag -* set). -*/ -int (*thread_exits)(struct fsg_common *common); -}; -struct fsg_lun_opts {struct config_group group;struct fsg_lun *lun;
@@ -142,9 +131,6 @@ void fsg_common_remove_lun(struct fsg_luvoid fsg_common_remove_luns (struct fsg_common *common); -void fsg_common_set_ops (struct fsg_common *common, -const struct fsg_operations *ops); -int fsg_common_create_lun (struct fsg_common *common,struct fsg_lun_config *cfg,unsigned int id,const char *name,const char **name_pfx);
drivers/usb/gadget/legacy/mass_storage.c +3 -23
@@ -107,15 +107,6 @@ static unsigned int fsg_num_buffers = CO FSG_MODULE_PARAMETERS(/* no prefix */, mod_data); -static unsigned long msg_registered; -static void msg_cleanup (void ); - -static int msg_thread_exits (struct fsg_common *common) -{ -msg_cleanup (); -return 0 ; -} -static int msg_do_config (struct usb_configuration *c) {struct fsg_opts *opts;
@@ -154,9 +145,6 @@ static struct usb_configuration msg_confstatic int msg_bind (struct usb_composite_dev *cdev) { -static const struct fsg_operations ops = { - .thread_exits = msg_thread_exits, - };struct fsg_opts *opts;struct fsg_config config;int status;
@@ -173,8 +161,6 @@ static int msg_bind(struct usb_compositeif (status) goto fail; -fsg_common_set_ops (opts->common, &ops); - status =fsg_common_set_cdev (opts->common, cdev, config.can_stall);if (status) goto fail_set_cdev;
@@ -256,18 +242,12 @@ MODULE_LICENSE("GPL");static int __init msg_init (void ) { -int ret; - - ret =usb_composite_probe (&msg_driver); -set_bit (0 , &msg_registered); - -return ret; +return usb_composite_probe (&msg_driver); }module_init (msg_init); -static void msg_cleanup (void ) +static void __exit msg_cleanup(void) { -if (test_and_clear_bit (0 , &msg_registered)) -usb_composite_unregister (&msg_driver); +usb_composite_unregister (&msg_driver); }module_exit (msg_cleanup);
Greg Kroah-Hartman
maintainerPATCH 70/160 USB: uas: fix bug in handling of alternate settings
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit 786de92b3cb26012d3d0f00ee37adf14527f35c4 upstream.
The uas driver has a subtle bug in the way it handles alternate settings. The uas_find_uas_alt_setting() routine returns an altsetting value (the bAlternateSetting number in the descriptor), but uas_use_uas_driver() then treats that value as an index to the intf->altsetting array, which it isn't.
Normally this doesn't cause any problems because the various alternate settings have bAlternateSetting values 0, 1, 2, ..., so the value is equal to the index in the array. But this is not guaranteed, and Andrey Konovalov used the syzkaller fuzzer with KASAN to get a slab-out-of-bounds error by violating this assumption.
This patch fixes the bug by making uas_find_uas_alt_setting() return a pointer to the altsetting entry rather than either the value or the index. Pointers are less subject to misinterpretation.
--- drivers/usb/storage/uas-detect.h | 15 ++++++++------- drivers/usb/storage/uas.c | 10 +++++----- 2 files changed, 13 insertions(+), 12 deletions(-)
drivers/usb/storage/uas-detect.h +8 -7
@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_h intf->desc.bInterfaceProtocol == USB_PR_UAS); } -static int uas_find_uas_alt_setting (struct usb_interface *intf) +static struct usb_host_interface *uas_find_uas_alt_setting ( +struct usb_interface *intf) {int i;
@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(strustruct usb_host_interface *alt = &intf->altsetting[i];if (uas_is_interface (alt)) -return alt->desc.bAlternateSetting; +return alt; } -return -ENODEV ; +return NULL ; } static int uas_find_endpoints(struct usb_host_interface *alt,
@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usbstruct usb_device *udev =interface_to_usbdev (intf);struct usb_hcd *hcd =bus_to_hcd (udev->bus);unsigned long flags = id->driver_info; -int r, alt; - +struct usb_host_interface *alt; +int r; alt =uas_find_uas_alt_setting (intf); -if (alt <0 ) +if (!alt)return 0 ; - r =uas_find_endpoints (&intf->altsetting[alt], eps); + r =uas_find_endpoints (alt, eps);if (r <0 )return 0 ;
drivers/usb/storage/uas.c +5 -5
@@ -873,14 +873,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids);static int uas_switch_interface (struct usb_device *udev,struct usb_interface *intf) { -int alt; +struct usb_host_interface *alt; alt =uas_find_uas_alt_setting (intf); -if (alt <0 ) -return alt; +if (!alt) +return -ENODEV ; -return usb_set_interface (udev, - intf->altsetting[0 ].desc.bInterfaceNumber, alt); +return usb_set_interface (udev, alt->desc.bInterfaceNumber, + alt->desc.bAlternateSetting); }static int uas_configure_endpoints (struct uas_dev_info *devinfo)
Greg Kroah-Hartman
maintainerPATCH 71/160 USB: core: harden cdc_parse_cdc_header
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit 2e1c42391ff2556387b3cb6308b24f6f65619feb upstream.
Andrey Konovalov reported a possible out-of-bounds problem for the cdc_parse_cdc_header function. He writes:
It looks like cdc_parse_cdc_header() doesn't validate buflen before accessing buffer[1], buffer[2] and so on. The only check present is while (buflen > 0).
So fix this issue up by properly validating the buffer length matches what the descriptor says it is.
--- drivers/usb/core/message.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/core/message.c +4 -0
@@ -2069,6 +2069,10 @@ int cdc_parse_cdc_header(struct usb_cdc_ elength =1 ; goto next_desc; } +if ((buflen < elength) || (elength <3 )) { +dev_err (&intf->dev,"invalid descriptor buffer length\n" ); +break ; + }if (buffer[1 ] !=USB_DT_CS_INTERFACE ) {dev_err (&intf->dev,"skipping garbage\n" ); goto next_desc;
Greg Kroah-Hartman
maintainerPATCH 72/160 usb: Increase quirk delay for USB devices
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Fleytman <[email protected]>
commit b2a542bbb3081dbd64acc8929c140d196664c406 upstream.
Commit e0429362ab15
("usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e") introduced quirk to workaround an issue with some Logitech webcams.
The workaround is introducing delay for some USB operations.
According to our testing, delay introduced by original commit is not long enough and in rare cases we still see issues described by the aforementioned commit.
This patch increases delays introduced by original commit. Having this patch applied we do not see those problems anymore.
--- drivers/usb/core/config.c | 2 +- drivers/usb/core/hub.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/core/config.c +1 -1
@@ -852,7 +852,7 @@ int usb_get_configuration(struct usb_dev }if (dev->quirks &USB_QUIRK_DELAY_INIT ) -msleep (100 ); +msleep (200 ); result =usb_get_descriptor (dev,USB_DT_CONFIG , cfgno, bigbuffer, length);
drivers/usb/core/hub.c +1 -1
@@ -4825,7 +4825,7 @@ static void hub_port_connect(struct usb_ goto loop;if (udev->quirks &USB_QUIRK_DELAY_INIT ) -msleep (1000 ); +msleep (2000 );/* consecutive bus-powered hubs aren't reliable; they can * violate the voltage drop budget. if the new child has
Greg Kroah-Hartman
maintainerPATCH 73/160 USB: fix out-of-bounds in usb_set_configuration
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface association descriptor. He writes:
It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION descriptor. It's only checked that the size is >= 2 in usb_parse_configuration(), so find_iad() might do out-of-bounds access to intf_assoc->bInterfaceCount.
And he's right, we don't check for crazy descriptors of this type very well, so resolve this problem. Yet another issue found by syzkaller...
--- drivers/usb/core/config.c | 14 +++++++++++--- include/uapi/linux/usb/ch9.h | 1 + 2 files changed, 12 insertions(+), 3 deletions(-)
drivers/usb/core/config.c +11 -3
@@ -643,15 +643,23 @@ static int usb_parse_configuration(struc }else if (header->bDescriptorType ==USB_DT_INTERFACE_ASSOCIATION ) { +struct usb_interface_assoc_descriptor *d; + + d = (struct usb_interface_assoc_descriptor *)header; +if (d->bLength <USB_DT_INTERFACE_ASSOCIATION_SIZE ) { +dev_warn (ddev, +"config %d has an invalid interface association descriptor of length %d, skipping\n" , + cfgno, d->bLength); +continue ; + } +if (iad_num ==USB_MAXIADS ) {dev_warn (ddev,"found more Interface " "Association Descriptors " "than allocated for in " "configuration %d\n" , cfgno); }else { - config->intf_assoc[iad_num] = - (struct usb_interface_assoc_descriptor - *)header; + config->intf_assoc[iad_num] = d; iad_num++; }
include/uapi/linux/usb/ch9.h +1 -0
@@ -780,6 +780,7 @@ struct usb_interface_assoc_descriptor {__u8 iFunction; } __attribute__ ((packed)); +#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8/*-------------------------------------------------------------------------*/
Greg Kroah-Hartman
maintainerPATCH 74/160 usb: xhci: Free the right ring in xhci_add_endpoint()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit 9821786d7c90eee2f6852261893d9703801aae47 upstream.
In the xhci_add_endpoint(), a new ring was allocated and saved at xhci_virt_ep->new_ring. Hence, when error happens, we need to free the allocated ring before returning error.
Current code frees xhci_virt_ep->ring instead of the new_ring. This patch fixes this.
--- drivers/usb/host/xhci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/host/xhci.c +2 -1
@@ -1703,7 +1703,8 @@ static int xhci_add_endpoint(struct usb_if (xhci->quirks &XHCI_MTK_HOST ) { ret =xhci_mtk_add_ep_quirk (hcd, udev, ep);if (ret <0 ) { -xhci_free_endpoint_ring (xhci, virt_dev, ep_index); +xhci_ring_free (xhci, virt_dev->eps[ep_index].new_ring); + virt_dev->eps[ep_index].new_ring =NULL ;return ret; } }
Greg Kroah-Hartman
maintainerPATCH 75/160 xhci: fix finding correct bus_state structure for USB 3.1 hosts
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 5a838a13c9b4e5dd188b7a6eaeb894e9358ead0c upstream.
xhci driver keeps a bus_state structure for each hcd (usb2 and usb3)
The structure is picked based on hcd speed, but driver only compared for HCD_USB3 speed, returning the wrong bus_state for HCD_USB31 hosts.
This caused null pointer dereference errors in bus_resume function.
--- drivers/usb/host/xhci.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/xhci.h +1 -1
@@ -1674,7 +1674,7 @@ struct xhci_bus_state {static inline unsigned int hcd_index (struct usb_hcd *hcd) { -if (hcd->speed ==HCD_USB3 ) +if (hcd->speed >=HCD_USB3 )return 0 ;else return 1 ;
Greg Kroah-Hartman
maintainerPATCH 76/160 xhci: fix wrong endpoint ESIT value shown in tracing
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 76a14d7bf92960aac2f5450bfd23783bfa618be9 upstream.
Read the endpiont ESIT from endpiont context using correct macro. Add a macro for reading the high bits of ESIT for Large ESIT Payload Capable hosts (LEC=1)
--- drivers/usb/host/xhci.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/usb/host/xhci.h +4 -2
@@ -728,6 +728,8 @@ struct xhci_ep_ctx {#define EP_MAXPSTREAMS (p) (((p) << 10) & EP_MAXPSTREAMS_MASK)/* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */ #define EP_HAS_LSA (1 << 15) +/* hosts with LEC=1 use bits 31:24 as ESIT high bits. */ +#define CTX_TO_MAX_ESIT_PAYLOAD_HI (p) (((p) >> 24) & 0xff)/* ep_info2 bitmasks */ /*
@@ -2452,8 +2454,8 @@ static inline const char *xhci_decode_epu8 lsa;u8 hid; - esit =EP_MAX_ESIT_PAYLOAD_HI (info) <<16 | -EP_MAX_ESIT_PAYLOAD_LO (tx_info); + esit =CTX_TO_MAX_ESIT_PAYLOAD_HI (info) <<16 | +CTX_TO_MAX_ESIT_PAYLOAD (tx_info); ep_state = info &EP_STATE_MASK ; max_pstr = info &EP_MAXPSTREAMS_MASK ;
Greg Kroah-Hartman
maintainerPATCH 77/160 usb: host: xhci-plat: allow sysdev to inherit from ACPI
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Wallis <[email protected]>
commit c6b8e79306f515b5483eb11076e0fbfc140434a8 upstream.
Commit 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration") updated the method determining DMA for XHCI from sysdev. However, this patch broke the ability to enumerate the FWNODE from parent ACPI devices from the child plat XHCI device.
Currently, xhci_plat is not set up properly when the parent device is an ACPI node. The conditions that xhci_plat_probe should satisfy are
1. xhci_plat comes from firmware
2. xhci_plat is child of a device from firmware (dwc3-plat)
3. xhci_plat is grandchild of a pci device (dwc3-pci)
Case 2 is covered when the child is an OF node (by checking sysdev->parent->of_node), however, an ACPI parent will return NULL in the of_node check and will thus not result in sysdev being set to sysdev->parent
[ 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5
This change adds a check for ACPI to completely allow for condition 2. This is done by first checking if the parent node is of type ACPI (e.g., dwc3-plat) and set sysdev to sysdev->parent if either of the two following conditions are met:
1: If fwnode is empty (in the case that platform_device_add_properties was not called on the allocated platform device)
2: fwnode exists but is not of type ACPI (this would happen if platform_device_add_properties was called on the allocated device. Instead of type FWNODE_ACPI, you would end up with FWNODE_PDATA)
--- drivers/usb/host/xhci-plat.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/usb/host/xhci-plat.c +10 -6
@@ -186,14 +186,18 @@ static int xhci_plat_probe(struct platfo* 2. xhci_plat is child of a device from firmware (dwc3-plat) * 3. xhci_plat is grandchild of a pci device (dwc3-pci) */ - sysdev = &pdev->dev; -if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node) - sysdev = sysdev->parent; +for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) { +if (is_of_node (sysdev->fwnode) || +is_acpi_device_node (sysdev->fwnode)) +break ;#ifdef CONFIG_PCI - else if (sysdev->parent && sysdev->parent->parent && - sysdev->parent->parent->bus == &pci_bus_type) - sysdev = sysdev->parent->parent; + else if (sysdev->bus == &pci_bus_type) + break;#endif + } + +if (!sysdev) + sysdev = &pdev->dev;/* Try to set 64-bit DMA first */ if (WARN_ON (!sysdev->dma_mask))
A message that is not in the archive (sent off-list or not yet received): CAKrQpStfip1YroPqVsc+d4hUjoLKAsnd3ob5YPGaUnBg4pVXbw@mail.gmail.com
Re: [PATCH 4.13 077/160] usb: host: xhci-plat: allow sysdev to inherit from ACPI
Quoted 101 lines · Thang Q. Nguyen
Hi,
On Wed, Oct 11, 2017 at 2:50 AM, Greg Kroah-Hartman <[email protected] <mailto:[email protected]>> wrote:
4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adam Wallis <[email protected] <mailto:[email protected]>>
commit
c6b8e79306f515b5483eb11076e0fbfc140434a8upstream.Commit
4c39d4b949d3("usb: xhci: usebus->sysdevfor DMA configuration") updated the method determining DMA for XHCI from sysdev. However, this patch broke the ability to enumerate the FWNODE from parent ACPI devices from the child plat XHCI device.Currently,
xhci_platis not set up properly when the parent device is an ACPI node. The conditions thatxhci_plat_probeshould satisfy are1.
xhci_platcomes from firmware
2.xhci_platis child of a device from firmware (dwc3-plat)
3.xhci_platis grandchild of a pci device (dwc3-pci)Case 2 is covered when the child is an OF node (by checking
sysdev->parent->of_node), however, an ACPI parent will return NULL in theof_nodecheck and will thus not result in sysdev being set tosysdev->parent[ 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5
This change adds a check for ACPI to completely allow for condition 2. This is done by first checking if the parent node is of type ACPI (e.g., dwc3-plat) and set sysdev to
sysdev->parentif either of the two following conditions are met:1: If fwnode is empty (in the case that
platform_device_add_propertieswas not called on the allocated platform device)
2: fwnode exists but is not of type ACPI (this would happen ifplatform_device_add_propertieswas called on the allocated device. Instead of typeFWNODE_ACPI, you would end up withFWNODE_PDATA)Fixes 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration")Tested-by Thang Q. Nguyen <[email protected] <mailto:[email protected]>>Signed-off-by Adam Wallis <[email protected] <mailto:[email protected]>>Signed-off-by Mathias Nyman <[email protected] <mailto:[email protected]>>Signed-off-by Greg Kroah-Hartman <[email protected] <mailto:[email protected]>>---
drivers/usb/host/xhci-plat.c| 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)---
a/drivers/usb/host/xhci-plat.c
+++b/drivers/usb/host/xhci-plat.c
@@ -186,14 +186,18 @@ static int xhci_plat_probe(struct platfo
* 2.xhci_platis child of a device from firmware (dwc3-plat)
* 3.xhci_platis grandchild of a pci device (dwc3-pci) */
- sysdev =&pdev->dev;
- if (sysdev->parent&& !sysdev->of_node &&sysdev->parent->of_node)
- sysdev =sysdev->parent;
+ for (sysdev =&pdev->dev; sysdev; sysdev =sysdev->parent) {
+ if (is_of_node(sysdev->fwnode)||
+is_acpi_device_node(sysdev->fwnode))
+ break;
#ifdefCONFIG_PCI
- else if (sysdev->parent&&sysdev->parent->parent&&
-sysdev->parent->parent->bus==&pci_bus_type)
- sysdev =sysdev->parent->parent;
+ else if (sysdev->bus==&pci_bus_type)
+ break;
#endif
+ }
+
+ if (!sysdev)
+ sysdev =&pdev->dev;/* Try to set 64-bit DMA first */
if (WARN_ON(!sysdev->dma_mask))This patch and Sriram's patches below should come together:
d64ff406e5("usb: dwc3: use bus->sysdev for DMA configuration")8c9f2de459("usb: dwc3: Do not set dma coherent mask")
a8c06e407e("usb: separate out sysdev pointer from usb_bus")
aeb78cda51("usb: chipidea: use bus->sysdev for DMA configuration")8123e4953f("usb: ehci: fsl: use
bus->sysdevfor DMA configuration")4c39d4b949("usb: xhci: use
bus->sysdevfor DMA configuration")Otherwise, the below issue still happen:
[ 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5The first 2 above patches are in linux-stable.git/linux-4.11.y. And all above Sriram's patches are in linux-stable.git/linux-4.12.y. This means we need the followings:
Quoted 8 lines
- Apply this patch and 4 missing Sriram's patches into linux-4.11.y.
- Apply this patch into linux-4.12.y
Regards,
Thang Q. Nguyen
All those required patches are already in 4.13 stable. They were accepted to 4.12
Applying this one on top is fine.
The issue you are talking about is for 4.11 stable only
-Mathias
Greg Kroah-Hartman
maintainerRe: [PATCH 4.13 077/160] usb: host: xhci-plat: allow sysdev to inherit from ACPI
In reply to a message not in the archiveQuoted 104 lines · Thang Q. Nguyen
Hi,
On Wed, Oct 11, 2017 at 2:50 AM, Greg Kroah-Hartman <[email protected]
Quoted 1 line
wrote:
4.13-stable review patch.� If anyone has any objections, please let me know.
------------------
From: Adam Wallis <[email protected]>
commit
c6b8e79306f515b5483eb11076e0fbfc140434a8upstream.Commit
4c39d4b949d3("usb: xhci: usebus->sysdevfor DMA configuration") updated the method determining DMA for XHCI from sysdev. However, this patch broke the ability to enumerate the FWNODE from parent ACPI devices from the child plat XHCI device.Currently,
xhci_platis not set up properly when the parent device is an ACPI node. The conditions thatxhci_plat_probeshould satisfy are1.
xhci_platcomes from firmware
2.xhci_platis child of a device from firmware (dwc3-plat)
3.xhci_platis grandchild of a pci device (dwc3-pci)Case 2 is covered when the child is an OF node (by checking
sysdev->parent->of_node), however, an ACPI parent will return NULL in theof_nodecheck and will thus not result in sysdev being set tosysdev->parent[� �17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5
This change adds a check for ACPI to completely allow for condition 2. This is done by first checking if the parent node is of type ACPI (e.g., dwc3-plat) and set sysdev to
sysdev->parentif either of the two following conditions are met:1: If fwnode is empty (in the case that
platform_device_add_propertieswas not called on the allocated platform device)
2: fwnode exists but is not of type ACPI (this would happen ifplatform_device_add_propertieswas called on the allocated device. Instead of typeFWNODE_ACPI, you would end up withFWNODE_PDATA)Fixes 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration")Tested-by Thang Q. Nguyen <[email protected]>Signed-off-by Adam Wallis <[email protected]>Signed-off-by Mathias Nyman <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
�drivers/usb/host/xhci-plat.c |� �16 ++++++++++------ �1 file changed, 10 insertions(+), 6 deletions(-)---
a/drivers/usb/host/xhci-plat.c
+++b/drivers/usb/host/xhci-plat.c
@@ -186,14 +186,18 @@ static int xhci_plat_probe(struct platfo
� � � � �* 2.xhci_platis child of a device from firmware (dwc3-plat) � � � � �* 3.xhci_platis grandchild of a pci device (dwc3-pci) � � � � �*/
-� � � �sysdev =&pdev->dev;
-� � � �if (sysdev->parent&& !sysdev->of_node &&sysdev->parent->of_node) -� � � � � � � �sysdev =sysdev->parent;
+� � � �for (sysdev =&pdev->dev; sysdev; sysdev =sysdev->parent) { +� � � � � � � �if (is_of_node(sysdev->fwnode)||
+� � � � � � � � � � � �is_acpi_device_node(sysdev->fwnode)) +� � � � � � � � � � � �break;
�#ifdefCONFIG_PCI
-� � � �else if (sysdev->parent&&sysdev->parent->parent&& -� � � � � � � �sysdev->parent->parent->bus==&pci_bus_type) -� � � � � � � �sysdev =sysdev->parent->parent;
+� � � � � � � �else if (sysdev->bus==&pci_bus_type) +� � � � � � � � � � � �break;
�#endif
+� � � �}
+
+� � � �if (!sysdev)
+� � � � � � � �sysdev =&pdev->dev;� � � � /* Try to set 64-bit DMA first */ � � � � if (
WARN_ON(!sysdev->dma_mask))This patch and Sriram's patches below should come together:
d64ff406e5("usb: dwc3: use bus->sysdev for DMA configuration")8c9f2de459("usb: dwc3: Do not set dma coherent mask")
a8c06e407e("usb: separate out sysdev pointer from usb_bus")
aeb78cda51("usb: chipidea: use bus->sysdev for DMA configuration")8123e4953f("usb: ehci: fsl: use
bus->sysdevfor DMA configuration")4c39d4b949("usb: xhci: use
bus->sysdevfor DMA configuration")Otherwise, the below issue still happen:
[�� 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5
�
Quoted 7 lines
The first 2 above patches are in linux-stable.git/linux-4.11.y. And all above Sriram's patches are in linux-stable.git/linux-4.12.y. This means we need the followings:
- Apply this patch and 4 missing Sriram's patches into linux-4.11.y.
- Apply this patch into linux-4.12.y
Huh? As Mathias said, all of the 4.11 and 4.12 patches are in 4.13, right? We better not have missed them, as that is _not_ how we do kernel development and version branching.
Can you please verify this?
