4.4.177-stable review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 4.4.177-stable review
This is the start of the stable review cycle for the 4.4.177 release. There are 230 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun Mar 24 11:10:58 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.177-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.177-rc1
Wanpeng Li <[email protected]>
KVM: X86: Fix residual mmio emulation request to userspace
Sean Christopherson <[email protected]>
KVM: nVMX: Ignore limit checks on VMX instructions using flat segments
Sean Christopherson <[email protected]>
KVM: nVMX: Sign extend displacements of VMX instr's mem operands
Gustavo A. R. Silva <[email protected]>
drm/radeon/evergreen_cs: fix missing break in switch statement
Sakari Ailus <[email protected]>
media: uvcvideo: Avoid NULL pointer dereference at the end of streaming
Zhang, Jun <[email protected]>
rcu: Do RCU GP kthread self-wakeup from softirq and interrupt
Viresh Kumar <[email protected]>
PM / wakeup: Rework wakeup source timer cancellation
Yihao Wu <[email protected]>
nfsd: fix wrong check in write_v4_end_grace()
NeilBrown <[email protected]>
nfsd: fix memory corruption caused by readdir
Trond Myklebust <[email protected]>
NFS: Don't recoalesce on error in nfs_pageio_complete_mirror()
Trond Myklebust <[email protected]>
NFS: Fix an I/O request leakage in nfs_do_recoalesce
Aditya Pakki <[email protected]>
md: Fix failed allocation of md_register_thread
Adrian Hunter <[email protected]>
perf intel-pt: Fix overlap calculation for padding
Adrian Hunter <[email protected]>
perf auxtrace: Define auxtrace record alignment
Adrian Hunter <[email protected]>
perf intel-pt: Fix CYC timestamp calculation after OVF
Peng Tao <[email protected]>
NFS41: pop some layoutget errors to application
NeilBrown <[email protected]>
dm: fix to_sector() for 32bit
Gustavo A. R. Silva <[email protected]>
ARM: s3c24xx: Fix boolean expressions in osiris_dvs_notify
Christophe Leroy <[email protected]>
powerpc/83xx: Also save/restore SPRG4-7 during suspend
Jordan Niethe <[email protected]>
powerpc/powernv: Make opal log only readable by root
Christophe Leroy <[email protected]>
powerpc/wii: properly disable use of BATs when requested.
Christophe Leroy <[email protected]>
powerpc/32: Clear on-stack exception marker upon exception return
zhangyi (F) <[email protected]>
jbd2: fix compile warning when using JBUFFER_TRACE
zhangyi (F) <[email protected]>
jbd2: clear dirty flag when revoking a buffer from an older transaction
Jay Dolan <[email protected]>
serial: 8250_pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pci_pericom_setup()
Jay Dolan <[email protected]>
serial: 8250_pci: Fix number of ports for ACCES serial cards
Arnaldo Carvalho de Melo <[email protected]>
perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks
Sowjanya Komatineni <[email protected]>
i2c: tegra: fix maximum transfer size
QiaoChong <[email protected]>
parport_pc: fix find_superio io compare code, should use equal test.
Alexander Shishkin <[email protected]>
intel_th: Don't reference unassigned outputs
Zev Weiss <[email protected]>
kernel/sysctl.c: add missing range check in do_proc_dointvec_minmax_conv
Roman Penyaev <[email protected]>
mm/vmalloc: fix size check for remap_vmalloc_range_partial()
Phuong Nguyen <[email protected]>
dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit
Paul Cercueil <[email protected]>
clk: ingenic: Fix round_rate misbehaving with non-integer dividers
Jan Kara <[email protected]>
ext2: Fix underflow in ext2_max_size()
Jan Kara <[email protected]>
ext4: fix crash during online resizing
Arnd Bergmann <[email protected]>
cpufreq: pxa2xx: remove incorrect __init annotation
Yangtao Li <[email protected]>
cpufreq: tegra124: add missing of_node_put()
Eric Biggers <[email protected]>
crypto: pcbc - remove bogus memcpy()s with src == dest
Filipe Manana <[email protected]>
Btrfs: fix corruption reading shared and compressed extents after hole punching
Johannes Thumshirn <[email protected]>
btrfs: ensure that a DUP or RAID1 block group has exactly two stripes
Finn Thain <[email protected]>
m68k: Add -ffreestanding to CFLAGS
Bart Van Assche <[email protected]>
scsi: target/iscsi: Avoid iscsit_release_commands_from_conn() deadlock
Felipe Franciosi <[email protected]>
scsi: virtio_scsi: don't send sc payload with tmfs
Halil Pasic <[email protected]>
s390/virtio: handle find on invalid queue gracefully
Stuart Menefy <[email protected]>
clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown
Stuart Menefy <[email protected]>
clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR
Stuart Menefy <[email protected]>
regulator: s2mpa01: Fix step values for some LDOs
Krzysztof Kozlowski <[email protected]>
regulator: s2mps11: Fix steps for buck7, buck8 and LDO35
Andy Shevchenko <[email protected]>
ACPI / device_sysfs: Avoid OF modalias creation for removed device
zhangyi (F) <[email protected]>
tracing: Do not free iter->trace in fail path of tracing_open_pipe()
Pavel Shilovsky <[email protected]>
CIFS: Fix read after write for files with read caching
Ard Biesheuvel <[email protected]>
crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling
Alexander Shishkin <[email protected]>
stm class: Prevent division by zero
Darrick J. Wong <[email protected]>
tmpfs: fix uninitialized return value in shmem_link
Mao Wenan <[email protected]>
net: set static variable an initial value in atl2_probe()
Li RongQing <[email protected]>
mac80211_hwsim: propagate genlmsg_reply return code
Arnd Bergmann <[email protected]>
phonet: fix building with clang
Vineet Gupta <[email protected]>
ARC: uacces: remove lp_start, lp_end from clobber list
Darrick J. Wong <[email protected]>
tmpfs: fix link accounting when a tmpfile is linked in
Vladimir Murzin <[email protected]>
arm64: Relax GIC version check during early boot
Bard liao <[email protected]>
ASoC: topology: free created components in tplg load error
Alexey Khoroshilov <[email protected]>
net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe()
Martin Blumenstingl <[email protected]>
pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins
Florian Fainelli <[email protected]>
net: systemport: Fix reception of BPDUs
Anoob Soman <[email protected]>
scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task
David Howells <[email protected]>
assoc_array: Fix shortcut creation
Dietmar Eggemann <[email protected]>
ARM: 8824/1: fix a migrating irq bug when hotplug cpu
Gabriel Fernandez <[email protected]>
Input: st-keyscan - fix potential zalloc NULL dereference
Shubhrajyoti Datta <[email protected]>
i2c: cadence: Fix the hold bit setting
Dmitry Torokhov <[email protected]>
Input: matrix_keypad - use flush_delayed_work()
Yizhuo <[email protected]>
ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
Stefan Haberland <[email protected]>
s390/dasd: fix using offset into zero size array error
Steve Longerbeam <[email protected]>
gpu: ipu-v3: Fix CSI offsets for imx53
Alexander Shiyan <[email protected]>
gpu: ipu-v3: Fix i.MX51 CSI control registers offset
Eric Biggers <[email protected]>
crypto: ahash - fix another early termination in hash walk
Pankaj Gupta <[email protected]>
crypto: caam - fixed handling of sg list
Zhi Jin <[email protected]>
stm class: Fix an endless loop in channel allocation
S.j. Wang <[email protected]>
ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
zhengbin <[email protected]>
9p/net: fix memory leak in p9_client_create
Hou Tao <[email protected]>
9p: use inode->i_lock to protect i_size_write() under 32-bit
Hans Verkuil <[email protected]>
media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
Xiao Ni <[email protected]>
It's wrong to add len to sector_nr in raid10 reshape twice
Sasha Levin <[email protected]>
fs/9p: use fscache mutex rather than spinlock
Takashi Sakamoto <[email protected]>
ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
Eric Dumazet <[email protected]>
tcp/dccp: remove reqsk_put() from inet_child_forget()
Eric Dumazet <[email protected]>
gro_cells: make sure device is up in gro_cells_receive()
Eric Dumazet <[email protected]>
net/hsr: fix possible crash in add_timer()
Stefano Brivio <[email protected]>
vxlan: Fix GRO cells race condition between receive and link delete
Eric Dumazet <[email protected]>
vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
Daniel Borkmann <[email protected]>
ipvlan: disallow userns cap_net_admin to change global mode/flags
Al Viro <[email protected]>
missing barriers in some of unix_sock ->addr and ->path accesses
Kalash Nainwal <[email protected]>
net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
YueHaibing <[email protected]>
mdio_bus: Fix use-after-free on device_register fails
Eric Dumazet <[email protected]>
net/x25: fix a race in x25_bind()
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix qp mtt size calculation
Jack Morgenstein <[email protected]>
net/mlx4_core: Fix reset flow when in command polling mode
Guillaume Nault <[email protected]>
tcp: handle inet_csk_reqsk_queue_add() failures
Xin Long <[email protected]>
route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
Masaru Nagai <[email protected]>
ravb: Decrease TxFIFO depth of Q3 and Q2 to one
Xin Long <[email protected]>
pptp: dst_release sk_dst_cache in pptp_sock_destruct
Eric Dumazet <[email protected]>
net/x25: reset state in x25_connect()
Eric Dumazet <[email protected]>
net/x25: fix use-after-free in x25_device_event()
Miaohe Lin <[email protected]>
net: sit: fix UBSAN Undefined behaviour in check_6rd
Mao Wenan <[email protected]>
net: hsr: fix memory leak in hsr_dev_finalize()
Eric Dumazet <[email protected]>
l2tp: fix infoleak in l2tp_ip6_recvmsg()
Eric Biggers <[email protected]>
KEYS: restrict /proc/keys by credentials at open time
Jozsef Kadlecsik <[email protected]>
netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
Phil Turnbull <[email protected]>
netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
Ken-ichirou MATSUZAWA <[email protected]>
netfilter: nfnetlink_log: just returns error for unknown command
Pablo Neira Ayuso <[email protected]>
netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
Eric Dumazet <[email protected]>
udplite: call proper backlog handlers
Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420
Sasha Levin <[email protected]>
Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
Marek Szyprowski <[email protected]>
ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
Peter Zijlstra <[email protected]>
futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
Gustavo A. R. Silva <[email protected]>
iscsi_ibft: Fix missing break in switch statement
Vincent Batts <[email protected]>
Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
Jason Gerecke <[email protected]>
Input: wacom_serial4 - add support for Wacom ArtPad II tablet
Jun-Ru Chang <[email protected]>
MIPS: Remove function size check in get_frame_info()
Jiri Olsa <[email protected]>
perf symbols: Filter out hidden symbols from labels
Julian Wiedmann <[email protected]>
s390/qeth: fix use-after-free in error path
Andy Shevchenko <[email protected]>
dmaengine: dmatest: Abort test in case of mapping error
Codrin Ciubotariu <[email protected]>
dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
Lubomir Rintel <[email protected]>
irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
Peng Hao <[email protected]>
ARM: pxa: ssp: unneeded to free devm_ allocated data
Ian Kent <[email protected]>
autofs: fix error return in autofs_fill_super()
Pan Bian <[email protected]>
autofs: drop dentry reference only when it is never used
Jan Kara <[email protected]>
fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
Mikhail Zaslonko <[email protected]>
mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
Michal Hocko <[email protected]>
mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
Qian Cai <[email protected]>
x86_64: increase stack size for KASAN_EXTRA
Kairui Song <[email protected]>
x86/kexec: Don't setup EFI info if EFI runtime is not enabled
Ronnie Sahlberg <[email protected]>
cifs: fix computation for MAX_SMB2_HDR_SIZE
Sinan Kaya <[email protected]>
platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
Ming Lu <[email protected]>
scsi: libfc: free skb when receiving invalid flogi resp
Yao Liu <[email protected]>
nfs: Fix NULL pointer dereference of dev_name
Andrew Lunn <[email protected]>
gpio: vf610: Mask all GPIO interrupts
Alexey Khoroshilov <[email protected]>
net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
Yonglong Liu <[email protected]>
net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
Tomonori Sakita <[email protected]>
net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
Max Filippov <[email protected]>
xtensa: SMP: limit number of possible CPUs by NR_CPUS
Max Filippov <[email protected]>
xtensa: SMP: mark each possible CPU as present
Max Filippov <[email protected]>
xtensa: smp_lx200_defconfig: fix vectors clash
Max Filippov <[email protected]>
xtensa: SMP: fix secondary CPU initialization
Max Filippov <[email protected]>
xtensa: SMP: fix ccount_timer_shutdown
Suravee Suthikulpanit <[email protected]>
iommu/amd: Fix IOMMU page flush when detach device from a domain
ZhangXiaoxu <[email protected]>
ipvs: Fix signed integer overflow when setsockopt timeout
Brian Welty <[email protected]>
IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
Stephane Eranian <[email protected]>
perf tools: Handle TOPOLOGY headers with no CPU
Su Yanjun <[email protected]>
vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel
Alistair Strachan <[email protected]>
media: uvcvideo: Fix 'type' check leading to overflow
Ido Schimmel <[email protected]>
ip6mr: Do not call __IP6_INC_STATS() from preemptible context
Andrew Lunn <[email protected]>
net: dsa: mv88e6xxx: Fix u64 statistics
Paul Moore <[email protected]>
netlabel: fix out-of-bounds memory accesses
Mike Kravetz <[email protected]>
hugetlbfs: fix races and page leaks during migration
Liu Xiang <[email protected]>
MIPS: irq: Allocate accurate order pages for irq stack
Gustavo A. R. Silva <[email protected]>
applicom: Fix potential Spectre v1 vulnerabilities
Jiaxun Yang <[email protected]>
x86/CPU/AMD: Set the CPB bit unconditionally on F17h
Rajasingh Thavamani <[email protected]>
net: phy: Micrel KSZ8061: link failure after cable connect
Nazarov Sergey <[email protected]>
net: avoid use IPCB in cipso_v4_error
Nazarov Sergey <[email protected]>
net: Add __icmp_send helper.
Igor Druzhinin <[email protected]>
xen-netback: fix occasional leak of grant ref mappings under memory pressure
YueHaibing <[email protected]>
net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
Michael Chan <[email protected]>
bnxt_en: Drop oversize TX packets to prevent errors.
Ido Schimmel <[email protected]>
team: Free BPF filter when unregistering netdev
Kai-Heng Feng <[email protected]>
sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
YueHaibing <[email protected]>
net-sysfs: Fix mem leak in netdev_register_kobject
Dmitry Eremin <[email protected]>
staging: lustre: fix buffer overflow of string buffer
Greg Kroah-Hartman <[email protected]>
isdn: isdn_tty: fix build warning of strncpy
Greg Kroah-Hartman <[email protected]>
ncpfs: fix build warning of strncpy
Andreas Gruenbacher <[email protected]>
sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
Viresh Kumar <[email protected]>
cpufreq: Use struct kobj_attribute instead of struct global_attr
Mans Rullgard <[email protected]>
USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
Ivan Mironov <[email protected]>
USB: serial: cp210x: add ID for Ingenico 3070
Daniele Palmas <[email protected]>
USB: serial: option: add Telit ME910 ECM composition
Andy Lutomirski <[email protected]>
x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
Jann Horn <[email protected]>
mm: enforce min addr even if capable() in expand_downwards()
Jonathan Neuschäfer <[email protected]>
mmc: spi: Fix card detection during probe
Seth Forshee <[email protected]>
powerpc: Always initialize input array when calling epapr_hypercall()
Christoffer Dall <[email protected]>
KVM: arm/arm64: Fix MMIO emulation data handling
Marc Zyngier <[email protected]>
arm/arm64: KVM: Feed initialized memory to MMIO accesses
Vitaly Kuznetsov <[email protected]>
KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
Chaitanya Tata <[email protected]>
cfg80211: extend range deviation for DMG
Balaji Pothunoori <[email protected]>
mac80211: don't initiate TDLS connection if station is not associated to AP
Thomas Falcon <[email protected]>
ibmveth: Do not process frames after calling napi_reschedule
Atsushi Nemoto <[email protected]>
net: altera_tse: fix connect_local_phy error path
Varun Prakash <[email protected]>
scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
Tomonori Sakita <[email protected]>
serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
Bob Copeland <[email protected]>
mac80211: fix miscounting of ttl-dropped frames
Eugeniy Paltsev <[email protected]>
ARC: fix __ffs return value to avoid build warnings
Silvio Cesare <[email protected]>
ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
Silvio Cesare <[email protected]>
ASoC: dapm: change snprintf to scnprintf for possible overflow
Dan Carpenter <[email protected]>
usb: gadget: Potential NULL dereference on allocation error
Zeng Tao <[email protected]>
usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
Dan Carpenter <[email protected]>
thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
Dan Carpenter <[email protected]>
ALSA: compress: prevent potential divide by zero bugs
Rander Wang <[email protected]>
ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
Kristian H. Kristensen <[email protected]>
drm/msm: Unblock writer if reader closes file
John Garry <[email protected]>
scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
Ilya Dryomov <[email protected]>
libceph: handle an empty authorize reply
Hangbin Liu <[email protected]>
Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
Eugeniy Paltsev <[email protected]>
ARCv2: Enable unaligned access in early ASM code
Saeed Mahameed <[email protected]>
net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
Hangbin Liu <[email protected]>
sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
Cong Wang <[email protected]>
team: avoid complex list operations in team_nl_cmd_options_set()
Kal Conley <[email protected]>
net/packet: fix 4gb buffer limit due to overflow check
Eric Dumazet <[email protected]>
batman-adv: fix uninit-value in batadv_interface_tx()
Eric Biggers <[email protected]>
KEYS: always initialize keyring_index_key::desc_len
Eric Biggers <[email protected]>
KEYS: user: Align the payload buffer
Bart Van Assche <[email protected]>
RDMA/srp: Rework SCSI device reset handling
Nathan Chancellor <[email protected]>
isdn: avm: Fix string plus integer warning from Clang
Kangjie Lu <[email protected]>
leds: lp5523: fix a missing check of return value of lp55xx_read
Colin Ian King <[email protected]>
atm: he: fix sign-extension overflow on large shift
Jia-Ju Bai <[email protected]>
isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
Thomas Bogendoerfer <[email protected]>
MIPS: jazz: fix 64bit build
Logan Gunthorpe <[email protected]>
scsi: isci: initialize shost fully before calling scsi_add_host()
YueHaibing <[email protected]>
scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
Alban Bedel <[email protected]>
MIPS: ath79: Enable OF serial ports in the default config
Yonglong Liu <[email protected]>
net: hns: Fix use after free identified by SLUB debug
Kangjie Lu <[email protected]>
mfd: mc13xxx: Fix a missing check of a register-read failure
Charles Keepax <[email protected]>
mfd: wm5110: Add missing ASRC rate register
Jonathan Marek <[email protected]>
mfd: qcom_rpm: write fw_version to CTRL_REG
Dan Carpenter <[email protected]>
mfd: ab8500-core: Return zero in get_register_interruptible()
Nathan Chancellor <[email protected]>
mfd: db8500-prcmu: Fix some section annotations
Nathan Chancellor <[email protected]>
mfd: twl-core: Fix section annotations on {,un}protect_pm_master
Vignesh R <[email protected]>
mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
Eric Biggers <[email protected]>
KEYS: allow reaching the keys quotas exactly
Ralph Campbell <[email protected]>
numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
Yan, Zheng <[email protected]>
ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
-------------
Diffstat:
Makefile | 4 +-
arch/arc/include/asm/bitops.h | 6 +-
arch/arc/include/asm/uaccess.h | 8 +-
arch/arc/kernel/head.S | 10 +
arch/arm/Kconfig | 1 +
arch/arm/boot/dts/exynos3250.dtsi | 3 +
arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi | 25 ++
arch/arm/boot/dts/exynos5420.dtsi | 10 +-
arch/arm/include/asm/irq.h | 1 -
arch/arm/kernel/irq.c | 62 ----
arch/arm/kernel/smp.c | 2 +-
arch/arm/kvm/mmio.c | 10 +-
arch/arm/mach-omap2/display.c | 7 +-
arch/arm/mach-s3c24xx/mach-osiris-dvs.c | 8 +-
arch/arm/plat-pxa/ssp.c | 3 -
arch/arm64/crypto/aes-ce-ccm-core.S | 5 +-
arch/arm64/kernel/head.S | 3 +-
arch/m68k/Makefile | 5 +-
arch/mips/configs/ath79_defconfig | 1 +
arch/mips/jazz/jazzdma.c | 5 +-
arch/mips/kernel/irq.c | 4 +-
arch/mips/kernel/process.c | 7 +-
arch/powerpc/include/asm/epapr_hcalls.h | 12 +-
arch/powerpc/kernel/entry_32.S | 9 +
arch/powerpc/platforms/83xx/suspend-asm.S | 34 ++-
arch/powerpc/platforms/embedded6xx/wii.c | 4 +
arch/powerpc/platforms/powernv/opal-msglog.c | 2 +-
arch/x86/include/asm/page_64_types.h | 4 +
arch/x86/include/asm/uaccess.h | 7 +-
arch/x86/include/asm/uv/bios.h | 8 +-
arch/x86/kernel/cpu/amd.c | 8 +-
arch/x86/kernel/kexec-bzimage64.c | 3 +
arch/x86/kvm/svm.c | 8 +
arch/x86/kvm/vmx.c | 17 +-
arch/x86/kvm/x86.c | 1 +
arch/x86/platform/uv/bios_uv.c | 23 +-
arch/xtensa/configs/smp_lx200_defconfig | 1 +
arch/xtensa/kernel/head.S | 5 +-
arch/xtensa/kernel/smp.c | 41 ++-
arch/xtensa/kernel/time.c | 2 +-
crypto/ahash.c | 14 +-
crypto/pcbc.c | 14 +-
drivers/acpi/device_sysfs.c | 6 +-
drivers/atm/he.c | 2 +-
drivers/base/power/wakeup.c | 8 +-
drivers/char/applicom.c | 35 ++-
drivers/clk/ingenic/cgu.c | 10 +-
drivers/clocksource/exynos_mct.c | 23 +-
drivers/cpufreq/cpufreq.c | 6 +-
drivers/cpufreq/cpufreq_governor.h | 10 +-
drivers/cpufreq/intel_pstate.c | 14 +-
drivers/cpufreq/pxa2xx-cpufreq.c | 4 +-
drivers/cpufreq/tegra124-cpufreq.c | 2 +
drivers/crypto/caam/caamalg.c | 1 +
drivers/dma/at_xdmac.c | 19 +-
drivers/dma/dmatest.c | 28 +-
drivers/dma/sh/usb-dmac.c | 2 +
drivers/firmware/efi/runtime-wrappers.c | 7 -
drivers/firmware/iscsi_ibft.c | 1 +
drivers/gpio/gpio-vf610.c | 5 +
drivers/gpu/drm/msm/msm_rd.c | 7 +-
drivers/gpu/drm/radeon/evergreen_cs.c | 1 +
drivers/gpu/ipu-v3/ipu-common.c | 8 +-
drivers/hwtracing/intel_th/gth.c | 4 +
drivers/hwtracing/stm/core.c | 11 +-
drivers/i2c/busses/i2c-cadence.c | 9 +-
drivers/i2c/busses/i2c-tegra.c | 2 +-
drivers/infiniband/hw/qib/qib_ud.c | 1 -
drivers/infiniband/ulp/srp/ib_srp.c | 10 -
drivers/input/keyboard/matrix_keypad.c | 2 +-
drivers/input/keyboard/st-keyscan.c | 4 +-
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/input/tablet/wacom_serial4.c | 2 +
drivers/iommu/amd_iommu.c | 15 +-
drivers/irqchip/irq-mmp.c | 6 +-
drivers/isdn/hardware/avm/b1.c | 2 +-
drivers/isdn/i4l/isdn_tty.c | 8 +-
drivers/leds/leds-lp5523.c | 4 +-
drivers/md/raid10.c | 3 +-
drivers/md/raid5.c | 2 +
drivers/media/usb/uvc/uvc_driver.c | 14 +-
drivers/media/usb/uvc/uvc_video.c | 8 +
drivers/media/v4l2-core/videobuf2-v4l2.c | 1 -
drivers/mfd/ab8500-core.c | 2 +-
drivers/mfd/db8500-prcmu.c | 4 +-
drivers/mfd/mc13xxx-core.c | 4 +-
drivers/mfd/qcom_rpm.c | 4 +
drivers/mfd/ti_am335x_tscadc.c | 5 +-
drivers/mfd/twl-core.c | 4 +-
drivers/mfd/wm5110-tables.c | 2 +
drivers/mmc/host/mmc_spi.c | 1 +
drivers/net/dsa/mv88e6xxx.c | 2 +-
drivers/net/ethernet/altera/altera_msgdma.c | 3 +-
drivers/net/ethernet/altera/altera_tse_main.c | 4 +-
drivers/net/ethernet/atheros/atlx/atl2.c | 4 +-
drivers/net/ethernet/broadcom/bcmsysport.c | 4 +
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 +
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 +-
drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 2 -
drivers/net/ethernet/marvell/mv643xx_eth.c | 7 +-
drivers/net/ethernet/marvell/sky2.c | 24 +-
drivers/net/ethernet/mellanox/mlx4/cmd.c | 1 +
drivers/net/ethernet/mellanox/mlx4/en_rx.c | 23 +-
.../net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +-
drivers/net/ethernet/renesas/ravb_main.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +-
drivers/net/ipvlan/ipvlan_main.c | 9 +-
drivers/net/phy/mdio_bus.c | 1 -
drivers/net/phy/micrel.c | 14 +-
drivers/net/ppp/pptp.c | 1 +
drivers/net/team/team.c | 27 +-
drivers/net/team/team_mode_loadbalance.c | 15 +
drivers/net/vxlan.c | 13 +-
drivers/net/wireless/mac80211_hwsim.c | 2 +-
drivers/net/xen-netback/netback.c | 10 +-
drivers/parport/parport_pc.c | 2 +-
drivers/pinctrl/meson/pinctrl-meson8b.c | 2 +-
drivers/platform/x86/Kconfig | 1 +
drivers/regulator/s2mpa01.c | 10 +-
drivers/regulator/s2mps11.c | 6 +-
drivers/s390/block/dasd_eckd.c | 8 +
drivers/s390/net/qeth_core_main.c | 15 +-
drivers/s390/virtio/virtio_ccw.c | 4 +-
drivers/scsi/csiostor/csio_attr.c | 2 +-
drivers/scsi/isci/init.c | 14 +-
drivers/scsi/libfc/fc_lport.c | 6 +-
drivers/scsi/libiscsi.c | 6 +
drivers/scsi/libsas/sas_expander.c | 2 +
drivers/scsi/qla4xxx/ql4_os.c | 2 +
drivers/scsi/virtio_scsi.c | 2 -
.../staging/lustre/lnet/klnds/socklnd/socklnd.c | 9 +-
drivers/staging/lustre/lnet/lnet/config.c | 14 +-
drivers/staging/lustre/lnet/selftest/conrpc.c | 4 +-
drivers/staging/lustre/lnet/selftest/console.c | 6 +-
.../staging/lustre/lustre/include/lustre_disk.h | 1 +
drivers/staging/lustre/lustre/libcfs/debug.c | 6 +-
drivers/staging/lustre/lustre/libcfs/hash.c | 3 +-
drivers/staging/lustre/lustre/libcfs/workitem.c | 4 +-
drivers/staging/lustre/lustre/llite/dir.c | 2 +-
drivers/staging/lustre/lustre/lov/lov_pool.c | 3 +-
drivers/staging/lustre/lustre/obdclass/obd_mount.c | 10 +-
drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c | 1 +
drivers/staging/lustre/lustre/ptlrpc/sec_config.c | 3 +-
drivers/staging/rdma/hfi1/ud.c | 1 -
drivers/target/iscsi/iscsi_target.c | 4 +-
.../int340x_thermal/processor_thermal_device.c | 2 +-
drivers/tty/serial/8250/8250_pci.c | 141 +++++++--
drivers/tty/serial/fsl_lpuart.c | 2 +-
drivers/usb/dwc3/gadget.c | 1 +
drivers/usb/gadget/function/f_sourcesink.c | 2 +-
drivers/usb/serial/cp210x.c | 1 +
drivers/usb/serial/ftdi_sio.c | 2 +
drivers/usb/serial/ftdi_sio_ids.h | 6 +
drivers/usb/serial/option.c | 2 +
fs/9p/cache.c | 8 +-
fs/9p/v9fs.h | 2 +-
fs/9p/v9fs_vfs.h | 23 +-
fs/9p/vfs_file.c | 6 +-
fs/9p/vfs_inode.c | 25 +-
fs/9p/vfs_inode_dotl.c | 27 +-
fs/9p/vfs_super.c | 4 +-
fs/autofs4/expire.c | 3 +-
fs/autofs4/inode.c | 4 +-
fs/btrfs/extent_io.c | 4 +-
fs/btrfs/volumes.c | 4 +-
fs/ceph/snap.c | 3 +-
fs/cifs/file.c | 12 +-
fs/cifs/smb2pdu.h | 4 +-
fs/drop_caches.c | 8 +-
fs/ext2/super.c | 39 ++-
fs/ext4/resize.c | 3 +-
fs/hugetlbfs/inode.c | 12 +
fs/jbd2/transaction.c | 33 +-
fs/ncpfs/ioctl.c | 4 +-
fs/nfs/direct.c | 15 +-
fs/nfs/filelayout/filelayout.c | 17 +-
fs/nfs/flexfilelayout/flexfilelayout.c | 25 +-
fs/nfs/pagelist.c | 12 +-
fs/nfs/pnfs.c | 24 +-
fs/nfs/read.c | 2 +-
fs/nfs/super.c | 5 +
fs/nfsd/nfs3proc.c | 16 +-
fs/nfsd/nfs3xdr.c | 1 +
fs/nfsd/nfsctl.c | 2 +-
include/keys/user-type.h | 2 +-
include/linux/cpufreq.h | 12 +-
include/linux/device-mapper.h | 2 +-
include/net/gro_cells.h | 12 +-
include/net/icmp.h | 9 +-
include/net/ip.h | 2 +
include/net/phonet/pep.h | 5 +-
kernel/futex.c | 7 +-
kernel/locking/rtmutex.c | 52 +++-
kernel/locking/rtmutex_common.h | 8 +-
kernel/rcu/tree.c | 20 +-
kernel/sysctl.c | 11 +-
kernel/trace/trace.c | 1 -
lib/assoc_array.c | 8 +-
mm/hugetlb.c | 14 +-
mm/memory_hotplug.c | 6 +-
mm/mempolicy.c | 6 +-
mm/migrate.c | 11 +
mm/mmap.c | 7 +-
mm/shmem.c | 12 +-
mm/vmalloc.c | 2 +-
net/9p/client.c | 2 +-
net/batman-adv/soft-interface.c | 2 +
net/bridge/br_multicast.c | 9 +-
net/bridge/netfilter/ebtables.c | 4 +
net/ceph/messenger.c | 12 +-
net/core/net-sysfs.c | 3 +
net/hsr/hsr_device.c | 18 +-
net/hsr/hsr_framereg.c | 12 +
net/hsr/hsr_framereg.h | 1 +
net/ipv4/cipso_ipv4.c | 23 +-
net/ipv4/icmp.c | 7 +-
net/ipv4/inet_connection_sock.c | 2 +-
net/ipv4/ip_options.c | 22 +-
net/ipv4/ip_vti.c | 50 +++
net/ipv4/netfilter/arp_tables.c | 2 +
net/ipv4/netfilter/ip_tables.c | 2 +
net/ipv4/route.c | 4 +
net/ipv4/syncookies.c | 7 +-
net/ipv4/tcp_input.c | 8 +-
net/ipv4/udp.c | 2 +-
net/ipv4/udp_impl.h | 2 +-
net/ipv4/udplite.c | 2 +-
net/ipv6/ip6mr.c | 8 +-
net/ipv6/netfilter/ip6_tables.c | 2 +
net/ipv6/route.c | 2 +-
net/ipv6/sit.c | 7 +-
net/ipv6/udp.c | 2 +-
net/ipv6/udp_impl.h | 2 +-
net/ipv6/udplite.c | 2 +-
net/l2tp/l2tp_ip6.c | 4 +-
net/mac80211/cfg.c | 4 +
net/mac80211/rx.c | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 12 +
net/netfilter/nf_conntrack_proto_tcp.c | 4 +
net/netfilter/nfnetlink_acct.c | 3 +
net/netfilter/nfnetlink_log.c | 2 +-
net/nfc/llcp_commands.c | 20 ++
net/nfc/llcp_core.c | 24 +-
net/packet/af_packet.c | 2 +-
net/phonet/pep.c | 32 +-
net/socket.c | 24 +-
net/unix/af_unix.c | 48 +--
net/unix/diag.c | 3 +-
net/wireless/reg.c | 4 +-
net/x25/af_x25.c | 20 +-
security/keys/key.c | 4 +-
security/keys/keyring.c | 4 +-
security/keys/proc.c | 11 +-
security/keys/request_key.c | 1 +
security/keys/request_key_auth.c | 2 +-
security/lsm_audit.c | 10 +-
sound/core/compress_offload.c | 3 +-
sound/firewire/bebob/bebob.c | 14 +-
sound/soc/fsl/fsl_esai.c | 7 +-
sound/soc/fsl/imx-audmux.c | 24 +-
sound/soc/intel/boards/broadwell.c | 2 +-
sound/soc/intel/boards/haswell.c | 2 +-
sound/soc/soc-dapm.c | 10 +-
sound/soc/soc-topology.c | 8 +-
tools/arch/x86/include/asm/cpufeatures.h | 336 +++++++++++++++++++++
tools/arch/x86/include/asm/disabled-features.h | 65 ++++
tools/arch/x86/include/asm/required-features.h | 106 +++++++
tools/arch/x86/lib/memcpy_64.S | 179 +++++++++++
tools/arch/x86/lib/memset_64.S | 138 +++++++++
.../{perf/util => }/include/asm/alternative-asm.h | 4 +-
tools/perf/MANIFEST | 8 +-
tools/perf/Makefile.perf | 15 +
tools/perf/bench/mem-memcpy-x86-64-asm.S | 2 +-
tools/perf/bench/mem-memset-x86-64-asm.S | 2 +-
tools/perf/util/auxtrace.c | 4 +-
tools/perf/util/auxtrace.h | 3 +
tools/perf/util/cpumap.c | 11 +-
.../perf/util/intel-pt-decoder/intel-pt-decoder.c | 37 ++-
tools/perf/util/symbol-elf.c | 9 +-
virt/kvm/arm/vgic.c | 7 -
281 files changed, 2463 insertions(+), 797 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/230 ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan, Zheng <[email protected]>
commit 04242ff3ac0abbaa4362f97781dac268e6c3541a upstream.
Otherwise, mdsc->snap_flush_list may get corrupted.
--- fs/ceph/snap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/ceph/snap.c +2 -1
@@ -611,7 +611,8 @@ int __ceph_finish_cap_snap(struct ceph_i capsnap->size);spin_lock (&mdsc->snap_flush_lock); -list_add_tail (&ci->i_snap_flush_item, &mdsc->snap_flush_list); +if (list_empty (&ci->i_snap_flush_item)) +list_add_tail (&ci->i_snap_flush_item, &mdsc->snap_flush_list);spin_unlock (&mdsc->snap_flush_lock);return 1 ;/* caller may want to ceph_flush_snaps */ }
Greg Kroah-Hartman
maintainerPATCH 2/230 numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Campbell <[email protected]>
commit 050c17f239fd53adb55aa768d4f41bc76c0fe045 upstream.
The system call, get_mempolicy() [1], passes an unsigned long *nodemask pointer and an unsigned long maxnode argument which specifies the length of the user's nodemask array in bits (which is rounded up). The manual page says that if the maxnode value is too small, get_mempolicy will return EINVAL but there is no system call to return this minimum value. To determine this value, some programs search /proc/<pid>/status for a line starting with "Mems_allowed:" and use the number of digits in the mask to determine the minimum value. A recent change to the way this line is formatted [2] causes these programs to compute a value less than MAX_NUMNODES so get_mempolicy() returns EINVAL.
Change get_mempolicy(), the older compat version of get_mempolicy(), and the copy_nodes_to_user() function to use nr_node_ids instead of MAX_NUMNODES, thus preserving the defacto method of computing the minimum size for the nodemask array and the maxnode argument.
[1] http://man7.org/linux/man-pages/man2/get_mempolicy.2.html
[2] https://lore.kernel.org/lkml/[email protected]
--- mm/mempolicy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/mempolicy.c +3 -3
@@ -1295,7 +1295,7 @@ static int copy_nodes_to_user(unsigned l nodemask_t *nodes) {unsigned long copy =ALIGN (maxnode-1 ,64 ) /8 ; -const int nbytes =BITS_TO_LONGS (MAX_NUMNODES ) *sizeof (long ); +unsigned int nbytes =BITS_TO_LONGS (nr_node_ids) *sizeof (long );if (copy > nbytes) {if (copy >PAGE_SIZE )
@@ -1456,7 +1456,7 @@ SYSCALL_DEFINE5(get_mempolicy, int __useint uninitialized_var (pval );nodemask_t nodes; -if (nmask !=NULL && maxnode <MAX_NUMNODES ) +if (nmask !=NULL && maxnode < nr_node_ids)return -EINVAL ; err =do_get_mempolicy (&pval, &nodes, addr, flags);
@@ -1485,7 +1485,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, inunsigned long nr_bits, alloc_size;DECLARE_BITMAP (bm,MAX_NUMNODES ); - nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES); + nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids); alloc_size =ALIGN (nr_bits,BITS_PER_LONG ) /8 ;if (nmask)
Greg Kroah-Hartman
maintainerPATCH 3/230 KEYS: allow reaching the keys quotas exactly
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit a08bf91ce28ed3ae7b6fef35d843fef8dc8c2cd9 upstream.
If the sysctl 'kernel.keys.maxkeys' is set to some number n, then actually users can only add up to 'n - 1' keys. Likewise for 'kernel.keys.maxbytes' and the root_* versions of these sysctls. But these sysctls are apparently supposed to be *maximums*, as per their names and all documentation I could find -- the keyrings(7) man page, Documentation/security/keys/core.rst, and all the mentions of EDQUOT meaning that the key quota was *exceeded* (as opposed to reached).
Thus, fix the code to allow reaching the quotas exactly.
--- security/keys/key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
security/keys/key.c +2 -2
@@ -260,8 +260,8 @@ struct key *key_alloc(struct key_type *tspin_lock (&user->lock);if (!(flags &KEY_ALLOC_QUOTA_OVERRUN )) { -if (user->qnkeys +1 >= maxkeys || - user->qnbytes + quotalen >= maxbytes || +if (user->qnkeys +1 > maxkeys || + user->qnbytes + quotalen > maxbytes || user->qnbytes + quotalen < user->qnbytes) goto no_quota; }
Greg Kroah-Hartman
maintainerPATCH 4/230 mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ]
Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that different instances are uniquely identified. This is required in order to support registering of multiple instances of same ti_am335x_tscadc IP.
--- drivers/mfd/ti_am335x_tscadc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mfd/ti_am335x_tscadc.c +3 -2
@@ -279,8 +279,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) cell->pdata_size =sizeof (tscadc); } - err =mfd_add_devices (&pdev->dev, pdev->id, tscadc->cells, - tscadc->used_cells,NULL ,0 ,NULL ); + err =mfd_add_devices (&pdev->dev,PLATFORM_DEVID_AUTO , + tscadc->cells, tscadc->used_cells,NULL , +0 ,NULL );if (err <0 ) goto err_disable_clk;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 5/230 mfd: twl-core: Fix section annotations on {,un}protect_pm_master
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ]
When building the kernel with Clang, the following section mismatch warning appears:
WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from the function twl_probe() to the function .init.text:unprotect_pm_master()
The function twl_probe() references
the function __init unprotect_pm_master().
This is often because twl_probe lacks a __init
annotation or the annotation of unprotect_pm_master is wrong.
Remove the __init annotation on the *protect_pm_master functions so there is no more mismatch.
--- drivers/mfd/twl-core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/twl-core.c +2 -2
@@ -982,7 +982,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,* letting it generate the right frequencies for USB, MADC, and * other purposes. */ -static inline int __init protect_pm_master (void ) +static inline int protect_pm_master (void ) {int e =0 ;
@@ -991,7 +991,7 @@ static inline int __init protect_pm_master(void)return e; } -static inline int __init unprotect_pm_master (void ) +static inline int unprotect_pm_master (void ) {int e =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 6/230 mfd: db8500-prcmu: Fix some section annotations
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ]
When building the kernel with Clang, the following section mismatch warnings appear:
WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:init_prcm_registers()
The function db8500_prcmu_probe() references
the function __init init_prcm_registers().
This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of init_prcm_registers is wrong.
WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from the function db8500_prcmu_probe() to the function .init.text:fw_project_name()
The function db8500_prcmu_probe() references
the function __init fw_project_name().
This is often because db8500_prcmu_probe lacks a __init annotation or the annotation of fw_project_name is wrong.
db8500_prcmu_probe should not be marked as __init so remove the __init annotation from fw_project_name and init_prcm_registers.
--- drivers/mfd/db8500-prcmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mfd/db8500-prcmu.c +2 -2
@@ -2610,7 +2610,7 @@ static struct irq_chip prcmu_irq_chip = { .irq_unmask = prcmu_irq_unmask, }; -static __init char *fw_project_name (u32 project) +static char *fw_project_name (u32 project) {switch (project) {case PRCMU_FW_PROJECT_U8500 :
@@ -2758,7 +2758,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)INIT_WORK (&mb0_transfer.mask_work, prcmu_mask_work); } -static void __init init_prcm_registers (void ) +static void init_prcm_registers (void ) {u32 val;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 7/230 mfd: ab8500-core: Return zero in get_register_interruptible()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ]
This function is supposed to return zero on success or negative error codes on error. Unfortunately, there is a bug so it sometimes returns non-zero, positive numbers on success.
I noticed this bug during review and I can't test it. It does appear that the return is sometimes propogated back to _regmap_read() where all non-zero returns are treated as failure so this may affect run time.
--- drivers/mfd/ab8500-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mfd/ab8500-core.c +1 -1
@@ -259,7 +259,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,mutex_unlock (&ab8500->lock);dev_vdbg (ab8500->dev,"rd: addr %#x => data %#x\n" , addr, ret); -return ret; +return (ret <0 ) ? ret :0 ; } static int ab8500_get_register(struct device *dev, u8 bank,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 8/230 mfd: qcom_rpm: write fw_version to CTRL_REG
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ]
This is required as part of the initialization sequence on certain SoCs.
If these registers are not initialized, the hardware can be unresponsive. This fixes the driver on apq8060 (HP TouchPad device).
--- drivers/mfd/qcom_rpm.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/mfd/qcom_rpm.c +4 -0
@@ -570,6 +570,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)return -EFAULT ; } +writel (fw_version[0 ],RPM_CTRL_REG (rpm,0 )); +writel (fw_version[1 ],RPM_CTRL_REG (rpm,1 )); +writel (fw_version[2 ],RPM_CTRL_REG (rpm,2 )); +dev_info (&pdev->dev,"RPM firmware %u.%u.%u\n" , fw_version[0 ], fw_version[1 ], fw_version[2 ]);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 9/230 mfd: wm5110: Add missing ASRC rate register
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ]
--- drivers/mfd/wm5110-tables.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mfd/wm5110-tables.c +2 -0
@@ -1622,6 +1622,7 @@ static const struct reg_default wm5110_reg_default[] = { { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ + { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */
@@ -2877,6 +2878,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)case ARIZONA_ASRC_ENABLE :case ARIZONA_ASRC_STATUS :case ARIZONA_ASRC_RATE1 : +case ARIZONA_ASRC_RATE2 :case ARIZONA_ISRC_1_CTRL_1 :case ARIZONA_ISRC_1_CTRL_2 :case ARIZONA_ISRC_1_CTRL_3 :
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 10/230 mfd: mc13xxx: Fix a missing check of a register-read failure
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ]
When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will contain random value. Further execution uses "old_adc0" even when mc13xxx_reg_read() fails.
The fix checks the return value of mc13xxx_reg_read(), and exits the execution when it fails.
