4.15.16-stable review
Greg Kroah-Hartman
maintainercover 4.15.16-stable review
This is the start of the stable review cycle for the 4.15.16 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Apr 8 08:43:10 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.16-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.15.16-rc1
Greg Kroah-Hartman <[email protected]>
Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
Greg Kroah-Hartman <[email protected]>
Revert "cpufreq: Fix governor module removal race"
Greg Kroah-Hartman <[email protected]>
Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin"
Greg Kroah-Hartman <[email protected]>
Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin"
Mikulas Patocka <[email protected]>
Fix slab name "biovec-(1<<(21-12))"
Matthias Brugger <[email protected]>
net: hns: Fix ethtool private flags
Keerthy <[email protected]>
ARM: dts: DRA76-EVM: Set powerhold property for tps65917
Mike Frysinger <[email protected]>
vt: change SGR 21 to follow the standards
Ondrej Zary <[email protected]>
Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
Dennis Wassenberg <[email protected]>
Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
Masaki Ota <[email protected]>
Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
Gaku Inami <[email protected]>
Revert "base: arch_topology: fix section mismatch build warnings"
Frank Mori Hess <[email protected]>
staging: comedi: ni_mio_common: ack ai fifo error interrupts.
Liu Bo <[email protected]>
Btrfs: fix unexpected cow in run_delalloc_nocow
Eric Biggers <[email protected]>
crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
Leonard Crestez <[email protected]>
crypto: arm,arm64 - Fix random regeneration of S_shipped
Maciej S. Szmigiero <[email protected]>
crypto: ccp - return an actual key size from RSA max_size callback
Rui Miguel Silva <[email protected]>
crypto: caam - Fix null dereference at error path
Herbert Xu <[email protected]>
crypto: ahash - Fix early termination in hash walk
LEROY Christophe <[email protected]>
crypto: talitos - fix IPsec cipher in length
Conor McLoughlin <[email protected]>
crypto: testmgr - Fix incorrect values in PKCS#1 test vector
Gregory CLEMENT <[email protected]>
crypto: inside-secure - fix clock management
LEROY Christophe <[email protected]>
crypto: talitos - don't persistently map req_ctx->hw_context and req_ctx->buf
Herbert Xu <[email protected]>
crypto: lrw - Free rctx->ext with kzfree
Alexander Gerasiov <[email protected]>
parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
Oliver Neukum <[email protected]>
media: usbtv: prevent double free in error case
Kees Cook <[email protected]>
/dev/mem: Avoid overwriting "err" in read_mem()
Colin Ian King <[email protected]>
mei: remove dev_err message on an unsupported ioctl
Joel Stanley <[email protected]>
serial: 8250: Add Nuvoton NPCM UART
Johan Hovold <[email protected]>
USB: serial: cp210x: add ELDAT Easywave RX09 id
Clemens Werther <[email protected]>
USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
Major Hayden <[email protected]>
USB: serial: ftdi_sio: add RT Systems VX-8 cable
Omar Sandoval <[email protected]>
bitmap: fix memset optimization on big-endian systems
Dhinakaran Pandiyan <[email protected]>
drm/i915/dp: Write to SET_POWER dpcd to enable MST hub.
Szymon Janc <[email protected]>
Bluetooth: Fix missing encryption refresh on Security Request
Arnd Bergmann <[email protected]>
phy: qcom-ufs: add MODULE_LICENSE tag
Florian Westphal <[email protected]>
netfilter: x_tables: add and use xt_check_proc_name
Paolo Abeni <[email protected]>
netfilter: drop template ct when conntrack is skipped.
Paolo Abeni <[email protected]>
l2tp: fix races with ipv4-mapped ipv6 addresses
Florian Westphal <[email protected]>
netfilter: bridge: ebt_among: add more missing match size checks
Michal Hocko <[email protected]>
netfilter: x_tables: make allocation less aggressive
Dennis Zhou <[email protected]>
percpu: add __GFP_NORETRY semantics to the percpu balancing path
Steffen Klassert <[email protected]>
xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
Greg Hackmann <[email protected]>
net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
Eric Dumazet <[email protected]>
ipv6: fix possible deadlock in rt6_age_examine_exception()
Roland Dreier <[email protected]>
RDMA/ucma: Introduce safer rdma_addr_size() variants
Leon Romanovsky <[email protected]>
RDMA/ucma: Check that device exists prior to accessing it
Leon Romanovsky <[email protected]>
RDMA/ucma: Check that device is connected prior to access it
Jason Gunthorpe <[email protected]>
RDMA/rdma_cm: Fix use after free race with process_one_req
Leon Romanovsky <[email protected]>
RDMA/ucma: Ensure that CM_ID exists prior to access it
Leon Romanovsky <[email protected]>
RDMA/ucma: Fix use-after-free access in ucma_close
Leon Romanovsky <[email protected]>
RDMA/ucma: Check AF family prior resolving address
Florian Westphal <[email protected]>
xfrm_user: uncoditionally validate esn replay attribute struct
Richard Narron <[email protected]>
partitions/msdos: Unable to mount UFS 44bsd partitions
Nicholas Piggin <[email protected]>
powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
Nicholas Piggin <[email protected]>
powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
Benjamin Herrenschmidt <[email protected]>
powerpc/mm: Workaround Nest MMU bug with TLB invalidations
Benjamin Herrenschmidt <[email protected]>
powerpc/mm: Add tracking of the number of coprocessors using a context
Pierre-Yves MORDRET <[email protected]>
i2c: i2c-stm32f7: fix no check on returned setup
Mike Kravetz <[email protected]>
ipc/shm.c: add split function to shm_vm_ops
Yan, Zheng <[email protected]>
ceph: only dirty ITER_IOVEC pages for direct read
Linus Torvalds <[email protected]>
perf/hwbp: Simplify the perf-hwbp code, fix documentation
Andrew Banman <[email protected]>
x86/platform/uv/BAU: Add APIC idt entry
Dan Carpenter <[email protected]>
ALSA: pcm: potential uninitialized return values
Stefan Roese <[email protected]>
ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
Nobutaka Okabe <[email protected]>
ALSA: usb-audio: Add native DSD support for TEAC UD-301
Boris Brezillon <[email protected]>
mtd: nand: atmel: Fix get_sectorsize() function
Linus Walleij <[email protected]>
mtd: jedec_probe: Fix crash in jedec_read_mfr()
Philipp Rossak <[email protected]>
ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
Philipp Rossak <[email protected]>
ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
Fabio Estevam <[email protected]>
ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
Tony Lindgren <[email protected]>
ARM: OMAP: Fix SRAM W+X mapping
-------------
Diffstat:
Documentation/devicetree/bindings/serial/8250.txt | 1 + Makefile | 4 +- arch/arm/boot/dts/am335x-pepper.dts | 2 +- arch/arm/boot/dts/dra76-evm.dts | 1 + arch/arm/boot/dts/omap3-n900.dts | 4 +- arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts | 63 +++++++- arch/arm/crypto/Makefile | 2 + arch/arm/plat-omap/include/plat/sram.h | 11 +- arch/arm/plat-omap/sram.c | 36 ++++- arch/arm/vfp/vfpmodule.c | 2 +- arch/arm64/crypto/Makefile | 2 + arch/powerpc/include/asm/book3s/64/mmu.h | 3 + arch/powerpc/include/asm/mmu_context.h | 18 ++- arch/powerpc/kernel/exceptions-64s.S | 2 +- arch/powerpc/kernel/irq.c | 8 + arch/powerpc/mm/mmu_context_book3s64.c | 1 + arch/powerpc/mm/tlb-radix.c | 50 +++++- arch/x86/crypto/cast5_avx_glue.c | 3 +- arch/x86/include/asm/hw_irq.h | 1 + arch/x86/kernel/idt.c | 3 + arch/x86/platform/uv/tlb_uv.c | 2 - block/bio.c | 4 +- block/partitions/msdos.c | 4 +- crypto/ahash.c | 7 +- crypto/lrw.c | 2 +- crypto/testmgr.h | 6 +- drivers/base/arch_topology.c | 12 +- drivers/char/mem.c | 6 +- drivers/cpufreq/cpufreq.c | 6 - drivers/crypto/caam/ctrl.c | 3 - drivers/crypto/ccp/ccp-crypto-rsa.c | 7 +- drivers/crypto/inside-secure/safexcel.c | 2 +- drivers/crypto/talitos.c | 168 ++++++++------------- drivers/gpu/drm/i915/intel_ddi.c | 12 +- drivers/i2c/busses/i2c-stm32f7.c | 5 + drivers/infiniband/core/addr.c | 25 +++ drivers/infiniband/core/ucma.c | 61 +++++--- drivers/input/mouse/alps.c | 24 ++- drivers/input/serio/i8042-x86ia64io.h | 24 +++ drivers/media/usb/usbtv/usbtv-core.c | 2 + drivers/misc/mei/main.c | 1 - drivers/mtd/chips/jedec_probe.c | 2 + drivers/mtd/nand/atmel/pmecc.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 +- drivers/parport/parport_pc.c | 4 + drivers/phy/qualcomm/phy-qcom-ufs.c | 5 + drivers/staging/comedi/drivers/ni_mio_common.c | 2 + drivers/tty/serial/8250/8250_of.c | 1 + drivers/tty/serial/8250/8250_port.c | 33 ++++ drivers/tty/vt/vt.c | 6 +- drivers/usb/serial/cp210x.c | 1 + drivers/usb/serial/ftdi_sio.c | 2 + drivers/usb/serial/ftdi_sio_ids.h | 9 ++ fs/btrfs/inode.c | 37 ++++- fs/ceph/file.c | 9 +- include/linux/bitmap.h | 22 ++- include/linux/netfilter/x_tables.h | 2 + include/rdma/ib_addr.h | 2 + include/uapi/linux/serial_core.h | 3 + ipc/shm.c | 12 ++ kernel/events/hw_breakpoint.c | 30 +--- mm/percpu-km.c | 8 +- mm/percpu-vm.c | 18 ++- mm/percpu.c | 45 +++--- net/bluetooth/smp.c | 8 +- net/bridge/netfilter/ebt_among.c | 34 +++++ net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +- net/ipv6/ip6_vti.c | 20 --- net/ipv6/route.c | 13 +- net/l2tp/l2tp_core.c | 38 +++-- net/l2tp/l2tp_core.h | 3 - net/netfilter/x_tables.c | 37 ++++- net/netfilter/xt_hashlimit.c | 16 +- net/netfilter/xt_recent.c | 6 +- net/xfrm/xfrm_ipcomp.c | 2 +- net/xfrm/xfrm_state.c | 5 + net/xfrm/xfrm_user.c | 21 +-- sound/core/oss/pcm_oss.c | 4 +- sound/core/pcm_native.c | 2 +- sound/usb/quirks.c | 1 + 83 files changed, 731 insertions(+), 358 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/72 ARM: OMAP: Fix SRAM W+X mapping
4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit eb85a355c3afd9379f5953cfe2df73632d14c884 upstream.
We are still using custom SRAM code for some SoCs and are not marking the PM code mapped to SRAM as read-only and executable after we're done. With CONFIG_DEBUG_WX=y, we will get "Found insecure W+X mapping at address" warning.
Let's fix this issue the same way as commit 728bbe75c82f ("misc: sram:
Introduce support code for protect-exec sram type") is doing for drivers/misc/sram-exec.c.
On omap3, we need to restore SRAM when returning from off mode after idle, so init time configuration is not enough.
And as we no longer have users for omap_sram_push_address() we can make it static while at it.
Note that eventually we should be using sram-exec.c for all SoCs.
--- arch/arm/plat-omap/include/plat/sram.h | 11 ---------- arch/arm/plat-omap/sram.c | 36 ++++++++++++++++++++++++++++++++- 2 files changed, 36 insertions(+), 11 deletions(-)
arch/arm/plat-omap/include/plat/sram.h +1 -10
@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long skip, int cached);void omap_sram_reset (void ); -extern void *omap_sram_push_address (unsigned long size); - -/* Macro to push a function to the internal SRAM, using the fncpy API */ -#define omap_sram_push (funcp, size) ({ \ - typeof(&(funcp)) _res = NULL; \ - void *_sram_address = omap_sram_push_address(size); \ - if (_sram_address) \ - _res = fncpy(_sram_address, &(funcp), size); \ - _res; \ -}) +extern void *omap_sram_push (void *funcp,unsigned long size);
arch/arm/plat-omap/sram.c +35 -1
@@ -23,6 +23,7 @@#include <asm/fncpy.h> #include <asm/tlb.h> #include <asm/cacheflush.h> +#include <asm/set_memory.h> #include <asm/mach/map.h>
@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil;* Note that fncpy requires the returned address to be aligned * to an 8-byte boundary. */ -void *omap_sram_push_address (unsigned long size) +static void *omap_sram_push_address (unsigned long size) {unsigned long available, new_ceil = (unsigned long )omap_sram_ceil;
@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned loreturn (void *)omap_sram_ceil; } +void *omap_sram_push (void *funcp,unsigned long size) +{ +void *sram; +unsigned long base; +int pages; +void *dst =NULL ; + + sram =omap_sram_push_address (size); +if (!sram) +return NULL ; + + base = (unsigned long )sram &PAGE_MASK ; + pages =PAGE_ALIGN (size) /PAGE_SIZE ; + +set_memory_rw (base, pages); + + dst =fncpy (sram, funcp, size); + +set_memory_ro (base, pages); +set_memory_x (base, pages); + +return dst; +} +/* * The SRAM context is lost during off-idle and stack * needs to be reset.
@@ -75,6 +100,9 @@ void omap_sram_reset(void)void __init omap_map_sram (unsigned long start,unsigned long size,unsigned long skip,int cached) { +unsigned long base; +int pages; +if (size ==0 )return ;
@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long*/ memset_io (omap_sram_base + omap_sram_skip,0 , omap_sram_size - omap_sram_skip); + + base = (unsigned long )omap_sram_base; + pages =PAGE_ALIGN (omap_sram_size) /PAGE_SIZE ; + +set_memory_ro (base, pages); +set_memory_x (base, pages); }
Greg Kroah-Hartman
maintainerPATCH 2/72 ARM: 8746/1: vfp: Go back to clearing vfp_current_hw_state[]
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <[email protected]>
commit 1328f02005bbbaed15b9d5b7f3ab5ec9d4d5268a upstream.
Commit 384b38b66947 ("ARM: 7873/1: vfp: clear vfp_current_hw_state for dying cpu") fixed the cpu dying notifier by clearing vfp_current_hw_state[]. However commit e5b61bafe704 ("arm: Convert VFP hotplug notifiers to state machine") incorrectly used the original vfp_force_reload() function in the cpu dying notifier.
Fix it by going back to clearing vfp_current_hw_state[].
--- arch/arm/vfp/vfpmodule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/vfp/vfpmodule.c +1 -1
@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user*/ static int vfp_dying_cpu (unsigned int cpu) { -vfp_force_reload (cpu,current_thread_info ()); + vfp_current_hw_state[cpu] =NULL ;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 3/72 ARM: dts: sun6i: a31s: bpi-m2: improve pmic properties
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Rossak <[email protected]>
commit b23af6ad8d2f708c4c3f92dd8f82c233247ba8bf upstream.
The eldoin is supplied from the dcdc1 regulator. The N_VBUSEN pin is connected to an external power regulator (SY6280AAC). With this commit we update the pmic binding properties to support those features.
--- arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +2 -0
@@ -163,6 +163,8 @@ reg = <0x68>; interrupt-parent = <&nmi_intc>; interrupts = <0 IRQ_TYPE_LEVEL_LOW>; + eldoin-supply = <®_dcdc1>; + x-powers,drive-vbus-en; }; };
Greg Kroah-Hartman
maintainerPATCH 4/72 ARM: dts: sun6i: a31s: bpi-m2: add missing regulators
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Rossak <[email protected]>
commit 70b8d21496758dd7ff600ec9de0ee3812fac7a40 upstream.
This patch fixes a bootproblem with the Bananapi M2 board. Since there are some regulators missing we add them right now. Those values come from the schematic, below you can find a small overview:
* reg_aldo1: 3,3V, powers the wifi * reg_aldo2: 2,5V, powers the IO of the RTL8211E * reg_aldo3: 3,3V, powers the audio
* reg_dldo1: 3,0V, powers the RTL8211E * reg_dldo2: 2,8V, powers the analog part of the csi * reg_dldo3: 3,3V, powers misc * reg_eldo1: 1,8V, powers the csi
* reg_ldo_io1:1,8V, powers the gpio
* reg_dc5ldo: needs to be always on
This patch updates also the vmmc-supply properties on the mmc0 and mmc2 node to use the allready existent regulators.
We can now remove the sunxi-common-regulators.dtsi include since we don't need it anymore.
--- arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts | 61 +++++++++++++++++++++-- 1 file changed, 58 insertions(+), 3 deletions(-)
arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +58 -3
@@ -42,7 +42,6 @@ /dts-v1/; #include "sun6i-a31s.dtsi" -#include "sunxi-common-regulators.dtsi" #include <dt-bindings/gpio/gpio.h> / {
@@ -99,6 +98,7 @@ pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>; phy = <&phy1>; phy-mode = "rgmii"; + phy-supply = <®_dldo1>; snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */ snps,reset-active-low; snps,reset-delays-us = <0 10000 30000>;
@@ -118,7 +118,7 @@ &mmc0 { pinctrl-names = "default"; pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>; - vmmc-supply = <®_vcc3v0>; + vmmc-supply = <®_dcdc1>; bus-width = <4>; cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */ cd-inverted;
@@ -132,7 +132,7 @@ &mmc2 { pinctrl-names = "default"; pinctrl-0 = <&mmc2_pins_a>; - vmmc-supply = <®_vcc3v0>; + vmmc-supply = <®_aldo1>; mmc-pwrseq = <&mmc2_pwrseq>; bus-width = <4>; non-removable;
@@ -195,7 +195,28 @@ #include "axp22x.dtsi" +®_aldo1 { + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vcc-wifi"; +}; + +®_aldo2 { + regulator-always-on; + regulator-min-microvolt = <2500000>; + regulator-max-microvolt = <2500000>; + regulator-name = "vcc-gmac"; +}; + +®_aldo3 { + regulator-always-on; + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3000000>; + regulator-name = "avcc"; +}; + ®_dc5ldo { + regulator-always-on; regulator-min-microvolt = <700000>; regulator-max-microvolt = <1320000>; regulator-name = "vdd-cpus";
@@ -235,6 +256,40 @@ regulator-name = "vcc-dram"; }; +®_dldo1 { + regulator-min-microvolt = <3000000>; + regulator-max-microvolt = <3000000>; + regulator-name = "vcc-mac"; +}; + +®_dldo2 { + regulator-min-microvolt = <2800000>; + regulator-max-microvolt = <2800000>; + regulator-name = "avdd-csi"; +}; + +®_dldo3 { + regulator-always-on; + regulator-min-microvolt = <3300000>; + regulator-max-microvolt = <3300000>; + regulator-name = "vcc-pb"; +}; + +®_eldo1 { + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-name = "vdd-csi"; + status = "okay"; +}; + +®_ldo_io1 { + regulator-always-on; + regulator-min-microvolt = <1800000>; + regulator-max-microvolt = <1800000>; + regulator-name = "vcc-pm-cpus"; + status = "okay"; +}; + &uart0 { pinctrl-names = "default"; pinctrl-0 = <&uart0_pins_a>;
Greg Kroah-Hartman
maintainerPATCH 5/72 mtd: jedec_probe: Fix crash in jedec_read_mfr()
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <[email protected]>
commit 87a73eb5b56fd6e07c8e499fe8608ef2d8912b82 upstream.
It turns out that the loop where we read manufacturer jedec_read_mfd() can under some circumstances get a CFI_MFR_CONTINUATION repeatedly, making the loop go over all banks and eventually hit the end of the map and crash because of an access violation:
Unable to handle kernel paging request at virtual address c4980000 pgd = (ptrval) [c4980000] *pgd=03808811, *pte=00000000, *ppte=00000000 Internal error: Oops: 7 [#1] PREEMPT ARM CPU: 0 PID: 1 Comm: swapper Not tainted 4.16.0-rc1+ #150 Hardware name: Gemini (Device Tree) PC is at jedec_probe_chip+0x6ec/0xcd0 LR is at 0x4 pc : [<c03a2bf4>] lr : [<00000004>] psr: 60000013
sp : c382dd18 ip : 0000ffff fp : 00000000
r10: c0626388 r9 : 00020000 r8 : c0626340
r7 : 00000000 r6 : 00000001 r5 : c3a71afc r4 : c382dd70 r3 : 00000001 r2 : c4900000 r1 : 00000002 r0 : 00080000
Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 0000397f Table: 00004000 DAC: 00000053 Process swapper (pid: 1, stack limit = 0x(ptrval))
Fix this by breaking the loop with a return 0 if the offset exceeds the map size.
--- drivers/mtd/chips/jedec_probe.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/chips/jedec_probe.c +2 -0
@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(structdo {uint32_t ofs =cfi_build_cmd_addr (0 + (bank <<8 ), map, cfi); mask = (1 << (cfi->device_type *8 )) -1 ; +if (ofs >= map->size) +return 0 ; result =map_read (map, base + ofs); bank++; }while ((result.x[0 ] & mask) ==CFI_MFR_CONTINUATION );
Greg Kroah-Hartman
maintainerPATCH 6/72 mtd: nand: atmel: Fix get_sectorsize() function
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
commit 2b1b1b4ac716fd929a2d221bd4ade62263bed915 upstream.
get_sectorsize() was not using the appropriate macro to extract the ECC sector size from the config cache, which led to buggy ECC when using 1024 byte sectors.
--- drivers/mtd/nand/atmel/pmecc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/nand/atmel/pmecc.c +1 -1
@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmestatic int get_sectorsize (struct atmel_pmecc_user *user) { -return user->cache.cfg &PMECC_LOOKUP_TABLE_SIZE_1024 ?1024 :512 ; +return user->cache.cfg &PMECC_CFG_SECTOR1024 ?1024 :512 ; }static void atmel_pmecc_gen_syndrome (struct atmel_pmecc_user *user,int sector)
Greg Kroah-Hartman
maintainerPATCH 7/72 ALSA: usb-audio: Add native DSD support for TEAC UD-301
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nobutaka Okabe <[email protected]>
commit b00214865d65100163574ba250008f182cf90869 upstream.
Add native DSD support quirk for TEAC UD-301 DAC,
by adding the PID/VID 0644:804a.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1171,6 +1171,7 @@ static bool is_teac_dsd_dac(unsigned intswitch (id) {case USB_ID (0x0644 ,0x8043 ):/* TEAC UD-501/UD-503/NT-503 */ case USB_ID (0x0644 ,0x8044 ):/* Esoteric D-05X */ +case USB_ID (0x0644 ,0x804a ):/* TEAC UD-301 */ return true; }return false;
Greg Kroah-Hartman
maintainerPATCH 8/72 ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent()
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Roese <[email protected]>
commit 9066ae7ff5d89c0b5daa271e2d573540097a94fa upstream.
When trying to use the driver (e.g. aplay *.wav), the 4MiB DMA buffer will get mmapp'ed in 16KiB chunks. But this fails with the 2nd 16KiB area, as the page offset is outside of the VMA range (size), which is currently used as size parameter in snd_pcm_lib_default_mmap(). By using the DMA buffer size (dma_bytes) instead, the complete DMA buffer can be mmapp'ed and the issue is fixed.
This issue was detected on an ARM platform (TI AM57xx) using the RME HDSP MADI PCIe soundcard.
--- sound/core/pcm_native.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/pcm_native.c +1 -1
@@ -3422,7 +3422,7 @@ int snd_pcm_lib_default_mmap(struct snd_ area, substream->runtime->dma_area, substream->runtime->dma_addr, - area->vm_end - area->vm_start); + substream->runtime->dma_bytes);#endif /* CONFIG_X86 */ /* mmap with fault handler */ area->vm_ops = &snd_pcm_vm_ops_data_fault;
Greg Kroah-Hartman
maintainerPATCH 9/72 ALSA: pcm: potential uninitialized return values
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 5607dddbfca774fb38bffadcb077fe03aa4ac5c6 upstream.
