4.14.173-stable review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 4.14.173-stable review
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.173-rc1
Mathias Nyman <[email protected]>
xhci: handle port status events for removed USB3 hcd
Mikulas Patocka <[email protected]>
dm integrity: fix a deadlock due to offloading to an incorrect workqueue
Desnes A. Nunes do Rosario <[email protected]>
powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
Dan Carpenter <[email protected]>
dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
Dan Carpenter <[email protected]>
hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
Johan Hovold <[email protected]>
ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties
Ahmad Fatoum <[email protected]>
ARM: imx: build v7_cpu_resume() unconditionally
Dennis Dalessandro <[email protected]>
IB/hfi1, qib: Ensure RCU is locked when accessing list
Jason Gunthorpe <[email protected]>
RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
Bernard Metzler <[email protected]>
RDMA/iwcm: Fix iwcm work deallocation
Charles Keepax <[email protected]>
ASoC: dapm: Correct DAPM handling of active widgets during shutdown
Matthias Reichl <[email protected]>
ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
Takashi Iwai <[email protected]>
ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
Takashi Iwai <[email protected]>
ASoC: intel: skl: Fix possible buffer overflow in debug outputs
Takashi Iwai <[email protected]>
ASoC: intel: skl: Fix pin debug prints
Dragos Tarcatu <[email protected]>
ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
Vladimir Oltean <[email protected]>
ARM: dts: ls1021a: Restore MDIO compatible to gianfar
Mikulas Patocka <[email protected]>
dm cache: fix a crash due to incorrect work item cancelling
Dmitry Osipenko <[email protected]>
dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
Dmitry Osipenko <[email protected]>
dmaengine: tegra-apb: Fix use-after-free
Sean Christopherson <[email protected]>
x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
Jiri Slaby <[email protected]>
vt: selection, push sel_lock up
Jiri Slaby <[email protected]>
vt: selection, push console lock down
Jiri Slaby <[email protected]>
vt: selection, close sel_buffer race
Jay Dolan <[email protected]>
serial: 8250_exar: add support for ACCES cards
tangbin <[email protected]>
tty:serial:mvebu-uart:fix a wrong return
Faiz Abbas <[email protected]>
arm: dts: dra76x: Fix mmc3 max-frequency
OGAWA Hirofumi <[email protected]>
fat: fix uninit-memory access for partial initialized inode
Mel Gorman <[email protected]>
mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
Zhang Xiaoxu <[email protected]>
vgacon: Fix a UAF in vgacon_invert_region
Eugeniu Rosca <[email protected]>
usb: core: port: do error out if usb_autopm_get_interface() fails
Eugeniu Rosca <[email protected]>
usb: core: hub: do error out if usb_autopm_get_interface() fails
Eugeniu Rosca <[email protected]>
usb: core: hub: fix unhandled return by employing a void function
Dan Lazewatsky <[email protected]>
usb: quirks: add NO_LPM quirk for Logitech Screen Share
Jim Lin <[email protected]>
usb: storage: Add quirk for Samsung Fit flash
Ronnie Sahlberg <[email protected]>
cifs: don't leak -EAGAIN for stat() during reconnect
Tim Harvey <[email protected]>
net: thunderx: workaround BGX TX Underflow issue
Kees Cook <[email protected]>
x86/xen: Distribute switch variables for initialization
Keith Busch <[email protected]>
nvme: Fix uninitialized-variable warning
H.J. Lu <[email protected]>
x86/boot/compressed: Don't declare __force_order in kaslr_64.c
Vasily Averin <[email protected]>
s390/cio: cio_ignore_proc_seq_next should increase position index
Marco Felsch <[email protected]>
watchdog: da9062: do not ping the hw during stop()
Marek Vasut <[email protected]>
net: ks8851-ml: Fix 16-bit IO operation
Marek Vasut <[email protected]>
net: ks8851-ml: Fix 16-bit data access
Marek Vasut <[email protected]>
net: ks8851-ml: Remove 8-bit bus accessors
Harigovindan P <[email protected]>
drm/msm/dsi: save pll state before dsi host is powered off
John Stultz <[email protected]>
drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
Brian Masney <[email protected]>
drm/msm/mdp5: rate limit pp done timeout warnings
Sergey Organov <[email protected]>
usb: gadget: serial: fix Tx stall after buffer overflow
Lars-Peter Clausen <[email protected]>
usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
Jack Pham <[email protected]>
usb: gadget: composite: Support more than 500mA MaxPower
Jiri Benc <[email protected]>
selftests: fix too long argument
Daniel Golle <[email protected]>
serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
Masami Hiramatsu <[email protected]>
kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
Nathan Chancellor <[email protected]>
RDMA/core: Fix use of logical OR in get_new_pps
Maor Gottlieb <[email protected]>
RDMA/core: Fix pkey and port assignment in get_new_pps
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
Yazen Ghannam <[email protected]>
EDAC/amd64: Set grain per DIMM
Yazen Ghannam <[email protected]>
x86/mce: Handle varying MCA bank counts
Eugenio Pérez <[email protected]>
vhost: Check docket sk_family instead of call getname
Paul Moore <[email protected]>
audit: always check the netlink payload length in audit_receive_msg()
Greg Kroah-Hartman <[email protected]>
Revert "char/random: silence a lockdep splat with printk()"
David Rientjes <[email protected]>
mm, thp: fix defrag setting if newline is not used
Wei Yang <[email protected]>
mm/huge_memory.c: use head to check huge zero page
Arnaldo Carvalho de Melo <[email protected]>
perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
Masami Hiramatsu <[email protected]>
kprobes: Set unoptimized flag after unoptimizing code
Christophe JAILLET <[email protected]>
drivers: net: xgene: Fix the order of the arguments of 'alloc_etherdev_mqs()'
Jason Wang <[email protected]>
tuntap: correctly set SOCKWQ_ASYNC_NOSPACE
Sean Christopherson <[email protected]>
KVM: Check for a bad hva before dropping into the ghc slow path
Tom Lendacky <[email protected]>
KVM: SVM: Override default MMIO mask if memory encryption is enabled
Brian Norris <[email protected]>
mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
Aleksa Sarai <[email protected]>
namei: only return -ECHILD from follow_dotdot_rcu()
Arthur Kiyanovski <[email protected]>
net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
Pavel Belous <[email protected]>
net: atlantic: fix potential error handling
Nikolay Aleksandrov <[email protected]>
net: netlink: cap max groups which will be considered in netlink_bind()
Chris Wilson <[email protected]>
include/linux/bitops.h: introduce BITS_PER_TYPE
Nathan Chancellor <[email protected]>
ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
Peter Chen <[email protected]>
usb: charger: assign specific number for enum value
Tina Zhang <[email protected]>
drm/i915/gvt: Separate display reset from ALL_ENGINES reset
Wolfram Sang <[email protected]>
i2c: jz4780: silence log flood on txabrt
Gustavo A. R. Silva <[email protected]>
i2c: altera: Fix potential integer overflow
Christophe JAILLET <[email protected]>
MIPS: VPE: Fix a double free and a memory leak in 'release_vpe()'
[email protected] <[email protected]>
HID: hiddev: Fix race in in hiddev_disconnect()
Orson Zhai <[email protected]>
Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
Steven Rostedt (VMware) <[email protected]>
tracing: Disable trace_printk() on post poned tests
Johan Korsnes <[email protected]>
HID: core: increase HID report buffer size to 8KiB
Johan Korsnes <[email protected]>
HID: core: fix off-by-one memset in hid_report_raw_event()
Hans de Goede <[email protected]>
HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
Oliver Upton <[email protected]>
KVM: VMX: check descriptor table exits on instruction emulation
Mika Westerberg <[email protected]>
ACPI: watchdog: Fix gas->access_width usage
Mika Westerberg <[email protected]>
ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
Paul Moore <[email protected]>
audit: fix error handling in audit_data_to_entry()
Dan Carpenter <[email protected]>
ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
Jason Baron <[email protected]>
net: sched: correct flower port blocking
Michal Kalderon <[email protected]>
qede: Fix race between rdma destroy workqueue and link change event
Benjamin Poirier <[email protected]>
ipv6: Fix route replacement with dev-only route
Benjamin Poirier <[email protected]>
ipv6: Fix nlmsg_flags when splitting a multipath route
Xin Long <[email protected]>
sctp: move the format error check out of __sctp_sf_do_9_1_abort
Dmitry Osipenko <[email protected]>
nfc: pn544: Fix occasional HW initialization failure
Arun Parameswaran <[email protected]>
net: phy: restore mdio regs in the iproc mdio driver
Jethro Beekman <[email protected]>
net: fib_rules: Correctly set table field when table number exceeds 8 bits
Petr Mladek <[email protected]>
sysrq: Remove duplicated sysrq message
Petr Mladek <[email protected]>
sysrq: Restore original console_loglevel when sysrq disabled
Sergey Matyukevich <[email protected]>
cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
Frank Sorenson <[email protected]>
cifs: Fix mode output in debugging statements
Arthur Kiyanovski <[email protected]>
net: ena: ena-com.c: prevent NULL pointer dereference
Sameeh Jubran <[email protected]>
net: ena: ethtool: use correct value for crc32 hash
Arthur Kiyanovski <[email protected]>
net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
Arthur Kiyanovski <[email protected]>
net: ena: rss: store hash function as values and not bits
Sameeh Jubran <[email protected]>
net: ena: rss: fix failure to get indirection table
Arthur Kiyanovski <[email protected]>
net: ena: fix incorrect default RSS key
Arthur Kiyanovski <[email protected]>
net: ena: add missing ethtool TX timestamping indication
Arthur Kiyanovski <[email protected]>
net: ena: fix uses of round_jiffies()
Arthur Kiyanovski <[email protected]>
net: ena: fix potential crash when rxfh key is NULL
Bjørn Mork <[email protected]>
qmi_wwan: unconditionally reject 2 ep interfaces
Bjørn Mork <[email protected]>
qmi_wwan: re-add DW5821e pre-production variant
Sergey Matyukevich <[email protected]>
cfg80211: check wiphy driver existence for drvinfo report
Johannes Berg <[email protected]>
mac80211: consider more elements in parsing CRC
Jeff Moyer <[email protected]>
dax: pass NOWAIT flag to iomap_apply
Sean Paul <[email protected]>
drm/msm: Set dma maximum segment size for mdss
Corey Minyard <[email protected]>
ipmi:ssif: Handle a possible NULL pointer reference
Suraj Jitindar Singh <[email protected]>
ext4: fix potential race between s_group_info online resizing and access
Suraj Jitindar Singh <[email protected]>
ext4: fix potential race between s_flex_groups online resizing and access
Theodore Ts'o <[email protected]>
ext4: fix potential race between online resizing and write operations
Martynas Pumputis <[email protected]>
netfilter: nf_conntrack: resolve clash for matching conntracks
Johannes Berg <[email protected]>
iwlwifi: pcie: fix rb_allocator workqueue allocation
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/dra76x.dtsi | 5 ++ arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts | 4 +- arch/arm/boot/dts/ls1021a.dtsi | 4 +- arch/arm/mach-imx/Makefile | 2 + arch/arm/mach-imx/common.h | 4 +- arch/arm/mach-imx/resume-imx6.S | 24 +++++ arch/arm/mach-imx/suspend-imx6.S | 14 --- arch/mips/kernel/vpe.c | 2 +- arch/powerpc/kernel/cputable.c | 4 +- arch/x86/boot/compressed/pagetable.c | 3 - arch/x86/kernel/cpu/common.c | 2 +- arch/x86/kernel/cpu/mcheck/mce-inject.c | 14 +-- arch/x86/kernel/cpu/mcheck/mce.c | 22 ++--- arch/x86/kvm/svm.c | 43 +++++++++ arch/x86/kvm/vmx.c | 15 ++++ arch/x86/xen/enlighten_pv.c | 7 +- drivers/acpi/acpi_watchdog.c | 3 +- drivers/char/ipmi/ipmi_ssif.c | 10 ++- drivers/char/random.c | 5 +- drivers/devfreq/devfreq.c | 4 +- drivers/dma/coh901318.c | 4 - drivers/dma/tegra20-apb-dma.c | 6 +- drivers/edac/amd64_edac.c | 1 + drivers/gpu/drm/i915/gvt/vgpu.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_manager.c | 7 +- drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 - drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c | 4 +- drivers/gpu/drm/msm/msm_drv.c | 8 ++ drivers/hid/hid-core.c | 4 +- drivers/hid/hid-ite.c | 5 +- drivers/hid/usbhid/hiddev.c | 2 +- drivers/hwmon/adt7462.c | 2 +- drivers/i2c/busses/i2c-altera.c | 2 +- drivers/i2c/busses/i2c-jz4780.c | 36 +------- drivers/infiniband/core/cm.c | 1 + drivers/infiniband/core/iwcm.c | 4 +- drivers/infiniband/core/security.c | 14 +-- drivers/infiniband/hw/hfi1/verbs.c | 4 +- drivers/infiniband/hw/qib/qib_verbs.c | 2 + drivers/md/dm-cache-target.c | 4 +- drivers/md/dm-integrity.c | 15 +++- drivers/net/dsa/bcm_sf2.c | 3 +- drivers/net/ethernet/amazon/ena/ena_com.c | 48 ++++++++-- drivers/net/ethernet/amazon/ena/ena_com.h | 9 ++ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 46 +++++++++- drivers/net/ethernet/amazon/ena/ena_netdev.c | 6 +- drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 + drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 2 +- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +- drivers/net/ethernet/cavium/thunder/thunder_bgx.c | 62 ++++++++++++- drivers/net/ethernet/cavium/thunder/thunder_bgx.h | 9 ++ drivers/net/ethernet/micrel/ks8851_mll.c | 53 ++--------- drivers/net/ethernet/qlogic/qede/qede.h | 2 + drivers/net/ethernet/qlogic/qede/qede_rdma.c | 29 +++++- drivers/net/phy/mdio-bcm-iproc.c | 20 +++++ drivers/net/tun.c | 19 +++- drivers/net/usb/qmi_wwan.c | 43 ++++----- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 15 +++- drivers/net/wireless/marvell/mwifiex/tdls.c | 75 ++++++---------- drivers/nfc/pn544/i2c.c | 1 + drivers/nvme/host/core.c | 2 +- drivers/s390/cio/blacklist.c | 5 +- drivers/tty/serial/8250/8250_exar.c | 33 +++++++ drivers/tty/serial/ar933x_uart.c | 8 ++ drivers/tty/serial/mvebu-uart.c | 2 +- drivers/tty/sysrq.c | 8 +- drivers/tty/vt/selection.c | 26 +++++- drivers/tty/vt/vt.c | 2 - drivers/usb/core/hub.c | 8 +- drivers/usb/core/port.c | 10 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/gadget/composite.c | 24 +++-- drivers/usb/gadget/function/f_fs.c | 5 +- drivers/usb/gadget/function/u_serial.c | 4 +- drivers/usb/host/xhci-ring.c | 6 ++ drivers/usb/storage/unusual_devs.h | 6 ++ drivers/vhost/net.c | 13 +-- drivers/video/console/vgacon.c | 3 + drivers/watchdog/da9062_wdt.c | 7 -- drivers/watchdog/wdat_wdt.c | 2 +- fs/cifs/cifsacl.c | 4 +- fs/cifs/connect.c | 2 +- fs/cifs/inode.c | 8 +- fs/dax.c | 3 + fs/ecryptfs/keystore.c | 4 +- fs/ext4/balloc.c | 14 ++- fs/ext4/ext4.h | 30 +++++-- fs/ext4/ialloc.c | 23 +++-- fs/ext4/mballoc.c | 61 ++++++++----- fs/ext4/resize.c | 62 ++++++++++--- fs/ext4/super.c | 103 +++++++++++++++------- fs/fat/inode.c | 19 ++-- fs/namei.c | 2 +- include/acpi/actypes.h | 3 +- include/linux/bitops.h | 3 +- include/linux/hid.h | 2 +- include/net/flow_dissector.h | 9 ++ include/uapi/linux/usb/charger.h | 16 ++-- kernel/audit.c | 40 +++++---- kernel/auditfilter.c | 71 ++++++++------- kernel/kprobes.c | 71 +++++++++------ kernel/trace/trace.c | 2 + mm/huge_memory.c | 26 ++---- mm/mprotect.c | 38 +++++++- net/core/fib_rules.c | 2 +- net/ipv6/ip6_fib.c | 7 +- net/ipv6/route.c | 1 + net/mac80211/util.c | 18 ++-- net/netfilter/nf_conntrack_core.c | 30 +++++-- net/netlink/af_netlink.c | 5 +- net/sched/cls_flower.c | 1 + net/sctp/sm_statefuns.c | 29 ++++-- net/wireless/ethtool.c | 8 +- net/wireless/nl80211.c | 1 + sound/soc/codecs/pcm512x.c | 8 +- sound/soc/intel/skylake/skl-debug.c | 32 +++---- sound/soc/soc-dapm.c | 2 +- sound/soc/soc-pcm.c | 16 ++-- sound/soc/soc-topology.c | 5 +- tools/perf/ui/browsers/hists.c | 1 + tools/testing/selftests/lib.mk | 23 ++--- virt/kvm/kvm_main.c | 12 +-- 123 files changed, 1159 insertions(+), 609 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/126 iwlwifi: pcie: fix rb_allocator workqueue allocation
From: Johannes Berg <[email protected]>
commit 8188a18ee2e48c9a7461139838048363bfce3fef upstream
We don't handle failures in the rb_allocator workqueue allocation correctly. To fix that, move the code earlier so the cleanup is easier and we don't have to undo all the interrupt allocations in this case.
--- drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/pcie/trans.c +11 -4
@@ -3023,6 +3023,15 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev,spin_lock_init (&trans_pcie->reg_lock);mutex_init (&trans_pcie->mutex);init_waitqueue_head (&trans_pcie->ucode_write_waitq); + + trans_pcie->rba.alloc_wq =alloc_workqueue ("rb_allocator" , +WQ_HIGHPRI |WQ_UNBOUND ,1 ); +if (!trans_pcie->rba.alloc_wq) { + ret = -ENOMEM ; + goto out_free_trans; + } +INIT_WORK (&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work); + trans_pcie->tso_hdr_page = alloc_percpu(struct iwl_tso_hdr_page);if (!trans_pcie->tso_hdr_page) { ret = -ENOMEM ;
@@ -3195,10 +3204,6 @@ struct iwl_trans *iwl_trans_pcie_alloc(struct pci_dev *pdev, trans_pcie->inta_mask =CSR_INI_SET_MASK ; } - trans_pcie->rba.alloc_wq =alloc_workqueue ("rb_allocator" , -WQ_HIGHPRI |WQ_UNBOUND ,1 ); -INIT_WORK (&trans_pcie->rba.rx_alloc, iwl_pcie_rx_allocator_work); -#ifdef CONFIG_IWLWIFI_PCIE_RTPM trans->runtime_pm_mode =IWL_PLAT_PM_MODE_D0I3 ;#else
@@ -3211,6 +3216,8 @@ out_free_ict:iwl_pcie_free_ict (trans); out_no_pci:free_percpu (trans_pcie->tso_hdr_page); +destroy_workqueue (trans_pcie->rba.alloc_wq); +out_free_trans:iwl_trans_free (trans);return ERR_PTR (ret); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/126 netfilter: nf_conntrack: resolve clash for matching conntracks
In reply to Greg Kroah-HartmanFrom: Martynas Pumputis <[email protected]>
[ Upstream commit ed07d9a021df6da53456663a76999189badc432a ]
This patch enables the clash resolution for NAT (disabled in "590b52e10d41") if clashing conntracks match (i.e. both tuples are equal) and a protocol allows it.
The clash might happen for a connections-less protocol (e.g. UDP) when two threads in parallel writes to the same socket and consequent calls to "get_unique_tuple" return the same tuples (incl. reply tuples).
In this case it is safe to perform the resolution, as the losing CT describes the same mangling as the winning CT, so no modifications to the packet are needed, and the result of rules traversal for the loser's packet stays valid.
--- net/netfilter/nf_conntrack_core.c | 30 ++++++++++++++++++++++-------- 1 file changed, 22 insertions(+), 8 deletions(-)
net/netfilter/nf_conntrack_core.c +22 -8
@@ -543,6 +543,18 @@ nf_ct_key_equal(struct nf_conntrack_tuple_hash *h,net_eq (net,nf_ct_net (ct)); } +static inline bool +nf_ct_match (const struct nf_conn *ct1,const struct nf_conn *ct2) +{ +return nf_ct_tuple_equal (&ct1->tuplehash[IP_CT_DIR_ORIGINAL ].tuple, + &ct2->tuplehash[IP_CT_DIR_ORIGINAL ].tuple) && +nf_ct_tuple_equal (&ct1->tuplehash[IP_CT_DIR_REPLY ].tuple, + &ct2->tuplehash[IP_CT_DIR_REPLY ].tuple) && +nf_ct_zone_equal (ct1,nf_ct_zone (ct2),IP_CT_DIR_ORIGINAL ) && +nf_ct_zone_equal (ct1,nf_ct_zone (ct2),IP_CT_DIR_REPLY ) && +net_eq (nf_ct_net (ct1),nf_ct_net (ct2)); +} +/* caller must hold rcu readlock and none of the nf_conntrack_locks */ static void nf_ct_gc_expired (struct nf_conn *ct) {
@@ -736,19 +748,21 @@ static int nf_ct_resolve_clash(struct net *net, struct sk_buff *skb,/* This is the conntrack entry already in hashes that won race. */ struct nf_conn *ct =nf_ct_tuplehash_to_ctrack (h);const struct nf_conntrack_l4proto *l4proto; +enum ip_conntrack_info oldinfo; +struct nf_conn *loser_ct =nf_ct_get (skb, &oldinfo); l4proto =__nf_ct_l4proto_find (nf_ct_l3num (ct),nf_ct_protonum (ct));if (l4proto->allow_clash && - ((ct->status &IPS_NAT_DONE_MASK ) ==0 ) && !nf_ct_is_dying (ct) &&atomic_inc_not_zero (&ct->ct_general.use)) { -enum ip_conntrack_info oldinfo; -struct nf_conn *loser_ct =nf_ct_get (skb, &oldinfo); - -nf_ct_acct_merge (ct, ctinfo, loser_ct); -nf_conntrack_put (&loser_ct->ct_general); -nf_ct_set (skb, ct, oldinfo); -return NF_ACCEPT ; +if (((ct->status &IPS_NAT_DONE_MASK ) ==0 ) || +nf_ct_match (ct, loser_ct)) { +nf_ct_acct_merge (ct, ctinfo, loser_ct); +nf_conntrack_put (&loser_ct->ct_general); +nf_ct_set (skb, ct, oldinfo); +return NF_ACCEPT ; + } +nf_ct_put (ct); }NF_CT_STAT_INC (net, drop);return NF_DROP ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/126 ext4: fix potential race between online resizing and write operations
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 1d0c3924a92e69bfa91163bda83c12a994b4d106 upstream.
During an online resize an array of pointers to buffer heads gets replaced so it can get enlarged. If there is a racing block allocation or deallocation which uses the old array, and the old array has gotten reused this can lead to a GPF or some other random kernel memory getting modified.
--- fs/ext4/balloc.c | 14 +++++++++--- fs/ext4/ext4.h | 20 +++++++++++++++++- fs/ext4/resize.c | 55 ++++++++++++++++++++++++++++++++++++++---------- fs/ext4/super.c | 31 +++++++++++++++++++-------- 4 files changed, 96 insertions(+), 24 deletions(-)
fs/ext4/balloc.c +11 -3
@@ -280,6 +280,7 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb,ext4_group_t ngroups =ext4_get_groups_count (sb);struct ext4_group_desc *desc;struct ext4_sb_info *sbi =EXT4_SB (sb); +struct buffer_head *bh_p;if (block_group >= ngroups) { ext4_error(sb, "block_group >= groups_count - block_group = %u,"
@@ -290,7 +291,14 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb, group_desc = block_group >>EXT4_DESC_PER_BLOCK_BITS (sb); offset = block_group & (EXT4_DESC_PER_BLOCK (sb) -1 ); -if (!sbi->s_group_desc[group_desc]) { + bh_p =sbi_array_rcu_deref (sbi, s_group_desc, group_desc); +/* +* sbi_array_rcu_deref returns with rcu unlocked, this is ok since +* the pointer being dereferenced won't be dereferenced again. By +* looking at the usage in add_new_gdb() the value isn't modified, +* just the pointer, and so it remains valid. +*/ +if (!bh_p) {ext4_error (sb,"Group descriptor not loaded - " "block_group = %u, group_desc = %u, desc = %u" , block_group, group_desc, offset);
@@ -298,10 +306,10 @@ struct ext4_group_desc * ext4_get_group_desc(struct super_block *sb, } desc = (struct ext4_group_desc *)( - (__u8 *)sbi->s_group_desc[group_desc]->b_data + + (__u8 *)bh_p->b_data + offset *EXT4_DESC_SIZE (sb));if (bh) - *bh = sbi->s_group_desc[group_desc]; + *bh = bh_p;return desc; }
fs/ext4/ext4.h +19 -1
@@ -1382,7 +1382,7 @@ struct ext4_sb_info {loff_t s_bitmap_maxbytes;/* max bytes for bitmap files */ struct buffer_head * s_sbh;/* Buffer containing the super block */ struct ext4_super_block *s_es;/* Pointer to the super block in the buffer */ -struct buffer_head **s_group_desc; +struct buffer_head *__rcu *s_group_desc;unsigned int s_mount_opt;unsigned int s_mount_opt2;unsigned int s_mount_flags;
@@ -1556,6 +1556,23 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino) ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)); } +/* +* Returns: sbi->field[index] +* Used to access an array element from the following sbi fields which require +* rcu protection to avoid dereferencing an invalid pointer due to reassignment +* - s_group_desc +* - s_group_info +* - s_flex_group +*/ +#define sbi_array_rcu_deref (sbi, field, index) \ +({ \ + typeof(*((sbi)->field)) _v; \ + rcu_read_lock(); \ + _v = ((typeof(_v)*)rcu_dereference((sbi)->field))[index]; \ + rcu_read_unlock(); \ + _v; \ +}) +/* * Inode dynamic state flags */
@@ -2569,6 +2586,7 @@ extern int ext4_generic_delete_entry(handle_t *handle,extern bool ext4_empty_dir (struct inode *inode);/* resize.c */ +extern void ext4_kvfree_array_rcu (void *to_free);extern int ext4_group_add (struct super_block *sb,struct ext4_new_group_data *input); extern int ext4_group_extend(struct super_block *sb,
fs/ext4/resize.c +44 -11
110 lines not on this page · raw message
fs/ext4/super.c +22 -9
@@ -900,6 +900,7 @@ static void ext4_put_super(struct super_block *sb) {struct ext4_sb_info *sbi =EXT4_SB (sb);struct ext4_super_block *es = sbi->s_es; +struct buffer_head **group_desc;int aborted =0 ;int i, err;
@@ -931,9 +932,12 @@ static void ext4_put_super(struct super_block *sb)if (!sb_rdonly (sb))ext4_commit_super (sb,1 ); +rcu_read_lock (); + group_desc =rcu_dereference (sbi->s_group_desc);for (i =0 ; i < sbi->s_gdb_count; i++) -brelse (sbi->s_group_desc[i]); -kvfree (sbi->s_group_desc); +brelse (group_desc[i]); +kvfree (group_desc); +rcu_read_unlock ();kvfree (sbi->s_flex_groups);percpu_counter_destroy (&sbi->s_freeclusters_counter);percpu_counter_destroy (&sbi->s_freeinodes_counter);
@@ -3489,7 +3493,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) {struct dax_device *dax_dev =fs_dax_get_by_bdev (sb->s_bdev);char *orig_data =kstrdup (data,GFP_KERNEL ); -struct buffer_head *bh; +struct buffer_head *bh, **group_desc;struct ext4_super_block *es =NULL ;struct ext4_sb_info *sbi =kzalloc (sizeof (*sbi),GFP_KERNEL );ext4_fsblk_t block;
@@ -4104,9 +4108,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) goto failed_mount; } } - sbi->s_group_desc =kvmalloc (db_count * +rcu_assign_pointer (sbi->s_group_desc, +kvmalloc_array (db_count,sizeof (struct buffer_head *), -GFP_KERNEL ); +GFP_KERNEL ));if (sbi->s_group_desc ==NULL ) {ext4_msg (sb,KERN_ERR ,"not enough memory" ); ret = -ENOMEM ;
@@ -4122,14 +4127,19 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) }for (i =0 ; i < db_count; i++) { +struct buffer_head *bh; + block =descriptor_loc (sb, logical_sb_block, i); - sbi->s_group_desc[i] =sb_bread_unmovable (sb, block); -if (!sbi->s_group_desc[i]) { + bh =sb_bread_unmovable (sb, block); +if (!bh) {ext4_msg (sb,KERN_ERR ,"can't read group descriptor %d" , i); db_count = i; goto failed_mount2; } +rcu_read_lock (); +rcu_dereference (sbi->s_group_desc)[i] = bh; +rcu_read_unlock (); } sbi->s_gdb_count = db_count;if (!ext4_check_descriptors (sb, logical_sb_block, &first_not_zeroed)) {
@@ -4521,9 +4531,12 @@ failed_mount3:if (sbi->s_mmp_tsk)kthread_stop (sbi->s_mmp_tsk); failed_mount2: +rcu_read_lock (); + group_desc =rcu_dereference (sbi->s_group_desc);for (i =0 ; i < db_count; i++) -brelse (sbi->s_group_desc[i]); -kvfree (sbi->s_group_desc); +brelse (group_desc[i]); +kvfree (group_desc); +rcu_read_unlock (); failed_mount:if (sbi->s_chksum_driver)crypto_free_shash (sbi->s_chksum_driver);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/126 ext4: fix potential race between s_flex_groups online resizing and access
In reply to Greg Kroah-HartmanFrom: Suraj Jitindar Singh <[email protected]>
commit 7c990728b99ed6fbe9c75fc202fce1172d9916da upstream.
