4.14.85-stable review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.85-stable review
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.85-rc1
Mimi Zohar <[email protected]>
ima: re-initialize iint->atomic_flags
Dmitry Kasatkin <[email protected]>
ima: re-introduce own integrity cache lock
Matthew Garrett <[email protected]>
EVM: Add support for portable signature format
Mimi Zohar <[email protected]>
ima: always measure and audit files in policy
Alexander Aring <[email protected]>
net: ieee802154: 6lowpan: fix frag reassembly
Paul E. McKenney <[email protected]>
rcu: Make need_resched() respond to urgent RCU-QS needs
Janosch Frank <[email protected]>
s390/mm: Check for valid vma before zapping in gmap_discard
Phil Elwell <[email protected]>
lan78xx: Read MAC address from DT if present
Salvatore Mesoraca <[email protected]>
namei: allow restricted O_CREAT of FIFOs and regular files
Aaron Ma <[email protected]>
usb: xhci: fix uninitialized completion when USB3 port got wrong status
Greg Kroah-Hartman <[email protected]>
tty: wipe buffer if not echoing data
Linus Torvalds <[email protected]>
tty: wipe buffer.
Sebastien Boisvert <[email protected]>
include/linux/pfn_t.h: force '~' to be parsed as an unary operator
Jeffy Chen <[email protected]>
driver core: Move device_links_purge() after bus_remove_device()
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: Fix invalid node referenced by i2c20 alias in Peach Pit and Pi
Marek Szyprowski <[email protected]>
clk: samsung: exynos5250: Add missing clocks for FIMC LITE SYSMMU devices
Alexandre Belloni <[email protected]>
rtc: omap: fix error path when pinctrl_register fails
Mustafa Ismail <[email protected]>
i40iw: Fix memory leak in error path of create QP
Eran Ben Elisha <[email protected]>
net/mlx4_core: Fix wrong calculation of free counters
Niklas Cassel <[email protected]>
PCI: endpoint: Populate func_no before calling pci_epc_add_epf()
Stefan Agner <[email protected]>
kbuild: allow to use GCC toolchain not in Clang search path
Matt Chen <[email protected]>
iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
Ramses Ramírez <[email protected]>
Input: xpad - add support for Xbox1 PDP Camo series gamepad
Marcus Folkesson <[email protected]>
Input: xpad - avoid using __set_bit() for capabilities
Leo Sperling <[email protected]>
Input: xpad - fix some coding style issues
Francis Therien <[email protected]>
Input: xpad - add PDP device id 0x02a4
Richard Weinberger <[email protected]>
ubi: fastmap: Check each mapping only once
Johan Hovold <[email protected]>
mtd: rawnand: atmel: fix OF child-node lookup
Cherian, George <[email protected]>
xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
Marc Zyngier <[email protected]>
xhci: Allow more than 32 quirks
Greg Hackmann <[email protected]>
arm64: remove no-op -p linker flag
Johan Hovold <[email protected]>
power: supply: twl4030-charger: fix OF sibling-node lookup
Johan Hovold <[email protected]>
drm/mediatek: fix OF sibling-node lookup
Johan Hovold <[email protected]>
net: bcmgenet: fix OF child-node lookup
Johan Hovold <[email protected]>
NFC: nfcmrvl_uart: fix OF child-node lookup
Johan Hovold <[email protected]>
of: add helper to lookup compatible child node
Michal Hocko <[email protected]>
mm, page_alloc: check for max order in hot path
Yufen Yu <[email protected]>
tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
Vitaly Wool <[email protected]>
z3fold: fix possible reclaim races
Ard Biesheuvel <[email protected]>
efi/arm: Revert deferred unmap of early memmap mapping
Satheesh Rajendran <[email protected]>
powerpc/numa: Suppress "VPHN is not supported" messages
Prarit Bhargava <[email protected]>
kdb: Use strscpy with destination buffer size
Trond Myklebust <[email protected]>
SUNRPC: Fix a bogus get/put in generic_key_to_expire()
Russell King <[email protected]>
ARM: spectre-v2: per-CPU vtables to work around big.Little systems
Russell King <[email protected]>
ARM: add PROC_VTABLE and PROC_TABLE macros
Russell King <[email protected]>
ARM: clean up per-processor check_bugs method call
Russell King <[email protected]>
ARM: make lookup_processor_type() non-__init
Kan Liang <[email protected]>
perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
Michael Ellerman <[email protected]>
powerpc/io: Fix the IO workarounds code to work with Radix
Jens Axboe <[email protected]>
floppy: fix race condition in __floppy_read_block_0()
Ard Biesheuvel <[email protected]>
crypto: simd - correctly take reqsize of wrapped skcipher into account
Xulin Sun <[email protected]>
rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
Anson Huang <[email protected]>
cpufreq: imx6q: add return value check for voltage scale
Scott Wood <[email protected]>
KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
Jerome Brunet <[email protected]>
pinctrl: meson: fix pinconf bias disable
Michael J. Ruhl <[email protected]>
IB/hfi1: Eliminate races in the SDMA send error path
Erik Schmauss <[email protected]>
ACPICA: AML interpreter: add region addresses in global list during initialization
Lukas Wunner <[email protected]>
can: hi311x: Use level-triggered interrupt
Oliver Hartkopp <[email protected]>
can: raw: check for CAN FD capable netdev in raw_sendmsg()
Oleksij Rempel <[email protected]>
can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to can_rx_offload_queue_tail()
Oleksij Rempel <[email protected]>
can: rx-offload: introduce can_rx_offload_get_echo_skb() and can_rx_offload_queue_sorted() functions
Marc Kleine-Budde <[email protected]>
can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb
Marc Kleine-Budde <[email protected]>
can: dev: __can_get_echo_skb(): Don't crash the kernel if can_priv::echo_skb is accessed out of bounds
Marc Kleine-Budde <[email protected]>
can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length
Marc Kleine-Budde <[email protected]>
can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
Thomas Zimmermann <[email protected]>
drm/ast: Remove existing framebuffers before loading driver
Y.C. Chen <[email protected]>
drm/ast: fixed cursor may disappear sometimes
Y.C. Chen <[email protected]>
drm/ast: change resolution may cause screen blurred
Mathias Nyman <[email protected]>
usb: xhci: Prevent bus suspend if a port connect change or polling state is detected
Parav Pandit <[email protected]>
IB/core: Perform modify QP on real one
Eric Dumazet <[email protected]>
tcp: do not release socket ownership in tcp_close()
Aneesh Kumar K.V <[email protected]>
mm/memory.c: recheck page table entry with page table lock held
Dmitry Vyukov <[email protected]>
mm: don't warn about large allocations for slab
Eric Dumazet <[email protected]>
llc: do not use sk_eat_skb()
Andrew Price <[email protected]>
gfs2: Don't leave s_fs_info pointing to freed memory in init_sbd
Xin Long <[email protected]>
sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
Tetsuo Handa <[email protected]>
bfs: add sanity check at bfs_fill_super()
Dmitry Torokhov <[email protected]>
Input: synaptics - avoid using uninitialized variable when probing
Tetsuo Handa <[email protected]>
selinux: Add __GFP_NOWARN to allocation at str_read()
Dominique Martinet <[email protected]>
v9fs_dir_readdir: fix double-free on p9stat_read error
Konstantin Khlebnikov <[email protected]>
tools/power/cpupower: fix compilation with STATIC=true
Rafał Miłecki <[email protected]>
brcmfmac: fix reporting support for 160 MHz channels
Luca Coelho <[email protected]>
iwlwifi: mvm: don't use SAR Geo if basic SAR is not used
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: fix regulatory domain update when the firmware starts
Emmanuel Grumbach <[email protected]>
iwlwifi: mvm: support sta_statistics() even on older firmware
Vladimir Zapolskiy <[email protected]>
gpio: don't free unallocated ida on gpiochip_add_data_with_key() error path
Rajat Jain <[email protected]>
mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
Greg Kroah-Hartman <[email protected]>
MAINTAINERS: Add Sasha as a stable branch maintainer
Takashi Iwai <[email protected]>
ALSA: oss: Use kvzalloc() for local buffer allocations
Aaron Ma <[email protected]>
usb: xhci: fix timeout for transition from RExit to U0
Sandeep Singh <[email protected]>
xhci: Add check for invalid byte size error when UAS devices are connected.
Andy Shevchenko <[email protected]>
usb: dwc3: core: Clean up ULPI device
Thinh Nguyen <[email protected]>
usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
Felipe Balbi <[email protected]>
usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
Dennis Wassenberg <[email protected]>
usb: core: Fix hub port connection events lost
Stefan Agner <[email protected]>
ARM: trusted_foundations: do not use naked function
Stefan Agner <[email protected]>
bus: arm-cci: remove unnecessary unreachable()
Stefan Agner <[email protected]>
ARM: 8767/1: add support for building ARM kernel with clang
Stefan Agner <[email protected]>
ARM: 8766/1: drop no-thumb-interwork in EABI mode
Alistair Strachan <[email protected]>
efi/libstub: arm: support building with clang
-------------
Diffstat:
.../devicetree/bindings/net/can/holt_hi311x.txt | 2 +- Documentation/sysctl/fs.txt | 36 +++++++ MAINTAINERS | 1 + Makefile | 12 ++- arch/arm/Makefile | 2 +- arch/arm/boot/compressed/Makefile | 2 +- arch/arm/boot/dts/exynos5420-peach-pit.dts | 4 +- arch/arm/boot/dts/exynos5800-peach-pi.dts | 4 +- arch/arm/firmware/trusted_foundations.c | 14 ++- arch/arm/include/asm/proc-fns.h | 61 ++++++++--- arch/arm/kernel/bugs.c | 4 +- arch/arm/kernel/head-common.S | 6 +- arch/arm/kernel/setup.c | 9 +- arch/arm/kernel/smp.c | 31 ++++++ arch/arm/mm/proc-v7-bugs.c | 17 +-- arch/arm64/Makefile | 2 +- arch/powerpc/include/asm/io.h | 20 ++-- arch/powerpc/kvm/trace.h | 8 +- arch/powerpc/kvm/trace_booke.h | 9 +- arch/powerpc/kvm/trace_hv.h | 9 +- arch/powerpc/kvm/trace_pr.h | 9 +- arch/powerpc/mm/numa.c | 2 +- arch/s390/mm/gmap.c | 2 + arch/x86/events/intel/uncore_snb.c | 115 ++++++++++++++++++++- crypto/simd.c | 5 +- drivers/acpi/acpica/dsopcode.c | 4 + drivers/base/core.c | 2 +- drivers/block/floppy.c | 3 +- drivers/bus/arm-cci.c | 2 - drivers/clk/samsung/clk-exynos5250.c | 6 ++ drivers/cpufreq/imx6q-cpufreq.c | 7 +- drivers/firmware/efi/arm-init.c | 4 + drivers/firmware/efi/arm-runtime.c | 2 +- drivers/firmware/efi/libstub/Makefile | 3 +- drivers/firmware/efi/memmap.c | 3 + drivers/gpio/gpiolib.c | 5 +- drivers/gpu/drm/ast/ast_drv.c | 21 ++++ drivers/gpu/drm/ast/ast_mode.c | 3 +- drivers/gpu/drm/mediatek/mtk_hdmi.c | 5 +- drivers/infiniband/core/verbs.c | 5 +- drivers/infiniband/hw/hfi1/user_sdma.c | 87 +++++++--------- drivers/infiniband/hw/hfi1/user_sdma.h | 3 - drivers/infiniband/hw/i40iw/i40iw_verbs.c | 2 +- drivers/input/joystick/xpad.c | 45 +++++--- drivers/input/mouse/synaptics.c | 4 +- drivers/mmc/host/sdhci-pci-core.c | 7 +- drivers/mtd/nand/atmel/nand-controller.c | 11 +- drivers/mtd/ubi/build.c | 1 + drivers/mtd/ubi/eba.c | 4 + drivers/mtd/ubi/fastmap.c | 20 ++++ drivers/mtd/ubi/ubi.h | 11 ++ drivers/mtd/ubi/vmt.c | 1 + drivers/mtd/ubi/vtbl.c | 16 ++- drivers/net/can/dev.c | 48 ++++++--- drivers/net/can/flexcan.c | 4 +- drivers/net/can/rx-offload.c | 51 ++++++++- drivers/net/can/spi/hi311x.c | 2 +- drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 +- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 1 - drivers/net/usb/lan78xx.c | 42 ++++---- .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 40 +++++-- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 12 +-- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 5 +- drivers/nfc/nfcmrvl/uart.c | 5 +- drivers/of/base.c | 25 +++++ drivers/pci/endpoint/pci-ep-cfs.c | 14 ++- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- drivers/power/supply/twl4030_charger.c | 5 +- drivers/rtc/rtc-omap.c | 3 +- drivers/rtc/rtc-pcf2127.c | 3 + drivers/tty/n_tty.c | 20 +++- drivers/tty/tty_buffer.c | 6 +- drivers/usb/core/hub.c | 4 +- drivers/usb/dwc3/core.c | 1 + drivers/usb/dwc3/gadget.c | 8 +- drivers/usb/host/xhci-hub.c | 66 +++++++++--- drivers/usb/host/xhci-pci.c | 5 + drivers/usb/host/xhci-ring.c | 38 ++++++- drivers/usb/host/xhci.c | 6 +- drivers/usb/host/xhci.h | 67 ++++++------ fs/9p/vfs_dir.c | 11 -- fs/bfs/inode.c | 9 +- fs/gfs2/ops_fstype.c | 2 +- fs/namei.c | 53 +++++++++- include/linux/can/dev.h | 1 + include/linux/can/rx-offload.h | 7 +- include/linux/fs.h | 2 + include/linux/integrity.h | 1 + include/linux/of.h | 8 ++ include/linux/pfn_t.h | 2 +- include/net/sock.h | 1 + kernel/debug/kdb/kdb_io.c | 15 +-- kernel/debug/kdb/kdb_private.h | 2 +- kernel/debug/kdb/kdb_support.c | 10 +- kernel/rcu/tree.c | 9 ++ kernel/sysctl.c | 18 ++++ mm/memory.c | 34 +++++- mm/page_alloc.c | 20 ++-- mm/shmem.c | 4 +- mm/slab.c | 4 + mm/slab_common.c | 12 +-- mm/z3fold.c | 101 +++++++++++------- net/can/raw.c | 15 +-- net/core/sock.c | 2 +- net/ieee802154/6lowpan/6lowpan_i.h | 4 +- net/ieee802154/6lowpan/reassembly.c | 14 +-- net/ipv4/tcp.c | 11 +- net/llc/af_llc.c | 11 +- net/sctp/associola.c | 10 +- net/sunrpc/auth_generic.c | 8 +- security/integrity/evm/evm.h | 2 +- security/integrity/evm/evm_crypto.c | 75 ++++++++++++-- security/integrity/evm/evm_main.c | 29 ++++-- security/integrity/iint.c | 3 + security/integrity/ima/ima_api.c | 67 +++++++----- security/integrity/ima/ima_appraise.c | 31 +++--- security/integrity/ima/ima_crypto.c | 10 ++ security/integrity/ima/ima_main.c | 77 +++++++++----- security/integrity/integrity.h | 18 +++- security/selinux/ss/policydb.c | 2 +- sound/core/oss/pcm_oss.c | 6 +- sound/core/oss/pcm_plugin.c | 6 +- tools/power/cpupower/bench/Makefile | 2 +- tools/power/cpupower/lib/cpufreq.c | 2 +- tools/power/cpupower/lib/cpuidle.c | 2 +- tools/power/cpupower/lib/cpupower.c | 4 +- tools/power/cpupower/lib/cpupower_intern.h | 2 +- 128 files changed, 1351 insertions(+), 549 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/100 efi/libstub: arm: support building with clang
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
(commit 41f1c48420709470c51ee0e54b6fb28b956bb4e0 upstream)
When building with CONFIG_EFI and CONFIG_EFI_STUB on ARM, the libstub Makefile would use -mno-single-pic-base without checking it was supported by the compiler. As the ARM (32-bit) clang backend does not support this flag, the build would fail.
This changes the Makefile to check the compiler's support for -mno-single-pic-base before using it, similar to c1c386681bd7 ("ARM:
8767/1: add support for building ARM kernel with clang").
[ND: adjusted due to missing commit ce279d374ff3 ("efi/libstub:
Only disable stackleak plugin for arm64")]
--- drivers/firmware/efi/libstub/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/firmware/efi/libstub/Makefile +2 -1
@@ -13,7 +13,8 @@ cflags-$(CONFIG_X86) += -m$(BITS) -D__K cflags-$(CONFIG_ARM64) := $(subst -pg,,$(KBUILD_CFLAGS)) -fpie cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \ - -fno-builtin -fpic -mno-single-pic-base + -fno-builtin -fpic \ + $(call cc-option,-mno-single-pic-base) cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
Greg Kroah-Hartman
maintainerPATCH 2/100 ARM: 8766/1: drop no-thumb-interwork in EABI mode
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
(commit 22905a24306c8c312c2d66da9f90d09af0414f81 upstream)
According to GCC documentation -m(no-)thumb-interwork is meaningless in AAPCS configurations. Also clang does not support the flag:
clang-5.0: error: unknown argument: '-mno-thumb-interwork'
Just drop -mno-thumb-interwork in AEABI configuration.
--- arch/arm/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/Makefile +1 -1
@@ -106,7 +106,7 @@ tune-$(CONFIG_CPU_V6K) =$(call cc-optio tune-y := $(tune-y) ifeq ($(CONFIG_AEABI),y) -CFLAGS_ABI :=-mabi=aapcs-linux -mno-thumb-interwork -mfpu=vfp +CFLAGS_ABI :=-mabi=aapcs-linux -mfpu=vfp else CFLAGS_ABI :=$(call cc-option,-mapcs-32,-mabi=apcs-gnu) $(call cc-option,-mno-thumb-interwork,) endif
Greg Kroah-Hartman
maintainerPATCH 3/100 ARM: 8767/1: add support for building ARM kernel with clang
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
(commit c1c386681bd73c4fc28eb5cc91cf8b7be9b409ba upstream)
Use cc-options call for compiler options which are not available in clang. With this patch an ARMv7 multi platform kernel can be successfully build using clang (tested with version 5.0.1).
--- arch/arm/boot/compressed/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/compressed/Makefile +1 -1
@@ -113,7 +113,7 @@ CFLAGS_fdt_ro.o := $(nossp_flags) CFLAGS_fdt_rw.o := $(nossp_flags) CFLAGS_fdt_wip.o := $(nossp_flags) -ccflags-y := -fpic -mno-single-pic-base -fno-builtin -I$(obj) +ccflags-y := -fpic $(call cc-option,-mno-single-pic-base,) -fno-builtin -I$(obj) asflags-y := -DZIMAGE # Supply kernel BSS size to the decompressor via a linker symbol.
Greg Kroah-Hartman
maintainerPATCH 4/100 bus: arm-cci: remove unnecessary unreachable()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
(commit 10d8713429d345867fc8998d6193b233c0cab28c upstream)
Mixing asm and C code is not recommended in a naked function by gcc and leads to an error when using clang:
drivers/bus/arm-cci.c:2107:2: error: non-ASM statement in naked function is not supported
unreachable();
^While the function is marked __naked it actually properly return in asm. There is no need for the unreachable() call.
GCC 7.2 generates identical object files before and after, other than (for obvious reasons) the line numbers generated by WANT_WARN_ON_SLOWPATH for all the WARN()s appearing later in the file.
--- drivers/bus/arm-cci.c | 2 -- 1 file changed, 2 deletions(-)
drivers/bus/arm-cci.c +0 -2
@@ -2103,8 +2103,6 @@ asmlinkage void __naked cci_enable_port_ [sizeof_struct_cpu_port] "i" (sizeof(struct cpu_port)), [sizeof_struct_ace_port] "i" (sizeof(struct cci_ace_port)), [offsetof_port_phys] "i" (offsetof(struct cci_ace_port, phys)) ); - -unreachable (); }/**
Greg Kroah-Hartman
maintainerPATCH 5/100 ARM: trusted_foundations: do not use naked function
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
(commit 4ea7bdc6b5b33427bbd3f41c333e21c1825462a3 upstream)
As documented in GCC naked functions should only use basic ASM syntax. The extended ASM or mixture of basic ASM and "C" code is not guaranteed. Currently this works because it was hard coded to follow and check GCC behavior for arguments and register placement.
Furthermore with clang using parameters in Extended asm in a naked function is not supported:
arch/arm/firmware/trusted_foundations.c:47:10: error: parameter
references not allowed in naked functions
: "r" (type), "r" (arg1), "r" (arg2)
^Use a regular function to be more portable. This aligns also with the other SMC call implementations e.g. in qcom_scm-32.c and bcm_kona_smc.c.
--- arch/arm/firmware/trusted_foundations.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
arch/arm/firmware/trusted_foundations.c +9 -5
@@ -31,21 +31,25 @@static unsigned long cpu_boot_addr; -static void __naked tf_generic_smc (u32 type,u32 arg1,u32 arg2) +static void tf_generic_smc (u32 type,u32 arg1,u32 arg2) { + register u32 r0 asm("r0") = type; + register u32 r1 asm("r1") = arg1; + register u32 r2 asm("r2") = arg2; + asmvolatile (".arch_extension sec\n\t" -"stmfd sp!, {r4 - r11, lr}\n\t" +"stmfd sp!, {r4 - r11}\n\t" __asmeq("%0", "r0") __asmeq("%1", "r1") __asmeq("%2", "r2") "mov r3, #0\n\t" "mov r4, #0\n\t" "smc #0\n\t" - "ldmfd sp!, {r4 - r11, pc}" + "ldmfd sp!, {r4 - r11}\n\t" : - : "r" (type), "r" (arg1), "r" (arg2) - : "memory"); + : "r" (r0), "r" (r1), "r" (r2) + : "memory", "r3", "r12", "lr"); }static int tf_set_cpu_boot_addr (int cpu,unsigned long boot_addr)
Greg Kroah-Hartman
maintainerPATCH 6/100 usb: core: Fix hub port connection events lost
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Wassenberg <[email protected]>
commit 22454b79e6de05fa61a2a72d00d2eed798abbb75 upstream.
This will clear the USB_PORT_FEAT_C_CONNECTION bit in case of a hub port reset only if a device is was attached to the hub port before resetting the hub port.
Using a Lenovo T480s attached to the ultra dock it was not possible to detect some usb-c devices at the dock usb-c ports because the hub_port_reset code will clear the USB_PORT_FEAT_C_CONNECTION bit after the actual hub port reset. Using this device combo the USB_PORT_FEAT_C_CONNECTION bit was set between the actual hub port reset and the clear of the USB_PORT_FEAT_C_CONNECTION bit. This ends up with clearing the USB_PORT_FEAT_C_CONNECTION bit after the new device was attached such that it was not detected.
This patch will not clear the USB_PORT_FEAT_C_CONNECTION bit if there is currently no device attached to the port before the hub port reset. This will avoid clearing the connection bit for new attached devices.
--- drivers/usb/core/hub.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +3 -1
@@ -2815,7 +2815,9 @@ static int hub_port_reset(struct usb_hub USB_PORT_FEAT_C_BH_PORT_RESET);usb_clear_port_feature (hub->hdev, port1,USB_PORT_FEAT_C_PORT_LINK_STATE ); -usb_clear_port_feature (hub->hdev, port1, + +if (udev) +usb_clear_port_feature (hub->hdev, port1,USB_PORT_FEAT_C_CONNECTION );/*
Greg Kroah-Hartman
maintainerPATCH 7/100 usb: dwc3: gadget: fix ISOC TRB type on unaligned transfers
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 2fc6d4be35fb1e262f209758e25bfe2b7a113a7f upstream.
When chaining ISOC TRBs together, only the first ISOC TRB should be of type ISOC_FIRST, all others should be of type ISOC. This patch fixes that.
--- drivers/usb/dwc3/gadget.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/usb/dwc3/gadget.c +3 -3
@@ -1088,7 +1088,7 @@ static void dwc3_prepare_one_trb_sg(stru/* Now prepare one extra TRB to align transfer size */ trb = &dep->trb_pool[dep->trb_enqueue];__dwc3_prepare_one_trb (dep, trb, dwc->bounce_addr, - maxp - rem, false,0 , + maxp - rem, false,1 , req->request.stream_id, req->request.short_not_ok, req->request.no_interrupt);
@@ -1120,7 +1120,7 @@ static void dwc3_prepare_one_trb_linear(/* Now prepare one extra TRB to align transfer size */ trb = &dep->trb_pool[dep->trb_enqueue];__dwc3_prepare_one_trb (dep, trb, dwc->bounce_addr, maxp - rem, - false,0 , req->request.stream_id, + false,1 , req->request.stream_id, req->request.short_not_ok, req->request.no_interrupt); } else if (req->request.zero && req->request.length &&
@@ -1136,7 +1136,7 @@ static void dwc3_prepare_one_trb_linear(/* Now prepare one extra TRB to handle ZLP */ trb = &dep->trb_pool[dep->trb_enqueue];__dwc3_prepare_one_trb (dep, trb, dwc->bounce_addr,0 , - false,0 , req->request.stream_id, + false,1 , req->request.stream_id, req->request.short_not_ok, req->request.no_interrupt); }else {
Greg Kroah-Hartman
maintainerPATCH 8/100 usb: dwc3: gadget: Properly check last unaligned/zero chain TRB
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit ba3a51ac32ebcf8d0a54b37f1af268ad8a31c52f upstream.
Current check for the last extra TRB for zero and unaligned transfers does not account for isoc OUT. The last TRB of the Buffer Descriptor for isoc OUT transfers will be retired with HWO=0. As a result, we won't return early. The req->remaining will be updated to include the BUFSIZ count of the extra TRB, and the actual number of transferred bytes calculation will be wrong.
To fix this, check whether it's a short or zero packet and the last TRB chain bit to return early.
--- drivers/usb/dwc3/gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/gadget.c +1 -1
@@ -2249,7 +2249,7 @@ static int __dwc3_cleanup_done_trbs(stru* with one TRB pending in the ring. We need to manually clear HWO bit * from that TRB. */ -if ((req->zero || req->unaligned) && (trb->ctrl &DWC3_TRB_CTRL_HWO )) { +if ((req->zero || req->unaligned) && !(trb->ctrl &DWC3_TRB_CTRL_CHN )) { trb->ctrl &= ~DWC3_TRB_CTRL_HWO ;return 1 ; }
Greg Kroah-Hartman
maintainerPATCH 9/100 usb: dwc3: core: Clean up ULPI device
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 08fd9a82fda86529bb2f2af3c2f7cb657b4d3066 upstream.
If dwc3_core_init_mode() fails with deferred probe, next probe fails on sysfs with
sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:11.0/dwc3.0.auto/dwc3.0.auto.ulpi'
To avoid this failure, clean up ULPI device.
--- drivers/usb/dwc3/core.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/core.c +1 -0
@@ -1276,6 +1276,7 @@ static int dwc3_probe(struct platform_de err5:dwc3_event_buffers_cleanup (dwc); +dwc3_ulpi_exit (dwc); err4:dwc3_free_scratch_buffers (dwc);
Greg Kroah-Hartman
maintainerPATCH 10/100 xhci: Add check for invalid byte size error when UAS devices are connected.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandeep Singh <[email protected]>
commit d9193efba84fe4c4aa22a569fade5e6ca971f8af upstream.
Observed "TRB completion code (27)" error which corresponds to Stopped - Length Invalid error(xhci spec section 4.17.4) while connecting USB to SATA bridge.
Looks like this case was not considered when the following patch[1] was committed. Hence adding this new check which can prevent
the invalid byte size error.
[1] ade2e3a xhci: handle transfer events without TRB pointer
--- drivers/usb/host/xhci-ring.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/xhci-ring.c +1 -0
@@ -2335,6 +2335,7 @@ static int handle_tx_event(struct xhci_h goto cleanup;case COMP_RING_UNDERRUN :case COMP_RING_OVERRUN : +case COMP_STOPPED_LENGTH_INVALID : goto cleanup;default : xhci_err(xhci, "ERROR Transfer event for unknown stream ring slot %u ep %u\n",
Greg Kroah-Hartman
maintainerPATCH 11/100 usb: xhci: fix timeout for transition from RExit to U0
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
commit a5baeaeabcca3244782a9b6382ebab6f8a58f583 upstream.
This definition is used by msecs_to_jiffies in milliseconds. According to the comments, max rexit timeout should be 20ms. Align with the comments to properly calculate the delay.
Verified on Sunrise Point-LP and Cannon Lake.
--- drivers/usb/host/xhci-hub.c | 4 ++-- drivers/usb/host/xhci.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
drivers/usb/host/xhci-hub.c +2 -2
@@ -941,7 +941,7 @@ static u32 xhci_get_port_status(struct u time_left =wait_for_completion_timeout ( &bus_state->rexit_done[wIndex],msecs_to_jiffies ( -XHCI_MAX_REXIT_TIMEOUT )); +XHCI_MAX_REXIT_TIMEOUT_MS ));spin_lock_irqsave (&xhci->lock, flags);if (time_left) {
@@ -955,7 +955,7 @@ static u32 xhci_get_port_status(struct u }else {int port_status =readl (port_array[wIndex]);xhci_warn (xhci,"Port resume took longer than %i msec, port status = 0x%x\n" , -XHCI_MAX_REXIT_TIMEOUT , +XHCI_MAX_REXIT_TIMEOUT_MS , port_status); status |=USB_PORT_STAT_SUSPEND ;clear_bit (wIndex, &bus_state->rexit_ports);
drivers/usb/host/xhci.h +1 -1
@@ -1684,7 +1684,7 @@ struct xhci_bus_state {* It can take up to 20 ms to transition from RExit to U0 on the * Intel Lynx Point LP xHCI host. */ -#define XHCI_MAX_REXIT_TIMEOUT (20 * 1000) +#define XHCI_MAX_REXIT_TIMEOUT_MS 20static inline unsigned int hcd_index (struct usb_hcd *hcd) {
Greg Kroah-Hartman
maintainerPATCH 12/100 ALSA: oss: Use kvzalloc() for local buffer allocations
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 65766ee0bf7fe8b3be80e2e1c3ef54ad59b29476 upstream.
PCM OSS layer may allocate a few temporary buffers, one for the core read/write and another for the conversions via plugins. Currently both are allocated via vmalloc(). But as the allocation size is equivalent with the PCM period size, the required size might be quite small, depending on the application.
This patch replaces these vmalloc() calls with kvzalloc() for covering small period sizes better. Also, we use "z"-alloc variant here for addressing the possible uninitialized access reported by syzkaller.
--- sound/core/oss/pcm_oss.c | 6 +++--- sound/core/oss/pcm_plugin.c | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-)
sound/core/oss/pcm_oss.c +3 -3
@@ -1062,8 +1062,8 @@ static int snd_pcm_oss_change_params_loc runtime->oss.channels =params_channels (params); runtime->oss.rate =params_rate (params); -vfree (runtime->oss.buffer); - runtime->oss.buffer =vmalloc (runtime->oss.period_bytes); +kvfree (runtime->oss.buffer); + runtime->oss.buffer =kvzalloc (runtime->oss.period_bytes,GFP_KERNEL );if (!runtime->oss.buffer) { err = -ENOMEM ; goto failure;
@@ -2328,7 +2328,7 @@ static void snd_pcm_oss_release_substrea {struct snd_pcm_runtime *runtime; runtime = substream->runtime; -vfree (runtime->oss.buffer); +kvfree (runtime->oss.buffer); runtime->oss.buffer =NULL ;#ifdef CONFIG_SND_PCM_OSS_PLUGINS snd_pcm_oss_plugin_clear (substream);
sound/core/oss/pcm_plugin.c +3 -3
@@ -66,8 +66,8 @@ static int snd_pcm_plugin_alloc(struct sreturn -ENXIO ; size /=8 ;if (plugin->buf_frames < frames) { -vfree (plugin->buf); - plugin->buf =vmalloc (size); +kvfree (plugin->buf); + plugin->buf =kvzalloc (size,GFP_KERNEL ); plugin->buf_frames = frames; }if (!plugin->buf) {
@@ -191,7 +191,7 @@ int snd_pcm_plugin_free(struct snd_pcm_pif (plugin->private_free) plugin->private_free (plugin);kfree (plugin->buf_channels); -vfree (plugin->buf); +kvfree (plugin->buf);kfree (plugin);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 13/100 MAINTAINERS: Add Sasha as a stable branch maintainer
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit cb5d21946d2a2f4687c482ab4604af1d29dac35a upstream.