--- drivers/mfd/mc13xxx-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mfd/mc13xxx-core.c +3 -1
@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, mc13xxx->adcflags |=MC13XXX_ADC_WORKING ; -mc13xxx_reg_read (mc13xxx,MC13XXX_ADC0 , &old_adc0); + ret =mc13xxx_reg_read (mc13xxx,MC13XXX_ADC0 , &old_adc0); +if (ret) + goto out; adc0 =MC13XXX_ADC0_ADINC1 |MC13XXX_ADC0_ADINC2 ; adc1 =MC13XXX_ADC1_ADEN |MC13XXX_ADC1_ADTRIGIGN |MC13XXX_ADC1_ASC ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 11/230 net: hns: Fix use after free identified by SLUB debug
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ]
When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will identify a use after free bug:
[134.189505] Unable to handle kernel paging request at virtual address 006b6b6b6b6b6b6b [134.197553] Mem abort info: [134.200381] ESR = 0x96000004 [134.203487] Exception class = DABT (current EL), IL = 32 bits [134.209497] SET = 0, FnV = 0 [134.212596] EA = 0, S1PTW = 0 [134.215777] Data abort info: [134.218701] ISV = 0, ISS = 0x00000004 [134.222596] CM = 0, WnR = 0 [134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges [134.232851] Internal error: Oops: 96000004 [#1] SMP [134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G OE 4.19.5-1.2.34.aarch64 #1 [134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018 [134.255181] pstate: 20000005 (nzCv daif -PAN -UAO) [134.260044] pc : hns_ae_put_handle+0x38/0x60 [134.264372] lr : hns_ae_put_handle+0x24/0x60 [134.268700] sp : ffff00001be93c50 [134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040 [134.277442] x27: 0000000000000000 x26: 0000000000000000 [134.282830] x25: 0000000056000000 x24: 0000000000000015 [134.288284] x23: ffff0000096fe098 x22: ffff000001050070 [134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098 [134.303287] x19: ffff80afb75ec098 x18: 0000000000000000 [134.312945] x17: 0000000000000000 x16: 0000000000000000 [134.322517] x15: 0000000000000002 x14: 0000000000000000 [134.332030] x13: dead000000000100 x12: ffff7e02bea3c988 [134.341487] x11: ffff80affbee9e68 x10: 0000000000000000 [134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000 [134.360569] x7 : dead000000000100 x6 : ffff000009579748 [134.370059] x5 : 0000000000210d00 x4 : 0000000000000000 [134.379550] x3 : 0000000000000001 x2 : 0000000000000000 [134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000 [134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd) [134.408498] Call trace: [134.414611] hns_ae_put_handle+0x38/0x60 [134.422208] hnae_put_handle+0xd4/0x108 [134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv] [134.438342] platform_drv_remove+0x2c/0x70 [134.445958] device_release_driver_internal+0x174/0x208 [134.454810] driver_detach+0x70/0xd8 [134.461913] bus_remove_driver+0x64/0xe8 [134.469396] driver_unregister+0x34/0x60 [134.476822] platform_driver_unregister+0x20/0x30 [134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv] [134.494634] __arm64_sys_delete_module+0x238/0x290
struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is freed, than use hnae_handle will cause use after free panic.
This patch frees vf_cb after hnae_handle used.
--- drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +2 -4
@@ -188,12 +188,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)struct hnae_vf_cb *vf_cb =hns_ae_get_vf_cb (handle);int i; - vf_cb->mac_cb =NULL ; - -kfree (vf_cb); -for (i =0 ; i < handle->q_num; i++)hns_ae_get_ring_pair (handle->qs[i])->used_by_vf =0 ; + +kfree (vf_cb); }static void hns_ae_ring_enable_all (struct hnae_handle *handle,int val)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 12/230 MIPS: ath79: Enable OF serial ports in the default config
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ]
CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF boards, enable it in the default config to get a working setup out of the box.
--- arch/mips/configs/ath79_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/mips/configs/ath79_defconfig +1 -0
@@ -74,6 +74,7 @@ CONFIG_SERIAL_8250_CONSOLE=y # CONFIG_SERIAL_8250_PCI is not set CONFIG_SERIAL_8250_NR_UARTS=1 CONFIG_SERIAL_8250_RUNTIME_UARTS=1 +CONFIG_SERIAL_OF_PLATFORM=y CONFIG_SERIAL_AR933X=y CONFIG_SERIAL_AR933X_CONSOLE=y # CONFIG_HW_RANDOM is not set
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 13/230 scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ]
The return code should be check while qla4xxx_copy_from_fwddb_param fails.
--- drivers/scsi/qla4xxx/ql4_os.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/qla4xxx/ql4_os.c +2 -0
@@ -7245,6 +7245,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, rc =qla4xxx_copy_from_fwddb_param (fnode_sess, fnode_conn, fw_ddb_entry); +if (rc) + goto free_sess;ql4_printk (KERN_INFO , ha,"%s: sysfs entry %s created\n" , __func__, fnode_sess->dev.kobj.name);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 14/230 scsi: isci: initialize shost fully before calling scsi_add_host()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ]
scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the command size to allocate based on the prot_capabilities. In the isci driver, scsi_host_set_prot() is called after scsi_add_host() so the command size gets calculated to be smaller than it needs to be. Eventually, scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it was sized correctly and a buffer overrun may occur.
However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line size, the mistake can go unnoticed.
The bug was noticed after the struct request size was reduced by commit 9d037ad707ed ("block: remove req->timeout_list")
Which likely reduced the allocated space for the request by an entire cache line, enough that the overflow could be hit and it caused a panic, on boot, at:
RIP: 0010:t10_pi_complete+0x77/0x1c0
Call Trace:
<IRQ>
sd_done+0xf5/0x340
scsi_finish_command+0xc3/0x120
blk_done_softirq+0x83/0xb0
__do_softirq+0xa1/0x2e6
irq_exit+0xbc/0xd0
call_function_single_interrupt+0xf/0x20
</IRQ>sd_done() would call scsi_prot_sg_count() which reads the number of entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of the allocated space it reads a garbage number and erroneously calls t10_pi_complete().
To prevent this, the calls to scsi_host_set_prot() are moved into isci_host_alloc() before the call to scsi_add_host(). Out of caution, also move the similar call to scsi_host_set_guard().
--- drivers/scsi/isci/init.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/scsi/isci/init.c +7 -7
@@ -595,6 +595,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) shost->max_lun = ~0 ; shost->max_cmd_len =MAX_COMMAND_SIZE ; +/* turn on DIF support */ +scsi_host_set_prot (shost, +SHOST_DIF_TYPE1_PROTECTION | +SHOST_DIF_TYPE2_PROTECTION | +SHOST_DIF_TYPE3_PROTECTION ); +scsi_host_set_guard (shost,SHOST_DIX_GUARD_CRC ); + err =scsi_add_host (shost, &pdev->dev);if (err) goto err_shost;
@@ -682,13 +689,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto err_host_alloc; } pci_info->hosts[i] = h; - -/* turn on DIF support */ -scsi_host_set_prot (to_shost (h), -SHOST_DIF_TYPE1_PROTECTION | -SHOST_DIF_TYPE2_PROTECTION | -SHOST_DIF_TYPE3_PROTECTION ); -scsi_host_set_guard (to_shost (h),SHOST_DIX_GUARD_CRC ); } err =isci_setup_interrupts (pdev);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 15/230 MIPS: jazz: fix 64bit build
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ]
64bit JAZZ builds failed with
linux-next/arch/mips/jazz/jazzdma.c: In function vdma_init:
/linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration
of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`?
[-Werror=implicit-function-declaration]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^~~~~~~~~
CKSEG1ADDR
/linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from
integer of different size [-Werror=int-to-pointer-cast]
pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
^
In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0,
from /linux-next/include/linux/compiler.h:248,
from /linux-next/include/linux/kernel.h:10,
from /linux-next/arch/mips/jazz/jazzdma.c:11:
/linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from
pointer to integer of different size [-Werror=pointer-to-int-cast]
#define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */
^
/linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in
expansion of macro `_ACAST32_`
#define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff)
^~~~~~~~~
/linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of
macro `CPHYSADDR`
r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup fixes this.
--- arch/mips/jazz/jazzdma.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/mips/jazz/jazzdma.c +3 -2
@@ -71,14 +71,15 @@ static int __init vdma_init(void) get_order(VDMA_PGTBL_SIZE));BUG_ON (!pgtbl);dma_cache_wback_inv ((unsigned long )pgtbl,VDMA_PGTBL_SIZE ); - pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR (pgtbl); + pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR ((unsigned long )pgtbl);/* * Clear the R4030 translation table */ vdma_pgtbl_init (); -r4030_write_reg32 (JAZZ_R4030_TRSTBL_BASE ,CPHYSADDR (pgtbl)); +r4030_write_reg32 (JAZZ_R4030_TRSTBL_BASE , +CPHYSADDR ((unsigned long )pgtbl));r4030_write_reg32 (JAZZ_R4030_TRSTBL_LIM ,VDMA_PGTBL_SIZE );r4030_write_reg32 (JAZZ_R4030_TRSTBL_INV ,0 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 16/230 isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ]
The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be concurrently executed.
isdn_tty_tiocmset
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);isdn_tty_set_termios
isdn_tty_modem_hup
line 719: kfree(info->dtmf_state);
line 721: kfree(info->silence_state);
line 723: kfree(info->adpcms);
line 725: kfree(info->adpcmr);Thus, some concurrency double-free bugs may occur.
These possible bugs are found by a static tool written by myself and my manual code review.
To fix these possible bugs, the mutex lock "modem_info_mutex" used in isdn_tty_tiocmset() is added in isdn_tty_set_termios().
--- drivers/isdn/i4l/isdn_tty.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/isdn/i4l/isdn_tty.c +5 -1
@@ -1459,15 +1459,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) {modem_info *info = (modem_info *) tty->driver_data; +mutex_lock (&modem_info_mutex);if (!old_termios)isdn_tty_change_speed (info);else {if (tty->termios.c_cflag == old_termios->c_cflag && tty->termios.c_ispeed == old_termios->c_ispeed && - tty->termios.c_ospeed == old_termios->c_ospeed) + tty->termios.c_ospeed == old_termios->c_ospeed) { +mutex_unlock (&modem_info_mutex);return ; + }isdn_tty_change_speed (info); } +mutex_unlock (&modem_info_mutex); }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 17/230 atm: he: fix sign-extension overflow on large shift
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ]
Shifting the 1 by exp by an int can lead to sign-extension overlow when exp is 31 since 1 is an signed int and sign-extending this result to an unsigned long long will set the upper 32 bits. Fix this by shifting an unsigned long.
Detected by cppcheck:
(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour
--- drivers/atm/he.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/atm/he.c +1 -1
@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)instead of '/ 512', use '>> 9' to prevent a call to divdu3 on x86 platforms */ - rate_cps = (unsigned long long ) (1 << exp) * (man +512 ) >>9 ; + rate_cps = (unsigned long long ) (1UL << exp) * (man +512 ) >>9 ;if (rate_cps <10 ) rate_cps =10 ;/* 2.2.1 minimum payload rate is 10 cps */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 18/230 leds: lp5523: fix a missing check of return value of lp55xx_read
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ]
When lp55xx_read() fails, "status" is an uninitialized variable and thus may contain random value; using it leads to undefined behaviors.
The fix inserts a check for the return value of lp55xx_read: if it fails, returns with its error code.
--- drivers/leds/leds-lp5523.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/leds/leds-lp5523.c +3 -1
@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)/* Let the programs run for couple of ms and check the engine status */ usleep_range (3000 ,6000 ); -lp55xx_read (chip,LP5523_REG_STATUS , &status); + ret =lp55xx_read (chip,LP5523_REG_STATUS , &status); +if (ret) +return ret; status &=LP5523_ENG_STATUS_MASK ;if (status !=LP5523_ENG_STATUS_MASK ) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 19/230 isdn: avm: Fix string plus integer warning from Clang
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ]
A recent commit in Clang expanded the -Wstring-plus-int warning, showing some odd behavior in this file.
drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int]
cinfo->version[j] = "\0\0" + 1;
~~~~~~~^~~
drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning
cinfo->version[j] = "\0\0" + 1;
^
& [ ]1 warning generated.
This is equivalent to just "\0". Nick pointed out that it is smarter to use "" instead of "\0" because "" is used elsewhere in the kernel and can be deduplicated at the linking stage.
--- drivers/isdn/hardware/avm/b1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/isdn/hardware/avm/b1.c +1 -1
@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)int i, j;for (j =0 ; j <AVM_MAXVERSION ; j++) - cinfo->version[j] ="\0\0" +1 ; + cinfo->version[j] ="" ;for (i =0 , j =0 ; j <AVM_MAXVERSION && i < cinfo->versionlen; j++, i += cinfo->versionbuf[i] +1 )
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 20/230 RDMA/srp: Rework SCSI device reset handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 48396e80fb6526ea5ed267bd84f028bae56d2f9e upstream.
Since .scsi_done() must only be called after scsi_queue_rq() has finished, make sure that the SRP initiator driver does not call .scsi_done() while scsi_queue_rq() is in progress. Although invoking sg_reset -d while I/O is in progress works fine with kernel v4.20 and before, that is not the case with kernel v5.0-rc1. This patch avoids that the following crash is triggered with kernel v5.0-rc1:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000138 CPU: 0 PID: 360 Comm: kworker/0:1H Tainted: G B 5.0.0-rc1-dbg+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014 Workqueue: kblockd blk_mq_run_work_fn RIP: 0010:blk_mq_dispatch_rq_list+0x116/0xb10 Call Trace: blk_mq_sched_dispatch_requests+0x2f7/0x300 __blk_mq_run_hw_queue+0xd6/0x180 blk_mq_run_work_fn+0x27/0x30 process_one_work+0x4f1/0xa20 worker_thread+0x67/0x5b0 kthread+0x1cf/0x1f0 ret_from_fork+0x24/0x30
--- drivers/infiniband/ulp/srp/ib_srp.c | 10 ---------- 1 file changed, 10 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.c +0 -10
@@ -2594,7 +2594,6 @@ static int srp_reset_device(struct scsi_ {struct srp_target_port *target =host_to_target (scmnd->device->host);struct srp_rdma_ch *ch; -int i, j;u8 status;shost_printk (KERN_ERR , target->scsi_host,"SRP reset_device called\n" );
@@ -2606,15 +2605,6 @@ static int srp_reset_device(struct scsi_if (status)return FAILED ; -for (i =0 ; i < target->ch_count; i++) { - ch = &target->ch[i]; -for (j =0 ; j < target->req_ring_size; ++j) { -struct srp_request *req = &ch->req_ring[j]; - -srp_finish_req (ch, req, scmnd->device,DID_RESET <<16 ); - } - } -return SUCCESS ; }
Greg Kroah-Hartman
maintainerPATCH 21/230 KEYS: user: Align the payload buffer
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit cc1780fc42c76c705dd07ea123f1143dc5057630 upstream.
Align the payload of "user" and "logon" keys so that users of the keyrings service can access it as a struct that requires more than 2-byte alignment. fscrypt currently does this which results in the read of fscrypt_key::size being misaligned as it needs 4-byte alignment.
Align to __alignof__(u64) rather than __alignof__(long) since in the future it's conceivable that people would use structs beginning with u64, which on some platforms would require more than 'long' alignment.
--- include/keys/user-type.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/keys/user-type.h +1 -1
@@ -31,7 +31,7 @@struct user_key_payload {struct rcu_head rcu;/* RCU destructor */ unsigned short datalen;/* length of this data */ -char data[0 ];/* actual data */ +char data[0 ]__aligned(__alignof__(u64)) ;/* actual data */ };extern struct key_type key_type_user;
Greg Kroah-Hartman
maintainerPATCH 22/230 KEYS: always initialize keyring_index_key::desc_len
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit ede0fa98a900e657d1fcd80b50920efc896c1a4c upstream.
syzbot hit the 'BUG_ON(index_key->desc_len == 0);' in __key_link_begin() called from construct_alloc_key() during sys_request_key(), because the length of the key description was never calculated.
The problem is that we rely on ->desc_len being initialized by search_process_keyrings(), specifically by search_nested_keyrings(). But, if the process isn't subscribed to any keyrings that never happens.
Fix it by always initializing keyring_index_key::desc_len as soon as the description is set, like we already do in some places.
The following program reproduces the BUG_ON() when it's run as root and no session keyring has been installed. If it doesn't work, try removing pam_keyinit.so from /etc/pam.d/login and rebooting.
#include <stdlib.h>
#include <unistd.h>
#include <keyutils.h>
int main(void)
{
int id = add_key("keyring", "syz", NULL, 0, KEY_SPEC_USER_KEYRING);
keyctl_setperm(id, KEY_OTH_WRITE);
setreuid(5000, 5000);
request_key("user", "desc", "", id);
}--- security/keys/keyring.c | 4 +--- security/keys/proc.c | 3 +-- security/keys/request_key.c | 1 + security/keys/request_key_auth.c | 2 +- 4 files changed, 4 insertions(+), 6 deletions(-)
security/keys/keyring.c +1 -3
@@ -628,9 +628,6 @@ static bool search_nested_keyrings(strucBUG_ON ((ctx->flags &STATE_CHECKS ) ==0 || (ctx->flags &STATE_CHECKS ) ==STATE_CHECKS ); -if (ctx->index_key.description) - ctx->index_key.desc_len =strlen (ctx->index_key.description); -/* Check to see if this top-level keyring is what we are looking for * and whether it is valid or not. */
@@ -888,6 +885,7 @@ key_ref_t keyring_search(key_ref_t keyristruct keyring_search_context ctx = { .index_key.type = type, .index_key.description = description, + .index_key.desc_len =strlen (description), .cred =current_cred (), .match_data.cmp = key_default_cmp, .match_data.raw_data = description,
security/keys/proc.c +1 -2
@@ -186,8 +186,7 @@ static int proc_keys_show(struct seq_filint rc;struct keyring_search_context ctx = { - .index_key.type = key->type, - .index_key.description = key->description, + .index_key = key->index_key, .cred =current_cred (), .match_data.cmp = lookup_user_key_possessed, .match_data.raw_data = key,
security/keys/request_key.c +1 -0
@@ -544,6 +544,7 @@ struct key *request_key_and_link(structstruct keyring_search_context ctx = { .index_key.type = type, .index_key.description = description, + .index_key.desc_len =strlen (description), .cred =current_cred (), .match_data.cmp = key_default_cmp, .match_data.raw_data = description,
security/keys/request_key_auth.c +1 -1
@@ -254,7 +254,7 @@ struct key *key_get_instantiation_authkestruct key *authkey;key_ref_t authkey_ref; -sprintf (description,"%x" , target_id); + ctx.index_key.desc_len =sprintf (description,"%x" , target_id); authkey_ref =search_process_keyrings (&ctx);
Greg Kroah-Hartman
maintainerPATCH 23/230 batman-adv: fix uninit-value in batadv_interface_tx()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 4ffcbfac60642f63ae3d80891f573ba7e94a265c ]
KMSAN reported batadv_interface_tx() was possibly using a garbage value [1]
batadv_get_vid() does have a pskb_may_pull() call but batadv_interface_tx() does not actually make sure this did not fail.
[1]
BUG: KMSAN: uninit-value in batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 CPU: 0 PID: 10006 Comm: syz-executor469 Not tainted 4.20.0-rc7+ #5 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:613 __msan_warning+0x82/0xf0 mm/kmsan/kmsan_instr.c:313 batadv_interface_tx+0x908/0x1e40 net/batman-adv/soft-interface.c:231 __netdev_start_xmit include/linux/netdevice.h:4356 [inline] netdev_start_xmit include/linux/netdevice.h:4365 [inline] xmit_one net/core/dev.c:3257 [inline] dev_hard_start_xmit+0x607/0xc40 net/core/dev.c:3273 __dev_queue_xmit+0x2e42/0x3bc0 net/core/dev.c:3843 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3876 packet_snd net/packet/af_packet.c:2928 [inline] packet_sendmsg+0x8306/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x441889 Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 10 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffdda6fd468 EFLAGS: 00000216 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 0000000000441889 RDX: 000000000000000e RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00007ffdda6fd4c0 R13: 00007ffdda6fd4b0 R14: 0000000000000000 R15: 0000000000000000
Uninit was created at:
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:204 [inline] kmsan_internal_poison_shadow+0x92/0x150 mm/kmsan/kmsan.c:158 kmsan_kmalloc+0xa6/0x130 mm/kmsan/kmsan_hooks.c:176 kmsan_slab_alloc+0xe/0x10 mm/kmsan/kmsan_hooks.c:185 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2759 [inline] __kmalloc_node_track_caller+0xe18/0x1030 mm/slub.c:4383 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x309/0xa20 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:998 [inline] alloc_skb_with_frags+0x1c7/0xac0 net/core/skbuff.c:5220 sock_alloc_send_pskb+0xafd/0x10e0 net/core/sock.c:2083 packet_alloc_skb net/packet/af_packet.c:2781 [inline] packet_snd net/packet/af_packet.c:2872 [inline] packet_sendmsg+0x661a/0x8f30 net/packet/af_packet.c:2953 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg net/socket.c:631 [inline] __sys_sendto+0x8c4/0xac0 net/socket.c:1788 __do_sys_sendto net/socket.c:1800 [inline] __se_sys_sendto+0x107/0x130 net/socket.c:1796 __x64_sys_sendto+0x6e/0x90 net/socket.c:1796 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7
--- net/batman-adv/soft-interface.c | 2 ++ 1 file changed, 2 insertions(+)
net/batman-adv/soft-interface.c +2 -0
@@ -215,6 +215,8 @@ static int batadv_interface_tx(struct skswitch (ntohs (ethhdr->h_proto)) {case ETH_P_8021Q : +if (!pskb_may_pull (skb,sizeof (*vhdr))) + goto dropped; vhdr =vlan_eth_hdr (skb);if (vhdr->h_vlan_encapsulated_proto != ethertype) {
Greg Kroah-Hartman
maintainerPATCH 24/230 net/packet: fix 4gb buffer limit due to overflow check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kal Conley <[email protected]>
[ Upstream commit fc62814d690cf62189854464f4bd07457d5e9e50 ]
When calculating rb->frames_per_block * req->tp_block_nr the result can overflow. Check it for overflow without limiting the total buffer size to UINT_MAX.
This change fixes support for packet ring buffers >= UINT_MAX.
--- net/packet/af_packet.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/packet/af_packet.c +1 -1
@@ -4217,7 +4217,7 @@ static int packet_set_ring(struct sock * rb->frames_per_block = req->tp_block_size / req->tp_frame_size;if (unlikely (rb->frames_per_block ==0 )) goto out; -if (unlikely (req->tp_block_size >UINT_MAX / req->tp_block_nr)) +if (unlikely (rb->frames_per_block >UINT_MAX / req->tp_block_nr)) goto out;if (unlikely ((rb->frames_per_block * req->tp_block_nr) != req->tp_frame_nr))
Greg Kroah-Hartman
maintainerPATCH 25/230 team: avoid complex list operations in team_nl_cmd_options_set()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <[email protected]>
[ Upstream commit 2fdeee2549231b1f989f011bb18191f5660d3745 ]
The current opt_inst_list operations inside team_nl_cmd_options_set() is too complex to track:
LIST_HEAD(opt_inst_list);
nla_for_each_nested(...) {
list_for_each_entry(opt_inst, &team->option_inst_list, list) {
if (__team_option_inst_tmp_find(&opt_inst_list, opt_inst))
continue;
list_add(&opt_inst->tmp_list, &opt_inst_list);
}
}
team_nl_send_event_options_get(team, &opt_inst_list);as while we retrieve 'opt_inst' from team->option_inst_list, it could be added to the local 'opt_inst_list' for multiple times. The __team_option_inst_tmp_find() doesn't work, as the setter team_mode_option_set() still calls team->ops.exit() which uses ->tmp_list too in __team_options_change_check().
Simplify the list operations by moving the 'opt_inst_list' and team_nl_send_event_options_get() into the nla_for_each_nested() loop so that it can be guranteed that we won't insert a same list entry for multiple times. Therefore, __team_option_inst_tmp_find() can be removed too.
--- drivers/net/team/team.c | 27 +++++---------------------- 1 file changed, 5 insertions(+), 22 deletions(-)
drivers/net/team/team.c +5 -22
@@ -247,17 +247,6 @@ static void __team_option_inst_mark_remo } } -static bool __team_option_inst_tmp_find (const struct list_head *opts, -const struct team_option_inst *needle) -{ -struct team_option_inst *opt_inst; - -list_for_each_entry (opt_inst, opts, tmp_list) -if (opt_inst == needle) -return true; -return false; -} -static int __team_options_register (struct team *team,const struct team_option *option,size_t option_count)
@@ -2447,7 +2436,6 @@ static int team_nl_cmd_options_set(strucint err =0 ;int i;struct nlattr *nl_option; -LIST_HEAD (opt_inst_list); team =team_nl_team_get (info);if (!team)
@@ -2463,6 +2451,7 @@ static int team_nl_cmd_options_set(strucstruct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX +1 ];struct nlattr *attr;struct nlattr *attr_data; +LIST_HEAD (opt_inst_list);enum team_option_type opt_type;int opt_port_ifindex =0 ;/* != 0 for per-port options */ u32 opt_array_index =0 ;
@@ -2566,23 +2555,17 @@ static int team_nl_cmd_options_set(strucif (err) goto team_put; opt_inst->changed = true; - -/* dumb/evil user-space can send us duplicate opt, -* keep only the last one -*/ -if (__team_option_inst_tmp_find (&opt_inst_list, - opt_inst)) -continue ; -list_add (&opt_inst->tmp_list, &opt_inst_list); }if (!opt_found) { err = -ENOENT ; goto team_put; } - } - err =team_nl_send_event_options_get (team, &opt_inst_list); + err =team_nl_send_event_options_get (team, &opt_inst_list); +if (err) +break ; + } team_put:team_nl_team_put (team);
Greg Kroah-Hartman
maintainerPATCH 26/230 sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit 173656accaf583698bac3f9e269884ba60d51ef4 ]
If we disabled IPv6 from the kernel command line (ipv6.disable=1), we should not call ip6_err_gen_icmpv6_unreach(). This:
ip link add sit1 type sit local 192.0.2.1 remote 192.0.2.2 ttl 1 ip link set sit1 up
ip addr add 198.51.100.1/24 dev sit1
ping 198.51.100.2
if IPv6 is disabled at boot time, will crash the kernel.
v2: there's no need to use in6_dev_get(), use __in6_dev_get() instead,
as we only need to check that idev exists and we are under rcu_read_lock() (from netif_receive_skb_internal()).
--- net/ipv6/sit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/sit.c +1 -1
@@ -577,7 +577,7 @@ static int ipip6_err(struct sk_buff *skb goto out; err =0 ; -if (!ipip6_err_gen_icmpv6_unreach (skb)) +if (__in6_dev_get (skb->dev) && !ipip6_err_gen_icmpv6_unreach (skb)) goto out;if (t->parms.iph.ttl ==0 && type ==ICMP_TIME_EXCEEDED )
Greg Kroah-Hartman
maintainerPATCH 27/230 net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saeed Mahameed <[email protected]>
[ Upstream commit 29dded89e80e3fff61efb34f07a8a3fba3ea146d ]
When an ethernet frame is padded to meet the minimum ethernet frame size, the padding octets are not covered by the hardware checksum. Fortunately the padding octets are usually zero's, which don't affect checksum. However, it is not guaranteed. For example, switches might choose to make other use of these octets.
This repeatedly causes kernel hardware checksum fault.
Prior to the cited commit below, skb checksum was forced to be CHECKSUM_NONE when padding is detected. After it, we need to keep skb->csum updated. However, fixing up CHECKSUM_COMPLETE requires to verify and parse IP headers, it does not worth the effort as the packets are so small that CHECKSUM_COMPLETE has no significant advantage.
Future work: when reporting checksum complete is not an option for IP non-TCP/UDP packets, we can actually fallback to report checksum unnecessary, by looking at cqe IPOK bit.
--- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/en_rx.c +20 -1
@@ -725,13 +725,27 @@ static int get_fixed_ipv6_csum(__wsum hwreturn 0 ; }#endif + +#define short_frame (size) ((size) <= ETH_ZLEN + ETH_FCS_LEN) +static int check_csum (struct mlx4_cqe *cqe,struct sk_buff *skb,void *va,netdev_features_t dev_features) {__wsum hw_checksum =0 ; +void *hdr; -void *hdr = (u8 *)va +sizeof (struct ethhdr ); +/* CQE csum doesn't cover padding octets in short ethernet +* frames. And the pad field is appended prior to calculating +* and appending the FCS field. +* +* Detecting these padded frames requires to verify and parse +* IP headers, so we simply force all those small frames to skip +* checksum complete. +*/ +if (short_frame (skb->len)) +return -EINVAL ; + hdr = (u8 *)va +sizeof (struct ethhdr ); hw_checksum =csum_unfold ((__force __sum16 )cqe->checksum); if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) &&
@@ -851,6 +865,11 @@ int mlx4_en_process_rx_cq(struct net_dev (cqe->vlan_my_qpn &cpu_to_be32 (MLX4_CQE_L2_TUNNEL ));if (likely (dev->features &NETIF_F_RXCSUM )) { +/* TODO: For IP non TCP/UDP packets when csum complete is +* not an option (not supported or any other reason) we can +* actually check cqe IPOK status bit and report +* CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE +*/ if (cqe->status &cpu_to_be16 (MLX4_CQE_STATUS_TCP |MLX4_CQE_STATUS_UDP )) { if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
Greg Kroah-Hartman
maintainerPATCH 28/230 ARCv2: Enable unaligned access in early ASM code
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eugeniy Paltsev <[email protected]>
commit 252f6e8eae909bc075a1b1e3b9efb095ae4c0b56 upstream.
It is currently done in arc_init_IRQ() which might be too late considering gcc 7.3.1 onwards (GNU 2018.03) generates unaligned memory accesses by default
--- arch/arc/kernel/head.S | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/arc/kernel/head.S +10 -0
@@ -17,6 +17,7 @@ #include <asm/entry.h> #include <asm/arcregs.h> #include <asm/cache.h> +#include <asm/irqflags.h> .macro CPU_EARLY_SETUP
@@ -47,6 +48,15 @@ sr r5, [ARC_REG_DC_CTRL] 1: + +#ifdef CONFIG_ISA_ARCV2 + ; Unaligned access is disabled at reset, so re-enable early as + ; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access + ; by default + lr r5, [status32] + bset r5, r5, STATUS_AD_BIT + kflag r5 +#endif .endm .section .init.text, "ax",@progbits
Greg Kroah-Hartman
maintainerPATCH 29/230 Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
commit 278e2148c07559dd4ad8602f22366d61eb2ee7b7 upstream.
This reverts commit 5a2de63fd1a5 ("bridge: do not add port to router list when receives query with source 0.0.0.0") and commit 0fe5119e267f ("net:
bridge: remove ipv6 zero address check in mcast queries")
The reason is RFC 4541 is not a standard but suggestive. Currently we will elect 0.0.0.0 as Querier if there is no ip address configured on bridge. If we do not add the port which recives query with source 0.0.0.0 to router list, the IGMP reports will not be about to forward to Querier, IGMP data will also not be able to forward to dest.
As Nikolay suggested, revert this change first and add a boolopt api to disable none-zero election in future if needed.
--- net/bridge/br_multicast.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
net/bridge/br_multicast.c +1 -8
@@ -1261,14 +1261,7 @@ static void br_multicast_query_received(return ;br_multicast_update_query_timer (br, query, max_delay); - -/* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules, -* the arrival port for IGMP Queries where the source address -* is 0.0.0.0 should not be added to router port list. -*/ -if ((saddr->proto ==htons (ETH_P_IP ) && saddr->u.ip4) || - saddr->proto ==htons (ETH_P_IPV6 )) -br_multicast_mark_router (br, port); +br_multicast_mark_router (br, port); } static int br_ip4_multicast_query(struct net_bridge *br,
Greg Kroah-Hartman
maintainerPATCH 30/230 libceph: handle an empty authorize reply
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <[email protected]>
commit 0fd3fd0a9bb0b02b6435bb7070e9f7b82a23f068 upstream.
The authorize reply can be empty, for example when the ticket used to build the authorizer is too old and TAG_BADAUTHORIZER is returned from the service. Calling ->verify_authorizer_reply() results in an attempt to decrypt and validate (somewhat) random data in au->buf (most likely the signature block from calc_signature()), which fails and ends up in con_fault_finish() with !con->auth_retry. The ticket isn't invalidated and the connection is retried again and again until a new ticket is obtained from the monitor:
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
libceph: osd2 192.168.122.1:6809 bad authorize reply
Let TAG_BADAUTHORIZER handler kick in and increment con->auth_retry.
--- net/ceph/messenger.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
net/ceph/messenger.c +8 -4
@@ -2049,15 +2049,19 @@ static int process_connect(struct ceph_cdout ("process_connect on %p tag %d\n" , con, (int )con->in_tag);if (con->auth_reply_buf) { +int len =le32_to_cpu (con->in_reply.authorizer_len); +/* * Any connection that defines ->get_authorizer() * should also define ->verify_authorizer_reply(). * See get_connect_authorizer(). */ - ret = con->ops->verify_authorizer_reply (con,0 ); -if (ret <0 ) { - con->error_msg ="bad authorize reply" ; -return ret; +if (len) { + ret = con->ops->verify_authorizer_reply (con,0 ); +if (ret <0 ) { + con->error_msg ="bad authorize reply" ; +return ret; + } } }
Greg Kroah-Hartman
maintainerPATCH 31/230 scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <[email protected]>
commit ffeafdd2bf0b280d67ec1a47ea6287910d271f3f upstream.
The sysfs phy_identifier attribute for a sas_end_device comes from the rphy phy_identifier value.
Currently this is not being set for rphys with an end device attached, so we see incorrect symlinks from systemd disk/by-path:
root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 10 Feb 13 12:26 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy0-lun-0-part3 -> ../../sdc3
Indeed, each sas_end_device phy_identifier value is 0:
root@localhost:/# more sys/class/sas_device/end_device-0\:0\:2/phy_identifier 0 root@localhost:/# more sys/class/sas_device/end_device-0\:0\:10/phy_identifier 0
This patch fixes the discovery code to set the phy_identifier. With this, we now get proper symlinks:
root@localhost:~# ls -l /dev/disk/by-path/ total 0 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy10-lun-0 -> ../../sdg lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy11-lun-0 -> ../../sdh lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0 -> ../../sda lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy2-lun-0-part1 -> ../../sda1 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0 -> ../../sdb lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part1 -> ../../sdb1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy3-lun-0-part2 -> ../../sdb2 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0 -> ../../sdc lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part1 -> ../../sdc1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part2 -> ../../sdc2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy4-lun-0-part3 -> ../../sdc3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy5-lun-0 -> ../../sdd lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0 -> ../../sde lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part1 -> ../../sde1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part2 -> ../../sde2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy7-lun-0-part3 -> ../../sde3 lrwxrwxrwx 1 root root 9 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0 -> ../../sdf lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part1 -> ../../sdf1 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part2 -> ../../sdf2 lrwxrwxrwx 1 root root 10 Feb 13 11:53 platform-HISI0162:01-sas-exp0x500e004aaaaaaa1f-phy8-lun-0-part3 -> ../../sdf3
--- drivers/scsi/libsas/sas_expander.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/scsi/libsas/sas_expander.c +2 -0
@@ -818,6 +818,7 @@ static struct domain_device *sas_ex_disc rphy =sas_end_device_alloc (phy->port);if (!rphy) goto out_free; + rphy->identify.phy_identifier = phy_id; child->rphy = rphy;get_device (&rphy->dev);
@@ -845,6 +846,7 @@ static struct domain_device *sas_ex_disc child->rphy = rphy;get_device (&rphy->dev); + rphy->identify.phy_identifier = phy_id;sas_fill_in_rphy (child, rphy);list_add_tail (&child->disco_list_node, &parent->port->disco_list);
Greg Kroah-Hartman
maintainerPATCH 32/230 drm/msm: Unblock writer if reader closes file
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 99c66bc051e7407fe0bf0607b142ec0be1a1d1dd ]
Prevents deadlock when fifo is full and reader closes file.
--- drivers/gpu/drm/msm/msm_rd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/gpu/drm/msm/msm_rd.c +6 -1
@@ -103,7 +103,9 @@ static void rd_write(struct msm_rd_state *rd, const void *buf, int sz)char *fptr = &fifo->buf[fifo->head];int n; -wait_event (rd->fifo_event,circ_space (&rd->fifo) >0 ); +wait_event (rd->fifo_event,circ_space (&rd->fifo) >0 || !rd->open); +if (!rd->open) +return ; n =min (sz,circ_space_to_end (&rd->fifo));memcpy (fptr, ptr, n);
@@ -192,7 +194,10 @@ static int rd_open(struct inode *inode, struct file *file)static int rd_release (struct inode *inode,struct file *file) {struct msm_rd_state *rd = inode->i_private; + rd->open = false; +wake_up_all (&rd->fifo_event); +return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/230 ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 906a9abc5de73c383af518f5a806f4be2993a0c7 ]
For some reason this field was set to zero when all other drivers use .dynamic = 1 for front-ends. This change was tested on Dell XPS13 and has no impact with the existing legacy driver. The SOF driver also works with this change which enables it to override the fixed topology.
--- sound/soc/intel/boards/broadwell.c | 2 +- sound/soc/intel/boards/haswell.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
sound/soc/intel/boards/broadwell.c +1 -1
@@ -191,7 +191,7 @@ static struct snd_soc_dai_link broadwell_rt286_dais[] = { .stream_name = "Loopback", .cpu_dai_name = "Loopback Pin", .platform_name = "haswell-pcm-audio", - .dynamic = 0, + .dynamic = 1, .codec_name = "snd-soc-dummy", .codec_dai_name = "snd-soc-dummy-dai", .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
sound/soc/intel/boards/haswell.c +1 -1
@@ -145,7 +145,7 @@ static struct snd_soc_dai_link haswell_rt5640_dais[] = { .stream_name = "Loopback", .cpu_dai_name = "Loopback Pin", .platform_name = "haswell-pcm-audio", - .dynamic = 0, + .dynamic = 1, .codec_name = "snd-soc-dummy", .codec_dai_name = "snd-soc-dummy-dai", .trigger = {SND_SOC_DPCM_TRIGGER_POST, SND_SOC_DPCM_TRIGGER_POST},
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/230 ALSA: compress: prevent potential divide by zero bugs
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 678e2b44c8e3fec3afc7202f1996a4500a50be93 ]
The problem is seen in the q6asm_dai_compr_set_params() function:
ret = q6asm_map_memory_regions(dir, prtd->audio_client, prtd->phys,
(prtd->pcm_size / prtd->periods),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
prtd->periods);In this code prtd->pcm_size is the buffer_size and prtd->periods comes from params->buffer.fragments. If we allow the number of fragments to be zero then it results in a divide by zero bug. One possible fix would be to use prtd->pcm_count directly instead of using the division to re-calculate it. But I decided that it doesn't really make sense to allow zero fragments.
--- sound/core/compress_offload.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/core/compress_offload.c +2 -1
@@ -500,7 +500,8 @@ static int snd_compress_check_input(struct snd_compr_params *params) {/* first let's check the buffer parameter's */ if (params->buffer.fragment_size ==0 || - params->buffer.fragments >INT_MAX / params->buffer.fragment_size) + params->buffer.fragments >INT_MAX / params->buffer.fragment_size || + params->buffer.fragments ==0 )return -EINVAL ;/* now codec parameters */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/230 thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 3fe931b31a4078395c1967f0495dcc9e5ec6b5e3 ]
The intel_soc_dts_iosf_init() function doesn't return NULL, it returns error pointers.
--- drivers/thermal/int340x_thermal/processor_thermal_device.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/thermal/int340x_thermal/processor_thermal_device.c +1 -1
@@ -363,7 +363,7 @@ static int proc_thermal_pci_probe(struct pci_dev *pdev, proc_priv->soc_dts =intel_soc_dts_iosf_init (INTEL_SOC_DTS_INTERRUPT_MSI ,2 ,0 ); -if (proc_priv->soc_dts && pdev->irq) { +if (!IS_ERR (proc_priv->soc_dts) && pdev->irq) { ret =pci_enable_msi (pdev);if (!ret) { ret = request_threaded_irq(pdev->irq, NULL,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 36/230 usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 88b1bb1f3b88e0bf20b05d543a53a5b99bd7ceb6 ]
Currently the link_state is uninitialized and the default value is 0(U0) before the first time we start the udc, and after we start the udc then
stop the udc, the link_state will be undefined.
We may have the following warnings if we start the udc again with an undefined link_state:
WARNING: CPU: 0 PID: 327 at drivers/usb/dwc3/gadget.c:294 dwc3_send_gadget_ep_cmd+0x304/0x308 dwc3 100e0000.hidwc3_0: wakeup failed --> -22 [...] Call Trace: [<c010f270>] (unwind_backtrace) from [<c010b3d8>] (show_stack+0x10/0x14) [<c010b3d8>] (show_stack) from [<c034a4dc>] (dump_stack+0x84/0x98) [<c034a4dc>] (dump_stack) from [<c0118000>] (__warn+0xe8/0x100) [<c0118000>] (__warn) from [<c0118050>](warn_slowpath_fmt+0x38/0x48) [<c0118050>] (warn_slowpath_fmt) from [<c0442ec0>](dwc3_send_gadget_ep_cmd+0x304/0x308) [<c0442ec0>] (dwc3_send_gadget_ep_cmd) from [<c0445e68>](dwc3_ep0_start_trans+0x48/0xf4) [<c0445e68>] (dwc3_ep0_start_trans) from [<c0446750>](dwc3_ep0_out_start+0x64/0x80) [<c0446750>] (dwc3_ep0_out_start) from [<c04451c0>](__dwc3_gadget_start+0x1e0/0x278) [<c04451c0>] (__dwc3_gadget_start) from [<c04452e0>](dwc3_gadget_start+0x88/0x10c) [<c04452e0>] (dwc3_gadget_start) from [<c045ee54>](udc_bind_to_driver+0x88/0xbc) [<c045ee54>] (udc_bind_to_driver) from [<c045f29c>](usb_gadget_probe_driver+0xf8/0x140) [<c045f29c>] (usb_gadget_probe_driver) from [<bf005424>](gadget_dev_desc_UDC_store+0xac/0xc4 [libcomposite]) [<bf005424>] (gadget_dev_desc_UDC_store [libcomposite]) from[<c023d8e0>] (configfs_write_file+0xd4/0x160) [<c023d8e0>] (configfs_write_file) from [<c01d51e8>] (__vfs_write+0x1c/0x114) [<c01d51e8>] (__vfs_write) from [<c01d5ff4>] (vfs_write+0xa4/0x168) [<c01d5ff4>] (vfs_write) from [<c01d6d40>] (SyS_write+0x3c/0x90) [<c01d6d40>] (SyS_write) from [<c0107400>] (ret_fast_syscall+0x0/0x3c)
--- drivers/usb/dwc3/gadget.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/dwc3/gadget.c +1 -0
@@ -1676,6 +1676,7 @@ static int dwc3_gadget_start(struct usb_gadget *g,/* begin to receive SETUP packets */ dwc->ep0state =EP0_SETUP_PHASE ; + dwc->link_state =DWC3_LINK_STATE_SS_DIS ;dwc3_ep0_out_start (dwc);dwc3_gadget_enable_irq (dwc);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 37/230 usb: gadget: Potential NULL dereference on allocation error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit df28169e1538e4a8bcd8b779b043e5aa6524545c ]
The source_sink_alloc_func() function is supposed to return error pointers on error. The function is called from usb_get_function() which doesn't check for NULL returns so it would result in an Oops.
Of course, in the current kernel, small allocations always succeed so this doesn't affect runtime.
--- drivers/usb/gadget/function/f_sourcesink.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/function/f_sourcesink.c +1 -1
@@ -849,7 +849,7 @@ static struct usb_function *source_sink_alloc_func( ss =kzalloc (sizeof (*ss),GFP_KERNEL );if (!ss) -return NULL ; +return ERR_PTR (-ENOMEM ); ss_opts = container_of(fi, struct f_ss_opts, func_inst);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 38/230 ASoC: dapm: change snprintf to scnprintf for possible overflow
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e581e151e965bf1f2815dd94620b638fec4d0a7e ]
Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems.
1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf.
2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration.
The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE.
--- sound/soc/soc-dapm.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
sound/soc/soc-dapm.c +5 -5
@@ -1943,19 +1943,19 @@ static ssize_t dapm_widget_power_read_file(struct file *file, out =is_connected_output_ep (w,NULL ); } - ret =snprintf (buf,PAGE_SIZE ,"%s: %s%s in %d out %d" , + ret =scnprintf (buf,PAGE_SIZE ,"%s: %s%s in %d out %d" , w->name, w->power ?"On" :"Off" , w->force ?" (forced)" :"" , in, out);if (w->reg >=0 ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret," - R%d(0x%x) mask 0x%x" , w->reg, w->reg, w->mask << w->shift); - ret +=snprintf (buf + ret,PAGE_SIZE - ret,"\n" ); + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"\n" );if (w->sname) - ret +=snprintf (buf + ret,PAGE_SIZE - ret," stream %s %s\n" , + ret +=scnprintf (buf + ret,PAGE_SIZE - ret," stream %s %s\n" , w->sname, w->active ?"active" :"inactive" );
@@ -1968,7 +1968,7 @@ static ssize_t dapm_widget_power_read_file(struct file *file,if (!p->connect)continue ; - ret += snprintf(buf + ret, PAGE_SIZE - ret, + ret += scnprintf(buf + ret, PAGE_SIZE - ret, " %s \"%s\" \"%s\"\n", (rdir == SND_SOC_DAPM_DIR_IN) ? "in" : "out", p->name ? p->name : "static",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 39/230 ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c407cd008fd039320d147088b52d0fa34ed3ddcb ]
Change snprintf to scnprintf. There are generally two cases where using snprintf causes problems.
1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)
In this case, if snprintf would have written more characters than what the buffer size (SIZE) is, then size will end up larger than SIZE. In later uses of snprintf, SIZE - size will result in a negative number, leading to problems. Note that size might already be too large by using size = snprintf before the code reaches a case of size += snprintf.
2) If size is ultimately used as a length parameter for a copy back to user space, then it will potentially allow for a buffer overflow and information disclosure when size is greater than SIZE. When the size is used to index the buffer directly, we can have memory corruption. This also means when size = snprintf... is used, it may also cause problems since size may become large. Copying to userspace is mitigated by the HARDENED_USERCOPY kernel configuration.