During an online resize an array of s_flex_groups structures gets replaced so it can get enlarged. If there is a concurrent access to the array and this memory has been reused then this can lead to an invalid memory access.
The s_flex_group array has been converted into an array of pointers rather than an array of structures. This is to ensure that the information contained in the structures cannot get out of sync during a resize due to an accessor updating the value in the old structure after it has been copied but before the array pointer is updated. Since the structures them- selves are no longer copied but only the pointers to them this case is mitigated.
--- fs/ext4/ext4.h | 2 +- fs/ext4/ialloc.c | 23 +++++++++------ fs/ext4/mballoc.c | 9 ++++-- fs/ext4/resize.c | 7 +++-- fs/ext4/super.c | 72 ++++++++++++++++++++++++++++++++--------------- 5 files changed, 76 insertions(+), 37 deletions(-)
fs/ext4/ext4.h +1 -1
@@ -1492,7 +1492,7 @@ struct ext4_sb_info {unsigned int s_extent_max_zeroout_kb;unsigned int s_log_groups_per_flex; -struct flex_groups *s_flex_groups; +struct flex_groups *__rcu *s_flex_groups;ext4_group_t s_flex_groups_allocated;/* workqueue for reserved extent conversions (buffered io) */
fs/ext4/ialloc.c +14 -9
@@ -333,11 +333,13 @@ void ext4_free_inode(handle_t *handle, struct inode *inode)percpu_counter_inc (&sbi->s_freeinodes_counter);if (sbi->s_log_groups_per_flex) { -ext4_group_t f =ext4_flex_group (sbi, block_group); +struct flex_groups *fg; -atomic_inc (&sbi->s_flex_groups[f].free_inodes); + fg =sbi_array_rcu_deref (sbi, s_flex_groups, +ext4_flex_group (sbi, block_group)); +atomic_inc (&fg->free_inodes);if (is_directory) -atomic_dec (&sbi->s_flex_groups[f].used_dirs); +atomic_dec (&fg->used_dirs); }BUFFER_TRACE (bh2,"call ext4_handle_dirty_metadata" ); fatal =ext4_handle_dirty_metadata (handle,NULL , bh2);
@@ -378,12 +380,13 @@ static void get_orlov_stats(struct super_block *sb, ext4_group_t g, int flex_size, struct orlov_stats *stats) { struct ext4_group_desc *desc; -struct flex_groups *flex_group =EXT4_SB (sb)->s_flex_groups;if (flex_size >1 ) { - stats->free_inodes =atomic_read (&flex_group[g].free_inodes); - stats->free_clusters =atomic64_read (&flex_group[g].free_clusters); - stats->used_dirs =atomic_read (&flex_group[g].used_dirs); +struct flex_groups *fg =sbi_array_rcu_deref (EXT4_SB (sb), + s_flex_groups, g); + stats->free_inodes =atomic_read (&fg->free_inodes); + stats->free_clusters =atomic64_read (&fg->free_clusters); + stats->used_dirs =atomic_read (&fg->used_dirs);return ; }
@@ -1062,7 +1065,8 @@ got:if (sbi->s_log_groups_per_flex) {ext4_group_t f =ext4_flex_group (sbi, group); -atomic_inc (&sbi->s_flex_groups[f].used_dirs); +atomic_inc (&sbi_array_rcu_deref (sbi, s_flex_groups, + f)->used_dirs); } }if (ext4_has_group_desc_csum (sb)) {
@@ -1085,7 +1089,8 @@ got:if (sbi->s_log_groups_per_flex) { flex_group =ext4_flex_group (sbi, group); -atomic_dec (&sbi->s_flex_groups[flex_group].free_inodes); +atomic_dec (&sbi_array_rcu_deref (sbi, s_flex_groups, + flex_group)->free_inodes); } inode->i_ino = ino + group *EXT4_INODES_PER_GROUP (sb);
fs/ext4/mballoc.c +6 -3
@@ -3052,7 +3052,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,ext4_group_t flex_group =ext4_flex_group (sbi, ac->ac_b_ex.fe_group);atomic64_sub (ac->ac_b_ex.fe_len, - &sbi->s_flex_groups[flex_group].free_clusters); + &sbi_array_rcu_deref (sbi, s_flex_groups, + flex_group)->free_clusters); } err =ext4_handle_dirty_metadata (handle,NULL , bitmap_bh);
@@ -4947,7 +4948,8 @@ do_more:if (sbi->s_log_groups_per_flex) {ext4_group_t flex_group =ext4_flex_group (sbi, block_group);atomic64_add (count_clusters, - &sbi->s_flex_groups[flex_group].free_clusters); + &sbi_array_rcu_deref (sbi, s_flex_groups, + flex_group)->free_clusters); }if (!(flags &EXT4_FREE_BLOCKS_NO_QUOT_UPDATE ))
@@ -5092,7 +5094,8 @@ int ext4_group_add_blocks(handle_t *handle, struct super_block *sb,if (sbi->s_log_groups_per_flex) {ext4_group_t flex_group =ext4_flex_group (sbi, block_group);atomic64_add (EXT4_NUM_B2C (sbi, blocks_freed), - &sbi->s_flex_groups[flex_group].free_clusters); + &sbi_array_rcu_deref (sbi, s_flex_groups, + flex_group)->free_clusters); }ext4_mb_unload_buddy (&e4b);
fs/ext4/resize.c +5 -2
@@ -1425,11 +1425,14 @@ static void ext4_update_super(struct super_block *sb, percpu_counter_read(&sbi->s_freeclusters_counter));if (ext4_has_feature_flex_bg (sb) && sbi->s_log_groups_per_flex) {ext4_group_t flex_group; +struct flex_groups *fg; + flex_group =ext4_flex_group (sbi, group_data[0 ].group); + fg =sbi_array_rcu_deref (sbi, s_flex_groups, flex_group);atomic64_add (EXT4_NUM_B2C (sbi, free_blocks), - &sbi->s_flex_groups[flex_group].free_clusters); + &fg->free_clusters);atomic_add (EXT4_INODES_PER_GROUP (sb) * flex_gd->count, - &sbi->s_flex_groups[flex_group].free_inodes); + &fg->free_inodes); }/*
fs/ext4/super.c +50 -22
126 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/126 ext4: fix potential race between s_group_info online resizing and access
In reply to Greg Kroah-HartmanFrom: Suraj Jitindar Singh <[email protected]>
[ Upstream commit df3da4ea5a0fc5d115c90d5aa6caa4dd433750a7 ]
During an online resize an array of pointers to s_group_info gets replaced so it can get enlarged. If there is a concurrent access to the array in ext4_get_group_info() and this memory has been reused then this can lead to an invalid memory access.
--- fs/ext4/ext4.h | 8 ++++---- fs/ext4/mballoc.c | 52 +++++++++++++++++++++++++++++++---------------- 2 files changed, 39 insertions(+), 21 deletions(-)
fs/ext4/ext4.h +4 -4
@@ -1442,7 +1442,7 @@ struct ext4_sb_info {#endif /* for buddy allocator */ -struct ext4_group_info ***s_group_info; +struct ext4_group_info **__rcu *s_group_info;struct inode *s_buddy_cache;spinlock_t s_md_lock;unsigned short *s_mb_offsets;
@@ -2832,13 +2832,13 @@ static inlinestruct ext4_group_info *ext4_get_group_info (struct super_block *sb,ext4_group_t group) { -struct ext4_group_info ***grp_info; +struct ext4_group_info **grp_info;long indexv, indexh;BUG_ON (group >=EXT4_SB (sb)->s_groups_count); - grp_info =EXT4_SB (sb)->s_group_info; indexv = group >> (EXT4_DESC_PER_BLOCK_BITS (sb)); indexh = group & ((EXT4_DESC_PER_BLOCK (sb)) -1 ); -return grp_info[indexv][indexh]; + grp_info =sbi_array_rcu_deref (EXT4_SB (sb), s_group_info, indexv); +return grp_info[indexh]; }/*
fs/ext4/mballoc.c +35 -17
114 lines not on this page · raw message
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/126 ipmi:ssif: Handle a possible NULL pointer reference
In reply to Greg Kroah-HartmanFrom: Corey Minyard <[email protected]>
[ Upstream commit 6b8526d3abc02c08a2f888e8c20b7ac9e5776dfe ]
In error cases a NULL can be passed to memcpy. The length will always be zero, so it doesn't really matter, but go ahead and check for NULL, anyway, to be more precise and avoid static analysis errors.
--- drivers/char/ipmi/ipmi_ssif.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/char/ipmi/ipmi_ssif.c +7 -3
@@ -750,10 +750,14 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, flags =ipmi_ssif_lock_cond (ssif_info, &oflags); msg = ssif_info->curr_msg;if (msg) { +if (data) { +if (len >IPMI_MAX_MSG_LENGTH ) + len =IPMI_MAX_MSG_LENGTH ; +memcpy (msg->rsp, data, len); + }else { + len =0 ; + } msg->rsp_size = len; -if (msg->rsp_size >IPMI_MAX_MSG_LENGTH ) - msg->rsp_size =IPMI_MAX_MSG_LENGTH ; -memcpy (msg->rsp, data, msg->rsp_size); ssif_info->curr_msg =NULL ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/126 drm/msm: Set dma maximum segment size for mdss
In reply to Greg Kroah-HartmanFrom: Sean Paul <[email protected]>
[ Upstream commit db735fc4036bbe1fbe606819b5f0ff26cc76cdff ]
Turning on CONFIG_DMA_API_DEBUG_SG results in the following error:
[ 12.078665] msm ae00000.mdss: DMA-API: mapping sg segment longer than device claims to support [len=3526656] [max=65536] [ 12.089870] WARNING: CPU: 6 PID: 334 at /mnt/host/source/src/third_party/kernel/v4.19/kernel/dma/debug.c:1301 debug_dma_map_sg+0x1dc/0x318 [ 12.102655] Modules linked in: joydev [ 12.106442] CPU: 6 PID: 334 Comm: frecon Not tainted 4.19.0 #2 [ 12.112450] Hardware name: Google Cheza (rev3+) (DT) [ 12.117566] pstate: 60400009 (nZCv daif +PAN -UAO) [ 12.122506] pc : debug_dma_map_sg+0x1dc/0x318 [ 12.126995] lr : debug_dma_map_sg+0x1dc/0x318 [ 12.131487] sp : ffffff800cc3ba80 [ 12.134913] x29: ffffff800cc3ba80 x28: 0000000000000000 [ 12.140395] x27: 0000000000000004 x26: 0000000000000004 [ 12.145868] x25: ffffff8008e55b18 x24: 0000000000000000 [ 12.151337] x23: 00000000ffffffff x22: ffffff800921c000 [ 12.156809] x21: ffffffc0fa75b080 x20: ffffffc0f7195090 [ 12.162280] x19: ffffffc0f1c53280 x18: 0000000000000000 [ 12.167749] x17: 0000000000000000 x16: 0000000000000000 [ 12.173218] x15: 0000000000000000 x14: 0720072007200720 [ 12.178689] x13: 0720072007200720 x12: 0720072007200720 [ 12.184161] x11: 0720072007200720 x10: 0720072007200720 [ 12.189641] x9 : ffffffc0f1fc6b60 x8 : 0000000000000000 [ 12.195110] x7 : ffffff8008132ce0 x6 : 0000000000000000 [ 12.200585] x5 : 0000000000000000 x4 : ffffff8008134734 [ 12.206058] x3 : ffffff800cc3b830 x2 : ffffffc0f1fc6240 [ 12.211532] x1 : 25045a74f48a7400 x0 : 25045a74f48a7400 [ 12.217006] Call trace: [ 12.219535] debug_dma_map_sg+0x1dc/0x318 [ 12.223671] get_pages+0x19c/0x20c [ 12.227177] msm_gem_fault+0x64/0xfc [ 12.230874] __do_fault+0x3c/0x140 [ 12.234383] __handle_mm_fault+0x70c/0xdb8 [ 12.238603] handle_mm_fault+0xac/0xc4 [ 12.242473] do_page_fault+0x1bc/0x3d4 [ 12.246342] do_translation_fault+0x54/0x88 [ 12.250652] do_mem_abort+0x60/0xf0 [ 12.254250] el0_da+0x20/0x24 [ 12.257317] irq event stamp: 67260 [ 12.260828] hardirqs last enabled at (67259): [<ffffff8008132d0c>] console_unlock+0x214/0x608 [ 12.269693] hardirqs last disabled at (67260): [<ffffff8008080e0c>] do_debug_exception+0x5c/0x178 [ 12.278820] softirqs last enabled at (67256): [<ffffff8008081664>] __do_softirq+0x4d4/0x520 [ 12.287510] softirqs last disabled at (67249): [<ffffff80080be574>] irq_exit+0xa8/0x100 [ 12.295742] ---[ end trace e63cfc40c313ffab ]---
The root of the problem is that the default segment size for sgt is (UINT_MAX & PAGE_MASK), and the default segment size for device dma is 64K. As such, if you compare the 2, you would deduce that the sg segment will overflow the device's capacity. In reality, the hardware can accommodate the larger sg segments, it's just not initializing its max segment properly. This patch initializes the max segment size for the mdss device, which gets rid of that pesky warning.
--- drivers/gpu/drm/msm/msm_drv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/gpu/drm/msm/msm_drv.c +8 -0
@@ -420,6 +420,14 @@ static int msm_drm_init(struct device *dev, struct drm_driver *drv)if (ret) goto fail; +if (!dev->dma_parms) { + dev->dma_parms =devm_kzalloc (dev,sizeof (*dev->dma_parms), +GFP_KERNEL ); +if (!dev->dma_parms) +return -ENOMEM ; + } +dma_set_max_seg_size (dev,DMA_BIT_MASK (32 )); +msm_gem_shrinker_init (ddev);switch (get_mdp_ver (pdev)) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/126 dax: pass NOWAIT flag to iomap_apply
In reply to Greg Kroah-HartmanFrom: Jeff Moyer <[email protected]>
[ Upstream commit 96222d53842dfe54869ec4e1b9d4856daf9105a2 ]
fstests generic/471 reports a failure when run with MOUNT_OPTIONS="-o dax". The reason is that the initial pwrite to an empty file with the RWF_NOWAIT flag set does not return -EAGAIN. It turns out that dax_iomap_rw doesn't pass that flag through to iomap_apply.
With this patch applied, generic/471 passes for me.
--- fs/dax.c | 3 +++ 1 file changed, 3 insertions(+)
fs/dax.c +3 -0
@@ -1057,6 +1057,9 @@ dax_iomap_rw(struct kiocb *iocb, struct iov_iter *iter,lockdep_assert_held (&inode->i_rwsem); } +if (iocb->ki_flags &IOCB_NOWAIT ) + flags |=IOMAP_NOWAIT ; +while (iov_iter_count (iter)) { ret =iomap_apply (inode, pos,iov_iter_count (iter), flags, ops, iter, dax_iomap_actor);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/126 mac80211: consider more elements in parsing CRC
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit a04564c99bb4a92f805a58e56b2d22cc4978f152 ]
We only use the parsing CRC for checking if a beacon changed, and elements with an ID > 63 cannot be represented in the filter. Thus, like we did before with WMM and Cisco vendor elements, just statically add these forgotten items to the CRC:
- WLAN_EID_VHT_OPERATION
- WLAN_EID_OPMODE_NOTIF
I guess that in most cases when VHT/HE operation change, the HT operation also changed, and so the change was picked up, but we did notice that pure operating mode notification changes were ignored.
--- net/mac80211/util.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
net/mac80211/util.c +12 -6
@@ -944,16 +944,22 @@ u32 ieee802_11_parse_elems_crc(const u8 *start, size_t len, bool action, elem_parse_failed = true;break ;case WLAN_EID_VHT_OPERATION : -if (elen >=sizeof (struct ieee80211_vht_operation )) +if (elen >=sizeof (struct ieee80211_vht_operation )) { elems->vht_operation = (void *)pos; -else - elem_parse_failed = true; +if (calc_crc) + crc =crc32_be (crc, pos -2 , elen +2 ); +break ; + } + elem_parse_failed = true;break ;case WLAN_EID_OPMODE_NOTIF : -if (elen >0 ) +if (elen >0 ) { elems->opmode_notif = pos; -else - elem_parse_failed = true; +if (calc_crc) + crc =crc32_be (crc, pos -2 , elen +2 ); +break ; + } + elem_parse_failed = true;break ;case WLAN_EID_MESH_ID : elems->mesh_id = pos;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/126 cfg80211: check wiphy driver existence for drvinfo report
In reply to Greg Kroah-HartmanFrom: Sergey Matyukevich <[email protected]>
[ Upstream commit bfb7bac3a8f47100ebe7961bd14e924c96e21ca7 ]
When preparing ethtool drvinfo, check if wiphy driver is defined before dereferencing it. Driver may not exist, e.g. if wiphy is attached to a virtual platform device.
--- net/wireless/ethtool.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
net/wireless/ethtool.c +6 -2
@@ -7,9 +7,13 @@void cfg80211_get_drvinfo (struct net_device *dev,struct ethtool_drvinfo *info) {struct wireless_dev *wdev = dev->ieee80211_ptr; +struct device *pdev =wiphy_dev (wdev->wiphy); -strlcpy (info->driver,wiphy_dev (wdev->wiphy)->driver->name, -sizeof (info->driver)); +if (pdev->driver) +strlcpy (info->driver, pdev->driver->name, +sizeof (info->driver)); +else +strlcpy (info->driver,"N/A" ,sizeof (info->driver));strlcpy (info->version,init_utsname ()->release,sizeof (info->version));
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/126 qmi_wwan: re-add DW5821e pre-production variant
In reply to Greg Kroah-HartmanFrom: Bjørn Mork <[email protected]>
[ Upstream commit 88bf54603f6f2c137dfee1abf6436ceac3528d2d ]
Commit f25e1392fdb5 removed the support for the pre-production variant of the Dell DW5821e to avoid probing another USB interface unnecessarily. However, the pre-production samples are found in the wild, and this lack of support is causing problems for users of such samples. It is therefore necessary to support both variants.
Matching on both interfaces 0 and 1 is not expected to cause any problem with either variant, as only the QMI function will be probed successfully on either. Interface 1 will be rejected based on the HID class for the production variant:
T: Bus=01 Lev=03 Prnt=04 Port=00 Cnt=01 Dev#= 16 Spd=480 MxCh= 0 D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 2 P: Vendor=413c ProdID=81d7 Rev=03.18 S: Manufacturer=DELL S: Product=DW5821e Snapdragon X20 LTE S: SerialNumber=0123456789ABCDEF C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan I: If#= 1 Alt= 0 #EPs= 1 Cls=03(HID ) Sub=00 Prot=00 Driver=usbhid I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#= 5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
And interface 0 will be rejected based on too few endpoints for the pre-production variant:
T: Bus=01 Lev=02 Prnt=02 Port=03 Cnt=03 Dev#= 7 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 2
P: Vendor=413c ProdID=81d7 Rev= 3.18
S: Manufacturer=DELL
S: Product=DW5821e Snapdragon X20 LTE
S: SerialNumber=0123456789ABCDEF
C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
I: If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1287,6 +1287,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */ + {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/ {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/126 qmi_wwan: unconditionally reject 2 ep interfaces
In reply to Greg Kroah-HartmanFrom: Bjørn Mork <[email protected]>
[ Upstream commit 00516d13d4cfa56ce39da144db2dbf08b09b9357 ]
We have been using the fact that the QMI and DIAG functions usually are the only ones with class/subclass/protocol being ff/ff/ff on Quectel modems. This has allowed us to match the QMI function without knowing the exact interface number, which can vary depending on firmware configuration.
The ability to silently reject the DIAG function, which is usually handled by the option driver, is important for this method to work. This is done based on the knowledge that it has exactly 2 bulk endpoints. QMI function control interfaces will have either 3 or 1 endpoint. This rule is universal so the quirk condition can be removed.
The fixed layouts known from the Gobi1k and Gobi2k modems have been gradually replaced by more dynamic layouts, and many vendors now use configurable layouts without changing device IDs. Renaming the class/subclass/protocol matching macro makes it more obvious that this is now not Quectel specific anymore.
--- drivers/net/usb/qmi_wwan.c | 42 ++++++++++++++------------------------ 1 file changed, 15 insertions(+), 27 deletions(-)
drivers/net/usb/qmi_wwan.c +15 -27
@@ -63,7 +63,6 @@ enum qmi_wwan_flags {enum qmi_wwan_quirks {QMI_WWAN_QUIRK_DTR =1 <<0 ,/* needs "set DTR" request */ -QMI_WWAN_QUIRK_QUECTEL_DYNCFG =1 <<1 ,/* check num. endpoints */ };struct qmimux_hdr {
@@ -853,16 +852,6 @@ static const struct driver_info qmi_wwan_info_quirk_dtr = { .data = QMI_WWAN_QUIRK_DTR, }; -static const struct driver_info qmi_wwan_info_quirk_quectel_dyncfg = { - .description ="WWAN/QMI device" , - .flags =FLAG_WWAN |FLAG_SEND_ZLP , - .bind = qmi_wwan_bind, - .unbind = qmi_wwan_unbind, - .manage_power = qmi_wwan_manage_power, - .rx_fixup = qmi_wwan_rx_fixup, - .data =QMI_WWAN_QUIRK_DTR |QMI_WWAN_QUIRK_QUECTEL_DYNCFG , -}; -#define HUAWEI_VENDOR_ID 0x12D1/* map QMI/wwan function by a fixed interface number */
@@ -883,14 +872,18 @@ static const struct driver_info qmi_wwan_info_quirk_quectel_dyncfg = {#define QMI_GOBI_DEVICE (vend, prod) \ QMI_FIXED_INTF(vend, prod, 0) -/* Quectel does not use fixed interface numbers on at least some of their -* devices. We need to check the number of endpoints to ensure that we bind to -* the correct interface. +/* Many devices have QMI and DIAG functions which are distinguishable +* from other vendor specific functions by class, subclass and +* protocol all being 0xff. The DIAG function has exactly 2 endpoints +* and is silently rejected when probed. +* +* This makes it possible to match dynamically numbered QMI functions +* as seen on e.g. many Quectel modems. */ -#define QMI_QUIRK_QUECTEL_DYNCFG (vend, prod) \ +#define QMI_MATCH_FF_FF_FF (vend, prod) \ USB_DEVICE_AND_INTERFACE_INFO(vend, prod, USB_CLASS_VENDOR_SPEC, \ USB_SUBCLASS_VENDOR_SPEC, 0xff), \ - .driver_info = (unsigned long)&qmi_wwan_info_quirk_quectel_dyncfg + .driver_info = (unsigned long)&qmi_wwan_info_quirk_dtrstatic const struct usb_device_id products[] = {/* 1. CDC ECM like devices match on the control interface */
@@ -996,10 +989,10 @@ static const struct usb_device_id products[] = { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), .driver_info = (unsigned long )&qmi_wwan_info, }, - {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ - {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ - {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ - {QMI_QUIRK_QUECTEL_DYNCFG(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0125)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0306)}, /* Quectel EP06/EG06/EM06 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0512)}, /* Quectel EG12/EM12 */ + {QMI_MATCH_FF_FF_FF(0x2c7c, 0x0800)}, /* Quectel RM500Q-GL *//* 3. Combined interface devices matching on interface number */ {QMI_FIXED_INTF(0x0408, 0xea42, 4)}, /* Yota / Megafon M100-1 */
@@ -1379,7 +1372,6 @@ static int qmi_wwan_probe(struct usb_interface *intf, {struct usb_device_id *id = (struct usb_device_id *)prod;struct usb_interface_descriptor *desc = &intf->cur_altsetting->desc; -const struct driver_info *info;/* Workaround to enable dynamic IDs. This disables usbnet * blacklisting functionality. Which, if required, can be
@@ -1415,12 +1407,8 @@ static int qmi_wwan_probe(struct usb_interface *intf,* different. Ignore the current interface if the number of endpoints * equals the number for the diag interface (two). */ - info = (void *)id->driver_info; - -if (info->data &QMI_WWAN_QUIRK_QUECTEL_DYNCFG ) { -if (desc->bNumEndpoints ==2 ) -return -ENODEV ; - } +if (desc->bNumEndpoints ==2 ) +return -ENODEV ;return usbnet_probe (intf, id); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/126 net: ena: fix potential crash when rxfh key is NULL
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit 91a65b7d3ed8450f31ab717a65dcb5f9ceb5ab02 ]
When ethtool -X is called without an hkey, ena_com_fill_hash_function() is called with key=NULL, which is passed to memcpy causing a crash.
This commit fixes this issue by checking key is not NULL.
--- drivers/net/ethernet/amazon/ena/ena_com.c | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-)
drivers/net/ethernet/amazon/ena/ena_com.c +9 -8
@@ -2069,15 +2069,16 @@ int ena_com_fill_hash_function(struct ena_com_dev *ena_dev,switch (func) {case ENA_ADMIN_TOEPLITZ : -if (key_len >sizeof (hash_key->key)) { -pr_err ("key len (%hu) is bigger than the max supported (%zu)\n" , - key_len,sizeof (hash_key->key)); -return -EINVAL ; +if (key) { +if (key_len !=sizeof (hash_key->key)) { +pr_err ("key len (%hu) doesn't equal the supported size (%zu)\n" , + key_len,sizeof (hash_key->key)); +return -EINVAL ; + } +memcpy (hash_key->key, key, key_len); + rss->hash_init_val = init_val; + hash_key->keys_num = key_len >>2 ; } - -memcpy (hash_key->key, key, key_len); - rss->hash_init_val = init_val; - hash_key->keys_num = key_len >>2 ;break ;case ENA_ADMIN_CRC32 : rss->hash_init_val = init_val;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/126 net: ena: fix uses of round_jiffies()
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit 2a6e5fa2f4c25b66c763428a3e65363214946931 ]
Quoted 1 line
From the documentation of
round_jiffies():
"Rounds a time delta in the future (in jiffies) up or down to (approximately) full seconds. This is useful for timers for which the exact time they fire does not matter too much, as long as they fire approximately every X seconds.
By rounding these timers to whole seconds, all such timers will fire at the same time, rather than at various times spread out. The goal of this is to have the CPU wake up less, which saves power."
There are 2 parts to this patch:
================================
Part 1:
-------
In our case we need timer_service to be called approximately every X=1 seconds, and the exact time does not matter, so using round_jiffies() is the right way to go.
Therefore we add round_jiffies() to the mod_timer() in ena_timer_service().
Part 2:
-------round_jiffies() is used in check_for_missing_keep_alive() when getting the jiffies of the expiration of the keep_alive timeout. Here it is actually a mistake to use round_jiffies() because we want the exact time when keep_alive should expire and not an approximate rounded time, which can cause early, false positive, timeouts.
Therefore we remove round_jiffies() in the calculation of keep_alive_expired() in check_for_missing_keep_alive().
--- drivers/net/ethernet/amazon/ena/ena_netdev.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/ethernet/amazon/ena/ena_netdev.c +3 -3
@@ -2803,8 +2803,8 @@ static void check_for_missing_keep_alive(struct ena_adapter *adapter)if (adapter->keep_alive_timeout ==ENA_HW_HINTS_NO_TIMEOUT )return ; - keep_alive_expired =round_jiffies (adapter->last_keep_alive_jiffies + - adapter->keep_alive_timeout); + keep_alive_expired = adapter->last_keep_alive_jiffies + + adapter->keep_alive_timeout;if (unlikely (time_is_before_jiffies (keep_alive_expired))) {netif_err (adapter, drv, adapter->netdev,"Keep alive watchdog timeout.\n" );
@@ -2906,7 +2906,7 @@ static void ena_timer_service(unsigned long data) }/* Reset the timer */ -mod_timer (&adapter->timer_service, jiffies +HZ ); +mod_timer (&adapter->timer_service,round_jiffies (jiffies +HZ )); } static int ena_calc_io_queue_num(struct pci_dev *pdev,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/126 net: ena: add missing ethtool TX timestamping indication
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit cf6d17fde93bdda23c9b02dd5906a12bf8c55209 ]
Current implementation of the driver calls skb_tx_timestamp()to add a software tx timestamp to the skb, however the software-transmit capability is not reported in ethtool -T.
This commit updates the ethtool structure to report the software-transmit capability in ethtool -T using the standard ethtool_op_get_ts_info(). This function reports all software timestamping capabilities (tx and rx), as well as setting phc_index = -1. phc_index is the index of the PTP hardware clock device that will be used for hardware timestamps. Since we don't have such a device in ENA, using the default -1 value is the correct setting.
