4.19.102-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.19.102-stable review
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.102-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.102-rc1
Praveen Chaudhary <[email protected]>
net: Fix skb->csum update in inet_proto_csum_replace16().
Vasily Averin <[email protected]>
l2t_seq_next should increase position index
Vasily Averin <[email protected]>
seq_tab_next() should increase position index
Madalin Bucur <[email protected]>
net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
Madalin Bucur <[email protected]>
net/fsl: treat fsl,erratum-a011043
Madalin Bucur <[email protected]>
powerpc/fsl/dts: add fsl,erratum-a011043
Manish Chopra <[email protected]>
qlcnic: Fix CPU soft lockup while collecting firmware dump
Raag Jadav <[email protected]>
ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
Hayes Wang <[email protected]>
r8152: get default setting of WOL before initializing
Michael Ellerman <[email protected]>
airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
Michael Ellerman <[email protected]>
airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
Vincenzo Frascino <[email protected]>
tee: optee: Fix compilation issue with nommu
Vladimir Murzin <[email protected]>
ARM: 8955/1: virt: Relax arch timer version check during early boot
Hannes Reinecke <[email protected]>
scsi: fnic: do not queue commands during fwreset
Xu Wang <[email protected]>
xfrm: interface: do not confirm neighbor when do pmtu update
Nicolas Dichtel <[email protected]>
xfrm interface: fix packet tx through bpf_redirect()
Nicolas Dichtel <[email protected]>
vti[6]: fix packet tx through bpf_redirect()
Matwey V. Kornilov <[email protected]>
ARM: dts: am335x-boneblack-common: fix memory size
Johan Hovold <[email protected]>
Input: aiptek - use descriptors of current altsetting
Haim Dreyfuss <[email protected]>
iwlwifi: Don't ignore the cap field upon mcc update
Luca Coelho <[email protected]>
iwlwifi: mvm: fix NVM check for 3168 devices
Ilie Halip <[email protected]>
riscv: delete temporary files
Michael Chan <[email protected]>
bnxt_en: Fix ipv6 RFS filter matching logic.
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
Florian Westphal <[email protected]>
netfilter: nft_tunnel: ERSPAN_VERSION must not be null
Arnd Bergmann <[email protected]>
wireless: wext: avoid gcc -O3 warning
Jouni Malinen <[email protected]>
mac80211: Fix TKIP replay protection immediately after key setup
Orr Mazor <[email protected]>
cfg80211: Fix radar event during another phy CAC
Ganapathi Bhat <[email protected]>
wireless: fix enabling channel 12 for custom regulatory domain
Krzysztof Kozlowski <[email protected]>
parisc: Use proper printk format for resource_size_t
Kristian Evensen <[email protected]>
qmi_wwan: Add support for Quectel RM500Q
Arnaud Pouliquen <[email protected]>
ASoC: sti: fix possible sleep-in-atomic
Hans de Goede <[email protected]>
platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
Manfred Rudigier <[email protected]>
igb: Fix SGMII SFP module discovery for 100FX/LX.
Cambda Zhu <[email protected]>
ixgbe: Fix calculation of queue with VFs and flow director on interface flap
Radoslaw Tyl <[email protected]>
ixgbevf: Remove limit of 10 entries for unicast filter list
Dmitry Osipenko <[email protected]>
ASoC: rt5640: Fix NULL dereference on module unload
Lubomir Rintel <[email protected]>
clk: mmp2: Fix the order of timer mux parents
Markus Theil <[email protected]>
mac80211: mesh: restrict airtime metric to peered established plinks
Samuel Holland <[email protected]>
clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
Mathieu Desnoyers <[email protected]>
rseq: Unregister rseq for clone CLONE_VM
Hewenliang <[email protected]>
tools lib traceevent: Fix memory leakage in filter_event
Dave Gerlach <[email protected]>
soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
Kishon Vijay Abraham I <[email protected]>
ARM: dts: beagle-x15-common: Model 5V0 regulator
Kishon Vijay Abraham I <[email protected]>
ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
Marek Szyprowski <[email protected]>
ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
Lee Jones <[email protected]>
media: si470x-i2c: Move free() past last use of 'radio'
Michal Koutný <[email protected]>
cgroup: Prevent double killing of css when enabling threaded cgroup
Dan Carpenter <[email protected]>
Bluetooth: Fix race condition in hci_release_sock()
Zhenzhong Duan <[email protected]>
ttyprintk: fix a potential deadlock in interrupt context issue
Tetsuo Handa <[email protected]>
tomoyo: Use atomic_t for statistics counter
Hans Verkuil <[email protected]>
media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
Hans Verkuil <[email protected]>
media: gspca: zero usb_buf
Sean Young <[email protected]>
media: vp7045: do not read uninitialized values if usb transfer fails
Sean Young <[email protected]>
media: af9005: uninitialized variable printked
Sean Young <[email protected]>
media: digitv: don't continue if remote control state can't be read
Jan Kara <[email protected]>
reiserfs: Fix memory leak of journal device string
Dan Carpenter <[email protected]>
mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
Theodore Ts'o <[email protected]>
ext4: validate the debug_want_extra_isize mount option at parse time
Dirk Behme <[email protected]>
arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean'
Vitaly Chikunov <[email protected]>
tools lib: Fix builds when glibc contains strlcpy()
Chanwoo Choi <[email protected]>
PM / devfreq: Add new name attribute for sysfs
Andres Freund <[email protected]>
perf c2c: Fix return type for histogram sorting comparision functions
Johan Hovold <[email protected]>
rsi: fix use-after-free on failed probe and unbind
Siva Rebbagondla <[email protected]>
rsi: add hci detach for hibernation and poweroff
Herbert Xu <[email protected]>
crypto: pcrypt - Fix user-after-free on module unload
Xiaochen Shen <[email protected]>
x86/resctrl: Fix a deadlock due to inaccurate reference
Xiaochen Shen <[email protected]>
x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
Xiaochen Shen <[email protected]>
x86/resctrl: Fix use-after-free when deleting resource groups
Al Viro <[email protected]>
vfs: fix do_last() regression
-------------
Diffstat:
Documentation/ABI/testing/sysfs-class-devfreq | 7 ++ Makefile | 4 +- arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 + arch/arm/boot/dts/am43x-epos-evm.dts | 2 + arch/arm/boot/dts/am571x-idk.dts | 4 - arch/arm/boot/dts/am572x-idk-common.dtsi | 4 - arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 25 +++- arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- arch/arm/kernel/hyp-stub.S | 7 +- arch/arm64/boot/Makefile | 2 +- arch/parisc/kernel/drivers.c | 4 +- .../dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 + .../dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 + arch/riscv/kernel/vdso/Makefile | 3 +- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 32 ++++-- crypto/pcrypt.c | 3 +- drivers/char/ttyprintk.c | 15 ++- drivers/clk/mmp/clk-of-mmp2.c | 2 +- drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 +- drivers/devfreq/devfreq.c | 9 ++ drivers/input/tablet/aiptek.c | 2 +- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- drivers/media/usb/dvb-usb/af9005.c | 2 +- drivers/media/usb/dvb-usb/digitv.c | 10 +- drivers/media/usb/dvb-usb/dvb-usb-urb.c | 2 +- drivers/media/usb/dvb-usb/vp7045.c | 21 ++-- drivers/media/usb/gspca/gspca.c | 2 +- drivers/net/dsa/bcm_sf2.c | 2 +- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 +++- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +- drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +- drivers/net/ethernet/freescale/fman/fman_memac.c | 4 +- drivers/net/ethernet/freescale/xgmac_mdio.c | 7 +- drivers/net/ethernet/intel/igb/e1000_82575.c | 8 +- drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++-- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 - .../net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 + .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 + drivers/net/usb/qmi_wwan.c | 1 + drivers/net/usb/r8152.c | 9 +- drivers/net/wireless/cisco/airo.c | 20 ++-- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 +++++++- drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +- drivers/net/wireless/rsi/rsi_91x_sdio.c | 18 +++ drivers/net/wireless/rsi/rsi_91x_usb.c | 25 +++- drivers/platform/x86/gpd-pocket-fan.c | 2 +- drivers/scsi/fnic/fnic_scsi.c | 3 + drivers/soc/ti/wkup_m3_ipc.c | 4 +- drivers/tee/optee/Kconfig | 1 + fs/ext4/super.c | 127 +++++++++++---------- fs/namei.c | 4 +- fs/reiserfs/super.c | 2 + include/linux/sched.h | 4 +- include/net/cfg80211.h | 5 + kernel/cgroup/cgroup.c | 11 +- mm/mempolicy.c | 6 +- net/bluetooth/hci_sock.c | 3 + net/core/utils.c | 20 +++- net/ipv4/ip_vti.c | 13 ++- net/ipv6/ip6_vti.c | 13 ++- net/mac80211/cfg.c | 23 ++++ net/mac80211/mesh_hwmp.c | 3 + net/mac80211/tkip.c | 18 ++- net/netfilter/nft_tunnel.c | 3 + net/wireless/rdev-ops.h | 10 ++ net/wireless/reg.c | 36 +++++- net/wireless/trace.h | 5 + net/wireless/wext-core.c | 3 +- net/xfrm/xfrm_interface.c | 34 ++++-- security/tomoyo/common.c | 11 +- sound/soc/codecs/rt5640.c | 7 ++ sound/soc/sti/uniperif_player.c | 7 +- tools/include/linux/string.h | 8 ++ tools/lib/string.c | 7 ++ tools/lib/traceevent/parse-filter.c | 4 +- tools/perf/builtin-c2c.c | 10 +- 95 files changed, 596 insertions(+), 232 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/70 vfs: fix do_last() regression
From: Al Viro <[email protected]>
commit 6404674acd596de41fd3ad5f267b4525494a891a upstream.
Brown paperbag time: fetching ->i_uid/->i_mode really should've been done from nd->inode. I even suggested that, but the reason for that has slipped through the cracks and I went for dir->d_inode instead - made for more "obvious" patch.
Analysis:
- at the entry into do_last() and all the way to step_into(): dir (aka nd->path.dentry) is known not to have been freed; so's nd->inode and it's equal to dir->d_inode unless we are already doomed to -ECHILD. inode of the file to get opened is not known.
- after step_into(): inode of the file to get opened is known; dir might be pointing to freed memory/be negative/etc.
- at the call of may_create_in_sticky(): guaranteed to be out of RCU mode; inode of the file to get opened is known and pinned; dir might be garbage.
The last was the reason for the original patch. Except that at the do_last() entry we can be in RCU mode and it is possible that nd->path.dentry->d_inode has already changed under us.
In that case we are going to fail with -ECHILD, but we need to be careful; nd->inode is pointing to valid struct inode and it's the same as nd->path.dentry->d_inode in "won't fail with -ECHILD" case, so we should use that.
Wearing-brown-paperbag: Al Viro <[email protected]>
--- fs/namei.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/namei.c +2 -2
@@ -3259,8 +3259,8 @@ static int do_last(struct nameidata *nd, struct file *file, const struct open_flags *op) { struct dentry *dir = nd->path.dentry; -kuid_t dir_uid = dir->d_inode->i_uid; -umode_t dir_mode = dir->d_inode->i_mode; +kuid_t dir_uid = nd->inode->i_uid; +umode_t dir_mode = nd->inode->i_mode;int open_flag = op->open_flag;bool will_truncate = (open_flag &O_TRUNC ) !=0 ;bool got_write = false;
Greg Kroah-Hartman
maintainerPATCH 2/70 x86/resctrl: Fix use-after-free when deleting resource groups
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
commit b8511ccc75c033f6d54188ea4df7bf1e85778740 upstream.
A resource group (rdtgrp) contains a reference count (rdtgrp->waitcount) that indicates how many waiters expect this rdtgrp to exist. Waiters could be waiting on rdtgroup_mutex or some work sitting on a task's workqueue for when the task returns from kernel mode or exits.
The deletion of a rdtgrp is intended to have two phases:
(1) while holding rdtgroup_mutex the necessary cleanup is done and rdtgrp->flags is set to RDT_DELETED,
(2) after releasing the rdtgroup_mutex, the rdtgrp structure is freed only if there are no waiters and its flag is set to RDT_DELETED. Upon gaining access to rdtgroup_mutex or rdtgrp, a waiter is required to check for the RDT_DELETED flag.
When unmounting the resctrl file system or deleting ctrl_mon groups, all of the subdirectories are removed and the data structure of rdtgrp is forcibly freed without checking rdtgrp->waitcount. If at this point there was a waiter on rdtgrp then a use-after-free issue occurs when the waiter starts running and accesses the rdtgrp structure it was waiting on.
See kfree() calls in [1], [2] and [3] in these two call paths in following scenarios:
(1) rdt_kill_sb() -> rmdir_all_sub() -> free_all_child_rdtgrp()
(2) rdtgroup_rmdir() -> rdtgroup_rmdir_ctrl() -> free_all_child_rdtgrp()
There are several scenarios that result in use-after-free issue in following:
Scenario 1:
-----------
In Thread 1, rdtgroup_tasks_write() adds a task_work callback move_myself(). If move_myself() is scheduled to execute after Thread 2 rdt_kill_sb() is finished, referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_tasks_write) Thread 2 (rdt_kill_sb)
------------------------------- ----------------------rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lockrdtgroup_move_task
__rdtgroup_move_task
/*
* Take an extra refcount, so rdtgrp cannot be freed
* before the call back move_myself has been invoked
*/
atomic_inc(&rdtgrp->waitcount)
/* Callback move_myself will be scheduled for later */
task_work_add(move_myself)rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
mutex_lock
rmdir_all_sub
/*
* sentry and rdtgrp are freed
* without checking refcount
*/
free_all_child_rdtgrp
kfree(sentry)*[1]
kfree(rdtgrp)*[2]
mutex_unlock/*
* Callback is scheduled to execute
* after rdt_kill_sb is finished
*/move_myself
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [1] or [2].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)
Scenario 2:
-----------
In Thread 1, rdtgroup_tasks_write() adds a task_work callback move_myself(). If move_myself() is scheduled to execute after Thread 2 rdtgroup_rmdir() is finished, referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_tasks_write) Thread 2 (rdtgroup_rmdir)
------------------------------- -------------------------rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lockrdtgroup_move_task
__rdtgroup_move_task
/*
* Take an extra refcount, so rdtgrp cannot be freed
* before the call back move_myself has been invoked
*/
atomic_inc(&rdtgrp->waitcount)
/* Callback move_myself will be scheduled for later */
task_work_add(move_myself)rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lock
rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
/*
* sentry is freed without
* checking refcount
*/
kfree(sentry)*[3]
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(
&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)/*
* Callback is scheduled to execute
* after rdt_kill_sb is finished
*/move_myself
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [3].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kfree(rdtgrp)
If CONFIG_DEBUG_SLAB=y, Slab corruption on kmalloc-2k can be observed like following. Note that "0x6b" is POISON_FREE after kfree(). The corrupted bits "0x6a", "0x64" at offset 0x424 correspond to waitcount member of struct rdtgroup which was freed:
Slab corruption (Not tainted): kmalloc-2k start=ffff9504c5b0d000, len=2048 420: 6b 6b 6b 6b 6a 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkjkkkkkkkkkkk Single bit error detected. Probably bad RAM.
Run memtest86+ or a similar memory test tool.
Next obj: start=ffff9504c5b0d800, len=2048
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Slab corruption (Not tainted): kmalloc-2k start=ffff9504c58ab800, len=2048 420: 6b 6b 6b 6b 64 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkdkkkkkkkkkkk Prev obj: start=ffff9504c58ab000, len=2048
000: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 010: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Fix this by taking reference count (waitcount) of rdtgrp into account in the two call paths that currently do not do so. Instead of always freeing the resource group it will only be freed if there are no waiters on it. If there are waiters, the resource group will have its flags set to RDT_DELETED.
It will be left to the waiter to free the resource group when it starts running and finding that it was the last waiter and the resource group has been removed (rdtgrp->flags & RDT_DELETED) since. (1) rdt_kill_sb() -> rmdir_all_sub() -> free_all_child_rdtgrp() (2) rdtgroup_rmdir() -> rdtgroup_rmdir_ctrl() -> free_all_child_rdtgrp()
Backporting notes:
Since upstream commit fa7d949337cc ("x86/resctrl: Rename and move rdt files to a separate directory"), the file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c has been renamed and moved to arch/x86/kernel/cpu/resctrl/rdtgroup.c.
Apply the change against file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c in older stable trees.
--- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +10 -2
@@ -2167,7 +2167,11 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)list_for_each_entry_safe (sentry, stmp, head, mon.crdtgrp_list) {free_rmid (sentry->mon.rmid);list_del (&sentry->mon.crdtgrp_list); -kfree (sentry); + +if (atomic_read (&sentry->waitcount) !=0 ) + sentry->flags =RDT_DELETED ; +else +kfree (sentry); } }
@@ -2205,7 +2209,11 @@ static void rmdir_all_sub(void)kernfs_remove (rdtgrp->kn);list_del (&rdtgrp->rdtgroup_list); -kfree (rdtgrp); + +if (atomic_read (&rdtgrp->waitcount) !=0 ) + rdtgrp->flags =RDT_DELETED ; +else +kfree (rdtgrp); }/* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ update_closid_rmid (cpu_online_mask, &rdtgroup_default);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/70 x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
commit 074fadee59ee7a9d2b216e9854bd4efb5dad679f upstream.
There is a race condition in the following scenario which results in an use-after-free issue when reading a monitoring file and deleting the parent ctrl_mon group concurrently:
Thread 1 calls atomic_inc() to take refcount of rdtgrp and then calls kernfs_break_active_protection() to drop the active reference of kernfs node in rdtgroup_kn_lock_live().
In Thread 2, kernfs_remove() is a blocking routine. It waits on all sub kernfs nodes to drop the active reference when removing all subtree kernfs nodes recursively. Thread 2 could block on kernfs_remove() until Thread 1 calls kernfs_break_active_protection(). Only after kernfs_remove() completes the refcount of rdtgrp could be trusted.
Before Thread 1 calls atomic_inc() and kernfs_break_active_protection(), Thread 2 could call kfree() when the refcount of rdtgrp (sentry) is 0 instead of 1 due to the race.
In Thread 1, in rdtgroup_kn_unlock(), referring to earlier rdtgrp memory (rdtgrp->waitcount) which was already freed in Thread 2 results in use-after-free issue.
Thread 1 (rdtgroup_mondata_show) Thread 2 (rdtgroup_rmdir) -------------------------------- ------------------------- rdtgroup_kn_lock_live
/*
* kn active protection until
* kernfs_break_active_protection(kn)
*/
rdtgrp = kernfs_to_rdtgroup(kn)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
mutex_lock
rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
/*
* sentry->waitcount should be 1
* but is 0 now due to the race.
*/
kfree(sentry)*[1]
/*
* Only after kernfs_remove()
* completes, the refcount of
* rdtgrp could be trusted.