Sasha has somehow been convinced into helping me with the stable kernel maintenance. Codify this slip in good judgement before he realizes what he really signed up for :)
--- MAINTAINERS | 1 + 1 file changed, 1 insertion(+)
MAINTAINERS +1 -0
@@ -12662,6 +12662,7 @@ F: arch/alpha/kernel/srm_env.c STABLE BRANCH M: Greg Kroah-Hartman <[email protected]> +M: Sasha Levin <[email protected]> L: [email protected] S: Supported F: Documentation/process/stable-kernel-rules.rst
Greg Kroah-Hartman
maintainerPATCH 14/100 mmc: sdhci-pci: Try "cd" for card-detect lookup before using NULL
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajat Jain <[email protected]>
commit cdcefe6bd9df754f528ffc339d3cc143cea4ddf6 upstream.
Problem:
The card detect IRQ does not work with modern BIOS (that want to use _DSD to provide the card detect GPIO to the driver).
Details:
The mmc core provides the mmc_gpiod_request_cd() API to let host drivers request the gpio descriptor for the "card detect" pin.
This pin is specified in the ACPI for the SDHC device:
* Either as a resource using _CRS. This is a method used by legacy BIOS. (The driver needs to tell which resource index).
* Or as a named property ("cd-gpios"/"cd-gpio") in _DSD (which internally points to an entry in _CRS). This way, the driver can lookup using a string. This is what modern BIOS prefer to use.
This API finally results in a call to the following code:
struct gpio_desc *acpi_find_gpio(..., const char *con_id,...) {
...
/* Lookup gpio (using "<con_id>-gpio") in the _DSD */
...
if (!acpi_can_fallback_to_crs(adev, con_id))
return ERR_PTR(-ENOENT);
...
/* Falling back to _CRS is allowed, Lookup gpio in the _CRS */
...
}
Note that this means that if the ACPI has _DSD properties, the kernel will never use _CRS for the lookup (Because acpi_can_fallback_to_crs() will always be false for any device hat has _DSD entries).
The SDHCI driver is thus currently broken on a modern BIOS, even if BIOS provides both _CRS (for index based lookup) and _DSD entries (for string based lookup). Ironically, none of these will be used for the lookup currently because:
* Since the con_id is NULL, acpi_find_gpio() does not find a matching entry in DSDT. (The _DSDT entry has the property name = "cd-gpios")
* Because ACPI contains DSDT entries, thus acpi_can_fallback_to_crs() returns false (because device properties have been populated from _DSD), thus the _CRS is never used for the lookup.
Fix:
Try "cd" for lookup in the _DSD before falling back to using NULL so as to try looking up in the _CRS.
I've tested this patch successfully with both Legacy BIOS (that provide only _CRS method) as well as modern BIOS (that provide both _CRS and _DSD). Also the use of "cd" appears to be fairly consistent across other users of this API (other MMC host controller drivers).
--- drivers/mmc/host/sdhci-pci-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/mmc/host/sdhci-pci-core.c +6 -1
@@ -1607,8 +1607,13 @@ static struct sdhci_pci_slot *sdhci_pci_ host->mmc->caps2 |=MMC_CAP2_NO_PRESCAN_POWERUP ;if (slot->cd_idx >=0 ) { - ret =mmc_gpiod_request_cd (host->mmc,NULL , slot->cd_idx, + ret =mmc_gpiod_request_cd (host->mmc,"cd" , slot->cd_idx, slot->cd_override_level,0 ,NULL ); +if (ret && ret != -EPROBE_DEFER ) + ret =mmc_gpiod_request_cd (host->mmc,NULL , + slot->cd_idx, + slot->cd_override_level, +0 ,NULL );if (ret == -EPROBE_DEFER ) goto remove;
Greg Kroah-Hartman
maintainerPATCH 15/100 gpio: dont free unallocated ida on gpiochip_add_data_with_key() error path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <[email protected]>
commit a05a14049999598a3bb6fab12db6b768a0215522 upstream.
The change corrects the error path in gpiochip_add_data_with_key() by avoiding to call ida_simple_remove(), if ida_simple_get() returns an error.
Note that ida_simple_remove()/ida_free() throws a BUG(), if id argument is negative, it allows to easily check the correctness of the fix by fuzzing the return value from ida_simple_get().
--- drivers/gpio/gpiolib.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpio/gpiolib.c +3 -2
@@ -1166,7 +1166,7 @@ int gpiochip_add_data(struct gpio_chip * gdev->descs =kcalloc (chip->ngpio,sizeof (gdev->descs[0 ]),GFP_KERNEL );if (!gdev->descs) { status = -ENOMEM ; - goto err_free_gdev; + goto err_free_ida; }if (chip->ngpio ==0 ) {
@@ -1298,8 +1298,9 @@ err_free_label:kfree (gdev->label); err_free_descs:kfree (gdev->descs); -err_free_gdev: +err_free_ida:ida_simple_remove (&gpio_ida, gdev->id); +err_free_gdev:/* failures here can mean systems won't boot... */ pr_err("%s: GPIOs %d..%d (%s) failed to register\n", __func__, gdev->base, gdev->base + gdev->ngpio - 1,
Greg Kroah-Hartman
maintainerPATCH 16/100 iwlwifi: mvm: support sta_statistics() even on older firmware
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit ec484d03ef0df8d34086b95710e355a259cbe1f2 upstream.
The oldest firmware supported by iwlmvm do support getting the average beacon RSSI. Enable the sta_statistics() call from mac80211 even on older firmware versions.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +0 -4
@@ -4189,10 +4189,6 @@ static void iwl_mvm_mac_sta_statistics(s sinfo->filled |=BIT (NL80211_STA_INFO_SIGNAL_AVG ); } -if (!fw_has_capa (&mvm->fw->ucode_capa, -IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS )) -return ; -/* if beacon filtering isn't on mac80211 does it anyway */ if (!(vif->driver_flags &IEEE80211_VIF_BEACON_FILTER ))return ;
Greg Kroah-Hartman
maintainerPATCH 17/100 iwlwifi: mvm: fix regulatory domain update when the firmware starts
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
commit 82715ac71e6b94a2c2136e31f3a8e6748e33aa8c upstream.
When the firmware starts, it doesn't have any regulatory information, hence it uses the world wide limitations. The driver can feed the firmware with previous knowledge that was kept in the driver, but the firmware may still not update its internal tables.
This happens when we start a BSS interface, and then the firmware can change the regulatory tables based on our location and it'll use more lenient, location specific rules. Then, if the firmware is shut down (when the interface is brought down), and then an AP interface is created, the firmware will forget the country specific rules.
The host will think that we are in a certain country that may allow channels and will try to teach the firmware about our location, but the firmware may still not allow to drop the world wide limitations and apply country specific rules because it was just re-started.
In this case, the firmware will reply with MCC_RESP_ILLEGAL to the MCC_UPDATE_CMD. In that case, iwlwifi needs to let the upper layers (cfg80211 / hostapd) know that the channel list they know about has been updated.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=201105
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 8 ++++++-- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 5 ++--- 2 files changed, 8 insertions(+), 5 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +6 -2
@@ -328,8 +328,12 @@ struct ieee80211_regdomain *iwl_mvm_get_ goto out; } -if (changed) - *changed = (resp->status ==MCC_RESP_NEW_CHAN_PROFILE ); +if (changed) { +u32 status =le32_to_cpu (resp->status); + + *changed = (status ==MCC_RESP_NEW_CHAN_PROFILE || + status ==MCC_RESP_ILLEGAL ); + } regd = iwl_parse_nvm_mcc_info(mvm->trans->dev, mvm->cfg, __le32_to_cpu(resp->n_channels),
drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +2 -3
@@ -732,9 +732,8 @@ iwl_mvm_update_mcc(struct iwl_mvm *mvm, }IWL_DEBUG_LAR (mvm, -"MCC response status: 0x%x. new MCC: 0x%x ('%c%c') change: %d n_chans: %d\n" , - status, mcc, mcc >>8 , mcc &0xff , - !!(status ==MCC_RESP_NEW_CHAN_PROFILE ), n_channels); +"MCC response status: 0x%x. new MCC: 0x%x ('%c%c') n_chans: %d\n" , + status, mcc, mcc >>8 , mcc &0xff , n_channels); exit:iwl_free_resp (&cmd);
Greg Kroah-Hartman
maintainerPATCH 18/100 iwlwifi: mvm: dont use SAR Geo if basic SAR is not used
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Coelho <[email protected]>
commit 5d041c46ccb9b48acc110e214beff5e2789311df upstream.
We can't use SAR Geo if basic SAR is not enabled, since the SAR Geo tables define offsets in relation to the basic SAR table in use.
To fix this, make iwl_mvm_sar_init() return one in case WRDS is not available, so we can skip reading WGDS entirely.
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 36 +++++++++++++++++++++------- 1 file changed, 28 insertions(+), 8 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +28 -8
@@ -997,6 +997,11 @@ static int iwl_mvm_sar_get_ewrd_table(streturn -ENOENT ; } +static int iwl_mvm_sar_get_wgds_table (struct iwl_mvm *mvm) +{ +return -ENOENT ; +} +static int iwl_mvm_sar_geo_init (struct iwl_mvm *mvm) {return 0 ;
@@ -1023,8 +1028,11 @@ static int iwl_mvm_sar_init(struct iwl_mIWL_DEBUG_RADIO (mvm,"WRDS SAR BIOS table invalid or unavailable. (%d)\n" , ret); -/* if not available, don't fail and don't bother with EWRD */ -return 0 ; +/* +* If not available, don't fail and don't bother with EWRD. +* Return 1 to tell that we can't use WGDS either. +*/ +return 1 ; } ret =iwl_mvm_sar_get_ewrd_table (mvm);
@@ -1037,9 +1045,13 @@ static int iwl_mvm_sar_init(struct iwl_m/* choose profile 1 (WRDS) as default for both chains */ ret =iwl_mvm_sar_select_profile (mvm,1 ,1 ); -/* if we don't have profile 0 from BIOS, just skip it */ +/* +* If we don't have profile 0 from BIOS, just skip it. This +* means that SAR Geo will not be enabled either, even if we +* have other valid profiles. +*/ if (ret == -ENOENT ) -return 0 ; +return 1 ;return ret; }
@@ -1229,11 +1241,19 @@ int iwl_mvm_up(struct iwl_mvm *mvm)iwl_mvm_unref (mvm,IWL_MVM_REF_UCODE_DOWN ); ret =iwl_mvm_sar_init (mvm); -if (ret) - goto error; +if (ret ==0 ) { + ret =iwl_mvm_sar_geo_init (mvm); + }else if (ret >0 && !iwl_mvm_sar_get_wgds_table (mvm)) { +/* +* If basic SAR is not available, we check for WGDS, +* which should *not* be available either. If it is +* available, issue an error, because we can't use SAR +* Geo without basic SAR. +*/ +IWL_ERR (mvm,"BIOS contains WGDS but no WRDS\n" ); + } - ret =iwl_mvm_sar_geo_init (mvm); -if (ret) +if (ret <0 ) goto error;iwl_mvm_leds_sync (mvm);
Greg Kroah-Hartman
maintainerPATCH 19/100 brcmfmac: fix reporting support for 160 MHz channels
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <[email protected]>
commit d1fe6ad6f6bd61c84788d3a7b11e459a439c6169 upstream.
Driver can report IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ so it's important to provide valid & complete info about supported bands for each channel. By default no support for 160 MHz should be assumed unless firmware reports it for a given channel later.
This fixes info passed to the userspace. Without that change userspace could try to use invalid channel and fail to start an interface.
--- drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +2 -1
@@ -6098,7 +6098,8 @@ static int brcmf_construct_chaninfo(stru* for subsequent chanspecs. */ channel->flags =IEEE80211_CHAN_NO_HT40 | -IEEE80211_CHAN_NO_80MHZ ; +IEEE80211_CHAN_NO_80MHZ | +IEEE80211_CHAN_NO_160MHZ ; ch.bw =BRCMU_CHAN_BW_20 ; cfg->d11inf.encchspec (&ch); chaninfo = ch.chspec;
Greg Kroah-Hartman
maintainerPATCH 20/100 tools/power/cpupower: fix compilation with STATIC=true
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 9de9aa45e9bd67232e000cca42ceb134b8ae51b6 upstream.
Rename duplicate sysfs_read_file into cpupower_read_sysfs and fix linking.
--- tools/power/cpupower/bench/Makefile | 2 +- tools/power/cpupower/lib/cpufreq.c | 2 +- tools/power/cpupower/lib/cpuidle.c | 2 +- tools/power/cpupower/lib/cpupower.c | 4 ++-- tools/power/cpupower/lib/cpupower_intern.h | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-)
tools/power/cpupower/bench/Makefile +1 -1
@@ -9,7 +9,7 @@ endif ifeq ($(strip $(STATIC)),true) LIBS = -L../ -L$(OUTPUT) -lm OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o \ - $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/sysfs.o + $(OUTPUT)../lib/cpufreq.o $(OUTPUT)../lib/cpupower.o else LIBS = -L../ -L$(OUTPUT) -lm -lcpupower OBJS = $(OUTPUT)main.o $(OUTPUT)parse.o $(OUTPUT)system.o $(OUTPUT)benchmark.o
tools/power/cpupower/lib/cpufreq.c +1 -1
@@ -28,7 +28,7 @@ static unsigned int sysfs_cpufreq_read_fsnprintf (path,sizeof (path),PATH_TO_CPU "cpu%u/cpufreq/%s" , cpu, fname); -return sysfs_read_file (path, buf, buflen); +return cpupower_read_sysfs (path, buf, buflen); }/* helper function to write a new value to a /sys file */
tools/power/cpupower/lib/cpuidle.c +1 -1
@@ -319,7 +319,7 @@ static unsigned int sysfs_cpuidle_read_fsnprintf (path,sizeof (path),PATH_TO_CPU "cpuidle/%s" , fname); -return sysfs_read_file (path, buf, buflen); +return cpupower_read_sysfs (path, buf, buflen); }
tools/power/cpupower/lib/cpupower.c +2 -2
@@ -15,7 +15,7 @@#include "cpupower.h" #include "cpupower_intern.h" -unsigned int sysfs_read_file (const char *path,char *buf,size_t buflen) +unsigned int cpupower_read_sysfs (const char *path,char *buf,size_t buflen) {int fd;ssize_t numread;
@@ -95,7 +95,7 @@ static int sysfs_topology_read_file(unsisnprintf (path,sizeof (path),PATH_TO_CPU "cpu%u/topology/%s" , cpu, fname); -if (sysfs_read_file (path, linebuf,MAX_LINE_LEN ) ==0 ) +if (cpupower_read_sysfs (path, linebuf,MAX_LINE_LEN ) ==0 )return -1 ; *result =strtol (linebuf, &endp,0 );if (endp == linebuf || errno ==ERANGE )
tools/power/cpupower/lib/cpupower_intern.h +1 -1
@@ -3,4 +3,4 @@#define MAX_LINE_LEN 4096#define SYSFS_PATH_MAX 255 -unsigned int sysfs_read_file (const char *path,char *buf,size_t buflen); +unsigned int cpupower_read_sysfs (const char *path,char *buf,size_t buflen);
Greg Kroah-Hartman
maintainerPATCH 21/100 v9fs_dir_readdir: fix double-free on p9stat_read error
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <[email protected]>
commit 81c99089bce693b94b775b6eb888115d2d540086 upstream.
p9stat_read will call p9stat_free on error, we should only free the struct content on success.
There also is no need to "p9stat_init" st as the read function will zero the whole struct for us anyway, so clean up the code a bit while we are here.
--- fs/9p/vfs_dir.c | 11 ----------- 1 file changed, 11 deletions(-)
fs/9p/vfs_dir.c +0 -11
@@ -76,15 +76,6 @@ static inline int dt_type(struct p9_wstareturn rettype; } -static void p9stat_init (struct p9_wstat *stbuf) -{ - stbuf->name =NULL ; - stbuf->uid =NULL ; - stbuf->gid =NULL ; - stbuf->muid =NULL ; - stbuf->extension =NULL ; -} -/** * v9fs_alloc_rdir_buf - Allocate buffer used for read and readdir * @filp: opened file structure
@@ -145,12 +136,10 @@ static int v9fs_dir_readdir(struct file rdir->tail = n; }while (rdir->head < rdir->tail) { -p9stat_init (&st); err =p9stat_read (fid->clnt, rdir->buf + rdir->head, rdir->tail - rdir->head, &st);if (err) {p9_debug (P9_DEBUG_VFS ,"returned %d\n" , err); -p9stat_free (&st);return -EIO ; } reclen = st.size+2 ;
Greg Kroah-Hartman
maintainerPATCH 22/100 selinux: Add __GFP_NOWARN to allocation at str_read()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 4458bba09788e70e8fb39ad003f087cd9dfbd6ac upstream.
syzbot is hitting warning at str_read() [1] because len parameter can become larger than KMALLOC_MAX_SIZE. We don't need to emit warning for this case.
[1] https://syzkaller.appspot.com/bug?id=7f2f5aad79ea8663c296a2eedb81978401a908f0
--- security/selinux/ss/policydb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/selinux/ss/policydb.c +1 -1
@@ -1099,7 +1099,7 @@ static int str_read(char **strp, gfp_t fif ((len ==0 ) || (len == (u32)-1 ))return -EINVAL ; - str =kmalloc (len +1 , flags); + str =kmalloc (len +1 , flags | __GFP_NOWARN);if (!str)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 23/100 Input: synaptics - avoid using uninitialized variable when probing
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit f39f8688888ae74fa8deae2d01289b69b4727394 upstream.
synaptics_detect() does not check whether sending commands to the device succeeds and instead relies on getting unique data from the device. Let's make sure we seed entire buffer with zeroes to make sure we will not use garbage on stack that just happen to be 0x47.
--- drivers/input/mouse/synaptics.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/input/mouse/synaptics.c +1 -3
@@ -99,9 +99,7 @@ static int synaptics_mode_cmd(struct psmint synaptics_detect (struct psmouse *psmouse,bool set_properties) {struct ps2dev *ps2dev = &psmouse->ps2dev; -u8 param[4 ]; - - param[0 ] =0 ; +u8 param[4 ] = {0 };ps2_command (ps2dev, param,PSMOUSE_CMD_SETRES );ps2_command (ps2dev, param,PSMOUSE_CMD_SETRES );
Greg Kroah-Hartman
maintainerPATCH 24/100 bfs: add sanity check at bfs_fill_super()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 9f2df09a33aa2c76ce6385d382693f98d7f2f07e upstream.
syzbot is reporting too large memory allocation at bfs_fill_super() [1]. Since file system image is corrupted such that bfs_sb->s_start == 0, bfs_fill_super() is trying to allocate 8MB of continuous memory. Fix this by adding a sanity check on bfs_sb->s_start, __GFP_NOWARN and printf().
[1] https://syzkaller.appspot.com/bug?id=16a87c236b951351374a84c8a32f40edbc034e96
--- fs/bfs/inode.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
fs/bfs/inode.c +6 -3
@@ -350,7 +350,8 @@ static int bfs_fill_super(struct super_b s->s_magic =BFS_MAGIC ; -if (le32_to_cpu (bfs_sb->s_start) >le32_to_cpu (bfs_sb->s_end)) { +if (le32_to_cpu (bfs_sb->s_start) >le32_to_cpu (bfs_sb->s_end) || +le32_to_cpu (bfs_sb->s_start) <BFS_BSIZE ) {printf ("Superblock is corrupted\n" ); goto out1; }
@@ -359,9 +360,11 @@ static int bfs_fill_super(struct super_bsizeof (struct bfs_inode ) +BFS_ROOT_INO -1 ; imap_len = (info->si_lasti /8 ) +1 ; - info->si_imap =kzalloc (imap_len,GFP_KERNEL ); -if (!info->si_imap) + info->si_imap =kzalloc (imap_len,GFP_KERNEL | __GFP_NOWARN); +if (!info->si_imap) { +printf ("Cannot allocate %u bytes\n" , imap_len); goto out1; + }for (i =0 ; i <BFS_ROOT_INO ; i++)set_bit (i, info->si_imap);
Greg Kroah-Hartman
maintainerPATCH 25/100 sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
commit df132eff463873e14e019a07f387b4d577d6d1f9 upstream.
If a transport is removed by asconf but there still are some chunks with this transport queuing on out_chunk_list, later an use-after-free issue will be caused when accessing this transport from these chunks in sctp_outq_flush().
This is an old bug, we fix it by clearing the transport of these chunks in out_chunk_list when removing a transport in sctp_assoc_rm_peer().
--- net/sctp/associola.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/sctp/associola.c +7 -3
@@ -497,8 +497,9 @@ void sctp_assoc_set_primary(struct sctp_void sctp_assoc_rm_peer (struct sctp_association *asoc,struct sctp_transport *peer) { -struct list_head *pos; -struct sctp_transport *transport; +struct sctp_transport *transport; +struct list_head *pos; +struct sctp_chunk *ch;pr_debug ("%s: association:%p addr:%pISpc\n" , __func__, asoc, &peer->ipaddr.sa);
@@ -562,7 +563,6 @@ void sctp_assoc_rm_peer(struct sctp_asso*/ if (!list_empty (&peer->transmitted)) {struct sctp_transport *active = asoc->peer.active_path; -struct sctp_chunk *ch;/* Reset the transport of each chunk on this list */ list_for_each_entry(ch, &peer->transmitted,
@@ -584,6 +584,10 @@ void sctp_assoc_rm_peer(struct sctp_assosctp_transport_hold (active); } +list_for_each_entry (ch, &asoc->outqueue.out_chunk_list, list) +if (ch->transport == peer) + ch->transport =NULL ; + asoc->peer.transport_count--;sctp_transport_free (peer);
Greg Kroah-Hartman
maintainerPATCH 26/100 gfs2: Dont leave s_fs_info pointing to freed memory in init_sbd
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Price <[email protected]>
commit 4c62bd9cea7bcf10292f7e4c57a2bca332942697 upstream.
When alloc_percpu() fails, sdp gets freed but sb->s_fs_info still points to the same address. Move the assignment after that error check so that s_fs_info can only point to a valid sdp or NULL, which is checked for later in the error path, in gfs2_kill_super().
--- fs/gfs2/ops_fstype.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/gfs2/ops_fstype.c +1 -1
@@ -72,13 +72,13 @@ static struct gfs2_sbd *init_sbd(structif (!sdp)return NULL ; - sb->s_fs_info = sdp; sdp->sd_vfs = sb; sdp->sd_lkstats = alloc_percpu(struct gfs2_pcpu_lkstats);if (!sdp->sd_lkstats) {kfree (sdp);return NULL ; } + sb->s_fs_info = sdp;set_bit (SDF_NOJOURNALID , &sdp->sd_flags);gfs2_tune_init (&sdp->sd_tune);
Greg Kroah-Hartman
maintainerPATCH 27/100 llc: do not use sk_eat_skb()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 604d415e2bd642b7e02c80e719e0396b9d4a77a6 upstream.
syzkaller triggered a use-after-free [1], caused by a combination of skb_get() in llc_conn_state_process() and usage of sk_eat_skb()
sk_eat_skb() is assuming the skb about to be freed is only used by the current thread. TCP/DCCP stacks enforce this because current thread holds the socket lock.
llc_conn_state_process() wants to make sure skb does not disappear, and holds a reference on the skb it manipulates. But as soon as this skb is added to socket receive queue, another thread can consume it.
This means that llc must use regular skb_unlink() and kfree_skb() so that both producer and consumer can safely work on the same skb.
[1]
BUG: KASAN: use-after-free in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: use-after-free in refcount_read include/linux/refcount.h:43 [inline]
BUG: KASAN: use-after-free in skb_unref include/linux/skbuff.h:967 [inline]
BUG: KASAN: use-after-free in kfree_skb+0xb7/0x580 net/core/skbuff.c:655
Read of size 4 at addr ffff8801d1f6fba4 by task ksoftirqd/1/18
CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.0-rc8+ #295
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b6 lib/dump_stack.c:113
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
check_memory_region_inline mm/kasan/kasan.c:260 [inline]
check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
refcount_read include/linux/refcount.h:43 [inline]
skb_unref include/linux/skbuff.h:967 [inline]
kfree_skb+0xb7/0x580 net/core/skbuff.c:655
llc_sap_state_process+0x9b/0x550 net/llc/llc_sap.c:224
llc_sap_rcv+0x156/0x1f0 net/llc/llc_sap.c:297
llc_sap_handler+0x65e/0xf80 net/llc/llc_sap.c:438
llc_rcv+0x79e/0xe20 net/llc/llc_input.c:208
__netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
__netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
process_backlog+0x218/0x6f0 net/core/dev.c:5829
napi_poll net/core/dev.c:6249 [inline]
net_rx_action+0x7c5/0x1950 net/core/dev.c:6315
__do_softirq+0x30c/0xb03 kernel/softirq.c:292
run_ksoftirqd+0x94/0x100 kernel/softirq.c:653
smpboot_thread_fn+0x68b/0xa00 kernel/smpboot.c:164
kthread+0x35a/0x420 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413
Allocated by task 18:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc_node+0x144/0x730 mm/slab.c:3644
__alloc_skb+0x119/0x770 net/core/skbuff.c:193
alloc_skb include/linux/skbuff.h:995 [inline]
llc_alloc_frame+0xbc/0x370 net/llc/llc_sap.c:54
llc_station_ac_send_xid_r net/llc/llc_station.c:52 [inline]
llc_station_rcv+0x1dc/0x1420 net/llc/llc_station.c:111
llc_rcv+0xc32/0xe20 net/llc/llc_input.c:220
__netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
__netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
process_backlog+0x218/0x6f0 net/core/dev.c:5829
napi_poll net/core/dev.c:6249 [inline]
net_rx_action+0x7c5/0x1950 net/core/dev.c:6315
__do_softirq+0x30c/0xb03 kernel/softirq.c:292
Freed by task 16383:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kmem_cache_free+0x83/0x290 mm/slab.c:3756
kfree_skbmem+0x154/0x230 net/core/skbuff.c:582
__kfree_skb+0x1d/0x20 net/core/skbuff.c:642
sk_eat_skb include/net/sock.h:2366 [inline]
llc_ui_recvmsg+0xec2/0x1610 net/llc/af_llc.c:882
sock_recvmsg_nosec net/socket.c:794 [inline]
sock_recvmsg+0xd0/0x110 net/socket.c:801
___sys_recvmsg+0x2b6/0x680 net/socket.c:2278
__sys_recvmmsg+0x303/0xb90 net/socket.c:2390
do_sys_recvmmsg+0x181/0x1a0 net/socket.c:2466
__do_sys_recvmmsg net/socket.c:2484 [inline]
__se_sys_recvmmsg net/socket.c:2480 [inline]
__x64_sys_recvmmsg+0xbe/0x150 net/socket.c:2480
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801d1f6fac0
which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 228 bytes inside of
232-byte region [ffff8801d1f6fac0, ffff8801d1f6fba8)
The buggy address belongs to the page:
page:ffffea000747dbc0 count:1 mapcount:0 mapping:ffff8801d9be7680 index:0xffff8801d1f6fe80
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0007346e88 ffffea000705b108 ffff8801d9be7680
raw: ffff8801d1f6fe80 ffff8801d1f6f0c0 000000010000000b 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801d1f6fa80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff8801d1f6fb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801d1f6fb80: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
^
ffff8801d1f6fc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801d1f6fc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc--- net/llc/af_llc.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
net/llc/af_llc.c +4 -7
@@ -730,7 +730,6 @@ static int llc_ui_recvmsg(struct socketstruct sk_buff *skb =NULL ;struct sock *sk = sock->sk;struct llc_sock *llc =llc_sk (sk); -unsigned long cpu_flags;size_t copied =0 ;u32 peek_seq =0 ;u32 *seq, skb_len;
@@ -855,9 +854,8 @@ static int llc_ui_recvmsg(struct socket goto copy_uaddr;if (!(flags &MSG_PEEK )) { -spin_lock_irqsave (&sk->sk_receive_queue.lock, cpu_flags); -sk_eat_skb (sk, skb); -spin_unlock_irqrestore (&sk->sk_receive_queue.lock, cpu_flags); +skb_unlink (skb, &sk->sk_receive_queue); +kfree_skb (skb); *seq =0 ; }
@@ -878,9 +876,8 @@ copy_uaddr:llc_cmsg_rcv (msg, skb);if (!(flags &MSG_PEEK )) { -spin_lock_irqsave (&sk->sk_receive_queue.lock, cpu_flags); -sk_eat_skb (sk, skb); -spin_unlock_irqrestore (&sk->sk_receive_queue.lock, cpu_flags); +skb_unlink (skb, &sk->sk_receive_queue); +kfree_skb (skb); *seq =0 ; }
Greg Kroah-Hartman
maintainerPATCH 28/100 mm: dont warn about large allocations for slab
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <[email protected]>
commit 61448479a9f2c954cde0cfe778cb6bec5d0a748d upstream.
Slub does not call kmalloc_slab() for sizes > KMALLOC_MAX_CACHE_SIZE, instead it falls back to kmalloc_large().
For slab KMALLOC_MAX_CACHE_SIZE == KMALLOC_MAX_SIZE and it calls kmalloc_slab() for all allocations relying on NULL return value for over-sized allocations.
This inconsistency leads to unwanted warnings from kmalloc_slab() for over-sized allocations for slab. Returning NULL for failed allocations is the expected behavior.
Make slub and slab code consistent by checking size > KMALLOC_MAX_CACHE_SIZE in slab before calling kmalloc_slab().
While we are here also fix the check in kmalloc_slab(). We should check against KMALLOC_MAX_CACHE_SIZE rather than KMALLOC_MAX_SIZE. It all kinda worked because for slab the constants are the same, and slub always checks the size against KMALLOC_MAX_CACHE_SIZE before kmalloc_slab(). But if we get there with size > KMALLOC_MAX_CACHE_SIZE anyhow bad things will happen. For example, in case of a newly introduced bug in slub code.
Also move the check in kmalloc_slab() from function entry to the size > 192 case. This partially compensates for the additional check in slab code and makes slub code a bit faster (at least theoretically).
Also drop __GFP_NOWARN in the warning check. This warning means a bug in slab code itself, user-passed flags have nothing to do with it.
Nothing of this affects slob.
--- mm/slab.c | 4 ++++ mm/slab_common.c | 12 ++++++------ 2 files changed, 10 insertions(+), 6 deletions(-)
mm/slab.c +4 -0
@@ -3670,6 +3670,8 @@ __do_kmalloc_node(size_t size, gfp_t flastruct kmem_cache *cachep;void *ret; +if (unlikely (size >KMALLOC_MAX_CACHE_SIZE )) +return NULL ; cachep =kmalloc_slab (size, flags);if (unlikely (ZERO_OR_NULL_PTR (cachep)))return cachep;
@@ -3705,6 +3707,8 @@ static __always_inline void *__do_kmallostruct kmem_cache *cachep;void *ret; +if (unlikely (size >KMALLOC_MAX_CACHE_SIZE )) +return NULL ; cachep =kmalloc_slab (size, flags);if (unlikely (ZERO_OR_NULL_PTR (cachep)))return cachep;
mm/slab_common.c +6 -6
@@ -971,18 +971,18 @@ struct kmem_cache *kmalloc_slab(size_t s {int index; -if (unlikely (size >KMALLOC_MAX_SIZE )) { -WARN_ON_ONCE (!(flags & __GFP_NOWARN)); -return NULL ; - } -if (size <=192 ) {if (!size)return ZERO_SIZE_PTR ; index = size_index[size_index_elem (size)]; - }else + }else { +if (unlikely (size >KMALLOC_MAX_CACHE_SIZE )) { +WARN_ON (1 ); +return NULL ; + } index =fls (size -1 ); + }#ifdef CONFIG_ZONE_DMA if (unlikely ((flags &GFP_DMA )))
Greg Kroah-Hartman
maintainerPATCH 29/100 mm/memory.c: recheck page table entry with page table lock held
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aneesh Kumar K.V <[email protected]>
commit ff09d7ec9786be4ad7589aa987d7dc66e2dd9160 upstream.
We clear the pte temporarily during read/modify/write update of the pte. If we take a page fault while the pte is cleared, the application can get SIGBUS. One such case is with remap_pfn_range without a backing vm_ops->fault callback. do_fault will return SIGBUS in that case.
cpu 0 cpu1mprotect()
ptep_modify_prot_start()/pte cleared.
.
. page fault.
.