Smatch complains that "tmp" can be uninitialized if we do a zero size write.
--- sound/core/oss/pcm_oss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/oss/pcm_oss.c +2 -2
@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(structstatic ssize_t snd_pcm_oss_write1 (struct snd_pcm_substream *substream,const char __user *buf,size_t bytes) {size_t xfer =0 ; -ssize_t tmp; +ssize_t tmp =0 ;struct snd_pcm_runtime *runtime = substream->runtime;if (atomic_read (&substream->mmap_count))
@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(structstatic ssize_t snd_pcm_oss_read1 (struct snd_pcm_substream *substream,char __user *buf,size_t bytes) {size_t xfer =0 ; -ssize_t tmp; +ssize_t tmp =0 ;struct snd_pcm_runtime *runtime = substream->runtime;if (atomic_read (&substream->mmap_count))
Greg Kroah-Hartman
maintainerPATCH 10/72 x86/platform/uv/BAU: Add APIC idt entry
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Banman <[email protected]>
commit 151ad17fbe5e56afa59709f41980508672c777ce upstream.
BAU uses the old alloc_initr_gate90 method to setup its interrupt. This fails silently as the BAU vector is in the range of APIC vectors that are registered to the spurious interrupt handler. As a consequence BAU broadcasts are not handled, and the broadcast source CPU hangs.
Update BAU to use new idt structure.
--- arch/x86/include/asm/hw_irq.h | 1 + arch/x86/kernel/idt.c | 3 +++ arch/x86/platform/uv/tlb_uv.c | 2 -- 3 files changed, 4 insertions(+), 2 deletions(-)
arch/x86/include/asm/hw_irq.h +1 -0
@@ -36,6 +36,7 @@ extern asmlinkage void kvm_posted_intr_w extern asmlinkage void kvm_posted_intr_nested_ipi(void); extern asmlinkage void error_interrupt(void); extern asmlinkage void irq_work_interrupt(void); +extern asmlinkage void uv_bau_message_intr1(void); extern asmlinkage void spurious_interrupt(void); extern asmlinkage void thermal_interrupt(void);
arch/x86/kernel/idt.c +3 -0
@@ -140,6 +140,9 @@ static const __initconst struct idt_data # ifdef CONFIG_IRQ_WORK INTG(IRQ_WORK_VECTOR, irq_work_interrupt), # endif +#ifdef CONFIG_X86_UV + INTG(UV_BAU_MESSAGE, uv_bau_message_intr1), +#endif INTG(SPURIOUS_APIC_VECTOR, spurious_interrupt), INTG(ERROR_APIC_VECTOR, error_interrupt), #endif
arch/x86/platform/uv/tlb_uv.c +0 -2
@@ -2254,8 +2254,6 @@ static int __init uv_bau_init(void)init_uvhub (uvhub, vector, uv_base_pnode); } -alloc_intr_gate (vector, uv_bau_message_intr1); -for_each_possible_blade (uvhub) {if (uv_blade_nr_possible_cpus (uvhub)) {unsigned long val;
Greg Kroah-Hartman
maintainerPATCH 11/72 perf/hwbp: Simplify the perf-hwbp code, fix documentation
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit f67b15037a7a50c57f72e69a6d59941ad90a0f0f upstream.
Annoyingly, modify_user_hw_breakpoint() unnecessarily complicates the modification of a breakpoint - simplify it and remove the pointless local variables.
Also update the stale Docbook while at it.
--- kernel/events/hw_breakpoint.c | 30 +++++++----------------------- 1 file changed, 7 insertions(+), 23 deletions(-)
kernel/events/hw_breakpoint.c +7 -23
@@ -427,16 +427,9 @@ EXPORT_SYMBOL_GPL(register_user_hw_break* modify_user_hw_breakpoint - modify a user-space hardware breakpoint * @bp: the breakpoint structure to modify * @attr: new breakpoint attributes -* @triggered: callback to trigger when we hit the breakpoint -* @tsk: pointer to 'task_struct' of the process to which the address belongs */ int modify_user_hw_breakpoint (struct perf_event *bp,struct perf_event_attr *attr) { -u64 old_addr = bp->attr.bp_addr; -u64 old_len = bp->attr.bp_len; -int old_type = bp->attr.bp_type; -int err =0 ; -/* * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it * will not be possible to raise IPIs that invoke __perf_event_disable.
@@ -451,27 +444,18 @@ int modify_user_hw_breakpoint(struct per bp->attr.bp_addr = attr->bp_addr; bp->attr.bp_type = attr->bp_type; bp->attr.bp_len = attr->bp_len; + bp->attr.disabled =1 ; -if (attr->disabled) - goto end; - - err =validate_hw_breakpoint (bp); -if (!err) -perf_event_enable (bp); +if (!attr->disabled) { +int err =validate_hw_breakpoint (bp); -if (err) { - bp->attr.bp_addr = old_addr; - bp->attr.bp_type = old_type; - bp->attr.bp_len = old_len; -if (!bp->attr.disabled) -perf_event_enable (bp); +if (err) +return err; -return err; +perf_event_enable (bp); + bp->attr.disabled =0 ; } -end: - bp->attr.disabled = attr->disabled; -return 0 ; }EXPORT_SYMBOL_GPL (modify_user_hw_breakpoint);
Greg Kroah-Hartman
maintainerPATCH 12/72 ceph: only dirty ITER_IOVEC pages for direct read
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan, Zheng <[email protected]>
commit 85784f9395987a422fa04263e7c0fb13da11eb5c upstream.
If a page is already locked, attempting to dirty it leads to a deadlock in lock_page(). This is what currently happens to ITER_BVEC pages when a dio-enabled loop device is backed by ceph:
$ losetup --direct-io /dev/loop0 /mnt/cephfs/img $ xfs_io -c 'pread 0 4k' /dev/loop0
Follow other file systems and only dirty ITER_IOVEC pages.
--- fs/ceph/file.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/ceph/file.c +6 -3
@@ -635,7 +635,8 @@ static ssize_t ceph_sync_read(struct kiostruct ceph_aio_request {struct kiocb *iocb;size_t total_len; -int write; +bool write; +bool should_dirty;int error;struct list_head osd_reqs;unsigned num_reqs;
@@ -745,7 +746,7 @@ static void ceph_aio_complete_req(struct } } -ceph_put_page_vector (osd_data->pages, num_pages, !aio_req->write); +ceph_put_page_vector (osd_data->pages, num_pages, aio_req->should_dirty);ceph_osdc_put_request (req);if (rc <0 )
@@ -842,6 +843,7 @@ ceph_direct_read_write(struct kiocb *iocsize_t count =iov_iter_count (iter);loff_t pos = iocb->ki_pos;bool write =iov_iter_rw (iter) ==WRITE ; +bool should_dirty = !write &&iter_is_iovec (iter);if (write &&ceph_snap (file_inode (file)) !=CEPH_NOSNAP )return -EROFS ;
@@ -909,6 +911,7 @@ ceph_direct_read_write(struct kiocb *iocif (aio_req) { aio_req->iocb = iocb; aio_req->write = write; + aio_req->should_dirty = should_dirty;INIT_LIST_HEAD (&aio_req->osd_reqs);if (write) { aio_req->mtime = mtime;
@@ -966,7 +969,7 @@ ceph_direct_read_write(struct kiocb *ioc len = ret; } -ceph_put_page_vector (pages, num_pages, !write); +ceph_put_page_vector (pages, num_pages, should_dirty);ceph_osdc_put_request (req);if (ret <0 )
Greg Kroah-Hartman
maintainerPATCH 13/72 ipc/shm.c: add split function to shm_vm_ops
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit 3d942ee079b917b24e2a0c5f18d35ac8ec9fee48 upstream.
If System V shmget/shmat operations are used to create a hugetlbfs backed mapping, it is possible to munmap part of the mapping and split the underlying vma such that it is not huge page aligned. This will untimately result in the following BUG:
kernel BUG at /build/linux-jWa1Fv/linux-4.15.0/mm/hugetlb.c:3310!
Oops: Exception in kernel mode, sig: 5 [#1]
LE SMP NR_CPUS=2048 NUMA PowerNV
Modules linked in: kcm nfc af_alg caif_socket caif phonet fcrypt
CPU: 18 PID: 43243 Comm: trinity-subchil Tainted: G C E 4.15.0-10-generic #11-Ubuntu
NIP: c00000000036e764 LR: c00000000036ee48 CTR: 0000000000000009
REGS: c000003fbcdcf810 TRAP: 0700 Tainted: G C E (4.15.0-10-generic)
MSR: 9000000000029033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 24002222 XER: 20040000
CFAR: c00000000036ee44 SOFTE: 1
NIP __unmap_hugepage_range+0xa4/0x760
LR __unmap_hugepage_range_final+0x28/0x50
Call Trace:
0x7115e4e00000 (unreliable)
__unmap_hugepage_range_final+0x28/0x50
unmap_single_vma+0x11c/0x190
unmap_vmas+0x94/0x140
exit_mmap+0x9c/0x1d0
mmput+0xa8/0x1d0
do_exit+0x360/0xc80
do_group_exit+0x60/0x100
SyS_exit_group+0x24/0x30
system_call+0x58/0x6c
---[ end trace ee88f958a1c62605 ]---This bug was introduced by commit 31383c6865a5 ("mm, hugetlbfs:
introduce ->split() to vm_operations_struct"). A split function was added to vm_operations_struct to determine if a mapping can be split. This was mostly for device-dax and hugetlbfs mappings which have specific alignment constraints.
Mappings initiated via shmget/shmat have their original vm_ops overwritten with shm_vm_ops. shm_vm_ops functions will call back to the original vm_ops if needed. Add such a split function to shm_vm_ops.
--- ipc/shm.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
ipc/shm.c +12 -0
@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmreturn sfd->vm_ops->fault (vmf); } +static int shm_split (struct vm_area_struct *vma,unsigned long addr) +{ +struct file *file = vma->vm_file; +struct shm_file_data *sfd =shm_file_data (file); + +if (sfd->vm_ops && sfd->vm_ops->split) +return sfd->vm_ops->split (vma, addr); + +return 0 ; +} +#ifdef CONFIG_NUMA static int shm_set_policy (struct vm_area_struct *vma,struct mempolicy *new) {
@@ -510,6 +521,7 @@ static const struct vm_operations_struct .open = shm_open, /* callback for a new vm-area open */ .close = shm_close, /* callback for when the vm-area is released */ .fault = shm_fault, + .split = shm_split,#if defined(CONFIG_NUMA ) .set_policy = shm_set_policy, .get_policy = shm_get_policy,
Greg Kroah-Hartman
maintainerPATCH 14/72 i2c: i2c-stm32f7: fix no check on returned setup
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pierre-Yves MORDRET <[email protected]>
commit 771b7bf05339081019d22452ebcab6929372e13e upstream.
Before assigning returned setup structure check if not null
--- drivers/i2c/busses/i2c-stm32f7.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/i2c/busses/i2c-stm32f7.c +5 -0
@@ -888,6 +888,11 @@ static int stm32f7_i2c_probe(struct plat } setup =of_device_get_match_data (&pdev->dev); +if (!setup) { +dev_err (&pdev->dev,"Can't get device data\n" ); + ret = -ENODEV ; + goto clk_free; + } i2c_dev->setup = *setup; ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns",
Greg Kroah-Hartman
maintainerPATCH 15/72 powerpc/mm: Add tracking of the number of coprocessors using a context
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit aff6f8cb3e2170b9e58b0932bce7bfb492775e23 upstream.
Currently, when using coprocessors (which use the Nest MMU), we simply increment the active_cpu count to force all TLB invalidations to be come broadcast.
Unfortunately, due to an errata in POWER9, we will need to know more specifically that coprocessors are in use.
This maintains a separate copros counter in the MMU context for that purpose.
NB. The commit mentioned in the fixes tag below is not at fault for the bug we're fixing in this commit and the next, but this fix applies on top the infrastructure it introduced.
--- arch/powerpc/include/asm/book3s/64/mmu.h | 3 +++ arch/powerpc/include/asm/mmu_context.h | 18 +++++++++++++----- arch/powerpc/mm/mmu_context_book3s64.c | 1 + 3 files changed, 17 insertions(+), 5 deletions(-)
arch/powerpc/include/asm/book3s/64/mmu.h +3 -0
@@ -87,6 +87,9 @@ typedef struct {/* Number of bits in the mm_cpumask */ atomic_t active_cpus; +/* Number of users of the external (Nest) MMU */ +atomic_t copros; +/* NPU NMMU context */ struct npu_context *npu_context;
arch/powerpc/include/asm/mmu_context.h +13 -5
@@ -92,15 +92,23 @@ static inline void dec_mm_active_cpus(ststatic inline void mm_context_add_copro (struct mm_struct *mm) {/* -* On hash, should only be called once over the lifetime of -* the context, as we can't decrement the active cpus count -* and flush properly for the time being. +* If any copro is in use, increment the active CPU count +* in order to force TLB invalidations to be global as to +* propagate to the Nest MMU. */ -inc_mm_active_cpus (mm); +if (atomic_inc_return (&mm->context.copros) ==1 ) +inc_mm_active_cpus (mm); }static inline void mm_context_remove_copro (struct mm_struct *mm) { +int c; + + c =atomic_dec_if_positive (&mm->context.copros); + +/* Detect imbalance between add and remove */ +WARN_ON (c <0 ); +/* * Need to broadcast a global flush of the full mm before * decrementing active_cpus count, as the next TLBI may be
@@ -111,7 +119,7 @@ static inline void mm_context_remove_cop* for the time being. Invalidations will remain global if * used on hash. */ -if (radix_enabled ()) { +if (c ==0 &&radix_enabled ()) {flush_all_mm (mm);dec_mm_active_cpus (mm); }
arch/powerpc/mm/mmu_context_book3s64.c +1 -0
@@ -171,6 +171,7 @@ int init_new_context(struct task_structmm_iommu_init (mm);#endif atomic_set (&mm->context.active_cpus,0 ); +atomic_set (&mm->context.copros,0 );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 16/72 powerpc/mm: Workaround Nest MMU bug with TLB invalidations
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Herrenschmidt <[email protected]>
commit 80a4ae202f2d319eced8bbf612a4e8b0f11c21f5 upstream.
On POWER9 the Nest MMU may fail to invalidate some translations when doing a tlbie "by PID" or "by LPID" that is targeted at the TLB only and not the page walk cache.
This works around it by forcing such invalidations to escalate to RIC=2 (full invalidation of TLB *and* PWC) when a coprocessor is in use for the context.
--- arch/powerpc/mm/tlb-radix.c | 50 +++++++++++++++++++++++++++++++++++++------- 1 file changed, 43 insertions(+), 7 deletions(-)
arch/powerpc/mm/tlb-radix.c +43 -7
@@ -85,7 +85,23 @@ static inline void _tlbiel_pid(unsignedstatic inline void _tlbie_pid (unsigned long pid,unsigned long ric) { asmvolatile ("ptesync" : : :"memory" ); -__tlbie_pid (pid, ric); + +/* +* Workaround the fact that the "ric" argument to __tlbie_pid +* must be a compile-time contraint to match the "i" constraint +* in the asm statement. +*/ +switch (ric) { +case RIC_FLUSH_TLB : +__tlbie_pid (pid,RIC_FLUSH_TLB ); +break ; +case RIC_FLUSH_PWC : +__tlbie_pid (pid,RIC_FLUSH_PWC ); +break ; +case RIC_FLUSH_ALL : +default : +__tlbie_pid (pid,RIC_FLUSH_ALL ); + } asmvolatile ("eieio; tlbsync; ptesync" : : :"memory" ); }
@@ -245,6 +261,16 @@ void radix__local_flush_tlb_page(struct }EXPORT_SYMBOL (radix__local_flush_tlb_page); +static bool mm_needs_flush_escalation (struct mm_struct *mm) +{ +/* +* P9 nest MMU has issues with the page walk cache +* caching PTEs and not flushing them properly when +* RIC = 0 for a PID/LPID invalidate +*/ +return atomic_read (&mm->context.copros) !=0 ; +} +#ifdef CONFIG_SMP void radix__flush_tlb_mm (struct mm_struct *mm) {
@@ -255,9 +281,12 @@ void radix__flush_tlb_mm(struct mm_strucreturn ;preempt_disable (); -if (!mm_is_thread_local (mm)) -_tlbie_pid (pid,RIC_FLUSH_TLB ); -else +if (!mm_is_thread_local (mm)) { +if (mm_needs_flush_escalation (mm)) +_tlbie_pid (pid,RIC_FLUSH_ALL ); +else +_tlbie_pid (pid,RIC_FLUSH_TLB ); + }else _tlbiel_pid (pid,RIC_FLUSH_TLB );preempt_enable (); }
@@ -369,10 +398,14 @@ void radix__flush_tlb_range(struct vm_ar }if (full) { -if (local) +if (local) {_tlbiel_pid (pid,RIC_FLUSH_TLB ); -else -_tlbie_pid (pid,RIC_FLUSH_TLB ); + }else { +if (mm_needs_flush_escalation (mm)) +_tlbie_pid (pid,RIC_FLUSH_ALL ); +else +_tlbie_pid (pid,RIC_FLUSH_TLB ); + } }else {bool hflush = false;unsigned long hstart, hend;
@@ -482,6 +515,9 @@ static inline void __radix__flush_tlb_ra }if (full) { +if (!local &&mm_needs_flush_escalation (mm)) + also_pwc = true; +if (local)_tlbiel_pid (pid, also_pwc ?RIC_FLUSH_ALL :RIC_FLUSH_TLB );else
Greg Kroah-Hartman
maintainerPATCH 17/72 powerpc/64s: Fix lost pending interrupt due to race causing lost update to irq_happened
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit ff6781fd1bb404d8a551c02c35c70cec1da17ff1 upstream.
force_external_irq_replay() can be called in the do_IRQ path with interrupts hard enabled and soft disabled if may_hard_irq_enable() set MSR[EE]=1. It updates local_paca->irq_happened with a load, modify, store sequence. If a maskable interrupt hits during this sequence, it will go to the masked handler to be marked pending in irq_happened. This update will be lost when the interrupt returns and the store instruction executes. This can result in unpredictable latencies, timeouts, lockups, etc.
Fix this by ensuring hard interrupts are disabled before modifying irq_happened.
This could cause any maskable asynchronous interrupt to get lost, but it was noticed on P9 SMP system doing RDMA NVMe target over 100GbE, so very high external interrupt rate and high IPI rate. The hang was bisected down to enabling doorbell interrupts for IPIs. These provided an interrupt type that could run at high rates in the do_IRQ path, stressing the race.
--- arch/powerpc/kernel/irq.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/kernel/irq.c +8 -0
@@ -475,6 +475,14 @@ void force_external_irq_replay(void)*/ WARN_ON (!arch_irqs_disabled ()); +/* +* Interrupts must always be hard disabled before irq_happened is +* modified (to prevent lost update in case of interrupt between +* load and store). +*/ +__hard_irq_disable (); + local_paca->irq_happened |=PACA_IRQ_HARD_DIS ; +/* Indicate in the PACA that we have an interrupt to replay */ local_paca->irq_happened |=PACA_IRQ_EE ; }
Greg Kroah-Hartman
maintainerPATCH 18/72 powerpc/64s: Fix i-side SLB miss bad address handler saving nonvolatile GPRs
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit 52396500f97c53860164debc7d4f759077853423 upstream.
The SLB bad address handler's trap number fixup does not preserve the low bit that indicates nonvolatile GPRs have not been saved. This leads save_nvgprs to skip saving them, and subsequent functions and return from interrupt will think they are saved.
This causes kernel branch-to-garbage debugging to not have correct registers, can also cause userspace to have its registers clobbered after a segfault.
--- arch/powerpc/kernel/exceptions-64s.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/exceptions-64s.S +1 -1
@@ -706,7 +706,7 @@ EXC_COMMON_BEGIN(bad_addr_slb) ld r3, PACA_EXSLB+EX_DAR(r13) std r3, _DAR(r1) beq cr6, 2f - li r10, 0x480 /* fix trap number for I-SLB miss */ + li r10, 0x481 /* fix trap number for I-SLB miss */ std r10, _TRAP(r1) 2: bl save_nvgprs addi r3, r1, STACK_FRAME_OVERHEAD
Greg Kroah-Hartman
maintainerPATCH 19/72 partitions/msdos: Unable to mount UFS 44bsd partitions
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Narron <[email protected]>
commit 5f15684bd5e5ef39d4337988864fec8012471dda upstream.
UFS partitions from newer versions of FreeBSD 10 and 11 use relative addressing for their subpartitions. But older versions of FreeBSD still use absolute addressing just like OpenBSD and NetBSD.
Instead of simply testing for a FreeBSD partition, the code needs to also test if the starting offset of the C subpartition is zero.
https://bugzilla.kernel.org/show_bug.cgi?id=197733
--- block/partitions/msdos.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
block/partitions/msdos.c +3 -1
@@ -301,7 +301,9 @@ static void parse_bsd(struct parsed_partcontinue ; bsd_start =le32_to_cpu (p->p_offset); bsd_size =le32_to_cpu (p->p_size); -if (memcmp (flavour,"bsd\0" ,4 ) ==0 ) +/* FreeBSD has relative offset if C partition offset is zero */ +if (memcmp (flavour,"bsd\0" ,4 ) ==0 && +le32_to_cpu (l->d_partitions[2 ].p_offset) ==0 ) bsd_start += offset;if (offset == bsd_start && size == bsd_size)/* full parent partition, we have it already */
Greg Kroah-Hartman
maintainerPATCH 20/72 xfrm_user: uncoditionally validate esn replay attribute struct
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit d97ca5d714a5334aecadadf696875da40f1fbf3e upstream.
The sanity test added in ecd7918745234 can be bypassed, validation only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care and just checks if the attribute itself is present.
So always validate. Alternative is to reject if we have the attribute without the flag but that would change abi.
--- net/xfrm/xfrm_user.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-)
net/xfrm/xfrm_user.c +8 -13
@@ -121,22 +121,17 @@ static inline int verify_replay(struct xstruct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL ];struct xfrm_replay_state_esn *rs; -if (p->flags &XFRM_STATE_ESN ) { -if (!rt) -return -EINVAL ; - - rs =nla_data (rt); +if (!rt) +return (p->flags &XFRM_STATE_ESN ) ? -EINVAL :0 ; -if (rs->bmp_len >XFRMA_REPLAY_ESN_MAX /sizeof (rs->bmp[0 ]) /8 ) -return -EINVAL ; + rs =nla_data (rt); -if (nla_len (rt) < (int )xfrm_replay_state_esn_len (rs) && -nla_len (rt) !=sizeof (*rs)) -return -EINVAL ; - } +if (rs->bmp_len >XFRMA_REPLAY_ESN_MAX /sizeof (rs->bmp[0 ]) /8 ) +return -EINVAL ; -if (!rt) -return 0 ; +if (nla_len (rt) < (int )xfrm_replay_state_esn_len (rs) && +nla_len (rt) !=sizeof (*rs)) +return -EINVAL ;/* As only ESP and AH support ESN feature. */ if ((p->id.proto !=IPPROTO_ESP ) && (p->id.proto !=IPPROTO_AH ))
Greg Kroah-Hartman
maintainerPATCH 21/72 RDMA/ucma: Check AF family prior resolving address
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit 2975d5de6428ff6d9317e9948f0968f7d42e5d74 upstream.
Garbage supplied by user will cause to UCMA module provide zero memory size for memcpy(), because it wasn't checked, it will produce unpredictable results in rdma_resolve_addr().