Also note that 4.11.y and 4.12.y are end-of-life, and we in the community are not adding any new patches to it. If you have a crazy vendor that feels they want to maintain one of these kernel versions on their own, then please go talk to them about it :)
thanks,
greg k-h
Re: [PATCH 4.13 077/160] usb: host: xhci-plat: allow sysdev to inherit from ACPI
Quoted 111 lines · Greg Kroah-Hartman
Quoted 110 lines · Thang Q. Nguyen
Hi,
On Wed, Oct 11, 2017 at 2:50 AM, Greg Kroah-Hartman <[email protected]
Quoted 1 line
wrote:
4.13-stable review patch. If anyone has any objections, please let me know. ------------------ From: Adam Wallis <[email protected]> commit c6b8e79306f515b5483eb11076e0fbfc140434a8 upstream. Commit 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration") updated the method determining DMA for XHCI from sysdev. However, this patch broke the ability to enumerate the FWNODE from parent ACPI devices from the child plat XHCI device. Currently, xhci_plat is not set up properly when the parent device is an ACPI node. The conditions that xhci_plat_probe should satisfy are 1. xhci_plat comes from firmware 2. xhci_plat is child of a device from firmware (dwc3-plat) 3. xhci_plat is grandchild of a pci device (dwc3-pci) Case 2 is covered when the child is an OF node (by checking sysdev->parent->of_node), however, an ACPI parent will return NULL in the of_node check and will thus not result in sysdev being set to sysdev->parent [ 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5 This change adds a check for ACPI to completely allow for condition 2. This is done by first checking if the parent node is of type ACPI (e.g., dwc3-plat) and set sysdev to sysdev->parent if either of the two following conditions are met: 1: If fwnode is empty (in the case that platform_device_add_properties was not called on the allocated platform device) 2: fwnode exists but is not of type ACPI (this would happen if platform_device_add_properties was called on the allocated device. Instead of type FWNODE_ACPI, you would end up with FWNODE_PDATA) Fixes: 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration") Tested-by: Thang Q. Nguyen <[email protected]> Signed-off-by: Adam Wallis <[email protected]> Signed-off-by: Mathias Nyman <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]> --- drivers/usb/host/xhci-plat.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/drivers/usb/host/xhci-plat.c +++ b/drivers/usb/host/xhci-plat.c @@ -186,14 +186,18 @@ static int xhci_plat_probe(struct platfo * 2. xhci_plat is child of a device from firmware (dwc3-plat) * 3. xhci_plat is grandchild of a pci device (dwc3-pci) */ - sysdev = &pdev->dev; - if (sysdev->parent && !sysdev->of_node && sysdev->parent->of_node) - sysdev = sysdev->parent; + for (sysdev = &pdev->dev; sysdev; sysdev = sysdev->parent) { + if (is_of_node(sysdev->fwnode) || + is_acpi_device_node(sysdev->fwnode)) + break; #ifdef CONFIG_PCI - else if (sysdev->parent && sysdev->parent->parent && - sysdev->parent->parent->bus == &pci_bus_type) - sysdev = sysdev->parent->parent; + else if (sysdev->bus == &pci_bus_type) + break; #endif + } + + if (!sysdev) + sysdev = &pdev->dev; /* Try to set 64-bit DMA first */ if (WARN_ON(!sysdev->dma_mask))This patch and Sriram's patches below should come together:
d64ff406e5("usb: dwc3: use bus->sysdev for DMA configuration")8c9f2de459("usb: dwc3: Do not set dma coherent mask")
a8c06e407e("usb: separate out sysdev pointer from usb_bus")
aeb78cda51("usb: chipidea: use bus->sysdev for DMA configuration")8123e4953f("usb: ehci: fsl: use
bus->sysdevfor DMA configuration")4c39d4b949("usb: xhci: use
bus->sysdevfor DMA configuration")Otherwise, the below issue still happen:
[ 17.591549] xhci-hcd: probe of xhci-hcd.6.auto failed with error -5
The first 2 above patches are in linux-stable.git/linux-4.11.y. And all above Sriram's patches are in linux-stable.git/linux-4.12.y. This means we need the followings:
- Apply this patch and 4 missing Sriram's patches into linux-4.11.y.
Quoted 7 lines
Quoted 1 line
- Apply this patch into linux-4.12.y
Huh? As Mathias said, all of the 4.11 and 4.12 patches are in 4.13, right? We better not have missed them, as that is _not_ how we do kernel development and version branching.
Can you please verify this?
This patch applies directly on 4.13. All required patches are already in 4.13 as Mathias mentioned
Quoted 10 lines
Also note that 4.11.y and 4.12.y are end-of-life, and we in the community are not adding any new patches to it. If you have a crazy vendor that feels they want to maintain one of these kernel versions on their own, then please go talk to them about it :)
thanks,
greg k-h
Signature · 4 lines
Adam Wallis Qualcomm Datacenter Technologies as an affiliate of Qualcomm Technologies, Inc. Qualcomm Technologies, Inc. is a member of the Code Aurora Forum, a Linux Foundation Collaborative Project.
Greg Kroah-Hartman
maintainerPATCH 78/160 xhci: Fix sleeping with spin_lock_irq() held in ASmedia 1042A workaround
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 4ec1cd3eeeee7ccc35681270da028dbc29ca7bbd upstream.
The flow control workaround for ASM1042A xHC hosts sleeps between register polling. The workaround gets called in several places, among them with spin_lock_irq() held when xHC host is resumed or hoplug removed.
This was noticed as kernel panics at resume on a Dell XPS15 9550 with TB16 thunderbolt dock.
Avoid sleeping with spin_lock_irq() held, use udelay() instead
The original workaround was added to 4.9 and 4.12 stable releases, this patch needs to be applied to those as well.
--- drivers/usb/host/pci-quirks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/host/pci-quirks.c +1 -1
@@ -447,7 +447,7 @@ static int usb_asmedia_wait_write(structif ((value &ASMT_CONTROL_WRITE_BIT ) ==0 )return 0 ; -usleep_range (40 ,60 ); +udelay (50 ); }dev_warn (&pdev->dev,"%s: check_write_ready timeout" , __func__);
Greg Kroah-Hartman
maintainerPATCH 79/160 xhci: set missing SuperSpeedPlus Link Protocol bit in roothub descriptor
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 7bea22b124d77845c85a62eaa29a85ba6cc2f899 upstream.
A SuperSpeedPlus roothub needs to have the Link Protocol (LP) bit set in the bmSublinkSpeedAttr[] entry of a SuperSpeedPlus descriptor.
If the xhci controller has an optional Protocol Speed ID (PSI) table then that will be used as a base to create the roothub SuperSpeedPlus descriptor.
The PSI table does not however necessary contain the LP bit so we need to set it manually.
Check the psi speed and set LP bit if speed is 10Gbps or higher. We're not setting it for 5 to 10Gbps as USB 3.1 specification always mention SuperSpeedPlus for 10Gbps or higher, and some SSIC USB 3.0 speeds can be over 5Gbps, such as SSIC-G3B-L1 at 5830 Mbps
--- drivers/usb/host/xhci-hub.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-hub.c +10 -1
@@ -112,7 +112,7 @@ static int xhci_create_usb3_bos_desc(str/* If PSI table exists, add the custom speed attributes from it */ if (usb3_1 && xhci->usb3_rhub.psi_count) { -u32 ssp_cap_base, bm_attrib, psi; +u32 ssp_cap_base, bm_attrib, psi, psi_mant, psi_exp;int offset; ssp_cap_base =USB_DT_BOS_SIZE +USB_DT_USB_SS_CAP_SIZE ;
@@ -139,6 +139,15 @@ static int xhci_create_usb3_bos_desc(strfor (i =0 ; i < xhci->usb3_rhub.psi_count; i++) { psi = xhci->usb3_rhub.psi[i]; psi &= ~USB_SSP_SUBLINK_SPEED_RSVD ; + psi_exp =XHCI_EXT_PORT_PSIE (psi); + psi_mant =XHCI_EXT_PORT_PSIM (psi); + +/* Shift to Gbps and set SSP Link BIT(14) if 10Gpbs */ +for (; psi_exp <3 ; psi_exp++) + psi_mant /=1000 ; +if (psi_mant >=10 ) + psi |=BIT (14 ); +if ((psi &PLT_MASK ) ==PLT_SYM ) {/* Symmetric, create SSA RX and TX from one PSI entry */ put_unaligned_le32 (psi, &buf[offset]);
Greg Kroah-Hartman
maintainerPATCH 80/160 Revert "xhci: Limit USB2 port wake support for AMD Promontory hosts"
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit bcd6a7aa13800afc1418e6b29d944d882214939a upstream.
This reverts commit dec08194ffeccfa1cf085906b53d301930eae18f.
Commit dec08194ffec ("xhci: Limit USB2 port wake support for AMD Promontory hosts") makes all high speed USB ports on ASUS PRIME B350M-A cease to function after enabling runtime PM.
All boards with this chipsets will be affected, so revert the commit.
The original patch was added to stable 4.9, 4.11 and 4.12 and needs to reverted from there as well
--- drivers/usb/host/xhci-hub.c | 3 --- drivers/usb/host/xhci-pci.c | 12 ------------ drivers/usb/host/xhci.h | 2 +- 3 files changed, 1 insertion(+), 16 deletions(-)
drivers/usb/host/xhci-hub.c +0 -3
@@ -1482,9 +1482,6 @@ int xhci_bus_suspend(struct usb_hcd *hcd t2 |=PORT_WKOC_E |PORT_WKCONN_E ; t2 &= ~PORT_WKDISC_E ; } -if ((xhci->quirks &XHCI_U2_DISABLE_WAKE ) && - (hcd->speed <HCD_USB3 )) - t2 &= ~PORT_WAKE_BITS ; }else t2 &= ~PORT_WAKE_BITS ;
drivers/usb/host/xhci-pci.c +0 -12
@@ -54,11 +54,6 @@#define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 -#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 -#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba -#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb -#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc -#define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142static const char hcd_name[] ="xhci_hcd" ;
@@ -142,13 +137,6 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_AMD ) xhci->quirks |=XHCI_TRUST_TX_LENGTH ; -if ((pdev->vendor ==PCI_VENDOR_ID_AMD ) && - ((pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_4 ) || - (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_3 ) || - (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_2 ) || - (pdev->device ==PCI_DEVICE_ID_AMD_PROMONTORYA_1 ))) - xhci->quirks |=XHCI_U2_DISABLE_WAKE ; -if (pdev->vendor ==PCI_VENDOR_ID_INTEL ) { xhci->quirks |=XHCI_LPM_SUPPORT ; xhci->quirks |=XHCI_INTEL_HOST ;
drivers/usb/host/xhci.h +1 -1
@@ -1821,7 +1821,7 @@ struct xhci_hcd {/* For controller with a broken Port Disable implementation */ #define XHCI_BROKEN_PORT_PED (1 << 25)#define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) -#define XHCI_U2_DISABLE_WAKE (1 << 27) +/* Reserved. It was XHCI_U2_DISABLE_WAKE */ #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28)unsigned int num_active_eps;
Greg Kroah-Hartman
maintainerPATCH 81/160 iio: adc: twl4030: Fix an error handling path in twl4030_madc_probe()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 245a396a9b1a67ac5c3228737c261b3e48708a2a upstream.
If 'devm_regulator_get()' fails, we should go through the existing error handling path instead of returning directly, as done is all the other error handling paths in this function.
--- drivers/iio/adc/twl4030-madc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/iio/adc/twl4030-madc.c +4 -2
@@ -887,8 +887,10 @@ static int twl4030_madc_probe(struct pla/* Enable 3v1 bias regulator for MADC[3:6] */ madc->usb3v1 =devm_regulator_get (madc->dev,"vusb3v1" ); -if (IS_ERR (madc->usb3v1)) -return -ENODEV ; +if (IS_ERR (madc->usb3v1)) { + ret = -ENODEV ; + goto err_i2c; + } ret =regulator_enable (madc->usb3v1);if (ret)
Greg Kroah-Hartman
maintainerPATCH 82/160 iio: adc: twl4030: Disable the vusb3v1 rugulator in the error handling path of twl4030_madc_probe()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
commit 7f70be6e4025db0551e6863e7eb9cca07122695c upstream.
Commit 7cc97d77ee8a has introduced a call to 'regulator_disable()' in the .remove function.
So we should also have such a call in the .probe function in case of error after a successful 'regulator_enable()' call.
Add a new label for that and use it.
--- drivers/iio/adc/twl4030-madc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/adc/twl4030-madc.c +3 -1
@@ -899,11 +899,13 @@ static int twl4030_madc_probe(struct pla ret =iio_device_register (iio_dev);if (ret) {dev_err (&pdev->dev,"could not register iio device\n" ); - goto err_i2c; + goto err_usb3v1; }return 0 ; +err_usb3v1: +regulator_disable (madc->usb3v1); err_i2c:twl4030_madc_set_current_generator (madc,0 ,0 ); err_current_generator:
Greg Kroah-Hartman
maintainerPATCH 83/160 iio: ad_sigma_delta: Implement a dedicated reset function
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Bogdan <[email protected]>
commit 7fc10de8d49a748c476532c9d8e8fe19e548dd67 upstream.
Since most of the SD ADCs have the option of reseting the serial interface by sending a number of SCLKs with CS = 0 and DIN = 1, a dedicated function that can do this is usefull.
Needed for the patch: iio: ad7793: Fix the serial interface reset
--- drivers/iio/adc/ad_sigma_delta.c | 28 ++++++++++++++++++++++++++++ include/linux/iio/adc/ad_sigma_delta.h | 3 +++ 2 files changed, 31 insertions(+)
drivers/iio/adc/ad_sigma_delta.c +28 -0
@@ -177,6 +177,34 @@ out: }EXPORT_SYMBOL_GPL (ad_sd_read_reg); +/** +* ad_sd_reset() - Reset the serial interface +* +* @sigma_delta: The sigma delta device +* @reset_length: Number of SCLKs with DIN = 1 +* +* Returns 0 on success, an error code otherwise. +**/ +int ad_sd_reset (struct ad_sigma_delta *sigma_delta, +unsigned int reset_length) +{ +uint8_t *buf; +unsigned int size; +int ret; + + size =DIV_ROUND_UP (reset_length,8 ); + buf =kcalloc (size,sizeof (*buf),GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + +memset (buf,0xff , size); + ret =spi_write (sigma_delta->spi, buf, size); +kfree (buf); + +return ret; +} +EXPORT_SYMBOL_GPL (ad_sd_reset); +static int ad_sd_calibrate (struct ad_sigma_delta *sigma_delta,unsigned int mode,unsigned int channel) {
include/linux/iio/adc/ad_sigma_delta.h +3 -0
@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_deltint ad_sd_read_reg (struct ad_sigma_delta *sigma_delta,unsigned int reg,unsigned int size,unsigned int *val); +int ad_sd_reset (struct ad_sigma_delta *sigma_delta, +unsigned int reset_length); +int ad_sigma_delta_single_conversion (struct iio_dev *indio_dev,const struct iio_chan_spec *chan,int *val); int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta,
Greg Kroah-Hartman
maintainerPATCH 84/160 staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack.
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Popa <[email protected]>
commit f790923f146140a261ad211e5baf75d169f16fb2 upstream.
Depends on: 691c4b95d1 ("iio: ad_sigma_delta: Implement a dedicated reset function")
SPI host drivers can use DMA to transfer data, so the buffer should be properly allocated. Keeping it on the stack could cause an undefined behavior.
The dedicated reset function solves this issue.
--- drivers/staging/iio/adc/ad7192.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/staging/iio/adc/ad7192.c +1 -3
@@ -223,11 +223,9 @@ static int ad7192_setup(struct ad7192_ststruct iio_dev *indio_dev =spi_get_drvdata (st->sd.spi);unsigned long long scale_uv;int i, ret, id; -u8 ones[6 ];/* reset the serial interface */ -memset (&ones,0xFF ,6 ); - ret =spi_write (st->sd.spi, &ones,6 ); + ret =ad_sd_reset (&st->sd,48 );if (ret <0 ) goto out;usleep_range (500 ,1000 );/* Wait for at least 500us */
Greg Kroah-Hartman
maintainerPATCH 85/160 iio: core: Return error for failed read_reg
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Fornero <[email protected]>
commit 3d62c78a6eb9a7d67bace9622b66ad51e81c5f9b upstream.
If an IIO device returns an error code for a read access via debugfs, it is currently ignored by the IIO core (other than emitting an error message). Instead, return this error code to user space, so upper layers can detect it correctly.
--- drivers/iio/industrialio-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/iio/industrialio-core.c +3 -1
@@ -310,8 +310,10 @@ static ssize_t iio_debugfs_read_reg(stru ret = indio_dev->info->debugfs_reg_access (indio_dev, indio_dev->cached_reg_addr,0 , &val); -if (ret) +if (ret) {dev_err (indio_dev->dev.parent,"%s: read failed\n" , __func__); +return ret; + } len =snprintf (buf,sizeof (buf),"0x%X\n" , val);
Greg Kroah-Hartman
maintainerPATCH 86/160 IIO: BME280: Updates to Humidity readings need ctrl_reg write!
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Parker <[email protected]>
commit 4b1f0c31f96c45e8521dd84aae50f2aa4aecfb7b upstream.
The ctrl_reg register needs to be written after any write to the humidity registers. The value written to the ctrl_reg register does not necessarily need to change, but a write operation must occur.
The regmap_update_bits functions will not write to a register if the register value matches the value to be written. This saves unnecessary bus operations. The change in this patch forces a bus write during the chip_config operation by switching to regmap_write_bits.
This will fix issues where the Humidity Sensor Oversampling bits are not updated after initialization.
--- drivers/iio/pressure/bmp280-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/pressure/bmp280-core.c +1 -1
@@ -573,7 +573,7 @@ static int bmp280_chip_config(struct bmpu8 osrs =BMP280_OSRS_TEMP_X (data->oversampling_temp +1 ) |BMP280_OSRS_PRESS_X (data->oversampling_press +1 ); - ret = regmap_update_bits(data->regmap, BMP280_REG_CTRL_MEAS, + ret = regmap_write_bits(data->regmap, BMP280_REG_CTRL_MEAS, BMP280_OSRS_TEMP_MASK | BMP280_OSRS_PRESS_MASK | BMP280_MODE_MASK,
Greg Kroah-Hartman
maintainerPATCH 87/160 iio: trigger: stm32-timer: preset shouldnt be buffered
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 0a56eabc4e3f730782e4a9f3af4f60aa03a8a849 upstream.
Currently, setting preset value (ARR) will update directly 'Auto reload value' only on 1st write access. But then, ARPE is set. This makes ARR a shadow register. Preset value should be updated upon each write request: ensure ARPE is 0. This fixes successive writes to preset attribute.
--- drivers/iio/trigger/stm32-timer-trigger.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/iio/trigger/stm32-timer-trigger.c +2 -1
@@ -679,8 +679,9 @@ static ssize_t stm32_count_set_preset(stif (ret)return ret; +/* TIMx_ARR register shouldn't be buffered (ARPE=0) */ +regmap_update_bits (priv->regmap,TIM_CR1 ,TIM_CR1_ARPE ,0 );regmap_write (priv->regmap,TIM_ARR , preset); -regmap_update_bits (priv->regmap,TIM_CR1 ,TIM_CR1_ARPE ,TIM_CR1_ARPE );return len; }
Greg Kroah-Hartman
maintainerPATCH 88/160 iio: trigger: stm32-timer: fix a corner case to write preset
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit b7a9776c1f9443326632486fcbd82dca82f8511e upstream.
Balance timer start routine that sets ARPE: clear it in stop routine. This fixes a corner case, when timer is used successively as trigger (with sampling_frequency start/stop routines), then as a counter (with preset).
--- drivers/iio/trigger/stm32-timer-trigger.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/trigger/stm32-timer-trigger.c +1 -0
@@ -138,6 +138,7 @@ static void stm32_timer_stop(struct stm3clk_disable (priv->clk);/* Stop timer */ +regmap_update_bits (priv->regmap,TIM_CR1 ,TIM_CR1_ARPE ,0 );regmap_update_bits (priv->regmap,TIM_CR1 ,TIM_CR1_CEN ,0 );regmap_write (priv->regmap,TIM_PSC ,0 );regmap_write (priv->regmap,TIM_ARR ,0 );
Greg Kroah-Hartman
maintainerPATCH 89/160 iio: ad7793: Fix the serial interface reset
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Bogdan <[email protected]>
commit 7ee3b7ebcb74714df6d94c8f500f307e1ee5dda5 upstream.
The serial interface can be reset by writing 32 consecutive 1s to the device. 'ret' was initialized correctly but its value was overwritten when ad7793_check_platform_data() was called. Since a dedicated reset function is present now, it should be used instead.
--- drivers/iio/adc/ad7793.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/iio/adc/ad7793.c +2 -2
@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev * unsigned int vref_mv) {struct ad7793_state *st =iio_priv (indio_dev); -int i, ret =-1 ; +int i, ret;unsigned long long scale_uv;u32 id;
@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *return ret;/* reset the serial interface */ - ret =spi_write (st->sd.spi, (u8 *)&ret,sizeof (ret)); + ret =ad_sd_reset (&st->sd,32 );if (ret <0 ) goto out;usleep_range (500 ,2000 );/* Wait for at least 500us */
Greg Kroah-Hartman
maintainerPATCH 90/160 iio: adc: stm32: fix bad error check on max_channels
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabrice Gasnier <[email protected]>
commit 4fb840c95f82652cece7352be9080884cafb92a0 upstream.
Fix a bad error check when counting 'st,adc-channels' array elements. This is seen when all channels are in use simultaneously.
--- drivers/iio/adc/stm32-adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/stm32-adc.c +1 -1
@@ -1543,7 +1543,7 @@ static int stm32_adc_chan_of_init(struct num_channels =of_property_count_u32_elems (node,"st,adc-channels" );if (num_channels <0 || - num_channels >= adc_info->max_channels) { + num_channels > adc_info->max_channels) {dev_err (&indio_dev->dev,"Bad st,adc-channels?\n" );return num_channels <0 ? num_channels : -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 91/160 iio: adc: mcp320x: Fix readout of negative voltages
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit e6f4794371ee7cce1339e7ca9542f1e703c5f84a upstream.
Commit f686a36b4b79 ("iio: adc: mcp320x: Add support for mcp3301") returns a signed voltage from mcp320x_adc_conversion() but neglects that the caller interprets a negative return value as failure. Only mcp3301 (and the upcoming mcp3550/1/3) is affected as the other chips are incapable of measuring negative voltages.
Fix and while at it, add mcp3301 to the list of supported chips at the top of the file.
--- drivers/iio/adc/mcp320x.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-)
drivers/iio/adc/mcp320x.c +15 -9
@@ -17,6 +17,8 @@* MCP3204 * MCP3208 * ------------ +* 13 bit converter +* MCP3301 * * Datasheet can be found here: * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001
@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(in }static int mcp320x_adc_conversion (struct mcp320x *adc,u8 channel, -bool differential,int device_index) +bool differential,int device_index,int *val) {int ret;
@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(structswitch (device_index) {case mcp3001: -return (adc->rx_buf[0 ] <<5 | adc->rx_buf[1 ] >>3 ); + *val = (adc->rx_buf[0 ] <<5 | adc->rx_buf[1 ] >>3 ); +return 0 ;case mcp3002:case mcp3004:case mcp3008: -return (adc->rx_buf[0 ] <<2 | adc->rx_buf[1 ] >>6 ); + *val = (adc->rx_buf[0 ] <<2 | adc->rx_buf[1 ] >>6 ); +return 0 ;case mcp3201: -return (adc->rx_buf[0 ] <<7 | adc->rx_buf[1 ] >>1 ); + *val = (adc->rx_buf[0 ] <<7 | adc->rx_buf[1 ] >>1 ); +return 0 ;case mcp3202:case mcp3204:case mcp3208: -return (adc->rx_buf[0 ] <<4 | adc->rx_buf[1 ] >>4 ); + *val = (adc->rx_buf[0 ] <<4 | adc->rx_buf[1 ] >>4 ); +return 0 ;case mcp3301: -return sign_extend32 ((adc->rx_buf[0 ] &0x1f ) <<8 | adc->rx_buf[1 ],12 ); + *val =sign_extend32 ((adc->rx_buf[0 ] &0x1f ) <<8 + | adc->rx_buf[1 ],12 ); +return 0 ;default :return -EINVAL ; }
@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dswitch (mask) {case IIO_CHAN_INFO_RAW : ret =mcp320x_adc_conversion (adc, channel->address, - channel->differential, device_index); - + channel->differential, device_index, val);if (ret <0 ) goto out; - *val = ret; ret =IIO_VAL_INT ;break ;
Greg Kroah-Hartman
maintainerPATCH 92/160 iio: adc: mcp320x: Fix oops on module unload
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 0964e40947a630a2a6f724e968246992f97bcf1c upstream.
The driver calls spi_get_drvdata() in its ->remove hook even though it has never called spi_set_drvdata(). Stack trace for posterity:
Unable to handle kernel NULL pointer dereference at virtual address 00000220 Internal error: Oops: 5 [#1] SMP ARM [<8072f564>] (mutex_lock) from [<7f1400d0>] (iio_device_unregister+0x24/0x7c [industrialio]) [<7f1400d0>] (iio_device_unregister [industrialio]) from [<7f15e020>] (mcp320x_remove+0x20/0x30 [mcp320x]) [<7f15e020>] (mcp320x_remove [mcp320x]) from [<8055a8cc>] (spi_drv_remove+0x2c/0x44) [<8055a8cc>] (spi_drv_remove) from [<805087bc>] (__device_release_driver+0x98/0x134) [<805087bc>] (__device_release_driver) from [<80509180>] (driver_detach+0xdc/0xe0) [<80509180>] (driver_detach) from [<8050823c>] (bus_remove_driver+0x5c/0xb0) [<8050823c>] (bus_remove_driver) from [<80509ab0>] (driver_unregister+0x38/0x58) [<80509ab0>] (driver_unregister) from [<7f15e69c>] (mcp320x_driver_exit+0x14/0x1c [mcp320x]) [<7f15e69c>] (mcp320x_driver_exit [mcp320x]) from [<801a78d0>] (SyS_delete_module+0x184/0x1d0) [<801a78d0>] (SyS_delete_module) from [<80108100>] (ret_fast_syscall+0x0/0x1c)
--- drivers/iio/adc/mcp320x.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/adc/mcp320x.c +1 -0
@@ -318,6 +318,7 @@ static int mcp320x_probe(struct spi_devi indio_dev->name =spi_get_device_id (spi)->name; indio_dev->modes =INDIO_DIRECT_MODE ; indio_dev->info = &mcp320x_info; +spi_set_drvdata (spi, indio_dev); chip_info = &mcp320x_chip_infos[spi_get_device_id (spi)->driver_data]; indio_dev->channels = chip_info->channels;
Greg Kroah-Hartman
maintainerPATCH 93/160 uwb: properly check kthread_run return value
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit bbf26183b7a6236ba602f4d6a2f7cade35bba043 upstream.
uwbd_start() calls kthread_run() and checks that the return value is not NULL. But the return value is not NULL in case kthread_run() fails, it takes the form of ERR_PTR(-EINTR).