.prep_modify_prot_commit()
Fix this by taking page table lock and rechecking for pte_none.
--- mm/memory.c | 34 ++++++++++++++++++++++++++++++---- 1 file changed, 30 insertions(+), 4 deletions(-)
mm/memory.c +30 -4
@@ -3697,10 +3697,36 @@ static int do_fault(struct vm_fault *vmfstruct vm_area_struct *vma = vmf->vma;int ret; -/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ -if (!vma->vm_ops->fault) - ret =VM_FAULT_SIGBUS ; -else if (!(vmf->flags &FAULT_FLAG_WRITE )) +/* +* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND +*/ +if (!vma->vm_ops->fault) { +/* +* If we find a migration pmd entry or a none pmd entry, which +* should never happen, return SIGBUS +*/ +if (unlikely (!pmd_present (*vmf->pmd))) + ret =VM_FAULT_SIGBUS ; +else { + vmf->pte =pte_offset_map_lock (vmf->vma->vm_mm, + vmf->pmd, + vmf->address, + &vmf->ptl); +/* +* Make sure this is not a temporary clearing of pte +* by holding ptl and checking again. A R/M/W update +* of pte involves: take ptl, clearing the pte so that +* we don't have concurrent modification by hardware +* followed by an update. +*/ +if (unlikely (pte_none (*vmf->pte))) + ret =VM_FAULT_SIGBUS ; +else + ret =VM_FAULT_NOPAGE ; + +pte_unmap_unlock (vmf->pte, vmf->ptl); + } + }else if (!(vmf->flags &FAULT_FLAG_WRITE )) ret =do_read_fault (vmf);else if (!(vma->vm_flags &VM_SHARED )) ret =do_cow_fault (vmf);
Greg Kroah-Hartman
maintainerPATCH 30/100 tcp: do not release socket ownership in tcp_close()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 8873c064d1de579ea23412a6d3eee972593f142b upstream.
syzkaller was able to hit the WARN_ON(sock_owned_by_user(sk)); in tcp_close()
While a socket is being closed, it is very possible other threads find it in rtnetlink dump.
tcp_get_info() will acquire the socket lock for a short amount of time (slow = lock_sock_fast(sk)/unlock_sock_fast(sk, slow);), enough to trigger the warning.
--- include/net/sock.h | 1 + net/core/sock.c | 2 +- net/ipv4/tcp.c | 11 +++-------- 3 files changed, 5 insertions(+), 9 deletions(-)
include/net/sock.h +1 -0
@@ -1452,6 +1452,7 @@ static inline void lock_sock(struct socklock_sock_nested (sk,0 ); } +void __release_sock (struct sock *sk);void release_sock (struct sock *sk);/* BH context may only use the following locking interface. */
net/core/sock.c +1 -1
@@ -2242,7 +2242,7 @@ static void __lock_sock(struct sock *sk)finish_wait (&sk->sk_lock.wq, &wait); } -static void __release_sock (struct sock *sk) +void __release_sock (struct sock *sk) __releases(&sk->sk_lock.slock) __acquires(&sk->sk_lock.slock) {
net/ipv4/tcp.c +3 -8
@@ -2217,16 +2217,10 @@ adjudge_to_death:sock_hold (sk);sock_orphan (sk); -/* It is the last release_sock in its life. It will remove backlog. */ -release_sock (sk); - - -/* Now socket is owned by kernel and we acquire BH lock -* to finish close. No need to check for user refs. -*/ local_bh_disable ();bh_lock_sock (sk); -WARN_ON (sock_owned_by_user (sk)); +/* remove backlog if any, without releasing ownership. */ +__release_sock (sk);percpu_counter_inc (sk->sk_prot->orphan_count);
@@ -2295,6 +2289,7 @@ adjudge_to_death: out:bh_unlock_sock (sk);local_bh_enable (); +release_sock (sk);sock_put (sk); }EXPORT_SYMBOL (tcp_close);
Greg Kroah-Hartman
maintainerPATCH 31/100 IB/core: Perform modify QP on real one
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Parav Pandit <[email protected]>
commit b2bedfb39541a7e14798d066b6f8685d84c8fcf5 upstream.
Currently qp->port stores the port number whenever IB_QP_PORT QP attribute mask is set (during QP state transition to INIT state). This port number should be stored for the real QP when XRC target QP is used.
Follow the ib_modify_qp() implementation and hide the access to ->real_qp.
--- drivers/infiniband/core/verbs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/infiniband/core/verbs.c +3 -2
@@ -1285,7 +1285,7 @@ EXPORT_SYMBOL(ib_resolve_eth_dmac);/** * ib_modify_qp_with_udata - Modifies the attributes for the specified QP. -* @qp: The QP to modify. +* @ib_qp: The QP to modify. * @attr: On input, specifies the QP attributes to modify. On output, * the current values of selected QP attributes are returned. * @attr_mask: A bit-mask used to specify which attributes of the QP
@@ -1294,9 +1294,10 @@ EXPORT_SYMBOL(ib_resolve_eth_dmac);* are being modified. * It returns 0 on success and returns appropriate error code on error. */ -int ib_modify_qp_with_udata (struct ib_qp *qp,struct ib_qp_attr *attr, +int ib_modify_qp_with_udata (struct ib_qp *ib_qp,struct ib_qp_attr *attr,int attr_mask,struct ib_udata *udata) { +struct ib_qp *qp = ib_qp->real_qp;int ret;if (attr_mask &IB_QP_AV ) {
Greg Kroah-Hartman
maintainerPATCH 32/100 usb: xhci: Prevent bus suspend if a port connect change or polling state is detected
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 2f31a67f01a8beb22cae754c53522cb61a005750 upstream.
USB3 roothub might autosuspend before a plugged USB3 device is detected, causing USB3 device enumeration failure.
USB3 devices don't show up as connected and enabled until USB3 link trainig completes. On a fast booting platform with a slow USB3 link training the link might reach the connected enabled state just as the bus is suspending.
If this device is discovered first time by the xhci_bus_suspend() routine it will be put to U3 suspended state like the other ports which failed to suspend earlier.
The hub thread will notice the connect change and resume the bus, moving the port back to U0
This U0 -> U3 -> U0 transition right after being connected seems to be too much for some devices, causing them to first go to SS.Inactive state, and finally end up stuck in a polling state with reset asserted
Fix this by failing the bus suspend if a port has a connect change or is in a polling state in xhci_bus_suspend().
Don't do any port changes until all ports are checked, buffer all port changes and only write them in the end if suspend can proceed
--- drivers/usb/host/xhci-hub.c | 60 +++++++++++++++++++++++++++++++++----------- 1 file changed, 46 insertions(+), 14 deletions(-)
drivers/usb/host/xhci-hub.c +46 -14
@@ -1481,13 +1481,16 @@ int xhci_bus_suspend(struct usb_hcd *hcd__le32 __iomem **port_array;struct xhci_bus_state *bus_state;unsigned long flags; +u32 portsc_buf[USB_MAXCHILDREN ]; +bool wake_enabled; max_ports =xhci_get_ports (hcd, &port_array); bus_state = &xhci->bus_state[hcd_index (hcd)]; + wake_enabled = hcd->self.root_hub->do_remote_wakeup;spin_lock_irqsave (&xhci->lock, flags); -if (hcd->self.root_hub->do_remote_wakeup) { +if (wake_enabled) {if (bus_state->resuming_ports ||/* USB2 */ bus_state->port_remote_wakeup) {/* USB3 */ spin_unlock_irqrestore (&xhci->lock, flags);
@@ -1495,26 +1498,36 @@ int xhci_bus_suspend(struct usb_hcd *hcdreturn -EBUSY ; } } - - port_index = max_ports; +/* +* Prepare ports for suspend, but don't write anything before all ports +* are checked and we know bus suspend can proceed +*/ bus_state->bus_suspended =0 ; + port_index = max_ports;while (port_index--) { -/* suspend the port if the port is not suspended */ u32 t1, t2; -int slot_id; t1 =readl (port_array[port_index]); t2 =xhci_port_state_to_neutral (t1); + portsc_buf[port_index] =0 ; -if ((t1 &PORT_PE ) && !(t1 &PORT_PLS_MASK )) { -xhci_dbg (xhci,"port %d not suspended\n" , port_index); - slot_id =xhci_find_slot_id_by_port (hcd, xhci, - port_index +1 ); -if (slot_id) { +/* Bail out if a USB3 port has a new device in link training */ +if ((t1 &PORT_PLS_MASK ) ==XDEV_POLLING ) { + bus_state->bus_suspended =0 ; +spin_unlock_irqrestore (&xhci->lock, flags); +xhci_dbg (xhci,"Bus suspend bailout, port in polling\n" ); +return -EBUSY ; + } + +/* suspend ports in U0, or bail out for new connect changes */ +if ((t1 &PORT_PE ) && (t1 &PORT_PLS_MASK ) ==XDEV_U0 ) { +if ((t1 &PORT_CSC ) && wake_enabled) { + bus_state->bus_suspended =0 ;spin_unlock_irqrestore (&xhci->lock, flags); -xhci_stop_device (xhci, slot_id,1 ); -spin_lock_irqsave (&xhci->lock, flags); +xhci_dbg (xhci,"Bus suspend bailout, port connect change\n" ); +return -EBUSY ; } +xhci_dbg (xhci,"port %d not suspended\n" , port_index); t2 &= ~PORT_PLS_MASK ; t2 |=PORT_LINK_STROBE |XDEV_U3 ;set_bit (port_index, &bus_state->bus_suspended);
@@ -1523,7 +1536,7 @@ int xhci_bus_suspend(struct usb_hcd *hcd* including the USB 3.0 roothub, but only if CONFIG_PM * is enabled, so also enable remote wake here. */ -if (hcd->self.root_hub->do_remote_wakeup) { +if (wake_enabled) {if (t1 &PORT_CONNECT ) { t2 |=PORT_WKOC_E |PORT_WKDISC_E ; t2 &= ~PORT_WKCONN_E ;
@@ -1543,7 +1556,26 @@ int xhci_bus_suspend(struct usb_hcd *hcd t1 =xhci_port_state_to_neutral (t1);if (t1 != t2) -writel (t2, port_array[port_index]); + portsc_buf[port_index] = t2; + } + +/* write port settings, stopping and suspending ports if needed */ + port_index = max_ports; +while (port_index--) { +if (!portsc_buf[port_index]) +continue ; +if (test_bit (port_index, &bus_state->bus_suspended)) { +int slot_id; + + slot_id =xhci_find_slot_id_by_port (hcd, xhci, + port_index +1 ); +if (slot_id) { +spin_unlock_irqrestore (&xhci->lock, flags); +xhci_stop_device (xhci, slot_id,1 ); +spin_lock_irqsave (&xhci->lock, flags); + } + } +writel (portsc_buf[port_index], port_array[port_index]); } hcd->state =HC_STATE_SUSPENDED ; bus_state->next_statechange = jiffies +msecs_to_jiffies (10 );
Greg Kroah-Hartman
maintainerPATCH 33/100 drm/ast: change resolution may cause screen blurred
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Y.C. Chen <[email protected]>
commit 1a37bd823891568f8721989aed0615835632d81a upstream.
The value of pitches is not correct while calling mode_set. The issue we found so far on following system:
- Debian8 with XFCE Desktop
- Ubuntu with KDE Desktop
- SUSE15 with KDE Desktop
--- drivers/gpu/drm/ast/ast_mode.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/ast/ast_mode.c +1 -0
@@ -568,6 +568,7 @@ static int ast_crtc_do_set_base(struct d }ast_bo_unreserve (bo); +ast_set_offset_reg (crtc);ast_set_start_address_crt1 (crtc, (u32 )gpu_addr);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 34/100 drm/ast: fixed cursor may disappear sometimes
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Y.C. Chen <[email protected]>
commit 7989b9ee8bafe5cc625381dd0c3c4586de27ca26 upstream.
--- drivers/gpu/drm/ast/ast_mode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/ast/ast_mode.c +1 -1
@@ -1255,7 +1255,7 @@ static int ast_cursor_move(struct drm_crast_set_index_reg (ast,AST_IO_CRTC_PORT ,0xc7 , ((y >>8 ) &0x07 ));/* dummy write to fire HWC */ -ast_set_index_reg_mask (ast,AST_IO_CRTC_PORT ,0xCB ,0xFF ,0x00 ); +ast_show_cursor (crtc);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 35/100 drm/ast: Remove existing framebuffers before loading driver
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
commit 5478ad10e7850ce3d8b7056db05ddfa3c9ddad9a upstream.
If vesafb attaches to the AST device, it configures the framebuffer memory for uncached access by default. When ast.ko later tries to attach itself to the device, it wants to use write-combining on the framebuffer memory, but vesefb's existing configuration for uncached access takes precedence. This results in reduced performance.
Removing the framebuffer's configuration before loding the AST driver fixes the problem. Other DRM drivers already contain equivalent code.
--- drivers/gpu/drm/ast/ast_drv.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+)
drivers/gpu/drm/ast/ast_drv.c +21 -0
@@ -60,8 +60,29 @@ static const struct pci_device_id pciidlMODULE_DEVICE_TABLE (pci, pciidlist); +static void ast_kick_out_firmware_fb (struct pci_dev *pdev) +{ +struct apertures_struct *ap; +bool primary = false; + + ap =alloc_apertures (1 ); +if (!ap) +return ; + + ap->ranges[0 ].base =pci_resource_start (pdev,0 ); + ap->ranges[0 ].size =pci_resource_len (pdev,0 ); + +#ifdef CONFIG_X86 + primary = pdev->resource[PCI_ROM_RESOURCE ].flags &IORESOURCE_ROM_SHADOW ; +#endif +drm_fb_helper_remove_conflicting_framebuffers (ap,"astdrmfb" , primary); +kfree (ap); +} +static int ast_pci_probe (struct pci_dev *pdev,const struct pci_device_id *ent) { +ast_kick_out_firmware_fb (pdev); +return drm_get_pci_dev (pdev, ent, &driver); }
Greg Kroah-Hartman
maintainerPATCH 36/100 can: dev: can_get_echo_skb(): factor out non sending code to __can_get_echo_skb()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit a4310fa2f24687888ce80fdb0e88583561a23700 upstream.
This patch factors out all non sending parts of can_get_echo_skb() into a seperate function __can_get_echo_skb(), so that it can be re-used in an upcoming patch.
--- drivers/net/can/dev.c | 36 +++++++++++++++++++++++++----------- include/linux/can/dev.h | 1 + 2 files changed, 26 insertions(+), 11 deletions(-)
drivers/net/can/dev.c +25 -11
@@ -476,14 +476,7 @@ void can_put_echo_skb(struct sk_buff *sk }EXPORT_SYMBOL_GPL (can_put_echo_skb); -/* -* Get the skb from the stack and loop it back locally -* -* The function is typically called when the TX done interrupt -* is handled in the device driver. The driver must protect -* access to priv->echo_skb, if necessary. -*/ -unsigned int can_get_echo_skb (struct net_device *dev,unsigned int idx) +struct sk_buff *__can_get_echo_skb (struct net_device *dev,unsigned int idx,u8 *len_ptr) {struct can_priv *priv =netdev_priv (dev);
@@ -494,13 +487,34 @@ unsigned int can_get_echo_skb(struct netstruct can_frame *cf = (struct can_frame *)skb->data;u8 dlc = cf->can_dlc; -netif_rx (priv->echo_skb[idx]); + *len_ptr = dlc; priv->echo_skb[idx] =NULL ; -return dlc; +return skb; } -return 0 ; +return NULL ; +} + +/* +* Get the skb from the stack and loop it back locally +* +* The function is typically called when the TX done interrupt +* is handled in the device driver. The driver must protect +* access to priv->echo_skb, if necessary. +*/ +unsigned int can_get_echo_skb (struct net_device *dev,unsigned int idx) +{ +struct sk_buff *skb; +u8 len; + + skb =__can_get_echo_skb (dev, idx, &len); +if (!skb) +return 0 ; + +netif_rx (skb); + +return len; }EXPORT_SYMBOL_GPL (can_get_echo_skb);
include/linux/can/dev.h +1 -0
@@ -163,6 +163,7 @@ void can_change_state(struct net_devicevoid can_put_echo_skb (struct sk_buff *skb,struct net_device *dev,unsigned int idx); +struct sk_buff *__can_get_echo_skb (struct net_device *dev,unsigned int idx,u8 *len_ptr);unsigned int can_get_echo_skb (struct net_device *dev,unsigned int idx);void can_free_echo_skb (struct net_device *dev,unsigned int idx);
Greg Kroah-Hartman
maintainerPATCH 37/100 can: dev: __can_get_echo_skb(): replace struct can_frame by canfd_frame to access frame length
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 200f5c49f7a2cd694436bfc6cb0662b794c96736 upstream.
This patch replaces the use of "struct can_frame::can_dlc" by "struct canfd_frame::len" to access the frame's length. As it is ensured that both structures have a compatible memory layout for this member this is no functional change. Futher, this compatibility is documented in a comment.
--- drivers/net/can/dev.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/can/dev.c +6 -3
@@ -483,11 +483,14 @@ struct sk_buff *__can_get_echo_skb(strucBUG_ON (idx >= priv->echo_skb_max);if (priv->echo_skb[idx]) { +/* Using "struct canfd_frame::len" for the frame +* length is supported on both CAN and CANFD frames. +*/ struct sk_buff *skb = priv->echo_skb[idx]; -struct can_frame *cf = (struct can_frame *)skb->data; -u8 dlc = cf->can_dlc; +struct canfd_frame *cf = (struct canfd_frame *)skb->data; +u8 len = cf->len; - *len_ptr = dlc; + *len_ptr = len; priv->echo_skb[idx] =NULL ;return skb;
Greg Kroah-Hartman
maintainerPATCH 38/100 can: dev: __can_get_echo_skb(): Dont crash the kernel if can_priv::echo_skb is accessed out of bounds
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit e7a6994d043a1e31d5b17706a22ce33d2a3e4cdc upstream.
If the "struct can_priv::echo_skb" is accessed out of bounds would lead to a kernel crash. Better print a sensible warning message instead and try to recover.
--- drivers/net/can/dev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +5 -1
@@ -480,7 +480,11 @@ struct sk_buff *__can_get_echo_skb(struc {struct can_priv *priv =netdev_priv (dev); -BUG_ON (idx >= priv->echo_skb_max); +if (idx >= priv->echo_skb_max) { +netdev_err (dev,"%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n" , + __func__, idx, priv->echo_skb_max); +return NULL ; + }if (priv->echo_skb[idx]) {/* Using "struct canfd_frame::len" for the frame
Greg Kroah-Hartman
maintainerPATCH 39/100 can: dev: __can_get_echo_skb(): print error message, if trying to echo non existing skb
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <[email protected]>
commit 7da11ba5c5066dadc2e96835a6233d56d7b7764a upstream.
Prior to echoing a successfully transmitted CAN frame (by calling can_get_echo_skb()), CAN drivers have to put the CAN frame (by calling can_put_echo_skb() in the transmit function). These put and get function take an index as parameter, which is used to identify the CAN frame.
A driver calling can_get_echo_skb() with a index not pointing to a skb is a BUG, so add an appropriate error message.
--- drivers/net/can/dev.c | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-)
drivers/net/can/dev.c +14 -13
@@ -479,6 +479,8 @@ EXPORT_SYMBOL_GPL(can_put_echo_skb);struct sk_buff *__can_get_echo_skb (struct net_device *dev,unsigned int idx,u8 *len_ptr) {struct can_priv *priv =netdev_priv (dev); +struct sk_buff *skb = priv->echo_skb[idx]; +struct canfd_frame *cf;if (idx >= priv->echo_skb_max) { netdev_err(dev, "%s: BUG! Trying to access can_priv::echo_skb out of bounds (%u/max %u)\n",
@@ -486,21 +488,20 @@ struct sk_buff *__can_get_echo_skb(strucreturn NULL ; } -if (priv->echo_skb[idx]) { -/* Using "struct canfd_frame::len" for the frame -* length is supported on both CAN and CANFD frames. -*/ -struct sk_buff *skb = priv->echo_skb[idx]; -struct canfd_frame *cf = (struct canfd_frame *)skb->data; -u8 len = cf->len; - - *len_ptr = len; - priv->echo_skb[idx] =NULL ; - -return skb; +if (!skb) { +netdev_err (dev,"%s: BUG! Trying to echo non existing skb: can_priv::echo_skb[%u]\n" , + __func__, idx); +return NULL ; } -return NULL ; +/* Using "struct canfd_frame::len" for the frame +* length is supported on both CAN and CANFD frames. +*/ + cf = (struct canfd_frame *)skb->data; + *len_ptr = cf->len; + priv->echo_skb[idx] =NULL ; + +return skb; }/*
Greg Kroah-Hartman
maintainerPATCH 40/100 can: rx-offload: introduce can_rx_offload_get_echo_skb() and can_rx_offload_queue_sorted() functions
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 55059f2b7f868cd43b3ad30e28e18347e1b46ace upstream.
Current CAN framework can't guarantee proper/chronological order of RX and TX-ECHO messages. To make this possible, drivers should use this functions instead of can_get_echo_skb().
--- drivers/net/can/rx-offload.c | 46 +++++++++++++++++++++++++++++++++++++++++ include/linux/can/rx-offload.h | 4 +++ 2 files changed, 50 insertions(+)
drivers/net/can/rx-offload.c +46 -0
@@ -209,6 +209,52 @@ int can_rx_offload_irq_offload_fifo(stru }EXPORT_SYMBOL_GPL (can_rx_offload_irq_offload_fifo); +int can_rx_offload_queue_sorted (struct can_rx_offload *offload, +struct sk_buff *skb,u32 timestamp) +{ +struct can_rx_offload_cb *cb; +unsigned long flags; + +if (skb_queue_len (&offload->skb_queue) > + offload->skb_queue_len_max) +return -ENOMEM ; + + cb =can_rx_offload_get_cb (skb); + cb->timestamp = timestamp; + +spin_lock_irqsave (&offload->skb_queue.lock, flags); +__skb_queue_add_sort (&offload->skb_queue, skb, can_rx_offload_compare); +spin_unlock_irqrestore (&offload->skb_queue.lock, flags); + +can_rx_offload_schedule (offload); + +return 0 ; +} +EXPORT_SYMBOL_GPL (can_rx_offload_queue_sorted); + +unsigned int can_rx_offload_get_echo_skb (struct can_rx_offload *offload, +unsigned int idx,u32 timestamp) +{ +struct net_device *dev = offload->dev; +struct net_device_stats *stats = &dev->stats; +struct sk_buff *skb; +u8 len; +int err; + + skb =__can_get_echo_skb (dev, idx, &len); +if (!skb) +return 0 ; + + err =can_rx_offload_queue_sorted (offload, skb, timestamp); +if (err) { + stats->rx_errors++; + stats->tx_fifo_errors++; + } + +return len; +} +EXPORT_SYMBOL_GPL (can_rx_offload_get_echo_skb); +int can_rx_offload_irq_queue_err_skb (struct can_rx_offload *offload,struct sk_buff *skb) { if (skb_queue_len(&offload->skb_queue) >
include/linux/can/rx-offload.h +4 -0
@@ -41,6 +41,10 @@ int can_rx_offload_add_timestamp(structint can_rx_offload_add_fifo (struct net_device *dev,struct can_rx_offload *offload,unsigned int weight);int can_rx_offload_irq_offload_timestamp (struct can_rx_offload *offload,u64 reg);int can_rx_offload_irq_offload_fifo (struct can_rx_offload *offload); +int can_rx_offload_queue_sorted (struct can_rx_offload *offload, +struct sk_buff *skb,u32 timestamp); +unsigned int can_rx_offload_get_echo_skb (struct can_rx_offload *offload, +unsigned int idx,u32 timestamp);int can_rx_offload_irq_queue_err_skb (struct can_rx_offload *offload,struct sk_buff *skb);void can_rx_offload_reset (struct can_rx_offload *offload);void can_rx_offload_del (struct can_rx_offload *offload);
Greg Kroah-Hartman
maintainerPATCH 41/100 can: rx-offload: rename can_rx_offload_irq_queue_err_skb() to can_rx_offload_queue_tail()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksij Rempel <[email protected]>
commit 4530ec36bb1e0d24f41c33229694adacda3d5d89 upstream.
This function has nothing todo with error.
--- drivers/net/can/flexcan.c | 4 ++-- drivers/net/can/rx-offload.c | 5 +++-- include/linux/can/rx-offload.h | 3 ++- 3 files changed, 7 insertions(+), 5 deletions(-)
drivers/net/can/flexcan.c +2 -2
@@ -599,7 +599,7 @@ static void flexcan_irq_bus_err(struct nif (tx_errors) dev->stats.tx_errors++; -can_rx_offload_irq_queue_err_skb (&priv->offload, skb); +can_rx_offload_queue_tail (&priv->offload, skb); }static void flexcan_irq_state (struct net_device *dev,u32 reg_esr)
@@ -639,7 +639,7 @@ static void flexcan_irq_state(struct netif (unlikely (new_state ==CAN_STATE_BUS_OFF ))can_bus_off (dev); -can_rx_offload_irq_queue_err_skb (&priv->offload, skb); +can_rx_offload_queue_tail (&priv->offload, skb); }static inline struct flexcan_priv *rx_offload_to_priv (struct can_rx_offload *offload)
drivers/net/can/rx-offload.c +3 -2
@@ -255,7 +255,8 @@ unsigned int can_rx_offload_get_echo_skb }EXPORT_SYMBOL_GPL (can_rx_offload_get_echo_skb); -int can_rx_offload_irq_queue_err_skb (struct can_rx_offload *offload,struct sk_buff *skb) +int can_rx_offload_queue_tail (struct can_rx_offload *offload, +struct sk_buff *skb) {if (skb_queue_len (&offload->skb_queue) > offload->skb_queue_len_max)
@@ -266,7 +267,7 @@ int can_rx_offload_irq_queue_err_skb(strreturn 0 ; } -EXPORT_SYMBOL_GPL (can_rx_offload_irq_queue_err_skb); +EXPORT_SYMBOL_GPL (can_rx_offload_queue_tail);static int can_rx_offload_init_queue (struct net_device *dev,struct can_rx_offload *offload,unsigned int weight) {
include/linux/can/rx-offload.h +2 -1
@@ -45,7 +45,8 @@ int can_rx_offload_queue_sorted(struct c struct sk_buff *skb, u32 timestamp);unsigned int can_rx_offload_get_echo_skb (struct can_rx_offload *offload,unsigned int idx,u32 timestamp); -int can_rx_offload_irq_queue_err_skb (struct can_rx_offload *offload,struct sk_buff *skb); +int can_rx_offload_queue_tail (struct can_rx_offload *offload, +struct sk_buff *skb);void can_rx_offload_reset (struct can_rx_offload *offload);void can_rx_offload_del (struct can_rx_offload *offload);void can_rx_offload_enable (struct can_rx_offload *offload);
Greg Kroah-Hartman
maintainerPATCH 42/100 can: raw: check for CAN FD capable netdev in raw_sendmsg()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <[email protected]>
commit a43608fa77213ad5ac5f75994254b9f65d57cfa0 upstream.
When the socket is CAN FD enabled it can handle CAN FD frame transmissions. Add an additional check in raw_sendmsg() as a CAN2.0 CAN driver (non CAN FD) should never see a CAN FD frame. Due to the commonly used can_dropped_invalid_skb() function the CAN 2.0 driver would drop that CAN FD frame anyway - but with this patch the user gets a proper -EINVAL return code.
--- net/can/raw.c | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-)
net/can/raw.c +8 -7
@@ -745,18 +745,19 @@ static int raw_sendmsg(struct socket *so }else ifindex = ro->ifindex; -if (ro->fd_frames) { + dev =dev_get_by_index (sock_net (sk), ifindex); +if (!dev) +return -ENXIO ; + + err = -EINVAL ; +if (ro->fd_frames && dev->mtu ==CANFD_MTU ) {if (unlikely (size !=CANFD_MTU && size !=CAN_MTU )) -return -EINVAL ; + goto put_dev; }else {if (unlikely (size !=CAN_MTU )) -return -EINVAL ; + goto put_dev; } - dev =dev_get_by_index (sock_net (sk), ifindex); -if (!dev) -return -ENXIO ; - skb =sock_alloc_send_skb (sk, size +sizeof (struct can_skb_priv ), msg->msg_flags &MSG_DONTWAIT , &err);if (!skb)
Greg Kroah-Hartman
maintainerPATCH 43/100 can: hi311x: Use level-triggered interrupt
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <[email protected]>
commit f164d0204b1156a7e0d8d1622c1a8d25752befec upstream.
If the hi3110 shares the SPI bus with another traffic-intensive device and packets are received in high volume (by a separate machine sending with "cangen -g 0 -i -x"), reception stops after a few minutes and the counter in /proc/interrupts stops incrementing. Bus state is "active". Bringing the interface down and back up reconvenes the reception. The issue is not observed when the hi3110 is the sole device on the SPI bus.
Using a level-triggered interrupt makes the issue go away and lets the hi3110 successfully receive 2 GByte over the course of 5 days while a ks8851 Ethernet chip on the same SPI bus handles 6 GByte of traffic.
Unfortunately the hi3110 datasheet is mum on the trigger type. The pin description on page 3 only specifies the polarity (active high):
http://www.holtic.com/documents/371-hi-3110_v-rev-kpdf.do
--- Documentation/devicetree/bindings/net/can/holt_hi311x.txt | 2 +- drivers/net/can/spi/hi311x.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/net/can/holt_hi311x.txt +1 -1
@@ -18,7 +18,7 @@ Example: reg = <1>; clocks = <&clk32m>; interrupt-parent = <&gpio4>; - interrupts = <13 IRQ_TYPE_EDGE_RISING>; + interrupts = <13 IRQ_TYPE_LEVEL_HIGH>; vdd-supply = <®5v0>; xceiver-supply = <®5v0>; };
drivers/net/can/spi/hi311x.c +1 -1
@@ -760,7 +760,7 @@ static int hi3110_open(struct net_device {struct hi3110_priv *priv =netdev_priv (net);struct spi_device *spi = priv->spi; -unsigned long flags =IRQF_ONESHOT |IRQF_TRIGGER_RISING ; +unsigned long flags =IRQF_ONESHOT |IRQF_TRIGGER_HIGH ;int ret; ret =open_candev (net);
Greg Kroah-Hartman
maintainerPATCH 44/100 ACPICA: AML interpreter: add region addresses in global list during initialization
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Schmauss <[email protected]>
commit 4abb951b73ff0a8a979113ef185651aa3c8da19b upstream.
The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following:
[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042F conflicts with op_region 0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213) [ 7.871769] ACPI: If an ACPI driver is available for this device, you should use it instead of the native driver
However, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list.
--- drivers/acpi/acpica/dsopcode.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/acpi/acpica/dsopcode.c +4 -0
@@ -451,6 +451,10 @@ acpi_ds_eval_region_operands(struct acpiACPI_FORMAT_UINT64 (obj_desc->region.address), obj_desc->region.length)); + status =acpi_ut_add_address_range (obj_desc->region.space_id, + obj_desc->region.address, + obj_desc->region.length, node); +/* Now the address and length are valid for this opregion */ obj_desc->region.flags |=AOPOBJ_DATA_VALID ;
Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Hi Greg,
Quoted 20 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Schmauss <[email protected]>
commit
4abb951b73ff0a8a979113ef185651aa3c8da19bupstream.The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following:
[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042F conflicts with op_region 0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213) [ 7.871769] ACPI: If an ACPI driver is available for this device, you should use it instead of the native driverHowever, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list.
Quoted 7 lines
Tested-by Jean-Marc Lenoir <[email protected]>Signed-off-by Erik Schmauss <[email protected]>Cc All applicable <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Cc Jean Delvare <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
I'm confused. While we were discussing the regression, Erik said that this is fixing commit 5a8361f7ecceaed64b4064000d16cb703462be49, which went upstream in v4.17. So how can the fix be needed in any kernel older than v4.17? Erik, did I understand you incorrectly?
Signature · 2 lines
Jean Delvare SUSE L3 Support
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 31 lines · Jean Delvare
Hi Greg,
Quoted 20 lines · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Erik Schmauss <[email protected]>
commit
4abb951b73ff0a8a979113ef185651aa3c8da19bupstream.The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following:
[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042F conflicts with op_region 0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213) [ 7.871769] ACPI: If an ACPI driver is available for this device, you should use it instead of the native driverHowever, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list.