*/
atomic_inc(&rdtgrp->waitcount)
/* kn->active-- */
kernfs_break_active_protection(kn)
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
/*
* Blocking routine, wait for
* all sub kernfs nodes to drop
* active reference in
* kernfs_break_active_protection.
*/
kernfs_remove(rdtgrp->kn)
rdtgroup_kn_unlock
mutex_unlock
atomic_dec_and_test(
&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
kernfs_unbreak_active_protection(kn)
kfree(rdtgrp) mutex_lockmon_event_readrdtgroup_kn_unlock
mutex_unlock
/*
* Use-after-free: refer to earlier rdtgrp
* memory which was freed in [1].
*/
atomic_dec_and_test(&rdtgrp->waitcount)
&& (flags & RDT_DELETED)
/* kn->active++ */
kernfs_unbreak_active_protection(kn)
kfree(rdtgrp)Fix it by moving free_all_child_rdtgrp() to after kernfs_remove() in rdtgroup_rmdir_ctrl() to ensure it has the accurate refcount of rdtgrp.
Backporting notes:
Since upstream commit fa7d949337cc ("x86/resctrl: Rename and move rdt files to a separate directory"), the file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c has been renamed and moved to arch/x86/kernel/cpu/resctrl/rdtgroup.c.
Apply the change against file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c for older stable trees.
--- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +2 -2
@@ -2877,13 +2877,13 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,closid_free (rdtgrp->closid);free_rmid (rdtgrp->mon.rmid); +rdtgroup_ctrl_remove (kn, rdtgrp); +/* * Free all the child monitor group rmids. */ free_all_child_rdtgrp (rdtgrp); -rdtgroup_ctrl_remove (kn, rdtgrp); -return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/70 x86/resctrl: Fix a deadlock due to inaccurate reference
In reply to Greg Kroah-HartmanFrom: Xiaochen Shen <[email protected]>
commit 334b0f4e9b1b4a1d475f803419d202f6c5e4d18e upstream.
There is a race condition which results in a deadlock when rmdir and mkdir execute concurrently:
$ ls /sys/fs/resctrl/c1/mon_groups/m1/ cpus cpus_list mon_data tasks
Thread 1: rmdir /sys/fs/resctrl/c1
Thread 2: mkdir /sys/fs/resctrl/c1/mon_groups/m1
3 locks held by mkdir/48649:
#0: (sb_writers#17){.+.+}, at: [<ffffffffb4ca2aa0>] mnt_want_write+0x20/0x50
#1: (&type->i_mutex_dir_key#8/1){+.+.}, at: [<ffffffffb4c8c13b>] filename_create+0x7b/0x170
#2: (rdtgroup_mutex){+.+.}, at: [<ffffffffb4a4389d>] rdtgroup_kn_lock_live+0x3d/0x704 locks held by rmdir/48652:
#0: (sb_writers#17){.+.+}, at: [<ffffffffb4ca2aa0>] mnt_want_write+0x20/0x50
#1: (&type->i_mutex_dir_key#8/1){+.+.}, at: [<ffffffffb4c8c3cf>] do_rmdir+0x13f/0x1e0
#2: (&type->i_mutex_dir_key#8){++++}, at: [<ffffffffb4c86d5d>] vfs_rmdir+0x4d/0x120
#3: (rdtgroup_mutex){+.+.}, at: [<ffffffffb4a4389d>] rdtgroup_kn_lock_live+0x3d/0x70Thread 1 is deleting control group "c1". Holding rdtgroup_mutex, kernfs_remove() removes all kernfs nodes under directory "c1" recursively, then waits for sub kernfs node "mon_groups" to drop active reference.
Thread 2 is trying to create a subdirectory "m1" in the "mon_groups" directory. The wrapper kernfs_iop_mkdir() takes an active reference to the "mon_groups" directory but the code drops the active reference to the parent directory "c1" instead.
As a result, Thread 1 is blocked on waiting for active reference to drop and never release rdtgroup_mutex, while Thread 2 is also blocked on trying to get rdtgroup_mutex.
Thread 1 (rdtgroup_rmdir) Thread 2 (rdtgroup_mkdir) (rmdir /sys/fs/resctrl/c1) (mkdir /sys/fs/resctrl/c1/mon_groups/m1) ------------------------- -------------------------
kernfs_iop_mkdir
/*
* kn: "m1", parent_kn: "mon_groups",
* prgrp_kn: parent_kn->parent: "c1", *
* "mon_groups", parent_kn->active++: 1 */
kernfs_get_active(parent_kn)kernfs_iop_rmdir
/* "c1", kn->active++ */
kernfs_get_active(kn)
rdtgroup_kn_lock_live
atomic_inc(&rdtgrp->waitcount)
/* "c1", kn->active-- */
kernfs_break_active_protection(kn)
mutex_lock rdtgroup_rmdir_ctrl
free_all_child_rdtgrp
sentry->flags = RDT_DELETED
rdtgroup_ctrl_remove
rdtgrp->flags = RDT_DELETED
kernfs_get(kn)
kernfs_remove(rdtgrp->kn)
__kernfs_remove
/* "mon_groups", sub_kn */
atomic_add(KN_DEACTIVATED_BIAS, &sub_kn->active)
kernfs_drain(sub_kn)
/*
* sub_kn->active == KN_DEACTIVATED_BIAS + 1,
* waiting on sub_kn->active to drop, but it
* never drops in Thread 2 which is blocked
* on getting rdtgroup_mutex.
*/Thread 1 hangs here ---->
wait_event(sub_kn->active == KN_DEACTIVATED_BIAS)
...
rdtgroup_mkdir
rdtgroup_mkdir_mon(parent_kn, prgrp_kn)
mkdir_rdt_prepare(parent_kn, prgrp_kn)
rdtgroup_kn_lock_live(prgrp_kn)
atomic_inc(&rdtgrp->waitcount) /*
* "c1", prgrp_kn->active-- *
* The active reference on "c1" is
* dropped, but not matching the
* actual active reference taken
* on "mon_groups", thus causing
* Thread 1 to wait forever while
* holding rdtgroup_mutex. */
kernfs_break_active_protection(
prgrp_kn)
/*
* Trying to get rdtgroup_mutex
* which is held by Thread 1. */
Thread 2 hangs here ----> mutex_lock
...
The problem is that the creation of a subdirectory in the "mon_groups" directory incorrectly releases the active protection of its parent directory instead of itself before it starts waiting for rdtgroup_mutex. This is triggered by the rdtgroup_mkdir() flow calling rdtgroup_kn_lock_live()/rdtgroup_kn_unlock() with kernfs node of the parent control group ("c1") as argument. It should be called with kernfs node "mon_groups" instead. What is currently missing is that the kn->priv of "mon_groups" is NULL instead of pointing to the rdtgrp.
Fix it by pointing kn->priv to rdtgrp when "mon_groups" is created. Then it could be passed to rdtgroup_kn_lock_live()/rdtgroup_kn_unlock() instead. And then it operates on the same rdtgroup structure but handles the active reference of kernfs node "mon_groups" to prevent deadlock. The same changes are also made to the "mon_data" directories.
This results in some unused function parameters that will be cleaned up in follow-up patch as the focus here is on the fix only in support of backporting efforts.
Backporting notes:
Since upstream commit fa7d949337cc ("x86/resctrl: Rename and move rdt files to a separate directory"), the file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c has been renamed and moved to arch/x86/kernel/cpu/resctrl/rdtgroup.c.
Apply the change against file arch/x86/kernel/cpu/intel_rdt_rdtgroup.c for older stable trees.
--- arch/x86/kernel/cpu/intel_rdt_rdtgroup.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +8 -8
@@ -2005,7 +2005,7 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,if (rdt_mon_capable) { ret =mongroup_create_dir (rdtgroup_default.kn, -NULL ,"mon_groups" , + &rdtgroup_default,"mon_groups" , &kn_mongrp);if (ret) { dentry =ERR_PTR (ret);
@@ -2415,7 +2415,7 @@ static int mkdir_mondata_all(struct kernfs_node *parent_kn,/* * Create the mon_data directory first. */ - ret =mongroup_create_dir (parent_kn,NULL ,"mon_data" , &kn); + ret =mongroup_create_dir (parent_kn, prgrp,"mon_data" , &kn);if (ret)return ret;
@@ -2568,7 +2568,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,uint files =0 ;int ret; - prdtgrp =rdtgroup_kn_lock_live (prgrp_kn); + prdtgrp =rdtgroup_kn_lock_live (parent_kn);rdt_last_cmd_clear ();if (!prdtgrp) { ret = -ENODEV ;
@@ -2643,7 +2643,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,kernfs_activate (kn);/* -* The caller unlocks the prgrp_kn upon success. +* The caller unlocks the parent_kn upon success. */ return 0 ;
@@ -2654,7 +2654,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn, out_free_rgrp:kfree (rdtgrp); out_unlock: -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
@@ -2692,7 +2692,7 @@ static int rdtgroup_mkdir_mon(struct kernfs_node *parent_kn,*/ list_add_tail (&rdtgrp->mon.crdtgrp_list, &prgrp->mon.crdtgrp_list); -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
@@ -2735,7 +2735,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn,* Create an empty mon_groups directory to hold the subset * of tasks and cpus to monitor. */ - ret =mongroup_create_dir (kn,NULL ,"mon_groups" ,NULL ); + ret =mongroup_create_dir (kn, rdtgrp,"mon_groups" ,NULL );if (ret) {rdt_last_cmd_puts ("kernfs subdir error\n" ); goto out_del_list;
@@ -2751,7 +2751,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn, out_common_fail:mkdir_rdt_prepare_clean (rdtgrp); out_unlock: -rdtgroup_kn_unlock (prgrp_kn); +rdtgroup_kn_unlock (parent_kn);return ret; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/70 crypto: pcrypt - Fix user-after-free on module unload
In reply to Greg Kroah-HartmanFrom: Herbert Xu <[email protected]>
[ Upstream commit 07bfd9bdf568a38d9440c607b72342036011f727 ]
On module unload of pcrypt we must unregister the crypto algorithms first and then tear down the padata structure. As otherwise the crypto algorithms are still alive and can be used while the padata structure is being freed.
--- crypto/pcrypt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
crypto/pcrypt.c +2 -1
@@ -505,11 +505,12 @@ static int __init pcrypt_init(void) static void __exit pcrypt_exit(void) { +crypto_unregister_template (&pcrypt_tmpl); +pcrypt_fini_padata (&pencrypt);pcrypt_fini_padata (&pdecrypt);kset_unregister (pcrypt_kset); -crypto_unregister_template (&pcrypt_tmpl); }module_init (pcrypt_init);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/70 rsi: add hci detach for hibernation and poweroff
In reply to Greg Kroah-HartmanFrom: Siva Rebbagondla <[email protected]>
[ Upstream commit cbde979b33fa16e06dadc2c81093699a2bc787db ]
As we missed to detach HCI, while entering power off or hibernation, an extra hci interface gets created whenever system is woken up, to avoid this we added hci_detach() in rsi_disconnect(), rsi_freeze(), and rsi_shutdown() functions which are invoked for these tests. This patch fixes the issue
--- drivers/net/wireless/rsi/rsi_91x_sdio.c | 18 ++++++++++++++++++ drivers/net/wireless/rsi/rsi_91x_usb.c | 7 +++++++ 2 files changed, 25 insertions(+)
drivers/net/wireless/rsi/rsi_91x_sdio.c +18 -0
@@ -1129,6 +1129,12 @@ static void rsi_disconnect(struct sdio_func *pfunction)rsi_mac80211_detach (adapter);mdelay (10 ); +if (IS_ENABLED (CONFIG_RSI_COEX ) && adapter->priv->coex_mode >1 && + adapter->priv->bt_adapter) { + rsi_bt_ops.detach (adapter->priv->bt_adapter); + adapter->priv->bt_adapter =NULL ; + } +/* Reset Chip */ rsi_reset_chip (adapter);
@@ -1305,6 +1311,12 @@ static int rsi_freeze(struct device *dev)rsi_dbg (ERR_ZONE ,"##### Device can not wake up through WLAN\n" ); +if (IS_ENABLED (CONFIG_RSI_COEX ) && common->coex_mode >1 && + common->bt_adapter) { + rsi_bt_ops.detach (common->bt_adapter); + common->bt_adapter =NULL ; + } + ret =rsi_sdio_disable_interrupts (pfunction);if (sdev->write_fail)
@@ -1352,6 +1364,12 @@ static void rsi_shutdown(struct device *dev)if (rsi_config_wowlan (adapter, wowlan))rsi_dbg (ERR_ZONE ,"Failed to configure WoWLAN\n" ); +if (IS_ENABLED (CONFIG_RSI_COEX ) && adapter->priv->coex_mode >1 && + adapter->priv->bt_adapter) { + rsi_bt_ops.detach (adapter->priv->bt_adapter); + adapter->priv->bt_adapter =NULL ; + } +rsi_sdio_disable_interrupts (sdev->pfunction);if (sdev->write_fail)
drivers/net/wireless/rsi/rsi_91x_usb.c +7 -0
@@ -818,6 +818,13 @@ static void rsi_disconnect(struct usb_interface *pfunction)return ;rsi_mac80211_detach (adapter); + +if (IS_ENABLED (CONFIG_RSI_COEX ) && adapter->priv->coex_mode >1 && + adapter->priv->bt_adapter) { + rsi_bt_ops.detach (adapter->priv->bt_adapter); + adapter->priv->bt_adapter =NULL ; + } +rsi_reset_card (adapter);rsi_deinit_usb_interface (adapter);rsi_91x_deinit (adapter);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/70 rsi: fix use-after-free on failed probe and unbind
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit e93cd35101b61e4c79149be2cfc927c4b28dc60c ]
Make sure to stop both URBs before returning after failed probe as well as on disconnect to avoid use-after-free in the completion handler.
--- drivers/net/wireless/rsi/rsi_91x_usb.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-)
drivers/net/wireless/rsi/rsi_91x_usb.c +17 -1
@@ -291,6 +291,15 @@ static void rsi_rx_done_handler(struct urb *urb)dev_kfree_skb (rx_cb->rx_skb); } +static void rsi_rx_urb_kill (struct rsi_hw *adapter,u8 ep_num) +{ +struct rsi_91x_usbdev *dev = (struct rsi_91x_usbdev *)adapter->rsi_dev; +struct rx_usb_ctrl_block *rx_cb = &dev->rx_cb[ep_num -1 ]; +struct urb *urb = rx_cb->rx_urb; + +usb_kill_urb (urb); +} +/** * rsi_rx_urb_submit() - This function submits the given URB to the USB stack. * @adapter: Pointer to the adapter structure.
@@ -791,10 +800,13 @@ static int rsi_probe(struct usb_interface *pfunction,if (adapter->priv->coex_mode >1 ) { status =rsi_rx_urb_submit (adapter,BT_EP ,GFP_KERNEL );if (status) - goto err1; + goto err_kill_wlan_urb; }return 0 ; + +err_kill_wlan_urb: +rsi_rx_urb_kill (adapter,WLAN_EP ); err1:rsi_deinit_usb_interface (adapter); err:
@@ -825,6 +837,10 @@ static void rsi_disconnect(struct usb_interface *pfunction) adapter->priv->bt_adapter =NULL ; } +if (adapter->priv->coex_mode >1 ) +rsi_rx_urb_kill (adapter,BT_EP ); +rsi_rx_urb_kill (adapter,WLAN_EP ); +rsi_reset_card (adapter);rsi_deinit_usb_interface (adapter);rsi_91x_deinit (adapter);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/70 perf c2c: Fix return type for histogram sorting comparision functions
In reply to Greg Kroah-HartmanFrom: Andres Freund <[email protected]>
commit c1c8013ec34d7163431d18367808ea40b2e305f8 upstream.
Commit 722ddfde366f ("perf tools: Fix time sorting") changed - correctly so - hist_entry__sort to return int64. Unfortunately several of the builtin-c2c.c comparison routines only happened to work due the cast caused by the wrong return type.
This causes meaningless ordering of both the cacheline list, and the cacheline details page. E.g a simple:
perf c2c record -a sleep 3
perf c2c report
will result in cacheline table like
=================================================
Shared Data Cache Line Table
=================================================
#
# ------- Cacheline ---------- Total Tot - LLC Load Hitm - - Store Reference - - Load Dram - LLC Total - Core Load Hit - - LLC Load Hit - # Index Address Node PA cnt records Hitm Total Lcl Rmt Total L1Hit L1Miss Lcl Rmt Ld Miss Loads FB L1 L2 Llc Rmt # ..... .............. .... ...... ....... ...... ..... ..... ... .... ..... ...... ...... .... ...... ..... ..... ..... ... .... .......
0 0x7f0d27ffba00 N/A 0 52 0.12% 13 6 7 12 12 0 0 7 14 40 4 16 0 0 0
1 0x7f0d27ff61c0 N/A 0 6353 14.04% 1475 801 674 779 779 0 0 718 1392 5574 1299 1967 0 115 0
2 0x7f0d26d3ec80 N/A 0 71 0.15% 16 4 12 13 13 0 0 12 24 58 1 20 0 9 0
3 0x7f0d26d3ec00 N/A 0 98 0.22% 23 17 6 19 19 0 0 6 12 79 0 40 0 10 0i.e. with the list not being ordered by Total Hitm.
--- tools/perf/builtin-c2c.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
tools/perf/builtin-c2c.c +6 -4
@@ -586,8 +586,8 @@ tot_hitm_cmp(struct perf_hpp_fmt *fmt __ {struct c2c_hist_entry *c2c_left;struct c2c_hist_entry *c2c_right; -unsigned int tot_hitm_left; -unsigned int tot_hitm_right; +uint64_t tot_hitm_left; +uint64_t tot_hitm_right; c2c_left = container_of(left, struct c2c_hist_entry, he); c2c_right = container_of(right, struct c2c_hist_entry, he);
@@ -620,7 +620,8 @@ __f ## _cmp(struct perf_hpp_fmt *fmt __m \ c2c_left = container_of(left, struct c2c_hist_entry, he); \ c2c_right = container_of(right, struct c2c_hist_entry, he); \ -return c2c_left->stats.__f - c2c_right->stats.__f; \ +return (uint64_t ) c2c_left->stats.__f - \ + (uint64_t ) c2c_right->stats.__f; \ }#define STAT_FN (__f) \
@@ -673,7 +674,8 @@ ld_llcmiss_cmp(struct perf_hpp_fmt *fmt c2c_left = container_of(left, struct c2c_hist_entry, he); c2c_right = container_of(right, struct c2c_hist_entry, he); -return llc_miss (&c2c_left->stats) -llc_miss (&c2c_right->stats); +return (uint64_t )llc_miss (&c2c_left->stats) - + (uint64_t )llc_miss (&c2c_right->stats); }static uint64_t total_records (struct c2c_stats *stats)
Greg Kroah-Hartman
maintainerPATCH 9/70 PM / devfreq: Add new name attribute for sysfs
In reply to Greg Kroah-HartmanFrom: Chanwoo Choi <[email protected]>
commit 2fee1a7cc6b1ce6634bb0f025be2c94a58dfa34d upstream.