[ 42.873814] BUG: KASAN: null-ptr-deref in rdma_resolve_addr+0xc8/0xfb0 [ 42.874816] Write of size 28 at addr 00000000000000a0 by task resaddr/1044 [ 42.876765] [ 42.876960] CPU: 1 PID: 1044 Comm: resaddr Not tainted 4.16.0-rc1-00057-gaa56a5293d7e #34 [ 42.877840] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 42.879691] Call Trace: [ 42.880236] dump_stack+0x5c/0x77 [ 42.880664] kasan_report+0x163/0x380 [ 42.881354] ? rdma_resolve_addr+0xc8/0xfb0 [ 42.881864] memcpy+0x34/0x50 [ 42.882692] rdma_resolve_addr+0xc8/0xfb0 [ 42.883366] ? deref_stack_reg+0x88/0xd0 [ 42.883856] ? vsnprintf+0x31a/0x770 [ 42.884686] ? rdma_bind_addr+0xc40/0xc40 [ 42.885327] ? num_to_str+0x130/0x130 [ 42.885773] ? deref_stack_reg+0x88/0xd0 [ 42.886217] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [ 42.887698] ? unwind_get_return_address_ptr+0x50/0x50 [ 42.888302] ? replace_slot+0x147/0x170 [ 42.889176] ? delete_node+0x12c/0x340 [ 42.890223] ? __radix_tree_lookup+0xa9/0x160 [ 42.891196] ? ucma_resolve_ip+0xb7/0x110 [ 42.891917] ucma_resolve_ip+0xb7/0x110 [ 42.893003] ? ucma_resolve_addr+0x190/0x190 [ 42.893531] ? _copy_from_user+0x5e/0x90 [ 42.894204] ucma_write+0x174/0x1f0 [ 42.895162] ? ucma_resolve_route+0xf0/0xf0 [ 42.896309] ? dequeue_task_fair+0x67e/0xd90 [ 42.897192] ? put_prev_entity+0x7d/0x170 [ 42.897870] ? ring_buffer_record_is_on+0xd/0x20 [ 42.898439] ? tracing_record_taskinfo_skip+0x20/0x50 [ 42.899686] __vfs_write+0xc4/0x350 [ 42.900142] ? kernel_read+0xa0/0xa0 [ 42.900602] ? firmware_map_remove+0xdf/0xdf [ 42.901135] ? do_task_dead+0x5d/0x60 [ 42.901598] ? do_exit+0xcc6/0x1220 [ 42.902789] ? __fget+0xa8/0xf0 [ 42.903190] vfs_write+0xf7/0x280 [ 42.903600] SyS_write+0xa1/0x120 [ 42.904206] ? SyS_read+0x120/0x120 [ 42.905710] ? compat_start_thread+0x60/0x60 [ 42.906423] ? SyS_read+0x120/0x120 [ 42.908716] do_syscall_64+0xeb/0x250 [ 42.910760] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 42.912735] RIP: 0033:0x7f138b0afe99 [ 42.914734] RSP: 002b:00007f138b799e98 EFLAGS: 00000287 ORIG_RAX: 0000000000000001 [ 42.917134] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f138b0afe99 [ 42.919487] RDX: 000000000000002e RSI: 0000000020000c40 RDI: 0000000000000004 [ 42.922393] RBP: 00007f138b799ec0 R08: 00007f138b79a700 R09: 0000000000000000 [ 42.925266] R10: 00007f138b79a700 R11: 0000000000000287 R12: 00007f138b799fc0 [ 42.927570] R13: 0000000000000000 R14: 00007ffdbae757c0 R15: 00007f138b79a9c0 [ 42.930047] [ 42.932681] Disabling lock debugging due to kernel taint [ 42.934795] BUG: unable to handle kernel NULL pointer dereference at 00000000000000a0 [ 42.936939] IP: memcpy_erms+0x6/0x10 [ 42.938864] PGD 80000001bea92067 P4D 80000001bea92067 PUD 1bea96067 PMD 0 [ 42.941576] Oops: 0002 [#1] SMP KASAN PTI [ 42.943952] CPU: 1 PID: 1044 Comm: resaddr Tainted: G B 4.16.0-rc1-00057-gaa56a5293d7e #34 [ 42.946964] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 42.952336] RIP: 0010:memcpy_erms+0x6/0x10 [ 42.954707] RSP: 0018:ffff8801c8b479c8 EFLAGS: 00010286 [ 42.957227] RAX: 00000000000000a0 RBX: ffff8801c8b47ba0 RCX: 000000000000001c [ 42.960543] RDX: 000000000000001c RSI: ffff8801c8b47bbc RDI: 00000000000000a0 [ 42.963867] RBP: ffff8801c8b47b60 R08: 0000000000000000 R09: ffffed0039168ed1 [ 42.967303] R10: 0000000000000001 R11: ffffed0039168ed0 R12: ffff8801c8b47bbc [ 42.970685] R13: 00000000000000a0 R14: 1ffff10039168f4a R15: 0000000000000000 [ 42.973631] FS: 00007f138b79a700(0000) GS:ffff8801e5d00000(0000) knlGS:0000000000000000 [ 42.976831] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 42.979239] CR2: 00000000000000a0 CR3: 00000001be908002 CR4: 00000000003606a0 [ 42.982060] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 42.984877] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 42.988033] Call Trace: [ 42.990487] rdma_resolve_addr+0xc8/0xfb0 [ 42.993202] ? deref_stack_reg+0x88/0xd0 [ 42.996055] ? vsnprintf+0x31a/0x770 [ 42.998707] ? rdma_bind_addr+0xc40/0xc40 [ 43.000985] ? num_to_str+0x130/0x130 [ 43.003410] ? deref_stack_reg+0x88/0xd0 [ 43.006302] ? __read_once_size_nocheck.constprop.6+0x10/0x10 [ 43.008780] ? unwind_get_return_address_ptr+0x50/0x50 [ 43.011178] ? replace_slot+0x147/0x170 [ 43.013517] ? delete_node+0x12c/0x340 [ 43.016019] ? __radix_tree_lookup+0xa9/0x160 [ 43.018755] ? ucma_resolve_ip+0xb7/0x110 [ 43.021270] ucma_resolve_ip+0xb7/0x110 [ 43.023968] ? ucma_resolve_addr+0x190/0x190 [ 43.026312] ? _copy_from_user+0x5e/0x90 [ 43.029384] ucma_write+0x174/0x1f0 [ 43.031861] ? ucma_resolve_route+0xf0/0xf0 [ 43.034782] ? dequeue_task_fair+0x67e/0xd90 [ 43.037483] ? put_prev_entity+0x7d/0x170 [ 43.040215] ? ring_buffer_record_is_on+0xd/0x20 [ 43.042990] ? tracing_record_taskinfo_skip+0x20/0x50 [ 43.045595] __vfs_write+0xc4/0x350 [ 43.048624] ? kernel_read+0xa0/0xa0 [ 43.051604] ? firmware_map_remove+0xdf/0xdf [ 43.055379] ? do_task_dead+0x5d/0x60 [ 43.058000] ? do_exit+0xcc6/0x1220 [ 43.060783] ? __fget+0xa8/0xf0 [ 43.063133] vfs_write+0xf7/0x280 [ 43.065677] SyS_write+0xa1/0x120 [ 43.068647] ? SyS_read+0x120/0x120 [ 43.071179] ? compat_start_thread+0x60/0x60 [ 43.074025] ? SyS_read+0x120/0x120 [ 43.076705] do_syscall_64+0xeb/0x250 [ 43.079006] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 43.081606] RIP: 0033:0x7f138b0afe99 [ 43.083679] RSP: 002b:00007f138b799e98 EFLAGS: 00000287 ORIG_RAX: 0000000000000001 [ 43.086802] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f138b0afe99 [ 43.089989] RDX: 000000000000002e RSI: 0000000020000c40 RDI: 0000000000000004 [ 43.092866] RBP: 00007f138b799ec0 R08: 00007f138b79a700 R09: 0000000000000000 [ 43.096233] R10: 00007f138b79a700 R11: 0000000000000287 R12: 00007f138b799fc0 [ 43.098913] R13: 0000000000000000 R14: 00007ffdbae757c0 R15: 00007f138b79a9c0 [ 43.101809] Code: 90 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 [ 43.107950] RIP: memcpy_erms+0x6/0x10 RSP: ffff8801c8b479c8
--- drivers/infiniband/core/ucma.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/infiniband/core/ucma.c +7 -3
@@ -664,19 +664,23 @@ static ssize_t ucma_resolve_ip(struct uc int in_len, int out_len) {struct rdma_ucm_resolve_ip cmd; +struct sockaddr *src, *dst;struct ucma_context *ctx;int ret;if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; + src = (struct sockaddr *) &cmd.src_addr; + dst = (struct sockaddr *) &cmd.dst_addr; +if (!rdma_addr_size (src) || !rdma_addr_size (dst)) +return -EINVAL ; + ctx =ucma_get_ctx (file, cmd.id);if (IS_ERR (ctx))return PTR_ERR (ctx); - ret =rdma_resolve_addr (ctx->cm_id, (struct sockaddr *) &cmd.src_addr, - (struct sockaddr *) &cmd.dst_addr, - cmd.timeout_ms); + ret =rdma_resolve_addr (ctx->cm_id, src, dst, cmd.timeout_ms);ucma_put_ctx (ctx);return ret; }
Greg Kroah-Hartman
maintainerPATCH 22/72 RDMA/ucma: Fix use-after-free access in ucma_close
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit ed65a4dc22083e73bac599ded6a262318cad7baf upstream.
The error in ucma_create_id() left ctx in the list of contexts belong to ucma file descriptor. The attempt to close this file descriptor causes to use-after-free accesses while iterating over such list.
--- drivers/infiniband/core/ucma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/core/ucma.c +3 -0
@@ -497,6 +497,9 @@ err1:mutex_lock (&mut);idr_remove (&ctx_idr, ctx->id);mutex_unlock (&mut); +mutex_lock (&file->mut); +list_del (&ctx->list); +mutex_unlock (&file->mut);kfree (ctx);return ret; }
Greg Kroah-Hartman
maintainerPATCH 23/72 RDMA/ucma: Ensure that CM_ID exists prior to access it
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit e8980d67d6017c8eee8f9c35f782c4bd68e004c9 upstream.
Prior to access UCMA commands, the context should be initialized and connected to CM_ID with ucma_create_id(). In case user skips this step, he can provide non-valid ctx without CM_ID and cause to multiple NULL dereferences.
Also there are situations where the create_id can be raced with other user access, ensure that the context is only shared to other threads once it is fully initialized to avoid the races.
[ 109.088108] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 [ 109.090315] IP: ucma_connect+0x138/0x1d0 [ 109.092595] PGD 80000001dc02d067 P4D 80000001dc02d067 PUD 1da9ef067 PMD 0 [ 109.095384] Oops: 0000 [#1] SMP KASAN PTI [ 109.097834] CPU: 0 PID: 663 Comm: uclose Tainted: G B 4.16.0-rc1-00062-g2975d5de6428 #45 [ 109.100816] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 109.105943] RIP: 0010:ucma_connect+0x138/0x1d0 [ 109.108850] RSP: 0018:ffff8801c8567a80 EFLAGS: 00010246 [ 109.111484] RAX: 0000000000000000 RBX: 1ffff100390acf50 RCX: ffffffff9d7812e2 [ 109.114496] RDX: 1ffffffff3f507a5 RSI: 0000000000000297 RDI: 0000000000000297 [ 109.117490] RBP: ffff8801daa15600 R08: 0000000000000000 R09: ffffed00390aceeb [ 109.120429] R10: 0000000000000001 R11: ffffed00390aceea R12: 0000000000000000 [ 109.123318] R13: 0000000000000120 R14: ffff8801de6459c0 R15: 0000000000000118 [ 109.126221] FS: 00007fabb68d6700(0000) GS:ffff8801e5c00000(0000) knlGS:0000000000000000 [ 109.129468] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 109.132523] CR2: 0000000000000020 CR3: 00000001d45d8003 CR4: 00000000003606b0 [ 109.135573] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 109.138716] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 109.142057] Call Trace: [ 109.144160] ? ucma_listen+0x110/0x110 [ 109.146386] ? wake_up_q+0x59/0x90 [ 109.148853] ? futex_wake+0x10b/0x2a0 [ 109.151297] ? save_stack+0x89/0xb0 [ 109.153489] ? _copy_from_user+0x5e/0x90 [ 109.155500] ucma_write+0x174/0x1f0 [ 109.157933] ? ucma_resolve_route+0xf0/0xf0 [ 109.160389] ? __mod_node_page_state+0x1d/0x80 [ 109.162706] __vfs_write+0xc4/0x350 [ 109.164911] ? kernel_read+0xa0/0xa0 [ 109.167121] ? path_openat+0x1b10/0x1b10 [ 109.169355] ? fsnotify+0x899/0x8f0 [ 109.171567] ? fsnotify_unmount_inodes+0x170/0x170 [ 109.174145] ? __fget+0xa8/0xf0 [ 109.177110] vfs_write+0xf7/0x280 [ 109.179532] SyS_write+0xa1/0x120 [ 109.181885] ? SyS_read+0x120/0x120 [ 109.184482] ? compat_start_thread+0x60/0x60 [ 109.187124] ? SyS_read+0x120/0x120 [ 109.189548] do_syscall_64+0xeb/0x250 [ 109.192178] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 109.194725] RIP: 0033:0x7fabb61ebe99 [ 109.197040] RSP: 002b:00007fabb68d5e98 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 [ 109.200294] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fabb61ebe99 [ 109.203399] RDX: 0000000000000120 RSI: 00000000200001c0 RDI: 0000000000000004 [ 109.206548] RBP: 00007fabb68d5ec0 R08: 0000000000000000 R09: 0000000000000000 [ 109.209902] R10: 0000000000000000 R11: 0000000000000202 R12: 00007fabb68d5fc0 [ 109.213327] R13: 0000000000000000 R14: 00007fff40ab2430 R15: 00007fabb68d69c0 [ 109.216613] Code: 88 44 24 2c 0f b6 84 24 6e 01 00 00 88 44 24 2d 0f b6 84 24 69 01 00 00 88 44 24 2e 8b 44 24 60 89 44 24 30 e8 da f6 06 ff 31 c0 <66> 41 83 7c 24 20 1b 75 04 8b 44 24 64 48 8d 74 24 20 4c 89 e7 [ 109.223602] RIP: ucma_connect+0x138/0x1d0 RSP: ffff8801c8567a80 [ 109.226256] CR2: 0000000000000020
--- drivers/infiniband/core/ucma.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/infiniband/core/ucma.c +9 -6
@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma ctx =idr_find (&ctx_idr, id);if (!ctx) ctx =ERR_PTR (-ENOENT ); -else if (ctx->file != file) +else if (ctx->file != file || !ctx->cm_id) ctx =ERR_PTR (-EINVAL );return ctx; }
@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucmstruct rdma_ucm_create_id cmd;struct rdma_ucm_create_id_resp resp;struct ucma_context *ctx; +struct rdma_cm_id *cm_id;enum ib_qp_type qp_type;int ret;
@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucmreturn -ENOMEM ; ctx->uid = cmd.uid; - ctx->cm_id =rdma_create_id (current->nsproxy->net_ns, - ucma_event_handler, ctx, cmd.ps, qp_type); -if (IS_ERR (ctx->cm_id)) { - ret =PTR_ERR (ctx->cm_id); + cm_id =rdma_create_id (current->nsproxy->net_ns, + ucma_event_handler, ctx, cmd.ps, qp_type); +if (IS_ERR (cm_id)) { + ret =PTR_ERR (cm_id); goto err1; }
@@ -489,10 +490,12 @@ static ssize_t ucma_create_id(struct ucm ret = -EFAULT ; goto err2; } + + ctx->cm_id = cm_id;return 0 ; err2: -rdma_destroy_id (ctx->cm_id); +rdma_destroy_id (cm_id); err1:mutex_lock (&mut);idr_remove (&ctx_idr, ctx->id);
Greg Kroah-Hartman
maintainerPATCH 24/72 RDMA/rdma_cm: Fix use after free race with process_one_req
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 9137108cc3d64ade13e753108ec611a0daed16a0 upstream.
process_one_req() can race with rdma_addr_cancel():
CPU0 CPU1
==== ====
process_one_work()
debug_work_deactivate(work);
process_one_req()
rdma_addr_cancel()
mutex_lock(&lock);
set_timeout(&req->work,..);
__queue_work()
debug_work_activate(work);
mutex_unlock(&lock); mutex_lock(&lock);
[..]
list_del(&req->list);
mutex_unlock(&lock);
[..]
// ODEBUG explodes since the work is still queued. kfree(req);
Causing ODEBUG to detect the use after free:
ODEBUG: free active (active state 0) object type: work_struct hint: process_one_req+0x0/0x6c0 include/net/dst.h:165
WARNING: CPU: 0 PID: 79 at lib/debugobjects.c:291 debug_print_object+0x166/0x220 lib/debugobjects.c:288 kvm: emulating exchange as write Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 79 Comm: kworker/u4:3 Not tainted 4.16.0-rc6+ #361 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: ib_addr process_one_req Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 panic+0x1e4/0x41c kernel/panic.c:183 __warn+0x1dc/0x200 kernel/panic.c:547 report_bug+0x1f4/0x2b0 lib/bug.c:186 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 fixup_bug arch/x86/kernel/traps.c:247 [inline] do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:986 RIP: 0010:debug_print_object+0x166/0x220 lib/debugobjects.c:288 RSP: 0000:ffff8801d966f210 EFLAGS: 00010086 RAX: dffffc0000000008 RBX: 0000000000000003 RCX: ffffffff815acd6e RDX: 0000000000000000 RSI: 1ffff1003b2cddf2 RDI: 0000000000000000 RBP: ffff8801d966f250 R08: 0000000000000000 R09: 1ffff1003b2cddc8 R10: ffffed003b2cde71 R11: ffffffff86f39a98 R12: 0000000000000001 R13: ffffffff86f15540 R14: ffffffff86408700 R15: ffffffff8147c0a0 __debug_check_no_obj_freed lib/debugobjects.c:745 [inline] debug_check_no_obj_freed+0x662/0xf1f lib/debugobjects.c:774 kfree+0xc7/0x260 mm/slab.c:3799 process_one_req+0x2e7/0x6c0 drivers/infiniband/core/addr.c:592 process_one_work+0xc47/0x1bb0 kernel/workqueue.c:2113 worker_thread+0x223/0x1990 kernel/workqueue.c:2247 kthread+0x33c/0x400 kernel/kthread.c:238 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:406
--- drivers/infiniband/core/addr.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/infiniband/core/addr.c +9 -0
@@ -598,6 +598,15 @@ static void process_one_req(struct work_list_del (&req->list);mutex_unlock (&lock); +/* +* Although the work will normally have been canceled by the +* workqueue, it can still be requeued as long as it is on the +* req_list, so it could have been requeued before we grabbed &lock. +* We need to cancel it after it is removed from req_list to really be +* sure it is safe to free. +*/ +cancel_delayed_work (&req->work); + req->callback (req->status, (struct sockaddr *)&req->src_addr, req->addr, req->context);put_client (req->client);
Greg Kroah-Hartman
maintainerPATCH 25/72 RDMA/ucma: Check that device is connected prior to access it
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit 4b658d1bbc16605330694bb3ef2570c465ef383d upstream.
Add missing check that device is connected prior to access it.
[ 55.358652] BUG: KASAN: null-ptr-deref in rdma_init_qp_attr+0x4a/0x2c0 [ 55.359389] Read of size 8 at addr 00000000000000b0 by task qp/618 [ 55.360255] [ 55.360432] CPU: 1 PID: 618 Comm: qp Not tainted 4.16.0-rc1-00071-gcaf61b1b8b88 #91 [ 55.361693] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.0-0-g63451fca13-prebuilt.qemu-project.org 04/01/2014 [ 55.363264] Call Trace: [ 55.363833] dump_stack+0x5c/0x77 [ 55.364215] kasan_report+0x163/0x380 [ 55.364610] ? rdma_init_qp_attr+0x4a/0x2c0 [ 55.365238] rdma_init_qp_attr+0x4a/0x2c0 [ 55.366410] ucma_init_qp_attr+0x111/0x200 [ 55.366846] ? ucma_notify+0xf0/0xf0 [ 55.367405] ? _get_random_bytes+0xea/0x1b0 [ 55.367846] ? urandom_read+0x2f0/0x2f0 [ 55.368436] ? kmem_cache_alloc_trace+0xd2/0x1e0 [ 55.369104] ? refcount_inc_not_zero+0x9/0x60 [ 55.369583] ? refcount_inc+0x5/0x30 [ 55.370155] ? rdma_create_id+0x215/0x240 [ 55.370937] ? _copy_to_user+0x4f/0x60 [ 55.371620] ? mem_cgroup_commit_charge+0x1f5/0x290 [ 55.372127] ? _copy_from_user+0x5e/0x90 [ 55.372720] ucma_write+0x174/0x1f0 [ 55.373090] ? ucma_close_id+0x40/0x40 [ 55.373805] ? __lru_cache_add+0xa8/0xd0 [ 55.374403] __vfs_write+0xc4/0x350 [ 55.374774] ? kernel_read+0xa0/0xa0 [ 55.375173] ? fsnotify+0x899/0x8f0 [ 55.375544] ? fsnotify_unmount_inodes+0x170/0x170 [ 55.376689] ? __fsnotify_update_child_dentry_flags+0x30/0x30 [ 55.377522] ? handle_mm_fault+0x174/0x320 [ 55.378169] vfs_write+0xf7/0x280 [ 55.378864] SyS_write+0xa1/0x120 [ 55.379270] ? SyS_read+0x120/0x120 [ 55.379643] ? mm_fault_error+0x180/0x180 [ 55.380071] ? task_work_run+0x7d/0xd0 [ 55.380910] ? __task_pid_nr_ns+0x120/0x140 [ 55.381366] ? SyS_read+0x120/0x120 [ 55.381739] do_syscall_64+0xeb/0x250 [ 55.382143] entry_SYSCALL_64_after_hwframe+0x21/0x86 [ 55.382841] RIP: 0033:0x7fc2ef803e99 [ 55.383227] RSP: 002b:00007fffcc5f3be8 EFLAGS: 00000217 ORIG_RAX: 0000000000000001 [ 55.384173] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc2ef803e99 [ 55.386145] RDX: 0000000000000057 RSI: 0000000020000080 RDI: 0000000000000003 [ 55.388418] RBP: 00007fffcc5f3c00 R08: 0000000000000000 R09: 0000000000000000 [ 55.390542] R10: 0000000000000000 R11: 0000000000000217 R12: 0000000000400480 [ 55.392916] R13: 00007fffcc5f3cf0 R14: 0000000000000000 R15: 0000000000000000 [ 55.521088] Code: e5 4d 1e ff 48 89 df 44 0f b6 b3 b8 01 00 00 e8 65 50 1e ff 4c 8b 2b 49 8d bd b0 00 00 00 e8 56 50 1e ff 41 0f b6 c6 48 c1 e0 04 <49> 03 85 b0 00 00 00 48 8d 78 08 48 89 04 24 e8 3a 4f 1e ff 48 [ 55.525980] RIP: rdma_init_qp_attr+0x52/0x2c0 RSP: ffff8801e2c2f9d8 [ 55.532648] CR2: 00000000000000b0 [ 55.534396] ---[ end trace 70cee64090251c0b ]---
--- drivers/infiniband/core/ucma.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/core/ucma.c +5 -0
@@ -1165,6 +1165,11 @@ static ssize_t ucma_init_qp_attr(structif (IS_ERR (ctx))return PTR_ERR (ctx); +if (!ctx->cm_id->device) { + ret = -EINVAL ; + goto out; + } + resp.qp_attr_mask =0 ;memset (&qp_attr,0 ,sizeof qp_attr); qp_attr.qp_state = cmd.qp_state;
Greg Kroah-Hartman
maintainerPATCH 26/72 RDMA/ucma: Check that device exists prior to accessing it
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <[email protected]>
commit c8d3bcbfc5eab3f01cf373d039af725f3b488813 upstream.
Ensure that device exists prior to accessing its properties.