Quoted 7 lines
Tested-by Jean-Marc Lenoir <[email protected]>Signed-off-by Erik Schmauss <[email protected]>Cc All applicable <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Cc Jean Delvare <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 4 lines
I'm confused. While we were discussing the regression, Erik said that this is fixing commit
5a8361f7ecceaed64b4064000d16cb703462be49, which went upstream in v4.17. So how can the fix be needed in any kernel older than v4.17? Erik, did I understand you incorrectly?
The patch says "All applicable", and I assumed that meant, "as long as it applies."
Erik, should I drop this from 4.14.y?
thanks,
greg k-h
RE: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 31 lines
-----Original Message-----
From: Greg Kroah-Hartman [mailto:[email protected]]
Sent: Thursday, November 29, 2018 7:01 AM
To: Jean Delvare <[email protected]>
Cc: [email protected]; [email protected]; Jean-Marc Lenoir <[email protected]>; Schmauss, Erik <[email protected]>; Wysocki, Rafael J <[email protected]>
Subject: Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initializationQuoted 4 lines · Jean Delvare
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me
know.
Quoted 13 lines
Quoted 13 lines
------------------
From: Erik Schmauss <[email protected]>
commit
4abb951b73ff0a8a979113ef185651aa3c8da19bupstream.The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following:
Quoted 22 lines
Quoted 1 line
Quoted 1 line
[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042Fconflicts with
op_region0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213)Quoted 1 line
Quoted 1 line
[ 7.871769] ACPI: If an ACPI driver is available for this device, you shoulduse it instead of the native driver
Quoted 16 lines
Quoted 11 lines
However, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list.
Tested-by Jean-Marc Lenoir <[email protected]>Signed-off-by Erik Schmauss <[email protected]>Cc All applicable <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Cc Jean Delvare <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>I'm confused. While we were discussing the regression, Erik said that this is fixing commit
5a8361f7ecceaed64b4064000d16cb703462be49, which went upstream in v4.17. So how can the fix be needed in any kernel older than v4.17? Erik, did I understand you incorrectly?
Hi Greg,
Quoted 4 lines
The patch says "All applicable", and I assumed that meant, "as long as it applies."
Erik, should I drop this from 4.14.y?
This should only apply to 4.17 or later. I unintentionally put all applicable so please drop this for all 4.16 or earlier. I've learned my lesson and I'll put the correct tags from now on :-)
Erik
Quoted 4 lines
thanks,
greg k-h
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 55 lines · Erik
Quoted 31 lines
-----Original Message-----
From: Greg Kroah-Hartman [mailto:[email protected]]
Sent: Thursday, November 29, 2018 7:01 AM
To: Jean Delvare <[email protected]>
Cc: [email protected]; [email protected]; Jean-Marc Lenoir <[email protected]>; Schmauss, Erik <[email protected]>; Wysocki, Rafael J <[email protected]>
Subject: Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initializationQuoted 4 lines · Jean Delvare
Hi Greg,
Quoted 1 line · Greg Kroah-Hartman
4.14-stable review patch. If anyone has any objections, please let me
know.
Quoted 13 lines
Quoted 13 lines
------------------
From: Erik Schmauss <[email protected]>
commit
4abb951b73ff0a8a979113ef185651aa3c8da19bupstream.The table load process omitted adding the operation region address range to the global list. This omission is problematic because the OS queries the global list to check for address range conflicts before deciding which drivers to load. This commit may result in warning messages that look like the following:
Quoted 22 lines
Quoted 1 line
Quoted 1 line
[ 7.871761] ACPI Warning: system_IO range 0x00000428-0x0000042Fconflicts with
op_region0x00000400-0x0000047F (\PMIO) (20180531/utaddress-213)Quoted 1 line
Quoted 1 line
[ 7.871769] ACPI: If an ACPI driver is available for this device, you shoulduse it instead of the native driver
Quoted 16 lines
Quoted 11 lines
However, these messages do not signify regressions. It is a result of properly adding address ranges within the global address list.
Tested-by Jean-Marc Lenoir <[email protected]>Signed-off-by Erik Schmauss <[email protected]>Cc All applicable <[email protected]>Signed-off-by Rafael J. Wysocki <[email protected]>Cc Jean Delvare <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>I'm confused. While we were discussing the regression, Erik said that this is fixing commit
5a8361f7ecceaed64b4064000d16cb703462be49, which went upstream in v4.17. So how can the fix be needed in any kernel older than v4.17? Erik, did I understand you incorrectly?Hi Greg,
Quoted 8 lines
Quoted 4 lines
The patch says "All applicable", and I assumed that meant, "as long as it applies."
Erik, should I drop this from 4.14.y?
This should only apply to 4.17 or later. I unintentionally put all applicable so please drop this for all 4.16 or earlier. I've learned my lesson and I'll put the correct tags from now on :-)
Ok, now dropped from 4.14, thanks.
greg k-h
Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 6 lines · Greg Kroah-Hartman
Quoted 3 lines · Erik
This should only apply to 4.17 or later. I unintentionally put all applicable so please drop this for all 4.16 or earlier. I've learned my lesson and I'll put the correct tags from now on :-)
Ok, now dropped from 4.14, thanks.
Should be dropped from 4.9 and 4.4 too... if it was not clear.
Thanks,
Signature · 2 lines
Jean Delvare SUSE L3 Support
RE: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 13 lines
-----Original Message-----
From: Jean Delvare [mailto:[email protected]]
Sent: Thursday, November 29, 2018 11:34 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: Schmauss, Erik <[email protected]>; linux- [email protected]; [email protected]; Jean-Marc Lenoir <[email protected]>; Wysocki, Rafael J <[email protected]>
Subject: Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initializationOn Thu, 29 Nov 2018 20:21:37 +0100, Greg Kroah-Hartman wrote:
Quoted 8 lines
Quoted 6 lines · Erik
Quoted 3 lines
This should only apply to 4.17 or later. I unintentionally put all applicable so please drop this for all 4.16 or earlier. I've learned my lesson and I'll put the correct tags from now on :-)
Ok, now dropped from 4.14, thanks.
Should be dropped from 4.9 and 4.4 too... if it was not clear.
Yes, it should,
Thanks,
Erik
Quoted 5 lines
Thanks,
--
Jean Delvare
SUSE L3 Support
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initialization
Quoted 18 lines · Erik
Quoted 18 lines
-----Original Message-----
From: Jean Delvare [mailto:[email protected]]
Sent: Thursday, November 29, 2018 11:34 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: Schmauss, Erik <[email protected]>; linux- [email protected]; [email protected]; Jean-Marc Lenoir <[email protected]>; Wysocki, Rafael J <[email protected]>
Subject: Re: [PATCH 4.14 044/100] ACPICA: AML interpreter: add region addresses in global list during initializationQuoted 5 lines · Greg Kroah-Hartman
Quoted 3 lines · Erik
This should only apply to 4.17 or later. I unintentionally put all applicable so please drop this for all 4.16 or earlier. I've learned my lesson and I'll put the correct tags from now on :-)
Quoted 5 lines
Quoted 3 lines
Quoted 1 line
Ok, now dropped from 4.14, thanks.
Should be dropped from 4.9 and 4.4 too... if it was not clear.
Yes, it should,
oops, sorry about that, now dropped from the 4.9 and 4.4 queues as well.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 45/100 IB/hfi1: Eliminate races in the SDMA send error path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael J. Ruhl <[email protected]>
commit a0e0cb82804a6a21d9067022c2dfdf80d11da429 upstream.
pq_update() can only be called in two places: from the completion function when the complete (npkts) sequence of packets has been submitted and processed, or from setup function if a subset of the packets were submitted (i.e. the error path).
Currently both paths can call pq_update() if an error occurrs. This race will cause the n_req value to go negative, hanging file_close(), or cause a crash by freeing the txlist more than once.
Several variables are used to determine SDMA send state. Most of these are unnecessary, and have code inspectible races between the setup function and the completion function, in both the send path and the error path.
The request 'status' value can be set by the setup or by the completion function. This is code inspectibly racy. Since the status is not needed in the completion code or by the caller it has been removed.
The request 'done' value races between usage by the setup and the completion function. The completion function does not need this. When the number of processed packets matches npkts, it is done.
The 'has_error' value races between usage of the setup and the completion function. This can cause incorrect error handling and leave the n_req in an incorrect value (i.e. negative).
Simplify the code by removing all of the unneeded state checks and variables.
Clean up iovs node when it is freed.
Eliminate race conditions in the error path:
If all packets are submitted, the completion handler will set the completion status correctly (ok or aborted).
If all packets are not submitted, the caller must wait until the submitted packets have completed, and then set the completion status.
These two change eliminate the race condition in the error path.
--- drivers/infiniband/hw/hfi1/user_sdma.c | 85 ++++++++++++++------------------- drivers/infiniband/hw/hfi1/user_sdma.h | 3 - 2 files changed, 38 insertions(+), 50 deletions(-)
drivers/infiniband/hw/hfi1/user_sdma.c +38 -47
@@ -328,7 +328,6 @@ int hfi1_user_sdma_process_request(strucu8 opcode, sc, vl;u16 pkey;u32 slid; -int req_queued =0 ;u16 dlid;u32 selector;
@@ -392,7 +391,6 @@ int hfi1_user_sdma_process_request(struc req->data_len =0 ; req->pq = pq; req->cq = cq; - req->status =-1 ; req->ahg_idx =-1 ; req->iov_idx =0 ; req->sent =0 ;
@@ -400,12 +398,14 @@ int hfi1_user_sdma_process_request(struc req->seqcomp =0 ; req->seqsubmitted =0 ; req->tids =NULL ; - req->done =0 ; req->has_error =0 ;INIT_LIST_HEAD (&req->txps);memcpy (&req->info, &info,sizeof (info)); +/* The request is initialized, count it */ +atomic_inc (&pq->n_reqs); +if (req_opcode (info.ctrl) ==EXPECTED ) {/* expected must have a TID info and at least one data vector */ if (req->data_iovs <2 ) {
@@ -500,7 +500,6 @@ int hfi1_user_sdma_process_request(struc ret =pin_vector_pages (req, &req->iovs[i]);if (ret) { req->data_iovs = i; - req->status = ret; goto free_req; } req->data_len += req->iovs[i].iov.iov_len;
@@ -561,14 +560,10 @@ int hfi1_user_sdma_process_request(struc req->ahg_idx =sdma_ahg_alloc (req->sde);set_comp_state (pq, cq, info.comp_idx,QUEUED ,0 ); -atomic_inc (&pq->n_reqs); - req_queued =1 ;/* Send the first N packets in the request to buy us some time */ ret =user_sdma_send_pkts (req, pcount); -if (unlikely (ret <0 && ret != -EBUSY )) { - req->status = ret; +if (unlikely (ret <0 && ret != -EBUSY )) goto free_req; - }/* * It is possible that the SDMA engine would have processed all the
@@ -588,14 +583,8 @@ int hfi1_user_sdma_process_request(strucwhile (req->seqsubmitted != req->info.npkts) { ret =user_sdma_send_pkts (req, pcount);if (ret <0 ) { -if (ret != -EBUSY ) { - req->status = ret; -WRITE_ONCE (req->has_error,1 ); -if (ACCESS_ONCE (req->seqcomp) == - req->seqsubmitted -1 ) - goto free_req; -return ret; - } +if (ret != -EBUSY ) + goto free_req; wait_event_interruptible_timeout( pq->busy.wait_dma, (pq->state == SDMA_PKT_Q_ACTIVE),
@@ -606,10 +595,19 @@ int hfi1_user_sdma_process_request(struc *count += idx;return 0 ; free_req: -user_sdma_free_request (req, true); -if (req_queued) +/* +* If the submitted seqsubmitted == npkts, the completion routine +* controls the final state. If sequbmitted < npkts, wait for any +* outstanding packets to finish before cleaning up. +*/ +if (req->seqsubmitted < req->info.npkts) { +if (req->seqsubmitted) +wait_event (pq->busy.wait_dma, + (req->seqcomp == req->seqsubmitted -1 )); +user_sdma_free_request (req, true);pq_update (pq); -set_comp_state (pq, cq, info.comp_idx,ERROR , req->status); +set_comp_state (pq, cq, info.comp_idx,ERROR , ret); + }return ret; }
@@ -917,7 +915,6 @@ dosend: ret =sdma_send_txlist (req->sde, &pq->busy, &req->txps, &count); req->seqsubmitted += count;if (req->seqsubmitted == req->info.npkts) { -WRITE_ONCE (req->done,1 );/* * The txreq has already been submitted to the HW queue * so we can free the AHG entry now. Corruption will not
@@ -1347,11 +1344,15 @@ static int set_txreq_header_ahg(struct ureturn diff; } -/* -* SDMA tx request completion callback. Called when the SDMA progress -* state machine gets notification that the SDMA descriptors for this -* tx request have been processed by the DMA engine. Called in -* interrupt context. +/** +* user_sdma_txreq_cb() - SDMA tx request completion callback. +* @txreq: valid sdma tx request +* @status: success/failure of request +* +* Called when the SDMA progress state machine gets notification that +* the SDMA descriptors for this tx request have been processed by the +* DMA engine. Called in interrupt context. +* Only do work on completed sequences. */ static void user_sdma_txreq_cb (struct sdma_txreq *txreq,int status) {
@@ -1360,7 +1361,7 @@ static void user_sdma_txreq_cb(struct sdstruct user_sdma_request *req;struct hfi1_user_sdma_pkt_q *pq;struct hfi1_user_sdma_comp_q *cq; -u16 idx; +enum hfi1_sdma_comp_state state =COMPLETE ;if (!tx->req)return ;
@@ -1373,31 +1374,19 @@ static void user_sdma_txreq_cb(struct sdSDMA_DBG (req,"SDMA completion with error %d" , status);WRITE_ONCE (req->has_error,1 ); + state =ERROR ; } req->seqcomp = tx->seqnum;kmem_cache_free (pq->txreq_cache, tx); - tx =NULL ; - idx = req->info.comp_idx; -if (req->status ==-1 && status ==SDMA_TXREQ_S_OK ) { -if (req->seqcomp == req->info.npkts -1 ) { - req->status =0 ; -user_sdma_free_request (req, false); -pq_update (pq); -set_comp_state (pq, cq, idx,COMPLETE ,0 ); - } - }else { -if (status !=SDMA_TXREQ_S_OK ) - req->status = status; -if (req->seqcomp == (ACCESS_ONCE (req->seqsubmitted) -1 ) && - (READ_ONCE (req->done) || -READ_ONCE (req->has_error))) { -user_sdma_free_request (req, false); -pq_update (pq); -set_comp_state (pq, cq, idx,ERROR , req->status); - } - } +/* sequence isn't complete? We are done */ +if (req->seqcomp != req->info.npkts -1 ) +return ; + +user_sdma_free_request (req, false); +set_comp_state (pq, cq, req->info.comp_idx, state, status); +pq_update (pq); }static inline void pq_update (struct hfi1_user_sdma_pkt_q *pq)
@@ -1430,6 +1419,8 @@ static void user_sdma_free_request(strucif (!node)continue ; + req->iovs[i].node =NULL ; +if (unpin)hfi1_mmu_rb_remove (req->pq->handler, &node->rb);
drivers/infiniband/hw/hfi1/user_sdma.h +0 -3
@@ -196,8 +196,6 @@ struct user_sdma_request {/* Writeable fields shared with interrupt */ u64 seqcomp____cacheline_aligned_in_smp ;u64 seqsubmitted; -/* status of the last txreq completed */ -int status;/* Send side fields */ struct list_head txps____cacheline_aligned_in_smp ;
@@ -219,7 +217,6 @@ struct user_sdma_request {u16 tididx;/* progress index moving along the iovs array */ u8 iov_idx; -u8 done;u8 has_error;struct user_sdma_iovec iovs[MAX_VECTORS_PER_REQ ];
Greg Kroah-Hartman
maintainerPATCH 46/100 pinctrl: meson: fix pinconf bias disable
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e39f9dd8206ad66992ac0e6218ef1ba746f2cce9 ]
If a bias is enabled on a pin of an Amlogic SoC, calling .pin_config_set() with PIN_CONFIG_BIAS_DISABLE will not disable the bias. Instead it will force a pull-down bias on the pin.
Instead of the pull type register bank, the driver should access the pull enable register bank.
--- drivers/pinctrl/meson/pinctrl-meson.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/meson/pinctrl-meson.c +1 -1
@@ -273,7 +273,7 @@ static int meson_pinconf_set(struct pinctrl_dev *pcdev, unsigned int pin,dev_dbg (pc->dev,"pin %u: disable bias\n" , pin);meson_calc_reg_and_bit (bank, pin,REG_PULL , ®, &bit); - ret =regmap_update_bits (pc->reg_pull, reg, + ret =regmap_update_bits (pc->reg_pullen, reg,BIT (bit),0 );if (ret)return ret;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 47/100 KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 28c5bcf74fa07c25d5bd118d1271920f51ce2a98 ]
TRACE_INCLUDE_PATH and TRACE_INCLUDE_FILE are used by <trace/define_trace.h>, so like that #include, they should be outside #ifdef protection.
They also need to be #undefed before defining, in case multiple trace headers are included by the same C file. This became the case on book3e after commit cf4a6085151a ("powerpc/mm: Add missing tracepoint for tlbie"), leading to the following build error:
CC arch/powerpc/kvm/powerpc.o
In file included from arch/powerpc/kvm/powerpc.c:51:0:arch/powerpc/kvm/trace.h:9:0: error: "TRACE_INCLUDE_PATH" redefined [-Werror]
#define TRACE_INCLUDE_PATH .
^
In file included from arch/powerpc/kvm/../mm/mmu_decl.h:25:0,
from arch/powerpc/kvm/powerpc.c:48:./arch/powerpc/include/asm/trace.h:224:0: note: this is the location of the previous definition
#define TRACE_INCLUDE_PATH asm
^
cc1: all warnings being treated as errors
--- arch/powerpc/kvm/trace.h | 8 ++++++-- arch/powerpc/kvm/trace_booke.h | 9 +++++++-- arch/powerpc/kvm/trace_hv.h | 9 +++++++-- arch/powerpc/kvm/trace_pr.h | 9 +++++++-- 4 files changed, 27 insertions(+), 8 deletions(-)
arch/powerpc/kvm/trace.h +6 -2
@@ -6,8 +6,6 @@#undef TRACE_SYSTEM#define TRACE_SYSTEM kvm -#define TRACE_INCLUDE_PATH . -#define TRACE_INCLUDE_FILE trace/* * Tracepoint for guest mode entry.
@@ -120,4 +118,10 @@ TRACE_EVENT(kvm_check_requests,#endif /* _TRACE_KVM_H */ /* This part must be outside protection */ +#undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE + +#define TRACE_INCLUDE_PATH . +#define TRACE_INCLUDE_FILE trace +#include <trace/define_trace.h>
arch/powerpc/kvm/trace_booke.h +7 -2
@@ -6,8 +6,6 @@#undef TRACE_SYSTEM#define TRACE_SYSTEM kvm_booke -#define TRACE_INCLUDE_PATH . -#define TRACE_INCLUDE_FILE trace_booke#define kvm_trace_symbol_exit \ {0, "CRITICAL"}, \
@@ -218,4 +216,11 @@ TRACE_EVENT(kvm_booke_queue_irqprio,#endif /* This part must be outside protection */ + +#undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE + +#define TRACE_INCLUDE_PATH . +#define TRACE_INCLUDE_FILE trace_booke +#include <trace/define_trace.h>
arch/powerpc/kvm/trace_hv.h +7 -2
@@ -9,8 +9,6 @@#undef TRACE_SYSTEM#define TRACE_SYSTEM kvm_hv -#define TRACE_INCLUDE_PATH . -#define TRACE_INCLUDE_FILE trace_hv#define kvm_trace_symbol_hcall \ {H_REMOVE, "H_REMOVE"}, \
@@ -497,4 +495,11 @@ TRACE_EVENT(kvmppc_run_vcpu_exit,#endif /* _TRACE_KVM_HV_H */ /* This part must be outside protection */ + +#undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE + +#define TRACE_INCLUDE_PATH . +#define TRACE_INCLUDE_FILE trace_hv +#include <trace/define_trace.h>
arch/powerpc/kvm/trace_pr.h +7 -2
@@ -8,8 +8,6 @@#undef TRACE_SYSTEM#define TRACE_SYSTEM kvm_pr -#define TRACE_INCLUDE_PATH . -#define TRACE_INCLUDE_FILE trace_pr TRACE_EVENT(kvm_book3s_reenter, TP_PROTO(int r, struct kvm_vcpu *vcpu),
@@ -272,4 +270,11 @@ TRACE_EVENT(kvm_unmap_hva,#endif /* _TRACE_KVM_H */ /* This part must be outside protection */ + +#undef TRACE_INCLUDE_PATH +#undef TRACE_INCLUDE_FILE + +#define TRACE_INCLUDE_PATH . +#define TRACE_INCLUDE_FILE trace_pr +#include <trace/define_trace.h>
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 48/100 cpufreq: imx6q: add return value check for voltage scale
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6ef28a04d1ccf718eee069b72132ce4aa1e52ab9 ]
Add return value check for voltage scale when ARM clock rate change fail.
--- drivers/cpufreq/imx6q-cpufreq.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/cpufreq/imx6q-cpufreq.c +6 -1
@@ -135,8 +135,13 @@ static int imx6q_set_target(struct cpufreq_policy *policy, unsigned int index)/* Ensure the arm clock divider is what we expect */ ret =clk_set_rate (arm_clk, new_freq *1000 );if (ret) { +int ret1; +dev_err (cpu_dev,"failed to set clock rate: %d\n" , ret); -regulator_set_voltage_tol (arm_reg, volt_old,0 ); + ret1 =regulator_set_voltage_tol (arm_reg, volt_old,0 ); +if (ret1) +dev_warn (cpu_dev, +"failed to restore vddarm voltage: %d\n" , ret1);return ret; }
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 49/100 rtc: pcf2127: fix a kmemleak caused in pcf2127_i2c_gather_write
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9bde0afb7a906f1dabdba37162551565740b862d ]
pcf2127_i2c_gather_write() allocates memory as local variable for i2c_master_send(), after finishing the master transfer, the allocated memory should be freed. The kmemleak is reported:
unreferenced object 0xffff80231e7dba80 (size 64):
comm "hwclock", pid 27762, jiffies 4296880075 (age 356.944s) hex dump (first 32 bytes):
03 00 12 03 19 02 11 13 00 80 98 18 00 00 ff ff ................
00 50 00 00 00 00 00 00 02 00 00 00 00 00 00 00 .P..............
backtrace:
[<ffff000008221398>] create_object+0xf8/0x278
[<ffff000008a96264>] kmemleak_alloc+0x74/0xa0
[<ffff00000821070c>] __kmalloc+0x1ac/0x348
[<ffff0000087ed1dc>] pcf2127_i2c_gather_write+0x54/0xf8
[<ffff0000085fd9d4>] _regmap_raw_write+0x464/0x850
[<ffff0000085fe3f4>] regmap_bulk_write+0x1a4/0x348
[<ffff0000087ed32c>] pcf2127_rtc_set_time+0xac/0xe8
[<ffff0000087eaad8>] rtc_set_time+0x80/0x138
[<ffff0000087ebfb0>] rtc_dev_ioctl+0x398/0x610
[<ffff00000823f2c0>] do_vfs_ioctl+0xb0/0x848
[<ffff00000823fae4>] SyS_ioctl+0x8c/0xa8
[<ffff000008083ac0>] el0_svc_naked+0x34/0x38
[<ffffffffffffffff>] 0xffffffffffffffff--- drivers/rtc/rtc-pcf2127.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/rtc/rtc-pcf2127.c +3 -0
@@ -248,6 +248,9 @@ static int pcf2127_i2c_gather_write(void *context,memcpy (buf +1 , val, val_size); ret =i2c_master_send (client, buf, val_size +1 ); + +kfree (buf); +if (ret != val_size +1 )return ret <0 ? ret : -EIO ;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 50/100 crypto: simd - correctly take reqsize of wrapped skcipher into account
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 508a1c4df085a547187eed346f1bfe5e381797f1 ]
The simd wrapper's skcipher request context structure consists of a single subrequest whose size is taken from the subordinate skcipher. However, in simd_skcipher_init(), the reqsize that is retrieved is not from the subordinate skcipher but from the cryptd request structure, whose size is completely unrelated to the actual wrapped skcipher.
--- crypto/simd.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
crypto/simd.c +3 -2
@@ -126,8 +126,9 @@ static int simd_skcipher_init(struct crypto_skcipher *tfm) ctx->cryptd_tfm = cryptd_tfm; - reqsize =sizeof (struct skcipher_request ); - reqsize +=crypto_skcipher_reqsize (&cryptd_tfm->base); + reqsize =crypto_skcipher_reqsize (cryptd_skcipher_child (cryptd_tfm)); + reqsize =max (reqsize,crypto_skcipher_reqsize (&cryptd_tfm->base)); + reqsize +=sizeof (struct skcipher_request );crypto_skcipher_set_reqsize (tfm, reqsize);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 51/100 floppy: fix race condition in __floppy_read_block_0()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit de7b75d82f70c5469675b99ad632983c50b6f7e7 ]
LKP recently reported a hang at bootup in the floppy code:
[ 245.678853] INFO: task mount:580 blocked for more than 120 seconds. [ 245.679906] Tainted: G T 4.19.0-rc6-00172-ga9f38e1 #1 [ 245.680959] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 245.682181] mount D 6372 580 1 0x00000004 [ 245.683023] Call Trace: [ 245.683425] __schedule+0x2df/0x570 [ 245.683975] schedule+0x2d/0x80 [ 245.684476] schedule_timeout+0x19d/0x330 [ 245.685090] ? wait_for_common+0xa5/0x170 [ 245.685735] wait_for_common+0xac/0x170 [ 245.686339] ? do_sched_yield+0x90/0x90 [ 245.686935] wait_for_completion+0x12/0x20 [ 245.687571] __floppy_read_block_0+0xfb/0x150 [ 245.688244] ? floppy_resume+0x40/0x40 [ 245.688844] floppy_revalidate+0x20f/0x240 [ 245.689486] check_disk_change+0x43/0x60 [ 245.690087] floppy_open+0x1ea/0x360 [ 245.690653] __blkdev_get+0xb4/0x4d0 [ 245.691212] ? blkdev_get+0x1db/0x370 [ 245.691777] blkdev_get+0x1f3/0x370 [ 245.692351] ? path_put+0x15/0x20 [ 245.692871] ? lookup_bdev+0x4b/0x90 [ 245.693539] blkdev_get_by_path+0x3d/0x80 [ 245.694165] mount_bdev+0x2a/0x190 [ 245.694695] squashfs_mount+0x10/0x20 [ 245.695271] ? squashfs_alloc_inode+0x30/0x30 [ 245.695960] mount_fs+0xf/0x90 [ 245.696451] vfs_kern_mount+0x43/0x130 [ 245.697036] do_mount+0x187/0xc40 [ 245.697563] ? memdup_user+0x28/0x50 [ 245.698124] ksys_mount+0x60/0xc0 [ 245.698639] sys_mount+0x19/0x20 [ 245.699167] do_int80_syscall_32+0x61/0x130 [ 245.699813] entry_INT80_32+0xc7/0xc7
showing that we never complete that read request. The reason is that the completion setup is racy - it initializes the completion event AFTER submitting the IO, which means that the IO could complete before/during the init. If it does, we are passing garbage to complete() and we may sleep forever waiting for the event to occur.
--- drivers/block/floppy.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/block/floppy.c +2 -1
@@ -4146,10 +4146,11 @@ static int __floppy_read_block_0(struct block_device *bdev, int drive) bio.bi_end_io = floppy_rb0_cb;bio_set_op_attrs (&bio,REQ_OP_READ ,0 ); +init_completion (&cbdata.complete); +submit_bio (&bio);process_fd_request (); -init_completion (&cbdata.complete);wait_for_completion (&cbdata.complete);__free_page (page);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 52/100 powerpc/io: Fix the IO workarounds code to work with Radix
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 43c6494fa1499912c8177e71450c0279041152a6 ]
Back in 2006 Ben added some workarounds for a misbehaviour in the Spider IO bridge used on early Cell machines, see commit 014da7ff47b5 ("[POWERPC] Cell "Spider" MMIO workarounds"). Later these were made to be generic, ie. not tied specifically to Spider.
The code stashes a token in the high bits (59-48) of virtual addresses used for IO (eg. returned from ioremap()). This works fine when using the Hash MMU, but when we're using the Radix MMU the bits used for the token overlap with some of the bits of the virtual address.
This is because the maximum virtual address is larger with Radix, up to c00fffffffffffff, and in fact we use that high part of the address range for ioremap(), see RADIX_KERN_IO_START.
As it happens the bits that are used overlap with the bits that differentiate an IO address vs a linear map address. If the resulting address lies outside the linear mapping we will crash (see below), if not we just corrupt memory.
virtio-pci 0000:00:00.0: Using 64-bit direct DMA at offset 800000000000000
Unable to handle kernel paging request for data at address 0xc000000080000014
...
CFAR: c000000000626b98 DAR: c000000080000014 DSISR: 42000000 IRQMASK: 0
GPR00: c0000000006c54fc c00000003e523378 c0000000016de600 0000000000000000
GPR04: c00c000080000014 0000000000000007 0fffffff000affff 0000000000000030
^^^^
...
NIP [c000000000626c5c] .iowrite8+0xec/0x100
LR [c0000000006c992c] .vp_reset+0x2c/0x90
Call Trace:
.pci_bus_read_config_dword+0xc4/0x120 (unreliable)
.register_virtio_device+0x13c/0x1c0
.virtio_pci_probe+0x148/0x1f0
.local_pci_probe+0x68/0x140
.pci_device_probe+0x164/0x220
.really_probe+0x274/0x3b0
.driver_probe_device+0x80/0x170
.__driver_attach+0x14c/0x150
.bus_for_each_dev+0xb8/0x130
.driver_attach+0x34/0x50
.bus_add_driver+0x178/0x2f0
.driver_register+0x90/0x1a0
.__pci_register_driver+0x6c/0x90
.virtio_pci_driver_init+0x2c/0x40
.do_one_initcall+0x64/0x280
.kernel_init_freeable+0x36c/0x474
.kernel_init+0x24/0x160
.ret_from_kernel_thread+0x58/0x7cThis hasn't been a problem because CONFIG_PPC_IO_WORKAROUNDS which enables this code is usually not enabled. It is only enabled when it's selected by PPC_CELL_NATIVE which is only selected by PPC_IBM_CELL_BLADE and that in turn depends on BIG_ENDIAN. So in order to hit the bug you need to build a big endian kernel, with IBM Cell Blade support enabled, as well as Radix MMU support, and then boot that on Power9 using Radix MMU.
Still we can fix the bug, so let's do that. We simply use fewer bits for the token, taking the union of the restrictions on the address from both Hash and Radix, we end up with 8 bits we can use for the token. The only user of the token is iowa_mem_find_bus() which only supports 8 token values, so 8 bits is plenty for that.
--- arch/powerpc/include/asm/io.h | 20 +++++++------------- 1 file changed, 7 insertions(+), 13 deletions(-)
arch/powerpc/include/asm/io.h +7 -13
@@ -287,19 +287,13 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,* their hooks, a bitfield is reserved for use by the platform near the * top of MMIO addresses (not PIO, those have to cope the hard way). * -* This bit field is 12 bits and is at the top of the IO virtual -* addresses PCI_IO_INDIRECT_TOKEN_MASK. +* The highest address in the kernel virtual space are: * -* The kernel virtual space is thus: +* d0003fffffffffff # with Hash MMU +* c00fffffffffffff # with Radix MMU * -* 0xD000000000000000 : vmalloc -* 0xD000080000000000 : PCI PHB IO space -* 0xD000080080000000 : ioremap -* 0xD0000fffffffffff : end of ioremap region -* -* Since the top 4 bits are reserved as the region ID, we use thus -* the next 12 bits and keep 4 bits available for the future if the -* virtual address space is ever to be extended. +* The top 4 bits are reserved as the region ID on hash, leaving us 8 bits +* that can be used for the field. * * The direct IO mapping operations will then mask off those bits * before doing the actual access, though that only happen when
@@ -311,8 +305,8 @@ extern void _memcpy_toio(volatile void __iomem *dest, const void *src,*/ #ifdef CONFIG_PPC_INDIRECT_MMIO -#define PCI_IO_IND_TOKEN_MASK 0x0fff000000000000ul -#define PCI_IO_IND_TOKEN_SHIFT 48 +#define PCI_IO_IND_TOKEN_SHIFT 52 +#define PCI_IO_IND_TOKEN_MASK (0xfful << PCI_IO_IND_TOKEN_SHIFT)#define PCI_FIX_ADDR (addr) \ ((PCI_IO_ADDR)(((unsigned long)(addr)) & ~PCI_IO_IND_TOKEN_MASK))#define PCI_GET_ADDR_TOKEN (addr) \
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 53/100 perf/x86/intel/uncore: Add more IMC PCI IDs for KabyLake and CoffeeLake CPUs
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c10a8de0d32e95b0b8c7c17b6dc09baea5a5a899 ]
KabyLake and CoffeeLake CPUs have the same client uncore events as SkyLake.