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +1 -0
@@ -816,6 +816,7 @@ static const struct ethtool_ops ena_ethtool_ops = { .get_channels = ena_get_channels, .get_tunable = ena_get_tunable, .set_tunable = ena_set_tunable, + .get_ts_info = ethtool_op_get_ts_info, };void ena_set_ethtool_ops (struct net_device *netdev)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/126 net: ena: fix incorrect default RSS key
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit 0d1c3de7b8c78a5e44b74b62ede4a63629f5d811 ]
Bug description:
When running "ethtool -x <if_name>" the key shows up as all zeros.
When we use "ethtool -X <if_name> hfunc toeplitz hkey <some:random:key>" to set the key and then try to retrieve it using "ethtool -x <if_name>" then we return the correct key because we return the one we saved.
Bug cause:
We don't fetch the key from the device but instead return the key that we have saved internally which is by default set to zero upon allocation.
Fix:
This commit fixes the issue by initializing the key to a random value using netdev_rss_key_fill().
--- drivers/net/ethernet/amazon/ena/ena_com.c | 15 +++++++++++++++ drivers/net/ethernet/amazon/ena/ena_com.h | 1 + 2 files changed, 16 insertions(+)
drivers/net/ethernet/amazon/ena/ena_com.c +15 -0
@@ -843,6 +843,19 @@ static int ena_com_get_feature(struct ena_com_dev *ena_dev, 0); } +static void ena_com_hash_key_fill_default_key (struct ena_com_dev *ena_dev) +{ +struct ena_admin_feature_rss_flow_hash_control *hash_key = + (ena_dev->rss).hash_key; + +netdev_rss_key_fill (&hash_key->key,sizeof (hash_key->key)); +/* The key is stored in the device in u32 array +* as well as the API requires the key to be passed in this +* format. Thus the size of our array should be divided by 4 +*/ + hash_key->keys_num =sizeof (hash_key->key) /sizeof (u32); +} +static int ena_com_hash_key_allocate (struct ena_com_dev *ena_dev) {struct ena_rss *rss = &ena_dev->rss;
@@ -2403,6 +2416,8 @@ int ena_com_rss_init(struct ena_com_dev *ena_dev, u16 indr_tbl_log_size)if (unlikely (rc)) goto err_hash_key; +ena_com_hash_key_fill_default_key (ena_dev); + rc =ena_com_hash_ctrl_init (ena_dev);if (unlikely (rc)) goto err_hash_ctrl;
drivers/net/ethernet/amazon/ena/ena_com.h +1 -0
@@ -42,6 +42,7 @@#include <linux/spinlock.h> #include <linux/types.h> #include <linux/wait.h> +#include <linux/netdevice.h> #include "ena_common_defs.h" #include "ena_admin_defs.h"
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/126 net: ena: rss: fix failure to get indirection table
In reply to Greg Kroah-HartmanFrom: Sameeh Jubran <[email protected]>
[ Upstream commit 0c8923c0a64fb5d14bebb9a9065d2dc25ac5e600 ]
On old hardware, getting / setting the hash function is not supported while gettting / setting the indirection table is.
This commit enables us to still show the indirection table on older hardwares by setting the hash function and key to NULL.
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +14 -0
@@ -660,7 +660,21 @@ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,if (rc)return rc; +/* We call this function in order to check if the device +* supports getting/setting the hash function. +*/ rc =ena_com_get_hash_function (adapter->ena_dev, &ena_func, key); + +if (rc) { +if (rc == -EOPNOTSUPP ) { + key =NULL ; + hfunc =NULL ; + rc =0 ; + } + +return rc; + } +if (rc)return rc;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/126 net: ena: rss: store hash function as values and not bits
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit 4844470d472d660c26149ad764da2406adb13423 ]
The device receives, stores and retrieves the hash function value as bits and not as their enum value.
The bug:
* In ena_com_set_hash_function() we set cmd.u.flow_hash_func.selected_func to the bit value of rss->hash_func. (1 << rss->hash_func)
* In ena_com_get_hash_function() we retrieve the hash function and store it's bit value in rss->hash_func. (Now the bit value of rss->hash_func is stored in rss->hash_func instead of it's enum value)
The fix:
This commit fixes the issue by converting the retrieved hash function values from the device to the matching enum value of the set bit using ffs(). ffs() finds the first set bit's index in a word. Since the function returns 1 for the LSB's index, we need to subtract 1 from the returned value (note that BIT(0) is 1).
--- drivers/net/ethernet/amazon/ena/ena_com.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_com.c +5 -1
@@ -2128,7 +2128,11 @@ int ena_com_get_hash_function(struct ena_com_dev *ena_dev,if (unlikely (rc))return rc; - rss->hash_func = get_resp.u.flow_hash_func.selected_func; +/* ffs() returns 1 in case the lsb is set */ + rss->hash_func =ffs (get_resp.u.flow_hash_func.selected_func); +if (rss->hash_func) + rss->hash_func--; +if (func) *func = rss->hash_func;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 19/126 net: ena: fix incorrectly saving queue numbers when setting RSS indirection table
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit 92569fd27f5cb0ccbdf7c7d70044b690e89a0277 ]
The indirection table has the indices of the Rx queues. When we store it during set indirection operation, we convert the indices to our internal representation of the indices.
Our internal representation of the indices is: even indices for Tx and uneven indices for Rx, where every Tx/Rx pair are in a consecutive order starting from 0. For example if the driver has 3 queues (3 for Tx and 3 for Rx) then the indices are as follows:
0 1 2 3 4 5
Tx Rx Tx Rx Tx Rx
The BUG:
The issue is that when we satisfy a get request for the indirection table, we don't convert the indices back to the original representation.
The FIX:
Simply apply the inverse function for the indices of the indirection table after we set it.
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 24 ++++++++++++++++++- drivers/net/ethernet/amazon/ena/ena_netdev.h | 2 ++ 2 files changed, 25 insertions(+), 1 deletion(-)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +23 -1
@@ -648,6 +648,28 @@ static u32 ena_get_rxfh_key_size(struct net_device *netdev)return ENA_HASH_KEY_SIZE ; } +static int ena_indirection_table_get (struct ena_adapter *adapter,u32 *indir) +{ +struct ena_com_dev *ena_dev = adapter->ena_dev; +int i, rc; + +if (!indir) +return 0 ; + + rc =ena_com_indirect_table_get (ena_dev, indir); +if (rc) +return rc; + +/* Our internal representation of the indices is: even indices +* for Tx and uneven indices for Rx. We need to convert the Rx +* indices to be consecutive +*/ +for (i =0 ; i <ENA_RX_RSS_TABLE_SIZE ; i++) + indir[i] =ENA_IO_RXQ_IDX_TO_COMBINED_IDX (indir[i]); + +return rc; +} +static int ena_get_rxfh (struct net_device *netdev,u32 *indir,u8 *key,u8 *hfunc) {
@@ -656,7 +678,7 @@ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key,u8 func;int rc; - rc =ena_com_indirect_table_get (adapter->ena_dev, indir); + rc =ena_indirection_table_get (adapter, indir);if (rc)return rc;
drivers/net/ethernet/amazon/ena/ena_netdev.h +2 -0
@@ -113,6 +113,8 @@#define ENA_IO_TXQ_IDX (q) (2 * (q))#define ENA_IO_RXQ_IDX (q) (2 * (q) + 1) +#define ENA_IO_TXQ_IDX_TO_COMBINED_IDX (q) ((q) / 2) +#define ENA_IO_RXQ_IDX_TO_COMBINED_IDX (q) (((q) - 1) / 2)#define ENA_MGMNT_IRQ_IDX 0#define ENA_IO_IRQ_FIRST_IDX 1
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 20/126 net: ena: ethtool: use correct value for crc32 hash
In reply to Greg Kroah-HartmanFrom: Sameeh Jubran <[email protected]>
[ Upstream commit 886d2089276e40d460731765083a741c5c762461 ]
Up till kernel 4.11 there was no enum defined for crc32 hash in ethtool, thus the xor enum was used for supporting crc32.
--- drivers/net/ethernet/amazon/ena/ena_ethtool.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +2 -2
@@ -705,7 +705,7 @@ static int ena_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key, func =ETH_RSS_HASH_TOP ;break ;case ENA_ADMIN_CRC32 : - func =ETH_RSS_HASH_XOR ; + func =ETH_RSS_HASH_CRC32 ;break ;default : netif_err(adapter, drv, netdev,
@@ -751,7 +751,7 @@ static int ena_set_rxfh(struct net_device *netdev, const u32 *indir,case ETH_RSS_HASH_TOP : func =ENA_ADMIN_TOEPLITZ ;break ; -case ETH_RSS_HASH_XOR : +case ETH_RSS_HASH_CRC32 : func =ENA_ADMIN_CRC32 ;break ;default :
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 21/126 net: ena: ena-com.c: prevent NULL pointer dereference
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
[ Upstream commit c207979f5ae10ed70aff1bb13f39f0736973de99 ]
comp_ctx can be NULL in a very rare case when an admin command is executed during the execution of ena_remove().
The bug scenario is as follows:
* ena_destroy_device() sets the comp_ctx to be NULL
* An admin command is executed before executing unregister_netdev(), this can still happen because our device can still receive callbacks from the netdev infrastructure such as ethtool commands.
* When attempting to access the comp_ctx, the bug occurs since it's set to NULL
Fix:
Added a check that comp_ctx is not NULL
--- drivers/net/ethernet/amazon/ena/ena_com.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/amazon/ena/ena_com.c +5 -0
@@ -199,6 +199,11 @@ static inline void comp_ctxt_release(struct ena_com_admin_queue *queue,static struct ena_comp_ctx *get_comp_ctxt (struct ena_com_admin_queue *queue,u16 command_id,bool capture) { +if (unlikely (!queue->comp_ctx)) { +pr_err ("Completion context is NULL\n" ); +return NULL ; + } +if (unlikely (command_id >= queue->q_depth)) {pr_err ("command id is larger than the queue size. cmd_id: %u queue size %d\n" , command_id, queue->q_depth);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 22/126 cifs: Fix mode output in debugging statements
In reply to Greg Kroah-HartmanFrom: Frank Sorenson <[email protected]>
[ Upstream commit f52aa79df43c4509146140de0241bc21a4a3b4c7 ]
A number of the debug statements output file or directory mode in hex. Change these to print using octal.
--- fs/cifs/cifsacl.c | 4 ++-- fs/cifs/connect.c | 2 +- fs/cifs/inode.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)
fs/cifs/cifsacl.c +2 -2
@@ -603,7 +603,7 @@ static void access_flags_to_mode(__le32 ace_flags, int type, umode_t *pmode, ((flags & FILE_EXEC_RIGHTS) == FILE_EXEC_RIGHTS)) *pmode |= (S_IXUGO & (*pbits_to_set)); -cifs_dbg (NOISY ,"access flags 0x%x mode now 0x%x\n" , flags, *pmode); +cifs_dbg (NOISY ,"access flags 0x%x mode now %04o\n" , flags, *pmode);return ; }
@@ -632,7 +632,7 @@ static void mode_to_access_flags(umode_t mode, umode_t bits_to_use,if (mode &S_IXUGO ) *pace_flags |=SET_FILE_EXEC_RIGHTS ; -cifs_dbg (NOISY ,"mode: 0x%x, access flags now 0x%x\n" , +cifs_dbg (NOISY ,"mode: %04o, access flags now 0x%x\n" , mode, *pace_flags);return ; }
fs/cifs/connect.c +1 -1
@@ -3521,7 +3521,7 @@ int cifs_setup_cifs_sb(struct smb_vol *pvolume_info, cifs_sb->mnt_gid = pvolume_info->linux_gid; cifs_sb->mnt_file_mode = pvolume_info->file_mode; cifs_sb->mnt_dir_mode = pvolume_info->dir_mode; -cifs_dbg (FYI ,"file mode: 0x%hx dir mode: 0x%hx\n" , +cifs_dbg (FYI ,"file mode: %04ho dir mode: %04ho\n" , cifs_sb->mnt_file_mode, cifs_sb->mnt_dir_mode); cifs_sb->actimeo = pvolume_info->actimeo;
fs/cifs/inode.c +1 -1
@@ -1581,7 +1581,7 @@ int cifs_mkdir(struct inode *inode, struct dentry *direntry, umode_t mode)struct TCP_Server_Info *server;char *full_path; -cifs_dbg (FYI ,"In cifs_mkdir, mode = 0x%hx inode = 0x%p\n" , +cifs_dbg (FYI ,"In cifs_mkdir, mode = %04ho inode = 0x%p\n" , mode, inode); cifs_sb =CIFS_SB (inode->i_sb);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 23/126 cfg80211: add missing policy for NL80211_ATTR_STATUS_CODE
In reply to Greg Kroah-HartmanFrom: Sergey Matyukevich <[email protected]>
[ Upstream commit ea75080110a4c1fa011b0a73cb8f42227143ee3e ]
The nl80211_policy is missing for NL80211_ATTR_STATUS_CODE attribute. As a result, for strictly validated commands, it's assumed to not be supported.
--- net/wireless/nl80211.c | 1 + 1 file changed, 1 insertion(+)
net/wireless/nl80211.c +1 -0
@@ -321,6 +321,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 }, [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG }, [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG }, + [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 }, [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 }, [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, [NL80211_ATTR_PID] = { .type = NLA_U32 },
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 24/126 sysrq: Restore original console_loglevel when sysrq disabled
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
commit 075e1a0c50f59ea210561d0d0fedbd945615df78 upstream.
The sysrq header line is printed with an increased loglevel to provide users some positive feedback.
The original loglevel is not restored when the sysrq operation is disabled. This bug was introduced in 2.6.12 (pre-git-history) by the commit ("Allow admin to enable only some of the Magic-Sysrq functions").
--- drivers/tty/sysrq.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/sysrq.c +1 -0
@@ -560,6 +560,7 @@ void __handle_sysrq(int key, bool check_ op_p->handler (key); }else {pr_cont ("This sysrq operation is disabled.\n" ); + console_loglevel = orig_log_level; } }else {pr_cont ("HELP : " );
Greg Kroah-Hartman
maintainerPATCH 25/126 sysrq: Remove duplicated sysrq message
In reply to Greg Kroah-HartmanFrom: Petr Mladek <[email protected]>
commit c3fee60908db4a8594f2e4a2131998384b8fa006 upstream.
The commit 97f5f0cd8cd0a0544 ("Input: implement SysRq as a separate input handler") added pr_fmt() definition. It caused a duplicated message prefix in the sysrq header messages, for example:
[ 177.053931] sysrq: SysRq : Show backtrace of all active CPUs [ 742.864776] sysrq: SysRq : HELP : loglevel(0-9) reboot(b) crash(c)
--- drivers/tty/sysrq.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/tty/sysrq.c +3 -4
@@ -546,7 +546,6 @@ void __handle_sysrq(int key, bool check_*/ orig_log_level = console_loglevel; console_loglevel =CONSOLE_LOGLEVEL_DEFAULT ; -pr_info ("SysRq : " ); op_p =__sysrq_get_key_op (key);if (op_p) {
@@ -555,15 +554,15 @@ void __handle_sysrq(int key, bool check_* should not) and is the invoked operation enabled? */ if (!check_mask ||sysrq_on_mask (op_p->enable_mask)) { -pr_cont ("%s\n" , op_p->action_msg); +pr_info ("%s\n" , op_p->action_msg); console_loglevel = orig_log_level; op_p->handler (key); }else { -pr_cont ("This sysrq operation is disabled.\n" ); +pr_info ("This sysrq operation is disabled.\n" ); console_loglevel = orig_log_level; } }else { -pr_cont ("HELP : " ); +pr_info ("HELP : " );/* Only print the help msg once per handler */ for (i =0 ; i <ARRAY_SIZE (sysrq_key_table); i++) {if (sysrq_key_table[i]) {
Greg Kroah-Hartman
maintainerPATCH 26/126 net: fib_rules: Correctly set table field when table number exceeds 8 bits
In reply to Greg Kroah-HartmanFrom: Jethro Beekman <[email protected]>
[ Upstream commit 540e585a79e9d643ede077b73bcc7aa2d7b4d919 ]
In 709772e6e06564ed94ba740de70185ac3d792773, RT_TABLE_COMPAT was added to allow legacy software to deal with routing table numbers >= 256, but the same change to FIB rule queries was overlooked.
--- net/core/fib_rules.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/fib_rules.c +1 -1
@@ -799,7 +799,7 @@ static int fib_nl_fill_rule(struct sk_bu frh =nlmsg_data (nlh); frh->family = ops->family; - frh->table = rule->table; + frh->table = rule->table <256 ? rule->table :RT_TABLE_COMPAT ;if (nla_put_u32 (skb,FRA_TABLE , rule->table)) goto nla_put_failure;if (nla_put_u32 (skb,FRA_SUPPRESS_PREFIXLEN , rule->suppress_prefixlen))
Greg Kroah-Hartman
maintainerPATCH 27/126 net: phy: restore mdio regs in the iproc mdio driver
In reply to Greg Kroah-HartmanFrom: Arun Parameswaran <[email protected]>
commit 6f08e98d62799e53c89dbf2c9a49d77e20ca648c upstream.
The mii management register in iproc mdio block
does not have a retention register so it is lost on suspend. Save and restore value of register while resuming from suspend.
--- drivers/net/phy/mdio-bcm-iproc.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
drivers/net/phy/mdio-bcm-iproc.c +20 -0
@@ -188,6 +188,23 @@ static int iproc_mdio_remove(struct platreturn 0 ; } +#ifdef CONFIG_PM_SLEEP +int iproc_mdio_resume (struct device *dev) +{ +struct platform_device *pdev =to_platform_device (dev); +struct iproc_mdio_priv *priv =platform_get_drvdata (pdev); + +/* restore the mii clock configuration */ +iproc_mdio_config_clk (priv->base); + +return 0 ; +} + +static const struct dev_pm_ops iproc_mdio_pm_ops = { + .resume = iproc_mdio_resume +}; +#endif /* CONFIG_PM_SLEEP */ +static const struct of_device_id iproc_mdio_of_match[] = { { .compatible ="brcm,iproc-mdio" , }, {/* sentinel */ },
@@ -198,6 +215,9 @@ static struct platform_driver iproc_mdio .driver = { .name = "iproc-mdio", .of_match_table = iproc_mdio_of_match, +#ifdef CONFIG_PM_SLEEP + .pm = &iproc_mdio_pm_ops, +#endif }, .probe = iproc_mdio_probe, .remove = iproc_mdio_remove,
Greg Kroah-Hartman
maintainerPATCH 28/126 nfc: pn544: Fix occasional HW initialization failure
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
[ Upstream commit c3331d2fe3fd4d5e321f2467d01f72de7edfb5d0 ]
The PN544 driver checks the "enable" polarity during of driver's probe and it's doing that by turning ON and OFF NFC with different polarities until enabling succeeds. It takes some time for the hardware to power-down, and thus, to deassert the IRQ that is raised by turning ON the hardware. Since the delay after last power-down of the polarity-checking process is missed in the code, the interrupt may trigger immediately after installing the IRQ handler (right after the checking is done), which results in IRQ handler trying to touch the disabled HW and ends with marking NFC as 'DEAD' during of the driver's probe:
pn544_hci_i2c 1-002a: NFC: nfc_en polarity : active high pn544_hci_i2c 1-002a: NFC: invalid len byte
shdlc: llc_shdlc_recv_frame: NULL Frame -> link is dead
This patch fixes the occasional NFC initialization failure on Nexus 7 device.
--- drivers/nfc/pn544/i2c.c | 1 + 1 file changed, 1 insertion(+)
drivers/nfc/pn544/i2c.c +1 -0
@@ -236,6 +236,7 @@ static void pn544_hci_i2c_platform_init( out:gpiod_set_value_cansleep (phy->gpiod_en, !phy->en_polarity); +usleep_range (10000 ,15000 ); }static void pn544_hci_i2c_enable_mode (struct pn544_i2c_phy *phy,int run_mode)
Greg Kroah-Hartman
maintainerPATCH 29/126 sctp: move the format error check out of __sctp_sf_do_9_1_abort
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 245709ec8be89af46ea7ef0444c9c80913999d99 ]
When T2 timer is to be stopped, the asoc should also be deleted, otherwise, there will be no chance to call sctp_association_free and the asoc could last in memory forever.
However, in sctp_sf_shutdown_sent_abort(), after adding the cmd SCTP_CMD_TIMER_STOP for T2 timer, it may return error due to the format error from __sctp_sf_do_9_1_abort() and miss adding SCTP_CMD_ASSOC_FAILED where the asoc will be deleted.
This patch is to fix it by moving the format error check out of __sctp_sf_do_9_1_abort(), and do it before adding the cmd SCTP_CMD_TIMER_STOP for T2 timer.
Thanks Hangbin for reporting this issue by the fuzz testing.
v1->v2:
- improve the comment in the code as Marcelo's suggestion.
--- net/sctp/sm_statefuns.c | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-)
net/sctp/sm_statefuns.c +20 -9
@@ -182,6 +182,16 @@ static inline bool sctp_chunk_length_valreturn true; } +/* Check for format error in an ABORT chunk */ +static inline bool sctp_err_chunk_valid (struct sctp_chunk *chunk) +{ +struct sctp_errhdr *err; + +sctp_walk_errors (err, chunk->chunk_hdr); + +return (void *)err == (void *)chunk->chunk_end; +} +/********************************************************** * These are the state functions for handling chunk events. **********************************************************/
@@ -2202,6 +2212,9 @@ enum sctp_disposition sctp_sf_shutdown_p sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))return sctp_sf_discard_chunk (net, ep, asoc, type, arg, commands); +if (!sctp_err_chunk_valid (chunk)) +return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); +return __sctp_sf_do_9_1_abort (net, ep, asoc, type, arg, commands); }
@@ -2245,6 +2258,9 @@ enum sctp_disposition sctp_sf_shutdown_s sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))return sctp_sf_discard_chunk (net, ep, asoc, type, arg, commands); +if (!sctp_err_chunk_valid (chunk)) +return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); +/* Stop the T2-shutdown timer. */ sctp_add_cmd_sf (commands,SCTP_CMD_TIMER_STOP ,SCTP_TO (SCTP_EVENT_TIMEOUT_T2_SHUTDOWN ));
@@ -2512,6 +2528,9 @@ enum sctp_disposition sctp_sf_do_9_1_abo sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))return sctp_sf_discard_chunk (net, ep, asoc, type, arg, commands); +if (!sctp_err_chunk_valid (chunk)) +return sctp_sf_pdiscard (net, ep, asoc, type, arg, commands); +return __sctp_sf_do_9_1_abort (net, ep, asoc, type, arg, commands); }
@@ -2529,16 +2548,8 @@ static enum sctp_disposition __sctp_sf_d/* See if we have an error cause code in the chunk. */ len =ntohs (chunk->chunk_hdr->length); -if (len >=sizeof (struct sctp_chunkhdr ) +sizeof (struct sctp_errhdr )) { -struct sctp_errhdr *err; - -sctp_walk_errors (err, chunk->chunk_hdr); -if ((void *)err != (void *)chunk->chunk_end) -return sctp_sf_pdiscard (net, ep, asoc, type, arg, - commands); - +if (len >=sizeof (struct sctp_chunkhdr ) +sizeof (struct sctp_errhdr )) error = ((struct sctp_errhdr *)chunk->skb->data)->cause; - }sctp_add_cmd_sf (commands,SCTP_CMD_SET_SK_ERR ,SCTP_ERROR (ECONNRESET ));/* ASSOC_FAILED will DELETE_TCB. */
Greg Kroah-Hartman
maintainerPATCH 30/126 ipv6: Fix nlmsg_flags when splitting a multipath route
In reply to Greg Kroah-HartmanFrom: Benjamin Poirier <[email protected]>
[ Upstream commit afecdb376bd81d7e16578f0cfe82a1aec7ae18f3 ]
When splitting an RTA_MULTIPATH request into multiple routes and adding the second and later components, we must not simply remove NLM_F_REPLACE but instead replace it by NLM_F_CREATE. Otherwise, it may look like the netlink message was malformed.
For example,
ip route add 2001:db8::1/128 dev dummy0 ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 \ nexthop via fe80::30:2 dev dummy0 results in the following warnings: [ 1035.057019] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1035.057517] IPv6: NLM_F_CREATE should be set when creating new route
This patch makes the nlmsg sequence look equivalent for __ip6_ins_rt() to what it would get if the multipath route had been added in multiple netlink operations:
ip route add 2001:db8::1/128 dev dummy0 ip route change 2001:db8::1/128 nexthop via fe80::30:1 dev dummy0 ip route append 2001:db8::1/128 nexthop via fe80::30:2 dev dummy0
--- net/ipv6/route.c | 1 + 1 file changed, 1 insertion(+)
net/ipv6/route.c +1 -0
@@ -3283,6 +3283,7 @@ static int ip6_route_multipath_add(struc*/ cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |NLM_F_REPLACE ); + cfg->fc_nlinfo.nlh->nlmsg_flags |=NLM_F_CREATE ; nhn++; }
Greg Kroah-Hartman
maintainerPATCH 31/126 ipv6: Fix route replacement with dev-only route
In reply to Greg Kroah-HartmanFrom: Benjamin Poirier <[email protected]>
[ Upstream commit e404b8c7cfb31654c9024d497cec58a501501692 ]
After commit 27596472473a ("ipv6: fix ECMP route replacement") it is no longer possible to replace an ECMP-able route by a non ECMP-able route. For example,
ip route add 2001:db8::1/128 via fe80::1 dev dummy0 ip route replace 2001:db8::1/128 dev dummy0
does not work as expected.
Tweak the replacement logic so that point 3 in the log of the above commit becomes:
3. If the new route is not ECMP-able, and no matching non-ECMP-able route exists, replace matching ECMP-able route (if any) or add the new route.
We can now summarize the entire replace semantics to:
When doing a replace, prefer replacing a matching route of the same "ECMP-able-ness" as the replace argument. If there is no such candidate, fallback to the first route found.
--- net/ipv6/ip6_fib.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv6/ip6_fib.c +4 -3
@@ -893,8 +893,7 @@ static int fib6_add_rt2node(struct fib6_ found++;break ; } -if (rt_can_ecmp) - fallback_ins = fallback_ins ?: ins; + fallback_ins = fallback_ins ?: ins; goto next_iter; }
@@ -934,7 +933,9 @@ next_iter: }if (fallback_ins && !found) { -/* No ECMP-able route found, replace first non-ECMP one */ +/* No matching route with same ecmp-able-ness found, replace +* first matching route +*/ ins = fallback_ins; iter = *ins; found++;
Greg Kroah-Hartman
maintainerPATCH 32/126 qede: Fix race between rdma destroy workqueue and link change event
In reply to Greg Kroah-HartmanFrom: Michal Kalderon <[email protected]>
[ Upstream commit af6565adb02d3129d3fae4d9d5da945abaf4417a ]
If an event is added while the rdma workqueue is being destroyed it could lead to several races, list corruption, null pointer dereference during queue_work or init_queue.
This fixes the race between the two flows which can occur during shutdown.
A kref object and a completion object are added to the rdma_dev structure, these are initialized before the workqueue is created. The refcnt is used to indicate work is being added to the workqueue and ensures the cleanup flow won't start while we're in the middle of adding the event.
Once the work is added, the refcnt is decreased and the cleanup flow is safe to run.
--- drivers/net/ethernet/qlogic/qede/qede.h | 2 + drivers/net/ethernet/qlogic/qede/qede_rdma.c | 29 ++++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qede/qede.h +2 -0
@@ -156,6 +156,8 @@ struct qede_rdma_dev {struct list_head entry;struct list_head rdma_event_list;struct workqueue_struct *rdma_wq; +struct kref refcnt; +struct completion event_comp; };struct qede_ptp ;
drivers/net/ethernet/qlogic/qede/qede_rdma.c +28 -1
@@ -57,6 +57,9 @@ static void _qede_rdma_dev_add(struct qestatic int qede_rdma_create_wq (struct qede_dev *edev) {INIT_LIST_HEAD (&edev->rdma_info.rdma_event_list); +kref_init (&edev->rdma_info.refcnt); +init_completion (&edev->rdma_info.event_comp); + edev->rdma_info.rdma_wq =create_singlethread_workqueue ("rdma_wq" );if (!edev->rdma_info.rdma_wq) {DP_NOTICE (edev,"qedr: Could not create workqueue\n" );
@@ -81,8 +84,23 @@ static void qede_rdma_cleanup_event(stru } } +static void qede_rdma_complete_event (struct kref *ref) +{ +struct qede_rdma_dev *rdma_dev = + container_of(ref, struct qede_rdma_dev, refcnt); + +/* no more events will be added after this */ +complete (&rdma_dev->event_comp); +} +static void qede_rdma_destroy_wq (struct qede_dev *edev) { +/* Avoid race with add_event flow, make sure it finishes before +* we start accessing the list and cleaning up the work +*/ +kref_put (&edev->rdma_info.refcnt, qede_rdma_complete_event); +wait_for_completion (&edev->rdma_info.event_comp); +qede_rdma_cleanup_event (edev);destroy_workqueue (edev->rdma_info.rdma_wq); }
@@ -287,15 +305,24 @@ static void qede_rdma_add_event(struct qif (!edev->rdma_info.qedr_dev)return ; +/* We don't want the cleanup flow to start while we're allocating and +* scheduling the work +*/ +if (!kref_get_unless_zero (&edev->rdma_info.refcnt)) +return ;/* already being destroyed */ + event_node =qede_rdma_get_free_event_node (edev);if (!event_node) -return ; + goto out; event_node->event = event; event_node->ptr = edev;INIT_WORK (&event_node->work, qede_rdma_handle_event);queue_work (edev->rdma_info.rdma_wq, &event_node->work); + +out: +kref_put (&edev->rdma_info.refcnt, qede_rdma_complete_event); }void qede_rdma_dev_event_open (struct qede_dev *edev)
Greg Kroah-Hartman
maintainerPATCH 33/126 net: sched: correct flower port blocking
In reply to Greg Kroah-HartmanFrom: Jason Baron <[email protected]>
[ Upstream commit 8a9093c79863b58cc2f9874d7ae788f0d622a596 ]
tc flower rules that are based on src or dst port blocking are sometimes ineffective due to uninitialized stack data. __skb_flow_dissect() extracts ports from the skb for tc flower to match against. However, the port dissection is not done when when the FLOW_DIS_IS_FRAGMENT bit is set in key_control->flags. All callers of __skb_flow_dissect(), zero-out the key_control field except for fl_classify() as used by the flower classifier. Thus, the FLOW_DIS_IS_FRAGMENT may be set on entry to __skb_flow_dissect(), since key_control is allocated on the stack and may not be initialized.