The solution to these issues is to use scnprintf which returns the number of characters actually written to the buffer, so the size variable will never exceed SIZE.
--- sound/soc/fsl/imx-audmux.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
sound/soc/fsl/imx-audmux.c +12 -12
@@ -86,49 +86,49 @@ static ssize_t audmux_read_file(struct file *file, char __user *user_buf,if (!buf)return -ENOMEM ; - ret =snprintf (buf,PAGE_SIZE ,"PDCR: %08x\nPTCR: %08x\n" , + ret =scnprintf (buf,PAGE_SIZE ,"PDCR: %08x\nPTCR: %08x\n" , pdcr, ptcr);if (ptcr &IMX_AUDMUX_V2_PTCR_TFSDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxFS output from %s, " ,audmux_port_string ((ptcr >>27 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxFS input, " );if (ptcr &IMX_AUDMUX_V2_PTCR_TCLKDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxClk output from %s" ,audmux_port_string ((ptcr >>22 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"TxClk input" ); - ret +=snprintf (buf + ret,PAGE_SIZE - ret,"\n" ); + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"\n" );if (ptcr &IMX_AUDMUX_V2_PTCR_SYN ) { - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"Port is symmetric" ); }else {if (ptcr &IMX_AUDMUX_V2_PTCR_RFSDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxFS output from %s, " ,audmux_port_string ((ptcr >>17 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxFS input, " );if (ptcr &IMX_AUDMUX_V2_PTCR_RCLKDIR ) - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxClk output from %s" ,audmux_port_string ((ptcr >>12 ) &0x7 ));else - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"RxClk input" ); } - ret +=snprintf (buf + ret,PAGE_SIZE - ret, + ret +=scnprintf (buf + ret,PAGE_SIZE - ret,"\nData received from %s\n" ,audmux_port_string ((pdcr >>13 ) &0x7 ));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 40/230 ARC: fix __ffs return value to avoid build warnings
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4e868f8419cb4cb558c5d428e7ab5629cef864c7 ]
| CC mm/nobootmem.o |In file included from ./include/asm-generic/bug.h:18:0, | from ./arch/arc/include/asm/bug.h:32, | from ./include/linux/bug.h:5, | from ./include/linux/mmdebug.h:5, | from ./include/linux/gfp.h:5, | from ./include/linux/slab.h:15, | from mm/nobootmem.c:14: |mm/nobootmem.c: In function '__free_pages_memory': |./include/linux/kernel.h:845:29: warning: comparison of distinct pointer types lacks a cast | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^ |./include/linux/kernel.h:859:4: note: in expansion of macro '__typecheck' | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ |./include/linux/kernel.h:869:24: note: in expansion of macro '__safe_cmp' | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ |./include/linux/kernel.h:878:19: note: in expansion of macro '__careful_cmp' | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ |mm/nobootmem.c:104:11: note: in expansion of macro 'min' | order = min(MAX_ORDER - 1UL, __ffs(start));
Change __ffs return value from 'int' to 'unsigned long' as it is done in other implementations (like asm-generic, x86, etc...) to avoid build-time warnings in places where type is strictly checked.
As __ffs may return values in [0-31] interval changing return type to unsigned is valid.
--- arch/arc/include/asm/bitops.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arc/include/asm/bitops.h +3 -3
@@ -286,7 +286,7 @@ static inline __attribute__ ((const)) int __fls(unsigned long x)/* * __ffs: Similar to ffs, but zero based (0-31) */ -static inline __attribute__ ((const))int __ffs (unsigned long word) +static inline __attribute__ ((const))unsigned long __ffs (unsigned long word) {if (!word)return word;
@@ -346,9 +346,9 @@ static inline __attribute__ ((const)) int ffs(unsigned long x)/* * __ffs: Similar to ffs, but zero based (0-31) */ -static inline __attribute__ ((const))int __ffs (unsigned long x) +static inline __attribute__ ((const))unsigned long __ffs (unsigned long x) { -int n; +unsigned long n; asmvolatile ( " ffs.f %0, %1 \n" /* 0:31; 31(Z) if src 0 */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 41/230 mac80211: fix miscounting of ttl-dropped frames
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a0dc02039a2ee54fb4ae400e0b755ed30e73e58c ]
In ieee80211_rx_h_mesh_fwding, we increment the 'dropped_frames_ttl' counter when we decrement the ttl to zero. For unicast frames destined for other hosts, we stop processing the frame at that point.
For multicast frames, we do not rebroadcast it in this case, but we do pass the frame up the stack to process it on this STA. That doesn't match the usual definition of "dropped," so don't count those as such.
With this change, something like ping6 -i0.2 ff02::1%mesh0 from a peer in a ttl=1 network no longer increments the counter rapidly.
--- net/mac80211/rx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/rx.c +3 -1
@@ -2340,7 +2340,9 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)skb_set_queue_mapping (skb, q);if (!--mesh_hdr->ttl) { -IEEE80211_IFSTA_MESH_CTR_INC (ifmsh, dropped_frames_ttl); +if (!is_multicast_ether_addr (hdr->addr1)) +IEEE80211_IFSTA_MESH_CTR_INC (ifmsh, + dropped_frames_ttl); goto out; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 42/230 serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 815d835b7ba46685c316b000013367dacb2b461b ]
Using over-sampling ratio, lpuart can accept baud rate upto uartclk / 4.
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -1409,7 +1409,7 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios, }/* ask the core to calculate the divisor */ - baud =uart_get_baud_rate (port, termios, old,50 , port->uartclk /16 ); + baud =uart_get_baud_rate (port, termios, old,50 , port->uartclk /4 );spin_lock_irqsave (&sport->port.lock, flags);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 43/230 scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit fe35a40e675473eb65f2f5462b82770f324b5689 ]
Assign fc_vport to ln->fc_vport before calling csio_fcoe_alloc_vnp() to avoid a NULL pointer dereference in csio_vport_set_state().
ln->fc_vport is dereferenced in csio_vport_set_state().
--- drivers/scsi/csiostor/csio_attr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/csiostor/csio_attr.c +1 -1
@@ -582,12 +582,12 @@ csio_vport_create(struct fc_vport *fc_vport, bool disable) }fc_vport_set_state (fc_vport,FC_VPORT_INITIALIZING ); + ln->fc_vport = fc_vport;if (csio_fcoe_alloc_vnp (hw, ln)) goto error; *(struct csio_lnode **)fc_vport->dd_data = ln; - ln->fc_vport = fc_vport;if (!fc_vport->node_name) fc_vport->node_name =wwn_to_u64 (csio_ln_wwnn (ln));if (!fc_vport->port_name)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 44/230 net: altera_tse: fix connect_local_phy error path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 17b42a20d7ca59377788c6a2409e77569570cc10 ]
The connect_local_phy should return NULL (not negative errno) on error, since its caller expects it.
--- drivers/net/ethernet/altera/altera_tse_main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_tse_main.c +3 -1
@@ -716,8 +716,10 @@ static struct phy_device *connect_local_phy(struct net_device *dev) phydev =phy_connect (dev, phy_id_fmt, &altera_tse_adjust_link, priv->phy_iface); -if (IS_ERR (phydev)) +if (IS_ERR (phydev)) {netdev_err (dev,"Could not attach to PHY\n" ); + phydev =NULL ; + } }else {int ret;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 45/230 ibmveth: Do not process frames after calling napi_reschedule
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit e95d22c69b2c130ccce257b84daf283fd82d611e ]
The IBM virtual ethernet driver's polling function continues to process frames after rescheduling NAPI, resulting in a warning if it exhausted its budget. Do not restart polling after calling napi_reschedule. Instead let frames be processed in the following instance.
--- drivers/net/ethernet/ibm/ibmveth.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/ibm/ibmveth.c +0 -2
@@ -1238,7 +1238,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)struct iphdr *iph;u16 mss =0 ; -restart_poll:while (frames_processed < budget) {if (!ibmveth_rxq_pending_buffer (adapter))break ;
@@ -1336,7 +1335,6 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) napi_reschedule(napi)) { lpar_rc =h_vio_signal (adapter->vdev->unit_address,VIO_IRQ_DISABLE ); - goto restart_poll; } }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 46/230 mac80211: dont initiate TDLS connection if station is not associated to AP
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ed5285396c257fd4070b1e29e7b2341aae2a1ce ]
Following call trace is observed while adding TDLS peer entry in driver during TDLS setup.
Call Trace: [<c1301476>] dump_stack+0x47/0x61 [<c10537d2>] __warn+0xe2/0x100 [<fa22415f>] ? sta_apply_parameters+0x49f/0x550 [mac80211] [<c1053895>] warn_slowpath_null+0x25/0x30 [<fa22415f>] sta_apply_parameters+0x49f/0x550 [mac80211] [<fa20ad42>] ? sta_info_alloc+0x1c2/0x450 [mac80211] [<fa224623>] ieee80211_add_station+0xe3/0x160 [mac80211] [<c1876fe3>] nl80211_new_station+0x273/0x420 [<c170f6d9>] genl_rcv_msg+0x219/0x3c0 [<c170f4c0>] ? genl_rcv+0x30/0x30 [<c170ee7e>] netlink_rcv_skb+0x8e/0xb0 [<c170f4ac>] genl_rcv+0x1c/0x30 [<c170e8aa>] netlink_unicast+0x13a/0x1d0 [<c170ec18>] netlink_sendmsg+0x2d8/0x390 [<c16c5acd>] sock_sendmsg+0x2d/0x40 [<c16c6369>] ___sys_sendmsg+0x1d9/0x1e0
Fixing this by allowing TDLS setup request only when we have completed association.
--- net/mac80211/cfg.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/cfg.c +4 -0
@@ -1228,6 +1228,10 @@ static int ieee80211_add_station(struct wiphy *wiphy, struct net_device *dev,if (params->sta_flags_set &BIT (NL80211_STA_FLAG_TDLS_PEER )) sta->sta.tdls = true; +if (sta->sta.tdls && sdata->vif.type ==NL80211_IFTYPE_STATION && + !sdata->u.mgd.associated) +return -EINVAL ; + err =sta_apply_parameters (local, sta, params);if (err) {sta_info_free (local, sta);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 47/230 cfg80211: extend range deviation for DMG
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 93183bdbe73bbdd03e9566c8dc37c9d06b0d0db6 ]
Recently, DMG frequency bands have been extended till 71GHz, so extend the range check till 20GHz (45-71GHZ), else some channels will be marked as disabled.
--- net/wireless/reg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/wireless/reg.c +2 -2
@@ -780,7 +780,7 @@ static bool reg_does_bw_fit(const struct ieee80211_freq_range *freq_range,* definitions (the "2.4 GHz band", the "5 GHz band" and the "60GHz band"), * however it is safe for now to assume that a frequency rule should not be * part of a frequency's band if the start freq or end freq are off by more -* than 2 GHz for the 2.4 and 5 GHz bands, and by more than 10 GHz for the +* than 2 GHz for the 2.4 and 5 GHz bands, and by more than 20 GHz for the * 60 GHz band. * This resolution can be lowered and should be considered as we add * regulatory rule support for other "bands".
@@ -795,7 +795,7 @@ static bool freq_in_rule_band(const struct ieee80211_freq_range *freq_range,* with the Channel starting frequency above 45 GHz. */ u32 limit = freq_khz >45 *ONE_GHZ_IN_KHZ ? -10 *ONE_GHZ_IN_KHZ :2 *ONE_GHZ_IN_KHZ ; +20 *ONE_GHZ_IN_KHZ :2 *ONE_GHZ_IN_KHZ ;if (abs (freq_khz - freq_range->start_freq_khz) <= limit)return true;if (abs (freq_khz - freq_range->end_freq_khz) <= limit)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 48/230 KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 619ad846fc3452adaf71ca246c5aa711e2055398 ]
kvm-unit-tests' eventinj "NMI failing on IDT" test results in NMI being delivered to the host (L1) when it's running nested. The problem seems to
be: svm_complete_interrupts() raises 'nmi_injected' flag but later we decide to reflect EXIT_NPF to L1. The flag remains pending and we do NMI injection upon entry so it got delivered to L1 instead of L2.
It seems that VMX code solves the same issue in prepare_vmcs12(), this was introduced with code refactoring in commit 5f3d5799974b ("KVM: nVMX: Rework event injection and recovery").
--- arch/x86/kvm/svm.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kvm/svm.c +8 -0
@@ -2388,6 +2388,14 @@ static int nested_svm_vmexit(struct vcpu_svm *svm)kvm_mmu_reset_context (&svm->vcpu);kvm_mmu_load (&svm->vcpu); +/* +* Drop what we picked up for L2 via svm_complete_interrupts() so it +* doesn't end up in L1. +*/ + svm->vcpu.arch.nmi_injected = false; +kvm_clear_exception_queue (&svm->vcpu); +kvm_clear_interrupt_queue (&svm->vcpu); +return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 49/230 arm/arm64: KVM: Feed initialized memory to MMIO accesses
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
commit 1d6a821277aaa0cdd666278aaff93298df313d41 upstream.
On an MMIO access, we always copy the on-stack buffer info the shared "run" structure, even if this is a read access. This ends up leaking up to 8 bytes of uninitialized memory into userspace, depending on the size of the access.
An obvious fix for this one is to only perform the copy if this is an actual write.
--- arch/arm/kvm/mmio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/kvm/mmio.c +2 -1
@@ -207,7 +207,8 @@ int io_mem_abort(struct kvm_vcpu *vcpu, run->mmio.is_write = is_write; run->mmio.phys_addr = fault_ipa; run->mmio.len = len; -memcpy (run->mmio.data, data_buf, len); +if (is_write) +memcpy (run->mmio.data, data_buf, len);if (!ret) {/* We handled the access successfully in the kernel. */
Greg Kroah-Hartman
maintainerPATCH 50/230 KVM: arm/arm64: Fix MMIO emulation data handling
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Dall <[email protected]>
commit 83091db981e105d97562d3ed3ffe676e21927e3a upstream.
When the kernel was handling a guest MMIO read access internally, we need to copy the emulation result into the run->mmio structure in order for the kvm_handle_mmio_return() function to pick it up and inject the
result back into the guest.
Currently the only user of kvm_io_bus for ARM is the VGIC, which did this copying itself, so this was not causing issues so far.
But with the upcoming new vgic implementation we need this done properly.
Update the kvm_handle_mmio_return description and cleanup the code to only perform a single copying when needed.
Code and commit message inspired by Andre Przywara.
--- arch/arm/kvm/mmio.c | 11 ++++++----- virt/kvm/arm/vgic.c | 7 ------- 2 files changed, 6 insertions(+), 12 deletions(-)
arch/arm/kvm/mmio.c +6 -5
@@ -87,11 +87,10 @@ static unsigned long mmio_read_buf(char/** * kvm_handle_mmio_return -- Handle MMIO loads after user space emulation +* or in-kernel IO emulation +* * @vcpu: The VCPU pointer * @run: The VCPU run struct containing the mmio data -* -* This should only be called after returning from userspace for MMIO load -* emulation. */ int kvm_handle_mmio_return (struct kvm_vcpu *vcpu,struct kvm_run *run) {
@@ -207,15 +206,17 @@ int io_mem_abort(struct kvm_vcpu *vcpu, run->mmio.is_write = is_write; run->mmio.phys_addr = fault_ipa; run->mmio.len = len; -if (is_write) -memcpy (run->mmio.data, data_buf, len);if (!ret) {/* We handled the access successfully in the kernel. */ +if (!is_write) +memcpy (run->mmio.data, data_buf, len);kvm_handle_mmio_return (vcpu, run);return 1 ; } +if (is_write) +memcpy (run->mmio.data, data_buf, len); run->exit_reason =KVM_EXIT_MMIO ;return 0 ; }
virt/kvm/arm/vgic.c +0 -7
@@ -821,7 +821,6 @@ static int vgic_handle_mmio_access(strucstruct vgic_dist *dist = &vcpu->kvm->arch.vgic;struct vgic_io_device *iodev =container_of (this, struct vgic_io_device, dev); -struct kvm_run *run = vcpu->run;const struct vgic_io_range *range;struct kvm_exit_mmio mmio;bool updated_state;
@@ -850,12 +849,6 @@ static int vgic_handle_mmio_access(struc updated_state = false; }spin_unlock (&dist->lock); - run->mmio.is_write = is_write; - run->mmio.len = len; - run->mmio.phys_addr = addr; -memcpy (run->mmio.data, val, len); - -kvm_handle_mmio_return (vcpu, run);if (updated_state)vgic_kick_vcpus (vcpu->kvm);
Greg Kroah-Hartman
maintainerPATCH 51/230 powerpc: Always initialize input array when calling epapr_hypercall()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seth Forshee <[email protected]>
commit 186b8f1587c79c2fa04bfa392fdf084443e398c1 upstream.
Several callers to epapr_hypercall() pass an uninitialized stack allocated array for the input arguments, presumably because they have no input arguments. However this can produce errors like this one
arch/powerpc/include/asm/epapr_hcalls.h:470:42: error: 'in' may be used uninitialized in this function [-Werror=maybe-uninitialized]
unsigned long register r3 asm("r3") = in[0];
~~^~~Fix callers to this function to always zero-initialize the input arguments array to prevent this.
--- arch/powerpc/include/asm/epapr_hcalls.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
arch/powerpc/include/asm/epapr_hcalls.h +6 -6
@@ -508,7 +508,7 @@ static unsigned long epapr_hypercall(unsstatic inline long epapr_hypercall0_1 (unsigned int nr,unsigned long *r2) { -unsigned long in[8 ]; +unsigned long in[8 ] = {0 };unsigned long out[8 ];unsigned long r;
@@ -520,7 +520,7 @@ static inline long epapr_hypercall0_1(unstatic inline long epapr_hypercall0 (unsigned int nr) { -unsigned long in[8 ]; +unsigned long in[8 ] = {0 };unsigned long out[8 ];return epapr_hypercall (in, out, nr);
@@ -528,7 +528,7 @@ static inline long epapr_hypercall0(unsistatic inline long epapr_hypercall1 (unsigned int nr,unsigned long p1) { -unsigned long in[8 ]; +unsigned long in[8 ] = {0 };unsigned long out[8 ]; in[0 ] = p1;
@@ -538,7 +538,7 @@ static inline long epapr_hypercall1(unsistatic inline long epapr_hypercall2 (unsigned int nr,unsigned long p1,unsigned long p2) { -unsigned long in[8 ]; +unsigned long in[8 ] = {0 };unsigned long out[8 ]; in[0 ] = p1;
@@ -549,7 +549,7 @@ static inline long epapr_hypercall2(unsistatic inline long epapr_hypercall3 (unsigned int nr,unsigned long p1,unsigned long p2,unsigned long p3) { -unsigned long in[8 ]; +unsigned long in[8 ] = {0 };unsigned long out[8 ]; in[0 ] = p1;
@@ -562,7 +562,7 @@ static inline long epapr_hypercall4(unsi unsigned long p2, unsigned long p3, unsigned long p4) { - unsigned long in[8]; + unsigned long in[8] = {0};unsigned long out[8 ]; in[0 ] = p1;
Greg Kroah-Hartman
maintainerPATCH 52/230 mmc: spi: Fix card detection during probe
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Neuschäfer <[email protected]>
commit c9bd505dbd9d3dc80c496f88eafe70affdcf1ba6 upstream.
When using the mmc_spi driver with a card-detect pin, I noticed that the card was not detected immediately after probe, but only after it was unplugged and plugged back in (and the CD IRQ fired).
The call tree looks something like this:
mmc_spi_probe
mmc_add_host
mmc_start_host
_mmc_detect_change
mmc_schedule_delayed_work(&host->detect, 0)
mmc_rescan
host->bus_ops->detect(host)
mmc_detect
_mmc_detect_card_removed
host->ops->get_cd(host)
mmc_gpio_get_cd -> -ENOSYS (ctx->cd_gpio not set)
mmc_gpiod_request_cd
ctx->cd_gpio = descTo fix this issue, call mmc_detect_change after the card-detect GPIO/IRQ is registered.
--- drivers/mmc/host/mmc_spi.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/mmc_spi.c +1 -0
@@ -1451,6 +1451,7 @@ static int mmc_spi_probe(struct spi_deviif (status !=0 ) goto fail_add_host; } +mmc_detect_change (mmc,0 ); dev_info(&spi->dev, "SD/MMC host %s%s%s%s%s\n", dev_name(&mmc->class_dev),
Greg Kroah-Hartman
maintainerPATCH 53/230 mm: enforce min addr even if capable() in expand_downwards()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 0a1d52994d440e21def1c2174932410b4f2a98a1 upstream.
security_mmap_addr() does a capability check with current_cred(), but we can reach this code from contexts like a VFS write handler where current_cred() must not be used.
This can be abused on systems without SMAP to make NULL pointer dereferences exploitable again.
--- mm/mmap.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
mm/mmap.c +3 -4
@@ -2294,12 +2294,11 @@ int expand_downwards(struct vm_area_strustruct mm_struct *mm = vma->vm_mm;struct vm_area_struct *prev;unsigned long gap_addr; -int error; +int error =0 ; address &=PAGE_MASK ; - error =security_mmap_addr (address); -if (error) -return error; +if (address < mmap_min_addr) +return -EPERM ;/* Enforce stack_guard_gap */ gap_addr = address - stack_guard_gap;
Greg Kroah-Hartman
maintainerPATCH 54/230 x86/uaccess: Dont leak the AC flag into __put_user() value evaluation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Lutomirski <[email protected]>
commit 2a418cf3f5f1caf911af288e978d61c9844b0695 upstream.
When calling __put_user(foo(), ptr), the __put_user() macro would call foo() in between __uaccess_begin() and __uaccess_end(). If that code were buggy, then those bugs would be run without SMAP protection.
Fortunately, there seem to be few instances of the problem in the kernel. Nevertheless, __put_user() should be fixed to avoid doing this. Therefore, evaluate __put_user()'s argument before setting AC.
This issue was noticed when an objtool hack by Peter Zijlstra complained about genregs_get() and I compared the assembly output to the C source.
[ bp: Massage commit message and fixed up whitespace. ]
--- arch/x86/include/asm/uaccess.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/include/asm/uaccess.h +4 -3
@@ -314,8 +314,7 @@ do { \__put_user_asm (x, ptr, retval,"l" ,"k" ,"ir" , errret); \break ; \case 8 : \ -__put_user_asm_u64 ((__typeof__ (*ptr))(x), ptr, retval, \ - errret); \ +__put_user_asm_u64 (x, ptr, retval, errret); \break ; \default : \__put_user_bad (); \
@@ -426,8 +425,10 @@ do { \#define __put_user_nocheck (x, ptr, size) \ ({ \ int __pu_err; \ + __typeof__(*(ptr)) __pu_val; \ + __pu_val = x; \ __uaccess_begin(); \ - __put_user_size((x), (ptr), (size), __pu_err, -EFAULT); \ + __put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT);\ __uaccess_end(); \ __builtin_expect(__pu_err, 0); \ })
Greg Kroah-Hartman
maintainerPATCH 55/230 USB: serial: option: add Telit ME910 ECM composition
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 6431866b6707d27151be381252d6eef13025cfce upstream.
This patch adds Telit ME910 family ECM composition 0x1102.
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1147,6 +1147,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), .driver_info = NCTRL(0) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1102, 0xff), /* Telit ME910 (ECM) */ + .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
Greg Kroah-Hartman
maintainerPATCH 56/230 USB: serial: cp210x: add ID for Ingenico 3070
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Mironov <[email protected]>
commit dd9d3d86b08d6a106830364879c42c78db85389c upstream.
Here is how this device appears in kernel log:
usb 3-1: new full-speed USB device number 18 using xhci_hcd usb 3-1: New USB device found, idVendor=0b00, idProduct=3070 usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 usb 3-1: Product: Ingenico 3070
usb 3-1: Manufacturer: Silicon Labs
usb 3-1: SerialNumber: 0001
Apparently this is a POS terminal with embedded USB-to-Serial converter.
--- drivers/usb/serial/cp210x.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/cp210x.c +1 -0
@@ -57,6 +57,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(0x08e6, 0x5501) }, /* Gemalto Prox-PU/CU contactless smartcard reader */ { USB_DEVICE(0x08FD, 0x000A) }, /* Digianswer A/S , ZigBee/802.15.4 MAC Device */ { USB_DEVICE(0x0908, 0x01FF) }, /* Siemens RUGGEDCOM USB Serial Console */ + { USB_DEVICE(0x0B00, 0x3070) }, /* Ingenico 3070 */ { USB_DEVICE(0x0BED, 0x1100) }, /* MEI (TM) Cashflow-SC Bill/Voucher Acceptor */ { USB_DEVICE(0x0BED, 0x1101) }, /* MEI series 2000 Combo Acceptor */ { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
Greg Kroah-Hartman
maintainerPATCH 57/230 USB: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mans Rullgard <[email protected]>
commit 8d7fa3d4ea3f0ca69554215e87411494e6346fdc upstream.
This adds the USB ID of the Hjelmslund Electronics USB485 Iso stick.
--- drivers/usb/serial/ftdi_sio.c | 2 ++ drivers/usb/serial/ftdi_sio_ids.h | 6 ++++++ 2 files changed, 8 insertions(+)
drivers/usb/serial/ftdi_sio.c +2 -0
@@ -1020,6 +1020,8 @@ static const struct usb_device_id id_tab { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, +/* EZPrototypes devices */ + { USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) }, { } /* Terminating entry */ };
drivers/usb/serial/ftdi_sio_ids.h +6 -0
@@ -1308,6 +1308,12 @@#define IONICS_PLUGCOMPUTER_PID 0x0102/* +* EZPrototypes (PID reseller) +*/ +#define EZPROTOTYPES_VID 0x1c40 +#define HJELMSLUND_USB485_ISO_PID 0x0477 + +/* * Dresden Elektronik Sensor Terminal Board */ #define DE_VID 0x1cf1/* Vendor ID */
Greg Kroah-Hartman
maintainerPATCH 58/230 cpufreq: Use struct kobj_attribute instead of struct global_attr
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <[email protected]>
commit 625c85a62cb7d3c79f6e16de3cfa972033658250 upstream.
The cpufreq_global_kobject is created using kobject_create_and_add() helper, which assigns the kobj_type as dynamic_kobj_ktype and show/store routines are set to kobj_attr_show() and kobj_attr_store().
These routines pass struct kobj_attribute as an argument to the show/store callbacks. But all the cpufreq files created using the cpufreq_global_kobject expect the argument to be of type struct attribute. Things work fine currently as no one accesses the "attr" argument. We may not see issues even if the argument is used, as struct kobj_attribute has struct attribute as its first element and so they will both get same address.
But this is logically incorrect and we should rather use struct kobj_attribute instead of struct global_attr in the cpufreq core and drivers and the show/store callbacks should take struct kobj_attribute as argument instead.
This bug is caught using CFI CLANG builds in android kernel which catches mismatch in function prototypes for such callbacks.
--- drivers/cpufreq/cpufreq.c | 6 +++--- drivers/cpufreq/cpufreq_governor.h | 10 +++++----- drivers/cpufreq/intel_pstate.c | 14 +++++++------- include/linux/cpufreq.h | 12 ++---------- 4 files changed, 17 insertions(+), 25 deletions(-)
drivers/cpufreq/cpufreq.c +3 -3
@@ -474,13 +474,13 @@ EXPORT_SYMBOL_GPL(cpufreq_freq_transitio* SYSFS INTERFACE * *********************************************************************/ static ssize_t show_boost (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {return sprintf (buf,"%d\n" , cpufreq_driver->boost_enabled); } -static ssize_t store_boost (struct kobject *kobj,struct attribute *attr, -const char *buf,size_t count) +static ssize_t store_boost (struct kobject *kobj,struct kobj_attribute *attr, +const char *buf,size_t count) {int ret, enable;
drivers/cpufreq/cpufreq_governor.h +5 -5
@@ -48,11 +48,11 @@ enum {OD_NORMAL_SAMPLE, OD_SUB_SAMPLE};/* Create attributes */ #define gov_sys_attr_ro (_name) \ -static struct global_attr _name##_gov_sys = \ +static struct kobj_attribute _name##_gov_sys = \ __ATTR(_name, 0444, show_##_name##_gov_sys, NULL)#define gov_sys_attr_rw (_name) \ -static struct global_attr _name##_gov_sys = \ +static struct kobj_attribute _name##_gov_sys = \ __ATTR(_name, 0644, show_##_name##_gov_sys, store_##_name##_gov_sys)#define gov_pol_attr_ro (_name) \
@@ -74,7 +74,7 @@ __ATTR(_name, 0644, show_##_name##_gov_p/* Create show/store routines */ #define show_one (_gov, file_name) \ static ssize_t show_##file_name##_gov_sys \ -(struct kobject *kobj, struct attribute *attr, char *buf) \ +(struct kobject *kobj, struct kobj_attribute *attr, char *buf) \ { \ struct _gov##_dbs_tuners *tuners = _gov##_dbs_cdata.gdbs_data->tuners; \ return sprintf(buf, "%u\n", tuners->file_name); \
@@ -90,7 +90,7 @@ static ssize_t show_##file_name##_gov_po#define store_one (_gov, file_name) \ static ssize_t store_##file_name##_gov_sys \ -(struct kobject *kobj, struct attribute *attr, const char *buf, size_t count) \ +(struct kobject *kobj, struct kobj_attribute *attr, const char *buf, size_t count) \ { \ struct dbs_data *dbs_data = _gov##_dbs_cdata.gdbs_data; \ return store_##file_name(dbs_data, buf, count); \
@@ -254,7 +254,7 @@ static inline int delay_for_sampling_rat#define declare_show_sampling_rate_min (_gov) \ static ssize_t show_sampling_rate_min_gov_sys \ -(struct kobject *kobj, struct attribute *attr, char *buf) \ +(struct kobject *kobj, struct kobj_attribute *attr, char *buf) \ { \ struct dbs_data *dbs_data = _gov##_dbs_cdata.gdbs_data; \ return sprintf(buf, "%u\n", dbs_data->min_sampling_rate); \
drivers/cpufreq/intel_pstate.c +7 -7
@@ -368,13 +368,13 @@ static void __init intel_pstate_debug_ex/************************** sysfs begin ************************/ #define show_one (file_name, object) \ static ssize_t show_##file_name \ - (struct kobject *kobj, struct attribute *attr, char *buf) \ + (struct kobject *kobj, struct kobj_attribute *attr, char *buf) \ { \ return sprintf(buf, "%u\n", limits->object); \ }static ssize_t show_turbo_pct (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {struct cpudata *cpu;int total, no_turbo, turbo_pct;
@@ -390,7 +390,7 @@ static ssize_t show_turbo_pct(struct kob }static ssize_t show_num_pstates (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {struct cpudata *cpu;int total;
@@ -401,7 +401,7 @@ static ssize_t show_num_pstates(struct k }static ssize_t show_no_turbo (struct kobject *kobj, -struct attribute *attr,char *buf) +struct kobj_attribute *attr,char *buf) {ssize_t ret;
@@ -414,7 +414,7 @@ static ssize_t show_no_turbo(struct kobjreturn ret; } -static ssize_t store_no_turbo (struct kobject *a,struct attribute *b, +static ssize_t store_no_turbo (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
@@ -438,7 +438,7 @@ static ssize_t store_no_turbo(struct kobreturn count; } -static ssize_t store_max_perf_pct (struct kobject *a,struct attribute *b, +static ssize_t store_max_perf_pct (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
@@ -463,7 +463,7 @@ static ssize_t store_max_perf_pct(structreturn count; } -static ssize_t store_min_perf_pct (struct kobject *a,struct attribute *b, +static ssize_t store_min_perf_pct (struct kobject *a,struct kobj_attribute *b,const char *buf,size_t count) {unsigned int input;
include/linux/cpufreq.h +2 -10
@@ -203,20 +203,12 @@ __ATTR(_name, _perm, show_##_name, NULL)static struct freq_attr _name = \ __ATTR(_name, 0644, show_##_name, store_##_name) -struct global_attr { -struct attribute attr; -ssize_t (*show)(struct kobject *kobj, -struct attribute *attr,char *buf); -ssize_t (*store)(struct kobject *a,struct attribute *b, -const char *c,size_t count); -}; -#define define_one_global_ro (_name) \ -static struct global_attr _name = \ +static struct kobj_attribute _name = \ __ATTR(_name, 0444, show_##_name, NULL)#define define_one_global_rw (_name) \ -static struct global_attr _name = \ +static struct kobj_attribute _name = \ __ATTR(_name, 0644, show_##_name, store_##_name)
Greg Kroah-Hartman
maintainerPATCH 59/230 sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Gruenbacher <[email protected]>
commit 971df15bd54ad46e907046ff33750a137b2f0096 upstream.
The standard return value for unsupported attribute names is -EOPNOTSUPP, as opposed to undefined but supported attributes (-ENODATA).
Also, fail for attribute names like "system.sockprotonameXXX" and simplify the code a bit.
--- net/socket.c | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-)
net/socket.c +6 -18
@@ -470,27 +470,15 @@ static struct socket *sockfd_lookup_lighstatic ssize_t sockfs_getxattr (struct dentry *dentry,const char *name,void *value,size_t size) { -const char *proto_name; -size_t proto_size; -int error; - - error = -ENODATA ; -if (!strncmp (name,XATTR_NAME_SOCKPROTONAME ,XATTR_NAME_SOCKPROTONAME_LEN )) { - proto_name = dentry->d_name.name; - proto_size =strlen (proto_name); - +if (!strcmp (name,XATTR_NAME_SOCKPROTONAME )) {if (value) { - error = -ERANGE ; -if (proto_size +1 > size) - goto out; - -strncpy (value, proto_name, proto_size +1 ); +if (dentry->d_name.len +1 > size) +return -ERANGE ; +memcpy (value, dentry->d_name.name, dentry->d_name.len +1 ); } - error = proto_size +1 ; +return dentry->d_name.len +1 ; } - -out: -return error; +return -EOPNOTSUPP ; } static ssize_t sockfs_listxattr(struct dentry *dentry, char *buffer,
Greg Kroah-Hartman
maintainerPATCH 60/230 ncpfs: fix build warning of strncpy
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
Not upstream as ncpfs is long deleted.
Fix up two strncpy build warnings in ncp_get_charsets() by using strscpy and the max size of the array.
It's not like anyone uses this code anyway, and this gets rid of two build warnings so that we can see real warnings as they pop up over time.
--- fs/ncpfs/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ncpfs/ioctl.c +2 -2
@@ -233,7 +233,7 @@ ncp_get_charsets(struct ncp_server* serv len =strlen (server->nls_vol->charset);if (len >NCP_IOCSNAME_LEN ) len =NCP_IOCSNAME_LEN ; -strncpy (user.codepage, server->nls_vol->charset, len); +strscpy (user.codepage, server->nls_vol->charset,NCP_IOCSNAME_LEN ); user.codepage[len] =0 ; }
@@ -243,7 +243,7 @@ ncp_get_charsets(struct ncp_server* serv len =strlen (server->nls_io->charset);if (len >NCP_IOCSNAME_LEN ) len =NCP_IOCSNAME_LEN ; -strncpy (user.iocharset, server->nls_io->charset, len); +strscpy (user.iocharset, server->nls_io->charset,NCP_IOCSNAME_LEN ); user.iocharset[len] =0 ; }mutex_unlock (&server->root_setup_lock);
Greg Kroah-Hartman
maintainerPATCH 61/230 isdn: isdn_tty: fix build warning of strncpy
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
Not upstream as isdn is long deleted.
Fix up a strncpy build warning for isdn_tty_suspend() using strscpy.
It's not like anyone uses this code anyway, and this gets rid of a build warnings so that we can see real warnings as they pop up over time.
--- drivers/isdn/i4l/isdn_tty.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/isdn/i4l/isdn_tty.c +1 -1
@@ -786,7 +786,7 @@ isdn_tty_suspend(char *id, modem_info *i cmd.parm.cmsg.para[3 ] =4 ;/* 16 bit 0x0004 Suspend */ cmd.parm.cmsg.para[4 ] =0 ; cmd.parm.cmsg.para[5 ] = l; -strncpy (&cmd.parm.cmsg.para[6 ], id, l); +strscpy (&cmd.parm.cmsg.para[6 ], id, l); cmd.command =CAPI_PUT_MESSAGE ; cmd.driver = info->isdn_driver; cmd.arg = info->isdn_channel;
Greg Kroah-Hartman
maintainerPATCH 62/230 staging: lustre: fix buffer overflow of string buffer
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Eremin <[email protected]>
commit 9563fe8a2de9db5eb087fe0e48ec335ee66f8f41 upstream.
Buffer overflow of string buffer due to non null terminated string. Use strlcpy() when it's justifiable.
Use sizeof(var) instead of constants.
Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-4629
Reviewed-on: http://review.whamcloud.com/9389
--- drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c | 9 +++++---- drivers/staging/lustre/lnet/lnet/config.c | 14 ++++++++------ drivers/staging/lustre/lnet/selftest/conrpc.c | 4 ++-- drivers/staging/lustre/lnet/selftest/console.c | 6 ++++-- drivers/staging/lustre/lustre/include/lustre_disk.h | 1 + drivers/staging/lustre/lustre/libcfs/debug.c | 6 +++--- drivers/staging/lustre/lustre/libcfs/hash.c | 3 +-- drivers/staging/lustre/lustre/libcfs/workitem.c | 4 ++-- drivers/staging/lustre/lustre/llite/dir.c | 2 +- drivers/staging/lustre/lustre/lov/lov_pool.c | 3 +-- drivers/staging/lustre/lustre/obdclass/obd_mount.c | 10 +++++++--- drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c | 1 + drivers/staging/lustre/lustre/ptlrpc/sec_config.c | 3 +-- 13 files changed, 37 insertions(+), 29 deletions(-)
drivers/staging/lustre/lnet/klnds/socklnd/socklnd.c +5 -4
@@ -2621,8 +2621,8 @@ ksocknal_enumerate_interfaces(ksock_net_ net->ksnn_interfaces[j].ksni_ipaddr = ip; net->ksnn_interfaces[j].ksni_netmask = mask; -strncpy (&net->ksnn_interfaces[j].ksni_name[0 ], - names[i],IFNAMSIZ ); +strlcpy (net->ksnn_interfaces[j].ksni_name, + names[i],sizeof (net->ksnn_interfaces[j].ksni_name)); j++; }
@@ -2805,8 +2805,9 @@ ksocknal_startup(lnet_ni_t *ni) goto fail_1; } -strncpy (&net->ksnn_interfaces[i].ksni_name[0 ], - ni->ni_interfaces[i],IFNAMSIZ ); +strlcpy (net->ksnn_interfaces[i].ksni_name, + ni->ni_interfaces[i], +sizeof (net->ksnn_interfaces[i].ksni_name)); } net->ksnn_ninterfaces = i; }
drivers/staging/lustre/lnet/lnet/config.c +8 -6
@@ -650,8 +650,8 @@ lnet_parse_route(char *str, int *im_a_roINIT_LIST_HEAD (&nets);/* save a copy of the string for error messages */ -strncpy (cmd, str,sizeof (cmd) -1 ); - cmd[sizeof (cmd) -1 ] =0 ; +strncpy (cmd, str,sizeof (cmd)); + cmd[sizeof (cmd) -1 ] ='\0' ; sep = str;for (;;) {
@@ -972,11 +972,13 @@ lnet_splitnets(char *source, struct listreturn 0 ; offset += (int )(sep - tb->ltb_text); - tb2 =lnet_new_text_buf (strlen (sep)); + len =strlen (sep); + tb2 =lnet_new_text_buf (len);if (tb2 ==NULL )return -ENOMEM ; -strcpy (tb2->ltb_text, sep); +strncpy (tb2->ltb_text, sep, len); + tb2->ltb_text[len] ='\0' ;list_add_tail (&tb2->ltb_list, nets); tb = tb2;
@@ -1021,8 +1023,8 @@ lnet_match_networks(char **networksp, ch tb = list_entry(raw_entries.next, struct lnet_text_buf_t, ltb_list); -strncpy (source, tb->ltb_text,sizeof (source)-1 ); - source[sizeof (source)-1 ] =0 ; +strncpy (source, tb->ltb_text,sizeof (source)); + source[sizeof (source)-1 ] ='\0' ;/* replace ltb_text with the network(s) add on match */ rc =lnet_match_network_tokens (tb->ltb_text, ipaddrs, nip);
drivers/staging/lustre/lnet/selftest/conrpc.c +2 -2
@@ -612,8 +612,8 @@ lstcon_sesrpc_prep(lstcon_node_t *nd, in msrq = &(*crpc)->crp_rpc->crpc_reqstmsg.msg_body.mksn_reqst; msrq->mksn_sid = console_session.ses_id; msrq->mksn_force = console_session.ses_force; -strncpy (msrq->mksn_name, console_session.ses_name, -strlen (console_session.ses_name)); +strlcpy (msrq->mksn_name, console_session.ses_name, +sizeof (msrq->mksn_name));break ;case LST_TRANS_SESEND :
drivers/staging/lustre/lnet/selftest/console.c +4 -2
@@ -1739,7 +1739,8 @@ lstcon_session_new(char *name, int key, console_session.ses_feats_updated =0 ; console_session.ses_timeout = (timeout <=0 ) ?LST_CONSOLE_TIMEOUT : timeout; -strcpy (console_session.ses_name, name); +strlcpy (console_session.ses_name, name, +sizeof (console_session.ses_name)); rc =lstcon_batch_add (LST_DEFAULT_BATCH );if (rc !=0 )
@@ -1959,7 +1960,8 @@ lstcon_acceptor_handle(srpc_server_rpc_tif (grp->grp_userland ==0 ) grp->grp_userland =1 ; -strcpy (jrep->join_session, console_session.ses_name); +strlcpy (jrep->join_session, console_session.ses_name, +sizeof (jrep->join_session)); jrep->join_timeout = console_session.ses_timeout; jrep->join_status =0 ;
drivers/staging/lustre/lustre/include/lustre_disk.h +1 -0
@@ -68,6 +68,7 @@everything as string options */ #define LMD_MAGIC 0xbdacbd03 +#define LMD_PARAMS_MAXLEN 4096/* gleaned from the mount command - no persistent info here */ struct lustre_mount_data {
drivers/staging/lustre/lustre/libcfs/debug.c +3 -3
@@ -512,9 +512,9 @@ int libcfs_debug_init(unsigned long bufs }if (libcfs_debug_file_path !=NULL ) { -strncpy (libcfs_debug_file_path_arr, - libcfs_debug_file_path,PATH_MAX -1 ); - libcfs_debug_file_path_arr[PATH_MAX -1 ] ='\0' ; +strlcpy (libcfs_debug_file_path_arr, + libcfs_debug_file_path, +sizeof (libcfs_debug_file_path_arr)); }/* If libcfs_debug_mb is set to an invalid value or uninitialized
drivers/staging/lustre/lustre/libcfs/hash.c +1 -2
@@ -1062,8 +1062,7 @@ cfs_hash_create(char *name, unsigned curif (hs ==NULL )return NULL ; -strncpy (hs->hs_name, name, len); - hs->hs_name[len -1 ] ='\0' ; +strlcpy (hs->hs_name, name, len); hs->hs_flags = flags;atomic_set (&hs->hs_refcount,1 );
drivers/staging/lustre/lustre/libcfs/workitem.c +2 -2
@@ -360,8 +360,8 @@ cfs_wi_sched_create(char *name, struct cif (sched ==NULL )return -ENOMEM ; -strncpy (sched->ws_name, name,CFS_WS_NAME_LEN ); - sched->ws_name[CFS_WS_NAME_LEN -1 ] ='\0' ; +strlcpy (sched->ws_name, name,CFS_WS_NAME_LEN ); + sched->ws_cptab = cptab; sched->ws_cpt = cpt;
drivers/staging/lustre/lustre/llite/dir.c +1 -1
@@ -641,7 +641,7 @@ static int ll_send_mgc_param(struct obd_if (!msp)return -ENOMEM ; -strncpy (msp->mgs_param, string,MGS_PARAM_MAXLEN ); +strlcpy (msp->mgs_param, string,sizeof (msp->mgs_param)); rc =obd_set_info_async (NULL , mgc,sizeof (KEY_SET_INFO ),KEY_SET_INFO ,sizeof (struct mgs_send_param ), msp,NULL );if (rc)
drivers/staging/lustre/lustre/lov/lov_pool.c +1 -2
@@ -412,8 +412,7 @@ int lov_pool_new(struct obd_device *obd,if (!new_pool)return -ENOMEM ; -strncpy (new_pool->pool_name, poolname,LOV_MAXPOOLNAME ); - new_pool->pool_name[LOV_MAXPOOLNAME ] ='\0' ; +strlcpy (new_pool->pool_name, poolname,sizeof (new_pool->pool_name)); new_pool->pool_lobd = obd;/* ref count init to 1 because when created a pool is always used * up to deletion
drivers/staging/lustre/lustre/obdclass/obd_mount.c +7 -3
@@ -892,7 +892,7 @@ static int lmd_parse(char *options, stru } lmd->lmd_magic =LMD_MAGIC ; - lmd->lmd_params =kzalloc (4096 ,GFP_NOFS ); + lmd->lmd_params =kzalloc (LMD_PARAMS_MAXLEN ,GFP_NOFS );if (!lmd->lmd_params)return -ENOMEM ; lmd->lmd_params[0 ] ='\0' ;
@@ -978,7 +978,7 @@ static int lmd_parse(char *options, stru goto invalid; clear++; }else if (strncmp (s1,"param=" ,6 ) ==0 ) { -int length; +size_t length, params_length;char *tail =strchr (s1 +6 ,',' );if (tail ==NULL )
@@ -986,8 +986,12 @@ static int lmd_parse(char *options, struelse length = tail - s1; length -=6 ; + params_length =strlen (lmd->lmd_params); +if (params_length + length +1 >=LMD_PARAMS_MAXLEN ) +return -E2BIG ;strncat (lmd->lmd_params, s1 +6 , length); -strcat (lmd->lmd_params," " ); + lmd->lmd_params[params_length + length] ='\0' ; +strlcat (lmd->lmd_params," " ,LMD_PARAMS_MAXLEN ); clear++; }else if (strncmp (s1,"osd=" ,4 ) ==0 ) { rc =lmd_parse_string (&lmd->lmd_osd_type, s1 +4 );
drivers/staging/lustre/lustre/ptlrpc/ptlrpcd.c +1 -0
@@ -422,6 +422,7 @@ static int ptlrpcd(void *arg)complete (&pc->pc_starting);/* +* This mainloop strongly resembles ptlrpc_set_wait() except that our * set never completes. ptlrpcd_check() calls ptlrpc_check_set() when * there are requests in the set. New requests come in on the set's
drivers/staging/lustre/lustre/ptlrpc/sec_config.c +1 -2
@@ -83,8 +83,7 @@ int sptlrpc_parse_flavor(const char *strreturn 0 ; } -strncpy (buf, str,sizeof (buf)); - buf[sizeof (buf) -1 ] ='\0' ; +strlcpy (buf, str,sizeof (buf)); bulk =strchr (buf,'-' );if (bulk)
Greg Kroah-Hartman
maintainerPATCH 63/230 net-sysfs: Fix mem leak in netdev_register_kobject
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 895a5e96dbd6386c8e78e5b78e067dcc67b7f0ab ]
syzkaller report this:
BUG: memory leak
unreferenced object 0xffff88837a71a500 (size 256):
comm "syz-executor.2", pid 9770, jiffies 4297825125 (age 17.843s)
hex dump (first 32 bytes):
00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........
ff ff ff ff ff ff ff ff 20 c0 ef 86 ff ff ff ff ........ .......
backtrace:
[<00000000db12624b>] netdev_register_kobject+0x124/0x2e0 net/core/net-sysfs.c:1751
[<00000000dc49a994>] register_netdevice+0xcc1/0x1270 net/core/dev.c:8516
[<00000000e5f3fea0>] tun_set_iff drivers/net/tun.c:2649 [inline]
[<00000000e5f3fea0>] __tun_chr_ioctl+0x2218/0x3d20 drivers/net/tun.c:2883
[<000000001b8ac127>] vfs_ioctl fs/ioctl.c:46 [inline]
[<000000001b8ac127>] do_vfs_ioctl+0x1a5/0x10e0 fs/ioctl.c:690
[<0000000079b269f8>] ksys_ioctl+0x89/0xa0 fs/ioctl.c:705
[<00000000de649beb>] __do_sys_ioctl fs/ioctl.c:712 [inline]
[<00000000de649beb>] __se_sys_ioctl fs/ioctl.c:710 [inline]
[<00000000de649beb>] __x64_sys_ioctl+0x74/0xb0 fs/ioctl.c:710
[<000000007ebded1e>] do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290
[<00000000db315d36>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000115be9bb>] 0xffffffffffffffffIt should call kset_unregister to free 'dev->queues_kset'
in error path of register_queue_kobjects, otherwise will cause a mem leak.