Add the PCI IDs for the KabyLake Y, U, S processor lines and CoffeeLake U, H, S processor lines.
--- arch/x86/events/intel/uncore_snb.c | 115 ++++++++++++++++++++++++++++- 1 file changed, 114 insertions(+), 1 deletion(-)
arch/x86/events/intel/uncore_snb.c +114 -1
@@ -15,6 +15,25 @@#define PCI_DEVICE_ID_INTEL_SKL_HQ_IMC 0x1910#define PCI_DEVICE_ID_INTEL_SKL_SD_IMC 0x190f#define PCI_DEVICE_ID_INTEL_SKL_SQ_IMC 0x191f +#define PCI_DEVICE_ID_INTEL_KBL_Y_IMC 0x590c +#define PCI_DEVICE_ID_INTEL_KBL_U_IMC 0x5904 +#define PCI_DEVICE_ID_INTEL_KBL_UQ_IMC 0x5914 +#define PCI_DEVICE_ID_INTEL_KBL_SD_IMC 0x590f +#define PCI_DEVICE_ID_INTEL_KBL_SQ_IMC 0x591f +#define PCI_DEVICE_ID_INTEL_CFL_2U_IMC 0x3ecc +#define PCI_DEVICE_ID_INTEL_CFL_4U_IMC 0x3ed0 +#define PCI_DEVICE_ID_INTEL_CFL_4H_IMC 0x3e10 +#define PCI_DEVICE_ID_INTEL_CFL_6H_IMC 0x3ec4 +#define PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC 0x3e0f +#define PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC 0x3e1f +#define PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC 0x3ec2 +#define PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC 0x3e30 +#define PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC 0x3e18 +#define PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC 0x3ec6 +#define PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC 0x3e31 +#define PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC 0x3e33 +#define PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC 0x3eca +#define PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC 0x3e32/* SNB event control */ #define SNB_UNC_CTL_EV_SEL_MASK 0x000000ff
@@ -632,7 +651,82 @@ static const struct pci_device_id skl_uncore_pci_ids[] = { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SKL_SQ_IMC), .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), }, - + {/* IMC */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_KBL_Y_IMC), + .driver_data =UNCORE_PCI_DEV_DATA (SNB_PCI_UNCORE_IMC ,0 ), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_KBL_U_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_KBL_UQ_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_KBL_SD_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_KBL_SQ_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_2U_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_4U_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_4H_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_6H_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_2S_D_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_4S_D_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_6S_D_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_8S_D_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_4S_W_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_6S_W_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_8S_W_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_4S_S_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_6S_S_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, + { /* IMC */ +PCI_DEVICE (PCI_VENDOR_ID_INTEL ,PCI_DEVICE_ID_INTEL_CFL_8S_S_IMC ), + .driver_data = UNCORE_PCI_DEV_DATA(SNB_PCI_UNCORE_IMC, 0), + }, { /* end: all zeroes */ }, };
@@ -681,6 +775,25 @@ static const struct imc_uncore_pci_dev desktop_imc_pci_ids[] = {IMC_DEV (SKL_HQ_IMC , &skl_uncore_pci_driver),/* 6th Gen Core H Quad Core */ IMC_DEV (SKL_SD_IMC , &skl_uncore_pci_driver),/* 6th Gen Core S Dual Core */ IMC_DEV (SKL_SQ_IMC , &skl_uncore_pci_driver),/* 6th Gen Core S Quad Core */ +IMC_DEV (KBL_Y_IMC , &skl_uncore_pci_driver),/* 7th Gen Core Y */ +IMC_DEV (KBL_U_IMC , &skl_uncore_pci_driver),/* 7th Gen Core U */ +IMC_DEV (KBL_UQ_IMC , &skl_uncore_pci_driver),/* 7th Gen Core U Quad Core */ +IMC_DEV (KBL_SD_IMC , &skl_uncore_pci_driver),/* 7th Gen Core S Dual Core */ +IMC_DEV (KBL_SQ_IMC , &skl_uncore_pci_driver),/* 7th Gen Core S Quad Core */ +IMC_DEV (CFL_2U_IMC , &skl_uncore_pci_driver),/* 8th Gen Core U 2 Cores */ +IMC_DEV (CFL_4U_IMC , &skl_uncore_pci_driver),/* 8th Gen Core U 4 Cores */ +IMC_DEV (CFL_4H_IMC , &skl_uncore_pci_driver),/* 8th Gen Core H 4 Cores */ +IMC_DEV (CFL_6H_IMC , &skl_uncore_pci_driver),/* 8th Gen Core H 6 Cores */ +IMC_DEV (CFL_2S_D_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 2 Cores Desktop */ +IMC_DEV (CFL_4S_D_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 4 Cores Desktop */ +IMC_DEV (CFL_6S_D_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 6 Cores Desktop */ +IMC_DEV (CFL_8S_D_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 8 Cores Desktop */ +IMC_DEV (CFL_4S_W_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 4 Cores Work Station */ +IMC_DEV (CFL_6S_W_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 6 Cores Work Station */ +IMC_DEV (CFL_8S_W_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 8 Cores Work Station */ +IMC_DEV (CFL_4S_S_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 4 Cores Server */ +IMC_DEV (CFL_6S_S_IMC , &skl_uncore_pci_driver),/* 8th Gen Core S 6 Cores Server */ + IMC_DEV(CFL_8S_S_IMC, &skl_uncore_pci_driver), /* 8th Gen Core S 8 Cores Server */ { /* end marker */ } };
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 54/100 ARM: make lookup_processor_type() non-__init
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc ]
Move lookup_processor_type() out of the __init section so it is callable from (eg) the secondary startup code during hotplug.
--- arch/arm/kernel/head-common.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/kernel/head-common.S +3 -3
@@ -122,6 +122,9 @@ __mmap_switched_data: .long init_thread_union + THREAD_START_SP @ sp .size __mmap_switched_data, . - __mmap_switched_data + __FINIT + .text + /* * This provides a C-API version of __lookup_processor_type */
@@ -133,9 +136,6 @@ ENTRY(lookup_processor_type) ldmfd sp!, {r4 - r6, r9, pc} ENDPROC(lookup_processor_type) - __FINIT - .text - /* * Read processor ID register (CP#15, CR0), and look up in the linker-built * supported processor list. Note that we can't use the absolute addresses
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 55/100 ARM: clean up per-processor check_bugs method call
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 945aceb1db8885d3a35790cf2e810f681db52756 ]
Call the per-processor type check_bugs() method in the same way as we do other per-processor functions - move the "processor." detail into proc-fns.h.
--- arch/arm/include/asm/proc-fns.h | 1 + arch/arm/kernel/bugs.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/arm/include/asm/proc-fns.h +1 -0
@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *);extern void cpu_do_resume (void *);#else #define cpu_proc_init processor._proc_init +#define cpu_check_bugs processor.check_bugs#define cpu_proc_fin processor._proc_fin#define cpu_reset processor.reset#define cpu_do_idle processor._do_idle
arch/arm/kernel/bugs.c +2 -2
@@ -6,8 +6,8 @@void check_other_bugs (void ) {#ifdef MULTI_CPU -if (processor.check_bugs) - processor.check_bugs (); +if (cpu_check_bugs) +cpu_check_bugs ();#endif }
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 56/100 ARM: add PROC_VTABLE and PROC_TABLE macros
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e209950fdd065d2cc46e6338e47e52841b830cba ]
Allow the way we access members of the processor vtable to be changed at compile time. We will need to move to per-CPU vtables to fix the Spectre variant 2 issues on big.Little systems.
However, we have a couple of calls that do not need the vtable treatment, and indeed cause a kernel warning due to the (later) use of smp_processor_id(), so also introduce the PROC_TABLE macro for these which always use CPU 0's function pointers.
--- arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++----------- arch/arm/kernel/setup.c | 4 +--- 2 files changed, 27 insertions(+), 16 deletions(-)
arch/arm/include/asm/proc-fns.h +26 -13
@@ -23,7 +23,7 @@ struct mm_struct;/* * Don't change this structure - ASM code relies on it. */ -extern struct processor { +struct processor {/* MISC * get data abort address/flags */
@@ -79,9 +79,13 @@ extern struct processor {unsigned int suspend_size;void (*do_suspend)(void *);void (*do_resume)(void *); -} processor; +};#ifndef MULTI_CPU +static inline void init_proc_vtable (const struct processor *p) +{ +} +extern void cpu_proc_init (void );extern void cpu_proc_fin (void );extern int cpu_do_idle (void );
@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr, bool hvc) __attribute__((noreturn));extern void cpu_do_suspend (void *);extern void cpu_do_resume (void *);#else -#define cpu_proc_init processor._proc_init -#define cpu_check_bugs processor.check_bugs -#define cpu_proc_fin processor._proc_fin -#define cpu_reset processor.reset -#define cpu_do_idle processor._do_idle -#define cpu_dcache_clean_area processor.dcache_clean_area -#define cpu_set_pte_ext processor.set_pte_ext -#define cpu_do_switch_mm processor.switch_mm -/* These three are private to arch/arm/kernel/suspend.c */ -#define cpu_do_suspend processor.do_suspend -#define cpu_do_resume processor.do_resume +extern struct processor processor; +#define PROC_VTABLE (f) processor.f +#define PROC_TABLE (f) processor.f +static inline void init_proc_vtable (const struct processor *p) +{ + processor = *p; +} + +#define cpu_proc_init PROC_VTABLE(_proc_init) +#define cpu_check_bugs PROC_VTABLE(check_bugs) +#define cpu_proc_fin PROC_VTABLE(_proc_fin) +#define cpu_reset PROC_VTABLE(reset) +#define cpu_do_idle PROC_VTABLE(_do_idle) +#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area) +#define cpu_set_pte_ext PROC_TABLE(set_pte_ext) +#define cpu_do_switch_mm PROC_VTABLE(switch_mm) + +/* These two are private to arch/arm/kernel/suspend.c */ +#define cpu_do_suspend PROC_VTABLE(do_suspend) +#define cpu_do_resume PROC_VTABLE(do_resume)#endif extern void cpu_resume (void );
arch/arm/kernel/setup.c +1 -3
@@ -686,9 +686,7 @@ static void __init setup_processor(void) cpu_name = list->cpu_name; __cpu_architecture =__get_cpu_architecture (); -#ifdef MULTI_CPU - processor = *list->proc; -#endif +init_proc_vtable (list->proc);#ifdef MULTI_TLB cpu_tlb = *list->tlb;#endif
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 57/100 ARM: spectre-v2: per-CPU vtables to work around big.Little systems
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 383fb3ee8024d596f488d2dbaf45e572897acbdb ]
In big.Little systems, some CPUs require the Spectre workarounds in paths such as the context switch, but other CPUs do not. In order to handle these differences, we need per-CPU vtables.
We are unable to use the kernel's per-CPU variables to support this as per-CPU is not initialised at times when we need access to the vtables, so we have to use an array indexed by logical CPU number.
We use an array-of-pointers to avoid having function pointers in the kernel's read/write .data section.
--- arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++ arch/arm/kernel/setup.c | 5 +++++ arch/arm/kernel/smp.c | 31 +++++++++++++++++++++++++++++++ arch/arm/mm/proc-v7-bugs.c | 17 ++--------------- 4 files changed, 61 insertions(+), 15 deletions(-)
arch/arm/include/asm/proc-fns.h +23 -0
@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *);#else extern struct processor processor; +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +#include <linux/smp.h> +/* +* This can't be a per-cpu variable because we need to access it before +* per-cpu has been initialised. We have a couple of functions that are +* called in a pre-emptible context, and so can't use smp_processor_id() +* there, hence PROC_TABLE(). We insist in init_proc_vtable() that the +* function pointers for these are identical across all CPUs. +*/ +extern struct processor *cpu_vtable[]; +#define PROC_VTABLE (f) cpu_vtable[smp_processor_id()]->f +#define PROC_TABLE (f) cpu_vtable[0]->f +static inline void init_proc_vtable (const struct processor *p) +{ +unsigned int cpu =smp_processor_id (); + *cpu_vtable[cpu] = *p; +WARN_ON_ONCE (cpu_vtable[cpu]->dcache_clean_area != + cpu_vtable[0 ]->dcache_clean_area); +WARN_ON_ONCE (cpu_vtable[cpu]->set_pte_ext != + cpu_vtable[0 ]->set_pte_ext); +} +#else #define PROC_VTABLE (f) processor.f#define PROC_TABLE (f) processor.fstatic inline void init_proc_vtable (const struct processor *p) { processor = *p; } +#endif #define cpu_proc_init PROC_VTABLE(_proc_init)#define cpu_check_bugs PROC_VTABLE(check_bugs)
arch/arm/kernel/setup.c +5 -0
@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2);#ifdef MULTI_CPU struct processor processor__ro_after_init ; +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +struct processor *cpu_vtable[NR_CPUS ] = { + [0 ] = &processor, +}; +#endif #endif #ifdef MULTI_TLB struct cpu_tlb_fns cpu_tlb__ro_after_init ;
arch/arm/kernel/smp.c +31 -0
@@ -42,6 +42,7 @@#include <asm/mmu_context.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> +#include <asm/procinfo.h> #include <asm/processor.h> #include <asm/sections.h> #include <asm/tlbflush.h>
@@ -102,6 +103,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)#endif } +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +static int secondary_biglittle_prepare (unsigned int cpu) +{ +if (!cpu_vtable[cpu]) + cpu_vtable[cpu] =kzalloc (sizeof (*cpu_vtable[cpu]),GFP_KERNEL ); + +return cpu_vtable[cpu] ?0 : -ENOMEM ; +} + +static void secondary_biglittle_init (void ) +{ +init_proc_vtable (lookup_processor (read_cpuid_id ())->proc); +} +#else +static int secondary_biglittle_prepare (unsigned int cpu) +{ +return 0 ; +} + +static void secondary_biglittle_init (void ) +{ +} +#endif +int __cpu_up (unsigned int cpu,struct task_struct *idle) {int ret;
@@ -109,6 +134,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)if (!smp_ops.smp_boot_secondary)return -ENOSYS ; + ret =secondary_biglittle_prepare (cpu); +if (ret) +return ret; +/* * We need to tell the secondary core where to find * its stack and the page tables.
@@ -360,6 +389,8 @@ asmlinkage void secondary_start_kernel(void)struct mm_struct *mm = &init_mm;unsigned int cpu; +secondary_biglittle_init (); +/* * The identity mapping is uncached (strongly ordered), so * switch away from it before attempting any exclusive accesses.
arch/arm/mm/proc-v7-bugs.c +2 -15
@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)case ARM_CPU_PART_CORTEX_A17 :case ARM_CPU_PART_CORTEX_A73 :case ARM_CPU_PART_CORTEX_A75 : -if (processor.switch_mm != cpu_v7_bpiall_switch_mm) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = harden_branch_predictor_bpiall; spectre_v2_method ="BPIALL" ;
@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)case ARM_CPU_PART_CORTEX_A15 :case ARM_CPU_PART_BRAHMA_B15 : -if (processor.switch_mm != cpu_v7_iciallu_switch_mm) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = harden_branch_predictor_iciallu; spectre_v2_method ="ICIALLU" ;
@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void) ARM_SMCCC_ARCH_WORKAROUND_1, &res);if ((int )res.a0 !=0 )break ; -if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = call_hvc_arch_workaround_1; - processor.switch_mm = cpu_v7_hvc_switch_mm; + cpu_do_switch_mm = cpu_v7_hvc_switch_mm; spectre_v2_method ="hypervisor" ;break ;
@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void) ARM_SMCCC_ARCH_WORKAROUND_1, &res);if ((int )res.a0 !=0 )break ; -if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = call_smc_arch_workaround_1; - processor.switch_mm = cpu_v7_smc_switch_mm; + cpu_do_switch_mm = cpu_v7_smc_switch_mm; spectre_v2_method ="firmware" ;break ;
@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)if (spectre_v2_method)pr_info ("CPU%u: Spectre v2: using %s workaround\n" , smp_processor_id(), spectre_v2_method); -return ; - -bl_error: -pr_err ("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n" , - cpu); }#else static void cpu_v7_spectre_init (void )
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 58/100 SUNRPC: Fix a bogus get/put in generic_key_to_expire()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e3d5e573a54dabdc0f9f3cb039d799323372b251 ]
--- net/sunrpc/auth_generic.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-)
net/sunrpc/auth_generic.c +1 -7
@@ -281,13 +281,7 @@ static bool generic_key_to_expire(struct rpc_cred *cred) { struct auth_cred *acred = &container_of(cred, struct generic_cred, gc_base)->acred; -bool ret; - -get_rpccred (cred); - ret =test_bit (RPC_CRED_KEY_EXPIRE_SOON , &acred->ac_flags); -put_rpccred (cred); - -return ret; +return test_bit (RPC_CRED_KEY_EXPIRE_SOON , &acred->ac_flags); }static const struct rpc_credops generic_credops = {
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 59/100 kdb: Use strscpy with destination buffer size
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c2b94c72d93d0929f48157eef128c4f9d2e603ce ]
gcc 8.1.0 warns with:
kernel/debug/kdb/kdb_support.c: In function ‘kallsyms_symbol_next’:kernel/debug/kdb/kdb_support.c:239:4: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
strncpy(prefix_name, name, strlen(name)+1);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~kernel/debug/kdb/kdb_support.c:239:31: note: length computed here
Use strscpy() with the destination buffer size, and use ellipses when displaying truncated symbols.
v2: Use strscpy()
--- kernel/debug/kdb/kdb_io.c | 15 +++++++++------ kernel/debug/kdb/kdb_private.h | 2 +- kernel/debug/kdb/kdb_support.c | 10 +++++----- 3 files changed, 15 insertions(+), 12 deletions(-)
kernel/debug/kdb/kdb_io.c +9 -6
@@ -216,7 +216,7 @@ static char *kdb_read(char *buffer, size_t bufsize)int count;int i;int diag, dtab_count; -int key; +int key, buf_size, ret; diag =kdbgetintenv ("DTABCOUNT" , &dtab_count);
@@ -336,9 +336,8 @@ poll_again:else p_tmp = tmpbuffer; len =strlen (p_tmp); - count =kallsyms_symbol_complete (p_tmp, -sizeof (tmpbuffer) - - (p_tmp - tmpbuffer)); + buf_size =sizeof (tmpbuffer) - (p_tmp - tmpbuffer); + count =kallsyms_symbol_complete (p_tmp, buf_size);if (tab ==2 && count >0 ) {kdb_printf ("\n%d symbols are found." , count);if (count > dtab_count) {
@@ -350,9 +349,13 @@ poll_again: }kdb_printf ("\n" );for (i =0 ; i < count; i++) { -if (WARN_ON (!kallsyms_symbol_next (p_tmp, i))) + ret =kallsyms_symbol_next (p_tmp, i, buf_size); +if (WARN_ON (!ret))break ; -kdb_printf ("%s " , p_tmp); +if (ret != -E2BIG ) +kdb_printf ("%s " , p_tmp); +else +kdb_printf ("%s... " , p_tmp); *(p_tmp + len) ='\0' ; }if (i >= dtab_count)
kernel/debug/kdb/kdb_private.h +1 -1
@@ -83,7 +83,7 @@ typedef struct __ksymtab {unsigned long sym_start;unsigned long sym_end; } kdb_symtab_t; -extern int kallsyms_symbol_next (char *prefix_name,int flag); +extern int kallsyms_symbol_next (char *prefix_name,int flag,int buf_size);extern int kallsyms_symbol_complete (char *prefix_name,int max_len);/* Exported Symbols for kernel loadable modules to use. */
kernel/debug/kdb/kdb_support.c +5 -5
@@ -221,11 +221,13 @@ int kallsyms_symbol_complete(char *prefix_name, int max_len)* Parameters: * prefix_name prefix of a symbol name to lookup * flag 0 means search from the head, 1 means continue search. +* buf_size maximum length that can be written to prefix_name +* buffer * Returns: * 1 if a symbol matches the given prefix. * 0 if no string found */ -int kallsyms_symbol_next (char *prefix_name,int flag) +int kallsyms_symbol_next (char *prefix_name,int flag,int buf_size) {int prefix_len =strlen (prefix_name);static loff_t pos;
@@ -235,10 +237,8 @@ int kallsyms_symbol_next(char *prefix_name, int flag) pos =0 ;while ((name =kdb_walk_kallsyms (&pos))) { -if (strncmp (name, prefix_name, prefix_len) ==0 ) { -strncpy (prefix_name, name,strlen (name)+1 ); -return 1 ; - } +if (!strncmp (name, prefix_name, prefix_len)) +return strscpy (prefix_name, name, buf_size); }return 0 ; }
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 60/100 powerpc/numa: Suppress "VPHN is not supported" messages
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 437ccdc8ce629470babdda1a7086e2f477048cbd ]
When VPHN function is not supported and during cpu hotplug event, kernel prints message 'VPHN function not supported. Disabling polling...'. Currently it prints on every hotplug event, it floods dmesg when a KVM guest tries to hotplug huge number of vcpus, let's just print once and suppress further kernel prints.
--- arch/powerpc/mm/numa.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/mm/numa.c +1 -1
@@ -1261,7 +1261,7 @@ static long vphn_get_associativity(unsigned long cpu,switch (rc) {case H_FUNCTION : -printk (KERN_INFO +printk_once (KERN_INFO "VPHN is not supported. Disabling polling...\n" );stop_topology_update ();break ;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 61/100 efi/arm: Revert deferred unmap of early memmap mapping
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 33412b8673135b18ea42beb7f5117ed0091798b6 ]
Commit:
3ea86495aef2 ("efi/arm: preserve early mapping of UEFI memory map longer for BGRT")
deferred the unmap of the early mapping of the UEFI memory map to accommodate the ACPI BGRT code, which looks up the memory type that backs the BGRT table to validate it against the requirements of the UEFI spec.
Unfortunately, this causes problems on ARM, which does not permit early mappings to persist after paging_init() is called, resulting in a WARN() splat. Since we don't support the BGRT table on ARM anway, let's revert ARM to the old behaviour, which is to take down the early mapping at the end of efi_init().
--- drivers/firmware/efi/arm-init.c | 4 ++++ drivers/firmware/efi/arm-runtime.c | 2 +- drivers/firmware/efi/memmap.c | 3 +++ 3 files changed, 8 insertions(+), 1 deletion(-)
drivers/firmware/efi/arm-init.c +4 -0
@@ -265,6 +265,10 @@ void __init efi_init(void) (params.mmap & ~PAGE_MASK)));init_screen_info (); + +/* ARM does not permit early mappings to persist across paging_init() */ +if (IS_ENABLED (CONFIG_ARM )) +efi_memmap_unmap (); }static int __init register_gop_device (void )
drivers/firmware/efi/arm-runtime.c +1 -1
@@ -122,7 +122,7 @@ static int __init arm_enable_runtime_services(void) {u64 mapsize; -if (!efi_enabled (EFI_BOOT ) || !efi_enabled (EFI_MEMMAP )) { +if (!efi_enabled (EFI_BOOT )) {pr_info ("EFI services will not be available.\n" );return 0 ; }
drivers/firmware/efi/memmap.c +3 -0
@@ -118,6 +118,9 @@ int __init efi_memmap_init_early(struct efi_memory_map_data *data)void __init efi_memmap_unmap (void ) { +if (!efi_enabled (EFI_MEMMAP )) +return ; +if (!efi.memmap.late) {unsigned long size;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 62/100 z3fold: fix possible reclaim races
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ca0246bb97c23da9d267c2107c07fb77e38205c9 ]
Reclaim and free can race on an object which is basically fine but in order for reclaim to be able to map "freed" object we need to encode object length in the handle. handle_to_chunks() is then introduced to extract object length from a handle and use it during mapping.
Moreover, to avoid racing on a z3fold "headless" page release, we should not try to free that page in z3fold_free() if the reclaim bit is set. Also, in the unlikely case of trying to reclaim a page being freed, we should not proceed with that page.
While at it, fix the page accounting in reclaim function.
This patch supersedes "[PATCH] z3fold: fix reclaim lock-ups".
--- mm/z3fold.c | 101 ++++++++++++++++++++++++++++++++-------------------- 1 file changed, 62 insertions(+), 39 deletions(-)
mm/z3fold.c +62 -39
@@ -99,6 +99,7 @@ struct z3fold_header {#define NCHUNKS ((PAGE_SIZE - ZHDR_SIZE_ALIGNED) >> CHUNK_SHIFT)#define BUDDY_MASK (0x3) +#define BUDDY_SHIFT 2/** * struct z3fold_pool - stores metadata for each z3fold pool
@@ -145,7 +146,7 @@ enum z3fold_page_flags {MIDDLE_CHUNK_MAPPED ,NEEDS_COMPACTING ,PAGE_STALE , - UNDER_RECLAIM + PAGE_CLAIMED, /* by either reclaim or free */ };/*****************
@@ -174,7 +175,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page,clear_bit (MIDDLE_CHUNK_MAPPED , &page->private);clear_bit (NEEDS_COMPACTING , &page->private);clear_bit (PAGE_STALE , &page->private); -clear_bit (UNDER_RECLAIM , &page->private); +clear_bit (PAGE_CLAIMED , &page->private);spin_lock_init (&zhdr->page_lock);kref_init (&zhdr->refcount);
@@ -223,8 +224,11 @@ static unsigned long encode_handle(struct z3fold_header *zhdr, enum buddy bud)unsigned long handle; handle = (unsigned long )zhdr; -if (bud !=HEADLESS ) - handle += (bud + zhdr->first_num) &BUDDY_MASK ; +if (bud !=HEADLESS ) { + handle |= (bud + zhdr->first_num) &BUDDY_MASK ; +if (bud ==LAST ) + handle |= (zhdr->last_chunks <<BUDDY_SHIFT ); + }return handle; }
@@ -234,6 +238,12 @@ static struct z3fold_header *handle_to_z3fold_header(unsigned long handle)return (struct z3fold_header *)(handle &PAGE_MASK ); } +/* only for LAST bud, returns zero otherwise */ +static unsigned short handle_to_chunks (unsigned long handle) +{ +return (handle & ~PAGE_MASK ) >>BUDDY_SHIFT ; +} +/* * (handle & BUDDY_MASK) < zhdr->first_num is possible in encode_handle * but that doesn't matter. because the masking will result in the
@@ -717,37 +727,39 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) page =virt_to_page (zhdr);if (test_bit (PAGE_HEADLESS , &page->private)) { -/* HEADLESS page stored */ - bud =HEADLESS ; - }else { -z3fold_page_lock (zhdr); - bud =handle_to_buddy (handle); - -switch (bud) { -case FIRST : - zhdr->first_chunks =0 ; -break ; -case MIDDLE : - zhdr->middle_chunks =0 ; - zhdr->start_middle =0 ; -break ; -case LAST : - zhdr->last_chunks =0 ; -break ; -default : -pr_err ("%s: unknown bud %d\n" , __func__, bud); -WARN_ON (1 ); -z3fold_page_unlock (zhdr); -return ; +/* if a headless page is under reclaim, just leave. +* NB: we use test_and_set_bit for a reason: if the bit +* has not been set before, we release this page +* immediately so we don't care about its value any more. +*/ +if (!test_and_set_bit (PAGE_CLAIMED , &page->private)) { +spin_lock (&pool->lock); +list_del (&page->lru); +spin_unlock (&pool->lock); +free_z3fold_page (page); +atomic64_dec (&pool->pages_nr); } +return ; } -if (bud ==HEADLESS ) { -spin_lock (&pool->lock); -list_del (&page->lru); -spin_unlock (&pool->lock); -free_z3fold_page (page); -atomic64_dec (&pool->pages_nr); +/* Non-headless case */ +z3fold_page_lock (zhdr); + bud =handle_to_buddy (handle); + +switch (bud) { +case FIRST : + zhdr->first_chunks =0 ; +break ; +case MIDDLE : + zhdr->middle_chunks =0 ; +break ; +case LAST : + zhdr->last_chunks =0 ; +break ; +default : +pr_err ("%s: unknown bud %d\n" , __func__, bud); +WARN_ON (1 ); +z3fold_page_unlock (zhdr);return ; }
@@ -755,7 +767,7 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle)atomic64_dec (&pool->pages_nr);return ; } -if (test_bit (UNDER_RECLAIM , &page->private)) { +if (test_bit (PAGE_CLAIMED , &page->private)) {z3fold_page_unlock (zhdr);return ; }
@@ -833,20 +845,30 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) }list_for_each_prev (pos, &pool->lru) { page = list_entry(pos, struct page, lru); + +/* this bit could have been set by free, in which case +* we pass over to the next page in the pool. +*/ +if (test_and_set_bit (PAGE_CLAIMED , &page->private)) +continue ; + + zhdr =page_address (page);if (test_bit (PAGE_HEADLESS , &page->private)) -/* candidate found */ break ; - zhdr =page_address (page); -if (!z3fold_page_trylock (zhdr)) +if (!z3fold_page_trylock (zhdr)) { + zhdr =NULL ;continue ;/* can't evict at this point */ + }kref_get (&zhdr->refcount);list_del_init (&zhdr->buddy); zhdr->cpu =-1 ; -set_bit (UNDER_RECLAIM , &page->private);break ; } +if (!zhdr) +break ; +list_del_init (&page->lru);spin_unlock (&pool->lock);
@@ -895,6 +917,7 @@ next:if (test_bit (PAGE_HEADLESS , &page->private)) {if (ret ==0 ) {free_z3fold_page (page); +atomic64_dec (&pool->pages_nr);return 0 ; }spin_lock (&pool->lock);
@@ -902,7 +925,7 @@ next:spin_unlock (&pool->lock); }else {z3fold_page_lock (zhdr); -clear_bit (UNDER_RECLAIM , &page->private); +clear_bit (PAGE_CLAIMED , &page->private);if (kref_put (&zhdr->refcount, release_z3fold_page_locked)) {atomic64_dec (&pool->pages_nr);
@@ -961,7 +984,7 @@ static void *z3fold_map(struct z3fold_pool *pool, unsigned long handle)set_bit (MIDDLE_CHUNK_MAPPED , &page->private);break ;case LAST : - addr +=PAGE_SIZE - (zhdr->last_chunks <<CHUNK_SHIFT ); + addr +=PAGE_SIZE - (handle_to_chunks (handle) <<CHUNK_SHIFT );break ;default :pr_err ("unknown buddy id %d\n" , buddy);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 63/100 tmpfs: make lseek(SEEK_DATA/SEK_HOLE) return ENXIO with a negative offset
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1a413646931cb14442065cfc17561e50f5b5bb44 ]
Other filesystems such as ext4, f2fs and ubifs all return ENXIO when lseek (SEEK_DATA or SEEK_HOLE) requests a negative offset.
man 2 lseek says
: EINVAL whence is not valid. Or: the resulting file offset would be
: negative, or beyond the end of a seekable device.
:
: ENXIO whence is SEEK_DATA or SEEK_HOLE, and the file offset is beyond
: the end of the file.
Make tmpfs return ENXIO under these circumstances as well. After this, tmpfs also passes xfstests's generic/448.
--- mm/shmem.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
mm/shmem.c +1 -3
@@ -2590,9 +2590,7 @@ static loff_t shmem_file_llseek(struct file *file, loff_t offset, int whence)inode_lock (inode);/* We're holding i_mutex so we can access i_size directly */ -if (offset <0 ) - offset = -EINVAL ; -else if (offset >= inode->i_size) +if (offset <0 || offset >= inode->i_size) offset = -ENXIO ;else { start = offset >>PAGE_SHIFT ;
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 64/100 mm, page_alloc: check for max order in hot path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c63ae43ba53bc432b414fd73dd5f4b01fcb1ab43 ]
Konstantin has noticed that kvmalloc might trigger the following warning:
WARNING: CPU: 0 PID: 6676 at mm/vmstat.c:986 __fragmentation_index+0x54/0x60 [...] Call Trace: fragmentation_index+0x76/0x90 compaction_suitable+0x4f/0xf0 shrink_node+0x295/0x310 node_reclaim+0x205/0x250 get_page_from_freelist+0x649/0xad0 __alloc_pages_nodemask+0x12a/0x2a0 kmalloc_large_node+0x47/0x90 __kmalloc_node+0x22b/0x2e0 kvmalloc_node+0x3e/0x70 xt_alloc_table_info+0x3a/0x80 [x_tables] do_ip6t_set_ctl+0xcd/0x1c0 [ip6_tables] nf_setsockopt+0x44/0x60 SyS_setsockopt+0x6f/0xc0 do_syscall_64+0x67/0x120 entry_SYSCALL_64_after_hwframe+0x3d/0xa2
the problem is that we only check for an out of bound order in the slow path and the node reclaim might happen from the fast path already. This is fixable by making sure that kvmalloc doesn't ever use kmalloc for requests that are larger than KMALLOC_MAX_SIZE but this also shows that the code is rather fragile. A recent UBSAN report just underlines that by the following report
UBSAN: Undefined behaviour in mm/page_alloc.c:3117:19 shift exponent 51 is too large for 32-bit type 'int' CPU: 0 PID: 6520 Comm: syz-executor1 Not tainted 4.19.0-rc2 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xd2/0x148 lib/dump_stack.c:113 ubsan_epilogue+0x12/0x94 lib/ubsan.c:159 __ubsan_handle_shift_out_of_bounds+0x2b6/0x30b lib/ubsan.c:425 __zone_watermark_ok+0x2c7/0x400 mm/page_alloc.c:3117 zone_watermark_fast mm/page_alloc.c:3216 [inline] get_page_from_freelist+0xc49/0x44c0 mm/page_alloc.c:3300 __alloc_pages_nodemask+0x21e/0x640 mm/page_alloc.c:4370 alloc_pages_current+0xcc/0x210 mm/mempolicy.c:2093 alloc_pages include/linux/gfp.h:509 [inline] __get_free_pages+0x12/0x60 mm/page_alloc.c:4414 dma_mem_alloc+0x36/0x50 arch/x86/include/asm/floppy.h:156 raw_cmd_copyin drivers/block/floppy.c:3159 [inline] raw_cmd_ioctl drivers/block/floppy.c:3206 [inline] fd_locked_ioctl+0xa00/0x2c10 drivers/block/floppy.c:3544 fd_ioctl+0x40/0x60 drivers/block/floppy.c:3571 __blkdev_driver_ioctl block/ioctl.c:303 [inline] blkdev_ioctl+0xb3c/0x1a30 block/ioctl.c:601 block_ioctl+0x105/0x150 fs/block_dev.c:1883 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1c0/0x1150 fs/ioctl.c:687 ksys_ioctl+0x9e/0xb0 fs/ioctl.c:702 __do_sys_ioctl fs/ioctl.c:709 [inline] __se_sys_ioctl fs/ioctl.c:707 [inline] __x64_sys_ioctl+0x7e/0xc0 fs/ioctl.c:707 do_syscall_64+0xc4/0x510 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Note that this is not a kvmalloc path. It is just that the fast path really depends on having sanitzed order as well. Therefore move the order check to the fast path.
--- mm/page_alloc.c | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-)
mm/page_alloc.c +9 -11
@@ -3867,17 +3867,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,unsigned int cpuset_mems_cookie;int reserve_flags; -/* -* In the slowpath, we sanity check order to avoid ever trying to -* reclaim >= MAX_ORDER areas which will never succeed. Callers may -* be using allocators in order of preference for an area that is -* too large. -*/ -if (order >=MAX_ORDER ) { -WARN_ON_ONCE (!(gfp_mask & __GFP_NOWARN)); -return NULL ; - } -/* * We also sanity check to catch abuse of atomic reserves being used by * callers that are not in atomic context.
@@ -4179,6 +4168,15 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid,gfp_t alloc_mask;/* The gfp_t that was actually used for allocation */ struct alloc_context ac = { }; +/* +* There are several places where we assume that the order value is sane +* so bail out early if the request is out of bound. +*/ +if (unlikely (order >=MAX_ORDER )) { +WARN_ON_ONCE (!(gfp_mask & __GFP_NOWARN)); +return NULL ; + } + gfp_mask &= gfp_allowed_mask; alloc_mask = gfp_mask;if (!prepare_alloc_pages (gfp_mask, order, preferred_nid, nodemask, &ac, &alloc_mask, &alloc_flags))
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 65/100 of: add helper to lookup compatible child node
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 36156f9241cb0f9e37d998052873ca7501ad4b36 ]
Add of_get_compatible_child() helper that can be used to lookup compatible child nodes.
Several drivers currently use of_find_compatible_node() to lookup child nodes while failing to notice that the of_find_ functions search the entire tree depth-first (from a given start node) and therefore can match unrelated nodes. The fact that these functions also drop a reference to the node they start searching from (e.g. the parent node) is typically also overlooked, something which can lead to use-after-free bugs.
--- drivers/of/base.c | 25 +++++++++++++++++++++++++ include/linux/of.h | 8 ++++++++ 2 files changed, 33 insertions(+)
drivers/of/base.c +25 -0
@@ -737,6 +737,31 @@ struct device_node *of_get_next_available_child(const struct device_node *node, }EXPORT_SYMBOL (of_get_next_available_child); +/** +* of_get_compatible_child - Find compatible child node +* @parent: parent node +* @compatible: compatible string +* +* Lookup child node whose compatible property contains the given compatible +* string. +* +* Returns a node pointer with refcount incremented, use of_node_put() on it +* when done; or NULL if not found. +*/ +struct device_node *of_get_compatible_child (const struct device_node *parent, +const char *compatible) +{ +struct device_node *child; + +for_each_child_of_node (parent, child) { +if (of_device_is_compatible (child, compatible)) +break ; + } + +return child; +} +EXPORT_SYMBOL (of_get_compatible_child); +/** * of_get_child_by_name - Find the child node by name for a given parent * @node: parent node
include/linux/of.h +8 -0
@@ -288,6 +288,8 @@ extern struct device_node *of_get_next_child(const struct device_node *node,extern struct device_node *of_get_next_available_child (const struct device_node *node,struct device_node *prev); +extern struct device_node *of_get_compatible_child (const struct device_node *parent, +const char *compatible);extern struct device_node *of_get_child_by_name (const struct device_node *node,const char *name);
@@ -625,6 +627,12 @@ static inline bool of_have_populated_dt(void)return false; } +static inline struct device_node *of_get_compatible_child (const struct device_node *parent, +const char *compatible) +{ +return NULL ; +} +static inline struct device_node *of_get_child_by_name (const struct device_node *node,const char *name)
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 66/100 NFC: nfcmrvl_uart: fix OF child-node lookup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5bf59773aaf36dd62117dc83d50e1bbf9ef432da ]
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent node).
--- drivers/nfc/nfcmrvl/uart.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/nfc/nfcmrvl/uart.c +2 -3
@@ -73,10 +73,9 @@ static int nfcmrvl_uart_parse_dt(struct device_node *node,struct device_node *matched_node;int ret; - matched_node =of_find_compatible_node (node,NULL ,"marvell,nfc-uart" ); + matched_node =of_get_compatible_child (node,"marvell,nfc-uart" );if (!matched_node) { - matched_node =of_find_compatible_node (node,NULL , -"mrvl,nfc-uart" ); + matched_node =of_get_compatible_child (node,"mrvl,nfc-uart" );if (!matched_node)return -ENODEV ; }
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 67/100 net: bcmgenet: fix OF child-node lookup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d397dbe606120a1ea1b11b0020c3f7a3852da5ac ]
Use the new of_get_compatible_child() helper to lookup the mdio child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
--- drivers/net/ethernet/broadcom/genet/bcmmii.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/genet/bcmmii.c +1 -1
@@ -360,7 +360,7 @@ static struct device_node *bcmgenet_mii_of_find_mdio(struct bcmgenet_priv *priv)if (!compat)return NULL ; - priv->mdio_dn =of_find_compatible_node (dn,NULL , compat); + priv->mdio_dn =of_get_compatible_child (dn, compat);kfree (compat);if (!priv->mdio_dn) {dev_err (kdev,"unable to find MDIO bus node\n" );
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 68/100 drm/mediatek: fix OF sibling-node lookup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ceff2f4dcd44abf35864d9a99f85ac619e89a01d ]
Use the new of_get_compatible_child() helper to lookup the sibling instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-sibling) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent device node).
While at it, also fix the related cec-node reference leak.
--- drivers/gpu/drm/mediatek/mtk_hdmi.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/gpu/drm/mediatek/mtk_hdmi.c +3 -2
@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, }/* The CEC module handles HDMI hotplug detection */ - cec_np =of_find_compatible_node (np->parent,NULL , -"mediatek,mt8173-cec" ); + cec_np =of_get_compatible_child (np->parent,"mediatek,mt8173-cec" );if (!cec_np) {dev_err (dev,"Failed to find CEC node\n" );return -EINVAL ;
@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,if (!cec_pdev) {dev_err (hdmi->dev,"Waiting for CEC device %pOF\n" , cec_np); +of_node_put (cec_np);return -EPROBE_DEFER ; } +of_node_put (cec_np); hdmi->cec_dev = &cec_pdev->dev;/*
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 69/100 power: supply: twl4030-charger: fix OF sibling-node lookup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9844fb2e351311210e6660a9a1c62d17424a6145 ]
Use the new of_get_compatible_child() helper to lookup the usb sibling node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (non-sibling) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the parent device node).
While at it, also fix the related phy-node reference leak.
--- drivers/power/supply/twl4030_charger.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/power/supply/twl4030_charger.c +3 -2
@@ -996,12 +996,13 @@ static int twl4030_bci_probe(struct platform_device *pdev)if (bci->dev->of_node) {struct device_node *phynode; - phynode =of_find_compatible_node (bci->dev->of_node->parent, -NULL ,"ti,twl4030-usb" ); + phynode =of_get_compatible_child (bci->dev->of_node->parent, +"ti,twl4030-usb" );if (phynode) { bci->usb_nb.notifier_call = twl4030_bci_usb_ncb; bci->transceiver =devm_usb_get_phy_by_node ( bci->dev, phynode, &bci->usb_nb); +of_node_put (phynode);if (IS_ERR (bci->transceiver)) { ret =PTR_ERR (bci->transceiver);if (ret == -EPROBE_DEFER )
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 70/100 arm64: remove no-op -p linker flag
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
(commit 1a381d4a0a9a0f999a13faaba22bf6b3fc80dcb9 upstream)
Linking the ARM64 defconfig kernel with LLVM lld fails with the error:
ld.lld: error: unknown argument: -p Makefile:1015: recipe for target 'vmlinux' failed
Without this flag, the ARM64 defconfig kernel successfully links with lld and boots on Dragonboard 410c.
After digging through binutils source and changelogs, it turns out that -p is only relevant to ancient binutils installations targeting 32-bit ARM. binutils accepts -p for AArch64 too, but it's always been undocumented and silently ignored. A comment in ld/emultempl/aarch64elf.em explains that it's "Only here for backwards compatibility".
Since this flag is a no-op on ARM64, we can safely drop it.
--- arch/arm64/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/Makefile +1 -1
@@ -10,7 +10,7 @@ # # Copyright (C) 1995-2001 by Russell King -LDFLAGS_vmlinux :=-p --no-undefined -X +LDFLAGS_vmlinux :=--no-undefined -X CPPFLAGS_vmlinux.lds = -DTEXT_OFFSET=$(TEXT_OFFSET) GZFLAGS :=-9
Greg Kroah-Hartman
maintainerPATCH 71/100 xhci: Allow more than 32 quirks
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 36b6857932f380fcb55c31ac75857e3e81dd583a upstream.
We now have 32 different quirks, and the field that holds them is full. Let's bump it up to the next stage so that we can handle some more... The type is now an unsigned long long, which is 64bit on most architectures.
We take this opportunity to change the quirks from using (1 << x) to BIT_ULL(x).
--- drivers/usb/host/xhci.c | 6 ++-- drivers/usb/host/xhci.h | 64 ++++++++++++++++++++++++------------------------ 2 files changed, 36 insertions(+), 34 deletions(-)
drivers/usb/host/xhci.c +3 -3
@@ -43,8 +43,8 @@ static int link_quirk;module_param (link_quirk, int,S_IRUGO |S_IWUSR );MODULE_PARM_DESC (link_quirk,"Don't clear the chain bit on a link TRB" ); -static unsigned int quirks; -module_param (quirks, uint,S_IRUGO ); +static unsigned long long quirks; +module_param (quirks, ullong,S_IRUGO );MODULE_PARM_DESC (quirks,"Bit flags for quirks to be enabled as default" );static bool td_on_ring (struct xhci_td *td,struct xhci_ring *ring)
@@ -4956,7 +4956,7 @@ int xhci_gen_setup(struct usb_hcd *hcd,return retval;xhci_dbg (xhci,"Called HCD init\n" ); -xhci_info (xhci,"hcc params 0x%08x hci version 0x%x quirks 0x%08x\n" , +xhci_info (xhci,"hcc params 0x%08x hci version 0x%x quirks 0x%016llx\n" , xhci->hcc_params, xhci->hci_version, xhci->quirks);return 0 ;
drivers/usb/host/xhci.h +33 -31
78 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 72/100 xhci: Add quirk to workaround the errata seen on Cavium Thunder-X2 Soc
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cherian, George <[email protected]>
commit 11644a7659529730eaf2f166efaabe7c3dc7af8c upstream.
Implement workaround for ThunderX2 Errata-129 (documented in CN99XX Known Issues" available at Cavium support site).
As per ThunderX2errata-129, USB 2 device may come up as USB 1 if a connection to a USB 1 device is followed by another connection to a USB 2 device, the link will come up as USB 1 for the USB 2 device.
Resolution: Reset the PHY after the USB 1 device is disconnected. The PHY reset sequence is done using private registers in XHCI register space. After the PHY is reset we check for the PLL lock status and retry the operation if it fails. From our tests, retrying 4 times is sufficient.
Add a new quirk flag XHCI_RESET_PLL_ON_DISCONNECT to invoke the workaround in handle_xhci_port_status().
--- drivers/usb/host/xhci-pci.c | 5 +++++ drivers/usb/host/xhci-ring.c | 35 ++++++++++++++++++++++++++++++++++- drivers/usb/host/xhci.h | 1 + 3 files changed, 40 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-pci.c +5 -0
@@ -236,6 +236,11 @@ static void xhci_pci_quirks(struct devicif (pdev->vendor ==PCI_VENDOR_ID_TI && pdev->device ==0x8241 ) xhci->quirks |=XHCI_LIMIT_ENDPOINT_INTERVAL_7 ; +if ((pdev->vendor ==PCI_VENDOR_ID_BROADCOM || + pdev->vendor ==PCI_VENDOR_ID_CAVIUM ) && + pdev->device ==0x9026 ) + xhci->quirks |=XHCI_RESET_PLL_ON_DISCONNECT ; +if (xhci->quirks &XHCI_RESET_ON_RESUME )xhci_dbg_trace (xhci, trace_xhci_dbg_quirks,"QUIRK: Resetting on resume" );
drivers/usb/host/xhci-ring.c +34 -1
@@ -1568,6 +1568,35 @@ static void handle_device_notification(susb_wakeup_notification (udev->parent, udev->portnum); } +/* +* Quirk hanlder for errata seen on Cavium ThunderX2 processor XHCI +* Controller. +* As per ThunderX2errata-129 USB 2 device may come up as USB 1 +* If a connection to a USB 1 device is followed by another connection +* to a USB 2 device. +* +* Reset the PHY after the USB device is disconnected if device speed +* is less than HCD_USB3. +* Retry the reset sequence max of 4 times checking the PLL lock status. +* +*/ +static void xhci_cavium_reset_phy_quirk (struct xhci_hcd *xhci) +{ +struct usb_hcd *hcd =xhci_to_hcd (xhci); +u32 pll_lock_check; +u32 retry_count =4 ; + +do { +/* Assert PHY reset */ +writel (0x6F , hcd->regs +0x1048 ); +udelay (10 ); +/* De-assert the PHY reset */ +writel (0x7F , hcd->regs +0x1048 ); +udelay (200 ); + pll_lock_check =readl (hcd->regs +0x1070 ); + }while (!(pll_lock_check &0x1 ) && --retry_count); +} +static void handle_port_status (struct xhci_hcd *xhci,union xhci_trb *event) {
@@ -1725,9 +1754,13 @@ static void handle_port_status(struct xh goto cleanup; } -if (hcd->speed <HCD_USB3 ) +if (hcd->speed <HCD_USB3 ) {xhci_test_and_clear_bit (xhci, port_array, faked_port_index,PORT_PLC ); +if ((xhci->quirks &XHCI_RESET_PLL_ON_DISCONNECT ) && + (portsc &PORT_CSC ) && !(portsc &PORT_CONNECT )) +xhci_cavium_reset_phy_quirk (xhci); + } cleanup:/* Update event ring dequeue pointer before dropping the lock */
drivers/usb/host/xhci.h +1 -0
@@ -1838,6 +1838,7 @@ struct xhci_hcd {#define XHCI_HW_LPM_DISABLE BIT_ULL(29)#define XHCI_SUSPEND_DELAY BIT_ULL(30)#define XHCI_INTEL_USB_ROLE_SW BIT_ULL(31) +#define XHCI_RESET_PLL_ON_DISCONNECT BIT_ULL(34)unsigned int num_active_eps;unsigned int limit_active_eps;
Greg Kroah-Hartman
maintainerPATCH 73/100 mtd: rawnand: atmel: fix OF child-node lookup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 5d1e9c2212ea6b4dd735e4fc3dd6279a365d5d10 upstream.
Use the new of_get_compatible_child() helper to lookup the nfc child node instead of using of_find_compatible_node(), which searches the entire tree from a given start node and thus can return an unrelated (i.e. non-child) node.
This also addresses a potential use-after-free (e.g. after probe deferral) as the tree-wide helper drops a reference to its first argument (i.e. the node of the device being probed).
While at it, also fix a related nfc-node reference leak.
--- drivers/mtd/nand/atmel/nand-controller.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/mtd/nand/atmel/nand-controller.c +7 -4
@@ -2077,8 +2077,7 @@ atmel_hsmc_nand_controller_legacy_init(sint ret; nand_np = dev->of_node; - nfc_np =of_find_compatible_node (dev->of_node,NULL , -"atmel,sama5d3-nfc" ); + nfc_np =of_get_compatible_child (dev->of_node,"atmel,sama5d3-nfc" );if (!nfc_np) {dev_err (dev,"Could not find device node for sama5d3-nfc\n" );return -ENODEV ;
@@ -2492,15 +2491,19 @@ static int atmel_nand_controller_probe(s }if (caps->legacy_of_bindings) { +struct device_node *nfc_node;u32 ale_offs =21 ;/* * If we are parsing legacy DT props and the DT contains a * valid NFC node, forward the request to the sama5 logic. */ -if (of_find_compatible_node (pdev->dev.of_node,NULL , -"atmel,sama5d3-nfc" )) + nfc_node =of_get_compatible_child (pdev->dev.of_node, +"atmel,sama5d3-nfc" ); +if (nfc_node) { caps = &atmel_sama5_nand_caps; +of_node_put (nfc_node); + }/* * Even if the compatible says we are dealing with an
Greg Kroah-Hartman
maintainerPATCH 74/100 ubi: fastmap: Check each mapping only once
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 34653fd8c46e771585fce5975e4243f8fd401914 upstream.
Maintain a bitmap to keep track of which LEB->PEB mapping was checked already.
That way we have to read back VID headers only once.
--- drivers/mtd/ubi/build.c | 1 + drivers/mtd/ubi/eba.c | 4 ++++ drivers/mtd/ubi/fastmap.c | 20 ++++++++++++++++++++ drivers/mtd/ubi/ubi.h | 11 +++++++++++ drivers/mtd/ubi/vmt.c | 1 + drivers/mtd/ubi/vtbl.c | 16 +++++++++++++++- 6 files changed, 52 insertions(+), 1 deletion(-)
drivers/mtd/ubi/build.c +1 -0
@@ -526,6 +526,7 @@ void ubi_free_internal_volumes(struct ubfor (i = ubi->vtbl_slots; i < ubi->vtbl_slots +UBI_INT_VOL_COUNT ; i++) {ubi_eba_replace_table (ubi->volumes[i],NULL ); +ubi_fastmap_destroy_checkmap (ubi->volumes[i]);kfree (ubi->volumes[i]); } }
drivers/mtd/ubi/eba.c +4 -0
@@ -517,6 +517,9 @@ static int check_mapping(struct ubi_deviif (!ubi->fast_attach)return 0 ; +if (!vol->checkmap ||test_bit (lnum, vol->checkmap)) +return 0 ; + vidb =ubi_alloc_vid_buf (ubi,GFP_NOFS );if (!vidb)return -ENOMEM ;
@@ -551,6 +554,7 @@ static int check_mapping(struct ubi_devi goto out_free; } +set_bit (lnum, vol->checkmap); err =0 ; out_free:
drivers/mtd/ubi/fastmap.c +20 -0
@@ -1101,6 +1101,26 @@ free_fm_sb: goto out; } +int ubi_fastmap_init_checkmap (struct ubi_volume *vol,int leb_count) +{ +struct ubi_device *ubi = vol->ubi; + +if (!ubi->fast_attach) +return 0 ; + + vol->checkmap =kcalloc (BITS_TO_LONGS (leb_count),sizeof (unsigned long ), +GFP_KERNEL ); +if (!vol->checkmap) +return -ENOMEM ; + +return 0 ; +} + +void ubi_fastmap_destroy_checkmap (struct ubi_volume *vol) +{ +kfree (vol->checkmap); +} +/** * ubi_write_fastmap - writes a fastmap. * @ubi: UBI device object
drivers/mtd/ubi/ubi.h +11 -0
@@ -334,6 +334,9 @@ struct ubi_eba_leb_desc {* @changing_leb: %1 if the atomic LEB change ioctl command is in progress * @direct_writes: %1 if direct writes are enabled for this volume * +* @checkmap: bitmap to remember which PEB->LEB mappings got checked, +* protected by UBI LEB lock tree. +* * The @corrupted field indicates that the volume's contents is corrupted. * Since UBI protects only static volumes, this field is not relevant to * dynamic volumes - it is user's responsibility to assure their data
@@ -377,6 +380,10 @@ struct ubi_volume { unsigned int updating:1; unsigned int changing_leb:1; unsigned int direct_writes:1; + +#ifdef CONFIG_MTD_UBI_FASTMAP +unsigned long *checkmap; +#endif };/**
@@ -965,8 +972,12 @@ size_t ubi_calc_fm_size(struct ubi_devicint ubi_update_fastmap (struct ubi_device *ubi);int ubi_scan_fastmap (struct ubi_device *ubi,struct ubi_attach_info *ai,struct ubi_attach_info *scan_ai); +int ubi_fastmap_init_checkmap (struct ubi_volume *vol,int leb_count); +void ubi_fastmap_destroy_checkmap (struct ubi_volume *vol);#else static inline int ubi_update_fastmap (struct ubi_device *ubi) {return 0 ; } +int static inline ubi_fastmap_init_checkmap (struct ubi_volume *vol,int leb_count) {return 0 ; } +static inline void ubi_fastmap_destroy_checkmap (struct ubi_volume *vol) {}#endif /* block.c */
drivers/mtd/ubi/vmt.c +1 -0
@@ -139,6 +139,7 @@ static void vol_release(struct device *d struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev);ubi_eba_replace_table (vol,NULL ); +ubi_fastmap_destroy_checkmap (vol);kfree (vol); }
drivers/mtd/ubi/vtbl.c +15 -1
@@ -534,7 +534,7 @@ static int init_volumes(struct ubi_devicconst struct ubi_attach_info *ai, const struct ubi_vtbl_record *vtbl) { - int i, reserved_pebs = 0; + int i, err, reserved_pebs = 0;struct ubi_ainf_volume *av;struct ubi_volume *vol;
@@ -620,6 +620,16 @@ static int init_volumes(struct ubi_devic (long long )(vol->used_ebs -1 ) * vol->usable_leb_size; vol->used_bytes += av->last_data_size; vol->last_eb_bytes = av->last_data_size; + +/* +* We use ubi->peb_count and not vol->reserved_pebs because +* we want to keep the code simple. Otherwise we'd have to +* resize/check the bitmap upon volume resize too. +* Allocating a few bytes more does not hurt. +*/ + err =ubi_fastmap_init_checkmap (vol, ubi->peb_count); +if (err) +return err; }/* And add the layout volume */
@@ -645,6 +655,9 @@ static int init_volumes(struct ubi_devic reserved_pebs += vol->reserved_pebs; ubi->vol_count +=1 ; vol->ubi = ubi; + err =ubi_fastmap_init_checkmap (vol,UBI_LAYOUT_VOLUME_EBS ); +if (err) +return err;if (reserved_pebs > ubi->avail_pebs) { ubi_err(ubi, "not enough PEBs, required %d, available %d",
@@ -849,6 +862,7 @@ int ubi_read_volume_table(struct ubi_dev out_free:vfree (ubi->vtbl);for (i =0 ; i < ubi->vtbl_slots +UBI_INT_VOL_COUNT ; i++) { +ubi_fastmap_destroy_checkmap (ubi->volumes[i]);kfree (ubi->volumes[i]); ubi->volumes[i] =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 75/100 Input: xpad - add PDP device id 0x02a4
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c6c848572f4da0e34ffe0a35364b4db871e13e42 ]
Adds support for a PDP Xbox One controller with device ID (0x06ef:0x02a4). The Product string for this device is "PDP Wired Controller for Xbox One - Stealth Series | Phantom Black".
--- drivers/input/joystick/xpad.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/input/joystick/xpad.c +7 -2
@@ -231,6 +231,7 @@ static const struct xpad_device { { 0x0e6f, 0x021f, "Rock Candy Gamepad for Xbox 360", 0, XTYPE_XBOX360 }, { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 }, { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
@@ -480,7 +481,8 @@ static const u8 xboxone_hori_init[] = {/* * This packet is required for some of the PDP pads to start -* sending input reports. One of those pads is (0x0e6f:0x02ab). +* sending input reports. These pads include: (0x0e6f:0x02ab), +* (0x0e6f:0x02a4). */ static const u8 xboxone_pdp_init1[] = {0x0a ,0x20 ,0x00 ,0x03 ,0x00 ,0x01 ,0x14
@@ -488,7 +490,8 @@ static const u8 xboxone_pdp_init1[] = {/* * This packet is required for some of the PDP pads to start -* sending input reports. One of those pads is (0x0e6f:0x02ab). +* sending input reports. These pads include: (0x0e6f:0x02ab), +* (0x0e6f:0x02a4). */ static const u8 xboxone_pdp_init2[] = {0x06 ,0x20 ,0x00 ,0x02 ,0x01 ,0x00
@@ -526,6 +529,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {XBOXONE_INIT_PKT (0x0000 ,0x0000 , xboxone_fw2015_init),XBOXONE_INIT_PKT (0x0e6f ,0x02ab , xboxone_pdp_init1),XBOXONE_INIT_PKT (0x0e6f ,0x02ab , xboxone_pdp_init2), +XBOXONE_INIT_PKT (0x0e6f ,0x02a4 , xboxone_pdp_init1), +XBOXONE_INIT_PKT (0x0e6f ,0x02a4 , xboxone_pdp_init2),XBOXONE_INIT_PKT (0x24c6 ,0x541a , xboxone_rumblebegin_init),XBOXONE_INIT_PKT (0x24c6 ,0x542a , xboxone_rumblebegin_init), XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 76/100 Input: xpad - fix some coding style issues
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 68c78d0155e37992268664e134996d2b140ddf38 ]
Fix some coding style issues reported by checkpatch.pl. Mostly brackets in macros, spacing and comment style.
--- drivers/input/joystick/xpad.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/input/joystick/xpad.c +9 -6
@@ -89,8 +89,10 @@#define XPAD_PKT_LEN 64 -/* xbox d-pads should map to buttons, as is required for DDR pads -but we map them to axes when possible to simplify things */ +/* +* xbox d-pads should map to buttons, as is required for DDR pads +* but we map them to axes when possible to simplify things +*/ #define MAP_DPAD_TO_BUTTONS (1 << 0)#define MAP_TRIGGERS_TO_BUTTONS (1 << 1)#define MAP_STICKS_TO_NULL (1 << 2)
@@ -391,15 +393,15 @@ static const signed short xpad_abs_triggers[] = {* match against vendor id as well. Wired Xbox 360 devices have protocol 1, * wireless controllers have protocol 129. */ -#define XPAD_XBOX360_VENDOR_PROTOCOL (vend,pr) \ +#define XPAD_XBOX360_VENDOR_PROTOCOL (vend, pr) \ .match_flags = USB_DEVICE_ID_MATCH_VENDOR | USB_DEVICE_ID_MATCH_INT_INFO, \ .idVendor = (vend), \ .bInterfaceClass = USB_CLASS_VENDOR_SPEC, \ .bInterfaceSubClass = 93, \ .bInterfaceProtocol = (pr)#define XPAD_XBOX360_VENDOR (vend) \ - { XPAD_XBOX360_VENDOR_PROTOCOL(vend,1) }, \ - { XPAD_XBOX360_VENDOR_PROTOCOL(vend,129) } + { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 1) }, \ + { XPAD_XBOX360_VENDOR_PROTOCOL((vend), 129) }/* The Xbox One controller uses subclass 71 and protocol 208. */ #define XPAD_XBOXONE_VENDOR_PROTOCOL (vend, pr) \
@@ -409,7 +411,7 @@ static const signed short xpad_abs_triggers[] = { .bInterfaceSubClass = 71, \ .bInterfaceProtocol = (pr)#define XPAD_XBOXONE_VENDOR (vend) \ - { XPAD_XBOXONE_VENDOR_PROTOCOL(vend, 208) } + { XPAD_XBOXONE_VENDOR_PROTOCOL((vend), 208) }static const struct usb_device_id xpad_table[] = { {USB_INTERFACE_INFO ('X' ,'B' ,0 ) },/* X-Box USB-IF not approved class */
@@ -1578,6 +1580,7 @@ static void xpad_close(struct input_dev *dev)static void xpad_set_up_abs (struct input_dev *input_dev,signed short abs) {struct usb_xpad *xpad =input_get_drvdata (input_dev); +set_bit (abs, input_dev->absbit);switch (abs) {
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 77/100 Input: xpad - avoid using __set_bit() for capabilities
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a01308031c2647ed5f1c845104b73a8820a958a9 ]
input_set_capability() and input_set_abs_param() will do it for you.
--- drivers/input/joystick/xpad.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/input/joystick/xpad.c +10 -10
@@ -1581,8 +1581,6 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs) {struct usb_xpad *xpad =input_get_drvdata (input_dev); -set_bit (abs, input_dev->absbit); -switch (abs) {case ABS_X :case ABS_Y :
@@ -1601,6 +1599,9 @@ static void xpad_set_up_abs(struct input_dev *input_dev, signed short abs)case ABS_HAT0Y :/* the d-pad (only if dpad is mapped to axes */ input_set_abs_params (input_dev, abs,-1 ,1 ,0 ,0 );break ; +default : +input_set_abs_params (input_dev, abs,0 ,0 ,0 ,0 ); +break ; } }
@@ -1641,10 +1642,7 @@ static int xpad_init_input(struct usb_xpad *xpad) input_dev->close = xpad_close; } -__set_bit (EV_KEY , input_dev->evbit); -if (!(xpad->mapping &MAP_STICKS_TO_NULL )) { -__set_bit (EV_ABS , input_dev->evbit);/* set up axes */ for (i =0 ; xpad_abs[i] >=0 ; i++)xpad_set_up_abs (input_dev, xpad_abs[i]);
@@ -1652,21 +1650,22 @@ static int xpad_init_input(struct usb_xpad *xpad)/* set up standard buttons */ for (i =0 ; xpad_common_btn[i] >=0 ; i++) -__set_bit (xpad_common_btn[i], input_dev->keybit); +input_set_capability (input_dev,EV_KEY , xpad_common_btn[i]);/* set up model-specific ones */ if (xpad->xtype ==XTYPE_XBOX360 || xpad->xtype ==XTYPE_XBOX360W || xpad->xtype ==XTYPE_XBOXONE ) {for (i =0 ; xpad360_btn[i] >=0 ; i++) -__set_bit (xpad360_btn[i], input_dev->keybit); +input_set_capability (input_dev,EV_KEY , xpad360_btn[i]); }else {for (i =0 ; xpad_btn[i] >=0 ; i++) -__set_bit (xpad_btn[i], input_dev->keybit); +input_set_capability (input_dev,EV_KEY , xpad_btn[i]); }if (xpad->mapping &MAP_DPAD_TO_BUTTONS ) {for (i =0 ; xpad_btn_pad[i] >=0 ; i++) -__set_bit (xpad_btn_pad[i], input_dev->keybit); +input_set_capability (input_dev,EV_KEY , + xpad_btn_pad[i]); }/*
@@ -1683,7 +1682,8 @@ static int xpad_init_input(struct usb_xpad *xpad)if (xpad->mapping &MAP_TRIGGERS_TO_BUTTONS ) {for (i =0 ; xpad_btn_triggers[i] >=0 ; i++) -__set_bit (xpad_btn_triggers[i], input_dev->keybit); +input_set_capability (input_dev,EV_KEY , + xpad_btn_triggers[i]); }else {for (i =0 ; xpad_abs_triggers[i] >=0 ; i++)xpad_set_up_abs (input_dev, xpad_abs_triggers[i]);
Signature · 1 line
2.17.1
Greg Kroah-Hartman
maintainerPATCH 78/100 Input: xpad - add support for Xbox1 PDP Camo series gamepad
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9735082a7cbae572c2eabdc45acecc8c9fa0759b ]
The "Xbox One PDP Wired Controller - Camo series" has a different product-id than the regular PDP controller and the PDP stealth series, but it uses the same initialization sequence. This patch adds the product-id of the camo series to the structures that handle the other PDP Xbox One controllers.
--- drivers/input/joystick/xpad.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/input/joystick/xpad.c +3 -0
@@ -234,6 +234,7 @@ static const struct xpad_device { { 0x0e6f, 0x0246, "Rock Candy Gamepad for Xbox One 2015", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x02ab, "PDP Controller for Xbox One", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x02a4, "PDP Wired Controller for Xbox One - Stealth Series", 0, XTYPE_XBOXONE }, + { 0x0e6f, 0x02a6, "PDP Wired Controller for Xbox One - Camo Series", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x0301, "Logic3 Controller", 0, XTYPE_XBOX360 }, { 0x0e6f, 0x0346, "Rock Candy Gamepad for Xbox One 2016", 0, XTYPE_XBOXONE }, { 0x0e6f, 0x0401, "Logic3 Controller", 0, XTYPE_XBOX360 },
@@ -533,6 +534,8 @@ static const struct xboxone_init_packetXBOXONE_INIT_PKT (0x0e6f ,0x02ab , xboxone_pdp_init2),XBOXONE_INIT_PKT (0x0e6f ,0x02a4 , xboxone_pdp_init1),XBOXONE_INIT_PKT (0x0e6f ,0x02a4 , xboxone_pdp_init2), +XBOXONE_INIT_PKT (0x0e6f ,0x02a6 , xboxone_pdp_init1), +XBOXONE_INIT_PKT (0x0e6f ,0x02a6 , xboxone_pdp_init2),XBOXONE_INIT_PKT (0x24c6 ,0x541a , xboxone_rumblebegin_init),XBOXONE_INIT_PKT (0x24c6 ,0x542a , xboxone_rumblebegin_init), XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
Greg Kroah-Hartman
maintainerPATCH 79/100 iwlwifi: fix wrong WGDS_WIFI_DATA_SIZE
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Chen <[email protected]>
commit 66e839030fd698586734e017fd55c4f2a89dba0b upstream.
Quoted 1 line
Quoted 1 line
From coreboot/BIOS:
Name ("WGDS", Package() {
Revision,
Package() {
DomainType, // 0x7:WiFi ==> We miss this one.
WgdsWiFiSarDeltaGroup1PowerMax1, // Group 1 FCC 2400 Max
WgdsWiFiSarDeltaGroup1PowerChainA1, // Group 1 FCC 2400 A Offset WgdsWiFiSarDeltaGroup1PowerChainB1, // Group 1 FCC 2400 B Offset
WgdsWiFiSarDeltaGroup1PowerMax2, // Group 1 FCC 5200 Max
WgdsWiFiSarDeltaGroup1PowerChainA2, // Group 1 FCC 5200 A Offset WgdsWiFiSarDeltaGroup1PowerChainB2, // Group 1 FCC 5200 B Offset
WgdsWiFiSarDeltaGroup2PowerMax1, // Group 2 EC Jap 2400 Max
WgdsWiFiSarDeltaGroup2PowerChainA1, // Group 2 EC Jap 2400 A Offset WgdsWiFiSarDeltaGroup2PowerChainB1, // Group 2 EC Jap 2400 B Offset
WgdsWiFiSarDeltaGroup2PowerMax2, // Group 2 EC Jap 5200 Max
WgdsWiFiSarDeltaGroup2PowerChainA2, // Group 2 EC Jap 5200 A Offset WgdsWiFiSarDeltaGroup2PowerChainB2, // Group 2 EC Jap 5200 B Offset
WgdsWiFiSarDeltaGroup3PowerMax1, // Group 3 ROW 2400 Max
WgdsWiFiSarDeltaGroup3PowerChainA1, // Group 3 ROW 2400 A Offset WgdsWiFiSarDeltaGroup3PowerChainB1, // Group 3 ROW 2400 B Offset
WgdsWiFiSarDeltaGroup3PowerMax2, // Group 3 ROW 5200 Max
WgdsWiFiSarDeltaGroup3PowerChainA2, // Group 3 ROW 5200 A Offset WgdsWiFiSarDeltaGroup3PowerChainB2, // Group 3 ROW 5200 B Offset
}
})
When read the ACPI data to find out the WGDS, the DATA_SIZE is never matched.
Quoted 1 line
Quoted 1 line
From the above format, it gives 19 numbers, but our driver is hardcode
as 18.
Fix it to pass then can parse the data into our wgds table. Then we will see:
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init Sending GEO_TX_POWER_LIMIT iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0] Band[0]: chain A = 68 chain B = 69 max_tx_power = 54
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[0] Band[1]: chain A = 48 chain B = 49 max_tx_power = 70
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1] Band[0]: chain A = 51 chain B = 67 max_tx_power = 50
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[1] Band[1]: chain A = 69 chain B = 70 max_tx_power = 68
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2] Band[0]: chain A = 49 chain B = 50 max_tx_power = 48
iwlwifi 0000:01:00.0: U iwl_mvm_sar_geo_init SAR geographic profile[2] Band[1]: chain A = 52 chain B = 53 max_tx_power = 51
--- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c +2 -2
@@ -590,7 +590,7 @@ static int iwl_mvm_config_ltr(struct iwl#define ACPI_WRDS_WIFI_DATA_SIZE (IWL_MVM_SAR_TABLE_SIZE + 2)#define ACPI_EWRD_WIFI_DATA_SIZE ((IWL_MVM_SAR_PROFILE_NUM - 1) * \ IWL_MVM_SAR_TABLE_SIZE + 3) -#define ACPI_WGDS_WIFI_DATA_SIZE 18 +#define ACPI_WGDS_WIFI_DATA_SIZE 19#define ACPI_WGDS_NUM_BANDS 2#define ACPI_WGDS_TABLE_SIZE 3
@@ -964,7 +964,7 @@ static int iwl_mvm_sar_geo_init(struct iIWL_DEBUG_RADIO (mvm,"Sending GEO_TX_POWER_LIMIT\n" );BUILD_BUG_ON (IWL_NUM_GEO_PROFILES *ACPI_WGDS_NUM_BANDS * -ACPI_WGDS_TABLE_SIZE !=ACPI_WGDS_WIFI_DATA_SIZE ); +ACPI_WGDS_TABLE_SIZE +1 !=ACPI_WGDS_WIFI_DATA_SIZE );for (i =0 ; i <IWL_NUM_GEO_PROFILES ; i++) { struct iwl_per_chain_offset *chain =
Greg Kroah-Hartman
maintainerPATCH 80/100 kbuild: allow to use GCC toolchain not in Clang search path
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Agner <[email protected]>
commit ef8c4ed9db80261f397f0c0bf723684601ae3b52 upstream.
When using a GCC cross toolchain which is not in a compiled in Clang search path, Clang reverts to the system assembler and linker. This leads to assembler or linker errors, depending on which tool is first used for a given architecture.
It seems that Clang is not searching $PATH for a matching assembler or linker.
Make sure that Clang picks up the correct assembler or linker by passing the cross compilers bin directory as search path.
This allows to use Clang provided by distributions with GCC toolchains not in /usr/bin.
--- Makefile | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
Makefile +5 -3
@@ -480,13 +480,15 @@ endif ifeq ($(cc-name),clang) ifneq ($(CROSS_COMPILE),) CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%)) -GCC_TOOLCHAIN := $(realpath $(dir $(shell which $(LD)))/..) +GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD))) +CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR) +GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..) endif ifneq ($(GCC_TOOLCHAIN),) CLANG_GCC_TC := --gcc-toolchain=$(GCC_TOOLCHAIN) endif -KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) -KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) +KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX) +KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX) KBUILD_CFLAGS += $(call cc-option, -no-integrated-as) KBUILD_AFLAGS += $(call cc-option, -no-integrated-as) endif
Greg Kroah-Hartman
maintainerPATCH 81/100 PCI: endpoint: Populate func_no before calling pci_epc_add_epf()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <[email protected]>
commit 0c47cd7a9b6c9c36c08113e594e9ad017fb17865 upstream.
func_no is a member of struct pci_epf.
Since struct pci_epf is used as an argument to pci_epc_add_epf() (to bind an endpoint function to a controller), struct pci_epf.func_no should be populated before calling pci_epc_add_epf().
Initialize the struct pci_epf.func_no member before calling pci_epc_add_epf(), to fix the endpoint function binding to an endpoint controller.
--- drivers/pci/endpoint/pci-ep-cfs.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/pci/endpoint/pci-ep-cfs.c +6 -8
@@ -97,16 +97,10 @@ static int pci_epc_epf_link(struct confi {int ret;u32 func_no =0 ; -struct pci_epc *epc; -struct pci_epf *epf;struct pci_epf_group *epf_group =to_pci_epf_group (epf_item);struct pci_epc_group *epc_group =to_pci_epc_group (epc_item); - - epc = epc_group->epc; - epf = epf_group->epf; - ret =pci_epc_add_epf (epc, epf); -if (ret) - goto err_add_epf; +struct pci_epc *epc = epc_group->epc; +struct pci_epf *epf = epf_group->epf; func_no =find_first_zero_bit (&epc_group->function_num_map,BITS_PER_LONG );
@@ -116,6 +110,10 @@ static int pci_epc_epf_link(struct confiset_bit (func_no, &epc_group->function_num_map); epf->func_no = func_no; + ret =pci_epc_add_epf (epc, epf); +if (ret) + goto err_add_epf; + ret =pci_epf_bind (epf);if (ret) goto err_epf_bind;
Greg Kroah-Hartman
maintainerPATCH 82/100 net/mlx4_core: Fix wrong calculation of free counters
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eran Ben Elisha <[email protected]>
commit 0bb9fc4f5429ac970181c073aa32e521e20f7b73 upstream.
The field res_free indicates the total number of counters which are available for allocation (reserved and unreserved). Fixed a bug where the reserved counters were subtracted from res_free before any allocation was performed.
Before this fix, free counters which were not reserved could not be allocated.
--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +0 -1
@@ -611,7 +611,6 @@ int mlx4_init_resource_tracker(struct mlMLX4_MAX_PORTS ; else res_alloc->guaranteed[t] = 0; - res_alloc->res_free -= res_alloc->guaranteed[t];break ;default :break ;
Greg Kroah-Hartman
maintainerPATCH 83/100 i40iw: Fix memory leak in error path of create QP
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mustafa Ismail <[email protected]>
commit 5a7189d529cd146cd5838af97b32fcac4122b471 upstream.
If i40iw_allocate_dma_mem fails when creating a QP, the memory allocated for the QP structure using kzalloc is not freed because iwqp->allocated_buffer is used to free the memory and it is not setup until later. Fix this by setting iwqp->allocated_buffer before allocating the dma memory.
--- drivers/infiniband/hw/i40iw/i40iw_verbs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/i40iw/i40iw_verbs.c +1 -1
@@ -631,6 +631,7 @@ static struct ib_qp *i40iw_create_qp(strreturn ERR_PTR (-ENOMEM ); iwqp = (struct i40iw_qp *)mem; + iwqp->allocated_buffer = mem; qp = &iwqp->sc_qp; qp->back_qp = (void *)iwqp; qp->push_idx =I40IW_INVALID_PUSH_PAGE_INDEX ;
@@ -659,7 +660,6 @@ static struct ib_qp *i40iw_create_qp(str goto error; } - iwqp->allocated_buffer = mem; iwqp->iwdev = iwdev; iwqp->iwpd = iwpd; iwqp->ibqp.qp_num = qp_num;
Greg Kroah-Hartman
maintainerPATCH 84/100 rtc: omap: fix error path when pinctrl_register fails
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <[email protected]>
commit 26e480f7bb7840fc0daa9c3af7c4501b2cf5902f upstream.
If pinctrl_register() fails probe will return with an error without locking the RTC and disabling pm_runtime.
Set ret and jump to err instead.
--- drivers/rtc/rtc-omap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/rtc/rtc-omap.c +2 -1
@@ -823,7 +823,8 @@ static int omap_rtc_probe(struct platfor rtc->pctldev =pinctrl_register (&rtc_pinctrl_desc, &pdev->dev, rtc);if (IS_ERR (rtc->pctldev)) {dev_err (&pdev->dev,"Couldn't register pinctrl driver\n" ); -return PTR_ERR (rtc->pctldev); + ret =PTR_ERR (rtc->pctldev); + goto err; }if (rtc->is_pmic_controller) {
Greg Kroah-Hartman
maintainerPATCH 85/100 clk: samsung: exynos5250: Add missing clocks for FIMC LITE SYSMMU devices
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 5b23fceec1ff94305c5d1accde018cae27448005 upstream.
FIMC LITE SYSMMU devices are defined in exynos5250.dtsi, but clocks for them are not instantiated by Exynos5250 clock provider driver. Add needed definitions for those clocks to fix IOMMU probe failure:
ERROR: could not get clock /soc/sysmmu@13c40000:sysmmu(0) exynos-sysmmu 13c40000.sysmmu: Failed to get device clock(s)!
exynos-sysmmu: probe of 13c40000.sysmmu failed with error -38
ERROR: could not get clock /soc/sysmmu@13c50000:sysmmu(0) exynos-sysmmu 13c50000.sysmmu: Failed to get device clock(s)!
exynos-sysmmu: probe of 13c50000.sysmmu failed with error -38
--- drivers/clk/samsung/clk-exynos5250.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/clk/samsung/clk-exynos5250.c +6 -0
@@ -560,6 +560,8 @@ static const struct samsung_gate_clock e 0),GATE (CLK_GSCL3 ,"gscl3" ,"mout_aclk266_gscl_sub" ,GATE_IP_GSCL ,3 ,0 ,0 ), +GATE (CLK_CAMIF_TOP ,"camif_top" ,"mout_aclk266_gscl_sub" , +GATE_IP_GSCL ,4 ,0 ,0 ),GATE (CLK_GSCL_WA ,"gscl_wa" ,"div_gscl_wa" ,GATE_IP_GSCL ,5 ,0 ,0 ),GATE (CLK_GSCL_WB ,"gscl_wb" ,"div_gscl_wb" ,GATE_IP_GSCL ,6 ,0 ,0 ), GATE(CLK_SMMU_GSCL0, "smmu_gscl0", "mout_aclk266_gscl_sub",
@@ -570,6 +572,10 @@ static const struct samsung_gate_clock e GATE_IP_GSCL, 9, 0, 0),GATE (CLK_SMMU_GSCL3 ,"smmu_gscl3" ,"mout_aclk266_gscl_sub" ,GATE_IP_GSCL ,10 ,0 ,0 ), +GATE (CLK_SMMU_FIMC_LITE0 ,"smmu_fimc_lite0" ,"mout_aclk266_gscl_sub" , +GATE_IP_GSCL ,11 ,0 ,0 ), +GATE (CLK_SMMU_FIMC_LITE1 ,"smmu_fimc_lite1" ,"mout_aclk266_gscl_sub" , +GATE_IP_GSCL ,12 ,0 ,0 ),GATE (CLK_FIMD1 ,"fimd1" ,"mout_aclk200_disp1_sub" ,GATE_IP_DISP1 ,0 ,0 , 0),
Greg Kroah-Hartman
maintainerPATCH 86/100 ARM: dts: exynos: Fix invalid node referenced by i2c20 alias in Peach Pit and Pi
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 70c3250ac1374688d7963e562fe58b23f70bcba9 upstream.
After moving all nodes under "soc" node in commit 5d99cc59a3c6 ("ARM:
dts: exynos: Move Exynos5250 and Exynos5420 nodes under soc"), the i2c20 alias in Peach Pit and Peach Pi stopped pointing to proper node:
arch/arm/boot/dts/exynos5420-peach-pit.dtb: Warning (alias_paths):
/aliases:i2c20: aliases property is not a valid node (/spi@12d40000/cros-ec@0/i2c-tunnel)
arch/arm/boot/dts/exynos5800-peach-pi.dtb: Warning (alias_paths):
/aliases:i2c20: aliases property is not a valid node (/spi@12d40000/cros-ec@0/i2c-tunnel)
--- arch/arm/boot/dts/exynos5420-peach-pit.dts | 4 ++-- arch/arm/boot/dts/exynos5800-peach-pi.dts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/exynos5420-peach-pit.dts +2 -2
@@ -31,7 +31,7 @@ aliases { /* Assign 20 so we don't get confused w/ builtin ones */ - i2c20 = "/spi@12d40000/cros-ec@0/i2c-tunnel"; + i2c20 = &i2c_tunnel; }; backlight: backlight {
@@ -952,7 +952,7 @@ samsung,spi-feedback-delay = <1>; }; - i2c-tunnel { + i2c_tunnel: i2c-tunnel { compatible = "google,cros-ec-i2c-tunnel"; #address-cells = <1>; #size-cells = <0>;
arch/arm/boot/dts/exynos5800-peach-pi.dts +2 -2
@@ -29,7 +29,7 @@ aliases { /* Assign 20 so we don't get confused w/ builtin ones */ - i2c20 = "/spi@12d40000/cros-ec@0/i2c-tunnel"; + i2c20 = &i2c_tunnel; }; backlight: backlight {
@@ -921,7 +921,7 @@ samsung,spi-feedback-delay = <1>; }; - i2c-tunnel { + i2c_tunnel: i2c-tunnel { compatible = "google,cros-ec-i2c-tunnel"; #address-cells = <1>; #size-cells = <0>;
Greg Kroah-Hartman
maintainerPATCH 87/100 driver core: Move device_links_purge() after bus_remove_device()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffy Chen <[email protected]>
commit 2ec16150179888b81717d1d3ce84e634f4736af2 upstream.
The current ordering of code in device_del() triggers a WARN_ON() in device_links_purge(), because of an unexpected link status.
The device_links_unbind_consumers() call in device_release_driver() has to take place before device_links_purge() for the status of all links to be correct, so move the device_links_purge() call in device_del() after the invocation of bus_remove_device() which calls device_release_driver().
--- drivers/base/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/core.c +1 -1
@@ -1973,7 +1973,6 @@ void device_del(struct device *dev)blocking_notifier_call_chain (&dev->bus->p->bus_notifier,BUS_NOTIFY_DEL_DEVICE , dev); -device_links_purge (dev);dpm_sysfs_remove (dev);if (parent)klist_del (&dev->p->knode_parent);
@@ -2001,6 +2000,7 @@ void device_del(struct device *dev)device_pm_remove (dev);driver_deferred_probe_del (dev);device_remove_properties (dev); +device_links_purge (dev);/* Notify the platform of the removal, in case they * need to do anything...
Greg Kroah-Hartman
maintainerPATCH 88/100 include/linux/pfn_t.h: force ~ to be parsed as an unary operator
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sebastien Boisvert <[email protected]>
commit 4d54954a197175c0dcb3c82af0c0740d0c5f827a upstream.
Tracing the event "fs_dax:dax_pmd_insert_mapping" with perf produces this warning:
[fs_dax:dax_pmd_insert_mapping] unknown op '~'
It is printed in process_op (tools/lib/traceevent/event-parse.c) because '~' is parsed as a binary operator.
perf reads the format of fs_dax:dax_pmd_insert_mapping ("print fmt") from /sys/kernel/debug/tracing/events/fs_dax/dax_pmd_insert_mapping/format .
The format contains:
~(((u64) ~(~(((1UL) << 12)-1)))
^
\ interpreted as a binary operator by process_op().
This part is generated in the declaration of the event class dax_pmd_insert_mapping_class in include/trace/events/fs_dax.h :
__print_flags_u64(__entry->pfn_val & PFN_FLAGS_MASK, "|", PFN_FLAGS_TRACE),
This patch adds a pair of parentheses in the declaration of PFN_FLAGS_MASK to make sure that '~' is parsed as a unary operator by perf.
The part of the format that was problematic is now:
~(((u64) (~(~(((1UL) << 12)-1))))
Now, all the '~' are parsed as unary operators.
--- include/linux/pfn_t.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/pfn_t.h +1 -1
@@ -10,7 +10,7 @@* PFN_DEV - pfn is not covered by system memmap by default * PFN_MAP - pfn has a dynamic page mapping established by a device driver */ -#define PFN_FLAGS_MASK (((u64) ~PAGE_MASK) << (BITS_PER_LONG_LONG - PAGE_SHIFT)) +#define PFN_FLAGS_MASK (((u64) (~PAGE_MASK)) << (BITS_PER_LONG_LONG - PAGE_SHIFT))#define PFN_SG_CHAIN (1ULL << (BITS_PER_LONG_LONG - 1))#define PFN_SG_LAST (1ULL << (BITS_PER_LONG_LONG - 2))#define PFN_DEV (1ULL << (BITS_PER_LONG_LONG - 3))
Greg Kroah-Hartman
maintainerPATCH 89/100 tty: wipe buffer.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit c9a8e5fce009e3c601a43c49ea9dbcb25d1ffac5 upstream.
After we are done with the tty buffer, zero it out.
--- drivers/tty/tty_buffer.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/tty/tty_buffer.c +5 -1
@@ -467,11 +467,15 @@ receive_buf(struct tty_port *port, struc {unsigned char *p =char_buf_ptr (head, head->read);char *f =NULL ; +int n;if (~head->flags &TTYB_NORMAL ) f =flag_buf_ptr (head, head->read); -return port->client_ops->receive_buf (port, p, f, count); + n = port->client_ops->receive_buf (port, p, f, count); +if (n >0 ) +memset (p,0 , n); +return n; }/**
Greg Kroah-Hartman
maintainerPATCH 90/100 tty: wipe buffer if not echoing data
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
commit b97b3d9fb57860a60592859e332de7759fd54c2e upstream.
If we are not echoing the data to userspace or the console is in icanon mode, then perhaps it is a "secret" so we should wipe it once we are done with it.
This mirrors the logic that the audit code has.
--- drivers/tty/n_tty.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
drivers/tty/n_tty.c +17 -3
@@ -154,17 +154,28 @@ static inline unsigned char *echo_buf_adreturn &ldata->echo_buf[i & (N_TTY_BUF_SIZE -1 )]; } +/* If we are not echoing the data, perhaps this is a secret so erase it */ +static void zero_buffer (struct tty_struct *tty,u8 *buffer,int size) +{ +bool icanon = !!L_ICANON (tty); +bool no_echo = !L_ECHO (tty); + +if (icanon && no_echo) +memset (buffer,0x00 , size); +} +static int tty_copy_to_user (struct tty_struct *tty,void __user *to,size_t tail,size_t n) {struct n_tty_data *ldata = tty->disc_data;size_t size =N_TTY_BUF_SIZE - tail; -const void *from =read_buf_addr (ldata, tail); +void *from =read_buf_addr (ldata, tail);int uncopied;if (n > size) {tty_audit_add_data (tty, from, size); uncopied =copy_to_user (to, from, size); +zero_buffer (tty, from, size - uncopied);if (uncopied)return uncopied; to += size;
@@ -173,7 +184,9 @@ static int tty_copy_to_user(struct tty_s }tty_audit_add_data (tty, from, n); -return copy_to_user (to, from, n); + uncopied =copy_to_user (to, from, n); +zero_buffer (tty, from, n - uncopied); +return uncopied; }/**
@@ -1962,11 +1975,12 @@ static int copy_from_read_buf(struct tty n =min (head - ldata->read_tail,N_TTY_BUF_SIZE - tail); n =min (*nr, n);if (n) { -const unsigned char *from =read_buf_addr (ldata, tail); +unsigned char *from =read_buf_addr (ldata, tail); retval =copy_to_user (*b, from, n); n -= retval; is_eof = n ==1 && *from ==EOF_CHAR (tty);tty_audit_add_data (tty, from, n); +zero_buffer (tty, from, n);smp_store_release (&ldata->read_tail, ldata->read_tail + n);/* Turn single EOF into zero-length read */ if (L_EXTPROC(tty) && ldata->icanon && is_eof &&
Greg Kroah-Hartman
maintainerPATCH 91/100 usb: xhci: fix uninitialized completion when USB3 port got wrong status
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
commit 958c0bd86075d4ef1c936998deefe1947e539240 upstream.
Realtek USB3.0 Card Reader [0bda:0328] reports wrong port status on Cannon lake PCH USB3.1 xHCI [8086:a36d] after resume from S3, after clear port reset it works fine.
Since this device is registered on USB3 roothub at boot, when port status reports not superspeed, xhci_get_port_status will call an uninitialized completion in bus_state[0].
Kernel will hang because of NULL pointer.
Restrict the USB2 resume status check in USB2 roothub to fix hang issue.
--- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-ring.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-hub.c +1 -1
@@ -895,7 +895,7 @@ static u32 xhci_get_port_status(struct u status |=USB_PORT_STAT_SUSPEND ; }if ((raw_port_status &PORT_PLS_MASK ) ==XDEV_RESUME && - !DEV_SUPERSPEED_ANY (raw_port_status)) { + !DEV_SUPERSPEED_ANY (raw_port_status) && hcd->speed <HCD_USB3 ) {if ((raw_port_status &PORT_RESET ) || !(raw_port_status &PORT_PE ))return 0xffffffff ;
drivers/usb/host/xhci-ring.c +1 -1
@@ -1746,7 +1746,7 @@ static void handle_port_status(struct xh* RExit to a disconnect state). If so, let the the driver know it's * out of the RExit state. */ -if (!DEV_SUPERSPEED_ANY (portsc) && +if (!DEV_SUPERSPEED_ANY (portsc) && hcd->speed <HCD_USB3 &&test_and_clear_bit (faked_port_index, &bus_state->rexit_ports)) {complete (&bus_state->rexit_done[faked_port_index]);
Greg Kroah-Hartman
maintainerPATCH 92/100 namei: allow restricted O_CREAT of FIFOs and regular files
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Salvatore Mesoraca <[email protected]>
commit 30aba6656f61ed44cba445a3c0d38b296fa9e8f5 upstream.
Disallows open of FIFOs or regular files not owned by the user in world writable sticky directories, unless the owner is the same as that of the directory or the file is opened without the O_CREAT flag. The purpose is to make data spoofing attacks harder. This protection can be turned on and off separately for FIFOs and regular files via sysctl, just like the symlinks/hardlinks protection. This patch is based on Openwall's "HARDEN_FIFO" feature by Solar Designer.
This is a brief list of old vulnerabilities that could have been prevented by this feature, some of them even allow for privilege escalation:
CVE-2000-1134
CVE-2007-3852
CVE-2008-0525
CVE-2009-0416
CVE-2011-4834
CVE-2015-1838
CVE-2015-7442
CVE-2016-7489
This list is not meant to be complete. It's difficult to track down all vulnerabilities of this kind because they were often reported without any mention of this particular attack vector. In fact, before hardlinks/symlinks restrictions, fifos/regular files weren't the favorite vehicle to exploit them.
--- Documentation/sysctl/fs.txt | 36 +++++++++++++++++++++++++++++ fs/namei.c | 53 +++++++++++++++++++++++++++++++++++++++++--- include/linux/fs.h | 2 + kernel/sysctl.c | 18 ++++++++++++++ 4 files changed, 106 insertions(+), 3 deletions(-)
Documentation/sysctl/fs.txt +36 -0
@@ -34,7 +34,9 @@ Currently, these files are in /proc/sys/ - overflowgid - pipe-user-pages-hard - pipe-user-pages-soft +- protected_fifos - protected_hardlinks +- protected_regular - protected_symlinks - suid_dumpable - super-max
@@ -182,6 +184,24 @@ applied. ============================================================== +protected_fifos: + +The intent of this protection is to avoid unintentional writes to +an attacker-controlled FIFO, where a program expected to create a regular +file. + +When set to "0", writing to FIFOs is unrestricted. + +When set to "1" don't allow O_CREAT open on FIFOs that we don't own +in world writable sticky directories, unless they are owned by the +owner of the directory. + +When set to "2" it also applies to group writable sticky directories. + +This protection is based on the restrictions in Openwall. + +============================================================== + protected_hardlinks: A long-standing class of security issues is the hardlink-based
@@ -202,6 +222,22 @@ This protection is based on the restrict ============================================================== +protected_regular: + +This protection is similar to protected_fifos, but it +avoids writes to an attacker-controlled regular file, where a program +expected to create one. + +When set to "0", writing to regular files is unrestricted. + +When set to "1" don't allow O_CREAT open on regular files that we +don't own in world writable sticky directories, unless they are +owned by the owner of the directory. + +When set to "2" it also applies to group writable sticky directories. + +============================================================== + protected_symlinks: A long-standing class of security issues is the symlink-based
fs/namei.c +50 -3
71 lines not on this page · raw message
include/linux/fs.h +2 -0
@@ -72,6 +72,8 @@ extern struct inodes_stat_t inodes_stat;extern int leases_enable, lease_break_time;extern int sysctl_protected_symlinks;extern int sysctl_protected_hardlinks; +extern int sysctl_protected_fifos; +extern int sysctl_protected_regular;typedef __kernel_rwf_t rwf_t ;
kernel/sysctl.c +18 -0
@@ -1794,6 +1794,24 @@ static struct ctl_table fs_table[] = { .extra2 = &one, }, { + .procname = "protected_fifos", + .data = &sysctl_protected_fifos, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &two, + }, + { + .procname = "protected_regular", + .data = &sysctl_protected_regular, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &two, + }, + { .procname = "suid_dumpable", .data = &suid_dumpable, .maxlen = sizeof(int),
Greg Kroah-Hartman
maintainerPATCH 93/100 lan78xx: Read MAC address from DT if present
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
commit 760db29bdc97b73ff60b091315ad787b1deb5cf5 upstream.
There is a standard mechanism for locating and using a MAC address from the Device Tree. Use this facility in the lan78xx driver to support applications without programmed EEPROM or OTP. At the same time, regularise the handling of the different address sources.
--- drivers/net/usb/lan78xx.c | 42 ++++++++++++++++++++---------------------- 1 file changed, 20 insertions(+), 22 deletions(-)
drivers/net/usb/lan78xx.c +20 -22
@@ -37,6 +37,7 @@#include <linux/irqchip/chained_irq.h> #include <linux/microchipphy.h> #include <linux/phy.h> +#include <linux/of_net.h> #include "lan78xx.h" #define DRIVER_AUTHOR "WOOJUNG HUH <[email protected]>"
@@ -1645,34 +1646,31 @@ static void lan78xx_init_mac_address(str addr[5 ] = (addr_hi >>8 ) &0xFF ;if (!is_valid_ether_addr (addr)) { -/* reading mac address from EEPROM or OTP */ -if ((lan78xx_read_eeprom (dev,EEPROM_MAC_OFFSET ,ETH_ALEN , - addr) ==0 ) || - (lan78xx_read_otp (dev,EEPROM_MAC_OFFSET ,ETH_ALEN , - addr) ==0 )) { -if (is_valid_ether_addr (addr)) { -/* eeprom values are valid so use them */ -netif_dbg (dev, ifup, dev->net, -"MAC address read from EEPROM" ); - }else { -/* generate random MAC */ -random_ether_addr (addr); -netif_dbg (dev, ifup, dev->net, -"MAC address set to random addr" ); - } - - addr_lo = addr[0 ] | (addr[1 ] <<8 ) | - (addr[2 ] <<16 ) | (addr[3 ] <<24 ); - addr_hi = addr[4 ] | (addr[5 ] <<8 ); - - ret =lan78xx_write_reg (dev,RX_ADDRL , addr_lo); - ret =lan78xx_write_reg (dev,RX_ADDRH , addr_hi); +if (!eth_platform_get_mac_address (&dev->udev->dev, addr)) { +/* valid address present in Device Tree */ +netif_dbg (dev, ifup, dev->net, +"MAC address read from Device Tree" ); + }else if (((lan78xx_read_eeprom (dev,EEPROM_MAC_OFFSET , +ETH_ALEN , addr) ==0 ) || + (lan78xx_read_otp (dev,EEPROM_MAC_OFFSET , +ETH_ALEN , addr) ==0 )) && +is_valid_ether_addr (addr)) { +/* eeprom values are valid so use them */ +netif_dbg (dev, ifup, dev->net, +"MAC address read from EEPROM" ); }else {/* generate random MAC */ random_ether_addr (addr);netif_dbg (dev, ifup, dev->net,"MAC address set to random addr" ); } + + addr_lo = addr[0 ] | (addr[1 ] <<8 ) | + (addr[2 ] <<16 ) | (addr[3 ] <<24 ); + addr_hi = addr[4 ] | (addr[5 ] <<8 ); + + ret =lan78xx_write_reg (dev,RX_ADDRL , addr_lo); + ret =lan78xx_write_reg (dev,RX_ADDRH , addr_hi); } ret =lan78xx_write_reg (dev,MAF_LO (0 ), addr_lo);
Greg Kroah-Hartman
maintainerPATCH 94/100 s390/mm: Check for valid vma before zapping in gmap_discard
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janosch Frank <[email protected]>
commit 1843abd03250115af6cec0892683e70cf2297c25 upstream.
Userspace could have munmapped the area before doing unmapping from the gmap. This would leave us with a valid vmaddr, but an invalid vma from which we would try to zap memory.
Let's check before using the vma.
Message-Id: <[email protected]>
--- arch/s390/mm/gmap.c | 2 ++ 1 file changed, 2 insertions(+)
arch/s390/mm/gmap.c +2 -0
@@ -689,6 +689,8 @@ void gmap_discard(struct gmap *gmap, uns vmaddr |= gaddr & ~PMD_MASK ;/* Find vma in the parent mm */ vma =find_vma (gmap->mm, vmaddr); +if (!vma) +continue ; size =min (to - gaddr,PMD_SIZE - (gaddr & ~PMD_MASK ));zap_page_range (vma, vmaddr, size); }
Greg Kroah-Hartman
maintainerPATCH 95/100 rcu: Make need_resched() respond to urgent RCU-QS needs
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul E. McKenney <[email protected]>
commit 92aa39e9dc77481b90cbef25e547d66cab901496 upstream.
The per-CPU rcu_dynticks.rcu_urgent_qs variable communicates an urgent need for an RCU quiescent state from the force-quiescent-state processing within the grace-period kthread to context switches and to cond_resched(). Unfortunately, such urgent needs are not communicated to need_resched(), which is sometimes used to decide when to invoke cond_resched(), for but one example, within the KVM vcpu_run() function. As of v4.15, this can result in synchronize_sched() being delayed by up to ten seconds, which can be problematic, to say nothing of annoying.
This commit therefore checks rcu_dynticks.rcu_urgent_qs from within rcu_check_callbacks(), which is invoked from the scheduling-clock interrupt handler. If the current task is not an idle task and is not executing in usermode, a context switch is forced, and either way, the rcu_dynticks.rcu_urgent_qs variable is set to false. If the current task is an idle task, then RCU's dyntick-idle code will detect the quiescent state, so no further action is required. Similarly, if the task is executing in usermode, other code in rcu_check_callbacks() and its called functions will report the corresponding quiescent state.
--- kernel/rcu/tree.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/rcu/tree.c +9 -0
@@ -2772,6 +2772,15 @@ void rcu_check_callbacks(int user)rcu_bh_qs (); }rcu_preempt_check_callbacks (); +/* The load-acquire pairs with the store-release setting to true. */ +if (smp_load_acquire (this_cpu_ptr (&rcu_dynticks.rcu_urgent_qs))) { +/* Idle and userspace execution already are quiescent states. */ +if (!rcu_is_cpu_rrupt_from_idle () && !user) { +set_tsk_need_resched (current); +set_preempt_need_resched (); + } +__this_cpu_write (rcu_dynticks.rcu_urgent_qs, false); + }if (rcu_pending ())invoke_rcu_core ();if (user)
Greg Kroah-Hartman
maintainerPATCH 96/100 net: ieee802154: 6lowpan: fix frag reassembly
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
commit f18fa5de5ba7f1d6650951502bb96a6e4715a948 upstream.
This patch initialize stack variables which are used in frag_lowpan_compare_key to zero. In my case there are padding bytes in the structures ieee802154_addr as well in frag_lowpan_compare_key. Otherwise the key variable contains random bytes. The result is that a compare of two keys by memcmp works incorrect.
--- net/ieee802154/6lowpan/6lowpan_i.h | 4 ++-- net/ieee802154/6lowpan/reassembly.c | 14 +++++++------- 2 files changed, 9 insertions(+), 9 deletions(-)
net/ieee802154/6lowpan/6lowpan_i.h +2 -2
@@ -20,8 +20,8 @@ typedef unsigned __bitwise lowpan_rx_resstruct frag_lowpan_compare_key {u16 tag;u16 d_size; -const struct ieee802154_addr src; -const struct ieee802154_addr dst; +struct ieee802154_addr src; +struct ieee802154_addr dst; };/* Equivalent of ipv4 struct ipq
net/ieee802154/6lowpan/reassembly.c +7 -7
@@ -75,14 +75,14 @@ fq_find(struct net *net, const struct lo {struct netns_ieee802154_lowpan *ieee802154_lowpan =net_ieee802154_lowpan (net); -struct frag_lowpan_compare_key key = { - .tag = cb->d_tag, - .d_size = cb->d_size, - .src = *src, - .dst = *dst, - }; +struct frag_lowpan_compare_key key = {};struct inet_frag_queue *q; + key.tag = cb->d_tag; + key.d_size = cb->d_size; + key.src = *src; + key.dst = *dst; + q =inet_frag_find (&ieee802154_lowpan->frags, &key);if (!q)return NULL ;
@@ -372,7 +372,7 @@ int lowpan_frag_rcv(struct sk_buff *skb,struct lowpan_frag_queue *fq;struct net *net =dev_net (skb->dev);struct lowpan_802154_cb *cb =lowpan_802154_cb (skb); -struct ieee802154_hdr hdr; +struct ieee802154_hdr hdr = {};int err;if (ieee802154_hdr_peek_addrs (skb, &hdr) <0 )
Greg Kroah-Hartman
maintainerPATCH 97/100 ima: always measure and audit files in policy
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <[email protected]>
commit f3cc6b25dcc5616f0d5c720009b2ac66f97df2ff upstream.
All files matching a "measure" rule must be included in the IMA measurement list, even when the file hash cannot be calculated. Similarly, all files matching an "audit" rule must be audited, even when the file hash can not be calculated.
The file data hash field contained in the IMA measurement list template data will contain 0's instead of the actual file hash digest.
Note:
In general, adding, deleting or in anyway changing which files are included in the IMA measurement list is not a good idea, as it might result in not being able to unseal trusted keys sealed to a specific TPM PCR value. This patch not only adds file measurements that were not previously measured, but specifies that the file hash value for these files will be 0's.
As the IMA measurement list ordering is not consistent from one boot to the next, it is unlikely that anyone is sealing keys based on the IMA measurement list. Remote attestation servers should be able to process these new measurement records, but might complain about these unknown records.
--- security/integrity/ima/ima_api.c | 69 ++++++++++++++++++++++-------------- security/integrity/ima/ima_crypto.c | 10 +++++ security/integrity/ima/ima_main.c | 9 ++-- 3 files changed, 57 insertions(+), 31 deletions(-)
security/integrity/ima/ima_api.c +43 -26
@@ -199,42 +199,59 @@ int ima_collect_measurement(struct integstruct inode *inode =file_inode (file);const char *filename = file->f_path.dentry->d_name.name;int result =0 ; +int length; +void *tmpbuf; +u64 i_version;struct {struct ima_digest_data hdr;char digest[IMA_MAX_DIGEST_SIZE ]; } hash; -if (!(iint->flags &IMA_COLLECTED )) { -u64 i_version =file_inode (file)->i_version; +if (iint->flags &IMA_COLLECTED ) + goto out; -if (file->f_flags &O_DIRECT ) { - audit_cause ="failed(directio)" ; - result = -EACCES ; - goto out; - } - - hash.hdr.algo = algo; - - result = (!buf) ?ima_calc_file_hash (file, &hash.hdr) : -ima_calc_buffer_hash (buf, size, &hash.hdr); -if (!result) { -int length =sizeof (hash.hdr) + hash.hdr.length; -void *tmpbuf =krealloc (iint->ima_hash, length, -GFP_NOFS ); -if (tmpbuf) { - iint->ima_hash = tmpbuf; -memcpy (iint->ima_hash, &hash, length); - iint->version = i_version; - iint->flags |=IMA_COLLECTED ; - }else - result = -ENOMEM ; - } +/* +* Dectecting file change is based on i_version. On filesystems +* which do not support i_version, support is limited to an initial +* measurement/appraisal/audit. +*/ + i_version =file_inode (file)->i_version; + hash.hdr.algo = algo; + +/* Initialize hash digest to 0's in case of failure */ +memset (&hash.digest,0 ,sizeof (hash.digest)); + +if (buf) + result =ima_calc_buffer_hash (buf, size, &hash.hdr); +else + result =ima_calc_file_hash (file, &hash.hdr); + +if (result && result != -EBADF && result != -EINVAL ) + goto out; + + length =sizeof (hash.hdr) + hash.hdr.length; + tmpbuf =krealloc (iint->ima_hash, length,GFP_NOFS ); +if (!tmpbuf) { + result = -ENOMEM ; + goto out; } + + iint->ima_hash = tmpbuf; +memcpy (iint->ima_hash, &hash, length); + iint->version = i_version; + +/* Possibly temporary failure due to type of read (eg. O_DIRECT) */ +if (!result) + iint->flags |=IMA_COLLECTED ; out: -if (result) +if (result) { +if (file->f_flags &O_DIRECT ) + audit_cause ="failed(directio)" ; +integrity_audit_msg (AUDIT_INTEGRITY_DATA , inode, filename,"collect_data" , audit_cause, result,0 ); + }return result; }
@@ -278,7 +295,7 @@ void ima_store_measurement(struct integr } result =ima_store_template (entry, violation, inode, filename, pcr); -if (!result || result == -EEXIST ) { +if ((!result || result == -EEXIST ) && !(file->f_flags &O_DIRECT )) { iint->flags |=IMA_MEASURED ; iint->measured_pcrs |= (0x1 << pcr); }
security/integrity/ima/ima_crypto.c +10 -0
@@ -443,6 +443,16 @@ int ima_calc_file_hash(struct file *fileloff_t i_size;int rc; +/* +* For consistency, fail file's opened with the O_DIRECT flag on +* filesystems mounted with/without DAX option. +*/ +if (file->f_flags &O_DIRECT ) { + hash->length = hash_digest_size[ima_hash_algo]; + hash->algo = ima_hash_algo; +return -EINVAL ; + } + i_size =i_size_read (file_inode (file));if (ima_ahash_minsize && i_size >= ima_ahash_minsize) {
security/integrity/ima/ima_main.c +4 -5
@@ -242,11 +242,8 @@ static int process_measurement(struct fi hash_algo =ima_get_hash_algo (xattr_value, xattr_len); rc =ima_collect_measurement (iint, file, buf, size, hash_algo); -if (rc !=0 ) { -if (file->f_flags &O_DIRECT ) - rc = (iint->flags &IMA_PERMIT_DIRECTIO ) ?0 : -EACCES ; +if (rc !=0 && rc != -EBADF && rc != -EINVAL ) goto out_digsig; - }if (!pathbuf)/* ima_rdwr_violation possibly pre-fetched */ pathname =ima_d_path (&file->f_path, &pathbuf, filename);
@@ -254,12 +251,14 @@ static int process_measurement(struct fiif (action &IMA_MEASURE )ima_store_measurement (iint, file, pathname, xattr_value, xattr_len, pcr); -if (action &IMA_APPRAISE_SUBMASK ) +if (rc ==0 && (action &IMA_APPRAISE_SUBMASK )) rc =ima_appraise_measurement (func, iint, file, pathname, xattr_value, xattr_len, opened);if (action &IMA_AUDIT )ima_audit_measurement (iint, pathname); +if ((file->f_flags &O_DIRECT ) && (iint->flags &IMA_PERMIT_DIRECTIO )) + rc =0 ; out_digsig:if ((mask &MAY_WRITE ) && (iint->flags &IMA_DIGSIG ) && !(iint->flags &IMA_NEW_FILE ))
Greg Kroah-Hartman
maintainerPATCH 98/100 EVM: Add support for portable signature format
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Garrett <[email protected]>
commit 50b977481fce90aa5fbda55e330b9d722733e358 upstream.
The EVM signature includes the inode number and (optionally) the filesystem UUID, making it impractical to ship EVM signatures in packages. This patch adds a new portable format intended to allow distributions to include EVM signatures. It is identical to the existing format but hardcodes the inode and generation numbers to 0 and does not include the filesystem UUID even if the kernel is configured to do so.
Removing the inode means that the metadata and signature from one file could be copied to another file without invalidating it. This is avoided by ensuring that an IMA xattr is present during EVM validation.
Portable signatures are intended to be immutable - ie, they will never be transformed into HMACs.
Based on earlier work by Dmitry Kasatkin and Mikhail Kurinnoi.
--- include/linux/integrity.h | 1 security/integrity/evm/evm.h | 2 security/integrity/evm/evm_crypto.c | 75 +++++++++++++++++++++++++++++----- security/integrity/evm/evm_main.c | 29 ++++++++----- security/integrity/ima/ima_appraise.c | 4 + security/integrity/integrity.h | 2 6 files changed, 92 insertions(+), 21 deletions(-)
include/linux/integrity.h +1 -0
@@ -14,6 +14,7 @@enum integrity_status {INTEGRITY_PASS =0 , +INTEGRITY_PASS_IMMUTABLE ,INTEGRITY_FAIL ,INTEGRITY_NOLABEL ,INTEGRITY_NOXATTRS ,
security/integrity/evm/evm.h +1 -1
@@ -48,7 +48,7 @@ int evm_calc_hmac(struct dentry *dentry, size_t req_xattr_value_len, char *digest);int evm_calc_hash (struct dentry *dentry,const char *req_xattr_name,const char *req_xattr_value, -size_t req_xattr_value_len,char *digest); +size_t req_xattr_value_len,char type,char *digest);int evm_init_hmac (struct inode *inode,const struct xattr *xattr,char *hmac_val);int evm_init_secfs (void );
security/integrity/evm/evm_crypto.c +66 -9
144 lines not on this page · raw message
security/integrity/evm/evm_main.c +19 -10
@@ -31,7 +31,7 @@int evm_initialized;static char *integrity_status_msg[] = { -"pass" ,"fail" ,"no_label" ,"no_xattrs" ,"unknown" +"pass" ,"pass_immutable" ,"fail" ,"no_label" ,"no_xattrs" ,"unknown" };char *evm_hmac ="hmac(sha1)" ;char *evm_hash ="sha1" ;
@@ -120,7 +120,8 @@ static enum integrity_status evm_verify_enum integrity_status evm_status =INTEGRITY_PASS ;int rc, xattr_len; -if (iint && iint->evm_status ==INTEGRITY_PASS ) +if (iint && (iint->evm_status ==INTEGRITY_PASS || + iint->evm_status ==INTEGRITY_PASS_IMMUTABLE ))return iint->evm_status;/* if status is not PASS, try to check again - against -ENOMEM */
@@ -161,22 +162,26 @@ static enum integrity_status evm_verify_ rc = -EINVAL ;break ;case EVM_IMA_XATTR_DIGSIG : +case EVM_XATTR_PORTABLE_DIGSIG : rc =evm_calc_hash (dentry, xattr_name, xattr_value, - xattr_value_len, calc.digest); + xattr_value_len, xattr_data->type, + calc.digest);if (rc)break ; rc =integrity_digsig_verify (INTEGRITY_KEYRING_EVM , (const char *)xattr_data, xattr_len, calc.digest,sizeof (calc.digest));if (!rc) { -/* Replace RSA with HMAC if not mounted readonly and -* not immutable -*/ -if (!IS_RDONLY (d_backing_inode (dentry)) && - !IS_IMMUTABLE (d_backing_inode (dentry))) +if (xattr_data->type ==EVM_XATTR_PORTABLE_DIGSIG ) { +if (iint) + iint->flags |=EVM_IMMUTABLE_DIGSIG ; + evm_status =INTEGRITY_PASS_IMMUTABLE ; + }else if (!IS_RDONLY (d_backing_inode (dentry)) && + !IS_IMMUTABLE (d_backing_inode (dentry))) {evm_update_evmxattr (dentry, xattr_name, xattr_value, xattr_value_len); + } }break ;default :
@@ -277,7 +282,7 @@ static enum integrity_status evm_verify_* affect security.evm. An interesting side affect of writing posix xattr * acls is their modifying of the i_mode, which is included in security.evm. * For posix xattr acls only, permit security.evm, even if it currently -* doesn't exist, to be updated. +* doesn't exist, to be updated unless the EVM signature is immutable. */ static int evm_protect_xattr (struct dentry *dentry,const char *xattr_name,const void *xattr_value,size_t xattr_value_len)
@@ -345,7 +350,8 @@ int evm_inode_setxattr(struct dentry *deif (strcmp (xattr_name,XATTR_NAME_EVM ) ==0 ) {if (!xattr_value_len)return -EINVAL ; -if (xattr_data->type !=EVM_IMA_XATTR_DIGSIG ) +if (xattr_data->type !=EVM_IMA_XATTR_DIGSIG && + xattr_data->type !=EVM_XATTR_PORTABLE_DIGSIG )return -EPERM ; } return evm_protect_xattr(dentry, xattr_name, xattr_value,
@@ -422,6 +428,9 @@ void evm_inode_post_removexattr(struct d/** * evm_inode_setattr - prevent updating an invalid EVM extended attribute * @dentry: pointer to the affected dentry +* +* Permit update of file attributes when files have a valid EVM signature, +* except in the case of them having an immutable portable signature. */ int evm_inode_setattr (struct dentry *dentry,struct iattr *attr) {
security/integrity/ima/ima_appraise.c +3 -1
@@ -230,7 +230,9 @@ int ima_appraise_measurement(enum ima_ho } status =evm_verifyxattr (dentry,XATTR_NAME_IMA , xattr_value, rc, iint); -if ((status !=INTEGRITY_PASS ) && (status !=INTEGRITY_UNKNOWN )) { +if ((status !=INTEGRITY_PASS ) && + (status !=INTEGRITY_PASS_IMMUTABLE ) && + (status !=INTEGRITY_UNKNOWN )) {if ((status ==INTEGRITY_NOLABEL ) || (status ==INTEGRITY_NOXATTRS )) cause ="missing-HMAC" ;
security/integrity/integrity.h +2 -0
@@ -33,6 +33,7 @@#define IMA_DIGSIG_REQUIRED 0x02000000#define IMA_PERMIT_DIRECTIO 0x04000000#define IMA_NEW_FILE 0x08000000 +#define EVM_IMMUTABLE_DIGSIG 0x10000000#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_APPRAISE_SUBMASK)
@@ -58,6 +59,7 @@ enum evm_ima_xattr_type {EVM_XATTR_HMAC ,EVM_IMA_XATTR_DIGSIG ,IMA_XATTR_DIGEST_NG , +EVM_XATTR_PORTABLE_DIGSIG , IMA_XATTR_LAST };
Greg Kroah-Hartman
maintainerPATCH 99/100 ima: re-introduce own integrity cache lock
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kasatkin <[email protected]>
commit 0d73a55208e94fc9fb6deaeea61438cd3280d4c0 upstream.
Before IMA appraisal was introduced, IMA was using own integrity cache lock along with i_mutex. process_measurement and ima_file_free took the iint->mutex first and then the i_mutex, while setxattr, chmod and chown took the locks in reverse order. To resolve the potential deadlock, i_mutex was moved to protect entire IMA functionality and the redundant iint->mutex was eliminated.
Solution was based on the assumption that filesystem code does not take i_mutex further. But when file is opened with O_DIRECT flag, direct-io implementation takes i_mutex and produces deadlock. Furthermore, certain other filesystem operations, such as llseek, also take i_mutex.
More recently some filesystems have replaced their filesystem specific lock with the global i_rwsem to read a file. As a result, when IMA attempts to calculate the file hash, reading the file attempts to take the i_rwsem again.
To resolve O_DIRECT related deadlock problem, this patch re-introduces iint->mutex. But to eliminate the original chmod() related deadlock problem, this patch eliminates the requirement for chmod hooks to take the iint->mutex by introducing additional atomic iint->attr_flags to indicate calling of the hooks. The allowed locking order is to take the iint->mutex first and then the i_rwsem.
Original flags were cleared in chmod(), setxattr() or removwxattr() hooks and tested when file was closed or opened again. New atomic flags are set or cleared in those hooks and tested to clear iint->flags on close or on open.
Atomic flags are following:
* IMA_CHANGE_ATTR - indicates that chATTR() was called (chmod, chown, chgrp) and file attributes have changed. On file open, it causes IMA to clear iint->flags to re-evaluate policy and perform IMA functions again.
* IMA_CHANGE_XATTR - indicates that setxattr or removexattr was called and extended attributes have changed. On file open, it causes IMA to clear iint->flags IMA_DONE_MASK to re-appraise.
* IMA_UPDATE_XATTR - indicates that security.ima needs to be updated. It is cleared if file policy changes and no update is needed.
* IMA_DIGSIG - indicates that file security.ima has signature and file security.ima must not update to file has on file close.
* IMA_MUST_MEASURE - indicates the file is in the measurement policy.
Fixes: Commit 6552321831dc ("xfs: remove i_iolock and use i_rwsem in the VFS inode instead")
--- security/integrity/iint.c | 2 security/integrity/ima/ima_appraise.c | 27 ++++++------- security/integrity/ima/ima_main.c | 70 +++++++++++++++++++++++----------- security/integrity/integrity.h | 18 ++++++-- 4 files changed, 77 insertions(+), 40 deletions(-)
security/integrity/iint.c +2 -0
@@ -155,12 +155,14 @@ static void init_once(void *foo)memset (iint,0 ,sizeof (*iint)); iint->version =0 ; iint->flags =0UL ; + iint->atomic_flags =0 ; iint->ima_file_status =INTEGRITY_UNKNOWN ; iint->ima_mmap_status =INTEGRITY_UNKNOWN ; iint->ima_bprm_status =INTEGRITY_UNKNOWN ; iint->ima_read_status =INTEGRITY_UNKNOWN ; iint->evm_status =INTEGRITY_UNKNOWN ; iint->measured_pcrs =0 ; +mutex_init (&iint->mutex); }static int __init integrity_iintcache_init (void )
security/integrity/ima/ima_appraise.c +14 -13
@@ -251,6 +251,7 @@ int ima_appraise_measurement(enum ima_ho status =INTEGRITY_FAIL ;break ; } +clear_bit (IMA_DIGSIG , &iint->atomic_flags);if (xattr_len -sizeof (xattr_value->type) - hash_start >= iint->ima_hash->length)/* xattr length may be longer. md5 hash in previous
@@ -269,7 +270,7 @@ int ima_appraise_measurement(enum ima_ho status =INTEGRITY_PASS ;break ;case EVM_IMA_XATTR_DIGSIG : - iint->flags |=IMA_DIGSIG ; +set_bit (IMA_DIGSIG , &iint->atomic_flags); rc = integrity_digsig_verify(INTEGRITY_KEYRING_IMA, (const char *)xattr_value, rc, iint->ima_hash->digest,
@@ -320,7 +321,7 @@ void ima_update_xattr(struct integrity_iint rc =0 ;/* do not collect and update hash for digital signatures */ -if (iint->flags &IMA_DIGSIG ) +if (test_bit (IMA_DIGSIG , &iint->atomic_flags))return ;if (iint->ima_file_status !=INTEGRITY_PASS )
@@ -330,7 +331,9 @@ void ima_update_xattr(struct integrity_iif (rc <0 )return ; +inode_lock (file_inode (file));ima_fix_xattr (dentry, iint); +inode_unlock (file_inode (file)); }/**
@@ -353,16 +356,14 @@ void ima_inode_post_setattr(struct dentrreturn ; must_appraise =ima_must_appraise (inode,MAY_ACCESS ,POST_SETATTR ); +if (!must_appraise) +__vfs_removexattr (dentry,XATTR_NAME_IMA ); iint =integrity_iint_find (inode);if (iint) { - iint->flags &= ~(IMA_APPRAISE |IMA_APPRAISED | -IMA_APPRAISE_SUBMASK |IMA_APPRAISED_SUBMASK | -IMA_ACTION_RULE_FLAGS ); -if (must_appraise) - iint->flags |=IMA_APPRAISE ; +set_bit (IMA_CHANGE_ATTR , &iint->atomic_flags); +if (!must_appraise) +clear_bit (IMA_UPDATE_XATTR , &iint->atomic_flags); } -if (!must_appraise) -__vfs_removexattr (dentry,XATTR_NAME_IMA ); }/*
@@ -391,12 +392,12 @@ static void ima_reset_appraise_flags(str iint =integrity_iint_find (inode);if (!iint)return ; - - iint->flags &= ~IMA_DONE_MASK ; iint->measured_pcrs =0 ; +set_bit (IMA_CHANGE_XATTR , &iint->atomic_flags);if (digsig) - iint->flags |=IMA_DIGSIG ; -return ; +set_bit (IMA_DIGSIG , &iint->atomic_flags); +else +clear_bit (IMA_DIGSIG , &iint->atomic_flags); } int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name,
security/integrity/ima/ima_main.c +48 -22
143 lines not on this page · raw message
security/integrity/integrity.h +13 -5
@@ -29,11 +29,10 @@/* iint cache flags */ #define IMA_ACTION_FLAGS 0xff000000#define IMA_ACTION_RULE_FLAGS 0x06000000 -#define IMA_DIGSIG 0x01000000 -#define IMA_DIGSIG_REQUIRED 0x02000000 -#define IMA_PERMIT_DIRECTIO 0x04000000 -#define IMA_NEW_FILE 0x08000000 -#define EVM_IMMUTABLE_DIGSIG 0x10000000 +#define IMA_DIGSIG_REQUIRED 0x01000000 +#define IMA_PERMIT_DIRECTIO 0x02000000 +#define IMA_NEW_FILE 0x04000000 +#define EVM_IMMUTABLE_DIGSIG 0x08000000#define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ IMA_APPRAISE_SUBMASK)
@@ -54,6 +53,13 @@#define IMA_APPRAISED_SUBMASK (IMA_FILE_APPRAISED | IMA_MMAP_APPRAISED | \ IMA_BPRM_APPRAISED | IMA_READ_APPRAISED) +/* iint cache atomic_flags */ +#define IMA_CHANGE_XATTR 0 +#define IMA_UPDATE_XATTR 1 +#define IMA_CHANGE_ATTR 2 +#define IMA_DIGSIG 3 +#define IMA_MUST_MEASURE 4 +enum evm_ima_xattr_type {IMA_XATTR_DIGEST =0x01 ,EVM_XATTR_HMAC ,
@@ -102,10 +108,12 @@ struct signature_v2_hdr {/* integrity data associated with an inode */ struct integrity_iint_cache {struct rb_node rb_node;/* rooted in integrity_iint_tree */ +struct mutex mutex;/* protects: version, flags, digest */ struct inode *inode;/* back pointer to inode in question */ u64 version;/* track inode changes */ unsigned long flags;unsigned long measured_pcrs; +unsigned long atomic_flags;enum integrity_status ima_file_status:4 ;enum integrity_status ima_mmap_status:4 ;enum integrity_status ima_bprm_status:4 ;
Greg Kroah-Hartman
maintainerPATCH 100/100 ima: re-initialize iint->atomic_flags
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mimi Zohar <[email protected]>
commit e2598077dc6a26c9644393e5c21f22a90dbdccdb upstream.
Intermittently security.ima is not being written for new files. This patch re-initializes the new slab iint->atomic_flags field before freeing it.
--- security/integrity/iint.c | 1 + 1 file changed, 1 insertion(+)
security/integrity/iint.c +1 -0
@@ -74,6 +74,7 @@ static void iint_free(struct integrity_i iint->ima_hash =NULL ; iint->version =0 ; iint->flags =0UL ; + iint->atomic_flags =0UL ; iint->ima_file_status =INTEGRITY_UNKNOWN ; iint->ima_mmap_status =INTEGRITY_UNKNOWN ; iint->ima_bprm_status =INTEGRITY_UNKNOWN ;
stable-rc/linux-4.14.y boot: 121 boots: 0 failed, 117 passed with 3 offline, 1 conflict (v4.14.84-101-gfed8ae3e80b0)
stable-rc/linux-4.14.y boot: 121 boots: 0 failed, 117 passed with 3 offline, 1 conflict (v4.14.84-101-gfed8ae3e80b0)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.14.y/kernel/v4.14.84-101-gfed8ae3e80b0/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.14.y/kernel/v4.14.84-101-gfed8ae3e80b0/
Tree: stable-rc
Branch: linux-4.14.y
Git Describe: v4.14.84-101-gfed8ae3e80b0
Git Commit: fed8ae3e80b06a2e8f9c86798dec421d50054bab
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 66 unique boards, 24 SoC families, 14 builds out of 197
Boot Regressions Detected:
arm64:
defconfig:
meson-gxbb-p200:
lab-baylibre: new failure (last pass: v4.14.83-63-g0ece78cdc128)Offline Platforms:
arm:
multi_v7_defconfig:
stih410-b2120: 1 offline labarm64:
defconfig:
meson-gxl-s905d-p230: 1 offline lab
meson-gxl-s905x-p212: 1 offline labConflicting Boot Failure Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
arm64:
defconfig:
meson-gxbb-p200:
lab-baylibre: FAIL
lab-baylibre-seattle: PASS---
For more info write to <[email protected]>
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.85-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: ae0375de4a2b34514e4e7934342b476788d9e4f6
git describe: v4.14.84-100-gae0375de4a2b
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.84-100-gae0375de4a2b
No regressions (compared to build v4.14.84)
No fixes (compared to build v4.14.84)
Ran 21425 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-containers-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-cap_bounds-tests
* ltp-filecaps-tests
* ltp-timers-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
arm:allmodconfig, arm:exynos_defconfig
arch/arm/kernel/smp.c: In function 'secondary_biglittle_init':arch/arm/kernel/smp.c:117:19: error: implicit declaration of function 'lookup_processor'; did you mean 'lookup_resource'?
Also affects v4.19.5-111-gac4af649901b.
Guenter
Greg Kroah-Hartman
maintainerQuoted 10 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
Quoted 6 lines
arm:allmodconfig, arm:exynos_defconfig
arch/arm/kernel/smp.c: In function 'secondary_biglittle_init':arch/arm/kernel/smp.c:117:19: error: implicit declaration of function 'lookup_processor'; did you mean 'lookup_resource'?Also affects v4.19.5-111-gac4af649901b.
Thanks, I'm about to rip out a bunch of these arm patches as Russell says not to include them just yet. Let me do a -rc2 in a bit with them gone...
thanks,
greg k-h
Greg Kroah-Hartman
maintainerQuoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc1.gz
I have released a -rc2:
ttps://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc2.gz
to resolve some reported issues.
thanks,
greg k-h
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
Quoted 6 lines
Quoted 2 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc1.gzI have released a -rc2:
ttps://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.85-rc2.gzto resolve some reported issues.
Sorry this is late, but all tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
14 tests: 14 pass, 0 failLinux version: 4.14.85-rc2-gce3bc71
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.85 release. There are 100 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat Dec 1 14:00:29 UTC 2018. Anything received after that time might be too late.
For v4.14.84-96-gce3bc714816f:
Build results:
total: 175 pass: 175 fail: 0 Qemu test results: total: 322 pass: 322 fail: 0
Details are available at https://kerneltests.org/builders/.
Guenter