--- drivers/infiniband/core/ucma.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/infiniband/core/ucma.c +4 -2
@@ -1335,7 +1335,7 @@ static ssize_t ucma_notify(struct ucma_f {struct rdma_ucm_notify cmd;struct ucma_context *ctx; -int ret; +int ret = -EINVAL ;if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ;
@@ -1344,7 +1344,9 @@ static ssize_t ucma_notify(struct ucma_fif (IS_ERR (ctx))return PTR_ERR (ctx); - ret =rdma_notify (ctx->cm_id, (enum ib_event_type ) cmd.event); +if (ctx->cm_id->device) + ret =rdma_notify (ctx->cm_id, (enum ib_event_type )cmd.event); +ucma_put_ctx (ctx);return ret; }
Greg Kroah-Hartman
maintainerPATCH 27/72 RDMA/ucma: Introduce safer rdma_addr_size() variants
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
commit 84652aefb347297aa08e91e283adf7b18f77c2d5 upstream.
There are several places in the ucma ABI where userspace can pass in a sockaddr but set the address family to AF_IB. When that happens, rdma_addr_size() will return a size bigger than sizeof struct sockaddr_in6, and the ucma kernel code might end up copying past the end of a buffer not sized for a struct sockaddr_ib.
Fix this by introducing new variants
int rdma_addr_size_in6(struct sockaddr_in6 *addr);
int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr);that are type-safe for the types used in the ucma ABI and return 0 if the size computed is bigger than the size of the type passed in. We can use these new variants to check what size userspace has passed in before copying any addresses.
--- drivers/infiniband/core/addr.c | 16 ++++++++++++++++ drivers/infiniband/core/ucma.c | 34 +++++++++++++++++----------------- include/rdma/ib_addr.h | 2 ++ 3 files changed, 35 insertions(+), 17 deletions(-)
drivers/infiniband/core/addr.c +16 -0
@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr }EXPORT_SYMBOL (rdma_addr_size); +int rdma_addr_size_in6 (struct sockaddr_in6 *addr) +{ +int ret =rdma_addr_size ((struct sockaddr *) addr); + +return ret <=sizeof (*addr) ? ret :0 ; +} +EXPORT_SYMBOL (rdma_addr_size_in6); + +int rdma_addr_size_kss (struct __kernel_sockaddr_storage *addr) +{ +int ret =rdma_addr_size ((struct sockaddr *) addr); + +return ret <=sizeof (*addr) ? ret :0 ; +} +EXPORT_SYMBOL (rdma_addr_size_kss); +static struct rdma_addr_client self;void rdma_addr_register_client (struct rdma_addr_client *client)
drivers/infiniband/core/ucma.c +17 -17
@@ -632,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; +if (!rdma_addr_size_in6 (&cmd.addr)) +return -EINVAL ; + ctx =ucma_get_ctx (file, cmd.id);if (IS_ERR (ctx))return PTR_ERR (ctx);
@@ -645,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_fil int in_len, int out_len) {struct rdma_ucm_bind cmd; -struct sockaddr *addr;struct ucma_context *ctx;int ret;if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; - addr = (struct sockaddr *) &cmd.addr; -if (cmd.reserved || !cmd.addr_size || (cmd.addr_size !=rdma_addr_size (addr))) +if (cmd.reserved || !cmd.addr_size || + cmd.addr_size !=rdma_addr_size_kss (&cmd.addr))return -EINVAL ; ctx =ucma_get_ctx (file, cmd.id);if (IS_ERR (ctx))return PTR_ERR (ctx); - ret =rdma_bind_addr (ctx->cm_id, addr); + ret =rdma_bind_addr (ctx->cm_id, (struct sockaddr *) &cmd.addr);ucma_put_ctx (ctx);return ret; }
@@ -670,23 +672,22 @@ static ssize_t ucma_resolve_ip(struct uc int in_len, int out_len) {struct rdma_ucm_resolve_ip cmd; -struct sockaddr *src, *dst;struct ucma_context *ctx;int ret;if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; - src = (struct sockaddr *) &cmd.src_addr; - dst = (struct sockaddr *) &cmd.dst_addr; -if (!rdma_addr_size (src) || !rdma_addr_size (dst)) +if (!rdma_addr_size_in6 (&cmd.src_addr) || + !rdma_addr_size_in6 (&cmd.dst_addr))return -EINVAL ; ctx =ucma_get_ctx (file, cmd.id);if (IS_ERR (ctx))return PTR_ERR (ctx); - ret =rdma_resolve_addr (ctx->cm_id, src, dst, cmd.timeout_ms); + ret =rdma_resolve_addr (ctx->cm_id, (struct sockaddr *) &cmd.src_addr, + (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);ucma_put_ctx (ctx);return ret; }
@@ -696,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct int in_len, int out_len) {struct rdma_ucm_resolve_addr cmd; -struct sockaddr *src, *dst;struct ucma_context *ctx;int ret;if (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; - src = (struct sockaddr *) &cmd.src_addr; - dst = (struct sockaddr *) &cmd.dst_addr; -if (cmd.reserved || (cmd.src_size && (cmd.src_size !=rdma_addr_size (src))) || - !cmd.dst_size || (cmd.dst_size !=rdma_addr_size (dst))) +if (cmd.reserved || + (cmd.src_size && (cmd.src_size !=rdma_addr_size_kss (&cmd.src_addr))) || + !cmd.dst_size || (cmd.dst_size !=rdma_addr_size_kss (&cmd.dst_addr)))return -EINVAL ; ctx =ucma_get_ctx (file, cmd.id);if (IS_ERR (ctx))return PTR_ERR (ctx); - ret =rdma_resolve_addr (ctx->cm_id, src, dst, cmd.timeout_ms); + ret =rdma_resolve_addr (ctx->cm_id, (struct sockaddr *) &cmd.src_addr, + (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms);ucma_put_ctx (ctx);return ret; }
@@ -1432,7 +1432,7 @@ static ssize_t ucma_join_ip_multicast(st join_cmd.response = cmd.response; join_cmd.uid = cmd.uid; join_cmd.id = cmd.id; - join_cmd.addr_size =rdma_addr_size ((struct sockaddr *) &cmd.addr); + join_cmd.addr_size =rdma_addr_size_in6 (&cmd.addr);if (!join_cmd.addr_size)return -EINVAL ;
@@ -1451,7 +1451,7 @@ static ssize_t ucma_join_multicast(strucif (copy_from_user (&cmd, inbuf,sizeof (cmd)))return -EFAULT ; -if (!rdma_addr_size ((struct sockaddr *)&cmd.addr)) +if (!rdma_addr_size_kss (&cmd.addr))return -EINVAL ;return ucma_process_join (file, &cmd, out_len);
include/rdma/ib_addr.h +2 -0
@@ -130,6 +130,8 @@ void rdma_copy_addr(struct rdma_dev_addr const unsigned char *dst_dev_addr);int rdma_addr_size (struct sockaddr *addr); +int rdma_addr_size_in6 (struct sockaddr_in6 *addr); +int rdma_addr_size_kss (struct __kernel_sockaddr_storage *addr);int rdma_addr_find_smac_by_sgid (union ib_gid *sgid,u8 *smac,u16 *vlan_id); int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid,
Greg Kroah-Hartman
maintainerPATCH 28/72 ipv6: fix possible deadlock in rt6_age_examine_exception()
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 1bfa26ff8c4b7512f4e4efa6df211239223033d4 upstream.
syzbot reported a LOCKDEP splat [1] in rt6_age_examine_exception()
rt6_age_examine_exception() is called while rt6_exception_lock is held. This lock is the lower one in the lock hierarchy, thus we can not call dst_neigh_lookup() function, as it can fallback to neigh_create()
We should instead do a pure RCU lookup. As a bonus we avoid a pair of atomic operations on neigh refcount.
[1]
WARNING: possible circular locking dependency detected 4.16.0-rc4+ #277 Not tainted
syz-executor7/4015 is trying to acquire lock:
(&ndev->lock){++--}, at: [<00000000416dce19>] __ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928
but task is already holding lock:
(&tbl->lock){++-.}, at: [<00000000b5cb1d65>] neigh_ifdown+0x3d/0x250 net/core/neighbour.c:292
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&tbl->lock){++-.}:
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312
__neigh_create+0x87e/0x1d90 net/core/neighbour.c:528
neigh_create include/net/neighbour.h:315 [inline]
ip6_neigh_lookup+0x9a7/0xba0 net/ipv6/route.c:228
dst_neigh_lookup include/net/dst.h:405 [inline]
rt6_age_examine_exception net/ipv6/route.c:1609 [inline]
rt6_age_exceptions+0x381/0x660 net/ipv6/route.c:1645
fib6_age+0xfb/0x140 net/ipv6/ip6_fib.c:2033
fib6_clean_node+0x389/0x580 net/ipv6/ip6_fib.c:1919
fib6_walk_continue+0x46c/0x8a0 net/ipv6/ip6_fib.c:1845
fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1893
fib6_clean_tree+0x1e6/0x340 net/ipv6/ip6_fib.c:1970
__fib6_clean_all+0x1f4/0x3a0 net/ipv6/ip6_fib.c:1986
fib6_clean_all net/ipv6/ip6_fib.c:1997 [inline]
fib6_run_gc+0x16b/0x3c0 net/ipv6/ip6_fib.c:2053
ndisc_netdev_event+0x3c2/0x4a0 net/ipv6/ndisc.c:1781
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x262/0x430 net/core/dev.c:6960
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080
inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919
sock_do_ioctl+0xef/0x390 net/socket.c:957
sock_ioctl+0x36b/0x610 net/socket.c:1081
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7-> #2 (rt6_exception_lock){+.-.}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:315 [inline]
rt6_flush_exceptions+0x21/0x210 net/ipv6/route.c:1367
fib6_del_route net/ipv6/ip6_fib.c:1677 [inline]
fib6_del+0x624/0x12c0 net/ipv6/ip6_fib.c:1761
__ip6_del_rt+0xc7/0x120 net/ipv6/route.c:2980
ip6_del_rt+0x132/0x1a0 net/ipv6/route.c:2993
__ipv6_dev_ac_dec+0x3b1/0x600 net/ipv6/anycast.c:332
ipv6_dev_ac_dec net/ipv6/anycast.c:345 [inline]
ipv6_sock_ac_close+0x2b4/0x3e0 net/ipv6/anycast.c:200
inet6_release+0x48/0x70 net/ipv6/af_inet6.c:433
sock_release+0x8d/0x1e0 net/socket.c:594
sock_close+0x16/0x20 net/socket.c:1149
__fput+0x327/0x7e0 fs/file_table.c:209
____fput+0x15/0x20 fs/file_table.c:243
task_work_run+0x199/0x270 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x9bb/0x1ad0 kernel/exit.c:865
do_group_exit+0x149/0x400 kernel/exit.c:968
get_signal+0x73a/0x16d0 kernel/signal.c:2469
do_signal+0x90/0x1e90 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0x258/0x2f0 arch/x86/entry/common.c:162
prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline]
syscall_return_slowpath arch/x86/entry/common.c:265 [inline]
do_syscall_64+0x6ec/0x940 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x42/0xb7-> #1 (&(&tb->tb6_lock)->rlock){+.-.}:
__raw_spin_lock_bh include/linux/spinlock_api_smp.h:135 [inline]
_raw_spin_lock_bh+0x31/0x40 kernel/locking/spinlock.c:168
spin_lock_bh include/linux/spinlock.h:315 [inline]
__ip6_ins_rt+0x56/0x90 net/ipv6/route.c:1007
ip6_route_add+0x141/0x190 net/ipv6/route.c:2955
addrconf_prefix_route+0x44f/0x620 net/ipv6/addrconf.c:2359
fixup_permanent_addr net/ipv6/addrconf.c:3368 [inline]
addrconf_permanent_addr net/ipv6/addrconf.c:3391 [inline]
addrconf_notify+0x1ad2/0x2310 net/ipv6/addrconf.c:3460
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x15d/0x430 net/core/dev.c:6958
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
do_setlink+0xa22/0x3bb0 net/core/rtnetlink.c:2357
rtnl_newlink+0xf37/0x1a50 net/core/rtnetlink.c:2965
rtnetlink_rcv_msg+0x57f/0xb10 net/core/rtnetlink.c:4641
netlink_rcv_skb+0x14b/0x380 net/netlink/af_netlink.c:2444
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4659
netlink_unicast_kernel net/netlink/af_netlink.c:1308 [inline]
netlink_unicast+0x4c4/0x6b0 net/netlink/af_netlink.c:1334
netlink_sendmsg+0xa4a/0xe60 net/netlink/af_netlink.c:1897
sock_sendmsg_nosec net/socket.c:629 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:639
___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
__sys_sendmsg+0xe5/0x210 net/socket.c:2081
SYSC_sendmsg net/socket.c:2092 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2088
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7-> #0 (&ndev->lock){++--}:
lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920
__raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline]
_raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312
__ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928
ipv6_dev_mc_dec+0x110/0x1f0 net/ipv6/mcast.c:961
pndisc_destructor+0x21a/0x340 net/ipv6/ndisc.c:392
pneigh_ifdown net/core/neighbour.c:695 [inline]
neigh_ifdown+0x149/0x250 net/core/neighbour.c:294
rt6_disable_ip+0x537/0x700 net/ipv6/route.c:3874
addrconf_ifdown+0x14b/0x14f0 net/ipv6/addrconf.c:3633
addrconf_notify+0x5f8/0x2310 net/ipv6/addrconf.c:3557
notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93
__raw_notifier_call_chain kernel/notifier.c:394 [inline]
raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401
call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707
call_netdevice_notifiers net/core/dev.c:1725 [inline]
__dev_notify_flags+0x262/0x430 net/core/dev.c:6960
dev_change_flags+0xf5/0x140 net/core/dev.c:6994
devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080
inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919
packet_ioctl+0x1ff/0x310 net/packet/af_packet.c:4066
sock_do_ioctl+0xef/0x390 net/socket.c:957
sock_ioctl+0x36b/0x610 net/socket.c:1081
vfs_ioctl fs/ioctl.c:46 [inline]
do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686
SYSC_ioctl fs/ioctl.c:701 [inline]
SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692
do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
entry_SYSCALL_64_after_hwframe+0x42/0xb7other info that might help us debug this:
Chain exists of: &ndev->lock --> rt6_exception_lock --> &tbl->lock Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&tbl->lock);
lock(rt6_exception_lock);
lock(&tbl->lock); lock(&ndev->lock);
*** DEADLOCK ***
2 locks held by syz-executor7/4015:
#0: (rtnl_mutex){+.+.}, at: [<00000000a2f16daa>] rtnl_lock+0x17/0x20 net/core/rtnetlink.c:74 #1: (&tbl->lock){++-.}, at: [<00000000b5cb1d65>] neigh_ifdown+0x3d/0x250 net/core/neighbour.c:292
stack backtrace: CPU: 0 PID: 4015 Comm: syz-executor7 Not tainted 4.16.0-rc4+ #277 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_circular_bug.isra.38+0x2cd/0x2dc kernel/locking/lockdep.c:1223 check_prev_add kernel/locking/lockdep.c:1863 [inline] check_prevs_add kernel/locking/lockdep.c:1976 [inline] validate_chain kernel/locking/lockdep.c:2417 [inline] __lock_acquire+0x30a8/0x3e00 kernel/locking/lockdep.c:3431 lock_acquire+0x1d5/0x580 kernel/locking/lockdep.c:3920 __raw_write_lock_bh include/linux/rwlock_api_smp.h:203 [inline] _raw_write_lock_bh+0x31/0x40 kernel/locking/spinlock.c:312 __ipv6_dev_mc_dec+0x45/0x350 net/ipv6/mcast.c:928 ipv6_dev_mc_dec+0x110/0x1f0 net/ipv6/mcast.c:961 pndisc_destructor+0x21a/0x340 net/ipv6/ndisc.c:392 pneigh_ifdown net/core/neighbour.c:695 [inline] neigh_ifdown+0x149/0x250 net/core/neighbour.c:294 rt6_disable_ip+0x537/0x700 net/ipv6/route.c:3874 addrconf_ifdown+0x14b/0x14f0 net/ipv6/addrconf.c:3633 addrconf_notify+0x5f8/0x2310 net/ipv6/addrconf.c:3557 notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1707 call_netdevice_notifiers net/core/dev.c:1725 [inline] __dev_notify_flags+0x262/0x430 net/core/dev.c:6960 dev_change_flags+0xf5/0x140 net/core/dev.c:6994 devinet_ioctl+0x126a/0x1ac0 net/ipv4/devinet.c:1080 inet_ioctl+0x184/0x310 net/ipv4/af_inet.c:919 packet_ioctl+0x1ff/0x310 net/packet/af_packet.c:4066 sock_do_ioctl+0xef/0x390 net/socket.c:957 sock_ioctl+0x36b/0x610 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7
--- net/ipv6/route.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/ipv6/route.c +7 -6
@@ -1627,11 +1627,10 @@ static void rt6_age_examine_exception(ststruct neighbour *neigh;__u8 neigh_flags =0 ; - neigh =dst_neigh_lookup (&rt->dst, &rt->rt6i_gateway); -if (neigh) { + neigh =__ipv6_neigh_lookup_noref (rt->dst.dev, &rt->rt6i_gateway); +if (neigh) neigh_flags = neigh->flags; -neigh_release (neigh); - } +if (!(neigh_flags &NTF_ROUTER )) {RT6_TRACE ("purging route %p via non-router but gateway\n" , rt);
@@ -1655,7 +1654,8 @@ void rt6_age_exceptions(struct rt6_infoif (!rcu_access_pointer (rt->rt6i_exception_bucket))return ; -spin_lock_bh (&rt6_exception_lock); +rcu_read_lock_bh (); +spin_lock (&rt6_exception_lock); bucket =rcu_dereference_protected (rt->rt6i_exception_bucket,lockdep_is_held (&rt6_exception_lock));
@@ -1669,7 +1669,8 @@ void rt6_age_exceptions(struct rt6_info bucket++; } } -spin_unlock_bh (&rt6_exception_lock); +spin_unlock (&rt6_exception_lock); +rcu_read_unlock_bh (); } struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
Greg Kroah-Hartman
maintainerPATCH 29/72 net: xfrm: use preempt-safe this_cpu_read() in ipcomp_alloc_tfms()
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Hackmann <[email protected]>
commit 0dcd7876029b58770f769cbb7b484e88e4a305e5 upstream.
f7c83bcbfaf5 ("net: xfrm: use __this_cpu_read per-cpu helper") added a __this_cpu_read() call inside ipcomp_alloc_tfms().
At the time, __this_cpu_read() required the caller to either not care about races or to handle preemption/interrupt issues. 3.15 tightened the rules around some per-cpu operations, and now __this_cpu_read() should never be used in a preemptible context. On 3.15 and later, we need to use this_cpu_read() instead.
syzkaller reported this leading to the following kernel BUG while fuzzing sendmsg:
BUG: using __this_cpu_read() in preemptible [00000000] code: repro/3101 caller is ipcomp_init_state+0x185/0x990 CPU: 3 PID: 3101 Comm: repro Not tainted 4.16.0-rc4-00123-g86f84779d8e9 #154 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Call Trace: dump_stack+0xb9/0x115 check_preemption_disabled+0x1cb/0x1f0 ipcomp_init_state+0x185/0x990 ? __xfrm_init_state+0x876/0xc20 ? lock_downgrade+0x5e0/0x5e0 ipcomp4_init_state+0xaa/0x7c0 __xfrm_init_state+0x3eb/0xc20 xfrm_init_state+0x19/0x60 pfkey_add+0x20df/0x36f0 ? pfkey_broadcast+0x3dd/0x600 ? pfkey_sock_destruct+0x340/0x340 ? pfkey_seq_stop+0x80/0x80 ? __skb_clone+0x236/0x750 ? kmem_cache_alloc+0x1f6/0x260 ? pfkey_sock_destruct+0x340/0x340 ? pfkey_process+0x62a/0x6f0 pfkey_process+0x62a/0x6f0 ? pfkey_send_new_mapping+0x11c0/0x11c0 ? mutex_lock_io_nested+0x1390/0x1390 pfkey_sendmsg+0x383/0x750 ? dump_sp+0x430/0x430 sock_sendmsg+0xc0/0x100 ___sys_sendmsg+0x6c8/0x8b0 ? copy_msghdr_from_user+0x3b0/0x3b0 ? pagevec_lru_move_fn+0x144/0x1f0 ? find_held_lock+0x32/0x1c0 ? do_huge_pmd_anonymous_page+0xc43/0x11e0 ? lock_downgrade+0x5e0/0x5e0 ? get_kernel_page+0xb0/0xb0 ? _raw_spin_unlock+0x29/0x40 ? do_huge_pmd_anonymous_page+0x400/0x11e0 ? __handle_mm_fault+0x553/0x2460 ? __fget_light+0x163/0x1f0 ? __sys_sendmsg+0xc7/0x170 __sys_sendmsg+0xc7/0x170 ? SyS_shutdown+0x1a0/0x1a0 ? __do_page_fault+0x5a0/0xca0 ? lock_downgrade+0x5e0/0x5e0 SyS_sendmsg+0x27/0x40 ? __sys_sendmsg+0x170/0x170 do_syscall_64+0x19f/0x640 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x7f0ee73dfb79 RSP: 002b:00007ffe14fc15a8 EFLAGS: 00000207 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ee73dfb79 RDX: 0000000000000000 RSI: 00000000208befc8 RDI: 0000000000000004 RBP: 00007ffe14fc15b0 R08: 00007ffe14fc15c0 R09: 00007ffe14fc15c0 R10: 0000000000000000 R11: 0000000000000207 R12: 0000000000400440 R13: 00007ffe14fc16b0 R14: 0000000000000000 R15: 0000000000000000
--- net/xfrm/xfrm_ipcomp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_ipcomp.c +1 -1
@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipstruct crypto_comp *tfm;/* This can be any valid CPU ID so we don't need locking. */ - tfm =__this_cpu_read (*pos->tfms); + tfm =this_cpu_read (*pos->tfms);if (!strcmp (crypto_comp_name (tfm), alg_name)) { pos->users++;
Greg Kroah-Hartman
maintainerPATCH 30/72 xfrm: Refuse to insert 32 bit userspace socket policies on 64 bit systems
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <[email protected]>
commit 19d7df69fdb2636856dc8919de72fc1bf8f79598 upstream.
We don't have a compat layer for xfrm, so userspace and kernel structures have different sizes in this case. This results in a broken configuration, so refuse to configure socket policies when trying to insert from 32 bit userspace as we do it already with policies inserted via netlink.
--- net/xfrm/xfrm_state.c | 5 +++++ 1 file changed, 5 insertions(+)
net/xfrm/xfrm_state.c +5 -0
@@ -2056,6 +2056,11 @@ int xfrm_user_policy(struct sock *sk, instruct xfrm_mgr *km;struct xfrm_policy *pol =NULL ; +#ifdef CONFIG_COMPAT +if (in_compat_syscall ()) +return -EOPNOTSUPP ; +#endif +if (!optval && !optlen) {xfrm_sk_policy_insert (sk,XFRM_POLICY_IN ,NULL );xfrm_sk_policy_insert (sk,XFRM_POLICY_OUT ,NULL );
Greg Kroah-Hartman
maintainerPATCH 31/72 percpu: add __GFP_NORETRY semantics to the percpu balancing path
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Zhou <[email protected]>
commit 47504ee04b9241548ae2c28be7d0b01cff3b7aa6 upstream.
Percpu memory using the vmalloc area based chunk allocator lazily populates chunks by first requesting the full virtual address space required for the chunk and subsequently adding pages as allocations come through. To ensure atomic allocations can succeed, a workqueue item is used to maintain a minimum number of empty pages. In certain scenarios, such as reported in [1], it is possible that physical memory becomes quite scarce which can result in either a rather long time spent trying to find free pages or worse, a kernel panic.