--- net/core/net-sysfs.c | 3 +++ 1 file changed, 3 insertions(+)
net/core/net-sysfs.c +3 -0
@@ -1361,6 +1361,9 @@ static int register_queue_kobjects(struc error:netdev_queue_update_kobjects (dev, txq,0 );net_rx_queue_update_kobjects (dev, rxq,0 ); +#ifdef CONFIG_SYSFS +kset_unregister (dev->queues_kset); +#endif return error; }
Greg Kroah-Hartman
maintainerPATCH 64/230 sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
[ Upstream commit b33b7cd6fd86478dd2890a9abeb6f036aa01fdf7 ]
Some sky2 chips fire IRQ after S3, before the driver is fully resumed:
[ 686.804877] do_IRQ: 1.37 No irq handler for vector
This is likely a platform bug that device isn't fully quiesced during S3. Use MSI-X, maskable MSI or INTx can prevent this issue from happening.
Since MSI-X and maskable MSI are not supported by this device, fallback to use INTx on affected platforms.
--- drivers/net/ethernet/marvell/sky2.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-)
drivers/net/ethernet/marvell/sky2.c +23 -1
@@ -46,6 +46,7 @@#include <linux/mii.h> #include <linux/of_device.h> #include <linux/of_net.h> +#include <linux/dmi.h> #include <asm/irq.h>
@@ -93,7 +94,7 @@ static int copybreak __read_mostly = 128module_param (copybreak, int,0 );MODULE_PARM_DESC (copybreak,"Receive copy threshold" ); -static int disable_msi =0 ; +static int disable_msi =-1 ;module_param (disable_msi, int,0 );MODULE_PARM_DESC (disable_msi,"Disable Message Signaled Interrupt (MSI)" );
@@ -4923,6 +4924,24 @@ static const char *sky2_name(u8 chipid,return buf; } +static const struct dmi_system_id msi_blacklist[] = { + { + .ident ="Dell Inspiron 1545" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ), +DMI_MATCH (DMI_PRODUCT_NAME ,"Inspiron 1545" ), + }, + }, + { + .ident ="Gateway P-79" , + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Gateway" ), +DMI_MATCH (DMI_PRODUCT_NAME ,"P-79" ), + }, + }, + {} +}; +static int sky2_probe (struct pci_dev *pdev,const struct pci_device_id *ent) {struct net_device *dev, *dev1;
@@ -5034,6 +5053,9 @@ static int sky2_probe(struct pci_dev *pd goto err_out_free_pci; } +if (disable_msi ==-1 ) + disable_msi = !!dmi_check_system (msi_blacklist); +if (!disable_msi &&pci_enable_msi (pdev) ==0 ) { err =sky2_test_msi (hw);if (err) {
Greg Kroah-Hartman
maintainerPATCH 65/230 team: Free BPF filter when unregistering netdev
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 692c31bd4054212312396b1d303bffab2c5b93a7 ]
When team is used in loadbalance mode a BPF filter can be used to provide a hash which will determine the Tx port.
When the netdev is later unregistered the filter is not freed which results in memory leaks [1].
Fix by freeing the program and the corresponding filter when unregistering the netdev.
[1]
unreferenced object 0xffff8881dbc47cc8 (size 16):
comm "teamd", pid 3068, jiffies 4294997779 (age 438.247s) hex dump (first 16 bytes):
a3 00 6b 6b 6b 6b 6b 6b 88 a5 82 e1 81 88 ff ff ..kkkkkk........
backtrace:
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff
unreferenced object 0xffff8881e182a588 (size 2048):
comm "teamd", pid 3068, jiffies 4294997780 (age 438.247s)
hex dump (first 32 bytes):
20 00 00 00 02 00 00 00 30 00 00 00 28 f0 ff ff .......0...(...
07 00 00 00 00 00 00 00 28 00 00 00 00 00 00 00 ........(.......
backtrace:
[<000000002daf01fb>] lb_bpf_func_set+0x45c/0x6d0
[<000000008a3b47e3>] team_nl_cmd_options_set+0x88f/0x11b0
[<00000000c4f4f27e>] genl_family_rcv_msg+0x78f/0x1080
[<00000000610ef838>] genl_rcv_msg+0xca/0x170
[<00000000a281df93>] netlink_rcv_skb+0x132/0x380
[<000000004d9448a2>] genl_rcv+0x29/0x40
[<000000000321b2f4>] netlink_unicast+0x4c0/0x690
[<000000008c25dffb>] netlink_sendmsg+0x929/0xe10
[<00000000068298c5>] sock_sendmsg+0xc8/0x110
[<0000000082a61ff0>] ___sys_sendmsg+0x77a/0x8f0
[<00000000663ae29d>] __sys_sendmsg+0xf7/0x250
[<0000000027c5f11a>] do_syscall_64+0x14d/0x610
[<000000006cfbc8d3>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e23197e2>] 0xffffffffffffffff--- drivers/net/team/team_mode_loadbalance.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
drivers/net/team/team_mode_loadbalance.c +15 -0
@@ -305,6 +305,20 @@ static int lb_bpf_func_set(struct team *return 0 ; } +static void lb_bpf_func_free (struct team *team) +{ +struct lb_priv *lb_priv =get_lb_priv (team); +struct bpf_prog *fp; + +if (!lb_priv->ex->orig_fprog) +return ; + +__fprog_destroy (lb_priv->ex->orig_fprog); + fp =rcu_dereference_protected (lb_priv->fp, +lockdep_is_held (&team->lock)); +bpf_prog_destroy (fp); +} +static int lb_tx_method_get (struct team *team,struct team_gsetter_ctx *ctx) {struct lb_priv *lb_priv =get_lb_priv (team);
@@ -619,6 +633,7 @@ static void lb_exit(struct team *team)team_options_unregister (team, lb_options,ARRAY_SIZE (lb_options)); +lb_bpf_func_free (team);cancel_delayed_work_sync (&lb_priv->ex->stats.refresh_dw);free_percpu (lb_priv->pcpu_stats);kfree (lb_priv->ex);
Greg Kroah-Hartman
maintainerPATCH 66/230 bnxt_en: Drop oversize TX packets to prevent errors.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Chan <[email protected]>
[ Upstream commit 2b3c6885386020b1b9d92d45e8349637e27d1f66 ]
There have been reports of oversize UDP packets being sent to the driver to be transmitted, causing error conditions. The issue is likely caused by the dst of the SKB switching between 'lo' with 64K MTU and the hardware device with a smaller MTU. Patches are being proposed by Mahesh Bandewar <[email protected]> to fix the issue.
In the meantime, add a quick length check in the driver to prevent the error. The driver uses the TX packet size as index to look up an array to setup the TX BD. The array is large enough to support all MTU sizes supported by the driver. The oversize TX packet causes the driver to index beyond the array and put garbage values into the TX BD. Add a simple check to prevent this.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -0
@@ -330,6 +330,12 @@ normal_tx: } length >>=9 ; +if (unlikely (length >=ARRAY_SIZE (bnxt_lhint_arr))) { +dev_warn_ratelimited (&pdev->dev,"Dropped oversize %d bytes TX packet.\n" , + skb->len); + i =0 ; + goto tx_dma_error; + } flags |= bnxt_lhint_arr[length]; txbd->tx_bd_len_flags_type =cpu_to_le32 (flags);
Greg Kroah-Hartman
maintainerPATCH 67/230 net: nfc: Fix NULL dereference on nfc_llcp_build_tlv fails
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 58bdd544e2933a21a51eecf17c3f5f94038261b5 ]
KASAN report this:
BUG: KASAN: null-ptr-deref in nfc_llcp_build_gb+0x37f/0x540 [nfc] Read of size 3 at addr 0000000000000000 by task syz-executor.0/5401 CPU: 0 PID: 5401 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xfa/0x1ce lib/dump_stack.c:113 kasan_report+0x171/0x18d mm/kasan/report.c:321 memcpy+0x1f/0x50 mm/kasan/common.c:130 nfc_llcp_build_gb+0x37f/0x540 [nfc] nfc_llcp_register_device+0x6eb/0xb50 [nfc] nfc_register_device+0x50/0x1d0 [nfc] nfcsim_device_new+0x394/0x67d [nfcsim] ? 0xffffffffc1080000 nfcsim_init+0x6b/0x1000 [nfcsim] do_one_initcall+0xfa/0x5ca init/main.c:887 do_init_module+0x204/0x5f6 kernel/module.c:3460 load_module+0x66b2/0x8570 kernel/module.c:3808 __do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902 do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x462e99 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9cb79dcc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9cb79dcc70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9cb79dd6bc R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
nfc_llcp_build_tlv will return NULL on fails, caller should check it, otherwise will trigger a NULL dereference.
--- net/nfc/llcp_commands.c | 20 ++++++++++++++++++++ net/nfc/llcp_core.c | 24 ++++++++++++++++++++---- 2 files changed, 40 insertions(+), 4 deletions(-)
net/nfc/llcp_commands.c +20 -0
@@ -419,6 +419,10 @@ int nfc_llcp_send_connect(struct nfc_llc sock->service_name, sock->service_name_len, &service_name_tlv_length); +if (!service_name_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += service_name_tlv_length; }
@@ -429,9 +433,17 @@ int nfc_llcp_send_connect(struct nfc_llc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length;pr_debug ("SKB size %d SN length %zu\n" , size, sock->service_name_len);
@@ -486,9 +498,17 @@ int nfc_llcp_send_cc(struct nfc_llcp_soc miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&miux,0 , &miux_tlv_length); +if (!miux_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += miux_tlv_length; rw_tlv =nfc_llcp_build_tlv (LLCP_TLV_RW , &rw,0 , &rw_tlv_length); +if (!rw_tlv) { + err = -ENOMEM ; + goto error_tlv; + } size += rw_tlv_length; skb =llcp_allocate_pdu (sock,LLCP_PDU_CC , size);
net/nfc/llcp_core.c +20 -4
@@ -532,10 +532,10 @@ static u8 nfc_llcp_reserve_sdp_ssap(strustatic int nfc_llcp_build_gb (struct nfc_llcp_local *local) { -u8 *gb_cur, *version_tlv, version, version_length; -u8 *lto_tlv, lto_length; -u8 *wks_tlv, wks_length; -u8 *miux_tlv, miux_length; +u8 *gb_cur, version, version_length; +u8 lto_length, wks_length, miux_length; +u8 *version_tlv =NULL , *lto_tlv =NULL , + *wks_tlv =NULL , *miux_tlv =NULL ;__be16 wks =cpu_to_be16 (local->local_wks);u8 gb_len =0 ;int ret =0 ;
@@ -543,17 +543,33 @@ static int nfc_llcp_build_gb(struct nfc_ version =LLCP_VERSION_11 ; version_tlv =nfc_llcp_build_tlv (LLCP_TLV_VERSION , &version,1 , &version_length); +if (!version_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += version_length; lto_tlv =nfc_llcp_build_tlv (LLCP_TLV_LTO , &local->lto,1 , <o_length); +if (!lto_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += lto_length;pr_debug ("Local wks 0x%lx\n" , local->local_wks); wks_tlv =nfc_llcp_build_tlv (LLCP_TLV_WKS , (u8 *)&wks,2 , &wks_length); +if (!wks_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += wks_length; miux_tlv =nfc_llcp_build_tlv (LLCP_TLV_MIUX , (u8 *)&local->miux,0 , &miux_length); +if (!miux_tlv) { + ret = -ENOMEM ; + goto out; + } gb_len += miux_length; gb_len +=ARRAY_SIZE (llcp_magic);
Greg Kroah-Hartman
maintainerPATCH 68/230 xen-netback: fix occasional leak of grant ref mappings under memory pressure
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Druzhinin <[email protected]>
[ Upstream commit 99e87f56b48f490fb16b6e0f74691c1e664dea95 ]
Zero-copy callback flag is not yet set on frag list skb at the moment xenvif_handle_frag_list() returns -ENOMEM. This eventually results in leaking grant ref mappings since xenvif_zerocopy_callback() is never called for these fragments. Those eventually build up and cause Xen to kill Dom0 as the slots get reused for new mappings:
"d0v0 Attempt to implicitly unmap a granted PTE c010000329fce005"
That behavior is observed under certain workloads where sudden spikes of page cache writes coexist with active atomic skb allocations from network traffic. Additionally, rework the logic to deal with frag_list deallocation in a single place.
--- drivers/net/xen-netback/netback.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/net/xen-netback/netback.c +5 -5
@@ -1538,11 +1538,6 @@ static int xenvif_handle_frag_list(strucskb_frag_size_set (&frags[i], len); } -/* Copied all the bits from the frag list -- free it. */ -skb_frag_list_init (skb); -xenvif_skb_zerocopy_prepare (queue, nskb); -kfree_skb (nskb); -/* Release all the original (foreign) frags. */ for (f =0 ; f <skb_shinfo (skb)->nr_frags; f++)skb_frag_unref (skb, f);
@@ -1611,6 +1606,8 @@ static int xenvif_tx_submit(struct xenvixenvif_fill_frags (queue, skb);if (unlikely (skb_has_frag_list (skb))) { +struct sk_buff *nskb =skb_shinfo (skb)->frag_list; +xenvif_skb_zerocopy_prepare (queue, nskb);if (xenvif_handle_frag_list (queue, skb)) {if (net_ratelimit ()) netdev_err(queue->vif->dev,
@@ -1619,6 +1616,9 @@ static int xenvif_tx_submit(struct xenvikfree_skb (skb);continue ; } +/* Copied all the bits from the frag list -- free it. */ +skb_frag_list_init (skb); +kfree_skb (nskb); } skb->dev = queue->vif->dev;
Greg Kroah-Hartman
maintainerPATCH 69/230 net: Add __icmp_send helper.
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 9ef6b42ad6fd7929dd1b6092cb02014e382c6a91 ]
Add __icmp_send function having ip_options struct parameter
--- include/net/icmp.h | 9 ++++++++- net/ipv4/icmp.c | 7 ++++--- 2 files changed, 12 insertions(+), 4 deletions(-)
include/net/icmp.h +8 -1
@@ -22,6 +22,7 @@#include <net/inet_sock.h> #include <net/snmp.h> +#include <net/ip.h> struct icmp_err {int errno;
@@ -39,7 +40,13 @@ struct net_proto_family;struct sk_buff ;struct net ; -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info); +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt); +static inline void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +{ +__icmp_send (skb_in, type, code, info, &IPCB (skb_in)->opt); +} +int icmp_rcv (struct sk_buff *skb);void icmp_err (struct sk_buff *skb,u32 info);int icmp_init (void );
net/ipv4/icmp.c +4 -3
@@ -565,7 +565,8 @@ relookup_failed:* MUST reply to only the first fragment. */ -void icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info) +void __icmp_send (struct sk_buff *skb_in,int type,int code,__be32 info, +const struct ip_options *opt) {struct iphdr *iph;int room;
@@ -679,7 +680,7 @@ void icmp_send(struct sk_buff *skb_in, i iph->tos; mark =IP4_REPLY_MARK (net, skb_in->mark); -if (ip_options_echo (&icmp_param->replyopts.opt.opt, skb_in)) +if (__ip_options_echo (&icmp_param->replyopts.opt.opt, skb_in, opt)) goto out_unlock;
@@ -731,7 +732,7 @@ out_free:kfree (icmp_param); out:; } -EXPORT_SYMBOL (icmp_send); +EXPORT_SYMBOL (__icmp_send);static void icmp_socket_deliver (struct sk_buff *skb,u32 info)
Greg Kroah-Hartman
maintainerPATCH 70/230 net: avoid use IPCB in cipso_v4_error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nazarov Sergey <[email protected]>
[ Upstream commit 3da1ed7ac398f34fff1694017a07054d69c5f5c5 ]
Extract IP options in cipso_v4_error and use __icmp_send.
--- include/net/ip.h | 2 ++ net/ipv4/cipso_ipv4.c | 17 +++++++++++++++-- net/ipv4/ip_options.c | 22 +++++++++++++++++----- 3 files changed, 34 insertions(+), 7 deletions(-)
include/net/ip.h +2 -0
@@ -546,6 +546,8 @@ static inline int ip_options_echo(struct }void ip_options_fragment (struct sk_buff *skb); +int __ip_options_compile (struct net *net,struct ip_options *opt, +struct sk_buff *skb,__be32 *info);int ip_options_compile (struct net *net,struct ip_options *opt,struct sk_buff *skb); int ip_options_get(struct net *net, struct ip_options_rcu **optp,
net/ipv4/cipso_ipv4.c +15 -2
@@ -1805,13 +1805,26 @@ validate_return:*/ void cipso_v4_error (struct sk_buff *skb,int error,u32 gateway) { +unsigned char optbuf[sizeof (struct ip_options ) +40 ]; +struct ip_options *opt = (struct ip_options *)optbuf; +if (ip_hdr (skb)->protocol ==IPPROTO_ICMP || error != -EACCES )return ; +/* +* We might be called above the IP layer, +* so we can not use icmp_send and IPCB here. +*/ + +memset (opt,0 ,sizeof (struct ip_options )); + opt->optlen =ip_hdr (skb)->ihl*4 -sizeof (struct iphdr ); +if (__ip_options_compile (dev_net (skb->dev), opt, skb,NULL )) +return ; +if (gateway) -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_NET_ANO ,0 , opt);else -icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 ); +__icmp_send (skb,ICMP_DEST_UNREACH ,ICMP_HOST_ANO ,0 , opt); }/**
net/ipv4/ip_options.c +17 -5
@@ -254,8 +254,9 @@ static void spec_dst_fill(__be32 *spec_d* If opt == NULL, then skb->data should point to IP header. */ -int ip_options_compile (struct net *net, -struct ip_options *opt,struct sk_buff *skb) +int __ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb, +__be32 *info) {__be32 spec_dst =htonl (INADDR_ANY );unsigned char *pp_ptr =NULL ;
@@ -472,11 +473,22 @@ eol:return 0 ; error: -if (skb) { -icmp_send (skb,ICMP_PARAMETERPROB ,0 ,htonl ((pp_ptr-iph)<<24 )); - } +if (info) + *info =htonl ((pp_ptr-iph)<<24 );return -EINVAL ; } + +int ip_options_compile (struct net *net, +struct ip_options *opt,struct sk_buff *skb) +{ +int ret; +__be32 info; + + ret =__ip_options_compile (net, opt, skb, &info); +if (ret !=0 && skb) +icmp_send (skb,ICMP_PARAMETERPROB ,0 , info); +return ret; +}EXPORT_SYMBOL (ip_options_compile);/*
Greg Kroah-Hartman
maintainerPATCH 71/230 net: phy: Micrel KSZ8061: link failure after cable connect
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajasingh Thavamani <[email protected]>
[ Upstream commit 232ba3a51cc224b339c7114888ed7f0d4d95695e ]
With Micrel KSZ8061 PHY, the link may occasionally not come up after Ethernet cable connect. The vendor's (Microchip, former Micrel) errata sheet 80000688A.pdf descripes the problem and possible workarounds in detail, see below.
The batch implements workaround 1, which permanently fixes the issue.
DESCRIPTION
Link-up may not occur properly when the Ethernet cable is initially connected. This issue occurs more commonly when the cable is connected slowly, but it may occur any time a cable is connected. This issue occurs in the auto-negotiation circuit, and will not occur if auto-negotiation is disabled (which requires that the two link partners be set to the same speed and duplex).
END USER IMPLICATIONS
When this issue occurs, link is not established. Subsequent cable plug/unplaug cycle will not correct the issue.
WORk AROUND
There are four approaches to work around this issue:
1. This issue can be prevented by setting bit 15 in MMD device address 1, register 2, prior to connecting the cable or prior to setting the Restart Auto-negotiation bit in register 0h. The MMD registers are accessed via the indirect access registers Dh and Eh, or via the Micrel EthUtil utility as shown here:
. if using the EthUtil utility (usually with a Micrel KSZ8061
Evaluation Board), type the following commands:
> address 1
> mmd 1
> iw 2 b61a
. Alternatively, write the following registers to write to the
indirect MMD register:
Write register Dh, data 0001h
Write register Eh, data 0002h
Write register Dh, data 4001h
Write register Eh, data B61Ah
2. The issue can be avoided by disabling auto-negotiation in the KSZ8061, either by the strapping option, or by clearing bit 12 in register 0h. Care must be taken to ensure that the KSZ8061 and the link partner will link with the same speed and duplex. Note that the KSZ8061 defaults to full-duplex when auto-negotiation is off, but other devices may default to half-duplex in the event of failed auto-negotiation.
3. The issue can be avoided by connecting the cable prior to powering-up or resetting the KSZ8061, and leaving it plugged in thereafter.
4. If the above measures are not taken and the problem occurs, link can be recovered by setting the Restart Auto-Negotiation bit in register 0h, or by resetting or power cycling the device. Reset may be either hardware reset or software reset (register 0h, bit 15).
PLAN
This errata will not be corrected in the future revision.
--- drivers/net/phy/micrel.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/net/phy/micrel.c +13 -1
@@ -28,6 +28,7 @@#include <linux/micrel_phy.h> #include <linux/of.h> #include <linux/clk.h> +#include <uapi/linux/mdio.h> /* Operation Mode Strap Override */ #define MII_KSZPHY_OMSO 0x16
@@ -287,6 +288,17 @@ static int kszphy_config_init(struct phyreturn 0 ; } +static int ksz8061_config_init (struct phy_device *phydev) +{ +int ret; + + ret =phy_write_mmd (phydev,MDIO_MMD_PMAPMD ,MDIO_DEVID1 ,0xB61A ); +if (ret) +return ret; + +return kszphy_config_init (phydev); +} + static int ksz9021_load_values_from_of(struct phy_device *phydev, const struct device_node *of_node, u16 reg,
@@ -771,7 +783,7 @@ static struct phy_driver ksphy_driver[] .phy_id_mask = 0x00fffff0, .features = (PHY_BASIC_FEATURES | SUPPORTED_Pause), .flags = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT, - .config_init = kszphy_config_init, + .config_init = ksz8061_config_init, .config_aneg = genphy_config_aneg, .read_status = genphy_read_status, .ack_interrupt = kszphy_ack_interrupt,
Greg Kroah-Hartman
maintainerPATCH 72/230 x86/CPU/AMD: Set the CPB bit unconditionally on F17h
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
commit 0237199186e7a4aa5310741f0a6498a20c820fd7 upstream.
Some F17h models do not have CPB set in CPUID even though the CPU supports it. Set the feature bit unconditionally on all F17h.
[ bp: Rewrite commit message and patch. ]
--- arch/x86/kernel/cpu/amd.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-)
arch/x86/kernel/cpu/amd.c +3 -5
@@ -716,11 +716,9 @@ static void init_amd_bd(struct cpuinfo_xstatic void init_amd_zn (struct cpuinfo_x86 *c) {set_cpu_cap (c,X86_FEATURE_ZEN ); -/* -* Fix erratum 1076: CPB feature bit not being set in CPUID. It affects -* all up to and including B1. -*/ -if (c->x86_model <=1 && c->x86_mask <=1 ) + +/* Fix erratum 1076: CPB feature bit not being set in CPUID. */ +if (!cpu_has (c,X86_FEATURE_CPB ))set_cpu_cap (c,X86_FEATURE_CPB ); }
Greg Kroah-Hartman
maintainerPATCH 73/230 applicom: Fix potential Spectre v1 vulnerabilities
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit d7ac3c6ef5d8ce14b6381d52eb7adafdd6c8bb3c upstream.
IndexCard is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/char/applicom.c:418 ac_write() warn: potential spectre issue 'apbs' [r] drivers/char/applicom.c:728 ac_ioctl() warn: potential spectre issue 'apbs' [r] (local cap)
Fix this by sanitizing IndexCard before using it to index apbs.
Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].
[1] https://lore.kernel.org/lkml/[email protected]/
--- drivers/char/applicom.c | 35 ++++++++++++++++++++++++----------- 1 file changed, 24 insertions(+), 11 deletions(-)
drivers/char/applicom.c +24 -11
@@ -32,6 +32,7 @@#include <linux/wait.h> #include <linux/init.h> #include <linux/fs.h> +#include <linux/nospec.h> #include <asm/io.h> #include <asm/uaccess.h>
@@ -386,7 +387,11 @@ static ssize_t ac_write(struct file *fil TicCard = st_loc.tic_des_from_pc;/* tic number to send */ IndexCard = NumCard -1 ; -if ((NumCard <1 ) || (NumCard >MAX_BOARD ) || !apbs[IndexCard].RamIO) +if (IndexCard >=MAX_BOARD ) +return -EINVAL ; + IndexCard =array_index_nospec (IndexCard,MAX_BOARD ); + +if (!apbs[IndexCard].RamIO)return -EINVAL ;#ifdef DEBUG
@@ -697,6 +702,7 @@ static long ac_ioctl(struct file *file,unsigned char IndexCard;void __iomem *pmem;int ret =0 ; +static int warncount =10 ;volatile unsigned char byte_reset_it;struct st_ram_io *adgl;void __user *argp = (void __user *)arg;
@@ -711,16 +717,12 @@ static long ac_ioctl(struct file *file,mutex_lock (&ac_mutex); IndexCard = adgl->num_card-1 ; -if (cmd !=6 && ((IndexCard >=MAX_BOARD ) || !apbs[IndexCard].RamIO)) { -static int warncount =10 ; -if (warncount) { -printk (KERN_WARNING "APPLICOM driver IOCTL, bad board number %d\n" ,(int )IndexCard+1 ); - warncount--; - } -kfree (adgl); -mutex_unlock (&ac_mutex); -return -EINVAL ; - } +if (cmd !=6 && IndexCard >=MAX_BOARD ) + goto err; + IndexCard =array_index_nospec (IndexCard,MAX_BOARD ); + +if (cmd !=6 && !apbs[IndexCard].RamIO) + goto err;switch (cmd) {
@@ -838,5 +840,16 @@ static long ac_ioctl(struct file *file,kfree (adgl);mutex_unlock (&ac_mutex);return 0 ; + +err: +if (warncount) { +pr_warn ("APPLICOM driver IOCTL, bad board number %d\n" , + (int )IndexCard +1 ); + warncount--; + } +kfree (adgl); +mutex_unlock (&ac_mutex); +return -EINVAL ; + }
Greg Kroah-Hartman
maintainerPATCH 74/230 MIPS: irq: Allocate accurate order pages for irq stack
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Xiang <[email protected]>
commit 72faa7a773ca59336f3c889e878de81445c5a85c upstream.
The irq_pages is the number of pages for irq stack, but not the order which is needed by __get_free_pages().
We can use get_order() to calculate the accurate order.
--- arch/mips/kernel/irq.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/kernel/irq.c +2 -2
@@ -52,6 +52,7 @@ asmlinkage void spurious_interrupt(void)void __init init_IRQ (void ) {int i; +unsigned int order =get_order (IRQ_STACK_SIZE );for (i =0 ; i <NR_IRQS ; i++)irq_set_noprobe (i);
@@ -59,8 +60,7 @@ void __init init_IRQ(void)arch_init_irq ();for_each_possible_cpu (i) { -int irq_pages =IRQ_STACK_SIZE /PAGE_SIZE ; -void *s = (void *)__get_free_pages (GFP_KERNEL , irq_pages); +void *s = (void *)__get_free_pages (GFP_KERNEL , order); irq_stack[i] = s; pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i,
Greg Kroah-Hartman
maintainerPATCH 75/230 hugetlbfs: fix races and page leaks during migration
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Kravetz <[email protected]>
commit cb6acd01e2e43fd8bad11155752b7699c3d0fb76 upstream.
hugetlb pages should only be migrated if they are 'active'. The routines set/clear_page_huge_active() modify the active state of hugetlb pages.
When a new hugetlb page is allocated at fault time, set_page_huge_active is called before the page is locked. Therefore, another thread could race and migrate the page while it is being added to page table by the fault code. This race is somewhat hard to trigger, but can be seen by strategically adding udelay to simulate worst case scheduling behavior. Depending on 'how' the code races, various BUG()s could be triggered.
To address this issue, simply delay the set_page_huge_active call until after the page is successfully added to the page table.
Hugetlb pages can also be leaked at migration time if the pages are associated with a file in an explicitly mounted hugetlbfs filesystem. For example, consider a two node system with 4GB worth of huge pages available. A program mmaps a 2G file in a hugetlbfs filesystem. It then migrates the pages associated with the file from one node to another. When the program exits, huge page counts are as follows:
node0
1024 free_hugepages
1024 nr_hugepages
node1
0 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
That is as expected. 2G of huge pages are taken from the free_hugepages counts, and 2G is the size of the file in the explicitly mounted filesystem. If the file is then removed, the counts become:
node0
1024 free_hugepages
1024 nr_hugepages
node1
1024 free_hugepages
1024 nr_hugepages
Filesystem Size Used Avail Use% Mounted on nodev 4.0G 2.0G 2.0G 50% /var/opt/hugepool
Note that the filesystem still shows 2G of pages used, while there actually are no huge pages in use. The only way to 'fix' the filesystem accounting is to unmount the filesystem
If a hugetlb page is associated with an explicitly mounted filesystem, this information in contained in the page_private field. At migration time, this information is not preserved. To fix, simply transfer page_private from old to new page at migration time if necessary.
There is a related race with removing a huge page from a file and migration. When a huge page is removed from the pagecache, the page_mapping() field is cleared, yet page_private remains set until the page is actually freed by free_huge_page(). A page could be migrated while in this state. However, since page_mapping() is not set the hugetlbfs specific routine to transfer page_private is not called and we leak the page count in the filesystem.
To fix that, check for this condition before migrating a huge page. If the condition is detected, return EBUSY for the page.
--- fs/hugetlbfs/inode.c | 12 ++++++++++++ mm/hugetlb.c | 14 ++++++++++++-- mm/migrate.c | 11 +++++++++++ 3 files changed, 35 insertions(+), 2 deletions(-)
fs/hugetlbfs/inode.c +12 -0
@@ -869,6 +869,18 @@ static int hugetlbfs_migrate_page(struct rc =migrate_huge_page_move_mapping (mapping, newpage, page);if (rc !=MIGRATEPAGE_SUCCESS )return rc; + +/* +* page_private is subpool pointer in hugetlb pages. Transfer to +* new page. PagePrivate is not associated with page_private for +* hugetlb pages and can not be set here as only page_huge_active +* pages can be migrated. +*/ +if (page_private (page)) { +set_page_private (newpage,page_private (page)); +set_page_private (page,0 ); + } +migrate_page_copy (newpage, page);return MIGRATEPAGE_SUCCESS ;
mm/hugetlb.c +12 -2
@@ -3472,7 +3472,6 @@ retry_avoidcopy:copy_user_huge_page (new_page, old_page, address, vma,pages_per_huge_page (h));__SetPageUptodate (new_page); -set_page_huge_active (new_page); mmun_start = address &huge_page_mask (h); mmun_end = mmun_start +huge_page_size (h);
@@ -3494,6 +3493,7 @@ retry_avoidcopy: make_huge_pte(vma, new_page, 1));page_remove_rmap (old_page);hugepage_add_new_anon_rmap (new_page, vma, address); +set_page_huge_active (new_page);/* Make the old page be freed below */ new_page = old_page; }
@@ -3575,6 +3575,7 @@ static int hugetlb_no_page(struct mm_strstruct page *page;pte_t new_pte;spinlock_t *ptl; +bool new_page = false;/* * Currently, we are forced to kill the process in the event the
@@ -3608,7 +3609,7 @@ retry: }clear_huge_page (page, address,pages_per_huge_page (h));__SetPageUptodate (page); -set_page_huge_active (page); + new_page = true;if (vma->vm_flags &VM_MAYSHARE ) {int err =huge_add_to_page_cache (page, mapping, idx);
@@ -3680,6 +3681,15 @@ retry: }spin_unlock (ptl); + +/* +* Only make newly allocated pages active. Existing pages found +* in the pagecache could be !page_huge_active() if they have been +* isolated for migration. +*/ +if (new_page) +set_page_huge_active (page); +unlock_page (page); out:return ret;
mm/migrate.c +11 -0
@@ -1056,6 +1056,16 @@ static int unmap_and_move_huge_page(new_lock_page (hpage); } +/* +* Check for pages which are in the process of being freed. Without +* page_mapping() set, hugetlbfs specific move page routine will not +* be called and we could leak usage counts for subpools. +*/ +if (page_private (hpage) && !page_mapping (hpage)) { + rc = -EBUSY ; + goto out_unlock; + } +if (PageAnon (hpage)) anon_vma =page_get_anon_vma (hpage);
@@ -1086,6 +1096,7 @@ put_anon: put_new_page =NULL ; } +out_unlock:unlock_page (hpage); out:if (rc != -EAGAIN )
Greg Kroah-Hartman
maintainerPATCH 76/230 netlabel: fix out-of-bounds memory accesses
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <[email protected]>
[ Upstream commit 5578de4834fe0f2a34fedc7374be691443396d1f ]
There are two array out-of-bounds memory accesses, one in cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both errors are embarassingly simple, and the fixes are straightforward.
As a FYI for anyone backporting this patch to kernels prior to v4.8, you'll want to apply the netlbl_bitmap_walk() patch to cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before Linux v4.8.
--- net/ipv4/cipso_ipv4.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/cipso_ipv4.c +4 -2
@@ -167,7 +167,8 @@ static int cipso_v4_bitmap_walk(const un (state == 0 && (byte & bitmask) == 0))return bit_spot; - bit_spot++; +if (++bit_spot >= bitmap_len) +return -1 ; bitmask >>=1 ;if (bitmask ==0 ) { byte = bitmap[++byte_offset];
@@ -737,7 +738,8 @@ static int cipso_v4_map_lvl_valid(constcase CIPSO_V4_MAP_PASS :return 0 ;case CIPSO_V4_MAP_TRANS : -if (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ) +if ((level < doi_def->map.std->lvl.cipso_size) && + (doi_def->map.std->lvl.cipso[level] <CIPSO_V4_INV_LVL ))return 0 ;break ; }
Greg Kroah-Hartman
maintainerPATCH 77/230 net: dsa: mv88e6xxx: Fix u64 statistics
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Lunn <[email protected]>
[ Upstream commit 6e46e2d821bb22b285ae8187959096b65d063b0d ]
The switch maintains u64 counters for the number of octets sent and received. These are kept as two u32's which need to be combined. Fix the combing, which wrongly worked on u16's.
--- drivers/net/dsa/mv88e6xxx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx.c +1 -1
@@ -712,7 +712,7 @@ static uint64_t _mv88e6xxx_get_ethtool_sif (s->sizeof_stat ==8 )_mv88e6xxx_stats_read (ds, s->reg +1 , &high); } - value = (((u64 )high) <<16 ) | low; + value = (((u64 )high) <<32 ) | low;return value; }
Greg Kroah-Hartman
maintainerPATCH 78/230 ip6mr: Do not call __IP6_INC_STATS() from preemptible context
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 87c11f1ddbbad38ad8bad47af133a8208985fbdf ]
Similar to commit 44f49dd8b5a6 ("ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context."), we cannot assume preemption is disabled when incrementing the counter and accessing a per-CPU variable.
Preemption can be enabled when we add a route in process context that corresponds to packets stored in the unresolved queue, which are then forwarded using this route [1].
Fix this by using IP6_INC_STATS() which takes care of disabling preemption on architectures where it is needed.
[1]
[ 157.451447] BUG: using __this_cpu_add() in preemptible [00000000] code: smcrouted/2314 [ 157.460409] caller is ip6mr_forward2+0x73e/0x10e0 [ 157.460434] CPU: 3 PID: 2314 Comm: smcrouted Not tainted 5.0.0-rc7-custom-03635-g22f2712113f1 #1336 [ 157.460449] Hardware name: Mellanox Technologies Ltd. MSN2100-CB2FO/SA001017, BIOS 5.6.5 06/07/2016 [ 157.460461] Call Trace: [ 157.460486] dump_stack+0xf9/0x1be [ 157.460553] check_preemption_disabled+0x1d6/0x200 [ 157.460576] ip6mr_forward2+0x73e/0x10e0 [ 157.460705] ip6_mr_forward+0x9a0/0x1510 [ 157.460771] ip6mr_mfc_add+0x16b3/0x1e00 [ 157.461155] ip6_mroute_setsockopt+0x3cb/0x13c0 [ 157.461384] do_ipv6_setsockopt.isra.8+0x348/0x4060 [ 157.462013] ipv6_setsockopt+0x90/0x110 [ 157.462036] rawv6_setsockopt+0x4a/0x120 [ 157.462058] __sys_setsockopt+0x16b/0x340 [ 157.462198] __x64_sys_setsockopt+0xbf/0x160 [ 157.462220] do_syscall_64+0x14d/0x610 [ 157.462349] entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/ipv6/ip6mr.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/ipv6/ip6mr.c +4 -4
@@ -1990,10 +1990,10 @@ int ip6mr_compat_ioctl(struct sock *sk,static inline int ip6mr_forward2_finish (struct net *net,struct sock *sk,struct sk_buff *skb) { -IP6_INC_STATS_BH (net,ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTFORWDATAGRAMS ); -IP6_ADD_STATS_BH (net,ip6_dst_idev (skb_dst (skb)), -IPSTATS_MIB_OUTOCTETS , skb->len); +IP6_INC_STATS (net,ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTFORWDATAGRAMS ); +IP6_ADD_STATS (net,ip6_dst_idev (skb_dst (skb)), +IPSTATS_MIB_OUTOCTETS , skb->len);return dst_output (net, sk, skb); }
Greg Kroah-Hartman
maintainerPATCH 79/230 media: uvcvideo: Fix type check leading to overflow
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alistair Strachan <[email protected]>
commit 47bb117911b051bbc90764a8bff96543cbd2005f upstream.
When initially testing the Camera Terminal Descriptor wTerminalType field (buffer[4]), no mask is used. Later in the function, the MSB is overloaded to store the descriptor subtype, and so a mask of 0x7fff is used to check the type.
If a descriptor is specially crafted to set this overloaded bit in the original wTerminalType field, the initial type check will fail (falling through, without adjusting the buffer size), but the later type checks will pass, assuming the buffer has been made suitably large, causing an overflow.
Avoid this problem by checking for the MSB in the wTerminalType field. If the bit is set, assume the descriptor is bad, and abort parsing it.
Originally reported here:
https://groups.google.com/forum/#!topic/syzkaller/Ot1fOE6v1d8
A similar (non-compiling) patch was provided at that time.
--- drivers/media/usb/uvc/uvc_driver.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/media/usb/uvc/uvc_driver.c +11 -3
@@ -1019,11 +1019,19 @@ static int uvc_parse_standard_control(streturn -EINVAL ; } -/* Make sure the terminal type MSB is not null, otherwise it -* could be confused with a unit. +/* +* Reject invalid terminal types that would cause issues: +* +* - The high byte must be non-zero, otherwise it would be +* confused with a unit. +* +* - Bit 15 must be 0, as we use it internally as a terminal +* direction flag. +* +* Other unknown types are accepted. */ type =get_unaligned_le16 (&buffer[4 ]); -if ((type &0xff00 ) ==0 ) { +if ((type &0x7f00 ) ==0 || (type &0x8000 ) !=0 ) { uvc_trace(UVC_TRACE_DESCR, "device %d videocontrol " "interface %d INPUT_TERMINAL %d has invalid " "type 0x%04x, skipping\n", udev->devnum,
Greg Kroah-Hartman
maintainerPATCH 80/230 vti4: Fix a ipip packet processing bug in IPCOMP virtual tunnel
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dd9ee3444014e8f28c0eefc9fffc9ac9c5248c12 ]
Recently we run a network test over ipcomp virtual tunnel.We find that if a ipv4 packet needs fragment, then the peer can't receive it.
We deep into the code and find that when packet need fragment the smaller fragment will be encapsulated by ipip not ipcomp. So when the ipip packet goes into xfrm, it's skb->dev is not properly set. The ipv4 reassembly code always set skb'dev to the last fragment's dev. After ipv4 defrag processing, when the kernel rp_filter parameter is set, the skb will be drop by -EXDEV error.
This patch adds compatible support for the ipip process in ipcomp virtual tunnel.
--- net/ipv4/ip_vti.c | 50 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 50 insertions(+)
net/ipv4/ip_vti.c +50 -0
@@ -75,6 +75,33 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,return 0 ; } +static int vti_input_ipip (struct sk_buff *skb,int nexthdr,__be32 spi, +int encap_type) +{ +struct ip_tunnel *tunnel; +const struct iphdr *iph =ip_hdr (skb); +struct net *net =dev_net (skb->dev); +struct ip_tunnel_net *itn =net_generic (net, vti_net_id); + + tunnel =ip_tunnel_lookup (itn, skb->dev->ifindex,TUNNEL_NO_KEY , + iph->saddr, iph->daddr,0 ); +if (tunnel) { +if (!xfrm4_policy_check (NULL ,XFRM_POLICY_IN , skb)) + goto drop; + +XFRM_TUNNEL_SKB_CB (skb)->tunnel.ip4 = tunnel; + + skb->dev = tunnel->dev; + +return xfrm_input (skb, nexthdr, spi, encap_type); + } + +return -EINVAL ; +drop: +kfree_skb (skb); +return 0 ; +} +static int vti_rcv (struct sk_buff *skb) {XFRM_SPI_SKB_CB (skb)->family =AF_INET ;
@@ -83,6 +110,14 @@ static int vti_rcv(struct sk_buff *skb)return vti_input (skb,ip_hdr (skb)->protocol,0 ,0 ); } +static int vti_rcv_ipip (struct sk_buff *skb) +{ +XFRM_SPI_SKB_CB (skb)->family =AF_INET ; +XFRM_SPI_SKB_CB (skb)->daddroff = offsetof(struct iphdr , daddr); + +return vti_input_ipip (skb,ip_hdr (skb)->protocol,ip_hdr (skb)->saddr,0 ); +} +static int vti_rcv_cb (struct sk_buff *skb,int err) {unsigned short family;
@@ -409,6 +444,12 @@ static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = { .priority = 100, }; +static struct xfrm_tunnel ipip_handler__read_mostly = { + .handler = vti_rcv_ipip, + .err_handler = vti4_err, + .priority =0 , +}; +static int __net_init vti_init_net (struct net *net) {int err;
@@ -592,6 +633,13 @@ static int __init vti_init(void)if (err <0 ) goto xfrm_proto_comp_failed; + msg ="ipip tunnel" ; + err =xfrm4_tunnel_register (&ipip_handler,AF_INET ); +if (err <0 ) { +pr_info ("%s: cant't register tunnel\n" ,__func__); + goto xfrm_tunnel_failed; + } + msg ="netlink interface" ; err =rtnl_link_register (&vti_link_ops);if (err <0 )
@@ -601,6 +649,8 @@ static int __init vti_init(void) rtnl_link_failed:xfrm4_protocol_deregister (&vti_ipcomp4_protocol,IPPROTO_COMP ); +xfrm_tunnel_failed: +xfrm4_tunnel_deregister (&ipip_handler,AF_INET ); xfrm_proto_comp_failed:xfrm4_protocol_deregister (&vti_ah4_protocol,IPPROTO_AH ); xfrm_proto_ah_failed:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 81/230 perf tools: Handle TOPOLOGY headers with no CPU
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 1497e804d1a6e2bd9107ddf64b0310449f4673eb ]
This patch fixes an issue in cpumap.c when used with the TOPOLOGY header. In some configurations, some NUMA nodes may have no CPU (empty cpulist). Yet a cpumap map must be created otherwise perf abort with an error. This patch handles this case by creating a dummy map.