The commit 4585fbcb5331 ("PM / devfreq: Modify the device name as devfreq(X) for sysfs") changed the node name to devfreq(x). After this commit, it is not possible to get the device name through /sys/class/devfreq/devfreq(X)/*.
Add new name attribute in order to get device name.
--- Documentation/ABI/testing/sysfs-class-devfreq | 7 +++++++ drivers/devfreq/devfreq.c | 9 +++++++++ 2 files changed, 16 insertions(+)
Documentation/ABI/testing/sysfs-class-devfreq +7 -0
@@ -7,6 +7,13 @@ Description: The name of devfreq object denoted as ... is same as the name of device using devfreq. +What: /sys/class/devfreq/.../name +Date: November 2019 +Contact: Chanwoo Choi <[email protected]> +Description: + The /sys/class/devfreq/.../name shows the name of device + of the corresponding devfreq object. + What: /sys/class/devfreq/.../governor Date: September 2011 Contact: MyungJoo Ham <[email protected]>
drivers/devfreq/devfreq.c +9 -0
@@ -1014,6 +1014,14 @@ err_out: }EXPORT_SYMBOL (devfreq_remove_governor); +static ssize_t name_show (struct device *dev, +struct device_attribute *attr,char *buf) +{ +struct devfreq *devfreq =to_devfreq (dev); +return sprintf (buf,"%s\n" ,dev_name (devfreq->dev.parent)); +} +static DEVICE_ATTR_RO (name); +static ssize_t governor_show (struct device *dev,struct device_attribute *attr,char *buf) {
@@ -1330,6 +1338,7 @@ static ssize_t trans_stat_show(struct destatic DEVICE_ATTR_RO (trans_stat);static struct attribute *devfreq_attrs[] = { + &dev_attr_name.attr, &dev_attr_governor.attr, &dev_attr_available_governors.attr, &dev_attr_cur_freq.attr,
Greg Kroah-Hartman
maintainerPATCH 10/70 tools lib: Fix builds when glibc contains strlcpy()
In reply to Greg Kroah-HartmanFrom: Vitaly Chikunov <[email protected]>
commit 6c4798d3f08b81c2c52936b10e0fa872590c96ae upstream.
Disable a couple of compilation warnings (which are treated as errors) on strlcpy() definition and declaration, allowing users to compile perf and kernel (objtool) when:
1. glibc have strlcpy() (such as in ALT Linux since 2004) objtool and perf build fails with this (in gcc):
In file included from exec-cmd.c:3:
tools/include/linux/string.h:20:15: error: redundant redeclaration of ‘strlcpy’ [-Werror=redundant-decls]
20 | extern size_t strlcpy(char *dest, const char *src, size_t size);
2. clang ignores `-Wredundant-decls', but produces another warning when building perf:
CC util/string.o
../lib/string.c:99:8: error: attribute declaration must precede definition [-Werror,-Wignored-attributes] size_t __weak strlcpy(char *dest, const char *src, size_t size) ../../tools/include/linux/compiler.h:66:34: note: expanded from macro '__weak'
# define __weak __attribute__((weak)) /usr/include/bits/string_fortified.h:151:8: note: previous definition is here __NTH (strlcpy (char *__restrict __dest, const char *__restrict __src,
Committer notes:
The
#pragma GCC diagnostic
directive was introduced in gcc 4.6, so check for that as well.
Resolves: https://bugzilla.kernel.org/show_bug.cgi?id=118481
--- tools/include/linux/string.h | 8 ++++++++ tools/lib/string.c | 7 +++++++ 2 files changed, 15 insertions(+)
tools/include/linux/string.h +8 -0
@@ -14,7 +14,15 @@ int strtobool(const char *s, bool *res);* However uClibc headers also define __GLIBC__ hence the hack below */ #if defined(__GLIBC__) && !defined(__UCLIBC__) +// pragma diagnostic was introduced in gcc 4.6 +#if __GNUC__ >4 || (__GNUC__ ==4 && __GNUC_MINOR__ >=6 ) +#pragma GCC diagnostic push +#pragma GCC diagnostic ignored "-Wredundant-decls" +#endif extern size_t strlcpy (char *dest,const char *src,size_t size); +#if __GNUC__ >4 || (__GNUC__ ==4 && __GNUC_MINOR__ >=6 ) +#pragma GCC diagnostic pop +#endif #endif char *str_error_r (int errnum,char *buf,size_t buflen);
tools/lib/string.c +7 -0
@@ -95,6 +95,10 @@ int strtobool(const char *s, bool *res)* If libc has strlcpy() then that version will override this * implementation: */ +#ifdef __clang__ +#pragma clang diagnostic push +#pragma clang diagnostic ignored "-Wignored-attributes" +#endif size_t __weak strlcpy (char *dest,const char *src,size_t size) {size_t ret =strlen (src);
@@ -106,3 +110,6 @@ size_t __weak strlcpy(char *dest, const }return ret; } +#ifdef __clang__ +#pragma clang diagnostic pop +#endif
Greg Kroah-Hartman
maintainerPATCH 11/70 arm64: kbuild: remove compressed images on make ARCH=arm64 (dist)clean
In reply to Greg Kroah-HartmanFrom: Dirk Behme <[email protected]>
commit d7bbd6c1b01cb5dd13c245d4586a83145c1d5f52 upstream.
Since v4.3-rc1 commit 0723c05fb75e44 ("arm64: enable more compressed Image formats"), it is possible to build Image.{bz2,lz4,lzma,lzo} AArch64 images. However, the commit missed adding support for removing those images on 'make ARCH=arm64 (dist)clean'.
Fix this by adding them to the target list.
Make sure to match the order of the recipes in the makefile.
--- arch/arm64/boot/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/Makefile +1 -1
@@ -16,7 +16,7 @@ OBJCOPYFLAGS_Image :=-O binary -R .note -R .note.gnu.build-id -R .comment -S -targets := Image Image.gz +targets := Image Image.bz2 Image.gz Image.lz4 Image.lzma Image.lzo $(obj)/Image: vmlinux FORCE $(call if_changed,objcopy)
Greg Kroah-Hartman
maintainerPATCH 12/70 ext4: validate the debug_want_extra_isize mount option at parse time
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 9803387c55f7d2ce69aa64340c5fdc6b3027dbc8 upstream.
Instead of setting s_want_extra_size and then making sure that it is a valid value afterwards, validate the field before we set it. This avoids races and other problems when remounting the file system.
--- fs/ext4/super.c | 127 +++++++++++++++++++++++++++++--------------------------- 1 file changed, 66 insertions(+), 61 deletions(-)
fs/ext4/super.c +66 -61
@@ -1842,6 +1842,13 @@ static int handle_mount_opt(struct super arg =JBD2_DEFAULT_MAX_COMMIT_AGE ; sbi->s_commit_interval =HZ * arg; }else if (token == Opt_debug_want_extra_isize) { +if ((arg &1 ) || + (arg <4 ) || + (arg > (sbi->s_inode_size -EXT4_GOOD_OLD_INODE_SIZE ))) { +ext4_msg (sb,KERN_ERR , +"Invalid want_extra_isize %d" , arg); +return -1 ; + } sbi->s_want_extra_isize = arg; }else if (token == Opt_max_batch_time) { sbi->s_max_batch_time = arg;
@@ -3513,40 +3520,6 @@ int ext4_calculate_overhead(struct superreturn 0 ; } -static void ext4_clamp_want_extra_isize (struct super_block *sb) -{ -struct ext4_sb_info *sbi =EXT4_SB (sb); -struct ext4_super_block *es = sbi->s_es; -unsigned def_extra_isize =sizeof (struct ext4_inode ) - -EXT4_GOOD_OLD_INODE_SIZE ; - -if (sbi->s_inode_size ==EXT4_GOOD_OLD_INODE_SIZE ) { - sbi->s_want_extra_isize =0 ; -return ; - } -if (sbi->s_want_extra_isize <4 ) { - sbi->s_want_extra_isize = def_extra_isize; -if (ext4_has_feature_extra_isize (sb)) { -if (sbi->s_want_extra_isize < -le16_to_cpu (es->s_want_extra_isize)) - sbi->s_want_extra_isize = -le16_to_cpu (es->s_want_extra_isize); -if (sbi->s_want_extra_isize < -le16_to_cpu (es->s_min_extra_isize)) - sbi->s_want_extra_isize = -le16_to_cpu (es->s_min_extra_isize); - } - } -/* Check if enough inode space is available */ -if ((sbi->s_want_extra_isize > sbi->s_inode_size) || - (EXT4_GOOD_OLD_INODE_SIZE + sbi->s_want_extra_isize > - sbi->s_inode_size)) { - sbi->s_want_extra_isize = def_extra_isize; -ext4_msg (sb,KERN_INFO , -"required extra inode space not available" ); - } -} -static void ext4_set_resv_clusters (struct super_block *sb) {ext4_fsblk_t resv_clusters;
@@ -3754,6 +3727,65 @@ static int ext4_fill_super(struct super_*/ sbi->s_li_wait_mult =EXT4_DEF_LI_WAIT_MULT ; +if (le32_to_cpu (es->s_rev_level) ==EXT4_GOOD_OLD_REV ) { + sbi->s_inode_size =EXT4_GOOD_OLD_INODE_SIZE ; + sbi->s_first_ino =EXT4_GOOD_OLD_FIRST_INO ; + }else { + sbi->s_inode_size =le16_to_cpu (es->s_inode_size); + sbi->s_first_ino =le32_to_cpu (es->s_first_ino); +if (sbi->s_first_ino <EXT4_GOOD_OLD_FIRST_INO ) { +ext4_msg (sb,KERN_ERR ,"invalid first ino: %u" , + sbi->s_first_ino); + goto failed_mount; + } +if ((sbi->s_inode_size <EXT4_GOOD_OLD_INODE_SIZE ) || + (!is_power_of_2 (sbi->s_inode_size)) || + (sbi->s_inode_size > blocksize)) { +ext4_msg (sb,KERN_ERR , +"unsupported inode size: %d" , + sbi->s_inode_size); + goto failed_mount; + } +/* +* i_atime_extra is the last extra field available for +* [acm]times in struct ext4_inode. Checking for that +* field should suffice to ensure we have extra space +* for all three. +*/ +if (sbi->s_inode_size >= offsetof(struct ext4_inode , i_atime_extra) + +sizeof (((struct ext4_inode *)0 )->i_atime_extra)) { + sb->s_time_gran =1 ; + }else { + sb->s_time_gran =NSEC_PER_SEC ; + } + } +if (sbi->s_inode_size >EXT4_GOOD_OLD_INODE_SIZE ) { + sbi->s_want_extra_isize =sizeof (struct ext4_inode ) - +EXT4_GOOD_OLD_INODE_SIZE ; +if (ext4_has_feature_extra_isize (sb)) { +unsigned v, max = (sbi->s_inode_size - +EXT4_GOOD_OLD_INODE_SIZE ); + + v =le16_to_cpu (es->s_want_extra_isize); +if (v > max) { +ext4_msg (sb,KERN_ERR , +"bad s_want_extra_isize: %d" , v); + goto failed_mount; + } +if (sbi->s_want_extra_isize < v) + sbi->s_want_extra_isize = v; + + v =le16_to_cpu (es->s_min_extra_isize); +if (v > max) { +ext4_msg (sb,KERN_ERR , +"bad s_min_extra_isize: %d" , v); + goto failed_mount; + } +if (sbi->s_want_extra_isize < v) + sbi->s_want_extra_isize = v; + } + } +if (sbi->s_es->s_mount_opts[0 ]) { char *s_mount_opts = kstrndup(sbi->s_es->s_mount_opts, sizeof(sbi->s_es->s_mount_opts),
@@ -3955,29 +3987,6 @@ static int ext4_fill_super(struct super_ has_huge_files); sb->s_maxbytes =ext4_max_size (sb->s_blocksize_bits, has_huge_files); -if (le32_to_cpu (es->s_rev_level) ==EXT4_GOOD_OLD_REV ) { - sbi->s_inode_size =EXT4_GOOD_OLD_INODE_SIZE ; - sbi->s_first_ino =EXT4_GOOD_OLD_FIRST_INO ; - }else { - sbi->s_inode_size =le16_to_cpu (es->s_inode_size); - sbi->s_first_ino =le32_to_cpu (es->s_first_ino); -if (sbi->s_first_ino <EXT4_GOOD_OLD_FIRST_INO ) { -ext4_msg (sb,KERN_ERR ,"invalid first ino: %u" , - sbi->s_first_ino); - goto failed_mount; - } -if ((sbi->s_inode_size <EXT4_GOOD_OLD_INODE_SIZE ) || - (!is_power_of_2 (sbi->s_inode_size)) || - (sbi->s_inode_size > blocksize)) { -ext4_msg (sb,KERN_ERR , -"unsupported inode size: %d" , - sbi->s_inode_size); - goto failed_mount; - } -if (sbi->s_inode_size >EXT4_GOOD_OLD_INODE_SIZE ) - sb->s_time_gran =1 << (EXT4_EPOCH_BITS -2 ); - } - sbi->s_desc_size =le16_to_cpu (es->s_desc_size);if (ext4_has_feature_64bit (sb)) { if (sbi->s_desc_size < EXT4_MIN_DESC_SIZE_64BIT ||
@@ -4421,8 +4430,6 @@ no_journal: }else if (ret) goto failed_mount4a; -ext4_clamp_want_extra_isize (sb); -ext4_set_resv_clusters (sb); err =ext4_setup_system_zone (sb);
@@ -5207,8 +5214,6 @@ static int ext4_remount(struct super_blo goto restore_opts; } -ext4_clamp_want_extra_isize (sb); -if ((old_opts.s_mount_opt &EXT4_MOUNT_JOURNAL_CHECKSUM ) ^test_opt (sb,JOURNAL_CHECKSUM )) { ext4_msg(sb, KERN_ERR, "changing journal_checksum "
Greg Kroah-Hartman
maintainerPATCH 13/70 mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit c7a91bc7c2e17e0a9c8b9745a2cb118891218fd1 upstream.
What we are trying to do is change the '=' character to a NUL terminator and then at the end of the function we restore it back to an '='. The problem is there are two error paths where we jump to the end of the function before we have replaced the '=' with NUL.
We end up putting the '=' in the wrong place (possibly one element before the start of the buffer).
Dmitry Vyukov <[email protected]>
--- mm/mempolicy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
mm/mempolicy.c +3 -3
@@ -2808,6 +2808,9 @@ int mpol_parse_str(char *str, struct memchar *flags =strchr (str,'=' );int err =1 ; +if (flags) + *flags++ ='\0' ;/* terminate mode string */ +if (nodelist) {/* NUL-terminate mode or flags string */ *nodelist++ ='\0' ;
@@ -2818,9 +2821,6 @@ int mpol_parse_str(char *str, struct mem }else nodes_clear (nodes); -if (flags) - *flags++ ='\0' ;/* terminate mode string */ -for (mode =0 ; mode <MPOL_MAX ; mode++) {if (!strcmp (str, policy_modes[mode])) {break ;
Greg Kroah-Hartman
maintainerPATCH 14/70 reiserfs: Fix memory leak of journal device string
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 5474ca7da6f34fa95e82edc747d5faa19cbdfb5c upstream.
When a filesystem is mounted with jdev mount option, we store the journal device name in an allocated string in superblock. However we fail to ever free that string. Fix it.
--- fs/reiserfs/super.c | 2 ++ 1 file changed, 2 insertions(+)
fs/reiserfs/super.c +2 -0
@@ -629,6 +629,7 @@ static void reiserfs_put_super(struct sureiserfs_write_unlock (s);mutex_destroy (&REISERFS_SB (s)->lock);destroy_workqueue (REISERFS_SB (s)->commit_wq); +kfree (REISERFS_SB (s)->s_jdev);kfree (s->s_fs_info); s->s_fs_info =NULL ; }
@@ -2243,6 +2244,7 @@ error_unlocked: kfree(qf_names[j]); }#endif +kfree (sbi->s_jdev);kfree (sbi); s->s_fs_info =NULL ;
Greg Kroah-Hartman
maintainerPATCH 15/70 media: digitv: dont continue if remote control state cant be read
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit eecc70d22ae51225de1ef629c1159f7116476b2e upstream.
This results in an uninitialized variable read.
--- drivers/media/usb/dvb-usb/digitv.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/digitv.c +7 -3
@@ -233,18 +233,22 @@ static struct rc_map_table rc_map_digitvstatic int digitv_rc_query (struct dvb_usb_device *d,u32 *event,int *state) { -int i; +int ret, i;u8 key[5 ];u8 b[4 ] = {0 }; *event =0 ; *state =REMOTE_NO_KEY_PRESSED ; -digitv_ctrl_msg (d,USB_READ_REMOTE ,0 ,NULL ,0 ,&key[1 ],4 ); + ret =digitv_ctrl_msg (d,USB_READ_REMOTE ,0 ,NULL ,0 , &key[1 ],4 ); +if (ret) +return ret;/* Tell the device we've read the remote. Not sure how necessary this is, but the Nebula SDK does it. */ -digitv_ctrl_msg (d,USB_WRITE_REMOTE ,0 ,b,4 ,NULL ,0 ); + ret =digitv_ctrl_msg (d,USB_WRITE_REMOTE ,0 , b,4 ,NULL ,0 ); +if (ret) +return ret;/* if something is inside the buffer, simulate key press */ if (key[1 ] !=0 )
Greg Kroah-Hartman
maintainerPATCH 16/70 media: af9005: uninitialized variable printked
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 51d0c99b391f0cac61ad7b827c26f549ee55672c upstream.
If usb_bulk_msg() fails, actual_length can be uninitialized.
--- drivers/media/usb/dvb-usb/af9005.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/af9005.c +1 -1
@@ -563,7 +563,7 @@ static int af9005_boot_packet(struct usb u8 *buf, int size) {u16 checksum; -int act_len, i, ret; +int act_len =0 , i, ret;memset (buf,0 , size); buf[0 ] = (u8) (FW_BULKOUT_SIZE &0xff );
Greg Kroah-Hartman
maintainerPATCH 17/70 media: vp7045: do not read uninitialized values if usb transfer fails
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 26cff637121d8bb866ebd6515c430ac890e6ec80 upstream.
It is not a fatal error if reading the mac address or the remote control decoder state fails.