This patch adds support for __GFP_NORETRY and __GFP_NOWARN passing them through to the underlying allocators. This should prevent any unnecessary panics potentially caused by the workqueue item. The passing of gfp around is as additional flags rather than a full set of flags. The next patch will change these to caller passed semantics.
V2:
Added const modifier to gfp flags in the balance path. Removed an extra whitespace.
[1] https://lkml.org/lkml/2018/2/12/551
--- mm/percpu-km.c | 8 ++++---- mm/percpu-vm.c | 18 +++++++++++------- mm/percpu.c | 45 ++++++++++++++++++++++++++++----------------- 3 files changed, 43 insertions(+), 28 deletions(-)
mm/percpu-km.c +4 -4
@@ -34,7 +34,7 @@#include <linux/log2.h> static int pcpu_populate_chunk (struct pcpu_chunk *chunk, -int page_start,int page_end) +int page_start,int page_end,gfp_t gfp) {return 0 ; }
@@ -45,18 +45,18 @@ static void pcpu_depopulate_chunk(struct/* nada */ } -static struct pcpu_chunk *pcpu_create_chunk (void ) +static struct pcpu_chunk *pcpu_create_chunk (gfp_t gfp) {const int nr_pages = pcpu_group_sizes[0 ] >>PAGE_SHIFT ;struct pcpu_chunk *chunk;struct page *pages;int i; - chunk =pcpu_alloc_chunk (); + chunk =pcpu_alloc_chunk (gfp);if (!chunk)return NULL ; - pages =alloc_pages (GFP_KERNEL ,order_base_2 (nr_pages)); + pages =alloc_pages (gfp |GFP_KERNEL ,order_base_2 (nr_pages));if (!pages) {pcpu_free_chunk (chunk);return NULL ;
mm/percpu-vm.c +11 -7
@@ -37,7 +37,7 @@ static struct page **pcpu_get_pages(voidlockdep_assert_held (&pcpu_alloc_mutex);if (!pages) - pages =pcpu_mem_zalloc (pages_size); + pages =pcpu_mem_zalloc (pages_size,0 );return pages; }
@@ -73,18 +73,21 @@ static void pcpu_free_pages(struct pcpu_* @pages: array to put the allocated pages into, indexed by pcpu_page_idx() * @page_start: page index of the first page to be allocated * @page_end: page index of the last page to be allocated + 1 +* @gfp: allocation flags passed to the underlying allocator * * Allocate pages [@page_start,@page_end) into @pages for all units. * The allocation is for @chunk. Percpu core doesn't care about the * content of @pages and will pass it verbatim to pcpu_map_pages(). */ static int pcpu_alloc_pages (struct pcpu_chunk *chunk, -struct page **pages,int page_start,int page_end) +struct page **pages,int page_start,int page_end, +gfp_t gfp) { -const gfp_t gfp =GFP_KERNEL | __GFP_HIGHMEM;unsigned int cpu, tcpu;int i; + gfp |=GFP_KERNEL | __GFP_HIGHMEM; +for_each_possible_cpu (cpu) {for (i = page_start; i < page_end; i++) {struct page **pagep = &pages[pcpu_page_idx (cpu, i)];
@@ -262,6 +265,7 @@ static void pcpu_post_map_flush(struct p* @chunk: chunk of interest * @page_start: the start page * @page_end: the end page +* @gfp: allocation flags passed to the underlying memory allocator * * For each cpu, populate and map pages [@page_start,@page_end) into * @chunk.
@@ -270,7 +274,7 @@ static void pcpu_post_map_flush(struct p* pcpu_alloc_mutex, does GFP_KERNEL allocation. */ static int pcpu_populate_chunk (struct pcpu_chunk *chunk, -int page_start,int page_end) +int page_start,int page_end,gfp_t gfp) {struct page **pages;
@@ -278,7 +282,7 @@ static int pcpu_populate_chunk(struct pcif (!pages)return -ENOMEM ; -if (pcpu_alloc_pages (chunk, pages, page_start, page_end)) +if (pcpu_alloc_pages (chunk, pages, page_start, page_end, gfp))return -ENOMEM ;if (pcpu_map_pages (chunk, pages, page_start, page_end)) {
@@ -325,12 +329,12 @@ static void pcpu_depopulate_chunk(structpcpu_free_pages (chunk, pages, page_start, page_end); } -static struct pcpu_chunk *pcpu_create_chunk (void ) +static struct pcpu_chunk *pcpu_create_chunk (gfp_t gfp) {struct pcpu_chunk *chunk;struct vm_struct **vms; - chunk =pcpu_alloc_chunk (); + chunk =pcpu_alloc_chunk (gfp);if (!chunk)return NULL ;
mm/percpu.c +28 -17
129 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 32/72 netfilter: x_tables: make allocation less aggressive
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit 0537250fdc6c876ed4cbbe874c739aebef493ee2 upstream.
syzbot has noticed that xt_alloc_table_info can allocate a lot of memory. This is an admin only interface but an admin in a namespace is sufficient as well. eacd86ca3b03 ("net/netfilter/x_tables.c: use kvmalloc() in xt_alloc_table_info()") has changed the opencoded kmalloc->vmalloc fallback into kvmalloc. It has dropped __GFP_NORETRY on the way because vmalloc has simply never fully supported __GFP_NORETRY semantic. This is still the case because e.g. page tables backing the vmalloc area are hardcoded GFP_KERNEL.
Revert back to __GFP_NORETRY as a poors man defence against excessively large allocation request here. We will not rule out the OOM killer completely but __GFP_NORETRY should at least stop the large request in most cases.
--- net/netfilter/x_tables.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/x_tables.c +6 -1
@@ -1008,7 +1008,12 @@ struct xt_table_info *xt_alloc_table_infif ((size >>PAGE_SHIFT ) +2 > totalram_pages)return NULL ; - info =kvmalloc (sz,GFP_KERNEL ); +/* __GFP_NORETRY is not fully supported by kvmalloc but it should +* work reasonably well if sz is too large and bail out rather +* than shoot all processes down before realizing there is nothing +* more to reclaim. +*/ + info =kvmalloc (sz,GFP_KERNEL | __GFP_NORETRY);if (!info)return NULL ;
Greg Kroah-Hartman
maintainerPATCH 33/72 netfilter: bridge: ebt_among: add more missing match size checks
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit c8d70a700a5b486bfa8e5a7d33d805389f6e59f9 upstream.
ebt_among is special, it has a dynamic match size and is exempt from the central size checks.
commit c4585a2823edf ("bridge: ebt_among: add missing match size checks") added validation for pool size, but missed fact that the macros ebt_among_wh_src/dst can already return out-of-bound result because they do not check value of wh_src/dst_ofs (an offset) vs. the size of the match that userspace gave to us.
v2:
check that offset has correct alignment.
Paolo Abeni points out that we should also check that src/dst wormhash arrays do not overlap, and src + length lines up with start of dst (or vice versa).
v3: compact wormhash_sizes_valid() part
NB: Fixes tag is intentionally wrong, this bug exists from day one when match was added for 2.6 kernel. Tag is there so stable maintainers will notice this one too.
Tested with same rules from the earlier patch.
--- net/bridge/netfilter/ebt_among.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
net/bridge/netfilter/ebt_among.c +34 -0
@@ -177,6 +177,28 @@ static bool poolsize_invalid(const strucreturn w && w->poolsize >= (INT_MAX /sizeof (struct ebt_mac_wormhash_tuple )); } +static bool wormhash_offset_invalid (int off,unsigned int len) +{ +if (off ==0 )/* not present */ +return false; + +if (off < (int )sizeof (struct ebt_among_info ) || + off % __alignof__(struct ebt_mac_wormhash )) +return true; + + off +=sizeof (struct ebt_mac_wormhash ); + +return off > len; +} + +static bool wormhash_sizes_valid (const struct ebt_mac_wormhash *wh,int a,int b) +{ +if (a ==0 ) + a =sizeof (struct ebt_among_info ); + +return ebt_mac_wormhash_size (wh) + a == b; +} +static int ebt_among_mt_check (const struct xt_mtchk_param *par) {const struct ebt_among_info *info = par->matchinfo;
@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struif (expected_length > em->match_size)return -EINVAL ; +if (wormhash_offset_invalid (info->wh_dst_ofs, em->match_size) || +wormhash_offset_invalid (info->wh_src_ofs, em->match_size)) +return -EINVAL ; + wh_dst =ebt_among_wh_dst (info);if (poolsize_invalid (wh_dst))return -EINVAL ;
@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struif (poolsize_invalid (wh_src))return -EINVAL ; +if (info->wh_src_ofs < info->wh_dst_ofs) { +if (!wormhash_sizes_valid (wh_src, info->wh_src_ofs, info->wh_dst_ofs)) +return -EINVAL ; + }else { +if (!wormhash_sizes_valid (wh_dst, info->wh_dst_ofs, info->wh_src_ofs)) +return -EINVAL ; + } + expected_length +=ebt_mac_wormhash_size (wh_src);if (em->match_size !=EBT_ALIGN (expected_length)) {
Greg Kroah-Hartman
maintainerPATCH 34/72 l2tp: fix races with ipv4-mapped ipv6 addresses
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit b954f94023dcc61388c8384f0f14eb8e42c863c5 upstream.
The l2tp_tunnel_create() function checks for v4mapped ipv6 sockets and cache that flag, so that l2tp core code can reusing it at xmit time.
If the socket is provided by the userspace, the connection status of the tunnel sockets can change between the tunnel creation and the xmit call, so that syzbot is able to trigger the following splat:
BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:192 [inline] BUG: KASAN: use-after-free in ip6_xmit+0x1f76/0x2260 net/ipv6/ip6_output.c:264 Read of size 8 at addr ffff8801bd949318 by task syz-executor4/23448 CPU: 0 PID: 23448 Comm: syz-executor4 Not tainted 4.16.0-rc4+ #65 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x23c/0x360 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 ip6_dst_idev include/net/ip6_fib.h:192 [inline] ip6_xmit+0x1f76/0x2260 net/ipv6/ip6_output.c:264 inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139 l2tp_xmit_core net/l2tp/l2tp_core.c:1053 [inline] l2tp_xmit_skb+0x105f/0x1410 net/l2tp/l2tp_core.c:1148 pppol2tp_sendmsg+0x470/0x670 net/l2tp/l2tp_ppp.c:341 sock_sendmsg_nosec net/socket.c:630 [inline] sock_sendmsg+0xca/0x110 net/socket.c:640 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2046 __sys_sendmsg+0xe5/0x210 net/socket.c:2080 SYSC_sendmsg net/socket.c:2091 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2087 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x453e69 RSP: 002b:00007f819593cc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f819593d6d4 RCX: 0000000000453e69 RDX: 0000000000000081 RSI: 000000002037ffc8 RDI: 0000000000000004 RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000004c3 R14: 00000000006f72e8 R15: 0000000000000000
This change addresses the issues:
* explicitly checking for TCP_ESTABLISHED for user space provided sockets
* dropping the v4mapped flag usage - it can become outdated - and explicitly invoking ipv6_addr_v4mapped() instead
The issue is apparently there since ancient times.
v1 -> v2: (many thanks to Guillaume)
- with csum issue introduced in v1
- replace pr_err with pr_debug
- fix build issue with IPV6 disabled
- move l2tp_sk_is_v4mapped in l2tp_core.c
v2 -> v3:
- don't update inet_daddr for v4mapped address, unneeded
- drop rendundant check at creation time
--- net/l2tp/l2tp_core.c | 38 ++++++++++++++++++-------------------- net/l2tp/l2tp_core.h | 3 --- 2 files changed, 18 insertions(+), 23 deletions(-)
net/l2tp/l2tp_core.c +18 -20
@@ -111,6 +111,13 @@ struct l2tp_net {spinlock_t l2tp_session_hlist_lock; }; +#if IS_ENABLED (CONFIG_IPV6 ) +static bool l2tp_sk_is_v6 (struct sock *sk) +{ +return sk->sk_family ==PF_INET6 && + !ipv6_addr_v4mapped (&sk->sk_v6_daddr); +} +#endif static inline struct l2tp_tunnel *l2tp_tunnel (struct sock *sk) {
@@ -1058,7 +1065,7 @@ static int l2tp_xmit_core(struct l2tp_se/* Queue the packet to IP for output */ skb->ignore_df =1 ;#if IS_ENABLED (CONFIG_IPV6 ) -if (tunnel->sock->sk_family ==PF_INET6 && !tunnel->v4mapped) +if (l2tp_sk_is_v6 (tunnel->sock)) error =inet6_csk_xmit (tunnel->sock, skb,NULL ); else#endif
@@ -1121,6 +1128,15 @@ int l2tp_xmit_skb(struct l2tp_session *s goto out_unlock; } +/* The user-space may change the connection status for the user-space +* provided socket at run time: we must check it under the socket lock +*/ +if (tunnel->fd >=0 && sk->sk_state !=TCP_ESTABLISHED ) { +kfree_skb (skb); + ret =NET_XMIT_DROP ; + goto out_unlock; + } +/* Get routing info from the tunnel socket */ skb_dst_drop (skb);skb_dst_set (skb,dst_clone (__sk_dst_check (sk,0 )));
@@ -1140,7 +1156,7 @@ int l2tp_xmit_skb(struct l2tp_session *s/* Calculate UDP checksum if configured to do so */ #if IS_ENABLED (CONFIG_IPV6 ) -if (sk->sk_family ==PF_INET6 && !tunnel->v4mapped) +if (l2tp_sk_is_v6 (sk))udp6_set_csum (udp_get_no_check6_tx (sk), skb, &inet6_sk (sk)->saddr, &sk->sk_v6_daddr, udp_len);
@@ -1520,24 +1536,6 @@ int l2tp_tunnel_create(struct net *net,if (cfg !=NULL ) tunnel->debug = cfg->debug; -#if IS_ENABLED (CONFIG_IPV6 ) -if (sk->sk_family ==PF_INET6 ) { -struct ipv6_pinfo *np =inet6_sk (sk); - -if (ipv6_addr_v4mapped (&np->saddr) && -ipv6_addr_v4mapped (&sk->sk_v6_daddr)) { -struct inet_sock *inet =inet_sk (sk); - - tunnel->v4mapped = true; - inet->inet_saddr = np->saddr.s6_addr32[3 ]; - inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3 ]; - inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3 ]; - }else { - tunnel->v4mapped = false; - } - } -#endif -/* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ tunnel->encap = encap;if (encap ==L2TP_ENCAPTYPE_UDP ) {
net/l2tp/l2tp_core.h +0 -3
@@ -193,9 +193,6 @@ struct l2tp_tunnel {struct sock *sock;/* Parent socket */ int fd;/* Parent fd, if tunnel socket * was created by userspace */ -#if IS_ENABLED (CONFIG_IPV6 ) -bool v4mapped; -#endif struct work_struct del_work;
Greg Kroah-Hartman
maintainerPATCH 35/72 netfilter: drop template ct when conntrack is skipped.
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <[email protected]>
commit aebfa52a925d701114afd6af0def35bab16d4f47 upstream.
The ipv4 nf_ct code currently skips the nf_conntrak_in() call for fragmented packets. As a results later matches/target can end up manipulating template ct entry instead of 'real' ones.
Exploiting the above, syzbot found a way to trigger the following splat:
WARNING: CPU: 1 PID: 4242 at net/netfilter/xt_cluster.c:55 xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127 Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 4242 Comm: syzkaller027971 Not tainted 4.16.0-rc2+ #243 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 panic+0x1e4/0x41c kernel/panic.c:183 __warn+0x1dc/0x200 kernel/panic.c:547 report_bug+0x211/0x2d0 lib/bug.c:184 fixup_bug.part.11+0x37/0x80 arch/x86/kernel/traps.c:178 fixup_bug arch/x86/kernel/traps.c:247 [inline] do_error_trap+0x2d7/0x3e0 arch/x86/kernel/traps.c:296 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:315 invalid_op+0x58/0x80 arch/x86/entry/entry_64.S:957 RIP: 0010:xt_cluster_hash net/netfilter/xt_cluster.c:55 [inline] RIP: 0010:xt_cluster_mt+0x6c1/0x840 net/netfilter/xt_cluster.c:127 RSP: 0018:ffff8801d2f6f2d0 EFLAGS: 00010293 RAX: ffff8801af700540 RBX: 0000000000000000 RCX: ffffffff84a2d1e1 RDX: 0000000000000000 RSI: ffff8801d2f6f478 RDI: ffff8801cafd336a RBP: ffff8801d2f6f2e8 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801b03b3d18 R13: ffff8801cafd3300 R14: dffffc0000000000 R15: ffff8801d2f6f478 ipt_do_table+0xa91/0x19b0 net/ipv4/netfilter/ip_tables.c:296 iptable_filter_hook+0x65/0x80 net/ipv4/netfilter/iptable_filter.c:41 nf_hook_entry_hookfn include/linux/netfilter.h:120 [inline] nf_hook_slow+0xba/0x1a0 net/netfilter/core.c:483 nf_hook include/linux/netfilter.h:243 [inline] NF_HOOK include/linux/netfilter.h:286 [inline] raw_send_hdrinc.isra.17+0xf39/0x1880 net/ipv4/raw.c:432 raw_sendmsg+0x14cd/0x26b0 net/ipv4/raw.c:669 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xca/0x110 net/socket.c:639 SYSC_sendto+0x361/0x5c0 net/socket.c:1748 SyS_sendto+0x40/0x50 net/socket.c:1716 do_syscall_64+0x280/0x940 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x441b49 RSP: 002b:00007ffff5ca8b18 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000441b49 RDX: 0000000000000030 RSI: 0000000020ff7000 RDI: 0000000000000003 RBP: 00000000006cc018 R08: 000000002066354c R09: 0000000000000010 R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000403470 R13: 0000000000403500 R14: 0000000000000000 R15: 0000000000000000
Dumping ftrace buffer:
(ftrace buffer empty)
Kernel Offset: disabled
Rebooting in 86400 seconds..
Instead of adding checks for template ct on every target/match manipulating skb->_nfct, simply drop the template ct when skipping nf_conntrack_in().
--- net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +13 -1
@@ -159,8 +159,20 @@ static unsigned int ipv4_conntrack_local ip_hdrlen(skb) < sizeof(struct iphdr))return NF_ACCEPT ; -if (ip_is_fragment (ip_hdr (skb)))/* IP_NODEFRAG setsockopt set */ +if (ip_is_fragment (ip_hdr (skb))) {/* IP_NODEFRAG setsockopt set */ +enum ip_conntrack_info ctinfo; +struct nf_conn *tmpl; + + tmpl =nf_ct_get (skb, &ctinfo); +if (tmpl &&nf_ct_is_template (tmpl)) { +/* when skipping ct, clear templates to avoid fooling +* later targets/matches +*/ + skb->_nfct =0 ; +nf_ct_put (tmpl); + }return NF_ACCEPT ; + }return nf_conntrack_in (state->net,PF_INET , state->hook, skb); }
Greg Kroah-Hartman
maintainerPATCH 36/72 netfilter: x_tables: add and use xt_check_proc_name
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit b1d0a5d0cba4597c0394997b2d5fced3e3841b4e upstream.
recent and hashlimit both create /proc files, but only check that name is 0 terminated.
This can trigger WARN() from procfs when name is "" or "/". Add helper for this and then use it for both.
--- include/linux/netfilter/x_tables.h | 2 ++ net/netfilter/x_tables.c | 30 ++++++++++++++++++++++++++++++ net/netfilter/xt_hashlimit.c | 16 ++++++++++------ net/netfilter/xt_recent.c | 6 +++--- 4 files changed, 45 insertions(+), 9 deletions(-)
include/linux/netfilter/x_tables.h +2 -0
@@ -285,6 +285,8 @@ unsigned int *xt_alloc_entry_offsets(unsbool xt_find_jump_offset (const unsigned int *offsets,unsigned int target,unsigned int size); +int xt_check_proc_name (const char *name,unsigned int size); +int xt_check_match (struct xt_mtchk_param *,unsigned int size,u_int8_t proto,bool inv_proto); int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto,
net/netfilter/x_tables.c +30 -0
@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unreturn buf; } +/** +* xt_check_proc_name - check that name is suitable for /proc file creation +* +* @name: file name candidate +* @size: length of buffer +* +* some x_tables modules wish to create a file in /proc. +* This function makes sure that the name is suitable for this +* purpose, it checks that name is NUL terminated and isn't a 'special' +* name, like "..". +* +* returns negative number on error or 0 if name is useable. +*/ +int xt_check_proc_name (const char *name,unsigned int size) +{ +if (name[0 ] =='\0' ) +return -EINVAL ; + +if (strnlen (name, size) == size) +return -ENAMETOOLONG ; + +if (strcmp (name,"." ) ==0 || +strcmp (name,".." ) ==0 || +strchr (name,'/' )) +return -EINVAL ; + +return 0 ; +} +EXPORT_SYMBOL (xt_check_proc_name); +int xt_check_match (struct xt_mtchk_param *par,unsigned int size,u_int8_t proto,bool inv_proto) {
net/netfilter/xt_hashlimit.c +10 -6
@@ -915,8 +915,9 @@ static int hashlimit_mt_check_v1(const sstruct hashlimit_cfg3 cfg = {};int ret; -if (info->name[sizeof (info->name) -1 ] !='\0' ) -return -EINVAL ; + ret =xt_check_proc_name (info->name,sizeof (info->name)); +if (ret) +return ret; ret =cfg_copy (&cfg, (void *)&info->cfg,1 );
@@ -933,8 +934,9 @@ static int hashlimit_mt_check_v2(const sstruct hashlimit_cfg3 cfg = {};int ret; -if (info->name[sizeof (info->name) -1 ] !='\0' ) -return -EINVAL ; + ret =xt_check_proc_name (info->name,sizeof (info->name)); +if (ret) +return ret; ret =cfg_copy (&cfg, (void *)&info->cfg,2 );
@@ -948,9 +950,11 @@ static int hashlimit_mt_check_v2(const sstatic int hashlimit_mt_check (const struct xt_mtchk_param *par) {struct xt_hashlimit_mtinfo3 *info = par->matchinfo; +int ret; -if (info->name[sizeof (info->name) -1 ] !='\0' ) -return -EINVAL ; + ret =xt_check_proc_name (info->name,sizeof (info->name)); +if (ret) +return ret;return hashlimit_mt_check_common (par, &info->hinfo, &info->cfg, info->name,3 );
net/netfilter/xt_recent.c +3 -3
@@ -361,9 +361,9 @@ static int recent_mt_check(const struct info->hit_count, XT_RECENT_MAX_NSTAMPS - 1);return -EINVAL ; } -if (info->name[0 ] =='\0' || -strnlen (info->name,XT_RECENT_NAME_LEN ) ==XT_RECENT_NAME_LEN ) -return -EINVAL ; + ret =xt_check_proc_name (info->name,sizeof (info->name)); +if (ret) +return ret;if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot) nstamp_mask =roundup_pow_of_two (ip_pkt_list_tot) -1 ;
Greg Kroah-Hartman
maintainerPATCH 37/72 phy: qcom-ufs: add MODULE_LICENSE tag
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 59fba0869acae06ff594dd7e9808ed673f53538a upstream.
While the specific UFS PHY drivers (14nm and 20nm) have a module license, the common base module does not, leading to a Kbuild failure:
WARNING: modpost: missing MODULE_LICENSE() in drivers/phy/qualcomm/phy-qcom-ufs.o
FATAL: modpost: GPL-incompatible module phy-qcom-ufs.ko uses GPL-only symbol 'clk_enable'
This adds a module description and license tag to fix the build. I added both Yaniv and Vivek as authors here, as Yaniv sent the initial submission, while Vivek did most of the work since.
