3.18.137-stable review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 3.18.137-stable review
This is the start of the stable review cycle for the 3.18.137 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:54 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.18.137-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-3.18.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 3.18.137-rc1
Gustavo A. R. Silva <[email protected]>
drm/radeon/evergreen_cs: fix missing break in switch statement
Sakari Ailus <[email protected]>
media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
Zhang, Jun <[email protected]>
rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Aditya Pakki <[email protected]>
md: Fix failed allocation of md_register_thread
Yihao Wu <[email protected]>
nfsd: fix wrong check in write_v4_end_grace()
NeilBrown <[email protected]>
nfsd: fix memory corruption caused by readdir
Gustavo A. R. Silva <[email protected]>
ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
Christophe Leroy <[email protected]>
powerpc/83xx: Also save/restore SPRG4-7 during suspend
Jordan Niethe <[email protected]>
powerpc/powernv: Make opal log only readable by root
Christophe Leroy <[email protected]>
powerpc/wii: properly disable use of BATs when requested.
Christophe Leroy <[email protected]>
powerpc/32: Clear on-stack exception marker upon exception return
zhangyi (F) <[email protected]>
jbd2: clear dirty flag when revoking a buffer from an older transaction
QiaoChong <[email protected]>
parport_pc: fix find_superio io compare code, should use equal test.
Zev Weiss <[email protected]>
kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
Roman Penyaev <[email protected]>
mm/vmalloc: fix size check for remap_vmalloc_range_partial()
Jan Kara <[email protected]>
ext2: Fix underflow in ext2_max_size()
Jan Kara <[email protected]>
ext4: fix crash during online resizing
Arnd Bergmann <[email protected]>
cpufreq: pxa2xx: remove incorrect __init annotation
Eric Biggers <[email protected]>
crypto: pcbc - remove bogus memcpy()s with src == dest
Filipe Manana <[email protected]>
Btrfs: fix corruption reading shared and compressed extents after hole punching
Finn Thain <[email protected]>
m68k: Add -ffreestanding to CFLAGS
Bart Van Assche <[email protected]>
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
Felipe Franciosi <[email protected]>
scsi: virtio_scsi: don't send sc payload with tmfs
Stuart Menefy <[email protected]>
regulator: s2mpa01: Fix step values for some LDOs
Krzysztof Kozlowski <[email protected]>
regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
Pavel Shilovsky <[email protected]>
CIFS: Fix read after write for files with read caching
Mao Wenan <[email protected]>
net: set static variable an initial value in atl2_probe()
Darrick J. Wong <[email protected]>
tmpfs: fix link accounting when a tmpfile is linked in
Vladimir Murzin <[email protected]>
arm64: Relax GIC version check during early boot
Alexey Khoroshilov <[email protected]>
net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
Florian Fainelli <[email protected]>
net: systemport: Fix reception of BPDUs
Anoob Soman <[email protected]>
scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
David Howells <[email protected]>
assoc_array: Fix shortcut creation
Gabriel Fernandez <[email protected]>
Input: st-keyscan - fix potential zalloc NULL dereference
Shubhrajyoti Datta <[email protected]>
i2c: cadence: Fix the hold bit setting
Dmitry Torokhov <[email protected]>
Input: matrix_keypad - use flush_delayed_work()
Stefan Haberland <[email protected]>
s390/dasd: fix using offset into zero size array error
Eric Biggers <[email protected]>
crypto: ahash - fix another early termination in hash walk
S.j. Wang <[email protected]>
ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
zhengbin <[email protected]>
9p/net: fix memory leak in p9_client_create
Xiao Ni <[email protected]>
It's wrong to add len to sector_nr in raid10 reshape twice
Takashi Sakamoto <[email protected]>
ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
Eric Dumazet <[email protected]>
gro_cells: make sure device is up in gro_cells_receive()
Eric Dumazet <[email protected]>
net/hsr: fix possible crash in add_timer()
Eric Dumazet <[email protected]>
vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
Al Viro <[email protected]>
missing barriers in some of unix_sock ->addr and ->path accesses
Kalash Nainwal <[email protected]>
net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
YueHaibing <[email protected]>
mdio_bus: Fix use-after-free on device_register fails
Eric Dumazet <[email protected]>
net/x25: fix a race in x25_bind()
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix qp mtt size calculation
Xin Long <[email protected]>
pptp: dst_release sk_dst_cache in pptp_sock_destruct
Eric Dumazet <[email protected]>
net/x25: reset state in x25_connect()
Eric Dumazet <[email protected]>
net/x25: fix use-after-free in x25_device_event()
Miaohe Lin <[email protected]>
net: sit: fix UBSAN Undefined behaviour in check_6rd
Mao Wenan <[email protected]>
net: hsr: fix memory leak in hsr_dev_finalize()
Eric Dumazet <[email protected]>
l2tp: fix infoleak in l2tp_ip6_recvmsg()
Gustavo A. R. Silva <[email protected]>
iscsi_ibft: Fix missing break in switch statement
Jason Gerecke <[email protected]>
Input: wacom_serial4 - add support for Wacom ArtPad II tablet
Jiri Olsa <[email protected]>
perf symbols: Filter out hidden symbols from labels
Julian Wiedmann <[email protected]>
s390/qeth: fix use-after-free in error path
Andy Shevchenko <[email protected]>
dmaengine: dmatest: Abort test in case of mapping error
Lubomir Rintel <[email protected]>
irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
Peng Hao <[email protected]>
ARM: pxa: ssp: unneeded to free devm_ allocated data
Ian Kent <[email protected]>
autofs: fix error return in autofs_fill_super()
Pan Bian <[email protected]>
autofs: drop dentry reference only when it is never used
Michal Hocko <[email protected]>
mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
Kairui Song <[email protected]>
x86/kexec: Don't setup EFI info if EFI runtime is not enabled
Ronnie Sahlberg <[email protected]>
cifs: fix computation for MAX_SMB2_HDR_SIZE
Sinan Kaya <[email protected]>
platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
Ming Lu <[email protected]>
scsi: libfc: free skb when receiving invalid flogi resp
Yao Liu <[email protected]>
nfs: Fix NULL pointer dereference of dev_name
Tomonori Sakita <[email protected]>
net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
Max Filippov <[email protected]>
xtensa: SMP: limit number of possible CPUs by NR_CPUS
Max Filippov <[email protected]>
xtensa: SMP: mark each possible CPU as present
Max Filippov <[email protected]>
xtensa: smp_lx200_defconfig: fix vectors clash
Max Filippov <[email protected]>
xtensa: SMP: fix secondary CPU initialization
Suravee Suthikulpanit <[email protected]>
iommu/amd: Fix IOMMU page flush when detach device from a domain
ZhangXiaoxu <[email protected]>
ipvs: Fix signed integer overflow when setsockopt timeout
Stephane Eranian <[email protected]>
perf tools: Handle TOPOLOGY headers with no CPU
Su Yanjun <[email protected]>
vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
Alistair Strachan <[email protected]>
media: uvcvideo: Fix 'type' check leading to overflow
Mike Kravetz <[email protected]>
hugetlbfs: fix races and page leaks during migration
Ido Schimmel <[email protected]>
ip6mr: Do not call __IP6_INC_STATS() from preemptible context
Paul Moore <[email protected]>
netlabel: fix out-of-bounds memory accesses
Rajasingh Thavamani <[email protected]>
net: phy: Micrel KSZ8061: link failure after cable connect
Nazarov Sergey <[email protected]>
net: avoid use IPCB in cipso_v4_error
Nazarov Sergey <[email protected]>
net: Add __icmp_send helper.
YueHaibing <[email protected]>
net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
Ido Schimmel <[email protected]>
team: Free BPF filter when unregistering netdev
Kai-Heng Feng <[email protected]>
sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
YueHaibing <[email protected]>
net-sysfs: Fix mem leak in netdev_register_kobject
Ivan Mironov <[email protected]>
USB: serial: cp210x: add ID for Ingenico 3070
Jann Horn <[email protected]>
mm: enforce min addr even if capable() in expand_downwards()
Jonathan Neuschäfer <[email protected]>
mmc: spi: Fix card detection during probe
Vitaly Kuznetsov <[email protected]>
KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
Chaitanya Tata <[email protected]>
cfg80211: extend range deviation for DMG
Balaji Pothunoori <[email protected]>
mac80211: don't initiate TDLS connection if station is not associated to AP
Thomas Falcon <[email protected]>
ibmveth: Do not process frames after calling napi_reschedule
Atsushi Nemoto <[email protected]>
net: altera_tse: fix connect_local_phy error path
Varun Prakash <[email protected]>
scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
Tomonori Sakita <[email protected]>
serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
Bob Copeland <[email protected]>
mac80211: fix miscounting of ttl-dropped frames
Silvio Cesare <[email protected]>
ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
Dan Carpenter <[email protected]>
usb: gadget: Potential NULL dereference on allocation error
Zeng Tao <[email protected]>
usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
Dan Carpenter <[email protected]>
ALSA: compress: prevent potential divide by zero bugs
Rander Wang <[email protected]>
ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
Kristian H. Kristensen <[email protected]>
drm/msm: Unblock writer if reader closes file
John Garry <[email protected]>
scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
Ilya Dryomov <[email protected]>
libceph: handle an empty authorize reply
Arad, Ronen <[email protected]>
netlink: Trim skb to alloc size to avoid MSG_TRUNC
Hangbin Liu <[email protected]>
sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
Cong Wang <[email protected]>
team: avoid complex list operations in team_nl_cmd_options_set()
Kal Conley <[email protected]>
net/packet: fix 4gb buffer limit due to overflow check
Eric Dumazet <[email protected]>
batman-adv: fix uninit-value in batadv_interface_tx()
Eric Biggers <[email protected]>
KEYS: always initialize keyring_index_key::desc_len
Eric Biggers <[email protected]>
KEYS: user: Align the payload buffer
Nathan Chancellor <[email protected]>
isdn: avm: Fix string plus integer warning from Clang
Kangjie Lu <[email protected]>
leds: lp5523: fix a missing check of return value of lp55xx_read
Colin Ian King <[email protected]>
atm: he: fix sign-extension overflow on large shift
Jia-Ju Bai <[email protected]>
isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
Thomas Bogendoerfer <[email protected]>
MIPS: jazz: fix 64bit build
Logan Gunthorpe <[email protected]>
scsi: isci: initialize shost fully before calling scsi_add_host()
YueHaibing <[email protected]>
scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
Alban Bedel <[email protected]>
MIPS: ath79: Enable OF serial ports in the default config
Kangjie Lu <[email protected]>
mfd: mc13xxx: Fix a missing check of a register-read failure
Charles Keepax <[email protected]>
mfd: wm5110: Add missing ASRC rate register
Dan Carpenter <[email protected]>
mfd: ab8500-core: Return zero in get_register_interruptible()
Nathan Chancellor <[email protected]>
mfd: db8500-prcmu: Fix some section annotations
Nathan Chancellor <[email protected]>
mfd: twl-core: Fix section annotations on {,un}protect_pm_master
Vignesh R <[email protected]>
mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
Eric Biggers <[email protected]>
KEYS: allow reaching the keys quotas exactly
Ralph Campbell <[email protected]>
numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
Yan, Zheng <[email protected]>
ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
-------------
Diffstat:
Makefile | 4 +- arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 ++-- arch/arm/plat-pxa/ssp.c | 3 -- arch/arm64/kernel/head.S | 3 +- arch/m68k/Makefile | 5 ++- arch/mips/configs/ath79_defconfig | 1 + arch/mips/jazz/jazzdma.c | 5 ++- arch/powerpc/kernel/entry_32.S | 9 ++++ arch/powerpc/platforms/83xx/suspend-asm.S | 34 ++++++++++++--- arch/powerpc/platforms/embedded6xx/wii.c | 4 ++ arch/powerpc/platforms/powernv/opal-msglog.c | 2 +- arch/x86/kernel/kexec-bzimage64.c | 3 ++ arch/x86/kvm/svm.c | 8 ++++ arch/xtensa/configs/smp_lx200_defconfig | 1 + arch/xtensa/kernel/head.S | 5 ++- arch/xtensa/kernel/smp.c | 41 ++++++++++++------ crypto/ahash.c | 14 +++--- crypto/pcbc.c | 14 ++---- drivers/atm/he.c | 2 +- drivers/cpufreq/pxa2xx-cpufreq.c | 4 +- drivers/dma/dmatest.c | 28 ++++++------ drivers/firmware/iscsi_ibft.c | 1 + drivers/gpu/drm/msm/msm_rd.c | 7 ++- drivers/gpu/drm/radeon/evergreen_cs.c | 1 + drivers/i2c/busses/i2c-cadence.c | 9 +++- drivers/input/keyboard/matrix_keypad.c | 2 +- drivers/input/keyboard/st-keyscan.c | 4 +- drivers/input/tablet/wacom_serial4.c | 2 + drivers/iommu/amd_iommu.c | 15 +++++-- drivers/irqchip/irq-mmp.c | 6 ++- drivers/isdn/hardware/avm/b1.c | 2 +- drivers/isdn/i4l/isdn_tty.c | 6 ++- drivers/leds/leds-lp5523.c | 4 +- drivers/md/raid10.c | 3 +- drivers/md/raid5.c | 2 + drivers/media/usb/uvc/uvc_driver.c | 14 ++++-- drivers/media/usb/uvc/uvc_video.c | 8 ++++ drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/db8500-prcmu.c | 4 +- drivers/mfd/mc13xxx-core.c | 4 +- drivers/mfd/ti_am335x_tscadc.c | 5 ++- drivers/mfd/twl-core.c | 4 +- drivers/mfd/wm5110-tables.c | 2 + drivers/mmc/host/mmc_spi.c | 1 + drivers/net/ethernet/altera/altera_msgdma.c | 3 +- drivers/net/ethernet/altera/altera_tse_main.c | 4 +- drivers/net/ethernet/atheros/atlx/atl2.c | 4 +- drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++ drivers/net/ethernet/ibm/ibmveth.c | 2 - drivers/net/ethernet/marvell/mv643xx_eth.c | 7 ++- drivers/net/ethernet/marvell/sky2.c | 24 ++++++++++- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +-- drivers/net/phy/mdio_bus.c | 1 - drivers/net/phy/micrel.c | 14 +++++- drivers/net/ppp/pptp.c | 1 + drivers/net/team/team.c | 27 +++--------- drivers/net/team/team_mode_loadbalance.c | 15 +++++++ drivers/net/vxlan.c | 10 +++++ drivers/parport/parport_pc.c | 2 +- drivers/platform/x86/Kconfig | 1 + drivers/regulator/s2mpa01.c | 10 ++--- drivers/regulator/s2mps11.c | 6 +-- drivers/s390/block/dasd_eckd.c | 8 ++++ drivers/s390/net/qeth_core_main.c | 15 +++---- drivers/scsi/csiostor/csio_attr.c | 2 +- drivers/scsi/isci/init.c | 14 +++--- drivers/scsi/libfc/fc_lport.c | 6 +-- drivers/scsi/libiscsi.c | 6 +++ drivers/scsi/libsas/sas_expander.c | 2 + drivers/scsi/qla4xxx/ql4_os.c | 2 + drivers/scsi/virtio_scsi.c | 2 - drivers/target/iscsi/iscsi_target.c | 4 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/usb/dwc3/gadget.c | 1 + drivers/usb/gadget/function/f_sourcesink.c | 2 +- drivers/usb/serial/cp210x.c | 1 + fs/autofs4/expire.c | 3 +- fs/autofs4/inode.c | 4 +- fs/btrfs/extent_io.c | 4 +- fs/ceph/snap.c | 3 +- fs/cifs/file.c | 12 +++--- fs/cifs/smb2pdu.h | 4 +- fs/ext2/super.c | 39 +++++++++++------ fs/ext4/resize.c | 3 +- fs/hugetlbfs/inode.c | 12 ++++++ fs/jbd2/transaction.c | 17 +++++--- fs/nfs/super.c | 5 +++ fs/nfsd/nfs3proc.c | 16 ++++++- fs/nfsd/nfs3xdr.c | 1 + fs/nfsd/nfsctl.c | 2 +- include/keys/user-type.h | 2 +- include/net/gro_cells.h | 12 +++++- include/net/icmp.h | 9 +++- include/net/ip.h | 2 + kernel/rcu/tree.c | 20 ++++++--- kernel/sysctl.c | 11 ++++- lib/assoc_array.c | 8 ++-- mm/hugetlb.c | 14 +++++- mm/memory_hotplug.c | 3 +- mm/mempolicy.c | 6 +-- mm/migrate.c | 11 +++++ mm/mmap.c | 7 ++- mm/shmem.c | 10 +++-- mm/vmalloc.c | 2 +- net/9p/client.c | 2 +- net/batman-adv/soft-interface.c | 2 + net/ceph/messenger.c | 12 ++++-- net/core/net-sysfs.c | 3 ++ net/hsr/hsr_device.c | 18 ++++---- net/hsr/hsr_framereg.c | 12 ++++++ net/hsr/hsr_framereg.h | 1 + net/ipv4/cipso_ipv4.c | 23 ++++++++-- net/ipv4/icmp.c | 7 +-- net/ipv4/ip_options.c | 22 +++++++--- net/ipv4/ip_vti.c | 50 ++++++++++++++++++++++ net/ipv6/ip6mr.c | 8 ++-- net/ipv6/route.c | 2 +- net/ipv6/sit.c | 7 +-- net/l2tp/l2tp_ip6.c | 4 +- net/mac80211/cfg.c | 4 ++ net/mac80211/rx.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++ net/netlink/af_netlink.c | 34 +++++++++------ net/nfc/llcp_commands.c | 20 +++++++++ net/nfc/llcp_core.c | 24 +++++++++-- net/packet/af_packet.c | 2 +- net/unix/af_unix.c | 48 +++++++++++++-------- net/unix/diag.c | 3 +- net/wireless/reg.c | 4 +- net/x25/af_x25.c | 20 ++++++--- security/keys/key.c | 4 +- security/keys/keyring.c | 4 +- security/keys/proc.c | 3 +- security/keys/request_key.c | 1 + security/keys/request_key_auth.c | 2 +- security/lsm_audit.c | 10 +++-- sound/core/compress_offload.c | 3 +- sound/firewire/bebob/bebob.c | 14 +++++- sound/soc/fsl/fsl_esai.c | 7 +-- sound/soc/fsl/imx-audmux.c | 24 +++++------ sound/soc/intel/broadwell.c | 2 +- sound/soc/intel/haswell.c | 2 +- tools/perf/util/cpumap.c | 11 ++++- tools/perf/util/symbol-elf.c | 9 +++- 144 files changed, 850 insertions(+), 350 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/134 ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan, Zheng <[email protected]>
commit 04242ff3ac0abbaa4362f97781dac268e6c3541a upstream.
Otherwise, mdsc->snap_flush_list may get corrupted.
--- fs/ceph/snap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ceph/snap.c +2 -1
@@ -566,7 +566,8 @@ int __ceph_finish_cap_snap(struct ceph_i capsnap->size);spin_lock (&mdsc->snap_flush_lock); -list_add_tail (&ci->i_snap_flush_item, &mdsc->snap_flush_list); +if (list_empty (&ci->i_snap_flush_item)) +list_add_tail (&ci->i_snap_flush_item, &mdsc->snap_flush_list);spin_unlock (&mdsc->snap_flush_lock);return 1 ;/* caller may want to ceph_flush_snaps */ }
Greg Kroah-Hartman
maintainerPATCH 2/134 numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Campbell <[email protected]>
commit 050c17f239fd53adb55aa768d4f41bc76c0fe045 upstream.
The system call, get_mempolicy() [1], passes an unsigned long *nodemask pointer and an unsigned long maxnode argument which specifies the length of the user's nodemask array in bits (which is rounded up). The manual page says that if the maxnode value is too small, get_mempolicy will return EINVAL but there is no system call to return this minimum value. To determine this value, some programs search /proc/<pid>/status for a line starting with "Mems_allowed:" and use the number of digits in the mask to determine the minimum value. A recent change to the way this line is formatted [2] causes these programs to compute a value less than MAX_NUMNODES so get_mempolicy() returns EINVAL.
Change get_mempolicy(), the older compat version of get_mempolicy(), and the copy_nodes_to_user() function to use nr_node_ids instead of MAX_NUMNODES, thus preserving the defacto method of computing the minimum size for the nodemask array and the maxnode argument.
[1] http://man7.org/linux/man-pages/man2/get_mempolicy.2.html
[2] https://lore.kernel.org/lkml/[email protected]
--- mm/mempolicy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/mempolicy.c +3 -3
@@ -1349,7 +1349,7 @@ static int copy_nodes_to_user(unsigned l nodemask_t *nodes) {unsigned long copy =ALIGN (maxnode-1 ,64 ) /8 ; -const int nbytes =BITS_TO_LONGS (MAX_NUMNODES ) *sizeof (long ); +unsigned int nbytes =BITS_TO_LONGS (nr_node_ids) *sizeof (long );if (copy > nbytes) {if (copy >PAGE_SIZE )
@@ -1510,7 +1510,7 @@ SYSCALL_DEFINE5(get_mempolicy, int __useint uninitialized_var (pval );nodemask_t nodes; -if (nmask !=NULL && maxnode <MAX_NUMNODES ) +if (nmask !=NULL && maxnode < nr_node_ids)return -EINVAL ; err =do_get_mempolicy (&pval, &nodes, addr, flags);
@@ -1539,7 +1539,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, inunsigned long nr_bits, alloc_size;DECLARE_BITMAP (bm,MAX_NUMNODES ); - nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES); + nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids); alloc_size =ALIGN (nr_bits,BITS_PER_LONG ) /8 ;if (nmask)
Greg Kroah-Hartman
maintainerPATCH 3/134 KEYS: allow reaching the keys quotas exactly
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit a08bf91ce28ed3ae7b6fef35d843fef8dc8c2cd9 upstream.
If the sysctl 'kernel.keys.maxkeys' is set to some number n, then actually users can only add up to 'n - 1' keys. Likewise for 'kernel.keys.maxbytes' and the root_* versions of these sysctls. But these sysctls are apparently supposed to be *maximums*, as per their names and all documentation I could find -- the keyrings(7) man page, Documentation/security/keys/core.rst, and all the mentions of EDQUOT meaning that the key quota was *exceeded* (as opposed to reached).
Thus, fix the code to allow reaching the quotas exactly.
--- security/keys/key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/keys/key.c +2 -2
@@ -260,8 +260,8 @@ struct key *key_alloc(struct key_type *tspin_lock (&user->lock);if (!(flags &KEY_ALLOC_QUOTA_OVERRUN )) { -if (user->qnkeys +1 >= maxkeys || - user->qnbytes + quotalen >= maxbytes || +if (user->qnkeys +1 > maxkeys || + user->qnbytes + quotalen > maxbytes || user->qnbytes + quotalen < user->qnbytes) goto no_quota; }
Greg Kroah-Hartman
maintainerPATCH 4/134 mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ]
Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that different instances are uniquely identified. This is required in order to support registering of multiple instances of same ti_am335x_tscadc IP.
--- drivers/mfd/ti_am335x_tscadc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mfd/ti_am335x_tscadc.c +3 -2
@@ -282,8 +282,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) cell->pdata_size =sizeof (tscadc); } - err =mfd_add_devices (&pdev->dev, pdev->id, tscadc->cells, - tscadc->used_cells,NULL ,0 ,NULL ); + err =mfd_add_devices (&pdev->dev,PLATFORM_DEVID_AUTO , + tscadc->cells, tscadc->used_cells,NULL , +0 ,NULL );if (err <0 ) goto err_disable_clk;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 5/134 mfd: twl-core: Fix section annotations on {,un}protect_pm_master
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
When building the kernel with Clang, the following section mismatch warning appears:
WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from the function twl_probe() to the function .init.text:unprotect_pm_master()
The function twl_probe() references
the function __init unprotect_pm_master().
This is often because twl_probe lacks a __init
annotation or the annotation of unprotect_pm_master is wrong.
Remove the __init annotation on the *protect_pm_master functions so there is no more mismatch.
--- drivers/mfd/twl-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/twl-core.c +2 -2
@@ -983,7 +983,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,* letting it generate the right frequencies for USB, MADC, and * other purposes. */ -static inline int __init protect_pm_master (void ) +static inline int protect_pm_master (void ) {int e =0 ;
@@ -992,7 +992,7 @@ static inline int __init protect_pm_master(void)return e; } -static inline int __init unprotect_pm_master (void ) +static inline int unprotect_pm_master (void ) {int e =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 6/134 mfd: db8500-prcmu: Fix some section annotations
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
When building the kernel with Clang, the following section mismatch warnings appear:
WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:init_prcm_registers()
The function db8500_prcmu_probe() references
the function __init init_prcm_registers().
This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of init_prcm_registers is wrong.
WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:fw_project_name()
The function db8500_prcmu_probe() references
the function __init fw_project_name().
This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of fw_project_name is wrong.
db8500_prcmu_probe should not be marked as __init so remove the __init annotation from fw_project_name and init_prcm_registers.
--- drivers/mfd/db8500-prcmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/db8500-prcmu.c +2 -2
@@ -2616,7 +2616,7 @@ static struct irq_chip prcmu_irq_chip = { .irq_unmask = prcmu_irq_unmask, }; -static __init char *fw_project_name (u32 project) +static char *fw_project_name (u32 project) {switch (project) {case PRCMU_FW_PROJECT_U8500 :
@@ -2765,7 +2765,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)INIT_WORK (&mb0_transfer.mask_work, prcmu_mask_work); } -static void __init init_prcm_registers (void ) +static void init_prcm_registers (void ) {u32 val;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 7/134 mfd: ab8500-core: Return zero in get_register_interruptible()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
This function is supposed to return zero on success or negative error codes on error. Unfortunately, there is a bug so it sometimes returns non-zero, positive numbers on success.
I noticed this bug during review and I can't test it. It does appear that the return is sometimes propogated back to _regmap_read() where all non-zero returns are treated as failure so this may affect run time.
--- drivers/mfd/ab8500-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/ab8500-core.c +1 -1
@@ -259,7 +259,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,mutex_unlock (&ab8500->lock);dev_vdbg (ab8500->dev,"rd: addr %#x => data %#x\n" , addr, ret); -return ret; +return (ret <0 ) ? ret :0 ; } static int ab8500_get_register(struct device *dev, u8 bank,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 8/134 mfd: wm5110: Add missing ASRC rate register
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
--- drivers/mfd/wm5110-tables.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/wm5110-tables.c +2 -0
@@ -1617,6 +1617,7 @@ static const struct reg_default wm5110_reg_default[] = { { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ + { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
@@ -2684,6 +2685,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)case ARIZONA_ASRC_ENABLE :case ARIZONA_ASRC_STATUS :case ARIZONA_ASRC_RATE1 : +case ARIZONA_ASRC_RATE2 :case ARIZONA_ISRC_1_CTRL_1 :case ARIZONA_ISRC_1_CTRL_2 :case ARIZONA_ISRC_1_CTRL_3 :
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 9/134 mfd: mc13xxx: Fix a missing check of a register-read failure
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will contain random value. Further execution uses "old_adc0" even when mc13xxx_reg_read() fails.
The fix checks the return value of mc13xxx_reg_read(), and exits the execution when it fails.
--- drivers/mfd/mc13xxx-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mfd/mc13xxx-core.c +3 -1
@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, mc13xxx->adcflags |=MC13XXX_ADC_WORKING ; -mc13xxx_reg_read (mc13xxx,MC13XXX_ADC0 , &old_adc0); + ret =mc13xxx_reg_read (mc13xxx,MC13XXX_ADC0 , &old_adc0); +if (ret) + goto out; adc0 =MC13XXX_ADC0_ADINC1 |MC13XXX_ADC0_ADINC2 ; adc1 =MC13XXX_ADC1_ADEN |MC13XXX_ADC1_ADTRIGIGN |MC13XXX_ADC1_ASC ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 10/134 MIPS: ath79: Enable OF serial ports in the default config
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF boards, enable it in the default config to get a working setup out of the box.
--- arch/mips/configs/ath79_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/configs/ath79_defconfig +1 -0
@@ -74,6 +74,7 @@ CONFIG_SERIAL_8250_CONSOLE=y # CONFIG_SERIAL_8250_PCI is not set CONFIG_SERIAL_8250_NR_UARTS=1 CONFIG_SERIAL_8250_RUNTIME_UARTS=1 +CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_AR933X=y CONFIG_SERIAL_AR933X_CONSOLE=y # CONFIG_HW_RANDOM is not set
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 11/134 scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
The return code should be check while qla4xxx_copy_from_fwddb_param fails.
--- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/qla4xxx/ql4_os.c +2 -0
@@ -7251,6 +7251,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, rc =qla4xxx_copy_from_fwddb_param (fnode_sess, fnode_conn, fw_ddb_entry); +if (rc) + goto free_sess;ql4_printk (KERN_INFO , ha,"%s: sysfs entry %s created\n" , __func__, fnode_sess->dev.kobj.name);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 12/134 scsi: isci: initialize shost fully before calling scsi_add_host()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the command size to allocate based on the prot_capabilities. In the isci driver, scsi_host_set_prot() is called after scsi_add_host() so the command size gets calculated to be smaller than it needs to be. Eventually, scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it was sized correctly and a buffer overrun may occur.
However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line size, the mistake can go unnoticed.
The bug was noticed after the struct request size was reduced by commit 9d037ad707ed ("block: remove req->timeout_list")
Which likely reduced the allocated space for the request by an entire cache line, enough that the overflow could be hit and it caused a panic, on boot, at:
RIP: 0010:t10_pi_complete+0x77/0x1c0
Call Trace:
<IRQ>
sd_done+0xf5/0x340
scsi_finish_command+0xc3/0x120
blk_done_softirq+0x83/0xb0
__do_softirq+0xa1/0x2e6
irq_exit+0xbc/0xd0
call_function_single_interrupt+0xf/0x20
</IRQ>sd_done() would call scsi_prot_sg_count() which reads the number of entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of the allocated space it reads a garbage number and erroneously calls t10_pi_complete().
To prevent this, the calls to scsi_host_set_prot() are moved into isci_host_alloc() before the call to scsi_add_host(). Out of caution, also move the similar call to scsi_host_set_guard().
--- drivers/scsi/isci/init.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/scsi/isci/init.c +7 -7
@@ -598,6 +598,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) shost->max_lun = ~0 ; shost->max_cmd_len =MAX_COMMAND_SIZE ; +/* turn on DIF support */ +scsi_host_set_prot (shost, +SHOST_DIF_TYPE1_PROTECTION | +SHOST_DIF_TYPE2_PROTECTION | +SHOST_DIF_TYPE3_PROTECTION ); +scsi_host_set_guard (shost,SHOST_DIX_GUARD_CRC ); + err =scsi_add_host (shost, &pdev->dev);if (err) goto err_shost;
@@ -685,13 +692,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err_host_alloc; } pci_info->hosts[i] = h; - -/* turn on DIF support */ -scsi_host_set_prot (to_shost (h), -SHOST_DIF_TYPE1_PROTECTION | -SHOST_DIF_TYPE2_PROTECTION | -SHOST_DIF_TYPE3_PROTECTION ); -scsi_host_set_guard (to_shost (h),SHOST_DIX_GUARD_CRC ); } err =isci_setup_interrupts (pdev);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 13/134 MIPS: jazz: fix 64bit build
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
64bit JAZZ builds failed with
linux-next/arch/mips/jazz/jazzdma.c: In function vdma_init:
/linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
[-Werror=implicit-function-declaration]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^~~~~~~~~
CKSEG1ADDR
/linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
integer of different size [-Werror=int-to-pointer-cast]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^
In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
from /linux-next/include/linux/compiler.h:248,
from /linux-next/include/linux/kernel.h:10,
from /linux-next/arch/mips/jazz/jazzdma.c:11:
/linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
pointer to integer of different size [-Werror=pointer-to-int-cast]
#define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
^
/linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
expansion of macro `_ACAST32_`
#define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
^~~~~~~~~
/linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
macro `CPHYSADDR`
r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup fixes this.
--- arch/mips/jazz/jazzdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/mips/jazz/jazzdma.c +3 -2
@@ -71,14 +71,15 @@ static int __init vdma_init(void) get_order(VDMA_PGTBL_SIZE));BUG_ON (!pgtbl);dma_cache_wback_inv ((unsigned long )pgtbl,VDMA_PGTBL_SIZE ); - pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR (pgtbl); + pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR ((unsigned long )pgtbl);/* * Clear the R4030 translation table */ vdma_pgtbl_init (); -r4030_write_reg32 (JAZZ_R4030_TRSTBL_BASE ,CPHYSADDR (pgtbl)); +r4030_write_reg32 (JAZZ_R4030_TRSTBL_BASE , +CPHYSADDR ((unsigned long )pgtbl));r4030_write_reg32 (JAZZ_R4030_TRSTBL_LIM ,VDMA_PGTBL_SIZE );r4030_write_reg32 (JAZZ_R4030_TRSTBL_INV ,0 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 14/134 isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be concurrently executed.
isdn_tty_tiocmset
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);isdn_tty_set_termios
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);Thus, some concurrency double-free bugs may occur.