--- drivers/media/usb/dvb-usb/vp7045.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-)
drivers/media/usb/dvb-usb/vp7045.c +14 -7
@@ -99,10 +99,14 @@ static int vp7045_power_ctrl(struct dvb_static int vp7045_rc_query (struct dvb_usb_device *d) { +int ret;u8 key; -vp7045_usb_op (d,RC_VAL_READ ,NULL ,0 ,&key,1 ,20 ); -deb_rc ("remote query key: %x %d\n" ,key,key); + ret =vp7045_usb_op (d,RC_VAL_READ ,NULL ,0 , &key,1 ,20 ); +if (ret) +return ret; + +deb_rc ("remote query key: %x\n" , key);if (key !=0x44 ) {/*
@@ -118,15 +122,18 @@ static int vp7045_rc_query(struct dvb_usstatic int vp7045_read_eeprom (struct dvb_usb_device *d,u8 *buf,int len,int offset) { -int i =0 ; -u8 v,br[2 ]; +int i, ret; +u8 v, br[2 ];for (i=0 ; i < len; i++) { v = offset + i; -vp7045_usb_op (d,GET_EE_VALUE ,&v,1 ,br,2 ,5 ); + ret =vp7045_usb_op (d,GET_EE_VALUE , &v,1 , br,2 ,5 ); +if (ret) +return ret; + buf[i] = br[1 ]; } -deb_info ("VP7045 EEPROM read (offs: %d, len: %d) : " ,offset, i); -debug_dump (buf,i,deb_info); +deb_info ("VP7045 EEPROM read (offs: %d, len: %d) : " , offset, i); +debug_dump (buf, i, deb_info);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 18/70 media: gspca: zero usb_buf
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit de89d0864f66c2a1b75becfdd6bf3793c07ce870 upstream.
Allocate gspca_dev->usb_buf with kzalloc instead of kmalloc to ensure it is property zeroed. This fixes various syzbot errors about uninitialized data.
Syzbot links:
https://syzkaller.appspot.com/bug?extid=32310fc2aea76898d074
https://syzkaller.appspot.com/bug?extid=99706d6390be1ac542a2
https://syzkaller.appspot.com/bug?extid=64437af5c781a7f0e08e
--- drivers/media/usb/gspca/gspca.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/gspca/gspca.c +1 -1
@@ -1473,7 +1473,7 @@ int gspca_dev_probe2(struct usb_interfacpr_err ("couldn't kzalloc gspca struct\n" );return -ENOMEM ; } - gspca_dev->usb_buf =kmalloc (USB_BUF_SZ ,GFP_KERNEL ); + gspca_dev->usb_buf =kzalloc (USB_BUF_SZ ,GFP_KERNEL );if (!gspca_dev->usb_buf) {pr_err ("out of memory\n" ); ret = -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 19/70 media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0
In reply to Greg Kroah-HartmanFrom: Hans Verkuil <[email protected]>
commit 569bc8d6a6a50acb5fcf07fb10b8d2d461fdbf93 upstream.
This fixes a syzbot failure since actlen could be uninitialized, but it was still used.
Syzbot link:
https://syzkaller.appspot.com/bug?extid=6bf9606ee955b646c0e1
--- drivers/media/usb/dvb-usb/dvb-usb-urb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/dvb-usb-urb.c +1 -1
@@ -12,7 +12,7 @@int dvb_usb_generic_rw (struct dvb_usb_device *d,u8 *wbuf,u16 wlen,u8 *rbuf,u16 rlen,int delay_ms) { -int actlen,ret = -ENOMEM ; +int actlen =0 , ret = -ENOMEM ;if (!d || wbuf ==NULL || wlen ==0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 20/70 tomoyo: Use atomic_t for statistics counter
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit a8772fad0172aeae339144598b809fd8d4823331 upstream.
syzbot is reporting that there is a race at tomoyo_stat_update() [1]. Although it is acceptable to fail to track exact number of times policy was updated, convert to atomic_t because this is not a hot path.
[1] https://syzkaller.appspot.com/bug?id=a4d7b973972eeed410596e6604580e0133b0fc04
--- security/tomoyo/common.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-)
security/tomoyo/common.c +4 -7
@@ -2254,9 +2254,9 @@ static const char * const tomoyo_memory_ [TOMOYO_MEMORY_QUERY] = "query message:", }; -/* Timestamp counter for last updated. */ -static unsigned int tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT ];/* Counter for number of updates. */ +static atomic_t tomoyo_stat_updated[TOMOYO_MAX_POLICY_STAT ]; +/* Timestamp counter for last updated. */ static time64_t tomoyo_stat_modified[TOMOYO_MAX_POLICY_STAT ];/**
@@ -2268,10 +2268,7 @@ static time64_t tomoyo_stat_modified[TOM*/ void tomoyo_update_stat (const u8 index) { -/* -* I don't use atomic operations because race condition is not fatal. -*/ - tomoyo_stat_updated[index]++; +atomic_inc (&tomoyo_stat_updated[index]); tomoyo_stat_modified[index] =ktime_get_real_seconds (); }
@@ -2291,7 +2288,7 @@ static void tomoyo_read_stat(struct tomofor (i =0 ; i <TOMOYO_MAX_POLICY_STAT ; i++) {tomoyo_io_printf (head,"Policy %-30s %10u" , tomoyo_policy_headers[i], - tomoyo_stat_updated[i]); +atomic_read (&tomoyo_stat_updated[i]));if (tomoyo_stat_modified[i]) {struct tomoyo_time stamp;tomoyo_convert_time (tomoyo_stat_modified[i], &stamp);
Greg Kroah-Hartman
maintainerPATCH 21/70 ttyprintk: fix a potential deadlock in interrupt context issue
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
commit 9a655c77ff8fc65699a3f98e237db563b37c439b upstream.
tpk_write()/tpk_close() could be interrupted when holding a mutex, then in timer handler tpk_write() may be called again trying to acquire same mutex, lead to deadlock.
Google syzbot reported this issue with CONFIG_DEBUG_ATOMIC_SLEEP enabled:
BUG: sleeping function called from invalid context at
kernel/locking/mutex.c:938in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 0, name: swapper/1 1 lock held by swapper/1/0:
...
Call Trace: <IRQ> dump_stack+0x197/0x210 ___might_sleep.cold+0x1fb/0x23e __might_sleep+0x95/0x190 __mutex_lock+0xc5/0x13c0 mutex_lock_nested+0x16/0x20 tpk_write+0x5d/0x340 resync_tnc+0x1b6/0x320 call_timer_fn+0x1ac/0x780 run_timer_softirq+0x6c3/0x1790 __do_softirq+0x262/0x98c irq_exit+0x19b/0x1e0 smp_apic_timer_interrupt+0x1a3/0x610 apic_timer_interrupt+0xf/0x20 </IRQ>
See link https://syzkaller.appspot.com/bug?extid=2eeef62ee31f9460ad65 for more details.
Fix it by using spinlock in process context instead of mutex and having interrupt disabled in critical section.
--- drivers/char/ttyprintk.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/char/ttyprintk.c +9 -6
@@ -18,10 +18,11 @@#include <linux/serial.h> #include <linux/tty.h> #include <linux/module.h> +#include <linux/spinlock.h> struct ttyprintk_port {struct tty_port port; -struct mutex port_write_mutex; +spinlock_t spinlock; };static struct ttyprintk_port tpk_port;
@@ -100,11 +101,12 @@ static int tpk_open(struct tty_struct *tstatic void tpk_close (struct tty_struct *tty,struct file *filp) {struct ttyprintk_port *tpkp = tty->driver_data; +unsigned long flags; -mutex_lock (&tpkp->port_write_mutex); +spin_lock_irqsave (&tpkp->spinlock, flags);/* flush tpk_printk buffer */ tpk_printk (NULL ,0 ); -mutex_unlock (&tpkp->port_write_mutex); +spin_unlock_irqrestore (&tpkp->spinlock, flags);tty_port_close (&tpkp->port, tty, filp); }
@@ -116,13 +118,14 @@ static int tpk_write(struct tty_struct * const unsigned char *buf, int count) {struct ttyprintk_port *tpkp = tty->driver_data; +unsigned long flags;int ret;/* exclusive use of tpk_printk within this tty */ -mutex_lock (&tpkp->port_write_mutex); +spin_lock_irqsave (&tpkp->spinlock, flags); ret =tpk_printk (buf, count); -mutex_unlock (&tpkp->port_write_mutex); +spin_unlock_irqrestore (&tpkp->spinlock, flags);return ret; }
@@ -172,7 +175,7 @@ static int __init ttyprintk_init(void) {int ret = -ENOMEM ; -mutex_init (&tpk_port.port_write_mutex); +spin_lock_init (&tpk_port.spinlock); ttyprintk_driver = tty_alloc_driver(1, TTY_DRIVER_RESET_TERMIOS |
Greg Kroah-Hartman
maintainerPATCH 22/70 Bluetooth: Fix race condition in hci_release_sock()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 11eb85ec42dc8c7a7ec519b90ccf2eeae9409de8 upstream.
Syzbot managed to trigger a use after free "KASAN: use-after-free Write in hci_sock_bind". I have reviewed the code manually and one possibly cause I have found is that we are not holding lock_sock(sk) when we do the hci_dev_put(hdev) in hci_sock_release(). My theory is that the bind and the release are racing against each other which results in this use after free.
--- net/bluetooth/hci_sock.c | 3 +++ 1 file changed, 3 insertions(+)
net/bluetooth/hci_sock.c +3 -0
@@ -831,6 +831,8 @@ static int hci_sock_release(struct sockeif (!sk)return 0 ; +lock_sock (sk); +switch (hci_pi (sk)->channel) {case HCI_CHANNEL_MONITOR :atomic_dec (&monitor_promisc);
@@ -878,6 +880,7 @@ static int hci_sock_release(struct sockeskb_queue_purge (&sk->sk_receive_queue);skb_queue_purge (&sk->sk_write_queue); +release_sock (sk);sock_put (sk);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/70 cgroup: Prevent double killing of css when enabling threaded cgroup
In reply to Greg Kroah-HartmanFrom: Michal Koutný <[email protected]>
commit 3bc0bb36fa30e95ca829e9cf480e1ef7f7638333 upstream.
The test_cgcore_no_internal_process_constraint_on_threads selftest when running with subsystem controlling noise triggers two warnings:
Quoted 2 lines
[ 597.443115] WARNING: CPU: 1 PID: 28167 at kernel/cgroup/cgroup.c:3131 cgroup_apply_control_enable+0xe0/0x3f0 [ 597.443413] WARNING: CPU: 1 PID: 28167 at kernel/cgroup/cgroup.c:3177 cgroup_apply_control_disable+0xa6/0x160
Both stem from a call to cgroup_type_write. The first warning was also triggered by syzkaller.
When we're switching cgroup to threaded mode shortly after a subsystem was disabled on it, we can see the respective subsystem css dying there.
The warning in cgroup_apply_control_enable is harmless in this case since we're not adding new subsys anyway.
The warning in cgroup_apply_control_disable indicates an attempt to kill css of recently disabled subsystem repeatedly.
The commit prevents these situations by making cgroup_type_write wait for all dying csses to go away before re-applying subtree controls. When at it, the locations of WARN_ON_ONCE calls are moved so that warning is triggered only when we are about to misuse the dying css.
--- kernel/cgroup/cgroup.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
kernel/cgroup/cgroup.c +6 -5
@@ -2940,8 +2940,6 @@ static int cgroup_apply_control_enable(sfor_each_subsys (ss, ssid) {struct cgroup_subsys_state *css =cgroup_css (dsct, ss); -WARN_ON_ONCE (css &&percpu_ref_is_dying (&css->refcnt)); -if (!(cgroup_ss_mask (dsct) & (1 << ss->id)))continue ;
@@ -2951,6 +2949,8 @@ static int cgroup_apply_control_enable(sreturn PTR_ERR (css); } +WARN_ON_ONCE (percpu_ref_is_dying (&css->refcnt)); +if (css_visible (css)) { ret =css_populate_dir (css);if (ret)
@@ -2986,11 +2986,11 @@ static void cgroup_apply_control_disablefor_each_subsys (ss, ssid) {struct cgroup_subsys_state *css =cgroup_css (dsct, ss); -WARN_ON_ONCE (css &&percpu_ref_is_dying (&css->refcnt)); -if (!css)continue ; +WARN_ON_ONCE (percpu_ref_is_dying (&css->refcnt)); +if (css->parent && !(cgroup_ss_mask (dsct) & (1 << ss->id))) {kill_css (css);
@@ -3277,7 +3277,8 @@ static ssize_t cgroup_type_write(structif (strcmp (strstrip (buf),"threaded" ))return -EINVAL ; - cgrp =cgroup_kn_lock_live (of->kn, false); +/* drain dying csses before we re-apply (threaded) subtree control */ + cgrp =cgroup_kn_lock_live (of->kn, true);if (!cgrp)return -ENOENT ;
Greg Kroah-Hartman
maintainerPATCH 24/70 media: si470x-i2c: Move free() past last use of radio
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
A pointer to 'struct si470x_device' is currently used after free:
drivers/media/radio/si470x/radio-si470x-i2c.c:462:25-30: ERROR: reference
preceded by free on line 460
Shift the call to free() down past its final use.
NB: Not sending to Mainline, since the problem does not exist there, it was caused by the backport of 2df200ab234a ("media: si470x-i2c: add missed operations in remove") to the stable trees.
--- drivers/media/radio/si470x/radio-si470x-i2c.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/radio/si470x/radio-si470x-i2c.c +1 -1
@@ -483,10 +483,10 @@ static int si470x_i2c_remove(struct i2c_free_irq (client->irq, radio);video_unregister_device (&radio->videodev); -kfree (radio);v4l2_ctrl_handler_free (&radio->hdl);v4l2_device_unregister (&radio->v4l2_dev); +kfree (radio);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 25/70 ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity
In reply to Greg Kroah-HartmanFrom: Marek Szyprowski <[email protected]>
[ Upstream commit 1c226017d3ec93547b58082bdf778d9db7401c95 ]
Current USB3503 driver ignores GPIO polarity and always operates as if the GPIO lines were flagged as ACTIVE_HIGH. Fix the polarity for the existing USB3503 chip applications to match the chip specification and common convention for naming the pins. The only pin, which has to be ACTIVE_LOW is the reset pin. The remaining are ACTIVE_HIGH. This change allows later to fix the USB3503 driver to properly use generic GPIO bindings and read polarity from DT.
--- arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sun8i-a83t-cubietruck-plus.dts +1 -1
@@ -90,7 +90,7 @@ initial-mode = <1>; /* initialize in HUB mode */ disabled-ports = <1>; intn-gpios = <&pio 7 5 GPIO_ACTIVE_HIGH>; /* PH5 */ - reset-gpios = <&pio 4 16 GPIO_ACTIVE_HIGH>; /* PE16 */ + reset-gpios = <&pio 4 16 GPIO_ACTIVE_LOW>; /* PE16 */ connect-gpios = <&pio 4 17 GPIO_ACTIVE_HIGH>; /* PE17 */ refclk-frequency = <19200000>; };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 26/70 ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit 81cc0877840f72210e809bbedd6346d686560fc1 ]
PERST# line in the PCIE connector is driven by the host mode and not EP mode. The gpios property here is used for driving the PERST# line. Remove gpios property from all endpoint device tree nodes.
--- arch/arm/boot/dts/am571x-idk.dts | 4 ---- arch/arm/boot/dts/am572x-idk-common.dtsi | 4 ---- arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi | 4 ---- 3 files changed, 12 deletions(-)
arch/arm/boot/dts/am571x-idk.dts +0 -4
@@ -93,10 +93,6 @@ gpios = <&gpio5 18 GPIO_ACTIVE_HIGH>; }; -&pcie1_ep { - gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; -}; - &mmc1 { pinctrl-names = "default", "hs"; pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
arch/arm/boot/dts/am572x-idk-common.dtsi +0 -4
@@ -71,10 +71,6 @@ gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; }; -&pcie1_ep { - gpios = <&gpio3 23 GPIO_ACTIVE_HIGH>; -}; - &mailbox5 { status = "okay"; mbox_ipu1_ipc3x: mbox_ipu1_ipc3x {
arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +0 -4
@@ -550,10 +550,6 @@ gpios = <&gpio2 8 GPIO_ACTIVE_LOW>; }; -&pcie1_ep { - gpios = <&gpio2 8 GPIO_ACTIVE_LOW>; -}; - &mcasp3 { #sound-dai-cells = <0>; assigned-clocks = <&l4per_clkctrl DRA7_MCASP3_CLKCTRL 24>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 27/70 ARM: dts: beagle-x15-common: Model 5V0 regulator
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
[ Upstream commit e17e7c498d4f734df93c300441e100818ed58168 ]
On am57xx-beagle-x15, 5V0 is connected to P16, P17, P18 and P19 connectors. On am57xx-evm, 5V0 regulator is used to get 3V6 regulator which is connected to the COMQ port. Model 5V0 regulator here in order for it to be used in am57xx-evm to model 3V6 regulator.
--- .../boot/dts/am57xx-beagle-x15-common.dtsi | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+)
arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi +21 -0
@@ -32,6 +32,27 @@ reg = <0x0 0x80000000 0x0 0x80000000>; }; + main_12v0: fixedregulator-main_12v0 { + /* main supply */ + compatible = "regulator-fixed"; + regulator-name = "main_12v0"; + regulator-min-microvolt = <12000000>; + regulator-max-microvolt = <12000000>; + regulator-always-on; + regulator-boot-on; + }; + + evm_5v0: fixedregulator-evm_5v0 { + /* Output of TPS54531D */ + compatible = "regulator-fixed"; + regulator-name = "evm_5v0"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + vin-supply = <&main_12v0>; + regulator-always-on; + regulator-boot-on; + }; + vdd_3v3: fixedregulator-vdd_3v3 { compatible = "regulator-fixed"; regulator-name = "vdd_3v3";
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 28/70 soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot
In reply to Greg Kroah-HartmanFrom: Dave Gerlach <[email protected]>
[ Upstream commit 03729cfa0d543bc996bf959e762ec999afc8f3d2 ]
Any user of wkup_m3_ipc calls wkup_m3_ipc_get to get a handle and this checks the value of the static variable m3_ipc_state to see if the wkup_m3 is ready. Currently this is populated during probe before rproc_boot has been called, meaning there is a window of time that wkup_m3_ipc_get can return a valid handle but the wkup_m3 itself is not ready, leading to invalid IPC calls to the wkup_m3 and system instability.
To avoid this, move the population of the m3_ipc_state variable until after rproc_boot has succeeded to guarantee a valid and usable handle is always returned.
--- drivers/soc/ti/wkup_m3_ipc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/ti/wkup_m3_ipc.c +2 -2
@@ -426,6 +426,8 @@ static void wkup_m3_rproc_boot_thread(struct wkup_m3_ipc *m3_ipc) ret =rproc_boot (m3_ipc->rproc);if (ret)dev_err (dev,"rproc_boot failed\n" ); +else + m3_ipc_state = m3_ipc;do_exit (0 ); }
@@ -512,8 +514,6 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) goto err_put_rproc; } - m3_ipc_state = m3_ipc; -return 0 ; err_put_rproc:
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 29/70 tools lib traceevent: Fix memory leakage in filter_event
In reply to Greg Kroah-HartmanFrom: Hewenliang <[email protected]>
[ Upstream commit f84ae29a6169318f9c929720c49d96323d2bbab9 ]
It is necessary to call free_arg(arg) when add_filter_type() returns NULL in filter_event().