Use IS_ERR() instead.
Also add a check to uwbd_stop().
--- drivers/uwb/uwbd.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/uwb/uwbd.c +8 -4
@@ -302,18 +302,22 @@ static int uwbd(void *param)/** Start the UWB daemon */ void uwbd_start (struct uwb_rc *rc) { - rc->uwbd.task =kthread_run (uwbd, rc,"uwbd" ); -if (rc->uwbd.task ==NULL ) +struct task_struct *task =kthread_run (uwbd, rc,"uwbd" ); +if (IS_ERR (task)) { + rc->uwbd.task =NULL ;printk (KERN_ERR "UWB: Cannot start management daemon; " "UWB won't work\n" ); -else + }else { + rc->uwbd.task = task; rc->uwbd.pid = rc->uwbd.task->pid; + } }/* Stop the UWB daemon and free any unprocessed events */ void uwbd_stop (struct uwb_rc *rc) { -kthread_stop (rc->uwbd.task); +if (rc->uwbd.task) +kthread_stop (rc->uwbd.task);uwbd_flush (rc); }
Greg Kroah-Hartman
maintainerPATCH 94/160 uwb: ensure that endpoint is interrupt
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Konovalov <[email protected]>
commit 70e743e4cec3733dc13559f6184b35d358b9ef3f upstream.
hwarc_neep_init() assumes that endpoint 0 is interrupt, but there's no check for that, which results in a WARNING in USB core code, when a bad USB descriptor is provided from a device:
usb 1-1: BOGUS urb xfer, pipe 1 != type 3
------------[ cut here ]------------ WARNING: CPU: 0 PID: 3 at drivers/usb/core/urb.c:449 usb_submit_urb+0xf8a/0x11d0 Modules linked in: CPU: 0 PID: 3 Comm: kworker/0:0 Not tainted 4.13.0+ #111 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: usb_hub_wq hub_event task: ffff88006bdc1a00 task.stack: ffff88006bde8000 RIP: 0010:usb_submit_urb+0xf8a/0x11d0 drivers/usb/core/urb.c:448 RSP: 0018:ffff88006bdee3c0 EFLAGS: 00010282 RAX: 0000000000000029 RBX: ffff8800672a7200 RCX: 0000000000000000 RDX: 0000000000000029 RSI: ffff88006c815c78 RDI: ffffed000d7bdc6a RBP: ffff88006bdee4c0 R08: fffffbfff0fe00ff R09: fffffbfff0fe00ff R10: 0000000000000018 R11: fffffbfff0fe00fe R12: 1ffff1000d7bdc7f R13: 0000000000000003 R14: 0000000000000001 R15: ffff88006b02cc90 FS: 0000000000000000(0000) GS:ffff88006c800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fe4daddf000 CR3: 000000006add6000 CR4: 00000000000006f0 Call Trace: hwarc_neep_init+0x4ce/0x9c0 drivers/uwb/hwa-rc.c:710 uwb_rc_add+0x2fb/0x730 drivers/uwb/lc-rc.c:361 hwarc_probe+0x34e/0x9b0 drivers/uwb/hwa-rc.c:858 usb_probe_interface+0x351/0x8d0 drivers/usb/core/driver.c:361 really_probe drivers/base/dd.c:385 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463 __device_attach+0x269/0x3c0 drivers/base/dd.c:682 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523 device_add+0xcf9/0x1640 drivers/base/core.c:1703 usb_set_configuration+0x1064/0x1890 drivers/usb/core/message.c:1932 generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174 usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266 really_probe drivers/base/dd.c:385 driver_probe_device+0x610/0xa00 drivers/base/dd.c:529 __device_attach_driver+0x230/0x290 drivers/base/dd.c:625 bus_for_each_drv+0x15e/0x210 drivers/base/bus.c:463 __device_attach+0x269/0x3c0 drivers/base/dd.c:682 device_initial_probe+0x1f/0x30 drivers/base/dd.c:729 bus_probe_device+0x1da/0x280 drivers/base/bus.c:523 device_add+0xcf9/0x1640 drivers/base/core.c:1703 usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457 hub_port_connect drivers/usb/core/hub.c:4890 hub_port_connect_change drivers/usb/core/hub.c:4996 port_event drivers/usb/core/hub.c:5102 hub_event+0x23c8/0x37c0 drivers/usb/core/hub.c:5182 process_one_work+0x9fb/0x1570 kernel/workqueue.c:2097 worker_thread+0x1e4/0x1350 kernel/workqueue.c:2231 kthread+0x324/0x3f0 kernel/kthread.c:231 ret_from_fork+0x25/0x30 arch/x86/entry/entry_64.S:425 Code: 48 8b 85 30 ff ff ff 48 8d b8 98 00 00 00 e8 8e 93 07 ff 45 89 e8 44 89 f1 4c 89 fa 48 89 c6 48 c7 c7 a0 e5 55 86 e8 20 08 8f fd <0f> ff e9 9b f7 ff ff e8 4a 04 d6 fd e9 80 f7 ff ff e8 60 11 a6 ---[ end trace 55d741234124cfc3 ]---
Check that endpoint is interrupt.
Found by syzkaller.
--- drivers/uwb/hwa-rc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/uwb/hwa-rc.c +2 -0
@@ -825,6 +825,8 @@ static int hwarc_probe(struct usb_interfif (iface->cur_altsetting->desc.bNumEndpoints <1 )return -ENODEV ; +if (!usb_endpoint_xfer_int (&iface->cur_altsetting->endpoint[0 ].desc)) +return -ENODEV ; result = -ENOMEM ; uwb_rc =uwb_rc_alloc ();
Greg Kroah-Hartman
maintainerPATCH 95/160 staging: vchiq_2835_arm: Fix NULL ptr dereference in free_pagelist
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
commit 974d4d03fc020af4fa4e9e72a86f0fefa37803c5 upstream.
This fixes a NULL pointer dereference on RPi 2 with multi_v7_defconfig. The function page_address() could return NULL with enabled CONFIG_HIGHMEM. So fix this by using kmap() instead.
--- drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/staging/vc04_services/interface/vchiq_arm/vchiq_2835_arm.c +4 -2
@@ -612,18 +612,20 @@ free_pagelist(struct vchiq_pagelist_infoif (head_bytes > actual) head_bytes = actual; -memcpy ((char *)page_address (pages[0 ]) + +memcpy ((char *)kmap (pages[0 ]) + pagelist->offset, fragments, head_bytes); +kunmap (pages[0 ]); }if ((actual >=0 ) && (head_bytes < actual) && (tail_bytes !=0 )) { -memcpy ((char *)page_address (pages[num_pages -1 ]) + +memcpy ((char *)kmap (pages[num_pages -1 ]) + ((pagelist->offset + actual) & (PAGE_SIZE -1 ) & ~(g_cache_line_size -1 )), fragments + g_cache_line_size, tail_bytes); +kunmap (pages[num_pages -1 ]); }down (&g_free_fragments_mutex);
Greg Kroah-Hartman
maintainerPATCH 96/160 ksm: fix unlocked iteration over vmas in cmp_and_merge_page()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill Tkhai <[email protected]>
commit 4b22927f0cbd58303aac689e378d20bf56267a39 upstream.
In this place mm is unlocked, so vmas or list may change. Down read mmap_sem to protect them from modifications.
--- mm/ksm.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
mm/ksm.c +4 -1
@@ -1990,6 +1990,7 @@ static void stable_tree_append(struct rm*/ static void cmp_and_merge_page (struct page *page,struct rmap_item *rmap_item) { +struct mm_struct *mm = rmap_item->mm;struct rmap_item *tree_rmap_item;struct page *tree_page =NULL ;struct stable_node *stable_node;
@@ -2062,9 +2063,11 @@ static void cmp_and_merge_page(struct paif (ksm_use_zero_pages && (checksum == zero_checksum)) {struct vm_area_struct *vma; - vma =find_mergeable_vma (rmap_item->mm, rmap_item->address); +down_read (&mm->mmap_sem); + vma =find_mergeable_vma (mm, rmap_item->address); err =try_to_merge_one_page (vma, page,ZERO_PAGE (rmap_item->address)); +up_read (&mm->mmap_sem);/* * In case of failure, the page was not really empty, so we * need to continue. Otherwise we're done.
Greg Kroah-Hartman
maintainerPATCH 97/160 mm, hugetlb, soft_offline: save compound page order before page migration
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Moise <[email protected]>
commit 19bfbe22f59a207417b2679e7e83c180419c9ec5 upstream.
This fixes a bug in madvise() where if you'd try to soft offline a hugepage via madvise(), while walking the address range you'd end up, using the wrong page offset due to attempting to get the compound order of a former but presently not compound page, due to dissolving the huge page (since commit c3114a84f7f9: "mm: hugetlb: soft-offline: dissolve source hugepage after successful migration").
As a result I ended up with all my free pages except one being offlined.
--- mm/madvise.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
mm/madvise.c +10 -2
@@ -614,18 +614,26 @@ static int madvise_inject_error(int beha {struct page *page;struct zone *zone; +unsigned int order;if (!capable (CAP_SYS_ADMIN ))return -EPERM ; -for (; start < end; start +=PAGE_SIZE << -compound_order (compound_head (page))) { + +for (; start < end; start +=PAGE_SIZE << order) {int ret; ret =get_user_pages_fast (start,1 ,0 , &page);if (ret !=1 )return ret; +/* +* When soft offlining hugepages, after migrating the page +* we dissolve it, therefore in the second loop "page" will +* no longer be a compound page, and order will be 0. +*/ + order =compound_order (compound_head (page)); +if (PageHWPoison (page)) {put_page (page);continue ;
Greg Kroah-Hartman
maintainerPATCH 98/160 mm, oom_reaper: skip mm structs with mmu notifiers
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 4d4bbd8526a8fbeb2c090ea360211fceff952383 upstream.
Andrea has noticed that the oom_reaper doesn't invalidate the range via mmu notifiers (mmu_notifier_invalidate_range_start/end) and that can corrupt the memory of the kvm guest for example.
tlb_flush_mmu_tlbonly already invokes mmu notifiers but that is not sufficient as per Andrea:
"mmu_notifier_invalidate_range cannot be used in replacement of
mmu_notifier_invalidate_range_start/end. For KVM mmu_notifier_invalidate_range is a noop and rightfully so. A MMU notifier implementation has to implement either ->invalidate_range method or the invalidate_range_start/end methods, not both. And if you implement invalidate_range_start/end like KVM is forced to do, calling mmu_notifier_invalidate_range in common code is a noop for KVM.
For those MMU notifiers that can get away only implementing ->invalidate_range, the ->invalidate_range is implicitly called by mmu_notifier_invalidate_range_end(). And only those secondary MMUs that share the same pagetable with the primary MMU (like AMD iommuv2) can get away only implementing ->invalidate_range"
As the callback is allowed to sleep and the implementation is out of hand of the MM it is safer to simply bail out if there is an mmu notifier registered. In order to not fail too early make the mm_has_notifiers check under the oom_lock and have a little nap before failing to give the current oom victim some more time to exit.
--- include/linux/mmu_notifier.h | 5 +++++ mm/oom_kill.c | 16 ++++++++++++++++ 2 files changed, 21 insertions(+)
include/linux/mmu_notifier.h +5 -0
@@ -400,6 +400,11 @@ extern void mmu_notifier_synchronize(voi#else /* CONFIG_MMU_NOTIFIER */ +static inline int mm_has_notifiers (struct mm_struct *mm) +{ +return 0 ; +} +static inline void mmu_notifier_release (struct mm_struct *mm) { }
mm/oom_kill.c +16 -0
@@ -40,6 +40,7 @@#include <linux/ratelimit.h> #include <linux/kthread.h> #include <linux/init.h> +#include <linux/mmu_notifier.h> #include <asm/tlb.h> #include "internal.h"
@@ -494,6 +495,21 @@ static bool __oom_reap_task_mm(struct ta goto unlock_oom; } +/* +* If the mm has notifiers then we would need to invalidate them around +* unmap_page_range and that is risky because notifiers can sleep and +* what they do is basically undeterministic. So let's have a short +* sleep to give the oom victim some more time. +* TODO: we really want to get rid of this ugly hack and make sure that +* notifiers cannot block for unbounded amount of time and add +* mmu_notifier_invalidate_range_{start,end} around unmap_page_range +*/ +if (mm_has_notifiers (mm)) { +up_read (&mm->mmap_sem); +schedule_timeout_idle (HZ ); + goto unlock_oom; + } +/* * increase mm_users only after we know we will reap something so * that the mmput_async is called only when we have reaped something
Greg Kroah-Hartman
maintainerPATCH 99/160 mm: fix RODATA_TEST failure "rodata_test: test data was not read only"
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit a872eb2131e91ce7c89a8888974a5e22a272b12f upstream.
On powerpc, RODATA_TEST fails with message the following messages:
Freeing unused kernel memory: 528K
rodata_test: test data was not read only
This is because GCC allocates it to .data section:
c0695034 g O .data 00000004 rodata_test_data
Since commit 056b9d8a7692 ("mm: remove rodata_test_data export, add pr_fmt"), rodata_test_data is used only inside rodata_test.c By declaring it static, it gets properly allocated into .rodata section instead of .data:
c04df710 l O .rodata 00000004 rodata_test_data
--- mm/rodata_test.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/rodata_test.c +1 -1
@@ -14,7 +14,7 @@#include <linux/uaccess.h> #include <asm/sections.h> -const int rodata_test_data =0xC3 ; +static const int rodata_test_data =0xC3 ;void rodata_test (void ) {
Greg Kroah-Hartman
maintainerPATCH 100/160 mm: avoid marking swap cached page as lazyfree
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 24c92eb7dce0a299b8e1a8c5fa585844a53bf7f0 upstream.
MADV_FREE clears pte dirty bit and then marks the page lazyfree (clear SwapBacked). There is no lock to prevent the page is added to swap cache between these two steps by page reclaim. Page reclaim could add the page to swap cache and unmap the page. After page reclaim, the page is added back to lru. At that time, we probably start draining per-cpu pagevec and mark the page lazyfree. So the page could be in a state with SwapBacked cleared and PG_swapcache set. Next time there is a refault in the virtual address, do_swap_page can find the page from swap cache but the page has PageSwapCache false because SwapBacked isn't set, so do_swap_page will bail out and do nothing. The task will keep running into fault handler.
--- mm/swap.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
mm/swap.c +2 -2
@@ -575,7 +575,7 @@ static void lru_lazyfree_fn(struct page void *arg) {if (PageLRU (page) &&PageAnon (page) &&PageSwapBacked (page) && - !PageUnevictable (page)) { + !PageSwapCache (page) && !PageUnevictable (page)) {bool active =PageActive (page); del_page_from_lru_list(page, lruvec,
@@ -665,7 +665,7 @@ void deactivate_file_page(struct page *pvoid mark_page_lazyfree (struct page *page) {if (PageLRU (page) &&PageAnon (page) &&PageSwapBacked (page) && - !PageUnevictable (page)) { + !PageSwapCache (page) && !PageUnevictable (page)) {struct pagevec *pvec = &get_cpu_var (lru_lazyfree_pvecs);get_page (page);
Greg Kroah-Hartman
maintainerPATCH 101/160 mm: fix data corruption caused by lazyfree page
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 9625456cc76391b7f3f2809579126542a8ed4d39 upstream.
MADV_FREE clears pte dirty bit and then marks the page lazyfree (clear SwapBacked). There is no lock to prevent the page is added to swap cache between these two steps by page reclaim. If page reclaim finds such page, it will simply add the page to swap cache without pageout the page to swap because the page is marked as clean. Next time, page fault will read data from the swap slot which doesn't have the original data, so we have a data corruption. To fix issue, we mark the page dirty and pageout the page.
However, we shouldn't dirty all pages which is clean and in swap cache. swapin page is swap cache and clean too. So we only dirty page which is added into swap cache in page reclaim, which shouldn't be swapin page. As Minchan suggested, simply dirty the page in add_to_swap can do the job.
--- mm/swap_state.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
mm/swap_state.c +11 -0
@@ -219,6 +219,17 @@ int add_to_swap(struct page *page)* clear SWAP_HAS_CACHE flag. */ goto fail; +/* +* Normally the page will be dirtied in unmap because its pte should be +* dirty. A special case is MADV_FREE page. The page'e pte could have +* dirty bit cleared but the page's SwapBacked bit is still set because +* clearing the dirty bit and SwapBacked bit has no lock protected. For +* such page, unmap will not set dirty bit for it, so page reclaim will +* not write the page out. This can cause data corruption when the page +* is swap in later. Always setting the dirty bit for the page solves +* the problem. +*/ +set_page_dirty (page);return 1 ;
Greg Kroah-Hartman
maintainerPATCH 102/160 userfaultfd: non-cooperative: fix fork use after free
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea Arcangeli <[email protected]>
commit 384632e67e0829deb8015ee6ad916b180049d252 upstream.
When reading the event from the uffd, we put it on a temporary fork_event list to detect if we can still access it after releasing and retaking the event_wqh.lock.
If fork aborts and removes the event from the fork_event all is fine as long as we're still in the userfault read context and fork_event head is still alive.
We've to put the event allocated in the fork kernel stack, back from fork_event list-head to the event_wqh head, before returning from userfaultfd_ctx_read, because the fork_event head lifetime is limited to the userfaultfd_ctx_read stack lifetime.
Forgetting to move the event back to its event_wqh place then results in __remove_wait_queue(&ctx->event_wqh, &ewq->wq); in userfaultfd_event_wait_completion to remove it from a head that has been already freed from the reader stack.
This could only happen if resolve_userfault_fork failed (for example if there are no file descriptors available to allocate the fork uffd). If it succeeded it was put back correctly.
Furthermore, after find_userfault_evt receives a fork event, the forked userfault context in fork_nctx and uwq->msg.arg.reserved.reserved1 can be released by the fork thread as soon as the event_wqh.lock is released. Taking a reference on the fork_nctx before dropping the lock prevents an use after free in resolve_userfault_fork().
If the fork side aborted and it already released everything, we still try to succeed resolve_userfault_fork(), if possible.
--- fs/userfaultfd.c | 66 ++++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 56 insertions(+), 10 deletions(-)
fs/userfaultfd.c +56 -10
@@ -566,6 +566,12 @@ static void userfaultfd_event_wait_complbreak ;if (ACCESS_ONCE (ctx->released) ||fatal_signal_pending (current)) { +/* +* &ewq->wq may be queued in fork_event, but +* __remove_wait_queue ignores the head +* parameter. It would be a problem if it +* didn't. +*/ __remove_wait_queue (&ctx->event_wqh, &ewq->wq);if (ewq->msg.event ==UFFD_EVENT_FORK ) {struct userfaultfd_ctx *new;
@@ -1039,6 +1045,12 @@ static ssize_t userfaultfd_ctx_read(stru (unsigned long ) uwq->msg.arg.reserved.reserved1;list_move (&uwq->wq.entry, &fork_event); +/* +* fork_nctx can be freed as soon as +* we drop the lock, unless we take a +* reference on it. +*/ +userfaultfd_ctx_get (fork_nctx);spin_unlock (&ctx->event_wqh.lock); ret =0 ;break ;
@@ -1069,19 +1081,53 @@ static ssize_t userfaultfd_ctx_read(struif (!ret && msg->event ==UFFD_EVENT_FORK ) { ret =resolve_userfault_fork (ctx, fork_nctx, msg); +spin_lock (&ctx->event_wqh.lock); +if (!list_empty (&fork_event)) { +/* +* The fork thread didn't abort, so we can +* drop the temporary refcount. +*/ +userfaultfd_ctx_put (fork_nctx); + + uwq =list_first_entry (&fork_event, +typeof (*uwq), + wq.entry); +/* +* If fork_event list wasn't empty and in turn +* the event wasn't already released by fork +* (the event is allocated on fork kernel +* stack), put the event back to its place in +* the event_wq. fork_event head will be freed +* as soon as we return so the event cannot +* stay queued there no matter the current +* "ret" value. +*/ +list_del (&uwq->wq.entry); +__add_wait_queue (&ctx->event_wqh, &uwq->wq); -if (!ret) { -spin_lock (&ctx->event_wqh.lock); -if (!list_empty (&fork_event)) { - uwq =list_first_entry (&fork_event, -typeof (*uwq), - wq.entry); -list_del (&uwq->wq.entry); -__add_wait_queue (&ctx->event_wqh, &uwq->wq); +/* +* Leave the event in the waitqueue and report +* error to userland if we failed to resolve +* the userfault fork. +*/ +if (likely (!ret))userfaultfd_event_complete (ctx, uwq); - } -spin_unlock (&ctx->event_wqh.lock); + }else { +/* +* Here the fork thread aborted and the +* refcount from the fork thread on fork_nctx +* has already been released. We still hold +* the reference we took before releasing the +* lock above. If resolve_userfault_fork +* failed we've to drop it because the +* fork_nctx has to be freed in such case. If +* it succeeded we'll hold it because the new +* uffd references it. +*/ +if (ret) +userfaultfd_ctx_put (fork_nctx); } +spin_unlock (&ctx->event_wqh.lock); }return ret;
Greg Kroah-Hartman
maintainerPATCH 103/160 lib/ratelimit.c: use deferred printk() version
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <[email protected]>
commit 656d61ce9666209c4c4a13c71902d3ee70d1ff6f upstream.
printk_ratelimit() invokes ___ratelimit() which may invoke a normal printk() (pr_warn() in this particular case) to warn about suppressed output. Given that printk_ratelimit() may be called from anywhere, that pr_warn() is dangerous - it may end up deadlocking the system. Fix ___ratelimit() by using deferred printk().
Sasha reported the following lockdep error:
: Unregister pv shared memory for cpu 8
: select_fallback_rq: 3 callbacks suppressed
: process 8583 (trinity-c78) no longer affine to cpu8 :
: ====================================================== : WARNING: possible circular locking dependency detected : 4.14.0-rc2-next-20170927+ #252 Not tainted
: ------------------------------------------------------ : migration/8/62 is trying to acquire lock:
: (&port_lock_key){-.-.}, at: serial8250_console_write() :
: but task is already holding lock:
: (&rq->lock){-.-.}, at: sched_cpu_dying()
:
: which lock already depends on the new lock.