These possible bugs are found by a static tool written by myself and my manual code review.
To fix these possible bugs, the mutex lock "modem_info_mutex" used in isdn_tty_tiocmset() is added in isdn_tty_set_termios().
--- drivers/isdn/i4l/isdn_tty.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/isdn/i4l/isdn_tty.c +5 -1
@@ -1459,15 +1459,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) {modem_info *info = (modem_info *) tty->driver_data; +mutex_lock (&modem_info_mutex);if (!old_termios)isdn_tty_change_speed (info);else {if (tty->termios.c_cflag == old_termios->c_cflag && tty->termios.c_ispeed == old_termios->c_ispeed && - tty->termios.c_ospeed == old_termios->c_ospeed) + tty->termios.c_ospeed == old_termios->c_ospeed) { +mutex_unlock (&modem_info_mutex);return ; + }isdn_tty_change_speed (info); } +mutex_unlock (&modem_info_mutex); }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 15/134 atm: he: fix sign-extension overflow on large shift
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
Shifting the 1 by exp by an int can lead to sign-extension overlow when exp is 31 since 1 is an signed int and sign-extending this result to an unsigned long long will set the upper 32 bits. Fix this by shifting an unsigned long.
Detected by cppcheck:
(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
--- drivers/atm/he.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/atm/he.c +1 -1
@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)instead of '/ 512', use '>> 9' to prevent a call to divdu3 on x86 platforms */ - rate_cps = (unsigned long long ) (1 << exp) * (man +512 ) >>9 ; + rate_cps = (unsigned long long ) (1UL << exp) * (man +512 ) >>9 ;if (rate_cps <10 ) rate_cps =10 ;/* 2.2.1 minimum payload rate is 10 cps */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 16/134 leds: lp5523: fix a missing check of return value of lp55xx_read
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
When lp55xx_read() fails, "status" is an uninitialized variable and thus may contain random value; using it leads to undefined behaviors.
The fix inserts a check for the return value of lp55xx_read: if it fails, returns with its error code.
--- drivers/leds/leds-lp5523.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/leds/leds-lp5523.c +3 -1
@@ -313,7 +313,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)/* Let the programs run for couple of ms and check the engine status */ usleep_range (3000 ,6000 ); -lp55xx_read (chip,LP5523_REG_STATUS , &status); + ret =lp55xx_read (chip,LP5523_REG_STATUS , &status); +if (ret) +return ret; status &=LP5523_ENG_STATUS_MASK ;if (status !=LP5523_ENG_STATUS_MASK ) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 17/134 isdn: avm: Fix string plus integer warning from Clang
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
A recent commit in Clang expanded the -Wstring-plus-int warning, showing some odd behavior in this file.
drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
cinfo->version[j] = "\0\0" + 1;
~~~~~~~^~~
drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
cinfo->version[j] = "\0\0" + 1;
^
& [ ]1 warning generated.
This is equivalent to just "\0". Nick pointed out that it is smarter to use "" instead of "\0" because "" is used elsewhere in the kernel and can be deduplicated at the linking stage.
--- drivers/isdn/hardware/avm/b1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/isdn/hardware/avm/b1.c +1 -1
@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfint i, j;for (j =0 ; j <AVM_MAXVERSION ; j++) - cinfo->version[j] ="\0\0" +1 ; + cinfo->version[j] ="" ;for (i =0 , j =0 ; j <AVM_MAXVERSION && i < cinfo->versionlen; j++, i += cinfo->versionbuf[i] +1 )
Greg Kroah-Hartman
maintainerPATCH 18/134 KEYS: user: Align the payload buffer
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit cc1780fc42c76c705dd07ea123f1143dc5057630 upstream.
Align the payload of "user" and "logon" keys so that users of the keyrings service can access it as a struct that requires more than 2-byte alignment. fscrypt currently does this which results in the read of fscrypt_key::size being misaligned as it needs 4-byte alignment.
Align to __alignof__(u64) rather than __alignof__(long) since in the future it's conceivable that people would use structs beginning with u64, which on some platforms would require more than 'long' alignment.
--- include/keys/user-type.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/keys/user-type.h +1 -1
@@ -29,7 +29,7 @@struct user_key_payload {struct rcu_head rcu;/* RCU destructor */ unsigned short datalen;/* length of this data */ -char data[0 ];/* actual data */ +char data[0 ]__aligned(__alignof__(u64)) ;/* actual data */ };extern struct key_type key_type_user;
Greg Kroah-Hartman
maintainerPATCH 19/134 KEYS: always initialize keyring_index_key::desc_len
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit ede0fa98a900e657d1fcd80b50920efc896c1a4c upstream.
syzbot hit the 'BUG_ON(index_key->desc_len == 0);' in __key_link_begin() called from construct_alloc_key() during sys_request_key(), because the length of the key description was never calculated.
The problem is that we rely on ->desc_len being initialized by search_process_keyrings(), specifically by search_nested_keyrings(). But, if the process isn't subscribed to any keyrings that never happens.
Fix it by always initializing keyring_index_key::desc_len as soon as the description is set, like we already do in some places.
The following program reproduces the BUG_ON() when it's run as root and no session keyring has been installed. If it doesn't work, try removing pam_keyinit.so from /etc/pam.d/login and rebooting.
#include <stdlib.h>
#include <unistd.h>
#include <keyutils.h>
int main(void)
{
int id = add_key("keyring", "syz", NULL, 0, KEY_SPEC_USER_KEYRING);
keyctl_setperm(id, KEY_OTH_WRITE);
setreuid(5000, 5000);
request_key("user", "desc", "", id);
}--- security/keys/keyring.c | 4 +--- security/keys/proc.c | 3 +-- security/keys/request_key.c | 1 + security/keys/request_key_auth.c | 2 +- 4 files changed, 4 insertions(+), 6 deletions(-)
security/keys/keyring.c +1 -3
@@ -628,9 +628,6 @@ static bool search_nested_keyrings(strucBUG_ON ((ctx->flags &STATE_CHECKS ) ==0 || (ctx->flags &STATE_CHECKS ) ==STATE_CHECKS ); -if (ctx->index_key.description) - ctx->index_key.desc_len =strlen (ctx->index_key.description); -/* Check to see if this top-level keyring is what we are looking for * and whether it is valid or not. */
@@ -888,6 +885,7 @@ key_ref_t keyring_search(key_ref_t keyristruct keyring_search_context ctx = { .index_key.type = type, .index_key.description = description, + .index_key.desc_len =strlen (description), .cred =current_cred (), .match_data.cmp = key_default_cmp, .match_data.raw_data = description,
security/keys/proc.c +1 -2
@@ -191,8 +191,7 @@ static int proc_keys_show(struct seq_filint rc;struct keyring_search_context ctx = { - .index_key.type = key->type, - .index_key.description = key->description, + .index_key = key->index_key, .cred =current_cred (), .match_data.cmp = lookup_user_key_possessed, .match_data.raw_data = key,
security/keys/request_key.c +1 -0
@@ -544,6 +544,7 @@ struct key *request_key_and_link(structstruct keyring_search_context ctx = { .index_key.type = type, .index_key.description = description, + .index_key.desc_len =strlen (description), .cred =current_cred (), .match_data.cmp = key_default_cmp, .match_data.raw_data = description,
security/keys/request_key_auth.c +1 -1
@@ -254,7 +254,7 @@ struct key *key_get_instantiation_authkestruct key *authkey;key_ref_t authkey_ref; -sprintf (description,"%x" , target_id); + ctx.index_key.desc_len =sprintf (description,"%x" , target_id); authkey_ref =search_process_keyrings (&ctx);
Greg Kroah-Hartman
maintainerPATCH 20/134 batman-adv: fix uninit-value in batadv_interface_tx()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ffcbfac60642f63ae3d80891f573ba7e94a265c ]
KMSAN reported batadv_interface_tx() was possibly using a garbage value [1]
batadv_get_vid() does have a pskb_may_pull() call but batadv_interface_tx() does not actually make sure this did not fail.
[1]
BUG: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 CPU: 0 PID: 10006 Comm: syz-executor469 Not tainted 4.20.0-rc7+ #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 __netdev_start_xmit include/linux/netdevice.h:4356 [inline] netdev_start_xmit include/linux/netdevice.h:4365 [inline] xmit_one net/core/dev.c:3257 [inline] dev_hard_start_xmit+0x607/0xc40 net/core/dev.c:3273 __dev_queue_xmit+0x2e42/0x3bc0 net/core/dev.c:3843 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3876 packet_snd net/packet/af_packet.c:2928 [inline] packet_sendmsg+0x8306/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x441889 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdda6fd468 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000441889 RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00007ffdda6fd4c0 R13: 00007ffdda6fd4b0 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5220 sock_alloc_send_pskb+0xafd/0x10e0 net/core/sock.c:2083 packet_alloc_skb net/packet/af_packet.c:2781 [inline] packet_snd net/packet/af_packet.c:2872 [inline] packet_sendmsg+0x661a/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7
--- net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/soft-interface.c +2 -0
@@ -186,6 +186,8 @@ static int batadv_interface_tx(struct skswitch (ntohs (ethhdr->h_proto)) {case ETH_P_8021Q : +if (!pskb_may_pull (skb,sizeof (*vhdr))) + goto dropped; vhdr =vlan_eth_hdr (skb);if (vhdr->h_vlan_encapsulated_proto != ethertype) {
Greg Kroah-Hartman
maintainerPATCH 21/134 net/packet: fix 4gb buffer limit due to overflow check
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kal Conley <[email protected]>
[ Upstream commit fc62814d690cf62189854464f4bd07457d5e9e50 ]
When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Check it for overflow without limiting the total buffer size to UINT_MAX.
This change fixes support for packet ring buffers >= UINT_MAX.
--- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/packet/af_packet.c +1 -1
@@ -3894,7 +3894,7 @@ static int packet_set_ring(struct sock * rb->frames_per_block = req->tp_block_size/req->tp_frame_size;if (unlikely (rb->frames_per_block <=0 )) goto out; -if (unlikely (req->tp_block_size >UINT_MAX / req->tp_block_nr)) +if (unlikely (rb->frames_per_block >UINT_MAX / req->tp_block_nr)) goto out;if (unlikely ((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr))
Greg Kroah-Hartman
maintainerPATCH 22/134 team: avoid complex list operations in team_nl_cmd_options_set()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 2fdeee2549231b1f989f011bb18191f5660d3745 ]
The current opt_inst_list operations inside team_nl_cmd_options_set() is too complex to track:
LIST_HEAD(opt_inst_list);
nla_for_each_nested(...) {
list_for_each_entry(opt_inst, &team->option_inst_list, list) {
if (__team_option_inst_tmp_find(&opt_inst_list, opt_inst))
continue;
list_add(&opt_inst->tmp_list, &opt_inst_list);
}
}
team_nl_send_event_options_get(team, &opt_inst_list);as while we retrieve 'opt_inst' from team->option_inst_list, it could be added to the local 'opt_inst_list' for multiple times. The __team_option_inst_tmp_find() doesn't work, as the setter team_mode_option_set() still calls team->ops.exit() which uses ->tmp_list too in __team_options_change_check().
Simplify the list operations by moving the 'opt_inst_list' and team_nl_send_event_options_get() into the nla_for_each_nested() loop so that it can be guranteed that we won't insert a same list entry for multiple times. Therefore, __team_option_inst_tmp_find() can be removed too.
--- drivers/net/team/team.c | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-)
drivers/net/team/team.c +5 -22
@@ -253,17 +253,6 @@ static void __team_option_inst_mark_remo } } -static bool __team_option_inst_tmp_find (const struct list_head *opts, -const struct team_option_inst *needle) -{ -struct team_option_inst *opt_inst; - -list_for_each_entry (opt_inst, opts, tmp_list) -if (opt_inst == needle) -return true; -return false; -} -static int __team_options_register (struct team *team,const struct team_option *option,size_t option_count)
@@ -2435,7 +2424,6 @@ static int team_nl_cmd_options_set(strucint err =0 ;int i;struct nlattr *nl_option; -LIST_HEAD (opt_inst_list); team =team_nl_team_get (info);if (!team)
@@ -2451,6 +2439,7 @@ static int team_nl_cmd_options_set(strucstruct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX +1 ];struct nlattr *attr;struct nlattr *attr_data; +LIST_HEAD (opt_inst_list);enum team_option_type opt_type;int opt_port_ifindex =0 ;/* != 0 for per-port options */ u32 opt_array_index =0 ;
@@ -2554,23 +2543,17 @@ static int team_nl_cmd_options_set(strucif (err) goto team_put; opt_inst->changed = true; - -/* dumb/evil user-space can send us duplicate opt, -* keep only the last one -*/ -if (__team_option_inst_tmp_find (&opt_inst_list, - opt_inst)) -continue ; -list_add (&opt_inst->tmp_list, &opt_inst_list); }if (!opt_found) { err = -ENOENT ; goto team_put; } - } - err =team_nl_send_event_options_get (team, &opt_inst_list); + err =team_nl_send_event_options_get (team, &opt_inst_list); +if (err) +break ; + } team_put:team_nl_team_put (team);
Greg Kroah-Hartman
maintainerPATCH 23/134 sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 173656accaf583698bac3f9e269884ba60d51ef4 ]
If we disabled IPv6 from the kernel command line (ipv6.disable=1), we should not call ip6_err_gen_icmpv6_unreach(). This:
ip link add sit1 type sit local 192.0.2.1 remote 192.0.2.2 ttl 1 ip link set sit1 up
ip addr add 198.51.100.1/24 dev sit1
ping 198.51.100.2
if IPv6 is disabled at boot time, will crash the kernel.
v2: there's no need to use in6_dev_get(), use __in6_dev_get() instead,
as we only need to check that idev exists and we are under rcu_read_lock() (from netif_receive_skb_internal()).
--- net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/sit.c +1 -1
@@ -577,7 +577,7 @@ static int ipip6_err(struct sk_buff *skb goto out; err =0 ; -if (!ipip6_err_gen_icmpv6_unreach (skb)) +if (__in6_dev_get (skb->dev) && !ipip6_err_gen_icmpv6_unreach (skb)) goto out;if (t->parms.iph.ttl ==0 && type ==ICMP_TIME_EXCEEDED )
Greg Kroah-Hartman
maintainerPATCH 24/134 netlink: Trim skb to alloc size to avoid MSG_TRUNC
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arad, Ronen <[email protected]>
commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe upstream.
netlink_dump() allocates skb based on the calculated min_dump_alloc or a per socket max_recvmsg_len.min_alloc_size is maximum space required for any single netdev attributes as calculated by rtnl_calcit().max_recvmsg_len tracks the user provided buffer to netlink_recvmsg. It is capped at 16KiB.
The intention is to avoid small allocations and to minimize the number of calls required to obtain dump information for all net devices.
netlink_dump packs as many small messages as could fit within an skb that was sized for the largest single netdev information. The actual space available within an skb is larger than what is requested. It could be much larger and up to near 2x with align to next power of 2 approach.
Allowing netlink_dump to use all the space available within the allocated skb increases the buffer size a user has to provide to avoid truncaion (i.e. MSG_TRUNG flag set).
It was observed that with many VLANs configured on at least one netdev, a larger buffer of near 64KiB was necessary to avoid "Message truncated" error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when min_alloc_size was only little over 32KiB.
This patch trims skb to allocated size in order to allow the user to avoid truncation with more reasonable buffer size.
--- net/netlink/af_netlink.c | 34 ++++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-)
net/netlink/af_netlink.c +22 -12
@@ -1977,6 +1977,7 @@ static int netlink_dump(struct sock *sk)struct nlmsghdr *nlh;struct module *module;int err = -ENOBUFS ; +int alloc_min_size;int alloc_size;mutex_lock (nlk->cb_mutex);
@@ -1985,9 +1986,6 @@ static int netlink_dump(struct sock *sk) goto errout_skb; } - cb = &nlk->cb; - alloc_size =max_t (int, cb->min_dump_alloc,NLMSG_GOODSIZE ); -if (atomic_read (&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) goto errout_skb;
@@ -1996,22 +1994,34 @@ static int netlink_dump(struct sock *sk)* to reduce number of system calls on dump operations, if user * ever provided a big enough buffer. */ -if (alloc_size < nlk->max_recvmsg_len) { - skb =netlink_alloc_skb (sk, - nlk->max_recvmsg_len, - nlk->portid, + cb = &nlk->cb; + alloc_min_size =max_t (int, cb->min_dump_alloc,NLMSG_GOODSIZE ); + +if (alloc_min_size < nlk->max_recvmsg_len) { + alloc_size = nlk->max_recvmsg_len; + skb =netlink_alloc_skb (sk, alloc_size, nlk->portid, (GFP_KERNEL & ~__GFP_WAIT) | __GFP_NOWARN | __GFP_NORETRY); -/* available room should be exact amount to avoid MSG_TRUNC */ -if (skb) -skb_reserve (skb,skb_tailroom (skb) - - nlk->max_recvmsg_len); } -if (!skb) +if (!skb) { + alloc_size = alloc_min_size; skb =netlink_alloc_skb (sk, alloc_size, nlk->portid, (GFP_KERNEL & ~__GFP_WAIT)); + }if (!skb) goto errout_skb; + +/* Trim skb to allocated size. User is expected to provide buffer as +* large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at +* netlink_recvmsg())). dump will pack as many smaller messages as +* could fit within the allocated skb. skb is typically allocated +* with larger space than required (could be as much as near 2x the +* requested size with align to next power of 2 approach). Allowing +* dump to use the excess space makes it difficult for a user to have a +* reasonable static buffer based on the expected largest dump of a +* single netdev. The outcome is MSG_TRUNC error. +*/ +skb_reserve (skb,skb_tailroom (skb) - alloc_size);netlink_skb_set_owner_r (skb, sk);if (nlk->dump_done_errno >0 )
Greg Kroah-Hartman
maintainerPATCH 25/134 libceph: handle an empty authorize reply
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 0fd3fd0a9bb0b02b6435bb7070e9f7b82a23f068 upstream.
The authorize reply can be empty, for example when the ticket used to build the authorizer is too old and TAG_BADAUTHORIZER is returned from the service. Calling ->verify_authorizer_reply() results in an attempt to decrypt and validate (somewhat) random data in au->buf (most likely the signature block from calc_signature()), which fails and ends up in con_fault_finish() with !con->auth_retry. The ticket isn't invalidated and the connection is retried again and again until a new ticket is obtained from the monitor:
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
Let TAG_BADAUTHORIZER handler kick in and increment con->auth_retry.
--- net/ceph/messenger.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/ceph/messenger.c +8 -4
@@ -1980,15 +1980,19 @@ static int process_connect(struct ceph_cdout ("process_connect on %p tag %d\n" , con, (int )con->in_tag);if (con->auth_reply_buf) { +int len =le32_to_cpu (con->in_reply.authorizer_len); +/* * Any connection that defines ->get_authorizer() * should also define ->verify_authorizer_reply(). * See get_connect_authorizer(). */ - ret = con->ops->verify_authorizer_reply (con,0 ); -if (ret <0 ) { - con->error_msg ="bad authorize reply" ; -return ret; +if (len) { + ret = con->ops->verify_authorizer_reply (con,0 ); +if (ret <0 ) { + con->error_msg ="bad authorize reply" ; +return ret; + } } }
Greg Kroah-Hartman
maintainerPATCH 26/134 scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
commit ffeafdd2bf0b280d67ec1a47ea6287910d271f3f upstream.
The sysfs phy_identifier attribute for a sas_end_device comes from the rphy phy_identifier value.
Currently this is not being set for rphys with an end device attached, so we see incorrect symlinks from systemd disk/by-path:
root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part3 -> ../../sdc3
Indeed, each sas_end_device phy_identifier value is 0:
root@localhost:/# more sys/class/sas_device/end_device-0\:0\:2/phy_identifier 0 root@localhost:/# more sys/class/sas_device/end_device-0\:0\:10/phy_identifier 0
This patch fixes the discovery code to set the phy_identifier. With this, we now get proper symlinks:
root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy10-lun-0 -> ../../sdg lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy11-lun-0 -> ../../sdh lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0 -> ../../sda lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0-part1 -> ../../sda1 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0 -> ../../sdc lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part1 -> ../../sdc1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part2 -> ../../sdc2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part3 -> ../../sdc3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy5-lun-0 -> ../../sdd lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0 -> ../../sde lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part1 -> ../../sde1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part2 -> ../../sde2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part3 -> ../../sde3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0 -> ../../sdf lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part1 -> ../../sdf1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part2 -> ../../sdf2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part3 -> ../../sdf3
--- drivers/scsi/libsas/sas_expander.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/libsas/sas_expander.c +2 -0
@@ -818,6 +818,7 @@ static struct domain_device *sas_ex_disc rphy =sas_end_device_alloc (phy->port);if (!rphy) goto out_free; + rphy->identify.phy_identifier = phy_id; child->rphy = rphy;get_device (&rphy->dev);
@@ -845,6 +846,7 @@ static struct domain_device *sas_ex_disc child->rphy = rphy;get_device (&rphy->dev); + rphy->identify.phy_identifier = phy_id;sas_fill_in_rphy (child, rphy);list_add_tail (&child->disco_list_node, &parent->port->disco_list);
Greg Kroah-Hartman
maintainerPATCH 27/134 drm/msm: Unblock writer if reader closes file
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd ]
Prevents deadlock when fifo is full and reader closes file.
--- drivers/gpu/drm/msm/msm_rd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_rd.c +6 -1
@@ -103,7 +103,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)char *fptr = &fifo->buf[fifo->head];int n; -wait_event (rd->fifo_event,circ_space (&rd->fifo) >0 ); +wait_event (rd->fifo_event,circ_space (&rd->fifo) >0 || !rd->open); +if (!rd->open) +return ; n =min (sz,circ_space_to_end (&rd->fifo));memcpy (fptr, ptr, n);
@@ -192,7 +194,10 @@ static int rd_open(struct inode *inode, struct file *file)static int rd_release (struct inode *inode,struct file *file) {struct msm_rd_state *rd = inode->i_private; + rd->open = false; +wake_up_all (&rd->fifo_event); +return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 28/134 ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 906a9abc5de73c383af518f5a806f4be2993a0c7 ]
For some reason this field was set to zero when all other drivers use .dynamic = 1 for front-ends. This change was tested on Dell XPS13 and has no impact with the existing legacy driver. The SOF driver also works with this change which enables it to override the fixed topology.
--- sound/soc/intel/broadwell.c | 2 +- sound/soc/intel/haswell.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/soc/intel/broadwell.c +1 -1
@@ -168,7 +168,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { .stream_name = "Loopback", .cpu_dai_name = "Loopback Pin", .platform_name = "haswell-pcm-audio", - .dynamic = 0, + .dynamic = 1, .codec_name = "snd-soc-dummy", .codec_dai_name = "snd-soc-dummy-dai", .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
sound/soc/intel/haswell.c +1 -1
@@ -146,7 +146,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { .stream_name = "Loopback", .cpu_dai_name = "Loopback Pin", .platform_name = "haswell-pcm-audio", - .dynamic = 0, + .dynamic = 1, .codec_name = "snd-soc-dummy", .codec_dai_name = "snd-soc-dummy-dai", .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 29/134 ALSA: compress: prevent potential divide by zero bugs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]
The problem is seen in the q6asm_dai_compr_set_params() function:
ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
(prtd->pcm_size / prtd->periods),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
prtd->periods);In this code prtd->pcm_size is the buffer_size and prtd->periods comes from params->buffer.fragments. If we allow the number of fragments to be zero then it results in a divide by zero bug. One possible fix would be to use prtd->pcm_count directly instead of using the division to re-calculate it. But I decided that it doesn't really make sense to allow zero fragments.
--- sound/core/compress_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/core/compress_offload.c +2 -1
@@ -500,7 +500,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) {/* first let's check the buffer parameter's */ if (params->buffer.fragment_size ==0 || - params->buffer.fragments >INT_MAX / params->buffer.fragment_size) + params->buffer.fragments >INT_MAX / params->buffer.fragment_size || + params->buffer.fragments ==0 )return -EINVAL ;/* now codec parameters */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 30/134 usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ]
Currently the link_state is uninitialized and the default value is 0(U0) before the first time we start the udc, and after we start the udc then
stop the udc, the link_state will be undefined.
We may have the following warnings if we start the udc again with an undefined link_state:
WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308 dwc3 100e0000.hidwc3_0: wakeup failed --> -22 [...] Call Trace: [<c010f270>] (unwind_backtrace) from [<c010b3d8>] (show_stack+0x10/0x14) [<c010b3d8>] (show_stack) from [<c034a4dc>] (dump_stack+0x84/0x98) [<c034a4dc>] (dump_stack) from [<c0118000>] (__warn+0xe8/0x100) [<c0118000>] (__warn) from [<c0118050>](warn_slowpath_fmt+0x38/0x48) [<c0118050>] (warn_slowpath_fmt) from [<c0442ec0>](dwc3_send_gadget_ep_cmd+0x304/0x308) [<c0442ec0>] (dwc3_send_gadget_ep_cmd) from [<c0445e68>](dwc3_ep0_start_trans+0x48/0xf4) [<c0445e68>] (dwc3_ep0_start_trans) from [<c0446750>](dwc3_ep0_out_start+0x64/0x80) [<c0446750>] (dwc3_ep0_out_start) from [<c04451c0>](__dwc3_gadget_start+0x1e0/0x278) [<c04451c0>] (__dwc3_gadget_start) from [<c04452e0>](dwc3_gadget_start+0x88/0x10c) [<c04452e0>] (dwc3_gadget_start) from [<c045ee54>](udc_bind_to_driver+0x88/0xbc) [<c045ee54>] (udc_bind_to_driver) from [<c045f29c>](usb_gadget_probe_driver+0xf8/0x140) [<c045f29c>] (usb_gadget_probe_driver) from [<bf005424>](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite]) [<bf005424>] (gadget_dev_desc_UDC_store [libcomposite]) from[<c023d8e0>] (configfs_write_file+0xd4/0x160) [<c023d8e0>] (configfs_write_file) from [<c01d51e8>] (__vfs_write+0x1c/0x114) [<c01d51e8>] (__vfs_write) from [<c01d5ff4>] (vfs_write+0xa4/0x168) [<c01d5ff4>] (vfs_write) from [<c01d6d40>] (SyS_write+0x3c/0x90) [<c01d6d40>] (SyS_write) from [<c0107400>] (ret_fast_syscall+0x0/0x3c)
--- drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/gadget.c +1 -0
@@ -1641,6 +1641,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,/* begin to receive SETUP packets */ dwc->ep0state =EP0_SETUP_PHASE ; + dwc->link_state =DWC3_LINK_STATE_SS_DIS ;dwc3_ep0_out_start (dwc);dwc3_gadget_enable_irq (dwc);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 31/134 usb: gadget: Potential NULL dereference on allocation error
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit df28169e1538e4a8bcd8b779b043e5aa6524545c ]
The source_sink_alloc_func() function is supposed to return error pointers on error. The function is called from usb_get_function() which doesn't check for NULL returns so it would result in an Oops.
Of course, in the current kernel, small allocations always succeed so this doesn't affect runtime.
--- drivers/usb/gadget/function/f_sourcesink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_sourcesink.c +1 -1
@@ -1149,7 +1149,7 @@ static struct usb_function *source_sink_alloc_func( ss =kzalloc (sizeof (*ss),GFP_KERNEL );if (!ss) -return NULL ; +return ERR_PTR (-ENOMEM ); ss_opts = container_of(fi, struct f_ss_opts, func_inst);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 32/134 ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ]
Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems.
1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf.
2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration.
The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE.
--- sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
sound/soc/fsl/imx-audmux.c +12 -12
@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,if (!buf)return -ENOMEM ; - ret =snprintf (buf,PAGE_SIZE ,"PDCR: %08x\nPTCR: %08x\n" , + ret =scnprintf (buf,PAGE_SIZE ,"PDCR: %08x\nPTCR: %08x\n" , pdcr, ptcr);if (ptcr &IMX_AUDMUX_V2_PTCR_TFSDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxFS output from %s, " ,audmux_port_string ((ptcr >>27 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxFS input, " );if (ptcr &IMX_AUDMUX_V2_PTCR_TCLKDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxClk output from %s" ,audmux_port_string ((ptcr >>22 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxClk input" ); - ret +=snprintf (buf + ret,PAGE_SIZE - ret,"\n" ); + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"\n" );if (ptcr &IMX_AUDMUX_V2_PTCR_SYN ) { - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"Port is symmetric" ); }else {if (ptcr &IMX_AUDMUX_V2_PTCR_RFSDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxFS output from %s, " ,audmux_port_string ((ptcr >>17 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxFS input, " );if (ptcr &IMX_AUDMUX_V2_PTCR_RCLKDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxClk output from %s" ,audmux_port_string ((ptcr >>12 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxClk input" ); } - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"\nData received from %s\n" ,audmux_port_string ((pdcr >>13 ) &0x7 ));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/134 mac80211: fix miscounting of ttl-dropped frames
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c ]
In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl' counter when we decrement the ttl to zero. For unicast frames destined for other hosts, we stop processing the frame at that point.
For multicast frames, we do not rebroadcast it in this case, but we do pass the frame up the stack to process it on this STA. That doesn't match the usual definition of "dropped," so don't count those as such.
With this change, something like ping6 -i0.2 ff02::1%mesh0 from a peer in a ttl=1 network no longer increments the counter rapidly.
--- net/mac80211/rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/rx.c +3 -1
@@ -2179,7 +2179,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)skb_set_queue_mapping (skb, q);if (!--mesh_hdr->ttl) { -IEEE80211_IFSTA_MESH_CTR_INC (ifmsh, dropped_frames_ttl); +if (!is_multicast_ether_addr (hdr->addr1)) +IEEE80211_IFSTA_MESH_CTR_INC (ifmsh, + dropped_frames_ttl); goto out; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/134 serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 815d835b7ba46685c316b000013367dacb2b461b ]
Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4.
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -1426,7 +1426,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, }/* ask the core to calculate the divisor */ - baud =uart_get_baud_rate (port, termios, old,50 , port->uartclk /16 ); + baud =uart_get_baud_rate (port, termios, old,50 , port->uartclk /4 );spin_lock_irqsave (&sport->port.lock, flags);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/134 scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fe35a40e675473eb65f2f5462b82770f324b5689 ]
Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to avoid a NULL pointer dereference in csio_vport_set_state().
ln->fc_vport is dereferenced in csio_vport_set_state().
--- drivers/scsi/csiostor/csio_attr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/csiostor/csio_attr.c +1 -1
@@ -582,12 +582,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) }fc_vport_set_state (fc_vport,FC_VPORT_INITIALIZING ); + ln->fc_vport = fc_vport;if (csio_fcoe_alloc_vnp (hw, ln)) goto error; *(struct csio_lnode **)fc_vport->dd_data = ln; - ln->fc_vport = fc_vport;if (!fc_vport->node_name) fc_vport->node_name =wwn_to_u64 (csio_ln_wwnn (ln));if (!fc_vport->port_name)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 36/134 net: altera_tse: fix connect_local_phy error path
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 17b42a20d7ca59377788c6a2409e77569570cc10 ]
The connect_local_phy should return NULL (not negative errno) on error, since its caller expects it.
--- drivers/net/ethernet/altera/altera_tse_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_tse_main.c +3 -1
@@ -706,8 +706,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) phydev =phy_connect (dev, phy_id_fmt, &altera_tse_adjust_link, priv->phy_iface); -if (IS_ERR (phydev)) +if (IS_ERR (phydev)) {netdev_err (dev,"Could not attach to PHY\n" ); + phydev =NULL ; + } }else {int ret;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 37/134 ibmveth: Do not process frames after calling napi_reschedule
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e95d22c69b2c130ccce257b84daf283fd82d611e ]
The IBM virtual ethernet driver's polling function continues to process frames after rescheduling NAPI, resulting in a warning if it exhausted its budget. Do not restart polling after calling napi_reschedule. Instead let frames be processed in the following instance.
--- drivers/net/ethernet/ibm/ibmveth.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +0 -2
@@ -1085,7 +1085,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)int frames_processed =0 ;unsigned long lpar_rc; -restart_poll:while (frames_processed < budget) {if (!ibmveth_rxq_pending_buffer (adapter))break ;
@@ -1154,7 +1153,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) napi_reschedule(napi)) { lpar_rc =h_vio_signal (adapter->vdev->unit_address,VIO_IRQ_DISABLE ); - goto restart_poll; } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 38/134 mac80211: dont initiate TDLS connection if station is not associated to AP
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce ]
Following call trace is observed while adding TDLS peer entry in driver during TDLS setup.