--- tools/lib/traceevent/parse-filter.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
tools/lib/traceevent/parse-filter.c +3 -1
@@ -1227,8 +1227,10 @@ filter_event(struct event_filter *filter, struct event_format *event, } filter_type =add_filter_type (filter, event->id); -if (filter_type ==NULL ) +if (filter_type ==NULL ) { +free_arg (arg);return TEP_ERRNO__MEM_ALLOC_FAILED ; + }if (filter_type->filter)free_arg (filter_type->filter);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/70 rseq: Unregister rseq for clone CLONE_VM
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
[ Upstream commit 463f550fb47bede3a5d7d5177f363a6c3b45d50b ]
It has been reported by Google that rseq is not behaving properly with respect to clone when CLONE_VM is used without CLONE_THREAD.
It keeps the prior thread's rseq TLS registered when the TLS of the thread has moved, so the kernel can corrupt the TLS of the parent.
The approach of clearing the per task-struct rseq registration on clone with CLONE_THREAD flag is incomplete. It does not cover the use-case of clone with CLONE_VM set, but without CLONE_THREAD.
Here is the rationale for unregistering rseq on clone with CLONE_VM flag set:
1) CLONE_THREAD requires CLONE_SIGHAND, which requires CLONE_VM to be set. Therefore, just checking for CLONE_VM covers all CLONE_THREAD uses. There is no point in checking for both CLONE_THREAD and CLONE_VM,
2) There is the possibility of an unlikely scenario where CLONE_SETTLS is used without CLONE_VM. In order to be an issue, it would require that the rseq TLS is in a shared memory area.
I do not plan on adding CLONE_SETTLS to the set of clone flags which unregister RSEQ, because it would require that we also unregister RSEQ on set_thread_area(2) and arch_prctl(2) ARCH_SET_FS for completeness. So rather than doing a partial solution, it appears better to let user-space explicitly perform rseq unregistration across clone if needed in scenarios where CLONE_VM is not set.
--- include/linux/sched.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/sched.h +2 -2
@@ -1843,11 +1843,11 @@ static inline void rseq_migrate(struct task_struct *t)/* * If parent process has a registered restartable sequences area, the -* child inherits. Only applies when forking a process, not a thread. +* child inherits. Unregister rseq for a clone with CLONE_VM set. */ static inline void rseq_fork (struct task_struct *t,unsigned long clone_flags) { -if (clone_flags &CLONE_THREAD ) { +if (clone_flags &CLONE_VM ) { t->rseq =NULL ; t->rseq_len =0 ; t->rseq_sig =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/70 clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order
In reply to Greg Kroah-HartmanFrom: Samuel Holland <[email protected]>
[ Upstream commit 0c545240aebc2ccb8f661dc54283a14d64659804 ]
According to the BSP source code, both the AR100 and R_APB2 clocks have PLL_PERIPH0 as mux index 3, not 2 as it was on previous chips. The pre- divider used for PLL_PERIPH0 should be changed to index 3 to match.
This was verified by running a rough benchmark on the AR100 with various clock settings:
| mux | pre-divider | iterations/second | clock source |
|=====|=============|===================|==============|
| 0 | 0 | 19033 (stable) | osc24M |
| 2 | 5 | 11466 (unstable) | iosc/osc16M |
| 2 | 17 | 11422 (unstable) | iosc/osc16M |
| 3 | 5 | 85338 (stable) | pll-periph0 |
| 3 | 17 | 27167 (stable) | pll-periph0 |The relative performance numbers all match up (with pll-periph0 running at its default 600MHz).
--- drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/clk/sunxi-ng/ccu-sun50i-h6-r.c +2 -2
@@ -23,9 +23,9 @@*/ static const char *const ar100_r_apb2_parents[] = {"osc24M" ,"osc32k" , -"pll-periph0" ,"iosc" }; +"iosc" ,"pll-periph0" };static const struct ccu_mux_var_prediv ar100_r_apb2_predivs[] = { - { .index =2 , .shift =0 , .width =5 }, + { .index =3 , .shift =0 , .width =5 }, };static struct ccu_div ar100_clk = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/70 mac80211: mesh: restrict airtime metric to peered established plinks
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
[ Upstream commit 02a614499600af836137c3fbc4404cd96365fff2 ]
The following warning is triggered every time an unestablished mesh peer gets dumped. Checks if a peer link is established before retrieving the airtime link metric.
[ 9563.022567] WARNING: CPU: 0 PID: 6287 at net/mac80211/mesh_hwmp.c:345
airtime_link_metric_get+0xa2/0xb0 [mac80211]
[ 9563.022697] Hardware name: PC Engines apu2/apu2, BIOS v4.10.0.3
[ 9563.022756] RIP: 0010:airtime_link_metric_get+0xa2/0xb0 [mac80211]
[ 9563.022838] Call Trace:
[ 9563.022897] sta_set_sinfo+0x936/0xa10 [mac80211]
[ 9563.022964] ieee80211_dump_station+0x6d/0x90 [mac80211]
[ 9563.023062] nl80211_dump_station+0x154/0x2a0 [cfg80211]
[ 9563.023120] netlink_dump+0x17b/0x370
[ 9563.023130] netlink_recvmsg+0x2a4/0x480
[ 9563.023140] ____sys_recvmsg+0xa6/0x160
[ 9563.023154] ___sys_recvmsg+0x93/0xe0
[ 9563.023169] __sys_recvmsg+0x7e/0xd0
[ 9563.023210] do_syscall_64+0x4e/0x140
[ 9563.023217] entry_SYSCALL_64_after_hwframe+0x44/0xa9--- net/mac80211/mesh_hwmp.c | 3 +++ 1 file changed, 3 insertions(+)
net/mac80211/mesh_hwmp.c +3 -0
@@ -326,6 +326,9 @@ static u32 airtime_link_metric_get(struct ieee80211_local *local,unsigned long fail_avg =ewma_mesh_fail_avg_read (&sta->mesh->fail_avg); +if (sta->mesh->plink_state !=NL80211_PLINK_ESTAB ) +return MAX_METRIC ; +/* Try to get rate based on HW/SW RC algorithm. * Rate is returned in units of Kbps, correct this * to comply with airtime calculation units
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 33/70 clk: mmp2: Fix the order of timer mux parents
In reply to Greg Kroah-HartmanFrom: Lubomir Rintel <[email protected]>
[ Upstream commit 8bea5ac0fbc5b2103f8779ddff216122e3c2e1ad ]
Determined empirically, no documentation is available.
The OLPC XO-1.75 laptop used parent 1, that one being VCTCXO/4 (65MHz), but thought it's a VCTCXO/2 (130MHz). The mmp2 timer driver, not knowing what is going on, ended up just dividing the rate as of
commit f36797ee4380 ("ARM: mmp/mmp2: dt: enable the clock")'
--- drivers/clk/mmp/clk-of-mmp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/mmp/clk-of-mmp2.c +1 -1
@@ -134,7 +134,7 @@ static DEFINE_SPINLOCK(ssp3_lock);static const char *ssp_parent_names[] = {"vctcxo_4" ,"vctcxo_2" ,"vctcxo" ,"pll1_16" };static DEFINE_SPINLOCK (timer_lock); -static const char *timer_parent_names[] = {"clk32" ,"vctcxo_2" ,"vctcxo_4" ,"vctcxo" }; +static const char *timer_parent_names[] = {"clk32" ,"vctcxo_4" ,"vctcxo_2" ,"vctcxo" };static DEFINE_SPINLOCK (reset_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 34/70 ASoC: rt5640: Fix NULL dereference on module unload
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit 89b71b3f02d8ae5a08a1dd6f4a2098b7b868d498 ]
The rt5640->jack is NULL if jack is already disabled at the time of driver's module unloading.
--- sound/soc/codecs/rt5640.c | 7 +++++++ 1 file changed, 7 insertions(+)
sound/soc/codecs/rt5640.c +7 -0
@@ -2435,6 +2435,13 @@ static void rt5640_disable_jack_detect(struct snd_soc_component *component) {struct rt5640_priv *rt5640 =snd_soc_component_get_drvdata (component); +/* +* soc_remove_component() force-disables jack and thus rt5640->jack +* could be NULL at the time of driver's module unloading. +*/ +if (!rt5640->jack) +return ; +disable_irq (rt5640->irq);rt5640_cancel_work (rt5640);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 35/70 ixgbevf: Remove limit of 10 entries for unicast filter list
In reply to Greg Kroah-HartmanFrom: Radoslaw Tyl <[email protected]>
[ Upstream commit aa604651d523b1493988d0bf6710339f3ee60272 ]
Currently, though the FDB entry is added to VF, it does not appear in RAR filters. VF driver only allows to add 10 entries. Attempting to add another causes an error. This patch removes limitation and allows use of all free RAR entries for the FDB if needed.
--- drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +0 -5
@@ -2066,11 +2066,6 @@ static int ixgbevf_write_uc_addr_list(struct net_device *netdev)struct ixgbe_hw *hw = &adapter->hw;int count =0 ; -if ((netdev_uc_count (netdev)) >10 ) { -pr_err ("Too many unicast filters - No Space\n" ); -return -ENOSPC ; - } -if (!netdev_uc_empty (netdev)) {struct netdev_hw_addr *ha;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 36/70 ixgbe: Fix calculation of queue with VFs and flow director on interface flap
In reply to Greg Kroah-HartmanFrom: Cambda Zhu <[email protected]>
[ Upstream commit 4fad78ad6422d9bca62135bbed8b6abc4cbb85b8 ]
This patch fixes the calculation of queue when we restore flow director filters after resetting adapter. In ixgbe_fdir_filter_restore(), filter's vf may be zero which makes the queue outside of the rx_ring array.
The calculation is changed to the same as ixgbe_add_ethtool_fdir_entry().
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 37 ++++++++++++++----- 1 file changed, 27 insertions(+), 10 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +27 -10
@@ -5189,7 +5189,7 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)struct ixgbe_hw *hw = &adapter->hw;struct hlist_node *node2;struct ixgbe_fdir_filter *filter; -u64 action; +u8 queue;spin_lock (&adapter->fdir_perfect_lock);
@@ -5198,17 +5198,34 @@ static void ixgbe_fdir_filter_restore(struct ixgbe_adapter *adapter)hlist_for_each_entry_safe (filter, node2, &adapter->fdir_filter_list, fdir_node) { - action = filter->action; -if (action !=IXGBE_FDIR_DROP_QUEUE && action !=0 ) - action = - (action >>ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF ) -1 ; +if (filter->action ==IXGBE_FDIR_DROP_QUEUE ) { + queue =IXGBE_FDIR_DROP_QUEUE ; + }else { +u32 ring =ethtool_get_flow_spec_ring (filter->action); +u8 vf =ethtool_get_flow_spec_ring_vf (filter->action); + +if (!vf && (ring >= adapter->num_rx_queues)) { +e_err (drv,"FDIR restore failed without VF, ring: %u\n" , + ring); +continue ; + }else if (vf && + ((vf > adapter->num_vfs) || + ring >= adapter->num_rx_queues_per_pool)) { +e_err (drv,"FDIR restore failed with VF, vf: %hhu, ring: %u\n" , + vf, ring); +continue ; + } + +/* Map the ring onto the absolute queue index */ +if (!vf) + queue = adapter->rx_ring[ring]->reg_idx; +else + queue = ((vf -1 ) * + adapter->num_rx_queues_per_pool) + ring; + }ixgbe_fdir_write_perfect_filter_82599 (hw, - &filter->filter, - filter->sw_idx, - (action ==IXGBE_FDIR_DROP_QUEUE ) ? -IXGBE_FDIR_DROP_QUEUE : - adapter->rx_ring[action]->reg_idx); + &filter->filter, filter->sw_idx, queue); }spin_unlock (&adapter->fdir_perfect_lock);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 37/70 igb: Fix SGMII SFP module discovery for 100FX/LX.
In reply to Greg Kroah-HartmanFrom: Manfred Rudigier <[email protected]>
[ Upstream commit 5365ec1aeff5b9f2962a9c9b31d63f9dad7e0e2d ]
Changing the link mode should also be done for 100BaseFX SGMII modules, otherwise they just don't work when the default link mode in CTRL_EXT coming from the EEPROM is SERDES.
Additionally 100Base-LX SGMII SFP modules are also supported now, which was not the case before.
Tested with an i210 using Flexoptix S.1303.2M.G 100FX and S.1303.10.G 100LX SGMII SFP modules.
--- drivers/net/ethernet/intel/igb/e1000_82575.c | 8 ++------ drivers/net/ethernet/intel/igb/igb_ethtool.c | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-)
drivers/net/ethernet/intel/igb/e1000_82575.c +2 -6
@@ -530,7 +530,7 @@ static s32 igb_set_sfp_media_type_82575(struct e1000_hw *hw) dev_spec->module_plugged = true;if (eth_flags->e1000_base_lx || eth_flags->e1000_base_sx) { hw->phy.media_type = e1000_media_type_internal_serdes; - }else if (eth_flags->e100_base_fx) { + }else if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) { dev_spec->sgmii_active = true; hw->phy.media_type = e1000_media_type_internal_serdes; }else if (eth_flags->e1000_base_t) {
@@ -657,14 +657,10 @@ static s32 igb_get_invariants_82575(struct e1000_hw *hw)break ; } -/* do not change link mode for 100BaseFX */ -if (dev_spec->eth_flags.e100_base_fx) -break ; -/* change current link mode setting */ ctrl_ext &= ~E1000_CTRL_EXT_LINK_MODE_MASK ; -if (hw->phy.media_type == e1000_media_type_copper) +if (dev_spec->sgmii_active) ctrl_ext |=E1000_CTRL_EXT_LINK_MODE_SGMII ;else ctrl_ext |=E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES ;
drivers/net/ethernet/intel/igb/igb_ethtool.c +1 -1
@@ -181,7 +181,7 @@ static int igb_get_link_ksettings(struct net_device *netdev, advertising &= ~ADVERTISED_1000baseKX_Full; } } -if (eth_flags->e100_base_fx) { +if (eth_flags->e100_base_fx || eth_flags->e100_base_lx) { supported |= SUPPORTED_100baseT_Full; advertising |= ADVERTISED_100baseT_Full; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 38/70 platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit 1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3 ]
Allow the user to configure the fan to turn on / speed-up at lower thresholds then before (20 degrees Celcius as minimum instead of 40) and likewise also allow the user to delay the fan speeding-up till the temperature hits 90 degrees Celcius (was 70).
--- drivers/platform/x86/gpd-pocket-fan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/x86/gpd-pocket-fan.c +1 -1
@@ -127,7 +127,7 @@ static int gpd_pocket_fan_probe(struct platform_device *pdev)int i;for (i =0 ; i <ARRAY_SIZE (temp_limits); i++) { -if (temp_limits[i] <40000 || temp_limits[i] >70000 ) { +if (temp_limits[i] <20000 || temp_limits[i] >90000 ) {dev_err (&pdev->dev,"Invalid temp-limit %d (must be between 40000 and 70000)\n" , temp_limits[i]); temp_limits[0 ] =TEMP_LIMIT0_DEFAULT ;
Signature · 1 line
2.20.1
Re: [PATCH 4.19 38/70] platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits
Hi!
Quoted 8 lines
From: Hans de Goede <[email protected]>
[ Upstream commit
1f27dbd8265dbb379926c8f6a4453fe7fe26d7a3]Allow the user to configure the fan to turn on / speed-up at lower thresholds then before (20 degrees Celcius as minimum instead of 40) and likewise also allow the user to delay the fan speeding-up till the temperature hits 90 degrees Celcius (was 70).
I see it does not break anything, but I don't quite see it as a stable material.
That said... does lower limit make sense? Spinning fans 10C might be interesting but not wrong.
Anyway, dev_err() text is now outdated.
Best regards,
Pavel
Quoted 6 lines
drivers/platform/x86/gpd-pocket-fan.c +1
-1for (i =0 ; i <ARRAY_SIZE (temp_limits); i++) { -if (temp_limits[i] <40000 || temp_limits[i] >70000 ) { +if (temp_limits[i] <20000 || temp_limits[i] >90000 ) {dev_err (&pdev->dev,"Invalid temp-limit %d (must be between 40000 and 70000)\n" , temp_limits[i]); temp_limits[0 ] =TEMP_LIMIT0_DEFAULT ;
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Greg Kroah-Hartman
maintainerPATCH 39/70 ASoC: sti: fix possible sleep-in-atomic
In reply to Greg Kroah-HartmanFrom: Arnaud Pouliquen <[email protected]>
[ Upstream commit ce780a47c3c01e1e179d0792df6b853a913928f1 ]
Change mutex and spinlock management to avoid sleep in atomic issue.
--- sound/soc/sti/uniperif_player.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
sound/soc/sti/uniperif_player.c +4 -3
@@ -226,7 +226,6 @@ static void uni_player_set_channel_status(struct uniperif *player,* sampling frequency. If no sample rate is already specified, then * set one. */ -mutex_lock (&player->ctrl_lock);if (runtime) {switch (runtime->rate) {case 22050 :
@@ -303,7 +302,6 @@ static void uni_player_set_channel_status(struct uniperif *player, player->stream_settings.iec958.status[3 + (n *4 )] <<24 ;SET_UNIPERIF_CHANNEL_STA_REGN (player, n, status); } -mutex_unlock (&player->ctrl_lock);/* Update the channel status */ if (player->ver <SND_ST_UNIPERIF_VERSION_UNI_PLR_TOP_1_0 )
@@ -365,8 +363,10 @@ static int uni_player_prepare_iec958(struct uniperif *player,SET_UNIPERIF_CTRL_ZERO_STUFF_HW (player); +mutex_lock (&player->ctrl_lock);/* Update the channel status */ uni_player_set_channel_status (player, runtime); +mutex_unlock (&player->ctrl_lock);/* Clear the user validity user bits */ SET_UNIPERIF_USER_VALIDITY_VALIDITY_LR (player,0 );
@@ -598,7 +598,6 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol, iec958->status[1 ] = ucontrol->value.iec958.status[1 ]; iec958->status[2 ] = ucontrol->value.iec958.status[2 ]; iec958->status[3 ] = ucontrol->value.iec958.status[3 ]; -mutex_unlock (&player->ctrl_lock);spin_lock_irqsave (&player->irq_lock, flags);if (player->substream && player->substream->runtime)
@@ -608,6 +607,8 @@ static int uni_player_ctl_iec958_put(struct snd_kcontrol *kcontrol,uni_player_set_channel_status (player,NULL );spin_unlock_irqrestore (&player->irq_lock, flags); +mutex_unlock (&player->ctrl_lock); +return 0 ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 40/70 qmi_wwan: Add support for Quectel RM500Q
In reply to Greg Kroah-HartmanFrom: Kristian Evensen <[email protected]>
[ Upstream commit a9ff44f0e61d074f29770413fef6a5452be7b83e ]
RM500Q is a 5G module from Quectel, supporting both standalone and non-standalone modes. The normal Quectel quirks apply (DTR and dynamic interface numbers).