--- drivers/phy/qualcomm/phy-qcom-ufs.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/phy/qualcomm/phy-qcom-ufs.c +5 -0
@@ -675,3 +675,8 @@ int ufs_qcom_phy_power_off(struct phy *greturn 0 ; }EXPORT_SYMBOL_GPL (ufs_qcom_phy_power_off); + +MODULE_AUTHOR ("Yaniv Gardi <[email protected]>" ); +MODULE_AUTHOR ("Vivek Gautam <[email protected]>" ); +MODULE_DESCRIPTION ("Universal Flash Storage (UFS) QCOM PHY" ); +MODULE_LICENSE ("GPL v2" );
Greg Kroah-Hartman
maintainerPATCH 38/72 Bluetooth: Fix missing encryption refresh on Security Request
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szymon Janc <[email protected]>
commit 64e759f58f128730b97a3c3a26d283c075ad7c86 upstream.
If Security Request is received on connection that is already encrypted with sufficient security master should perform encryption key refresh procedure instead of just ignoring Slave Security Request (Core Spec 5.0 Vol 3 Part H 2.4.6).
Quoted 1 line
ACL Data RX: Handle 3585 flags
0x02dlen 6
SMP: Security Request (0x0b) len 1
Authentication requirement: Bonding, No MITM, SC, No Keypresses (0x09)
< HCI Command: LE Start Encryption (0x08|0x0019) plen 28
Handle: 3585
Random number: 0x0000000000000000
Encrypted diversifier: 0x0000
Long term key: 44264272a5c426a9e868f034cf0e69f3Quoted 1 line
HCI Event: Command Status (
0x0f) plen 4
LE Start Encryption (0x08|0x0019) ncmd 1
Status: Success (0x00)Quoted 1 line
HCI Event: Encryption Key Refresh Complete (
0x30) plen 3
Status: Success (0x00)
Handle: 3585--- net/bluetooth/smp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
net/bluetooth/smp.c +7 -1
@@ -2296,8 +2296,14 @@ static u8 smp_cmd_security_req(struct l2else sec_level =authreq_to_seclevel (auth); -if (smp_sufficient_security (hcon, sec_level,SMP_USE_LTK )) +if (smp_sufficient_security (hcon, sec_level,SMP_USE_LTK )) { +/* If link is already encrypted with sufficient security we +* still need refresh encryption as per Core Spec 5.0 Vol 3, +* Part H 2.4.6 +*/ +smp_ltk_encrypt (conn, hcon->sec_level);return 0 ; + }if (sec_level > hcon->pending_sec_level) hcon->pending_sec_level = sec_level;
Greg Kroah-Hartman
maintainerPATCH 39/72 drm/i915/dp: Write to SET_POWER dpcd to enable MST hub.
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dhinakaran Pandiyan <[email protected]>
commit b1e314462bba76660eec62760bb2e87f28f58866 upstream.
If bios sets up an MST output and hardware state readout code sees this is an SST configuration, when disabling the encoder we end up calling ->post_disable_dp() hook instead of the MST version. Consequently, we write to the DP_SET_POWER dpcd to set it D3 state. Further along when we try enable the encoder in MST mode, POWER_UP_PHY transaction fails to power up the MST hub. This results in continuous link training failures which keep the system busy delaying boot. We could identify bios MST boot discrepancy and handle it accordingly but a simple way to solve this is to write to the DP_SET_POWER dpcd for MST too.
Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=105470
--- drivers/gpu/drm/i915/intel_ddi.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/gpu/drm/i915/intel_ddi.c +2 -10
@@ -2208,8 +2208,7 @@ static void intel_ddi_pre_enable_dp(struintel_prepare_dp_ddi_buffers (encoder);intel_ddi_init_dp_buf_reg (encoder); -if (!is_mst) -intel_dp_sink_dpms (intel_dp,DRM_MODE_DPMS_ON ); +intel_dp_sink_dpms (intel_dp,DRM_MODE_DPMS_ON );intel_dp_start_link_train (intel_dp);if (port !=PORT_A ||INTEL_GEN (dev_priv) >=9 )intel_dp_stop_link_train (intel_dp);
@@ -2294,19 +2293,12 @@ static void intel_ddi_post_disable_dp(ststruct drm_i915_private *dev_priv =to_i915 (encoder->base.dev);struct intel_digital_port *dig_port =enc_to_dig_port (&encoder->base);struct intel_dp *intel_dp = &dig_port->dp; -/* -* old_crtc_state and old_conn_state are NULL when called from -* DP_MST. The main connector associated with this port is never -* bound to a crtc for MST. -*/ -bool is_mst = !old_crtc_state;/* * Power down sink before disabling the port, otherwise we end * up getting interrupts from the sink on detecting link loss. */ -if (!is_mst) -intel_dp_sink_dpms (intel_dp,DRM_MODE_DPMS_OFF ); +intel_dp_sink_dpms (intel_dp,DRM_MODE_DPMS_OFF );intel_disable_ddi_buf (encoder);
Greg Kroah-Hartman
maintainerPATCH 40/72 bitmap: fix memset optimization on big-endian systems
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit 21035965f60b0502fc6537b232839389bb4ce664 upstream.
Commit 2a98dc028f91 ("include/linux/bitmap.h: turn bitmap_set and bitmap_clear into memset when possible") introduced an optimization to bitmap_{set,clear}() which uses memset() when the start and length are constants aligned to a byte.
This is wrong on big-endian systems; our bitmaps are arrays of unsigned long, so bit n is not at byte n / 8 in memory. This was caught by the Btrfs selftests, but the bitmap selftests also fail when run on a big-endian machine.
We can still use memset if the start and length are aligned to an unsigned long, so do that on big-endian. The same problem applies to the memcmp in bitmap_equal(), so fix it there, too.
--- include/linux/bitmap.h | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
include/linux/bitmap.h +17 -5
@@ -271,12 +271,20 @@ static inline void bitmap_complement(uns__bitmap_complement (dst, src, nbits); } +#ifdef __LITTLE_ENDIAN +#define BITMAP_MEM_ALIGNMENT 8 +#else +#define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long)) +#endif +#define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1) +static inline int bitmap_equal (const unsigned long *src1,const unsigned long *src2,unsigned int nbits) {if (small_const_nbits (nbits))return !((*src1 ^ *src2) &BITMAP_LAST_WORD_MASK (nbits)); -if (__builtin_constant_p (nbits &7 ) &&IS_ALIGNED (nbits,8 )) +if (__builtin_constant_p (nbits &BITMAP_MEM_MASK ) && +IS_ALIGNED (nbits,BITMAP_MEM_ALIGNMENT ))return !memcmp (src1, src2, nbits /8 );return __bitmap_equal (src1, src2, nbits); }
@@ -327,8 +335,10 @@ static __always_inline void bitmap_set(u {if (__builtin_constant_p (nbits) && nbits ==1 )__set_bit (start, map); -else if (__builtin_constant_p (start &7 ) &&IS_ALIGNED (start,8 ) && -__builtin_constant_p (nbits &7 ) &&IS_ALIGNED (nbits,8 )) +else if (__builtin_constant_p (start &BITMAP_MEM_MASK ) && +IS_ALIGNED (start,BITMAP_MEM_ALIGNMENT ) && +__builtin_constant_p (nbits &BITMAP_MEM_MASK ) && +IS_ALIGNED (nbits,BITMAP_MEM_ALIGNMENT ))memset ((char *)map + start /8 ,0xff , nbits /8 );else __bitmap_set (map, start, nbits);
@@ -339,8 +349,10 @@ static __always_inline void bitmap_clear {if (__builtin_constant_p (nbits) && nbits ==1 )__clear_bit (start, map); -else if (__builtin_constant_p (start &7 ) &&IS_ALIGNED (start,8 ) && -__builtin_constant_p (nbits &7 ) &&IS_ALIGNED (nbits,8 )) +else if (__builtin_constant_p (start &BITMAP_MEM_MASK ) && +IS_ALIGNED (start,BITMAP_MEM_ALIGNMENT ) && +__builtin_constant_p (nbits &BITMAP_MEM_MASK ) && +IS_ALIGNED (nbits,BITMAP_MEM_ALIGNMENT ))memset ((char *)map + start /8 ,0 , nbits /8 );else __bitmap_clear (map, start, nbits);
Greg Kroah-Hartman
maintainerPATCH 41/72 USB: serial: ftdi_sio: add RT Systems VX-8 cable
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Major Hayden <[email protected]>
commit 9608e5c0f079390473b484ef92334dfd3431bb89 upstream.
This patch adds a device ID for the RT Systems cable used to program Yaesu VX-8R/VX-8DR handheld radios. It uses the main FTDI VID instead of the common RT Systems VID.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 3 +++ 2 files changed, 4 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -769,6 +769,7 @@ static const struct usb_device_id id_tab .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, + { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) },
drivers/usb/serial/ftdi_sio_ids.h +3 -0
@@ -923,6 +923,9 @@/* * RT Systems programming cables for various ham radios */ +/* This device uses the VID of FTDI */ +#define RTSYSTEMS_USB_VX8_PID 0x9e50/* USB-VX8 USB to 7 pin modular plug for Yaesu VX-8 radio */ +#define RTSYSTEMS_VID 0x2100/* Vendor ID */ #define RTSYSTEMS_USB_S03_PID 0x9001/* RTS-03 USB to Serial Adapter */ #define RTSYSTEMS_USB_59_PID 0x9e50/* USB-59 USB to 8 pin plug */
Greg Kroah-Hartman
maintainerPATCH 42/72 USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clemens Werther <[email protected]>
commit 6555ad13a01952c16485c82a52ad1f3e07e34b3a upstream.
Add device id for Harman FirmwareHubEmulator to make the device auto-detectable by the driver.
--- drivers/usb/serial/ftdi_sio.c | 1 + drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 7 insertions(+)
drivers/usb/serial/ftdi_sio.c +1 -0
@@ -932,6 +932,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) }, { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) }, { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1445,6 +1445,12 @@#define FTDI_CINTERION_MC55I_PID 0xA951/* +* Product: FirmwareHubEmulator +* Manufacturer: Harman Becker Automotive Systems +*/ +#define FTDI_FHE_PID 0xA9A0 + +/* * Product: Comet Caller ID decoder * Manufacturer: Crucible Technologies */
Greg Kroah-Hartman
maintainerPATCH 43/72 USB: serial: cp210x: add ELDAT Easywave RX09 id
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 1f1e82f74c0947e40144688c9e36abe4b3999f49 upstream.
Add device id for ELDAT Easywave RX09 tranceiver.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -155,6 +155,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ + { USB_DEVICE(0x155A, 0x1006) }, /* ELDAT Easywave RX09 */ { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */
Greg Kroah-Hartman
maintainerPATCH 44/72 serial: 8250: Add Nuvoton NPCM UART
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joel Stanley <[email protected]>
commit f597fbce38d230af95384f4a04e0a13a1d0ad45d upstream.
The Nuvoton UART is almost compatible with the 8250 driver when probed via the 8250_of driver, however it requires some extra configuration at startup.
--- Documentation/devicetree/bindings/serial/8250.txt | 1 drivers/tty/serial/8250/8250_of.c | 1 drivers/tty/serial/8250/8250_port.c | 33 ++++++++++++++++++++++ include/uapi/linux/serial_core.h | 3 ++ 4 files changed, 38 insertions(+)
Documentation/devicetree/bindings/serial/8250.txt +1 -0
@@ -24,6 +24,7 @@ Required properties: - "ti,da830-uart" - "aspeed,ast2400-vuart" - "aspeed,ast2500-vuart" + - "nuvoton,npcm750-uart" - "serial" if the port type is unknown. - reg : offset and length of the register set for the device. - interrupts : should contain uart interrupt.
drivers/tty/serial/8250/8250_of.c +1 -0
@@ -316,6 +316,7 @@ static const struct of_device_id of_plat { .compatible = "mrvl,mmp-uart", .data = (void *)PORT_XSCALE, }, { .compatible = "ti,da830-uart", .data = (void *)PORT_DA830, }, + { .compatible = "nuvoton,npcm750-uart", .data = (void *)PORT_NPCM, }, { /* end of list */ }, }; MODULE_DEVICE_TABLE(of, of_platform_serial_table);
drivers/tty/serial/8250/8250_port.c +33 -0
@@ -47,6 +47,10 @@#define UART_EXAR_SLEEP 0x8b/* Sleep mode */ #define UART_EXAR_DVID 0x8d/* Device identification */ +/* Nuvoton NPCM timeout register */ +#define UART_NPCM_TOR 7 +#define UART_NPCM_TOIE BIT(7)/* Timeout Interrupt Enable */ +/* * Debugging. */
@@ -293,6 +297,15 @@ static const struct serial8250_config ua UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, .flags = UART_CAP_FIFO, }, + [PORT_NPCM] = { + .name = "Nuvoton 16550", + .fifo_size = 16, + .tx_loadsz = 16, + .fcr =UART_FCR_ENABLE_FIFO |UART_FCR_R_TRIG_10 | + UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, + .rxtrig_bytes = {1, 4, 8, 14}, + .flags = UART_CAP_FIFO, + }, };/* Uart divisor latch read */
@@ -2161,6 +2174,15 @@ int serial8250_do_startup(struct uart_po UART_DA830_PWREMU_MGMT_FREE); } +if (port->type ==PORT_NPCM ) { +/* +* Nuvoton calls the scratch register 'UART_TOR' (timeout +* register). Enable it, and set TIOC (timeout interrupt +* comparator) to be 0x20 for correct operation. +*/ +serial_port_out (port,UART_NPCM_TOR ,UART_NPCM_TOIE |0x20 ); + } +#ifdef CONFIG_SERIAL_8250_RSA /* * If this is an RSA port, see if we can kick it up to the
@@ -2483,6 +2505,15 @@ static unsigned int xr17v35x_get_divisorreturn quot_16 >>4 ; } +/* Nuvoton NPCM UARTs have a custom divisor calculation */ +static unsigned int npcm_get_divisor (struct uart_8250_port *up, +unsigned int baud) +{ +struct uart_port *port = &up->port; + +return DIV_ROUND_CLOSEST (port->uartclk,16 * baud +2 ) -2 ; +} +static unsigned int serial8250_get_divisor (struct uart_8250_port *up,unsigned int baud,unsigned int *frac)
@@ -2503,6 +2534,8 @@ static unsigned int serial8250_get_divis quot =0x8002 ; else if (up->port.type == PORT_XR17V35X) quot =xr17v35x_get_divisor (up, baud, frac); + else if (up->port.type == PORT_NPCM) + quot =npcm_get_divisor (up, baud); else quot =uart_get_divisor (port, baud);
include/uapi/linux/serial_core.h +3 -0
@@ -76,6 +76,9 @@#define PORT_SUNZILOG 38#define PORT_SUNSAB 39 +/* Nuvoton UART */ +#define PORT_NPCM 40 +/* Intel EG20 */ #define PORT_PCH_8LINE 44#define PORT_PCH_2LINE 45
Greg Kroah-Hartman
maintainerPATCH 45/72 mei: remove dev_err message on an unsupported ioctl
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <[email protected]>
commit bb0829a741792b56c908d7745bc0b2b540293bcc upstream.
Currently the driver spams the kernel log on unsupported ioctls which is unnecessary as the ioctl returns -ENOIOCTLCMD to indicate this anyway. I suspect this was originally for debugging purposes but it really is not required so remove it.
--- drivers/misc/mei/main.c | 1 - 1 file changed, 1 deletion(-)
drivers/misc/mei/main.c +0 -1
@@ -507,7 +507,6 @@ static long mei_ioctl(struct file *file,break ;default : -dev_err (dev->dev,": unsupported ioctl %d.\n" , cmd); rets = -ENOIOCTLCMD ; }
Greg Kroah-Hartman
maintainerPATCH 46/72 /dev/mem: Avoid overwriting "err" in read_mem()
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <[email protected]>
commit b5b38200ebe54879a7264cb6f33821f61c586a7e upstream.
Successes in probe_kernel_read() would mask failures in copy_to_user() during read_mem().
--- drivers/char/mem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/char/mem.c +3 -3
@@ -137,7 +137,7 @@ static ssize_t read_mem(struct file *filwhile (count >0 ) {unsigned long remaining; -int allowed; +int allowed, probe; sz =size_inside_page (p, count);
@@ -160,9 +160,9 @@ static ssize_t read_mem(struct file *filif (!ptr) goto failed; - err =probe_kernel_read (bounce, ptr, sz); + probe =probe_kernel_read (bounce, ptr, sz);unxlate_dev_mem_ptr (p, ptr); -if (err) +if (probe) goto failed; remaining =copy_to_user (buf, bounce, sz);
Greg Kroah-Hartman
maintainerPATCH 47/72 media: usbtv: prevent double free in error case
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 50e7044535537b2a54c7ab798cd34c7f6d900bd2 upstream.
Quoting the original report:
It looks like there is a double-free vulnerability in Linux usbtv driver on an error path of usbtv_probe function. When audio registration fails, usbtv_video_free function ends up freeing usbtv data structure, which gets freed the second time under usbtv_video_fail label.
usbtv_audio_fail:
usbtv_video_free(usbtv); =>
v4l2_device_put(&usbtv->v4l2_dev);
=> v4l2_device_put
=> kref_put
=> v4l2_device_release => usbtv_release (CALLBACK)
=> kfree(usbtv) (1st time)
usbtv_video_fail:
usb_set_intfdata(intf, NULL);
usb_put_dev(usbtv->udev);
kfree(usbtv); (2nd time)So, as we have refcounting, use it
--- drivers/media/usb/usbtv/usbtv-core.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/usb/usbtv/usbtv-core.c +2 -0
@@ -112,6 +112,8 @@ static int usbtv_probe(struct usb_interfreturn 0 ; usbtv_audio_fail: +/* we must not free at this point */ +usb_get_dev (usbtv->udev);usbtv_video_free (usbtv); usbtv_video_fail:
Greg Kroah-Hartman
maintainerPATCH 48/72 parport_pc: Add support for WCH CH382L PCI-E single parallel port card.
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Gerasiov <[email protected]>
commit 823f7923833c6cc2b16e601546d607dcfb368004 upstream.
WCH CH382L is a PCI-E adapter with 1 parallel port. It is similair to CH382 but serial ports are not soldered on board. Detected as
Serial controller: Device 1c00:3050 (rev 10) (prog-if 05 [16850])
--- drivers/parport/parport_pc.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/parport/parport_pc.c +4 -0
@@ -2646,6 +2646,7 @@ enum parport_pc_pci_cards { netmos_9901, netmos_9865, quatech_sppxp100, + wch_ch382l, };
@@ -2708,6 +2709,7 @@ static struct parport_pc_pci { /* netmos_9901 */ { 1, { { 0, -1 }, } }, /* netmos_9865 */ { 1, { { 0, -1 }, } }, /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, + /* wch_ch382l */ { 1, { { 2, -1 }, } }, }; static const struct pci_device_id parport_pc_pci_tbl[] = {
@@ -2797,6 +2799,8 @@ static const struct pci_device_id parpor/* Quatech SPPXP-100 Parallel port PCI ExpressCard */ {PCI_VENDOR_ID_QUATECH ,PCI_DEVICE_ID_QUATECH_SPPXP_100 , PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 }, +/* WCH CH382L PCI-E single parallel port card */ + { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l }, { 0, } /* terminate list */ };MODULE_DEVICE_TABLE (pci, parport_pc_pci_tbl);
Greg Kroah-Hartman
maintainerPATCH 49/72 crypto: lrw - Free rctx->ext with kzfree
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 8c9bdab21289c211ca1ca6a5f9b7537b4a600a02 upstream.
The buffer rctx->ext contains potentially sensitive data and should be freed with kzfree.
--- crypto/lrw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
crypto/lrw.c +1 -1
@@ -313,7 +313,7 @@ static void exit_crypt(struct skcipher_r rctx->left =0 ;if (rctx->ext) -kfree (rctx->ext); +kzfree (rctx->ext); }static int do_encrypt (struct skcipher_request *req,int err)
Greg Kroah-Hartman
maintainerPATCH 50/72 crypto: talitos - dont persistently map req_ctx->hw_context and req_ctx->buf
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: LEROY Christophe <[email protected]>
commit ad4cd51fb8375109edb377712b5f9c0c31ece33e upstream.
Commit 49f9783b0cea ("crypto: talitos - do hw_context DMA mapping outside the requests") introduced a persistent dma mapping of req_ctx->hw_context
Commit 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1") introduced a persistent dma mapping of req_ctx->buf
As there is no destructor for req_ctx (the request context), the associated dma handlers where set in ctx (the tfm context). This is wrong as several hash operations can run with the same ctx.
This patch removes this persistent mapping.