Call Trace: [<c1301476>] dump_stack+0x47/0x61 [<c10537d2>] __warn+0xe2/0x100 [<fa22415f>] ? sta_apply_parameters+0x49f/0x550 [mac80211] [<c1053895>] warn_slowpath_null+0x25/0x30 [<fa22415f>] sta_apply_parameters+0x49f/0x550 [mac80211] [<fa20ad42>] ? sta_info_alloc+0x1c2/0x450 [mac80211] [<fa224623>] ieee80211_add_station+0xe3/0x160 [mac80211] [<c1876fe3>] nl80211_new_station+0x273/0x420 [<c170f6d9>] genl_rcv_msg+0x219/0x3c0 [<c170f4c0>] ? genl_rcv+0x30/0x30 [<c170ee7e>] netlink_rcv_skb+0x8e/0xb0 [<c170f4ac>] genl_rcv+0x1c/0x30 [<c170e8aa>] netlink_unicast+0x13a/0x1d0 [<c170ec18>] netlink_sendmsg+0x2d8/0x390 [<c16c5acd>] sock_sendmsg+0x2d/0x40 [<c16c6369>] ___sys_sendmsg+0x1d9/0x1e0
Fixing this by allowing TDLS setup request only when we have completed association.
--- net/mac80211/cfg.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/cfg.c +4 -0
@@ -1194,6 +1194,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev, sta->sta.tdls = true; } +if (sta->sta.tdls && sdata->vif.type ==NL80211_IFTYPE_STATION && + !sdata->u.mgd.associated) +return -EINVAL ; + err =sta_apply_parameters (local, sta, params);if (err) {sta_info_free (local, sta);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 39/134 cfg80211: extend range deviation for DMG
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ]
Recently, DMG frequency bands have been extended till 71GHz, so extend the range check till 20GHz (45-71GHZ), else some channels will be marked as disabled.
--- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/reg.c +2 -2
@@ -688,7 +688,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,* definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), * however it is safe for now to assume that a frequency rule should not be * part of a frequency's band if the start freq or end freq are off by more -* than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the +* than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the * 60 GHz band. * This resolution can be lowered and should be considered as we add * regulatory rule support for other "bands".
@@ -703,7 +703,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,* with the Channel starting frequency above 45 GHz. */ u32 limit = freq_khz >45 *ONE_GHZ_IN_KHZ ? -10 *ONE_GHZ_IN_KHZ :2 *ONE_GHZ_IN_KHZ ; +20 *ONE_GHZ_IN_KHZ :2 *ONE_GHZ_IN_KHZ ;if (abs (freq_khz - freq_range->start_freq_khz) <= limit)return true;if (abs (freq_khz - freq_range->end_freq_khz) <= limit)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 40/134 KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 619ad846fc3452adaf71ca246c5aa711e2055398 ]
kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being delivered to the host (L1) when it's running nested. The problem seems to
be: svm_complete_interrupts() raises 'nmi_injected' flag but later we decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI injection upon entry so it got delivered to L1 instead of L2.
It seems that VMX code solves the same issue in prepare_vmcs12(), this was introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework event injection and recovery").
--- arch/x86/kvm/svm.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kvm/svm.c +8 -0
@@ -2431,6 +2431,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)kvm_mmu_reset_context (&svm->vcpu);kvm_mmu_load (&svm->vcpu); +/* +* Drop what we picked up for L2 via svm_complete_interrupts() so it +* doesn't end up in L1. +*/ + svm->vcpu.arch.nmi_injected = false; +kvm_clear_exception_queue (&svm->vcpu); +kvm_clear_interrupt_queue (&svm->vcpu); +return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 41/134 mmc: spi: Fix card detection during probe
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Neuschäfer <[email protected]>
commit c9bd505dbd9d3dc80c496f88eafe70affdcf1ba6 upstream.
When using the mmc_spi driver with a card-detect pin, I noticed that the card was not detected immediately after probe, but only after it was unplugged and plugged back in (and the CD IRQ fired).
The call tree looks something like this:
mmc_spi_probe
mmc_add_host
mmc_start_host
_mmc_detect_change
mmc_schedule_delayed_work(&host->detect, 0)
mmc_rescan
host->bus_ops->detect(host)
mmc_detect
_mmc_detect_card_removed
host->ops->get_cd(host)
mmc_gpio_get_cd -> -ENOSYS (ctx->cd_gpio not set)
mmc_gpiod_request_cd
ctx->cd_gpio = descTo fix this issue, call mmc_detect_change after the card-detect GPIO/IRQ is registered.
--- drivers/mmc/host/mmc_spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/mmc_spi.c +1 -0
@@ -1451,6 +1451,7 @@ static int mmc_spi_probe(struct spi_deviif (status !=0 ) goto fail_add_host; } +mmc_detect_change (mmc,0 ); dev_info(&spi->dev, "SD/MMC host %s%s%s%s%s\n", dev_name(&mmc->class_dev),
Greg Kroah-Hartman
maintainerPATCH 42/134 mm: enforce min addr even if capable() in expand_downwards()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 0a1d52994d440e21def1c2174932410b4f2a98a1 upstream.
security_mmap_addr() does a capability check with current_cred(), but we can reach this code from contexts like a VFS write handler where current_cred() must not be used.
This can be abused on systems without SMAP to make NULL pointer dereferences exploitable again.
--- mm/mmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
mm/mmap.c +3 -4
@@ -2292,12 +2292,11 @@ int expand_downwards(struct vm_area_stru {struct vm_area_struct *prev;unsigned long gap_addr; -int error; +int error =0 ; address &=PAGE_MASK ; - error =security_mmap_addr (address); -if (error) -return error; +if (address < mmap_min_addr) +return -EPERM ;/* Enforce stack_guard_gap */ gap_addr = address - stack_guard_gap;
Greg Kroah-Hartman
maintainerPATCH 43/134 USB: serial: cp210x: add ID for Ingenico 3070
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Mironov <[email protected]>
commit dd9d3d86b08d6a106830364879c42c78db85389c upstream.
Here is how this device appears in kernel log:
usb 3-1: new full-speed USB device number 18 using xhci_hcd usb 3-1: New USB device found, idVendor=0b00, idProduct=3070 usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 3-1: Product: Ingenico 3070
usb 3-1: Manufacturer: Silicon Labs
usb 3-1: SerialNumber: 0001
Apparently this is a POS terminal with embedded USB-to-Serial converter.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -57,6 +57,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
Greg Kroah-Hartman
maintainerPATCH 44/134 net-sysfs: Fix mem leak in netdev_register_kobject
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab ]
syzkaller report this:
BUG: memory leak
unreferenced object 0xffff88837a71a500 (size 256):
comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ .......
backtrace:
[<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751
[<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516
[<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline]
[<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883
[<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline]
[<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690
[<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705
[<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline]
[<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline]
[<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710
[<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
[<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000115be9bb>] 0xffffffffffffffffIt should call kset_unregister to free 'dev->queues_kset'
in error path of register_queue_kobjects, otherwise will cause a mem leak.
--- net/core/net-sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/net-sysfs.c +3 -0
@@ -1241,6 +1241,9 @@ static int register_queue_kobjects(struc error:netdev_queue_update_kobjects (dev, txq,0 );net_rx_queue_update_kobjects (dev, rxq,0 ); +#ifdef CONFIG_SYSFS +kset_unregister (dev->queues_kset); +#endif return error; }
Greg Kroah-Hartman
maintainerPATCH 45/134 sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit b33b7cd6fd86478dd2890a9abeb6f036aa01fdf7 ]
Some sky2 chips fire IRQ after S3, before the driver is fully resumed:
[ 686.804877] do_IRQ: 1.37 No irq handler for vector
This is likely a platform bug that device isn't fully quiesced during S3. Use MSI-X, maskable MSI or INTx can prevent this issue from happening.
Since MSI-X and maskable MSI are not supported by this device, fallback to use INTx on affected platforms.
--- drivers/net/ethernet/marvell/sky2.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/sky2.c +23 -1
@@ -46,6 +46,7 @@#include <linux/mii.h> #include <linux/of_device.h> #include <linux/of_net.h> +#include <linux/dmi.h> #include <asm/irq.h>
@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128module_param (copybreak, int,0 );MODULE_PARM_DESC (copybreak,"Receive copy threshold" ); -static int disable_msi =0 ; +static int disable_msi =-1 ;module_param (disable_msi, int,0 );MODULE_PARM_DESC (disable_msi,"Disable Message Signaled Interrupt (MSI)" );
@@ -4913,6 +4914,24 @@ static const char *sky2_name(u8 chipid,return buf; } +static const struct dmi_system_id msi_blacklist[] = { + { + .ident ="Dell Inspiron 1545" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Inspiron 1545" ), + }, + }, + { + .ident ="Gateway P-79" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Gateway" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P-79" ), + }, + }, + {} +}; +static int sky2_probe (struct pci_dev *pdev,const struct pci_device_id *ent) {struct net_device *dev, *dev1;
@@ -5024,6 +5043,9 @@ static int sky2_probe(struct pci_dev *pd goto err_out_free_pci; } +if (disable_msi ==-1 ) + disable_msi = !!dmi_check_system (msi_blacklist); +if (!disable_msi &&pci_enable_msi (pdev) ==0 ) { err =sky2_test_msi (hw);if (err) {
Greg Kroah-Hartman
maintainerPATCH 46/134 team: Free BPF filter when unregistering netdev
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 692c31bd4054212312396b1d303bffab2c5b93a7 ]
When team is used in loadbalance mode a BPF filter can be used to provide a hash which will determine the Tx port.
When the netdev is later unregistered the filter is not freed which results in memory leaks [1].
Fix by freeing the program and the corresponding filter when unregistering the netdev.
[1]
unreferenced object 0xffff8881dbc47cc8 (size 16):
comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s) hex dump (first 16 bytes):
a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff ..kkkkkk........
backtrace:
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff
unreferenced object 0xffff8881e182a588 (size 2048):
comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s)
hex dump (first 32 bytes):
20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff .......0...(...
07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 ........(.......
backtrace:
[<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff--- drivers/net/team/team_mode_loadbalance.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/team/team_mode_loadbalance.c +15 -0
@@ -305,6 +305,20 @@ static int lb_bpf_func_set(struct team *return 0 ; } +static void lb_bpf_func_free (struct team *team) +{ +struct lb_priv *lb_priv =get_lb_priv (team); +struct bpf_prog *fp; + +if (!lb_priv->ex->orig_fprog) +return ; + +__fprog_destroy (lb_priv->ex->orig_fprog); + fp =rcu_dereference_protected (lb_priv->fp, +lockdep_is_held (&team->lock)); +bpf_prog_destroy (fp); +} +static int lb_tx_method_get (struct team *team,struct team_gsetter_ctx *ctx) {struct lb_priv *lb_priv =get_lb_priv (team);
@@ -619,6 +633,7 @@ static void lb_exit(struct team *team)team_options_unregister (team, lb_options,ARRAY_SIZE (lb_options)); +lb_bpf_func_free (team);cancel_delayed_work_sync (&lb_priv->ex->stats.refresh_dw);free_percpu (lb_priv->pcpu_stats);kfree (lb_priv->ex);
Greg Kroah-Hartman
maintainerPATCH 47/134 net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 58bdd544e2933a21a51eecf17c3f5f94038261b5 ]
KASAN report this:
BUG: KASAN: null-ptr-deref in nfc_llcp_build_gb+0x37f/0x540 [nfc] Read of size 3 at addr 0000000000000000 by task syz-executor.0/5401 CPU: 0 PID: 5401 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 kasan_report+0x171/0x18d mm/kasan/report.c:321 memcpy+0x1f/0x50 mm/kasan/common.c:130 nfc_llcp_build_gb+0x37f/0x540 [nfc] nfc_llcp_register_device+0x6eb/0xb50 [nfc] nfc_register_device+0x50/0x1d0 [nfc] nfcsim_device_new+0x394/0x67d [nfcsim] ? 0xffffffffc1080000 nfcsim_init+0x6b/0x1000 [nfcsim] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9cb79dcc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9cb79dcc70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9cb79dd6bc R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
nfc_llcp_build_tlv will return NULL on fails, caller should check it, otherwise will trigger a NULL dereference.
--- net/nfc/llcp_commands.c | 20 ++++++++++++++++++++ net/nfc/llcp_core.c | 24 ++++++++++++++++++++---- 2 files changed, 40 insertions(+), 4 deletions(-)
net/nfc/llcp_commands.c +20 -0
@@ -418,6 +418,10 @@ int nfc_llcp_send_connect(struct nfc_llc sock->service_name, sock->service_name_len, &service_name_tlv_length); +if (!service_name_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += service_name_tlv_length; }
@@ -428,9 +432,17 @@ int nfc_llcp_send_connect(struct nfc_llc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length;pr_debug ("SKB size %d SN length %zu\n" , size, sock->service_name_len);
@@ -484,9 +496,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_soc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length; skb =llcp_allocate_pdu (sock,LLCP_PDU_CC , size);
net/nfc/llcp_core.c +20 -4
@@ -531,10 +531,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(strustatic int nfc_llcp_build_gb (struct nfc_llcp_local *local) { -u8 *gb_cur, *version_tlv, version, version_length; -u8 *lto_tlv, lto_length; -u8 *wks_tlv, wks_length; -u8 *miux_tlv, miux_length; +u8 *gb_cur, version, version_length; +u8 lto_length, wks_length, miux_length; +u8 *version_tlv =NULL , *lto_tlv =NULL , + *wks_tlv =NULL , *miux_tlv =NULL ;__be16 wks =cpu_to_be16 (local->local_wks);u8 gb_len =0 ;int ret =0 ;
@@ -542,17 +542,33 @@ static int nfc_llcp_build_gb(struct nfc_ version =LLCP_VERSION_11 ; version_tlv =nfc_llcp_build_tlv (LLCP_TLV_VERSION , &version,1 , &version_length); +if (!version_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += version_length; lto_tlv =nfc_llcp_build_tlv (LLCP_TLV_LTO , &local->lto,1 , <o_length); +if (!lto_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += lto_length;pr_debug ("Local wks 0x%lx\n" , local->local_wks); wks_tlv =nfc_llcp_build_tlv (LLCP_TLV_WKS , (u8 *)&wks,2 , &wks_length); +if (!wks_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += wks_length; miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&local->miux,0 , &miux_length); +if (!miux_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += miux_length; gb_len +=ARRAY_SIZE (llcp_magic);
Greg Kroah-Hartman
maintainerPATCH 48/134 net: Add __icmp_send helper.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 9ef6b42ad6fd7929dd1b6092cb02014e382c6a91 ]
Add __icmp_send function having ip_options struct parameter
--- include/net/icmp.h | 9 ++++++++- net/ipv4/icmp.c | 7 ++++--- 2 files changed, 12 insertions(+), 4 deletions(-)
include/net/icmp.h +8 -1
@@ -22,6 +22,7 @@#include <net/inet_sock.h> #include <net/snmp.h> +#include <net/ip.h> struct icmp_err {int errno;
@@ -39,7 +40,13 @@ struct net_proto_family;struct sk_buff ;struct net ; -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info); +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt); +static inline void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +{ +__icmp_send (skb_in, type, code, info, &IPCB (skb_in)->opt); +} +int icmp_rcv (struct sk_buff *skb);void icmp_err (struct sk_buff *skb,u32 info);int icmp_init (void );
net/ipv4/icmp.c +4 -3
@@ -541,7 +541,8 @@ relookup_failed:* MUST reply to only the first fragment. */ -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt) {struct iphdr *iph;int room;
@@ -655,7 +656,7 @@ void icmp_send(struct sk_buff *skb_in, i iph->tos; mark =IP4_REPLY_MARK (net, skb_in->mark); -if (ip_options_echo (&icmp_param->replyopts.opt.opt, skb_in)) +if (__ip_options_echo (&icmp_param->replyopts.opt.opt, skb_in, opt)) goto out_unlock;
@@ -707,7 +708,7 @@ out_free:kfree (icmp_param); out:; } -EXPORT_SYMBOL (icmp_send); +EXPORT_SYMBOL (__icmp_send);static void icmp_socket_deliver (struct sk_buff *skb,u32 info)
Greg Kroah-Hartman
maintainerPATCH 49/134 net: avoid use IPCB in cipso_v4_error
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 3da1ed7ac398f34fff1694017a07054d69c5f5c5 ]
Extract IP options in cipso_v4_error and use __icmp_send.
--- include/net/ip.h | 2 ++ net/ipv4/cipso_ipv4.c | 17 +++++++++++++++-- net/ipv4/ip_options.c | 22 +++++++++++++++++----- 3 files changed, 34 insertions(+), 7 deletions(-)
include/net/ip.h +2 -0
@@ -512,6 +512,8 @@ static inline int ip_options_echo(struct }void ip_options_fragment (struct sk_buff *skb); +int __ip_options_compile (struct net *net,struct ip_options *opt, +struct sk_buff *skb,__be32 *info);int ip_options_compile (struct net *net,struct ip_options *opt,struct sk_buff *skb); int ip_options_get(struct net *net, struct ip_options_rcu **optp,
net/ipv4/cipso_ipv4.c +15 -2
@@ -1803,13 +1803,26 @@ validate_return:*/ void cipso_v4_error (struct sk_buff *skb,int error,u32 gateway) { +unsigned char optbuf[sizeof (struct ip_options ) +40 ]; +struct ip_options *opt = (struct ip_options *)optbuf; +if (ip_hdr (skb)->protocol ==IPPROTO_ICMP || error != -EACCES )return ; +/* +* We might be called above the IP layer, +* so we can not use icmp_send and IPCB here. +*/ + +memset (opt,0 ,sizeof (struct ip_options )); + opt->optlen =ip_hdr (skb)->ihl*4 -sizeof (struct iphdr ); +if (__ip_options_compile (dev_net (skb->dev), opt, skb,NULL )) +return ; +if (gateway) -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 , opt);else -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 , opt); }/**
net/ipv4/ip_options.c +17 -5
@@ -253,8 +253,9 @@ static void spec_dst_fill(__be32 *spec_d* If opt == NULL, then skb->data should point to IP header. */ -int ip_options_compile (struct net *net, -struct ip_options *opt,struct sk_buff *skb) +int __ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb, +__be32 *info) {__be32 spec_dst =htonl (INADDR_ANY );unsigned char *pp_ptr =NULL ;
@@ -470,11 +471,22 @@ eol:return 0 ; error: -if (skb) { -icmp_send (skb,ICMP_PARAMETERPROB ,0 ,htonl ((pp_ptr-iph)<<24 )); - } +if (info) + *info =htonl ((pp_ptr-iph)<<24 );return -EINVAL ; } + +int ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb) +{ +int ret; +__be32 info; + + ret =__ip_options_compile (net, opt, skb, &info); +if (ret !=0 && skb) +icmp_send (skb,ICMP_PARAMETERPROB ,0 , info); +return ret; +}EXPORT_SYMBOL (ip_options_compile);/*
Greg Kroah-Hartman
maintainerPATCH 50/134 net: phy: Micrel KSZ8061: link failure after cable connect
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajasingh Thavamani <[email protected]>
[ Upstream commit 232ba3a51cc224b339c7114888ed7f0d4d95695e ]
With Micrel KSZ8061 PHY, the link may occasionally not come up after Ethernet cable connect. The vendor's (Microchip, former Micrel) errata sheet 80000688A.pdf descripes the problem and possible workarounds in detail, see below.
The batch implements workaround 1, which permanently fixes the issue.
DESCRIPTION
Link-up may not occur properly when the Ethernet cable is initially connected. This issue occurs more commonly when the cable is connected slowly, but it may occur any time a cable is connected. This issue occurs in the auto-negotiation circuit, and will not occur if auto-negotiation is disabled (which requires that the two link partners be set to the same speed and duplex).
END USER IMPLICATIONS
When this issue occurs, link is not established. Subsequent cable plug/unplaug cycle will not correct the issue.
WORk AROUND
There are four approaches to work around this issue:
1. This issue can be prevented by setting bit 15 in MMD device address 1, register 2, prior to connecting the cable or prior to setting the Restart Auto-negotiation bit in register 0h. The MMD registers are accessed via the indirect access registers Dh and Eh, or via the Micrel EthUtil utility as shown here:
. if using the EthUtil utility (usually with a Micrel KSZ8061
Evaluation Board), type the following commands:
> address 1
> mmd 1
> iw 2 b61a
. Alternatively, write the following registers to write to the
indirect MMD register:
Write register Dh, data 0001h
Write register Eh, data 0002h
Write register Dh, data 4001h
Write register Eh, data B61Ah
2. The issue can be avoided by disabling auto-negotiation in the KSZ8061, either by the strapping option, or by clearing bit 12 in register 0h. Care must be taken to ensure that the KSZ8061 and the link partner will link with the same speed and duplex. Note that the KSZ8061 defaults to full-duplex when auto-negotiation is off, but other devices may default to half-duplex in the event of failed auto-negotiation.
3. The issue can be avoided by connecting the cable prior to powering-up or resetting the KSZ8061, and leaving it plugged in thereafter.
4. If the above measures are not taken and the problem occurs, link can be recovered by setting the Restart Auto-Negotiation bit in register 0h, or by resetting or power cycling the device. Reset may be either hardware reset or software reset (register 0h, bit 15).
PLAN
This errata will not be corrected in the future revision.
--- drivers/net/phy/micrel.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/phy/micrel.c +13 -1
@@ -27,6 +27,7 @@#include <linux/micrel_phy.h> #include <linux/of.h> #include <linux/clk.h> +#include <uapi/linux/mdio.h> /* Operation Mode Strap Override */ #define MII_KSZPHY_OMSO 0x16
@@ -217,6 +218,17 @@ static int ks8051_config_init(struct phyreturn rc <0 ? rc :0 ; } +static int ksz8061_config_init (struct phy_device *phydev) +{ +int ret; + + ret =phy_write_mmd (phydev,MDIO_MMD_PMAPMD ,MDIO_DEVID1 ,0xB61A ); +if (ret) +return ret; + +return kszphy_config_init (phydev); +} + static int ksz9021_load_values_from_of(struct phy_device *phydev, struct device_node *of_node, u16 reg, char *field1, char *field2,
@@ -593,7 +605,7 @@ static struct phy_driver ksphy_driver[] .phy_id_mask = 0x00fffff0, .features = (PHY_BASIC_FEATURES | SUPPORTED_Pause), .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, - .config_init = kszphy_config_init, + .config_init = ksz8061_config_init, .config_aneg = genphy_config_aneg, .read_status = genphy_read_status, .ack_interrupt = kszphy_ack_interrupt,
Greg Kroah-Hartman
maintainerPATCH 51/134 netlabel: fix out-of-bounds memory accesses
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 5578de4834fe0f2a34fedc7374be691443396d1f ]
There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward.
As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8.
--- net/ipv4/cipso_ipv4.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/cipso_ipv4.c +4 -2
@@ -165,7 +165,8 @@ static int cipso_v4_bitmap_walk(const un (state == 0 && (byte & bitmask) == 0))return bit_spot; - bit_spot++; +if (++bit_spot >= bitmap_len) +return -1 ; bitmask >>=1 ;if (bitmask ==0 ) { byte = bitmap[++byte_offset];
@@ -735,7 +736,8 @@ static int cipso_v4_map_lvl_valid(constcase CIPSO_V4_MAP_PASS :return 0 ;case CIPSO_V4_MAP_TRANS : -if (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ) +if ((level < doi_def->map.std->lvl.cipso_size) && + (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ))return 0 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 52/134 ip6mr: Do not call __IP6_INC_STATS() from preemptible context
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 87c11f1ddbbad38ad8bad47af133a8208985fbdf ]
Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot assume preemption is disabled when incrementing the counter and accessing a per-CPU variable.
Preemption can be enabled when we add a route in process context that corresponds to packets stored in the unresolved queue, which are then forwarded using this route [1].
Fix this by using IP6_INC_STATS() which takes care of disabling preemption on architectures where it is needed.
[1]
[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314 [ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0 [ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336 [ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016 [ 157.460461] Call Trace: [ 157.460486] dump_stack+0xf9/0x1be [ 157.460553] check_preemption_disabled+0x1d6/0x200 [ 157.460576] ip6mr_forward2+0x73e/0x10e0 [ 157.460705] ip6_mr_forward+0x9a0/0x1510 [ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00 [ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0 [ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060 [ 157.462013] ipv6_setsockopt+0x90/0x110 [ 157.462036] rawv6_setsockopt+0x4a/0x120 [ 157.462058] __sys_setsockopt+0x16b/0x340 [ 157.462198] __x64_sys_setsockopt+0xbf/0x160 [ 157.462220] do_syscall_64+0x14d/0x610 [ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/ipv6/ip6mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/ip6mr.c +4 -4
@@ -1987,10 +1987,10 @@ int ip6mr_compat_ioctl(struct sock *sk,static inline int ip6mr_forward2_finish (struct sk_buff *skb) { -IP6_INC_STATS_BH (dev_net (skb_dst (skb)->dev),ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTFORWDATAGRAMS ); -IP6_ADD_STATS_BH (dev_net (skb_dst (skb)->dev),ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTOCTETS , skb->len); +IP6_INC_STATS (dev_net (skb_dst (skb)->dev),ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTFORWDATAGRAMS ); +IP6_ADD_STATS (dev_net (skb_dst (skb)->dev),ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTOCTETS , skb->len);return dst_output (skb); }
Greg Kroah-Hartman
maintainerPATCH 53/134 hugetlbfs: fix races and page leaks during migration
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit cb6acd01e2e43fd8bad11155752b7699c3d0fb76 upstream.
hugetlb pages should only be migrated if they are 'active'. The routines set/clear_page_huge_active() modify the active state of hugetlb pages.
When a new hugetlb page is allocated at fault time, set_page_huge_active is called before the page is locked. Therefore, another thread could race and migrate the page while it is being added to page table by the fault code. This race is somewhat hard to trigger, but can be seen by strategically adding udelay to simulate worst case scheduling behavior. Depending on 'how' the code races, various BUG()s could be triggered.
To address this issue, simply delay the set_page_huge_active call until after the page is successfully added to the page table.
Hugetlb pages can also be leaked at migration time if the pages are associated with a file in an explicitly mounted hugetlbfs filesystem. For example, consider a two node system with 4GB worth of huge pages available. A program mmaps a 2G file in a hugetlbfs filesystem. It then migrates the pages associated with the file from one node to another. When the program exits, huge page counts are as follows:
node0
1024 free_hugepages
1024 nr_hugepages
node1
0 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
That is as expected. 2G of huge pages are taken from the free_hugepages counts, and 2G is the size of the file in the explicitly mounted filesystem. If the file is then removed, the counts become:
node0
1024 free_hugepages
1024 nr_hugepages
node1
1024 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
Note that the filesystem still shows 2G of pages used, while there actually are no huge pages in use. The only way to 'fix' the filesystem accounting is to unmount the filesystem
If a hugetlb page is associated with an explicitly mounted filesystem, this information in contained in the page_private field. At migration time, this information is not preserved. To fix, simply transfer page_private from old to new page at migration time if necessary.
There is a related race with removing a huge page from a file and migration. When a huge page is removed from the pagecache, the page_mapping() field is cleared, yet page_private remains set until the page is actually freed by free_huge_page(). A page could be migrated while in this state. However, since page_mapping() is not set the hugetlbfs specific routine to transfer page_private is not called and we leak the page count in the filesystem.
To fix that, check for this condition before migrating a huge page. If the condition is detected, return EBUSY for the page.
--- fs/hugetlbfs/inode.c | 12 ++++++++++++ mm/hugetlb.c | 14 ++++++++++++-- mm/migrate.c | 11 +++++++++++ 3 files changed, 35 insertions(+), 2 deletions(-)
fs/hugetlbfs/inode.c +12 -0
@@ -609,6 +609,18 @@ static int hugetlbfs_migrate_page(struct rc =migrate_huge_page_move_mapping (mapping, newpage, page);if (rc !=MIGRATEPAGE_SUCCESS )return rc; + +/* +* page_private is subpool pointer in hugetlb pages. Transfer to +* new page. PagePrivate is not associated with page_private for +* hugetlb pages and can not be set here as only page_huge_active +* pages can be migrated. +*/ +if (page_private (page)) { +set_page_private (newpage,page_private (page)); +set_page_private (page,0 ); + } +migrate_page_copy (newpage, page);return MIGRATEPAGE_SUCCESS ;
mm/hugetlb.c +12 -2
@@ -2938,7 +2938,6 @@ retry_avoidcopy:copy_user_huge_page (new_page, old_page, address, vma,pages_per_huge_page (h));__SetPageUptodate (new_page); -set_page_huge_active (new_page); mmun_start = address &huge_page_mask (h); mmun_end = mmun_start +huge_page_size (h);
@@ -2959,6 +2958,7 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1));page_remove_rmap (old_page);hugepage_add_new_anon_rmap (new_page, vma, address); +set_page_huge_active (new_page);/* Make the old page be freed below */ new_page = old_page; }
@@ -3017,6 +3017,7 @@ static int hugetlb_no_page(struct mm_strstruct page *page;pte_t new_pte;spinlock_t *ptl; +bool new_page = false;/* * Currently, we are forced to kill the process in the event the
@@ -3050,7 +3051,7 @@ retry: }clear_huge_page (page, address,pages_per_huge_page (h));__SetPageUptodate (page); -set_page_huge_active (page); + new_page = true;if (vma->vm_flags &VM_MAYSHARE ) {int err;
@@ -3126,6 +3127,15 @@ retry: }spin_unlock (ptl); + +/* +* Only make newly allocated pages active. Existing pages found +* in the pagecache could be !page_huge_active() if they have been +* isolated for migration. +*/ +if (new_page) +set_page_huge_active (page); +unlock_page (page); out:return ret;
mm/migrate.c +11 -0
@@ -1050,6 +1050,16 @@ static int unmap_and_move_huge_page(new_lock_page (hpage); } +/* +* Check for pages which are in the process of being freed. Without +* page_mapping() set, hugetlbfs specific move page routine will not +* be called and we could leak usage counts for subpools. +*/ +if (page_private (hpage) && !page_mapping (hpage)) { + rc = -EBUSY ; + goto out_unlock; + } +if (PageAnon (hpage)) anon_vma =page_get_anon_vma (hpage);
@@ -1067,6 +1077,7 @@ static int unmap_and_move_huge_page(new_if (rc ==MIGRATEPAGE_SUCCESS )hugetlb_cgroup_migrate (hpage, new_hpage); +out_unlock:unlock_page (hpage); out:if (rc != -EAGAIN )
Greg Kroah-Hartman
maintainerPATCH 54/134 media: uvcvideo: Fix type check leading to overflow
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.
When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type.
If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow.
Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it.
Originally reported here:
https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
A similar (non-compiling) patch was provided at that time.
--- drivers/media/usb/uvc/uvc_driver.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +11 -3
@@ -977,11 +977,19 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } -/* Make sure the terminal type MSB is not null, otherwise it -* could be confused with a unit. +/* +* Reject invalid terminal types that would cause issues: +* +* - The high byte must be non-zero, otherwise it would be +* confused with a unit. +* +* - Bit 15 must be 0, as we use it internally as a terminal +* direction flag. +* +* Other unknown types are accepted. */ type =get_unaligned_le16 (&buffer[4 ]); -if ((type &0xff00 ) ==0 ) { +if ((type &0x7f00 ) ==0 || (type &0x8000 ) !=0 ) { uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " "interface %d INPUT_TERMINAL %d has invalid " "type 0x%04x, skipping\n", udev->devnum,
Greg Kroah-Hartman
maintainerPATCH 55/134 vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ]
Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it.
We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error.
This patch adds compatible support for the ipip process in ipcomp virtual tunnel.
--- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
net/ipv4/ip_vti.c +50 -0
@@ -75,6 +75,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,return 0 ; } +static int vti_input_ipip (struct sk_buff *skb,int nexthdr,__be32 spi, +int encap_type) +{ +struct ip_tunnel *tunnel; +const struct iphdr *iph =ip_hdr (skb); +struct net *net =dev_net (skb->dev); +struct ip_tunnel_net *itn =net_generic (net, vti_net_id); + + tunnel =ip_tunnel_lookup (itn, skb->dev->ifindex,TUNNEL_NO_KEY , + iph->saddr, iph->daddr,0 ); +if (tunnel) { +if (!xfrm4_policy_check (NULL ,XFRM_POLICY_IN , skb)) + goto drop; + +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + +return xfrm_input (skb, nexthdr, spi, encap_type); + } + +return -EINVAL ; +drop: +kfree_skb (skb); +return 0 ; +} +static int vti_rcv (struct sk_buff *skb) {XFRM_SPI_SKB_CB (skb)->family =AF_INET ;
@@ -83,6 +110,14 @@ static int vti_rcv(struct sk_buff *skb)return vti_input (skb,ip_hdr (skb)->protocol,0 ,0 ); } +static int vti_rcv_ipip (struct sk_buff *skb) +{ +XFRM_SPI_SKB_CB (skb)->family =AF_INET ; +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct iphdr , daddr); + +return vti_input_ipip (skb,ip_hdr (skb)->protocol,ip_hdr (skb)->saddr,0 ); +} +static int vti_rcv_cb (struct sk_buff *skb,int err) {unsigned short family;
@@ -409,6 +444,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler__read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority =0 , +}; +static int __net_init vti_init_net (struct net *net) {int err;
@@ -562,6 +603,13 @@ static int __init vti_init(void)if (err <0 ) goto xfrm_proto_comp_failed; + msg ="ipip tunnel" ; + err =xfrm4_tunnel_register (&ipip_handler,AF_INET ); +if (err <0 ) { +pr_info ("%s: cant't register tunnel\n" ,__func__); + goto xfrm_tunnel_failed; + } + msg ="netlink interface" ; err =rtnl_link_register (&vti_link_ops);if (err <0 )
@@ -571,6 +619,8 @@ static int __init vti_init(void) rtnl_link_failed:xfrm4_protocol_deregister (&vti_ipcomp4_protocol,IPPROTO_COMP ); +xfrm_tunnel_failed: +xfrm4_tunnel_deregister (&ipip_handler,AF_INET ); xfrm_proto_comp_failed:xfrm4_protocol_deregister (&vti_ah4_protocol,IPPROTO_AH ); xfrm_proto_ah_failed:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 56/134 perf tools: Handle TOPOLOGY headers with no CPU
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1497e804d1a6e2bd9107ddf64b0310449f4673eb ]
This patch fixes an issue in cpumap.c when used with the TOPOLOGY header. In some configurations, some NUMA nodes may have no CPU (empty cpulist). Yet a cpumap map must be created otherwise perf abort with an error. This patch handles this case by creating a dummy map.
Before:
$ perf record -o - -e cycles noploop 2 | perf script -i - 0x6e8 [0x6c]: failed to process type: 80
After:
$ perf record -o - -e cycles noploop 2 | perf script -i - noploop for 2 seconds
--- tools/perf/util/cpumap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
tools/perf/util/cpumap.c +9 -2
@@ -121,7 +121,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (!cpu_list)return cpu_map__read_all_cpu_map (); -if (!isdigit (*cpu_list)) +/* +* must handle the case of empty cpumap to cover +* TOPOLOGY header for NUMA nodes with no CPU +* ( e.g., because of CPU hotplug) +*/ +if (!isdigit (*cpu_list) && *cpu_list !='\0' ) goto out;while (isdigit (*cpu_list)) {
@@ -168,8 +173,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (nr_cpus >0 ) cpus =cpu_map__trim_new (nr_cpus, tmp_cpus); -else +else if (*cpu_list !='\0' ) cpus =cpu_map__default_new (); +else + cpus =cpu_map__dummy_new (); invalid:free (tmp_cpus); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 57/134 ipvs: Fix signed integer overflow when setsockopt timeout
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 ]
There is a UBSAN bug report as below:
UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21
signed integer overflow:
-2147483647 * 1000 cannot be represented in type 'int'
Reproduce program:
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#define IPPROTO_IP 0
#define IPPROTO_RAW 255
#define IP_VS_BASE_CTL (64+1024+64)
#define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10)
/* The argument to IP_VS_SO_GET_TIMEOUT */
struct ipvs_timeout_t {
int tcp_timeout;
int tcp_fin_timeout;
int udp_timeout;
};
int main() {
int ret = -1;
int sockfd = -1;
struct ipvs_timeout_t to;
sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sockfd == -1) {
printf("socket init error\n");
return -1;
}
to.tcp_timeout = -2147483647;
to.tcp_fin_timeout = -2147483647;
to.udp_timeout = -2147483647;
ret = setsockopt(sockfd,
IPPROTO_IP,
IP_VS_SO_SET_TIMEOUT,
(char *)(&to),
sizeof(to));
printf("setsockopt return %d\n", ret);
return ret;
}Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
--- net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +12 -0
@@ -2182,6 +2182,18 @@ static int ip_vs_set_timeout(struct net *net, struct ip_vs_timeout_user *u) u->tcp_fin_timeout, u->udp_timeout); +#ifdef CONFIG_IP_VS_PROTO_TCP +if (u->tcp_timeout <0 || u->tcp_timeout > (INT_MAX /HZ ) || + u->tcp_fin_timeout <0 || u->tcp_fin_timeout > (INT_MAX /HZ )) { +return -EINVAL ; + } +#endif + +#ifdef CONFIG_IP_VS_PROTO_UDP +if (u->udp_timeout <0 || u->udp_timeout > (INT_MAX /HZ )) +return -EINVAL ; +#endif +#ifdef CONFIG_IP_VS_PROTO_TCP if (u->tcp_timeout) { pd =ip_vs_proto_data_get (net,IPPROTO_TCP );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 58/134 iommu/amd: Fix IOMMU page flush when detach device from a domain
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9825bd94e3a2baae1f4874767ae3a7d4c049720e ]
When a VM is terminated, the VFIO driver detaches all pass-through devices from VFIO domain by clearing domain id and page table root pointer from each device table entry (DTE), and then invalidates the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages.
Currently, the IOMMU driver keeps track of which IOMMU and how many devices are attached to the domain. When invalidate IOMMU pages, the driver checks if the IOMMU is still attached to the domain before issuing the invalidate page command.
However, since VFIO has already detached all devices from the domain, the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as there is no IOMMU attached to the domain. This results in data corruption and could cause the PCI device to end up in indeterministic state.
Fix this by invalidate IOMMU pages when detach a device, and before decrementing the per-domain device reference counts.
--- drivers/iommu/amd_iommu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iommu/amd_iommu.c +11 -4
@@ -2132,14 +2132,11 @@ static void do_attach(struct iommu_dev_data *dev_data,static void do_detach (struct iommu_dev_data *dev_data) { +struct protection_domain *domain = dev_data->domain;struct amd_iommu *iommu; iommu = amd_iommu_rlookup_table[dev_data->devid]; -/* decrease reference counters */ - dev_data->domain->dev_iommu[iommu->index] -=1 ; - dev_data->domain->dev_cnt -=1 ; -/* Update data structures */ dev_data->domain =NULL ;list_del (&dev_data->list);
@@ -2147,6 +2144,16 @@ static void do_detach(struct iommu_dev_data *dev_data)/* Flush the DTE entry */ device_flush_dte (dev_data); + +/* Flush IOTLB */ +domain_flush_tlb_pde (domain); + +/* Wait for the flushes to finish */ +domain_flush_complete (domain); + +/* decrease reference counters - needs to happen after the flushes */ + domain->dev_iommu[iommu->index] -=1 ; + domain->dev_cnt -=1 ; }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 59/134 xtensa: SMP: fix secondary CPU initialization
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 32a7726c4f4aadfabdb82440d84f88a5a2c8fe13 ]
- add missing memory barriers to the secondary CPU synchronization spin loops; add comment to the matching memory barrier in the boot_secondary and __cpu_die functions;
- use READ_ONCE/WRITE_ONCE to access cpu_start_id/cpu_start_ccount instead of reading/writing them directly;
- re-initialize cpu_running every time before starting secondary CPU to flush possible previous CPU startup results.
--- arch/xtensa/kernel/head.S | 5 ++++- arch/xtensa/kernel/smp.c | 34 +++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-)
arch/xtensa/kernel/head.S +4 -1
@@ -281,12 +281,13 @@ should_never_return: movi a2, cpu_start_ccount 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b movi a3, 0 s32i a3, a2, 0 - memw 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b wsr a3, ccount
@@ -323,11 +324,13 @@ ENTRY(cpu_restart) rsr a0, prid neg a2, a0 movi a3, cpu_start_id + memw s32i a2, a3, 0 #if XCHAL_DCACHE_IS_WRITEBACK dhwbi a3, 0 #endif 1: + memw l32i a2, a3, 0 dhi a3, 0 bne a2, a0, 1b
arch/xtensa/kernel/smp.c +21 -13
@@ -192,9 +192,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)int i;#ifdef CONFIG_HOTPLUG_CPU - cpu_start_id = cpu; -system_flush_invalidate_dcache_range ( - (unsigned long )&cpu_start_id,sizeof (cpu_start_id)); +WRITE_ONCE (cpu_start_id, cpu); +/* Pairs with the third memw in the cpu_restart */ +mb (); +system_flush_invalidate_dcache_range ((unsigned long )&cpu_start_id, +sizeof (cpu_start_id));#endif smp_call_function_single (0 , mx_cpu_start, (void *)cpu,1 );
@@ -203,18 +205,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) ccount =get_ccount ();while (!ccount); - cpu_start_ccount = ccount; +WRITE_ONCE (cpu_start_ccount, ccount); -while (time_before (jiffies, timeout)) { +do { +/* +* Pairs with the first two memws in the +* .Lboot_secondary. +*/ mb (); -if (!cpu_start_ccount) -break ; - } + ccount =READ_ONCE (cpu_start_ccount); + }while (ccount &&time_before (jiffies, timeout)); -if (cpu_start_ccount) { +if (ccount) {smp_call_function_single (0 , mx_cpu_stop, - (void *)cpu,1 ); - cpu_start_ccount =0 ; + (void *)cpu,1 ); +WRITE_ONCE (cpu_start_ccount,0 );return -EIO ; } }
@@ -234,6 +239,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)pr_debug ("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n" , __func__, cpu, idle, start_info.stack); +init_completion (&cpu_running); ret =boot_secondary (cpu, idle);if (ret ==0 ) { wait_for_completion_timeout(&cpu_running,
@@ -295,8 +301,10 @@ void __cpu_die(unsigned int cpu)unsigned long timeout = jiffies +msecs_to_jiffies (1000 );while (time_before (jiffies, timeout)) {system_invalidate_dcache_range ((unsigned long )&cpu_start_id, -sizeof (cpu_start_id)); -if (cpu_start_id == -cpu) { +sizeof (cpu_start_id)); +/* Pairs with the second memw in the cpu_restart */ +mb (); +if (READ_ONCE (cpu_start_id) == -cpu) {platform_cpu_kill (cpu);return ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 60/134 xtensa: smp_lx200_defconfig: fix vectors clash
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 306b38305c0f86de7f17c5b091a95451dcc93d7d ]
Secondary CPU reset vector overlaps part of the double exception handler code, resulting in weird crashes and hangups when running user code. Move exception vectors one page up so that they don't clash with the secondary CPU reset vector.
--- arch/xtensa/configs/smp_lx200_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/configs/smp_lx200_defconfig +1 -0
@@ -35,6 +35,7 @@ CONFIG_SMP=y CONFIG_HOTPLUG_CPU=y # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set # CONFIG_PCI is not set +CONFIG_VECTORS_OFFSET=0x00002000 CONFIG_XTENSA_PLATFORM_XTFPGA=y CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 61/134 xtensa: SMP: mark each possible CPU as present
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8b1c42cdd7181200dc1fff39dcb6ac1a3fac2c25 ]
Otherwise it is impossible to enable CPUs after booting with 'maxcpus' parameter.
--- arch/xtensa/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/smp.c +1 -1
@@ -80,7 +80,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) {unsigned i; -for (i =0 ; i < max_cpus; ++i) +for_each_possible_cpu (i)set_cpu_present (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 62/134 xtensa: SMP: limit number of possible CPUs by NR_CPUS
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 25384ce5f9530def39421597b1457d9462df6455 ]
This fixes the following warning at boot when the kernel is booted on a board with more CPU cores than was configured in NR_CPUS:
smp_init_cpus: Core Count = 8
smp_init_cpus: Core Id = 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at include/linux/cpumask.h:121 smp_init_cpus+0x54/0x74
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc3-00015-g1459333f88a0 #124
Call Trace:
__warn$part$3+0x6a/0x7c
warn_slowpath_null+0x35/0x3c
smp_init_cpus+0x54/0x74
setup_arch+0x1c0/0x1d0
start_kernel+0x44/0x310
_startup+0x107/0x107--- arch/xtensa/kernel/smp.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/xtensa/kernel/smp.c +5 -0
@@ -93,6 +93,11 @@ void __init smp_init_cpus(void)pr_info ("%s: Core Count = %d\n" , __func__, ncpus);pr_info ("%s: Core Id = %d\n" , __func__, core_id); +if (ncpus >NR_CPUS ) { + ncpus =NR_CPUS ; +pr_info ("%s: limiting core count by %d\n" , __func__, ncpus); + } +for (i =0 ; i < ncpus; ++i)set_cpu_possible (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 63/134 net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6571ebce112a21ec9be68ef2f53b96fcd41fd81b ]
If fill_level was not zero and status was not BUSY, result of "tx_prod - tx_cons - inuse" might be zero. Subtracting 1 unconditionally results invalid negative return value on this case.
Make sure not to return an negative value.
--- drivers/net/ethernet/altera/altera_msgdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_msgdma.c +2 -1
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) &0xffff ;if (inuse) {/* Tx FIFO is not empty */ - ready = priv->tx_prod - priv->tx_cons - inuse -1 ; + ready =max_t (int, + priv->tx_prod - priv->tx_cons - inuse -1 ,0 ); }else {/* Check for buffered last packet */ status =csrrd32 (priv->tx_dma_csr,msgdma_csroffs (status));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 64/134 nfs: Fix NULL pointer dereference of dev_name
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb ]
There is a NULL pointer dereference of dev_name in nfs_parse_devname()
The oops looks something like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on dev_name
--- fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/super.c +5 -0
@@ -1876,6 +1876,11 @@ static int nfs_parse_devname(const char *dev_name,size_t len;char *end; +if (unlikely (!dev_name || !*dev_name)) { +dfprintk (MOUNT ,"NFS: device name not specified\n" ); +return -EINVAL ; + } +/* Is the host name protected with square brakcets? */ if (*dev_name =='[' ) { end =strchr (++dev_name,']' );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 65/134 scsi: libfc: free skb when receiving invalid flogi resp
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 ]
The issue to be fixed in this commit is when libfc found it received a invalid FLOGI response from FC switch, it would return without freeing the fc frame, which is just the skb data. This would cause memory leak if FC switch keeps sending invalid FLOGI responses.
This fix is just to make it execute fc_frame_free(fp) before returning from function fc_lport_flogi_resp.
--- drivers/scsi/libfc/fc_lport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/libfc/fc_lport.c +3 -3
@@ -1739,14 +1739,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, fc_frame_payload_op(fp) != ELS_LS_ACC) {FC_LPORT_DBG (lport,"FLOGI not accepted or bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } flp =fc_frame_payload_get (fp,sizeof (*flp));if (!flp) {FC_LPORT_DBG (lport,"FLOGI bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1756,7 +1756,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " "lport->mfs:%hu\n" , mfs, lport->mfs);fc_lport_error (lport, fp); - goto err; + goto out; }if (mfs <= lport->mfs) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 66/134 platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0ee4b5f801b73b83a9fb3921d725f2162fd4a2e5 ]
Add BACKLIGHT_LCD_SUPPORT for SAMSUNG_Q10 to fix the
warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE.
SAMSUNG_Q10 selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT.
Copy BACKLIGHT_LCD_SUPPORT dependency into SAMSUNG_Q10 to fix:
WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE
Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]:
- SAMSUNG_Q10 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y]
--- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/Kconfig +1 -0
@@ -806,6 +806,7 @@ config INTEL_OAKTRAIL config SAMSUNG_Q10 tristate "Samsung Q10 Extras" depends on ACPI + depends on BACKLIGHT_LCD_SUPPORT select BACKLIGHT_CLASS_DEVICE ---help--- This driver provides support for backlight control on Samsung Q10
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 67/134 cifs: fix computation for MAX_SMB2_HDR_SIZE
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 58d15ed1203f4d858c339ea4d7dafa94bd2a56d3 ]
The size of the fixed part of the create response is 88 bytes not 56.
--- fs/cifs/smb2pdu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.h +2 -2
@@ -82,8 +82,8 @@#define NUMBER_OF_SMB2_COMMANDS 0x0013 -/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ -#define MAX_SMB2_HDR_SIZE 0x00b0 +/* 52 transform hdr + 64 hdr + 88 create rsp */ +#define MAX_SMB2_HDR_SIZE 204#define SMB2_PROTO_NUMBER __constant_cpu_to_le32(0x424d53fe)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 68/134 x86/kexec: Dont setup EFI info if EFI runtime is not enabled
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2aa958c99c7fd3162b089a1a56a34a0cdb778de1 ]
Kexec-ing a kernel with "efi=noruntime" on the first kernel's command line causes the following null pointer dereference:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] Call Trace: efi_runtime_map_copy+0x28/0x30 bzImage64_load+0x688/0x872 arch_kexec_kernel_image_load+0x6d/0x70 kimage_file_alloc_init+0x13e/0x220 __x64_sys_kexec_file_load+0x144/0x290 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Just skip the EFI info setup if EFI runtime services are not enabled.
[ bp: Massage commit message. ]
--- arch/x86/kernel/kexec-bzimage64.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/kexec-bzimage64.c +3 -0
@@ -167,6 +167,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,struct efi_info *current_ei = &boot_params.efi_info;struct efi_info *ei = ¶ms->efi_info; +if (!efi_enabled (EFI_RUNTIME_SERVICES )) +return 0 ; +if (!current_ei->efi_memmap_size)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 69/134 mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit efad4e475c312456edb3c789d0996d12ed744c13 ]
Patch series "mm, memory_hotplug: fix uninitialized pages fallouts", v2.
Mikhail Zaslonko has posted fixes for the two bugs quite some time ago [1]. I have pushed back on those fixes because I believed that it is much better to plug the problem at the initialization time rather than play whack-a-mole all over the hotplug code and find all the places which expect the full memory section to be initialized.
We have ended up with commit 2830bf6f05fb ("mm, memory_hotplug:
initialize struct pages for the full memory section") merged and cause a regression [2][3]. The reason is that there might be memory layouts when two NUMA nodes share the same memory section so the merged fix is simply incorrect.
In order to plug this hole we really have to be zone range aware in those handlers. I have split up the original patch into two. One is unchanged (patch 2) and I took a different approach for `removable' crash.
[1] http://lkml.kernel.org/r/[email protected]
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1666948
[3] http://lkml.kernel.org/r/[email protected]
This patch (of 2):
Mikhail has reported the following VM_BUG_ON triggered when reading sysfs removable state of a memory block:
page:000003d08300c000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: is_mem_section_removable+0xb4/0x190 show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops
The reason is that the memory block spans the zone boundary and we are stumbling over an unitialized struct page. Fix this by enforcing zone range in is_mem_section_removable so that we never run away from a zone.
--- mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +2 -1
@@ -1321,7 +1321,8 @@ static struct page *next_active_pageblock(struct page *page)int is_mem_section_removable (unsigned long start_pfn,unsigned long nr_pages) {struct page *page =pfn_to_page (start_pfn); -struct page *end_page = page + nr_pages; +unsigned long end_pfn =min (start_pfn + nr_pages,zone_end_pfn (page_zone (page))); +struct page *end_page =pfn_to_page (end_pfn);/* Check the starting page of each pageblock within the range */ for (; page < end_page; page =next_active_pageblock (page)) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 70/134 autofs: drop dentry reference only when it is never used
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ]
autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used.
--- fs/autofs4/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/autofs4/expire.c +2 -1
@@ -570,7 +570,6 @@ int autofs4_expire_run(struct super_block *sb, pkt.len = dentry->d_name.len;memcpy (pkt.name, dentry->d_name.name, pkt.len); pkt.name[pkt.len] ='\0' ; -dput (dentry);if (copy_to_user (pkt_p, &pkt,sizeof (struct autofs_packet_expire )) ) ret = -EFAULT ;
@@ -583,6 +582,8 @@ int autofs4_expire_run(struct super_block *sb,complete_all (&ino->expire_complete);spin_unlock (&sbi->fs_lock); +dput (dentry); +return ret; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 71/134 autofs: fix error return in autofs_fill_super()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f585b283e3f025754c45bbe7533fc6e5c4643700 ]
In autofs_fill_super() on error of get inode/make root dentry the return should be ENOMEM as this is the only failure case of the called functions.
--- fs/autofs4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/autofs4/inode.c +3 -1
@@ -256,8 +256,10 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) } root_inode =autofs4_get_inode (s,S_IFDIR |0755 ); root =d_make_root (root_inode); -if (!root) +if (!root) { + ret = -ENOMEM ; goto fail_ino; + } pipe =NULL ; root->d_fsdata = ino;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 72/134 ARM: pxa: ssp: unneeded to free devm_ allocated data
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba16adeb346387eb2d1ada69003588be96f098fa ]
devm_ allocated data will be automatically freed. The free of devm_ allocated data is invalid.
--- arch/arm/plat-pxa/ssp.c | 3 --- 1 file changed, 3 deletions(-)
arch/arm/plat-pxa/ssp.c +0 -3
@@ -239,8 +239,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)if (ssp ==NULL )return -ENODEV ; -iounmap (ssp->mmio_base); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );release_mem_region (res->start,resource_size (res));
@@ -250,7 +248,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)list_del (&ssp->node);mutex_unlock (&ssp_lock); -kfree (ssp);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 73/134 irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2380a22b60ce6f995eac806e69c66e397b59d045 ]
Resetting bit 4 disables the interrupt delivery to the "secure processor" core. This breaks the keyboard on a OLPC XO 1.75 laptop, where the firmware running on the "secure processor" bit-bangs the PS/2 protocol over the GPIO lines.
It is not clear what the rest of the bits are and Marvell was unhelpful when asked for documentation. Aside from the SP bit, there are probably priority bits.
Leaving the unknown bits as the firmware set them up seems to be a wiser course of action compared to just turning them off.
--- drivers/irqchip/irq-mmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-mmp.c +5 -1
@@ -35,6 +35,9 @@#define SEL_INT_PENDING (1 << 6)#define SEL_INT_NUM_MASK 0x3f +#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) +#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) +struct icu_chip_data {int nr_irqs;unsigned int virq_base;
@@ -191,7 +194,8 @@ static struct mmp_intc_conf mmp_conf = {static struct mmp_intc_conf mmp2_conf = { .conf_enable =0x20 , .conf_disable =0x0 , - .conf_mask =0x7f , + .conf_mask =MMP2_ICU_INT_ROUTE_PJ4_IRQ | +MMP2_ICU_INT_ROUTE_PJ4_FIQ , }; static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 74/134 dmaengine: dmatest: Abort test in case of mapping error
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6454368a804c4955ccd116236037536f81e5b1f1 ]
In case of mapping error the DMA addresses are invalid and continuing will screw system memory or potentially something else.
[ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0) ... [ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000 [ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b [ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf
...
Abort any test if mapping failed.
--- drivers/dma/dmatest.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-)
drivers/dma/dmatest.c +12 -16
@@ -548,11 +548,9 @@ static int dmatest_func(void *data) srcs[i] = um->addr[i] + src_off; ret =dma_mapping_error (dev->dev, um->addr[i]);if (ret) { -dmaengine_unmap_put (um);result ("src mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->to_cnt++; }
@@ -567,11 +565,9 @@ static int dmatest_func(void *data) DMA_BIDIRECTIONAL); ret =dma_mapping_error (dev->dev, dsts[i]);if (ret) { -dmaengine_unmap_put (um);result ("dst mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->bidi_cnt++; }
@@ -596,12 +592,10 @@ static int dmatest_func(void *data) }if (!tx) { -dmaengine_unmap_put (um);result ("prep error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; } done.done = false;
@@ -610,12 +604,10 @@ static int dmatest_func(void *data) cookie = tx->tx_submit (tx);if (dma_submit_error (cookie)) { -dmaengine_unmap_put (um);result ("submit error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; }dma_async_issue_pending (chan);
@@ -636,16 +628,14 @@ static int dmatest_func(void *data)dmaengine_unmap_put (um);result ("test timed out" , total_tests, src_off, dst_off, len,0 ); - failed_tests++; -continue ; + goto error_unmap_continue; }else if (status !=DMA_COMPLETE ) {dmaengine_unmap_put (um);result (status ==DMA_ERROR ?"completion error status" :"completion busy status" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; }dmaengine_unmap_put (um);
@@ -684,6 +674,12 @@ static int dmatest_func(void *data)verbose_result ("test passed" , total_tests, src_off, dst_off, len,0 ); } + +continue ; + +error_unmap_continue: +dmaengine_unmap_put (um); + failed_tests++; } runtime =ktime_us_delta (ktime_get (), ktime);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 75/134 s390/qeth: fix use-after-free in error path
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afa0c5904ba16d59b0454f7ee4c807dae350f432 ]
The error path in qeth_alloc_qdio_buffers() that takes care of cleaning up the Output Queues is buggy. It first frees the queue, but then calls qeth_clear_outq_buffers() with that very queue struct.
Make the call to qeth_clear_outq_buffers() part of the free action (in the correct order), and while at it fix the naming of the helper.
--- drivers/s390/net/qeth_core_main.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/s390/net/qeth_core_main.c +6 -9
@@ -2423,11 +2423,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)return rc; } -static void qeth_free_qdio_out_buf (struct qeth_qdio_out_q *q) +static void qeth_free_output_queue (struct qeth_qdio_out_q *q) {if (!q)return ; +qeth_clear_outq_buffers (q,1 );qdio_free_buffers (q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q );kfree (q); }
@@ -2500,10 +2501,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card) card->qdio.out_qs[i]->bufs[j] =NULL ; } out_freeoutq: -while (i >0 ) { -qeth_free_qdio_out_buf (card->qdio.out_qs[--i]); -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); - } +while (i >0 ) +qeth_free_output_queue (card->qdio.out_qs[--i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; out_freepool:
@@ -2536,10 +2535,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)qeth_free_buffer_pool (card);/* free outbound qdio_qs */ if (card->qdio.out_qs) { -for (i =0 ; i < card->qdio.no_out_queues; ++i) { -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); -qeth_free_qdio_out_buf (card->qdio.out_qs[i]); - } +for (i =0 ; i < card->qdio.no_out_queues; i++) +qeth_free_output_queue (card->qdio.out_qs[i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 76/134 perf symbols: Filter out hidden symbols from labels
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 59a17706915fe5ea6f711e1f92d4fb706bce07fe ]
When perf is built with the annobin plugin (RHEL8 build) extra symbols are added to its binary:
# nm perf | grep annobin | head -10 0000000000241100 t .annobin_annotate.c 0000000000326490 t .annobin_annotate.c 0000000000249255 t .annobin_annotate.c_end 00000000003283a8 t .annobin_annotate.c_end 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bc3e2 t .annobin_annotate.c_end.unlikely 00000000001bc400 t .annobin_annotate.c_end.unlikely 00000000001bce18 t .annobin_annotate.c.hot 00000000001bce18 t .annobin_annotate.c.hot ...
Those symbols have no use for report or annotation and should be skipped. Moreover they interfere with the DWARF unwind test on the PPC arch, where they are mixed with checked symbols and then the test fails:
# perf test dwarf -v 59: Test dwarf unwind : --- start --- test child forked, pid 8515 unwind: .annobin_dwarf_unwind.c:ip = 0x10dba40dc (0x2740dc) ... got: .annobin_dwarf_unwind.c 0x10dba40dc, expecting test__arch_unwind_sample unwind: failed with 'no error'
The annobin symbols are defined as NOTYPE/LOCAL/HIDDEN:
# readelf -s ./perf | grep annobin | head -1
40: 00000000001bce4f 0 NOTYPE LOCAL HIDDEN 13 .annobin_init.cThey can still pass the check for the label symbol. Adding check for HIDDEN and INTERNAL (as suggested by Nick below) visibility and filter out such symbols.
Quoted 4 lines
Just to be awkward, if you are going to ignore
STV_HIDDENsymbols then you should probably also ignoreSTV_INTERNALones as well... Annobin does not generate them, but you never know, one day some other tool might create some.
--- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
tools/perf/util/symbol-elf.c +8 -1
@@ -48,6 +48,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)return GELF_ST_TYPE (sym->st_info); } +static inline uint8_t elf_sym__visibility (const GElf_Sym *sym) +{ +return GELF_ST_VISIBILITY (sym->st_other); +} +#ifndef STT_GNU_IFUNC #define STT_GNU_IFUNC 10#endif
@@ -72,7 +77,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)return elf_sym__type (sym) ==STT_NOTYPE && sym->st_name !=0 && sym->st_shndx !=SHN_UNDEF && - sym->st_shndx !=SHN_ABS ; + sym->st_shndx !=SHN_ABS && +elf_sym__visibility (sym) !=STV_HIDDEN && +elf_sym__visibility (sym) !=STV_INTERNAL ; }static bool elf_sym__is_a (GElf_Sym *sym,enum map_type type)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 77/134 Input: wacom_serial4 - add support for Wacom ArtPad II tablet
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 44fc95e218a09d7966a9d448941fdb003f6bb69f upstream.
Tablet initially begins communicating at 9600 baud, so this command should be used to connect to the device:
$ inputattach --daemon --baud 9600 --wacom_iv /dev/ttyS0
https://github.com/linuxwacom/xf86-input-wacom/issues/40
--- drivers/input/tablet/wacom_serial4.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/tablet/wacom_serial4.c +2 -0
@@ -187,6 +187,7 @@ enum {MODEL_DIGITIZER_II =0x5544 ,/* UD */ MODEL_GRAPHIRE =0x4554 ,/* ET */ MODEL_PENPARTNER =0x4354 ,/* CT */ + MODEL_ARTPAD_II = 0x4B54, /* KT */ };static void wacom_handle_model_response (struct wacom *wacom)
@@ -245,6 +246,7 @@ static void wacom_handle_model_response( wacom->flags =F_HAS_STYLUS2 |F_HAS_SCROLLWHEEL ;break ; +case MODEL_ARTPAD_II :case MODEL_DIGITIZER_II : wacom->dev->name ="Wacom Digitizer II" ; wacom->dev->id.version =MODEL_DIGITIZER_II ;
Greg Kroah-Hartman
maintainerPATCH 78/134 iscsi_ibft: Fix missing break in switch statement
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit df997abeebadaa4824271009e2d2b526a70a11cb upstream.
Add missing break statement in order to prevent the code from falling through to case ISCSI_BOOT_TGT_NAME, which is unnecessary.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/firmware/iscsi_ibft.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/iscsi_ibft.c +1 -0
@@ -503,6 +503,7 @@ static umode_t __init ibft_check_tgt_forcase ISCSI_BOOT_TGT_NIC_ASSOC :case ISCSI_BOOT_TGT_CHAP_TYPE : rc =S_IRUGO ; +break ;case ISCSI_BOOT_TGT_NAME :if (tgt->tgt_name_len) rc =S_IRUGO ;
Greg Kroah-Hartman
maintainerPATCH 79/134 l2tp: fix infoleak in l2tp_ip6_recvmsg()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 163d1c3d6f17556ed3c340d3789ea93be95d6c28 ]
Back in 2013 Hannes took care of most of such leaks in commit bceaa90240b6 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
But the bug in l2tp_ip6_recvmsg() has not been fixed.
syzbot report :
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 CPU: 1 PID: 10996 Comm: syz-executor362 Not tainted 5.0.0+ #11 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600 kmsan_internal_check_memory+0x9f4/0xb10 mm/kmsan/kmsan.c:694 kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601 _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 copy_to_user include/linux/uaccess.h:174 [inline] move_addr_to_user+0x311/0x570 net/socket.c:227 ___sys_recvmsg+0xb65/0x1310 net/socket.c:2283 do_recvmmsg+0x646/0x10c0 net/socket.c:2390 __sys_recvmmsg net/socket.c:2469 [inline] __do_sys_recvmmsg net/socket.c:2492 [inline] __se_sys_recvmmsg+0x1d1/0x350 net/socket.c:2485 __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2485 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x445819 Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819 RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003 RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf
Local variable description: ----addr@___sys_recvmsg Variable was created at:
___sys_recvmsg+0xf6/0x1310 net/socket.c:2244 do_recvmmsg+0x646/0x10c0 net/socket.c:2390
Bytes 0-31 of 32 are uninitialized
Memory access of size 32 starts at ffff8880ae62fbb0 Data copied to user address 0000000020000000
--- net/l2tp/l2tp_ip6.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/l2tp/l2tp_ip6.c +1 -3
@@ -666,9 +666,6 @@ static int l2tp_ip6_recvmsg(struct kiocbif (flags &MSG_OOB ) goto out; -if (addr_len) - *addr_len =sizeof (*lsa); -if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len);
@@ -698,6 +695,7 @@ static int l2tp_ip6_recvmsg(struct kiocb lsa->l2tp_conn_id =0 ;if (ipv6_addr_type (&lsa->l2tp_addr) &IPV6_ADDR_LINKLOCAL ) lsa->l2tp_scope_id =inet6_iif (skb); + *addr_len =sizeof (*lsa); }if (np->rxopt.all)
Greg Kroah-Hartman
maintainerPATCH 80/134 net: hsr: fix memory leak in hsr_dev_finalize()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mao Wenan <[email protected]>
[ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ]
If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to add port, it directly returns res and forgets to free the node that allocated in hsr_create_self_node(), and forgets to delete the node->mac_list linked in hsr->self_node_db.