:
:
: the existing dependency chain (in reverse order) is:
:
: -> #3 (&rq->lock){-.-.}:
: __lock_acquire()
: lock_acquire()
: _raw_spin_lock()
: task_fork_fair()
: sched_fork()
: copy_process.part.31()
: _do_fork()
: kernel_thread()
: rest_init()
: start_kernel()
: x86_64_start_reservations()
: x86_64_start_kernel()
: verify_cpu()
:
: -> #2 (&p->pi_lock){-.-.}:
: __lock_acquire()
: lock_acquire()
: _raw_spin_lock_irqsave()
: try_to_wake_up()
: default_wake_function()
: woken_wake_function()
: __wake_up_common()
: __wake_up_common_lock()
: __wake_up()
: tty_wakeup()
: tty_port_default_wakeup()
: tty_port_tty_wakeup()
: uart_write_wakeup()
: serial8250_tx_chars()
: serial8250_handle_irq.part.25()
: serial8250_default_handle_irq()
: serial8250_interrupt()
: __handle_irq_event_percpu()
: handle_irq_event_percpu()
: handle_irq_event()
: handle_level_irq()
: handle_irq()
: do_IRQ()
: ret_from_intr()
: native_safe_halt()
: default_idle()
: arch_cpu_idle()
: default_idle_call()
: do_idle()
: cpu_startup_entry()
: rest_init()
: start_kernel()
: x86_64_start_reservations()
: x86_64_start_kernel()
: verify_cpu()
:
: -> #1 (&tty->write_wait){-.-.}:
: __lock_acquire()
: lock_acquire()
: _raw_spin_lock_irqsave()
: __wake_up_common_lock()
: __wake_up()
: tty_wakeup()
: tty_port_default_wakeup()
: tty_port_tty_wakeup()
: uart_write_wakeup()
: serial8250_tx_chars()
: serial8250_handle_irq.part.25()
: serial8250_default_handle_irq()
: serial8250_interrupt()
: __handle_irq_event_percpu()
: handle_irq_event_percpu()
: handle_irq_event()
: handle_level_irq()
: handle_irq()
: do_IRQ()
: ret_from_intr()
: native_safe_halt()
: default_idle()
: arch_cpu_idle()
: default_idle_call()
: do_idle()
: cpu_startup_entry()
: rest_init()
: start_kernel()
: x86_64_start_reservations()
: x86_64_start_kernel()
: verify_cpu()
:
: -> #0 (&port_lock_key){-.-.}:
: check_prev_add()
: __lock_acquire()
: lock_acquire()
: _raw_spin_lock_irqsave()
: serial8250_console_write()
: univ8250_console_write()
: console_unlock()
: vprintk_emit()
: vprintk_default()
: vprintk_func()
: printk()
: ___ratelimit()
: __printk_ratelimit()
: select_fallback_rq()
: sched_cpu_dying()
: cpuhp_invoke_callback()
: take_cpu_down()
: multi_cpu_stop()
: cpu_stopper_thread()
: smpboot_thread_fn()
: kthread()
: ret_from_fork()
:
: other info that might help us debug this:
:
: Chain exists of:
: &port_lock_key --> &p->pi_lock --> &rq->lock
:
: Possible unsafe locking scenario:
:
: CPU0 CPU1 : ---- ----
: lock(&rq->lock);
: lock(&p->pi_lock);
: lock(&rq->lock);
: lock(&port_lock_key);
:
: *** DEADLOCK ***
:
: 4 locks held by migration/8/62:
: #0: (&p->pi_lock){-.-.}, at: sched_cpu_dying()
: #1: (&rq->lock){-.-.}, at: sched_cpu_dying()
: #2: (printk_ratelimit_state.lock){....}, at: ___ratelimit()
: #3: (console_lock){+.+.}, at: vprintk_emit()
:
: stack backtrace:
: CPU: 8 PID: 62 Comm: migration/8 Not tainted 4.14.0-rc2-next-20170927+ #252 : Call Trace:
: dump_stack()
: print_circular_bug()
: check_prev_add()
: ? add_lock_to_list.isra.26()
: ? check_usage()
: ? kvm_clock_read()
: ? kvm_sched_clock_read()
: ? sched_clock()
: ? check_preemption_disabled()
: __lock_acquire()
: ? __lock_acquire()
: ? add_lock_to_list.isra.26()
: ? debug_check_no_locks_freed()
: ? memcpy()
: lock_acquire()
: ? serial8250_console_write()
: _raw_spin_lock_irqsave()
: ? serial8250_console_write()
: serial8250_console_write()
: ? serial8250_start_tx()
: ? lock_acquire()
: ? memcpy()
: univ8250_console_write()
: console_unlock()
: ? __down_trylock_console_sem()
: vprintk_emit()
: vprintk_default()
: vprintk_func()
: printk()
: ? show_regs_print_info()
: ? lock_acquire()
: ___ratelimit()
: __printk_ratelimit()
: select_fallback_rq()
: sched_cpu_dying()
: ? sched_cpu_starting()
: ? rcutree_dying_cpu()
: ? sched_cpu_starting()
: cpuhp_invoke_callback()
: ? cpu_disable_common()
: take_cpu_down()
: ? trace_hardirqs_off_caller()
: ? cpuhp_invoke_callback()
: multi_cpu_stop()
: ? __this_cpu_preempt_check()
: ? cpu_stop_queue_work()
: cpu_stopper_thread()
: ? cpu_stop_create()
: smpboot_thread_fn()
: ? sort_range()
: ? schedule()
: ? __kthread_parkme()
: kthread()
: ? sort_range()
: ? kthread_create_on_node()
: ret_from_fork()
: process 9121 (trinity-c78) no longer affine to cpu8
: smpboot: CPU 8 is now offline
--- lib/ratelimit.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
lib/ratelimit.c +3 -1
@@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_stateif (time_is_before_jiffies (rs->begin + rs->interval)) {if (rs->missed) {if (!(rs->flags &RATELIMIT_MSG_ON_RELEASE )) { -pr_warn ("%s: %d callbacks suppressed\n" , func, rs->missed); +printk_deferred (KERN_WARNING +"%s: %d callbacks suppressed\n" , + func, rs->missed); rs->missed =0 ; } }
Greg Kroah-Hartman
maintainerPATCH 104/160 lsm: fix smack_inode_removexattr and xattr_getsecurity memleak
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Casey Schaufler <[email protected]>
commit 57e7ba04d422c3d41c8426380303ec9b7533ded9 upstream.
security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx".
The code in xattr_getsecurity() that calls security_inode_getsecurity() and then calls security_release_secctx() happened to work because SElinux and Smack treat the attribute and the secctx the same way. It fails for cap_inode_getsecurity(), because that module has no secctx that ever needs releasing. It turns out that Smack is the one that's doing things wrong by not allocating memory when instructed to do so by the "alloc" parameter.
The fix is simple enough. Change the security_release_secctx() to kfree() because it isn't a secctx being returned by security_inode_getsecurity(). Change Smack to allocate the string when told to do so.
Note: this also fixes memory leaks for LSMs which implement inode_getsecurity but not release_secctx, such as capabilities.
--- fs/xattr.c | 2 - security/smack/smack_lsm.c | 59 ++++++++++++++++++++------------------------- 2 files changed, 28 insertions(+), 33 deletions(-)
fs/xattr.c +1 -1
@@ -249,7 +249,7 @@ xattr_getsecurity(struct inode *inode, c }memcpy (value, buffer, len); out: -security_release_secctx (buffer, len); +kfree (buffer); out_noalloc:return len; }
security/smack/smack_lsm.c +27 -32
77 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 105/160 ALSA: compress: Remove unused variable
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guneshwor Singh <[email protected]>
commit a931b9ce93841a5b66b709ba5a244276e345e63b upstream.
Commit 04c5d5a430fc ("ALSA: compress: Embed struct device") removed the statement that used 'str' but didn't remove the variable itself. So remove it.
[Adding stable to Cc since pr_debug() may refer to the uninitialized
buffer -- tiwai]
--- sound/core/compress_offload.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/core/compress_offload.c +1 -2
@@ -948,14 +948,13 @@ static const struct file_operations snd_static int snd_compress_dev_register (struct snd_device *device) {int ret = -EINVAL ; -char str[16 ];struct snd_compr *compr;if (snd_BUG_ON (!device || !device->device_data))return -EBADFD ; compr = device->device_data; -pr_debug ("reg %s for device %s, direction %d\n" , str, compr->name, +pr_debug ("reg device %s, direction %d\n" , compr->name, compr->direction);/* register compressed device */ ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS,
Greg Kroah-Hartman
maintainerPATCH 106/160 Revert "ALSA: echoaudio: purge contradictions between dimension matrix members and total number of members"
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 51db452df07bb4c5754b73789253ba21681d9dc2 upstream.
This reverts commit 275353bb684e to fix a regression which can abort 'alsactl' program in alsa-utils due to assertion in alsa-lib.
alsactl: control.c:2513: snd_ctl_elem_value_get_integer: Assertion `idx < sizeof(obj->value.integer.value) / sizeof(obj->value.integer.value[0])' failed.
alsactl: control.c:2976: snd_ctl_elem_value_get_integer: Assertion `idx < ARRAY_SIZE(obj->value.integer.value)' failed.
This commit is a band-aid. In a point of usage of ALSA control interface, the drivers still bring an issue that they prevent userspace applications to have a consistent way to parse each levels of the dimension information via ALSA control interface.
Let me investigate this issue. Current implementation of the drivers have three control element sets with dimension information:
* 'Monitor Mixer Volume' (type: integer)
* 'VMixer Volume' (type: integer)
* 'VU-meters' (type: boolean)
Although the number of elements named as 'Monitor Mixer Volume' differs depending on drivers in this group, it can be calculated by macros defined by each driver (= (BX_NUM - BX_ANALOG_IN) * BX_ANALOG_IN). Each of the elements has one member for value and has dimension information with 2 levels (= BX_ANALOG_IN * (BX_NUM - BX_ANALOG_IN)). For these elements, userspace applications are expected to handle the dimension information so that all of the elements construct a matrix where the number of rows and columns are represented by the dimension information.
The same way is applied to elements named as 'VMixer Volume'. The number of these elements can also be calculated by macros defined by each drivers (= PX_ANALOG_IN * BX_ANALOG_IN). Each of the element has one member for value and has dimension information with 2 levels (= BX_ANALOG_IN * PX_ANALOG_IN). All of the elements construct a matrix with the dimension information.
An element named as 'VU-meters' gets a different way in a point of dimension information. The element includes 96 members for value. The element has dimension information with 3 levels (= 3 or 2 * 16 * 2). For this element, userspace applications are expected to handle the dimension information so that all of the members for value construct a matrix where the number of rows and columns are represented by the dimension information. This is different from the way for the former.
As a summary, the drivers were not designed to produce a consistent way to parse the dimension information. This makes it hard for general userspace applications such as amixer to parse the information by a consistent way, and actually no userspace applications except for 'echomixer' utilize the dimension information. Additionally, no drivers excluding this group use the information.
The reverted commit was written based on the latter way. A commit 860c1994a70a ('ALSA: control: add dimension validator for userspace elements') is written based on the latter way, too. The patch should be reconsider too in the same time to re-define a consistent way to parse the dimension information.
--- sound/pci/echoaudio/echoaudio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/pci/echoaudio/echoaudio.c +3 -3
@@ -1272,11 +1272,11 @@ static int snd_echo_mixer_info(struct sn chip =snd_kcontrol_chip (kcontrol); uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; + uinfo->count =1 ; uinfo->value.integer.min =ECHOGAIN_MINOUT ; uinfo->value.integer.max =ECHOGAIN_MAXOUT ; uinfo->dimen.d[0 ] =num_busses_out (chip); uinfo->dimen.d[1 ] =num_busses_in (chip); - uinfo->count = uinfo->dimen.d[0 ] * uinfo->dimen.d[1 ];return 0 ; }
@@ -1344,11 +1344,11 @@ static int snd_echo_vmixer_info(struct s chip =snd_kcontrol_chip (kcontrol); uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; + uinfo->count =1 ; uinfo->value.integer.min =ECHOGAIN_MINOUT ; uinfo->value.integer.max =ECHOGAIN_MAXOUT ; uinfo->dimen.d[0 ] =num_busses_out (chip); uinfo->dimen.d[1 ] =num_pipes_out (chip); - uinfo->count = uinfo->dimen.d[0 ] * uinfo->dimen.d[1 ];return 0 ; }
@@ -1728,6 +1728,7 @@ static int snd_echo_vumeters_info(struct struct snd_ctl_elem_info *uinfo) { uinfo->type =SNDRV_CTL_ELEM_TYPE_INTEGER ; + uinfo->count =96 ; uinfo->value.integer.min =ECHOGAIN_MINOUT ; uinfo->value.integer.max =0 ;#ifdef ECHOCARD_HAS_VMIXER
@@ -1737,7 +1738,6 @@ static int snd_echo_vumeters_info(struct#endif uinfo->dimen.d[1 ] =16 ;/* 16 channels */ uinfo->dimen.d[2 ] =2 ;/* 0=level, 1=peak */ - uinfo->count = uinfo->dimen.d[0 ] * uinfo->dimen.d[1 ] * uinfo->dimen.d[2 ];return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 107/160 ALSA: usx2y: Suppress kernel warning at page allocation failures
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 7682e399485fe19622b6fd82510b1f4551e48a25 upstream.
The usx2y driver allocates the stream read/write buffers in continuous pages depending on the stream setup, and this may spew the kernel warning messages with a stack trace like:
WARNING: CPU: 1 PID: 1846 at mm/page_alloc.c:3883 __alloc_pages_slowpath+0x1ef2/0x2d70 Modules linked in: CPU: 1 PID: 1846 Comm: kworker/1:2 Not tainted ....
It may confuse user as if it were any serious error, although this is no fatal error and the driver handles the error case gracefully. Since the driver has already some sanity check of the given size (128 and 256 pages), it can't pass any crazy value. So it's merely page fragmentation.
This patch adds __GFP_NOWARN to each caller for suppressing such kernel warnings. The original issue was spotted by syzkaller.
--- sound/usb/usx2y/usb_stream.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
sound/usb/usx2y/usb_stream.c +4 -2
@@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct } pg =get_order (read_size); - sk->s = (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP|__GFP_ZERO, pg); + sk->s = (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP|__GFP_ZERO| + __GFP_NOWARN, pg);if (!sk->s) {snd_printk (KERN_WARNING "couldn't __get_free_pages()\n" ); goto out;
@@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct pg =get_order (write_size); sk->write_page = - (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP|__GFP_ZERO, pg); + (void *)__get_free_pages (GFP_KERNEL |__GFP_COMP|__GFP_ZERO| + __GFP_NOWARN, pg);if (!sk->write_page) {snd_printk (KERN_WARNING "couldn't __get_free_pages()\n" );usb_stream_free (sk);
Greg Kroah-Hartman
maintainerPATCH 108/160 powerpc/powernv: Increase memory block size to 1GB on radix
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Blanchard <[email protected]>
commit 53ecde0b9126ff140abe3aefd7f0ec64d6fa36b0 upstream.
Memory hot unplug on PowerNV radix hosts is broken. Our memory block size is 256MB but since we map the linear region with very large pages, each pte we tear down maps 1GB.
A hot unplug of one 256MB memory block results in 768MB of memory getting unintentionally unmapped. At this point we are likely to oops.
Fix this by increasing our memory block size to 1GB on PowerNV radix hosts.
--- arch/powerpc/platforms/powernv/setup.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
arch/powerpc/platforms/powernv/setup.c +9 -1
@@ -272,7 +272,15 @@ static void pnv_kexec_cpu_down(int crash#ifdef CONFIG_MEMORY_HOTPLUG_SPARSE static unsigned long pnv_memory_block_size (void ) { -return 256UL *1024 *1024 ; +/* +* We map the kernel linear region with 1GB large pages on radix. For +* memory hot unplug to work our memory block size must be at least +* this size. +*/ +if (radix_enabled ()) +return 1UL *1024 *1024 *1024 ; +else +return 256UL *1024 *1024 ; }#endif
Greg Kroah-Hartman
maintainerPATCH 109/160 powerpc: Fix action argument for cpufeatures-based TLB flush
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Kerr <[email protected]>
commit 3b7af5c0fd9631762d1c4d7b4cee76f571dd3c2c upstream.
Commit 41d0c2ecde19 ("powerpc/powernv: Fix local TLB flush for boot and MCE on POWER9") introduced calls to __flush_tlb_power[89] from the cpufeatures code, specifying the number of sets to flush.
However, these functions take an action argument, not a number of sets. This means we hit the BUG() in __flush_tlb_{206,300} when using cpufeatures-style configuration.
This change passes TLB_INVAL_SCOPE_GLOBAL instead.
--- arch/powerpc/kernel/dt_cpu_ftrs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/kernel/dt_cpu_ftrs.c +2 -2
@@ -102,10 +102,10 @@ static void cpufeatures_flush_tlb(void)case PVR_POWER8 :case PVR_POWER8E :case PVR_POWER8NVL : -__flush_tlb_power8 (POWER8_TLB_SETS ); +__flush_tlb_power8 (TLB_INVAL_SCOPE_GLOBAL );break ;case PVR_POWER9 : -__flush_tlb_power9 (POWER9_TLB_SETS_HASH ); +__flush_tlb_power9 (TLB_INVAL_SCOPE_GLOBAL );break ;default :pr_err ("unknown CPU version for boot TLB flush\n" );
Greg Kroah-Hartman
maintainerPATCH 110/160 powerpc/64s: Use emergency stack for kernel TM Bad Thing program checks
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cyril Bur <[email protected]>
commit 265e60a170d0a0ecfc2d20490134ed2c48dd45ab upstream.
When using transactional memory (TM), the CPU can be in one of six states as far as TM is concerned, encoded in the Machine State Register (MSR). Certain state transitions are illegal and if attempted trigger a "TM Bad Thing" type program check exception.
If we ever hit one of these exceptions it's treated as a bug, ie. we oops, and kill the process and/or panic, depending on configuration.
One case where we can trigger a TM Bad Thing, is when returning to userspace after a system call or interrupt, using RFID. When this happens the CPU first restores the user register state, in particular r1 (the stack pointer) and then attempts to update the MSR. However the MSR update is not allowed and so we take the program check with the user register state, but the kernel MSR.
This tricks the exception entry code into thinking we have a bad kernel stack pointer, because the MSR says we're coming from the kernel, but r1 is pointing to userspace.
To avoid this we instead always switch to the emergency stack if we take a TM Bad Thing from the kernel. That way none of the user register values are used, other than for printing in the oops message.
This is the fix for CVE-2017-1000255.
--- arch/powerpc/kernel/exceptions-64s.S | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
arch/powerpc/kernel/exceptions-64s.S +23 -1
@@ -734,7 +734,29 @@ EXC_REAL(program_check, 0x700, 0x100) EXC_VIRT(program_check, 0x4700, 0x100, 0x700) TRAMP_KVM(PACA_EXGEN, 0x700) EXC_COMMON_BEGIN(program_check_common) - EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) + /* + * It's possible to receive a TM Bad Thing type program check with + * userspace register values (in particular r1), but with SRR1 reporting + * that we came from the kernel. Normally that would confuse the bad + * stack logic, and we would report a bad kernel stack pointer. Instead + * we switch to the emergency stack if we're taking a TM Bad Thing from + * the kernel. + */ + li r10,MSR_PR /* Build a mask of MSR_PR .. */ + oris r10,r10,0x200000@h /* .. and SRR1_PROGTM */ + and r10,r10,r12 /* Mask SRR1 with that. */ + srdi r10,r10,8 /* Shift it so we can compare */ + cmpldi r10,(0x200000 >> 8) /* .. with an immediate. */ + bne 1f /* If != go to normal path. */ + + /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack */ + andi. r10,r12,MSR_PR; /* Set CR0 correctly for label */ + /* 3 in EXCEPTION_PROLOG_COMMON */ + mr r10,r1 /* Save r1 */ + ld r1,PACAEMERGSP(r13) /* Use emergency stack */ + subi r1,r1,INT_FRAME_SIZE /* alloc stack frame */ + b 3f /* Jump into the macro !! */ +1: EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN) bl save_nvgprs RECONCILE_IRQ_STATE(r10, r11) addi r3,r1,STACK_FRAME_OVERHEAD
Greg Kroah-Hartman
maintainerPATCH 111/160 powerpc/tm: Fix illegal TM state in signal handler
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo Romero <[email protected]>
commit 044215d145a7a8a60ffa8fdc859d110a795fa6ea upstream.
Currently it's possible that on returning from the signal handler through the restore_tm_sigcontexts() code path (e.g. from a signal caught due to a trap instruction executed in the middle of an HTM block, or a deliberately constructed sigframe) an illegal TM state (like TS=10 TM=0, i.e. "T0") is set in SRR1 and when rfid sets implicitly the MSR register from SRR1 register on return to userspace it causes a TM Bad Thing exception.
That illegal state can be set (a) by a malicious user that disables the TM bit by tweaking the bits in uc_mcontext before returning from the signal handler or (b) by a sufficient number of context switches occurring such that the load_tm counter overflows and TM is disabled whilst in the signal handler.
This commit fixes the illegal TM state by ensuring that TM bit is always enabled before we return from restore_tm_sigcontexts(). A small comment correction is made as well.
--- arch/powerpc/kernel/signal_64.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
arch/powerpc/kernel/signal_64.c +12 -1
@@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(strucif (MSR_TM_RESV (msr))return -EINVAL ; -/* pull in MSR TM from user context */ +/* pull in MSR TS bits from user context */ regs->msr = (regs->msr & ~MSR_TS_MASK ) | (msr &MSR_TS_MASK ); +/* +* Ensure that TM is enabled in regs->msr before we leave the signal +* handler. It could be the case that (a) user disabled the TM bit +* through the manipulation of the MSR bits in uc_mcontext or (b) the +* TM bit was disabled because a sufficient number of context switches +* happened whilst in the signal handler and load_tm overflowed, +* disabling the TM bit. In either case we can end up with an illegal +* TM state leading to a TM Bad Thing when we return to userspace. +*/ + regs->msr |=MSR_TM ; +/* pull in MSR LE from user context */ regs->msr = (regs->msr & ~MSR_LE ) | (msr &MSR_LE );
Greg Kroah-Hartman
maintainerPATCH 112/160 percpu: make this_cpu_generic_read() atomic w.r.t. interrupts
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <[email protected]>
commit e88d62cd4b2f0b1ae55e9008e79c2794b1fc914d upstream.
As raw_cpu_generic_read() is a plain read from a raw_cpu_ptr() address, it's possible (albeit unlikely) that the compiler will split the access across multiple instructions.
In this_cpu_generic_read() we disable preemption but not interrupts before calling raw_cpu_generic_read(). Thus, an interrupt could be taken in the middle of the split load instructions. If a this_cpu_write() or RMW this_cpu_*() op is made to the same variable in the interrupt handling path, this_cpu_read() will return a torn value.
For native word types, we can avoid tearing using READ_ONCE(), but this won't work in all cases (e.g. 64-bit types on most 32-bit platforms). This patch reworks this_cpu_generic_read() to use READ_ONCE() where possible, otherwise falling back to disabling interrupts.
--- include/asm-generic/percpu.h | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
include/asm-generic/percpu.h +22 -2
@@ -115,15 +115,35 @@ do { \ (__ret); \ }) -#define this_cpu_generic_read (pcp) \ +#define __this_cpu_generic_read_nopreempt (pcp) \ ({ \ typeof(pcp) __ret; \ preempt_disable_notrace(); \ - __ret = raw_cpu_generic_read(pcp); \ + __ret = READ_ONCE(*raw_cpu_ptr(&(pcp))); \ preempt_enable_notrace(); \ __ret; \ }) +#define __this_cpu_generic_read_noirq (pcp) \ +({ \ + typeof(pcp) __ret; \ + unsigned long __flags; \ + raw_local_irq_save(__flags); \ + __ret = raw_cpu_generic_read(pcp); \ + raw_local_irq_restore(__flags); \ + __ret; \ +}) + +#define this_cpu_generic_read (pcp) \ +({ \ + typeof(pcp) __ret; \ + if (__native_word(pcp)) \ + __ret = __this_cpu_generic_read_nopreempt(pcp); \ + else \ + __ret = __this_cpu_generic_read_noirq(pcp); \ + __ret; \ +}) +#define this_cpu_generic_to_op (pcp, val, op) \ do { \ unsigned long __flags; \
Greg Kroah-Hartman
maintainerPATCH 113/160 intel_th: pci: Add Lewisburg PCH support
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit 24600840c74112ad04a9ddd99d7d7f731dcaa1cb upstream.
This adds Intel(R) Trace Hub PCI ID for Lewisburg PCH.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -91,6 +91,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)0, }, { +/* Lewisburg PCH */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa1a6), + .driver_data = (kernel_ulong_t )0 , + }, + {/* Gemini Lake */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x318e ), .driver_data = (kernel_ulong_t)0,
Greg Kroah-Hartman
maintainerPATCH 114/160 driver core: platform: Dont read past the end of "driver_override" buffer
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <[email protected]>
commit bf563b01c2895a4bfd1a29cc5abc67fe706ecffd upstream.
When printing the driver_override parameter when it is 4095 and 4094 bytes long, the printing code would access invalid memory because we need count+1 bytes for printing.
Reject driver_override values of these lengths in driver_override_store().
This is in close analogy to commit 4efe874aace5 ("PCI: Don't read past the end of sysfs "driver_override" buffer") from Sasha Levin.
--- drivers/base/platform.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/base/platform.c +2 -1
@@ -868,7 +868,8 @@ static ssize_t driver_override_store(strstruct platform_device *pdev =to_platform_device (dev);char *driver_override, *old, *cp; -if (count >PATH_MAX ) +/* We need to keep extra room for a newline */ +if (count >= (PAGE_SIZE -1 ))return -EINVAL ; driver_override =kstrndup (buf, count,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 115/160 cgroup: Reinit cgroup_taskset structure before cgroup_migrate_execute() returns
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <[email protected]>
commit c4fa6c43ce4b427350cfbb659436bfe3d9e09a1d upstream.