Since key_basic and key_control are present for all flow keys, let's make sure they are initialized.
--- include/net/flow_dissector.h | 9 +++++++++ net/sched/cls_flower.c | 1 + 2 files changed, 10 insertions(+)
include/net/flow_dissector.h +9 -0
@@ -5,6 +5,7 @@#include <linux/types.h> #include <linux/in6.h> #include <linux/siphash.h> +#include <linux/string.h> #include <uapi/linux/if_ether.h> /**
@@ -282,4 +283,12 @@ static inline void *skb_flow_dissector_t return ((char *)target_container) + flow_dissector->offset[key_id]; } +static inline void +flow_dissector_init_keys (struct flow_dissector_key_control *key_control, +struct flow_dissector_key_basic *key_basic) +{ +memset (key_control,0 ,sizeof (*key_control)); +memset (key_basic,0 ,sizeof (*key_basic)); +} +#endif
net/sched/cls_flower.c +1 -0
@@ -160,6 +160,7 @@ static int fl_classify(struct sk_buff *sif (!atomic_read (&head->ht.nelems))return -1 ; +flow_dissector_init_keys (&skb_key.control, &skb_key.basic);fl_clear_masked_range (&skb_key, &head->mask); info =skb_tunnel_info (skb);
Greg Kroah-Hartman
maintainerPATCH 34/126 ext4: potential crash on allocation error in ext4_alloc_flex_bg_array()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 37b0b6b8b99c0e1c1f11abbe7cf49b6d03795b3f upstream.
If sbi->s_flex_groups_allocated is zero and the first allocation fails then this code will crash. The problem is that "i--" will set "i" to -1 but when we compare "i >= sbi->s_flex_groups_allocated" then the -1 is type promoted to unsigned and becomes UINT_MAX. Since UINT_MAX is more than zero, the condition is true so we call kvfree(new_groups[-1]). The loop will carry on freeing invalid memory until it crashes.
--- fs/ext4/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext4/super.c +3 -3
@@ -2238,7 +2238,7 @@ int ext4_alloc_flex_bg_array(struct supe {struct ext4_sb_info *sbi =EXT4_SB (sb);struct flex_groups **old_groups, **new_groups; -int size, i; +int size, i, j;if (!sbi->s_log_groups_per_flex)return 0 ;
@@ -2259,8 +2259,8 @@ int ext4_alloc_flex_bg_array(struct supe sizeof(struct flex_groups)), GFP_KERNEL);if (!new_groups[i]) { -for (i--; i >= sbi->s_flex_groups_allocated; i--) -kvfree (new_groups[i]); +for (j = sbi->s_flex_groups_allocated; j < i; j++) +kvfree (new_groups[j]);kvfree (new_groups);ext4_msg (sb,KERN_ERR ,"not enough memory for %d flex groups" , size);
Greg Kroah-Hartman
maintainerPATCH 35/126 audit: fix error handling in audit_data_to_entry()
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
commit 2ad3e17ebf94b7b7f3f64c050ff168f9915345eb upstream.
Commit 219ca39427bf ("audit: use union for audit_field values since they are mutually exclusive") combined a number of separate fields in the audit_field struct into a single union. Generally this worked just fine because they are generally mutually exclusive. Unfortunately in audit_data_to_entry() the overlap can be a problem when a specific error case is triggered that causes the error path code to attempt to cleanup an audit_field struct and the cleanup involves attempting to free a stored LSM string (the lsm_str field). Currently the code always has a non-NULL value in the audit_field.lsm_str field as the top of the for-loop transfers a value into audit_field.val (both .lsm_str and .val are part of the same union); if audit_data_to_entry() fails and the audit_field struct is specified to contain a LSM string, but the audit_field.lsm_str has not yet been properly set, the error handling code will attempt to free the bogus audit_field.lsm_str value that was set with audit_field.val at the top of the for-loop.
This patch corrects this by ensuring that the audit_field.val is only set when needed (it is cleared when the audit_field struct is allocated with kcalloc()). It also corrects a few other issues to ensure that in case of error the proper error code is returned.
--- kernel/auditfilter.c | 71 ++++++++++++++++++++++++++++----------------------- 1 file changed, 39 insertions(+), 32 deletions(-)
kernel/auditfilter.c +39 -32
@@ -435,6 +435,7 @@ static struct audit_entry *audit_data_to bufp = data->buf;for (i =0 ; i < data->field_count; i++) {struct audit_field *f = &entry->rule.fields[i]; +u32 f_val; err = -EINVAL ;
@@ -443,12 +444,12 @@ static struct audit_entry *audit_data_to goto exit_free; f->type = data->fields[i]; - f->val = data->values[i]; + f_val = data->values[i];/* Support legacy tests for a valid loginuid */ -if ((f->type ==AUDIT_LOGINUID ) && (f->val ==AUDIT_UID_UNSET )) { +if ((f->type ==AUDIT_LOGINUID ) && (f_val ==AUDIT_UID_UNSET )) { f->type =AUDIT_LOGINUID_SET ; - f->val =0 ; + f_val =0 ; entry->rule.pflags |=AUDIT_LOGINUID_LEGACY ; }
@@ -464,7 +465,7 @@ static struct audit_entry *audit_data_tocase AUDIT_SUID :case AUDIT_FSUID :case AUDIT_OBJ_UID : - f->uid =make_kuid (current_user_ns (), f->val); + f->uid =make_kuid (current_user_ns (), f_val);if (!uid_valid (f->uid)) goto exit_free;break ;
@@ -473,12 +474,13 @@ static struct audit_entry *audit_data_tocase AUDIT_SGID :case AUDIT_FSGID :case AUDIT_OBJ_GID : - f->gid =make_kgid (current_user_ns (), f->val); + f->gid =make_kgid (current_user_ns (), f_val);if (!gid_valid (f->gid)) goto exit_free;break ;case AUDIT_SESSIONID :case AUDIT_ARCH : + f->val = f_val; entry->rule.arch_f = f;break ;case AUDIT_SUBJ_USER :
@@ -491,11 +493,13 @@ static struct audit_entry *audit_data_tocase AUDIT_OBJ_TYPE :case AUDIT_OBJ_LEV_LOW :case AUDIT_OBJ_LEV_HIGH : - str =audit_unpack_string (&bufp, &remain, f->val); -if (IS_ERR (str)) + str =audit_unpack_string (&bufp, &remain, f_val); +if (IS_ERR (str)) { + err =PTR_ERR (str); goto exit_free; - entry->rule.buflen += f->val; - + } + entry->rule.buflen += f_val; + f->lsm_str = str; err =security_audit_rule_init (f->type, f->op, str, (void **)&f->lsm_rule);/* Keep currently invalid fields around in case they
@@ -504,68 +508,71 @@ static struct audit_entry *audit_data_topr_warn ("audit rule for LSM \'%s\' is invalid\n" , str); err =0 ; - } -if (err) { -kfree (str); + }else if (err) goto exit_free; - }else - f->lsm_str = str;break ;case AUDIT_WATCH : - str =audit_unpack_string (&bufp, &remain, f->val); -if (IS_ERR (str)) + str =audit_unpack_string (&bufp, &remain, f_val); +if (IS_ERR (str)) { + err =PTR_ERR (str); goto exit_free; - entry->rule.buflen += f->val; - - err =audit_to_watch (&entry->rule, str, f->val, f->op); + } + err =audit_to_watch (&entry->rule, str, f_val, f->op);if (err) {kfree (str); goto exit_free; } + entry->rule.buflen += f_val;break ;case AUDIT_DIR : - str =audit_unpack_string (&bufp, &remain, f->val); -if (IS_ERR (str)) + str =audit_unpack_string (&bufp, &remain, f_val); +if (IS_ERR (str)) { + err =PTR_ERR (str); goto exit_free; - entry->rule.buflen += f->val; - + } err =audit_make_tree (&entry->rule, str, f->op);kfree (str);if (err) goto exit_free; + entry->rule.buflen += f_val;break ;case AUDIT_INODE : + f->val = f_val; err =audit_to_inode (&entry->rule, f);if (err) goto exit_free;break ;case AUDIT_FILTERKEY : -if (entry->rule.filterkey || f->val >AUDIT_MAX_KEY_LEN ) +if (entry->rule.filterkey || f_val >AUDIT_MAX_KEY_LEN ) goto exit_free; - str =audit_unpack_string (&bufp, &remain, f->val); -if (IS_ERR (str)) + str =audit_unpack_string (&bufp, &remain, f_val); +if (IS_ERR (str)) { + err =PTR_ERR (str); goto exit_free; - entry->rule.buflen += f->val; + } + entry->rule.buflen += f_val; entry->rule.filterkey = str;break ;case AUDIT_EXE : -if (entry->rule.exe || f->val >PATH_MAX ) +if (entry->rule.exe || f_val >PATH_MAX ) goto exit_free; - str =audit_unpack_string (&bufp, &remain, f->val); + str =audit_unpack_string (&bufp, &remain, f_val);if (IS_ERR (str)) { err =PTR_ERR (str); goto exit_free; } - entry->rule.buflen += f->val; - - audit_mark =audit_alloc_mark (&entry->rule, str, f->val); + audit_mark =audit_alloc_mark (&entry->rule, str, f_val);if (IS_ERR (audit_mark)) {kfree (str); err =PTR_ERR (audit_mark); goto exit_free; } + entry->rule.buflen += f_val; entry->rule.exe = audit_mark;break ; +default : + f->val = f_val; +break ; } }
Greg Kroah-Hartman
maintainerPATCH 36/126 ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 1dade3a7048ccfc675650cd2cf13d578b095e5fb upstream.
Sometimes it is useful to find the access_width field value in bytes and not in bits so add a helper that can be used for this purpose.
--- include/acpi/actypes.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/acpi/actypes.h +2 -1
@@ -556,11 +556,12 @@ typedef u64 acpi_integer;#define ACPI_MAKE_RSDP_SIG (dest) (memcpy (ACPI_CAST_PTR (char, (dest)), ACPI_SIG_RSDP, 8))/* -* Algorithm to obtain access bit width. +* Algorithm to obtain access bit or byte width. * Can be used with access_width of struct acpi_generic_address and access_size of * struct acpi_resource_generic_register. */ #define ACPI_ACCESS_BIT_WIDTH (size) (1 << ((size) + 2)) +#define ACPI_ACCESS_BYTE_WIDTH (size) (1 << ((size) - 1))/******************************************************************************* *
Greg Kroah-Hartman
maintainerPATCH 37/126 ACPI: watchdog: Fix gas->access_width usage
In reply to Greg Kroah-HartmanFrom: Mika Westerberg <[email protected]>
commit 2ba33a4e9e22ac4dda928d3e9b5978a3a2ded4e0 upstream.
ACPI Generic Address Structure (GAS) access_width field is not in bytes as the driver seems to expect in few places so fix this by using the newly introduced macro ACPI_ACCESS_BYTE_WIDTH().
--- drivers/acpi/acpi_watchdog.c | 3 +-- drivers/watchdog/wdat_wdt.c | 2 +- 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/acpi/acpi_watchdog.c +1 -2
@@ -129,12 +129,11 @@ void __init acpi_watchdog_init(void) gas = &entries[i].register_region; res.start = gas->address; + res.end = res.start +ACPI_ACCESS_BYTE_WIDTH (gas->access_width) -1 ;if (gas->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { res.flags =IORESOURCE_MEM ; - res.end = res.start +ALIGN (gas->access_width,4 ) -1 ; }else if (gas->space_id ==ACPI_ADR_SPACE_SYSTEM_IO ) { res.flags =IORESOURCE_IO ; - res.end = res.start + gas->access_width -1 ; }else {pr_warn ("Unsupported address space: %u\n" , gas->space_id);
drivers/watchdog/wdat_wdt.c +1 -1
@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platformemset (&r,0 ,sizeof (r)); r.start = gas->address; - r.end = r.start + gas->access_width -1 ; + r.end = r.start +ACPI_ACCESS_BYTE_WIDTH (gas->access_width) -1 ;if (gas->space_id ==ACPI_ADR_SPACE_SYSTEM_MEMORY ) { r.flags =IORESOURCE_MEM ; }else if (gas->space_id ==ACPI_ADR_SPACE_SYSTEM_IO ) {
Greg Kroah-Hartman
maintainerPATCH 38/126 KVM: VMX: check descriptor table exits on instruction emulation
In reply to Greg Kroah-HartmanFrom: Oliver Upton <[email protected]>
commit 86f7e90ce840aa1db407d3ea6e9b3a52b2ce923c upstream.
KVM emulates UMIP on hardware that doesn't support it by setting the 'descriptor table exiting' VM-execution control and performing instruction emulation. When running nested, this emulation is broken as KVM refuses to emulate L2 instructions by default.
Correct this regression by allowing the emulation of descriptor table instructions if L1 hasn't requested 'descriptor table exiting'.
--- arch/x86/kvm/vmx.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
arch/x86/kvm/vmx.c +15 -0
@@ -12370,6 +12370,7 @@ static int vmx_check_intercept_io(structelse intercept =nested_vmx_check_io_bitmaps (vcpu, port, size); +/* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */ return intercept ?X86EMUL_UNHANDLEABLE :X86EMUL_CONTINUE ; }
@@ -12399,6 +12400,20 @@ static int vmx_check_intercept(struct kvcase x86_intercept_outs:return vmx_check_intercept_io (vcpu, info); +case x86_intercept_lgdt: +case x86_intercept_lidt: +case x86_intercept_lldt: +case x86_intercept_ltr: +case x86_intercept_sgdt: +case x86_intercept_sidt: +case x86_intercept_sldt: +case x86_intercept_str: +if (!nested_cpu_has2 (vmcs12,SECONDARY_EXEC_DESC )) +return X86EMUL_CONTINUE ; + +/* FIXME: produce nested vmexit and return X86EMUL_INTERCEPTED. */ +break ; +/* TODO: check more intercepts... */ default :break ;
Greg Kroah-Hartman
maintainerPATCH 39/126 HID: ite: Only bind to keyboard USB interface on Acer SW5-012 keyboard dock
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit beae56192a2570578ae45050e73c5ff9254f63e6 upstream.
Commit 8f18eca9ebc5 ("HID: ite: Add USB id match for Acer SW5-012 keyboard dock") added the USB id for the Acer SW5-012's keyboard dock to the hid-ite driver to fix the rfkill driver not working.
Most keyboard docks with an ITE 8595 keyboard/touchpad controller have the "Wireless Radio Control" bits which need the special hid-ite driver on the second USB interface (the mouse interface) and their touchpad only supports mouse emulation, so using generic hid-input handling for anything but the "Wireless Radio Control" bits is fine. On these devices we simply bind to all USB interfaces.
But unlike other ITE8595 using keyboard docks, the Acer Aspire Switch 10 (SW5-012)'s touchpad not only does mouse emulation it also supports HID-multitouch and all the keys including the "Wireless Radio Control" bits have been moved to the first USB interface (the keyboard intf).
So we need hid-ite to handle the first (keyboard) USB interface and have it NOT bind to the second (mouse) USB interface so that that can be handled by hid-multitouch.c and we get proper multi-touch support.
This commit changes the hid_device_id for the SW5-012 keyboard dock to only match on hid devices from the HID_GROUP_GENERIC group, this way hid-ite will not bind the the mouse/multi-touch interface which has HID_GROUP_MULTITOUCH_WIN_8 as group.
This fixes the regression to mouse-emulation mode introduced by adding the keyboard dock USB id.
--- drivers/hid/hid-ite.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hid/hid-ite.c +3 -2
@@ -44,8 +44,9 @@ static const struct hid_device_id ite_de { HID_USB_DEVICE(USB_VENDOR_ID_ITE, USB_DEVICE_ID_ITE8595) }, { HID_USB_DEVICE(USB_VENDOR_ID_258A, USB_DEVICE_ID_258A_6A88) },/* ITE8595 USB kbd ctlr, with Synaptics touchpad connected to it. */ - { HID_USB_DEVICE(USB_VENDOR_ID_SYNAPTICS, - USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) }, + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, +USB_VENDOR_ID_SYNAPTICS , + USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) }, { } };MODULE_DEVICE_TABLE (hid, ite_devices);
Greg Kroah-Hartman
maintainerPATCH 40/126 HID: core: fix off-by-one memset in hid_report_raw_event()
In reply to Greg Kroah-HartmanFrom: Johan Korsnes <[email protected]>
commit 5ebdffd25098898aff1249ae2f7dbfddd76d8f8f upstream.
In case a report is greater than HID_MAX_BUFFER_SIZE, it is truncated, but the report-number byte is not correctly handled. This results in a off-by-one in the following memset, causing a kernel Oops and ensuing system crash.
Note: With commit 8ec321e96e05 ("HID: Fix slab-out-of-bounds read in hid_field_extract") I no longer hit the kernel Oops as we instead fail "controlled" at probe if there is a report too long in the HID report-descriptor. hid_report_raw_event() is an exported symbol, so presumabely we cannot always rely on this being the case.
function.")
--- drivers/hid/hid-core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-core.c +3 -1
@@ -1567,7 +1567,9 @@ int hid_report_raw_event(struct hid_devi rsize = ((report->size -1 ) >>3 ) +1 ; -if (rsize >HID_MAX_BUFFER_SIZE ) +if (report_enum->numbered && rsize >=HID_MAX_BUFFER_SIZE ) + rsize =HID_MAX_BUFFER_SIZE -1 ; +else if (rsize >HID_MAX_BUFFER_SIZE ) rsize =HID_MAX_BUFFER_SIZE ;if (csize < rsize) {
Greg Kroah-Hartman
maintainerPATCH 41/126 HID: core: increase HID report buffer size to 8KiB
In reply to Greg Kroah-HartmanFrom: Johan Korsnes <[email protected]>
commit 84a4062632462c4320704fcdf8e99e89e94c0aba upstream.
We have a HID touch device that reports its opens and shorts test results in HID buffers of size 8184 bytes. The maximum size of the HID buffer is currently set to 4096 bytes, causing probe of this device to fail. With this patch we increase the maximum size of the HID buffer to 8192 bytes, making device probe and acquisition of said buffers succeed.
--- include/linux/hid.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/hid.h +1 -1
@@ -477,7 +477,7 @@ struct hid_report_enum { };#define HID_MIN_BUFFER_SIZE 64/* make sure there is at least a packet size of space */ -#define HID_MAX_BUFFER_SIZE 4096/* 4kb */ +#define HID_MAX_BUFFER_SIZE 8192/* 8kb */ #define HID_CONTROL_FIFO_SIZE 256/* to init devices with >100 reports */ #define HID_OUTPUT_FIFO_SIZE 64
Greg Kroah-Hartman
maintainerPATCH 42/126 tracing: Disable trace_printk() on post poned tests
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 78041c0c9e935d9ce4086feeff6c569ed88ddfd4 upstream.
The tracing seftests checks various aspects of the tracing infrastructure, and one is filtering. If trace_printk() is active during a self test, it can cause the filtering to fail, which will disable that part of the trace.
To keep the selftests from failing because of trace_printk() calls, trace_printk() checks the variable tracing_selftest_running, and if set, it does not write to the tracing buffer.
As some tracers were registered earlier in boot, the selftest they triggered would fail because not all the infrastructure was set up for the full selftest. Thus, some of the tests were post poned to when their infrastructure was ready (namely file system code). The postpone code did not set the tracing_seftest_running variable, and could fail if a trace_printk() was added and executed during their run.
--- kernel/trace/trace.c | 2 ++ 1 file changed, 2 insertions(+)
kernel/trace/trace.c +2 -0
@@ -1543,6 +1543,7 @@ static __init int init_trace_selftests(vpr_info ("Running postponed tracer tests:\n" ); + tracing_selftest_running = true;list_for_each_entry_safe (p, n, &postponed_selftests, list) { ret =run_tracer_selftest (p->type);/* If the test fails, then warn and remove from available_tracers */
@@ -1561,6 +1562,7 @@ static __init int init_trace_selftests(vlist_del (&p->list);kfree (p); } + tracing_selftest_running = false; out:mutex_unlock (&trace_types_lock);
Greg Kroah-Hartman
maintainerPATCH 43/126 Revert "PM / devfreq: Modify the device name as devfreq(X) for sysfs"
In reply to Greg Kroah-HartmanFrom: Orson Zhai <[email protected]>
commit 66d0e797bf095d407479c89952d42b1d96ef0a7f upstream.
This reverts commit 4585fbcb5331fc910b7e553ad3efd0dd7b320d14.
The name changing as devfreq(X) breaks some user space applications, such as Android HAL from Unisoc and Hikey [1].
The device name will be changed unexpectly after every boot depending on module init sequence. It will make trouble to setup some system configuration like selinux for Android.
So we'd like to revert it back to old naming rule before any better way being found.
[1] https://lkml.org/lkml/2018/5/8/1042
--- drivers/devfreq/devfreq.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/devfreq/devfreq.c +1 -3
@@ -513,7 +513,6 @@ struct devfreq *devfreq_add_device(struc {struct devfreq *devfreq;struct devfreq_governor *governor; -static atomic_t devfreq_no =ATOMIC_INIT (-1 );int err =0 ;if (!dev || !profile || !governor_name) {
@@ -556,8 +555,7 @@ struct devfreq *devfreq_add_device(strucmutex_lock (&devfreq->lock); } -dev_set_name (&devfreq->dev,"devfreq%d" , -atomic_inc_return (&devfreq_no)); +dev_set_name (&devfreq->dev,"%s" ,dev_name (dev)); err =device_register (&devfreq->dev);if (err) {mutex_unlock (&devfreq->lock);
Greg Kroah-Hartman
maintainerPATCH 44/126 HID: hiddev: Fix race in in hiddev_disconnect()
In reply to Greg Kroah-HartmanFrom: [email protected] <[email protected]>
commit 5c02c447eaeda29d3da121a2e17b97ccaf579b51 upstream.
Syzbot reports that "hiddev" is used after it's free in hiddev_disconnect(). The hiddev_disconnect() function sets "hiddev->exist = 0;" so hiddev_release() can free it as soon as we drop the "existancelock" lock. This patch moves the mutex_unlock(&hiddev->existancelock) until after we have finished using it.
--- drivers/hid/usbhid/hiddev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hid/usbhid/hiddev.c +1 -1
@@ -954,9 +954,9 @@ void hiddev_disconnect(struct hid_device hiddev->exist =0 ;if (hiddev->open) { -mutex_unlock (&hiddev->existancelock);hid_hw_close (hiddev->hid);wake_up_interruptible (&hiddev->wait); +mutex_unlock (&hiddev->existancelock); }else {mutex_unlock (&hiddev->existancelock);kfree (hiddev);
Greg Kroah-Hartman
maintainerPATCH 45/126 MIPS: VPE: Fix a double free and a memory leak in release_vpe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit bef8e2dfceed6daeb6ca3e8d33f9c9d43b926580 upstream.
Pointer on the memory allocated by 'alloc_progmem()' is stored in 'v->load_addr'. So this is this memory that should be freed by 'release_progmem()'.
'release_progmem()' is only a call to 'kfree()'.
With the current code, there is both a double free and a memory leak. Fix it by passing the correct pointer to 'release_progmem()'.
--- arch/mips/kernel/vpe.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/vpe.c +1 -1
@@ -134,7 +134,7 @@ void release_vpe(struct vpe *v) {list_del (&v->list);if (v->load_addr) -release_progmem (v); +release_progmem (v->load_addr);kfree (v); }
Greg Kroah-Hartman
maintainerPATCH 46/126 i2c: altera: Fix potential integer overflow
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 54498e8070e19e74498a72c7331348143e7e1f8c upstream.
Factor out 100 from the equation and do 32-bit arithmetic (3 * clk_mhz / 10) instead of 64-bit.
Notice that clk_mhz is MHz, so the multiplication will never wrap 32 bits and there is no need for div_u64().
Addresses-Coverity: 1458369 ("Unintentional integer overflow")
--- drivers/i2c/busses/i2c-altera.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-altera.c +1 -1
@@ -182,7 +182,7 @@ static void altr_i2c_init(struct altr_i2/* SCL Low Time */ writel (t_low, idev->base +ALTR_I2C_SCL_LOW );/* SDA Hold Time, 300ns */ -writel (div_u64 (300 * clk_mhz,1000 ), idev->base +ALTR_I2C_SDA_HOLD ); +writel (3 * clk_mhz /10 , idev->base +ALTR_I2C_SDA_HOLD );/* Mask all master interrupt bits */ altr_i2c_int_enable (idev,ALTR_I2C_ALL_IRQ , false);
Greg Kroah-Hartman
maintainerPATCH 47/126 i2c: jz4780: silence log flood on txabrt
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
commit 9e661cedcc0a072d91a32cb88e0515ea26e35711 upstream.
The printout for txabrt is way too talkative and is highly annoying with scanning programs like 'i2cdetect'. Reduce it to the minimum, the rest can be gained by I2C core debugging and datasheet information. Also, make it a debug printout, it won't help the regular user.
--- drivers/i2c/busses/i2c-jz4780.c | 36 ++---------------------------------- 1 file changed, 2 insertions(+), 34 deletions(-)
drivers/i2c/busses/i2c-jz4780.c +2 -34
@@ -82,25 +82,6 @@#define JZ4780_I2C_STA_TFNF BIT(1)#define JZ4780_I2C_STA_ACT BIT(0) -static const char *const jz4780_i2c_abrt_src[] = { -"ABRT_7B_ADDR_NOACK" , -"ABRT_10ADDR1_NOACK" , -"ABRT_10ADDR2_NOACK" , -"ABRT_XDATA_NOACK" , -"ABRT_GCALL_NOACK" , -"ABRT_GCALL_READ" , -"ABRT_HS_ACKD" , -"SBYTE_ACKDET" , -"ABRT_HS_NORSTRT" , -"SBYTE_NORSTRT" , -"ABRT_10B_RD_NORSTRT" , -"ABRT_MASTER_DIS" , -"ARB_LOST" , -"SLVFLUSH_TXFIFO" , -"SLV_ARBLOST" , -"SLVRD_INTX" , -}; -#define JZ4780_I2C_INTST_IGC BIT(11)#define JZ4780_I2C_INTST_ISTT BIT(10)#define JZ4780_I2C_INTST_ISTP BIT(9)
@@ -538,21 +519,8 @@ done:static void jz4780_i2c_txabrt (struct jz4780_i2c *i2c,int src) { -int i; - -dev_err (&i2c->adap.dev,"txabrt: 0x%08x\n" , src); -dev_err (&i2c->adap.dev,"device addr=%x\n" , -jz4780_i2c_readw (i2c,JZ4780_I2C_TAR )); -dev_err (&i2c->adap.dev,"send cmd count:%d %d\n" , - i2c->cmd, i2c->cmd_buf[i2c->cmd]); -dev_err (&i2c->adap.dev,"receive data count:%d %d\n" , - i2c->cmd, i2c->data_buf[i2c->cmd]); - -for (i =0 ; i <16 ; i++) { -if (src &BIT (i)) -dev_dbg (&i2c->adap.dev,"I2C TXABRT[%d]=%s\n" , - i, jz4780_i2c_abrt_src[i]); - } +dev_dbg (&i2c->adap.dev,"txabrt: 0x%08x, cmd: %d, send: %d, recv: %d\n" , + src, i2c->cmd, i2c->cmd_buf[i2c->cmd], i2c->data_buf[i2c->cmd]); } static inline int jz4780_i2c_xfer_read(struct jz4780_i2c *i2c,
Greg Kroah-Hartman
maintainerPATCH 48/126 drm/i915/gvt: Separate display reset from ALL_ENGINES reset
In reply to Greg Kroah-HartmanFrom: Tina Zhang <[email protected]>
commit 3eb55e6f753a379e293395de8d5f3be28351a7f8 upstream.
ALL_ENGINES reset doesn't clobber display with the current gvt-g supported platforms. Thus ALL_ENGINES reset shouldn't reset the display engine registers emulated by gvt-g.