BUG: memory leak
unreferenced object 0xffff8881cfa0c780 (size 64):
comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
hex dump (first 32 bytes):
e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................
00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I.............
backtrace:
[<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
[<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
[<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
[<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
[<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
[<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
[<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
[<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
[<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
[<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
[<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
[<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
[<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
[<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
[<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
[<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
[<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e01dacb3>] 0xffffffffffffffff--- net/hsr/hsr_device.c | 4 +++- net/hsr/hsr_framereg.c | 12 ++++++++++++ net/hsr/hsr_framereg.h | 1 + 3 files changed, 16 insertions(+), 1 deletion(-)
net/hsr/hsr_device.c +3 -1
@@ -474,7 +474,7 @@ int hsr_dev_finalize(struct net_device * res =hsr_add_port (hsr, hsr_dev,HSR_PT_MASTER );if (res) -return res; + goto err_add_port; res =register_netdevice (hsr_dev);if (res)
@@ -495,6 +495,8 @@ int hsr_dev_finalize(struct net_device * fail:hsr_for_each_port (hsr, port)hsr_del_port (port); +err_add_port: +hsr_del_node (&hsr->self_node_db);return res; }
net/hsr/hsr_framereg.c +12 -0
@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_heareturn 0 ; } +void hsr_del_node (struct list_head *self_node_db) +{ +struct hsr_node *node; + +rcu_read_lock (); + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); +rcu_read_unlock (); +if (node) { +list_del_rcu (&node->mac_list); +kfree (node); + } +}/* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; * seq_out is used to initialize filtering of outgoing duplicate frames
net/hsr/hsr_framereg.h +1 -0
@@ -16,6 +16,7 @@struct hsr_node ; +void hsr_del_node (struct list_head *self_node_db);struct hsr_node *hsr_add_node (struct list_head *node_db,unsigned char addr[],u16 seq_out); struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 81/134 net: sit: fix UBSAN Undefined behaviour in check_6rd
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaohe Lin <[email protected]>
[ Upstream commit a843dc4ebaecd15fca1f4d35a97210f72ea1473b ]
In func check_6rd,tunnel->ip6rd.relay_prefixlen may equal to 32,so UBSAN complain about it.
UBSAN: Undefined behaviour in net/ipv6/sit.c:781:47 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 6 PID: 20036 Comm: syz-executor.0 Not tainted 4.19.27 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 ubsan_epilogue+0xe/0x81 lib/ubsan.c:159 __ubsan_handle_shift_out_of_bounds+0x293/0x2e8 lib/ubsan.c:425 check_6rd.constprop.9+0x433/0x4e0 net/ipv6/sit.c:781 try_6rd net/ipv6/sit.c:806 [inline] ipip6_tunnel_xmit net/ipv6/sit.c:866 [inline] sit_tunnel_xmit+0x141c/0x2720 net/ipv6/sit.c:1033 __netdev_start_xmit include/linux/netdevice.h:4300 [inline] netdev_start_xmit include/linux/netdevice.h:4309 [inline] xmit_one net/core/dev.c:3243 [inline] dev_hard_start_xmit+0x17c/0x780 net/core/dev.c:3259 __dev_queue_xmit+0x1656/0x2500 net/core/dev.c:3829 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0xa36/0x2290 net/ipv6/ip6_output.c:120 ip6_finish_output+0x3e7/0xa20 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x1e2/0x720 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0x99/0x170 net/ipv6/output_core.c:176 ip6_send_skb+0x9d/0x2f0 net/ipv6/ip6_output.c:1697 ip6_push_pending_frames+0xc0/0x100 net/ipv6/ip6_output.c:1717 rawv6_push_pending_frames net/ipv6/raw.c:616 [inline] rawv6_sendmsg+0x2435/0x3530 net/ipv6/raw.c:946 inet_sendmsg+0xf8/0x5c0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xc8/0x110 net/socket.c:631 ___sys_sendmsg+0x6cf/0x890 net/socket.c:2114 __sys_sendmsg+0xf0/0x1b0 net/socket.c:2152 do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/ipv6/sit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv6/sit.c +3 -2
@@ -771,8 +771,9 @@ static bool check_6rd(struct ip_tunnel * pbw0 = tunnel->ip6rd.prefixlen >>5 ; pbi0 = tunnel->ip6rd.prefixlen &0x1f ; - d = (ntohl (v6dst->s6_addr32[pbw0]) << pbi0) >> - tunnel->ip6rd.relay_prefixlen; + d = tunnel->ip6rd.relay_prefixlen <32 ? + (ntohl (v6dst->s6_addr32[pbw0]) << pbi0) >> + tunnel->ip6rd.relay_prefixlen :0 ; pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;if (pbi1 >0 )
Greg Kroah-Hartman
maintainerPATCH 82/134 net/x25: fix use-after-free in x25_device_event()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 95d6ebd53c79522bf9502dbc7e89e0d63f94dae4 ]
In case of failure x25_connect() does a x25_neigh_put(x25->neighbour) but forgets to clear x25->neighbour pointer, thus triggering use-after-free.
Since the socket is visible in x25_list, we need to hold x25_list_lock to protect the operation.
syzbot report :
BUG: KASAN: use-after-free in x25_kill_by_device net/x25/af_x25.c:217 [inline] BUG: KASAN: use-after-free in x25_device_event+0x296/0x2b0 net/x25/af_x25.c:252 Read of size 8 at addr ffff8880a030edd0 by task syz-executor003/7854 CPU: 0 PID: 7854 Comm: syz-executor003 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 x25_kill_by_device net/x25/af_x25.c:217 [inline] x25_device_event+0x296/0x2b0 net/x25/af_x25.c:252 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] __dev_notify_flags+0x1e9/0x2c0 net/core/dev.c:7607 dev_change_flags+0x10d/0x170 net/core/dev.c:7643 dev_ifsioc+0x2b0/0x940 net/core/dev_ioctl.c:237 dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:488 sock_do_ioctl+0x1bd/0x300 net/socket.c:995 sock_ioctl+0x32b/0x610 net/socket.c:1096 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4467c9 Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fdbea222d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 00000000004467c9 RDX: 0000000020000340 RSI: 0000000000008914 RDI: 0000000000000003 RBP: 00000000006dbc50 R08: 00007fdbea223700 R09: 0000000000000000 R10: 00007fdbea223700 R11: 0000000000000246 R12: 00000000006dbc5c R13: 6000030030626669 R14: 0000000000000000 R15: 0000000030626669 Allocated by task 7843: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:468 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:509 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3615 kmalloc include/linux/slab.h:545 [inline] x25_link_device_up+0x46/0x3f0 net/x25/x25_link.c:249 x25_device_event+0x116/0x2b0 net/x25/af_x25.c:242 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] __dev_notify_flags+0x121/0x2c0 net/core/dev.c:7605 dev_change_flags+0x10d/0x170 net/core/dev.c:7643 dev_ifsioc+0x2b0/0x940 net/core/dev_ioctl.c:237 dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:488 sock_do_ioctl+0x1bd/0x300 net/socket.c:995 sock_ioctl+0x32b/0x610 net/socket.c:1096 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7865: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:457 kasan_slab_free+0xe/0x10 mm/kasan/common.c:465 __cache_free mm/slab.c:3494 [inline] kfree+0xcf/0x230 mm/slab.c:3811 x25_neigh_put include/net/x25.h:253 [inline] x25_connect+0x8d8/0xde0 net/x25/af_x25.c:824 __sys_connect+0x266/0x330 net/socket.c:1685 __do_sys_connect net/socket.c:1696 [inline] __se_sys_connect net/socket.c:1693 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1693 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a030edc0 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 16 bytes inside of 256-byte region [ffff8880a030edc0, ffff8880a030eec0) The buggy address belongs to the page: page:ffffea000280c380 count:1 mapcount:0 mapping:ffff88812c3f07c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002806788 ffffea00027f0188 ffff88812c3f07c0 raw: 0000000000000000 ffff8880a030e000 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected
--- net/x25/af_x25.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/x25/af_x25.c +5 -1
@@ -812,8 +812,12 @@ static int x25_connect(struct socket *so sock->state =SS_CONNECTED ; rc =0 ; out_put_neigh: -if (rc) +if (rc) { +read_lock_bh (&x25_list_lock);x25_neigh_put (x25->neighbour); + x25->neighbour =NULL ; +read_unlock_bh (&x25_list_lock); + } out_put_route:x25_route_put (rt); out:
Greg Kroah-Hartman
maintainerPATCH 83/134 net/x25: reset state in x25_connect()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ee74d0bd4325efb41e38affe5955f920ed973f23 ]
In case x25_connect() fails and frees the socket neighbour, we also need to undo the change done to x25->state.
Before my last bug fix, we had use-after-free so this patch fixes a latent bug.
syzbot report :
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 16137 Comm: syz-executor.1 Not tainted 5.0.0+ #117 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:x25_write_internal+0x1e8/0xdf0 net/x25/x25_subr.c:173 Code: 00 40 88 b5 e0 fe ff ff 0f 85 01 0b 00 00 48 8b 8b 80 04 00 00 48 ba 00 00 00 00 00 fc ff df 48 8d 79 1c 48 89 fe 48 c1 ee 03 <0f> b6 34 16 48 89 fa 83 e2 07 83 c2 03 40 38 f2 7c 09 40 84 f6 0f RSP: 0018:ffff888076717a08 EFLAGS: 00010207 RAX: ffff88805f2f2292 RBX: ffff8880a0ae6000 RCX: 0000000000000000 kobject: 'loop5' (0000000018d0d0ee): kobject_uevent_env RDX: dffffc0000000000 RSI: 0000000000000003 RDI: 000000000000001c RBP: ffff888076717b40 R08: ffff8880950e0580 R09: ffffed100be5e46d R10: ffffed100be5e46c R11: ffff88805f2f2363 R12: ffff888065579840 kobject: 'loop5' (0000000018d0d0ee): fill_kobj_path: path = '/devices/virtual/block/loop5' R13: 1ffff1100ece2f47 R14: 0000000000000013 R15: 0000000000000013 FS: 00007fb88cf43700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9a42a41028 CR3: 0000000087a67000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: x25_release+0xd0/0x340 net/x25/af_x25.c:658 __sock_release+0xd3/0x2b0 net/socket.c:579 sock_close+0x1b/0x30 net/socket.c:1162 __fput+0x2df/0x8d0 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x14a/0x1c0 kernel/task_work.c:113 get_signal+0x1961/0x1d50 kernel/signal.c:2388 do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457f29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fb88cf42c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 0000000000457f29 RDX: 0000000000000012 RSI: 0000000020000080 RDI: 0000000000000004 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb88cf436d4 R13: 00000000004be462 R14: 00000000004cec98 R15: 00000000ffffffff Modules linked in:
--- net/x25/af_x25.c | 1 + 1 file changed, 1 insertion(+)
net/x25/af_x25.c +1 -0
@@ -817,6 +817,7 @@ out_put_neigh:x25_neigh_put (x25->neighbour); x25->neighbour =NULL ;read_unlock_bh (&x25_list_lock); + x25->state =X25_STATE_0 ; } out_put_route:x25_route_put (rt);
Greg Kroah-Hartman
maintainerPATCH 84/134 pptp: dst_release sk_dst_cache in pptp_sock_destruct
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 9417d81f4f8adfe20a12dd1fadf73a618cbd945d ]
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect, so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct, otherwise, the dst refcnt will leak.
It can be reproduced by this syz log:
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
Consecutive dmesg warnings will occur:
unregister_netdevice: waiting for lo to become free. Usage count = 1
v1->v2:
- use rcu_dereference_protected() instead of rcu_dereference_check(), as suggested by Eric.
--- drivers/net/ppp/pptp.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ppp/pptp.c +1 -0
@@ -564,6 +564,7 @@ static void pptp_sock_destruct(struct sopppox_unbind_sock (sk); }skb_queue_purge (&sk->sk_receive_queue); +dst_release (rcu_dereference_protected (sk->sk_dst_cache,1 )); }static int pptp_create (struct net *net,struct socket *sock)
Greg Kroah-Hartman
maintainerPATCH 85/134 net/mlx4_core: Fix qp mtt size calculation
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <[email protected]>
[ Upstream commit 8511a653e9250ef36b95803c375a7be0e2edb628 ]
Calculation of qp mtt size (in function mlx4_RST2INIT_wrapper) ultimately depends on function roundup_pow_of_two.
If the amount of memory required by the QP is less than one page, roundup_pow_of_two is called with argument zero. In this case, the roundup_pow_of_two result is undefined.
Calling roundup_pow_of_two with a zero argument resulted in the following stack trace:
UBSAN: Undefined behaviour in ./include/linux/log2.h:61:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 4 PID: 26939 Comm: rping Tainted: G OE 4.19.0-rc1 Hardware name: Supermicro X9DR3-F/X9DR3-F, BIOS 3.2a 07/09/2015 Call Trace: dump_stack+0x9a/0xeb ubsan_epilogue+0x9/0x7c __ubsan_handle_shift_out_of_bounds+0x254/0x29d ? __ubsan_handle_load_invalid_value+0x180/0x180 ? debug_show_all_locks+0x310/0x310 ? sched_clock+0x5/0x10 ? sched_clock+0x5/0x10 ? sched_clock_cpu+0x18/0x260 ? find_held_lock+0x35/0x1e0 ? mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core] mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]
Fix this by explicitly testing for zero, and returning one if the argument is zero (assuming that the next higher power of 2 in this case should be one).
--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +3 -3
@@ -2474,13 +2474,13 @@ static int qp_get_mtt_size(struct mlx4_qint total_pages;int total_mem;int page_offset = (be32_to_cpu (qpc->params2) >>6 ) &0x3f ; +int tot; sq_size =1 << (log_sq_size + log_sq_sride +4 ); rq_size = (srq|rss|xrc) ?0 : (1 << (log_rq_size + log_rq_stride +4 )); total_mem = sq_size + rq_size; - total_pages = -roundup_pow_of_two ((total_mem + (page_offset <<6 )) >> - page_shift); + tot = (total_mem + (page_offset <<6 )) >> page_shift; + total_pages = !tot ?1 :roundup_pow_of_two (tot);return total_pages; }
Greg Kroah-Hartman
maintainerPATCH 86/134 net/x25: fix a race in x25_bind()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 797a22bd5298c2674d927893f46cadf619dad11d ]
syzbot was able to trigger another soft lockup [1]
I first thought it was the O(N^2) issue I mentioned in my prior fix (f657d22ee1f "net/x25: do not hold the cpu too long in x25_new_lci()"), but I eventually found that x25_bind() was not checking SOCK_ZAPPED state under socket lock protection.
This means that multiple threads can end up calling x25_insert_socket() for the same socket, and corrupt x25_list
[1]
watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.2:10492] Modules linked in: irq event stamp: 27515 hardirqs last enabled at (27514): [<ffffffff81006673>] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (27515): [<ffffffff8100668f>] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (32): [<ffffffff8632ee73>] x25_get_neigh+0xa3/0xd0 net/x25/x25_link.c:336 softirqs last disabled at (34): [<ffffffff86324bc3>] x25_find_socket+0x23/0x140 net/x25/af_x25.c:341 CPU: 0 PID: 10492 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:97 Code: f4 ff ff ff e8 11 9f ea ff 48 c7 05 12 fb e5 08 00 00 00 00 e9 c8 e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 <48> 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 38 0c 92 7e 81 e2 RSP: 0018:ffff88806e94fc48 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1100d84dac5 RBX: 0000000000000001 RCX: ffffc90006197000 RDX: 0000000000040000 RSI: ffffffff86324bf3 RDI: ffff88806c26d628 RBP: ffff88806e94fc48 R08: ffff88806c1c6500 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: ffff88806c26d628 R13: ffff888090455200 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f3a107e4700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3a107e3db8 CR3: 00000000a5544000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __x25_find_socket net/x25/af_x25.c:327 [inline] x25_find_socket+0x7d/0x140 net/x25/af_x25.c:342 x25_new_lci net/x25/af_x25.c:355 [inline] x25_connect+0x380/0xde0 net/x25/af_x25.c:784 __sys_connect+0x266/0x330 net/socket.c:1662 __do_sys_connect net/socket.c:1673 [inline] __se_sys_connect net/socket.c:1670 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1670 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3a107e3c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000005 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a107e46d4 R13: 00000000004be362 R14: 00000000004ceb98 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10493 Comm: syz-executor.3 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:queued_write_lock_slowpath+0x143/0x290 kernel/locking/qrwlock.c:86 Code: 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 41 0f b6 55 00 <41> 38 d7 7c eb 84 d2 74 e7 48 89 df e8 cc aa 4e 00 eb dd be 04 00 RSP: 0018:ffff888085c47bd8 EFLAGS: 00000206 RAX: 0000000000000300 RBX: ffffffff89412b00 RCX: 1ffffffff1282560 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89412b00 RBP: ffff888085c47c70 R08: 1ffffffff1282560 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: 00000000000000ff R13: fffffbfff1282560 R14: 1ffff11010b88f7d R15: 0000000000000003 FS: 00007fdd04086700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd04064db8 CR3: 0000000090be0000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:104 [inline] do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203 __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline] _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312 x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267 x25_bind+0x273/0x340 net/x25/af_x25.c:703 __sys_bind+0x23f/0x290 net/socket.c:1481 __do_sys_bind net/socket.c:1492 [inline] __se_sys_bind net/socket.c:1490 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1490 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29
--- net/x25/af_x25.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/x25/af_x25.c +8 -5
@@ -678,8 +678,7 @@ static int x25_bind(struct socket *sock,struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;int len, i, rc =0 ; -if (!sock_flag (sk,SOCK_ZAPPED ) || - addr_len !=sizeof (struct sockaddr_x25 ) || +if (addr_len !=sizeof (struct sockaddr_x25 ) || addr->sx25_family !=AF_X25 ) { rc = -EINVAL ; goto out;
@@ -694,9 +693,13 @@ static int x25_bind(struct socket *sock, }lock_sock (sk); -x25_sk (sk)->source_addr = addr->sx25_addr; -x25_insert_socket (sk); -sock_reset_flag (sk,SOCK_ZAPPED ); +if (sock_flag (sk,SOCK_ZAPPED )) { +x25_sk (sk)->source_addr = addr->sx25_addr; +x25_insert_socket (sk); +sock_reset_flag (sk,SOCK_ZAPPED ); + }else { + rc = -EINVAL ; + }release_sock (sk);SOCK_DEBUG (sk,"x25_bind: socket is bound\n" ); out:
Greg Kroah-Hartman
maintainerPATCH 87/134 mdio_bus: Fix use-after-free on device_register fails
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 6ff7b060535e87c2ae14dd8548512abfdda528fb ]
KASAN has found use-after-free in fixed_mdio_bus_init, commit 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") call put_device() while device_register() fails,give up the last reference to the device and allow mdiobus_release to be executed ,kfreeing the bus. However in most drives, mdiobus_free be called to free the bus while mdiobus_register fails. use-after-free occurs when access bus again, this patch revert it to let mdiobus_free free the bus.
KASAN report details as below:
BUG: KASAN: use-after-free in mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482
Read of size 4 at addr ffff8881dc824d78 by task syz-executor.0/3524
CPU: 1 PID: 3524 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xfa/0x1ce lib/dump_stack.c:113
print_address_description+0x65/0x270 mm/kasan/report.c:187
kasan_report+0x149/0x18d mm/kasan/report.c:317
mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482
fixed_mdio_bus_init+0x283/0x1000 [fixed_phy]
? 0xffffffffc0e40000
? 0xffffffffc0e40000
? 0xffffffffc0e40000
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6215c19c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00007f6215c19c70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6215c1a6bc
R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
Allocated by task 3524:
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:496
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
mdiobus_alloc_size+0x54/0x1b0 drivers/net/phy/mdio_bus.c:143
fixed_mdio_bus_init+0x163/0x1000 [fixed_phy]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3524:
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:458
slab_free_hook mm/slub.c:1409 [inline]
slab_free_freelist_hook mm/slub.c:1436 [inline]
slab_free mm/slub.c:2986 [inline]
kfree+0xe1/0x270 mm/slub.c:3938
device_release+0x78/0x200 drivers/base/core.c:919
kobject_cleanup lib/kobject.c:662 [inline]
kobject_release lib/kobject.c:691 [inline]
kref_put include/linux/kref.h:67 [inline]
kobject_put+0x146/0x240 lib/kobject.c:708
put_device+0x1c/0x30 drivers/base/core.c:2060
__mdiobus_register+0x483/0x560 drivers/net/phy/mdio_bus.c:382
fixed_mdio_bus_init+0x26b/0x1000 [fixed_phy]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881dc824c80
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 248 bytes inside of
2048-byte region [ffff8881dc824c80, ffff8881dc825480)
The buggy address belongs to the page:
page:ffffea0007720800 count:1 mapcount:0 mapping:ffff8881f6c02800 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000010200(slab|head)
raw: 02fffc0000010200 0000000000000000 0000000500000001 ffff8881f6c02800
raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881dc824c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881dc824c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881dc824d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881dc824d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881dc824e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/mdio_bus.c +0 -1
@@ -261,7 +261,6 @@ int mdiobus_register(struct mii_bus *bus err =device_register (&bus->dev);if (err) {pr_err ("mii_bus %s failed to register\n" , bus->id); -put_device (&bus->dev);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 88/134 net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalash Nainwal <[email protected]>
[ Upstream commit 97f0082a0592212fc15d4680f5a4d80f79a1687c ]
Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 to keep legacy software happy. This is similar to what was done for ipv4 in commit 709772e6e065 ("net: Fix routing tables with id > 255 for legacy software").
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -2558,7 +2558,7 @@ static int rt6_fill_node(struct net *net table = rt->rt6i_table->tb6_id; else table =RT6_TABLE_UNSPEC ; - rtm->rtm_table = table; + rtm->rtm_table = table <256 ? table :RT_TABLE_COMPAT ;if (nla_put_u32 (skb,RTA_TABLE , table)) goto nla_put_failure;if (rt->rt6i_flags &RTF_REJECT ) {
Greg Kroah-Hartman
maintainerPATCH 89/134 missing barriers in some of unix_sock ->addr and ->path accesses
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit ae3b564179bfd06f32d051b9e5d72ce4b2a07c37 ]
Several u->addr and u->path users are not holding any locks in common with unix_bind(). unix_state_lock() is useless for those purposes.
u->addr is assign-once and *(u->addr) is fully set up by the time we set u->addr (all under unix_table_lock). u->path is also set in the same critical area, also before setting u->addr, and any unix_sock with ->path filled will have non-NULL ->addr.
So setting ->addr with smp_store_release() is all we need for those "lockless" users - just have them fetch ->addr with smp_load_acquire() and don't even bother looking at ->path if they see NULL ->addr.
Users of ->addr and ->path fall into several classes now:
1) ones that do smp_load_acquire(u->addr) and access *(u->addr)
and u->path only if smp_load_acquire() has returned non-NULL.
2) places holding unix_table_lock. These are guaranteed that
*(u->addr) is seen fully initialized. If unix_sock is in one of the "bound" chains, so's ->path.
3) unix_sock_destructor() using ->addr is safe. All places
that set u->addr are guaranteed to have seen all stores *(u->addr) while holding a reference to u and unix_sock_destructor() is called when (atomic) refcount hits zero.
4) unix_release_sock() using ->path is safe. unix_bind()
is serialized wrt unix_release() (normally - by struct file refcount), and for the instances that had ->path set by unix_bind() unix_release_sock() comes from unix_release(), so they are fine. Instances that had it set in unix_stream_connect() either end up attached to a socket (in unix_accept()), in which case the call chain to unix_release_sock() and serialization are the same as in the previous case, or they never get accept'ed and unix_release_sock() is called when the listener is shut down and its queue gets purged. In that case the listener's queue lock provides the barriers needed - unix_stream_connect() shoves our unix_sock into listener's queue under that lock right after having set ->path and eventual unix_release_sock() caller picks them from that queue under the same lock right before calling unix_release_sock().
5) unix_find_other() use of ->path is pointless, but safe -
it happens with successful lookup by (abstract) name, so ->path.dentry is guaranteed to be NULL there.
--- net/unix/af_unix.c | 48 +++++++++++++++++++++++++++++------------------- net/unix/diag.c | 3 ++- security/lsm_audit.c | 10 ++++++---- 3 files changed, 37 insertions(+), 24 deletions(-)
net/unix/af_unix.c +29 -19
@@ -876,7 +876,7 @@ retry: addr->hash ^= sk->sk_type;__unix_remove_socket (sk); - u->addr = addr; +smp_store_release (&u->addr, addr);__unix_insert_socket (&unix_socket_table[addr->hash], sk);spin_unlock (&unix_table_lock); err =0 ;
@@ -1045,7 +1045,7 @@ static int unix_bind(struct socket *sock err =0 ;__unix_remove_socket (sk); - u->addr = addr; +smp_store_release (&u->addr, addr);__unix_insert_socket (list, sk); out_unlock:
@@ -1312,15 +1312,29 @@ restart:RCU_INIT_POINTER (newsk->sk_wq, &newu->peer_wq); otheru =unix_sk (other); -/* copy address information from listening to new sock*/ -if (otheru->addr) { -atomic_inc (&otheru->addr->refcnt); - newu->addr = otheru->addr; - } +/* copy address information from listening to new sock +* +* The contents of *(otheru->addr) and otheru->path +* are seen fully set up here, since we have found +* otheru in hash under unix_table_lock. Insertion +* into the hash chain we'd found it in had been done +* in an earlier critical area protected by unix_table_lock, +* the same one where we'd set *(otheru->addr) contents, +* as well as otheru->path and otheru->addr itself. +* +* Using smp_store_release() here to set newu->addr +* is enough to make those stores, as well as stores +* to newu->path visible to anyone who gets newu->addr +* by smp_load_acquire(). IOW, the same warranties +* as for unix_sock instances bound in unix_bind() or +* in unix_autobind(). +*/ if (otheru->path.dentry) {path_get (&otheru->path); newu->path = otheru->path; } +atomic_inc (&otheru->addr->refcnt); +smp_store_release (&newu->addr, otheru->addr);/* Set credentials */ copy_peercred (sk, other);
@@ -1433,7 +1447,7 @@ out:static int unix_getname (struct socket *sock,struct sockaddr *uaddr,int *uaddr_len,int peer) {struct sock *sk = sock->sk; -struct unix_sock *u; +struct unix_address *addr; DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);int err =0 ;
@@ -1448,19 +1462,15 @@ static int unix_getname(struct socket *ssock_hold (sk); } - u =unix_sk (sk); -unix_state_lock (sk); -if (!u->addr) { + addr =smp_load_acquire (&unix_sk (sk)->addr); +if (!addr) { sunaddr->sun_family =AF_UNIX ; sunaddr->sun_path[0 ] =0 ; *uaddr_len =sizeof (short ); }else { -struct unix_address *addr = u->addr; - *uaddr_len = addr->len;memcpy (sunaddr, addr->name, *uaddr_len); } -unix_state_unlock (sk);sock_put (sk); out:return err;
@@ -1936,11 +1946,11 @@ static int unix_seqpacket_recvmsg(structstatic void unix_copy_addr (struct msghdr *msg,struct sock *sk) { -struct unix_sock *u =unix_sk (sk); +struct unix_address *addr =smp_load_acquire (&unix_sk (sk)->addr); -if (u->addr) { - msg->msg_namelen = u->addr->len; -memcpy (msg->msg_name, u->addr->name, u->addr->len); +if (addr) { + msg->msg_namelen = addr->len; +memcpy (msg->msg_name, addr->name, addr->len); } }
@@ -2551,7 +2561,7 @@ static int unix_seq_show(struct seq_file (s->sk_state ==TCP_ESTABLISHED ?SS_CONNECTING :SS_DISCONNECTING ), sock_i_ino(s)); -if (u->addr) { +if (u->addr) {// under unix_table_lock here int i, len;seq_putc (seq,' ' );
net/unix/diag.c +2 -1
@@ -10,7 +10,8 @@static int sk_diag_dump_name (struct sock *sk,struct sk_buff *nlskb) { -struct unix_address *addr =unix_sk (sk)->addr; +/* might or might not have unix_table_lock */ +struct unix_address *addr =smp_load_acquire (&unix_sk (sk)->addr);if (!addr)return 0 ;
security/lsm_audit.c +6 -4
@@ -290,6 +290,7 @@ static void dump_common_audit_data(strucif (a->u.net->sk) {struct sock *sk = a->u.net->sk;struct unix_sock *u; +struct unix_address *addr;int len =0 ;char *p =NULL ;
@@ -320,14 +321,15 @@ static void dump_common_audit_data(struc#endif case AF_UNIX : u =unix_sk (sk); + addr =smp_load_acquire (&u->addr); +if (!addr) +break ;if (u->path.dentry) {audit_log_d_path (ab," path=" , &u->path);break ; } -if (!u->addr) -break ; - len = u->addr->len-sizeof (short ); - p = &u->addr->name->sun_path[0 ]; + len = addr->len-sizeof (short ); + p = &addr->name->sun_path[0 ];audit_log_format (ab," path=" );if (*p)audit_log_untrustedstring (ab, p);
Greg Kroah-Hartman
maintainerPATCH 90/134 vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 59cbf56fcd98ba2a715b6e97c4e43f773f956393 ]
Same reasons than the ones explained in commit 4179cb5a4c92 ("vxlan: test dev->flags & IFF_UP before calling netif_rx()")
netif_rx() or gro_cells_receive() must be called under a strict contract.
At device dismantle phase, core networking clears IFF_UP and flush_all_backlogs() is called after rcu grace period to make sure no incoming packet might be in a cpu backlog and still referencing the device.
A similar protocol is used for gro_cells infrastructure, as gro_cells_destroy() will be called only after a full rcu grace period is observed after IFF_UP has been cleared.
Most drivers call netif_rx() from their interrupt handler, and since the interrupts are disabled at device dismantle, netif_rx() does not have to check dev->flags & IFF_UP
Virtual drivers do not have this guarantee, and must therefore make the check themselves.
Otherwise we risk use-after-free and/or crashes.
--- drivers/net/vxlan.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/vxlan.c +10 -0
@@ -1238,6 +1238,14 @@ static void vxlan_rcv(struct vxlan_sock } } +rcu_read_lock (); + +if (unlikely (!(vxlan->dev->flags &IFF_UP ))) { +rcu_read_unlock (); +atomic_long_inc (&vxlan->dev->rx_dropped); + goto drop; + } + stats =this_cpu_ptr (vxlan->dev->tstats);u64_stats_update_begin (&stats->syncp); stats->rx_packets++;
@@ -1246,6 +1254,8 @@ static void vxlan_rcv(struct vxlan_socknetif_rx (skb); +rcu_read_unlock (); +return ; drop:/* Consume bad packet */
Greg Kroah-Hartman
maintainerPATCH 91/134 net/hsr: fix possible crash in add_timer()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1e027960edfaa6a43f9ca31081729b716598112b ]
syzbot found another add_timer() issue, this time in net/hsr [1]
Let's use mod_timer() which is safe.