The cgroup_taskset structure within the larger cgroup_mgctx structure is supposed to be used once and then discarded. That is not really the case in the hotplug code path:
cpuset_hotplug_workfn()
- cgroup_transfer_tasks()
- cgroup_migrate()
- cgroup_migrate_add_task()
- cgroup_migrate_execute()
In this case, the cgroup_migrate() function is called multiple time with the same cgroup_mgctx structure to transfer the tasks from one cgroup to another one-by-one. The second time cgroup_migrate() is called, the cgroup_taskset will be in an incorrect state and so may cause the system to panic. For example,
[ 150.888410] Faulting instruction address: 0xc0000000001db648
[ 150.888414] Oops: Kernel access of bad area, sig: 11 [#1]
[ 150.888417] SMP NR_CPUS=2048
[ 150.888417] NUMA
[ 150.888419] pSeries
:
[ 150.888545] NIP [c0000000001db648] cpuset_can_attach+0x58/0x1b0
[ 150.888548] LR [c0000000001db638] cpuset_can_attach+0x48/0x1b0
[ 150.888551] Call Trace:
[ 150.888554] [c0000005f65cb940] [c0000000001db638] cpuset_can_attach+0x48/0x1b 0 (unreliable)
[ 150.888559] [c0000005f65cb9a0] [c0000000001cff04] cgroup_migrate_execute+0xc4/0x4b0
[ 150.888563] [c0000005f65cba20] [c0000000001d7d14] cgroup_transfer_tasks+0x1d4/0x370
[ 150.888568] [c0000005f65cbb70] [c0000000001ddcb0] cpuset_hotplug_workfn+0x710/0x8f0
[ 150.888572] [c0000005f65cbc80] [c00000000012032c] process_one_work+0x1ac/0x4d0
[ 150.888576] [c0000005f65cbd20] [c0000000001206f8] worker_thread+0xa8/0x5b0
[ 150.888580] [c0000005f65cbdc0] [c0000000001293f8] kthread+0x168/0x1b0
[ 150.888584] [c0000005f65cbe30] [c00000000000b368] ret_from_kernel_thread+0x5c/0x74To allow reuse of the cgroup_mgctx structure, some fields in that structure are now re-initialized at the end of cgroup_migrate_execute() function call so that the structure can be reused again in a later iteration without causing problem.
This bug was introduced in the commit e595cd706982 ("group: track migration context in cgroup_mgctx") in 4.11. This commit moves the cgroup_taskset initialization out of cgroup_migrate(). The commit 10467270fb3 ("cgroup: don't call migration methods if there are no tasks to migrate") helped, but did not completely resolve the problem.
--- kernel/cgroup/cgroup.c | 8 ++++++++ 1 file changed, 8 insertions(+)
kernel/cgroup/cgroup.c +8 -0
@@ -2168,6 +2168,14 @@ out_release_tset:list_del_init (&cset->mg_node); }spin_unlock_irq (&css_set_lock); + +/* +* Re-initialize the cgroup_taskset structure in case it is reused +* again in another cgroup_migrate_add_task()/cgroup_migrate_execute() +* iteration. +*/ + tset->nr_tasks =0 ; + tset->csets = &tset->src_csets;return ret; }
Greg Kroah-Hartman
maintainerPATCH 116/160 Drivers: hv: fcopy: restore correct transfer length
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olaf Hering <[email protected]>
commit 549e658a0919e355a2b2144dc380b3729bef7f3e upstream.
Till recently the expected length of bytes read by the daemon did depend on the context. It was either hv_start_fcopy or hv_do_fcopy. The daemon had a buffer size of two pages, which was much larger than needed.
Now the expected length of bytes read by the
daemon changed slightly. For START_FILE_COPY it is still the size of hv_start_fcopy. But for WRITE_TO_FILE and the other operations it is as large as the buffer that arrived via vmbus. In case of WRITE_TO_FILE that is slightly larger than a struct hv_do_fcopy. Since the buffer in the daemon was still larger everything was fine.
Currently, the daemon reads only what is actually needed. The new buffer layout is as large as a struct hv_do_fcopy, for the WRITE_TO_FILE operation. Since the kernel expects a slightly larger size, hvt_op_read will return -EINVAL because the daemon will read slightly less than expected. Address this by restoring the expected buffer size in case of WRITE_TO_FILE.
--- drivers/hv/hv_fcopy.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/hv/hv_fcopy.c +4 -0
@@ -170,6 +170,10 @@ static void fcopy_send_data(struct work_ out_src = smsg_out;break ; +case WRITE_TO_FILE : + out_src = fcopy_transaction.fcopy_msg; + out_len =sizeof (struct hv_do_fcopy ); +break ;default : out_src = fcopy_transaction.fcopy_msg; out_len = fcopy_transaction.recv_len;
Greg Kroah-Hartman
maintainerPATCH 117/160 vmbus: dont acquire the mutex in vmbus_hvsock_device_unregister()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dexuan Cui <[email protected]>
commit 33c150c2ee4a65a59190a124b45d05b1abf9478e upstream.
Due to commit 54a66265d675 ("Drivers: hv: vmbus: Fix rescind handling"), we need this patch to resolve the below deadlock:
after we get the mutex in vmbus_hvsock_device_unregister() and call vmbus_device_unregister() -> device_unregister() -> ... -> device_release() -> vmbus_device_release(), we'll get a deadlock, because vmbus_device_release() tries to get the same mutex.
--- drivers/hv/channel_mgmt.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/hv/channel_mgmt.c +0 -4
@@ -922,14 +922,10 @@ static void vmbus_onoffer_rescind(structvoid vmbus_hvsock_device_unregister (struct vmbus_channel *channel) { -mutex_lock (&vmbus_connection.channel_mutex); -BUG_ON (!is_hvsock_channel (channel)); channel->rescind = true;vmbus_device_unregister (channel->device_obj); - -mutex_unlock (&vmbus_connection.channel_mutex); }EXPORT_SYMBOL_GPL (vmbus_hvsock_device_unregister);
Greg Kroah-Hartman
maintainerPATCH 118/160 stm class: Fix a use-after-free
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <[email protected]>
commit fd085bb1766d6a598f53af2308374a546a49775a upstream.
For reasons unknown, the stm_source removal path uses device_destroy() to kill the underlying device object. Because device_destroy() uses devt to look for the device to destroy and the fact that stm_source devices don't have one (or all have the same one), it just picks the first device in the class, which may well be the wrong one.
That is, loading stm_console and stm_heartbeat and then removing both will die in dereferencing a freed object.
Since this should have been device_unregister() in the first place, use it instead of device_destroy().
--- drivers/hwtracing/stm/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/stm/core.c +1 -1
@@ -1119,7 +1119,7 @@ void stm_source_unregister_device(structstm_source_link_drop (src); -device_destroy (&stm_source_class, src->dev.devt); +device_unregister (&src->dev); }EXPORT_SYMBOL_GPL (stm_source_unregister_device);
Greg Kroah-Hartman
maintainerPATCH 119/160 auxdisplay: charlcd: properly restore atomic counter on error path
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willy Tarreau <[email protected]>
commit 93dc1774d2a4c7a298d5cdf78cc8acdcb7b1428d upstream.
Commit f4757af ("staging: panel: Fix single-open policy race condition") introduced in 3.19-rc1 attempted to fix a race condition on the open, but failed to properly do it and used to exit without restoring the semaphore.
This results in -EBUSY being returned after the first open error until the module is reloaded or the system restarted (ie: consecutive to a dual open resulting in -EBUSY or to a permission error).
[ Note for stable maintainers: the code moved from drivers/misc/panel.c
to drivers/auxdisplay/{charlcd,panel}.c during 4.12. The patch easily applies there (modulo the renamed atomic counter) but I can provide a tested backport if desired. ]
--- drivers/auxdisplay/charlcd.c | 11 +++++++++-- drivers/auxdisplay/panel.c | 11 +++++++++-- 2 files changed, 18 insertions(+), 4 deletions(-)
drivers/auxdisplay/charlcd.c +9 -2
@@ -647,18 +647,25 @@ static ssize_t charlcd_write(struct filestatic int charlcd_open (struct inode *inode,struct file *file) {struct charlcd_priv *priv =to_priv (the_charlcd); +int ret; + ret = -EBUSY ;if (!atomic_dec_and_test (&charlcd_available)) -return -EBUSY ;/* open only once at a time */ + goto fail;/* open only once at a time */ + ret = -EPERM ;if (file->f_mode &FMODE_READ )/* device is write-only */ -return -EPERM ; + goto fail;if (priv->must_clear) {charlcd_clear_display (&priv->lcd); priv->must_clear = false; }return nonseekable_open (inode, file); + + fail: +atomic_inc (&charlcd_available); +return ret; }static int charlcd_release (struct inode *inode,struct file *file)
drivers/auxdisplay/panel.c +9 -2
@@ -1105,14 +1105,21 @@ static ssize_t keypad_read(struct file *static int keypad_open (struct inode *inode,struct file *file) { +int ret; + + ret = -EBUSY ;if (!atomic_dec_and_test (&keypad_available)) -return -EBUSY ;/* open only once at a time */ + goto fail;/* open only once at a time */ + ret = -EPERM ;if (file->f_mode &FMODE_WRITE )/* device is read-only */ -return -EPERM ; + goto fail; keypad_buflen =0 ;/* flush the buffer on opening */ return 0 ; + fail: +atomic_inc (&keypad_available); +return ret; }static int keypad_release (struct inode *inode,struct file *file)
Greg Kroah-Hartman
maintainerPATCH 120/160 ftrace: Fix kmemleak in unregister_ftrace_graph
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shu Wang <[email protected]>
commit 2b0b8499ae75df91455bbeb7491d45affc384fb0 upstream.
The trampoline allocated by function tracer was overwriten by function_graph tracer, and caused a memory leak. The save_global_trampoline should have saved the previous trampoline in register_ftrace_graph() and restored it in unregister_ftrace_graph(). But as it is implemented, save_global_trampoline was only used in unregister_ftrace_graph as default value 0, and it overwrote the previous trampoline's value. Causing the previous allocated trampoline to be lost.
kmmeleak backtrace:
kmemleak_vmalloc+0x77/0xc0
__vmalloc_node_range+0x1b5/0x2c0
module_alloc+0x7c/0xd0
arch_ftrace_update_trampoline+0xb5/0x290
ftrace_startup+0x78/0x210
register_ftrace_function+0x8b/0xd0
function_trace_init+0x4f/0x80
tracing_set_tracer+0xe6/0x170
tracing_set_trace_write+0x90/0xd0
__vfs_write+0x37/0x170
vfs_write+0xb2/0x1b0
SyS_write+0x55/0xc0
do_syscall_64+0x67/0x180
return_from_SYSCALL_64+0x0/0x6a[
Looking further into this, I found that this was left over from when the function and function graph tracers shared the same ftrace_ops. But in commit 5f151b2401 ("ftrace: Fix function_profiler and function tracer together"), the two were separated, and the save_global_trampoline no longer was necessary (and it may have been broken back then too). -- Steven Rostedt
]
--- kernel/trace/ftrace.c | 14 -------------- 1 file changed, 14 deletions(-)
kernel/trace/ftrace.c +0 -14
@@ -4954,9 +4954,6 @@ static char ftrace_graph_buf[FTRACE_FILTstatic char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE ]__initdata ;static int ftrace_graph_set_hash (struct ftrace_hash *hash,char *buffer); -static unsigned long save_global_trampoline; -static unsigned long save_global_flags; -static int __init set_graph_function (char *str) {strlcpy (ftrace_graph_buf, str,FTRACE_FILTER_SIZE );
@@ -6756,17 +6753,6 @@ void unregister_ftrace_graph(void)unregister_pm_notifier (&ftrace_suspend_notifier);unregister_trace_sched_switch (ftrace_graph_probe_sched_switch,NULL ); -#ifdef CONFIG_DYNAMIC_FTRACE -/* -* Function graph does not allocate the trampoline, but -* other global_ops do. We need to reset the ALLOC_TRAMP flag -* if one was used. -*/ - global_ops.trampoline = save_global_trampoline; -if (save_global_flags &FTRACE_OPS_FL_ALLOC_TRAMP ) - global_ops.flags |=FTRACE_OPS_FL_ALLOC_TRAMP ; -#endif - out:mutex_unlock (&ftrace_lock); }
Greg Kroah-Hartman
maintainerPATCH 121/160 ovl: fix error value printed in ovl_lookup_index()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit e0082a0f04c432cb6d7128ef60d8e425e45ce025 upstream.
--- fs/overlayfs/namei.c | 1 + 1 file changed, 1 insertion(+)
fs/overlayfs/namei.c +1 -0
@@ -506,6 +506,7 @@ static struct dentry *ovl_lookup_index(s index =lookup_one_len_unlocked (name.name, ofs->indexdir, name.len);if (IS_ERR (index)) { + err =PTR_ERR (index); pr_warn_ratelimited("overlayfs: failed inode index lookup (ino=%lu, key=%*s, err=%i);\n" "overlayfs: mount with '-o index=off' to disable inodes index.\n", d_inode(origin)->i_ino, name.len, name.name,
Greg Kroah-Hartman
maintainerPATCH 122/160 ovl: fix dput() of ERR_PTR in ovl_cleanup_index()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 9f4ec904dbd4eb1a2db10d5e7dc16eae386fe64d upstream.
--- fs/overlayfs/util.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/overlayfs/util.c +4 -1
@@ -418,7 +418,7 @@ void ovl_inuse_unlock(struct dentry *den } } -/* Called must hold OVL_I(inode)->oi_lock */ +/* Caller must hold OVL_I(inode)->lock */ static void ovl_cleanup_index (struct dentry *dentry) {struct inode *dir =ovl_indexdir (dentry->d_sb)->d_inode;
@@ -457,6 +457,9 @@ static void ovl_cleanup_index(struct den err =PTR_ERR (index);if (!IS_ERR (index)) err =ovl_cleanup (dir, index); +else + index =NULL ; +inode_unlock (dir);if (err) goto fail;
Greg Kroah-Hartman
maintainerPATCH 123/160 ovl: fix dentry leak in ovl_indexdir_cleanup()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit dc7ab6773e8171e07f16fd0df0c5eea28c899503 upstream.
index dentry was not released when breaking out of the loop due to index verification error.
--- fs/overlayfs/readdir.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/overlayfs/readdir.c +4 -2
@@ -672,6 +672,7 @@ int ovl_indexdir_cleanup(struct dentry * struct path *lowerstack, unsigned int numlower) { int err; +struct dentry *index =NULL ;struct inode *dir = dentry->d_inode;struct path path = { .mnt = mnt, .dentry = dentry };LIST_HEAD (list);
@@ -690,8 +691,6 @@ int ovl_indexdir_cleanup(struct dentry *inode_lock_nested (dir,I_MUTEX_PARENT );list_for_each_entry (p, &list, l_node) { -struct dentry *index; -if (p->name[0 ] =='.' ) {if (p->len ==1 )continue ;
@@ -701,6 +700,7 @@ int ovl_indexdir_cleanup(struct dentry * index =lookup_one_len (p->name, dentry, p->len);if (IS_ERR (index)) { err =PTR_ERR (index); + index =NULL ;break ; } err =ovl_verify_index (index, lowerstack, numlower);
@@ -712,7 +712,9 @@ int ovl_indexdir_cleanup(struct dentry *break ; }dput (index); + index =NULL ; } +dput (index);inode_unlock (dir); out:ovl_cache_free (&list);
Greg Kroah-Hartman
maintainerPATCH 124/160 ovl: fix missing unlock_rename() in ovl_do_copy_up()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 5820dc0888d302ac05f8b91ffdf7e4e53b4fbf53 upstream.
Use the ovl_lock_rename_workdir() helper which requires unlock_rename() only on lock success.
--- fs/overlayfs/copy_up.c | 6 ++---- fs/overlayfs/dir.c | 20 -------------------- fs/overlayfs/overlayfs.h | 1 + fs/overlayfs/util.c | 19 +++++++++++++++++++ 4 files changed, 22 insertions(+), 24 deletions(-)
fs/overlayfs/copy_up.c +2 -4
@@ -561,10 +561,8 @@ static int ovl_do_copy_up(struct ovl_cop c->tmpfile = true; err =ovl_copy_up_locked (c); }else { - err = -EIO ; -if (lock_rename (c->workdir, c->destdir) !=NULL ) { -pr_err ("overlayfs: failed to lock workdir+upperdir\n" ); - }else { + err =ovl_lock_rename_workdir (c->workdir, c->destdir); +if (!err) { err =ovl_copy_up_locked (c);unlock_rename (c->workdir, c->destdir); }
fs/overlayfs/dir.c +0 -20
@@ -216,26 +216,6 @@ out_unlock:return err; } -static int ovl_lock_rename_workdir (struct dentry *workdir, -struct dentry *upperdir) -{ -/* Workdir should not be the same as upperdir */ -if (workdir == upperdir) - goto err; - -/* Workdir should not be subdir of upperdir and vice versa */ -if (lock_rename (workdir, upperdir) !=NULL ) - goto err_unlock; - -return 0 ; - -err_unlock: -unlock_rename (workdir, upperdir); -err: -pr_err ("overlayfs: failed to lock workdir+upperdir\n" ); -return -EIO ; -} -static struct dentry *ovl_clear_empty (struct dentry *dentry,struct list_head *list) {
fs/overlayfs/overlayfs.h +1 -0
@@ -234,6 +234,7 @@ bool ovl_inuse_trylock(struct dentry *devoid ovl_inuse_unlock (struct dentry *dentry);int ovl_nlink_start (struct dentry *dentry,bool *locked);void ovl_nlink_end (struct dentry *dentry,bool locked); +int ovl_lock_rename_workdir (struct dentry *workdir,struct dentry *upperdir);static inline bool ovl_is_impuredir (struct dentry *dentry) {
fs/overlayfs/util.c +19 -0
@@ -548,3 +548,22 @@ void ovl_nlink_end(struct dentry *dentrymutex_unlock (&OVL_I (d_inode (dentry))->lock); } } + +int ovl_lock_rename_workdir (struct dentry *workdir,struct dentry *upperdir) +{ +/* Workdir should not be the same as upperdir */ +if (workdir == upperdir) + goto err; + +/* Workdir should not be subdir of upperdir and vice versa */ +if (lock_rename (workdir, upperdir) !=NULL ) + goto err_unlock; + +return 0 ; + +err_unlock: +unlock_rename (workdir, upperdir); +err: +pr_err ("overlayfs: failed to lock workdir+upperdir\n" ); +return -EIO ; +}
Greg Kroah-Hartman
maintainerPATCH 125/160 ovl: fix regression caused by exclusive upper/work dir protection
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 85fdee1eef1a9e48ad5716916677e0c5fbc781e3 upstream.
Enforcing exclusive ownership on upper/work dirs caused a docker
regression: https://github.com/moby/moby/issues/34672.
Euan spotted the regression and pointed to the offending commit. Vivek has brought the regression to my attention and provided this reproducer:
Terminal 1:
mount -t overlay -o workdir=work,lowerdir=lower,upperdir=upper none
merged/
Terminal 2:
unshare -m
Terminal 1:
umount merged
mount -t overlay -o workdir=work,lowerdir=lower,upperdir=upper none
merged/
mount: /root/overlay-testing/merged: none already mounted or mount point
busy
To fix the regression, I replaced the error with an alarming warning. With index feature enabled, mount does fail, but logs a suggestion to override exclusive dir protection by disabling index.
Note that index=off mount does take the inuse locks, so a concurrent index=off will issue the warning and a concurrent index=on mount will fail.
Documentation was updated to reflect this change.
--- Documentation/filesystems/overlayfs.txt | 5 ++++- fs/overlayfs/ovl_entry.h | 3 +++ fs/overlayfs/super.c | 27 +++++++++++++++++++-------- 3 files changed, 26 insertions(+), 9 deletions(-)
Documentation/filesystems/overlayfs.txt +4 -1
@@ -210,8 +210,11 @@ path as another overlay mount and it may beneath or above the path of another overlay lower layer path. Using an upper layer path and/or a workdir path that are already used by -another overlay mount is not allowed and will fail with EBUSY. Using +another overlay mount is not allowed and may fail with EBUSY. Using partially overlapping paths is not allowed but will not fail with EBUSY. +If files are accessed from two overlayfs mounts which share or overlap the +upper layer and/or workdir path the behavior of the overlay is undefined, +though it will not result in a crash or deadlock. Mounting an overlay using an upper layer path, where the upper layer path was previously used by another mounted overlay in combination with a
fs/overlayfs/ovl_entry.h +3 -0
@@ -37,6 +37,9 @@ struct ovl_fs {bool noxattr;/* sb common to all layers */ struct super_block *same_sb; +/* Did we take the inuse lock? */ +bool upperdir_locked; +bool workdir_locked; };/* private information held for every overlayfs dentry */
fs/overlayfs/super.c +19 -8
@@ -210,9 +210,10 @@ static void ovl_put_super(struct super_bdput (ufs->indexdir);dput (ufs->workdir); -ovl_inuse_unlock (ufs->workbasedir); +if (ufs->workdir_locked) +ovl_inuse_unlock (ufs->workbasedir);dput (ufs->workbasedir); -if (ufs->upper_mnt) +if (ufs->upper_mnt && ufs->upperdir_locked)ovl_inuse_unlock (ufs->upper_mnt->mnt_root);mntput (ufs->upper_mnt);for (i =0 ; i < ufs->numlower; i++)
@@ -880,9 +881,13 @@ static int ovl_fill_super(struct super_b goto out_put_upperpath; err = -EBUSY ; -if (!ovl_inuse_trylock (upperpath.dentry)) { -pr_err ("overlayfs: upperdir is in-use by another mount\n" ); +if (ovl_inuse_trylock (upperpath.dentry)) { + ufs->upperdir_locked = true; + }else if (ufs->config.index) { +pr_err ("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n" ); goto out_put_upperpath; + }else { +pr_warn ("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n" ); } err =ovl_mount_dir (ufs->config.workdir, &workpath);
@@ -900,9 +905,13 @@ static int ovl_fill_super(struct super_b } err = -EBUSY ; -if (!ovl_inuse_trylock (workpath.dentry)) { -pr_err ("overlayfs: workdir is in-use by another mount\n" ); +if (ovl_inuse_trylock (workpath.dentry)) { + ufs->workdir_locked = true; + }else if (ufs->config.index) { +pr_err ("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n" ); goto out_put_workpath; + }else { +pr_warn ("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n" ); } ufs->workbasedir = workpath.dentry;
@@ -1155,11 +1164,13 @@ out_put_lowerpath: out_free_lowertmp:kfree (lowertmp); out_unlock_workdentry: -ovl_inuse_unlock (workpath.dentry); +if (ufs->workdir_locked) +ovl_inuse_unlock (workpath.dentry); out_put_workpath:path_put (&workpath); out_unlock_upperdentry: -ovl_inuse_unlock (upperpath.dentry); +if (ufs->upperdir_locked) +ovl_inuse_unlock (upperpath.dentry); out_put_upperpath:path_put (&upperpath); out_free_config:
Greg Kroah-Hartman
maintainerPATCH 126/160 arm64: dt marvell: Fix AP806 system controller size
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baruch Siach <[email protected]>
commit 9e7460fc325dad06d2066abdbc1f4dd49456f9a4 upstream.
Extend the container size to 0x2000 to include the gpio controller at offset 0x1040.
While at it, add start address notation to the gpio node name to match its 'offset' property.
7K/8K")
--- arch/arm64/boot/dts/marvell/armada-ap806.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/marvell/armada-ap806.dtsi +2 -2
@@ -254,7 +254,7 @@ ap_syscon: system-controller@6f4000 { compatible = "syscon", "simple-mfd"; - reg = <0x6f4000 0x1000>; + reg = <0x6f4000 0x2000>; ap_clk: clock { compatible = "marvell,ap806-clock";
@@ -265,7 +265,7 @@ compatible = "marvell,ap806-pinctrl"; }; - ap_gpio: gpio { + ap_gpio: gpio@1040 { compatible = "marvell,armada-8k-gpio"; offset = <0x1040>; ngpios = <20>;
Greg Kroah-Hartman
maintainerPATCH 127/160 arm64: Ensure the instruction emulation is ready for userspace
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
commit c0d8832e78cbfd4a64b7112e34920af4b0b0e60e upstream.
We trap and emulate some instructions (e.g, mrs, deprecated instructions) for the userspace. However the handlers for these are registered as late_initcalls and the userspace could be up and running from the initramfs by that time (with populate_rootfs, which is a rootfs_initcall()). This could cause problems for the early applications ending up in failure like :
[ 11.152061] modprobe[93]: undefined instruction: pc=0000ffff8ca48ff4
This patch promotes the specific calls to core_initcalls, which are guaranteed to be completed before we hit userspace.
--- arch/arm64/kernel/armv8_deprecated.c | 2 +- arch/arm64/kernel/cpufeature.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/kernel/armv8_deprecated.c +1 -1
@@ -649,4 +649,4 @@ static int __init armv8_deprecated_init(return 0 ; } -late_initcall (armv8_deprecated_init); +core_initcall (armv8_deprecated_init);
arch/arm64/kernel/cpufeature.c +1 -1
@@ -1294,4 +1294,4 @@ static int __init enable_mrs_emulation(vreturn 0 ; } -late_initcall (enable_mrs_emulation); +core_initcall (enable_mrs_emulation);
Greg Kroah-Hartman
maintainerPATCH 128/160 HID: rmi: Make sure the HID device is opened on resume
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude <[email protected]>
commit cac72b990d34f4c70208998a86f910ba38253c94 upstream.