This fixes guest warning like
[ 14.622026] [drm] Initialized i915 1.6.0 20200114 for 0000:00:03.0 on minor 0 [ 14.967917] fbcon: i915drmfb (fb0) is primary device [ 25.100188] [drm:drm_atomic_helper_wait_for_dependencies [drm_kms_helper]] E RROR [CRTC:51:pipe A] flip_done timed out [ 25.100860] -----------[ cut here ]----------- [ 25.100861] pll on state mismatch (expected 0, found 1) [ 25.101024] WARNING: CPU: 1 PID: 30 at drivers/gpu/drm/i915/display/intel_dis play.c:14382 verify_single_dpll_state.isra.115+0x28f/0x320 [i915] [ 25.101025] Modules linked in: intel_rapl_msr intel_rapl_common kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel i915 aesni_intel cr ypto_simd cryptd glue_helper cec rc_core video drm_kms_helper joydev drm input_l eds i2c_algo_bit serio_raw fb_sys_fops syscopyarea sysfillrect sysimgblt mac_hid qemu_fw_cfg sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 e1000 psmouse i2c_piix4 pata_acpi floppy [ 25.101052] CPU: 1 PID: 30 Comm: kworker/u4:1 Not tainted 5.5.0+ #1 [ 25.101053] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1 .12.1-0-ga5cab58 04/01/2014 [ 25.101055] Workqueue: events_unbound async_run_entry_fn [ 25.101092] RIP: 0010:verify_single_dpll_state.isra.115+0x28f/0x320 [i915] [ 25.101093] Code: e0 d9 ff e9 a3 fe ff ff 80 3d e9 c2 11 00 00 44 89 f6 48 c7 c7 c0 9d 88 c0 75 3b e8 eb df d9 ff e9 c7 fe ff ff e8 d1 e0 ae c4 <0f> 0b e9 7a fe ff ff 80 3d c0 c2 11 00 00 8d 71 41 89 c2 48 c7 c7 [ 25.101093] RSP: 0018:ffffb1de80107878 EFLAGS: 00010286 [ 25.101094] RAX: 0000000000000000 RBX: ffffb1de80107884 RCX: 0000000000000007 [ 25.101095] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff94fdfdd19740 [ 25.101095] RBP: ffffb1de80107938 R08: 0000000d6bfdc7b4 R09: 000000000000002b [ 25.101096] R10: ffff94fdf82dc000 R11: 0000000000000225 R12: 00000000000001f8 [ 25.101096] R13: ffff94fdb3ca6a90 R14: ffff94fdb3ca0000 R15: 0000000000000000 [ 25.101097] FS: 0000000000000000(0000) GS:ffff94fdfdd00000(0000) knlGS:00000 00000000000 [ 25.101098] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 25.101098] CR2: 00007fbc3e2be9c8 CR3: 000000003339a003 CR4: 0000000000360ee0 [ 25.101101] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 25.101101] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 25.101102] Call Trace: [ 25.101139] intel_atomic_commit_tail+0xde4/0x1520 [i915] [ 25.101141] ? flush_workqueue_prep_pwqs+0xfa/0x130 [ 25.101142] ? flush_workqueue+0x198/0x3c0 [ 25.101174] intel_atomic_commit+0x2ad/0x320 [i915] [ 25.101209] drm_atomic_commit+0x4a/0x50 [drm] [ 25.101220] drm_client_modeset_commit_atomic+0x1c4/0x200 [drm] [ 25.101231] drm_client_modeset_commit_force+0x47/0x170 [drm] [ 25.101250] drm_fb_helper_restore_fbdev_mode_unlocked+0x4e/0xa0 [drm_kms_hel per] [ 25.101255] drm_fb_helper_set_par+0x2d/0x60 [drm_kms_helper] [ 25.101287] intel_fbdev_set_par+0x1a/0x40 [i915] [ 25.101289] ? con_is_visible+0x2e/0x60 [ 25.101290] fbcon_init+0x378/0x600 [ 25.101292] visual_init+0xd5/0x130 [ 25.101296] do_bind_con_driver+0x217/0x430 [ 25.101297] do_take_over_console+0x7d/0x1b0 [ 25.101298] do_fbcon_takeover+0x5c/0xb0 [ 25.101299] fbcon_fb_registered+0x199/0x1a0 [ 25.101301] register_framebuffer+0x22c/0x330 [ 25.101306] __drm_fb_helper_initial_config_and_unlock+0x31a/0x520 [drm_kms_h elper] [ 25.101311] drm_fb_helper_initial_config+0x35/0x40 [drm_kms_helper] [ 25.101341] intel_fbdev_initial_config+0x18/0x30 [i915] [ 25.101342] async_run_entry_fn+0x3c/0x150 [ 25.101343] process_one_work+0x1fd/0x3f0 [ 25.101344] worker_thread+0x34/0x410 [ 25.101346] kthread+0x121/0x140 [ 25.101346] ? process_one_work+0x3f0/0x3f0 [ 25.101347] ? kthread_park+0x90/0x90 [ 25.101350] ret_from_fork+0x35/0x40 [ 25.101351] --[ end trace b5b47d44cd998ba1 ]--
--- drivers/gpu/drm/i915/gvt/vgpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/i915/gvt/vgpu.c +1 -1
@@ -513,9 +513,9 @@ void intel_gvt_reset_vgpu_locked(structintel_vgpu_reset_mmio (vgpu, dmlr);populate_pvinfo_page (vgpu); -intel_vgpu_reset_display (vgpu);if (dmlr) { +intel_vgpu_reset_display (vgpu);intel_vgpu_reset_cfg_space (vgpu);/* only reset the failsafe mode when dmlr reset */ vgpu->failsafe = false;
Greg Kroah-Hartman
maintainerPATCH 49/126 usb: charger: assign specific number for enum value
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
commit ca4b43c14cd88d28cfc6467d2fa075aad6818f1d upstream.
To work properly on every architectures and compilers, the enum value needs to be specific numbers.
--- include/uapi/linux/usb/charger.h | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
include/uapi/linux/usb/charger.h +8 -8
@@ -14,18 +14,18 @@* ACA (Accessory Charger Adapters) */ enum usb_charger_type { -UNKNOWN_TYPE , -SDP_TYPE , -DCP_TYPE , -CDP_TYPE , -ACA_TYPE , +UNKNOWN_TYPE =0 , +SDP_TYPE =1 , +DCP_TYPE =2 , +CDP_TYPE =3 , +ACA_TYPE =4 , };/* USB charger state */ enum usb_charger_state { -USB_CHARGER_DEFAULT , -USB_CHARGER_PRESENT , -USB_CHARGER_ABSENT , +USB_CHARGER_DEFAULT =0 , +USB_CHARGER_PRESENT =1 , +USB_CHARGER_ABSENT =2 , };#endif /* _UAPI__LINUX_USB_CHARGER_H */
Greg Kroah-Hartman
maintainerPATCH 50/126 ecryptfs: Fix up bad backport of fe2e082f5da5b4a0a92ae32978f81507ef37ec66
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
When doing the 4.9 merge into certain Android trees, I noticed a warning from Android's deprecated GCC 4.9.4, which causes a build failure in those trees due to basically -Werror:
fs/ecryptfs/keystore.c: In function 'ecryptfs_parse_packet_set':fs/ecryptfs/keystore.c:1357:2: warning: 'auth_tok_list_item' may be used uninitialized in this function [-Wmaybe-uninitialized]
memset(auth_tok_list_item, 0,
^fs/ecryptfs/keystore.c:1260:38: note: 'auth_tok_list_item' was declared here
struct ecryptfs_auth_tok_list_item *auth_tok_list_item;
^GCC 9.2.0 was not able to pick up this warning when I tested it.
Turns out that Clang warns as well when -Wuninitialized is used, which is not the case in older stable trees at the moment (but shows value in potentially backporting the various warning fixes currently in upstream to get more coverage).
fs/ecryptfs/keystore.c:1284:6: warning: variable 'auth_tok_list_item' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
if (data[(*packet_size)++] != ECRYPTFS_TAG_1_PACKET_TYPE) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/ecryptfs/keystore.c:1360:4: note: uninitialized use occurs here
auth_tok_list_item);
^~~~~~~~~~~~~~~~~~
fs/ecryptfs/keystore.c:1284:2: note: remove the 'if' if its condition is
always false
if (data[(*packet_size)++] != ECRYPTFS_TAG_1_PACKET_TYPE) {
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/ecryptfs/keystore.c:1260:56: note: initialize the variable
'auth_tok_list_item' to silence this warning
struct ecryptfs_auth_tok_list_item *auth_tok_list_item;
^
= NULL1 warning generated.
Somehow, commit fe2e082f5da5 ("ecryptfs: fix a memory leak bug in parse_tag_1_packet()") upstream was not applied in the correct if block in 4.4.215, 4.9.215, and 4.14.172, which will indeed lead to use of uninitialized memory. Fix it up by undoing the bad backport in those trees then reapplying the patch in the proper location.
--- fs/ecryptfs/keystore.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/ecryptfs/keystore.c +2 -2
@@ -1285,7 +1285,7 @@ parse_tag_1_packet(struct ecryptfs_cryptprintk (KERN_ERR "Enter w/ first byte != 0x%.2x\n" ,ECRYPTFS_TAG_1_PACKET_TYPE ); rc = -EINVAL ; - goto out_free; + goto out; }/* Released: wipe_auth_tok_list called in ecryptfs_parse_packet_set or * at end of function upon failure */
@@ -1335,7 +1335,7 @@ parse_tag_1_packet(struct ecryptfs_cryptprintk (KERN_WARNING "Tag 1 packet contains key larger " "than ECRYPTFS_MAX_ENCRYPTED_KEY_BYTES" ); rc = -EINVAL ; - goto out; + goto out_free; }memcpy ((*new_auth_tok)->session_key.encrypted_key, &data[(*packet_size)], (body_size - (ECRYPTFS_SIG_SIZE +2 )));
Greg Kroah-Hartman
maintainerPATCH 51/126 include/linux/bitops.h: introduce BITS_PER_TYPE
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
commit 9144d75e22cad3c89e6b2ccab551db9ee28d250a upstream.
net_dim.h has a rather useful extension to BITS_PER_BYTE to compute the number of bits in a type (BITS_PER_BYTE * sizeof(T)), so promote the macro to bitops.h, alongside BITS_PER_BYTE, for wider usage.
--- include/linux/bitops.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/bitops.h +2 -1
@@ -4,7 +4,8 @@#include <asm/types.h> #include <linux/bits.h> -#define BITS_TO_LONGS (nr) DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long)) +#define BITS_PER_TYPE (type) (sizeof(type) * BITS_PER_BYTE) +#define BITS_TO_LONGS (nr) DIV_ROUND_UP(nr, BITS_PER_TYPE(long))extern unsigned int __sw_hweight8 (unsigned int w);extern unsigned int __sw_hweight16 (unsigned int w);
Greg Kroah-Hartman
maintainerPATCH 52/126 net: netlink: cap max groups which will be considered in netlink_bind()
In reply to Greg Kroah-HartmanFrom: Nikolay Aleksandrov <[email protected]>
commit 3a20773beeeeadec41477a5ba872175b778ff752 upstream.
Since nl_groups is a u32 we can't bind more groups via ->bind (netlink_bind) call, but netlink has supported more groups via setsockopt() for a long time and thus nlk->ngroups could be over 32. Recently I added support for per-vlan notifications and increased the groups to 33 for NETLINK_ROUTE which exposed an old bug in the netlink_bind() code causing out-of-bounds access on archs where unsigned long is 32 bits via test_bit() on a local variable. Fix this by capping the maximum groups in netlink_bind() to BITS_PER_TYPE(u32), effectively capping them at 32 which is the minimum of allocated groups and the maximum groups which can be bound via netlink_bind().
--- net/netlink/af_netlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/netlink/af_netlink.c +3 -2
@@ -997,7 +997,8 @@ static int netlink_bind(struct socket *sif (nlk->netlink_bind && groups) {int group; -for (group =0 ; group < nlk->ngroups; group++) { +/* nl_groups is a u32, so cap the maximum groups we can bind */ +for (group =0 ; group <BITS_PER_TYPE (u32); group++) {if (!test_bit (group, &groups))continue ; err = nlk->netlink_bind (net, group +1 );
@@ -1016,7 +1017,7 @@ static int netlink_bind(struct socket *s netlink_insert(sk, nladdr->nl_pid) :netlink_autobind (sock);if (err) { -netlink_undo_bind (nlk->ngroups, groups, sk); +netlink_undo_bind (BITS_PER_TYPE (u32), groups, sk); goto unlock; } }
Greg Kroah-Hartman
maintainerPATCH 53/126 net: atlantic: fix potential error handling
In reply to Greg Kroah-HartmanFrom: Pavel Belous <[email protected]>
commit 380ec5b9af7f0d57dbf6ac067fd9f33cff2fef71 upstream.
Code inspection found that in case of mapping error we do return current 'ret' value. But beside error, it is used to count number of descriptors allocated for the packet. In that case map_skb function could return '1'.
Changing it to return zero (number of mapped descriptors for skb)
--- drivers/net/ethernet/aquantia/atlantic/aq_nic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/aquantia/atlantic/aq_nic.c +3 -1
@@ -519,8 +519,10 @@ static unsigned int aq_nic_map_skb(struc dx_buff->len, DMA_TO_DEVICE); -if (unlikely (dma_mapping_error (aq_nic_get_dev (self), dx_buff->pa))) +if (unlikely (dma_mapping_error (aq_nic_get_dev (self), dx_buff->pa))) { + ret =0 ; goto exit; + } first = dx_buff; dx_buff->len_pkt = skb->len;
Greg Kroah-Hartman
maintainerPATCH 54/126 net: ena: make ena rxfh support ETH_RSS_HASH_NO_CHANGE
In reply to Greg Kroah-HartmanFrom: Arthur Kiyanovski <[email protected]>
commit 470793a78ce344bd53d31e0c2d537f71ba957547 upstream.
As the name suggests ETH_RSS_HASH_NO_CHANGE is received upon changing the key or indirection table using ethtool while keeping the same hash function.
Also add a function for retrieving the current hash function from the ena-com layer.
--- drivers/net/ethernet/amazon/ena/ena_com.c | 5 +++++ drivers/net/ethernet/amazon/ena/ena_com.h | 8 ++++++++ drivers/net/ethernet/amazon/ena/ena_ethtool.c | 3 +++ 3 files changed, 16 insertions(+)
drivers/net/ethernet/amazon/ena/ena_com.c +5 -0
@@ -861,6 +861,11 @@ static void ena_com_hash_key_fill_defaul hash_key->keys_num =sizeof (hash_key->key) /sizeof (u32); } +int ena_com_get_current_hash_function (struct ena_com_dev *ena_dev) +{ +return ena_dev->rss.hash_func; +} +static int ena_com_hash_key_allocate (struct ena_com_dev *ena_dev) {struct ena_rss *rss = &ena_dev->rss;
drivers/net/ethernet/amazon/ena/ena_com.h +8 -0
@@ -632,6 +632,14 @@ int ena_com_rss_init(struct ena_com_dev*/ void ena_com_rss_destroy (struct ena_com_dev *ena_dev); +/* ena_com_get_current_hash_function - Get RSS hash function +* @ena_dev: ENA communication layer struct +* +* Return the current hash function. +* @return: 0 or one of the ena_admin_hash_functions values. +*/ +int ena_com_get_current_hash_function (struct ena_com_dev *ena_dev); +/* ena_com_fill_hash_function - Fill RSS hash function * @ena_dev: ENA communication layer struct * @func: The hash function (Toeplitz or crc)
drivers/net/ethernet/amazon/ena/ena_ethtool.c +3 -0
@@ -748,6 +748,9 @@ static int ena_set_rxfh(struct net_devic }switch (hfunc) { +case ETH_RSS_HASH_NO_CHANGE : + func =ena_com_get_current_hash_function (ena_dev); +break ;case ETH_RSS_HASH_TOP : func =ENA_ADMIN_TOEPLITZ ;break ;
Greg Kroah-Hartman
maintainerPATCH 55/126 namei: only return -ECHILD from follow_dotdot_rcu()
In reply to Greg Kroah-HartmanFrom: Aleksa Sarai <[email protected]>
commit 2b98149c2377bff12be5dd3ce02ae0506e2dd613 upstream.
It's over-zealous to return hard errors under RCU-walk here, given that a REF-walk will be triggered for all other cases handling ".." under RCU.
The original purpose of this check was to ensure that if a rename occurs such that a directory is moved outside of the bind-mount which the resolution started in, it would be detected and blocked to avoid being able to mess with paths outside of the bind-mount. However, triggering a new REF-walk is just as effective a solution.
--- fs/namei.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/namei.c +1 -1
@@ -1382,7 +1382,7 @@ static int follow_dotdot_rcu(struct name nd->path.dentry = parent; nd->seq = seq;if (unlikely (!path_connected (&nd->path))) -return -ENOENT ; +return -ECHILD ;break ; }else {struct mount *mnt =real_mount (nd->path.mnt);
Greg Kroah-Hartman
maintainerPATCH 56/126 mwifiex: drop most magic numbers from mwifiex_process_tdls_action_frame()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
commit 70e5b8f445fd27fde0c5583460e82539a7242424 upstream.
Before commit 1e58252e334d ("mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame()"), mwifiex_process_tdls_action_frame() already had too many magic numbers. But this commit just added a ton more, in the name of checking for buffer overflows. That seems like a really bad idea.
Let's make these magic numbers a little less magic, by
(a) factoring out 'pos[1]' as 'ie_len'
(b) using 'sizeof' on the appropriate source or destination fields where possible, instead of bare numbers
(c) dropping redundant checks, per below.
Regarding redundant checks: the beginning of the loop has this:
if (pos + 2 + pos[1] > end)
break;but then individual 'case's include stuff like this:
if (pos > end - 3)
return;
if (pos[1] != 1)
return;
Note that the second 'return' (validating the length, pos[1]) combined with the above condition (ensuring 'pos + 2 + length' doesn't exceed 'end'), makes the first 'return' (whose 'if' can be reworded as 'pos > end - pos[1] - 2') redundant. Rather than unwind the magic numbers there, just drop those conditions.
--- drivers/net/wireless/marvell/mwifiex/tdls.c | 75 ++++++++++------------------ 1 file changed, 28 insertions(+), 47 deletions(-)
drivers/net/wireless/marvell/mwifiex/tdls.c +28 -47
@@ -897,7 +897,7 @@ void mwifiex_process_tdls_action_frame(su8 *peer, *pos, *end;u8 i, action, basic;u16 cap =0 ; -int ie_len =0 ; +int ies_len =0 ;if (len < (sizeof (struct ethhdr ) +3 ))return ;
@@ -919,7 +919,7 @@ void mwifiex_process_tdls_action_frame(s pos = buf +sizeof (struct ethhdr ) +4 ;/* payload 1+ category 1 + action 1 + dialog 1 */ cap =get_unaligned_le16 (pos); - ie_len = len -sizeof (struct ethhdr ) -TDLS_REQ_FIX_LEN ; + ies_len = len -sizeof (struct ethhdr ) -TDLS_REQ_FIX_LEN ; pos +=2 ;break ;
@@ -929,7 +929,7 @@ void mwifiex_process_tdls_action_frame(s/* payload 1+ category 1 + action 1 + dialog 1 + status code 2*/ pos = buf +sizeof (struct ethhdr ) +6 ; cap =get_unaligned_le16 (pos); - ie_len = len -sizeof (struct ethhdr ) -TDLS_RESP_FIX_LEN ; + ies_len = len -sizeof (struct ethhdr ) -TDLS_RESP_FIX_LEN ; pos +=2 ;break ;
@@ -937,7 +937,7 @@ void mwifiex_process_tdls_action_frame(sif (len < (sizeof (struct ethhdr ) +TDLS_CONFIRM_FIX_LEN ))return ; pos = buf +sizeof (struct ethhdr ) +TDLS_CONFIRM_FIX_LEN ; - ie_len = len -sizeof (struct ethhdr ) -TDLS_CONFIRM_FIX_LEN ; + ies_len = len -sizeof (struct ethhdr ) -TDLS_CONFIRM_FIX_LEN ;break ;default :mwifiex_dbg (priv->adapter,ERROR ,"Unknown TDLS frame type.\n" );
@@ -950,33 +950,33 @@ void mwifiex_process_tdls_action_frame(s sta_ptr->tdls_cap.capab =cpu_to_le16 (cap); -for (end = pos + ie_len; pos +1 < end; pos +=2 + pos[1 ]) { -if (pos +2 + pos[1 ] > end) +for (end = pos + ies_len; pos +1 < end; pos +=2 + pos[1 ]) { +u8 ie_len = pos[1 ]; + +if (pos +2 + ie_len > end)break ;switch (*pos) {case WLAN_EID_SUPP_RATES : -if (pos[1 ] >32 ) +if (ie_len >sizeof (sta_ptr->tdls_cap.rates))return ; - sta_ptr->tdls_cap.rates_len = pos[1 ]; -for (i =0 ; i < pos[1 ]; i++) + sta_ptr->tdls_cap.rates_len = ie_len; +for (i =0 ; i < ie_len; i++) sta_ptr->tdls_cap.rates[i] = pos[i +2 ];break ;case WLAN_EID_EXT_SUPP_RATES : -if (pos[1 ] >32 ) +if (ie_len >sizeof (sta_ptr->tdls_cap.rates))return ; basic = sta_ptr->tdls_cap.rates_len; -if (pos[1 ] >32 - basic) +if (ie_len >sizeof (sta_ptr->tdls_cap.rates) - basic)return ; -for (i =0 ; i < pos[1 ]; i++) +for (i =0 ; i < ie_len; i++) sta_ptr->tdls_cap.rates[basic + i] = pos[i +2 ]; - sta_ptr->tdls_cap.rates_len += pos[1 ]; + sta_ptr->tdls_cap.rates_len += ie_len;break ;case WLAN_EID_HT_CAPABILITY : -if (pos > end -sizeof (struct ieee80211_ht_cap ) -2 ) -return ; -if (pos[1 ] !=sizeof (struct ieee80211_ht_cap )) +if (ie_len !=sizeof (struct ieee80211_ht_cap ))return ;/* copy the ie's value into ht_capb*/ memcpy((u8 *)&sta_ptr->tdls_cap.ht_capb, pos + 2,
@@ -984,59 +984,45 @@ void mwifiex_process_tdls_action_frame(s sta_ptr->is_11n_enabled =1 ;break ;case WLAN_EID_HT_OPERATION : -if (pos > end - -sizeof (struct ieee80211_ht_operation ) -2 ) -return ; -if (pos[1 ] !=sizeof (struct ieee80211_ht_operation )) +if (ie_len !=sizeof (struct ieee80211_ht_operation ))return ;/* copy the ie's value into ht_oper*/ memcpy (&sta_ptr->tdls_cap.ht_oper, pos +2 ,sizeof (struct ieee80211_ht_operation ));break ;case WLAN_EID_BSS_COEX_2040 : -if (pos > end -3 ) -return ; -if (pos[1 ] !=1 ) +if (ie_len !=sizeof (pos[2 ]))return ; sta_ptr->tdls_cap.coex_2040 = pos[2 ];break ;case WLAN_EID_EXT_CAPABILITY : -if (pos > end -sizeof (struct ieee_types_header )) -return ; -if (pos[1 ] <sizeof (struct ieee_types_header )) +if (ie_len <sizeof (struct ieee_types_header ))return ; -if (pos[1 ] >8 ) +if (ie_len >8 )return ;memcpy ((u8 *)&sta_ptr->tdls_cap.extcap, pos,sizeof (struct ieee_types_header ) + -min_t (u8, pos[1 ],8 )); +min_t (u8, ie_len,8 ));break ;case WLAN_EID_RSN : -if (pos > end -sizeof (struct ieee_types_header )) +if (ie_len <sizeof (struct ieee_types_header ))return ; -if (pos[1 ] <sizeof (struct ieee_types_header )) -return ; -if (pos[1 ] >IEEE_MAX_IE_SIZE - +if (ie_len >IEEE_MAX_IE_SIZE -sizeof (struct ieee_types_header ))return ;memcpy ((u8 *)&sta_ptr->tdls_cap.rsn_ie, pos,sizeof (struct ieee_types_header ) + -min_t (u8, pos[1 ],IEEE_MAX_IE_SIZE - +min_t (u8, ie_len,IEEE_MAX_IE_SIZE -sizeof (struct ieee_types_header )));break ;case WLAN_EID_QOS_CAPA : -if (pos > end -3 ) -return ; -if (pos[1 ] !=1 ) +if (ie_len !=sizeof (pos[2 ]))return ; sta_ptr->tdls_cap.qos_info = pos[2 ];break ;case WLAN_EID_VHT_OPERATION :if (priv->adapter->is_hw_11ac_capable) { -if (pos > end - -sizeof (struct ieee80211_vht_operation ) -2 ) -return ; -if (pos[1 ] != +if (ie_len !=sizeof (struct ieee80211_vht_operation ))return ;/* copy the ie's value into vhtoper*/
@@ -1046,10 +1032,7 @@ void mwifiex_process_tdls_action_frame(sbreak ;case WLAN_EID_VHT_CAPABILITY :if (priv->adapter->is_hw_11ac_capable) { -if (pos > end - -sizeof (struct ieee80211_vht_cap ) -2 ) -return ; -if (pos[1 ] !=sizeof (struct ieee80211_vht_cap )) +if (ie_len !=sizeof (struct ieee80211_vht_cap ))return ;/* copy the ie's value into vhtcap*/ memcpy((u8 *)&sta_ptr->tdls_cap.vhtcap, pos + 2,
@@ -1059,9 +1042,7 @@ void mwifiex_process_tdls_action_frame(sbreak ;case WLAN_EID_AID :if (priv->adapter->is_hw_11ac_capable) { -if (pos > end -4 ) -return ; -if (pos[1 ] !=2 ) +if (ie_len !=sizeof (u16))return ; sta_ptr->tdls_cap.aid =get_unaligned_le16 ((pos +2 ));
Greg Kroah-Hartman
maintainerPATCH 57/126 KVM: SVM: Override default MMIO mask if memory encryption is enabled
In reply to Greg Kroah-HartmanFrom: Tom Lendacky <[email protected]>
commit 52918ed5fcf05d97d257f4131e19479da18f5d16 upstream.
The KVM MMIO support uses bit 51 as the reserved bit to cause nested page faults when a guest performs MMIO. The AMD memory encryption support uses a CPUID function to define the encryption bit position. Given this, it is possible that these bits can conflict.
Use svm_hardware_setup() to override the MMIO mask if memory encryption support is enabled. Various checks are performed to ensure that the mask is properly defined and rsvd_bits() is used to generate the new mask (as was done prior to the change that necessitated this patch).
--- arch/x86/kvm/svm.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)
arch/x86/kvm/svm.c +43 -0
@@ -1088,6 +1088,47 @@ static int avic_ga_log_notifier(u32 ga_treturn 0 ; } +/* +* The default MMIO mask is a single bit (excluding the present bit), +* which could conflict with the memory encryption bit. Check for +* memory encryption support and override the default MMIO mask if +* memory encryption is enabled. +*/ +static __init void svm_adjust_mmio_mask (void ) +{ +unsigned int enc_bit, mask_bit; +u64 msr, mask; + +/* If there is no memory encryption support, use existing mask */ +if (cpuid_eax (0x80000000 ) <0x8000001f ) +return ; + +/* If memory encryption is not enabled, use existing mask */ +rdmsrl (MSR_K8_SYSCFG , msr); +if (!(msr &MSR_K8_SYSCFG_MEM_ENCRYPT )) +return ; + + enc_bit =cpuid_ebx (0x8000001f ) &0x3f ; + mask_bit = boot_cpu_data.x86_phys_bits; + +/* Increment the mask bit if it is the same as the encryption bit */ +if (enc_bit == mask_bit) + mask_bit++; + +/* +* If the mask bit location is below 52, then some bits above the +* physical addressing limit will always be reserved, so use the +* rsvd_bits() function to generate the mask. This mask, along with +* the present bit, will be used to generate a page fault with +* PFER.RSV = 1. +* +* If the mask bit location is 52 (or above), then clear the mask. +*/ + mask = (mask_bit <52 ) ?rsvd_bits (mask_bit,51 ) |PT_PRESENT_MASK :0 ; + +kvm_mmu_set_mmio_spte_mask (mask,PT_WRITABLE_MASK |PT_USER_MASK ); +} +static __init int svm_hardware_setup (void ) {int cpu;
@@ -1123,6 +1164,8 @@ static __init int svm_hardware_setup(voikvm_enable_efer_bits (EFER_SVME |EFER_LMSLE ); } +svm_adjust_mmio_mask (); +for_each_possible_cpu (cpu) { r =svm_cpu_init (cpu);if (r)
Re: [PATCH 4.14 057/126] KVM: SVM: Override default MMIO mask if memory encryption is enabled
Has this been tested on the stable kernels? There's a recent bug report[*] that suggests the 4.19 backport of this patch may be causing issues.
[*] https://bugzilla.kernel.org/show_bug.cgi?id=206795
Quoted 86 lines · Greg Kroah-Hartman
From: Tom Lendacky <[email protected]>
commit
52918ed5fcf05d97d257f4131e19479da18f5d16upstream.The KVM MMIO support uses bit 51 as the reserved bit to cause nested page faults when a guest performs MMIO. The AMD memory encryption support uses a CPUID function to define the encryption bit position. Given this, it is possible that these bits can conflict.