Before:
$ perf record -o - -e cycles noploop 2 | perf script -i - 0x6e8 [0x6c]: failed to process type: 80
After:
$ perf record -o - -e cycles noploop 2 | perf script -i - noploop for 2 seconds
--- tools/perf/util/cpumap.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
tools/perf/util/cpumap.c +9 -2
@@ -124,7 +124,12 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (!cpu_list)return cpu_map__read_all_cpu_map (); -if (!isdigit (*cpu_list)) +/* +* must handle the case of empty cpumap to cover +* TOPOLOGY header for NUMA nodes with no CPU +* ( e.g., because of CPU hotplug) +*/ +if (!isdigit (*cpu_list) && *cpu_list !='\0' ) goto out;while (isdigit (*cpu_list)) {
@@ -171,8 +176,10 @@ struct cpu_map *cpu_map__new(const char *cpu_list)if (nr_cpus >0 ) cpus =cpu_map__trim_new (nr_cpus, tmp_cpus); -else +else if (*cpu_list !='\0' ) cpus =cpu_map__default_new (); +else + cpus =cpu_map__dummy_new (); invalid:free (tmp_cpus); out:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 82/230 IB/{hfi1, qib}: Fix WC.byte_len calculation for UD_SEND_WITH_IMM
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 904bba211acc2112fdf866e5a2bc6cd9ecd0de1b ]
The work completion length for a receiving a UD send with immediate is short by 4 bytes causing application using this opcode to fail.
The UD receive logic incorrectly subtracts 4 bytes for immediate value. These bytes are already included in header length and are used to calculate header/payload split, so the result is these 4 bytes are subtracted twice, once when the header length subtracted from the overall length and once again in the UD opcode specific path.
Remove the extra subtraction when handling the opcode.
--- drivers/infiniband/hw/qib/qib_ud.c | 1 - drivers/staging/rdma/hfi1/ud.c | 1 - 2 files changed, 2 deletions(-)
drivers/infiniband/hw/qib/qib_ud.c +0 -1
@@ -515,7 +515,6 @@ void qib_ud_rcv(struct qib_ibport *ibp, struct qib_ib_header *hdr, opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
drivers/staging/rdma/hfi1/ud.c +0 -1
@@ -793,7 +793,6 @@ void hfi1_ud_rcv(struct hfi1_packet *packet) opcode == IB_OPCODE_UD_SEND_ONLY_WITH_IMMEDIATE) { wc.ex.imm_data = ohdr->u.ud.imm_data; wc.wc_flags =IB_WC_WITH_IMM ; - tlen -=sizeof (u32); } else if (opcode == IB_OPCODE_UD_SEND_ONLY) { wc.ex.imm_data =0 ; wc.wc_flags =0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 83/230 ipvs: Fix signed integer overflow when setsockopt timeout
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 53ab60baa1ac4f20b080a22c13b77b6373922fd7 ]
There is a UBSAN bug report as below:
UBSAN: Undefined behaviour in net/netfilter/ipvs/ip_vs_ctl.c:2227:21
signed integer overflow:
-2147483647 * 1000 cannot be represented in type 'int'
Reproduce program:
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#define IPPROTO_IP 0
#define IPPROTO_RAW 255
#define IP_VS_BASE_CTL (64+1024+64)
#define IP_VS_SO_SET_TIMEOUT (IP_VS_BASE_CTL+10)
/* The argument to IP_VS_SO_GET_TIMEOUT */
struct ipvs_timeout_t {
int tcp_timeout;
int tcp_fin_timeout;
int udp_timeout;
};
int main() {
int ret = -1;
int sockfd = -1;
struct ipvs_timeout_t to;
sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);
if (sockfd == -1) {
printf("socket init error\n");
return -1;
}
to.tcp_timeout = -2147483647;
to.tcp_fin_timeout = -2147483647;
to.udp_timeout = -2147483647;
ret = setsockopt(sockfd,
IPPROTO_IP,
IP_VS_SO_SET_TIMEOUT,
(char *)(&to),
sizeof(to));
printf("setsockopt return %d\n", ret);
return ret;
}Return -EINVAL if the timeout value is negative or max than 'INT_MAX / HZ'.
--- net/netfilter/ipvs/ip_vs_ctl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +12 -0
@@ -2217,6 +2217,18 @@ static int ip_vs_set_timeout(struct netns_ipvs *ipvs, struct ip_vs_timeout_user u->tcp_fin_timeout, u->udp_timeout); +#ifdef CONFIG_IP_VS_PROTO_TCP +if (u->tcp_timeout <0 || u->tcp_timeout > (INT_MAX /HZ ) || + u->tcp_fin_timeout <0 || u->tcp_fin_timeout > (INT_MAX /HZ )) { +return -EINVAL ; + } +#endif + +#ifdef CONFIG_IP_VS_PROTO_UDP +if (u->udp_timeout <0 || u->udp_timeout > (INT_MAX /HZ )) +return -EINVAL ; +#endif +#ifdef CONFIG_IP_VS_PROTO_TCP if (u->tcp_timeout) { pd =ip_vs_proto_data_get (ipvs,IPPROTO_TCP );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 84/230 iommu/amd: Fix IOMMU page flush when detach device from a domain
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9825bd94e3a2baae1f4874767ae3a7d4c049720e ]
When a VM is terminated, the VFIO driver detaches all pass-through devices from VFIO domain by clearing domain id and page table root pointer from each device table entry (DTE), and then invalidates the DTE. Then, the VFIO driver unmap pages and invalidate IOMMU pages.
Currently, the IOMMU driver keeps track of which IOMMU and how many devices are attached to the domain. When invalidate IOMMU pages, the driver checks if the IOMMU is still attached to the domain before issuing the invalidate page command.
However, since VFIO has already detached all devices from the domain, the subsequent INVALIDATE_IOMMU_PAGES commands are being skipped as there is no IOMMU attached to the domain. This results in data corruption and could cause the PCI device to end up in indeterministic state.
Fix this by invalidate IOMMU pages when detach a device, and before decrementing the per-domain device reference counts.
--- drivers/iommu/amd_iommu.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/iommu/amd_iommu.c +11 -4
@@ -1982,6 +1982,7 @@ static void do_attach(struct iommu_dev_data *dev_data,static void do_detach (struct iommu_dev_data *dev_data) { +struct protection_domain *domain = dev_data->domain;struct amd_iommu *iommu;u16 alias;
@@ -1997,10 +1998,6 @@ static void do_detach(struct iommu_dev_data *dev_data) iommu = amd_iommu_rlookup_table[dev_data->devid]; alias = dev_data->alias; -/* decrease reference counters */ - dev_data->domain->dev_iommu[iommu->index] -=1 ; - dev_data->domain->dev_cnt -=1 ; -/* Update data structures */ dev_data->domain =NULL ;list_del (&dev_data->list);
@@ -2010,6 +2007,16 @@ static void do_detach(struct iommu_dev_data *dev_data)/* Flush the DTE entry */ device_flush_dte (dev_data); + +/* Flush IOTLB */ +domain_flush_tlb_pde (domain); + +/* Wait for the flushes to finish */ +domain_flush_complete (domain); + +/* decrease reference counters - needs to happen after the flushes */ + domain->dev_iommu[iommu->index] -=1 ; + domain->dev_cnt -=1 ; }/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 85/230 xtensa: SMP: fix ccount_timer_shutdown
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4fe8713b873fc881284722ce4ac47995de7cf62c ]
ccount_timer_shutdown is called from the atomic context in the secondary_start_kernel, resulting in the following BUG:
BUG: sleeping function called from invalid context in_atomic(): 1, irqs_disabled(): 1, pid: 0, name: swapper/1 Preemption disabled at: secondary_start_kernel+0xa1/0x130 Call Trace: ___might_sleep+0xe7/0xfc __might_sleep+0x41/0x44 synchronize_irq+0x24/0x64 disable_irq+0x11/0x14 ccount_timer_shutdown+0x12/0x20 clockevents_switch_state+0x82/0xb4 clockevents_exchange_device+0x54/0x60 tick_check_new_device+0x46/0x70 clockevents_register_device+0x8c/0xc8 clockevents_config_and_register+0x1d/0x2c local_timer_setup+0x75/0x7c secondary_start_kernel+0xb4/0x130 should_never_return+0x32/0x35
Use disable_irq_nosync instead of disable_irq to avoid it. This is safe because the ccount timer IRQ is per-CPU, and once IRQ is masked the ISR will not be called.
--- arch/xtensa/kernel/time.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/time.c +1 -1
@@ -87,7 +87,7 @@ static int ccount_timer_shutdown(struct clock_event_device *evt) container_of(evt, struct ccount_timer, evt);if (timer->irq_enabled) { -disable_irq (evt->irq); +disable_irq_nosync (evt->irq); timer->irq_enabled =0 ; }return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 86/230 xtensa: SMP: fix secondary CPU initialization
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 32a7726c4f4aadfabdb82440d84f88a5a2c8fe13 ]
- add missing memory barriers to the secondary CPU synchronization spin loops; add comment to the matching memory barrier in the boot_secondary and __cpu_die functions;
- use READ_ONCE/WRITE_ONCE to access cpu_start_id/cpu_start_ccount instead of reading/writing them directly;
- re-initialize cpu_running every time before starting secondary CPU to flush possible previous CPU startup results.
--- arch/xtensa/kernel/head.S | 5 ++++- arch/xtensa/kernel/smp.c | 34 +++++++++++++++++++++------------- 2 files changed, 25 insertions(+), 14 deletions(-)
arch/xtensa/kernel/head.S +4 -1
@@ -286,12 +286,13 @@ should_never_return: movi a2, cpu_start_ccount 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b movi a3, 0 s32i a3, a2, 0 - memw 1: + memw l32i a3, a2, 0 beqi a3, 0, 1b wsr a3, ccount
@@ -328,11 +329,13 @@ ENTRY(cpu_restart) rsr a0, prid neg a2, a0 movi a3, cpu_start_id + memw s32i a2, a3, 0 #if XCHAL_DCACHE_IS_WRITEBACK dhwbi a3, 0 #endif 1: + memw l32i a2, a3, 0 dhi a3, 0 bne a2, a0, 1b
arch/xtensa/kernel/smp.c +21 -13
@@ -192,9 +192,11 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts)int i;#ifdef CONFIG_HOTPLUG_CPU - cpu_start_id = cpu; -system_flush_invalidate_dcache_range ( - (unsigned long )&cpu_start_id,sizeof (cpu_start_id)); +WRITE_ONCE (cpu_start_id, cpu); +/* Pairs with the third memw in the cpu_restart */ +mb (); +system_flush_invalidate_dcache_range ((unsigned long )&cpu_start_id, +sizeof (cpu_start_id));#endif smp_call_function_single (0 , mx_cpu_start, (void *)cpu,1 );
@@ -203,18 +205,21 @@ static int boot_secondary(unsigned int cpu, struct task_struct *ts) ccount =get_ccount ();while (!ccount); - cpu_start_ccount = ccount; +WRITE_ONCE (cpu_start_ccount, ccount); -while (time_before (jiffies, timeout)) { +do { +/* +* Pairs with the first two memws in the +* .Lboot_secondary. +*/ mb (); -if (!cpu_start_ccount) -break ; - } + ccount =READ_ONCE (cpu_start_ccount); + }while (ccount &&time_before (jiffies, timeout)); -if (cpu_start_ccount) { +if (ccount) {smp_call_function_single (0 , mx_cpu_stop, - (void *)cpu,1 ); - cpu_start_ccount =0 ; + (void *)cpu,1 ); +WRITE_ONCE (cpu_start_ccount,0 );return -EIO ; } }
@@ -234,6 +239,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)pr_debug ("%s: Calling wakeup_secondary(cpu:%d, idle:%p, sp: %08lx)\n" , __func__, cpu, idle, start_info.stack); +init_completion (&cpu_running); ret =boot_secondary (cpu, idle);if (ret ==0 ) { wait_for_completion_timeout(&cpu_running,
@@ -295,8 +301,10 @@ void __cpu_die(unsigned int cpu)unsigned long timeout = jiffies +msecs_to_jiffies (1000 );while (time_before (jiffies, timeout)) {system_invalidate_dcache_range ((unsigned long )&cpu_start_id, -sizeof (cpu_start_id)); -if (cpu_start_id == -cpu) { +sizeof (cpu_start_id)); +/* Pairs with the second memw in the cpu_restart */ +mb (); +if (READ_ONCE (cpu_start_id) == -cpu) {platform_cpu_kill (cpu);return ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 87/230 xtensa: smp_lx200_defconfig: fix vectors clash
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 306b38305c0f86de7f17c5b091a95451dcc93d7d ]
Secondary CPU reset vector overlaps part of the double exception handler code, resulting in weird crashes and hangups when running user code. Move exception vectors one page up so that they don't clash with the secondary CPU reset vector.
--- arch/xtensa/configs/smp_lx200_defconfig | 1 + 1 file changed, 1 insertion(+)
arch/xtensa/configs/smp_lx200_defconfig +1 -0
@@ -35,6 +35,7 @@ CONFIG_SMP=y CONFIG_HOTPLUG_CPU=y # CONFIG_INITIALIZE_XTENSA_MMU_INSIDE_VMLINUX is not set # CONFIG_PCI is not set +CONFIG_VECTORS_OFFSET=0x00002000 CONFIG_XTENSA_PLATFORM_XTFPGA=y CONFIG_CMDLINE_BOOL=y CONFIG_CMDLINE="earlycon=uart8250,mmio32,0xfd050020,115200n8 console=ttyS0,115200n8 ip=dhcp root=/dev/nfs rw debug"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 88/230 xtensa: SMP: mark each possible CPU as present
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 8b1c42cdd7181200dc1fff39dcb6ac1a3fac2c25 ]
Otherwise it is impossible to enable CPUs after booting with 'maxcpus' parameter.
--- arch/xtensa/kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/kernel/smp.c +1 -1
@@ -80,7 +80,7 @@ void __init smp_prepare_cpus(unsigned int max_cpus) {unsigned i; -for (i =0 ; i < max_cpus; ++i) +for_each_possible_cpu (i)set_cpu_present (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 89/230 xtensa: SMP: limit number of possible CPUs by NR_CPUS
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 25384ce5f9530def39421597b1457d9462df6455 ]
This fixes the following warning at boot when the kernel is booted on a board with more CPU cores than was configured in NR_CPUS:
smp_init_cpus: Core Count = 8
smp_init_cpus: Core Id = 0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at include/linux/cpumask.h:121 smp_init_cpus+0x54/0x74
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.0.0-rc3-00015-g1459333f88a0 #124
Call Trace:
__warn$part$3+0x6a/0x7c
warn_slowpath_null+0x35/0x3c
smp_init_cpus+0x54/0x74
setup_arch+0x1c0/0x1d0
start_kernel+0x44/0x310
_startup+0x107/0x107--- arch/xtensa/kernel/smp.c | 5 +++++ 1 file changed, 5 insertions(+)
arch/xtensa/kernel/smp.c +5 -0
@@ -93,6 +93,11 @@ void __init smp_init_cpus(void)pr_info ("%s: Core Count = %d\n" , __func__, ncpus);pr_info ("%s: Core Id = %d\n" , __func__, core_id); +if (ncpus >NR_CPUS ) { + ncpus =NR_CPUS ; +pr_info ("%s: limiting core count by %d\n" , __func__, ncpus); + } +for (i =0 ; i < ncpus; ++i)set_cpu_possible (i, true); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 90/230 net: altera_tse: fix msgdma_tx_completion on non-zero fill_level case
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6571ebce112a21ec9be68ef2f53b96fcd41fd81b ]
If fill_level was not zero and status was not BUSY, result of "tx_prod - tx_cons - inuse" might be zero. Subtracting 1 unconditionally results invalid negative return value on this case.
Make sure not to return an negative value.
--- drivers/net/ethernet/altera/altera_msgdma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/ethernet/altera/altera_msgdma.c +2 -1
@@ -145,7 +145,8 @@ u32 msgdma_tx_completions(struct altera_tse_private *priv) &0xffff ;if (inuse) {/* Tx FIFO is not empty */ - ready = priv->tx_prod - priv->tx_cons - inuse -1 ; + ready =max_t (int, + priv->tx_prod - priv->tx_cons - inuse -1 ,0 ); }else {/* Check for buffered last packet */ status =csrrd32 (priv->tx_dma_csr,msgdma_csroffs (status));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 91/230 net: hns: Fix wrong read accesses via Clause 45 MDIO protocol
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit cec8abba13e6a26729dfed41019720068eeeff2b ]
When reading phy registers via Clause 45 MDIO protocol, after write address operation, the driver use another write address operation, so can not read the right value of any phy registers. This patch fixes it.
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -1
@@ -319,7 +319,7 @@ static int hns_mdio_read(struct mii_bus *bus, int phy_id, int regnum) }hns_mdio_cmd_write (mdio_dev, is_c45, -MDIO_C45_WRITE_ADDR , phy_id, devad); +MDIO_C45_READ , phy_id, devad); }/* Step 5: waitting for MDIO_COMMAND_REG 's mdio_start==0,*/
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 92/230 net: stmmac: dwmac-rk: fix error handling in rk_gmac_powerup()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c69c29a1a0a8f68cd87e98ba4a5a79fb8ef2a58c ]
If phy_power_on() fails in rk_gmac_powerup(), clocks are left enabled.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +3 -1
@@ -535,8 +535,10 @@ static int rk_gmac_init(struct platform_device *pdev, void *priv)int ret; ret =phy_power_on (bsp_priv, true); -if (ret) +if (ret) { +gmac_clk_enable (bsp_priv, false);return ret; + } ret =gmac_clk_enable (bsp_priv, true);if (ret)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 93/230 gpio: vf610: Mask all GPIO interrupts
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7ae710f9f8b2cf95297e7bbfe1c09789a7dc43d4 ]
On SoC reset all GPIO interrupts are disable. However, if kexec is used to boot into a new kernel, the SoC does not experience a reset. Hence GPIO interrupts can be left enabled from the previous kernel. It is then possible for the interrupt to fire before an interrupt handler is registered, resulting in the kernel complaining of an "unexpected IRQ trap", the interrupt is never cleared, and so fires again, resulting in an interrupt storm.
Disable all GPIO interrupts before registering the GPIO IRQ chip.
--- drivers/gpio/gpio-vf610.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/gpio/gpio-vf610.c +5 -0
@@ -227,6 +227,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)struct vf610_gpio_port *port;struct resource *iores;struct gpio_chip *gc; +int i;int ret; port =devm_kzalloc (&pdev->dev,sizeof (*port),GFP_KERNEL );
@@ -265,6 +266,10 @@ static int vf610_gpio_probe(struct platform_device *pdev)if (ret <0 )return ret; +/* Mask all GPIO interrupts */ +for (i =0 ; i < gc->ngpio; i++) +vf610_gpio_writel (0 , port->base +PORT_PCR (i)); +/* Clear the interrupt status register for all GPIO's */ vf610_gpio_writel (~0 , port->base +PORT_ISFR );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 94/230 nfs: Fix NULL pointer dereference of dev_name
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 80ff00172407e0aad4b10b94ef0816fc3e7813cb ]
There is a NULL pointer dereference of dev_name in nfs_parse_devname()
The oops looks something like:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 ... RIP: 0010:nfs_fs_mount+0x3b6/0xc20 [nfs] ... Call Trace: ? ida_alloc_range+0x34b/0x3d0 ? nfs_clone_super+0x80/0x80 [nfs] ? nfs_free_parsed_mount_data+0x60/0x60 [nfs] mount_fs+0x52/0x170 ? __init_waitqueue_head+0x3b/0x50 vfs_kern_mount+0x6b/0x170 do_mount+0x216/0xdc0 ksys_mount+0x83/0xd0 __x64_sys_mount+0x25/0x30 do_syscall_64+0x65/0x220 entry_SYSCALL_64_after_hwframe+0x49/0xbe
Fix this by adding a NULL check on dev_name
--- fs/nfs/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/nfs/super.c +5 -0
@@ -1877,6 +1877,11 @@ static int nfs_parse_devname(const char *dev_name,size_t len;char *end; +if (unlikely (!dev_name || !*dev_name)) { +dfprintk (MOUNT ,"NFS: device name not specified\n" ); +return -EINVAL ; + } +/* Is the host name protected with square brakcets? */ if (*dev_name =='[' ) { end =strchr (++dev_name,']' );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 95/230 scsi: libfc: free skb when receiving invalid flogi resp
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 5d8fc4a9f0eec20b6c07895022a6bea3fb6dfb38 ]
The issue to be fixed in this commit is when libfc found it received a invalid FLOGI response from FC switch, it would return without freeing the fc frame, which is just the skb data. This would cause memory leak if FC switch keeps sending invalid FLOGI responses.
This fix is just to make it execute fc_frame_free(fp) before returning from function fc_lport_flogi_resp.
--- drivers/scsi/libfc/fc_lport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/scsi/libfc/fc_lport.c +3 -3
@@ -1739,14 +1739,14 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp, fc_frame_payload_op(fp) != ELS_LS_ACC) {FC_LPORT_DBG (lport,"FLOGI not accepted or bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } flp =fc_frame_payload_get (fp,sizeof (*flp));if (!flp) {FC_LPORT_DBG (lport,"FLOGI bad response\n" );fc_lport_error (lport, fp); - goto err; + goto out; } mfs = ntohs(flp->fl_csp.sp_bb_data) &
@@ -1756,7 +1756,7 @@ void fc_lport_flogi_resp(struct fc_seq *sp, struct fc_frame *fp,FC_LPORT_DBG (lport,"FLOGI bad mfs:%hu response, " "lport->mfs:%hu\n" , mfs, lport->mfs);fc_lport_error (lport, fp); - goto err; + goto out; }if (mfs <= lport->mfs) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 96/230 platform/x86: Fix unmet dependency warning for SAMSUNG_Q10
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 0ee4b5f801b73b83a9fb3921d725f2162fd4a2e5 ]
Add BACKLIGHT_LCD_SUPPORT for SAMSUNG_Q10 to fix the
warning: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE.
SAMSUNG_Q10 selects BACKLIGHT_CLASS_DEVICE but BACKLIGHT_CLASS_DEVICE depends on BACKLIGHT_LCD_SUPPORT.
Copy BACKLIGHT_LCD_SUPPORT dependency into SAMSUNG_Q10 to fix:
WARNING: unmet direct dependencies detected for BACKLIGHT_CLASS_DEVICE
Depends on [n]: HAS_IOMEM [=y] && BACKLIGHT_LCD_SUPPORT [=n] Selected by [y]:
- SAMSUNG_Q10 [=y] && X86 [=y] && X86_PLATFORM_DEVICES [=y] && ACPI [=y]
--- drivers/platform/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/platform/x86/Kconfig +1 -0
@@ -881,6 +881,7 @@ config INTEL_OAKTRAIL config SAMSUNG_Q10 tristate "Samsung Q10 Extras" depends on ACPI + depends on BACKLIGHT_LCD_SUPPORT select BACKLIGHT_CLASS_DEVICE ---help--- This driver provides support for backlight control on Samsung Q10
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 97/230 cifs: fix computation for MAX_SMB2_HDR_SIZE
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 58d15ed1203f4d858c339ea4d7dafa94bd2a56d3 ]
The size of the fixed part of the create response is 88 bytes not 56.
--- fs/cifs/smb2pdu.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/cifs/smb2pdu.h +2 -2
@@ -82,8 +82,8 @@#define NUMBER_OF_SMB2_COMMANDS 0x0013 -/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ -#define MAX_SMB2_HDR_SIZE 0x00b0 +/* 52 transform hdr + 64 hdr + 88 create rsp */ +#define MAX_SMB2_HDR_SIZE 204#define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 98/230 x86/kexec: Dont setup EFI info if EFI runtime is not enabled
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2aa958c99c7fd3162b089a1a56a34a0cdb778de1 ]
Kexec-ing a kernel with "efi=noruntime" on the first kernel's command line causes the following null pointer dereference:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 #PF error: [normal kernel read fault] Call Trace: efi_runtime_map_copy+0x28/0x30 bzImage64_load+0x688/0x872 arch_kexec_kernel_image_load+0x6d/0x70 kimage_file_alloc_init+0x13e/0x220 __x64_sys_kexec_file_load+0x144/0x290 do_syscall_64+0x55/0x1a0 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Just skip the EFI info setup if EFI runtime services are not enabled.
[ bp: Massage commit message. ]
--- arch/x86/kernel/kexec-bzimage64.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kernel/kexec-bzimage64.c +3 -0
@@ -168,6 +168,9 @@ setup_efi_state(struct boot_params *params, unsigned long params_load_addr,struct efi_info *current_ei = &boot_params.efi_info;struct efi_info *ei = ¶ms->efi_info; +if (!efi_enabled (EFI_RUNTIME_SERVICES )) +return 0 ; +if (!current_ei->efi_memmap_size)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 99/230 x86_64: increase stack size for KASAN_EXTRA
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a8e911d13540487942d53137c156bd7707f66e5d ]
If the kernel is configured with KASAN_EXTRA, the stack size is increasted significantly because this option sets "-fstack-reuse" to "none" in GCC [1]. As a result, it triggers stack overrun quite often with 32k stack size compiled using GCC 8. For example, this reproducer
https://github.com/linux-test-project/ltp/blob/master/testcases/kernel/syscalls/madvise/madvise06.c
triggers a "corrupted stack end detected inside scheduler" very reliably with CONFIG_SCHED_STACK_END_CHECK enabled.
There are just too many functions that could have a large stack with KASAN_EXTRA due to large local variables that have been called over and over again without being able to reuse the stacks. Some noticiable ones are
size
7648 shrink_page_list
3584 xfs_rmap_convert
3312 migrate_page_move_mapping
3312 dev_ethtool
3200 migrate_misplaced_transhuge_page
3168 copy_process
There are other 49 functions are over 2k in size while compiling kernel with "-Wframe-larger-than=" even with a related minimal config on this machine. Hence, it is too much work to change Makefiles for each object to compile without "-fsanitize-address-use-after-scope" individually.
[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=81715#c23
Although there is a patch in GCC 9 to help the situation, GCC 9 probably won't be released in a few months and then it probably take another 6-month to 1-year for all major distros to include it as a default. Hence, the stack usage with KASAN_EXTRA can be revisited again in 2020 when GCC 9 is everywhere. Until then, this patch will help users avoid stack overrun.
This has already been fixed for arm64 for the same reason via 6e8830674ea ("arm64: kasan: Increase stack size for KASAN_EXTRA").
--- arch/x86/include/asm/page_64_types.h | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/include/asm/page_64_types.h +4 -0
@@ -2,7 +2,11 @@#define _ASM_X86_PAGE_64_DEFS_H#ifdef CONFIG_KASAN +#ifdef CONFIG_KASAN_EXTRA +#define KASAN_STACK_ORDER 2 +#else #define KASAN_STACK_ORDER 1 +#endif #else #define KASAN_STACK_ORDER 0#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 100/230 mm, memory_hotplug: is_mem_section_removable do not pass the end of a zone
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit efad4e475c312456edb3c789d0996d12ed744c13 ]
Patch series "mm, memory_hotplug: fix uninitialized pages fallouts", v2.
Mikhail Zaslonko has posted fixes for the two bugs quite some time ago [1]. I have pushed back on those fixes because I believed that it is much better to plug the problem at the initialization time rather than play whack-a-mole all over the hotplug code and find all the places which expect the full memory section to be initialized.
We have ended up with commit 2830bf6f05fb ("mm, memory_hotplug:
initialize struct pages for the full memory section") merged and cause a regression [2][3]. The reason is that there might be memory layouts when two NUMA nodes share the same memory section so the merged fix is simply incorrect.
In order to plug this hole we really have to be zone range aware in those handlers. I have split up the original patch into two. One is unchanged (patch 2) and I took a different approach for `removable' crash.
[1] http://lkml.kernel.org/r/[email protected]
[2] https://bugzilla.redhat.com/show_bug.cgi?id=1666948
[3] http://lkml.kernel.org/r/[email protected]
This patch (of 2):
Mikhail has reported the following VM_BUG_ON triggered when reading sysfs removable state of a memory block:
page:000003d08300c000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: is_mem_section_removable+0xb4/0x190 show_mem_removable+0x9a/0xd8 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: is_mem_section_removable+0xb4/0x190 Kernel panic - not syncing: Fatal exception: panic_on_oops
The reason is that the memory block spans the zone boundary and we are stumbling over an unitialized struct page. Fix this by enforcing zone range in is_mem_section_removable so that we never run away from a zone.
--- mm/memory_hotplug.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/memory_hotplug.c +2 -1
@@ -1358,7 +1358,8 @@ static struct page *next_active_pageblock(struct page *page)int is_mem_section_removable (unsigned long start_pfn,unsigned long nr_pages) {struct page *page =pfn_to_page (start_pfn); -struct page *end_page = page + nr_pages; +unsigned long end_pfn =min (start_pfn + nr_pages,zone_end_pfn (page_zone (page))); +struct page *end_page =pfn_to_page (end_pfn);/* Check the starting page of each pageblock within the range */ for (; page < end_page; page =next_active_pageblock (page)) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 101/230 mm, memory_hotplug: test_pages_in_a_zone do not pass the end of zone
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 24feb47c5fa5b825efb0151f28906dfdad027e61 ]
If memory end is not aligned with the sparse memory section boundary, the mapping of such a section is only partly initialized. This may lead to VM_BUG_ON due to uninitialized struct pages access from test_pages_in_a_zone() function triggered by memory_hotplug sysfs handlers.
Here are the the panic examples:
CONFIG_DEBUG_VM_PGFLAGS=y
kernel parameter mem=2050M
--------------------------
page:000003d082008000 is uninitialized and poisoned
page dumped because: VM_BUG_ON_PAGE(PagePoisoned(p)) Call Trace: test_pages_in_a_zone+0xde/0x160 show_valid_zones+0x5c/0x190 dev_attr_show+0x34/0x70 sysfs_kf_seq_show+0xc8/0x148 seq_read+0x204/0x480 __vfs_read+0x32/0x178 vfs_read+0x82/0x138 ksys_read+0x5a/0xb0 system_call+0xdc/0x2d8 Last Breaking-Event-Address: test_pages_in_a_zone+0xde/0x160 Kernel panic - not syncing: Fatal exception: panic_on_oops
Fix this by checking whether the pfn to check is within the zone.
[[email protected]: separated this change from
http://lkml.kernel.org/r/[email protected]]
--- mm/memory_hotplug.c | 3 +++ 1 file changed, 3 insertions(+)
mm/memory_hotplug.c +3 -0
@@ -1399,6 +1399,9 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, i++;if (i ==MAX_ORDER_NR_PAGES )continue ; +/* Check if we got outside of the zone */ +if (zone && !zone_spans_pfn (zone, pfn + i)) +return 0 ; page =pfn_to_page (pfn + i);if (zone &&page_zone (page) != zone)return 0 ;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 102/230 fs/drop_caches.c: avoid softlockups in drop_pagecache_sb()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c27d82f52f75fc9d8d9d40d120d2a96fdeeada5e ]
When superblock has lots of inodes without any pagecache (like is the case for /proc), drop_pagecache_sb() will iterate through all of them without dropping sb->s_inode_list_lock which can lead to softlockups (one of our customers hit this).
Fix the problem by going to the slow path and doing cond_resched() in case the process needs rescheduling.
--- fs/drop_caches.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/drop_caches.c +7 -1
@@ -20,8 +20,13 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_lock (&sb->s_inode_list_lock);list_for_each_entry (inode, &sb->s_inodes, i_sb_list) {spin_lock (&inode->i_lock); +/* +* We must skip inodes in unusual state. We may also skip +* inodes without pages but we deliberately won't in case +* we need to reschedule to avoid softlockups. +*/ if ((inode->i_state & (I_FREEING |I_WILL_FREE |I_NEW )) || - (inode->i_mapping->nrpages ==0 )) { + (inode->i_mapping->nrpages ==0 && !need_resched ())) {spin_unlock (&inode->i_lock);continue ; }
@@ -29,6 +34,7 @@ static void drop_pagecache_sb(struct super_block *sb, void *unused)spin_unlock (&inode->i_lock);spin_unlock (&sb->s_inode_list_lock); +cond_resched ();invalidate_mapping_pages (inode->i_mapping,0 ,-1 );iput (toput_inode); toput_inode = inode;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 103/230 autofs: drop dentry reference only when it is never used
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 63ce5f552beb9bdb41546b3a26c4374758b21815 ]
autofs_expire_run() calls dput(dentry) to drop the reference count of dentry. However, dentry is read via autofs_dentry_ino(dentry) after that. This may result in a use-free-bug. The patch drops the reference count of dentry only when it is never used.
--- fs/autofs4/expire.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/autofs4/expire.c +2 -1
@@ -560,7 +560,6 @@ int autofs4_expire_run(struct super_block *sb, pkt.len = dentry->d_name.len;memcpy (pkt.name, dentry->d_name.name, pkt.len); pkt.name[pkt.len] ='\0' ; -dput (dentry);if (copy_to_user (pkt_p, &pkt,sizeof (struct autofs_packet_expire )) ) ret = -EFAULT ;
@@ -573,6 +572,8 @@ int autofs4_expire_run(struct super_block *sb,complete_all (&ino->expire_complete);spin_unlock (&sbi->fs_lock); +dput (dentry); +return ret; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 104/230 autofs: fix error return in autofs_fill_super()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit f585b283e3f025754c45bbe7533fc6e5c4643700 ]
In autofs_fill_super() on error of get inode/make root dentry the return should be ENOMEM as this is the only failure case of the called functions.
--- fs/autofs4/inode.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/autofs4/inode.c +3 -1
@@ -255,8 +255,10 @@ int autofs4_fill_super(struct super_block *s, void *data, int silent) } root_inode =autofs4_get_inode (s,S_IFDIR |0755 ); root =d_make_root (root_inode); -if (!root) +if (!root) { + ret = -ENOMEM ; goto fail_ino; + } pipe =NULL ; root->d_fsdata = ino;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 105/230 ARM: pxa: ssp: unneeded to free devm_ allocated data
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit ba16adeb346387eb2d1ada69003588be96f098fa ]
devm_ allocated data will be automatically freed. The free of devm_ allocated data is invalid.
--- arch/arm/plat-pxa/ssp.c | 3 --- 1 file changed, 3 deletions(-)
arch/arm/plat-pxa/ssp.c +0 -3
@@ -238,8 +238,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)if (ssp ==NULL )return -ENODEV ; -iounmap (ssp->mmio_base); - res =platform_get_resource (pdev,IORESOURCE_MEM ,0 );release_mem_region (res->start,resource_size (res));
@@ -249,7 +247,6 @@ static int pxa_ssp_remove(struct platform_device *pdev)list_del (&ssp->node);mutex_unlock (&ssp_lock); -kfree (ssp);return 0 ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 106/230 irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2380a22b60ce6f995eac806e69c66e397b59d045 ]
Resetting bit 4 disables the interrupt delivery to the "secure processor" core. This breaks the keyboard on a OLPC XO 1.75 laptop, where the firmware running on the "secure processor" bit-bangs the PS/2 protocol over the GPIO lines.
It is not clear what the rest of the bits are and Marvell was unhelpful when asked for documentation. Aside from the SP bit, there are probably priority bits.
Leaving the unknown bits as the firmware set them up seems to be a wiser course of action compared to just turning them off.
--- drivers/irqchip/irq-mmp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/irqchip/irq-mmp.c +5 -1
@@ -34,6 +34,9 @@#define SEL_INT_PENDING (1 << 6)#define SEL_INT_NUM_MASK 0x3f +#define MMP2_ICU_INT_ROUTE_PJ4_IRQ (1 << 5) +#define MMP2_ICU_INT_ROUTE_PJ4_FIQ (1 << 6) +struct icu_chip_data {int nr_irqs;unsigned int virq_base;
@@ -190,7 +193,8 @@ static struct mmp_intc_conf mmp_conf = {static struct mmp_intc_conf mmp2_conf = { .conf_enable =0x20 , .conf_disable =0x0 , - .conf_mask =0x7f , + .conf_mask =MMP2_ICU_INT_ROUTE_PJ4_IRQ | +MMP2_ICU_INT_ROUTE_PJ4_FIQ , }; static void __exception_irq_entry mmp_handle_irq(struct pt_regs *regs)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 107/230 dmaengine: at_xdmac: Fix wrongfull report of a channel as in use
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc3f595b6617ebc0307e0ce151e8f2f2b2489b95 ]
atchan->status variable is used to store two different information:
- pass channel interrupts status from interrupt handler to tasklet;
- channel information like whether it is cyclic or paused;
This causes a bug when device_terminate_all() is called, (AT_XDMAC_CHAN_IS_CYCLIC cleared on atchan->status) and then a late End of Block interrupt arrives (AT_XDMAC_CIS_BIS), which sets bit 0 of atchan->status. Bit 0 is also used for AT_XDMAC_CHAN_IS_CYCLIC, so when a new descriptor for a cyclic transfer is created, the driver reports the channel as in use:
if (test_and_set_bit(AT_XDMAC_CHAN_IS_CYCLIC, &atchan->status)) {
dev_err(chan2dev(chan), "channel currently used\n");
return NULL;
}This patch fixes the bug by adding a different struct member to keep the interrupts status separated from the channel status bits.
--- drivers/dma/at_xdmac.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/dma/at_xdmac.c +10 -9
@@ -203,6 +203,7 @@ struct at_xdmac_chan {u32 save_cim;u32 save_cnda;u32 save_cndc; +u32 irq_status;unsigned long status;struct tasklet_struct tasklet;struct dma_slave_config sconfig;
@@ -1582,8 +1583,8 @@ static void at_xdmac_tasklet(unsigned long data)struct at_xdmac_desc *desc;u32 error_mask; -dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08lx\n" , - __func__, atchan->status); +dev_dbg (chan2dev (&atchan->chan),"%s: status=0x%08x\n" , + __func__, atchan->irq_status); error_mask =AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS
@@ -1591,15 +1592,15 @@ static void at_xdmac_tasklet(unsigned long data)if (at_xdmac_chan_is_cyclic (atchan)) {at_xdmac_handle_cyclic (atchan); - }else if ((atchan->status &AT_XDMAC_CIS_LIS ) - || (atchan->status & error_mask)) { + }else if ((atchan->irq_status &AT_XDMAC_CIS_LIS ) + || (atchan->irq_status & error_mask)) {struct dma_async_tx_descriptor *txd; -if (atchan->status &AT_XDMAC_CIS_RBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_RBEIS )dev_err (chan2dev (&atchan->chan),"read bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_WBEIS ) +if (atchan->irq_status &AT_XDMAC_CIS_WBEIS )dev_err (chan2dev (&atchan->chan),"write bus error!!!" ); -if (atchan->status &AT_XDMAC_CIS_ROIS ) +if (atchan->irq_status &AT_XDMAC_CIS_ROIS )dev_err (chan2dev (&atchan->chan),"request overflow error!!!" );spin_lock_bh (&atchan->lock);
@@ -1654,7 +1655,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id) atchan = &atxdmac->chan[i]; chan_imr =at_xdmac_chan_read (atchan,AT_XDMAC_CIM ); chan_status =at_xdmac_chan_read (atchan,AT_XDMAC_CIS ); - atchan->status = chan_status & chan_imr; + atchan->irq_status = chan_status & chan_imr;dev_vdbg (atxdmac->dma.dev,"%s: chan%d: imr=0x%x, status=0x%x\n" , __func__, i, chan_imr, chan_status);
@@ -1668,7 +1669,7 @@ static irqreturn_t at_xdmac_interrupt(int irq, void *dev_id)at_xdmac_chan_read (atchan,AT_XDMAC_CDA ), at_xdmac_chan_read(atchan, AT_XDMAC_CUBC)); -if (atchan->status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS )) +if (atchan->irq_status & (AT_XDMAC_CIS_RBEIS |AT_XDMAC_CIS_WBEIS ))at_xdmac_write (atxdmac,AT_XDMAC_GD , atchan->mask);tasklet_schedule (&atchan->tasklet);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 108/230 dmaengine: dmatest: Abort test in case of mapping error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 6454368a804c4955ccd116236037536f81e5b1f1 ]
In case of mapping error the DMA addresses are invalid and continuing will screw system memory or potentially something else.
[ 222.480310] dmatest: dma0chan7-copy0: summary 1 tests, 3 failures 6 iops 349 KB/s (0) ... [ 240.912725] check: Corrupted low memory at 00000000c7c75ac9 (2940 phys) = 5656000000000000 [ 240.921998] check: Corrupted low memory at 000000005715a1cd (2948 phys) = 279f2aca5595ab2b [ 240.931280] check: Corrupted low memory at 000000002f4024c0 (2950 phys) = 5e5624f349e793cf
...
Abort any test if mapping failed.
--- drivers/dma/dmatest.c | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-)
drivers/dma/dmatest.c +12 -16
@@ -563,11 +563,9 @@ static int dmatest_func(void *data) srcs[i] = um->addr[i] + src_off; ret =dma_mapping_error (dev->dev, um->addr[i]);if (ret) { -dmaengine_unmap_put (um);result ("src mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->to_cnt++; }
@@ -582,11 +580,9 @@ static int dmatest_func(void *data) DMA_BIDIRECTIONAL); ret =dma_mapping_error (dev->dev, dsts[i]);if (ret) { -dmaengine_unmap_put (um);result ("dst mapping error" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; } um->bidi_cnt++; }
@@ -611,12 +607,10 @@ static int dmatest_func(void *data) }if (!tx) { -dmaengine_unmap_put (um);result ("prep error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; } done->done = false;
@@ -625,12 +619,10 @@ static int dmatest_func(void *data) cookie = tx->tx_submit (tx);if (dma_submit_error (cookie)) { -dmaengine_unmap_put (um);result ("submit error" , total_tests, src_off, dst_off, len, ret);msleep (100 ); - failed_tests++; -continue ; + goto error_unmap_continue; }dma_async_issue_pending (chan);
@@ -643,16 +635,14 @@ static int dmatest_func(void *data)dmaengine_unmap_put (um);result ("test timed out" , total_tests, src_off, dst_off, len,0 ); - failed_tests++; -continue ; + goto error_unmap_continue; }else if (status !=DMA_COMPLETE ) {dmaengine_unmap_put (um);result (status ==DMA_ERROR ?"completion error status" :"completion busy status" , total_tests, src_off, dst_off, len, ret); - failed_tests++; -continue ; + goto error_unmap_continue; }dmaengine_unmap_put (um);
@@ -691,6 +681,12 @@ static int dmatest_func(void *data)verbose_result ("test passed" , total_tests, src_off, dst_off, len,0 ); } + +continue ; + +error_unmap_continue: +dmaengine_unmap_put (um); + failed_tests++; } runtime =ktime_us_delta (ktime_get (), ktime);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 109/230 s390/qeth: fix use-after-free in error path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit afa0c5904ba16d59b0454f7ee4c807dae350f432 ]
The error path in qeth_alloc_qdio_buffers() that takes care of cleaning up the Output Queues is buggy. It first frees the queue, but then calls qeth_clear_outq_buffers() with that very queue struct.
Make the call to qeth_clear_outq_buffers() part of the free action (in the correct order), and while at it fix the naming of the helper.