So it looks like that suspend/resume has actually always been broken on hid-rmi. The fact it worked was a rather silly coincidence that was relying on the HID device to already be opened upon resume. This means that so long as anything was reading the /dev/input/eventX node for for an RMI device, it would suspend and resume correctly. As well, if nothing happened to be keeping the HID device away it would shut off, then the RMI driver would get confused on resume when it stopped responding and explode.
So, call hid_hw_open() in rmi_post_resume() so we make sure that the device is alive before we try talking to it.
This fixes RMI device suspend/resume over HID.
--- drivers/hid/hid-rmi.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/hid/hid-rmi.c +10 -3
@@ -436,17 +436,24 @@ static int rmi_post_resume(struct hid_deif (!(data->device_flags &RMI_DEVICE ))return 0 ; - ret =rmi_reset_attn_mode (hdev); +/* Make sure the HID device is ready to receive events */ + ret =hid_hw_open (hdev);if (ret)return ret; + ret =rmi_reset_attn_mode (hdev); +if (ret) + goto out; + ret =rmi_driver_resume (rmi_dev, false);if (ret) {hid_warn (hdev,"Failed to resume device: %d\n" , ret); -return ret; + goto out; } - return 0; +out: +hid_hw_close (hdev); + return ret; }#endif /* CONFIG_PM */
Greg Kroah-Hartman
maintainerPATCH 129/160 HID: i2c-hid: allocate hid buffers for real worst case
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Salido <[email protected]>
commit 8320caeeffdefec3b58b9d4a7ed8e1079492fe7b upstream.
The buffer allocation is not currently accounting for an extra byte for the report id. This can cause an out of bounds access in function i2c_hid_set_or_send_report() with reportID > 15.
--- drivers/hid/i2c-hid/i2c-hid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/hid/i2c-hid/i2c-hid.c +2 -1
@@ -543,7 +543,8 @@ static int i2c_hid_alloc_buffers(struct {/* the worst case is computed from the set_report command with a * reportID > 15 and the maximum report length */ -int args_len =sizeof (__u8) +/* optional ReportID byte */ +int args_len =sizeof (__u8) +/* ReportID */ +sizeof (__u8) +/* optional ReportID byte */ sizeof (__u16) +/* data register */ sizeof (__u16) +/* size of the report */ report_size;/* report */
Greg Kroah-Hartman
maintainerPATCH 130/160 HID: wacom: leds: Dont try to control the EKRs read-only LEDs
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Armstrong Skomra <[email protected]>
commit 74aebed6dc13425233f2224668353cff7a112776 upstream.
Commit a50aac7193f1 introduces 'led.groups' and adds EKR support for these groups. However, unlike the other devices with LEDs, the EKR's LEDs are read-only and we shouldn't attempt to control them in wacom_led_control().
See bug: https://sourceforge.net/p/linuxwacom/bugs/342/
--- drivers/hid/wacom_sys.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hid/wacom_sys.c +3 -0
@@ -766,6 +766,9 @@ static int wacom_led_control(struct wacoif (!wacom->led.groups)return -ENOTSUPP ; +if (wacom->wacom_wac.features.type ==REMOTE ) +return -ENOTSUPP ; +if (wacom->wacom_wac.pid) {/* wireless connected */ report_id =WAC_CMD_WL_LED_CONTROL ; buf_size =13 ;
Greg Kroah-Hartman
maintainerPATCH 131/160 HID: wacom: Properly report negative values from Intuos Pro 2 Bluetooth
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit b63c4c2718d641ba9bec888994f0cb0c23a1ef45 upstream.
The wacom driver's IRQ handler for Bluetooth reports from the 2nd-gen Intuos Pro does not correctly process negative numbers. Values for tilt and rotation (which can go negative) are instead interpreted as unsigned and so jump to very large values when the data should be negative. This commit properly casts the data to ensure we report negative numbers when necessary.
--- drivers/hid/wacom_wac.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/hid/wacom_wac.c +3 -3
@@ -1229,9 +1229,9 @@ static void wacom_intuos_pro2_bt_pen(strif (range) {input_report_abs (pen_input,ABS_X ,get_unaligned_le16 (&frame[1 ]));input_report_abs (pen_input,ABS_Y ,get_unaligned_le16 (&frame[3 ])); -input_report_abs (pen_input,ABS_TILT_X , frame[7 ]); -input_report_abs (pen_input,ABS_TILT_Y , frame[8 ]); -input_report_abs (pen_input,ABS_Z ,get_unaligned_le16 (&frame[9 ])); +input_report_abs (pen_input,ABS_TILT_X , (char )frame[7 ]); +input_report_abs (pen_input,ABS_TILT_Y , (char )frame[8 ]); +input_report_abs (pen_input,ABS_Z , (int16_t )get_unaligned_le16 (&frame[9 ]));input_report_abs (pen_input,ABS_WHEEL ,get_unaligned_le16 (&frame[11 ])); }input_report_abs (pen_input,ABS_PRESSURE ,get_unaligned_le16 (&frame[5 ]));
Greg Kroah-Hartman
maintainerPATCH 132/160 HID: wacom: Correct coordinate system of touchring and pen twist
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit d252f4a10fb9c8f7187c6c936ff530039f8cb799 upstream.
The MobileStudio Pro, Cintiq Pro, and 2nd-gen Intuos Pro devices use a different coordinate system for their touchring and pen twist than prior devices. Prior devices had zero aligned to the tablet's left and would increase clockwise. Userspace expects data from the kernel to be in this old coordinate space, so adjustments are necessary.
While the coordinate system for pen twist is formally defined by the HID standard, no such definition existed for the touchring at the time these tablets were introduced. Future tablets are expected to report touchring data using the same "zero-up clockwise-increasing" coordinate system defined for twist.
--- drivers/hid/wacom_wac.c | 73 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 68 insertions(+), 5 deletions(-)
drivers/hid/wacom_wac.c +68 -5
@@ -1227,11 +1227,17 @@ static void wacom_intuos_pro2_bt_pen(strcontinue ;if (range) { +/* Fix rotation alignment: userspace expects zero at left */ +int16_t rotation = (int16_t )get_unaligned_le16 (&frame[9 ]); + rotation +=1800 /4 ; +if (rotation >899 ) + rotation -=1800 ; +input_report_abs (pen_input,ABS_X ,get_unaligned_le16 (&frame[1 ]));input_report_abs (pen_input,ABS_Y ,get_unaligned_le16 (&frame[3 ]));input_report_abs (pen_input,ABS_TILT_X , (char )frame[7 ]);input_report_abs (pen_input,ABS_TILT_Y , (char )frame[8 ]); -input_report_abs (pen_input,ABS_Z , (int16_t )get_unaligned_le16 (&frame[9 ])); +input_report_abs (pen_input,ABS_Z , rotation);input_report_abs (pen_input,ABS_WHEEL ,get_unaligned_le16 (&frame[11 ])); }input_report_abs (pen_input,ABS_PRESSURE ,get_unaligned_le16 (&frame[5 ]));
@@ -1319,12 +1325,19 @@ static void wacom_intuos_pro2_bt_pad(strunsigned char *data = wacom->data;int buttons = (data[282 ] <<1 ) | ((data[281 ] >>6 ) &0x01 ); -int ring = data[285 ]; -int prox = buttons | (ring &0x80 ); +int ring = data[285 ] &0x7F ; +bool ringstatus = data[285 ] &0x80 ; +bool prox = buttons || ringstatus; + +/* Fix touchring data: userspace expects 0 at left and increasing clockwise */ + ring =71 - ring; + ring +=3 *72 /16 ; +if (ring >71 ) + ring -=72 ;wacom_report_numbered_buttons (pad_input,9 , buttons); -input_report_abs (pad_input,ABS_WHEEL , (ring &0x80 ) ? (ring &0x7f ) :0 ); +input_report_abs (pad_input,ABS_WHEEL , ringstatus ? ring :0 );input_report_key (pad_input, wacom->tool[1 ], prox ?1 :0 );input_report_abs (pad_input,ABS_MISC , prox ?PAD_DEVICE_ID :0 );
@@ -1616,6 +1629,20 @@ static int wacom_tpc_irq(struct wacom_wareturn 0 ; } +static int wacom_offset_rotation (struct input_dev *input,struct hid_usage *usage, +int value,int num,int denom) +{ +struct input_absinfo *abs = &input->absinfo[usage->code]; +int range = (abs->maximum - abs->minimum +1 ); + + value += num*range/denom; +if (value > abs->maximum) + value -= range; +else if (value < abs->minimum) + value += range; +return value; +} +int wacom_equivalent_usage (int usage) {if ((usage &HID_USAGE_PAGE ) ==WACOM_HID_UP_WACOMDIGITIZER ) {
@@ -1898,6 +1925,7 @@ static void wacom_wac_pad_event(struct hunsigned equivalent_usage =wacom_equivalent_usage (usage->hid);int i;bool is_touch_on = value; +bool do_report = false;/* * Avoid reporting this event and setting inrange_state if this usage
@@ -1912,6 +1940,29 @@ static void wacom_wac_pad_event(struct h }switch (equivalent_usage) { +case WACOM_HID_WD_TOUCHRING : +/* +* Userspace expects touchrings to increase in value with +* clockwise gestures and have their zero point at the +* tablet's left. HID events "should" be clockwise- +* increasing and zero at top, though the MobileStudio +* Pro and 2nd-gen Intuos Pro don't do this... +*/ +if (hdev->vendor ==0x56a && + (hdev->product ==0x34d || hdev->product ==0x34e ||/* MobileStudio Pro */ + hdev->product ==0x357 || hdev->product ==0x358 )) {/* Intuos Pro 2 */ + value = (field->logical_maximum - value); + +if (hdev->product ==0x357 || hdev->product ==0x358 ) + value =wacom_offset_rotation (input, usage, value,3 ,16 ); +else if (hdev->product ==0x34d || hdev->product ==0x34e ) + value =wacom_offset_rotation (input, usage, value,1 ,2 ); + } +else { + value =wacom_offset_rotation (input, usage, value,1 ,4 ); + } + do_report = true; +break ;case WACOM_HID_WD_TOUCHRINGSTATUS :if (!value)input_event (input, usage->type, usage->code,0 );
@@ -1945,10 +1996,14 @@ static void wacom_wac_pad_event(struct h value, i);/* fall through*/ default : + do_report = true; +break ; + } + +if (do_report) {input_event (input, usage->type, usage->code, value);if (value) wacom_wac->hid_data.pad_input_event_flag = true; -break ; } }
@@ -2089,6 +2144,14 @@ static void wacom_wac_pen_event(struct h wacom_wac->serial[0 ] = (wacom_wac->serial[0 ] & ~0xFFFFFFFFULL ); wacom_wac->serial[0 ] |= (__u32 )value;return ; +case HID_DG_TWIST : +/* +* Userspace expects pen twist to have its zero point when +* the buttons/finger is on the tablet's left. HID values +* are zero when buttons are toward the top. +*/ + value =wacom_offset_rotation (input, usage, value,1 ,4 ); +break ;case WACOM_HID_WD_SENSE : wacom_wac->hid_data.sense_state = value;return ;
Greg Kroah-Hartman
maintainerPATCH 133/160 HID: wacom: generic: Send MSC_SERIAL and ABS_MISC when leaving prox
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 993f0d93f8538c15bd5c12a1a9fd74c777efea1b upstream.
The latest generation of pro devices (MobileStudio Pro, 2nd-gen Intuos Pro, Cintiq Pro) send a serial number of '0' whenever the pen is too far away for reliable communication. Userspace defines that a serial number of '0' is invalid, so we need to be careful not to actually forward this value. Additionally, since EMR ISDv4 devices do not support serial numbers or tool IDs, we'd like to not send these events if they aren't necessary.
The existing code achieves these goals by adding a check for a non-zero serial number within the wacom_wac_pen_report function. The MSC_SERIAL and ABS_MISC events are only sent if the serial number is non-zero. This code fails, however when the pen for a pro device leaves proximity. When the pen leaves prox and the tablet sends a serial of 0, wacom_wac_pen_event dutifully clears the serial number. When wacom_wac_pen_report is called, it does not send either the MSC_SERIAL of the exiting tool nor an ABS_MISC event.
This patch prevents the wacom_wac_pen_event function from clearing an already-set serial number. This ensures that we have the serial number handy when exiting proximity, but requires us to manually clear it afterwards to ensure the driver does not send stale data (e.g. when switching between AES pens that report a serial nubmer of 0 for the first few fully in-proximity packets).
--- drivers/hid/wacom_wac.c | 27 ++++++++++++++++----------- 1 file changed, 16 insertions(+), 11 deletions(-)
drivers/hid/wacom_wac.c +16 -11
@@ -2141,8 +2141,10 @@ static void wacom_wac_pen_event(struct h wacom_wac->hid_data.tipswitch |= value;return ;case HID_DG_TOOLSERIALNUMBER : - wacom_wac->serial[0 ] = (wacom_wac->serial[0 ] & ~0xFFFFFFFFULL ); - wacom_wac->serial[0 ] |= (__u32 )value; +if (value) { + wacom_wac->serial[0 ] = (wacom_wac->serial[0 ] & ~0xFFFFFFFFULL ); + wacom_wac->serial[0 ] |= (__u32 )value; + }return ;case HID_DG_TWIST :/*
@@ -2156,15 +2158,17 @@ static void wacom_wac_pen_event(struct h wacom_wac->hid_data.sense_state = value;return ;case WACOM_HID_WD_SERIALHI : - wacom_wac->serial[0 ] = (wacom_wac->serial[0 ] &0xFFFFFFFF ); - wacom_wac->serial[0 ] |= ((__u64 )value) <<32 ; -/* -* Non-USI EMR devices may contain additional tool type -* information here. See WACOM_HID_WD_TOOLTYPE case for -* more details. -*/ -if (value >>20 ==1 ) { - wacom_wac->id[0 ] |= value &0xFFFFF ; +if (value) { + wacom_wac->serial[0 ] = (wacom_wac->serial[0 ] &0xFFFFFFFF ); + wacom_wac->serial[0 ] |= ((__u64 )value) <<32 ; +/* +* Non-USI EMR devices may contain additional tool type +* information here. See WACOM_HID_WD_TOOLTYPE case for +* more details. +*/ +if (value >>20 ==1 ) { + wacom_wac->id[0 ] |= value &0xFFFFF ; + } }return ;case WACOM_HID_WD_TOOLTYPE :
@@ -2279,6 +2283,7 @@ static void wacom_wac_pen_report(structif (!prox) { wacom_wac->tool[0 ] =0 ; wacom_wac->id[0 ] =0 ; + wacom_wac->serial[0 ] =0 ; } }
Greg Kroah-Hartman
maintainerPATCH 134/160 HID: wacom: generic: Clear ABS_MISC when tool leaves proximity
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 92380b572d95caf48f8424746aeee63c5a2b1922 upstream.
The tool ID information sent in ABS_MISC is expected to be reset to 0 when a tool leaves proximity. Not doing this can cause problems if a tool is removed and then re-introduced. Kernel event filtering will prevent the (identical) ABS_MISC event from being sent when the tool re-enters proxmity. This can cause userspace to not properly set the tool ID.
--- drivers/hid/wacom_wac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/wacom_wac.c +1 -1
@@ -2272,7 +2272,7 @@ static void wacom_wac_pen_report(structinput_report_key (input, wacom_wac->tool[0 ], prox);if (wacom_wac->serial[0 ]) {input_event (input,EV_MSC ,MSC_SERIAL , wacom_wac->serial[0 ]); -input_report_abs (input,ABS_MISC , id); +input_report_abs (input,ABS_MISC , prox ? id :0 ); } wacom_wac->hid_data.tipswitch = false;
Greg Kroah-Hartman
maintainerPATCH 135/160 HID: wacom: Always increment hdev refcount within wacom_get_hdev_data
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 2a5e597c6bb1b873e473e5f57147e9e5d2755430 upstream.
The wacom_get_hdev_data function is used to find and return a reference to the "other half" of a Wacom device (i.e., the touch device associated with a pen, or vice-versa). To ensure these references are properly accounted for, the function is supposed to automatically increment the refcount before returning. This was not done, however, for devices which have pen & touch on different interfaces of the same USB device. This can lead to a WARNING ("refcount_t: underflow; use-after-free") when removing the module or device as we call kref_put() more times than kref_get(). Triggering an "actual" use- after-free would be difficult since both devices will disappear nearly- simultaneously. To silence this warning and prevent the potential error, we need to increment the refcount for all cases within wacom_get_hdev_data.
--- drivers/hid/wacom_sys.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/wacom_sys.c +3 -1
@@ -668,8 +668,10 @@ static struct wacom_hdev_data *wacom_get/* Try to find an already-probed interface from the same device */ list_for_each_entry (data, &wacom_udev_list, list) { -if (compare_device_paths (hdev, data->dev,'/' )) +if (compare_device_paths (hdev, data->dev,'/' )) { +kref_get (&data->kref);return data; + } }/* Fallback to finding devices that appear to be "siblings" */
Greg Kroah-Hartman
maintainerPATCH 136/160 HID: wacom: bits shifted too much for 9th and 10th buttons
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <[email protected]>
commit ce06760ba46b66dae50f2519ae76bd15e89b5710 upstream.
Cintiq 12 has 10 expresskey buttons. The bit shift for the last two buttons were off by 5.
--- drivers/hid/wacom_wac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hid/wacom_wac.c +2 -2
@@ -567,8 +567,8 @@ static int wacom_intuos_pad(struct wacom keys = data[9 ] &0x07 ; } }else { - buttons = ((data[6 ] &0x10 ) <<10 ) | - ((data[5 ] &0x10 ) <<9 ) | + buttons = ((data[6 ] &0x10 ) <<5 ) | + ((data[5 ] &0x10 ) <<4 ) | ((data[6 ] &0x0F ) <<4 ) | (data[5 ] &0x0F ); }
Greg Kroah-Hartman
maintainerPATCH 137/160 btrfs: avoid overflow when sector_t is 32 bit
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Goffredo Baroncelli <[email protected]>
commit 2d8ce70a08fe033c904115d59276ad86adeaa337 upstream.
Jean-Denis Girard noticed commit c821e7f3 "pass bytes to btrfs_bio_alloc" (https://patchwork.kernel.org/patch/9763081/)
introduces a regression on 32 bit machines.
When CONFIG_LBDAF is _not_ defined (CONFIG_LBDAF == Support for large (2TB+) block devices and files) sector_t is 32 bit on 32bit machines.
In the function submit_extent_page, 'sector' (which is sector_t type) is multiplied by 512 to convert it from sectors to bytes, leading to an overflow when the disk is bigger than 4GB (!).
I added a cast to u64 to avoid overflow.
--- fs/btrfs/extent_io.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/extent_io.c +1 -1
@@ -2799,7 +2799,7 @@ static int submit_extent_page(int op, in } } - bio =btrfs_bio_alloc (bdev, sector <<9 ); + bio =btrfs_bio_alloc (bdev, (u64 )sector <<9 );bio_add_page (bio, page, page_size, offset); bio->bi_end_io = end_io_func; bio->bi_private = tree;
Greg Kroah-Hartman
maintainerPATCH 138/160 Btrfs: fix overlap of fs_info::flags values
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tsutomu Itoh <[email protected]>
commit 69ad59767d094752c23c0fc180a79532fde073d0 upstream.
Because the values of BTRFS_FS_EXCL_OP and BTRFS_FS_QUOTA_OVERRIDE overlap, we should change the value.
First, BTRFS_FS_EXCL_OP was set to 14.
commit 171938e52807 ("btrfs: track exclusive filesystem operation in flags")
Next, the value of BTRFS_FS_QUOTA_OVERRIDE was set to 14.
commit f29efe292198 ("btrfs: add quota override flag to enable quota override for CAP_SYS_RESOURCE")
As a result, the value 14 overlapped, by accident.
This problem is solved by defining the value of BTRFS_FS_EXCL_OP as 16, the flags are internal.
--- fs/btrfs/ctree.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/ctree.h +1 -1
@@ -723,7 +723,7 @@ struct btrfs_delayed_root;* Indicate that a whole-filesystem exclusive operation is running * (device replace, resize, device add/delete, balance) */ -#define BTRFS_FS_EXCL_OP 14 +#define BTRFS_FS_EXCL_OP 16struct btrfs_fs_info {u8 fsid[BTRFS_FSID_SIZE ];
Greg Kroah-Hartman
maintainerPATCH 139/160 rocker: fix rocker_tlv_put_* functions for KASAN
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 6098d7ddd62f532f80ee2a4b01aca500a8e4e9e4 upstream.
Inlining these functions creates lots of stack variables that each take 64 bytes when KASAN is enabled, leading to this warning about potential stack overflow:
drivers/net/ethernet/rocker/rocker_ofdpa.c: In function 'ofdpa_cmd_flow_tbl_add':drivers/net/ethernet/rocker/rocker_ofdpa.c:621:1: error: the frame size of 2752 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
gcc-8 can now consolidate the stack slots itself, but on older versions we get the same behavior by using a temporary variable that holds a copy of the inline function argument.
--- drivers/net/ethernet/rocker/rocker_tlv.h | 48 +++++++++++++++++++------------ 1 file changed, 30 insertions(+), 18 deletions(-)
drivers/net/ethernet/rocker/rocker_tlv.h +30 -18
@@ -139,40 +139,52 @@ rocker_tlv_start(struct rocker_desc_infoint rocker_tlv_put (struct rocker_desc_info *desc_info,int attrtype,int attrlen,const void *data); -static inline int rocker_tlv_put_u8 (struct rocker_desc_info *desc_info, -int attrtype,u8 value) +static inline int +rocker_tlv_put_u8 (struct rocker_desc_info *desc_info,int attrtype,u8 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (u8), &value); +u8 tmp = value;/* work around GCC PR81715 */ + +return rocker_tlv_put (desc_info, attrtype,sizeof (u8), &tmp); } -static inline int rocker_tlv_put_u16 (struct rocker_desc_info *desc_info, -int attrtype,u16 value) +static inline int +rocker_tlv_put_u16 (struct rocker_desc_info *desc_info,int attrtype,u16 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (u16), &value); +u16 tmp = value; + +return rocker_tlv_put (desc_info, attrtype,sizeof (u16), &tmp); } -static inline int rocker_tlv_put_be16 (struct rocker_desc_info *desc_info, -int attrtype,__be16 value) +static inline int +rocker_tlv_put_be16 (struct rocker_desc_info *desc_info,int attrtype,__be16 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (__be16), &value); +__be16 tmp = value; + +return rocker_tlv_put (desc_info, attrtype,sizeof (__be16), &tmp); } -static inline int rocker_tlv_put_u32 (struct rocker_desc_info *desc_info, -int attrtype,u32 value) +static inline int +rocker_tlv_put_u32 (struct rocker_desc_info *desc_info,int attrtype,u32 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (u32), &value); +u32 tmp = value; + +return rocker_tlv_put (desc_info, attrtype,sizeof (u32), &tmp); } -static inline int rocker_tlv_put_be32 (struct rocker_desc_info *desc_info, -int attrtype,__be32 value) +static inline int +rocker_tlv_put_be32 (struct rocker_desc_info *desc_info,int attrtype,__be32 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (__be32), &value); +__be32 tmp = value; + +return rocker_tlv_put (desc_info, attrtype,sizeof (__be32), &tmp); } -static inline int rocker_tlv_put_u64 (struct rocker_desc_info *desc_info, -int attrtype,u64 value) +static inline int +rocker_tlv_put_u64 (struct rocker_desc_info *desc_info,int attrtype,u64 value) { -return rocker_tlv_put (desc_info, attrtype,sizeof (u64), &value); +u64 tmp = value; + +return rocker_tlv_put (desc_info, attrtype,sizeof (u64), &tmp); } static inline struct rocker_tlv *
Greg Kroah-Hartman
maintainerPATCH 140/160 netlink: fix nla_put_{u8,u16,u32} for KASAN
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit b4391db42308c9940944b5d7be5ca4b78fb88dd0 upstream.
When CONFIG_KASAN is enabled, the "--param asan-stack=1" causes rather large stack frames in some functions. This goes unnoticed normally because CONFIG_FRAME_WARN is disabled with CONFIG_KASAN by default as of commit 3f181b4d8652 ("lib/Kconfig.debug: disable -Wframe-larger-than warnings with KASAN=y").