[1]
kernel BUG at kernel/time/timer.c:1136!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15909 Comm: syz-executor.3 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'loop2' (00000000f5629718): kobject_uevent_env RIP: 0010:add_timer kernel/time/timer.c:1136 [inline] RIP: 0010:add_timer+0x654/0xbe0 kernel/time/timer.c:1134 Code: 0f 94 c5 31 ff 44 89 ee e8 09 61 0f 00 45 84 ed 0f 84 77 fd ff ff e8 bb 5f 0f 00 e8 07 10 a0 ff e9 68 fd ff ff e8 ac 5f 0f 00 <0f> 0b e8 a5 5f 0f 00 0f 0b e8 9e 5f 0f 00 4c 89 b5 58 ff ff ff e9 RSP: 0018:ffff8880656eeca0 EFLAGS: 00010246 kobject: 'loop2' (00000000f5629718): fill_kobj_path: path = '/devices/virtual/block/loop2' RAX: 0000000000040000 RBX: 1ffff1100caddd9a RCX: ffffc9000c436000 RDX: 0000000000040000 RSI: ffffffff816056c4 RDI: ffff88806a2f6cc8 RBP: ffff8880656eed58 R08: ffff888067f4a300 R09: ffff888067f4abc8 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806a2f6cc0 R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880656eed30 FS: 00007fc2019bf700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000738000 CR3: 0000000067e8e000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hsr_check_announce net/hsr/hsr_device.c:99 [inline] hsr_check_carrier_and_operstate+0x567/0x6f0 net/hsr/hsr_device.c:120 hsr_netdev_notify+0x297/0xa00 net/hsr/hsr_main.c:51 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] dev_open net/core/dev.c:1436 [inline] dev_open+0x143/0x160 net/core/dev.c:1424 team_port_add drivers/net/team/team.c:1203 [inline] team_add_slave+0xa07/0x15d0 drivers/net/team/team.c:1933 do_set_master net/core/rtnetlink.c:2358 [inline] do_set_master+0x1d4/0x230 net/core/rtnetlink.c:2332 do_setlink+0x966/0x3510 net/core/rtnetlink.c:2493 rtnl_setlink+0x271/0x3b0 net/core/rtnetlink.c:2747 rtnetlink_rcv_msg+0x465/0xb00 net/core/rtnetlink.c:5192 netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2485 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5210 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1925 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:632 sock_write_iter+0x27c/0x3e0 net/socket.c:923 call_write_iter include/linux/fs.h:1869 [inline] do_iter_readv_writev+0x5e0/0x8e0 fs/read_write.c:680 do_iter_write fs/read_write.c:956 [inline] do_iter_write+0x184/0x610 fs/read_write.c:937 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1001 do_writev+0xf6/0x290 fs/read_write.c:1036 __do_sys_writev fs/read_write.c:1109 [inline] __se_sys_writev fs/read_write.c:1106 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1106 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457f29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc2019bec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 RDX: 0000000000000001 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc2019bf6d4 R13: 00000000004c4a60 R14: 00000000004dd218 R15: 00000000ffffffff
--- net/hsr/hsr_device.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
net/hsr/hsr_device.c +6 -8
@@ -93,9 +93,8 @@ static void hsr_check_announce(struct neif ((hsr_dev->operstate ==IF_OPER_UP ) && (old_operstate !=IF_OPER_UP )) {/* Went up */ hsr->announce_count =0 ; - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL ); -add_timer (&hsr->announce_timer); +mod_timer (&hsr->announce_timer, + jiffies +msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL )); }if ((hsr_dev->operstate !=IF_OPER_UP ) && (old_operstate ==IF_OPER_UP ))
@@ -323,6 +322,7 @@ static void hsr_announce(unsigned long d {struct hsr_priv *hsr;struct hsr_port *master; +unsigned long interval; hsr = (struct hsr_priv *) data;
@@ -337,14 +337,12 @@ static void hsr_announce(unsigned long d }if (hsr->announce_count <3 ) - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL ); + interval =msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL );else - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_LIFE_CHECK_INTERVAL ); + interval =msecs_to_jiffies (HSR_LIFE_CHECK_INTERVAL );if (is_admin_up (master->dev)) -add_timer (&hsr->announce_timer); +mod_timer (&hsr->announce_timer, jiffies + interval);rcu_read_unlock (); }
Greg Kroah-Hartman
maintainerPATCH 92/134 gro_cells: make sure device is up in gro_cells_receive()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2a5ff07a0eb945f291e361aa6f6becca8340ba46 ]
We keep receiving syzbot reports [1] that show that tunnels do not play the rcu/IFF_UP rules properly.
At device dismantle phase, gro_cells_destroy() will be called only after a full rcu grace period is observed after IFF_UP has been cleared.
This means that IFF_UP needs to be tested before queueing packets into netif_rx() or gro_cells.
This patch implements the test in gro_cells_receive() because too many callers do not seem to bother enough.
[1]
BUG: unable to handle kernel paging request at fffff4ca0b9ffffe PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 kobject: 'loop2' (000000004bd7d84a): kobject_uevent_env FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0 Call Trace: kobject: 'loop2' (000000004bd7d84a): fill_kobj_path: path = '/devices/virtual/block/loop2' ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1010 netdev_run_todo+0x51c/0x7d0 net/core/dev.c:8970 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:116 ip_tunnel_delete_nets+0x423/0x5f0 net/ipv4/ip_tunnel.c:1124 vti_exit_batch_net+0x23/0x30 net/ipv4/ip_vti.c:495 ops_exit_list.isra.0+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x3fb/0x960 net/core/net_namespace.c:551 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173 worker_thread+0x98/0xe40 kernel/workqueue.c:2319 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: CR2: fffff4ca0b9ffffe [ end trace 513fc9c1338d1cb3 ] RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 kobject: 'loop3' (00000000e4ee57a6): kobject_uevent_env R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0
--- include/net/gro_cells.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
include/net/gro_cells.h +10 -2
@@ -20,18 +20,23 @@ static inline void gro_cells_receive(strstruct gro_cell *cell = gcells->cells;struct net_device *dev = skb->dev; +rcu_read_lock (); +if (unlikely (!(dev->flags &IFF_UP ))) + goto drop; +if (!cell ||skb_cloned (skb) || !(dev->features &NETIF_F_GRO )) {netif_rx (skb); -return ; + goto unlock; }if (skb_rx_queue_recorded (skb)) cell +=skb_get_rx_queue (skb) & gcells->gro_cells_mask;if (skb_queue_len (&cell->napi_skbs) > netdev_max_backlog) { +drop:atomic_long_inc (&dev->rx_dropped);kfree_skb (skb); -return ; + goto unlock; }/* We run in BH context */
@@ -42,6 +47,9 @@ static inline void gro_cells_receive(strnapi_schedule (&cell->napi);spin_unlock (&cell->napi_skbs.lock); + +unlock: +rcu_read_unlock (); }/* called unser BH context */
Greg Kroah-Hartman
maintainerPATCH 93/134 ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 upstream.
ALSA bebob driver has an entry for Focusrite Saffire Pro 10 I/O. The entry matches vendor_id in root directory and model_id in unit directory of configuration ROM for IEEE 1394 bus.
On the other hand, configuration ROM of Focusrite Liquid Saffire 56 has the same vendor_id and model_id. This device is an application of TCAT Dice (TCD2220 a.k.a Dice Jr.) however ALSA bebob driver can be bound to it randomly instead of ALSA dice driver. At present, drivers in ALSA firewire stack can not handle this situation appropriately.
This commit uses more identical mod_alias for Focusrite Saffire Pro 10 I/O in ALSA bebob driver.
$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
ROM header and bus information block
-----------------------------------------------------------------
400 042a829d bus_info_length 4, crc_length 42, crc 33437
404 31333934 bus_name "1394"
408 f0649222 irmc 1, cmc 1, isc 1, bmc 1, pmc 0, cyc_clk_acc 100,
max_rec 9 (1024), max_rom 2, gen 2, spd 2 (S400)
40c 00130e01 company_id 00130e |
410 000606e0 device_id 01000606e0 | EUI-64 00130e01000606e0 root directory
-----------------------------------------------------------------
414 0009d31c directory_length 9, crc 54044
418 04000014 hardware version
41c 0c0083c0 node capabilities per IEEE 1394
420 0300130e vendor
424 81000012 --> descriptor leaf at 46c
428 17000006 model
42c 81000016 --> descriptor leaf at 484
430 130120c2 version
434 d1000002 --> unit directory at 43c
438 d4000006 --> dependent info directory at 450 unit directory at 43c
-----------------------------------------------------------------
43c 0004707c directory_length 4, crc 28796 440 1200a02d specifier id: 1394 TA 444 13010001 version: AV/C 448 17000006 model 44c 81000013 --> descriptor leaf at 498
dependent info directory at 450
-----------------------------------------------------------------
450 000637c7 directory_length 6, crc 14279 454 120007f5 specifier id 458 13000001 version 45c 3affffc7 (immediate value) 460 3b100000 (immediate value) 464 3cffffc7 (immediate value) 468 3d600000 (immediate value)
descriptor leaf at 46c
-----------------------------------------------------------------
46c 00056f3b leaf_length 5, crc 28475 470 00000000 textual descriptor 474 00000000 minimal ASCII 478 466f6375 "Focu" 47c 73726974 "srit" 480 65000000 "e"
descriptor leaf at 484
-----------------------------------------------------------------
484 0004a165 leaf_length 4, crc 41317 488 00000000 textual descriptor 48c 00000000 minimal ASCII 490 50726f31 "Pro1" 494 30494f00 "0IO"
descriptor leaf at 498
-----------------------------------------------------------------
498 0004a165 leaf_length 4, crc 41317 49c 00000000 textual descriptor 4a0 00000000 minimal ASCII 4a4 50726f31 "Pro1" 4a8 30494f00 "0IO"
$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
ROM header and bus information block
-----------------------------------------------------------------
400 040442e4 bus_info_length 4, crc_length 4, crc 17124
404 31333934 bus_name "1394"
408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255,
max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400)
40c 00130e04 company_id 00130e |
410 018001e9 device_id 04018001e9 | EUI-64 00130e04018001e9 root directory
-----------------------------------------------------------------
414 00065612 directory_length 6, crc 22034
418 0300130e vendor
41c 8100000a --> descriptor leaf at 444
420 17000006 model
424 8100000e --> descriptor leaf at 45c
428 0c0087c0 node capabilities per IEEE 1394
42c d1000001 --> unit directory at 430 unit directory at 430
-----------------------------------------------------------------
430 000418a0 directory_length 4, crc 6304 434 1200130e specifier id 438 13000001 version 43c 17000006 model 440 8100000f --> descriptor leaf at 47c
descriptor leaf at 444
-----------------------------------------------------------------
444 00056f3b leaf_length 5, crc 28475 448 00000000 textual descriptor 44c 00000000 minimal ASCII 450 466f6375 "Focu" 454 73726974 "srit" 458 65000000 "e"
descriptor leaf at 45c
-----------------------------------------------------------------
45c 000762c6 leaf_length 7, crc 25286 460 00000000 textual descriptor 464 00000000 minimal ASCII 468 4c495155 "LIQU" 46c 49445f53 "ID_S" 470 41464649 "AFFI" 474 52455f35 "RE_5" 478 36000000 "6"
descriptor leaf at 47c
-----------------------------------------------------------------
47c 000762c6 leaf_length 7, crc 25286 480 00000000 textual descriptor 484 00000000 minimal ASCII 488 4c495155 "LIQU" 48c 49445f53 "ID_S" 490 41464649 "AFFI" 494 52455f35 "RE_5" 498 36000000 "6"
--- sound/firewire/bebob/bebob.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/firewire/bebob/bebob.c +13 -1
@@ -396,7 +396,19 @@ static const struct ieee1394_device_id b/* Focusrite, SaffirePro 26 I/O */ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), /* Focusrite, SaffirePro 10 I/O */ -SND_BEBOB_DEV_ENTRY (VEN_FOCUSRITE ,0x00000006 , &saffirepro_10_spec), + { +// The combination of vendor_id and model_id is the same as the +// same as the one of Liquid Saffire 56. + .match_flags =IEEE1394_MATCH_VENDOR_ID | +IEEE1394_MATCH_MODEL_ID | +IEEE1394_MATCH_SPECIFIER_ID | + IEEE1394_MATCH_VERSION, + .vendor_id = VEN_FOCUSRITE, + .model_id = 0x000006, + .specifier_id = 0x00a02d, + .version = 0x010001, + .driver_data = (kernel_ulong_t)&saffirepro_10_spec, + },/* Focusrite, Saffire(no label and LE) */ SND_BEBOB_DEV_ENTRY (VEN_FOCUSRITE ,MODEL_FOCUSRITE_SAFFIRE_BOTH , &saffire_spec),
Greg Kroah-Hartman
maintainerPATCH 94/134 Its wrong to add len to sector_nr in raid10 reshape twice
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
commit b761dcf1217760a42f7897c31dcb649f59b2333e upstream.
In reshape_request it already adds len to sector_nr already. It's wrong to add len to sector_nr again after adding pages to bio. If there is bad block it can't copy one chunk at a time, it needs to goto read_more. Now the sector_nr is wrong. It can cause data corruption.
--- drivers/md/raid10.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/raid10.c +0 -1
@@ -4528,7 +4528,6 @@ bio_full:atomic_inc (&r10_bio->remaining); read_bio->bi_next =NULL ;generic_make_request (read_bio); - sector_nr += nr_sectors; sectors_done += nr_sectors;if (sector_nr <= last) goto read_more;
Greg Kroah-Hartman
maintainerPATCH 95/134 9p/net: fix memory leak in p9_client_create
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhengbin <[email protected]>
commit bb06c388fa20ae24cfe80c52488de718a7e3a53f upstream.
If msize is less than 4096, we should close and put trans, destroy tagpool, not just free client. This patch fixes that.
--- net/9p/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/client.c +1 -1
@@ -1065,7 +1065,7 @@ struct p9_client *p9_client_create(constp9_debug (P9_DEBUG_ERROR ,"Please specify a msize of at least 4k\n" ); err = -EINVAL ; - goto free_client; + goto close_trans; } err =p9_client_version (clnt);
Greg Kroah-Hartman
maintainerPATCH 96/134 ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: S.j. Wang <[email protected]>
commit cc29ea007347f39f4c5a4d27b0b555955a0277f9 upstream.
The ESAI_xCR_xWA is xCR's bit, not the xCCR's bit, driver set it to wrong register, correct it.
Fixes 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
--- sound/soc/fsl/fsl_esai.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_esai.c +4 -3
@@ -394,7 +394,8 @@ static int fsl_esai_set_dai_fmt(struct sbreak ;case SND_SOC_DAIFMT_RIGHT_J :/* Data on rising edge of bclk, frame high, right aligned */ - xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; + xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; + xcr |= ESAI_xCR_xWA;break ;case SND_SOC_DAIFMT_DSP_A :/* Data on rising edge of bclk, frame high, 1clk before data */
@@ -451,12 +452,12 @@ static int fsl_esai_set_dai_fmt(struct sreturn -EINVAL ; } - mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; + mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCR , mask, xcr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCR , mask, xcr); mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | - ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; + ESAI_xCCR_xFSD | ESAI_xCCR_xCKD;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCCR , mask, xccr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCCR , mask, xccr);
Greg Kroah-Hartman
maintainerPATCH 97/134 crypto: ahash - fix another early termination in hash walk
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 77568e535af7c4f97eaef1e555bf0af83772456c upstream.
Hash algorithms with an alignmask set, e.g. "xcbc(aes-aesni)" and "michael_mic", fail the improved hash tests because they sometimes produce the wrong digest. The bug is that in the case where a scatterlist element crosses pages, not all the data is actually hashed because the scatterlist walk terminates too early. This happens because the 'nbytes' variable in crypto_hash_walk_done() is assigned the number of bytes remaining in the page, then later interpreted as the number of bytes remaining in the scatterlist element. Fix it.
--- crypto/ahash.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/ahash.c +7 -7
@@ -84,17 +84,17 @@ static int hash_walk_new_entry(struct crint crypto_hash_walk_done (struct crypto_hash_walk *walk,int err) {unsigned int alignmask = walk->alignmask; -unsigned int nbytes = walk->entrylen; walk->data -= walk->offset; -if (nbytes && walk->offset & alignmask && !err) { - walk->offset =ALIGN (walk->offset, alignmask +1 ); - nbytes =min (nbytes, - ((unsigned int )(PAGE_SIZE )) - walk->offset); - walk->entrylen -= nbytes; +if (walk->entrylen && (walk->offset & alignmask) && !err) { +unsigned int nbytes; + walk->offset =ALIGN (walk->offset, alignmask +1 ); + nbytes =min (walk->entrylen, + (unsigned int )(PAGE_SIZE - walk->offset));if (nbytes) { + walk->entrylen -= nbytes; walk->data += walk->offset;return nbytes; }
@@ -114,7 +114,7 @@ int crypto_hash_walk_done(struct crypto_if (err)return err; -if (nbytes) { +if (walk->entrylen) { walk->offset =0 ; walk->pg++;return hash_walk_next (walk);
Greg Kroah-Hartman
maintainerPATCH 98/134 s390/dasd: fix using offset into zero size array error
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4a8ef6999bce998fa5813023a9a6b56eea329dba ]
Dan Carpenter reported the following:
The patch 52898025cf7d: "[S390] dasd: security and PSF update patch for EMC CKD ioctl" from Mar 8, 2010, leads to the following static checker warning:
drivers/s390/block/dasd_eckd.c:4486 dasd_symm_io() error: using offset into zero size array 'psf_data[]'
drivers/s390/block/dasd_eckd.c
4458 /* Copy parms from caller */
4459 rc = -EFAULT;
4460 if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
^^^^^^^The user can specify any "usrparm.psf_data_len". They choose zero by mistake.
4461 goto out;
4462 if (is_compat_task()) {
4463 /* Make sure pointers are sane even on 31 bit. */ 4464 rc = -EINVAL; 4465 if ((usrparm.psf_data >> 32) != 0) 4466 goto out; 4467 if ((usrparm.rssd_result >> 32) != 0) 4468 goto out; 4469 usrparm.psf_data &= 0x7fffffffULL; 4470 usrparm.rssd_result &= 0x7fffffffULL; 4471 } 4472 /* alloc I/O data area */ 4473 psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); 4474 rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
4475 if (!psf_data || !rssd_result) {
kzalloc() returns a ZERO_SIZE_PTR (0x16).
4476 rc = -ENOMEM; 4477 goto out_free; 4478 } 4479 4480 /* get syscall header from user space */ 4481 rc = -EFAULT; 4482 if (copy_from_user(psf_data, 4483 (void __user *)(unsigned long) usrparm.psf_data, 4484 usrparm.psf_data_len))
That all works great.
4485 goto out_free; 4486 psf0 = psf_data[0]; 4487 psf1 = psf_data[1];
But now we're assuming that "->psf_data_len" was at least 2 bytes.
Fix this by checking the user specified length psf_data_len.
--- drivers/s390/block/dasd_eckd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/s390/block/dasd_eckd.c +8 -0
@@ -3990,6 +3990,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) usrparm.psf_data &=0x7fffffffULL ; usrparm.rssd_result &=0x7fffffffULL ; } +/* at least 2 bytes are accessed and should be allocated */ +if (usrparm.psf_data_len <2 ) { +DBF_DEV_EVENT (DBF_WARNING , device, +"Symmetrix ioctl invalid data length %d" , + usrparm.psf_data_len); + rc = -EINVAL ; + goto out; + }/* alloc I/O data area */ psf_data =kzalloc (usrparm.psf_data_len,GFP_KERNEL |GFP_DMA ); rssd_result =kzalloc (usrparm.rssd_result_len,GFP_KERNEL |GFP_DMA );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/134 Input: matrix_keypad - use flush_delayed_work()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a342083abe576db43594a32d458a61fa81f7cb32 ]
We should be using flush_delayed_work() instead of flush_work() in matrix_keypad_stop() to ensure that we are not missing work that is scheduled but not yet put in the workqueue (i.e. its delay timer has not expired yet).
--- drivers/input/keyboard/matrix_keypad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/matrix_keypad.c +1 -1
@@ -220,7 +220,7 @@ static void matrix_keypad_stop(struct input_dev *dev) keypad->stopped = true;spin_unlock_irq (&keypad->lock); -flush_work (&keypad->work.work); +flush_delayed_work (&keypad->work);/* * matrix_keypad_scan() will leave IRQs enabled; * we should disable them now.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/134 i2c: cadence: Fix the hold bit setting
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit d358def706880defa4c9e87381c5bf086a97d5f9 ]
In case the hold bit is not needed we are carrying the old values. Fix the same by resetting the bit when not needed.
Fixes the sporadic i2c bus lockups on National Instruments Zynq-based devices.
--- drivers/i2c/busses/i2c-cadence.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/i2c/busses/i2c-cadence.c +7 -2
@@ -320,8 +320,10 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->recv_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->recv_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ;cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );
@@ -375,8 +377,11 @@ static void cdns_i2c_msend(struct cdns_i2c *id)* Check for the message size against FIFO depth and set the * 'hold bus' bit if it is greater than FIFO depth. */ -if (id->send_count >CDNS_I2C_FIFO_DEPTH ) +if ((id->send_count >CDNS_I2C_FIFO_DEPTH ) || id->bus_hold_flag) ctrl_reg |=CDNS_I2C_CR_HOLD ; +else + ctrl_reg = ctrl_reg & ~CDNS_I2C_CR_HOLD ; +cdns_i2c_writereg (ctrl_reg,CDNS_I2C_CR_OFFSET );/* Clear the interrupts in interrupt status register. */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/134 Input: st-keyscan - fix potential zalloc NULL dereference
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2439d37e1bf8a34d437573c086572abe0f3f1b15 ]
This patch fixes the following static checker warning:
drivers/input/keyboard/st-keyscan.c:156 keyscan_probe()
error: potential zalloc NULL dereference: 'keypad_data->input_dev'
--- drivers/input/keyboard/st-keyscan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/input/keyboard/st-keyscan.c +2 -2
@@ -153,6 +153,8 @@ static int keyscan_probe(struct platform_device *pdev) input_dev->id.bustype =BUS_HOST ; + keypad_data->input_dev = input_dev; + error =keypad_matrix_key_parse_dt (keypad_data);if (error)return error;
@@ -168,8 +170,6 @@ static int keyscan_probe(struct platform_device *pdev)input_set_drvdata (input_dev, keypad_data); - keypad_data->input_dev = input_dev; - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); keypad_data->base =devm_ioremap_resource (&pdev->dev, res);if (IS_ERR (keypad_data->base))
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/134 assoc_array: Fix shortcut creation
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb2ba2d75a2d673e76ddaf13a9bd30d6a8b1bb08 ]
Fix the creation of shortcuts for which the length of the index key value is an exact multiple of the machine word size. The problem is that the code that blanks off the unused bits of the shortcut value malfunctions if the number of bits in the last word equals machine word size. This is due to the "<<" operator being given a shift of zero in this case, and so the mask that should be all zeros is all ones instead. This causes the subsequent masking operation to clear everything rather than clearing nothing.
Ordinarily, the presence of the hash at the beginning of the tree index key makes the issue very hard to test for, but in this case, it was encountered due to a development mistake that caused the hash output to be either 0 (keyring) or 1 (non-keyring) only. This made it susceptible to the keyctl/unlink/valid test in the keyutils package.
The fix is simply to skip the blanking if the shift would be 0. For example, an index key that is 64 bits long would produce a 0 shift and thus a 'blank' of all 1s. This would then be inverted and AND'd onto the index_key, incorrectly clearing the entire last word.
--- lib/assoc_array.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
lib/assoc_array.c +5 -3
@@ -780,9 +780,11 @@ all_leaves_cluster_together: new_s0->index_key[i] = ops->get_key_chunk (index_key, i *ASSOC_ARRAY_KEY_CHUNK_SIZE ); - blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); -pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); - new_s0->index_key[keylen -1 ] &= ~blank; +if (level &ASSOC_ARRAY_KEY_CHUNK_MASK ) { + blank =ULONG_MAX << (level &ASSOC_ARRAY_KEY_CHUNK_MASK ); +pr_devel ("blank off [%zu] %d: %lx\n" , keylen -1 , level, blank); + new_s0->index_key[keylen -1 ] &= ~blank; + }/* This now reduces to a node splitting exercise for which we'll need * to regenerate the disparity table.
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/134 scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 79edd00dc6a96644d76b4a1cb97d94d49e026768 ]
When a target sends Check Condition, whilst initiator is busy xmiting re-queued data, could lead to race between iscsi_complete_task() and iscsi_xmit_task() and eventually crashing with the following kernel backtrace.
[3326150.987523] ALERT: BUG: unable to handle kernel NULL pointer dereference at 0000000000000078 [3326150.987549] ALERT: IP: [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987571] WARN: PGD 569c8067 PUD 569c9067 PMD 0 [3326150.987582] WARN: Oops: 0002 [#1] SMP [3326150.987593] WARN: Modules linked in: tun nfsv3 nfs fscache dm_round_robin [3326150.987762] WARN: CPU: 2 PID: 8399 Comm: kworker/u32:1 Tainted: G O 4.4.0+2 #1 [3326150.987774] WARN: Hardware name: Dell Inc. PowerEdge R720/0W7JN5, BIOS 2.5.4 01/22/2016 [3326150.987790] WARN: Workqueue: iscsi_q_13 iscsi_xmitworker [libiscsi] [3326150.987799] WARN: task: ffff8801d50f3800 ti: ffff8801f5458000 task.ti: ffff8801f5458000 [3326150.987810] WARN: RIP: e030:[<ffffffffa05ce70d>] [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.987825] WARN: RSP: e02b:ffff8801f545bdb0 EFLAGS: 00010246 [3326150.987831] WARN: RAX: 00000000ffffffc3 RBX: ffff880282d2ab20 RCX: ffff88026b6ac480 [3326150.987842] WARN: RDX: 0000000000000000 RSI: 00000000fffffe01 RDI: ffff880282d2ab20 [3326150.987852] WARN: RBP: ffff8801f545bdc8 R08: 0000000000000000 R09: 0000000000000008 [3326150.987862] WARN: R10: 0000000000000000 R11: 000000000000fe88 R12: 0000000000000000 [3326150.987872] WARN: R13: ffff880282d2abe8 R14: ffff880282d2abd8 R15: ffff880282d2ac08 [3326150.987890] WARN: FS: 00007f5a866b4840(0000) GS:ffff88028a640000(0000) knlGS:0000000000000000 [3326150.987900] WARN: CS: e033 DS: 0000 ES: 0000 CR0: 0000000080050033 [3326150.987907] WARN: CR2: 0000000000000078 CR3: 0000000070244000 CR4: 0000000000042660 [3326150.987918] WARN: Stack: [3326150.987924] WARN: ffff880282d2ad58 ffff880282d2ab20 ffff880282d2abe8 ffff8801f545be18 [3326150.987938] WARN: ffffffffa05cea90 ffff880282d2abf8 ffff88026b59cc80 ffff88026b59cc00 [3326150.987951] WARN: ffff88022acf32c0 ffff880289491800 ffff880255a80800 0000000000000400 [3326150.987964] WARN: Call Trace: [3326150.987975] WARN: [<ffffffffa05cea90>] iscsi_xmitworker+0x2f0/0x360 [libiscsi] [3326150.987988] WARN: [<ffffffff8108862c>] process_one_work+0x1fc/0x3b0 [3326150.987997] WARN: [<ffffffff81088f95>] worker_thread+0x2a5/0x470 [3326150.988006] WARN: [<ffffffff8159cad8>] ? __schedule+0x648/0x870 [3326150.988015] WARN: [<ffffffff81088cf0>] ? rescuer_thread+0x300/0x300 [3326150.988023] WARN: [<ffffffff8108ddf5>] kthread+0xd5/0xe0 [3326150.988031] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988040] WARN: [<ffffffff815a0bcf>] ret_from_fork+0x3f/0x70 [3326150.988048] WARN: [<ffffffff8108dd20>] ? kthread_stop+0x110/0x110 [3326150.988127] ALERT: RIP [<ffffffffa05ce70d>] iscsi_xmit_task+0x2d/0xc0 [libiscsi] [3326150.988138] WARN: RSP <ffff8801f545bdb0> [3326150.988144] WARN: CR2: 0000000000000078 [3326151.020366] WARN: ---[ end trace 1c60974d4678d81b ]---
Commit 6f8830f5bbab ("scsi: libiscsi: add lock around task lists to fix list corruption regression") introduced "taskqueuelock" to fix list corruption during the race, but this wasn't enough.
Re-setting of conn->task to NULL, could race with iscsi_xmit_task(). iscsi_complete_task()
{
....
if (conn->task == task)
conn->task = NULL;
}conn->task in iscsi_xmit_task() could be NULL and so will be task. __iscsi_get_task(task) will crash (NullPtr de-ref), trying to access refcount.
iscsi_xmit_task()
{
struct iscsi_task *task = conn->task;
__iscsi_get_task(task);
}This commit will take extra conn->session->back_lock in iscsi_xmit_task() to ensure iscsi_xmit_task() waits for iscsi_complete_task(), if iscsi_complete_task() wins the race. If iscsi_xmit_task() wins the race, iscsi_xmit_task() increments task->refcount
(__iscsi_get_task) ensuring iscsi_complete_task() will not iscsi_free_task().
--- drivers/scsi/libiscsi.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/scsi/libiscsi.c +6 -0
@@ -1448,7 +1448,13 @@ static int iscsi_xmit_task(struct iscsi_conn *conn)if (test_bit (ISCSI_SUSPEND_BIT , &conn->suspend_tx))return -ENODATA ; +spin_lock_bh (&conn->session->back_lock); +if (conn->task ==NULL ) { +spin_unlock_bh (&conn->session->back_lock); +return -ENODATA ; + }__iscsi_get_task (task); +spin_unlock_bh (&conn->session->back_lock);spin_unlock_bh (&conn->session->frwd_lock); rc = conn->session->tt->xmit_task (task);spin_lock_bh (&conn->session->frwd_lock);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/134 net: systemport: Fix reception of BPDUs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a40061ea2e39494104602b3048751341bda374a1 ]
SYSTEMPORT has its RXCHK parser block that attempts to validate the packet structures, unfortunately setting the L2 header check bit will cause Bridge PDUs (BPDUs) to be incorrectly rejected because they look like LLC/SNAP packets with a non-IPv4 or non-IPv6 Ethernet Type.
--- drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/broadcom/bcmsysport.c +4 -0
@@ -126,6 +126,10 @@ static int bcm_sysport_set_rx_csum(struct net_device *dev, priv->rx_chk_en = !!(wanted &NETIF_F_RXCSUM ); reg =rxchk_readl (priv,RXCHK_CONTROL ); +/* Clear L2 header checks, which would prevent BPDUs +* from being received. +*/ + reg &= ~RXCHK_L2_HDR_DIS ;if (priv->rx_chk_en) reg |=RXCHK_EN ;else
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/134 net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e928b5d6b75e239feb9c6d5488974b6646a0ebc8 ]
If mv643xx_eth_shared_of_probe() fails, mv643xx_eth_shared_probe() leaves clk enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/marvell/mv643xx_eth.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/mv643xx_eth.c +6 -1
@@ -2814,7 +2814,7 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev) ret =mv643xx_eth_shared_of_probe (pdev);if (ret) -return ret; + goto err_put_clk; pd =dev_get_platdata (&pdev->dev); msp->tx_csum_limit = (pd != NULL && pd->tx_csum_limit) ?
@@ -2822,6 +2822,11 @@ static int mv643xx_eth_shared_probe(struct platform_device *pdev)infer_hw_params (msp);return 0 ; + +err_put_clk: +if (!IS_ERR (msp->clk)) +clk_disable_unprepare (msp->clk); +return ret; }static int mv643xx_eth_shared_remove (struct platform_device *pdev)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/134 arm64: Relax GIC version check during early boot
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 74698f6971f25d045301139413578865fc2bd8f9 ]
Updates to the GIC architecture allow ID_AA64PFR0_EL1.GIC to have values other than 0 or 1. At the moment, Linux is quite strict in the way it handles this field at early boot stage (cpufeature is fine) and will refuse to use the system register CPU interface if it doesn't find the value 1.
--- arch/arm64/kernel/head.S | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/kernel/head.S +1 -2
@@ -295,8 +295,7 @@ CPU_LE( bic x0, x0, #(3 << 24) ) // Clear the EE and E0E bits for EL1 /* GICv3 system register access */ mrs x0, id_aa64pfr0_el1 ubfx x0, x0, #24, #4 - cmp x0, #1 - b.ne 3f + cbz x0, 3f mrs_s x0, ICC_SRE_EL2 orr x0, x0, #ICC_SRE_EL2_SRE // Set ICC_SRE_EL2.SRE==1
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/134 tmpfs: fix link accounting when a tmpfile is linked in
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1062af920c07f5b54cf5060fde3339da6df0cf6b ]
tmpfs has a peculiarity of accounting hard links as if they were separate inodes: so that when the number of inodes is limited, as it is by default, a user cannot soak up an unlimited amount of unreclaimable dcache memory just by repeatedly linking a file.
But when v3.11 added O_TMPFILE, and the ability to use linkat() on the fd, we missed accommodating this new case in tmpfs: "df -i" shows that an extra "inode" remains accounted after the file is unlinked and the fd closed and the actual inode evicted. If a user repeatedly links tmpfiles into a tmpfs, the limit will be hit (ENOSPC) even after they are deleted.
Just skip the extra reservation from shmem_link() in this case: there's a sense in which this first link of a tmpfile is then cheaper than a hard link of another file, but the accounting works out, and there's still good limiting, so no need to do anything more complicated.