--- drivers/crypto/talitos.c | 132 +++++++++++++++-------------------------------- 1 file changed, 44 insertions(+), 88 deletions(-)
drivers/crypto/talitos.c +44 -88
@@ -832,8 +832,6 @@ struct talitos_ctx {unsigned int keylen;unsigned int enckeylen;unsigned int authkeylen; -dma_addr_t dma_buf; -dma_addr_t dma_hw_context; };#define HASH_MAX_BLOCK_SIZE SHA512_BLOCK_SIZE
@@ -1690,9 +1688,30 @@ static void common_nonsnoop_hash_unmap(s struct ahash_request *areq) {struct talitos_ahash_req_ctx *req_ctx =ahash_request_ctx (areq); +struct talitos_private *priv =dev_get_drvdata (dev); +bool is_sec1 =has_ftr_sec1 (priv); +struct talitos_desc *desc = &edesc->desc; +struct talitos_desc *desc2 = desc +1 ; + +unmap_single_talitos_ptr (dev, &edesc->desc.ptr[5 ],DMA_FROM_DEVICE ); +if (desc->next_desc && + desc->ptr[5 ].ptr != desc2->ptr[5 ].ptr) +unmap_single_talitos_ptr (dev, &desc2->ptr[5 ],DMA_FROM_DEVICE );talitos_sg_unmap (dev, edesc, req_ctx->psrc,NULL ,0 ,0 ); +/* When using hashctx-in, must unmap it. */ +if (from_talitos_ptr_len (&edesc->desc.ptr[1 ], is_sec1)) +unmap_single_talitos_ptr (dev, &edesc->desc.ptr[1 ], +DMA_TO_DEVICE ); +else if (desc->next_desc) +unmap_single_talitos_ptr (dev, &desc2->ptr[1 ], +DMA_TO_DEVICE ); + +if (is_sec1 && req_ctx->nbuf) +unmap_single_talitos_ptr (dev, &desc->ptr[3 ], +DMA_TO_DEVICE ); +if (edesc->dma_len)dma_unmap_single (dev, edesc->dma_link_tbl, edesc->dma_len,DMA_BIDIRECTIONAL );
@@ -1766,8 +1785,10 @@ static int common_nonsnoop_hash(struct t/* hash context in */ if (!req_ctx->first || req_ctx->swinit) { -to_talitos_ptr (&desc->ptr[1 ], ctx->dma_hw_context, - req_ctx->hw_context_size, is_sec1); +map_single_talitos_ptr (dev, &desc->ptr[1 ], + req_ctx->hw_context_size, + (char *)req_ctx->hw_context, +DMA_TO_DEVICE ); req_ctx->swinit =0 ; }/* Indicate next op is not the first. */
@@ -1793,10 +1814,9 @@ static int common_nonsnoop_hash(struct t* data in */ if (is_sec1 && req_ctx->nbuf) { -dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx * -HASH_MAX_BLOCK_SIZE ; - -to_talitos_ptr (&desc->ptr[3 ], dma_buf, req_ctx->nbuf, is_sec1); +map_single_talitos_ptr (dev, &desc->ptr[3 ], req_ctx->nbuf, + req_ctx->buf[req_ctx->buf_idx], +DMA_TO_DEVICE ); }else { sg_count =talitos_sg_map (dev, req_ctx->psrc, length, edesc, &desc->ptr[3 ], sg_count, offset,0 );
@@ -1812,8 +1832,9 @@ static int common_nonsnoop_hash(struct tcrypto_ahash_digestsize (tfm), areq->result, DMA_FROM_DEVICE); else - to_talitos_ptr(&desc->ptr[5], ctx->dma_hw_context, - req_ctx->hw_context_size, is_sec1); + map_single_talitos_ptr(dev, &desc->ptr[5], + req_ctx->hw_context_size, + req_ctx->hw_context, DMA_FROM_DEVICE);/* last DWORD empty */
@@ -1832,9 +1853,14 @@ static int common_nonsnoop_hash(struct t desc->hdr |=DESC_HDR_MODE0_MDEU_CONT ; desc->hdr &= ~DESC_HDR_DONE_NOTIFY ; -to_talitos_ptr (&desc2->ptr[1 ], ctx->dma_hw_context, - req_ctx->hw_context_size, is_sec1); - +if (desc->ptr[1 ].ptr) +copy_talitos_ptr (&desc2->ptr[1 ], &desc->ptr[1 ], + is_sec1); +else +map_single_talitos_ptr (dev, &desc2->ptr[1 ], + req_ctx->hw_context_size, + req_ctx->hw_context, +DMA_TO_DEVICE );copy_talitos_ptr (&desc2->ptr[2 ], &desc->ptr[2 ], is_sec1); sg_count =talitos_sg_map (dev, req_ctx->psrc, length, edesc, &desc2->ptr[3 ], sg_count, offset,0 );
@@ -1842,8 +1868,10 @@ static int common_nonsnoop_hash(struct t sync_needed = true;copy_talitos_ptr (&desc2->ptr[5 ], &desc->ptr[5 ], is_sec1);if (req_ctx->last) -to_talitos_ptr (&desc->ptr[5 ], ctx->dma_hw_context, - req_ctx->hw_context_size, is_sec1); +map_single_talitos_ptr (dev, &desc->ptr[5 ], + req_ctx->hw_context_size, + req_ctx->hw_context, +DMA_FROM_DEVICE ); next_desc =dma_map_single (dev, &desc2->hdr1,TALITOS_DESC_SIZE ,DMA_BIDIRECTIONAL );
@@ -1881,12 +1909,8 @@ static struct talitos_edesc *ahash_edescstatic int ahash_init (struct ahash_request *areq) {struct crypto_ahash *tfm =crypto_ahash_reqtfm (areq); -struct talitos_ctx *ctx =crypto_ahash_ctx (tfm); -struct device *dev = ctx->dev;struct talitos_ahash_req_ctx *req_ctx =ahash_request_ctx (areq);unsigned int size; -struct talitos_private *priv =dev_get_drvdata (dev); -bool is_sec1 =has_ftr_sec1 (priv);/* Initialize the context */ req_ctx->buf_idx =0 ;
@@ -1898,18 +1922,6 @@ static int ahash_init(struct ahash_reque : TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512; req_ctx->hw_context_size = size; -if (ctx->dma_hw_context) -dma_unmap_single (dev, ctx->dma_hw_context, size, -DMA_BIDIRECTIONAL ); - ctx->dma_hw_context =dma_map_single (dev, req_ctx->hw_context, size, -DMA_BIDIRECTIONAL ); -if (ctx->dma_buf) -dma_unmap_single (dev, ctx->dma_buf,sizeof (req_ctx->buf), -DMA_TO_DEVICE ); -if (is_sec1) - ctx->dma_buf =dma_map_single (dev, req_ctx->buf, -sizeof (req_ctx->buf), -DMA_TO_DEVICE );return 0 ; }
@@ -1920,9 +1932,6 @@ static int ahash_init(struct ahash_requestatic int ahash_init_sha224_swinit (struct ahash_request *areq) {struct talitos_ahash_req_ctx *req_ctx =ahash_request_ctx (areq); -struct crypto_ahash *tfm =crypto_ahash_reqtfm (areq); -struct talitos_ctx *ctx =crypto_ahash_ctx (tfm); -struct device *dev = ctx->dev;ahash_init (areq); req_ctx->swinit =1 ;/* prevent h/w initting context with sha256 values*/
@@ -1940,9 +1949,6 @@ static int ahash_init_sha224_swinit(stru req_ctx->hw_context[8 ] =0 ; req_ctx->hw_context[9 ] =0 ; -dma_sync_single_for_device (dev, ctx->dma_hw_context, - req_ctx->hw_context_size,DMA_TO_DEVICE ); -return 0 ; }
@@ -2046,13 +2052,6 @@ static int ahash_process_req(struct ahas/* request SEC to INIT hash. */ if (req_ctx->first && !req_ctx->swinit) edesc->desc.hdr |=DESC_HDR_MODE0_MDEU_INIT ; -if (is_sec1) { -dma_addr_t dma_buf = ctx->dma_buf + req_ctx->buf_idx * -HASH_MAX_BLOCK_SIZE ; - -dma_sync_single_for_device (dev, dma_buf, - req_ctx->nbuf,DMA_TO_DEVICE ); - }/* When the tfm context has a keylen, it's an HMAC. * A first or last (ie. not middle) descriptor must request HMAC.
@@ -2106,12 +2105,7 @@ static int ahash_export(struct ahash_req {struct talitos_ahash_req_ctx *req_ctx =ahash_request_ctx (areq);struct talitos_export_state *export = out; -struct crypto_ahash *ahash =crypto_ahash_reqtfm (areq); -struct talitos_ctx *ctx =crypto_ahash_ctx (ahash); -struct device *dev = ctx->dev; -dma_sync_single_for_cpu (dev, ctx->dma_hw_context, - req_ctx->hw_context_size,DMA_FROM_DEVICE );memcpy (export->hw_context, req_ctx->hw_context, req_ctx->hw_context_size);memcpy (export->buf, req_ctx->buf[req_ctx->buf_idx], req_ctx->nbuf);
@@ -2130,31 +2124,14 @@ static int ahash_import(struct ahash_reqstruct crypto_ahash *tfm =crypto_ahash_reqtfm (areq);const struct talitos_export_state *export = in;unsigned int size; -struct talitos_ctx *ctx =crypto_ahash_ctx (tfm); -struct device *dev = ctx->dev; -struct talitos_private *priv =dev_get_drvdata (dev); -bool is_sec1 =has_ftr_sec1 (priv);memset (req_ctx,0 ,sizeof (*req_ctx)); size = (crypto_ahash_digestsize (tfm) <=SHA256_DIGEST_SIZE ) ?TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 :TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512 ; req_ctx->hw_context_size = size; -if (ctx->dma_hw_context) -dma_unmap_single (dev, ctx->dma_hw_context, size, -DMA_BIDIRECTIONAL ); -memcpy (req_ctx->hw_context, export->hw_context, size); - ctx->dma_hw_context =dma_map_single (dev, req_ctx->hw_context, size, -DMA_BIDIRECTIONAL ); -if (ctx->dma_buf) -dma_unmap_single (dev, ctx->dma_buf,sizeof (req_ctx->buf), -DMA_TO_DEVICE );memcpy (req_ctx->buf[0 ], export->buf, export->nbuf); -if (is_sec1) - ctx->dma_buf =dma_map_single (dev, req_ctx->buf, -sizeof (req_ctx->buf), -DMA_TO_DEVICE ); req_ctx->swinit = export->swinit; req_ctx->first = export->first; req_ctx->last = export->last;
@@ -3064,27 +3041,6 @@ static void talitos_cra_exit(struct crypdma_unmap_single (dev, ctx->dma_key, ctx->keylen,DMA_TO_DEVICE ); } -static void talitos_cra_exit_ahash (struct crypto_tfm *tfm) -{ -struct talitos_ctx *ctx =crypto_tfm_ctx (tfm); -struct device *dev = ctx->dev; -unsigned int size; - -talitos_cra_exit (tfm); - - size = (crypto_ahash_digestsize (__crypto_ahash_cast (tfm)) <= -SHA256_DIGEST_SIZE ) - ?TALITOS_MDEU_CONTEXT_SIZE_MD5_SHA1_SHA256 - :TALITOS_MDEU_CONTEXT_SIZE_SHA384_SHA512 ; - -if (ctx->dma_hw_context) -dma_unmap_single (dev, ctx->dma_hw_context, size, -DMA_BIDIRECTIONAL ); -if (ctx->dma_buf) -dma_unmap_single (dev, ctx->dma_buf,HASH_MAX_BLOCK_SIZE *2 , -DMA_TO_DEVICE ); -} -/* * given the alg's descriptor header template, determine whether descriptor * type and primary/secondary execution units required match the hw
@@ -3183,7 +3139,7 @@ static struct talitos_crypto_alg *talitocase CRYPTO_ALG_TYPE_AHASH : alg = &t_alg->algt.alg.hash.halg.base; alg->cra_init = talitos_cra_init_ahash; - alg->cra_exit = talitos_cra_exit_ahash; + alg->cra_exit = talitos_cra_exit; alg->cra_type = &crypto_ahash_type; t_alg->algt.alg.hash.init = ahash_init; t_alg->algt.alg.hash.update = ahash_update;
Greg Kroah-Hartman
maintainerPATCH 51/72 crypto: inside-secure - fix clock management
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory CLEMENT <[email protected]>
commit f962eb46e7a9b98a58d2483f5eb216e738fec732 upstream.
In this driver the clock is got but never put when the driver is removed or if there is an error in the probe.
Using the managed version of clk_get() allows to let the kernel take care of it.
engine driver")
--- drivers/crypto/inside-secure/safexcel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/inside-secure/safexcel.c +1 -1
@@ -789,7 +789,7 @@ static int safexcel_probe(struct platforreturn PTR_ERR (priv->base); } - priv->clk =of_clk_get (dev->of_node,0 ); + priv->clk =devm_clk_get (&pdev->dev,NULL );if (!IS_ERR (priv->clk)) { ret =clk_prepare_enable (priv->clk);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 52/72 crypto: testmgr - Fix incorrect values in PKCS#1 test vector
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Conor McLoughlin <[email protected]>
commit 333e18c5cc74438f8940c7f3a8b3573748a371f9 upstream.
The RSA private key for the first form should have version, prime1, prime2, exponent1, exponent2, coefficient values 0.
With non-zero values for prime1,2, exponent 1,2 and coefficient the Intel QAT driver will assume that values are provided for the private key second form. This will result in signature verification failures for modules where QAT device is present and the modules are signed with rsa,sha256.
--- crypto/testmgr.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
crypto/testmgr.h +3 -3
@@ -548,7 +548,7 @@ static const struct akcipher_testvec rsastatic const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = { { .key = -"\x30\x82\x03\x1f\x02\x01\x10\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" +"\x30\x82\x03\x1f\x02\x01\x00\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" "\x8c\x92\x31\xe7\x69\x02\xa2\xd5\x5c\x78\xde\xa2\x0c\x8f\xfe\x28" "\x59\x31\xdf\x40\x9c\x60\x61\x06\xb9\x2f\x62\x40\x80\x76\xcb\x67" "\x4a\xb5\x59\x56\x69\x17\x07\xfa\xf9\x4c\xbd\x6c\x37\x7a\x46\x7d"
@@ -597,8 +597,8 @@ static const struct akcipher_testvec pkc"\xfe\xf8\x27\x1b\xd6\x55\x60\x5e\x48\xb7\x6d\x9a\xa8\x37\xf9\x7a" "\xde\x1b\xcd\x5d\x1a\x30\xd4\xe9\x9e\x5b\x3c\x15\xf8\x9c\x1f\xda" "\xd1\x86\x48\x55\xce\x83\xee\x8e\x51\xc7\xde\x32\x12\x47\x7d\x46" -"\xb8\x35\xdf\x41\x02\x01\x30\x02\x01\x30\x02\x01\x30\x02\x01\x30" - "\x02\x01\x30", +"\xb8\x35\xdf\x41\x02\x01\x00\x02\x01\x00\x02\x01\x00\x02\x01\x00" + "\x02\x01\x00", .key_len = 804,/* * m is SHA256 hash of following message:
Greg Kroah-Hartman
maintainerPATCH 53/72 crypto: talitos - fix IPsec cipher in length
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: LEROY Christophe <[email protected]>
commit 2b1227301a8e4729409694e323b72c064c47cb6b upstream.
For SEC 2.x+, cipher in length must contain only the ciphertext length. In case of using hardware ICV checking, the ICV length is provided via the "extent" field of the descriptor pointer.
--- drivers/crypto/talitos.c | 36 ++++++++++++++++++++---------------- 1 file changed, 20 insertions(+), 16 deletions(-)
drivers/crypto/talitos.c +20 -16
@@ -1128,10 +1128,10 @@ next:return count; } -static int talitos_sg_map (struct device *dev,struct scatterlist *src, -unsigned int len,struct talitos_edesc *edesc, -struct talitos_ptr *ptr, -int sg_count,unsigned int offset,int tbl_off) +static int talitos_sg_map_ext (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off,int elen) {struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1140,6 +1140,7 @@ static int talitos_sg_map(struct deviceto_talitos_ptr (ptr,0 ,0 , is_sec1);return 1 ; } +to_talitos_ptr_ext_set (ptr, elen, is_sec1);if (sg_count ==1 ) {to_talitos_ptr (ptr,sg_dma_address (src) + offset, len, is_sec1);return sg_count;
@@ -1148,7 +1149,7 @@ static int talitos_sg_map(struct deviceto_talitos_ptr (ptr, edesc->dma_link_tbl + offset, len, is_sec1);return sg_count; } - sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len, + sg_count =sg_to_link_tbl_offset (src, sg_count, offset, len + elen, &edesc->link_tbl[tbl_off]);if (sg_count ==1 ) {/* Only one segment now, so no link tbl needed*/
@@ -1162,6 +1163,15 @@ static int talitos_sg_map(struct devicereturn sg_count; } +static int talitos_sg_map (struct device *dev,struct scatterlist *src, +unsigned int len,struct talitos_edesc *edesc, +struct talitos_ptr *ptr,int sg_count, +unsigned int offset,int tbl_off) +{ +return talitos_sg_map_ext (dev, src, len, edesc, ptr, sg_count, offset, + tbl_off,0 ); +} +/* * fill in and submit ipsec_esp descriptor */
@@ -1179,7 +1189,7 @@ static int ipsec_esp(struct talitos_edesunsigned int ivsize =crypto_aead_ivsize (aead);int tbl_off =0 ;int sg_count, ret; -int sg_link_tbl_len; +int elen =0 ;bool sync_needed = false;struct talitos_private *priv =dev_get_drvdata (dev);bool is_sec1 =has_ftr_sec1 (priv);
@@ -1221,17 +1231,11 @@ static int ipsec_esp(struct talitos_edes* extent is bytes of HMAC postpended to ciphertext, * typically 12 for ipsec */ - sg_link_tbl_len = cryptlen; - -if (is_ipsec_esp) { -to_talitos_ptr_ext_set (&desc->ptr[4 ], authsize, is_sec1); - -if (desc->hdr &DESC_HDR_MODE1_MDEU_CICV ) - sg_link_tbl_len += authsize; - } +if (is_ipsec_esp && (desc->hdr &DESC_HDR_MODE1_MDEU_CICV )) + elen = authsize; - ret =talitos_sg_map (dev, areq->src, sg_link_tbl_len, edesc, - &desc->ptr[4 ], sg_count, areq->assoclen, tbl_off); + ret =talitos_sg_map_ext (dev, areq->src, cryptlen, edesc, &desc->ptr[4 ], + sg_count, areq->assoclen, tbl_off, elen);if (ret >1 ) { tbl_off += ret;
Greg Kroah-Hartman
maintainerPATCH 54/72 crypto: ahash - Fix early termination in hash walk
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <[email protected]>
commit 900a081f6912a8985dc15380ec912752cb66025a upstream.
When we have an unaligned SG list entry where there is no leftover aligned data, the hash walk code will incorrectly return zero as if the entire SG list has been processed.
This patch fixes it by moving onto the next page instead.
--- crypto/ahash.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
crypto/ahash.c +4 -3
@@ -92,13 +92,14 @@ int crypto_hash_walk_done(struct crypto_if (nbytes && walk->offset & alignmask && !err) { walk->offset =ALIGN (walk->offset, alignmask +1 ); - walk->data += walk->offset; - nbytes =min (nbytes, ((unsigned int )(PAGE_SIZE )) - walk->offset); walk->entrylen -= nbytes; -return nbytes; +if (nbytes) { + walk->data += walk->offset; +return nbytes; + } }if (walk->flags &CRYPTO_ALG_ASYNC )
Greg Kroah-Hartman
maintainerPATCH 55/72 crypto: caam - Fix null dereference at error path
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rui Miguel Silva <[email protected]>
commit b85149f6f5d5a9279f29a73b2e95342f4d465e73 upstream.
caam_remove already removes the debugfs entry, so we need to remove the one immediately before calling caam_remove.
This fix a NULL dereference at error paths is caam_probe fail.
--- drivers/crypto/caam/ctrl.c | 3 --- 1 file changed, 3 deletions(-)
drivers/crypto/caam/ctrl.c +0 -3
@@ -813,9 +813,6 @@ static int caam_probe(struct platform_dereturn 0 ; caam_remove: -#ifdef CONFIG_DEBUG_FS -debugfs_remove_recursive (ctrlpriv->dfs_root); -#endif caam_remove (pdev);return ret;
Greg Kroah-Hartman
maintainerPATCH 56/72 crypto: ccp - return an actual key size from RSA max_size callback
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej S. Szmigiero <[email protected]>
commit 0a9eb80e643064266868bd2fb2cd608e669309b0 upstream.
rsa-pkcs1pad uses a value returned from a RSA implementation max_size callback as a size of an input buffer passed to the RSA implementation for encrypt and sign operations.
CCP RSA implementation uses a hardware input buffer which size depends only on the current RSA key length, so it should return this key length in the max_size callback, too.
This also matches what the kernel software RSA implementation does.
Previously, the value returned from this callback was always the maximum RSA key size the CCP hardware supports.
This resulted in this huge buffer being passed by rsa-pkcs1pad to CCP even for smaller key sizes and then in a buffer overflow when ccp_run_rsa_cmd() tried to copy this large input buffer into a RSA key length-sized hardware input buffer.
--- drivers/crypto/ccp/ccp-crypto-rsa.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/crypto/ccp/ccp-crypto-rsa.c +3 -4
@@ -60,10 +60,9 @@ static int ccp_rsa_complete(struct cryptstatic unsigned int ccp_rsa_maxsize (struct crypto_akcipher *tfm) { -if (ccp_version () >CCP_VERSION (3 ,0 )) -return CCP5_RSA_MAXMOD ; -else -return CCP_RSA_MAXMOD ; +struct ccp_ctx *ctx =akcipher_tfm_ctx (tfm); + +return ctx->u.rsa.n_len; }static int ccp_rsa_crypt (struct akcipher_request *req,bool encrypt)
Greg Kroah-Hartman
maintainerPATCH 57/72 crypto: arm,arm64 - Fix random regeneration of S_shipped
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leonard Crestez <[email protected]>
commit 6aaf49b495b446ff6eec0ac983f781ca0dc56a73 upstream.
The decision to rebuild .S_shipped is made based on the relative timestamps of .S_shipped and .pl files but git makes this essentially random. This means that the perl script might run anyway (usually at most once per checkout), defeating the whole purpose of _shipped.
Fix by skipping the rule unless explicit make variables are provided:REGENERATE_ARM_CRYPTO or REGENERATE_ARM64_CRYPTO.
This can produce nasty occasional build failures downstream, for example for toolchains with broken perl. The solution is minimally intrusive to make it easier to push into stable.
Another report on a similar issue here: https://lkml.org/lkml/2018/3/8/1379
--- arch/arm/crypto/Makefile | 2 ++ arch/arm64/crypto/Makefile | 2 ++ 2 files changed, 4 insertions(+)
arch/arm/crypto/Makefile +2 -0
@@ -54,6 +54,7 @@ crct10dif-arm-ce-y := crct10dif-ce-core. crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o +ifdef REGENERATE_ARM_CRYPTO quiet_cmd_perl = PERL $@ cmd_perl = $(PERL) $(<) > $(@)
@@ -62,5 +63,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha $(src)/sha512-core.S_shipped: $(src)/sha512-armv4.pl $(call cmd,perl) +endif .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S
arch/arm64/crypto/Makefile +2 -0
@@ -58,6 +58,7 @@ CFLAGS_aes-glue-ce.o := -DUSE_V8_CRYPTO_ $(obj)/aes-glue-%.o: $(src)/aes-glue.c FORCE $(call if_changed_rule,cc_o_c) +ifdef REGENERATE_ARM64_CRYPTO quiet_cmd_perlasm = PERLASM $@ cmd_perlasm = $(PERL) $(<) void $(@)
@@ -66,5 +67,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha $(src)/sha512-core.S_shipped: $(src)/sha512-armv8.pl $(call cmd,perlasm) +endif .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S
Greg Kroah-Hartman
maintainerPATCH 58/72 crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 8f461b1e02ed546fbd0f11611138da67fd85a30f upstream.
With ecb-cast5-avx, if a 128+ byte scatterlist element followed a shorter one, then the algorithm accidentally encrypted/decrypted only 8 bytes instead of the expected 128 bytes. Fix it by setting the encryption/decryption 'fn' correctly.
--- arch/x86/crypto/cast5_avx_glue.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/crypto/cast5_avx_glue.c +1 -2
@@ -66,8 +66,6 @@ static int ecb_crypt(struct blkcipher_devoid (*fn)(struct cast5_ctx *ctx,u8 *dst,const u8 *src);int err; - fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; - err =blkcipher_walk_virt (desc, walk); desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP ;
@@ -79,6 +77,7 @@ static int ecb_crypt(struct blkcipher_de/* Process multi-block batch */ if (nbytes >= bsize *CAST5_PARALLEL_BLOCKS ) { + fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; do { fn(ctx, wdst, wsrc);
Greg Kroah-Hartman
maintainerPATCH 59/72 Btrfs: fix unexpected cow in run_delalloc_nocow
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit 5811375325420052fcadd944792a416a43072b7f upstream.
Fstests generic/475 provides a way to fail metadata reads while checking if checksum exists for the inode inside run_delalloc_nocow(), and csum_exist_in_range() interprets error (-EIO) as inode having checksum and makes its caller enter the cow path.
In case of free space inode, this ends up with a warning in cow_file_range().
The same problem applies to btrfs_cross_ref_exist() since it may also read metadata in between.
With this, run_delalloc_nocow() bails out when errors occur at the two places.
--- fs/btrfs/inode.c | 37 ++++++++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-)
fs/btrfs/inode.c +32 -5
@@ -1257,6 +1257,8 @@ static noinline int csum_exist_in_range(list_del (&sums->list);kfree (sums); } +if (ret <0 ) +return ret;return 1 ; }
@@ -1389,10 +1391,23 @@ next_slot: goto out_check;if (btrfs_extent_readonly (fs_info, disk_bytenr)) goto out_check; -if (btrfs_cross_ref_exist (root, ino, - found_key.offset - - extent_offset, disk_bytenr)) + ret =btrfs_cross_ref_exist (root, ino, + found_key.offset - + extent_offset, disk_bytenr); +if (ret) { +/* +* ret could be -EIO if the above fails to read +* metadata. +*/ +if (ret <0 ) { +if (cow_start != (u64)-1 ) + cur_offset = cow_start; + goto error; + } + +WARN_ON_ONCE (nolock); goto out_check; + } disk_bytenr += extent_offset; disk_bytenr += cur_offset - found_key.offset; num_bytes =min (end +1 , extent_end) - cur_offset;
@@ -1410,10 +1425,22 @@ next_slot:* this ensure that csum for a given extent are * either valid or do not exist. */ -if (csum_exist_in_range (fs_info, disk_bytenr, - num_bytes)) { + ret =csum_exist_in_range (fs_info, disk_bytenr, + num_bytes); +if (ret) {if (!nolock)btrfs_end_write_no_snapshotting (root); + +/* +* ret could be -EIO if the above fails to read +* metadata. +*/ +if (ret <0 ) { +if (cow_start != (u64)-1 ) + cur_offset = cow_start; + goto error; + } +WARN_ON_ONCE (nolock); goto out_check; }if (!btrfs_inc_nocow_writers (fs_info, disk_bytenr)) {
Greg Kroah-Hartman
maintainerPATCH 60/72 staging: comedi: ni_mio_common: ack ai fifo error interrupts.