Use
svm_hardware_setup()to override the MMIO mask if memory encryption support is enabled. Various checks are performed to ensure that the mask is properly defined andrsvd_bits()is used to generate the new mask (as was done prior to the change that necessitated this patch).Fixes 28a1f3ac1d0c ("kvm: x86: Set highest physical address bits in non-present/reserved SPTEs")Suggested-by Sean Christopherson <[email protected]>Reviewed-by Sean Christopherson <[email protected]>Signed-off-by Tom Lendacky <[email protected]>Signed-off-by Paolo Bonzini <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/x86/kvm/svm.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)arch/x86/kvm/svm.c +43
-0@@ -1088,6 +1088,47 @@ static int avic_ga_log_notifier(u32 ga_treturn 0 ; } +/* +* The default MMIO mask is a single bit (excluding the present bit), +* which could conflict with the memory encryption bit. Check for +* memory encryption support and override the default MMIO mask if +* memory encryption is enabled. +*/ +static __init void svm_adjust_mmio_mask (void ) +{ +unsigned int enc_bit, mask_bit; +u64 msr, mask; + +/* If there is no memory encryption support, use existing mask */ +if (cpuid_eax (0x80000000 ) <0x8000001f ) +return ; + +/* If memory encryption is not enabled, use existing mask */ +rdmsrl (MSR_K8_SYSCFG , msr); +if (!(msr &MSR_K8_SYSCFG_MEM_ENCRYPT )) +return ; + + enc_bit =cpuid_ebx (0x8000001f ) &0x3f ; + mask_bit = boot_cpu_data.x86_phys_bits; + +/* Increment the mask bit if it is the same as the encryption bit */ +if (enc_bit == mask_bit) + mask_bit++; + +/* +* If the mask bit location is below 52, then some bits above the +* physical addressing limit will always be reserved, so use the +* rsvd_bits() function to generate the mask. This mask, along with +* the present bit, will be used to generate a page fault with +* PFER.RSV = 1. +* +* If the mask bit location is 52 (or above), then clear the mask. +*/ + mask = (mask_bit <52 ) ?rsvd_bits (mask_bit,51 ) |PT_PRESENT_MASK :0 ; + +kvm_mmu_set_mmio_spte_mask (mask,PT_WRITABLE_MASK |PT_USER_MASK ); +} +static __init int svm_hardware_setup (void ) {int cpu;@@ -1123,6 +1164,8 @@ static __init int svm_hardware_setup(voikvm_enable_efer_bits (EFER_SVME |EFER_LMSLE ); } +svm_adjust_mmio_mask (); +for_each_possible_cpu (cpu) { r =svm_cpu_init (cpu);if (r)
Re: [PATCH 4.14 057/126] KVM: SVM: Override default MMIO mask if memory encryption is enabled
Quoted 2 lines · Sean Christopherson
Has this been tested on the stable kernels? There's a recent bug report[*] that suggests the 4.19 backport of this patch may be causing issues.
I missed this went the stable patches went by... when backported to the older version of kvm_mmu_set_mmio_spte_mask() in the stable kernels (4.14 and 4.19), the call should have been:
kvm_mmu_set_mmio_spte_mask(mask, mask) and not:
kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);
The call in the original upstream patch was:
kvm_mmu_set_mmio_spte_mask(mask, mask, PT_WRITABLE_MASK | PT_USER_MASK);
Tom
Quoted 91 lines
Quoted 86 lines · Greg Kroah-Hartman
From: Tom Lendacky <[email protected]>
commit
52918ed5fcf05d97d257f4131e19479da18f5d16upstream.The KVM MMIO support uses bit 51 as the reserved bit to cause nested page faults when a guest performs MMIO. The AMD memory encryption support uses a CPUID function to define the encryption bit position. Given this, it is possible that these bits can conflict.
Use
svm_hardware_setup()to override the MMIO mask if memory encryption support is enabled. Various checks are performed to ensure that the mask is properly defined andrsvd_bits()is used to generate the new mask (as was done prior to the change that necessitated this patch).Fixes 28a1f3ac1d0c ("kvm: x86: Set highest physical address bits in non-present/reserved SPTEs")Suggested-by Sean Christopherson <[email protected]>Reviewed-by Sean Christopherson <[email protected]>Signed-off-by Tom Lendacky <[email protected]>Signed-off-by Paolo Bonzini <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/x86/kvm/svm.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)arch/x86/kvm/svm.c +43
-0@@ -1088,6 +1088,47 @@ static int avic_ga_log_notifier(u32 ga_treturn 0 ; } +/* +* The default MMIO mask is a single bit (excluding the present bit), +* which could conflict with the memory encryption bit. Check for +* memory encryption support and override the default MMIO mask if +* memory encryption is enabled. +*/ +static __init void svm_adjust_mmio_mask (void ) +{ +unsigned int enc_bit, mask_bit; +u64 msr, mask; + +/* If there is no memory encryption support, use existing mask */ +if (cpuid_eax (0x80000000 ) <0x8000001f ) +return ; + +/* If memory encryption is not enabled, use existing mask */ +rdmsrl (MSR_K8_SYSCFG , msr); +if (!(msr &MSR_K8_SYSCFG_MEM_ENCRYPT )) +return ; + + enc_bit =cpuid_ebx (0x8000001f ) &0x3f ; + mask_bit = boot_cpu_data.x86_phys_bits; + +/* Increment the mask bit if it is the same as the encryption bit */ +if (enc_bit == mask_bit) + mask_bit++; + +/* +* If the mask bit location is below 52, then some bits above the +* physical addressing limit will always be reserved, so use the +* rsvd_bits() function to generate the mask. This mask, along with +* the present bit, will be used to generate a page fault with +* PFER.RSV = 1. +* +* If the mask bit location is 52 (or above), then clear the mask. +*/ + mask = (mask_bit <52 ) ?rsvd_bits (mask_bit,51 ) |PT_PRESENT_MASK :0 ; + +kvm_mmu_set_mmio_spte_mask (mask,PT_WRITABLE_MASK |PT_USER_MASK ); +} +static __init int svm_hardware_setup (void ) {int cpu;@@ -1123,6 +1164,8 @@ static __init int svm_hardware_setup(voikvm_enable_efer_bits (EFER_SVME |EFER_LMSLE ); } +svm_adjust_mmio_mask (); +for_each_possible_cpu (cpu) { r =svm_cpu_init (cpu);if (r)
Re: [PATCH 4.14 057/126] KVM: SVM: Override default MMIO mask if memory encryption is enabled
Quoted 8 lines · Tom Lendacky
Quoted 2 lines · Sean Christopherson
Has this been tested on the stable kernels? There's a recent bug report[*] that suggests the 4.19 backport of this patch may be causing issues.
I missed this went the stable patches went by... when backported to the older version of
kvm_mmu_set_mmio_spte_mask()in the stable kernels (4.14 and 4.19), the call should have been:
Quoted 7 lines
kvm_mmu_set_mmio_spte_mask(mask, mask)and not:
kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);The call in the original upstream patch was:
kvm_mmu_set_mmio_spte_mask(mask, mask, PT_WRITABLE_MASK | PT_USER_MASK);
Greg,
I should have asked in the earlier email... how do you want to address this?
Thanks,
Tom
Quoted 94 lines
Tom
Quoted 91 lines
Quoted 86 lines · Greg Kroah-Hartman
From: Tom Lendacky <[email protected]>
commit
52918ed5fcf05d97d257f4131e19479da18f5d16upstream.The KVM MMIO support uses bit 51 as the reserved bit to cause nested page faults when a guest performs MMIO. The AMD memory encryption support uses a CPUID function to define the encryption bit position. Given this, it is possible that these bits can conflict.
Use
svm_hardware_setup()to override the MMIO mask if memory encryption support is enabled. Various checks are performed to ensure that the mask is properly defined andrsvd_bits()is used to generate the new mask (as was done prior to the change that necessitated this patch).Fixes 28a1f3ac1d0c ("kvm: x86: Set highest physical address bits in non-present/reserved SPTEs")Suggested-by Sean Christopherson <[email protected]>Reviewed-by Sean Christopherson <[email protected]>Signed-off-by Tom Lendacky <[email protected]>Signed-off-by Paolo Bonzini <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>--- arch/x86/kvm/svm.c | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+)arch/x86/kvm/svm.c +43
-0@@ -1088,6 +1088,47 @@ static int avic_ga_log_notifier(u32 ga_treturn 0 ; } +/* +* The default MMIO mask is a single bit (excluding the present bit), +* which could conflict with the memory encryption bit. Check for +* memory encryption support and override the default MMIO mask if +* memory encryption is enabled. +*/ +static __init void svm_adjust_mmio_mask (void ) +{ +unsigned int enc_bit, mask_bit; +u64 msr, mask; + +/* If there is no memory encryption support, use existing mask */ +if (cpuid_eax (0x80000000 ) <0x8000001f ) +return ; + +/* If memory encryption is not enabled, use existing mask */ +rdmsrl (MSR_K8_SYSCFG , msr); +if (!(msr &MSR_K8_SYSCFG_MEM_ENCRYPT )) +return ; + + enc_bit =cpuid_ebx (0x8000001f ) &0x3f ; + mask_bit = boot_cpu_data.x86_phys_bits; + +/* Increment the mask bit if it is the same as the encryption bit */ +if (enc_bit == mask_bit) + mask_bit++; + +/* +* If the mask bit location is below 52, then some bits above the +* physical addressing limit will always be reserved, so use the +* rsvd_bits() function to generate the mask. This mask, along with +* the present bit, will be used to generate a page fault with +* PFER.RSV = 1. +* +* If the mask bit location is 52 (or above), then clear the mask. +*/ + mask = (mask_bit <52 ) ?rsvd_bits (mask_bit,51 ) |PT_PRESENT_MASK :0 ; + +kvm_mmu_set_mmio_spte_mask (mask,PT_WRITABLE_MASK |PT_USER_MASK ); +} +static __init int svm_hardware_setup (void ) {int cpu;@@ -1123,6 +1164,8 @@ static __init int svm_hardware_setup(voikvm_enable_efer_bits (EFER_SVME |EFER_LMSLE ); } +svm_adjust_mmio_mask (); +for_each_possible_cpu (cpu) { r =svm_cpu_init (cpu);if (r)
Greg Kroah-Hartman
maintainerRe: [PATCH 4.14 057/126] KVM: SVM: Override default MMIO mask if memory encryption is enabled
Quoted 13 lines · Tom Lendacky
Quoted 12 lines · Tom Lendacky
Quoted 2 lines · Sean Christopherson
Has this been tested on the stable kernels? There's a recent bug report[*] that suggests the 4.19 backport of this patch may be causing issues.
I missed this went the stable patches went by... when backported to the older version of
kvm_mmu_set_mmio_spte_mask()in the stable kernels (4.14 and 4.19), the call should have been:
kvm_mmu_set_mmio_spte_mask(mask, mask)and not:
kvm_mmu_set_mmio_spte_mask(mask, PT_WRITABLE_MASK | PT_USER_MASK);
Quoted 7 lines
Quoted 3 lines
The call in the original upstream patch was:
kvm_mmu_set_mmio_spte_mask(mask, mask, PT_WRITABLE_MASK | PT_USER_MASK);Greg,
I should have asked in the earlier email... how do you want to address this?
I will fix this up now, thanks for pointing out what I got wrong...
greg k-h
Greg Kroah-Hartman
maintainerPATCH 58/126 KVM: Check for a bad hva before dropping into the ghc slow path
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit fcfbc617547fc6d9552cb6c1c563b6a90ee98085 upstream.
When reading/writing using the guest/host cache, check for a bad hva before checking for a NULL memslot, which triggers the slow path for handing cross-page accesses. Because the memslot is nullified on error by __kvm_gfn_to_hva_cache_init(), if the bad hva is encountered after crossing into a new page, then the kvm_{read,write}_guest() slow path could potentially write/access the first chunk prior to detecting the bad hva.
Arguably, performing a partial access is semantically correct from an architectural perspective, but that behavior is certainly not intended. In the original implementation, memslot was not explicitly nullified and therefore the partial access behavior varied based on whether the memslot itself was null, or if the hva was simply bad. The current behavior was introduced as a seemingly unintentional side effect in commit f1b9dd5eb86c ("kvm: Disallow wraparound in kvm_gfn_to_hva_cache_init"), which justified the change with "since some callers don't check the return code from this function, it sit seems prudent to clear ghc->memslot in the event of an error".
Regardless of intent, the partial access is dependent on _not_ checking the result of the cache initialization, which is arguably a bug in its own right, at best simply weird.
--- virt/kvm/kvm_main.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
virt/kvm/kvm_main.c +6 -6
@@ -2027,12 +2027,12 @@ int kvm_write_guest_offset_cached(structif (slots->generation != ghc->generation)__kvm_gfn_to_hva_cache_init (slots, ghc, ghc->gpa, ghc->len); -if (unlikely (!ghc->memslot)) -return kvm_write_guest (kvm, gpa, data, len); -if (kvm_is_error_hva (ghc->hva))return -EFAULT ; +if (unlikely (!ghc->memslot)) +return kvm_write_guest (kvm, gpa, data, len); + r =__copy_to_user ((void __user *)ghc->hva + offset, data, len);if (r)return -EFAULT ;
@@ -2060,12 +2060,12 @@ int kvm_read_guest_cached(struct kvm *kvif (slots->generation != ghc->generation)__kvm_gfn_to_hva_cache_init (slots, ghc, ghc->gpa, ghc->len); -if (unlikely (!ghc->memslot)) -return kvm_read_guest (kvm, ghc->gpa, data, len); -if (kvm_is_error_hva (ghc->hva))return -EFAULT ; +if (unlikely (!ghc->memslot)) +return kvm_read_guest (kvm, ghc->gpa, data, len); + r =__copy_from_user (data, (void __user *)ghc->hva, len);if (r)return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 59/126 tuntap: correctly set SOCKWQ_ASYNC_NOSPACE
In reply to Greg Kroah-HartmanFrom: Jason Wang <[email protected]>
commit 2f3ab6221e4c87960347d65c7cab9bd917d1f637 upstream.
When link is down, writes to the device might fail with -EIO. Userspace needs an indication when the status is resolved. As a fix, tun_net_open() attempts to wake up writers - but that is only effective if SOCKWQ_ASYNC_NOSPACE has been set in the past. This is not the case of vhost_net which only poll for EPOLLOUT after it meets errors during sendmsg().
This patch fixes this by making sure SOCKWQ_ASYNC_NOSPACE is set when socket is not writable or device is down to guarantee EPOLLOUT will be raised in either tun_chr_poll() or tun_sock_write_space() after device is up.
--- drivers/net/tun.c | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
drivers/net/tun.c +15 -4
@@ -1134,6 +1134,13 @@ static void tun_net_init(struct net_devi dev->max_mtu =MAX_MTU - dev->hard_header_len; } +static bool tun_sock_writeable (struct tun_struct *tun,struct tun_file *tfile) +{ +struct sock *sk = tfile->socket.sk; + +return (tun->dev->flags &IFF_UP ) &&sock_writeable (sk); +} +/* Character device part */ /* Poll */
@@ -1156,10 +1163,14 @@ static unsigned int tun_chr_poll(structif (!skb_array_empty (&tfile->tx_array)) mask |=POLLIN |POLLRDNORM ; -if (tun->dev->flags &IFF_UP && - (sock_writeable (sk) || - (!test_and_set_bit (SOCKWQ_ASYNC_NOSPACE , &sk->sk_socket->flags) && -sock_writeable (sk)))) +/* Make sure SOCKWQ_ASYNC_NOSPACE is set if not writable to +* guarantee EPOLLOUT to be raised by either here or +* tun_sock_write_space(). Then process could get notification +* after it writes to a down device and meets -EIO. +*/ +if (tun_sock_writeable (tun, tfile) || + (!test_and_set_bit (SOCKWQ_ASYNC_NOSPACE , &sk->sk_socket->flags) && +tun_sock_writeable (tun, tfile))) mask |=POLLOUT |POLLWRNORM ;if (tun->dev->reg_state !=NETREG_REGISTERED )
Greg Kroah-Hartman
maintainerPATCH 60/126 drivers: net: xgene: Fix the order of the arguments of alloc_etherdev_mqs()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 5a44c71ccda60a50073c5d7fe3f694cdfa3ab0c2 upstream.
'alloc_etherdev_mqs()' expects first 'tx', then 'rx'. The semantic here looks reversed.
Reorder the arguments passed to 'alloc_etherdev_mqs()' in order to keep the correct semantic.
In fact, this is a no-op because both XGENE_NUM_[RT]X_RING are 8.
--- drivers/net/ethernet/apm/xgene/xgene_enet_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/apm/xgene/xgene_enet_main.c +1 -1
@@ -2034,7 +2034,7 @@ static int xgene_enet_probe(struct platfint ret; ndev =alloc_etherdev_mqs (sizeof (struct xgene_enet_pdata ), -XGENE_NUM_RX_RING ,XGENE_NUM_TX_RING ); +XGENE_NUM_TX_RING ,XGENE_NUM_RX_RING );if (!ndev)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 61/126 kprobes: Set unoptimized flag after unoptimizing code
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
commit f66c0447cca1281116224d474cdb37d6a18e4b5b upstream.
Set the unoptimized flag after confirming the code is completely unoptimized. Without this fix, when a kprobe hits the intermediate modified instruction (the first byte is replaced by an INT3, but later bytes can still be a jump address operand) while unoptimizing, it can return to the middle byte of the modified code, which causes an invalid instruction exception in the kernel.
Usually, this is a rare case, but if we put a probe on the function call while text patching, it always causes a kernel panic as below:
# echo p text_poke+5 > kprobe_events # echo 1 > events/kprobes/enable # echo 0 > events/kprobes/enable
invalid opcode: 0000 [#1] PREEMPT SMP PTI
RIP: 0010:text_poke+0x9/0x50 Call Trace: arch_unoptimize_kprobe+0x22/0x28 arch_unoptimize_kprobes+0x39/0x87 kprobe_optimizer+0x6e/0x290 process_one_work+0x2a0/0x610 worker_thread+0x28/0x3d0 ? process_one_work+0x610/0x610 kthread+0x10d/0x130 ? kthread_park+0x80/0x80 ret_from_fork+0x3a/0x50
text_poke() is used for patching the code in optprobes.
This can happen even if we blacklist text_poke() and other functions, because there is a small time window during which we show the intermediate code to other CPUs.
[ mingo: Edited the changelog. ]
--- kernel/kprobes.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/kprobes.c +3 -1
@@ -523,6 +523,8 @@ static void do_unoptimize_kprobes(void)arch_unoptimize_kprobes (&unoptimizing_list, &freeing_list);/* Loop free_list for disarming */ list_for_each_entry_safe (op, tmp, &freeing_list, list) { +/* Switching from detour code to origin */ + op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ;/* Disarm probes if marked disabled */ if (kprobe_disabled (&op->kp))arch_disarm_kprobe (&op->kp);
@@ -662,6 +664,7 @@ static void force_unoptimize_kprobe(stru {lockdep_assert_cpus_held ();arch_unoptimize_kprobe (op); + op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ;if (kprobe_disabled (&op->kp))arch_disarm_kprobe (&op->kp); }
@@ -689,7 +692,6 @@ static void unoptimize_kprobe(struct kprreturn ; } - op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ;if (!list_empty (&op->list)) {/* Dequeue from the optimization queue */ list_del_init (&op->list);
Greg Kroah-Hartman
maintainerPATCH 62/126 perf hists browser: Restore ESC as "Zoom out" of DSO/thread/etc
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
commit 3f7774033e6820d25beee5cf7aefa11d4968b951 upstream.
We need to set actions->ms.map since 599a2f38a989 ("perf hists browser:
Check sort keys before hot key actions"), as in that patch we bail out if map is NULL.
--- tools/perf/ui/browsers/hists.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/ui/browsers/hists.c +1 -0
@@ -3142,6 +3142,7 @@ static int perf_evsel__hists_browse(strucontinue ; } + actions->ms.map = map; top =pstack__peek (browser->pstack);if (top == &browser->hists->dso_filter) {/*
Greg Kroah-Hartman
maintainerPATCH 63/126 mm/huge_memory.c: use head to check huge zero page
In reply to Greg Kroah-HartmanFrom: Wei Yang <[email protected]>
commit cb829624867b5ab10bc6a7036d183b1b82bfe9f8 upstream.
The page could be a tail page, if this is the case, this BUG_ON will never be triggered.
--- mm/huge_memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/huge_memory.c +1 -1
@@ -2561,7 +2561,7 @@ int split_huge_page_to_list(struct pageunsigned long flags;pgoff_t end; -VM_BUG_ON_PAGE (is_huge_zero_page (page), page); +VM_BUG_ON_PAGE (is_huge_zero_page (head), head);VM_BUG_ON_PAGE (!PageLocked (page), page);VM_BUG_ON_PAGE (!PageCompound (page), page);
Greg Kroah-Hartman
maintainerPATCH 64/126 mm, thp: fix defrag setting if newline is not used
In reply to Greg Kroah-HartmanFrom: David Rientjes <[email protected]>
commit f42f25526502d851d0e3ca1e46297da8aafce8a7 upstream.
If thp defrag setting "defer" is used and a newline is *not* used when writing to the sysfs file, this is interpreted as the "defer+madvise" option.
This is because we do prefix matching and if five characters are written without a newline, the current code ends up comparing to the first five bytes of the "defer+madvise" option and using that instead.
Use the more appropriate sysfs_streq() that handles the trailing newline for us. Since this doubles as a nice cleanup, do it in enabled_store() as well.
The current implementation relies on prefix matching: the number of bytes compared is either the number of bytes written or the length of the option being compared. With a newline, "defer\n" does not match "defer+"madvise"; without a newline, however, "defer" is considered to match "defer+madvise" (prefix matching is only comparing the first five bytes). End result is that writing "defer" is broken unless it has an additional trailing character.
This means that writing "madv" in the past would match and set "madvise". With strict checking, that no longer is the case but it is unlikely anybody is currently doing this.
--- mm/huge_memory.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-)
mm/huge_memory.c +8 -16
@@ -163,16 +163,13 @@ static ssize_t enabled_store(struct kobj {ssize_t ret = count; -if (!memcmp ("always" , buf, -min (sizeof ("always" )-1 , count))) { +if (sysfs_streq (buf,"always" )) {clear_bit (TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG , &transparent_hugepage_flags);set_bit (TRANSPARENT_HUGEPAGE_FLAG , &transparent_hugepage_flags); - }else if (!memcmp ("madvise" , buf, -min (sizeof ("madvise" )-1 , count))) { + }else if (sysfs_streq (buf,"madvise" )) {clear_bit (TRANSPARENT_HUGEPAGE_FLAG , &transparent_hugepage_flags);set_bit (TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG , &transparent_hugepage_flags); - }else if (!memcmp ("never" , buf, -min (sizeof ("never" )-1 , count))) { + }else if (sysfs_streq (buf,"never" )) {clear_bit (TRANSPARENT_HUGEPAGE_FLAG , &transparent_hugepage_flags);clear_bit (TRANSPARENT_HUGEPAGE_REQ_MADV_FLAG , &transparent_hugepage_flags); }else
@@ -236,32 +233,27 @@ static ssize_t defrag_store(struct kobje struct kobj_attribute *attr, const char *buf, size_t count) { - if (!memcmp("always", buf, - min(sizeof("always")-1, count))) { + if (sysfs_streq(buf, "always")) { clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags); set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags); - } else if (!memcmp("defer+madvise", buf, -min (sizeof ("defer+madvise" )-1 , count))) { + } else if (sysfs_streq(buf, "defer+madvise")) { clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags); set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags); - }else if (!memcmp ("defer" , buf, -min (sizeof ("defer" )-1 , count))) { + } else if (sysfs_streq(buf, "defer")) { clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags); set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags); - }else if (!memcmp ("madvise" , buf, -min (sizeof ("madvise" )-1 , count))) { + } else if (sysfs_streq(buf, "madvise")) { clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags); set_bit(TRANSPARENT_HUGEPAGE_DEFRAG_REQ_MADV_FLAG, &transparent_hugepage_flags); - }else if (!memcmp ("never" , buf, -min (sizeof ("never" )-1 , count))) { + } else if (sysfs_streq(buf, "never")) { clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_DIRECT_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_FLAG, &transparent_hugepage_flags); clear_bit(TRANSPARENT_HUGEPAGE_DEFRAG_KSWAPD_OR_MADV_FLAG, &transparent_hugepage_flags);
Greg Kroah-Hartman
maintainerPATCH 65/126 Revert "char/random: silence a lockdep splat with printk()"
In reply to Greg Kroah-HartmanThis reverts commit 28820c5802f9f83c655ab09ccae8289103ce1490 which is commit 1b710b1b10eff9d46666064ea25f079f70bc67a8 upstream.
It causes problems here just like it did in 4.19.y and odds are it will be reverted upstream as well.
--- drivers/char/random.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/char/random.c +2 -3
@@ -1598,9 +1598,8 @@ static void _warn_unseeded_randomness(co print_once = true;#endif if (__ratelimit (&unseeded_warning)) -printk_deferred (KERN_NOTICE "random: %s called from %pS " -"with crng_init=%d\n" , func_name, caller, - crng_init); +pr_notice ("random: %s called from %pS with crng_init=%d\n" , + func_name, caller, crng_init); }/*
Greg Kroah-Hartman
maintainerPATCH 66/126 audit: always check the netlink payload length in audit_receive_msg()
In reply to Greg Kroah-HartmanFrom: Paul Moore <[email protected]>
[ Upstream commit 756125289285f6e55a03861bf4b6257aa3d19a93 ]
This patch ensures that we always check the netlink payload length in audit_receive_msg() before we take any action on the payload itself.
--- kernel/audit.c | 40 +++++++++++++++++++++------------------- 1 file changed, 21 insertions(+), 19 deletions(-)
kernel/audit.c +21 -19
@@ -1067,13 +1067,11 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_featureaudit_log_end (ab); } -static int audit_set_feature (struct sk_buff *skb) +static int audit_set_feature (struct audit_features *uaf) { -struct audit_features *uaf;int i;BUILD_BUG_ON (AUDIT_LAST_FEATURE +1 >ARRAY_SIZE (audit_feature_names)); - uaf =nlmsg_data (nlmsg_hdr (skb));/* if there is ever a version 2 we should handle that here */
@@ -1141,6 +1139,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) {u32 seq;void *data; +int data_len;int err;struct audit_buffer *ab;u16 msg_type = nlh->nlmsg_type;
@@ -1154,6 +1153,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) seq = nlh->nlmsg_seq; data =nlmsg_data (nlh); + data_len =nlmsg_len (nlh);switch (msg_type) {case AUDIT_GET : {
@@ -1177,7 +1177,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)struct audit_status s;memset (&s,0 ,sizeof (s));/* guard against past and future API changes */ -memcpy (&s, data,min_t (size_t,sizeof (s),nlmsg_len (nlh))); +memcpy (&s, data,min_t (size_t,sizeof (s), data_len));if (s.mask &AUDIT_STATUS_ENABLED ) { err =audit_set_enabled (s.enabled);if (err <0 )
@@ -1281,7 +1281,9 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)return err;break ;case AUDIT_SET_FEATURE : - err =audit_set_feature (skb); +if (data_len <sizeof (struct audit_features )) +return -EINVAL ; + err =audit_set_feature (data);if (err)return err;break ;
@@ -1293,6 +1295,8 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) err =audit_filter (msg_type,AUDIT_FILTER_USER );if (err ==1 ) {/* match or error */ +char *str = data; + err =0 ;if (msg_type ==AUDIT_USER_TTY ) { err =tty_audit_push ();
@@ -1300,26 +1304,24 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)break ; }audit_log_common_recv_msg (&ab, msg_type); -if (msg_type !=AUDIT_USER_TTY ) +if (msg_type !=AUDIT_USER_TTY ) { +/* ensure NULL termination */ + str[data_len -1 ] ='\0' ;audit_log_format (ab," msg='%.*s'" ,AUDIT_MESSAGE_TEXT_MAX , - (char *)data); -else { -int size; - + str); + }else {audit_log_format (ab," data=" ); - size =nlmsg_len (nlh); -if (size >0 && - ((unsigned char *)data)[size -1 ] =='\0' ) - size--; -audit_log_n_untrustedstring (ab, data, size); +if (data_len >0 && str[data_len -1 ] =='\0' ) + data_len--; +audit_log_n_untrustedstring (ab, str, data_len); }audit_log_end (ab); }break ;case AUDIT_ADD_RULE :case AUDIT_DEL_RULE : -if (nlmsg_len (nlh) <sizeof (struct audit_rule_data )) +if (data_len <sizeof (struct audit_rule_data ))return -EINVAL ;if (audit_enabled ==AUDIT_LOCKED ) {audit_log_common_recv_msg (&ab,AUDIT_CONFIG_CHANGE );
@@ -1327,7 +1329,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)audit_log_end (ab);return -EPERM ; } - err =audit_rule_change (msg_type, seq, data,nlmsg_len (nlh)); + err =audit_rule_change (msg_type, seq, data, data_len);break ;case AUDIT_LIST_RULES : err =audit_list_rules_send (skb, seq);
@@ -1341,7 +1343,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)case AUDIT_MAKE_EQUIV : {void *bufp = data;u32 sizes[2 ]; -size_t msglen =nlmsg_len (nlh); +size_t msglen = data_len;char *old, *new; err = -EINVAL ;
@@ -1417,7 +1419,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)memset (&s,0 ,sizeof (s));/* guard against past and future API changes */ -memcpy (&s, data,min_t (size_t,sizeof (s),nlmsg_len (nlh))); +memcpy (&s, data,min_t (size_t,sizeof (s), data_len));/* check if new data is valid */ if ((s.enabled !=0 && s.enabled !=1 ) || (s.log_passwd !=0 && s.log_passwd !=1 ))
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/126 vhost: Check docket sk_family instead of call getname
In reply to Greg Kroah-HartmanFrom: Eugenio Pérez <[email protected]>
commit 42d84c8490f9f0931786f1623191fcab397c3d64 upstream.