--- drivers/s390/net/qeth_core_main.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
drivers/s390/net/qeth_core_main.c +6 -9
@@ -2452,11 +2452,12 @@ static int qeth_init_qdio_out_buf(struct qeth_qdio_out_q *q, int bidx)return rc; } -static void qeth_free_qdio_out_buf (struct qeth_qdio_out_q *q) +static void qeth_free_output_queue (struct qeth_qdio_out_q *q) {if (!q)return ; +qeth_clear_outq_buffers (q,1 );qdio_free_buffers (q->qdio_bufs,QDIO_MAX_BUFFERS_PER_Q );kfree (q); }
@@ -2529,10 +2530,8 @@ static int qeth_alloc_qdio_buffers(struct qeth_card *card) card->qdio.out_qs[i]->bufs[j] =NULL ; } out_freeoutq: -while (i >0 ) { -qeth_free_qdio_out_buf (card->qdio.out_qs[--i]); -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); - } +while (i >0 ) +qeth_free_output_queue (card->qdio.out_qs[--i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; out_freepool:
@@ -2565,10 +2564,8 @@ static void qeth_free_qdio_buffers(struct qeth_card *card)qeth_free_buffer_pool (card);/* free outbound qdio_qs */ if (card->qdio.out_qs) { -for (i =0 ; i < card->qdio.no_out_queues; ++i) { -qeth_clear_outq_buffers (card->qdio.out_qs[i],1 ); -qeth_free_qdio_out_buf (card->qdio.out_qs[i]); - } +for (i =0 ; i < card->qdio.no_out_queues; i++) +qeth_free_output_queue (card->qdio.out_qs[i]);kfree (card->qdio.out_qs); card->qdio.out_qs =NULL ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 110/230 perf symbols: Filter out hidden symbols from labels
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 59a17706915fe5ea6f711e1f92d4fb706bce07fe ]
When perf is built with the annobin plugin (RHEL8 build) extra symbols are added to its binary:
# nm perf | grep annobin | head -10 0000000000241100 t .annobin_annotate.c 0000000000326490 t .annobin_annotate.c 0000000000249255 t .annobin_annotate.c_end 00000000003283a8 t .annobin_annotate.c_end 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bce18 t .annobin_annotate.c_end.hot 00000000001bc3e2 t .annobin_annotate.c_end.unlikely 00000000001bc400 t .annobin_annotate.c_end.unlikely 00000000001bce18 t .annobin_annotate.c.hot 00000000001bce18 t .annobin_annotate.c.hot ...
Those symbols have no use for report or annotation and should be skipped. Moreover they interfere with the DWARF unwind test on the PPC arch, where they are mixed with checked symbols and then the test fails:
# perf test dwarf -v 59: Test dwarf unwind : --- start --- test child forked, pid 8515 unwind: .annobin_dwarf_unwind.c:ip = 0x10dba40dc (0x2740dc) ... got: .annobin_dwarf_unwind.c 0x10dba40dc, expecting test__arch_unwind_sample unwind: failed with 'no error'
The annobin symbols are defined as NOTYPE/LOCAL/HIDDEN:
# readelf -s ./perf | grep annobin | head -1
40: 00000000001bce4f 0 NOTYPE LOCAL HIDDEN 13 .annobin_init.cThey can still pass the check for the label symbol. Adding check for HIDDEN and INTERNAL (as suggested by Nick below) visibility and filter out such symbols.
Quoted 4 lines
Just to be awkward, if you are going to ignore
STV_HIDDENsymbols then you should probably also ignoreSTV_INTERNALones as well... Annobin does not generate them, but you never know, one day some other tool might create some.
--- tools/perf/util/symbol-elf.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
tools/perf/util/symbol-elf.c +8 -1
@@ -74,6 +74,11 @@ static inline uint8_t elf_sym__type(const GElf_Sym *sym)return GELF_ST_TYPE (sym->st_info); } +static inline uint8_t elf_sym__visibility (const GElf_Sym *sym) +{ +return GELF_ST_VISIBILITY (sym->st_other); +} +#ifndef STT_GNU_IFUNC #define STT_GNU_IFUNC 10#endif
@@ -98,7 +103,9 @@ static inline int elf_sym__is_label(const GElf_Sym *sym)return elf_sym__type (sym) ==STT_NOTYPE && sym->st_name !=0 && sym->st_shndx !=SHN_UNDEF && - sym->st_shndx !=SHN_ABS ; + sym->st_shndx !=SHN_ABS && +elf_sym__visibility (sym) !=STV_HIDDEN && +elf_sym__visibility (sym) !=STV_INTERNAL ; }static bool elf_sym__is_a (GElf_Sym *sym,enum map_type type)
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 111/230 MIPS: Remove function size check in get_frame_info()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2b424cfc69728224fcb5fad138ea7260728e0901 ]
Patch (b6c7a324df37b "MIPS: Fix get_frame_info() handling of microMIPS function size.") introduces additional function size check for microMIPS by only checking insn between ip and ip + func_size. However, func_size in get_frame_info() is always 0 if KALLSYMS is not enabled. This causes get_frame_info() to return immediately without calculating correct frame_size, which in turn causes "Can't analyze schedule() prologue" warning messages at boot time.
This patch removes func_size check, and let the frame_size check run up to 128 insns for both MIPS and microMIPS.
--- arch/mips/kernel/process.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/mips/kernel/process.c +3 -4
@@ -339,7 +339,7 @@ static inline int is_sp_move_ins(union mips_instruction *ip)static int get_frame_info (struct mips_frame_info *info) {bool is_mmips =IS_ENABLED (CONFIG_CPU_MICROMIPS ); -union mips_instruction insn, *ip, *ip_end; +union mips_instruction insn, *ip;const unsigned int max_insns =128 ;unsigned int last_insn_size =0 ;unsigned int i;
@@ -351,10 +351,9 @@ static int get_frame_info(struct mips_frame_info *info)if (!ip) goto err; - ip_end = (void *)ip + info->func_size; - -for (i =0 ; i < max_insns && ip < ip_end; i++) { +for (i =0 ; i < max_insns; i++) { ip = (void *)ip + last_insn_size; +if (is_mmips &&mm_insn_16bit (ip->halfword[0 ])) { insn.halfword[0 ] =0 ; insn.halfword[1 ] = ip->halfword[0 ];
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 112/230 Input: wacom_serial4 - add support for Wacom ArtPad II tablet
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <[email protected]>
commit 44fc95e218a09d7966a9d448941fdb003f6bb69f upstream.
Tablet initially begins communicating at 9600 baud, so this command should be used to connect to the device:
$ inputattach --daemon --baud 9600 --wacom_iv /dev/ttyS0
https://github.com/linuxwacom/xf86-input-wacom/issues/40
--- drivers/input/tablet/wacom_serial4.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/input/tablet/wacom_serial4.c +2 -0
@@ -187,6 +187,7 @@ enum {MODEL_DIGITIZER_II =0x5544 ,/* UD */ MODEL_GRAPHIRE =0x4554 ,/* ET */ MODEL_PENPARTNER =0x4354 ,/* CT */ + MODEL_ARTPAD_II = 0x4B54, /* KT */ };static void wacom_handle_model_response (struct wacom *wacom)
@@ -245,6 +246,7 @@ static void wacom_handle_model_response( wacom->flags =F_HAS_STYLUS2 |F_HAS_SCROLLWHEEL ;break ; +case MODEL_ARTPAD_II :case MODEL_DIGITIZER_II : wacom->dev->name ="Wacom Digitizer II" ; wacom->dev->id.version =MODEL_DIGITIZER_II ;
Greg Kroah-Hartman
maintainerPATCH 113/230 Input: elan_i2c - add id for touchpad found in Lenovo s21e-20
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Batts <[email protected]>
commit e154ab69321ce2c54f19863d75c77b4e2dc9d365 upstream.
Lenovo s21e-20 uses ELAN0601 in its ACPI tables for the Elan touchpad.
--- drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/elan_i2c_core.c +1 -0
@@ -1241,6 +1241,7 @@ static const struct acpi_device_id elan_ { "ELAN0000", 0 }, { "ELAN0100", 0 }, { "ELAN0600", 0 }, + { "ELAN0601", 0 }, { "ELAN0602", 0 }, { "ELAN0605", 0 }, { "ELAN0608", 0 },
Greg Kroah-Hartman
maintainerPATCH 114/230 iscsi_ibft: Fix missing break in switch statement
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
commit df997abeebadaa4824271009e2d2b526a70a11cb upstream.
Add missing break statement in order to prevent the code from falling through to case ISCSI_BOOT_TGT_NAME, which is unnecessary.
This bug was found thanks to the ongoing efforts to enable -Wimplicit-fallthrough.
--- drivers/firmware/iscsi_ibft.c | 1 + 1 file changed, 1 insertion(+)
drivers/firmware/iscsi_ibft.c +1 -0
@@ -513,6 +513,7 @@ static umode_t __init ibft_check_tgt_forcase ISCSI_BOOT_TGT_NIC_ASSOC :case ISCSI_BOOT_TGT_CHAP_TYPE : rc =S_IRUGO ; +break ;case ISCSI_BOOT_TGT_NAME :if (tgt->tgt_name_len) rc =S_IRUGO ;
Greg Kroah-Hartman
maintainerPATCH 115/230 futex,rt_mutex: Restructure rt_mutex_finish_proxy_lock()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <[email protected]>
commit 38d589f2fd08f1296aea3ce62bebd185125c6d81 upstream.
With the ultimate goal of keeping rt_mutex wait_list and futex_q waiters consistent it's necessary to split 'rt_mutex_futex_lock()' into finer parts, such that only the actual blocking can be done without hb->lock held.
Split split_mutex_finish_proxy_lock() into two parts, one that does the blocking and one that does remove_waiter() when the lock acquire failed.
When the rtmutex was acquired successfully the waiter can be removed in the acquisiton path safely, since there is no concurrency on the lock owner.
This means that, except for futex_lock_pi(), all wait_list modifications are done with both hb->lock and wait_lock held.
[[email protected]: fix for futex_requeue_pi_signal_restart]
--- kernel/futex.c | 7 +++-- kernel/locking/rtmutex.c | 52 ++++++++++++++++++++++++++++++++++------ kernel/locking/rtmutex_common.h | 8 +++--- 3 files changed, 55 insertions(+), 12 deletions(-)
kernel/futex.c +5 -2
@@ -2923,10 +2923,13 @@ static int futex_wait_requeue_pi(u32 __u*/ WARN_ON (!q.pi_state); pi_mutex = &q.pi_state->pi_mutex; - ret =rt_mutex_finish_proxy_lock (pi_mutex, to, &rt_waiter); -debug_rt_mutex_free_waiter (&rt_waiter); + ret =rt_mutex_wait_proxy_lock (pi_mutex, to, &rt_waiter);spin_lock (q.lock_ptr); +if (ret && !rt_mutex_cleanup_proxy_lock (pi_mutex, &rt_waiter)) + ret =0 ; + +debug_rt_mutex_free_waiter (&rt_waiter);/* * Fixup the pi_state owner and possibly acquire the lock if we * haven't already.
kernel/locking/rtmutex.c +45 -7
78 lines not on this page · raw message
kernel/locking/rtmutex_common.h +5 -3
@@ -106,9 +106,11 @@ extern void rt_mutex_proxy_unlock(structextern int rt_mutex_start_proxy_lock (struct rt_mutex *lock,struct rt_mutex_waiter *waiter,struct task_struct *task); -extern int rt_mutex_finish_proxy_lock (struct rt_mutex *lock, -struct hrtimer_sleeper *to, -struct rt_mutex_waiter *waiter); +extern int rt_mutex_wait_proxy_lock (struct rt_mutex *lock, +struct hrtimer_sleeper *to, +struct rt_mutex_waiter *waiter); +extern bool rt_mutex_cleanup_proxy_lock (struct rt_mutex *lock, +struct rt_mutex_waiter *waiter);extern int rt_mutex_timed_futex_lock (struct rt_mutex *l,struct hrtimer_sleeper *to);extern bool rt_mutex_futex_unlock (struct rt_mutex *lock,struct wake_q_head *wqh);
Greg Kroah-Hartman
maintainerPATCH 116/230 ARM: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit a66352e005488ecb4b534ba1af58a9f671eba9b8 upstream.
Add minimal parameters needed by the Exynos CLKOUT driver to Exynos3250 PMU node. This fixes the following warning on boot:
exynos_clkout_init: failed to register clkout clock
--- arch/arm/boot/dts/exynos3250.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/exynos3250.dtsi +3 -0
@@ -150,6 +150,9 @@ interrupt-controller; #interrupt-cells = <3>; interrupt-parent = <&gic>; + clock-names = "clkout8"; + clocks = <&cmu CLK_FIN_PLL>; + #clock-cells = <1>; }; mipi_phy: video-phy@10020710 {
Greg Kroah-Hartman
maintainerPATCH 117/230 Revert "x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls"
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 7212e37cbdf99f48e4a6c689a42f4bda1ae69001.
Hedi Berriche <[email protected]> notes:
Quoted 6 lines
In 4.4-stable
efi_runtime_lockas defined indrivers/firmware/efi/runtime-wrappers.cis a spinlock (given it predates commitdce48e351c0d) and commit
f331e766c4bex86/platform/UV: Useefi_runtime_lockto serialise BIOS callswhich
7212e37cbdf9is a backport of, needs it to be a semaphore.
--- arch/x86/include/asm/uv/bios.h | 8 +------- arch/x86/platform/uv/bios_uv.c | 23 ++--------------------- drivers/firmware/efi/runtime-wrappers.c | 7 ------- 3 files changed, 3 insertions(+), 35 deletions(-)
arch/x86/include/asm/uv/bios.h +1 -7
@@ -48,8 +48,7 @@ enum {BIOS_STATUS_SUCCESS =0 ,BIOS_STATUS_UNIMPLEMENTED = -ENOSYS ,BIOS_STATUS_EINVAL = -EINVAL , -BIOS_STATUS_UNAVAIL = -EBUSY , - BIOS_STATUS_ABORT = -EINTR, + BIOS_STATUS_UNAVAIL = -EBUSY };/*
@@ -112,9 +111,4 @@ extern long system_serial_number;extern struct kobject *sgi_uv_kobj;/* /sys/firmware/sgi_uv */ -/* -* EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details -*/ -extern struct semaphore __efi_uv_runtime_lock; -#endif /* _ASM_X86_UV_BIOS_H */
arch/x86/platform/uv/bios_uv.c +2 -21
@@ -28,8 +28,7 @@static struct uv_systab uv_systab; -static s64 __uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3, -u64 a4,u64 a5) +s64 uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3,u64 a4,u64 a5) {struct uv_systab *tab = &uv_systab;s64 ret;
@@ -44,19 +43,6 @@ static s64 __uv_bios_call(enum uv_bios_c a1, a2, a3, a4, a5);return ret; } - -s64 uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3,u64 a4,u64 a5) -{ -s64 ret; - -if (down_interruptible (&__efi_uv_runtime_lock)) -return BIOS_STATUS_ABORT ; - - ret =__uv_bios_call (which, a1, a2, a3, a4, a5); -up (&__efi_uv_runtime_lock); - -return ret; -}EXPORT_SYMBOL_GPL (uv_bios_call); s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
@@ -65,15 +51,10 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmunsigned long bios_flags;s64 ret; -if (down_interruptible (&__efi_uv_runtime_lock)) -return BIOS_STATUS_ABORT ; -local_irq_save (bios_flags); - ret =__uv_bios_call (which, a1, a2, a3, a4, a5); + ret =uv_bios_call (which, a1, a2, a3, a4, a5);local_irq_restore (bios_flags); -up (&__efi_uv_runtime_lock); -return ret; }
drivers/firmware/efi/runtime-wrappers.c +0 -7
@@ -88,13 +88,6 @@ static DEFINE_SPINLOCK(efi_runtime_lock)*/ /* -* Expose the EFI runtime lock to the UV platform -*/ -#ifdef CONFIG_X86_UV -extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); -#endif - -/* * As per commit ef68c8f87ed1 ("x86: Serialize EFI time accesses on rtc_lock"), * the EFI specification requires that callers of the time related runtime * functions serialize with other CMOS accesses in the kernel, as the EFI time
Greg Kroah-Hartman
maintainerPATCH 118/230 ARM: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 28928a3ce142b2e4e5a7a0f067cefb41a3d2c3f9 upstream.
In Odroid XU3 Lite board, the temperature levels reported for thermal zone 0 were weird. In warm room:
/sys/class/thermal/thermal_zone0/temp:32000 /sys/class/thermal/thermal_zone1/temp:51000 /sys/class/thermal/thermal_zone2/temp:55000 /sys/class/thermal/thermal_zone3/temp:54000 /sys/class/thermal/thermal_zone4/temp:51000
Sometimes after booting the value was even equal to ambient temperature which is highly unlikely to be a real temperature of sensor in SoC.
The thermal sensor's calibration (trimming) is based on fused values. In case of the board above, the fused values are: 35, 52, 43, 58 and 43 (corresponding to each TMU device). However driver defined a minimum value for fused data as 40 and for smaller values it was using a hard-coded 55 instead. This lead to mapping data from sensor to wrong temperatures for thermal zone 0.
Various vendor 3.10 trees (Hardkernel's based on Samsung LSI, Artik 10) do not impose any limits on fused values. Since we do not have any knowledge about these limits, use 0 as a minimum accepted fused value. This should essentially allow accepting any reasonable fused value thus behaving like vendor driver.
The exynos5420-tmu-sensor-conf.dtsi is copied directly from existing exynos4412 with one change - the samsung,tmu_min_efuse_value.
--- arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi | 25 ++++++++++++++++++++++ arch/arm/boot/dts/exynos5420.dtsi | 10 ++++---- 2 files changed, 30 insertions(+), 5 deletions(-)
arch/arm/boot/dts/exynos5420-tmu-sensor-conf.dtsi new file +25 -0
@@ -0,0 +1,25 @@ +/* + * Device tree sources for Exynos5420 TMU sensor configuration + * + * Copyright (c) 2014 Lukasz Majewski <[email protected]> + * Copyright (c) 2017 Krzysztof Kozlowski <[email protected]> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include <dt-bindings/thermal/thermal_exynos.h> + +#thermal-sensor-cells = <0>; +samsung,tmu_gain = <8>; +samsung,tmu_reference_voltage = <16>; +samsung,tmu_noise_cancel_mode = <4>; +samsung,tmu_efuse_value = <55>; +samsung,tmu_min_efuse_value = <0>; +samsung,tmu_max_efuse_value = <100>; +samsung,tmu_first_point_trim = <25>; +samsung,tmu_second_point_trim = <85>; +samsung,tmu_default_temp_offset = <50>; +samsung,tmu_cal_type = <TYPE_ONE_POINT_TRIMMING>;
arch/arm/boot/dts/exynos5420.dtsi +5 -5
@@ -777,7 +777,7 @@ interrupts = <0 65 0>; clocks = <&clock CLK_TMU>; clock-names = "tmu_apbif"; - #include "exynos4412-tmu-sensor-conf.dtsi" + #include "exynos5420-tmu-sensor-conf.dtsi" }; tmu_cpu1: tmu@10064000 {
@@ -786,7 +786,7 @@ interrupts = <0 183 0>; clocks = <&clock CLK_TMU>; clock-names = "tmu_apbif"; - #include "exynos4412-tmu-sensor-conf.dtsi" + #include "exynos5420-tmu-sensor-conf.dtsi" }; tmu_cpu2: tmu@10068000 {
@@ -795,7 +795,7 @@ interrupts = <0 184 0>; clocks = <&clock CLK_TMU>, <&clock CLK_TMU>; clock-names = "tmu_apbif", "tmu_triminfo_apbif"; - #include "exynos4412-tmu-sensor-conf.dtsi" + #include "exynos5420-tmu-sensor-conf.dtsi" }; tmu_cpu3: tmu@1006c000 {
@@ -804,7 +804,7 @@ interrupts = <0 185 0>; clocks = <&clock CLK_TMU>, <&clock CLK_TMU_GPU>; clock-names = "tmu_apbif", "tmu_triminfo_apbif"; - #include "exynos4412-tmu-sensor-conf.dtsi" + #include "exynos5420-tmu-sensor-conf.dtsi" }; tmu_gpu: tmu@100a0000 {
@@ -813,7 +813,7 @@ interrupts = <0 215 0>; clocks = <&clock CLK_TMU_GPU>, <&clock CLK_TMU>; clock-names = "tmu_apbif", "tmu_triminfo_apbif"; - #include "exynos4412-tmu-sensor-conf.dtsi" + #include "exynos5420-tmu-sensor-conf.dtsi" }; thermal-zones {
Greg Kroah-Hartman
maintainerPATCH 119/230 udplite: call proper backlog handlers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 30c7be26fd3587abcb69587f781098e3ca2d565b upstream.
In commits 93821778def10 ("udp: Fix rcv socket locking") and f7ad74fef3af ("net/ipv6/udp: UDP encapsulation: break backlog_rcv into __udpv6_queue_rcv_skb") UDP backlog handlers were renamed, but UDPlite was forgotten.
This leads to crashes if UDPlite header is pulled twice, which happens starting from commit e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
Bug found by syzkaller team, thanks a lot guys !
Note that backlog use in UDP/UDPlite is scheduled to be removed starting from linux-4.10, so this patch is only needed up to linux-4.9
--- net/ipv4/udp.c | 2 +- net/ipv4/udp_impl.h | 2 +- net/ipv4/udplite.c | 2 +- net/ipv6/udp.c | 2 +- net/ipv6/udp_impl.h | 2 +- net/ipv6/udplite.c | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-)
net/ipv4/udp.c +1 -1
@@ -1463,7 +1463,7 @@ static void udp_v4_rehash(struct sock *sudp_lib_rehash (sk, new_hash); } -static int __udp_queue_rcv_skb (struct sock *sk,struct sk_buff *skb) +int __udp_queue_rcv_skb (struct sock *sk,struct sk_buff *skb) {int rc;
net/ipv4/udp_impl.h +1 -1
@@ -25,7 +25,7 @@ int udp_recvmsg(struct sock *sk, struct int flags, int *addr_len);int udp_sendpage (struct sock *sk,struct page *page,int offset,size_t size,int flags); -int udp_queue_rcv_skb (struct sock *sk,struct sk_buff *skb); +int __udp_queue_rcv_skb (struct sock *sk,struct sk_buff *skb);void udp_destroy_sock (struct sock *sk);#ifdef CONFIG_PROC_FS
net/ipv4/udplite.c +1 -1
@@ -50,7 +50,7 @@ struct proto udplite_prot = { .sendmsg = udp_sendmsg, .recvmsg = udp_recvmsg, .sendpage = udp_sendpage, - .backlog_rcv = udp_queue_rcv_skb, + .backlog_rcv = __udp_queue_rcv_skb, .hash = udp_lib_hash, .unhash = udp_lib_unhash, .get_port = udp_v4_get_port,
net/ipv6/udp.c +1 -1
@@ -585,7 +585,7 @@ out:sock_put (sk); } -static int __udpv6_queue_rcv_skb (struct sock *sk,struct sk_buff *skb) +int __udpv6_queue_rcv_skb (struct sock *sk,struct sk_buff *skb) {int rc;
net/ipv6/udp_impl.h +1 -1
@@ -26,7 +26,7 @@ int compat_udpv6_getsockopt(struct sockint udpv6_sendmsg (struct sock *sk,struct msghdr *msg,size_t len);int udpv6_recvmsg (struct sock *sk,struct msghdr *msg,size_t len,int noblock,int flags,int *addr_len); -int udpv6_queue_rcv_skb (struct sock *sk,struct sk_buff *skb); +int __udpv6_queue_rcv_skb (struct sock *sk,struct sk_buff *skb);void udpv6_destroy_sock (struct sock *sk);void udp_v6_clear_sk (struct sock *sk,int size);
net/ipv6/udplite.c +1 -1
@@ -45,7 +45,7 @@ struct proto udplitev6_prot = { .getsockopt = udpv6_getsockopt, .sendmsg = udpv6_sendmsg, .recvmsg = udpv6_recvmsg, - .backlog_rcv = udpv6_queue_rcv_skb, + .backlog_rcv = __udpv6_queue_rcv_skb, .hash = udp_lib_hash, .unhash = udp_lib_unhash, .get_port = udp_v6_get_port,
Greg Kroah-Hartman
maintainerPATCH 120/230 netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
commit b301f2538759933cf9ff1f7c4f968da72e3f0757 upstream.
Make sure the table names via getsockopt GET_ENTRIES is nul-terminated in ebtables and all the x_tables variants and their respective compat code. Uncovered by KASAN.
--- net/bridge/netfilter/ebtables.c | 4 ++++ net/ipv4/netfilter/arp_tables.c | 2 ++ net/ipv4/netfilter/ip_tables.c | 2 ++ net/ipv6/netfilter/ip6_tables.c | 2 ++ 4 files changed, 10 insertions(+)
net/bridge/netfilter/ebtables.c +4 -0
@@ -1528,6 +1528,8 @@ static int do_ebt_get_ctl(struct sock *sif (copy_from_user (&tmp, user,sizeof (tmp)))return -EFAULT ; + tmp.name[sizeof (tmp.name) -1 ] ='\0' ; + t =find_table_lock (net, tmp.name, &ret, &ebt_mutex);if (!t)return ret;
@@ -2368,6 +2370,8 @@ static int compat_do_ebt_get_ctl(structif (copy_from_user (&tmp, user,sizeof (tmp)))return -EFAULT ; + tmp.name[sizeof (tmp.name) -1 ] ='\0' ; + t =find_table_lock (net, tmp.name, &ret, &ebt_mutex);if (!t)return ret;
net/ipv4/netfilter/arp_tables.c +2 -0
@@ -983,6 +983,7 @@ static int get_entries(struct net *net, sizeof(struct arpt_get_entries) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ; t =xt_find_table_lock (net,NFPROTO_ARP , get.name);if (!IS_ERR_OR_NULL (t)) {
@@ -1557,6 +1558,7 @@ static int compat_get_entries(struct net *len, sizeof(get) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ;xt_compat_lock (NFPROTO_ARP ); t =xt_find_table_lock (net,NFPROTO_ARP , get.name);
net/ipv4/netfilter/ip_tables.c +2 -0
@@ -1171,6 +1171,7 @@ get_entries(struct net *net, struct ipt_ *len, sizeof(get) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ; t =xt_find_table_lock (net,AF_INET , get.name);if (!IS_ERR_OR_NULL (t)) {
@@ -1799,6 +1800,7 @@ compat_get_entries(struct net *net, stru *len, sizeof(get) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ;xt_compat_lock (AF_INET ); t =xt_find_table_lock (net,AF_INET , get.name);
net/ipv6/netfilter/ip6_tables.c +2 -0
@@ -1182,6 +1182,7 @@ get_entries(struct net *net, struct ip6t *len, sizeof(get) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ; t =xt_find_table_lock (net,AF_INET6 , get.name);if (!IS_ERR_OR_NULL (t)) {
@@ -1800,6 +1801,7 @@ compat_get_entries(struct net *net, stru *len, sizeof(get) + get.size);return -EINVAL ; } + get.name[sizeof (get.name) -1 ] ='\0' ;xt_compat_lock (AF_INET6 ); t =xt_find_table_lock (net,AF_INET6 , get.name);
Greg Kroah-Hartman
maintainerPATCH 121/230 netfilter: nfnetlink_log: just returns error for unknown command
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ken-ichirou MATSUZAWA <[email protected]>
commit eb075954e9fde114f57adc39a9ea6d379c13f81e upstream.
This patch stops processing options for unknown command.
--- net/netfilter/nfnetlink_log.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nfnetlink_log.c +1 -1
@@ -895,7 +895,7 @@ nfulnl_recv_config(struct sock *ctnl, st goto out_put;default : ret = -ENOTSUPP ; -break ; + goto out_put; } }else if (!inst) { ret = -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 122/230 netfilter: nfnetlink_acct: validate NFACCT_FILTER parameters
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Turnbull <[email protected]>
commit 017b1b6d28c479f1ad9a7a41f775545a3e1cba35 upstream.
nfacct_filter_alloc doesn't validate the NFACCT_FILTER_MASK and NFACCT_FILTER_VALUE parameters which can trigger a NULL pointer dereference. CAP_NET_ADMIN is required to trigger the bug.
--- net/netfilter/nfnetlink_acct.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nfnetlink_acct.c +3 -0
@@ -243,6 +243,9 @@ nfacct_filter_alloc(const struct nlattrif (err <0 )return ERR_PTR (err); +if (!tb[NFACCT_FILTER_MASK ] || !tb[NFACCT_FILTER_VALUE ]) +return ERR_PTR (-EINVAL ); + filter =kzalloc (sizeof (struct nfacct_filter ),GFP_KERNEL );if (!filter)return ERR_PTR (-ENOMEM );
Greg Kroah-Hartman
maintainerPATCH 123/230 netfilter: nf_conntrack_tcp: Fix stack out of bounds when parsing TCP options
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jozsef Kadlecsik <[email protected]>
commit 644c7e48cb59cfc6988ddc7bf3d3b1ba5fe7fa9d upstream.
Baozeng Ding reported a KASAN stack out of bounds issue - it uncovered that the TCP option parsing routines in netfilter TCP connection tracking could read one byte out of the buffer of the TCP options. Therefore in the patch we check that the available data length is large enough to parse both TCP option code and size.
--- net/netfilter/nf_conntrack_proto_tcp.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/nf_conntrack_proto_tcp.c +4 -0
@@ -410,6 +410,8 @@ static void tcp_options(const struct sk_ length--;continue ;default : +if (length <2 ) +return ; opsize=*ptr++;if (opsize <2 )/* "silly options" */ return ;
@@ -470,6 +472,8 @@ static void tcp_sack(const struct sk_buf length--;continue ;default : +if (length <2 ) +return ; opsize = *ptr++;if (opsize <2 )/* "silly options" */ return ;
Greg Kroah-Hartman
maintainerPATCH 124/230 KEYS: restrict /proc/keys by credentials at open time
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 4aa68e07d845562561f5e73c04aa521376e95252 upstream.
When checking for permission to view keys whilst reading from /proc/keys, we should use the credentials with which the /proc/keys file was opened. This is because, in a classic type of exploit, it can be possible to bypass checks for the *current* credentials by passing the file descriptor to a suid program.
Following commit 34dbbcdbf633 ("Make file credentials available to the seqfile interfaces") we can finally fix it. So let's do it.
--- security/keys/proc.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
security/keys/proc.c +2 -6
@@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_filstruct keyring_search_context ctx = { .index_key = key->index_key, - .cred =current_cred (), + .cred = m->file->f_cred, .match_data.cmp = lookup_user_key_possessed, .match_data.raw_data = key, .match_data.lookup_type =KEYRING_SEARCH_LOOKUP_DIRECT ,
@@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_fil } } -/* check whether the current task is allowed to view the key (assuming -* non-possession) -* - the caller holds a spinlock, and thus the RCU read lock, making our -* access to __current_cred() safe -*/ +/* check whether the current task is allowed to view the key */ rc =key_task_permission (key_ref, ctx.cred,KEY_NEED_VIEW );if (rc <0 )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 125/230 l2tp: fix infoleak in l2tp_ip6_recvmsg()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 163d1c3d6f17556ed3c340d3789ea93be95d6c28 ]
Back in 2013 Hannes took care of most of such leaks in commit bceaa90240b6 ("inet: prevent leakage of uninitialized memory to user in recv syscalls")
But the bug in l2tp_ip6_recvmsg() has not been fixed.
syzbot report :
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 CPU: 1 PID: 10996 Comm: syz-executor362 Not tainted 5.0.0+ #11 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x173/0x1d0 lib/dump_stack.c:113 kmsan_report+0x12e/0x2a0 mm/kmsan/kmsan.c:600 kmsan_internal_check_memory+0x9f4/0xb10 mm/kmsan/kmsan.c:694 kmsan_copy_to_user+0xab/0xc0 mm/kmsan/kmsan_hooks.c:601 _copy_to_user+0x16b/0x1f0 lib/usercopy.c:32 copy_to_user include/linux/uaccess.h:174 [inline] move_addr_to_user+0x311/0x570 net/socket.c:227 ___sys_recvmsg+0xb65/0x1310 net/socket.c:2283 do_recvmmsg+0x646/0x10c0 net/socket.c:2390 __sys_recvmmsg net/socket.c:2469 [inline] __do_sys_recvmmsg net/socket.c:2492 [inline] __se_sys_recvmmsg+0x1d1/0x350 net/socket.c:2485 __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2485 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x445819 Code: e8 6c b6 02 00 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 2b 12 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f64453eddb8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 00000000006dac28 RCX: 0000000000445819 RDX: 0000000000000005 RSI: 0000000020002f80 RDI: 0000000000000003 RBP: 00000000006dac20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000006dac2c R13: 00007ffeba8f87af R14: 00007f64453ee9c0 R15: 20c49ba5e353f7cf
Local variable description: ----addr@___sys_recvmsg Variable was created at:
___sys_recvmsg+0xf6/0x1310 net/socket.c:2244 do_recvmmsg+0x646/0x10c0 net/socket.c:2390
Bytes 0-31 of 32 are uninitialized
Memory access of size 32 starts at ffff8880ae62fbb0 Data copied to user address 0000000020000000
--- net/l2tp/l2tp_ip6.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/l2tp/l2tp_ip6.c +1 -3
@@ -666,9 +666,6 @@ static int l2tp_ip6_recvmsg(struct sockif (flags &MSG_OOB ) goto out; -if (addr_len) - *addr_len =sizeof (*lsa); -if (flags &MSG_ERRQUEUE )return ipv6_recv_error (sk, msg, len, addr_len);
@@ -698,6 +695,7 @@ static int l2tp_ip6_recvmsg(struct sock lsa->l2tp_conn_id =0 ;if (ipv6_addr_type (&lsa->l2tp_addr) &IPV6_ADDR_LINKLOCAL ) lsa->l2tp_scope_id =inet6_iif (skb); + *addr_len =sizeof (*lsa); }if (np->rxopt.all)
Greg Kroah-Hartman
maintainerPATCH 126/230 net: hsr: fix memory leak in hsr_dev_finalize()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mao Wenan <[email protected]>
[ Upstream commit 6caabe7f197d3466d238f70915d65301f1716626 ]
If hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER) failed to add port, it directly returns res and forgets to free the node that allocated in hsr_create_self_node(), and forgets to delete the node->mac_list linked in hsr->self_node_db.
BUG: memory leak
unreferenced object 0xffff8881cfa0c780 (size 64):
comm "syz-executor.0", pid 2077, jiffies 4294717969 (age 2415.377s)
hex dump (first 32 bytes):
e0 c7 a0 cf 81 88 ff ff 00 02 00 00 00 00 ad de ................
00 e6 49 cd 81 88 ff ff c0 9b 87 d0 81 88 ff ff ..I.............
backtrace:
[<00000000e2ff5070>] hsr_dev_finalize+0x736/0x960 [hsr]
[<000000003ed2e597>] hsr_newlink+0x2b2/0x3e0 [hsr]
[<000000003fa8c6b6>] __rtnl_newlink+0xf1f/0x1600 net/core/rtnetlink.c:3182
[<000000001247a7ad>] rtnl_newlink+0x66/0x90 net/core/rtnetlink.c:3240
[<00000000e7d1b61d>] rtnetlink_rcv_msg+0x54e/0xb90 net/core/rtnetlink.c:5130
[<000000005556bd3a>] netlink_rcv_skb+0x129/0x340 net/netlink/af_netlink.c:2477
[<00000000741d5ee6>] netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline]
[<00000000741d5ee6>] netlink_unicast+0x49a/0x650 net/netlink/af_netlink.c:1336
[<000000009d56f9b7>] netlink_sendmsg+0x88b/0xdf0 net/netlink/af_netlink.c:1917
[<0000000046b35c59>] sock_sendmsg_nosec net/socket.c:621 [inline]
[<0000000046b35c59>] sock_sendmsg+0xc3/0x100 net/socket.c:631
[<00000000d208adc9>] __sys_sendto+0x33e/0x560 net/socket.c:1786
[<00000000b582837a>] __do_sys_sendto net/socket.c:1798 [inline]
[<00000000b582837a>] __se_sys_sendto net/socket.c:1794 [inline]
[<00000000b582837a>] __x64_sys_sendto+0xdd/0x1b0 net/socket.c:1794
[<00000000c866801d>] do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
[<00000000fea382d9>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[<00000000e01dacb3>] 0xffffffffffffffff--- net/hsr/hsr_device.c | 4 +++- net/hsr/hsr_framereg.c | 12 ++++++++++++ net/hsr/hsr_framereg.h | 1 + 3 files changed, 16 insertions(+), 1 deletion(-)
net/hsr/hsr_device.c +3 -1
@@ -477,7 +477,7 @@ int hsr_dev_finalize(struct net_device * res =hsr_add_port (hsr, hsr_dev,HSR_PT_MASTER );if (res) -return res; + goto err_add_port; res =register_netdevice (hsr_dev);if (res)
@@ -498,6 +498,8 @@ int hsr_dev_finalize(struct net_device * fail:hsr_for_each_port (hsr, port)hsr_del_port (port); +err_add_port: +hsr_del_node (&hsr->self_node_db);return res; }
net/hsr/hsr_framereg.c +12 -0
@@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_heareturn 0 ; } +void hsr_del_node (struct list_head *self_node_db) +{ +struct hsr_node *node; + +rcu_read_lock (); + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list); +rcu_read_unlock (); +if (node) { +list_del_rcu (&node->mac_list); +kfree (node); + } +}/* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA; * seq_out is used to initialize filtering of outgoing duplicate frames
net/hsr/hsr_framereg.h +1 -0
@@ -16,6 +16,7 @@struct hsr_node ; +void hsr_del_node (struct list_head *self_node_db);struct hsr_node *hsr_add_node (struct list_head *node_db,unsigned char addr[],u16 seq_out); struct hsr_node *hsr_get_node(struct list_head *node_db, struct sk_buff *skb,
Greg Kroah-Hartman
maintainerPATCH 127/230 net: sit: fix UBSAN Undefined behaviour in check_6rd
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaohe Lin <[email protected]>
[ Upstream commit a843dc4ebaecd15fca1f4d35a97210f72ea1473b ]
In func check_6rd,tunnel->ip6rd.relay_prefixlen may equal to 32,so UBSAN complain about it.
UBSAN: Undefined behaviour in net/ipv6/sit.c:781:47 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 6 PID: 20036 Comm: syz-executor.0 Not tainted 4.19.27 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xca/0x13e lib/dump_stack.c:113 ubsan_epilogue+0xe/0x81 lib/ubsan.c:159 __ubsan_handle_shift_out_of_bounds+0x293/0x2e8 lib/ubsan.c:425 check_6rd.constprop.9+0x433/0x4e0 net/ipv6/sit.c:781 try_6rd net/ipv6/sit.c:806 [inline] ipip6_tunnel_xmit net/ipv6/sit.c:866 [inline] sit_tunnel_xmit+0x141c/0x2720 net/ipv6/sit.c:1033 __netdev_start_xmit include/linux/netdevice.h:4300 [inline] netdev_start_xmit include/linux/netdevice.h:4309 [inline] xmit_one net/core/dev.c:3243 [inline] dev_hard_start_xmit+0x17c/0x780 net/core/dev.c:3259 __dev_queue_xmit+0x1656/0x2500 net/core/dev.c:3829 neigh_output include/net/neighbour.h:501 [inline] ip6_finish_output2+0xa36/0x2290 net/ipv6/ip6_output.c:120 ip6_finish_output+0x3e7/0xa20 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x1e2/0x720 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] ip6_local_out+0x99/0x170 net/ipv6/output_core.c:176 ip6_send_skb+0x9d/0x2f0 net/ipv6/ip6_output.c:1697 ip6_push_pending_frames+0xc0/0x100 net/ipv6/ip6_output.c:1717 rawv6_push_pending_frames net/ipv6/raw.c:616 [inline] rawv6_sendmsg+0x2435/0x3530 net/ipv6/raw.c:946 inet_sendmsg+0xf8/0x5c0 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xc8/0x110 net/socket.c:631 ___sys_sendmsg+0x6cf/0x890 net/socket.c:2114 __sys_sendmsg+0xf0/0x1b0 net/socket.c:2152 do_syscall_64+0xc8/0x580 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- net/ipv6/sit.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv6/sit.c +3 -2
@@ -772,8 +772,9 @@ static bool check_6rd(struct ip_tunnel * pbw0 = tunnel->ip6rd.prefixlen >>5 ; pbi0 = tunnel->ip6rd.prefixlen &0x1f ; - d = (ntohl (v6dst->s6_addr32[pbw0]) << pbi0) >> - tunnel->ip6rd.relay_prefixlen; + d = tunnel->ip6rd.relay_prefixlen <32 ? + (ntohl (v6dst->s6_addr32[pbw0]) << pbi0) >> + tunnel->ip6rd.relay_prefixlen :0 ; pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;if (pbi1 >0 )
Greg Kroah-Hartman
maintainerPATCH 128/230 net/x25: fix use-after-free in x25_device_event()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 95d6ebd53c79522bf9502dbc7e89e0d63f94dae4 ]
In case of failure x25_connect() does a x25_neigh_put(x25->neighbour) but forgets to clear x25->neighbour pointer, thus triggering use-after-free.
Since the socket is visible in x25_list, we need to hold x25_list_lock to protect the operation.
syzbot report :
BUG: KASAN: use-after-free in x25_kill_by_device net/x25/af_x25.c:217 [inline] BUG: KASAN: use-after-free in x25_device_event+0x296/0x2b0 net/x25/af_x25.c:252 Read of size 8 at addr ffff8880a030edd0 by task syz-executor003/7854 CPU: 0 PID: 7854 Comm: syz-executor003 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 x25_kill_by_device net/x25/af_x25.c:217 [inline] x25_device_event+0x296/0x2b0 net/x25/af_x25.c:252 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] __dev_notify_flags+0x1e9/0x2c0 net/core/dev.c:7607 dev_change_flags+0x10d/0x170 net/core/dev.c:7643 dev_ifsioc+0x2b0/0x940 net/core/dev_ioctl.c:237 dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:488 sock_do_ioctl+0x1bd/0x300 net/socket.c:995 sock_ioctl+0x32b/0x610 net/socket.c:1096 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4467c9 Code: e8 0c e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 5b 07 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fdbea222d98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000006dbc58 RCX: 00000000004467c9 RDX: 0000000020000340 RSI: 0000000000008914 RDI: 0000000000000003 RBP: 00000000006dbc50 R08: 00007fdbea223700 R09: 0000000000000000 R10: 00007fdbea223700 R11: 0000000000000246 R12: 00000000006dbc5c R13: 6000030030626669 R14: 0000000000000000 R15: 0000000030626669 Allocated by task 7843: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:468 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:509 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3615 kmalloc include/linux/slab.h:545 [inline] x25_link_device_up+0x46/0x3f0 net/x25/x25_link.c:249 x25_device_event+0x116/0x2b0 net/x25/af_x25.c:242 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] __dev_notify_flags+0x121/0x2c0 net/core/dev.c:7605 dev_change_flags+0x10d/0x170 net/core/dev.c:7643 dev_ifsioc+0x2b0/0x940 net/core/dev_ioctl.c:237 dev_ioctl+0x1b8/0xc70 net/core/dev_ioctl.c:488 sock_do_ioctl+0x1bd/0x300 net/socket.c:995 sock_ioctl+0x32b/0x610 net/socket.c:1096 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd6e/0x1390 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 7865: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:457 kasan_slab_free+0xe/0x10 mm/kasan/common.c:465 __cache_free mm/slab.c:3494 [inline] kfree+0xcf/0x230 mm/slab.c:3811 x25_neigh_put include/net/x25.h:253 [inline] x25_connect+0x8d8/0xde0 net/x25/af_x25.c:824 __sys_connect+0x266/0x330 net/socket.c:1685 __do_sys_connect net/socket.c:1696 [inline] __se_sys_connect net/socket.c:1693 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1693 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880a030edc0 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 16 bytes inside of 256-byte region [ffff8880a030edc0, ffff8880a030eec0) The buggy address belongs to the page: page:ffffea000280c380 count:1 mapcount:0 mapping:ffff88812c3f07c0 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002806788 ffffea00027f0188 ffff88812c3f07c0 raw: 0000000000000000 ffff8880a030e000 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected
--- net/x25/af_x25.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
net/x25/af_x25.c +5 -1
@@ -812,8 +812,12 @@ static int x25_connect(struct socket *so sock->state =SS_CONNECTED ; rc =0 ; out_put_neigh: -if (rc) +if (rc) { +read_lock_bh (&x25_list_lock);x25_neigh_put (x25->neighbour); + x25->neighbour =NULL ; +read_unlock_bh (&x25_list_lock); + } out_put_route:x25_route_put (rt); out:
Greg Kroah-Hartman
maintainerPATCH 129/230 net/x25: reset state in x25_connect()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ee74d0bd4325efb41e38affe5955f920ed973f23 ]
In case x25_connect() fails and frees the socket neighbour, we also need to undo the change done to x25->state.