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -999,6 +999,7 @@ static const struct usb_device_id products[] = { {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ + {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL *//* 3. Combined interface devices matching on interface number */ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 41/70 parisc: Use proper printk format for resource_size_t
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 4f80b70e1953cb846dbdd1ce72cb17333d4c8d11 ]
resource_size_t should be printed with its own size-independent format to fix warnings when compiling on 64-bit platform (e.g. with COMPILE_TEST):
arch/parisc/kernel/drivers.c: In function 'print_parisc_device':
arch/parisc/kernel/drivers.c:892:9: warning:
format '%p' expects argument of type 'void *',
but argument 4 has type 'resource_size_t {aka unsigned int}' [-Wformat=]
--- arch/parisc/kernel/drivers.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/parisc/kernel/drivers.c +2 -2
@@ -868,8 +868,8 @@ static void print_parisc_device(struct parisc_device *dev)static int count;print_pa_hwpath (dev, hw_path); -pr_info ("%d. %s at 0x%px [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }" , - ++count, dev->name, (void *) dev->hpa.start, hw_path, dev->id.hw_type, +pr_info ("%d. %s at %pap [%s] { %d, 0x%x, 0x%.3x, 0x%.5x }" , + ++count, dev->name, &(dev->hpa.start), hw_path, dev->id.hw_type, dev->id.hversion_rev, dev->id.hversion, dev->id.sversion);if (dev->num_addrs) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 42/70 wireless: fix enabling channel 12 for custom regulatory domain
In reply to Greg Kroah-HartmanFrom: Ganapathi Bhat <[email protected]>
[ Upstream commit c4b9d655e445a8be0bff624aedea190606b5ebbc ]
Commit e33e2241e272 ("Revert "cfg80211: Use 5MHz bandwidth by default when checking usable channels"") fixed a broken regulatory (leaving channel 12 open for AP where not permitted). Apply a similar fix to custom regulatory domain processing.
--- net/wireless/reg.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
net/wireless/reg.c +10 -3
@@ -2254,14 +2254,15 @@ static void update_all_wiphy_regulatory(enum nl80211_reg_initiator initiator)static void handle_channel_custom (struct wiphy *wiphy,struct ieee80211_channel *chan, -const struct ieee80211_regdomain *regd) +const struct ieee80211_regdomain *regd, +u32 min_bw) {u32 bw_flags =0 ;const struct ieee80211_reg_rule *reg_rule =NULL ;const struct ieee80211_power_rule *power_rule =NULL ;u32 bw; -for (bw =MHZ_TO_KHZ (20 ); bw >=MHZ_TO_KHZ (5 ); bw = bw /2 ) { +for (bw =MHZ_TO_KHZ (20 ); bw >= min_bw; bw = bw /2 ) { reg_rule =freq_reg_info_regd (MHZ_TO_KHZ (chan->center_freq), regd, bw);if (!IS_ERR (reg_rule))
@@ -2317,8 +2318,14 @@ static void handle_band_custom(struct wiphy *wiphy,if (!sband)return ; +/* +* We currently assume that you always want at least 20 MHz, +* otherwise channel 12 might get enabled if this rule is +* compatible to US, which permits 2402 - 2472 MHz. +*/ for (i =0 ; i < sband->n_channels; i++) -handle_channel_custom (wiphy, &sband->channels[i], regd); +handle_channel_custom (wiphy, &sband->channels[i], regd, +MHZ_TO_KHZ (20 )); }/* Used by drivers prior to wiphy registration */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 43/70 cfg80211: Fix radar event during another phy CAC
In reply to Greg Kroah-HartmanFrom: Orr Mazor <[email protected]>
[ Upstream commit 26ec17a1dc5ecdd8d91aba63ead6f8b5ad5dea0d ]
In case a radar event of CAC_FINISHED or RADAR_DETECTED happens during another phy is during CAC we might need to cancel that CAC.
If we got a radar in a channel that another phy is now doing CAC on then the CAC should be canceled there.
If, for example, 2 phys doing CAC on the same channels, or on comptable channels, once on of them will finish his CAC the other might need to cancel his CAC, since it is no longer relevant.
To fix that the commit adds an callback and implement it in mac80211 to end CAC.
This commit also adds a call to said callback if after a radar event we see the CAC is no longer relevant
--- include/net/cfg80211.h | 5 +++++ net/mac80211/cfg.c | 23 +++++++++++++++++++++++ net/wireless/rdev-ops.h | 10 ++++++++++ net/wireless/reg.c | 23 ++++++++++++++++++++++- net/wireless/trace.h | 5 +++++ 5 files changed, 65 insertions(+), 1 deletion(-)
include/net/cfg80211.h +5 -0
@@ -3050,6 +3050,9 @@ struct cfg80211_external_auth_params {* * @start_radar_detection: Start radar detection in the driver. * +* @end_cac: End running CAC, probably because a related CAC +* was finished on another phy. +* * @update_ft_ies: Provide updated Fast BSS Transition information to the * driver. If the SME is in the driver/firmware, this information can be * used in building Authentication and Reassociation Request frames.
@@ -3364,6 +3367,8 @@ struct cfg80211_ops {struct net_device *dev, struct cfg80211_chan_def *chandef, u32 cac_time_ms); +void (*end_cac)(struct wiphy *wiphy, +struct net_device *dev);int (*update_ft_ies)(struct wiphy *wiphy,struct net_device *dev,struct cfg80211_update_ft_ies_params *ftie); int (*crit_proto_start)(struct wiphy *wiphy,
net/mac80211/cfg.c +23 -0
@@ -2825,6 +2825,28 @@ static int ieee80211_start_radar_detection(struct wiphy *wiphy,return err; } +static void ieee80211_end_cac (struct wiphy *wiphy, +struct net_device *dev) +{ +struct ieee80211_sub_if_data *sdata =IEEE80211_DEV_TO_SUB_IF (dev); +struct ieee80211_local *local = sdata->local; + +mutex_lock (&local->mtx); +list_for_each_entry (sdata, &local->interfaces, list) { +/* it might be waiting for the local->mtx, but then +* by the time it gets it, sdata->wdev.cac_started +* will no longer be true +*/ +cancel_delayed_work (&sdata->dfs_cac_timer_work); + +if (sdata->wdev.cac_started) { +ieee80211_vif_release_channel (sdata); + sdata->wdev.cac_started = false; + } + } +mutex_unlock (&local->mtx); +} +static struct cfg80211_beacon_data *cfg80211_beacon_dup (struct cfg80211_beacon_data *beacon) {
@@ -3848,6 +3870,7 @@ const struct cfg80211_ops mac80211_config_ops = {#endif .get_channel = ieee80211_cfg_get_channel, .start_radar_detection = ieee80211_start_radar_detection, + .end_cac = ieee80211_end_cac, .channel_switch = ieee80211_channel_switch, .set_qos_map = ieee80211_set_qos_map, .set_ap_chanwidth = ieee80211_set_ap_chanwidth,
net/wireless/rdev-ops.h +10 -0
@@ -1170,6 +1170,16 @@ rdev_start_radar_detection(struct cfg80211_registered_device *rdev,return ret; } +static inline void +rdev_end_cac (struct cfg80211_registered_device *rdev, +struct net_device *dev) +{ +trace_rdev_end_cac (&rdev->wiphy, dev); +if (rdev->ops->end_cac) + rdev->ops->end_cac (&rdev->wiphy, dev); +trace_rdev_return_void (&rdev->wiphy); +} + static inline int rdev_set_mcast_rate(struct cfg80211_registered_device *rdev, struct net_device *dev,
net/wireless/reg.c +22 -1
@@ -3840,6 +3840,25 @@ bool regulatory_pre_cac_allowed(struct wiphy *wiphy)return pre_cac_allowed; } +static void cfg80211_check_and_end_cac (struct cfg80211_registered_device *rdev) +{ +struct wireless_dev *wdev; +/* If we finished CAC or received radar, we should end any +* CAC running on the same channels. +* the check !cfg80211_chandef_dfs_usable contain 2 options: +* either all channels are available - those the CAC_FINISHED +* event has effected another wdev state, or there is a channel +* in unavailable state in wdev chandef - those the RADAR_DETECTED +* event has effected another wdev state. +* In both cases we should end the CAC on the wdev. +*/ +list_for_each_entry (wdev, &rdev->wiphy.wdev_list, list) { +if (wdev->cac_started && + !cfg80211_chandef_dfs_usable (&rdev->wiphy, &wdev->chandef)) +rdev_end_cac (rdev, wdev->netdev); + } +} + void regulatory_propagate_dfs_state(struct wiphy *wiphy, struct cfg80211_chan_def *chandef, enum nl80211_dfs_state dfs_state,
@@ -3866,8 +3885,10 @@ void regulatory_propagate_dfs_state(struct wiphy *wiphy,cfg80211_set_dfs_state (&rdev->wiphy, chandef, dfs_state);if (event ==NL80211_RADAR_DETECTED || - event ==NL80211_RADAR_CAC_FINISHED ) + event ==NL80211_RADAR_CAC_FINISHED ) {cfg80211_sched_dfs_chan_update (rdev); +cfg80211_check_and_end_cac (rdev); + }nl80211_radar_notify (rdev, chandef, event,NULL ,GFP_KERNEL ); }
net/wireless/trace.h +5 -0
@@ -607,6 +607,11 @@ DEFINE_EVENT(wiphy_netdev_evt, rdev_flush_pmksa,TP_ARGS (wiphy, netdev) ); +DEFINE_EVENT (wiphy_netdev_evt, rdev_end_cac, + TP_PROTO(struct wiphy *wiphy, struct net_device *netdev), +TP_ARGS (wiphy, netdev) +); + DECLARE_EVENT_CLASS(station_add_change, TP_PROTO(struct wiphy *wiphy, struct net_device *netdev, u8 *mac, struct station_parameters *params),
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 44/70 mac80211: Fix TKIP replay protection immediately after key setup
In reply to Greg Kroah-HartmanFrom: Jouni Malinen <[email protected]>
[ Upstream commit 6f601265215a421f425ba3a4850a35861d024643 ]
TKIP replay protection was skipped for the very first frame received after a new key is configured. While this is potentially needed to avoid dropping a frame in some cases, this does leave a window for replay attacks with group-addressed frames at the station side. Any earlier frame sent by the AP using the same key would be accepted as a valid frame and the internal RSC would then be updated to the TSC from that frame. This would allow multiple previously transmitted group-addressed frames to be replayed until the next valid new group-addressed frame from the AP is received by the station.
Fix this by limiting the no-replay-protection exception to apply only for the case where TSC=0, i.e., when this is for the very first frame protected using the new key, and the local RSC had not been set to a higher value when configuring the key (which may happen with GTK).
--- net/mac80211/tkip.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
net/mac80211/tkip.c +15 -3
@@ -266,9 +266,21 @@ int ieee80211_tkip_decrypt_data(struct crypto_cipher *tfm,if ((keyid >>6 ) != key->conf.keyidx)return TKIP_DECRYPT_INVALID_KEYIDX ; -if (rx_ctx->ctx.state !=TKIP_STATE_NOT_INIT && - (iv32 < rx_ctx->iv32 || - (iv32 == rx_ctx->iv32 && iv16 <= rx_ctx->iv16))) +/* Reject replays if the received TSC is smaller than or equal to the +* last received value in a valid message, but with an exception for +* the case where a new key has been set and no valid frame using that +* key has yet received and the local RSC was initialized to 0. This +* exception allows the very first frame sent by the transmitter to be +* accepted even if that transmitter were to use TSC 0 (IEEE 802.11 +* described TSC to be initialized to 1 whenever a new key is taken into +* use). +*/ +if (iv32 < rx_ctx->iv32 || + (iv32 == rx_ctx->iv32 && + (iv16 < rx_ctx->iv16 || + (iv16 == rx_ctx->iv16 && + (rx_ctx->iv32 || rx_ctx->iv16 || + rx_ctx->ctx.state !=TKIP_STATE_NOT_INIT )))))return TKIP_DECRYPT_REPLAY ;if (only_iv) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 45/70 wireless: wext: avoid gcc -O3 warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit e16119655c9e6c4aa5767cd971baa9c491f41b13 ]
After the introduction of CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE_O3, the wext code produces a bogus warning:
In function 'iw_handler_get_iwstats',
inlined from 'ioctl_standard_call' at net/wireless/wext-core.c:1015:9, inlined from 'wireless_process_ioctl' at net/wireless/wext-core.c:935:10, inlined from 'wext_ioctl_dispatch.part.8' at net/wireless/wext-core.c:986:8, inlined from 'wext_handle_ioctl':net/wireless/wext-core.c:671:3: error: argument 1 null where non-null expected [-Werror=nonnull]
memcpy(extra, stats, sizeof(struct iw_statistics)); ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from arch/x86/include/asm/string.h:5,net/wireless/wext-core.c: In function 'wext_handle_ioctl':arch/x86/include/asm/string_64.h:14:14: note: in a call to function 'memcpy' declared here
The problem is that ioctl_standard_call() sometimes calls the handler with a NULL argument that would cause a problem for iw_handler_get_iwstats. However, iw_handler_get_iwstats never actually gets called that way.
Marking that function as noinline avoids the warning and leads to slightly smaller object code as well.
--- net/wireless/wext-core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/wireless/wext-core.c +2 -1
@@ -657,7 +657,8 @@ struct iw_statistics *get_wireless_stats(struct net_device *dev)return NULL ; } -static int iw_handler_get_iwstats (struct net_device * dev, +/* noinline to avoid a bogus warning with -O3 */ +static noinline int iw_handler_get_iwstats(struct net_device * dev,struct iw_request_info * info,union iwreq_data * wrqu,char * extra)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 46/70 netfilter: nft_tunnel: ERSPAN_VERSION must not be null
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 9ec22d7c6c69146180577f3ad5fdf504beeaee62 ]
--- net/netfilter/nft_tunnel.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nft_tunnel.c +3 -0
@@ -235,6 +235,9 @@ static int nft_tunnel_obj_erspan_init(const struct nlattr *attr,if (err <0 )return err; +if (!tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION ]) +return -EINVAL ; + version =ntohl (nla_get_be32 (tb[NFTA_TUNNEL_KEY_ERSPAN_VERSION ]));switch (version) {case ERSPAN_VERSION :
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 47/70 net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 8f1880cbe8d0d49ebb7e9ae409b3b96676e5aa97 ]
With the implementation of the system reset controller we lost a setting that is currently applied by the bootloader and which configures the IMP port for 2Gb/sec, the default is 1Gb/sec. This is needed given the number of ports and applications we expect to run so bring back that setting.
--- drivers/net/dsa/bcm_sf2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/bcm_sf2.c +1 -1
@@ -72,7 +72,7 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)/* Force link status for IMP port */ reg =core_readl (priv, offset); - reg |= (MII_SW_OR |LINK_STS ); + reg |= (MII_SW_OR |LINK_STS |GMII_SPEED_UP_2G );core_writel (priv, reg, offset);/* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 48/70 bnxt_en: Fix ipv6 RFS filter matching logic.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit 6fc7caa84e713f7627e171ab1e7c4b5be0dc9b3d ]
Fix bnxt_fltr_match() to match ipv6 source and destination addresses. The function currently only checks ipv4 addresses and will not work corrently on ipv6 filters.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 22 +++++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +17 -5
@@ -8215,11 +8215,23 @@ static bool bnxt_fltr_match(struct bnxt_ntuple_filter *f1,struct flow_keys *keys1 = &f1->fkeys;struct flow_keys *keys2 = &f2->fkeys; -if (keys1->addrs.v4addrs.src == keys2->addrs.v4addrs.src && - keys1->addrs.v4addrs.dst == keys2->addrs.v4addrs.dst && - keys1->ports.ports == keys2->ports.ports && - keys1->basic.ip_proto == keys2->basic.ip_proto && - keys1->basic.n_proto == keys2->basic.n_proto && +if (keys1->basic.n_proto != keys2->basic.n_proto || + keys1->basic.ip_proto != keys2->basic.ip_proto) +return false; + +if (keys1->basic.n_proto ==htons (ETH_P_IP )) { +if (keys1->addrs.v4addrs.src != keys2->addrs.v4addrs.src || + keys1->addrs.v4addrs.dst != keys2->addrs.v4addrs.dst) +return false; + }else { +if (memcmp (&keys1->addrs.v6addrs.src, &keys2->addrs.v6addrs.src, +sizeof (keys1->addrs.v6addrs.src)) || +memcmp (&keys1->addrs.v6addrs.dst, &keys2->addrs.v6addrs.dst, +sizeof (keys1->addrs.v6addrs.dst))) +return false; + } + +if (keys1->ports.ports == keys2->ports.ports && keys1->control.flags == keys2->control.flags &ðer_addr_equal (f1->src_mac_addr, f2->src_mac_addr) &ðer_addr_equal (f1->dst_mac_addr, f2->dst_mac_addr))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 49/70 riscv: delete temporary files
In reply to Greg Kroah-HartmanFrom: Ilie Halip <[email protected]>
[ Upstream commit 95f4d9cced96afa9c69b3da8e79e96102c84fc60 ]
Temporary files used in the VDSO build process linger on even after make
mrproper: vdso-dummy.o.tmp, vdso.so.dbg.tmp.
Delete them once they're no longer needed.
--- arch/riscv/kernel/vdso/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/riscv/kernel/vdso/Makefile +2 -1
@@ -55,7 +55,8 @@ quiet_cmd_vdsold = VDSOLD $@ cmd_vdsold = $(CC) $(KBUILD_CFLAGS) $(call cc-option, -no-pie) -nostdlib -nostartfiles $(SYSCFLAGS_$(@F)) \ -Wl,-T,$(filter-out FORCE,$^) -o [email protected] && \ $(CROSS_COMPILE)objcopy \ - $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ + $(patsubst %, -G __vdso_%, $(vdso-syms)) [email protected] $@ && \ + rm [email protected] # install commands for the unstripped file quiet_cmd_vdso_install = INSTALL $@
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/70 iwlwifi: mvm: fix NVM check for 3168 devices
In reply to Greg Kroah-HartmanFrom: Luca Coelho <[email protected]>
[ Upstream commit b3f20e098293892388d6a0491d6bbb2efb46fbff ]
We had a check on !NVM_EXT and then a check for NVM_SDP in the else block of this if. The else block, obviously, could only be reached if using NVM_EXT, so it would never be NVM_SDP.