The kernelci.org build bot however has the warning enabled and that led me to investigate it a little further, as every build produces these warnings:
net/wireless/nl80211.c:4389:1: warning: the frame size of 2240 bytes is larger than 2048 bytes [-Wframe-larger-than=] net/wireless/nl80211.c:1895:1: warning: the frame size of 3776 bytes is larger than 2048 bytes [-Wframe-larger-than=] net/wireless/nl80211.c:1410:1: warning: the frame size of 2208 bytes is larger than 2048 bytes [-Wframe-larger-than=] net/bridge/br_netlink.c:1282:1: warning: the frame size of 2544 bytes is larger than 2048 bytes [-Wframe-larger-than=]
Most of this problem is now solved in gcc-8, which can consolidate the stack slots for the inline function arguments. On older compilers we can add a workaround by declaring a local variable in each function to pass the inline function argument.
--- include/net/netlink.h | 73 +++++++++++++++++++++++++++++++++++++------------- 1 file changed, 55 insertions(+), 18 deletions(-)
include/net/netlink.h +55 -18
@@ -768,7 +768,10 @@ static inline int nla_parse_nested(struc*/ static inline int nla_put_u8 (struct sk_buff *skb,int attrtype,u8 value) { -return nla_put (skb, attrtype,sizeof (u8), &value); +/* temporary variables to work around GCC PR81715 with asan-stack=1 */ +u8 tmp = value; + +return nla_put (skb, attrtype,sizeof (u8), &tmp); }/**
@@ -779,7 +782,9 @@ static inline int nla_put_u8(struct sk_b*/ static inline int nla_put_u16 (struct sk_buff *skb,int attrtype,u16 value) { -return nla_put (skb, attrtype,sizeof (u16), &value); +u16 tmp = value; + +return nla_put (skb, attrtype,sizeof (u16), &tmp); }/**
@@ -790,7 +795,9 @@ static inline int nla_put_u16(struct sk_*/ static inline int nla_put_be16 (struct sk_buff *skb,int attrtype,__be16 value) { -return nla_put (skb, attrtype,sizeof (__be16), &value); +__be16 tmp = value; + +return nla_put (skb, attrtype,sizeof (__be16), &tmp); }/**
@@ -801,7 +808,9 @@ static inline int nla_put_be16(struct sk*/ static inline int nla_put_net16 (struct sk_buff *skb,int attrtype,__be16 value) { -return nla_put_be16 (skb, attrtype |NLA_F_NET_BYTEORDER , value); +__be16 tmp = value; + +return nla_put_be16 (skb, attrtype |NLA_F_NET_BYTEORDER , tmp); }/**
@@ -812,7 +821,9 @@ static inline int nla_put_net16(struct s*/ static inline int nla_put_le16 (struct sk_buff *skb,int attrtype,__le16 value) { -return nla_put (skb, attrtype,sizeof (__le16), &value); +__le16 tmp = value; + +return nla_put (skb, attrtype,sizeof (__le16), &tmp); }/**
@@ -823,7 +834,9 @@ static inline int nla_put_le16(struct sk*/ static inline int nla_put_u32 (struct sk_buff *skb,int attrtype,u32 value) { -return nla_put (skb, attrtype,sizeof (u32), &value); +u32 tmp = value; + +return nla_put (skb, attrtype,sizeof (u32), &tmp); }/**
@@ -834,7 +847,9 @@ static inline int nla_put_u32(struct sk_*/ static inline int nla_put_be32 (struct sk_buff *skb,int attrtype,__be32 value) { -return nla_put (skb, attrtype,sizeof (__be32), &value); +__be32 tmp = value; + +return nla_put (skb, attrtype,sizeof (__be32), &tmp); }/**
@@ -845,7 +860,9 @@ static inline int nla_put_be32(struct sk*/ static inline int nla_put_net32 (struct sk_buff *skb,int attrtype,__be32 value) { -return nla_put_be32 (skb, attrtype |NLA_F_NET_BYTEORDER , value); +__be32 tmp = value; + +return nla_put_be32 (skb, attrtype |NLA_F_NET_BYTEORDER , tmp); }/**
@@ -856,7 +873,9 @@ static inline int nla_put_net32(struct s*/ static inline int nla_put_le32 (struct sk_buff *skb,int attrtype,__le32 value) { -return nla_put (skb, attrtype,sizeof (__le32), &value); +__le32 tmp = value; + +return nla_put (skb, attrtype,sizeof (__le32), &tmp); }/**
@@ -869,7 +888,9 @@ static inline int nla_put_le32(struct skstatic inline int nla_put_u64_64bit (struct sk_buff *skb,int attrtype,u64 value,int padattr) { -return nla_put_64bit (skb, attrtype,sizeof (u64), &value, padattr); +u64 tmp = value; + +return nla_put_64bit (skb, attrtype,sizeof (u64), &tmp, padattr); }/**
@@ -882,7 +903,9 @@ static inline int nla_put_u64_64bit(strustatic inline int nla_put_be64 (struct sk_buff *skb,int attrtype,__be64 value,int padattr) { -return nla_put_64bit (skb, attrtype,sizeof (__be64), &value, padattr); +__be64 tmp = value; + +return nla_put_64bit (skb, attrtype,sizeof (__be64), &tmp, padattr); }/**
@@ -895,7 +918,9 @@ static inline int nla_put_be64(struct skstatic inline int nla_put_net64 (struct sk_buff *skb,int attrtype,__be64 value,int padattr) { -return nla_put_be64 (skb, attrtype |NLA_F_NET_BYTEORDER , value, +__be64 tmp = value; + +return nla_put_be64 (skb, attrtype |NLA_F_NET_BYTEORDER , tmp, padattr); }
@@ -909,7 +934,9 @@ static inline int nla_put_net64(struct sstatic inline int nla_put_le64 (struct sk_buff *skb,int attrtype,__le64 value,int padattr) { -return nla_put_64bit (skb, attrtype,sizeof (__le64), &value, padattr); +__le64 tmp = value; + +return nla_put_64bit (skb, attrtype,sizeof (__le64), &tmp, padattr); }/**
@@ -920,7 +947,9 @@ static inline int nla_put_le64(struct sk*/ static inline int nla_put_s8 (struct sk_buff *skb,int attrtype,s8 value) { -return nla_put (skb, attrtype,sizeof (s8), &value); +s8 tmp = value; + +return nla_put (skb, attrtype,sizeof (s8), &tmp); }/**
@@ -931,7 +960,9 @@ static inline int nla_put_s8(struct sk_b*/ static inline int nla_put_s16 (struct sk_buff *skb,int attrtype,s16 value) { -return nla_put (skb, attrtype,sizeof (s16), &value); +s16 tmp = value; + +return nla_put (skb, attrtype,sizeof (s16), &tmp); }/**
@@ -942,7 +973,9 @@ static inline int nla_put_s16(struct sk_*/ static inline int nla_put_s32 (struct sk_buff *skb,int attrtype,s32 value) { -return nla_put (skb, attrtype,sizeof (s32), &value); +s32 tmp = value; + +return nla_put (skb, attrtype,sizeof (s32), &tmp); }/**
@@ -955,7 +988,9 @@ static inline int nla_put_s32(struct sk_static inline int nla_put_s64 (struct sk_buff *skb,int attrtype,s64 value,int padattr) { -return nla_put_64bit (skb, attrtype,sizeof (s64), &value, padattr); +s64 tmp = value; + +return nla_put_64bit (skb, attrtype,sizeof (s64), &tmp, padattr); }/**
@@ -1005,7 +1040,9 @@ static inline int nla_put_msecs(struct sstatic inline int nla_put_in_addr (struct sk_buff *skb,int attrtype,__be32 addr) { -return nla_put_be32 (skb, attrtype, addr); +__be32 tmp = addr; + +return nla_put_be32 (skb, attrtype, tmp); }/**
Greg Kroah-Hartman
maintainerPATCH 141/160 dm crypt: reject sector_size feature if device length is not aligned to it
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Milan Broz <[email protected]>
commit 783874b050768d361239e444ba0fa396bb6d463f upstream.
If a crypt mapping uses optional sector_size feature, additional restrictions to mapped device segment size must be applied in constructor, otherwise the device activation will fail later.
--- drivers/md/dm-crypt.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/md/dm-crypt.c +4 -0
@@ -2588,6 +2588,10 @@ static int crypt_ctr_optional(struct dm_ ti->error ="Invalid feature value for sector_size" ;return -EINVAL ; } +if (ti->len & ((cc->sector_size >>SECTOR_SHIFT ) -1 )) { + ti->error ="Device size is not multiple of sector_size feature" ; +return -EINVAL ; + } cc->sector_shift =__ffs (cc->sector_size) -SECTOR_SHIFT ; }else if (!strcasecmp (opt_string,"iv_large_sectors" ))set_bit (CRYPT_IV_LARGE_SECTORS , &cc->cipher_flags);
Greg Kroah-Hartman
maintainerPATCH 142/160 dm ioctl: fix alignment of event number in the device list
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit 62e082430ea4bb5b28909ca4375bb683931e22aa upstream.
The size of struct dm_name_list is different on 32-bit and 64-bit kernels (so "(nl + 1)" differs between 32-bit and 64-bit kernels).
This mismatch caused some harmless difference in padding when using 32-bit or 64-bit kernel. Commit 23d70c5e52dd ("dm ioctl: report event number in DM_LIST_DEVICES") added reporting event number in the output of DM_LIST_DEVICES_CMD. This difference in padding makes it impossible for userspace to determine the location of the event number (the location would be different when running on 32-bit and 64-bit kernels).
Fix the padding by using offsetof(struct dm_name_list, name) instead of sizeof(struct dm_name_list) to determine the location of entries.
Also, the ioctl version number is incremented to 37 so that userspace can use the version number to determine that the event number is present and correctly located.
In addition, a global event is now raised when a DM device is created, removed, renamed or when table is swapped, so that the user can monitor for device changes.
--- drivers/md/dm-core.h | 1 + drivers/md/dm-ioctl.c | 37 ++++++++++++++++++++++++------------- drivers/md/dm.c | 10 ++++++++-- include/uapi/linux/dm-ioctl.h | 4 ++-- 4 files changed, 35 insertions(+), 17 deletions(-)
drivers/md/dm-core.h +1 -0
@@ -149,5 +149,6 @@ static inline bool dm_message_test_buffeextern atomic_t dm_global_event_nr;extern wait_queue_head_t dm_global_eventq; +void dm_issue_global_event (void );#endif
drivers/md/dm-ioctl.c +24 -13
@@ -477,9 +477,13 @@ static int remove_all(struct file *filp,* Round up the ptr to an 8-byte boundary. */ #define ALIGN_MASK 7 +static inline size_t align_val (size_t val) +{ +return (val +ALIGN_MASK ) & ~ALIGN_MASK ; +}static inline void *align_ptr (void *ptr) { -return (void *) (((size_t ) (ptr +ALIGN_MASK )) & ~ALIGN_MASK ); +return (void *)align_val ((size_t )ptr); }/*
@@ -505,7 +509,7 @@ static int list_devices(struct file *filstruct hash_cell *hc;size_t len, needed =0 ;struct gendisk *disk; -struct dm_name_list *nl, *old_nl =NULL ; +struct dm_name_list *orig_nl, *nl, *old_nl =NULL ;uint32_t *event_nr;down_write (&_hash_lock);
@@ -516,17 +520,15 @@ static int list_devices(struct file *fil*/ for (i =0 ; i <NUM_BUCKETS ; i++) { list_for_each_entry (hc, _name_buckets + i, name_list) { - needed +=sizeof (struct dm_name_list ); - needed +=strlen (hc->name) +1 ; - needed +=ALIGN_MASK ; - needed += (sizeof (uint32_t ) +ALIGN_MASK ) & ~ALIGN_MASK ; + needed +=align_val (offsetof(struct dm_name_list , name) +strlen (hc->name) +1 ); + needed +=align_val (sizeof (uint32_t )); } }/* * Grab our output buffer. */ - nl =get_result_buffer (param, param_size, &len); + nl = orig_nl =get_result_buffer (param, param_size, &len);if (len < needed) { param->flags |=DM_BUFFER_FULL_FLAG ; goto out;
@@ -549,11 +551,16 @@ static int list_devices(struct file *filstrcpy (nl->name, hc->name); old_nl = nl; - event_nr =align_ptr (((void *) (nl +1 )) +strlen (hc->name) +1 ); + event_nr =align_ptr (nl->name +strlen (hc->name) +1 ); *event_nr =dm_get_event_nr (hc->md); nl =align_ptr (event_nr +1 ); } } +/* +* If mismatch happens, security may be compromised due to buffer +* overflow, so it's better to crash. +*/ +BUG_ON ((char *)nl - (char *)orig_nl != needed); out:up_write (&_hash_lock);
@@ -1621,7 +1628,8 @@ static int target_message(struct file *f* which has a variable size, is not used by the function processing * the ioctl. */ -#define IOCTL_FLAGS_NO_PARAMS 1 +#define IOCTL_FLAGS_NO_PARAMS 1 +#define IOCTL_FLAGS_ISSUE_GLOBAL_EVENT 2/*----------------------------------------------------------------- * Implementation of open/close/ioctl on the special char
@@ -1635,12 +1643,12 @@ static ioctl_fn lookup_ioctl(unsigned inioctl_fn fn; } _ioctls[] = { {DM_VERSION_CMD, 0, NULL}, /* version is dealt with elsewhere */ - {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS, remove_all}, + {DM_REMOVE_ALL_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, remove_all}, {DM_LIST_DEVICES_CMD, 0, list_devices}, - {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_create}, - {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS, dev_remove}, - {DM_DEV_RENAME_CMD, 0, dev_rename}, + {DM_DEV_CREATE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_create}, + {DM_DEV_REMOVE_CMD, IOCTL_FLAGS_NO_PARAMS | IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_remove}, + {DM_DEV_RENAME_CMD, IOCTL_FLAGS_ISSUE_GLOBAL_EVENT, dev_rename}, {DM_DEV_SUSPEND_CMD, IOCTL_FLAGS_NO_PARAMS, dev_suspend}, {DM_DEV_STATUS_CMD, IOCTL_FLAGS_NO_PARAMS, dev_status}, {DM_DEV_WAIT_CMD, 0, dev_wait},
@@ -1869,6 +1877,9 @@ static int ctl_ioctl(struct file *file, unlikely(ioctl_flags & IOCTL_FLAGS_NO_PARAMS))DMERR ("ioctl %d tried to output some data but has IOCTL_FLAGS_NO_PARAMS set" , cmd); +if (!r && ioctl_flags &IOCTL_FLAGS_ISSUE_GLOBAL_EVENT ) +dm_issue_global_event (); +/* * Copy the results back to userland. */
drivers/md/dm.c +8 -2
@@ -52,6 +52,12 @@ static struct workqueue_struct *deferredatomic_t dm_global_event_nr =ATOMIC_INIT (0 );DECLARE_WAIT_QUEUE_HEAD (dm_global_eventq); +void dm_issue_global_event (void ) +{ +atomic_inc (&dm_global_event_nr); +wake_up (&dm_global_eventq); +} +/* * One of these is allocated per bio. */
@@ -1865,9 +1871,8 @@ static void event_callback(void *contextdm_send_uevents (&uevents, &disk_to_dev (md->disk)->kobj);atomic_inc (&md->event_nr); -atomic_inc (&dm_global_event_nr);wake_up (&md->eventq); -wake_up (&dm_global_eventq); +dm_issue_global_event (); }/*
@@ -2283,6 +2288,7 @@ struct dm_table *dm_swap_table(struct ma } map =__bind (md, table, &limits); +dm_issue_global_event (); out:mutex_unlock (&md->suspend_lock);
include/uapi/linux/dm-ioctl.h +2 -2
@@ -269,9 +269,9 @@ enum {#define DM_DEV_SET_GEOMETRY _IOWR(DM_IOCTL, DM_DEV_SET_GEOMETRY_CMD, struct dm_ioctl)#define DM_VERSION_MAJOR 4 -#define DM_VERSION_MINOR 36 +#define DM_VERSION_MINOR 37#define DM_VERSION_PATCHLEVEL 0 -#define DM_VERSION_EXTRA "-ioctl (2017-06-09)" +#define DM_VERSION_EXTRA "-ioctl (2017-09-20)"/* Status bits */ #define DM_READONLY_FLAG (1 << 0)/* In/Out */
Greg Kroah-Hartman
maintainerPATCH 143/160 dm crypt: fix memory leak in crypt_ctr_cipher_old()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffy Chen <[email protected]>
commit bd86e32059526e2d0d13ca1e4447dfbbddb6e5cc upstream.
Fix memory leak of cipher_api.
--- drivers/md/dm-crypt.c | 1 + 1 file changed, 1 insertion(+)
drivers/md/dm-crypt.c +1 -0
@@ -2470,6 +2470,7 @@ static int crypt_ctr_cipher_old(struct dkfree (cipher_api);return ret; } +kfree (cipher_api);return 0 ; bad_mem:
Greg Kroah-Hartman
maintainerPATCH 146/160 iwlwifi: mvm: use IWL_HCMD_NOCOPY for MCAST_FILTER_CMD
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Coelho <[email protected]>
commit 97bce57bd7f96e1218751996f549a6e61f18cc8c upstream.
The MCAST_FILTER_CMD can get quite large when we have many mcast addresses to set (we support up to 255). So the command should be send as NOCOPY to prevent a warning caused by too-long commands:
WARNING: CPU: 0 PID: 9700 at /root/iwlwifi/stack-dev/drivers/net/wireless/intel/iwlwifi/pcie/tx.c:1550 iwl_pcie_enqueue_hcmd+0x8c7/0xb40 [iwlwifi]
Command MCAST_FILTER_CMD (0x1d0) is too large (328 bytes)
This fixes: https://bugzilla.kernel.org/show_bug.cgi?id=196743
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +9 -1
@@ -1589,6 +1589,11 @@ static void iwl_mvm_mc_iface_iterator(vostruct iwl_mvm_mc_iter_data *data = _data;struct iwl_mvm *mvm = data->mvm;struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd; +struct iwl_host_cmd hcmd = { + .id =MCAST_FILTER_CMD , + .flags =CMD_ASYNC , + .dataflags[0 ] =IWL_HCMD_DFL_NOCOPY , + };int ret, len;/* if we don't have free ports, mcast frames will be dropped */
@@ -1603,7 +1608,10 @@ static void iwl_mvm_mc_iface_iterator(vomemcpy (cmd->bssid, vif->bss_conf.bssid,ETH_ALEN ); len =roundup (sizeof (*cmd) + cmd->count *ETH_ALEN ,4 ); - ret =iwl_mvm_send_cmd_pdu (mvm,MCAST_FILTER_CMD ,CMD_ASYNC , len, cmd); + hcmd.len[0 ] = len; + hcmd.data[0 ] = cmd; + + ret =iwl_mvm_send_cmd (mvm, &hcmd);if (ret)IWL_ERR (mvm,"mcast filter cmd error. ret=%d\n" , ret); }
Greg Kroah-Hartman
maintainerPATCH 147/160 scsi: sd: Implement blacklist option for WRITE SAME w/ UNMAP
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit 28a0bc4120d38a394499382ba21d6965a67a3703 upstream.
SBC-4 states:
"A MAXIMUM UNMAP LBA COUNT field set to a non-zero value indicates the
maximum number of LBAs that may be unmapped by an UNMAP command"
"A MAXIMUM WRITE SAME LENGTH field set to a non-zero value indicates
the maximum number of contiguous logical blocks that the device server allows to be unmapped or written in a single WRITE SAME command."
Despite the spec being clear on the topic, some devices incorrectly expect WRITE SAME commands with the UNMAP bit set to be limited to the value reported in MAXIMUM UNMAP LBA COUNT in the Block Limits VPD.
Implement a blacklist option that can be used to accommodate devices with this behavior.
--- drivers/scsi/scsi_scan.c | 3 +++ drivers/scsi/sd.c | 16 ++++++++++++---- include/scsi/scsi_device.h | 1 + include/scsi/scsi_devinfo.h | 1 + 4 files changed, 17 insertions(+), 4 deletions(-)
drivers/scsi/scsi_scan.c +3 -0
@@ -956,6 +956,9 @@ static int scsi_add_lun(struct scsi_deviif (*bflags &BLIST_NO_DIF ) sdev->no_dif =1 ; +if (*bflags &BLIST_UNMAP_LIMIT_WS ) + sdev->unmap_limit_for_ws =1 ; + sdev->eh_timeout =SCSI_DEFAULT_EH_TIMEOUT ;if (*bflags &BLIST_TRY_VPD_PAGES )
drivers/scsi/sd.c +12 -4
@@ -715,13 +715,21 @@ static void sd_config_discard(struct scsbreak ;case SD_LBP_WS16 : - max_blocks =min_not_zero (sdkp->max_ws_blocks, - (u32 )SD_MAX_WS16_BLOCKS ); +if (sdkp->device->unmap_limit_for_ws) + max_blocks = sdkp->max_unmap_blocks; +else + max_blocks = sdkp->max_ws_blocks; + + max_blocks =min_not_zero (max_blocks, (u32 )SD_MAX_WS16_BLOCKS );break ;case SD_LBP_WS10 : - max_blocks =min_not_zero (sdkp->max_ws_blocks, - (u32 )SD_MAX_WS10_BLOCKS ); +if (sdkp->device->unmap_limit_for_ws) + max_blocks = sdkp->max_unmap_blocks; +else + max_blocks = sdkp->max_ws_blocks; + + max_blocks =min_not_zero (max_blocks, (u32 )SD_MAX_WS10_BLOCKS );break ;case SD_LBP_ZERO :
include/scsi/scsi_device.h +1 -0
@@ -182,6 +182,7 @@ struct scsi_device { unsigned no_dif:1; /* T10 PI (DIF) should be disabled */ unsigned broken_fua:1; /* Don't set FUA bit */ unsigned lun_in_cdb:1; /* Store LUN bits in CDB[1] */ + unsigned unmap_limit_for_ws:1; /* Use the UNMAP limit for WRITE SAME */atomic_t disk_events_disable_depth;/* disable depth for disk events */
include/scsi/scsi_devinfo.h +1 -0
@@ -29,5 +29,6 @@#define BLIST_TRY_VPD_PAGES 0x10000000/* Attempt to read VPD pages */ #define BLIST_NO_RSOC 0x20000000/* don't try to issue RSOC */ #define BLIST_MAX_1024 0x40000000/* maximum 1024 sector cdb length */ +#define BLIST_UNMAP_LIMIT_WS 0x80000000/* Use UNMAP limit for WRITE SAME */ #endif
Greg Kroah-Hartman
maintainerPATCH 148/160 scsi: sd: Do not override max_sectors_kb sysfs setting
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <[email protected]>
commit 77082ca503bed061f7fbda7cfd7c93beda967a41 upstream.
A user may lower the max_sectors_kb setting in sysfs to accommodate certain workloads. Previously we would always set the max I/O size to either the block layer default or the optional preferred I/O size reported by the device.
Keep the current heuristics for the initial setting of max_sectors_kb. For subsequent invocations, only update the current queue limit if it exceeds the capabilities of the hardware.
--- drivers/scsi/sd.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/scsi/sd.c +14 -5
@@ -3109,8 +3109,6 @@ static int sd_revalidate_disk(struct gensd_read_security (sdkp, buffer); } - sdkp->first_scan =0 ; -/* * We now have all cache related info, determine how we deal * with flush requests.
@@ -3125,7 +3123,7 @@ static int sd_revalidate_disk(struct gen q->limits.max_dev_sectors =logical_to_sectors (sdp, dev_max);/* -* Use the device's preferred I/O size for reads and writes +* Determine the device's preferred I/O size for reads and writes * unless the reported value is unreasonably small, large, or * garbage. */
@@ -3139,8 +3137,19 @@ static int sd_revalidate_disk(struct gen rw_max =min_not_zero (logical_to_sectors (sdp, dev_max), (sector_t )BLK_DEF_MAX_SECTORS ); -/* Combine with controller limits */ - q->limits.max_sectors =min (rw_max,queue_max_hw_sectors (q)); +/* Do not exceed controller limit */ + rw_max =min (rw_max,queue_max_hw_sectors (q)); + +/* +* Only update max_sectors if previously unset or if the current value +* exceeds the capabilities of the hardware. +*/ +if (sdkp->first_scan || + q->limits.max_sectors > q->limits.max_dev_sectors || + q->limits.max_sectors > q->limits.max_hw_sectors) + q->limits.max_sectors = rw_max; + + sdkp->first_scan =0 ;set_capacity (disk,logical_to_sectors (sdp, sdkp->capacity));sd_config_write_same (sdkp);
Greg Kroah-Hartman
maintainerPATCH 149/160 brcmfmac: add length check in brcmf_cfg80211_escan_handler()
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend Van Spriel <[email protected]>
commit 17df6453d4be17910456e99c5a85025aa1b7a246 upstream.