Before my last bug fix, we had use-after-free so this patch fixes a latent bug.
syzbot report :
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 16137 Comm: syz-executor.1 Not tainted 5.0.0+ #117 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:x25_write_internal+0x1e8/0xdf0 net/x25/x25_subr.c:173 Code: 00 40 88 b5 e0 fe ff ff 0f 85 01 0b 00 00 48 8b 8b 80 04 00 00 48 ba 00 00 00 00 00 fc ff df 48 8d 79 1c 48 89 fe 48 c1 ee 03 <0f> b6 34 16 48 89 fa 83 e2 07 83 c2 03 40 38 f2 7c 09 40 84 f6 0f RSP: 0018:ffff888076717a08 EFLAGS: 00010207 RAX: ffff88805f2f2292 RBX: ffff8880a0ae6000 RCX: 0000000000000000 kobject: 'loop5' (0000000018d0d0ee): kobject_uevent_env RDX: dffffc0000000000 RSI: 0000000000000003 RDI: 000000000000001c RBP: ffff888076717b40 R08: ffff8880950e0580 R09: ffffed100be5e46d R10: ffffed100be5e46c R11: ffff88805f2f2363 R12: ffff888065579840 kobject: 'loop5' (0000000018d0d0ee): fill_kobj_path: path = '/devices/virtual/block/loop5' R13: 1ffff1100ece2f47 R14: 0000000000000013 R15: 0000000000000013 FS: 00007fb88cf43700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9a42a41028 CR3: 0000000087a67000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: x25_release+0xd0/0x340 net/x25/af_x25.c:658 __sock_release+0xd3/0x2b0 net/socket.c:579 sock_close+0x1b/0x30 net/socket.c:1162 __fput+0x2df/0x8d0 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x14a/0x1c0 kernel/task_work.c:113 get_signal+0x1961/0x1d50 kernel/signal.c:2388 do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457f29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fb88cf42c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: fffffffffffffe00 RBX: 0000000000000003 RCX: 0000000000457f29 RDX: 0000000000000012 RSI: 0000000020000080 RDI: 0000000000000004 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb88cf436d4 R13: 00000000004be462 R14: 00000000004cec98 R15: 00000000ffffffff Modules linked in:
--- net/x25/af_x25.c | 1 + 1 file changed, 1 insertion(+)
net/x25/af_x25.c +1 -0
@@ -817,6 +817,7 @@ out_put_neigh:x25_neigh_put (x25->neighbour); x25->neighbour =NULL ;read_unlock_bh (&x25_list_lock); + x25->state =X25_STATE_0 ; } out_put_route:x25_route_put (rt);
Greg Kroah-Hartman
maintainerPATCH 130/230 pptp: dst_release sk_dst_cache in pptp_sock_destruct
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 9417d81f4f8adfe20a12dd1fadf73a618cbd945d ]
sk_setup_caps() is called to set sk->sk_dst_cache in pptp_connect, so we have to dst_release(sk->sk_dst_cache) in pptp_sock_destruct, otherwise, the dst refcnt will leak.
It can be reproduced by this syz log:
r1 = socket$pptp(0x18, 0x1, 0x2)
bind$pptp(r1, &(0x7f0000000100)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r1, &(0x7f0000000000)={0x18, 0x2, {0x3, @remote}}, 0x1e)
Consecutive dmesg warnings will occur:
unregister_netdevice: waiting for lo to become free. Usage count = 1
v1->v2:
- use rcu_dereference_protected() instead of rcu_dereference_check(), as suggested by Eric.
--- drivers/net/ppp/pptp.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ppp/pptp.c +1 -0
@@ -577,6 +577,7 @@ static void pptp_sock_destruct(struct sopppox_unbind_sock (sk); }skb_queue_purge (&sk->sk_receive_queue); +dst_release (rcu_dereference_protected (sk->sk_dst_cache,1 )); }static int pptp_create (struct net *net,struct socket *sock,int kern)
Greg Kroah-Hartman
maintainerPATCH 131/230 ravb: Decrease TxFIFO depth of Q3 and Q2 to one
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masaru Nagai <[email protected]>
[ Upstream commit ae9819e339b451da7a86ab6fe38ecfcb6814e78a ]
Hardware has the CBS (Credit Based Shaper) which affects only Q3 and Q2. When updating the CBS settings, even if the driver does so after waiting for Tx DMA finished, there is a possibility that frame data still remains in TxFIFO.
To avoid this, decrease TxFIFO depth of Q3 and Q2 to one.
This patch has been exercised this using netperf TCP_MAERTS, TCP_STREAM and UDP_STREAM tests run on an Ebisu board. No performance change was detected, outside of noise in the tests, both in terms of throughput and CPU utilisation.
--- drivers/net/ethernet/renesas/ravb_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/renesas/ravb_main.c +1 -1
@@ -453,7 +453,7 @@ static int ravb_dmac_init(struct net_devravb_write (ndev,RCR_EFFS |RCR_ENCF |RCR_ETS0 |0x18000000 ,RCR );/* Set FIFO size */ -ravb_write (ndev,TGC_TQP_AVBMODE1 |0x00222200 ,TGC ); +ravb_write (ndev,TGC_TQP_AVBMODE1 |0x00112200 ,TGC );/* Timestamp enable */ ravb_write (ndev,TCCR_TFEN ,TCCR );
Greg Kroah-Hartman
maintainerPATCH 132/230 route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit ee60ad219f5c7c4fb2f047f88037770063ef785f ]
The race occurs in __mkroute_output() when 2 threads lookup a dst:
CPU A CPU B
find_exception()
find_exception() [fnhe expires] ip_del_fnhe() [fnhe is deleted]
rt_bind_exception()
In rt_bind_exception() it will bind a deleted fnhe with the new dst, and this dst will get no chance to be freed. It causes a dev defcnt leak and consecutive dmesg warnings:
unregister_netdevice: waiting for ethX to become free. Usage count = 1
Especially thanks Jon to identify the issue.
This patch fixes it by setting fnhe_daddr to 0 in ip_del_fnhe() to stop binding the deleted fnhe with a new dst when checking fnhe's fnhe_daddr and daddr in rt_bind_exception().
It works as both ip_del_fnhe() and rt_bind_exception() are protected by fnhe_lock and the fhne is freed by kfree_rcu().
--- net/ipv4/route.c | 4 ++++ 1 file changed, 4 insertions(+)
net/ipv4/route.c +4 -0
@@ -1604,6 +1604,10 @@ static void ip_del_fnhe(struct fib_nh *nif (fnhe->fnhe_daddr == daddr) {rcu_assign_pointer (*fnhe_p,rcu_dereference_protected ( fnhe->fnhe_next,lockdep_is_held (&fnhe_lock))); +/* set fnhe_daddr to 0 to ensure it won't bind with +* new dsts in rt_bind_exception(). +*/ + fnhe->fnhe_daddr =0 ;fnhe_flush_routes (fnhe);kfree_rcu (fnhe, rcu);break ;
Greg Kroah-Hartman
maintainerPATCH 133/230 tcp: handle inet_csk_reqsk_queue_add() failures
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <[email protected]>
[ Upstream commit 9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af ]
Commit 7716682cc58e ("tcp/dccp: fix another race at listener dismantle") let inet_csk_reqsk_queue_add() fail, and adjusted {tcp,dccp}_check_req() accordingly. However, TFO and syncookies weren't modified, thus leaking allocated resources on error.
Contrary to tcp_check_req(), in both syncookies and TFO cases, we need to drop the request socket. Also, since the child socket is created with inet_csk_clone_lock(), we have to unlock it and drop an extra reference (->sk_refcount is initially set to 2 and inet_csk_reqsk_queue_add() drops only one ref).
For TFO, we also need to revert the work done by tcp_try_fastopen() (with reqsk_fastopen_remove()).
--- net/ipv4/syncookies.c | 7 ++++++- net/ipv4/tcp_input.c | 8 +++++++- 2 files changed, 13 insertions(+), 2 deletions(-)
net/ipv4/syncookies.c +6 -1
@@ -228,7 +228,12 @@ struct sock *tcp_get_cookie_sock(structif (child) {atomic_set (&req->rsk_refcnt,1 );sock_rps_save_rxhash (child, skb); -inet_csk_reqsk_queue_add (sk, req, child); +if (!inet_csk_reqsk_queue_add (sk, req, child)) { +bh_unlock_sock (child); +sock_put (child); + child =NULL ; +reqsk_put (req); + } }else {reqsk_free (req); }
net/ipv4/tcp_input.c +7 -1
@@ -6409,7 +6409,13 @@ int tcp_conn_request(struct request_sock af_ops->send_synack (fastopen_sk, dst, &fl, req, &foc, false);/* Add the child socket directly into the accept queue */ -inet_csk_reqsk_queue_add (sk, req, fastopen_sk); +if (!inet_csk_reqsk_queue_add (sk, req, fastopen_sk)) { +reqsk_fastopen_remove (fastopen_sk, req, false); +bh_unlock_sock (fastopen_sk); +sock_put (fastopen_sk); +reqsk_put (req); + goto drop; + } sk->sk_data_ready (sk);bh_unlock_sock (fastopen_sk);sock_put (fastopen_sk);
Greg Kroah-Hartman
maintainerPATCH 134/230 net/mlx4_core: Fix reset flow when in command polling mode
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <[email protected]>
[ Upstream commit e15ce4b8d11227007577e6dc1364d288b8874fbe ]
As part of unloading a device, the driver switches from FW command event mode to FW command polling mode.
Part of switching over to polling mode is freeing the command context array memory (unfortunately, currently, without NULLing the command context array pointer).
The reset flow calls "complete" to complete all outstanding fw commands (if we are in event mode). The check for event vs. polling mode here is to test if the command context array pointer is NULL.
If the reset flow is activated after the switch to polling mode, it will attempt (incorrectly) to complete all the commands in the context array -- because the pointer was not NULLed when the driver switched over to polling mode.
As a result, we have a use-after-free situation, which results in a kernel crash.
For example:
BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff876c4a8e>] __wake_up_common+0x2e/0x90 PGD 0 Oops: 0000 [#1] SMP Modules linked in: netconsole nfsv3 nfs_acl nfs lockd grace ... CPU: 2 PID: 940 Comm: kworker/2:3 Kdump: loaded Not tainted 3.10.0-862.el7.x86_64 #1 Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS 090006 04/28/2016 Workqueue: events hv_eject_device_work [pci_hyperv] task: ffff8d1734ca0fd0 ti: ffff8d17354bc000 task.ti: ffff8d17354bc000 RIP: 0010:[<ffffffff876c4a8e>] [<ffffffff876c4a8e>] __wake_up_common+0x2e/0x90 RSP: 0018:ffff8d17354bfa38 EFLAGS: 00010082 RAX: 0000000000000000 RBX: ffff8d17362d42c8 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8d17362d42c8 RBP: ffff8d17354bfa70 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000298 R11: ffff8d173610e000 R12: ffff8d17362d42d0 R13: 0000000000000246 R14: 0000000000000000 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8d1802680000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000f16d8000 CR4: 00000000001406e0 Call Trace: [<ffffffff876c7adc>] complete+0x3c/0x50 [<ffffffffc04242f0>] mlx4_cmd_wake_completions+0x70/0x90 [mlx4_core] [<ffffffffc041e7b1>] mlx4_enter_error_state+0xe1/0x380 [mlx4_core] [<ffffffffc041fa4b>] mlx4_comm_cmd+0x29b/0x360 [mlx4_core] [<ffffffffc041ff51>] __mlx4_cmd+0x441/0x920 [mlx4_core] [<ffffffff877f62b1>] ? __slab_free+0x81/0x2f0 [<ffffffff87951384>] ? __radix_tree_lookup+0x84/0xf0 [<ffffffffc043a8eb>] mlx4_free_mtt_range+0x5b/0xb0 [mlx4_core] [<ffffffffc043a957>] mlx4_mtt_cleanup+0x17/0x20 [mlx4_core] [<ffffffffc04272c7>] mlx4_free_eq+0xa7/0x1c0 [mlx4_core] [<ffffffffc042803e>] mlx4_cleanup_eq_table+0xde/0x130 [mlx4_core] [<ffffffffc0433e08>] mlx4_unload_one+0x118/0x300 [mlx4_core] [<ffffffffc0434191>] mlx4_remove_one+0x91/0x1f0 [mlx4_core]
The fix is to set the command context array pointer to NULL after freeing the array.
--- drivers/net/ethernet/mellanox/mlx4/cmd.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/mellanox/mlx4/cmd.c +1 -0
@@ -2636,6 +2636,7 @@ void mlx4_cmd_use_polling(struct mlx4_dedown (&priv->cmd.event_sem);kfree (priv->cmd.context); + priv->cmd.context =NULL ;up (&priv->cmd.poll_sem); }
Greg Kroah-Hartman
maintainerPATCH 135/230 net/mlx4_core: Fix qp mtt size calculation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jack Morgenstein <[email protected]>
[ Upstream commit 8511a653e9250ef36b95803c375a7be0e2edb628 ]
Calculation of qp mtt size (in function mlx4_RST2INIT_wrapper) ultimately depends on function roundup_pow_of_two.
If the amount of memory required by the QP is less than one page, roundup_pow_of_two is called with argument zero. In this case, the roundup_pow_of_two result is undefined.
Calling roundup_pow_of_two with a zero argument resulted in the following stack trace:
UBSAN: Undefined behaviour in ./include/linux/log2.h:61:13 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 4 PID: 26939 Comm: rping Tainted: G OE 4.19.0-rc1 Hardware name: Supermicro X9DR3-F/X9DR3-F, BIOS 3.2a 07/09/2015 Call Trace: dump_stack+0x9a/0xeb ubsan_epilogue+0x9/0x7c __ubsan_handle_shift_out_of_bounds+0x254/0x29d ? __ubsan_handle_load_invalid_value+0x180/0x180 ? debug_show_all_locks+0x310/0x310 ? sched_clock+0x5/0x10 ? sched_clock+0x5/0x10 ? sched_clock_cpu+0x18/0x260 ? find_held_lock+0x35/0x1e0 ? mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core] mlx4_RST2INIT_QP_wrapper+0xfb1/0x1440 [mlx4_core]
Fix this by explicitly testing for zero, and returning one if the argument is zero (assuming that the next higher power of 2 in this case should be one).
--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +3 -3
@@ -2652,13 +2652,13 @@ static int qp_get_mtt_size(struct mlx4_qint total_pages;int total_mem;int page_offset = (be32_to_cpu (qpc->params2) >>6 ) &0x3f ; +int tot; sq_size =1 << (log_sq_size + log_sq_sride +4 ); rq_size = (srq|rss|xrc) ?0 : (1 << (log_rq_size + log_rq_stride +4 )); total_mem = sq_size + rq_size; - total_pages = -roundup_pow_of_two ((total_mem + (page_offset <<6 )) >> - page_shift); + tot = (total_mem + (page_offset <<6 )) >> page_shift; + total_pages = !tot ?1 :roundup_pow_of_two (tot);return total_pages; }
Greg Kroah-Hartman
maintainerPATCH 136/230 net/x25: fix a race in x25_bind()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 797a22bd5298c2674d927893f46cadf619dad11d ]
syzbot was able to trigger another soft lockup [1]
I first thought it was the O(N^2) issue I mentioned in my prior fix (f657d22ee1f "net/x25: do not hold the cpu too long in x25_new_lci()"), but I eventually found that x25_bind() was not checking SOCK_ZAPPED state under socket lock protection.
This means that multiple threads can end up calling x25_insert_socket() for the same socket, and corrupt x25_list
[1]
watchdog: BUG: soft lockup - CPU#0 stuck for 123s! [syz-executor.2:10492] Modules linked in: irq event stamp: 27515 hardirqs last enabled at (27514): [<ffffffff81006673>] trace_hardirqs_on_thunk+0x1a/0x1c hardirqs last disabled at (27515): [<ffffffff8100668f>] trace_hardirqs_off_thunk+0x1a/0x1c softirqs last enabled at (32): [<ffffffff8632ee73>] x25_get_neigh+0xa3/0xd0 net/x25/x25_link.c:336 softirqs last disabled at (34): [<ffffffff86324bc3>] x25_find_socket+0x23/0x140 net/x25/af_x25.c:341 CPU: 0 PID: 10492 Comm: syz-executor.2 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__sanitizer_cov_trace_pc+0x4/0x50 kernel/kcov.c:97 Code: f4 ff ff ff e8 11 9f ea ff 48 c7 05 12 fb e5 08 00 00 00 00 e9 c8 e9 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 <48> 8b 75 08 65 48 8b 04 25 40 ee 01 00 65 8b 15 38 0c 92 7e 81 e2 RSP: 0018:ffff88806e94fc48 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1100d84dac5 RBX: 0000000000000001 RCX: ffffc90006197000 RDX: 0000000000040000 RSI: ffffffff86324bf3 RDI: ffff88806c26d628 RBP: ffff88806e94fc48 R08: ffff88806c1c6500 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: ffff88806c26d628 R13: ffff888090455200 R14: dffffc0000000000 R15: 0000000000000000 FS: 00007f3a107e4700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f3a107e3db8 CR3: 00000000a5544000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __x25_find_socket net/x25/af_x25.c:327 [inline] x25_find_socket+0x7d/0x140 net/x25/af_x25.c:342 x25_new_lci net/x25/af_x25.c:355 [inline] x25_connect+0x380/0xde0 net/x25/af_x25.c:784 __sys_connect+0x266/0x330 net/socket.c:1662 __do_sys_connect net/socket.c:1673 [inline] __se_sys_connect net/socket.c:1670 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1670 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3a107e3c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 RDX: 0000000000000012 RSI: 0000000020000200 RDI: 0000000000000005 RBP: 000000000073c040 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3a107e46d4 R13: 00000000004be362 R14: 00000000004ceb98 R15: 00000000ffffffff Sending NMI from CPU 0 to CPUs 1: NMI backtrace for cpu 1 CPU: 1 PID: 10493 Comm: syz-executor.3 Not tainted 5.0.0-rc7+ #88 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__read_once_size include/linux/compiler.h:193 [inline] RIP: 0010:queued_write_lock_slowpath+0x143/0x290 kernel/locking/qrwlock.c:86 Code: 4c 8d 2c 01 41 83 c7 03 41 0f b6 45 00 41 38 c7 7c 08 84 c0 0f 85 0c 01 00 00 8b 03 3d 00 01 00 00 74 1a f3 90 41 0f b6 55 00 <41> 38 d7 7c eb 84 d2 74 e7 48 89 df e8 cc aa 4e 00 eb dd be 04 00 RSP: 0018:ffff888085c47bd8 EFLAGS: 00000206 RAX: 0000000000000300 RBX: ffffffff89412b00 RCX: 1ffffffff1282560 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffff89412b00 RBP: ffff888085c47c70 R08: 1ffffffff1282560 R09: fffffbfff1282561 R10: fffffbfff1282560 R11: ffffffff89412b03 R12: 00000000000000ff R13: fffffbfff1282560 R14: 1ffff11010b88f7d R15: 0000000000000003 FS: 00007fdd04086700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdd04064db8 CR3: 0000000090be0000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: queued_write_lock include/asm-generic/qrwlock.h:104 [inline] do_raw_write_lock+0x1d6/0x290 kernel/locking/spinlock_debug.c:203 __raw_write_lock_bh include/linux/rwlock_api_smp.h:204 [inline] _raw_write_lock_bh+0x3b/0x50 kernel/locking/spinlock.c:312 x25_insert_socket+0x21/0xe0 net/x25/af_x25.c:267 x25_bind+0x273/0x340 net/x25/af_x25.c:703 __sys_bind+0x23f/0x290 net/socket.c:1481 __do_sys_bind net/socket.c:1492 [inline] __se_sys_bind net/socket.c:1490 [inline] __x64_sys_bind+0x73/0xb0 net/socket.c:1490 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457e29
--- net/x25/af_x25.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
net/x25/af_x25.c +8 -5
@@ -678,8 +678,7 @@ static int x25_bind(struct socket *sock,struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;int len, i, rc =0 ; -if (!sock_flag (sk,SOCK_ZAPPED ) || - addr_len !=sizeof (struct sockaddr_x25 ) || +if (addr_len !=sizeof (struct sockaddr_x25 ) || addr->sx25_family !=AF_X25 ) { rc = -EINVAL ; goto out;
@@ -694,9 +693,13 @@ static int x25_bind(struct socket *sock, }lock_sock (sk); -x25_sk (sk)->source_addr = addr->sx25_addr; -x25_insert_socket (sk); -sock_reset_flag (sk,SOCK_ZAPPED ); +if (sock_flag (sk,SOCK_ZAPPED )) { +x25_sk (sk)->source_addr = addr->sx25_addr; +x25_insert_socket (sk); +sock_reset_flag (sk,SOCK_ZAPPED ); + }else { + rc = -EINVAL ; + }release_sock (sk);SOCK_DEBUG (sk,"x25_bind: socket is bound\n" ); out:
Greg Kroah-Hartman
maintainerPATCH 137/230 mdio_bus: Fix use-after-free on device_register fails
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: YueHaibing <[email protected]>
[ Upstream commit 6ff7b060535e87c2ae14dd8548512abfdda528fb ]
KASAN has found use-after-free in fixed_mdio_bus_init, commit 0c692d07842a ("drivers/net/phy/mdio_bus.c: call put_device on device_register() failure") call put_device() while device_register() fails,give up the last reference to the device and allow mdiobus_release to be executed ,kfreeing the bus. However in most drives, mdiobus_free be called to free the bus while mdiobus_register fails. use-after-free occurs when access bus again, this patch revert it to let mdiobus_free free the bus.
KASAN report details as below:
BUG: KASAN: use-after-free in mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482
Read of size 4 at addr ffff8881dc824d78 by task syz-executor.0/3524
CPU: 1 PID: 3524 Comm: syz-executor.0 Not tainted 5.0.0-rc7+ #45
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1ubuntu1 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xfa/0x1ce lib/dump_stack.c:113
print_address_description+0x65/0x270 mm/kasan/report.c:187
kasan_report+0x149/0x18d mm/kasan/report.c:317
mdiobus_free+0x85/0x90 drivers/net/phy/mdio_bus.c:482
fixed_mdio_bus_init+0x283/0x1000 [fixed_phy]
? 0xffffffffc0e40000
? 0xffffffffc0e40000
? 0xffffffffc0e40000
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x462e99
Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6215c19c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000139
RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462e99
RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
RBP: 00007f6215c19c70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f6215c1a6bc
R13: 00000000004bcefb R14: 00000000006f7030 R15: 0000000000000004
Allocated by task 3524:
set_track mm/kasan/common.c:85 [inline]
__kasan_kmalloc.constprop.3+0xa0/0xd0 mm/kasan/common.c:496
kmalloc include/linux/slab.h:545 [inline]
kzalloc include/linux/slab.h:740 [inline]
mdiobus_alloc_size+0x54/0x1b0 drivers/net/phy/mdio_bus.c:143
fixed_mdio_bus_init+0x163/0x1000 [fixed_phy]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 3524:
set_track mm/kasan/common.c:85 [inline]
__kasan_slab_free+0x130/0x180 mm/kasan/common.c:458
slab_free_hook mm/slub.c:1409 [inline]
slab_free_freelist_hook mm/slub.c:1436 [inline]
slab_free mm/slub.c:2986 [inline]
kfree+0xe1/0x270 mm/slub.c:3938
device_release+0x78/0x200 drivers/base/core.c:919
kobject_cleanup lib/kobject.c:662 [inline]
kobject_release lib/kobject.c:691 [inline]
kref_put include/linux/kref.h:67 [inline]
kobject_put+0x146/0x240 lib/kobject.c:708
put_device+0x1c/0x30 drivers/base/core.c:2060
__mdiobus_register+0x483/0x560 drivers/net/phy/mdio_bus.c:382
fixed_mdio_bus_init+0x26b/0x1000 [fixed_phy]
do_one_initcall+0xfa/0x5ca init/main.c:887
do_init_module+0x204/0x5f6 kernel/module.c:3460
load_module+0x66b2/0x8570 kernel/module.c:3808
__do_sys_finit_module+0x238/0x2a0 kernel/module.c:3902
do_syscall_64+0x147/0x600 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8881dc824c80
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 248 bytes inside of
2048-byte region [ffff8881dc824c80, ffff8881dc825480)
The buggy address belongs to the page:
page:ffffea0007720800 count:1 mapcount:0 mapping:ffff8881f6c02800 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000010200(slab|head)
raw: 02fffc0000010200 0000000000000000 0000000500000001 ffff8881f6c02800
raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881dc824c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8881dc824c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881dc824d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881dc824d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881dc824e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- drivers/net/phy/mdio_bus.c | 1 - 1 file changed, 1 deletion(-)
drivers/net/phy/mdio_bus.c +0 -1
@@ -267,7 +267,6 @@ int __mdiobus_register(struct mii_bus *b err =device_register (&bus->dev);if (err) {pr_err ("mii_bus %s failed to register\n" , bus->id); -put_device (&bus->dev);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 138/230 net: Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kalash Nainwal <[email protected]>
[ Upstream commit 97f0082a0592212fc15d4680f5a4d80f79a1687c ]
Set rtm_table to RT_TABLE_COMPAT for ipv6 for tables > 255 to keep legacy software happy. This is similar to what was done for ipv4 in commit 709772e6e065 ("net: Fix routing tables with id > 255 for legacy software").
--- net/ipv6/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv6/route.c +1 -1
@@ -3095,7 +3095,7 @@ static int rt6_fill_node(struct net *net table = rt->rt6i_table->tb6_id; else table =RT6_TABLE_UNSPEC ; - rtm->rtm_table = table; + rtm->rtm_table = table <256 ? table :RT_TABLE_COMPAT ;if (nla_put_u32 (skb,RTA_TABLE , table)) goto nla_put_failure;if (rt->rt6i_flags &RTF_REJECT ) {
Greg Kroah-Hartman
maintainerPATCH 139/230 missing barriers in some of unix_sock ->addr and ->path accesses
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
[ Upstream commit ae3b564179bfd06f32d051b9e5d72ce4b2a07c37 ]
Several u->addr and u->path users are not holding any locks in common with unix_bind(). unix_state_lock() is useless for those purposes.
u->addr is assign-once and *(u->addr) is fully set up by the time we set u->addr (all under unix_table_lock). u->path is also set in the same critical area, also before setting u->addr, and any unix_sock with ->path filled will have non-NULL ->addr.
So setting ->addr with smp_store_release() is all we need for those "lockless" users - just have them fetch ->addr with smp_load_acquire() and don't even bother looking at ->path if they see NULL ->addr.
Users of ->addr and ->path fall into several classes now:
1) ones that do smp_load_acquire(u->addr) and access *(u->addr)
and u->path only if smp_load_acquire() has returned non-NULL.
2) places holding unix_table_lock. These are guaranteed that
*(u->addr) is seen fully initialized. If unix_sock is in one of the "bound" chains, so's ->path.
3) unix_sock_destructor() using ->addr is safe. All places
that set u->addr are guaranteed to have seen all stores *(u->addr) while holding a reference to u and unix_sock_destructor() is called when (atomic) refcount hits zero.
4) unix_release_sock() using ->path is safe. unix_bind()
is serialized wrt unix_release() (normally - by struct file refcount), and for the instances that had ->path set by unix_bind() unix_release_sock() comes from unix_release(), so they are fine. Instances that had it set in unix_stream_connect() either end up attached to a socket (in unix_accept()), in which case the call chain to unix_release_sock() and serialization are the same as in the previous case, or they never get accept'ed and unix_release_sock() is called when the listener is shut down and its queue gets purged. In that case the listener's queue lock provides the barriers needed - unix_stream_connect() shoves our unix_sock into listener's queue under that lock right after having set ->path and eventual unix_release_sock() caller picks them from that queue under the same lock right before calling unix_release_sock().
5) unix_find_other() use of ->path is pointless, but safe -
it happens with successful lookup by (abstract) name, so ->path.dentry is guaranteed to be NULL there.
--- net/unix/af_unix.c | 48 +++++++++++++++++++++++++++++------------------- net/unix/diag.c | 3 ++- security/lsm_audit.c | 10 ++++++---- 3 files changed, 37 insertions(+), 24 deletions(-)
net/unix/af_unix.c +29 -19
@@ -890,7 +890,7 @@ retry: addr->hash ^= sk->sk_type;__unix_remove_socket (sk); - u->addr = addr; +smp_store_release (&u->addr, addr);__unix_insert_socket (&unix_socket_table[addr->hash], sk);spin_unlock (&unix_table_lock); err =0 ;
@@ -1060,7 +1060,7 @@ static int unix_bind(struct socket *sock err =0 ;__unix_remove_socket (sk); - u->addr = addr; +smp_store_release (&u->addr, addr);__unix_insert_socket (list, sk); out_unlock:
@@ -1331,15 +1331,29 @@ restart:RCU_INIT_POINTER (newsk->sk_wq, &newu->peer_wq); otheru =unix_sk (other); -/* copy address information from listening to new sock*/ -if (otheru->addr) { -atomic_inc (&otheru->addr->refcnt); - newu->addr = otheru->addr; - } +/* copy address information from listening to new sock +* +* The contents of *(otheru->addr) and otheru->path +* are seen fully set up here, since we have found +* otheru in hash under unix_table_lock. Insertion +* into the hash chain we'd found it in had been done +* in an earlier critical area protected by unix_table_lock, +* the same one where we'd set *(otheru->addr) contents, +* as well as otheru->path and otheru->addr itself. +* +* Using smp_store_release() here to set newu->addr +* is enough to make those stores, as well as stores +* to newu->path visible to anyone who gets newu->addr +* by smp_load_acquire(). IOW, the same warranties +* as for unix_sock instances bound in unix_bind() or +* in unix_autobind(). +*/ if (otheru->path.dentry) {path_get (&otheru->path); newu->path = otheru->path; } +atomic_inc (&otheru->addr->refcnt); +smp_store_release (&newu->addr, otheru->addr);/* Set credentials */ copy_peercred (sk, other);
@@ -1452,7 +1466,7 @@ out:static int unix_getname (struct socket *sock,struct sockaddr *uaddr,int *uaddr_len,int peer) {struct sock *sk = sock->sk; -struct unix_sock *u; +struct unix_address *addr; DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);int err =0 ;
@@ -1467,19 +1481,15 @@ static int unix_getname(struct socket *ssock_hold (sk); } - u =unix_sk (sk); -unix_state_lock (sk); -if (!u->addr) { + addr =smp_load_acquire (&unix_sk (sk)->addr); +if (!addr) { sunaddr->sun_family =AF_UNIX ; sunaddr->sun_path[0 ] =0 ; *uaddr_len =sizeof (short ); }else { -struct unix_address *addr = u->addr; - *uaddr_len = addr->len;memcpy (sunaddr, addr->name, *uaddr_len); } -unix_state_unlock (sk);sock_put (sk); out:return err;
@@ -2093,11 +2103,11 @@ static int unix_seqpacket_recvmsg(structstatic void unix_copy_addr (struct msghdr *msg,struct sock *sk) { -struct unix_sock *u =unix_sk (sk); +struct unix_address *addr =smp_load_acquire (&unix_sk (sk)->addr); -if (u->addr) { - msg->msg_namelen = u->addr->len; -memcpy (msg->msg_name, u->addr->name, u->addr->len); +if (addr) { + msg->msg_namelen = addr->len; +memcpy (msg->msg_name, addr->name, addr->len); } }
@@ -2820,7 +2830,7 @@ static int unix_seq_show(struct seq_file (s->sk_state ==TCP_ESTABLISHED ?SS_CONNECTING :SS_DISCONNECTING ), sock_i_ino(s)); -if (u->addr) { +if (u->addr) {// under unix_table_lock here int i, len;seq_putc (seq,' ' );
net/unix/diag.c +2 -1
@@ -10,7 +10,8 @@static int sk_diag_dump_name (struct sock *sk,struct sk_buff *nlskb) { -struct unix_address *addr =unix_sk (sk)->addr; +/* might or might not have unix_table_lock */ +struct unix_address *addr =smp_load_acquire (&unix_sk (sk)->addr);if (!addr)return 0 ;
security/lsm_audit.c +6 -4
@@ -308,6 +308,7 @@ static void dump_common_audit_data(strucif (a->u.net->sk) {struct sock *sk = a->u.net->sk;struct unix_sock *u; +struct unix_address *addr;int len =0 ;char *p =NULL ;
@@ -338,14 +339,15 @@ static void dump_common_audit_data(struc#endif case AF_UNIX : u =unix_sk (sk); + addr =smp_load_acquire (&u->addr); +if (!addr) +break ;if (u->path.dentry) {audit_log_d_path (ab," path=" , &u->path);break ; } -if (!u->addr) -break ; - len = u->addr->len-sizeof (short ); - p = &u->addr->name->sun_path[0 ]; + len = addr->len-sizeof (short ); + p = &addr->name->sun_path[0 ];audit_log_format (ab," path=" );if (*p)audit_log_untrustedstring (ab, p);
Greg Kroah-Hartman
maintainerPATCH 140/230 ipvlan: disallow userns cap_net_admin to change global mode/flags
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <[email protected]>
[ Upstream commit 7cc9f7003a969d359f608ebb701d42cafe75b84a ]
When running Docker with userns isolation e.g. --userns-remap="default" and spawning up some containers with CAP_NET_ADMIN under this realm, I noticed that link changes on ipvlan slave device inside that container can affect all devices from this ipvlan group which are in other net namespaces where the container should have no permission to make changes to, such as the init netns, for example.
This effectively allows to undo ipvlan private mode and switch globally to bridge mode where slaves can communicate directly without going through hostns, or it allows to switch between global operation mode (l2/l3/l3s) for everyone bound to the given ipvlan master device. libnetwork plugin here is creating an ipvlan master and ipvlan slave in hostns and a slave each that is moved into the container's netns upon creation event.
* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]* Spawn container & change ipvlan mode setting inside of it:
# docker run -dt --cap-add=NET_ADMIN --network cilium-net --name client -l app=test cilium/netperf 9fff485d69dcb5ce37c9e33ca20a11ccafc236d690105aadbfb77e4f4170879c
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l3 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever# docker exec -ti client ip link change link cilium0 name cilium0 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever* In hostns (mode switched to l2):
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]Same l3 -> l2 switch would also happen by creating another slave inside the container's network namespace when specifying the existing cilium0 link to derive the actual (bond0) master:
# docker exec -ti client ip link add link cilium0 name cilium1 type ipvlan mode l2
# docker exec -ti client ip -d a
[...]
2: cilium1@if4: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
10: cilium0@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.197.43/32 brd 10.41.197.43 scope global cilium0
valid_lft forever preferred_lft forever* In hostns:
# ip -d a
[...]
8: cilium_host@bond0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000
link/ether 0c:c4:7a:e1:3d:cc brd ff:ff:ff:ff:ff:ff promiscuity 0 minmtu 68 maxmtu 65535
ipvlan mode l2 bridge numtxqueues 1 numrxqueues 1 gso_max_size 65536 gso_max_segs 65535
inet 10.41.0.1/32 scope link cilium_host
valid_lft forever preferred_lft forever
[...]One way to mitigate it is to check CAP_NET_ADMIN permissions of the ipvlan master device's ns, and only then allow to change mode or flags for all devices bound to it. Above two cases are then disallowed after the patch.
--- drivers/net/ipvlan/ipvlan_main.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ipvlan/ipvlan_main.c +8 -1
@@ -389,7 +389,12 @@ static int ipvlan_nl_changelink(struct nstruct ipvl_dev *ipvlan =netdev_priv (dev);struct ipvl_port *port =ipvlan_port_get_rtnl (ipvlan->phy_dev); -if (data && data[IFLA_IPVLAN_MODE ]) { +if (!data) +return 0 ; +if (!ns_capable (dev_net (ipvlan->phy_dev)->user_ns,CAP_NET_ADMIN )) +return -EPERM ; + +if (data[IFLA_IPVLAN_MODE ]) {u16 nmode =nla_get_u16 (data[IFLA_IPVLAN_MODE ]);ipvlan_set_port_mode (port, nmode);
@@ -454,6 +459,8 @@ static int ipvlan_link_new(struct net *sstruct ipvl_dev *tmp =netdev_priv (phy_dev); phy_dev = tmp->phy_dev; +if (!ns_capable (dev_net (phy_dev)->user_ns,CAP_NET_ADMIN )) +return -EPERM ; }else if (!netif_is_ipvlan_port (phy_dev)) { err =ipvlan_port_create (phy_dev);if (err <0 )
Greg Kroah-Hartman
maintainerPATCH 141/230 vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 59cbf56fcd98ba2a715b6e97c4e43f773f956393 ]
Same reasons than the ones explained in commit 4179cb5a4c92 ("vxlan: test dev->flags & IFF_UP before calling netif_rx()")
netif_rx() or gro_cells_receive() must be called under a strict contract.
At device dismantle phase, core networking clears IFF_UP and flush_all_backlogs() is called after rcu grace period to make sure no incoming packet might be in a cpu backlog and still referencing the device.
A similar protocol is used for gro_cells infrastructure, as gro_cells_destroy() will be called only after a full rcu grace period is observed after IFF_UP has been cleared.
Most drivers call netif_rx() from their interrupt handler, and since the interrupts are disabled at device dismantle, netif_rx() does not have to check dev->flags & IFF_UP
Virtual drivers do not have this guarantee, and must therefore make the check themselves.
Otherwise we risk use-after-free and/or crashes.
--- drivers/net/vxlan.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/net/vxlan.c +10 -0
@@ -1229,6 +1229,14 @@ static void vxlan_rcv(struct vxlan_sock } } +rcu_read_lock (); + +if (unlikely (!(vxlan->dev->flags &IFF_UP ))) { +rcu_read_unlock (); +atomic_long_inc (&vxlan->dev->rx_dropped); + goto drop; + } + stats =this_cpu_ptr (vxlan->dev->tstats);u64_stats_update_begin (&stats->syncp); stats->rx_packets++;
@@ -1237,6 +1245,8 @@ static void vxlan_rcv(struct vxlan_sockgro_cells_receive (&vxlan->gro_cells, skb); +rcu_read_unlock (); +return ; drop:if (tun_dst)
Greg Kroah-Hartman
maintainerPATCH 142/230 vxlan: Fix GRO cells race condition between receive and link delete
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Brivio <[email protected]>
[ Upstream commit ad6c9986bcb627c7c22b8f9e9a934becc27df87c ]
If we receive a packet while deleting a VXLAN device, there's a chance vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine, except that vxlan_dellink() should never ever touch stuff that's still in use, such as the GRO cells list.
Otherwise, vxlan_rcv() crashes while queueing packets via gro_cells_receive().
Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU grace period is elapsed and nothing needs the gro_cells anymore.
This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO cells infrastructure.") originally implemented for GENEVE.
--- drivers/net/vxlan.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/vxlan.c +2 -1
@@ -2322,6 +2322,8 @@ static void vxlan_uninit(struct net_devi {struct vxlan_dev *vxlan =netdev_priv (dev); +gro_cells_destroy (&vxlan->gro_cells); +vxlan_fdb_delete_default (vxlan);free_percpu (dev->tstats);
@@ -3066,7 +3068,6 @@ static void vxlan_dellink(struct net_dev {struct vxlan_dev *vxlan =netdev_priv (dev); -gro_cells_destroy (&vxlan->gro_cells);list_del (&vxlan->next);unregister_netdevice_queue (dev, head); }
Greg Kroah-Hartman
maintainerPATCH 143/230 net/hsr: fix possible crash in add_timer()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 1e027960edfaa6a43f9ca31081729b716598112b ]
syzbot found another add_timer() issue, this time in net/hsr [1]
Let's use mod_timer() which is safe.
[1]
kernel BUG at kernel/time/timer.c:1136!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 15909 Comm: syz-executor.3 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 kobject: 'loop2' (00000000f5629718): kobject_uevent_env RIP: 0010:add_timer kernel/time/timer.c:1136 [inline] RIP: 0010:add_timer+0x654/0xbe0 kernel/time/timer.c:1134 Code: 0f 94 c5 31 ff 44 89 ee e8 09 61 0f 00 45 84 ed 0f 84 77 fd ff ff e8 bb 5f 0f 00 e8 07 10 a0 ff e9 68 fd ff ff e8 ac 5f 0f 00 <0f> 0b e8 a5 5f 0f 00 0f 0b e8 9e 5f 0f 00 4c 89 b5 58 ff ff ff e9 RSP: 0018:ffff8880656eeca0 EFLAGS: 00010246 kobject: 'loop2' (00000000f5629718): fill_kobj_path: path = '/devices/virtual/block/loop2' RAX: 0000000000040000 RBX: 1ffff1100caddd9a RCX: ffffc9000c436000 RDX: 0000000000040000 RSI: ffffffff816056c4 RDI: ffff88806a2f6cc8 RBP: ffff8880656eed58 R08: ffff888067f4a300 R09: ffff888067f4abc8 R10: 0000000000000000 R11: 0000000000000000 R12: ffff88806a2f6cc0 R13: dffffc0000000000 R14: 0000000000000001 R15: ffff8880656eed30 FS: 00007fc2019bf700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000738000 CR3: 0000000067e8e000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: hsr_check_announce net/hsr/hsr_device.c:99 [inline] hsr_check_carrier_and_operstate+0x567/0x6f0 net/hsr/hsr_device.c:120 hsr_netdev_notify+0x297/0xa00 net/hsr/hsr_main.c:51 notifier_call_chain+0xc7/0x240 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2e/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1739 call_netdevice_notifiers_extack net/core/dev.c:1751 [inline] call_netdevice_notifiers net/core/dev.c:1765 [inline] dev_open net/core/dev.c:1436 [inline] dev_open+0x143/0x160 net/core/dev.c:1424 team_port_add drivers/net/team/team.c:1203 [inline] team_add_slave+0xa07/0x15d0 drivers/net/team/team.c:1933 do_set_master net/core/rtnetlink.c:2358 [inline] do_set_master+0x1d4/0x230 net/core/rtnetlink.c:2332 do_setlink+0x966/0x3510 net/core/rtnetlink.c:2493 rtnl_setlink+0x271/0x3b0 net/core/rtnetlink.c:2747 rtnetlink_rcv_msg+0x465/0xb00 net/core/rtnetlink.c:5192 netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2485 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5210 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1336 netlink_sendmsg+0x8ae/0xd70 net/netlink/af_netlink.c:1925 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xdd/0x130 net/socket.c:632 sock_write_iter+0x27c/0x3e0 net/socket.c:923 call_write_iter include/linux/fs.h:1869 [inline] do_iter_readv_writev+0x5e0/0x8e0 fs/read_write.c:680 do_iter_write fs/read_write.c:956 [inline] do_iter_write+0x184/0x610 fs/read_write.c:937 vfs_writev+0x1b3/0x2f0 fs/read_write.c:1001 do_writev+0xf6/0x290 fs/read_write.c:1036 __do_sys_writev fs/read_write.c:1109 [inline] __se_sys_writev fs/read_write.c:1106 [inline] __x64_sys_writev+0x75/0xb0 fs/read_write.c:1106 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457f29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fc2019bec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457f29 RDX: 0000000000000001 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fc2019bf6d4 R13: 00000000004c4a60 R14: 00000000004dd218 R15: 00000000ffffffff
--- net/hsr/hsr_device.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
net/hsr/hsr_device.c +6 -8
@@ -93,9 +93,8 @@ static void hsr_check_announce(struct neif ((hsr_dev->operstate ==IF_OPER_UP ) && (old_operstate !=IF_OPER_UP )) {/* Went up */ hsr->announce_count =0 ; - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL ); -add_timer (&hsr->announce_timer); +mod_timer (&hsr->announce_timer, + jiffies +msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL )); }if ((hsr_dev->operstate !=IF_OPER_UP ) && (old_operstate ==IF_OPER_UP ))
@@ -323,6 +322,7 @@ static void hsr_announce(unsigned long d {struct hsr_priv *hsr;struct hsr_port *master; +unsigned long interval; hsr = (struct hsr_priv *) data;
@@ -337,14 +337,12 @@ static void hsr_announce(unsigned long d }if (hsr->announce_count <3 ) - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL ); + interval =msecs_to_jiffies (HSR_ANNOUNCE_INTERVAL );else - hsr->announce_timer.expires = jiffies + -msecs_to_jiffies (HSR_LIFE_CHECK_INTERVAL ); + interval =msecs_to_jiffies (HSR_LIFE_CHECK_INTERVAL );if (is_admin_up (master->dev)) -add_timer (&hsr->announce_timer); +mod_timer (&hsr->announce_timer, jiffies + interval);rcu_read_unlock (); }
Greg Kroah-Hartman
maintainerPATCH 144/230 gro_cells: make sure device is up in gro_cells_receive()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2a5ff07a0eb945f291e361aa6f6becca8340ba46 ]
We keep receiving syzbot reports [1] that show that tunnels do not play the rcu/IFF_UP rules properly.
At device dismantle phase, gro_cells_destroy() will be called only after a full rcu grace period is observed after IFF_UP has been cleared.
This means that IFF_UP needs to be tested before queueing packets into netif_rx() or gro_cells.
This patch implements the test in gro_cells_receive() because too many callers do not seem to bother enough.