Fix that by checking whether the nvm_type is IWL_NVM instead of checking for !IWL_NVM_EXT to solve this issue.
--- drivers/net/wireless/intel/iwlwifi/mvm/nvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +1 -1
@@ -286,7 +286,7 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm)int regulatory_type;/* Checking for required sections */ -if (mvm->trans->cfg->nvm_type !=IWL_NVM_EXT ) { +if (mvm->trans->cfg->nvm_type ==IWL_NVM ) {if (!mvm->nvm_sections[NVM_SECTION_TYPE_SW ].data || !mvm->nvm_sections[mvm->cfg->nvm_hw_section_num].data) {IWL_ERR (mvm,"Can't parse empty OTP/NVM sections\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/70 iwlwifi: Dont ignore the cap field upon mcc update
In reply to Greg Kroah-HartmanFrom: Haim Dreyfuss <[email protected]>
[ Upstream commit 2763bba6328c53c455d8f7f5302b80030551c31b ]
When receiving a new MCC driver get all the data about the new country code and its regulatory information.
Mistakenly, we ignored the cap field, which includes global regulatory information which should be applies to every channel.
Fix it.
--- .../wireless/intel/iwlwifi/iwl-nvm-parse.c | 48 ++++++++++++++++++- .../wireless/intel/iwlwifi/iwl-nvm-parse.h | 6 +-- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 3 +- 3 files changed, 51 insertions(+), 6 deletions(-)
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +46 -2
@@ -217,6 +217,34 @@ enum iwl_nvm_channel_flags { NVM_CHANNEL_DC_HIGH = BIT(12), }; +/** +* enum iwl_reg_capa_flags - global flags applied for the whole regulatory +* domain. +* @REG_CAPA_BF_CCD_LOW_BAND: Beam-forming or Cyclic Delay Diversity in the +* 2.4Ghz band is allowed. +* @REG_CAPA_BF_CCD_HIGH_BAND: Beam-forming or Cyclic Delay Diversity in the +* 5Ghz band is allowed. +* @REG_CAPA_160MHZ_ALLOWED: 11ac channel with a width of 160Mhz is allowed +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_80MHZ_ALLOWED: 11ac channel with a width of 80Mhz is allowed +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_MCS_8_ALLOWED: 11ac with MCS 8 is allowed. +* @REG_CAPA_MCS_9_ALLOWED: 11ac with MCS 9 is allowed. +* @REG_CAPA_40MHZ_FORBIDDEN: 11n channel with a width of 40Mhz is forbidden +* for this regulatory domain (valid only in 5Ghz). +* @REG_CAPA_DC_HIGH_ENABLED: DC HIGH allowed. +*/ +enum iwl_reg_capa_flags { +REG_CAPA_BF_CCD_LOW_BAND =BIT (0 ), +REG_CAPA_BF_CCD_HIGH_BAND =BIT (1 ), +REG_CAPA_160MHZ_ALLOWED =BIT (2 ), +REG_CAPA_80MHZ_ALLOWED =BIT (3 ), +REG_CAPA_MCS_8_ALLOWED =BIT (4 ), +REG_CAPA_MCS_9_ALLOWED =BIT (5 ), +REG_CAPA_40MHZ_FORBIDDEN =BIT (7 ), +REG_CAPA_DC_HIGH_ENABLED =BIT (9 ), +}; +static inline void iwl_nvm_print_channel_flags (struct device *dev,u32 level,int chan,u16 flags) {
@@ -923,6 +951,7 @@ IWL_EXPORT_SYMBOL(iwl_parse_nvm_data);static u32 iwl_nvm_get_regdom_bw_flags (const u8 *nvm_chan,int ch_idx,u16 nvm_flags, +u16 cap_flags,const struct iwl_cfg *cfg) {u32 flags =NL80211_RRF_NO_HT40 ;
@@ -966,6 +995,20 @@ static u32 iwl_nvm_get_regdom_bw_flags(const u8 *nvm_chan, (flags & NL80211_RRF_NO_IR)) flags |=NL80211_RRF_GO_CONCURRENT ; +/* +* cap_flags is per regulatory domain so apply it for every channel +*/ +if (ch_idx >=NUM_2GHZ_CHANNELS ) { +if (cap_flags ®_CAPA_40MHZ_FORBIDDEN ) + flags |=NL80211_RRF_NO_HT40 ; + +if (!(cap_flags ®_CAPA_80MHZ_ALLOWED )) + flags |=NL80211_RRF_NO_80MHZ ; + +if (!(cap_flags ®_CAPA_160MHZ_ALLOWED )) + flags |=NL80211_RRF_NO_160MHZ ; + } +return flags; }
@@ -977,7 +1020,7 @@ struct regdb_ptrs {struct ieee80211_regdomain *iwl_parse_nvm_mcc_info (struct device *dev,const struct iwl_cfg *cfg,int num_of_ch,__le32 *channels,u16 fw_mcc, -u16 geo_info) +u16 geo_info,u16 cap) {int ch_idx;u16 ch_flags;
@@ -1038,7 +1081,8 @@ iwl_parse_nvm_mcc_info(struct device *dev, const struct iwl_cfg *cfg, } reg_rule_flags =iwl_nvm_get_regdom_bw_flags (nvm_chan, ch_idx, - ch_flags, cfg); + ch_flags, cap, + cfg);/* we can't continue the same rule */ if (ch_idx == 0 || prev_reg_rule_flags != reg_rule_flags ||
drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.h +3 -3
@@ -7,7 +7,7 @@* * Copyright(c) 2008 - 2015 Intel Corporation. All rights reserved. * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 Intel Corporation +* Copyright(c) 2018 - 2019 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of version 2 of the GNU General Public License as
@@ -34,7 +34,7 @@* * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. * Copyright(c) 2016 - 2017 Intel Deutschland GmbH -* Copyright(c) 2018 Intel Corporation +* Copyright(c) 2018 - 2019 Intel Corporation * All rights reserved. * * Redistribution and use in source and binary forms, with or without
@@ -108,7 +108,7 @@ iwl_parse_nvm_data(struct iwl_trans *trans, const struct iwl_cfg *cfg,struct ieee80211_regdomain *iwl_parse_nvm_mcc_info (struct device *dev,const struct iwl_cfg *cfg,int num_of_ch,__le32 *channels,u16 fw_mcc, -u16 geo_info); +u16 geo_info,u16 cap);/** * struct iwl_nvm_section - describes an NVM section in memory.
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +2 -1
@@ -317,7 +317,8 @@ struct ieee80211_regdomain *iwl_mvm_get_regdomain(struct wiphy *wiphy,__le32_to_cpu (resp->n_channels), resp->channels,__le16_to_cpu (resp->mcc), - __le16_to_cpu(resp->geo_info)); +__le16_to_cpu (resp->geo_info), + __le16_to_cpu(resp->cap));/* Store the return source id */ src_id = resp->source_id;kfree (resp);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/70 Input: aiptek - use descriptors of current altsetting
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit cfa4f6a99fb183742cace65ec551b444852b8ef6 ]
Make sure to always use the descriptors of the current alternate setting to avoid future issues when accessing fields that may differ between settings.
--- drivers/input/tablet/aiptek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/input/tablet/aiptek.c +1 -1
@@ -1726,7 +1726,7 @@ aiptek_probe(struct usb_interface *intf, const struct usb_device_id *id) aiptek->inputdev = inputdev; aiptek->intf = intf; - aiptek->ifnum = intf->altsetting[0 ].desc.bInterfaceNumber; + aiptek->ifnum = intf->cur_altsetting->desc.bInterfaceNumber; aiptek->inDelay =0 ; aiptek->endDelay =0 ; aiptek->previousJitterable =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/70 ARM: dts: am335x-boneblack-common: fix memory size
In reply to Greg Kroah-HartmanFrom: Matwey V. Kornilov <[email protected]>
[ Upstream commit 5abd45ea0fc3060f7805e131753fdcbafd6c6618 ]
BeagleBone Black series is equipped with 512MB RAM whereas only 256MB is included from am335x-bone-common.dtsi
This leads to an issue with unusual setups when devicetree is loaded by GRUB2 directly.
--- arch/arm/boot/dts/am335x-boneblack-common.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/am335x-boneblack-common.dtsi +5 -0
@@ -131,6 +131,11 @@ }; / { + memory@80000000 { + device_type = "memory"; + reg = <0x80000000 0x20000000>; /* 512 MB */ + }; + clk_mcasp0_fixed: clk_mcasp0_fixed { #clock-cells = <0>; compatible = "fixed-clock";
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/70 vti[6]: fix packet tx through bpf_redirect()
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit 95224166a9032ff5d08fca633d37113078ce7d01 ]
With an ebpf program that redirects packets through a vti[6] interface, the packets are dropped because no dst is attached.
This could also be reproduced with an AF_PACKET socket, with the following python script (vti1 is an ip_vti interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('vti1', 0x800, 0, 0))--- net/ipv4/ip_vti.c | 13 +++++++++++-- net/ipv6/ip6_vti.c | 13 +++++++++++-- 2 files changed, 22 insertions(+), 4 deletions(-)
net/ipv4/ip_vti.c +11 -2
@@ -208,8 +208,17 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev,int mtu;if (!dst) { - dev->stats.tx_carrier_errors++; - goto tx_error_icmp; +struct rtable *rt; + + fl->u.ip4.flowi4_oif = dev->ifindex; + fl->u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl->u.ip4); +if (IS_ERR (rt)) { + dev->stats.tx_carrier_errors++; + goto tx_error_icmp; + } + dst = &rt->dst; +skb_dst_set (skb, dst); }dst_hold (dst);
net/ipv6/ip6_vti.c +11 -2
@@ -453,8 +453,17 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)int err =-1 ;int mtu; -if (!dst) - goto tx_err_link_failure; +if (!dst) { + fl->u.ip6.flowi6_oif = dev->ifindex; + fl->u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl->u.ip6); +if (dst->error) { +dst_release (dst); + dst =NULL ; + goto tx_err_link_failure; + } +skb_dst_set (skb, dst); + }dst_hold (dst); dst =xfrm_lookup (t->net, dst, fl,NULL ,0 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 55/70 xfrm interface: fix packet tx through bpf_redirect()
In reply to Greg Kroah-HartmanFrom: Nicolas Dichtel <[email protected]>
[ Upstream commit f042365dbffea98fb8148c98c700402e8d099f02 ]
With an ebpf program that redirects packets through a xfrm interface, packets are dropped because no dst is attached to skb.
This could also be reproduced with an AF_PACKET socket, with the following python script (xfrm1 is a xfrm interface):
import socket
send_s = socket.socket(socket.AF_PACKET, socket.SOCK_RAW, 0)
# scapy
# p = IP(src='10.100.0.2', dst='10.200.0.1')/ICMP(type='echo-request')
# raw(p)
req = b'E\x00\x00\x1c\x00\x01\x00\x00@\x01e\xb2\nd\x00\x02\n\xc8\x00\x01\x08\x00\xf7\xff\x00\x00\x00\x00'
send_s.sendto(req, ('xfrm1', 0x800, 0, 0))It was also not possible to send an ip packet through an AF_PACKET socket because a LL header was expected. Let's remove those LL header constraints.
--- net/xfrm/xfrm_interface.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
net/xfrm/xfrm_interface.c +25 -7
@@ -268,9 +268,6 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)int err =-1 ;int mtu; -if (!dst) - goto tx_err_link_failure; -dst_hold (dst); dst =xfrm_lookup_with_ifid (xi->net, dst, fl,NULL ,0 , xi->p.if_id);if (IS_ERR (dst)) {
@@ -343,6 +340,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) {struct xfrm_if *xi =netdev_priv (dev);struct net_device_stats *stats = &xi->dev->stats; +struct dst_entry *dst =skb_dst (skb);struct flowi fl;int ret;
@@ -352,10 +350,33 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)case htons (ETH_P_IPV6 ):xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +if (!dst) { + fl.u.ip6.flowi6_oif = dev->ifindex; + fl.u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ; + dst =ip6_route_output (dev_net (dev),NULL , &fl.u.ip6); +if (dst->error) { +dst_release (dst); + stats->tx_carrier_errors++; + goto tx_err; + } +skb_dst_set (skb, dst); + }break ;case htons (ETH_P_IP ):xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +if (!dst) { +struct rtable *rt; + + fl.u.ip4.flowi4_oif = dev->ifindex; + fl.u.ip4.flowi4_flags |=FLOWI_FLAG_ANYSRC ; + rt =__ip_route_output_key (dev_net (dev), &fl.u.ip4); +if (IS_ERR (rt)) { + stats->tx_carrier_errors++; + goto tx_err; + } +skb_dst_set (skb, &rt->dst); + }break ;default : goto tx_err;
@@ -566,12 +587,9 @@ static void xfrmi_dev_setup(struct net_device *dev) { dev->netdev_ops = &xfrmi_netdev_ops; dev->type =ARPHRD_NONE ; - dev->hard_header_len =ETH_HLEN ; - dev->min_header_len =ETH_HLEN ; dev->mtu =ETH_DATA_LEN ; dev->min_mtu =ETH_MIN_MTU ; - dev->max_mtu =ETH_DATA_LEN ; - dev->addr_len =ETH_ALEN ; + dev->max_mtu =IP_MAX_MTU ; dev->flags =IFF_NOARP ; dev->needs_free_netdev = true; dev->priv_destructor = xfrmi_dev_free;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/70 xfrm: interface: do not confirm neighbor when do pmtu update
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit 8aaea2b0428b6aad7c7e22d3fddc31a78bb1d724 ]
When do IPv6 tunnel PMTU update and calls __ip6_rt_update_pmtu() in the end, we should not call dst_confirm_neigh() as there is no two-way communication.
--- net/xfrm/xfrm_interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_interface.c +1 -1
@@ -294,7 +294,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) mtu =dst_mtu (dst);if (!skb->ignore_df && skb->len > mtu) { -skb_dst_update_pmtu (skb, mtu); +skb_dst_update_pmtu_no_confirm (skb, mtu);if (skb->protocol ==htons (ETH_P_IPV6 )) {if (mtu <IPV6_MIN_MTU )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/70 scsi: fnic: do not queue commands during fwreset
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit 0e2209629fec427ba75a6351486153a9feddd36b ]
When a link is going down the driver will be calling fnic_cleanup_io(), which will traverse all commands and calling 'done' for each found command. While the traversal is handled under the host_lock, calling 'done' happens after the host_lock is being dropped.
As fnic_queuecommand_lck() is being called with the host_lock held, it might well be that it will pick the command being selected for abortion from the above routine and enqueue it for sending, but then 'done' is being called on that very command from the above routine.
Which of course confuses the hell out of the scsi midlayer.
So fix this by not queueing commands when fnic_cleanup_io is active.
--- drivers/scsi/fnic/fnic_scsi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/scsi/fnic/fnic_scsi.c +3 -0
@@ -446,6 +446,9 @@ static int fnic_queuecommand_lck(struct scsi_cmnd *sc, void (*done)(struct scsi_if (unlikely (fnic_chk_state_flags_locked (fnic,FNIC_FLAGS_IO_BLOCKED )))return SCSI_MLQUEUE_HOST_BUSY ; +if (unlikely (fnic_chk_state_flags_locked (fnic,FNIC_FLAGS_FWRESET ))) +return SCSI_MLQUEUE_HOST_BUSY ; + rport =starget_to_rport (scsi_target (sc->device));if (!rport) { FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/70 ARM: 8955/1: virt: Relax arch timer version check during early boot
In reply to Greg Kroah-HartmanFrom: Vladimir Murzin <[email protected]>
[ Upstream commit 6849b5eba1965ceb0cad3a75877ef4569dd3638e ]
Updates to the Generic Timer architecture allow ID_PFR1.GenTimer to have values other than 0 or 1 while still preserving backward compatibility. At the moment, Linux is quite strict in the way it handles this field at early boot and will not configure arch timer if it doesn't find the value 1.
Since here use ubfx for arch timer version extraction (hyb-stub build with -march=armv7-a, so it is safe)
To help backports (even though the code was correct at the time of writing)
--- arch/arm/kernel/hyp-stub.S | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
arch/arm/kernel/hyp-stub.S +3 -4
@@ -159,10 +159,9 @@ ARM_BE8(orr r7, r7, #(1 << 25)) @ HSCTLR.EE #if !defined(ZIMAGE) && defined(CONFIG_ARM_ARCH_TIMER) @ make CNTP_* and CNTPCT accessible from PL1 mrc p15, 0, r7, c0, c1, 1 @ ID_PFR1 - lsr r7, #16 - and r7, #0xf - cmp r7, #1 - bne 1f + ubfx r7, r7, #16, #4 + teq r7, #0 + beq 1f mrc p15, 4, r7, c14, c1, 0 @ CNTHCTL orr r7, r7, #3 @ PL1PCEN | PL1PCTEN mcr p15, 4, r7, c14, c1, 0 @ CNTHCTL
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/70 tee: optee: Fix compilation issue with nommu
In reply to Greg Kroah-HartmanFrom: Vincenzo Frascino <[email protected]>
[ Upstream commit 9e0caab8e0f96f0af7d1dd388e62f44184a75372 ]
The optee driver uses specific page table types to verify if a memory region is normal. These types are not defined in nommu systems. Trying to compile the driver in these systems results in a build error:
linux/drivers/tee/optee/call.c: In function ‘is_normal_memory’:
linux/drivers/tee/optee/call.c:533:26: error: ‘L_PTE_MT_MASK’ undeclared
(first use in this function); did you mean ‘PREEMPT_MASK’?
return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
^~~~~~~~~~~~~
PREEMPT_MASK
linux/drivers/tee/optee/call.c:533:26: note: each undeclared identifier is
reported only once for each function it appears in
linux/drivers/tee/optee/call.c:533:44: error: ‘L_PTE_MT_WRITEALLOC’ undeclared
(first use in this function)
return (pgprot_val(p) & L_PTE_MT_MASK) == L_PTE_MT_WRITEALLOC;
^~~~~~~~~~~~~~~~~~~Make the optee driver depend on MMU to fix the compilation issue.
--- drivers/tee/optee/Kconfig | 1 + 1 file changed, 1 insertion(+)
drivers/tee/optee/Kconfig +1 -0
@@ -2,6 +2,7 @@ config OPTEE tristate "OP-TEE" depends on HAVE_ARM_SMCCC + depends on MMU help This implements the OP-TEE Trusted Execution Environment (TEE) driver.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/70 airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit d6bce2137f5d6bb1093e96d2f801479099b28094 ]
The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
The ioctl handler copies an aironet_ioctl struct from userspace, which includes a command and a length. Some of the commands are handled in readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes.
That buffer is then passed to PC4500_readrid(), which has two cases. The else case does some setup and then reads up to RIDSIZE bytes from the hardware into the kmalloc()'ed buffer.
Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer:
// read the rid length field bap_read(ai, pBuf, 2, BAP1); // length for remaining part of rid len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2; ... // read remainder of the rid rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);
PC4500_readrid() then returns to readrids() which does:
len = comp->len;
if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) {Where comp->len is the user controlled length field.
So if the "rid length field" returned by the hardware is < 2048, and the user requests 2048 bytes in comp->len, we will leak the previous contents of the kmalloc()'ed buffer to userspace.
Fix it by kzalloc()'ing the buffer.
Found by Ilja by code inspection, not tested as I don't have the required hardware.
--- drivers/net/wireless/cisco/airo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/cisco/airo.c +1 -1
@@ -7809,7 +7809,7 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {return -EINVAL ; } -if ((iobuf =kmalloc (RIDSIZE ,GFP_KERNEL )) ==NULL ) +if ((iobuf =kzalloc (RIDSIZE ,GFP_KERNEL )) ==NULL )return -ENOMEM ;PC4500_readrid (ai,ridcode,iobuf,RIDSIZE ,1 );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/70 airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit 78f7a7566f5eb59321e99b55a6fdb16ea05b37d1 ]
The driver for Cisco Aironet 4500 and 4800 series cards (airo.c), implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().
The ioctl handler copies an aironet_ioctl struct from userspace, which includes a command. Some of the commands are handled in readrids(), where the user controlled command is converted into a driver-internal value called "ridcode".
There are two command values, AIROGWEPKTMP and AIROGWEPKNV, which correspond to ridcode values of RID_WEP_TEMP and RID_WEP_PERM respectively. These commands both have checks that the user has CAP_NET_ADMIN, with the comment that "Only super-user can read WEP keys", otherwise they return -EPERM.
However there is another command value, AIRORRID, that lets the user specify the ridcode value directly, with no other checks. This means the user can bypass the CAP_NET_ADMIN check on AIROGWEPKTMP and AIROGWEPKNV.
Fix it by moving the CAP_NET_ADMIN check out of the command handling and instead do it later based on the ridcode. That way regardless of whether the ridcode is set via AIROGWEPKTMP or AIROGWEPKNV, or passed in using AIRORID, we always do the CAP_NET_ADMIN check.
Found by Ilja by code inspection, not tested as I don't have the required hardware.
--- drivers/net/wireless/cisco/airo.c | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-)
drivers/net/wireless/cisco/airo.c +8 -10
@@ -7786,16 +7786,8 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {case AIROGVLIST : ridcode =RID_APLIST ;break ;case AIROGDRVNAM : ridcode =RID_DRVNAME ;break ;case AIROGEHTENC : ridcode =RID_ETHERENCAP ;break ; -case AIROGWEPKTMP : ridcode =RID_WEP_TEMP ; -/* Only super-user can read WEP keys */ -if (!capable (CAP_NET_ADMIN )) -return -EPERM ; -break ; -case AIROGWEPKNV : ridcode =RID_WEP_PERM ; -/* Only super-user can read WEP keys */ -if (!capable (CAP_NET_ADMIN )) -return -EPERM ; -break ; +case AIROGWEPKTMP : ridcode =RID_WEP_TEMP ;break ; +case AIROGWEPKNV : ridcode =RID_WEP_PERM ;break ;case AIROGSTAT : ridcode =RID_STATUS ;break ;case AIROGSTATSD32 : ridcode =RID_STATSDELTA ;break ;case AIROGSTATSC32 : ridcode =RID_STATS ;break ;
@@ -7809,6 +7801,12 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {return -EINVAL ; } +if (ridcode ==RID_WEP_TEMP || ridcode ==RID_WEP_PERM ) { +/* Only super-user can read WEP keys */ +if (!capable (CAP_NET_ADMIN )) +return -EPERM ; + } +if ((iobuf =kzalloc (RIDSIZE ,GFP_KERNEL )) ==NULL )return -ENOMEM ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/70 r8152: get default setting of WOL before initializing
In reply to Greg Kroah-HartmanFrom: Hayes Wang <[email protected]>
[ Upstream commit 9583a3638dc07cc1878f41265e85ed497f72efcb ]
Initailization would reset runtime suspend by tp->saved_wolopts, so the tp->saved_wolopts should be set before initializing.
--- drivers/net/usb/r8152.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/net/usb/r8152.c +5 -4
@@ -5259,6 +5259,11 @@ static int rtl8152_probe(struct usb_interface *intf, intf->needs_remote_wakeup =1 ; +if (!rtl_can_wakeup (tp)) +__rtl_set_wol (tp,0 ); +else + tp->saved_wolopts =__rtl_get_wol (tp); + tp->rtl_ops.init (tp);queue_delayed_work (system_long_wq, &tp->hw_phy_work,0 );set_ethernet_addr (tp);
@@ -5272,10 +5277,6 @@ static int rtl8152_probe(struct usb_interface *intf, goto out1; } -if (!rtl_can_wakeup (tp)) -__rtl_set_wol (tp,0 ); - - tp->saved_wolopts =__rtl_get_wol (tp);if (tp->saved_wolopts)device_set_wakeup_enable (&udev->dev, true);else
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/70 ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1
In reply to Greg Kroah-HartmanFrom: Raag Jadav <[email protected]>
[ Upstream commit b0b03951544534d6d9ad4aa2787eefec988fff20 ]
Set d0 and d1 pin directions for spi0 and spi1 as per their pinmux.
--- arch/arm/boot/dts/am43x-epos-evm.dts | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/dts/am43x-epos-evm.dts +2 -0
@@ -839,6 +839,7 @@ pinctrl-names = "default", "sleep"; pinctrl-0 = <&spi0_pins_default>; pinctrl-1 = <&spi0_pins_sleep>; + ti,pindir-d0-out-d1-in = <1>; }; &spi1 {
@@ -846,6 +847,7 @@ pinctrl-names = "default", "sleep"; pinctrl-0 = <&spi1_pins_default>; pinctrl-1 = <&spi1_pins_sleep>; + ti,pindir-d0-out-d1-in = <1>; }; &usb2_phy1 {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/70 qlcnic: Fix CPU soft lockup while collecting firmware dump
In reply to Greg Kroah-HartmanFrom: Manish Chopra <[email protected]>
[ Upstream commit 22e984493a41bf8081f13d9ed84def3ca8cfd427 ]
Driver while collecting firmware dump takes longer time to collect/process some of the firmware dump entries/memories. Bigger capture masks makes it worse as it results in larger amount of data being collected and results in CPU soft lockup. Place cond_resched() in some of the driver flows that are expectedly time consuming to relinquish the CPU to avoid CPU soft lockup panic.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 1 + drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 2 ++ 2 files changed, 3 insertions(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c +1 -0
@@ -2043,6 +2043,7 @@ static void qlcnic_83xx_exec_template_cmd(struct qlcnic_adapter *p_dev,break ; } entry += p_hdr->size; +cond_resched (); } p_dev->ahw->reset.seq_index = index; }
drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +2 -0
@@ -703,6 +703,7 @@ static u32 qlcnic_read_memory_test_agent(struct qlcnic_adapter *adapter, addr +=16 ; reg_read -=16 ; ret +=16 ; +cond_resched (); } out:mutex_unlock (&adapter->ahw->mem_lock);
@@ -1383,6 +1384,7 @@ int qlcnic_dump_fw(struct qlcnic_adapter *adapter) buf_offset += entry->hdr.cap_size; entry_offset += entry->hdr.offset; buffer = fw_dump->data + buf_offset; +cond_resched (); } fw_dump->clr =1 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/70 powerpc/fsl/dts: add fsl,erratum-a011043
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 73d527aef68f7644e59f22ce7f9ac75e7b533aea ]
Add fsl,erratum-a011043 to internal MDIO buses. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
--- arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi | 1 + arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi | 1 + 18 files changed, 18 insertions(+)
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0-best-effort.dtsi +1 -0
@@ -63,6 +63,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy0: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-0.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy6: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1-best-effort.dtsi +1 -0
@@ -63,6 +63,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy1: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-10g-1.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy7: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-0.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy0: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-1.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy1: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-2.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe5000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy2: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-3.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe7000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy3: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-4.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe9000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy4: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-0-1g-5.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@400000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xeb000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy5: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-0.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy14: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-10g-1.dtsi +1 -0
@@ -60,6 +60,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xf3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy15: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-0.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe1000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy8: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-1.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe3000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy9: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-2.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe5000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy10: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-3.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe7000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy11: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-4.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xe9000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy12: ethernet-phy@0 { reg = <0x0>;
arch/powerpc/boot/dts/fsl/qoriq-fman3-1-1g-5.dtsi +1 -0
@@ -59,6 +59,7 @@ fman@500000 { #size-cells = <0>; compatible = "fsl,fman-memac-mdio", "fsl,fman-xmdio"; reg = <0xeb000 0x1000>; + fsl,erratum-a011043; /* must ignore read errors */ pcsphy13: ethernet-phy@0 { reg = <0x0>;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/70 net/fsl: treat fsl,erratum-a011043
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 1d3ca681b9d9575ccf696ebc2840a1ebb1fd4074 ]
When fsl,erratum-a011043 is set, adjust for erratum A011043:
MDIO reads to internal PCS registers may result in having the MDIO_CFG[MDIO_RD_ER] bit set, even when there is no error and read data (MDIO_DATA[MDIO_DATA]) is correct. Software may get false read error when reading internal PCS registers through MDIO. As a workaround, all internal MDIO accesses should ignore the MDIO_CFG[MDIO_RD_ER] bit.
--- drivers/net/ethernet/freescale/xgmac_mdio.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/xgmac_mdio.c +6 -1
@@ -49,6 +49,7 @@ struct tgec_mdio_controller {struct mdio_fsl_priv {struct tgec_mdio_controller __iomem *mdio_base;bool is_little_endian; +bool has_a011043; }; static u32 xgmac_read32(void __iomem *regs,
@@ -226,7 +227,8 @@ static int xgmac_mdio_read(struct mii_bus *bus, int phy_id, int regnum)return ret;/* Return all Fs if nothing was there */ -if (xgmac_read32 (®s->mdio_stat, endian) &MDIO_STAT_RD_ER ) { +if ((xgmac_read32 (®s->mdio_stat, endian) &MDIO_STAT_RD_ER ) && + !priv->has_a011043) {dev_err (&bus->dev,"Error while reading PHY%d reg at %d.%hhu\n" , phy_id, dev_addr, regnum);
@@ -274,6 +276,9 @@ static int xgmac_mdio_probe(struct platform_device *pdev) priv->is_little_endian =of_property_read_bool (pdev->dev.of_node,"little-endian" ); + priv->has_a011043 =of_property_read_bool (pdev->dev.of_node, +"fsl,erratum-a011043" ); + ret =of_mdiobus_register (bus, np);if (ret) {dev_err (&pdev->dev,"cannot register MDIO bus\n" );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/70 net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G
In reply to Greg Kroah-HartmanFrom: Madalin Bucur <[email protected]>
[ Upstream commit 457bfc0a4bf531487ecc3cf82ec728a5e114fb1e ]
As the only 10G PHY interface type defined at the moment the code was developed was XGMII, although the PHY interface mode used was not XGMII, XGMII was used in the code to denote 10G. This patch renames the 10G interface mode to remove the ambiguity.
--- drivers/net/ethernet/freescale/fman/fman_memac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/freescale/fman/fman_memac.c +2 -2
@@ -110,7 +110,7 @@ do { \/* Interface Mode Register (IF_MODE) */ #define IF_MODE_MASK 0x00000003/* 30-31 Mask on i/f mode bits */ -#define IF_MODE_XGMII 0x00000000/* 30-31 XGMII (10G) interface */ +#define IF_MODE_10G 0x00000000/* 30-31 10G interface */ #define IF_MODE_GMII 0x00000002/* 30-31 GMII (1G) interface */ #define IF_MODE_RGMII 0x00000004#define IF_MODE_RGMII_AUTO 0x00008000
@@ -440,7 +440,7 @@ static int init(struct memac_regs __iomem *regs, struct memac_cfg *cfg, tmp =0 ;switch (phy_if) {case PHY_INTERFACE_MODE_XGMII : - tmp |=IF_MODE_XGMII ; + tmp |=IF_MODE_10G ;break ;default : tmp |=IF_MODE_GMII ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/70 seq_tab_next() should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 70a87287c821e9721b62463777f55ba588ac4623 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/cxgb4_debugfs.c +1 -2
@@ -70,8 +70,7 @@ static void *seq_tab_start(struct seq_file *seq, loff_t *pos)static void *seq_tab_next (struct seq_file *seq,void *v,loff_t *pos) { v =seq_tab_get_idx (seq->private, *pos +1 ); -if (v) - ++*pos; + ++(*pos);return v; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/70 l2t_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 66018a102f7756cf72db4d2704e1b93969d9d332 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
https://bugzilla.kernel.org/show_bug.cgi?id=206283
--- drivers/net/ethernet/chelsio/cxgb4/l2t.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/l2t.c +1 -2
@@ -683,8 +683,7 @@ static void *l2t_seq_start(struct seq_file *seq, loff_t *pos)static void *l2t_seq_next (struct seq_file *seq,void *v,loff_t *pos) { v =l2t_get_idx (seq, *pos); -if (v) - ++*pos; + ++(*pos);return v; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/70 net: Fix skb->csum update in inet_proto_csum_replace16().
In reply to Greg Kroah-HartmanFrom: Praveen Chaudhary <[email protected]>
[ Upstream commit 189c9b1e94539b11c80636bc13e9cf47529e7bba ]
skb->csum is updated incorrectly, when manipulation for NF_NAT_MANIP_SRC\DST is done on IPV6 packet.
Fix:
There is no need to update skb->csum in inet_proto_csum_replace16(), because update in two fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to update skb->csum, because update in 3 fields a.) IPv4 src/dst address, b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as L4 Header checksum for skb->csum calculation.
--- net/core/utils.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)
net/core/utils.c +17 -3
@@ -442,6 +442,23 @@ void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, }EXPORT_SYMBOL (inet_proto_csum_replace4); +/** +* inet_proto_csum_replace16 - update layer 4 header checksum field +* @sum: Layer 4 header checksum field +* @skb: sk_buff for the packet +* @from: old IPv6 address +* @to: new IPv6 address +* @pseudohdr: True if layer 4 header checksum includes pseudoheader +* +* Update layer 4 header as per the update in IPv6 src/dst address. +* +* There is no need to update skb->csum in this function, because update in two +* fields a.) IPv6 src/dst address and b.) L4 header checksum cancels each other +* for skb->csum calculation. Whereas inet_proto_csum_replace4 function needs to +* update skb->csum, because update in 3 fields a.) IPv4 src/dst address, +* b.) IPv4 Header checksum and c.) L4 header checksum results in same diff as +* L4 Header checksum for skb->csum calculation. +*/ void inet_proto_csum_replace16 (__sum16 *sum,struct sk_buff *skb,const __be32 *from,const __be32 *to,bool pseudohdr)
@@ -453,9 +470,6 @@ void inet_proto_csum_replace16(__sum16 *sum, struct sk_buff *skb,if (skb->ip_summed !=CHECKSUM_PARTIAL ) { *sum =csum_fold (csum_partial (diff,sizeof (diff), ~csum_unfold (*sum))); -if (skb->ip_summed ==CHECKSUM_COMPLETE && pseudohdr) - skb->csum = ~csum_partial (diff,sizeof (diff), - ~skb->csum); }else if (pseudohdr) *sum = ~csum_fold (csum_partial (diff,sizeof (diff),csum_unfold (*sum)));
Signature · 1 line
2.20.1
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.19:
11 builds: 11 pass, 0 fail
22 boots: 22 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.19.102-rc1-g15412149f234
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Cheers
Jon
Signature · 1 line
nvpublic
Hi!
Quoted 5 lines
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.
;; This buffer is for text that is not saved, and for Lisp evaluation. ;; To create a file, visit it with C-x C-f and enter text in its buffer.
I see different lists in git and on the lists. Extra on list:
20434 O Greg Kroah ├─>[PATCH 4.19 01/70] vfs: fix do_last() regression 20435 O Greg Kroah ├─>[PATCH 4.19 02/70] x86/resctrl: Fix use-after-free when deleting resource 20436 O Greg Kroah ├─>[PATCH 4.19 03/70] x86/resctrl: Fix use-after-free due to inaccurate refco
Extra in git:
| b220e4852d0a d55966c4279b o | btrfs: do not zero f_bavail if we have availab
le space
| e3dce09f7f99 c3314a74f86d | perf report: Fix no libunwind compiled warning
break s390 issue
| 39dc8d352a93 dfe9aa23cab7 o | mm/migrate.c: also overwrite error when it is bigger than zero
Automatic testing did not find any errors in 4.19.102-rc2:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/pipelines/114683672
(Hmm. I see some problems in 4.4.213-rc2, let me investigate.)
Best regards,
Pavel
Signature · 2 lines
(english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
Greg Kroah-Hartman
maintainerQuoted 10 lines · Pavel Machek
Hi!
Quoted 8 lines
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Quoted 8 lines
Quoted 5 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.;; This buffer is for text that is not saved, and for Lisp evaluation. ;; To create a file, visit it with C-x C-f and enter text in its buffer.
:)
Quoted 6 lines
I see different lists in git and on the lists. Extra on list:
20434 O Greg Kroah ├─>[PATCH 4.19 01/70] vfs: fix do_last() regression 20435 O Greg Kroah ├─>[PATCH 4.19 02/70] x86/resctrl: Fix use-after-free when deleting resource 20436 O Greg Kroah ├─>[PATCH 4.19 03/70] x86/resctrl: Fix use-after-free due to inaccurate refco
Quoted 7 lines
Extra in git:
|
b220e4852d0ad55966c4279bo | btrfs: do not zerof_bavailif we have availab
le space
|e3dce09f7f99c3314a74f86d| perf report: Fix no libunwind compiled warning
break s390 issue
|39dc8d352a93dfe9aa23cab7o |mm/migrate.c: also overwrite error when it is bigger than zero
Yeah, Sasha added stuff at the last minute, this was a "tough" round, sorry...
Quoted 5 lines
Automatic testing did not find any errors in 4.19.102-rc2:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/pipelines/114683672
(Hmm. I see some problems in 4.4.213-rc2, let me investigate.)
Great, thanks!
greg k-h
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.102-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.19.102-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: 32591972abd801a21846d4d355bc4e70784d02c6
git describe: v4.19.101-74-g32591972abd8
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.101-74-g32591972abd8
No regressions (compared to build v4.19.101)
No fixes (compared to build v4.19.101)
Ran 12112 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kvm-unit-tests
* ltp-open-posix-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.102 release. There are 70 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 05 Feb 2020 16:17:59 +0000. Anything received after that time might be too late.
Build results:
total: 156 pass: 156 fail: 0 Qemu test results: total: 385 pass: 385 fail: 0
Guenter