--- mm/shmem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
mm/shmem.c +7 -3
@@ -2286,10 +2286,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr* No ordinary (disk based) filesystem counts links as inodes; * but each new link needs a new dentry, pinning lowmem, and * tmpfs dentries cannot be pruned until they are unlinked. +* But if an O_TMPFILE file is linked into the tmpfs, the +* first link must skip that, to get the accounting right. */ - ret =shmem_reserve_inode (inode->i_sb); -if (ret) - goto out; +if (inode->i_nlink) { + ret =shmem_reserve_inode (inode->i_sb); +if (ret) + goto out; + } dir->i_size +=BOGO_DIRENT_SIZE ; inode->i_ctime = dir->i_ctime = dir->i_mtime =CURRENT_TIME ;
Signature · 1 line
2.19.1
Re: [PATCH 3.18 107/134] tmpfs: fix link accounting when a tmpfile is linked in
The other patchsets posted today are complete - thanks - but this 3.18.137-rc1 tree still wants29b00e609960 ("tmpfs: fix uninitialized return value in shmem_link") to be added to fix this one - thanks.
Hugh
Quoted 60 lines · Greg Kroah-Hartman
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit
1062af920c07f5b54cf5060fde3339da6df0cf6b]tmpfs has a peculiarity of accounting hard links as if they were separate inodes: so that when the number of inodes is limited, as it is by default, a user cannot soak up an unlimited amount of unreclaimable dcache memory just by repeatedly linking a file.
But when v3.11 added
O_TMPFILE, and the ability to uselinkat()on the fd, we missed accommodating this new case in tmpfs: "df -i" shows that an extra "inode" remains accounted after the file is unlinked and the fd closed and the actual inode evicted. If a user repeatedly links tmpfiles into a tmpfs, the limit will be hit (ENOSPC) even after they are deleted.Just skip the extra reservation from
shmem_link()in this case: there's a sense in which this first link of a tmpfile is then cheaper than a hard link of another file, but the accounting works out, and there's still good limiting, so no need to do anything more complicated.Fixes f4e0c30c191 ("allow the temp files created by open() to be linked to")Signed-off-by Darrick J. Wong <[email protected]>Signed-off-by Hugh Dickins <[email protected]>Reported-by Matej Kupljen <[email protected]>Acked-by Al Viro <[email protected]>Signed-off-by Andrew Morton <[email protected]>Signed-off-by Linus Torvalds <[email protected]>Signed-off-by Sasha Levin <[email protected]>--- mm/shmem.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)mm/shmem.c +7
-3@@ -2286,10 +2286,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr* No ordinary (disk based) filesystem counts links as inodes; * but each new link needs a new dentry, pinning lowmem, and * tmpfs dentries cannot be pruned until they are unlinked. +* But if an O_TMPFILE file is linked into the tmpfs, the +* first link must skip that, to get the accounting right. */ - ret =shmem_reserve_inode (inode->i_sb); -if (ret) - goto out; +if (inode->i_nlink) { + ret =shmem_reserve_inode (inode->i_sb); +if (ret) + goto out; + } dir->i_size +=BOGO_DIRENT_SIZE ; inode->i_ctime = dir->i_ctime = dir->i_mtime =CURRENT_TIME ;Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerRe: [PATCH 3.18 107/134] tmpfs: fix link accounting when a tmpfile is linked in
Quoted 4 lines · Hugh Dickins
The other patchsets posted today are complete - thanks - but this 3.18.137-rc1 tree still wants
29b00e609960("tmpfs: fix uninitialized return value inshmem_link") to be added to fix this one - thanks.
Thanks for letting me know, now queued up.
greg k-h
Greg Kroah-Hartman
maintainerPATCH 108/134 net: set static variable an initial value in atl2_probe()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4593403fa516a5a4cffe6883c5062d60932cbfbe ]
cards_found is a static variable, but when it enters atl2_probe(), cards_found is set to zero, the value is not consistent with last probe, so next behavior is not our expect.
--- drivers/net/ethernet/atheros/atlx/atl2.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/atheros/atlx/atl2.c +1 -3
@@ -1338,13 +1338,11 @@ static int atl2_probe(struct pci_dev *pd {struct net_device *netdev;struct atl2_adapter *adapter; -static int cards_found; +static int cards_found =0 ;unsigned long mmio_start;int mmio_len;int err; - cards_found =0 ; - err =pci_enable_device (pdev);if (err)return err;
Greg Kroah-Hartman
maintainerPATCH 109/134 CIFS: Fix read after write for files with read caching
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 6dfbd84684700cb58b34e8602c01c12f3d2595c8 upstream.
When we have a READ lease for a file and have just issued a write operation to the server we need to purge the cache and set oplock/lease level to NONE to avoid reading stale data. Currently we do that only if a write operation succedeed thus not covering cases when a request was sent to the server but a negative error code was returned later for some other reasons (e.g. -EIOCBQUEUED or -EINTR). Fix this by turning off caching regardless of the error code being returned.
The patches fixes generic tests 075 and 112 from the xfs-tests.
--- fs/cifs/file.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
fs/cifs/file.c +7 -5
@@ -2772,14 +2772,16 @@ cifs_strict_writev(struct kiocb *iocb, s* these pages but not on the region from pos to ppos+len-1. */ written =cifs_user_writev (iocb, from); -if (written >0 &&CIFS_CACHE_READ (cinode)) { +if (CIFS_CACHE_READ (cinode)) {/* -* Windows 7 server can delay breaking level2 oplock if a write -* request comes - break it on the client to prevent reading -* an old data. +* We have read level caching and we have just sent a write +* request to the server thus making data in the cache stale. +* Zap the cache and set oplock/lease level to NONE to avoid +* reading stale data from the cache. All subsequent read +* operations will read new data from the server. */ cifs_zap_mapping (inode); -cifs_dbg (FYI ,"Set no oplock for inode=%p after a write operation\n" , +cifs_dbg (FYI ,"Set Oplock/Lease to NONE for inode=%p after write\n" , inode); cinode->oplock =0 ; }
Greg Kroah-Hartman
maintainerPATCH 110/134 regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 56b5d4ea778c1b0989c5cdb5406d4a488144c416 upstream.
LDO35 uses 25 mV step, not 50 mV. Bucks 7 and 8 use 12.5 mV step instead of 6.25 mV. Wrong step caused over-voltage (LDO35) or under-voltage (buck7 and 8) if regulators were used (e.g. on Exynos5420 Arndale Octa board).
--- drivers/regulator/s2mps11.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/regulator/s2mps11.c +3 -3
@@ -369,7 +369,7 @@ static const struct regulator_desc s2mpsregulator_desc_s2mps11_ldo (32 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (33 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (34 ,STEP_50_MV ), -regulator_desc_s2mps11_ldo (35 ,STEP_50_MV ), +regulator_desc_s2mps11_ldo (35 ,STEP_25_MV ),regulator_desc_s2mps11_ldo (36 ,STEP_50_MV ),regulator_desc_s2mps11_ldo (37 ,STEP_50_MV ), regulator_desc_s2mps11_ldo(38, STEP_50_MV),
@@ -379,8 +379,8 @@ static const struct regulator_desc s2mpsregulator_desc_s2mps11_buck1_4 (4 ), regulator_desc_s2mps11_buck5,regulator_desc_s2mps11_buck67810 (6 ,MIN_600_MV ,STEP_6_25_MV ), -regulator_desc_s2mps11_buck67810 (7 ,MIN_600_MV ,STEP_6_25_MV ), -regulator_desc_s2mps11_buck67810 (8 ,MIN_600_MV ,STEP_6_25_MV ), +regulator_desc_s2mps11_buck67810 (7 ,MIN_600_MV ,STEP_12_5_MV ), +regulator_desc_s2mps11_buck67810 (8 ,MIN_600_MV ,STEP_12_5_MV ), regulator_desc_s2mps11_buck9, regulator_desc_s2mps11_buck67810(10, MIN_750_MV, STEP_12_5_MV), };
Greg Kroah-Hartman
maintainerPATCH 111/134 regulator: s2mpa01: Fix step values for some LDOs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stuart Menefy <[email protected]>
commit 28c4f730d2a44f2591cb104091da29a38dac49fe upstream.
The step values for some of the LDOs appears to be incorrect, resulting in incorrect voltages (or at least, ones which are different from the Samsung 3.4 vendor kernel).
--- drivers/regulator/s2mpa01.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/regulator/s2mpa01.c +5 -5
@@ -303,13 +303,13 @@ static struct regulator_desc regulators[regulator_desc_ldo (2 ,STEP_50_MV ),regulator_desc_ldo (3 ,STEP_50_MV ),regulator_desc_ldo (4 ,STEP_50_MV ), -regulator_desc_ldo (5 ,STEP_50_MV ), +regulator_desc_ldo (5 ,STEP_25_MV ),regulator_desc_ldo (6 ,STEP_25_MV ),regulator_desc_ldo (7 ,STEP_50_MV ),regulator_desc_ldo (8 ,STEP_50_MV ),regulator_desc_ldo (9 ,STEP_50_MV ),regulator_desc_ldo (10 ,STEP_50_MV ), -regulator_desc_ldo (11 ,STEP_25_MV ), +regulator_desc_ldo (11 ,STEP_50_MV ),regulator_desc_ldo (12 ,STEP_50_MV ),regulator_desc_ldo (13 ,STEP_50_MV ), regulator_desc_ldo(14, STEP_50_MV),
@@ -320,11 +320,11 @@ static struct regulator_desc regulators[regulator_desc_ldo (19 ,STEP_50_MV ),regulator_desc_ldo (20 ,STEP_50_MV ),regulator_desc_ldo (21 ,STEP_50_MV ), -regulator_desc_ldo (22 ,STEP_25_MV ), -regulator_desc_ldo (23 ,STEP_25_MV ), +regulator_desc_ldo (22 ,STEP_50_MV ), +regulator_desc_ldo (23 ,STEP_50_MV ),regulator_desc_ldo (24 ,STEP_50_MV ),regulator_desc_ldo (25 ,STEP_50_MV ), -regulator_desc_ldo (26 ,STEP_50_MV ), +regulator_desc_ldo (26 ,STEP_25_MV ),regulator_desc_buck1_4 (1 ),regulator_desc_buck1_4 (2 ), regulator_desc_buck1_4(3),
Greg Kroah-Hartman
maintainerPATCH 112/134 scsi: virtio_scsi: dont send sc payload with tmfs
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Franciosi <[email protected]>
commit 3722e6a52174d7c3a00e6f5efd006ca093f346c1 upstream.
The virtio scsi spec defines struct virtio_scsi_ctrl_tmf as a set of device-readable records and a single device-writable response entry:
struct virtio_scsi_ctrl_tmf
{
// Device-readable part
le32 type;
le32 subtype;
u8 lun[8];
le64 id;
// Device-writable part
u8 response;
}The above should be organised as two descriptor entries (or potentially more if using VIRTIO_F_ANY_LAYOUT), but without any extra data after "le64 id" or after "u8 response".
The Linux driver doesn't respect that, with virtscsi_abort() and virtscsi_device_reset() setting cmd->sc before calling virtscsi_tmf(). It results in the original scsi command payload (or writable buffers) added to the tmf.
This fixes the problem by leaving cmd->sc zeroed out, which makes virtscsi_kick_cmd() add the tmf to the control vq without any payload.
--- drivers/scsi/virtio_scsi.c | 2 -- 1 file changed, 2 deletions(-)
drivers/scsi/virtio_scsi.c +0 -2
@@ -653,7 +653,6 @@ static int virtscsi_device_reset(structreturn FAILED ;memset (cmd,0 ,sizeof (*cmd)); - cmd->sc = sc; cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req ){ .type =VIRTIO_SCSI_T_TMF , .subtype =VIRTIO_SCSI_T_TMF_LOGICAL_UNIT_RESET ,
@@ -728,7 +727,6 @@ static int virtscsi_abort(struct scsi_cmreturn FAILED ;memset (cmd,0 ,sizeof (*cmd)); - cmd->sc = sc; cmd->req.tmf = (struct virtio_scsi_ctrl_tmf_req ){ .type =VIRTIO_SCSI_T_TMF , .subtype =VIRTIO_SCSI_T_TMF_ABORT_TASK ,
Greg Kroah-Hartman
maintainerPATCH 113/134 scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 32e36bfbcf31452a854263e7c7f32fbefc4b44d8 upstream.
When using SCSI passthrough in combination with the iSCSI target driver then cmd->t_state_lock may be obtained from interrupt context. Hence, all code that obtains cmd->t_state_lock from thread context must disable interrupts first. This patch avoids that lockdep reports the following:
WARNING: inconsistent lock state
4.18.0-dbg+ #1 Not tainted
--------------------------------
inconsistent {HARDIRQ-ON-W} -> {IN-HARDIRQ-W} usage.
iscsi_ttx/1800 [HC1[1]:SC0[2]:HE0:SE0] takes:000000006e7b0ceb (&(&cmd->t_state_lock)->rlock){?...}, at: target_complete_cmd+0x47/0x2c0 [target_core_mod] {HARDIRQ-ON-W} state was registered at:
lock_acquire+0xd2/0x260 _raw_spin_lock+0x32/0x50 iscsit_close_connection+0x97e/0x1020 [iscsi_target_mod] iscsit_take_action_for_connection_exit+0x108/0x200 [iscsi_target_mod] iscsi_target_rx_thread+0x180/0x190 [iscsi_target_mod] kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30 irq event stamp: 1281 hardirqs last enabled at (1279): [<ffffffff970ade79>] __local_bh_enable_ip+0xa9/0x160 hardirqs last disabled at (1281): [<ffffffff97a008a5>] interrupt_entry+0xb5/0xd0 softirqs last enabled at (1278): [<ffffffff977cd9a1>] lock_sock_nested+0x51/0xc0 softirqs last disabled at (1280): [<ffffffffc07a6e04>] ip6_finish_output2+0x124/0xe40 [ipv6]
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
---- lock(&(&cmd->t_state_lock)->rlock);
<Interrupt>
lock(&(&cmd->t_state_lock)->rlock);
--- drivers/target/iscsi/iscsi_target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/target/iscsi/iscsi_target.c +2 -2
@@ -4198,9 +4198,9 @@ static void iscsit_release_commands_fromstruct se_cmd *se_cmd = &cmd->se_cmd;if (se_cmd->se_tfo !=NULL ) { -spin_lock (&se_cmd->t_state_lock); +spin_lock_irq (&se_cmd->t_state_lock); se_cmd->transport_state |=CMD_T_FABRIC_STOP ; -spin_unlock (&se_cmd->t_state_lock); +spin_unlock_irq (&se_cmd->t_state_lock); } }spin_unlock_bh (&conn->cmd_lock);
Greg Kroah-Hartman
maintainerPATCH 114/134 m68k: Add -ffreestanding to CFLAGS
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Finn Thain <[email protected]>
commit 28713169d879b67be2ef2f84dcf54905de238294 upstream.
This patch fixes a build failure when using GCC 8.1:
/usr/bin/ld: block/partitions/ldm.o: in function `ldm_parse_tocblock':block/partitions/ldm.c:153: undefined reference to `strcmp'
This is caused by a new optimization which effectively replaces a strncmp() call with a strcmp() call. This affects a number of strncmp() call sites in the kernel.
The entire class of optimizations is avoided with -fno-builtin, which gets enabled by -ffreestanding. This may avoid possible future build failures in case new optimizations appear in future compilers.
I haven't done any performance measurements with this patch but I did count the function calls in a defconfig build. For example, there are now 23 more sprintf() calls and 39 fewer strcpy() calls. The effect on the other libc functions is smaller.
If this harms performance we can tackle that regression by optimizing the call sites, ideally using semantic patches. That way, clang and ICC builds might benfit too.
Cc: [email protected]
Reference: https://marc.info/?l=linux-m68k&m=154514816222244&w=2
--- arch/m68k/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/m68k/Makefile +4 -1
@@ -59,7 +59,10 @@ cpuflags-$(CONFIG_M5206e) := $(call cc-o cpuflags-$(CONFIG_M5206) := $(call cc-option,-mcpu=5206,-m5200) KBUILD_AFLAGS += $(cpuflags-y) -KBUILD_CFLAGS += $(cpuflags-y) -pipe +KBUILD_CFLAGS += $(cpuflags-y) + +KBUILD_CFLAGS += -pipe -ffreestanding + ifdef CONFIG_MMU # without -fno-strength-reduce the 53c7xx.c driver fails ;-( KBUILD_CFLAGS += -fno-strength-reduce -ffixed-a2
Greg Kroah-Hartman
maintainerPATCH 115/134 Btrfs: fix corruption reading shared and compressed extents after hole punching
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 8e928218780e2f1cf2f5891c7575e8f0b284fcce upstream.
In the past we had data corruption when reading compressed extents that are shared within the same file and they are consecutive, this got fixed by commit 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared extents") and by commit 808f80b46790f ("Btrfs: update fix for read corruption of compressed and shared extents"). However there was a case that was missing in those fixes, which is when the shared and compressed extents are referenced with a non-zero offset. The following shell script creates a reproducer for this issue:
#!/bin/bash
mkfs.btrfs -f /dev/sdc &> /dev/null
mount -o compress /dev/sdc /mnt/sdc
# Create a file with 3 consecutive compressed extents, each has an
# uncompressed size of 128Kb and a compressed size of 4Kb.
for ((i = 1; i <= 3; i++)); do
head -c 4096 /dev/zero
for ((j = 1; j <= 31; j++)); do
head -c 4096 /dev/zero | tr '\0' "\377"
done
done > /mnt/sdc/foobar
syncecho "Digest after file creation: $(md5sum /mnt/sdc/foobar)"
# Clone the first extent into offsets 128K and 256K. xfs_io -c "reflink /mnt/sdc/foobar 0 128K 128K" /mnt/sdc/foobar xfs_io -c "reflink /mnt/sdc/foobar 0 256K 128K" /mnt/sdc/foobar sync
echo "Digest after cloning: $(md5sum /mnt/sdc/foobar)"
# Punch holes into the regions that are already full of zeroes. xfs_io -c "fpunch 0 4K" /mnt/sdc/foobar
xfs_io -c "fpunch 128K 4K" /mnt/sdc/foobar
xfs_io -c "fpunch 256K 4K" /mnt/sdc/foobar
sync
echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)" echo "Dropping page cache..." sysctl -q vm.drop_caches=1 echo "Digest after hole punching: $(md5sum /mnt/sdc/foobar)"
umount /dev/sdc
When running the script we get the following output:
Digest after file creation: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
linked 131072/131072 bytes at offset 131072
128 KiB, 1 ops; 0.0033 sec (36.960 MiB/sec and 295.6830 ops/sec) linked 131072/131072 bytes at offset 262144
128 KiB, 1 ops; 0.0015 sec (78.567 MiB/sec and 628.5355 ops/sec)
Digest after cloning: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar Digest after hole punching: 5a0888d80d7ab1fd31c229f83a3bbcc8 /mnt/sdc/foobar
Dropping page cache...
Digest after hole punching: fba694ae8664ed0c2e9ff8937e7f1484 /mnt/sdc/foobar
This happens because after reading all the pages of the extent in the range from 128K to 256K for example, we read the hole at offset 256K and then when reading the page at offset 260K we don't submit the existing bio, which is responsible for filling all the page in the range 128K to 256K only, therefore adding the pages from range 260K to 384K to the existing bio and submitting it after iterating over the entire range. Once the bio completes, the uncompressed data fills only the pages in the range 128K to 256K because there's no more data read from disk, leaving the pages in the range 260K to 384K unfilled. It is just a slightly different variant of what was solved by commit 005efedf2c7d0 ("Btrfs: fix read corruption of compressed and shared extents").
Fix this by forcing a bio submit, during readpages(), whenever we find a compressed extent map for a page that is different from the extent map for the previous page or has a different starting offset (in case it's the same compressed extent), instead of the extent map's original start offset.
A test case for fstests follows soon.
--- fs/btrfs/extent_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/extent_io.c +2 -2
@@ -3015,11 +3015,11 @@ static int __do_readpage(struct extent_i*/ if (test_bit (EXTENT_FLAG_COMPRESSED , &em->flags) && prev_em_start && *prev_em_start != (u64)-1 && - *prev_em_start != em->orig_start) + *prev_em_start != em->start) force_bio_submit = true;if (prev_em_start) - *prev_em_start = em->orig_start; + *prev_em_start = em->start;free_extent_map (em); em =NULL ;
Greg Kroah-Hartman
maintainerPATCH 116/134 crypto: pcbc - remove bogus memcpy()s with src == dest
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 251b7aea34ba3c4d4fdfa9447695642eb8b8b098 upstream.
The memcpy()s in the PCBC implementation use walk->iv as both the source and destination, which has undefined behavior. These memcpy()'s are actually unneeded, because walk->iv is already used to hold the previous plaintext block XOR'd with the previous ciphertext block. Thus, walk->iv is already updated to its final value.
So remove the broken and unnecessary memcpy()s.
--- crypto/pcbc.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
crypto/pcbc.c +4 -10
@@ -52,7 +52,7 @@ static int crypto_pcbc_encrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { crypto_xor(iv, src, bsize);
@@ -76,7 +76,7 @@ static int crypto_pcbc_encrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[bsize]; do {
@@ -89,8 +89,6 @@ static int crypto_pcbc_encrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -130,7 +128,7 @@ static int crypto_pcbc_decrypt_segment(sunsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr;u8 *dst = walk->dst.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv; do { fn(crypto_cipher_tfm(tfm), dst, src);
@@ -142,8 +140,6 @@ static int crypto_pcbc_decrypt_segment(s dst += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
@@ -156,7 +152,7 @@ static int crypto_pcbc_decrypt_inplace(sint bsize =crypto_cipher_blocksize (tfm);unsigned int nbytes = walk->nbytes;u8 *src = walk->src.virt.addr; -u8 *iv = walk->iv; +u8 *const iv = walk->iv;u8 tmpbuf[bsize]; do {
@@ -169,8 +165,6 @@ static int crypto_pcbc_decrypt_inplace(s src += bsize; }while ((nbytes -= bsize) >= bsize); -memcpy (walk->iv, iv, bsize); -return nbytes; }
Greg Kroah-Hartman
maintainerPATCH 117/134 cpufreq: pxa2xx: remove incorrect __init annotation
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit 9505b98ccddc454008ca7efff90044e3e857c827 upstream.
pxa_cpufreq_init_voltages() is marked __init but usually inlined into the non-__init pxa_cpufreq_init() function. When building with clang, it can stay as a standalone function in a discarded section, and produce this warning:
WARNING: vmlinux.o(.text+0x616a00): Section mismatch in reference from the function pxa_cpufreq_init() to the function .init.text:pxa_cpufreq_init_voltages() The function pxa_cpufreq_init() references
the function __init pxa_cpufreq_init_voltages().
This is often because pxa_cpufreq_init lacks a __init
annotation or the annotation of pxa_cpufreq_init_voltages is wrong.
--- drivers/cpufreq/pxa2xx-cpufreq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/cpufreq/pxa2xx-cpufreq.c +2 -2
@@ -191,7 +191,7 @@ static int pxa_cpufreq_change_voltage(pxreturn ret; } -static void __init pxa_cpufreq_init_voltages (void ) +static void pxa_cpufreq_init_voltages (void ) { vcc_core =regulator_get (NULL ,"vcc_core" );if (IS_ERR (vcc_core)) {
@@ -207,7 +207,7 @@ static int pxa_cpufreq_change_voltage(pxreturn 0 ; } -static void __init pxa_cpufreq_init_voltages (void ) { } +static void pxa_cpufreq_init_voltages (void ) { }#endif static void find_freq_tables(struct cpufreq_frequency_table **freq_table,
Greg Kroah-Hartman
maintainerPATCH 118/134 ext4: fix crash during online resizing
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit f96c3ac8dfc24b4e38fc4c2eba5fea2107b929d1 upstream.
When computing maximum size of filesystem possible with given number of group descriptor blocks, we forget to include s_first_data_block into the number of blocks. Thus for filesystems with non-zero s_first_data_block it can happen that computed maximum filesystem size is actually lower than current filesystem size which confuses the code and eventually leads to a BUG_ON in ext4_alloc_group_tables() hitting on flex_gd->count == 0. The problem can be reproduced like:
truncate -s 100g /tmp/image
mkfs.ext4 -b 1024 -E resize=262144 /tmp/image 32768 mount -t ext4 -o loop /tmp/image /mnt resize2fs /dev/loop0 262145
resize2fs /dev/loop0 300000
Fix the problem by properly including s_first_data_block into the computed number of filesystem blocks.
--- fs/ext4/resize.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ext4/resize.c +2 -1
@@ -1930,7 +1930,8 @@ retry:le16_to_cpu (es->s_reserved_gdt_blocks); n_group = n_desc_blocks *EXT4_DESC_PER_BLOCK (sb); n_blocks_count = (ext4_fsblk_t )n_group * -EXT4_BLOCKS_PER_GROUP (sb); +EXT4_BLOCKS_PER_GROUP (sb) + +le32_to_cpu (es->s_first_data_block); n_group--;/* set to last group number */ }
Greg Kroah-Hartman
maintainerPATCH 119/134 ext2: Fix underflow in ext2_max_size()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 1c2d14212b15a60300a2d4f6364753e87394c521 upstream.
When ext2 filesystem is created with 64k block size, ext2_max_size() will return value less than 0. Also, we cannot write any file in this fs since the sb->maxbytes is less than 0. The core of the problem is that the size of block index tree for such large block size is more than i_blocks can carry. So fix the computation to count with this possibility.
File size limits computed with the new function for the full range of possible block sizes look like:
bits file_size
10 17247252480
11 275415851008
12 2196873666560 13 2197948973056 14 2198486220800 15 2198754754560 16 2198888906752
--- fs/ext2/super.c | 41 ++++++++++++++++++++++++++--------------- 1 file changed, 26 insertions(+), 15 deletions(-)
fs/ext2/super.c +26 -15
@@ -701,7 +701,8 @@ static loff_t ext2_max_size(int bits) {loff_t res =EXT2_NDIR_BLOCKS ;int meta_blocks; -loff_t upper_limit; +unsigned int upper_limit; +unsigned int ppb =1 << (bits-2 );/* This is calculated to be the largest file size for a * dense, file such that the total number of
@@ -715,24 +716,34 @@ static loff_t ext2_max_size(int bits)/* total blocks in file system block size */ upper_limit >>= (bits -9 ); - -/* indirect blocks */ - meta_blocks =1 ; -/* double indirect blocks */ - meta_blocks +=1 + (1LL << (bits-2 )); -/* tripple indirect blocks */ - meta_blocks +=1 + (1LL << (bits-2 )) + (1LL << (2 *(bits-2 ))); - - upper_limit -= meta_blocks; - upper_limit <<= bits; - +/* Compute how many blocks we can address by block tree */ res +=1LL << (bits-2 ); res +=1LL << (2 *(bits-2 )); res +=1LL << (3 *(bits-2 )); +/* Does block tree limit file size? */ +if (res < upper_limit) + goto check_lfs; + + res = upper_limit; +/* How many metadata blocks are needed for addressing upper_limit? */ + upper_limit -=EXT2_NDIR_BLOCKS ; +/* indirect blocks */ + meta_blocks =1 ; + upper_limit -= ppb; +/* double indirect blocks */ +if (upper_limit < ppb * ppb) { + meta_blocks +=1 +DIV_ROUND_UP (upper_limit, ppb); + res -= meta_blocks; + goto check_lfs; + } + meta_blocks +=1 + ppb; + upper_limit -= ppb * ppb; +/* tripple indirect blocks for the rest */ + meta_blocks +=1 +DIV_ROUND_UP (upper_limit, ppb) + +DIV_ROUND_UP (upper_limit, ppb*ppb); + res -= meta_blocks; +check_lfs: res <<= bits; -if (res > upper_limit) - res = upper_limit; -if (res >MAX_LFS_FILESIZE ) res =MAX_LFS_FILESIZE ;
Greg Kroah-Hartman
maintainerPATCH 120/134 mm/vmalloc: fix size check for remap_vmalloc_range_partial()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roman Penyaev <[email protected]>
commit 401592d2e095947344e10ec0623adbcd58934dd4 upstream.
When VM_NO_GUARD is not set area->size includes adjacent guard page, thus for correct size checking get_vm_area_size() should be used, but not area->size.
This fixes possible kernel oops when userspace tries to mmap an area on 1 page bigger than was allocated by vmalloc_user() call: the size check inside remap_vmalloc_range_partial() accounts non-existing guard page also, so check successfully passes but vmalloc_to_page() returns NULL (guard page does not physically exist).
The following code pattern example should trigger an oops:
static int oops_mmap(struct file *file, struct vm_area_struct *vma)
{
void *mem; mem = vmalloc_user(4096);
BUG_ON(!mem);
/* Do not care about mem leak */
return remap_vmalloc_range(vma, mem, 0);}
And userspace simply mmaps size + PAGE_SIZE:
mmap(NULL, 8192, PROT_WRITE|PROT_READ, MAP_PRIVATE, fd, 0);
Possible candidates for oops which do not have any explicit size checks:
*** drivers/media/usb/stkwebcam/stk-webcam.c: v4l_stk_mmap[789] ret = remap_vmalloc_range(vma, sbuf->buffer, 0);
Or the following one:
*** drivers/video/fbdev/core/fbmem.c
static int
fb_mmap(struct file *file, struct vm_area_struct * vma)
...
res = fb->fb_mmap(info, vma);Where fb_mmap callback calls remap_vmalloc_range() directly without any explicit checks:
*** drivers/video/fbdev/vfb.c
static int vfb_mmap(struct fb_info *info,
struct vm_area_struct *vma)
{
return remap_vmalloc_range(vma, (void *)info->fix.smem_start, vma->vm_pgoff);
}--- mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/vmalloc.c +1 -1
@@ -2140,7 +2140,7 @@ int remap_vmalloc_range_partial(struct vif (!(area->flags &VM_USERMAP ))return -EINVAL ; -if (kaddr + size > area->addr + area->size) +if (kaddr + size > area->addr +get_vm_area_size (area))return -EINVAL ; do {
Greg Kroah-Hartman
maintainerPATCH 121/134 kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zev Weiss <[email protected]>
commit 8cf7630b29701d364f8df4a50e4f1f5e752b2778 upstream.
This bug has apparently existed since the introduction of this function in the pre-git era (4500e91754d3 in Thomas Gleixner's history.git, "[NET]: Add proc_dointvec_userhz_jiffies, use it for proper handling of neighbour sysctls.").
As a minimal fix we can simply duplicate the corresponding check in do_proc_dointvec_conv().
--- kernel/sysctl.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
kernel/sysctl.c +10 -1
@@ -2153,7 +2153,16 @@ static int do_proc_dointvec_minmax_conv( {struct do_proc_dointvec_minmax_conv_param *param = data;if (write) { -int val = *negp ? -*lvalp : *lvalp; +int val; +if (*negp) { +if (*lvalp > (unsigned long )INT_MAX +1 ) +return -EINVAL ; + val = -*lvalp; + }else { +if (*lvalp > (unsigned long )INT_MAX ) +return -EINVAL ; + val = *lvalp; + }if ((param->min && *param->min > val) || (param->max && *param->max < val))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 122/134 parport_pc: fix find_superio io compare code, should use equal test.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: QiaoChong <[email protected]>
commit 21698fd57984cd28207d841dbdaa026d6061bceb upstream.
In the original code before 181bf1e815a2 the loop was continuing until it finds the first matching superios[i].io and p->base.
But after 181bf1e815a2 the logic changed and the loop now returns the pointer to the first mismatched array element which is then used in get_superio_dma() and get_superio_irq() and thus returning the wrong value.
Fix the condition so that it now returns the correct pointer.
--- drivers/parport/parport_pc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/parport/parport_pc.c +1 -1
@@ -1377,7 +1377,7 @@ static struct superio_struct *find_super {int i;for (i =0 ; i <NR_SUPERIOS ; i++) -if (superios[i].io != p->base) +if (superios[i].io == p->base)return &superios[i];return NULL ; }
Greg Kroah-Hartman
maintainerPATCH 123/134 jbd2: clear dirty flag when revoking a buffer from an older transaction
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhangyi (F) <[email protected]>
commit 904cdbd41d749a476863a0ca41f6f396774f26e4 upstream.
Now, we capture a data corruption problem on ext4 while we're truncating an extent index block. Imaging that if we are revoking a buffer which has been journaled by the committing transaction, the buffer's jbddirty flag will not be cleared in jbd2_journal_forget(), so the commit code will set the buffer dirty flag again after refile the buffer.
fsx kjournald2
jbd2_journal_commit_transactionjbd2_journal_revoke commit phase 1~5...
jbd2_journal_forget
belongs to older transaction commit phase 6
jbddirty not clear __jbd2_journal_refile_buffer
__jbd2_journal_unfile_buffer
test_clear_buffer_jbddirty
mark_buffer_dirty
Finally, if the freed extent index block was allocated again as data block by some other files, it may corrupt the file data after writing cached pages later, such as during unmount time. (In general, clean_bdev_aliases() related helpers should be invoked after re-allocation to prevent the above corruption, but unfortunately we missed it when zeroout the head of extra extent blocks in ext4_ext_handle_unwritten_extents()).