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Mori Hess <[email protected]>
commit e1d9fc04c41840a4688ef6ce90b6dcca157ea4d7 upstream.
Ack ai fifo error interrupts in interrupt handler to clear interrupt after fifo overflow. It should prevent lock-ups after the ai fifo overflows.
--- drivers/staging/comedi/drivers/ni_mio_common.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/staging/comedi/drivers/ni_mio_common.c +2 -0
@@ -1284,6 +1284,8 @@ static void ack_a_interrupt(struct comed ack |=NISTC_INTA_ACK_AI_START ;if (a_status &NISTC_AI_STATUS1_STOP ) ack |=NISTC_INTA_ACK_AI_STOP ; +if (a_status &NISTC_AI_STATUS1_OVER ) + ack |=NISTC_INTA_ACK_AI_ERR ;if (ack)ni_stc_writew (dev, ack,NISTC_INTA_ACK_REG ); }
Greg Kroah-Hartman
maintainerPATCH 61/72 Revert "base: arch_topology: fix section mismatch build warnings"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaku Inami <[email protected]>
commit 9de9a449482677a75f1edd2049268a7efc40fc96 upstream.
This reverts commit 452562abb5b7 ("base: arch_topology: fix section mismatch build warnings"). It causes the notifier call hangs in some use-cases.
In some cases with using maxcpus, some of cpus are booted first and then the remaining cpus are booted. As an example, some users who want to realize fast boot up often use the following procedure.
1) Define all CPUs on device tree (CA57x4 + CA53x4)
2) Add "maxcpus=4" in bootargs
3) Kernel boot up with CA57x4
4) After kernel boot up, CA53x4 is booted from user
When kernel init was finished, CPUFREQ_POLICY_NOTIFIER was not still unregisterd. This means that "__init init_cpu_capacity_callback()" will be called after kernel init sequence. To avoid this problem, it needs to remove __init{,data} annotations by reverting this commit.
Also, this commit was needed to fix kernel compile issue below. However, this issue was also fixed by another patch: commit 82d8ba717ccb ("arch_topology: Fix section miss match warning due to free_raw_capacity()") in v4.15 as well.
Whereas commit 452562abb5b7 added all the missing __init annotations, commit 82d8ba717ccb removed it from free_raw_capacity().
WARNING: vmlinux.o(.text+0x548f24): Section mismatch in reference from the function init_cpu_capacity_callback() to the variable .init.text:$x
The function init_cpu_capacity_callback() references the variable __init $x.
This is often because init_cpu_capacity_callback lacks a __init annotation or the annotation of $x is wrong.
--- drivers/base/arch_topology.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/base/arch_topology.c +6 -6
@@ -175,11 +175,11 @@ bool __init topology_parse_cpu_capacity( }#ifdef CONFIG_CPU_FREQ -static cpumask_var_t cpus_to_visit__initdata ; -static void __init parsing_done_workfn (struct work_struct *work); -static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn); +static cpumask_var_t cpus_to_visit; +static void parsing_done_workfn (struct work_struct *work); +static DECLARE_WORK(parsing_done_work, parsing_done_workfn); -static int __init +static int init_cpu_capacity_callback (struct notifier_block *nb,unsigned long val,void *data)
@@ -215,7 +215,7 @@ init_cpu_capacity_callback(struct notifireturn 0 ; } -static struct notifier_block init_cpu_capacity_notifier__initdata = { +static struct notifier_block init_cpu_capacity_notifier = { .notifier_call = init_cpu_capacity_callback, };
@@ -248,7 +248,7 @@ static int __init register_cpufreq_notif }core_initcall (register_cpufreq_notifier); -static void __init parsing_done_workfn (struct work_struct *work) +static void parsing_done_workfn (struct work_struct *work) {cpufreq_unregister_notifier (&init_cpu_capacity_notifier,CPUFREQ_POLICY_NOTIFIER );
Greg Kroah-Hartman
maintainerPATCH 62/72 Input: ALPS - fix TrackStick detection on Thinkpad L570 and Latitude 7370
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masaki Ota <[email protected]>
commit 567b9b549cfa1cbc202762ae97b5385c29ade1e3 upstream.
The primary interface for the touchpad device in Thinkpad L570 is SMBus, so ALPS overlooked PS2 interface Firmware setting of TrackStick, and shipped with TrackStick otp bit is disabled.
The address 0xD7 contains device number information, so we can identify the device by checking this value, but to access it we need to enable Command mode, and then re-enable the device. Devices shipped in Thinkpad L570 report either 0x0C or 0x1D as device numbers, if we see them we assume that the devices are DualPoints.
The same issue exists on Dell Latitude 7370.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196929
--- drivers/input/mouse/alps.c | 24 +++++++++++++++++++++--- 1 file changed, 21 insertions(+), 3 deletions(-)
drivers/input/mouse/alps.c +21 -3
@@ -2544,13 +2544,31 @@ static int alps_update_btn_info_ss4_v2(u }static int alps_update_dual_info_ss4_v2 (unsigned char otp[][4 ], -struct alps_data *priv) +struct alps_data *priv, +struct psmouse *psmouse) {bool is_dual = false; +int reg_val =0 ; +struct ps2dev *ps2dev = &psmouse->ps2dev; -if (IS_SS4PLUS_DEV (priv->dev_id)) +if (IS_SS4PLUS_DEV (priv->dev_id)) { is_dual = (otp[0 ][0 ] >>4 ) &0x01 ; +if (!is_dual) { +/* For support TrackStick of Thinkpad L/E series */ +if (alps_exit_command_mode (psmouse) ==0 && +alps_enter_command_mode (psmouse) ==0 ) { + reg_val =alps_command_mode_read_reg (psmouse, +0xD7 ); + } +alps_exit_command_mode (psmouse); +ps2_command (ps2dev,NULL ,PSMOUSE_CMD_ENABLE ); + +if (reg_val ==0x0C || reg_val ==0x1D ) + is_dual = true; + } + } +if (is_dual) priv->flags |=ALPS_DUALPOINT |ALPS_DUALPOINT_WITH_PRESSURE ;
@@ -2573,7 +2591,7 @@ static int alps_set_defaults_ss4_v2(strualps_update_btn_info_ss4_v2 (otp, priv); -alps_update_dual_info_ss4_v2 (otp, priv); +alps_update_dual_info_ss4_v2 (otp, priv, psmouse);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 63/72 Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Wassenberg <[email protected]>
commit b56af54ac78c54a519d82813836f305d7f76ef27 upstream.
Reset i8042 before probing because of insufficient BIOS initialisation of the i8042 serial controller. This makes Synaptics touchpad detection possible. Without resetting the Synaptics touchpad is not detected because there are always NACK messages from AUX port.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -621,6 +621,13 @@ static const struct dmi_system_id __init }, }, { +/* Lenovo ThinkPad L460 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"), + }, + }, + {/* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ .matches = { DMI_MATCH(DMI_SYS_VENDOR, "Notebook"),
Greg Kroah-Hartman
maintainerPATCH 64/72 Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Zary <[email protected]>
commit 04bb1719c4de94700056241d4c0fe3c1413f5aff upstream.
The touch sensor buttons on Sony VAIO VGN-CS series laptops (e.g. VGN-CS31S) are a separate PS/2 device. As the MUX is disabled for all VAIO machines by the nomux blacklist, the data from touch sensor buttons and touchpad are combined. The protocol used by the buttons is probably similar to the touchpad protocol (both are Synaptics) so both devices get enabled. The controller combines the data, creating a mess which results in random button clicks, touchpad stopping working and lost sync error messages:
psmouse serio1: TouchPad at isa0060/serio1/input0 lost sync at byte 4 psmouse serio1: TouchPad at isa0060/serio1/input0 lost sync at byte 1 psmouse serio1: TouchPad at isa0060/serio1/input0 lost sync at byte 1 psmouse serio1: TouchPad at isa0060/serio1/input0 lost sync at byte 1 psmouse serio1: TouchPad at isa0060/serio1/input0 lost sync at byte 1 psmouse serio1: issuing reconnect request
Add a new i8042_dmi_forcemux_table whitelist with VGN-CS. With MUX enabled, touch sensor buttons are detected as separate device (and left disabled as there's currently no driver), fixing all touchpad problems.
--- drivers/input/serio/i8042-x86ia64io.h | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +17 -0
@@ -530,6 +530,20 @@ static const struct dmi_system_id __init { } }; +static const struct dmi_system_id i8042_dmi_forcemux_table[]__initconst = { + { +/* +* Sony Vaio VGN-CS series require MUX or the touch sensor +* buttons will disturb touchpad operation +*/ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Sony Corporation" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"VGN-CS" ), + }, + }, + { } +}; +/* * On some Asus laptops, just running self tests cause problems. */
@@ -1170,6 +1184,9 @@ static int __init i8042_platform_init(voif (dmi_check_system (i8042_dmi_nomux_table)) i8042_nomux = true; +if (dmi_check_system (i8042_dmi_forcemux_table)) + i8042_nomux = false; +if (dmi_check_system (i8042_dmi_notimeout_table)) i8042_notimeout = true;
Greg Kroah-Hartman
maintainerPATCH 65/72 vt: change SGR 21 to follow the standards
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Frysinger <[email protected]>
commit 65d9982d7e523a1a8e7c9af012da0d166f72fc56 upstream.
ECMA-48 [1] (aka ISO 6429) has defined SGR 21 as "doubly underlined" since at least March 1984. The Linux kernel has treated it as SGR 22 "normal intensity" since it was added in Linux-0.96b in June 1992. Before that, it was simply ignored. Other terminal emulators have either ignored it, or treat it as double underline now. xterm for example added support in its 304 release (May 2014) [2] where it was previously ignoring it.
Changing this behavior shouldn't be an issue:
- It isn't a named capability in ncurses's terminfo database, so no script is using libtinfo/libcurses to look this up, or using tput to query & output the right sequence.
- Any script assuming SGR 21 will reset intensity in all terminals already do not work correctly on non-Linux VTs (including running under screen/tmux/etc...).
- If someone has written a script that only runs in the Linux VT, and they're using SGR 21 (instead of SGR 22), the output should still be readable.
imo it's important to change this as the Linux VT's non-conformance is sometimes used as an argument for other terminal emulators to not implement SGR 21 at all, or do so incorrectly.
[1]: https://www.ecma-international.org/publications/standards/Ecma-048.htm
[2]: https://github.com/ThomasDickey/xterm-snapshots/commit/2fd29cb98d214cb536bcafbee00bc73b3f1eeb9d
--- drivers/tty/vt/vt.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tty/vt/vt.c +5 -1
@@ -1354,6 +1354,11 @@ static void csi_m(struct vc_data *vc)case 3 : vc->vc_italic =1 ;break ; +case 21 : +/* +* No console drivers support double underline, so +* convert it to a single underline. +*/ case 4 : vc->vc_underline =1 ;break ;
@@ -1389,7 +1394,6 @@ static void csi_m(struct vc_data *vc) vc->vc_disp_ctrl =1 ; vc->vc_toggle_meta =1 ;break ; -case 21 :case 22 : vc->vc_intensity =1 ;break ;
Greg Kroah-Hartman
maintainerPATCH 66/72 ARM: dts: DRA76-EVM: Set powerhold property for tps65917
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keerthy <[email protected]>
commit aac4619d028e2c444ac1217fc2d05b0322079dff upstream.
Set powerhold property for tps65917
--- arch/arm/boot/dts/dra76-evm.dts | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/dra76-evm.dts +1 -0
@@ -148,6 +148,7 @@ compatible = "ti,tps65917"; reg = <0x58>; ti,system-power-controller; + ti,palmas-override-powerhold; interrupt-controller; #interrupt-cells = <2>;
Greg Kroah-Hartman
maintainerPATCH 67/72 net: hns: Fix ethtool private flags
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Brugger <[email protected]>
commit d61d263c8d82db7c4404a29ebc29674b1c0c05c9 upstream.
The driver implementation returns support for private flags, while no private flags are present. When asked for the number of private flags it returns the number of statistic flag names.
Fix this by returning EOPNOTSUPP for not implemented ethtool flags.
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c | 2 +- drivers/net/ethernet/hisilicon/hns/hns_ethtool.c | 4 +++- 4 files changed, 6 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +1 -1
@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 strstatic int hns_gmac_get_sset_count (int stringset) { -if (stringset ==ETH_SS_STATS || stringset ==ETH_SS_PRIV_FLAGS ) +if (stringset ==ETH_SS_STATS )return ARRAY_SIZE (g_gmac_stats_string);return 0 ;
drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +1 -1
@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppeint hns_ppe_get_sset_count (int stringset) { -if (stringset ==ETH_SS_STATS || stringset ==ETH_SS_PRIV_FLAGS ) +if (stringset ==ETH_SS_STATS )return ETH_PPE_STATIC_NUM ;return 0 ; }
drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +1 -1
@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue*/ int hns_rcb_get_ring_sset_count (int stringset) { -if (stringset ==ETH_SS_STATS || stringset ==ETH_SS_PRIV_FLAGS ) +if (stringset ==ETH_SS_STATS )return HNS_RING_STATIC_REG_NUM ;return 0 ;
drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +3 -1
@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device cnt--;return cnt; - }else { + }else if (stringset ==ETH_SS_STATS ) {return (HNS_NET_STATS_CNT + ops->get_sset_count (h, stringset)); + }else { +return -EOPNOTSUPP ; } }
Greg Kroah-Hartman
maintainerPATCH 68/72 Fix slab name "biovec-(1<<(21-12))"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
commit bd5c4facf59648581d2f1692dad7b107bf429954 upstream.
I'm getting a slab named "biovec-(1<<(21-12))". It is caused by unintended expansion of the macro BIO_MAX_PAGES. This patch renames it to biovec-max.
--- block/bio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
block/bio.c +2 -2
@@ -43,9 +43,9 @@* break badly! cannot be bigger than what you can fit into an * unsigned short */ -#define BV (x) { .nr_vecs = x, .name = "biovec-"__stringify(x) } +#define BV (x, n) { .nr_vecs = x, .name = "biovec-"#n }static struct biovec_slab bvec_slabs[BVEC_POOL_NR ]__read_mostly = { -BV (1 ),BV (4 ),BV (16 ),BV (64 ),BV (128 ),BV (BIO_MAX_PAGES ), +BV (1 ,1 ),BV (4 ,4 ),BV (16 ,16 ),BV (64 ,64 ),BV (128 ,128 ),BV (BIO_MAX_PAGES , max), };#undef BV
Greg Kroah-Hartman
maintainerPATCH 69/72 Revert "ARM: dts: am335x-pepper: Fix the audio CODECs reset pin"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit cc578825b46e984c19b4a4630d3191d60ff83642 which was comit e153db03c6b7a035c797bcdf35262586f003ee93 upstream.
It requires a driver that was not merged until 4.16, so remove it from this stable tree as it is pointless.
--- arch/arm/boot/dts/am335x-pepper.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/am335x-pepper.dts +1 -1
@@ -139,7 +139,7 @@ &audio_codec { status = "okay"; - reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; AVDD-supply = <&ldo3_reg>; IOVDD-supply = <&ldo3_reg>; DRVDD-supply = <&ldo3_reg>;
Greg Kroah-Hartman
maintainerPATCH 70/72 Revert "ARM: dts: omap3-n900: Fix the audio CODECs reset pin"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit c91a501768717f449acd1c2cff1a8531e486c441 which was commit 7be4b5dc7ffa9499ac6ef33a5ffa9ff43f9b7057 upstream.
It requires a driver that was not merged until 4.16, so remove it from this stable tree as it is pointless.
--- arch/arm/boot/dts/omap3-n900.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/omap3-n900.dts +2 -2
@@ -558,7 +558,7 @@ tlv320aic3x: tlv320aic3x@18 { compatible = "ti,tlv320aic3x"; reg = <0x18>; - reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ai3x-gpio-func = < 0 /* AIC3X_GPIO1_FUNC_DISABLED */ 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */
@@ -575,7 +575,7 @@ tlv320aic3x_aux: tlv320aic3x@19 { compatible = "ti,tlv320aic3x"; reg = <0x19>; - reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ AVDD-supply = <&vmmc2>; DRVDD-supply = <&vmmc2>;
Greg Kroah-Hartman
maintainerPATCH 71/72 Revert "cpufreq: Fix governor module removal race"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit a853301f77b5c4feb5e17aebfd92018269525523 which was commit a8b149d32b663c1a4105273295184b78f53d33cf upstream.
The backport was not correct, so just drop it entirely.
--- drivers/cpufreq/cpufreq.c | 6 ------ 1 file changed, 6 deletions(-)
drivers/cpufreq/cpufreq.c +0 -6
@@ -637,8 +637,6 @@ static int cpufreq_parse_governor(char * *governor = t; err =0 ; } -if (t && !try_module_get (t->owner)) - t =NULL ;mutex_unlock (&cpufreq_governor_mutex); }
@@ -767,10 +765,6 @@ static ssize_t store_scaling_governor(streturn -EINVAL ; ret =cpufreq_set_policy (policy, &new_policy); - -if (new_policy.governor) -module_put (new_policy.governor->owner); -return ret ? ret : count; }
Greg Kroah-Hartman
maintainerPATCH 72/72 Revert "ip6_vti: adjust vti mtu according to mtu of lower device"
In reply to Greg Kroah-Hartman4.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit 813b2dad2cb59d2759f1538e65d56dcccdb18a94 which is commit 53c81e95df1793933f87748d36070a721f6cb287 upstream.
Ben writes that there are a number of follow-on patches needed to fix this up, but they get complex to backport, and some custom fixes are needed, so let's just revert this and wait for a "real" set of patches to resolve this to be submitted if it is really needed.
--- net/ipv6/ip6_vti.c | 20 -------------------- 1 file changed, 20 deletions(-)
net/ipv6/ip6_vti.c +0 -20
@@ -626,7 +626,6 @@ static void vti6_link_config(struct ip6_ {struct net_device *dev = t->dev;struct __ip6_tnl_parm *p = &t->parms; -struct net_device *tdev =NULL ;memcpy (dev->dev_addr, &p->laddr,sizeof (struct in6_addr ));memcpy (dev->broadcast, &p->raddr,sizeof (struct in6_addr ));
@@ -639,25 +638,6 @@ static void vti6_link_config(struct ip6_ dev->flags |=IFF_POINTOPOINT ; else dev->flags &= ~IFF_POINTOPOINT; - -if (p->flags &IP6_TNL_F_CAP_XMIT ) { -int strict = (ipv6_addr_type (&p->raddr) & - (IPV6_ADDR_MULTICAST |IPV6_ADDR_LINKLOCAL )); -struct rt6_info *rt =rt6_lookup (t->net, - &p->raddr, &p->laddr, - p->link, strict); - -if (rt) - tdev = rt->dst.dev; -ip6_rt_put (rt); - } - -if (!tdev && p->link) - tdev =__dev_get_by_index (t->net, p->link); - -if (tdev) - dev->mtu =max_t (int, tdev->mtu - dev->hard_header_len, -IPV6_MIN_MTU ); }/**
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.15.16 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Apr 8 08:43:10 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.16-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.15.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.15.16-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.15.y
git commit: 1abb272b72b7242da1c7b6bb5a57bfe7d6ac15e1
git describe: v4.15.15-73-g1abb272b72b7
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.15-oe/build/v4.15.15-73-g1abb272b72b7
No regressions (compared to build v4.15.15-59-g1c8d09b1ac26)
Boards, architectures and test suites:
-------------------------------------
dragonboard-410c - arm64
* boot - fail: 2, pass: 20
* kselftest - skip: 20, pass: 45
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 2, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - pass: 14
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 148, pass: 1002
* ltp-timers-tests - skip: 1, pass: 12
hi6220-hikey - arm64
* boot - pass: 20
* kselftest - skip: 17, pass: 48
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 2, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 1, pass: 21
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 151, pass: 999
* ltp-timers-tests - skip: 1, pass: 12
juno-r2 - arm64
* boot - pass: 20
* kselftest - skip: 17, pass: 48
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 2, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 4, pass: 10
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 149, pass: 1001
* ltp-timers-tests - skip: 1, pass: 12
qemu_x86_64
* boot - pass: 22
* kselftest - skip: 23, pass: 57
* kselftest-vsyscall-mode-native - skip: 23, pass: 57
* kselftest-vsyscall-mode-none - skip: 23, pass: 57
* libhugetlbfs - skip: 1, pass: 90
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 6, pass: 57
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 148, pass: 1002
* ltp-timers-tests - skip: 1, pass: 12
x15 - arm
* boot - pass: 20
* kselftest - skip: 21, pass: 41
* libhugetlbfs - skip: 1, fail: 1, pass: 86
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 18, pass: 63
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 2, pass: 61
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - skip: 2, pass: 20
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 1, pass: 13
* ltp-securebits-tests - pass: 4
* ltp-syscalls-tests - skip: 97, pass: 1053
* ltp-timers-tests - skip: 1, pass: 12
x86_64
* boot - pass: 22
* kselftest - skip: 19, pass: 61
* kselftest-vsyscall-mode-native - skip: 19, pass: 61
* kselftest-vsyscall-mode-none - skip: 19, fail: 1, pass: 60
* libhugetlbfs - skip: 1, pass: 89
* ltp-cap_bounds-tests - pass: 2
* ltp-containers-tests - skip: 17, pass: 64
* ltp-fcntl-locktests-tests - pass: 2
* ltp-filecaps-tests - pass: 2
* ltp-fs-tests - skip: 1, pass: 62
* ltp-fs_bind-tests - pass: 2
* ltp-fs_perms_simple-tests - pass: 19
* ltp-fsx-tests - pass: 2
* ltp-hugetlb-tests - pass: 22
* ltp-io-tests - pass: 3
* ltp-ipc-tests - pass: 9
* ltp-math-tests - pass: 11
* ltp-nptl-tests - pass: 2
* ltp-pty-tests - pass: 4
* ltp-sched-tests - skip: 5, pass: 9
* ltp-securebits-tests - pass: 3
* ltp-syscalls-tests - skip: 119, pass: 1031
* ltp-timers-tests - skip: 1, pass: 12
--
Linaro QA (beta)
https://qa-reports.linaro.org
stable-rc/linux-4.15.y boot: 65 boots: 0 failed, 62 passed with 3 untried/unknown (v4.15.15-73-g1abb272b72b7)
stable-rc/linux-4.15.y boot: 65 boots: 0 failed, 62 passed with 3 untried/unknown (v4.15.15-73-g1abb272b72b7)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.15.y/kernel/v4.15.15-73-g1abb272b72b7/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.15.y/kernel/v4.15.15-73-g1abb272b72b7/
Tree: stable-rc
Branch: linux-4.15.y
Git Describe: v4.15.15-73-g1abb272b72b7
Git Commit: 1abb272b72b7242da1c7b6bb5a57bfe7d6ac15e1
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 32 unique boards, 14 SoC families, 15 builds out of 185
---
For more info write to <[email protected]>
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.15.16 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Apr 8 08:43:10 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.16-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.15.y
and the diffstat can be found below.thanks,
greg k-h
Merged with bionic, built successfully on amd64, i386, s390x, armhf and ppc64el. I have some problems with the arm64 cross toolchain, not related to the kernel, so builds for arm64 have been failing. So I can report the status for that right now.
Boot tested on ppc64el on a Unicamp minicloud VM.
Using it without any problems on my Thinkpad X200 with the amd64 kernel.
Cascardo.
Greg Kroah-Hartman
maintainerQuoted 19 lines · Thadeu Lima de Souza Cascardo
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.15.16 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Apr 8 08:43:10 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.16-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.15.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 8 lines
Merged with bionic, built successfully on amd64, i386, s390x, armhf and ppc64el. I have some problems with the arm64 cross toolchain, not related to the kernel, so builds for arm64 have been failing. So I can report the status for that right now.
Boot tested on ppc64el on a Unicamp minicloud VM.
Using it without any problems on my Thinkpad X200 with the amd64 kernel.
Great, thanks for testing and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.15.16 release. There are 72 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Apr 8 08:43:10 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.15.16-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.15.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah