4.14.67-stable review
Subsystems (6)
Greg Kroah-Hartman
maintainerPATCH 192/217 PCI: versatile: Fix I/O space page leak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
[ Upstream commit 0018b265adf7e251f90d3ca1c7c0e32e2a0ad262 ]
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.
The Versatile PCI controller driver has the same issue. Replace pci_remap_iospace() with the devm_ managed version to fix the bug.
--- drivers/pci/host/pci-versatile.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/host/pci-versatile.c +1 -1
@@ -89,7 +89,7 @@ static int versatile_pci_parse_request_oswitch (resource_type (res)) {case IORESOURCE_IO : - err =pci_remap_iospace (res, iobase); + err =devm_pci_remap_iospace (dev, res, iobase);if (err) {dev_warn (dev,"error %d: failed to map resource %pR\n" , err, res);
Greg Kroah-Hartman
maintainerPATCH 193/217 net: qca_spi: Avoid packet drop during initial sync
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit b2bab426dc715de147f8039a3fccff27d795f4eb ]
As long as the synchronization with the QCA7000 isn't finished, we cannot accept packets from the upper layers. So let the SPI thread enable the TX queue after sync and avoid unwanted packet drop.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qualcomm/qca_spi.c +1 -1
@@ -658,7 +658,7 @@ qcaspi_netdev_open(struct net_device *dereturn ret; } -netif_start_queue (qca->net_dev); +/* SPI thread takes care of TX queue */ return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 194/217 net: qca_spi: Make sure the QCA7000 reset is triggered
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 711c62dfa6bdb4326ca6c587f295ea5c4f7269de ]
In case the SPI thread is not running, a simple reset of sync state won't fix the transmit timeout. We also need to wake up the kernel thread.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/qualcomm/qca_spi.c +3 -0
@@ -761,6 +761,9 @@ qcaspi_netdev_tx_timeout(struct net_devi qca->net_dev->stats.tx_errors++;/* Trigger tx queue flush and QCA7000 reset */ qca->sync =QCASPI_SYNC_UNKNOWN ; + +if (qca->spi_thread) +wake_up_process (qca->spi_thread); } static int
Greg Kroah-Hartman
maintainerPATCH 195/217 net: qca_spi: Fix log level if probe fails
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit 50973993260a6934f0a00da53d9b746cfbea89ab ]
In cases the probing fails the log level of the messages should be an error.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/qualcomm/qca_spi.c +8 -8
@@ -882,22 +882,22 @@ qca_spi_probe(struct spi_device *spi)if ((qcaspi_clkspeed <QCASPI_CLK_SPEED_MIN ) || (qcaspi_clkspeed >QCASPI_CLK_SPEED_MAX )) { -dev_info (&spi->dev,"Invalid clkspeed: %d\n" , - qcaspi_clkspeed); +dev_err (&spi->dev,"Invalid clkspeed: %d\n" , + qcaspi_clkspeed);return -EINVAL ; }if ((qcaspi_burst_len <QCASPI_BURST_LEN_MIN ) || (qcaspi_burst_len >QCASPI_BURST_LEN_MAX )) { -dev_info (&spi->dev,"Invalid burst len: %d\n" , - qcaspi_burst_len); +dev_err (&spi->dev,"Invalid burst len: %d\n" , + qcaspi_burst_len);return -EINVAL ; }if ((qcaspi_pluggable <QCASPI_PLUGGABLE_MIN ) || (qcaspi_pluggable >QCASPI_PLUGGABLE_MAX )) { -dev_info (&spi->dev,"Invalid pluggable: %d\n" , - qcaspi_pluggable); +dev_err (&spi->dev,"Invalid pluggable: %d\n" , + qcaspi_pluggable);return -EINVAL ; }
@@ -959,8 +959,8 @@ qca_spi_probe(struct spi_device *spi) }if (register_netdev (qcaspi_devs)) { -dev_info (&spi->dev,"Unable to register net device %s\n" , - qcaspi_devs->name); +dev_err (&spi->dev,"Unable to register net device %s\n" , + qcaspi_devs->name);free_netdev (qcaspi_devs);return -EFAULT ; }
Greg Kroah-Hartman
maintainerPATCH 197/217 soc: imx: gpc: restrict register range for regmap access
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anson Huang <[email protected]>
[ Upstream commit de2d9b5284bcb5c159c5882ac69f6bfd4dec7c67 ]
GPC registers are NOT continuous, some registers are reserved and accessing them from userspace will trigger external abort, add regmap register access table to avoid below abort:
root@imx6slevk:~# cat /sys/kernel/debug/regmap/20dc000.gpc/registers [ 108.480477] Unhandled fault: imprecise external abort (0x1406) at 0xb6db5004 [ 108.487985] pgd = 42b54bfd [ 108.490741] [b6db5004] *pgd=ba1b7831 [ 108.494386] Internal error: : 1406 [#1] SMP ARM [ 108.498943] Modules linked in: [ 108.502043] CPU: 0 PID: 389 Comm: cat Not tainted 4.18.0-rc1-00074-gc9f1f60-dirty #482 [ 108.509982] Hardware name: Freescale i.MX6 SoloLite (Device Tree) [ 108.516123] PC is at regmap_mmio_read32le+0x20/0x24 [ 108.521031] LR is at regmap_mmio_read+0x40/0x60 [ 108.525586] pc : [<c059cf74>] lr : [<c059d1ac>] psr: 20060093 [ 108.531875] sp : eccf1d98 ip : eccf1da8 fp : eccf1da4 [ 108.537122] r10: ec2d3800 r9 : eccf1f60 r8 : ecfc0000 [ 108.542370] r7 : eccf1e2c r6 : eccf1e2c r5 : 00000028 r4 : ec338e00 [ 108.548920] r3 : 00000000 r2 : eccf1e2c r1 : f0980028 r0 : 00000000 [ 108.555474] Flags: nzCv IRQs off FIQs on Mode SVC_32 ISA ARM Segment none [ 108.562720] Control: 10c5387d Table: acf4004a DAC: 00000051 [ 108.568491] Process cat (pid: 389, stack limit = 0xd4318a65) [ 108.574174] Stack: (0xeccf1d98 to 0xeccf2000)
--- drivers/soc/imx/gpc.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/soc/imx/gpc.c +21 -0
@@ -27,9 +27,16 @@#define GPC_PGC_SW2ISO_SHIFT 0x8#define GPC_PGC_SW_SHIFT 0x0 +#define GPC_PGC_PCI_PDN 0x200 +#define GPC_PGC_PCI_SR 0x20c +#define GPC_PGC_GPU_PDN 0x260#define GPC_PGC_GPU_PUPSCR 0x264#define GPC_PGC_GPU_PDNSCR 0x268 +#define GPC_PGC_GPU_SR 0x26c + +#define GPC_PGC_DISP_PDN 0x240 +#define GPC_PGC_DISP_SR 0x24c#define GPU_VPU_PUP_REQ BIT(1)#define GPU_VPU_PDN_REQ BIT(0)
@@ -303,10 +310,24 @@ static const struct of_device_id imx_gpc { } }; +static const struct regmap_range yes_ranges[] = { +regmap_reg_range (GPC_CNTR ,GPC_CNTR ), +regmap_reg_range (GPC_PGC_PCI_PDN ,GPC_PGC_PCI_SR ), +regmap_reg_range (GPC_PGC_GPU_PDN ,GPC_PGC_GPU_SR ), +regmap_reg_range (GPC_PGC_DISP_PDN ,GPC_PGC_DISP_SR ), +}; + +static const struct regmap_access_table access_table = { + .yes_ranges = yes_ranges, + .n_yes_ranges =ARRAY_SIZE (yes_ranges), +}; +static const struct regmap_config imx_gpc_regmap_config = { .reg_bits =32 , .val_bits =32 , .reg_stride =4 , + .rd_table = &access_table, + .wr_table = &access_table, .max_register =0x2ac , };
Greg Kroah-Hartman
maintainerPATCH 198/217 ACPI / EC: Use ec_no_wakeup on more Thinkpad X1 Carbon 6th systems
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Robin H. Johnson" <[email protected]>
[ Upstream commit 2c4d6baf1bc4f7729773ffcee9ba2a9781578633 ]
The ec_no_wakeup matcher added for Thinkpad X1 Carbon 6th gen systems beyond matched only a single DMI model (20KGS3JF01), that didn't cover my laptop (20KH002JUS). Change to match based on DMI product family to cover all X1 6th gen systems.
--- drivers/acpi/ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/ec.c +1 -1
@@ -2034,7 +2034,7 @@ static const struct dmi_system_id acpi_e .ident = "Thinkpad X1 Carbon 6th", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), - DMI_MATCH(DMI_PRODUCT_NAME, "20KGS3JF01"), + DMI_MATCH(DMI_PRODUCT_FAMILY, "Thinkpad X1 Carbon 6th"), }, }, { },
Greg Kroah-Hartman
maintainerPATCH 200/217 nvme: fix handling of metadata_len for NVME_IOCTL_IO_CMD
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
[ Upstream commit 9b382768135ee3ff282f828c906574a8478e036b ]
The old code in nvme_user_cmd() passed the userspace virtual address from nvme_passthru_cmd.metadata as the length of the metadata buffer as well as the address to nvme_submit_user_cmd().
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -1016,7 +1016,7 @@ static int nvme_user_cmd(struct nvme_ctr status =nvme_submit_user_cmd (ns ? ns->queue : ctrl->admin_q, &c, (void __user *)(uintptr_t )cmd.addr, cmd.data_len, - (void __user *)(uintptr_t )cmd.metadata, cmd.metadata, + (void __user *)(uintptr_t )cmd.metadata, cmd.metadata_len,0 , &cmd.result, timeout);if (status >=0 ) {if (put_user (cmd.result, &ucmd->result))
Greg Kroah-Hartman
maintainerPATCH 201/217 KVM: irqfd: fix race between EPOLLHUP and irq_bypass_register_consumer
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Bonzini <[email protected]>
commit 9432a3175770e06cb83eada2d91fac90c977cb99 upstream.
A comment warning against this bug is there, but the code is not doing what the comment says. Therefore it is possible that an EPOLLHUP races against irq_bypass_register_consumer. The EPOLLHUP handler schedules irqfd_shutdown, and if that runs soon enough, you get a use-after-free.
--- virt/kvm/eventfd.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
virt/kvm/eventfd.c +6 -5
@@ -405,11 +405,6 @@ kvm_irqfd_assign(struct kvm *kvm, structif (events &POLLIN )schedule_work (&irqfd->inject); -/* -* do not drop the file until the irqfd is fully initialized, otherwise -* we might race against the POLLHUP -*/ -fdput (f);#ifdef CONFIG_HAVE_KVM_IRQ_BYPASS if (kvm_arch_has_irq_bypass ()) { irqfd->consumer.token = (void *)irqfd->eventfd;
@@ -425,6 +420,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct#endif srcu_read_unlock (&kvm->irq_srcu, idx); + +/* +* do not drop the file until the irqfd is fully initialized, otherwise +* we might race against the POLLHUP +*/ +fdput (f);return 0 ; fail:
Greg Kroah-Hartman
maintainerPATCH 202/217 f2fs: return error during fill_super
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit c39a1b348c4fe172729eff77c533dabc3c7cdaa7 upstream.
Let's avoid BUG_ON during fill_super, when on-disk was totall corrupted.
--- fs/f2fs/segment.c | 16 ++++++++++++---- fs/f2fs/segment.h | 22 ++++++++++++++++++---- 2 files changed, 30 insertions(+), 8 deletions(-)
fs/f2fs/segment.c +12 -4
@@ -3240,7 +3240,7 @@ static int build_curseg(struct f2fs_sb_ireturn restore_curseg_summaries (sbi); } -static void build_sit_entries (struct f2fs_sb_info *sbi) +static int build_sit_entries (struct f2fs_sb_info *sbi) {struct sit_info *sit_i =SIT_I (sbi);struct curseg_info *curseg =CURSEG_I (sbi,CURSEG_COLD_DATA );
@@ -3250,6 +3250,7 @@ static void build_sit_entries(struct f2fint sit_blk_cnt =SIT_BLK_CNT (sbi);unsigned int i, start, end;unsigned int readed, start_blk =0 ; +int err =0 ; do { readed = ra_meta_pages(sbi, start_blk, BIO_MAX_PAGES,
@@ -3268,7 +3269,9 @@ static void build_sit_entries(struct f2f sit = sit_blk->entries[SIT_ENTRY_OFFSET (sit_i, start)];f2fs_put_page (page,1 ); -check_block_count (sbi, start, &sit); + err =check_block_count (sbi, start, &sit); +if (err) +return err;seg_info_from_raw_sit (se, &sit);/* build discard map only one time */
@@ -3303,7 +3306,9 @@ static void build_sit_entries(struct f2f old_valid_blocks = se->valid_blocks; -check_block_count (sbi, start, &sit); + err =check_block_count (sbi, start, &sit); +if (err) +break ;seg_info_from_raw_sit (se, &sit);if (f2fs_discard_en (sbi)) {
@@ -3323,6 +3328,7 @@ static void build_sit_entries(struct f2f se->valid_blocks - old_valid_blocks; }up_read (&curseg->journal_rwsem); +return err; }static void init_free_segmap (struct f2fs_sb_info *sbi)
@@ -3492,7 +3498,9 @@ int build_segment_manager(struct f2fs_sbreturn err;/* reinit free segmap based on SIT */ -build_sit_entries (sbi); + err =build_sit_entries (sbi); +if (err) +return err;init_free_segmap (sbi); err =build_dirty_segmap (sbi);
fs/f2fs/segment.h +18 -4
@@ -625,7 +625,7 @@ static inline void verify_block_addr(str/* * Summary block is always treated as an invalid block */ -static inline void check_block_count (struct f2fs_sb_info *sbi, +static inline int check_block_count (struct f2fs_sb_info *sbi,int segno,struct f2fs_sit_entry *raw_sit) {#ifdef CONFIG_F2FS_CHECK_FS
@@ -647,11 +647,25 @@ static inline void check_block_count(str cur_pos = next_pos; is_valid = !is_valid; } while (cur_pos < sbi->blocks_per_seg); -BUG_ON (GET_SIT_VBLOCKS (raw_sit) != valid_blocks); + +if (unlikely (GET_SIT_VBLOCKS (raw_sit) != valid_blocks)) { +f2fs_msg (sbi->sb,KERN_ERR , +"Mismatch valid blocks %d vs. %d" , +GET_SIT_VBLOCKS (raw_sit), valid_blocks); +set_sbi_flag (sbi,SBI_NEED_FSCK ); +return -EINVAL ; + }#endif /* check segment usage, and check boundary of a given segment number */ -f2fs_bug_on (sbi,GET_SIT_VBLOCKS (raw_sit) > sbi->blocks_per_seg - || segno >TOTAL_SEGS (sbi) -1 ); +if (unlikely (GET_SIT_VBLOCKS (raw_sit) > sbi->blocks_per_seg + || segno >TOTAL_SEGS (sbi) -1 )) { +f2fs_msg (sbi->sb,KERN_ERR , +"Wrong valid blocks %d or segno %u" , +GET_SIT_VBLOCKS (raw_sit), segno); +set_sbi_flag (sbi,SBI_NEED_FSCK ); +return -EINVAL ; + } +return 0 ; } static inline pgoff_t current_sit_addr(struct f2fs_sb_info *sbi,
Greg Kroah-Hartman
maintainerPATCH 203/217 f2fs: sanity check for total valid node blocks
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 8a29c1260e24e7c9c6ab138aa0017558d8b28208 upstream.
This patch enhances sanity check for SIT entries.
syzbot hit the following crash on upstream commit 83beed7b2b26f232d782127792dd0cd4362fdc41 (Fri Apr 20 17:56:32 2018 +0000)
Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal
syzbot dashboard link: https://syzkaller.appspot.com/bug?extid=bf9253040425feb155ad
syzkaller reproducer: https://syzkaller.appspot.com/x/repro.syz?id=5692130282438656
Raw console output: https://syzkaller.appspot.com/x/log.txt?id=5095924598571008
Kernel config: https://syzkaller.appspot.com/x/.config?id=1808800213120130118
compiler: gcc (GCC) 8.0.1 20180413 (experimental)
IMPORTANT: if you fix the bug, please add the following tag to the commit:
It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer.
F2FS-fs (loop0): invalid crc value
F2FS-fs (loop0): Try to recover 1th superblock, ret: 0 F2FS-fs (loop0): Mounted with checkpoint version = d F2FS-fs (loop0): Bitmap was wrongly cleared, blk:9740
------------[ cut here ]------------ kernel BUG at fs/f2fs/segment.c:1884! invalid opcode: 0000 [#1] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 4508 Comm: syz-executor0 Not tainted 4.17.0-rc1+ #10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882 RSP: 0018:ffff8801af526708 EFLAGS: 00010282 RAX: ffffed0035ea4cc0 RBX: ffff8801ad454f90 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff82eeb87e RDI: ffffed0035ea4cb6 RBP: ffff8801af526760 R08: ffff8801ad4a2480 R09: ffffed003b5e4f90 R10: ffffed003b5e4f90 R11: ffff8801daf27c87 R12: ffff8801adb8d380 R13: 0000000000000001 R14: 0000000000000008 R15: 00000000ffffffff FS: 00000000014af940(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f06bc223000 CR3: 00000001adb02000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: allocate_data_block+0x66f/0x2050 fs/f2fs/segment.c:2663 do_write_page+0x105/0x1b0 fs/f2fs/segment.c:2727 write_node_page+0x129/0x350 fs/f2fs/segment.c:2770 __write_node_page+0x7da/0x1370 fs/f2fs/node.c:1398 sync_node_pages+0x18cf/0x1eb0 fs/f2fs/node.c:1652 block_operations+0x429/0xa60 fs/f2fs/checkpoint.c:1088 write_checkpoint+0x3ba/0x5380 fs/f2fs/checkpoint.c:1405 f2fs_sync_fs+0x2fb/0x6a0 fs/f2fs/super.c:1077 __sync_filesystem fs/sync.c:39 [inline] sync_filesystem+0x265/0x310 fs/sync.c:67 generic_shutdown_super+0xd7/0x520 fs/super.c:429 kill_block_super+0xa4/0x100 fs/super.c:1191 kill_f2fs_super+0x9f/0xd0 fs/f2fs/super.c:3030 deactivate_locked_super+0x97/0x100 fs/super.c:316 deactivate_super+0x188/0x1b0 fs/super.c:347 cleanup_mnt+0xbf/0x160 fs/namespace.c:1174 __cleanup_mnt+0x16/0x20 fs/namespace.c:1181 task_work_run+0x1e4/0x290 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x2bd/0x310 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:265 [inline] do_syscall_64+0x6ac/0x800 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457d97 RSP: 002b:00007ffd46f9c8e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000457d97 RDX: 00000000014b09a3 RSI: 0000000000000002 RDI: 00007ffd46f9da50 RBP: 00007ffd46f9da50 R08: 0000000000000000 R09: 0000000000000009 R10: 0000000000000005 R11: 0000000000000246 R12: 00000000014b0940 R13: 0000000000000000 R14: 0000000000000002 R15: 000000000000658e RIP: update_sit_entry+0x1215/0x1590 fs/f2fs/segment.c:1882 RSP: ffff8801af526708 ---[ end trace f498328bb02610a2 ]---
--- fs/f2fs/segment.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/f2fs/segment.c +16 -0
@@ -3251,6 +3251,7 @@ static int build_sit_entries(struct f2fsunsigned int i, start, end;unsigned int readed, start_blk =0 ;int err =0 ; +block_t total_node_blocks =0 ; do { readed = ra_meta_pages(sbi, start_blk, BIO_MAX_PAGES,
@@ -3273,6 +3274,8 @@ static int build_sit_entries(struct f2fsif (err)return err;seg_info_from_raw_sit (se, &sit); +if (IS_NODESEG (se->type)) + total_node_blocks += se->valid_blocks;/* build discard map only one time */ if (f2fs_discard_en (sbi)) {
@@ -3305,11 +3308,15 @@ static int build_sit_entries(struct f2fs sit =sit_in_journal (journal, i); old_valid_blocks = se->valid_blocks; +if (IS_NODESEG (se->type)) + total_node_blocks -= old_valid_blocks; err =check_block_count (sbi, start, &sit);if (err)break ;seg_info_from_raw_sit (se, &sit); +if (IS_NODESEG (se->type)) + total_node_blocks += se->valid_blocks;if (f2fs_discard_en (sbi)) {if (is_set_ckpt_flags (sbi,CP_TRIMMED_FLAG )) {
@@ -3328,6 +3335,15 @@ static int build_sit_entries(struct f2fs se->valid_blocks - old_valid_blocks; }up_read (&curseg->journal_rwsem); + +if (!err && total_node_blocks !=valid_node_count (sbi)) { +f2fs_msg (sbi->sb,KERN_ERR , +"SIT is corrupted node# %u vs %u" , + total_node_blocks,valid_node_count (sbi)); +set_sbi_flag (sbi,SBI_NEED_FSCK ); + err = -EINVAL ; + } +return err; }
Greg Kroah-Hartman
maintainerPATCH 205/217 xfrm_user: prevent leaking 2 bytes of kernel memory
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 45c180bc29babbedd6b8c01b975780ef44d9d09c upstream.
struct xfrm_userpolicy_type has two holes, so we should not use C99 style initializer.
KMSAN report:
BUG: KMSAN: kernel-infoleak in copyout lib/iov_iter.c:140 [inline] BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571 CPU: 1 PID: 4520 Comm: syz-executor841 Not tainted 4.17.0+ #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x185/0x1d0 lib/dump_stack.c:113 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:1117 kmsan_internal_check_memory+0x138/0x1f0 mm/kmsan/kmsan.c:1211 kmsan_copy_to_user+0x7a/0x160 mm/kmsan/kmsan.c:1253 copyout lib/iov_iter.c:140 [inline] _copy_to_iter+0x1b14/0x2800 lib/iov_iter.c:571 copy_to_iter include/linux/uio.h:106 [inline] skb_copy_datagram_iter+0x422/0xfa0 net/core/datagram.c:431 skb_copy_datagram_msg include/linux/skbuff.h:3268 [inline] netlink_recvmsg+0x6f1/0x1900 net/netlink/af_netlink.c:1959 sock_recvmsg_nosec net/socket.c:802 [inline] sock_recvmsg+0x1d6/0x230 net/socket.c:809 ___sys_recvmsg+0x3fe/0x810 net/socket.c:2279 __sys_recvmmsg+0x58e/0xe30 net/socket.c:2391 do_sys_recvmmsg+0x2a6/0x3e0 net/socket.c:2472 __do_sys_recvmmsg net/socket.c:2485 [inline] __se_sys_recvmmsg net/socket.c:2481 [inline] __x64_sys_recvmmsg+0x15d/0x1c0 net/socket.c:2481 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x446ce9 RSP: 002b:00007fc307918db8 EFLAGS: 00000293 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000006dbc24 RCX: 0000000000446ce9 RDX: 000000000000000a RSI: 0000000020005040 RDI: 0000000000000003 RBP: 00000000006dbc20 R08: 0000000020004e40 R09: 0000000000000000 R10: 0000000040000000 R11: 0000000000000293 R12: 0000000000000000 R13: 00007ffc8d2df32f R14: 00007fc3079199c0 R15: 0000000000000001
Uninit was stored to memory at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:279 [inline] kmsan_save_stack mm/kmsan/kmsan.c:294 [inline] kmsan_internal_chain_origin+0x12b/0x210 mm/kmsan/kmsan.c:685 kmsan_memcpy_origins+0x11d/0x170 mm/kmsan/kmsan.c:527 __msan_memcpy+0x109/0x160 mm/kmsan/kmsan_instr.c:413 __nla_put lib/nlattr.c:569 [inline] nla_put+0x276/0x340 lib/nlattr.c:627 copy_to_user_policy_type net/xfrm/xfrm_user.c:1678 [inline] dump_one_policy+0xbe1/0x1090 net/xfrm/xfrm_user.c:1708 xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013 xfrm_dump_policy+0x1c0/0x2a0 net/xfrm/xfrm_user.c:1749 netlink_dump+0x9b5/0x1550 net/netlink/af_netlink.c:2226 __netlink_dump_start+0x1131/0x1270 net/netlink/af_netlink.c:2323 netlink_dump_start include/linux/netlink.h:214 [inline] xfrm_user_rcv_msg+0x8a3/0x9b0 net/xfrm/xfrm_user.c:2577 netlink_rcv_skb+0x37e/0x600 net/netlink/af_netlink.c:2448 xfrm_netlink_rcv+0xb2/0xf0 net/xfrm/xfrm_user.c:2598 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x1680/0x1750 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x104f/0x1350 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg net/socket.c:639 [inline] ___sys_sendmsg+0xec8/0x1320 net/socket.c:2117 __sys_sendmsg net/socket.c:2155 [inline] __do_sys_sendmsg net/socket.c:2164 [inline] __se_sys_sendmsg net/socket.c:2162 [inline] __x64_sys_sendmsg+0x331/0x460 net/socket.c:2162 do_syscall_64+0x15b/0x230 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Local variable description: ----upt.i@dump_one_policy Variable was created at: dump_one_policy+0x78/0x1090 net/xfrm/xfrm_user.c:1689 xfrm_policy_walk+0x45a/0xd00 net/xfrm/xfrm_policy.c:1013
Byte 130 of 137 is uninitialized
Memory access starts at ffff88019550407f
--- net/xfrm/xfrm_user.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
net/xfrm/xfrm_user.c +5 -3
@@ -1665,9 +1665,11 @@ static inline size_t userpolicy_type_att#ifdef CONFIG_XFRM_SUB_POLICY static int copy_to_user_policy_type (u8 type,struct sk_buff *skb) { -struct xfrm_userpolicy_type upt = { - .type = type, - }; +struct xfrm_userpolicy_type upt; + +/* Sadly there are two holes in struct xfrm_userpolicy_type */ +memset (&upt,0 ,sizeof (upt)); + upt.type = type;return nla_put (skb,XFRMA_POLICY_TYPE ,sizeof (upt), &upt); }
Greg Kroah-Hartman
maintainerPATCH 206/217 netfilter: conntrack: dccp: treat SYNC/SYNCACK as invalid if no prior state
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <[email protected]>
commit 6613b6173dee098997229caf1f3b961c49da75e6 upstream.
When first DCCP packet is SYNC or SYNCACK, we insert a new conntrack that has an un-initialized timeout value, i.e. such entry could be reaped at any time.
Mark them as INVALID and only ignore SYNC/SYNCACK when connection had an old state.
--- net/netfilter/nf_conntrack_proto_dccp.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netfilter/nf_conntrack_proto_dccp.c +4 -4
@@ -243,14 +243,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D* We currently ignore Sync packets * * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ - sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, }, [DCCP_PKT_SYNCACK] = {/* * We currently ignore SyncAck packets * * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ - sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, }, }, [CT_DCCP_ROLE_SERVER] = {
@@ -371,14 +371,14 @@ dccp_state_table[CT_DCCP_ROLE_MAX + 1][D* We currently ignore Sync packets * * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ - sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, }, [DCCP_PKT_SYNCACK] = {/* * We currently ignore SyncAck packets * * sNO, sRQ, sRS, sPO, sOP, sCR, sCG, sTW */ - sIG, sIG, sIG, sIG, sIG, sIG, sIG, sIG, + sIV, sIG, sIG, sIG, sIG, sIG, sIG, sIG, }, }, };
Greg Kroah-Hartman
maintainerPATCH 207/217 packet: refine ring v3 block size test to hold one frame
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <[email protected]>
commit 4576cd469d980317c4edd9173f8b694aa71ea3a3 upstream.
TPACKET_V3 stores variable length frames in fixed length blocks. Blocks must be able to store a block header, optional private space and at least one minimum sized frame.
Frames, even for a zero snaplen packet, store metadata headers and optional reserved space.
In the block size bounds check, ensure that the frame of the chosen configuration fits. This includes sockaddr_ll and optional tp_reserve.
Syzbot was able to construct a ring with insuffient room for the sockaddr_ll in the header of a zero-length frame, triggering an out-of-bounds write in dev_parse_header.
Convert the comparison to less than, as zero is a valid snap len. This matches the test for minimum tp_frame_size immediately below.
--- net/packet/af_packet.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/packet/af_packet.c +6 -4
@@ -4269,6 +4269,8 @@ static int packet_set_ring(struct sock * }if (req->tp_block_nr) { +unsigned int min_frame_size; +/* Sanity tests and some calculations */ err = -EBUSY ;if (unlikely (rb->pg_vec))
@@ -4291,12 +4293,12 @@ static int packet_set_ring(struct sock * goto out;if (unlikely (!PAGE_ALIGNED (req->tp_block_size))) goto out; + min_frame_size = po->tp_hdrlen + po->tp_reserve;if (po->tp_version >=TPACKET_V3 && - req->tp_block_size <= -BLK_PLUS_PRIV ((u64 )req_u->req3.tp_sizeof_priv) +sizeof (struct tpacket3_hdr )) + req->tp_block_size < +BLK_PLUS_PRIV ((u64 )req_u->req3.tp_sizeof_priv) + min_frame_size) goto out; -if (unlikely (req->tp_frame_size < po->tp_hdrlen + - po->tp_reserve)) +if (unlikely (req->tp_frame_size < min_frame_size)) goto out;if (unlikely (req->tp_frame_size & (TPACKET_ALIGNMENT -1 ))) goto out;
Greg Kroah-Hartman
maintainerPATCH 208/217 net/smc: no shutdown in state SMC_LISTEN
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <[email protected]>
commit caa21e19e08d7a1445116a93f7ab4e187ebbbadb upstream.
Invoking shutdown for a socket in state SMC_LISTEN does not make sense. Nevertheless programs like syzbot fuzzing the kernel may try to do this. For SMC this means a socket refcounting problem. This patch makes sure a shutdown call for an SMC socket in state SMC_LISTEN simply returns with -ENOTCONN.
--- net/smc/af_smc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
net/smc/af_smc.c +1 -2
@@ -1180,8 +1180,7 @@ static int smc_shutdown(struct socket *slock_sock (sk); rc = -ENOTCONN ; - if ((sk->sk_state != SMC_LISTEN) && - (sk->sk_state != SMC_ACTIVE) && + if ((sk->sk_state != SMC_ACTIVE) && (sk->sk_state != SMC_PEERCLOSEWAIT1) && (sk->sk_state != SMC_PEERCLOSEWAIT2) && (sk->sk_state != SMC_APPCLOSEWAIT1) &&
Greg Kroah-Hartman
maintainerPATCH 210/217 PCI: OF: Fix I/O space page leak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.
Introduce the devm_pci_remap_iospace() managed API and replace the pci_remap_iospace() call with it to fix the bug.
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)
drivers/pci/pci.c +38 -0
@@ -3446,6 +3446,44 @@ void pci_unmap_iospace(struct resource * }EXPORT_SYMBOL (pci_unmap_iospace); +static void devm_pci_unmap_iospace (struct device *dev,void *ptr) +{ +struct resource **res = ptr; + +pci_unmap_iospace (*res); +} + +/** +* devm_pci_remap_iospace - Managed pci_remap_iospace() +* @dev: Generic device to remap IO address for +* @res: Resource describing the I/O space +* @phys_addr: physical address of range to be mapped +* +* Managed pci_remap_iospace(). Map is automatically unmapped on driver +* detach. +*/ +int devm_pci_remap_iospace (struct device *dev,const struct resource *res, +phys_addr_t phys_addr) +{ +const struct resource **ptr; +int error; + + ptr =devres_alloc (devm_pci_unmap_iospace,sizeof (*ptr),GFP_KERNEL ); +if (!ptr) +return -ENOMEM ; + + error =pci_remap_iospace (res, phys_addr); +if (error) { +devres_free (ptr); + }else { + *ptr = res; +devres_add (dev, ptr); + } + +return error; +} +EXPORT_SYMBOL (devm_pci_remap_iospace); +/** * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace() * @dev: Generic device to remap IO address for
include/linux/pci.h +2 -0
@@ -1235,6 +1235,8 @@ int pci_register_io_range(phys_addr_t adunsigned long pci_address_to_pio (phys_addr_t addr);phys_addr_t pci_pio_to_address (unsigned long pio);int pci_remap_iospace (const struct resource *res,phys_addr_t phys_addr); +int devm_pci_remap_iospace (struct device *dev,const struct resource *res, +phys_addr_t phys_addr);void pci_unmap_iospace (struct resource *res); void __iomem *devm_pci_remap_cfgspace(struct device *dev, resource_size_t offset,
Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)
You missed a chnage to drivers/pci/host/pci-host-common.c (and
also drivers/pci/host/pcie-rcar.c which wasn't using the generic mode back then)...
[...]
MBR, Sergei
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 75 lines · Sergei Shtylyov
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 8 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode back then)...
Yes I totally messed this up, let me fix it...
Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 81 lines · Greg Kroah-Hartman
Quoted 80 lines · Sergei Shtylyov
Quoted 77 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)
Quoted 5 lines
Quoted 3 lines
You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode back then)...Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
thanks,
greg k-h
------------------------
From a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 Mon Sep 17 00:00:00 2001
From: Sergei Shtylyov <[email protected]>
Date: Wed, 18 Jul 2018 15:40:26 -0500
Subject: PCI: OF: Fix I/O space page leak
From: Sergei Shtylyov <[email protected]>
commit a5fb9fb023a1435f2b42bccd7f547560f3a21dc3 upstream.
When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at lib/ioremap.c:72!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)
It turned out that pci_remap_iospace() wasn't undone when the driver's probe failed, and since devm_phy_optional_get() returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.
Introduce the devm_pci_remap_iospace() managed API and replace the pci_remap_iospace() call with it to fix the bug.
drivers/pci/host/pci-host-common.c +1 -1
@@ -612,7 +612,7 @@ int pci_parse_request_of_pci_ranges(struct device *dev,switch (resource_type (res)) {case IORESOURCE_IO : - err =pci_remap_iospace (res, iobase); + err =devm_pci_remap_iospace (dev, res, iobase);if (err) {dev_warn (dev,"error %d: failed to map resource %pR\n" , err, res);
drivers/pci/pci.c +38 -0
@@ -3579,6 +3579,44 @@ void pci_unmap_iospace(struct resource *res) }EXPORT_SYMBOL (pci_unmap_iospace); +static void devm_pci_unmap_iospace (struct device *dev,void *ptr) +{ +struct resource **res = ptr; + +pci_unmap_iospace (*res); +} + +/** +* devm_pci_remap_iospace - Managed pci_remap_iospace() +* @dev: Generic device to remap IO address for +* @res: Resource describing the I/O space +* @phys_addr: physical address of range to be mapped +* +* Managed pci_remap_iospace(). Map is automatically unmapped on driver +* detach. +*/ +int devm_pci_remap_iospace (struct device *dev,const struct resource *res, +phys_addr_t phys_addr) +{ +const struct resource **ptr; +int error; + + ptr =devres_alloc (devm_pci_unmap_iospace,sizeof (*ptr),GFP_KERNEL ); +if (!ptr) +return -ENOMEM ; + + error =pci_remap_iospace (res, phys_addr); +if (error) { +devres_free (ptr); + }else { + *ptr = res; +devres_add (dev, ptr); + } + +return error; +} +EXPORT_SYMBOL (devm_pci_remap_iospace); +/** * devm_pci_remap_cfgspace - Managed pci_remap_cfgspace() * @dev: Generic device to remap IO address for
include/linux/pci.h +2 -0
@@ -1240,6 +1240,8 @@ int pci_register_io_range(struct fwnode_handle *fwnode, phys_addr_t addr,unsigned long pci_address_to_pio (phys_addr_t addr);phys_addr_t pci_pio_to_address (unsigned long pio);int pci_remap_iospace (const struct resource *res,phys_addr_t phys_addr); +int devm_pci_remap_iospace (struct device *dev,const struct resource *res, +phys_addr_t phys_addr);void pci_unmap_iospace (struct resource *res); void __iomem *devm_pci_remap_cfgspace(struct device *dev, resource_size_t offset,
Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 77 lines · Greg Kroah-Hartman
Quoted 76 lines · Greg Kroah-Hartman
Quoted 75 lines · Sergei Shtylyov
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode back
s/mode/code/, of course. :-)
Quoted 6 lines
Quoted 3 lines
Quoted 1 line
then)...
Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(
Quoted 78 lines
thanks,
greg k-h
------------------------
From
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3Mon Sep 17 00:00:00 2001
From: Sergei Shtylyov <[email protected]>
Date: Wed, 18 Jul 2018 15:40:26 -0500
Subject: PCI: OF: Fix I/O space page leakFrom: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 90 lines · Sergei Shtylyov
Quoted 77 lines · Greg Kroah-Hartman
Quoted 76 lines · Greg Kroah-Hartman
Quoted 75 lines · Sergei Shtylyov
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode backs/mode/code/, of course. :-)Quoted 2 lines
Quoted 2 lines
Quoted 1 line
then)...
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(
Really? Why not? What is missing here?
greg k-h
Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 93 lines · Greg Kroah-Hartman
Quoted 92 lines · Sergei Shtylyov
Quoted 77 lines · Greg Kroah-Hartman
Quoted 76 lines · Greg Kroah-Hartman
Quoted 75 lines · Sergei Shtylyov
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode backs/mode/code/, of course. :-)Quoted 4 lines
Quoted 3 lines
Quoted 1 line
then)...
Yes I totally messed this up, let me fix it...
Quoted 7 lines
Quoted 5 lines
Quoted 2 lines
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(Really? Why not? What is missing here?
You just need to fix drivers/pci/host/pcie-rcar.c in this same patch -- because
this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started using the common "PCI-resource-walker" function factored out from pci-host-common.c somewhere around 4.17, IIRC...
Quoted 1 line
greg k-h
MBR, Sergei
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 100 lines · Sergei Shtylyov
Quoted 99 lines · Greg Kroah-Hartman
Quoted 97 lines · Sergei Shtylyov
Quoted 77 lines · Greg Kroah-Hartman
Quoted 76 lines · Greg Kroah-Hartman
Quoted 75 lines · Sergei Shtylyov
Quoted 73 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode backs/mode/code/, of course. :-)Quoted 6 lines
Quoted 3 lines
Quoted 1 line
then)...
Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(
Quoted 6 lines
Quoted 1 line
Really? Why not? What is missing here?
You just need to fix
drivers/pci/host/pcie-rcar.cin this same patch -- because
this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started using the common "PCI-resource-walker" function factored out frompci-host-common.csomewhere around 4.17, IIRC...
Ok, can you send me a patch that does that please? Otherwise I really don't know how to exactly "fix" that at the moment.
thanks,
greg k-h
Re: [PATCH 4.14 210/217] PCI: OF: Fix I/O space page leak
Quoted 95 lines · Greg Kroah-Hartman
Quoted 95 lines
Quoted 94 lines
Quoted 85 lines
Quoted 73 lines
Quoted 73 lines
Quoted 73 lines
Quoted 73 lines
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Shtylyov <[email protected]>
commit
a5fb9fb023a1435f2b42bccd7f547560f3a21dc3upstream.When testing the R-Car PCIe driver on the Condor board, if the PCIe PHY driver was left disabled, the kernel crashed with this BUG:
kernel BUG at
lib/ioremap.c:72!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 39 Comm: kworker/0:1 Not tainted 4.17.0-dirty #1092 Hardware name: Renesas Condor board based on r8a77980 (DT) Workqueue: events deferred_probe_work_func pstate: 80000005 (Nzcv daif -PAN -UAO) pc : ioremap_page_range+0x370/0x3c8 lr : ioremap_page_range+0x40/0x3c8 sp : ffff000008da39e0 x29: ffff000008da39e0 x28: 00e8000000000f07 x27: ffff7dfffee00000 x26: 0140000000000000 x25: ffff7dfffef00000 x24: 00000000000fe100 x23: ffff80007b906000 x22: ffff000008ab8000 x21: ffff000008bb1d58 x20: ffff7dfffef00000 x19: ffff800009c30fb8 x18: 0000000000000001 x17: 00000000000152d0 x16: 00000000014012d0 x15: 0000000000000000 x14: 0720072007200720 x13: 0720072007200720 x12: 0720072007200720 x11: 0720072007300730 x10: 00000000000000ae x9 : 0000000000000000 x8 : ffff7dffff000000 x7 : 0000000000000000 x6 : 0000000000000100 x5 : 0000000000000000 x4 : 000000007b906000 x3 : ffff80007c61a880 x2 : ffff7dfffeefffff x1 : 0000000040000000 x0 : 00e80000fe100f07 Process kworker/0:1 (pid: 39, stack limit = 0x (ptrval)) Call trace: ioremap_page_range+0x370/0x3c8 pci_remap_iospace+0x7c/0xac pci_parse_request_of_pci_ranges+0x13c/0x190 rcar_pcie_probe+0x4c/0xb04 platform_drv_probe+0x50/0xbc driver_probe_device+0x21c/0x308 __device_attach_driver+0x98/0xc8 bus_for_each_drv+0x54/0x94 __device_attach+0xc4/0x12c device_initial_probe+0x10/0x18 bus_probe_device+0x90/0x98 deferred_probe_work_func+0xb0/0x150 process_one_work+0x12c/0x29c worker_thread+0x200/0x3fc kthread+0x108/0x134 ret_from_fork+0x10/0x18 Code: f9004ba2 54000080 aa0003fb 17ffff48 (d4210000)It turned out that
pci_remap_iospace()wasn't undone when the driver's probe failed, and sincedevm_phy_optional_get()returned -EPROBE_DEFER, the probe was retried, finally causing the BUG due to trying to remap already remapped pages.Introduce the
devm_pci_remap_iospace()managed API and replace thepci_remap_iospace()call with it to fix the bug.Fixes dbf9826d5797 ("PCI: generic: Convert to DT resource parsing API")Signed-off-by Sergei Shtylyov <[email protected]>[[email protected]: split commit/updated the commit log]Signed-off-by Lorenzo Pieralisi <[email protected]>Signed-off-by Bjorn Helgaas <[email protected]>Reviewed-by Linus Walleij <[email protected]>[Backport just for the new api which other patches need - gregkh]Signed-off-by Greg Kroah-Hartman <[email protected]>Quoted 7 lines
Quoted 7 lines
Quoted 7 lines
Quoted 4 lines
--- drivers/pci/pci.c | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/pci.h | 2 ++ 2 files changed, 40 insertions(+)You missed a chnage to
drivers/pci/host/pci-host-common.c(and
alsodrivers/pci/host/pcie-rcar.cwhich wasn't using the generic mode backs/mode/code/, of course. :-)Quoted 2 lines
Quoted 2 lines
Quoted 1 line
then)...
Quoted 7 lines
Quoted 4 lines
Quoted 1 line
Yes I totally messed this up, let me fix it...
Ok, below is the patch that I replaced the 4.14 and 4.9 versions with, it should now be resolved, but verifying this would be nice :)
Unfortunately, it doesn't fix anything on R-Car where this bug was originally
encountered and the fix was tested... and you leave no way for it to be fixed. :-(Really? Why not? What is missing here?
Quoted 7 lines
Quoted 4 lines
You just need to fix
drivers/pci/host/pcie-rcar.cin this same patch -- because
this same *upstream* patch fixed the R-Car PCIe driver in 4.18. That driver started using the common "PCI-resource-walker" function factored out frompci-host-common.csomewhere around 4.17, IIRC...Ok, can you send me a patch that does that please? Otherwise I really don't know how to exactly "fix" that at the moment.
I'd told you I could do it. :-) Sending...
Quoted 3 lines
thanks,
greg k-h
MBR, Sergei
Greg Kroah-Hartman
maintainerPATCH 211/217 PCI: hotplug: Dont leak pci_slot on registration failure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 4ce6435820d1f1cc2c2788e232735eb244bcc8a3 upstream.
If addition of sysfs files fails on registration of a hotplug slot, the struct pci_slot as well as the entry in the slot_list is leaked. The issue has been present since the hotplug core was introduced in 2002:
https://git.kernel.org/tglx/history/c/a8a2069f432c
Perhaps the idea was that even though sysfs addition fails, the slot should still be usable. But that's not how drivers use the interface, they abort probe if a non-zero value is returned.
--- drivers/pci/hotplug/pci_hotplug_core.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pci/hotplug/pci_hotplug_core.c +9 -0
@@ -452,8 +452,17 @@ int __pci_hp_register(struct hotplug_slolist_add (&slot->slot_list, &pci_hotplug_slot_list); result =fs_add_slot (pci_slot); +if (result) + goto err_list_del; +kobject_uevent (&pci_slot->kobj,KOBJ_ADD );dbg ("Added slot %s to the list\n" , name); + goto out; + +err_list_del: +list_del (&slot->slot_list); + pci_slot->hotplug =NULL ; +pci_destroy_slot (pci_slot); out:mutex_unlock (&pci_hp_mutex);return result;
Greg Kroah-Hartman
maintainerPATCH 212/217 PCI: Skip MPS logic for Virtual Functions (VFs)
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Myron Stowe <[email protected]>
commit 3dbe97efe8bf450b183d6dee2305cbc032e6b8a4 upstream.
PCIe r4.0, sec 9.3.5.4, "Device Control Register", shows both Max_Payload_Size (MPS) and Max_Read_request_Size (MRRS) to be 'RsvdP' for VFs. Just prior to the table it states:
"PF and VF functionality is defined in Section 7.5.3.4 except where
noted in Table 9-16. For VF fields marked 'RsvdP', the PF setting applies to the VF."
All of which implies that with respect to Max_Payload_Size Supported (MPSS), MPS, and MRRS values, we should not be paying any attention to the VF's fields, but rather only to the PF's. Only looking at the PF's fields also logically makes sense as it's the sole physical interface to the PCIe bus.
--- drivers/pci/probe.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pci/probe.c +4 -0
@@ -1560,6 +1560,10 @@ static void pci_configure_mps(struct pciif (!pci_is_pcie (dev) || !bridge || !pci_is_pcie (bridge))return ; +/* MPS and MRRS fields are of type 'RsvdP' for VFs, short-circuit out */ +if (dev->is_virtfn) +return ; + mps =pcie_get_mps (dev); p_mps =pcie_get_mps (bridge);
Greg Kroah-Hartman
maintainerPATCH 213/217 PCI: pciehp: Fix use-after-free on unplug
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 281e878eab191cce4259abbbf1a0322e3adae02c upstream.
When pciehp is unbound (e.g. on unplug of a Thunderbolt device), the hotplug_slot struct is deregistered and thus freed before freeing the IRQ. The IRQ handler and the work items it schedules print the slot name referenced from the freed structure in various informational and debug log messages, each time resulting in a quadruple dereference of freed pointers (hotplug_slot -> pci_slot -> kobject -> name).
At best the slot name is logged as "(null)", at worst kernel memory is exposed in logs or the driver crashes:
pciehp 0000:10:00.0:pcie204: Slot((null)): Card not present
An attacker may provoke the bug by unplugging multiple devices on a Thunderbolt daisy chain at once. Unplugging can also be simulated by powering down slots via sysfs. The bug is particularly easy to trigger in poll mode.
It has been present since the driver's introduction in 2004:
https://git.kernel.org/tglx/history/c/c16b4b14d980
Fix by rearranging teardown such that the IRQ is freed first. Run the work items queued by the IRQ handler to completion before freeing the hotplug_slot struct by draining the work queue from the ->release_slot callback which is invoked by pci_hp_deregister().
--- drivers/pci/hotplug/pciehp.h | 1 + drivers/pci/hotplug/pciehp_core.c | 7 +++++++ drivers/pci/hotplug/pciehp_hpc.c | 5 ++--- 3 files changed, 10 insertions(+), 3 deletions(-)
drivers/pci/hotplug/pciehp.h +1 -0
@@ -132,6 +132,7 @@ int pciehp_unconfigure_device(struct slovoid pciehp_queue_pushbutton_work (struct work_struct *work);struct controller *pcie_init (struct pcie_device *dev);int pcie_init_notification (struct controller *ctrl); +void pcie_shutdown_notification (struct controller *ctrl);int pciehp_enable_slot (struct slot *p_slot);int pciehp_disable_slot (struct slot *p_slot);void pcie_reenable_notification (struct controller *ctrl);
drivers/pci/hotplug/pciehp_core.c +7 -0
@@ -76,6 +76,12 @@ static int reset_slot(struct hotplug_slo*/ static void release_slot (struct hotplug_slot *hotplug_slot) { +struct slot *slot = hotplug_slot->private; + +/* queued work needs hotplug_slot name */ +cancel_delayed_work (&slot->work); +drain_workqueue (slot->wq); +kfree (hotplug_slot->ops);kfree (hotplug_slot->info);kfree (hotplug_slot);
@@ -278,6 +284,7 @@ static void pciehp_remove(struct pcie_de {struct controller *ctrl =get_service_data (dev); +pcie_shutdown_notification (ctrl);cleanup_slot (ctrl);pciehp_release_ctrl (ctrl); }
drivers/pci/hotplug/pciehp_hpc.c +2 -3
@@ -789,7 +789,7 @@ int pcie_init_notification(struct controreturn 0 ; } -static void pcie_shutdown_notification (struct controller *ctrl) +void pcie_shutdown_notification (struct controller *ctrl) {if (ctrl->notification_enabled) {pcie_disable_notification (ctrl);
@@ -824,7 +824,7 @@ abort:static void pcie_cleanup_slot (struct controller *ctrl) {struct slot *slot = ctrl->slot; -cancel_delayed_work (&slot->work); +destroy_workqueue (slot->wq);kfree (slot); }
@@ -912,7 +912,6 @@ abort:void pciehp_release_ctrl (struct controller *ctrl) { -pcie_shutdown_notification (ctrl);pcie_cleanup_slot (ctrl);kfree (ctrl); }
Greg Kroah-Hartman
maintainerPATCH 214/217 PCI: pciehp: Fix unprotected list iteration in IRQ handler
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit 1204e35bedf4e5015cda559ed8c84789a6dae24e upstream.
Commit b440bde74f04 ("PCI: Add pci_ignore_hotplug() to ignore hotplug events for a device") iterates over the devices on a hotplug port's subordinate bus in pciehp's IRQ handler without acquiring pci_bus_sem. It is thus possible for a user to cause a crash by concurrently manipulating the device list, e.g. by disabling slot power via sysfs on a different CPU or by initiating a remove/rescan via sysfs.
This can't be fixed by acquiring pci_bus_sem because it may sleep. The simplest fix is to avoid the list iteration altogether and just check the ignore_hotplug flag on the port itself. This works because pci_ignore_hotplug() sets the flag both on the device as well as on its parent bridge.
We do lose the ability to print the name of the device blocking hotplug in the debug message, but that's probably bearable.
--- drivers/pci/hotplug/pciehp_hpc.c | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-)
drivers/pci/hotplug/pciehp_hpc.c +3 -10
@@ -562,8 +562,6 @@ static irqreturn_t pciehp_isr(int irq, v {struct controller *ctrl = (struct controller *)dev_id;struct pci_dev *pdev =ctrl_dev (ctrl); -struct pci_bus *subordinate = pdev->subordinate; -struct pci_dev *dev;struct slot *slot = ctrl->slot;u16 status, events;u8 present;
@@ -611,14 +609,9 @@ static irqreturn_t pciehp_isr(int irq, vwake_up (&ctrl->queue); } -if (subordinate) { -list_for_each_entry (dev, &subordinate->devices, bus_list) { -if (dev->ignore_hotplug) { -ctrl_dbg (ctrl,"ignoring hotplug event %#06x (%s requested no hotplug)\n" , - events,pci_name (dev)); -return IRQ_HANDLED ; - } - } +if (pdev->ignore_hotplug) { +ctrl_dbg (ctrl,"ignoring hotplug event %#06x\n" , events); +return IRQ_HANDLED ; }/* Check Attention Button Pressed */
Greg Kroah-Hartman
maintainerPATCH 215/217 i2c: core: ACPI: Properly set status byte to 0 for multi-byte writes
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit c463a158cb6c5d9a85b7d894cd4f8116e8bd6be0 upstream.
acpi_gsb_i2c_write_bytes() returns i2c_transfer()'s return value, which is the number of transfers executed on success, so 1.
The ACPI code expects us to store 0 in gsb->status for success, not 1.
Specifically this breaks the following code in the Thinkpad 8 DSDT:
ECWR = I2CW = ECWR /* \_SB_.I2C1.BAT0.ECWR */
If ((ECST == Zero))
{
ECRD = I2CR /* \_SB_.I2C1.I2CR */
}Before this commit we set ECST to 1, causing the read to never happen breaking battery monitoring on the Thinkpad 8.
This commit makes acpi_gsb_i2c_write_bytes() return 0 when i2c_transfer() returns 1, so the single write transfer completed successfully, and makes it return -EIO on for other (unexpected) return values >= 0.
--- drivers/i2c/i2c-core-acpi.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/i2c/i2c-core-acpi.c +8 -3
@@ -475,11 +475,16 @@ static int acpi_gsb_i2c_write_bytes(stru msgs[0 ].buf = buffer; ret =i2c_transfer (client->adapter, msgs,ARRAY_SIZE (msgs)); -if (ret <0 ) -dev_err (&client->adapter->dev,"i2c write failed\n" );kfree (buffer); -return ret; + +if (ret <0 ) { +dev_err (&client->adapter->dev,"i2c write failed: %d\n" , ret); +return ret; + } + +/* 1 transfer must have completed successfully */ +return (ret ==1 ) ?0 : -EIO ; } static acpi_status
Greg Kroah-Hartman
maintainerPATCH 217/217 reiserfs: fix broken xattr handling (heap corruption, bad retval)
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit a13f085d111e90469faf2d9965eb39b11c114d7e upstream.
This fixes the following issues:
- When a buffer size is supplied to reiserfs_listxattr() such that each individual name fits, but the concatenation of all names doesn't fit, reiserfs_listxattr() overflows the supplied buffer. This leads to a kernel heap overflow (verified using KASAN) followed by an out-of-bounds usercopy and is therefore a security bug.
- When a buffer size is supplied to reiserfs_listxattr() such that a name doesn't fit, -ERANGE should be returned. But reiserfs instead just truncates the list of names; I have verified that if the only xattr on a file has a longer name than the supplied buffer length, listxattr() incorrectly returns zero.
With my patch applied, -ERANGE is returned in both cases and the memory corruption doesn't happen anymore.
Credit for making me clean this code up a bit goes to Al Viro, who pointed out that the ->actor calling convention is suboptimal and should be changed.
--- fs/reiserfs/xattr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/reiserfs/xattr.c +3 -1
@@ -792,8 +792,10 @@ static int listxattr_filler(struct dir_creturn 0 ; size = namelen +1 ;if (b->buf) { -if (size > b->size) +if (b->pos + size > b->size) { + b->pos = -ERANGE ;return -ERANGE ; + }memcpy (b->buf + b->pos, name, namelen); b->buf[b->pos + namelen] =0 ; }
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.67 release. There are 217 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Aug 25 07:54:25 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.67 release. There are 217 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Aug 25 07:54:25 UTC 2018. Anything received after that time might be too late.
Build results:
total: 148 pass: 148 fail: 0 Qemu test results: total: 299 pass: 299 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.67 release. There are 217 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Aug 25 07:54:25 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.67-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.14.67-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: c896707b8c8af7d51ca8575c395d03418984c94c
git describe: v4.14.66-218-gc896707b8c8a
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.66-218-gc896707b8c8a
No regressions (compared to build v4.14.65)
Ran 12451 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- juno-r2 - arm64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org