This patch mark buffer as freed and set j_next_transaction to the new transaction when it already belongs to the committing transaction in jbd2_journal_forget(), so that commit code knows it should clear dirty bits when it is done with the buffer.
This problem can be reproduced by xfstests generic/455 easily with seeds (3246 3247 3248 3249).
--- fs/jbd2/transaction.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
fs/jbd2/transaction.c +12 -5
@@ -1473,14 +1473,21 @@ int jbd2_journal_forget (handle_t *handl/* However, if the buffer is still owned by a prior * (committing) transaction, we can't drop it yet... */ JBUFFER_TRACE (jh,"belongs to older transaction" ); -/* ... but we CAN drop it from the new transaction if we -* have also modified it since the original commit. */ +/* ... but we CAN drop it from the new transaction through +* marking the buffer as freed and set j_next_transaction to +* the new transaction, so that not only the commit code +* knows it should clear dirty bits when it is done with the +* buffer, but also the buffer can be checkpointed only +* after the new transaction commits. */ -if (jh->b_next_transaction) { -J_ASSERT (jh->b_next_transaction == transaction); +set_buffer_freed (bh); + +if (!jh->b_next_transaction) {spin_lock (&journal->j_list_lock); - jh->b_next_transaction =NULL ; + jh->b_next_transaction = transaction;spin_unlock (&journal->j_list_lock); + }else { +J_ASSERT (jh->b_next_transaction == transaction);/* * only drop a reference if this transaction modified
Greg Kroah-Hartman
maintainerPATCH 124/134 powerpc/32: Clear on-stack exception marker upon exception return
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 9580b71b5a7863c24a9bd18bcd2ad759b86b1eff upstream.
Clear the on-stack STACK_FRAME_REGS_MARKER on exception exit in order to avoid confusing stacktrace like the one below.
Call Trace:
[c0e9dca0] [c01c42a0] print_address_description+0x64/0x2bc (unreliable)
[c0e9dcd0] [c01c4684] kasan_report+0xfc/0x180
[c0e9dd10] [c0895130] memchr+0x24/0x74
[c0e9dd30] [c00a9e38] msg_print_text+0x124/0x574
[c0e9dde0] [c00ab710] console_unlock+0x114/0x4f8
[c0e9de40] [c00adc60] vprintk_emit+0x188/0x1c4
--- interrupt: c0e9df00 at 0x400f330
LR = init_stack+0x1f00/0x2000
[c0e9de80] [c00ae3c4] printk+0xa8/0xcc (unreliable)
[c0e9df20] [c0c27e44] early_irq_init+0x38/0x108
[c0e9df50] [c0c15434] start_kernel+0x310/0x488
[c0e9dff0] [00003484] 0x3484With this patch the trace becomes:
Call Trace: [c0e9dca0] [c01c42c0] print_address_description+0x64/0x2bc (unreliable) [c0e9dcd0] [c01c46a4] kasan_report+0xfc/0x180 [c0e9dd10] [c0895150] memchr+0x24/0x74 [c0e9dd30] [c00a9e58] msg_print_text+0x124/0x574 [c0e9dde0] [c00ab730] console_unlock+0x114/0x4f8 [c0e9de40] [c00adc80] vprintk_emit+0x188/0x1c4 [c0e9de80] [c00ae3e4] printk+0xa8/0xcc [c0e9df20] [c0c27e44] early_irq_init+0x38/0x108 [c0e9df50] [c0c15434] start_kernel+0x310/0x488 [c0e9dff0] [00003484] 0x3484
--- arch/powerpc/kernel/entry_32.S | 9 +++++++++ 1 file changed, 9 insertions(+)
arch/powerpc/kernel/entry_32.S +9 -0
@@ -757,6 +757,9 @@ fast_exception_return: mtcr r10 lwz r10,_LINK(r11) mtlr r10 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r11) REST_GPR(10, r11) mtspr SPRN_SRR1,r9 mtspr SPRN_SRR0,r12
@@ -987,6 +990,9 @@ END_FTR_SECTION_IFSET(CPU_FTR_NEED_PAIRE mtcrf 0xFF,r10 mtlr r11 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r1) /* * Once we put values in SRR0 and SRR1, we are in a state * where exceptions are not recoverable, since taking an
@@ -1024,6 +1030,9 @@ exc_exit_restart_end: mtlr r11 lwz r10,_CCR(r1) mtcrf 0xff,r10 + /* Clear the exception_marker on the stack to avoid confusing stacktrace */ + li r10, 0 + stw r10, 8(r1) REST_2GPRS(9, r1) .globl exc_exit_restart exc_exit_restart:
Greg Kroah-Hartman
maintainerPATCH 125/134 powerpc/wii: properly disable use of BATs when requested.
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 6d183ca8baec983dc4208ca45ece3c36763df912 upstream.
'nobats' kernel parameter or some options like CONFIG_DEBUG_PAGEALLOC deny the use of BATS for mapping memory.
This patch makes sure that the specific wii RAM mapping function takes it into account as well.
--- arch/powerpc/platforms/embedded6xx/wii.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/platforms/embedded6xx/wii.c +4 -0
@@ -104,6 +104,10 @@ unsigned long __init wii_mmu_mapin_mem2(/* MEM2 64MB@0x10000000 */ delta = wii_hole_start + wii_hole_size; size = top - delta; + +if (__map_without_bats) +return delta; +for (bl =128 <<10 ; bl < max_size; bl <<=1 ) {if (bl *2 > size)break ;
Greg Kroah-Hartman
maintainerPATCH 126/134 powerpc/powernv: Make opal log only readable by root
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Niethe <[email protected]>
commit 7b62f9bd2246b7d3d086e571397c14ba52645ef1 upstream.
Currently the opal log is globally readable. It is kernel policy to limit the visibility of physical addresses / kernel pointers to root. Given this and the fact the opal log may contain this information it would be better to limit the readability to root.
--- arch/powerpc/platforms/powernv/opal-msglog.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/powernv/opal-msglog.c +1 -1
@@ -92,7 +92,7 @@ out: }static struct bin_attribute opal_msglog_attr = { - .attr = {.name ="msglog" , .mode =0444 }, + .attr = {.name ="msglog" , .mode =0400 }, .read = opal_msglog_read };
Greg Kroah-Hartman
maintainerPATCH 127/134 powerpc/83xx: Also save/restore SPRG4-7 during suspend
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
commit 36da5ff0bea2dc67298150ead8d8471575c54c7d upstream.
The 83xx has 8 SPRG registers and uses at least SPRG4 for DTLB handling LRU.
--- arch/powerpc/platforms/83xx/suspend-asm.S | 34 +++++++++++++++++++++++------- 1 file changed, 27 insertions(+), 7 deletions(-)
arch/powerpc/platforms/83xx/suspend-asm.S +27 -7
@@ -26,13 +26,13 @@ #define SS_MSR 0x74 #define SS_SDR1 0x78 #define SS_LR 0x7c -#define SS_SPRG 0x80 /* 4 SPRGs */ -#define SS_DBAT 0x90 /* 8 DBATs */ -#define SS_IBAT 0xd0 /* 8 IBATs */ -#define SS_TB 0x110 -#define SS_CR 0x118 -#define SS_GPREG 0x11c /* r12-r31 */ -#define STATE_SAVE_SIZE 0x16c +#define SS_SPRG 0x80 /* 8 SPRGs */ +#define SS_DBAT 0xa0 /* 8 DBATs */ +#define SS_IBAT 0xe0 /* 8 IBATs */ +#define SS_TB 0x120 +#define SS_CR 0x128 +#define SS_GPREG 0x12c /* r12-r31 */ +#define STATE_SAVE_SIZE 0x17c .section .data .align 5
@@ -103,6 +103,16 @@ _GLOBAL(mpc83xx_enter_deep_sleep) stw r7, SS_SPRG+12(r3) stw r8, SS_SDR1(r3) + mfspr r4, SPRN_SPRG4 + mfspr r5, SPRN_SPRG5 + mfspr r6, SPRN_SPRG6 + mfspr r7, SPRN_SPRG7 + + stw r4, SS_SPRG+16(r3) + stw r5, SS_SPRG+20(r3) + stw r6, SS_SPRG+24(r3) + stw r7, SS_SPRG+28(r3) + mfspr r4, SPRN_DBAT0U mfspr r5, SPRN_DBAT0L mfspr r6, SPRN_DBAT1U
@@ -493,6 +503,16 @@ mpc83xx_deep_resume: mtspr SPRN_IBAT7U, r6 mtspr SPRN_IBAT7L, r7 + lwz r4, SS_SPRG+16(r3) + lwz r5, SS_SPRG+20(r3) + lwz r6, SS_SPRG+24(r3) + lwz r7, SS_SPRG+28(r3) + + mtspr SPRN_SPRG4, r4 + mtspr SPRN_SPRG5, r5 + mtspr SPRN_SPRG6, r6 + mtspr SPRN_SPRG7, r7 + lwz r4, SS_SPRG+0(r3) lwz r5, SS_SPRG+4(r3) lwz r6, SS_SPRG+8(r3)
Greg Kroah-Hartman
maintainerPATCH 128/134 ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit e2477233145f2156434afb799583bccd878f3e9f upstream.
Fix boolean expressions by using logical AND operator '&&' instead of bitwise operator '&'.
This issue was detected with the help of Coccinelle.
--- arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/mach-s3c24xx/mach-osiris-dvs.c +4 -4
@@ -70,16 +70,16 @@ static int osiris_dvs_notify(struct notiswitch (val) {case CPUFREQ_PRECHANGE : -if (old_dvs & !new_dvs || - cur_dvs & !new_dvs) { +if ((old_dvs && !new_dvs) || + (cur_dvs && !new_dvs)) {pr_debug ("%s: exiting dvs\n" , __func__); cur_dvs = false;gpio_set_value (OSIRIS_GPIO_DVS ,1 ); }break ;case CPUFREQ_POSTCHANGE : -if (!old_dvs & new_dvs || - !cur_dvs & new_dvs) { +if ((!old_dvs && new_dvs) || + (!cur_dvs && new_dvs)) {pr_debug ("entering dvs\n" ); cur_dvs = true;gpio_set_value (OSIRIS_GPIO_DVS ,0 );
Greg Kroah-Hartman
maintainerPATCH 129/134 nfsd: fix memory corruption caused by readdir
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit b602345da6cbb135ba68cf042df8ec9a73da7981 upstream.
If the result of an NFSv3 readdir{,plus} request results in the "offset" on one entry having to be split across 2 pages, and is sized so that the next directory entry doesn't fit in the requested size, then memory corruption can happen.
When encode_entry() is called after encoding the last entry that fits, it notices that ->offset and ->offset1 are set, and so stores the offset value in the two pages as required. It clears ->offset1 but *does not* clear ->offset.
Normally this omission doesn't matter as encode_entry_baggage() will be called, and will set ->offset to a suitable value (not on a page boundary).
But in the case where cd->buflen < elen and nfserr_toosmall is returned, ->offset is not reset.
This means that nfsd3proc_readdirplus will see ->offset with a value 4 bytes before the end of a page, and ->offset1 set to NULL. It will try to write 8bytes to ->offset.
If we are lucky, the next page will be read-only, and the system will
BUG: unable to handle kernel paging request at...
If we are unlucky, some innocent page will have the first 4 bytes corrupted.
nfsd3proc_readdir() doesn't even check for ->offset1, it just blindly writes 8 bytes to the offset wherever it is.
Fix this by clearing ->offset after it is used, and copying the ->offset handling code from nfsd3_proc_readdirplus into nfsd3_proc_readdir.
(Note that the commit hash in the Fixes tag is from the 'history'
tree - this bug predates git).
Fixes-URL: https://git.kernel.org/pub/scm/linux/kernel/git/history/history.git/commit/?id=0b1d57cf7654
--- fs/nfsd/nfs3proc.c | 16 ++++++++++++++-- fs/nfsd/nfs3xdr.c | 1 + 2 files changed, 15 insertions(+), 2 deletions(-)
fs/nfsd/nfs3proc.c +14 -2
@@ -430,8 +430,19 @@ nfsd3_proc_readdir(struct svc_rqst *rqst &resp->common, nfs3svc_encode_entry);memcpy (resp->verf, argp->verf,8 ); resp->count = resp->buffer - argp->buffer; -if (resp->offset) -xdr_encode_hyper (resp->offset, argp->cookie); +if (resp->offset) { +loff_t offset = argp->cookie; + +if (unlikely (resp->offset1)) { +/* we ended up with offset on a page boundary */ + *resp->offset =htonl (offset >>32 ); + *resp->offset1 =htonl (offset &0xffffffff ); + resp->offset1 =NULL ; + }else { +xdr_encode_hyper (resp->offset, offset); + } + resp->offset =NULL ; + }RETURN_STATUS (nfserr); }
@@ -499,6 +510,7 @@ nfsd3_proc_readdirplus(struct svc_rqst * }else {xdr_encode_hyper (resp->offset, offset); } + resp->offset =NULL ; }RETURN_STATUS (nfserr);
fs/nfsd/nfs3xdr.c +1 -0
@@ -892,6 +892,7 @@ encode_entry(struct readdir_cd *ccd, con }else {xdr_encode_hyper (cd->offset, offset64); } + cd->offset =NULL ; }/*
Greg Kroah-Hartman
maintainerPATCH 130/134 nfsd: fix wrong check in write_v4_end_grace()
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihao Wu <[email protected]>
commit dd838821f0a29781b185cd8fb8e48d5c177bd838 upstream.
Commit 62a063b8e7d1 "nfsd4: fix crash on writing v4_end_grace before nfsd startup" is trying to fix a NULL dereference issue, but it mistakenly checks if the nfsd server is started. So fix it.
--- fs/nfsd/nfsctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfsctl.c +1 -1
@@ -1110,7 +1110,7 @@ static ssize_t write_v4_end_grace(structcase 'Y' :case 'y' :case '1' : -if (nn->nfsd_serv) +if (!nn->nfsd_serv)return -EBUSY ;nfsd4_end_grace (nn);break ;
Greg Kroah-Hartman
maintainerPATCH 131/134 md: Fix failed allocation of md_register_thread
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aditya Pakki <[email protected]>
commit e406f12dde1a8375d77ea02d91f313fb1a9c6aec upstream.
mddev->sync_thread can be set to NULL on kzalloc failure downstream. The patch checks for such a scenario and frees allocated resources.
Committer node:
Added similar fix to raid5.c, as suggested by Guoqing.
--- drivers/md/raid10.c | 2 ++ drivers/md/raid5.c | 2 ++ 2 files changed, 4 insertions(+)
drivers/md/raid10.c +2 -0
@@ -3836,6 +3836,8 @@ static int run(struct mddev *mddev)set_bit (MD_RECOVERY_RUNNING , &mddev->recovery); mddev->sync_thread =md_register_thread (md_do_sync, mddev,"reshape" ); +if (!mddev->sync_thread) + goto out_free_conf; }return 0 ;
drivers/md/raid5.c +2 -0
@@ -6171,6 +6171,8 @@ static int run(struct mddev *mddev)set_bit (MD_RECOVERY_RUNNING , &mddev->recovery); mddev->sync_thread =md_register_thread (md_do_sync, mddev,"reshape" ); +if (!mddev->sync_thread) + goto abort; }/* Ok, everything is just fine now */
Greg Kroah-Hartman
maintainerPATCH 132/134 rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang, Jun <[email protected]>
commit 1d1f898df6586c5ea9aeaf349f13089c6fa37903 upstream.
The rcu_gp_kthread_wake() function is invoked when it might be necessary to wake the RCU grace-period kthread. Because self-wakeups are normally a useless waste of CPU cycles, if rcu_gp_kthread_wake() is invoked from this kthread, it naturally refuses to do the wakeup.
Unfortunately, natural though it might be, this heuristic fails when rcu_gp_kthread_wake() is invoked from an interrupt or softirq handler that interrupted the grace-period kthread just after the final check of the wait-event condition but just before the schedule() call. In this case, a wakeup is required, even though the call to rcu_gp_kthread_wake() is within the RCU grace-period kthread's context. Failing to provide this wakeup can result in grace periods failing to start, which in turn results in out-of-memory conditions.
This race window is quite narrow, but it actually did happen during real testing. It would of course need to be fixed even if it was strictly theoretical in nature.
This patch does not Cc stable because it does not apply cleanly to earlier kernel versions.
Signed-off: "Zhang, Jun" <[email protected]>
Signed-off: "He, Bo" <[email protected]>
Signed-off: "xiao, jin" <[email protected]>
Signed-off: Bai, Jie A <[email protected]>
[ paulmck: Switch from !in_softirq() to "!in_interrupt() &&
!in_serving_softirq() to avoid redundant wakeups and to also handle the interrupt-handler scenario as well as the softirq-handler scenario that actually occurred in testing. ]
--- kernel/rcu/tree.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
kernel/rcu/tree.c +14 -6
@@ -1399,15 +1399,23 @@ static int rcu_future_gp_cleanup(struct }/* -* Awaken the grace-period kthread for the specified flavor of RCU. -* Don't do a self-awaken, and don't bother awakening when there is -* nothing for the grace-period kthread to do (as in several CPUs -* raced to awaken, and we lost), and finally don't try to awaken -* a kthread that has not yet been created. +* Awaken the grace-period kthread. Don't do a self-awaken (unless in +* an interrupt or softirq handler), and don't bother awakening when there +* is nothing for the grace-period kthread to do (as in several CPUs raced +* to awaken, and we lost), and finally don't try to awaken a kthread that +* has not yet been created. If all those checks are passed, track some +* debug information and awaken. +* +* So why do the self-wakeup when in an interrupt or softirq handler +* in the grace-period kthread's context? Because the kthread might have +* been interrupted just as it was going to sleep, and just after the final +* pre-sleep check of the awaken condition. In this case, a wakeup really +* is required, and is therefore supplied. */ static void rcu_gp_kthread_wake (struct rcu_state *rsp) { -if (current == rsp->gp_kthread || +if ((current == rsp->gp_kthread && + !in_interrupt () && !in_serving_softirq ()) || !ACCESS_ONCE (rsp->gp_flags) || !rsp->gp_kthread)return ;
RE: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:
Comments from Paul:
I subjected all of the others to light rcutorture testing, which they passed. This v3.18 patch hung, however. Trying it again with stock v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.
Worth paying special attention to further test results from 3.18.x, though!
-----Original Message-----
From: Greg Kroah-Hartman <[email protected]>
Sent: Friday, March 22, 2019 7:16 PM
To: [email protected]
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; He, Bo <[email protected]>; Zhang, Jun <[email protected]>; Paul E. McKenney <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang, Jun <[email protected]>
commit 1d1f898df6586c5ea9aeaf349f13089c6fa37903 upstream.
The rcu_gp_kthread_wake() function is invoked when it might be necessary to wake the RCU grace-period kthread. Because self-wakeups are normally a useless waste of CPU cycles, if rcu_gp_kthread_wake() is invoked from this kthread, it naturally refuses to do the wakeup.
Unfortunately, natural though it might be, this heuristic fails whenrcu_gp_kthread_wake() is invoked from an interrupt or softirq handler that interrupted the grace-period kthread just after the final check of the wait-event condition but just before the schedule() call. In this case, a wakeup is required, even though the call to rcu_gp_kthread_wake() is within the RCU grace-period kthread's context. Failing to provide this wakeup can result in grace periods failing to start, which in turn results in out-of-memory conditions.
This race window is quite narrow, but it actually did happen during real testing. It would of course need to be fixed even if it was strictly theoretical in nature.
This patch does not Cc stable because it does not apply cleanly to earlier kernel versions.
Signed-off: "Zhang, Jun" <[email protected]>
Signed-off: "He, Bo" <[email protected]>
Signed-off: "xiao, jin" <[email protected]>
Signed-off: Bai, Jie A <[email protected]>
!in_serving_softirq() to avoid redundant wakeups and to also handle the interrupt-handler scenario as well as the softirq-handler scenario that actually occurred in testing. ]
--- kernel/rcu/tree.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-)
kernel/rcu/tree.c +19 -6
@@ -1399,15 +1399,23 @@ static int rcu_future_gp_cleanup(struct }/* -* Awaken the grace-period kthread for the specified flavor of RCU. -* Don't do a self-awaken, and don't bother awakening when there is -* nothing for the grace-period kthread to do (as in several CPUs -* raced to awaken, and we lost), and finally don't try to awaken -* a kthread that has not yet been created. +* Awaken the grace-period kthread. Don't do a self-awaken (unless in +* an interrupt or softirq handler), and don't bother awakening when +there +* is nothing for the grace-period kthread to do (as in several CPUs +raced +* to awaken, and we lost), and finally don't try to awaken a kthread +that +* has not yet been created. If all those checks are passed, track +some +* debug information and awaken. +* +* So why do the self-wakeup when in an interrupt or softirq handler +* in the grace-period kthread's context? Because the kthread might +have +* been interrupted just as it was going to sleep, and just after the +final +* pre-sleep check of the awaken condition. In this case, a wakeup +really +* is required, and is therefore supplied. */ static void rcu_gp_kthread_wake (struct rcu_state *rsp) { - if (current == rsp->gp_kthread ||
+ if ((current == rsp->gp_kthread &&
+ !in_interrupt() && !in_serving_softirq()) ||
!ACCESS_ONCE(rsp->gp_flags) ||
!rsp->gp_kthread)
return;
Greg Kroah-Hartman
maintainerRe: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 8 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which they passed. This v3.18 patch hung, however. Trying it again with stock v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
greg k-h
Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 11 lines · Greg Kroah-Hartman
Quoted 8 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which they passed. This v3.18 patch hung, however. Trying it again with stock v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
RE: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hi, Paul:
I have tried on my PC and not hit any hang issue with RCU torture test for one hour, the configurations are like:
OS: ubuntu 16.04
kenrel: 3.18.136 + 3.18 rcu patch
CPU: Intel(R) Xeon(R) CPU E3-1225 V2 @ 3.20GHz
-----Original Message-----
From: Paul E. McKenney <[email protected]>
Sent: Tuesday, March 26, 2019 12:00 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: He, Bo <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which
they passed. This v3.18 patch hung, however. Trying it again with
stock
v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.
Quoted 3 lines
Quoted 1 line
Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 5 lines · Bo
Hi, Paul:
I have tried on my PC and not hit any hang issue with RCU torture test for one hour, the configurations are like:
OS: ubuntu 16.04
kenrel: 3.18.136 + 3.18 rcu patch
CPU: Intel(R) Xeon(R) CPU E3-1225 V2 @ 3.20GHz
Sounds good, please proceed!
Thanx, Paul
Quoted 26 lines
-----Original Message-----
From: Paul E. McKenney <[email protected]>
Sent: Tuesday, March 26, 2019 12:00 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: He, Bo <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which
they passed. This v3.18 patch hung, however. Trying it again with
stock
v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Quoted 3 lines
Quoted 1 line
Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
RE: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hello，Paul
I use a new NUC (made in 2017) to test, meet the same hang. System run very slowly.
But I use my PC (made before 2015), test V3.18.136+ patch for 12 hours, still well.
Maybe V3.18.y don't support some new devices.
-----Original Message-----
From: Paul E. McKenney [mailto:[email protected]]
Sent: Tuesday, March 26, 2019 23:56
To: He, Bo <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 5 lines · Bo
Hi, Paul:
I have tried on my PC and not hit any hang issue with RCU torture test for one hour, the configurations are like:
OS: ubuntu 16.04
kenrel: 3.18.136 + 3.18 rcu patch
CPU: Intel(R) Xeon(R) CPU E3-1225 V2 @ 3.20GHz
Sounds good, please proceed!
Thanx, Paul
Quoted 29 lines
-----Original Message-----
From: Paul E. McKenney <[email protected]>
Sent: Tuesday, March 26, 2019 12:00 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: He, Bo <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which
they passed. This v3.18 patch hung, however. Trying it again
with stock
v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Quoted 3 lines
Quoted 1 line
Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hello, Jun,
Do you see the same hang without the patch?
Thanx, Paul
Quoted 57 lines · Jun
Hello，Paul
I use a new NUC (made in 2017) to test, meet the same hang. System run very slowly.
But I use my PC (made before 2015), test V3.18.136+ patch for 12 hours, still well.
Maybe V3.18.y don't support some new devices.
-----Original Message-----
From: Paul E. McKenney [mailto:[email protected]]
Sent: Tuesday, March 26, 2019 23:56
To: He, Bo <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 5 lines · Bo
Hi, Paul:
I have tried on my PC and not hit any hang issue with RCU torture test for one hour, the configurations are like:
OS: ubuntu 16.04
kenrel: 3.18.136 + 3.18 rcu patch
CPU: Intel(R) Xeon(R) CPU E3-1225 V2 @ 3.20GHzSounds good, please proceed!
Thanx, Paul
Quoted 29 lines
-----Original Message-----
From: Paul E. McKenney <[email protected]>
Sent: Tuesday, March 26, 2019 12:00 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: He, Bo <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which
they passed. This v3.18 patch hung, however. Trying it again
with stock
v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Quoted 3 lines
Quoted 1 line
Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
RE: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hello, Paul
Yes, I only use original V3.18.136 to test. Because system run very slowly, I give up.
Device: NUC (made in 2017)
OS: ubuntu 16.04
Kernel: V3.18.136 (come from https://kernel.ubuntu.com/~kernel-ppa/mainline/v3.18.136/)
System can boot, but run very slowly, and couldn't connect the network. This make me not to work with terminal, because system very slowly.
So I don’t use V3.18.136+patch to test.
-----Original Message-----
From: Paul E. McKenney [mailto:[email protected]]
Sent: Wednesday, March 27, 2019 23:10
To: Zhang, Jun <[email protected]>
Cc: He, Bo <[email protected]>; Greg Kroah-Hartman <[email protected]>; [email protected]; [email protected]; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Hello, Jun,
Do you see the same hang without the patch?
Thanx, Paul
Quoted 61 lines · Jun
Hello，Paul
I use a new NUC (made in 2017) to test, meet the same hang. System run very slowly.
But I use my PC (made before 2015), test V3.18.136+ patch for 12 hours, still well.
Maybe V3.18.y don't support some new devices.
-----Original Message-----
From: Paul E. McKenney [mailto:[email protected]]
Sent: Tuesday, March 26, 2019 23:56
To: He, Bo <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 5 lines · Bo
Hi, Paul:
I have tried on my PC and not hit any hang issue with RCU torture test for one hour, the configurations are like:
OS: ubuntu 16.04
kenrel: 3.18.136 + 3.18 rcu patch
CPU: Intel(R) Xeon(R) CPU E3-1225 V2 @ 3.20GHzSounds good, please proceed!
Thanx, Paul
Quoted 29 lines
-----Original Message-----
From: Paul E. McKenney <[email protected]>
Sent: Tuesday, March 26, 2019 12:00 AM
To: Greg Kroah-Hartman <[email protected]>
Cc: He, Bo <[email protected]>; [email protected]; [email protected]; Zhang, Jun <[email protected]>; Xiao, Jin <[email protected]>; Bai, Jie A <[email protected]>
Subject: Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interruptQuoted 10 lines · Greg Kroah-Hartman
Quoted 9 lines · Bo
Hi, Greg:
Can you hold on the 3.18-stable branch, it seems there are some issue, please see the comments from Paul:Comments from Paul:
I subjected all of the others to light rcutorture testing, which
they passed. This v3.18 patch hung, however. Trying it again
with stock
v3.18 got the same hang, so I believe we can exonerate the patch and give it a good firm "maybe" on 3.18.Quoted 3 lines
Quoted 1 line
Worth paying special attention to further test results from 3.18.x, though!
Ok, I've dropped this from the 3.18.y queue now, thanks.
Bo, if you know of a "y" for 3.18.y that would likely pass rcutorture testing, please let me know.
Thanx, Paul
Greg Kroah-Hartman
maintainerRe: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 10 lines · Jun
Hello, Paul
Yes, I only use original V3.18.136 to test. Because system run very slowly, I give up.
Device: NUC (made in 2017)
OS: ubuntu 16.04
Kernel: V3.18.136 (come from https://kernel.ubuntu.com/~kernel-ppa/mainline/v3.18.136/)
System can boot, but run very slowly, and couldn't connect the network. This make me not to work with terminal, because system very slowly.
So I don’t use V3.18.136+patch to test.
Please do not worry about 3.18.y if it is any problem, I only keep it alive for a few users and if they have not reported issues yet, it is fine. Please do not do any extra work for this kernel tree at all, it is just too old :)
thanks,
greg k-h
Re: [PATCH 3.18 132/134] rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Quoted 12 lines · Greg Kroah-Hartman
Quoted 10 lines · Jun
Hello, Paul
Yes, I only use original V3.18.136 to test. Because system run very slowly, I give up.
Device: NUC (made in 2017)
OS: ubuntu 16.04
Kernel: V3.18.136 (come from https://kernel.ubuntu.com/~kernel-ppa/mainline/v3.18.136/)
System can boot, but run very slowly, and couldn't connect the network. This make me not to work with terminal, because system very slowly.
So I don’t use V3.18.136+patch to test.
Quoted 4 lines
Please do not worry about 3.18.y if it is any problem, I only keep it alive for a few users and if they have not reported issues yet, it is fine. Please do not do any extra work for this kernel tree at all, it is just too old :)
Very good. ;-)
From what I can see, if 3.18.y works for them, then 3.18.y+patch should also work for them.
Thanx, Paul
Greg Kroah-Hartman
maintainerPATCH 133/134 media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <[email protected]>
commit 9dd0627d8d62a7ddb001a75f63942d92b5336561 upstream.
The UVC video driver converts the timestamp from hardware specific unit to one known by the kernel at the time when the buffer is dequeued. This is fine in general, but the streamoff operation consists of the following steps (among other things):
1. uvc_video_clock_cleanup --- the hardware clock sample array is released and the pointer to the array is set to NULL,
2. buffers in active state are returned to the user and
3. buf_finish callback is called on buffers that are prepared. buf_finish includes calling uvc_video_clock_update that accesses the hardware clock sample array.
The above is serialised by a queue specific mutex. Address the problem by skipping the clock conversion if the hardware clock sample array is already released.
--- drivers/media/usb/uvc/uvc_video.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/media/usb/uvc/uvc_video.c +8 -0
@@ -627,6 +627,14 @@ void uvc_video_clock_update(struct uvc_su32 rem;u64 y; +/* +* We will get called from __vb2_queue_cancel() if there are buffers +* done but not dequeued by the user, but the sample array has already +* been released at that time. Just bail out in that case. +*/ +if (!clock->samples) +return ; +spin_lock_irqsave (&clock->lock, flags);if (clock->count < clock->size)
Greg Kroah-Hartman
maintainerPATCH 134/134 drm/radeon/evergreen_cs: fix missing break in switch statement
In reply to Greg Kroah-Hartman3.18-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit cc5034a5d293dd620484d1d836aa16c6764a1c8c upstream.
Add missing break statement in order to prevent the code from falling through to case CB_TARGET_MASK.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/gpu/drm/radeon/evergreen_cs.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/radeon/evergreen_cs.c +1 -0
@@ -1318,6 +1318,7 @@ static int evergreen_cs_check_reg(structreturn -EINVAL ; } ib[idx] += (u32)((reloc->gpu_offset >>8 ) &0xffffffff ); +break ;case CB_TARGET_MASK : track->cb_target_mask =radeon_get_ib_value (p, idx); track->cb_dirty = true;
stable-rc/linux-3.18.y boot: 26 boots: 1 failed, 24 passed with 1 untried/unknown (v3.18.136-135-g0ec48545fd19)
stable-rc/linux-3.18.y boot: 26 boots: 1 failed, 24 passed with 1 untried/unknown (v3.18.136-135-g0ec48545fd19)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-3.18.y/kernel/v3.18.136-135-g0ec48545fd19/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-3.18.y/kernel/v3.18.136-135-g0ec48545fd19/
Tree: stable-rc
Branch: linux-3.18.y
Git Describe: v3.18.136-135-g0ec48545fd19
Git Commit: 0ec48545fd19e7d77e038eae2475b73969f53a36
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 10 unique boards, 6 SoC families, 8 builds out of 189
Boot Failure Detected:
x86_64:
x86_64_defconfig:
gcc-7:
minnowboard-turbot-E3826: 1 failed lab---
For more info write to <[email protected]>
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 3.18.137 release. There are 134 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:54 UTC 2019. Anything received after that time might be too late.
Build results:
total: 155 pass: 155 fail: 0 Qemu test results: total: 226 pass: 226 fail: 0
Guenter