Upon handling the firmware notification for scans the length was checked properly and may result in corrupting kernel heap memory due to buffer overruns. This fix addresses CVE-2017-0786.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 18 ++++++++++-- 1 file changed, 15 insertions(+), 3 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +15 -3
@@ -3162,6 +3162,7 @@ brcmf_cfg80211_escan_handler(struct brcmstruct brcmf_cfg80211_info *cfg = ifp->drvr->config;s32 status;struct brcmf_escan_result_le *escan_result_le; +u32 escan_buflen;struct brcmf_bss_info_le *bss_info_le;struct brcmf_bss_info_le *bss =NULL ;u32 bi_length;
@@ -3181,11 +3182,23 @@ brcmf_cfg80211_escan_handler(struct brcmif (status ==BRCMF_E_STATUS_PARTIAL ) {brcmf_dbg (SCAN ,"ESCAN Partial result\n" ); +if (e->datalen <sizeof (*escan_result_le)) { +brcmf_err ("invalid event data length\n" ); + goto exit; + } escan_result_le = (struct brcmf_escan_result_le *) data;if (!escan_result_le) {brcmf_err ("Invalid escan result (NULL pointer)\n" ); goto exit; } + escan_buflen =le32_to_cpu (escan_result_le->buflen); +if (escan_buflen >BRCMF_ESCAN_BUF_SIZE || + escan_buflen > e->datalen || + escan_buflen <sizeof (*escan_result_le)) { +brcmf_err ("Invalid escan buffer length: %d\n" , + escan_buflen); + goto exit; + }if (le16_to_cpu (escan_result_le->bss_count) !=1 ) {brcmf_err ("Invalid bss_count %d: ignoring\n" , escan_result_le->bss_count);
@@ -3202,9 +3215,8 @@ brcmf_cfg80211_escan_handler(struct brcm } bi_length =le32_to_cpu (bss_info_le->length); -if (bi_length != (le32_to_cpu (escan_result_le->buflen) - -WL_ESCAN_RESULTS_FIXED_SIZE )) { -brcmf_err ("Invalid bss_info length %d: ignoring\n" , +if (bi_length != escan_buflen -WL_ESCAN_RESULTS_FIXED_SIZE ) { +brcmf_err ("Ignoring invalid bss_info length: %d\n" , bi_length); goto exit; }
Greg Kroah-Hartman
maintainerPATCH 150/160 brcmfmac: setup passive scan if requested by user-space
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arend Van Spriel <[email protected]>
commit 35f62727df0ed8e5e4857e162d94fd46d861f1cf upstream.
The driver was not properly configuring firmware with regard to the type of scan. It always performed an active scan even when user-space was requesting for passive scan, ie. the scan request was done without any SSIDs specified.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 19 ++-------- drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h | 5 ++ 2 files changed, 9 insertions(+), 15 deletions(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +4 -15
@@ -980,7 +980,7 @@ static void brcmf_escan_prep(struct brcmeth_broadcast_addr (params_le->bssid); params_le->bss_type =DOT11_BSSTYPE_ANY ; - params_le->scan_type =0 ; + params_le->scan_type =BRCMF_SCANTYPE_ACTIVE ; params_le->channel_num =0 ; params_le->nprobes =cpu_to_le32 (-1 ); params_le->active_time =cpu_to_le32 (-1 );
@@ -988,12 +988,9 @@ static void brcmf_escan_prep(struct brcm params_le->home_time =cpu_to_le32 (-1 );memset (¶ms_le->ssid_le,0 ,sizeof (params_le->ssid_le)); -/* if request is null exit so it will be all channel broadcast scan */ -if (!request) -return ; - n_ssids = request->n_ssids; n_channels = request->n_channels; +/* Copy channel array if applicable */ brcmf_dbg (SCAN ,"### List of channelspecs to scan ### %d\n" , n_channels);
@@ -1030,16 +1027,8 @@ static void brcmf_escan_prep(struct brcm ptr +=sizeof (ssid_le); } }else { -brcmf_dbg (SCAN ,"Broadcast scan %p\n" , request->ssids); -if ((request->ssids) && request->ssids->ssid_len) { -brcmf_dbg (SCAN ,"SSID %s len=%d\n" , - params_le->ssid_le.SSID, - request->ssids->ssid_len); - params_le->ssid_le.SSID_len = -cpu_to_le32 (request->ssids->ssid_len); -memcpy (¶ms_le->ssid_le.SSID, request->ssids->ssid, - request->ssids->ssid_len); - } +brcmf_dbg (SCAN ,"Performing passive scan\n" ); + params_le->scan_type =BRCMF_SCANTYPE_PASSIVE ; }/* Adding mask to channel numbers */ params_le->channel_num =
drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h +5 -0
@@ -45,6 +45,11 @@#define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff#define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 +/* scan type definitions */ +#define BRCMF_SCANTYPE_DEFAULT 0xFF +#define BRCMF_SCANTYPE_ACTIVE 0 +#define BRCMF_SCANTYPE_PASSIVE 1 +#define BRCMF_WSEC_MAX_PSK_LEN 32#define BRCMF_WSEC_PASSPHRASE BIT(0)
Greg Kroah-Hartman
maintainerPATCH 153/160 bsg-lib: fix use-after-free under memory-pressure
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Block <[email protected]>
commit eab40cf336065e8d765e006b81ff48c5c114b365 upstream.
When under memory-pressure it is possible that the mempool which backs the 'struct request_queue' will make use of up to BLKDEV_MIN_RQ count emergency buffers - in case it can't get a regular allocation. These buffers are preallocated and once they are also used, they are re-supplied with old finished requests from the same request_queue (see mempool_free()).
The bug is, when re-supplying the emergency pool, the old requests are not again ran through the callback mempool_t->alloc(), and thus also not through the callback bsg_init_rq(). Thus we skip initialization, and while the sense-buffer still should be good, scsi_request->cmd might have become to be an invalid pointer in the meantime. When the request is initialized in bsg.c, and the user's CDB is larger than BLK_MAX_CDB, bsg will replace it with a custom allocated buffer, which is freed when the user's command is finished, thus it dangles afterwards. When next a command is sent by the user that has a smaller/similar CDB as BLK_MAX_CDB, bsg will assume that scsi_request->cmd is backed by scsi_request->__cmd, will not make a custom allocation, and write into undefined memory.
Fix this by splitting bsg_init_rq() into two functions:
- bsg_init_rq() is changed to only do the allocation of the sense-buffer, which is used to back the bsg job's reply buffer. This pointer should never change during the lifetime of a scsi_request, so it doesn't need re-initialization.
- bsg_initialize_rq() is a new function that makes use of 'struct request_queue's initialize_rq_fn callback (which was introduced in v4.12). This is always called before the request is given out via blk_get_request(). This function does the remaining initialization that was previously done in bsg_init_rq(), and will also do it when the request is taken from the emergency-pool of the backing mempool.
--- block/bsg-lib.c | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-)
block/bsg-lib.c +21 -6
@@ -207,20 +207,34 @@ static int bsg_init_rq(struct request_qustruct bsg_job *job =blk_mq_rq_to_pdu (req);struct scsi_request *sreq = &job->sreq; +/* called right after the request is allocated for the request_queue */ + + sreq->sense =kzalloc (SCSI_SENSE_BUFFERSIZE , gfp); +if (!sreq->sense) +return -ENOMEM ; + +return 0 ; +} + +static void bsg_initialize_rq (struct request *req) +{ +struct bsg_job *job =blk_mq_rq_to_pdu (req); +struct scsi_request *sreq = &job->sreq; +void *sense = sreq->sense; + +/* called right before the request is given to the request_queue user */ +memset (job,0 ,sizeof (*job));scsi_req_init (sreq); + + sreq->sense = sense; sreq->sense_len =SCSI_SENSE_BUFFERSIZE ; - sreq->sense =kzalloc (sreq->sense_len, gfp); -if (!sreq->sense) -return -ENOMEM ; job->req = req; - job->reply = sreq->sense; + job->reply = sense; job->reply_len = sreq->sense_len; job->dd_data = job +1 ; - -return 0 ; }static void bsg_exit_rq (struct request_queue *q,struct request *req)
@@ -250,6 +264,7 @@ struct request_queue *bsg_setup_queue(st q->cmd_size =sizeof (struct bsg_job ) + dd_job_size; q->init_rq_fn = bsg_init_rq; q->exit_rq_fn = bsg_exit_rq; + q->initialize_rq_fn = bsg_initialize_rq; q->request_fn = bsg_request_fn; ret =blk_init_allocated_queue (q);
Greg Kroah-Hartman
maintainerPATCH 154/160 nvme-pci: Use PCI bus address for data/queues in CMB
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <[email protected]>
commit 8969f1f8291762c13147c1ba89d46238af01675b upstream.
Currently, NVMe PCI host driver is programming CMB dma address as I/O SQs addresses. This results in failures on systems where 1:1 outbound mapping is not used (example Broadcom iProc SOCs) because CMB BAR will be progammed with PCI bus address but NVMe PCI EP will try to access CMB using dma address.
To have CMB working on systems without 1:1 outbound mapping, we program PCI bus address for I/O SQs instead of dma address. This approach will work on systems with/without 1:1 outbound mapping.
Based on a report and previous patch from Abhishek Shah.
--- drivers/nvme/host/pci.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/nvme/host/pci.c +7 -7
@@ -93,7 +93,7 @@ struct nvme_dev {struct mutex shutdown_lock;bool subsystem;void __iomem *cmb; -dma_addr_t cmb_dma_addr; +pci_bus_addr_t cmb_bus_addr;u64 cmb_size;u32 cmbsz;u32 cmbloc;
@@ -1218,7 +1218,7 @@ static int nvme_alloc_sq_cmds(struct nvmif (qid && dev->cmb && use_cmb_sqes &&NVME_CMB_SQS (dev->cmbsz)) {unsigned offset = (qid -1 ) *roundup (SQ_SIZE (depth), dev->ctrl.page_size); - nvmeq->sq_dma_addr = dev->cmb_dma_addr + offset; + nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; nvmeq->sq_cmds_io = dev->cmb + offset; }else { nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth),
@@ -1517,7 +1517,7 @@ static void __iomem *nvme_map_cmb(structresource_size_t bar_size;struct pci_dev *pdev =to_pci_dev (dev->dev);void __iomem *cmb; -dma_addr_t dma_addr; +int bar; dev->cmbsz =readl (dev->bar +NVME_REG_CMBSZ );if (!(NVME_CMB_SZ (dev->cmbsz)))
@@ -1530,7 +1530,8 @@ static void __iomem *nvme_map_cmb(struct szu = (u64 )1 << (12 +4 *NVME_CMB_SZU (dev->cmbsz)); size = szu *NVME_CMB_SZ (dev->cmbsz); offset = szu *NVME_CMB_OFST (dev->cmbloc); - bar_size =pci_resource_len (pdev,NVME_CMB_BIR (dev->cmbloc)); + bar =NVME_CMB_BIR (dev->cmbloc); + bar_size =pci_resource_len (pdev, bar);if (offset > bar_size)return NULL ;
@@ -1543,12 +1544,11 @@ static void __iomem *nvme_map_cmb(structif (size > bar_size - offset) size = bar_size - offset; - dma_addr =pci_resource_start (pdev,NVME_CMB_BIR (dev->cmbloc)) + offset; - cmb =ioremap_wc (dma_addr, size); + cmb =ioremap_wc (pci_resource_start (pdev, bar) + offset, size);if (!cmb)return NULL ; - dev->cmb_dma_addr = dma_addr; + dev->cmb_bus_addr =pci_bus_address (pdev, bar) + offset; dev->cmb_size = size;return cmb; }
Greg Kroah-Hartman
maintainerPATCH 155/160 mmc: core: add driver strength selection when selecting hs400es
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chanho Min <[email protected]>
commit fb458864d9a78cc433fec7979acbe4078c82d7a8 upstream.
The driver strength selection is missed and required when selecting hs400es. So, It is added here.
--- drivers/mmc/core/mmc.c | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-)
drivers/mmc/core/mmc.c +19 -17
@@ -1286,6 +1286,23 @@ out_err:return err; } +static void mmc_select_driver_type (struct mmc_card *card) +{ +int card_drv_type, drive_strength, drv_type; + + card_drv_type = card->ext_csd.raw_driver_strength | +mmc_driver_type_mask (0 ); + + drive_strength =mmc_select_drive_strength (card, + card->ext_csd.hs200_max_dtr, + card_drv_type, &drv_type); + + card->drive_strength = drive_strength; + +if (drv_type) +mmc_set_driver_type (card->host, drv_type); +} +static int mmc_select_hs400es (struct mmc_card *card) {struct mmc_host *host = card->host;
@@ -1341,6 +1358,8 @@ static int mmc_select_hs400es(struct mmc goto out_err; } +mmc_select_driver_type (card); +/* Switch card to HS400 */ val =EXT_CSD_TIMING_HS400 | card->drive_strength <<EXT_CSD_DRV_STR_SHIFT ;
@@ -1374,23 +1393,6 @@ out_err:return err; } -static void mmc_select_driver_type (struct mmc_card *card) -{ -int card_drv_type, drive_strength, drv_type; - - card_drv_type = card->ext_csd.raw_driver_strength | -mmc_driver_type_mask (0 ); - - drive_strength =mmc_select_drive_strength (card, - card->ext_csd.hs200_max_dtr, - card_drv_type, &drv_type); - - card->drive_strength = drive_strength; - -if (drv_type) -mmc_set_driver_type (card->host, drv_type); -} -/* * For device supporting HS200 mode, the following sequence * should be done before executing the tuning process.
Greg Kroah-Hartman
maintainerPATCH 156/160 nl80211: Define policy for packet pattern attributes
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Xu <[email protected]>
commit ad670233c9e1d5feb365d870e30083ef1b889177 upstream.
Define a policy for packet pattern attributes in order to fix a potential read over the end of the buffer during nla_get_u32() of the NL80211_PKTPAT_OFFSET attribute.
Note that the data there can always be read due to SKB allocation (with alignment and struct skb_shared_info at the end), but the data might be uninitialized. This could be used to leak some data from uninitialized vmalloc() memory, but most drivers don't allow an offset (so you'd just get -EINVAL if the data is non-zero) or just allow it with a fixed value - 100 or 128 bytes, so anything above that would get -EINVAL. With brcmfmac the limit is 1500 so (at least) one byte could be obtained.
--- net/wireless/nl80211.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +12 -2
@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_A [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED }, }; +/* policy for packet pattern attributes */ +static const struct nla_policy +nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT +1 ] = { + [NL80211_PKTPAT_MASK ] = { .type =NLA_BINARY , }, + [NL80211_PKTPAT_PATTERN ] = { .type =NLA_BINARY , }, + [NL80211_PKTPAT_OFFSET ] = { .type =NLA_U32 }, +}; + static int nl80211_prepare_wdev_dump(struct sk_buff *skb, struct netlink_callback *cb, struct cfg80211_registered_device **rdev,
@@ -10529,7 +10537,8 @@ static int nl80211_set_wowlan(struct sk_u8 *mask_pat;nla_parse_nested (pat_tb,MAX_NL80211_PKTPAT , pat, -NULL , info->extack); + nl80211_packet_pattern_policy, + info->extack); err = -EINVAL ;if (!pat_tb[NL80211_PKTPAT_MASK ] || !pat_tb[NL80211_PKTPAT_PATTERN ])
@@ -10778,7 +10787,8 @@ static int nl80211_parse_coalesce_rule(s rem) {u8 *mask_pat; -nla_parse_nested (pat_tb,MAX_NL80211_PKTPAT , pat,NULL ,NULL ); +nla_parse_nested (pat_tb,MAX_NL80211_PKTPAT , pat, + nl80211_packet_pattern_policy,NULL );if (!pat_tb[NL80211_PKTPAT_MASK ] || !pat_tb[NL80211_PKTPAT_PATTERN ])return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 157/160 clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 5dcbeca615ef12047a5f4097b91030cbf995b1d2 upstream.
Commit 6edfa11cb396 ("clk: samsung: Add enable/disable operation for PLL36XX clocks") added enable/disable operations to PLL clocks. Prior that VPLL and EPPL clocks were always enabled because the enable bit was never touched. Those clocks have to be enabled during suspend/resume cycle, because otherwise board fails to enter sleep mode. This patch enables them unconditionally before entering system suspend state. System restore function will set them to the previous state saved in the register cache done before that unconditional enable.
--- drivers/clk/samsung/clk-exynos4.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/clk/samsung/clk-exynos4.c +15 -0
@@ -294,6 +294,18 @@ static const struct samsung_clk_reg_dump#define PLL_ENABLED (1 << 31)#define PLL_LOCKED (1 << 29) +static void exynos4_clk_enable_pll (u32 reg) +{ +u32 pll_con =readl (reg_base + reg); + pll_con |=PLL_ENABLED ; +writel (pll_con, reg_base + reg); + +while (!(pll_con &PLL_LOCKED )) { +cpu_relax (); + pll_con =readl (reg_base + reg); + } +} +static void exynos4_clk_wait_for_pll (u32 reg) {u32 pll_con;
@@ -315,6 +327,9 @@ static int exynos4_clk_suspend(void)samsung_clk_save (reg_base, exynos4_save_pll,ARRAY_SIZE (exynos4_clk_pll_regs)); +exynos4_clk_enable_pll (EPLL_CON0 ); +exynos4_clk_enable_pll (VPLL_CON0 ); +if (exynos4_soc ==EXYNOS4210 ) {samsung_clk_save (reg_base, exynos4_save_soc,ARRAY_SIZE (exynos4210_clk_save));
Greg Kroah-Hartman
maintainerPATCH 158/160 udp: perform source validation for mcast early demux
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
[ Upstream commit bc044e8db7962e727a75b591b9851ff2ac5cf846 ]
The UDP early demux can leverate the rx dst cache even for multicast unconnected sockets.
In such scenario the ipv4 source address is validated only on the first packet in the given flow. After that, when we fetch the dst entry from the socket rx cache, we stop enforcing the rp_filter and we even start accepting any kind of martian addresses.
Disabling the dst cache for unconnected multicast socket will cause large performace regression, nearly reducing by half the max ingress tput.
Instead we factor out a route helper to completely validate an skb source address for multicast packets and we call it from the UDP early demux for mcast packets landing on unconnected sockets, after successful fetching the related cached dst entry.
This still gives a measurable, but limited performance regression:
rp_filter = 0 rp_filter = 1
edmux disabled: 1182 Kpps 1127 Kpps
edmux before: 2238 Kpps 2238 Kpps
edmux after: 2037 Kpps 2019 Kpps
The above figures are on top of current net tree. Applying the net-next commit 6e617de84e87 ("net: avoid a full fib lookup when rp_filter is disabled.") the delta with rp_filter == 0 will decrease even more.
--- include/net/route.h | 4 +++- net/ipv4/route.c | 46 ++++++++++++++++++++++++++-------------------- net/ipv4/udp.c | 13 ++++++++++++- 3 files changed, 41 insertions(+), 22 deletions(-)
include/net/route.h +3 -1
@@ -175,7 +175,9 @@ static inline struct rtable *ip_route_ou fl4->fl4_gre_key = gre_key;return ip_route_output_key (net, fl4); } - +int ip_mc_validate_source (struct sk_buff *skb,__be32 daddr,__be32 saddr, +u8 tos,struct net_device *dev, +struct in_device *in_dev,u32 *itag);int ip_route_input_noref (struct sk_buff *skb,__be32 dst,__be32 src,u8 tos,struct net_device *devin); int ip_route_input_rcu(struct sk_buff *skb, __be32 dst, __be32 src,
net/ipv4/route.c +26 -20
82 lines not on this page · raw message
net/ipv4/udp.c +12 -1
@@ -2220,6 +2220,7 @@ static struct sock *__udp4_lib_demux_looint udp_v4_early_demux (struct sk_buff *skb) {struct net *net =dev_net (skb->dev); +struct in_device *in_dev =NULL ;const struct iphdr *iph;const struct udphdr *uh;struct sock *sk =NULL ;
@@ -2236,7 +2237,7 @@ int udp_v4_early_demux(struct sk_buff *sif (skb->pkt_type ==PACKET_BROADCAST || skb->pkt_type ==PACKET_MULTICAST ) { -struct in_device *in_dev =__in_dev_get_rcu (skb->dev); + in_dev =__in_dev_get_rcu (skb->dev);if (!in_dev)return 0 ;
@@ -2266,11 +2267,21 @@ int udp_v4_early_demux(struct sk_buff *sif (dst) dst =dst_check (dst,0 );if (dst) { +u32 itag =0 ; +/* set noref for now. * any place which wants to hold dst has to call * dst_hold_safe() */ skb_dst_set_noref (skb, dst); + +/* for unconnected multicast sockets we need to validate +* the source on each packet +*/ +if (!inet_sk (sk)->inet_daddr && in_dev) +return ip_mc_validate_source (skb, iph->daddr, + iph->saddr, iph->tos, + skb->dev, in_dev, &itag); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 159/160 udp: fix bcast packet reception
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit 996b44fcef8f216ea0b6b6e74468c5a77b5e341f upstream.
The commit bc044e8db796 ("udp: perform source validation for mcast early demux") does not take into account that broadcast packets lands in the same code path and they need different checks for the source address - notably, zero source address are valid for bcast and invalid for mcast.
As a result, 2nd and later broadcast packets with 0 source address landing to the same socket are dropped. This breaks dhcp servers.
Since we don't have stringent performance requirements for ingress broadcast traffic, fix it by disabling UDP early demux such traffic.
--- net/ipv4/udp.c | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-)
net/ipv4/udp.c +5 -9
@@ -2235,20 +2235,16 @@ int udp_v4_early_demux(struct sk_buff *s iph =ip_hdr (skb); uh =udp_hdr (skb); -if (skb->pkt_type ==PACKET_BROADCAST || - skb->pkt_type ==PACKET_MULTICAST ) { +if (skb->pkt_type ==PACKET_MULTICAST ) { in_dev =__in_dev_get_rcu (skb->dev);if (!in_dev)return 0 ; -/* we are supposed to accept bcast packets */ -if (skb->pkt_type ==PACKET_MULTICAST ) { - ours =ip_check_mc_rcu (in_dev, iph->daddr, iph->saddr, - iph->protocol); -if (!ours) -return 0 ; - } + ours =ip_check_mc_rcu (in_dev, iph->daddr, iph->saddr, + iph->protocol); +if (!ours) +return 0 ; sk =__udp4_lib_mcast_demux_lookup (net, uh->dest, iph->daddr, uh->source, iph->saddr, dif);
Greg Kroah-Hartman
maintainerPATCH 160/160 base: arch_topology: fix section mismatch build warnings
In reply to Greg Kroah-Hartman4.13-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <[email protected]>
commit 452562abb5b76c14449dead2a7113f641893e8bc upstream.
Commit 2ef7a2953c81 ("arm, arm64: factorize common cpu capacity default code") introduced init_cpu_capacity_callback and init_cpu_capacity_notifier which are referenced from initcall and are missing __init{,data} annotations resulting the below section mismatch build warnings.
"WARNING: vmlinux.o(.text+0xbab790): Section mismatch in reference from the function init_cpu_capacity_callback() to the variable .init.text:$x The function init_cpu_capacity_callback() references the variable __init $x. This is often because init_cpu_capacity_callback lacks a __init annotation or the annotation of $x is wrong."
This patch fixes the above build warnings by adding the required annotations.
--- drivers/base/arch_topology.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/base/arch_topology.c +7 -7
@@ -160,12 +160,12 @@ int __init topology_parse_cpu_capacity(s }#ifdef CONFIG_CPU_FREQ -static cpumask_var_t cpus_to_visit; -static bool cap_parsing_done; -static void parsing_done_workfn (struct work_struct *work); -static DECLARE_WORK(parsing_done_work, parsing_done_workfn); +static bool cap_parsing_done__initdata ; +static cpumask_var_t cpus_to_visit__initdata ; +static void __init parsing_done_workfn (struct work_struct *work); +static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn); -static int +static int __init init_cpu_capacity_callback (struct notifier_block *nb,unsigned long val,void *data)
@@ -200,7 +200,7 @@ init_cpu_capacity_callback(struct notifireturn 0 ; } -static struct notifier_block init_cpu_capacity_notifier = { +static struct notifier_block init_cpu_capacity_notifier__initdata = { .notifier_call = init_cpu_capacity_callback, };
@@ -226,7 +226,7 @@ static int __init register_cpufreq_notif }core_initcall (register_cpufreq_notifier); -static void parsing_done_workfn (struct work_struct *work) +static void __init parsing_done_workfn (struct work_struct *work) {cpufreq_unregister_notifier (&init_cpu_capacity_notifier,CPUFREQ_POLICY_NOTIFIER );
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.13.6 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Oct 12 19:05:14 UTC 2017. Anything received after that time might be too late.
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 123 pass: 123 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.13.6 release. There are 160 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu Oct 12 19:05:14 UTC 2017. Anything received after that time might be too late.
Quoted 6 lines
Build results:
total: 145 pass: 145 fail: 0 Qemu test results: total: 123 pass: 123 fail: 0Details are available at http://kerneltests.org/builders.
Great, thanks for testing all of these and letting me know.
greg k-h