[1]
BUG: unable to handle kernel paging request at fffff4ca0b9ffffe PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 21 Comm: kworker/u4:1 Not tainted 5.0.0+ #97 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 kobject: 'loop2' (000000004bd7d84a): kobject_uevent_env FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0 Call Trace: kobject: 'loop2' (000000004bd7d84a): fill_kobj_path: path = '/devices/virtual/block/loop2' ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1010 netdev_run_todo+0x51c/0x7d0 net/core/dev.c:8970 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:116 ip_tunnel_delete_nets+0x423/0x5f0 net/ipv4/ip_tunnel.c:1124 vti_exit_batch_net+0x23/0x30 net/ipv4/ip_vti.c:495 ops_exit_list.isra.0+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x3fb/0x960 net/core/net_namespace.c:551 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173 worker_thread+0x98/0xe40 kernel/workqueue.c:2319 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Modules linked in: CR2: fffff4ca0b9ffffe [ end trace 513fc9c1338d1cb3 ] RIP: 0010:__skb_unlink include/linux/skbuff.h:1929 [inline] RIP: 0010:__skb_dequeue include/linux/skbuff.h:1945 [inline] RIP: 0010:__skb_queue_purge include/linux/skbuff.h:2656 [inline] RIP: 0010:gro_cells_destroy net/core/gro_cells.c:89 [inline] RIP: 0010:gro_cells_destroy+0x19d/0x360 net/core/gro_cells.c:78 Code: 03 42 80 3c 20 00 0f 85 53 01 00 00 48 8d 7a 08 49 8b 47 08 49 c7 07 00 00 00 00 48 89 f9 49 c7 47 08 00 00 00 00 48 c1 e9 03 <42> 80 3c 21 00 0f 85 10 01 00 00 48 89 c1 48 89 42 08 48 c1 e9 03 RSP: 0018:ffff8880aa3f79a8 EFLAGS: 00010a02 RAX: 00ffffffffffffe8 RBX: ffffe8ffffc64b70 RCX: 1ffff8ca0b9ffffe RDX: ffffc6505cffffe8 RSI: ffffffff858410ca RDI: ffffc6505cfffff0 RBP: ffff8880aa3f7a08 R08: ffff8880aa3e8580 R09: fffffbfff1263645 R10: fffffbfff1263644 R11: ffffffff8931b223 R12: dffffc0000000000 kobject: 'loop3' (00000000e4ee57a6): kobject_uevent_env R13: 0000000000000000 R14: ffffe8ffffc64b80 R15: ffffe8ffffc64b75 FS: 0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffff4ca0b9ffffe CR3: 0000000094941000 CR4: 00000000001406f0
--- include/net/gro_cells.h | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
include/net/gro_cells.h +10 -2
@@ -19,22 +19,30 @@ static inline void gro_cells_receive(strstruct gro_cell *cell;struct net_device *dev = skb->dev; +rcu_read_lock (); +if (unlikely (!(dev->flags &IFF_UP ))) + goto drop; +if (!gcells->cells ||skb_cloned (skb) || !(dev->features &NETIF_F_GRO )) {netif_rx (skb); -return ; + goto unlock; } cell =this_cpu_ptr (gcells->cells);if (skb_queue_len (&cell->napi_skbs) > netdev_max_backlog) { +drop:atomic_long_inc (&dev->rx_dropped);kfree_skb (skb); -return ; + goto unlock; }__skb_queue_tail (&cell->napi_skbs, skb);if (skb_queue_len (&cell->napi_skbs) ==1 )napi_schedule (&cell->napi); + +unlock: +rcu_read_unlock (); }/* called under BH context */
Greg Kroah-Hartman
maintainerPATCH 145/230 tcp/dccp: remove reqsk_put() from inet_child_forget()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit da8ab57863ed7e912d10b179b6bdc652f635bd19 upstream.
Back in linux-4.4, I inadvertently put a call to reqsk_put() in inet_child_forget(), forgetting it could be called from two different points.
In the case it is called from inet_csk_reqsk_queue_add(), we want to keep the reference on the request socket, since it is released later by the caller (tcp_v{4|6}_rcv())
This bug never showed up because atomic_dec_and_test() was not signaling the underflow, and SLAB_DESTROY_BY RCU semantic for request sockets prevented the request to be put in quarantine.
Recent conversion of socket refcount from atomic_t to refcount_t finally exposed the bug.
So move the reqsk_put() to inet_csk_listen_stop() to fix this.
Thanks to Shankara Pailoor for using syzkaller and providing a nice set of .config and C repro.
WARNING: CPU: 2 PID: 4277 at lib/refcount.c:186 refcount_sub_and_test+0x167/0x1b0 lib/refcount.c:186 Kernel panic - not syncing: panic_on_warn set ... CPU: 2 PID: 4277 Comm: syz-executor0 Not tainted 4.13.0-rc7 #3 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: <IRQ> __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0xf7/0x1aa lib/dump_stack.c:52 panic+0x1ae/0x3a7 kernel/panic.c:180 __warn+0x1c4/0x1d9 kernel/panic.c:541 report_bug+0x211/0x2d0 lib/bug.c:183 fixup_bug+0x40/0x90 arch/x86/kernel/traps.c:190 do_trap_no_signal arch/x86/kernel/traps.c:224 [inline] do_trap+0x260/0x390 arch/x86/kernel/traps.c:273 do_error_trap+0x118/0x340 arch/x86/kernel/traps.c:310 do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:323 invalid_op+0x18/0x20 arch/x86/entry/entry_64.S:846 RIP: 0010:refcount_sub_and_test+0x167/0x1b0 lib/refcount.c:186 RSP: 0018:ffff88006e006b60 EFLAGS: 00010286 RAX: 0000000000000026 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000026 RSI: 1ffff1000dc00d2c RDI: ffffed000dc00d60 RBP: ffff88006e006bf0 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 1ffff1000dc00d6d R13: 00000000ffffffff R14: 0000000000000001 R15: ffff88006ce9d340 refcount_dec_and_test+0x1a/0x20 lib/refcount.c:211 reqsk_put+0x71/0x2b0 include/net/request_sock.h:123 tcp_v4_rcv+0x259e/0x2e20 net/ipv4/tcp_ipv4.c:1729 ip_local_deliver_finish+0x2e2/0xba0 net/ipv4/ip_input.c:216 NF_HOOK include/linux/netfilter.h:248 [inline] ip_local_deliver+0x1ce/0x6d0 net/ipv4/ip_input.c:257 dst_input include/net/dst.h:477 [inline] ip_rcv_finish+0x8db/0x19c0 net/ipv4/ip_input.c:397 NF_HOOK include/linux/netfilter.h:248 [inline] ip_rcv+0xc3f/0x17d0 net/ipv4/ip_input.c:488 __netif_receive_skb_core+0x1fb7/0x31f0 net/core/dev.c:4298 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4336 process_backlog+0x1c5/0x6d0 net/core/dev.c:5102 napi_poll net/core/dev.c:5499 [inline] net_rx_action+0x6d3/0x14a0 net/core/dev.c:5565 __do_softirq+0x2cb/0xb2d kernel/softirq.c:284 do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:898 </IRQ> do_softirq.part.16+0x63/0x80 kernel/softirq.c:328 do_softirq kernel/softirq.c:176 [inline] __local_bh_enable_ip+0x84/0x90 kernel/softirq.c:181 local_bh_enable include/linux/bottom_half.h:31 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:705 [inline] ip_finish_output2+0x8ad/0x1360 net/ipv4/ip_output.c:231 ip_finish_output+0x74e/0xb80 net/ipv4/ip_output.c:317 NF_HOOK_COND include/linux/netfilter.h:237 [inline] ip_output+0x1cc/0x850 net/ipv4/ip_output.c:405 dst_output include/net/dst.h:471 [inline] ip_local_out+0x95/0x160 net/ipv4/ip_output.c:124 ip_queue_xmit+0x8c6/0x1810 net/ipv4/ip_output.c:504 tcp_transmit_skb+0x1963/0x3320 net/ipv4/tcp_output.c:1123 tcp_send_ack.part.35+0x38c/0x620 net/ipv4/tcp_output.c:3575 tcp_send_ack+0x49/0x60 net/ipv4/tcp_output.c:3545 tcp_rcv_synsent_state_process net/ipv4/tcp_input.c:5795 [inline] tcp_rcv_state_process+0x4876/0x4b60 net/ipv4/tcp_input.c:5930 tcp_v4_do_rcv+0x58a/0x820 net/ipv4/tcp_ipv4.c:1483 sk_backlog_rcv include/net/sock.h:907 [inline] __release_sock+0x124/0x360 net/core/sock.c:2223 release_sock+0xa4/0x2a0 net/core/sock.c:2715 inet_wait_for_connect net/ipv4/af_inet.c:557 [inline] __inet_stream_connect+0x671/0xf00 net/ipv4/af_inet.c:643 inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:682 SYSC_connect+0x204/0x470 net/socket.c:1628 SyS_connect+0x24/0x30 net/socket.c:1609 entry_SYSCALL_64_fastpath+0x18/0xad RIP: 0033:0x451e59 RSP: 002b:00007f474843fc08 EFLAGS: 00000216 ORIG_RAX: 000000000000002a RAX: ffffffffffffffda RBX: 0000000000718000 RCX: 0000000000451e59 RDX: 0000000000000010 RSI: 0000000020002000 RDI: 0000000000000007 RBP: 0000000000000046 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 0000000000000000 R13: 00007ffc040a0f8f R14: 00007f47484409c0 R15: 0000000000000000
--- net/ipv4/inet_connection_sock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/inet_connection_sock.c +1 -1
@@ -787,7 +787,6 @@ static void inet_child_forget(struct soctcp_sk (child)->fastopen_rsk =NULL ; }inet_csk_destroy_sock (child); -reqsk_put (req); } struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
@@ -858,6 +857,7 @@ void inet_csk_listen_stop(struct sock *ssock_hold (child);inet_child_forget (sk, req, child); +reqsk_put (req);bh_unlock_sock (child);local_bh_enable ();sock_put (child);
Greg Kroah-Hartman
maintainerPATCH 146/230 ALSA: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <[email protected]>
commit 7dc661bd8d3261053b69e4e2d0050cd1ee540fc1 upstream.
ALSA bebob driver has an entry for Focusrite Saffire Pro 10 I/O. The entry matches vendor_id in root directory and model_id in unit directory of configuration ROM for IEEE 1394 bus.
On the other hand, configuration ROM of Focusrite Liquid Saffire 56 has the same vendor_id and model_id. This device is an application of TCAT Dice (TCD2220 a.k.a Dice Jr.) however ALSA bebob driver can be bound to it randomly instead of ALSA dice driver. At present, drivers in ALSA firewire stack can not handle this situation appropriately.
This commit uses more identical mod_alias for Focusrite Saffire Pro 10 I/O in ALSA bebob driver.
$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
ROM header and bus information block
-----------------------------------------------------------------
400 042a829d bus_info_length 4, crc_length 42, crc 33437
404 31333934 bus_name "1394"
408 f0649222 irmc 1, cmc 1, isc 1, bmc 1, pmc 0, cyc_clk_acc 100,
max_rec 9 (1024), max_rom 2, gen 2, spd 2 (S400)
40c 00130e01 company_id 00130e |
410 000606e0 device_id 01000606e0 | EUI-64 00130e01000606e0 root directory
-----------------------------------------------------------------
414 0009d31c directory_length 9, crc 54044
418 04000014 hardware version
41c 0c0083c0 node capabilities per IEEE 1394
420 0300130e vendor
424 81000012 --> descriptor leaf at 46c
428 17000006 model
42c 81000016 --> descriptor leaf at 484
430 130120c2 version
434 d1000002 --> unit directory at 43c
438 d4000006 --> dependent info directory at 450 unit directory at 43c
-----------------------------------------------------------------
43c 0004707c directory_length 4, crc 28796 440 1200a02d specifier id: 1394 TA 444 13010001 version: AV/C 448 17000006 model 44c 81000013 --> descriptor leaf at 498
dependent info directory at 450
-----------------------------------------------------------------
450 000637c7 directory_length 6, crc 14279 454 120007f5 specifier id 458 13000001 version 45c 3affffc7 (immediate value) 460 3b100000 (immediate value) 464 3cffffc7 (immediate value) 468 3d600000 (immediate value)
descriptor leaf at 46c
-----------------------------------------------------------------
46c 00056f3b leaf_length 5, crc 28475 470 00000000 textual descriptor 474 00000000 minimal ASCII 478 466f6375 "Focu" 47c 73726974 "srit" 480 65000000 "e"
descriptor leaf at 484
-----------------------------------------------------------------
484 0004a165 leaf_length 4, crc 41317 488 00000000 textual descriptor 48c 00000000 minimal ASCII 490 50726f31 "Pro1" 494 30494f00 "0IO"
descriptor leaf at 498
-----------------------------------------------------------------
498 0004a165 leaf_length 4, crc 41317 49c 00000000 textual descriptor 4a0 00000000 minimal ASCII 4a4 50726f31 "Pro1" 4a8 30494f00 "0IO"
$ python2 crpp < /sys/bus/firewire/devices/fw1/config_rom
ROM header and bus information block
-----------------------------------------------------------------
400 040442e4 bus_info_length 4, crc_length 4, crc 17124
404 31333934 bus_name "1394"
408 e0ff8112 irmc 1, cmc 1, isc 1, bmc 0, pmc 0, cyc_clk_acc 255,
max_rec 8 (512), max_rom 1, gen 1, spd 2 (S400)
40c 00130e04 company_id 00130e |
410 018001e9 device_id 04018001e9 | EUI-64 00130e04018001e9 root directory
-----------------------------------------------------------------
414 00065612 directory_length 6, crc 22034
418 0300130e vendor
41c 8100000a --> descriptor leaf at 444
420 17000006 model
424 8100000e --> descriptor leaf at 45c
428 0c0087c0 node capabilities per IEEE 1394
42c d1000001 --> unit directory at 430 unit directory at 430
-----------------------------------------------------------------
430 000418a0 directory_length 4, crc 6304 434 1200130e specifier id 438 13000001 version 43c 17000006 model 440 8100000f --> descriptor leaf at 47c
descriptor leaf at 444
-----------------------------------------------------------------
444 00056f3b leaf_length 5, crc 28475 448 00000000 textual descriptor 44c 00000000 minimal ASCII 450 466f6375 "Focu" 454 73726974 "srit" 458 65000000 "e"
descriptor leaf at 45c
-----------------------------------------------------------------
45c 000762c6 leaf_length 7, crc 25286 460 00000000 textual descriptor 464 00000000 minimal ASCII 468 4c495155 "LIQU" 46c 49445f53 "ID_S" 470 41464649 "AFFI" 474 52455f35 "RE_5" 478 36000000 "6"
descriptor leaf at 47c
-----------------------------------------------------------------
47c 000762c6 leaf_length 7, crc 25286 480 00000000 textual descriptor 484 00000000 minimal ASCII 488 4c495155 "LIQU" 48c 49445f53 "ID_S" 490 41464649 "AFFI" 494 52455f35 "RE_5" 498 36000000 "6"
--- sound/firewire/bebob/bebob.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
sound/firewire/bebob/bebob.c +13 -1
@@ -422,7 +422,19 @@ static const struct ieee1394_device_id b/* Focusrite, SaffirePro 26 I/O */ SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec), /* Focusrite, SaffirePro 10 I/O */ -SND_BEBOB_DEV_ENTRY (VEN_FOCUSRITE ,0x00000006 , &saffirepro_10_spec), + { +// The combination of vendor_id and model_id is the same as the +// same as the one of Liquid Saffire 56. + .match_flags =IEEE1394_MATCH_VENDOR_ID | +IEEE1394_MATCH_MODEL_ID | +IEEE1394_MATCH_SPECIFIER_ID | + IEEE1394_MATCH_VERSION, + .vendor_id = VEN_FOCUSRITE, + .model_id = 0x000006, + .specifier_id = 0x00a02d, + .version = 0x010001, + .driver_data = (kernel_ulong_t)&saffirepro_10_spec, + },/* Focusrite, Saffire(no label and LE) */ SND_BEBOB_DEV_ENTRY (VEN_FOCUSRITE ,MODEL_FOCUSRITE_SAFFIRE_BOTH , &saffire_spec),
Greg Kroah-Hartman
maintainerPATCH 147/230 fs/9p: use fscache mutex rather than spinlock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <[email protected]>
commit 8f5fed1e917588f946ad8882bd47a4093db0ff4c upstream.
We may sleep inside a the lock, so use a mutex rather than spinlock.
--- fs/9p/cache.c | 8 ++++---- fs/9p/v9fs.h | 2 +- fs/9p/vfs_inode.c | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-)
fs/9p/cache.c +4 -4
@@ -243,14 +243,14 @@ void v9fs_cache_inode_set_cookie(structif (!v9inode->fscache)return ; -spin_lock (&v9inode->fscache_lock); +mutex_lock (&v9inode->fscache_lock);if ((filp->f_flags &O_ACCMODE ) !=O_RDONLY )v9fs_cache_inode_flush_cookie (inode);else v9fs_cache_inode_get_cookie (inode); -spin_unlock (&v9inode->fscache_lock); +mutex_unlock (&v9inode->fscache_lock); }void v9fs_cache_inode_reset_cookie (struct inode *inode)
@@ -264,7 +264,7 @@ void v9fs_cache_inode_reset_cookie(struc old = v9inode->fscache; -spin_lock (&v9inode->fscache_lock); +mutex_lock (&v9inode->fscache_lock);fscache_relinquish_cookie (v9inode->fscache,1 ); v9ses =v9fs_inode2v9ses (inode);
@@ -274,7 +274,7 @@ void v9fs_cache_inode_reset_cookie(strucp9_debug (P9_DEBUG_FSC ,"inode %p revalidating cookie old %p new %p\n" , inode, old, v9inode->fscache); -spin_unlock (&v9inode->fscache_lock); +mutex_unlock (&v9inode->fscache_lock); }int __v9fs_fscache_release_page (struct page *page,gfp_t gfp)
fs/9p/v9fs.h +1 -1
@@ -123,7 +123,7 @@ struct v9fs_session_info {struct v9fs_inode {#ifdef CONFIG_9P_FSCACHE -spinlock_t fscache_lock; +struct mutex fscache_lock;struct fscache_cookie *fscache;#endif struct p9_qid qid;
fs/9p/vfs_inode.c +1 -1
@@ -244,7 +244,7 @@ struct inode *v9fs_alloc_inode(struct sureturn NULL ;#ifdef CONFIG_9P_FSCACHE v9inode->fscache =NULL ; -spin_lock_init (&v9inode->fscache_lock); +mutex_init (&v9inode->fscache_lock);#endif v9inode->writeback_fid =NULL ; v9inode->cache_validity =0 ;
Greg Kroah-Hartman
maintainerPATCH 148/230 Its wrong to add len to sector_nr in raid10 reshape twice
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <[email protected]>
commit b761dcf1217760a42f7897c31dcb649f59b2333e upstream.
In reshape_request it already adds len to sector_nr already. It's wrong to add len to sector_nr again after adding pages to bio. If there is bad block it can't copy one chunk at a time, it needs to goto read_more. Now the sector_nr is wrong. It can cause data corruption.
--- drivers/md/raid10.c | 1 - 1 file changed, 1 deletion(-)
drivers/md/raid10.c +0 -1
@@ -4442,7 +4442,6 @@ bio_full:atomic_inc (&r10_bio->remaining); read_bio->bi_next =NULL ;generic_make_request (read_bio); - sector_nr += nr_sectors; sectors_done += nr_sectors;if (sector_nr <= last) goto read_more;
Greg Kroah-Hartman
maintainerPATCH 149/230 media: videobuf2-v4l2: drop WARN_ON in vb2_warn_zero_bytesused()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
commit 5e99456c20f712dcc13d9f6ca4278937d5367355 upstream.
Userspace shouldn't set bytesused to 0 for output buffers. vb2_warn_zero_bytesused() warns about this (only once!), but it also calls WARN_ON(1), which is confusing since it is not immediately clear that it warns about a 0 value for bytesused.
Just drop the WARN_ON as it serves no purpose.
--- drivers/media/v4l2-core/videobuf2-v4l2.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/v4l2-core/videobuf2-v4l2.c +0 -1
@@ -141,7 +141,6 @@ static void vb2_warn_zero_bytesused(strureturn ; check_once = true; -WARN_ON (1 );pr_warn ("use of bytesused == 0 is deprecated and will be removed in the future,\n" );if (vb->vb2_queue->allow_zero_bytesused)
Greg Kroah-Hartman
maintainerPATCH 150/230 9p: use inode->i_lock to protect i_size_write() under 32-bit
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hou Tao <[email protected]>
commit 5e3cc1ee1405a7eb3487ed24f786dec01b4cbe1f upstream.
Use inode->i_lock to protect i_size_write(), else i_size_read() in generic_fillattr() may loop infinitely in read_seqcount_begin() when multiple processes invoke v9fs_vfs_getattr() or v9fs_vfs_getattr_dotl() simultaneously under 32-bit SMP environment, and a soft lockup will be triggered as show below:
watchdog: BUG: soft lockup - CPU#5 stuck for 22s! [stat:2217] Modules linked in: CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4 Hardware name: Generic DT based system PC is at generic_fillattr+0x104/0x108 LR is at 0xec497f00 pc : [<802b8898>] lr : [<ec497f00>] psr: 200c0013 sp : ec497e20 ip : ed608030 fp : ec497e3c r10: 00000000 r9 : ec497f00 r8 : ed608030 r7 : ec497ebc r6 : ec497f00 r5 : ee5c1550 r4 : ee005780 r3 : 0000052d r2 : 00000000 r1 : ec497f00 r0 : ed608030 Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none Control: 10c5387d Table: ac48006a DAC: 00000051 CPU: 5 PID: 2217 Comm: stat Not tainted 5.0.0-rc1-00005-g7f702faf5a9e #4 Hardware name: Generic DT based system Backtrace: [<8010d974>] (dump_backtrace) from [<8010dc88>] (show_stack+0x20/0x24) [<8010dc68>] (show_stack) from [<80a1d194>] (dump_stack+0xb0/0xdc) [<80a1d0e4>] (dump_stack) from [<80109f34>] (show_regs+0x1c/0x20) [<80109f18>] (show_regs) from [<801d0a80>] (watchdog_timer_fn+0x280/0x2f8) [<801d0800>] (watchdog_timer_fn) from [<80198658>] (__hrtimer_run_queues+0x18c/0x380) [<801984cc>] (__hrtimer_run_queues) from [<80198e60>] (hrtimer_run_queues+0xb8/0xf0) [<80198da8>] (hrtimer_run_queues) from [<801973e8>] (run_local_timers+0x28/0x64) [<801973c0>] (run_local_timers) from [<80197460>] (update_process_times+0x3c/0x6c) [<80197424>] (update_process_times) from [<801ab2b8>] (tick_nohz_handler+0xe0/0x1bc) [<801ab1d8>] (tick_nohz_handler) from [<80843050>] (arch_timer_handler_virt+0x38/0x48) [<80843018>] (arch_timer_handler_virt) from [<80180a64>] (handle_percpu_devid_irq+0x8c/0x240) [<801809d8>] (handle_percpu_devid_irq) from [<8017ac20>] (generic_handle_irq+0x34/0x44) [<8017abec>] (generic_handle_irq) from [<8017b344>] (__handle_domain_irq+0x6c/0xc4) [<8017b2d8>] (__handle_domain_irq) from [<801022e0>] (gic_handle_irq+0x4c/0x88) [<80102294>] (gic_handle_irq) from [<80101a30>] (__irq_svc+0x70/0x98) [<802b8794>] (generic_fillattr) from [<8056b284>] (v9fs_vfs_getattr_dotl+0x74/0xa4) [<8056b210>] (v9fs_vfs_getattr_dotl) from [<802b8904>] (vfs_getattr_nosec+0x68/0x7c) [<802b889c>] (vfs_getattr_nosec) from [<802b895c>] (vfs_getattr+0x44/0x48) [<802b8918>] (vfs_getattr) from [<802b8a74>] (vfs_statx+0x9c/0xec) [<802b89d8>] (vfs_statx) from [<802b9428>] (sys_lstat64+0x48/0x78) [<802b93e0>] (sys_lstat64) from [<80101000>] (ret_fast_syscall+0x0/0x28)
[[email protected]: updated comment to not refer to a function in another subsystem]
--- fs/9p/v9fs_vfs.h | 23 +++++++++++++++++++++-- fs/9p/vfs_file.c | 6 +++++- fs/9p/vfs_inode.c | 23 +++++++++++------------ fs/9p/vfs_inode_dotl.c | 27 ++++++++++++++------------- fs/9p/vfs_super.c | 4 ++-- 5 files changed, 53 insertions(+), 30 deletions(-)
fs/9p/v9fs_vfs.h +21 -2
@@ -40,6 +40,9 @@*/ #define P9_LOCK_TIMEOUT (30*HZ) +/* flags for v9fs_stat2inode() & v9fs_stat2inode_dotl() */ +#define V9FS_STAT2INODE_KEEP_ISIZE 1 +extern struct file_system_type v9fs_fs_type;extern const struct address_space_operations v9fs_addr_operations;extern const struct file_operations v9fs_file_operations;
@@ -61,8 +64,10 @@ int v9fs_init_inode(struct v9fs_session_ struct inode *inode, umode_t mode, dev_t);void v9fs_evict_inode (struct inode *inode);ino_t v9fs_qid2ino (struct p9_qid *qid); -void v9fs_stat2inode (struct p9_wstat *,struct inode *,struct super_block *); -void v9fs_stat2inode_dotl (struct p9_stat_dotl *,struct inode *); +void v9fs_stat2inode (struct p9_wstat *stat,struct inode *inode, +struct super_block *sb,unsigned int flags); +void v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode, +unsigned int flags);int v9fs_dir_release (struct inode *inode,struct file *filp);int v9fs_file_open (struct inode *inode,struct file *file);void v9fs_inode2stat (struct inode *inode,struct p9_wstat *stat);
@@ -83,4 +88,18 @@ static inline void v9fs_invalidate_inode }int v9fs_open_to_dotl_flags (int flags); + +static inline void v9fs_i_size_write (struct inode *inode,loff_t i_size) +{ +/* +* 32-bit need the lock, concurrent updates could break the +* sequences and make i_size_read() loop forever. +* 64-bit updates are atomic and can skip the locking. +*/ +if (sizeof (i_size) >sizeof (long )) +spin_lock (&inode->i_lock); +i_size_write (inode, i_size); +if (sizeof (i_size) >sizeof (long )) +spin_unlock (&inode->i_lock); +}#endif
fs/9p/vfs_file.c +5 -1
@@ -442,7 +442,11 @@ v9fs_file_write_iter(struct kiocb *iocb, i_size =i_size_read (inode);if (iocb->ki_pos > i_size) {inode_add_bytes (inode, iocb->ki_pos - i_size); -i_size_write (inode, iocb->ki_pos); +/* +* Need to serialize against i_size_write() in +* v9fs_stat2inode() +*/ +v9fs_i_size_write (inode, iocb->ki_pos); }return retval; }
fs/9p/vfs_inode.c +11 -12
@@ -538,7 +538,7 @@ static struct inode *v9fs_qid_iget(strucif (retval) goto error; -v9fs_stat2inode (st, inode, sb); +v9fs_stat2inode (st, inode, sb,0 );v9fs_cache_inode_get_cookie (inode);unlock_new_inode (inode);return inode;
@@ -1074,7 +1074,7 @@ v9fs_vfs_getattr(struct vfsmount *mnt, sif (IS_ERR (st))return PTR_ERR (st); -v9fs_stat2inode (st,d_inode (dentry),d_inode (dentry)->i_sb); +v9fs_stat2inode (st,d_inode (dentry),d_inode (dentry)->i_sb,0 );generic_fillattr (d_inode (dentry), stat);p9stat_free (st);
@@ -1152,12 +1152,13 @@ static int v9fs_vfs_setattr(struct dentr* @stat: Plan 9 metadata (mistat) structure * @inode: inode to populate * @sb: superblock of filesystem +* @flags: control flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) * */ void v9fs_stat2inode (struct p9_wstat *stat,struct inode *inode, -struct super_block *sb) +struct super_block *sb,unsigned int flags) {umode_t mode;char ext[32 ];
@@ -1198,10 +1199,11 @@ v9fs_stat2inode(struct p9_wstat *stat, s mode =p9mode2perm (v9ses, stat); mode |= inode->i_mode & ~S_IALLUGO ; inode->i_mode = mode; -i_size_write (inode, stat->length); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE )) +v9fs_i_size_write (inode, stat->length);/* not real number of blocks, but 512 byte ones ... */ - inode->i_blocks = (i_size_read (inode) +512 -1 ) >>9 ; + inode->i_blocks = (stat->length +512 -1 ) >>9 ; v9inode->cache_validity &= ~V9FS_INO_INVALID_ATTR ; }
@@ -1389,9 +1391,9 @@ int v9fs_refresh_inode(struct p9_fid *fi {int umode;dev_t rdev; -loff_t i_size;struct p9_wstat *st;struct v9fs_session_info *v9ses; +unsigned int flags; v9ses =v9fs_inode2v9ses (inode); st =p9_client_stat (fid);
@@ -1404,16 +1406,13 @@ int v9fs_refresh_inode(struct p9_fid *fiif ((inode->i_mode &S_IFMT ) != (umode &S_IFMT )) goto out; -spin_lock (&inode->i_lock);/* * We don't want to refresh inode->i_size, * because we may have cached data */ - i_size = inode->i_size; -v9fs_stat2inode (st, inode, inode->i_sb); -if (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) - inode->i_size = i_size; -spin_unlock (&inode->i_lock); + flags = (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) ? +V9FS_STAT2INODE_KEEP_ISIZE :0 ; +v9fs_stat2inode (st, inode, inode->i_sb, flags); out:p9stat_free (st);kfree (st);
fs/9p/vfs_inode_dotl.c +14 -13
@@ -143,7 +143,7 @@ static struct inode *v9fs_qid_iget_dotl(if (retval) goto error; -v9fs_stat2inode_dotl (st, inode); +v9fs_stat2inode_dotl (st, inode,0 );v9fs_cache_inode_get_cookie (inode); retval =v9fs_get_acl (inode, fid);if (retval)
@@ -498,7 +498,7 @@ v9fs_vfs_getattr_dotl(struct vfsmount *mif (IS_ERR (st))return PTR_ERR (st); -v9fs_stat2inode_dotl (st,d_inode (dentry)); +v9fs_stat2inode_dotl (st,d_inode (dentry),0 );generic_fillattr (d_inode (dentry), stat);/* Change block size to what the server returned */ stat->blksize = st->st_blksize;
@@ -609,11 +609,13 @@ int v9fs_vfs_setattr_dotl(struct dentry* v9fs_stat2inode_dotl - populate an inode structure with stat info * @stat: stat structure * @inode: inode to populate +* @flags: ctrl flags (e.g. V9FS_STAT2INODE_KEEP_ISIZE) * */ void -v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode) +v9fs_stat2inode_dotl (struct p9_stat_dotl *stat,struct inode *inode, +unsigned int flags) {umode_t mode;struct v9fs_inode *v9inode =V9FS_I (inode);
@@ -633,7 +635,8 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl mode |= inode->i_mode & ~S_IALLUGO ; inode->i_mode = mode; -i_size_write (inode, stat->st_size); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE )) +v9fs_i_size_write (inode, stat->st_size); inode->i_blocks = stat->st_blocks; }else {if (stat->st_result_mask &P9_STATS_ATIME ) {
@@ -663,8 +666,9 @@ v9fs_stat2inode_dotl(struct p9_stat_dotl }if (stat->st_result_mask &P9_STATS_RDEV ) inode->i_rdev =new_decode_dev (stat->st_rdev); -if (stat->st_result_mask &P9_STATS_SIZE ) -i_size_write (inode, stat->st_size); +if (!(flags &V9FS_STAT2INODE_KEEP_ISIZE ) && + stat->st_result_mask &P9_STATS_SIZE ) +v9fs_i_size_write (inode, stat->st_size);if (stat->st_result_mask &P9_STATS_BLOCKS ) inode->i_blocks = stat->st_blocks; }
@@ -926,9 +930,9 @@ v9fs_vfs_follow_link_dotl(struct dentryint v9fs_refresh_inode_dotl (struct p9_fid *fid,struct inode *inode) { -loff_t i_size;struct p9_stat_dotl *st;struct v9fs_session_info *v9ses; +unsigned int flags; v9ses =v9fs_inode2v9ses (inode); st =p9_client_getattr_dotl (fid,P9_STATS_ALL );
@@ -940,16 +944,13 @@ int v9fs_refresh_inode_dotl(struct p9_fiif ((inode->i_mode &S_IFMT ) != (st->st_mode &S_IFMT )) goto out; -spin_lock (&inode->i_lock);/* * We don't want to refresh inode->i_size, * because we may have cached data */ - i_size = inode->i_size; -v9fs_stat2inode_dotl (st, inode); -if (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) - inode->i_size = i_size; -spin_unlock (&inode->i_lock); + flags = (v9ses->cache ==CACHE_LOOSE || v9ses->cache ==CACHE_FSCACHE ) ? +V9FS_STAT2INODE_KEEP_ISIZE :0 ; +v9fs_stat2inode_dotl (st, inode, flags); out:kfree (st);return 0 ;
fs/9p/vfs_super.c +2 -2
@@ -165,7 +165,7 @@ static struct dentry *v9fs_mount(struct goto release_sb; }d_inode (root)->i_ino =v9fs_qid2ino (&st->qid); -v9fs_stat2inode_dotl (st,d_inode (root)); +v9fs_stat2inode_dotl (st,d_inode (root),0 );kfree (st); }else {struct p9_wstat *st =NULL ;
@@ -176,7 +176,7 @@ static struct dentry *v9fs_mount(struct }d_inode (root)->i_ino =v9fs_qid2ino (&st->qid); -v9fs_stat2inode (st,d_inode (root), sb); +v9fs_stat2inode (st,d_inode (root), sb,0 );p9stat_free (st);kfree (st);
Greg Kroah-Hartman
maintainerPATCH 151/230 9p/net: fix memory leak in p9_client_create
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: zhengbin <[email protected]>
commit bb06c388fa20ae24cfe80c52488de718a7e3a53f upstream.
If msize is less than 4096, we should close and put trans, destroy tagpool, not just free client. This patch fixes that.
--- net/9p/client.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/client.c +1 -1
@@ -1058,7 +1058,7 @@ struct p9_client *p9_client_create(constp9_debug (P9_DEBUG_ERROR ,"Please specify a msize of at least 4k\n" ); err = -EINVAL ; - goto free_client; + goto close_trans; } err =p9_client_version (clnt);
Greg Kroah-Hartman
maintainerPATCH 152/230 ASoC: fsl_esai: fix register setting issue in RIGHT_J mode
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: S.j. Wang <[email protected]>
commit cc29ea007347f39f4c5a4d27b0b555955a0277f9 upstream.
The ESAI_xCR_xWA is xCR's bit, not the xCCR's bit, driver set it to wrong register, correct it.
Fixes 43d24e76b698 ("ASoC: fsl_esai: Add ESAI CPU DAI driver")
--- sound/soc/fsl/fsl_esai.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/fsl/fsl_esai.c +4 -3
@@ -394,7 +394,8 @@ static int fsl_esai_set_dai_fmt(struct sbreak ;case SND_SOC_DAIFMT_RIGHT_J :/* Data on rising edge of bclk, frame high, right aligned */ - xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCR_xWA; + xccr |= ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP; + xcr |= ESAI_xCR_xWA;break ;case SND_SOC_DAIFMT_DSP_A :/* Data on rising edge of bclk, frame high, 1clk before data */
@@ -451,12 +452,12 @@ static int fsl_esai_set_dai_fmt(struct sreturn -EINVAL ; } - mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR; + mask = ESAI_xCR_xFSL | ESAI_xCR_xFSR | ESAI_xCR_xWA;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCR , mask, xcr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCR , mask, xcr); mask = ESAI_xCCR_xCKP | ESAI_xCCR_xHCKP | ESAI_xCCR_xFSP | - ESAI_xCCR_xFSD | ESAI_xCCR_xCKD | ESAI_xCR_xWA; + ESAI_xCCR_xFSD | ESAI_xCCR_xCKD;regmap_update_bits (esai_priv->regmap,REG_ESAI_TCCR , mask, xccr);regmap_update_bits (esai_priv->regmap,REG_ESAI_RCCR , mask, xccr);
Greg Kroah-Hartman
maintainerPATCH 153/230 stm class: Fix an endless loop in channel allocation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhi Jin <[email protected]>
commit a1d75dad3a2c689e70a1c4e0214cca9de741d0aa upstream.
There is a bug in the channel allocation logic that leads to an endless loop when looking for a contiguous range of channels in a range with a mixture of free and occupied channels. For example, opening three consequtive channels, closing the first two and requesting 4 channels in a row will trigger this soft lockup. The bug is that the search loop forgets to skip over the range once it detects that one channel in that range is occupied.
Restore the original intent to the logic by fixing the omission.
--- drivers/hwtracing/stm/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/hwtracing/stm/core.c +3 -0
@@ -229,6 +229,9 @@ static int find_free_channels(unsigned l ;if (i == width)return pos; + +/* step over [pos..pos+i) to continue search */ + pos += i; }return -1 ;
Greg Kroah-Hartman
maintainerPATCH 154/230 crypto: caam - fixed handling of sg list
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pankaj Gupta <[email protected]>
commit 42e95d1f10dcf8b18b1d7f52f7068985b3dc5b79 upstream.
when the source sg contains more than 1 fragment and destination sg contains 1 fragment, the caam driver mishandle the buffers to be sent to caam.
--- drivers/crypto/caam/caamalg.c | 1 + 1 file changed, 1 insertion(+)
drivers/crypto/caam/caamalg.c +1 -0
@@ -2081,6 +2081,7 @@ static void init_aead_job(struct aead_reif (unlikely (req->src != req->dst)) {if (!edesc->dst_nents) { dst_dma =sg_dma_address (req->dst); + out_options =0 ; }else { dst_dma = edesc->sec4_sg_dma + sec4_sg_index *
Greg Kroah-Hartman
maintainerPATCH 155/230 crypto: ahash - fix another early termination in hash walk
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 77568e535af7c4f97eaef1e555bf0af83772456c upstream.
Hash algorithms with an alignmask set, e.g. "xcbc(aes-aesni)" and "michael_mic", fail the improved hash tests because they sometimes produce the wrong digest. The bug is that in the case where a scatterlist element crosses pages, not all the data is actually hashed because the scatterlist walk terminates too early. This happens because the 'nbytes' variable in crypto_hash_walk_done() is assigned the number of bytes remaining in the page, then later interpreted as the number of bytes remaining in the scatterlist element. Fix it.
--- crypto/ahash.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
crypto/ahash.c +7 -7
@@ -85,17 +85,17 @@ static int hash_walk_new_entry(struct crint crypto_hash_walk_done (struct crypto_hash_walk *walk,int err) {unsigned int alignmask = walk->alignmask; -unsigned int nbytes = walk->entrylen; walk->data -= walk->offset; -if (nbytes && walk->offset & alignmask && !err) { - walk->offset =ALIGN (walk->offset, alignmask +1 ); - nbytes =min (nbytes, - ((unsigned int )(PAGE_SIZE )) - walk->offset); - walk->entrylen -= nbytes; +if (walk->entrylen && (walk->offset & alignmask) && !err) { +unsigned int nbytes; + walk->offset =ALIGN (walk->offset, alignmask +1 ); + nbytes =min (walk->entrylen, + (unsigned int )(PAGE_SIZE - walk->offset));if (nbytes) { + walk->entrylen -= nbytes; walk->data += walk->offset;return nbytes; }
@@ -115,7 +115,7 @@ int crypto_hash_walk_done(struct crypto_if (err)return err; -if (nbytes) { +if (walk->entrylen) { walk->offset =0 ; walk->pg++;return hash_walk_next (walk);
Greg Kroah-Hartman
maintainerPATCH 156/230 gpu: ipu-v3: Fix i.MX51 CSI control registers offset
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2c0408dd0d8906b26fe8023889af7adf5e68b2c2 ]
The CSI0/CSI1 registers offset is at +0xe030000/+0xe038000 relative to the control module registers on IPUv3EX.
This patch fixes wrong values for i.MX51 CSI0/CSI1.
--- drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/ipu-v3/ipu-common.c +2 -2
@@ -746,8 +746,8 @@ static struct ipu_devtype ipu_type_imx51 = { .cpmem_ofs = 0x1f000000, .srm_ofs = 0x1f040000, .tpm_ofs = 0x1f060000, - .csi0_ofs = 0x1f030000, - .csi1_ofs = 0x1f038000, + .csi0_ofs = 0x1e030000, + .csi1_ofs = 0x1e038000, .ic_ofs = 0x1e020000, .disp0_ofs = 0x1e040000, .disp1_ofs = 0x1e048000,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 157/230 gpu: ipu-v3: Fix CSI offsets for imx53
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit bb867d219fda7fbaabea3314702474c4eac2b91d ]
The CSI offsets are wrong for both CSI0 and CSI1. They are at physical address 0x1e030000 and 0x1e038000 respectively.
--- drivers/gpu/ipu-v3/ipu-common.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/ipu-v3/ipu-common.c +2 -2
@@ -762,8 +762,8 @@ static struct ipu_devtype ipu_type_imx53 = { .cpmem_ofs = 0x07000000, .srm_ofs = 0x07040000, .tpm_ofs = 0x07060000, - .csi0_ofs = 0x07030000, - .csi1_ofs = 0x07038000, + .csi0_ofs = 0x06030000, + .csi1_ofs = 0x06038000, .ic_ofs = 0x06020000, .disp0_ofs = 0x06040000, .disp1_ofs = 0x06048000,
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 158/230 s390/dasd: fix using offset into zero size array error
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4a8ef6999bce998fa5813023a9a6b56eea329dba ]
Dan Carpenter reported the following:
The patch 52898025cf7d: "[S390] dasd: security and PSF update patch for EMC CKD ioctl" from Mar 8, 2010, leads to the following static checker warning:
drivers/s390/block/dasd_eckd.c:4486 dasd_symm_io() error: using offset into zero size array 'psf_data[]'
drivers/s390/block/dasd_eckd.c
4458 /* Copy parms from caller */
4459 rc = -EFAULT;
4460 if (copy_from_user(&usrparm, argp, sizeof(usrparm)))
^^^^^^^The user can specify any "usrparm.psf_data_len". They choose zero by mistake.
4461 goto out;
4462 if (is_compat_task()) {
4463 /* Make sure pointers are sane even on 31 bit. */ 4464 rc = -EINVAL; 4465 if ((usrparm.psf_data >> 32) != 0) 4466 goto out; 4467 if ((usrparm.rssd_result >> 32) != 0) 4468 goto out; 4469 usrparm.psf_data &= 0x7fffffffULL; 4470 usrparm.rssd_result &= 0x7fffffffULL; 4471 } 4472 /* alloc I/O data area */ 4473 psf_data = kzalloc(usrparm.psf_data_len, GFP_KERNEL | GFP_DMA); 4474 rssd_result = kzalloc(usrparm.rssd_result_len, GFP_KERNEL | GFP_DMA);
4475 if (!psf_data || !rssd_result) {
kzalloc() returns a ZERO_SIZE_PTR (0x16).
4476 rc = -ENOMEM; 4477 goto out_free; 4478 } 4479 4480 /* get syscall header from user space */ 4481 rc = -EFAULT; 4482 if (copy_from_user(psf_data, 4483 (void __user *)(unsigned long) usrparm.psf_data, 4484 usrparm.psf_data_len))
That all works great.
4485 goto out_free; 4486 psf0 = psf_data[0]; 4487 psf1 = psf_data[1];
But now we're assuming that "->psf_data_len" was at least 2 bytes.
Fix this by checking the user specified length psf_data_len.
--- drivers/s390/block/dasd_eckd.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/s390/block/dasd_eckd.c +8 -0
@@ -4023,6 +4023,14 @@ static int dasd_symm_io(struct dasd_device *device, void __user *argp) usrparm.psf_data &=0x7fffffffULL ; usrparm.rssd_result &=0x7fffffffULL ; } +/* at least 2 bytes are accessed and should be allocated */ +if (usrparm.psf_data_len <2 ) { +DBF_DEV_EVENT (DBF_WARNING , device, +"Symmetrix ioctl invalid data length %d" , + usrparm.psf_data_len); + rc = -EINVAL ; + goto out; + }/* alloc I/O data area */ psf_data =kzalloc (usrparm.psf_data_len,GFP_KERNEL |GFP_DMA ); rssd_result =kzalloc (usrparm.rssd_result_len,GFP_KERNEL |GFP_DMA );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 159/230 ARM: OMAP2+: Variable "reg" in function omap4_dsi_mux_pads() could be uninitialized
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit dc30e70391376ba3987aeb856ae6d9c0706534f1 ]
In function omap4_dsi_mux_pads(), local variable "reg" could be uninitialized if function regmap_read() returns -EINVAL. However, it will be used directly in the later context, which is potentially unsafe.
--- arch/arm/mach-omap2/display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arm/mach-omap2/display.c +6 -1
@@ -115,6 +115,7 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)u32 enable_mask, enable_shift;u32 pipd_mask, pipd_shift;u32 reg; +int ret;if (dsi_id ==0 ) { enable_mask =OMAP4_DSI1_LANEENABLE_MASK ;
@@ -130,7 +131,11 @@ static int omap4_dsi_mux_pads(int dsi_id, unsigned lanes)return -ENODEV ; } -regmap_read (omap4_dsi_mux_syscon,OMAP4_DSIPHY_SYSCON_OFFSET , ®); + ret =regmap_read (omap4_dsi_mux_syscon, +OMAP4_DSIPHY_SYSCON_OFFSET , + ®); +if (ret) +return ret; reg &= ~enable_mask; reg &= ~pipd_mask;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 160/230 Input: matrix_keypad - use flush_delayed_work()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit a342083abe576db43594a32d458a61fa81f7cb32 ]
We should be using flush_delayed_work() instead of flush_work() in matrix_keypad_stop() to ensure that we are not missing work that is scheduled but not yet put in the workqueue (i.e. its delay timer has not expired yet).
--- drivers/input/keyboard/matrix_keypad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/keyboard/matrix_keypad.c +1 -1
@@ -220,7 +220,7 @@ static void matrix_keypad_stop(struct input_dev *dev) keypad->stopped = true;spin_unlock_irq (&keypad->lock); -flush_work (&keypad->work.work); +flush_delayed_work (&keypad->work);/* * matrix_keypad_scan() will leave IRQs enabled; * we should disable them now.
Signature · 1 line
2.19.1