Doing so, we save one call to get data we already have in the struct.
Also, since there is no guarantee that getname use sockaddr_ll parameter beyond its size, we add a little bit of security here. It should do not do beyond MAX_ADDR_LEN, but syzbot found that ax25_getname writes more (72 bytes, the size of full_sockaddr_ax25, versus 20 + 32 bytes of sockaddr_ll + MAX_ADDR_LEN in syzbot repro).
--- drivers/vhost/net.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-)
drivers/vhost/net.c +2 -11
@@ -1025,11 +1025,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)static struct socket *get_raw_socket (int fd) { -struct { -struct sockaddr_ll sa; -char buf[MAX_ADDR_LEN ]; - } uaddr; -int uaddr_len =sizeof uaddr, r; +int r;struct socket *sock =sockfd_lookup (fd, &r);if (!sock)
@@ -1041,12 +1037,7 @@ static struct socket *get_raw_socket(int fd) goto err; } - r = sock->ops->getname (sock, (struct sockaddr *)&uaddr.sa, - &uaddr_len,0 ); -if (r) - goto err; - -if (uaddr.sa.sll_family !=AF_PACKET ) { +if (sock->sk->sk_family !=AF_PACKET ) { r = -EPFNOSUPPORT ; goto err; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/126 x86/mce: Handle varying MCA bank counts
In reply to Greg Kroah-HartmanFrom: Yazen Ghannam <[email protected]>
[ Upstream commit 006c077041dc73b9490fffc4c6af5befe0687110 ]
Linux reads MCG_CAP[Count] to find the number of MCA banks visible to a CPU. Currently, this number is the same for all CPUs and a warning is shown if there is a difference. The number of banks is overwritten with the MCG_CAP[Count] value of each following CPU that boots.
According to the Intel SDM and AMD APM, the MCG_CAP[Count] value gives the number of banks that are available to a "processor implementation". The AMD BKDGs/PPRs further clarify that this value is per core. This value has historically been the same for every core in the system, but that is not an architectural requirement.
Future AMD systems may have different MCG_CAP[Count] values per core, so the assumption that all CPUs will have the same MCG_CAP[Count] value will no longer be valid.
Also, the first CPU to boot will allocate the struct mce_banks[] array using the number of banks based on its MCG_CAP[Count] value. The machine check handler and other functions use the global number of banks to iterate and index into the mce_banks[] array. So it's possible to use an out-of-bounds index on an asymmetric system where a following CPU sees a MCG_CAP[Count] value greater than its predecessors.
Thus, allocate the mce_banks[] array to the maximum number of banks. This will avoid the potential out-of-bounds index since the value of mca_cfg.banks is capped to MAX_NR_BANKS.
Set the value of mca_cfg.banks equal to the max of the previous value and the value for the current CPU. This way mca_cfg.banks will always represent the max number of banks detected on any CPU in the system.
This will ensure that all CPUs will access all the banks that are visible to them. A CPU that can access fewer than the max number of banks will find the registers of the extra banks to be read-as-zero.
Furthermore, print the resulting number of MCA banks in use. Do this in mcheck_late_init() so that the final value is printed after all CPUs have been initialized.
Finally, get bank count from target CPU when doing injection with mce-inject module.
[ bp: Remove out-of-bounds example, passify and cleanup commit message. ]
[jwang: cherry-pick to fix boot warning in arch/x86/kernel/cpu/mcheck/mce.c:1549 in epyc rome server]
--- arch/x86/kernel/cpu/mcheck/mce-inject.c | 14 +++++++------- arch/x86/kernel/cpu/mcheck/mce.c | 22 +++++++--------------- 2 files changed, 14 insertions(+), 22 deletions(-)
arch/x86/kernel/cpu/mcheck/mce-inject.c +7 -7
@@ -46,8 +46,6 @@static struct mce i_mce;static struct dentry *dfs_inj; -static u8 n_banks; -#define MAX_FLAG_OPT_SIZE 4#define NBCFG 0x44
@@ -570,9 +568,15 @@ static void do_inject(void)static int inj_bank_set (void *data,u64 val) {struct mce *m = (struct mce *)data; +u8 n_banks; +u64 cap; + +/* Get bank count on target CPU so we can handle non-uniform values. */ +rdmsrl_on_cpu (m->extcpu,MSR_IA32_MCG_CAP , &cap); + n_banks = cap &MCG_BANKCNT_MASK ;if (val >= n_banks) { -pr_err ("Non-existent MCE bank: %llu\n" , val); +pr_err ("MCA bank %llu non-existent on CPU%d\n" , val, m->extcpu);return -EINVAL ; }
@@ -665,10 +669,6 @@ static struct dfs_node {static int __init debugfs_init (void ) {unsigned int i; -u64 cap; - -rdmsrl (MSR_IA32_MCG_CAP , cap); - n_banks = cap &MCG_BANKCNT_MASK ; dfs_inj =debugfs_create_dir ("mce-inject" ,NULL );if (!dfs_inj)
arch/x86/kernel/cpu/mcheck/mce.c +7 -15
@@ -1499,13 +1499,12 @@ EXPORT_SYMBOL_GPL(mce_notify_irq);static int __mcheck_cpu_mce_banks_init (void ) {int i; -u8 num_banks = mca_cfg.banks; - mce_banks =kzalloc (num_banks *sizeof (struct mce_bank ),GFP_KERNEL ); + mce_banks =kcalloc (MAX_NR_BANKS ,sizeof (struct mce_bank ),GFP_KERNEL );if (!mce_banks)return -ENOMEM ; -for (i =0 ; i < num_banks; i++) { +for (i =0 ; i <MAX_NR_BANKS ; i++) {struct mce_bank *b = &mce_banks[i]; b->ctl =-1ULL ;
@@ -1519,28 +1518,19 @@ static int __mcheck_cpu_mce_banks_init(void)*/ static int __mcheck_cpu_cap_init (void ) { -unsigned b;u64 cap; +u8 b;rdmsrl (MSR_IA32_MCG_CAP , cap); b = cap &MCG_BANKCNT_MASK ; -if (!mca_cfg.banks) -pr_info ("CPU supports %d MCE banks\n" , b); - -if (b >MAX_NR_BANKS ) { -pr_warn ("Using only %u machine check banks out of %u\n" , -MAX_NR_BANKS , b); +if (WARN_ON_ONCE (b >MAX_NR_BANKS )) b =MAX_NR_BANKS ; - } -/* Don't support asymmetric configurations today */ -WARN_ON (mca_cfg.banks !=0 && b != mca_cfg.banks); - mca_cfg.banks = b; + mca_cfg.banks =max (mca_cfg.banks, b);if (!mce_banks) {int err =__mcheck_cpu_mce_banks_init (); -if (err)return err; }
@@ -2470,6 +2460,8 @@ EXPORT_SYMBOL_GPL(mcsafe_key);static int __init mcheck_late_init (void ) { +pr_info ("Using %d MCE banks\n" , mca_cfg.banks); +if (mca_cfg.recovery)static_branch_inc (&mcsafe_key);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/126 EDAC/amd64: Set grain per DIMM
In reply to Greg Kroah-HartmanFrom: Yazen Ghannam <[email protected]>
[ Upstream commit 466503d6b1b33be46ab87c6090f0ade6c6011cbc ]
The following commit introduced a warning on error reports without a non-zero grain value.
3724ace582d9 ("EDAC/mc: Fix grain_bits calculation")
The amd64_edac_mod module does not provide a value, so the warning will be given on the first reported memory error.
Set the grain per DIMM to cacheline size (64 bytes). This is the current recommendation.
--- drivers/edac/amd64_edac.c | 1 + 1 file changed, 1 insertion(+)
drivers/edac/amd64_edac.c +1 -0
@@ -2863,6 +2863,7 @@ static int init_csrows(struct mem_ctl_info *mci) dimm = csrow->channels[j]->dimm; dimm->mtype = pvt->dram_type; dimm->edac_mode = edac_mode; + dimm->grain =64 ; } }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/126 net: dsa: bcm_sf2: Forcibly configure IMP port for 1Gb/sec
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 98c5f7d44fef309e692c24c6d71131ee0f0871fb ]
We are still experiencing some packet loss with the existing advanced congestion buffering (ACB) settings with the IMP port configured for 2Gb/sec, so revert to conservative link speeds that do not produce packet loss until this is resolved.
--- drivers/net/dsa/bcm_sf2.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/dsa/bcm_sf2.c +1 -2
@@ -138,8 +138,7 @@ static void bcm_sf2_imp_setup(struct dsa_switch *ds, int port)/* Force link status for IMP port */ reg =core_readl (priv, offset); reg |= (MII_SW_OR |LINK_STS ); -if (priv->type ==BCM7278_DEVICE_ID ) - reg |=GMII_SPEED_UP_2G ; + reg &= ~GMII_SPEED_UP_2G ;core_writel (priv, reg, offset);/* Enable Broadcast, Multicast, Unicast forwarding to IMP port */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 71/126 RDMA/core: Fix pkey and port assignment in get_new_pps
In reply to Greg Kroah-HartmanFrom: Maor Gottlieb <[email protected]>
[ Upstream commit 801b67f3eaafd3f2ec8b65d93142d4ffedba85df ]
When port is part of the modify mask, then we should take it from the qp_attr and not from the old pps. Same for PKEY. Otherwise there are panics in some configurations:
RIP: 0010:get_pkey_idx_qp_list+0x50/0x80 [ib_core] Code: c7 18 e8 13 04 30 ef 0f b6 43 06 48 69 c0 b8 00 00 00 48 03 85 a0 04 00 00 48 8b 50 20 48 8d 48 20 48 39 ca 74 1a 0f b7 73 04 <66> 39 72 10 75 08 eb 10 66 39 72 10 74 0a 48 8b 12 48 39 ca 75 f2 RSP: 0018:ffffafb3480932f0 EFLAGS: 00010203 RAX: ffff98059ababa10 RBX: ffff980d926e8cc0 RCX: ffff98059ababa30 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff98059ababa28 RBP: ffff98059b940000 R08: 00000000000310c0 R09: ffff97fe47c07480 R10: 0000000000000036 R11: 0000000000000200 R12: 0000000000000071 R13: ffff98059b940000 R14: ffff980d87f948a0 R15: 0000000000000000 FS: 00007f88deb31740(0000) GS:ffff98059f600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000853e26001 CR4: 00000000001606e0 Call Trace: port_pkey_list_insert+0x3d/0x1b0 [ib_core] ? kmem_cache_alloc_trace+0x215/0x220 ib_security_modify_qp+0x226/0x3a0 [ib_core] _ib_modify_qp+0xcf/0x390 [ib_core] ipoib_init_qp+0x7f/0x200 [ib_ipoib] ? rvt_modify_port+0xd0/0xd0 [rdmavt] ? ib_find_pkey+0x99/0xf0 [ib_core] ipoib_ib_dev_open_default+0x1a/0x200 [ib_ipoib] ipoib_ib_dev_open+0x96/0x130 [ib_ipoib] ipoib_open+0x44/0x130 [ib_ipoib] __dev_open+0xd1/0x160 __dev_change_flags+0x1ab/0x1f0 dev_change_flags+0x23/0x60 do_setlink+0x328/0xe30 ? __nla_validate_parse+0x54/0x900 __rtnl_newlink+0x54e/0x810 ? __alloc_pages_nodemask+0x17d/0x320 ? page_fault+0x30/0x50 ? _cond_resched+0x15/0x30 ? kmem_cache_alloc_trace+0x1c8/0x220 rtnl_newlink+0x43/0x60 rtnetlink_rcv_msg+0x28f/0x350 ? kmem_cache_alloc+0x1fb/0x200 ? _cond_resched+0x15/0x30 ? __kmalloc_node_track_caller+0x24d/0x2d0 ? rtnl_calcit.isra.31+0x120/0x120 netlink_rcv_skb+0xcb/0x100 netlink_unicast+0x1e0/0x340 netlink_sendmsg+0x317/0x480 ? __check_object_size+0x48/0x1d0 sock_sendmsg+0x65/0x80 ____sys_sendmsg+0x223/0x260 ? copy_msghdr_from_user+0xdc/0x140 ___sys_sendmsg+0x7c/0xc0 ? skb_dequeue+0x57/0x70 ? __inode_wait_for_writeback+0x75/0xe0 ? fsnotify_grab_connector+0x45/0x80 ? __dentry_kill+0x12c/0x180 __sys_sendmsg+0x58/0xa0 do_syscall_64+0x5b/0x200 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f88de467f10
--- drivers/infiniband/core/security.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/infiniband/core/security.c +8 -4
@@ -339,11 +339,15 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,return NULL ;if (qp_attr_mask &IB_QP_PORT ) - new_pps->main.port_num = - (qp_pps) ? qp_pps->main.port_num : qp_attr->port_num; + new_pps->main.port_num = qp_attr->port_num; +else if (qp_pps) + new_pps->main.port_num = qp_pps->main.port_num; +if (qp_attr_mask &IB_QP_PKEY_INDEX ) - new_pps->main.pkey_index = (qp_pps) ? qp_pps->main.pkey_index : - qp_attr->pkey_index; + new_pps->main.pkey_index = qp_attr->pkey_index; +else if (qp_pps) + new_pps->main.pkey_index = qp_pps->main.pkey_index; +if ((qp_attr_mask &IB_QP_PKEY_INDEX ) && (qp_attr_mask &IB_QP_PORT )) new_pps->main.state =IB_PORT_PKEY_VALID ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 72/126 RDMA/core: Fix use of logical OR in get_new_pps
In reply to Greg Kroah-HartmanFrom: Nathan Chancellor <[email protected]>
[ Upstream commit 4ca501d6aaf21de31541deac35128bbea8427aa6 ]
Clang warns:
../drivers/infiniband/core/security.c:351:41: warning: converting the enum constant to a boolean [-Wint-in-bool-context]
if (!(qp_attr_mask & (IB_QP_PKEY_INDEX || IB_QP_PORT)) && qp_pps) {
^1 warning generated.
A bitwise OR should have been used instead.
--- drivers/infiniband/core/security.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/security.c +1 -1
@@ -351,7 +351,7 @@ static struct ib_ports_pkeys *get_new_pps(const struct ib_qp *qp,if ((qp_attr_mask &IB_QP_PKEY_INDEX ) && (qp_attr_mask &IB_QP_PORT )) new_pps->main.state =IB_PORT_PKEY_VALID ; -if (!(qp_attr_mask & (IB_QP_PKEY_INDEX ||IB_QP_PORT )) && qp_pps) { +if (!(qp_attr_mask & (IB_QP_PKEY_INDEX |IB_QP_PORT )) && qp_pps) { new_pps->main.port_num = qp_pps->main.port_num; new_pps->main.pkey_index = qp_pps->main.pkey_index;if (qp_pps->main.state !=IB_PORT_PKEY_NOT_VALID )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 73/126 kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic
In reply to Greg Kroah-HartmanFrom: Masami Hiramatsu <[email protected]>
[ Upstream commit e4add247789e4ba5e08ad8256183ce2e211877d4 ]
optimize_kprobe() and unoptimize_kprobe() cancels if a given kprobe is on the optimizing_list or unoptimizing_list already. However, since the following commit:
f66c0447cca1 ("kprobes: Set unoptimized flag after unoptimizing code")
modified the update timing of the KPROBE_FLAG_OPTIMIZED, it doesn't work as expected anymore.
The optimized_kprobe could be in the following states:
- [optimizing]: Before inserting jump instruction
op.kp->flags has KPROBE_FLAG_OPTIMIZED and
op->list is not empty.
- [optimized]: jump inserted
op.kp->flags has KPROBE_FLAG_OPTIMIZED and
op->list is empty.
- [unoptimizing]: Before removing jump instruction (including unused optprobe)
op.kp->flags has KPROBE_FLAG_OPTIMIZED and
op->list is not empty.
- [unoptimized]: jump removed
op.kp->flags doesn't have KPROBE_FLAG_OPTIMIZED and op->list is empty.
Current code mis-expects [unoptimizing] state doesn't have KPROBE_FLAG_OPTIMIZED, and that can cause incorrect results.
To fix this, introduce optprobe_queued_unopt() to distinguish [optimizing] and [unoptimizing] states and fixes the logic in optimize_kprobe() and unoptimize_kprobe().
[ mingo: Cleaned up the changelog and the code a bit. ]
--- kernel/kprobes.c | 67 +++++++++++++++++++++++++++++++----------------- 1 file changed, 43 insertions(+), 24 deletions(-)
kernel/kprobes.c +43 -24
@@ -625,6 +625,18 @@ void wait_for_kprobe_optimizer(void)mutex_unlock (&kprobe_mutex); } +static bool optprobe_queued_unopt (struct optimized_kprobe *op) +{ +struct optimized_kprobe *_op; + +list_for_each_entry (_op, &unoptimizing_list, list) { +if (op == _op) +return true; + } + +return false; +} +/* Optimize kprobe if p is ready to be optimized */ static void optimize_kprobe (struct kprobe *p) {
@@ -646,17 +658,21 @@ static void optimize_kprobe(struct kprobe *p)return ;/* Check if it is already optimized. */ -if (op->kp.flags &KPROBE_FLAG_OPTIMIZED ) +if (op->kp.flags &KPROBE_FLAG_OPTIMIZED ) { +if (optprobe_queued_unopt (op)) { +/* This is under unoptimizing. Just dequeue the probe */ +list_del_init (&op->list); + }return ; + } op->kp.flags |=KPROBE_FLAG_OPTIMIZED ; -if (!list_empty (&op->list)) -/* This is under unoptimizing. Just dequeue the probe */ -list_del_init (&op->list); -else { -list_add (&op->list, &optimizing_list); -kick_kprobe_optimizer (); - } +/* On unoptimizing/optimizing_list, op must have OPTIMIZED flag */ +if (WARN_ON_ONCE (!list_empty (&op->list))) +return ; + +list_add (&op->list, &optimizing_list); +kick_kprobe_optimizer (); }/* Short cut to direct unoptimizing */
@@ -678,30 +694,33 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)return ;/* This is not an optprobe nor optimized */ op = container_of(p, struct optimized_kprobe, kp); -if (!kprobe_optimized (p)) { -/* Unoptimized or unoptimizing case */ -if (force && !list_empty (&op->list)) { -/* -* Only if this is unoptimizing kprobe and forced, -* forcibly unoptimize it. (No need to unoptimize -* unoptimized kprobe again :) -*/ -list_del_init (&op->list); -force_unoptimize_kprobe (op); - } +if (!kprobe_optimized (p))return ; - }if (!list_empty (&op->list)) { -/* Dequeue from the optimization queue */ -list_del_init (&op->list); +if (optprobe_queued_unopt (op)) { +/* Queued in unoptimizing queue */ +if (force) { +/* +* Forcibly unoptimize the kprobe here, and queue it +* in the freeing list for release afterwards. +*/ +force_unoptimize_kprobe (op); +list_move (&op->list, &freeing_list); + } + }else { +/* Dequeue from the optimizing queue */ +list_del_init (&op->list); + op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED ; + }return ; } +/* Optimized kprobe case */ -if (force) +if (force) {/* Forcibly update the code: this is a special case */ force_unoptimize_kprobe (op); -else { + }else {list_add (&op->list, &unoptimizing_list);kick_kprobe_optimizer (); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 74/126 serial: ar933x_uart: set UART_CS_{RX,TX}_READY_ORIDE
In reply to Greg Kroah-HartmanFrom: Daniel Golle <[email protected]>
[ Upstream commit 87c5cbf71ecbb9e289d60a2df22eb686c70bf196 ]
On AR934x this UART is usually not initialized by the bootloader as it is only used as a secondary serial port while the primary UART is a newly introduced NS16550-compatible.
In order to make use of the ar933x-uart on AR934x without RTS/CTS hardware flow control, one needs to set the UART_CS_{RX,TX}_READY_ORIDE bits as other than on AR933x where this UART is used as primary/console, the bootloader on AR934x typically doesn't set those bits.
Setting them explicitely on AR933x should not do any harm, so just set them unconditionally.
--- drivers/tty/serial/ar933x_uart.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/tty/serial/ar933x_uart.c +8 -0
@@ -289,6 +289,10 @@ static void ar933x_uart_set_termios(struct uart_port *port,ar933x_uart_rmw_set (up,AR933X_UART_CS_REG ,AR933X_UART_CS_HOST_INT_EN ); +/* enable RX and TX ready overide */ +ar933x_uart_rmw_set (up,AR933X_UART_CS_REG , +AR933X_UART_CS_TX_READY_ORIDE |AR933X_UART_CS_RX_READY_ORIDE ); +/* reenable the UART */ ar933x_uart_rmw(up, AR933X_UART_CS_REG, AR933X_UART_CS_IF_MODE_M << AR933X_UART_CS_IF_MODE_S,
@@ -421,6 +425,10 @@ static int ar933x_uart_startup(struct uart_port *port)ar933x_uart_rmw_set (up,AR933X_UART_CS_REG ,AR933X_UART_CS_HOST_INT_EN ); +/* enable RX and TX ready overide */ +ar933x_uart_rmw_set (up,AR933X_UART_CS_REG , +AR933X_UART_CS_TX_READY_ORIDE |AR933X_UART_CS_RX_READY_ORIDE ); +/* Enable RX interrupts */ up->ier =AR933X_UART_INT_RX_VALID ;ar933x_uart_write (up,AR933X_UART_INT_EN_REG , up->ier);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 75/126 selftests: fix too long argument
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit c363eb48ada5cf732b3f489fab799fc881097842 ]
With some shells, the command construed for install of bpf selftests becomes too large due to long list of files:
make[1]: execvp: /bin/sh: Argument list too long
make[1]: *** [../lib.mk:73: install] Error 127
Currently, each of the file lists is replicated three times in the command:
in the shell 'if' condition, in the 'echo' and in the 'rsync'. Reduce that by one instance by using make conditionals and separate the echo and rsync into two shell commands. (One would be inclined to just remove the '@' at the beginning of the rsync command and let 'make' echo it by itself; unfortunately, it appears that the '@' in the front of mkdir silences output also for the following commands.)
Also, separate handling of each of the lists to its own shell command.
The semantics of the makefile is unchanged before and after the patch. The ability of individual test directories to override INSTALL_RULE is retained.
--- tools/testing/selftests/lib.mk | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-)
tools/testing/selftests/lib.mk +13 -10
@@ -54,17 +54,20 @@ else $(call RUN_TESTS, $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_PROGS)) endif +define INSTALL_SINGLE_RULE + $(if $(INSTALL_LIST),@mkdir -p $(INSTALL_PATH)) + $(if $(INSTALL_LIST),@echo rsync -a $(INSTALL_LIST) $(INSTALL_PATH)/) + $(if $(INSTALL_LIST),@rsync -a $(INSTALL_LIST) $(INSTALL_PATH)/) +endef + define INSTALL_RULE - @if [ "X$(TEST_PROGS)$(TEST_PROGS_EXTENDED)$(TEST_FILES)" != "X" ]; then \ - mkdir -p ${INSTALL_PATH}; \ - echo "rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/"; \ - rsync -a $(TEST_PROGS) $(TEST_PROGS_EXTENDED) $(TEST_FILES) $(INSTALL_PATH)/; \ - fi - @if [ "X$(TEST_GEN_PROGS)$(TEST_CUSTOM_PROGS)$(TEST_GEN_PROGS_EXTENDED)$(TEST_GEN_FILES)" != "X" ]; then \ - mkdir -p ${INSTALL_PATH}; \ - echo "rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/"; \ - rsync -a $(TEST_GEN_PROGS) $(TEST_CUSTOM_PROGS) $(TEST_GEN_PROGS_EXTENDED) $(TEST_GEN_FILES) $(INSTALL_PATH)/; \ - fi + $(eval INSTALL_LIST = $(TEST_PROGS)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_PROGS_EXTENDED)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_FILES)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_GEN_PROGS)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_CUSTOM_PROGS)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_GEN_PROGS_EXTENDED)) $(INSTALL_SINGLE_RULE) + $(eval INSTALL_LIST = $(TEST_GEN_FILES)) $(INSTALL_SINGLE_RULE) endef install: all
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 76/126 usb: gadget: composite: Support more than 500mA MaxPower
In reply to Greg Kroah-HartmanFrom: Jack Pham <[email protected]>
[ Upstream commit a2035411fa1d1206cea7d5dfe833e78481844a76 ]
USB 3.x SuperSpeed peripherals can draw up to 900mA of VBUS power when in configured state. However, if a configuration wanting to take advantage of this is added with MaxPower greater than 500 (currently possible if using a ConfigFS gadget) the composite driver fails to accommodate this for a couple reasons:
- usb_gadget_vbus_draw() when called from set_config() and composite_resume() will be passed the MaxPower value without regard for the current connection speed, resulting in a violation for USB 2.0 since the max is 500mA.
- the bMaxPower of the configuration descriptor would be incorrectly encoded, again if the connection speed is only at USB 2.0 or below, likely wrapping around U8_MAX since the 2mA multiplier corresponds to a maximum of 510mA.
Fix these by adding checks against the current gadget->speed when the c->MaxPower value is used (set_config() and composite_resume()) and appropriately limit based on whether it is currently at a low-/full-/high- or super-speed connection.
Because 900 is not divisible by 8, with the round-up division currently used in encode_bMaxPower() a MaxPower of 900mA will result in an encoded value of 0x71. When a host stack (including Linux and Windows) enumerates this on a single port root hub, it reads this value back and decodes (multiplies by 8) to get 904mA which is strictly greater than 900mA that is typically budgeted for that port, causing it to reject the configuration. Instead, we should be using the round-down behavior of normal integral division so that 900 / 8 -> 0x70 or 896mA to stay within range. And we might as well change it for the high/full/low case as well for consistency.
N.B. USB 3.2 Gen N x 2 allows for up to 1500mA but there doesn't seem to be any any peripheral controller supported by Linux that does two lane operation, so for now keeping the clamp at 900 should be fine.
--- drivers/usb/gadget/composite.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/usb/gadget/composite.c +18 -6
@@ -441,9 +441,13 @@ static u8 encode_bMaxPower(enum usb_device_speed speed,if (!val)return 0 ;if (speed <USB_SPEED_SUPER ) -return DIV_ROUND_UP (val,2 ); +return min (val,500U ) /2 ;else -return DIV_ROUND_UP (val,8 ); +/* +* USB 3.x supports up to 900mA, but since 900 isn't divisible +* by 8 the integral division will effectively cap to 896mA. +*/ +return min (val,900U ) /8 ; } static int config_buf(struct usb_configuration *config,
@@ -841,6 +845,10 @@ static int set_config(struct usb_composite_dev *cdev,/* when we return, be sure our power usage is valid */ power = c->MaxPower ? c->MaxPower :CONFIG_USB_GADGET_VBUS_DRAW ; +if (gadget->speed <USB_SPEED_SUPER ) + power =min (power,500U ); +else + power =min (power,900U ); done:usb_gadget_vbus_draw (gadget, power);if (result >=0 && cdev->delayed_status)
@@ -2280,7 +2288,7 @@ void composite_resume(struct usb_gadget *gadget) {struct usb_composite_dev *cdev =get_gadget_data (gadget);struct usb_function *f; -u16 maxpower; +unsigned maxpower;/* REVISIT: should we have config level * suspend/resume callbacks?
@@ -2294,10 +2302,14 @@ void composite_resume(struct usb_gadget *gadget) f->resume (f); } - maxpower = cdev->config->MaxPower; + maxpower = cdev->config->MaxPower ? + cdev->config->MaxPower :CONFIG_USB_GADGET_VBUS_DRAW ; +if (gadget->speed <USB_SPEED_SUPER ) + maxpower =min (maxpower,500U ); +else + maxpower =min (maxpower,900U ); -usb_gadget_vbus_draw (gadget, maxpower ? - maxpower :CONFIG_USB_GADGET_VBUS_DRAW ); +usb_gadget_vbus_draw (gadget, maxpower); } cdev->suspended =0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 77/126 usb: gadget: ffs: ffs_aio_cancel(): Save/restore IRQ flags
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit 43d565727a3a6fd24e37c7c2116475106af71806 ]
ffs_aio_cancel() can be called from both interrupt and thread context. Make sure that the current IRQ state is saved and restored by using spin_{un,}lock_irq{save,restore}().
Otherwise undefined behavior might occur.
--- drivers/usb/gadget/function/f_fs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/usb/gadget/function/f_fs.c +3 -2
@@ -1078,18 +1078,19 @@ static int ffs_aio_cancel(struct kiocb *kiocb) {struct ffs_io_data *io_data = kiocb->private;struct ffs_epfile *epfile = kiocb->ki_filp->private_data; +unsigned long flags;int value;ENTER (); -spin_lock_irq (&epfile->ffs->eps_lock); +spin_lock_irqsave (&epfile->ffs->eps_lock, flags);if (likely (io_data && io_data->ep && io_data->req)) value =usb_ep_dequeue (io_data->ep, io_data->req);else value = -EINVAL ; -spin_unlock_irq (&epfile->ffs->eps_lock); +spin_unlock_irqrestore (&epfile->ffs->eps_lock, flags);return value; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 78/126 usb: gadget: serial: fix Tx stall after buffer overflow
In reply to Greg Kroah-HartmanFrom: Sergey Organov <[email protected]>
[ Upstream commit e4bfded56cf39b8d02733c1e6ef546b97961e18a ]
Symptom: application opens /dev/ttyGS0 and starts sending (writing) to it while either USB cable is not connected, or nobody listens on the other side of the cable. If driver circular buffer overflows before connection is established, no data will be written to the USB layer until/unless /dev/ttyGS0 is closed and re-opened again by the application (the latter besides having no means of being notified about the event of establishing of the connection.)
Fix: on open and/or connect, kick Tx to flush circular buffer data to USB layer.
--- drivers/usb/gadget/function/u_serial.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/function/u_serial.c +3 -1
@@ -715,8 +715,10 @@ static int gs_start_io(struct gs_port *port) port->n_read =0 ; started =gs_start_rx (port); -/* unblock any pending writes into our circular buffer */ if (started) { +gs_start_tx (port); +/* Unblock any pending writes into our circular buffer, in case +* we didn't in gs_start_tx() */ tty_wakeup (port->port.tty); }else {gs_free_requests (ep, head, &port->read_allocated);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 79/126 drm/msm/mdp5: rate limit pp done timeout warnings
In reply to Greg Kroah-HartmanFrom: Brian Masney <[email protected]>
[ Upstream commit ef8c9809acb0805c991bba8bdd4749fc46d44a98 ]
Add rate limiting of the 'pp done time out' warnings since these warnings can quickly fill the dmesg buffer.
--- drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/mdp/mdp5/mdp5_crtc.c +2 -2
@@ -1004,8 +1004,8 @@ static void mdp5_crtc_wait_for_pp_done(struct drm_crtc *crtc) ret =wait_for_completion_timeout (&mdp5_crtc->pp_completion,msecs_to_jiffies (50 ));if (ret ==0 ) -dev_warn (dev->dev,"pp done time out, lm=%d\n" , - mdp5_cstate->pipeline.mixer->lm); +dev_warn_ratelimited (dev->dev,"pp done time out, lm=%d\n" , + mdp5_cstate->pipeline.mixer->lm); }static void mdp5_crtc_wait_for_flush_done (struct drm_crtc *crtc)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 80/126 drm: msm: Fix return type of dsi_mgr_connector_mode_valid for kCFI
In reply to Greg Kroah-HartmanFrom: John Stultz <[email protected]>
[ Upstream commit 7fd2dfc3694922eb7ace4801b7208cf9f62ebc7d ]
I was hitting kCFI crashes when building with clang, and after some digging finally narrowed it down to the dsi_mgr_connector_mode_valid() function being implemented as returning an int, instead of an enum drm_mode_status.
This patch fixes it, and appeases the opaque word of the kCFI gods (seriously, clang inlining everything makes the kCFI backtraces only really rough estimates of where things went wrong).
Thanks as always to Sami for his help narrowing this down.
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +1 -1
@@ -400,7 +400,7 @@ static int dsi_mgr_connector_get_modes(struct drm_connector *connector)return num; } -static int dsi_mgr_connector_mode_valid (struct drm_connector *connector, +static enum drm_mode_status dsi_mgr_connector_mode_valid (struct drm_connector *connector,struct drm_display_mode *mode) {int id =dsi_mgr_connector_get_id (connector);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 81/126 drm/msm/dsi: save pll state before dsi host is powered off
In reply to Greg Kroah-HartmanFrom: Harigovindan P <[email protected]>
[ Upstream commit a1028dcfd0dd97884072288d0c8ed7f30399b528 ]
Save pll state before dsi host is powered off. Without this change some register values gets resetted.
--- drivers/gpu/drm/msm/dsi/dsi_manager.c | 5 +++++ drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 ---- 2 files changed, 5 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/dsi/dsi_manager.c +5 -0
@@ -543,6 +543,7 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge)struct msm_dsi *msm_dsi1 =dsi_mgr_get_dsi (DSI_1 );struct mipi_dsi_host *host = msm_dsi->host;struct drm_panel *panel = msm_dsi->panel; +struct msm_dsi_pll *src_pll;bool is_dual_dsi =IS_DUAL_DSI ();int ret;
@@ -583,6 +584,10 @@ static void dsi_mgr_bridge_post_disable(struct drm_bridge *bridge) id, ret); } +/* Save PLL status if it is a clock source */ + src_pll =msm_dsi_phy_get_pll (msm_dsi->phy); +msm_dsi_pll_save_state (src_pll); + ret =msm_dsi_host_power_off (host);if (ret)pr_err ("%s: host %d power off failed,%d\n" , __func__, id, ret);
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c +0 -4
@@ -613,10 +613,6 @@ void msm_dsi_phy_disable(struct msm_dsi_phy *phy)if (!phy || !phy->cfg->ops.disable)return ; -/* Save PLL status if it is a clock source */ -if (phy->usecase !=MSM_DSI_PHY_SLAVE ) -msm_dsi_pll_save_state (phy->pll); - phy->cfg->ops.disable (phy);dsi_phy_regulator_disable (phy);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 82/126 net: ks8851-ml: Remove 8-bit bus accessors
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 69233bba6543a37755158ca3382765387b8078df ]
This driver is mixing 8-bit and 16-bit bus accessors for reasons unknown, however the speculation is that this was some sort of attempt to support the 8-bit bus mode.
As per the KS8851-16MLL documentation, all two registers accessed via the 8-bit accessors are internally 16-bit registers, so reading them using 16-bit accessors is fine. The KS_CCR read can be converted to 16-bit read outright, as it is already a concatenation of two 8-bit reads of that register. The KS_RXQCR accesses are 8-bit only, however writing the top 8 bits of the register is OK as well, since the driver caches the entire 16-bit register value anyway.
Finally, the driver is not used by any hardware in the kernel right now. The only hardware available to me is one with 16-bit bus, so I have no way to test the 8-bit bus mode, however it is unlikely this ever really worked anyway. If the 8-bit bus mode is ever required, it can be easily added by adjusting the 16-bit accessors to do 2 consecutive accesses, which is how this should have been done from the beginning.
--- drivers/net/ethernet/micrel/ks8851_mll.c | 45 +++--------------------- 1 file changed, 5 insertions(+), 40 deletions(-)
drivers/net/ethernet/micrel/ks8851_mll.c +5 -40
@@ -474,24 +474,6 @@ static int msg_enable;* chip is busy transferring packet data (RX/TX FIFO accesses). */ -/** -* ks_rdreg8 - read 8 bit register from device -* @ks : The chip information -* @offset: The register address -* -* Read a 8bit register from the chip, returning the result -*/ -static u8 ks_rdreg8 (struct ks_net *ks,int offset) -{ -u16 data; -u8 shift_bit = offset &0x03 ; -u8 shift_data = (offset &1 ) <<3 ; - ks->cmd_reg_cache = (u16 ) offset | (u16)(BE0 << shift_bit); -iowrite16 (ks->cmd_reg_cache, ks->hw_addr_cmd); - data =ioread16 (ks->hw_addr); -return (u8)(data >> shift_data); -} -/** * ks_rdreg16 - read 16 bit register from device * @ks : The chip information
@@ -507,22 +489,6 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset)return ioread16 (ks->hw_addr); } -/** -* ks_wrreg8 - write 8bit register value to chip -* @ks: The chip information -* @offset: The register address -* @value: The value to write -* -*/ -static void ks_wrreg8 (struct ks_net *ks,int offset,u8 value) -{ -u8 shift_bit = (offset &0x03 ); -u16 value_write = (u16)(value << ((offset &1 ) <<3 )); - ks->cmd_reg_cache = (u16 )offset | (BE0 << shift_bit); -iowrite16 (ks->cmd_reg_cache, ks->hw_addr_cmd); -iowrite16 (value_write, ks->hw_addr); -} -/** * ks_wrreg16 - write 16bit register value to chip * @ks: The chip information
@@ -642,8 +608,7 @@ static void ks_read_config(struct ks_net *ks)u16 reg_data =0 ;/* Regardless of bus width, 8 bit read should always work.*/ - reg_data =ks_rdreg8 (ks,KS_CCR ) &0x00FF ; - reg_data |=ks_rdreg8 (ks,KS_CCR +1 ) <<8 ; + reg_data =ks_rdreg16 (ks,KS_CCR );/* addr/data bus are multiplexed */ ks->sharedbus = (reg_data &CCR_SHARED ) ==CCR_SHARED ;
@@ -747,7 +712,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)/* 1. set sudo DMA mode */ ks_wrreg16 (ks,KS_RXFDPR ,RXFDPR_RXFPAI ); -ks_wrreg8 (ks,KS_RXQCR , (ks->rc_rxqcr |RXQCR_SDA ) &0xff ); +ks_wrreg16 (ks,KS_RXQCR , ks->rc_rxqcr |RXQCR_SDA );/* 2. read prepend data */ /**
@@ -764,7 +729,7 @@ static inline void ks_read_qmu(struct ks_net *ks, u16 *buf, u32 len)ks_inblk (ks, buf,ALIGN (len,4 ));/* 4. reset sudo DMA Mode */ -ks_wrreg8 (ks,KS_RXQCR , ks->rc_rxqcr); +ks_wrreg16 (ks,KS_RXQCR , ks->rc_rxqcr); }/**
@@ -997,13 +962,13 @@ static void ks_write_qmu(struct ks_net *ks, u8 *pdata, u16 len) ks->txh.txw[1 ] =cpu_to_le16 (len);/* 1. set sudo-DMA mode */ -ks_wrreg8 (ks,KS_RXQCR , (ks->rc_rxqcr |RXQCR_SDA ) &0xff ); +ks_wrreg16 (ks,KS_RXQCR , ks->rc_rxqcr |RXQCR_SDA );/* 2. write status/lenth info */ ks_outblk (ks, ks->txh.txw,4 );/* 3. write pkt data */ ks_outblk (ks, (u16 *)pdata,ALIGN (len,4 ));/* 4. reset sudo-DMA mode */ -ks_wrreg8 (ks,KS_RXQCR , ks->rc_rxqcr); +ks_wrreg16 (ks,KS_RXQCR , ks->rc_rxqcr);/* 5. Enqueue Tx(move the pkt from TX buffer into TXQ) */ ks_wrreg16 (ks,KS_TXQCR ,TXQCR_METFE );/* 6. wait until TXQCR_METFE is auto-cleared */
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 83/126 net: ks8851-ml: Fix 16-bit data access
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit edacb098ea9c31589276152f09b4439052c0f2b1 ]
The packet data written to and read from Micrel KSZ8851-16MLLI must be byte-swapped in 16-bit mode, add this byte-swapping.
--- drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/micrel/ks8851_mll.c +2 -2
@@ -515,7 +515,7 @@ static inline void ks_inblk(struct ks_net *ks, u16 *wptr, u32 len) { len >>=1 ;while (len--) - *wptr++ = (u16 )ioread16 (ks->hw_addr); + *wptr++ =be16_to_cpu (ioread16 (ks->hw_addr)); }/**
@@ -529,7 +529,7 @@ static inline void ks_outblk(struct ks_net *ks, u16 *wptr, u32 len) { len >>=1 ;while (len--) -iowrite16 (*wptr++, ks->hw_addr); +iowrite16 (cpu_to_be16 (*wptr++), ks->hw_addr); }static void ks_disable_int (struct ks_net *ks)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 84/126 net: ks8851-ml: Fix 16-bit IO operation
In reply to Greg Kroah-HartmanFrom: Marek Vasut <[email protected]>
[ Upstream commit 58292104832fef6cb4a89f736012c0e0724c3442 ]
The Micrel KSZ8851-16MLLI datasheet DS00002357B page 12 states that BE[3:0] signals are active high. This contradicts the measurements of the behavior of the actual chip, where these signals behave as active low. For example, to read the CIDER register, the bus must expose 0xc0c0 during the address phase, which means BE[3:0]=4'b1100.
--- drivers/net/ethernet/micrel/ks8851_mll.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/micrel/ks8851_mll.c +2 -2
@@ -484,7 +484,7 @@ static int msg_enable;static u16 ks_rdreg16 (struct ks_net *ks,int offset) { - ks->cmd_reg_cache = (u16 )offset | ((BE1 |BE0 ) << (offset &0x02 )); + ks->cmd_reg_cache = (u16 )offset | ((BE3 |BE2 ) >> (offset &0x02 ));iowrite16 (ks->cmd_reg_cache, ks->hw_addr_cmd);return ioread16 (ks->hw_addr); }
@@ -499,7 +499,7 @@ static u16 ks_rdreg16(struct ks_net *ks, int offset)static void ks_wrreg16 (struct ks_net *ks,int offset,u16 value) { - ks->cmd_reg_cache = (u16 )offset | ((BE1 |BE0 ) << (offset &0x02 )); + ks->cmd_reg_cache = (u16 )offset | ((BE3 |BE2 ) >> (offset &0x02 ));iowrite16 (ks->cmd_reg_cache, ks->hw_addr_cmd);iowrite16 (value, ks->hw_addr); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 85/126 watchdog: da9062: do not ping the hw during stop()
In reply to Greg Kroah-HartmanFrom: Marco Felsch <[email protected]>
[ Upstream commit e9a0e65eda3f78d0b04ec6136c591c000cbc3b76 ]
The da9062 hw has a minimum ping cool down phase of at least 200ms. The driver takes that into account by setting the min_hw_heartbeat_ms to 300ms and the core guarantees that the hw limit is observed for the ping() calls. But the core can't guarantee the required minimum ping cool down phase if a stop() command is send immediately after the ping() command. So it is not allowed to ping the watchdog within the stop() command as the driver does. Remove the ping can be done without doubts because the watchdog gets disabled anyway and a (re)start resets the watchdog counter too.
--- drivers/watchdog/da9062_wdt.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/watchdog/da9062_wdt.c +0 -7
@@ -126,13 +126,6 @@ static int da9062_wdt_stop(struct watchdog_device *wdd)struct da9062_watchdog *wdt =watchdog_get_drvdata (wdd);int ret; - ret =da9062_reset_watchdog_timer (wdt); -if (ret) { -dev_err (wdt->hw->dev,"Failed to ping the watchdog (err = %d)\n" , - ret); -return ret; - } - ret = regmap_update_bits(wdt->hw->regmap, DA9062AA_CONTROL_D, DA9062AA_TWDSCALE_MASK,
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 86/126 s390/cio: cio_ignore_proc_seq_next should increase position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 8b101a5e14f2161869636ff9cb4907b7749dc0c2 ]
if seq_file .next fuction does not change position index, read after some lseek can generate unexpected output.
--- drivers/s390/cio/blacklist.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/s390/cio/blacklist.c +3 -2
@@ -303,8 +303,10 @@ static void * cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset) { struct ccwdev_iter *iter; +loff_t p = *offset; -if (*offset >= (__MAX_SUBCHANNEL +1 ) * (__MAX_SSID +1 )) + (*offset)++; +if (p >= (__MAX_SUBCHANNEL +1 ) * (__MAX_SSID +1 ))return NULL ; iter = it;if (iter->devno == __MAX_SUBCHANNEL) {
@@ -314,7 +316,6 @@ cio_ignore_proc_seq_next(struct seq_file *s, void *it, loff_t *offset)return NULL ; }else iter->devno++; - (*offset)++;return iter; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 87/126 x86/boot/compressed: Dont declare __force_order in kaslr_64.c
In reply to Greg Kroah-HartmanFrom: H.J. Lu <[email protected]>
[ Upstream commit df6d4f9db79c1a5d6f48b59db35ccd1e9ff9adfc ]
GCC 10 changed the default to -fno-common, which leads to
LD arch/x86/boot/compressed/vmlinux
ld: arch/x86/boot/compressed/pgtable_64.o:(.bss+0x0): multiple definition of `__force_order'; \
arch/x86/boot/compressed/kaslr_64.o:(.bss+0x0): first defined here make[2]: *** [arch/x86/boot/compressed/Makefile:119: arch/x86/boot/compressed/vmlinux] Error 1
Since __force_order is already provided in pgtable_64.c, there is no need to declare __force_order in kaslr_64.c.
--- arch/x86/boot/compressed/pagetable.c | 3 --- 1 file changed, 3 deletions(-)
arch/x86/boot/compressed/pagetable.c +0 -3
@@ -36,9 +36,6 @@#define __PAGE_OFFSET __PAGE_OFFSET_BASE#include "../../mm/ident_map.c" -/* Used by pgtable.h asm code to force instruction serialization. */ -unsigned long __force_order; -/* Used to track our page table allocation area. */ struct alloc_pgt_data {unsigned char *pgt_buf;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 88/126 nvme: Fix uninitialized-variable warning
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
[ Upstream commit 15755854d53b4bbb0bb37a0fce66f0156cfc8a17 ]
gcc may detect a false positive on nvme using an unintialized variable if setting features fails. Since this is not a fast path, explicitly initialize this variable to suppress the warning.
--- drivers/nvme/host/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/nvme/host/core.c +1 -1
@@ -889,8 +889,8 @@ static struct nvme_id_ns *nvme_identify_ns(struct nvme_ctrl *ctrl,static int nvme_set_features (struct nvme_ctrl *dev,unsigned fid,unsigned dword11,void *buffer,size_t buflen,u32 *result) { +union nvme_result res = {0 };struct nvme_command c; -union nvme_result res;int ret;memset (&c,0 ,sizeof (c));
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 89/126 x86/xen: Distribute switch variables for initialization
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit 9038ec99ceb94fb8d93ade5e236b2928f0792c7c ]
Variables declared in a switch statement before any case statements cannot be automatically initialized with compiler instrumentation (as they are not part of any execution flow). With GCC's proposed automatic stack variable initialization feature, this triggers a warning (and they don't get initialized). Clang's automatic stack variable initialization (via CONFIG_INIT_STACK_ALL=y) doesn't throw a warning, but it also doesn't initialize such variables[1]. Note that these warnings (or silent skipping) happen before the dead-store elimination optimization phase, so even when the automatic initializations are later elided in favor of direct initializations, the warnings remain.
To avoid these problems, move such variables into the "case" where they're used or lift them up into the main function body.
arch/x86/xen/enlighten_pv.c: In function ‘xen_write_msr_safe’:arch/x86/xen/enlighten_pv.c:904:12: warning: statement will never be executed [-Wswitch-unreachable]
904 | unsigned which;
| ^~~~~[1] https://bugs.llvm.org/show_bug.cgi?id=44916
--- arch/x86/xen/enlighten_pv.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
arch/x86/xen/enlighten_pv.c +4 -3
@@ -909,14 +909,15 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)static int xen_write_msr_safe (unsigned int msr,unsigned low,unsigned high) {int ret; +#ifdef CONFIG_X86_64 +unsigned int which; +u64 base; +#endif ret =0 ;switch (msr) {#ifdef CONFIG_X86_64 -unsigned which; -u64 base; -case MSR_FS_BASE : which =SEGBASE_FS ; goto set;case MSR_KERNEL_GS_BASE : which =SEGBASE_GS_USER ; goto set;case MSR_GS_BASE : which =SEGBASE_GS_KERNEL ; goto set;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 90/126 net: thunderx: workaround BGX TX Underflow issue
In reply to Greg Kroah-HartmanFrom: Tim Harvey <[email protected]>
[ Upstream commit 971617c3b761c876d686a2188220a33898c90e99 ]
While it is not yet understood why a TX underflow can easily occur for SGMII interfaces resulting in a TX wedge. It has been found that disabling/re-enabling the LMAC resolves the issue.
--- .../net/ethernet/cavium/thunder/thunder_bgx.c | 62 ++++++++++++++++++- .../net/ethernet/cavium/thunder/thunder_bgx.h | 9 +++ 2 files changed, 68 insertions(+), 3 deletions(-)
drivers/net/ethernet/cavium/thunder/thunder_bgx.c +59 -3
@@ -234,10 +234,19 @@ void bgx_lmac_rx_tx_enable(int node, int bgx_idx, int lmacid, bool enable) lmac = &bgx->lmac[lmacid]; cfg =bgx_reg_read (bgx, lmacid,BGX_CMRX_CFG ); -if (enable) +if (enable) { cfg |=CMR_PKT_RX_EN |CMR_PKT_TX_EN ; -else + +/* enable TX FIFO Underflow interrupt */ +bgx_reg_modify (bgx, lmacid,BGX_GMP_GMI_TXX_INT_ENA_W1S , +GMI_TXX_INT_UNDFLW ); + }else { cfg &= ~(CMR_PKT_RX_EN |CMR_PKT_TX_EN ); + +/* Disable TX FIFO Underflow interrupt */ +bgx_reg_modify (bgx, lmacid,BGX_GMP_GMI_TXX_INT_ENA_W1C , +GMI_TXX_INT_UNDFLW ); + }bgx_reg_write (bgx, lmacid,BGX_CMRX_CFG , cfg);if (bgx->is_rgx)
@@ -1340,6 +1349,48 @@ static int bgx_init_phy(struct bgx *bgx)return bgx_init_of_phy (bgx); } +static irqreturn_t bgx_intr_handler (int irq,void *data) +{ +struct bgx *bgx = (struct bgx *)data; +u64 status, val; +int lmac; + +for (lmac =0 ; lmac < bgx->lmac_count; lmac++) { + status =bgx_reg_read (bgx, lmac,BGX_GMP_GMI_TXX_INT ); +if (status &GMI_TXX_INT_UNDFLW ) { +pci_err (bgx->pdev,"BGX%d lmac%d UNDFLW\n" , + bgx->bgx_id, lmac); + val =bgx_reg_read (bgx, lmac,BGX_CMRX_CFG ); + val &= ~CMR_EN ; +bgx_reg_write (bgx, lmac,BGX_CMRX_CFG , val); + val |=CMR_EN ; +bgx_reg_write (bgx, lmac,BGX_CMRX_CFG , val); + } +/* clear interrupts */ +bgx_reg_write (bgx, lmac,BGX_GMP_GMI_TXX_INT , status); + } + +return IRQ_HANDLED ; +} + +static void bgx_register_intr (struct pci_dev *pdev) +{ +struct bgx *bgx =pci_get_drvdata (pdev); +int ret; + + ret =pci_alloc_irq_vectors (pdev,BGX_LMAC_VEC_OFFSET , +BGX_LMAC_VEC_OFFSET ,PCI_IRQ_ALL_TYPES ); +if (ret <0 ) { +pci_err (pdev,"Req for #%d msix vectors failed\n" , +BGX_LMAC_VEC_OFFSET ); +return ; + } + ret =pci_request_irq (pdev,GMPX_GMI_TX_INT , bgx_intr_handler,NULL , + bgx,"BGX%d" , bgx->bgx_id); +if (ret) +pci_free_irq (pdev,GMPX_GMI_TX_INT , bgx); +} +static int bgx_probe (struct pci_dev *pdev,const struct pci_device_id *ent) {int err;
@@ -1355,7 +1406,7 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)pci_set_drvdata (pdev, bgx); - err =pci_enable_device (pdev); + err =pcim_enable_device (pdev);if (err) {dev_err (dev,"Failed to enable PCI device\n" );pci_set_drvdata (pdev,NULL );
@@ -1409,6 +1460,8 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)bgx_init_hw (bgx); +bgx_register_intr (pdev); +/* Enable all LMACs */ for (lmac =0 ; lmac < bgx->lmac_count; lmac++) { err =bgx_lmac_enable (bgx, lmac);
@@ -1425,6 +1478,7 @@ static int bgx_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_enable: bgx_vnic[bgx->bgx_id] =NULL ; +pci_free_irq (pdev,GMPX_GMI_TX_INT , bgx); err_release_regions:pci_release_regions (pdev); err_disable_device:
@@ -1442,6 +1496,8 @@ static void bgx_remove(struct pci_dev *pdev)for (lmac =0 ; lmac < bgx->lmac_count; lmac++)bgx_lmac_disable (bgx, lmac); +pci_free_irq (pdev,GMPX_GMI_TX_INT , bgx); + bgx_vnic[bgx->bgx_id] =NULL ;pci_release_regions (pdev);pci_disable_device (pdev);
drivers/net/ethernet/cavium/thunder/thunder_bgx.h +9 -0
@@ -179,6 +179,15 @@#define BGX_GMP_GMI_TXX_BURST 0x38228#define BGX_GMP_GMI_TXX_MIN_PKT 0x38240#define BGX_GMP_GMI_TXX_SGMII_CTL 0x38300 +#define BGX_GMP_GMI_TXX_INT 0x38500 +#define BGX_GMP_GMI_TXX_INT_W1S 0x38508 +#define BGX_GMP_GMI_TXX_INT_ENA_W1C 0x38510 +#define BGX_GMP_GMI_TXX_INT_ENA_W1S 0x38518 +#define GMI_TXX_INT_PTP_LOST BIT_ULL(4) +#define GMI_TXX_INT_LATE_COL BIT_ULL(3) +#define GMI_TXX_INT_XSDEF BIT_ULL(2) +#define GMI_TXX_INT_XSCOL BIT_ULL(1) +#define GMI_TXX_INT_UNDFLW BIT_ULL(0)#define BGX_MSIX_VEC_0_29_ADDR 0x400000/* +(0..29) << 4 */ #define BGX_MSIX_VEC_0_29_CTL 0x400008
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 91/126 cifs: dont leak -EAGAIN for stat() during reconnect
In reply to Greg Kroah-HartmanFrom: Ronnie Sahlberg <[email protected]>
commit fc513fac56e1b626ae48a74d7551d9c35c50129e upstream.
If from cifs_revalidate_dentry_attr() the SMB2/QUERY_INFO call fails with an error, such as STATUS_SESSION_EXPIRED, causing the session to be reconnected it is possible we will leak -EAGAIN back to the application even for system calls such as stat() where this is not a valid error.
Fix this by re-trying the operation from within cifs_revalidate_dentry_attr() if cifs_get_inode_info*() returns -EAGAIN.
This fixes stat() and possibly also other system calls that uses cifs_revalidate_dentry*().
--- fs/cifs/inode.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/cifs/inode.c +5 -1
@@ -1998,6 +1998,7 @@ int cifs_revalidate_dentry_attr(struct dstruct inode *inode =d_inode (dentry);struct super_block *sb = dentry->d_sb;char *full_path =NULL ; +int count =0 ;if (inode ==NULL )return -ENOENT ;
@@ -2019,15 +2020,18 @@ int cifs_revalidate_dentry_attr(struct d full_path, inode, inode->i_count.counter, dentry, cifs_get_time(dentry), jiffies); +again:if (cifs_sb_master_tcon (CIFS_SB (sb))->unix_ext) rc =cifs_get_inode_info_unix (&inode, full_path, sb, xid);else rc =cifs_get_inode_info (&inode, full_path,NULL , sb, xid,NULL ); - +if (rc == -EAGAIN && count++ <10 ) + goto again; out:kfree (full_path);free_xid (xid); +return rc; }
Greg Kroah-Hartman
maintainerPATCH 92/126 usb: storage: Add quirk for Samsung Fit flash
In reply to Greg Kroah-HartmanFrom: Jim Lin <[email protected]>
commit 86d92f5465958752481269348d474414dccb1552 upstream.
Current driver has 240 (USB2.0) and 2048 (USB3.0) as max_sectors, e.g., /sys/bus/scsi/devices/0:0:0:0/max_sectors
If data access times out, driver error handling will issue a port reset.
Sometimes Samsung Fit (090C:1000) flash disk will not respond to later Set Address or Get Descriptor command.
Adding this quirk to limit max_sectors to 64 sectors to avoid issue occurring.
--- drivers/usb/storage/unusual_devs.h | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/storage/unusual_devs.h +6 -0
@@ -1277,6 +1277,12 @@ UNUSUAL_DEV( 0x090a, 0x1200, 0x0000, 0x9 USB_SC_RBC, USB_PR_BULK, NULL, 0 ), +UNUSUAL_DEV (0x090c ,0x1000 ,0x1100 ,0x1100 , +"Samsung" , +"Flash Drive FIT" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , +US_FL_MAX_SECTORS_64 ), +/* aeb */ UNUSUAL_DEV( 0x090c, 0x1132, 0x0000, 0xffff, "Feiya",
Greg Kroah-Hartman
maintainerPATCH 93/126 usb: quirks: add NO_LPM quirk for Logitech Screen Share
In reply to Greg Kroah-HartmanFrom: Dan Lazewatsky <[email protected]>
commit b96ed52d781a2026d0c0daa5787c6f3d45415862 upstream.
LPM on the device appears to cause xHCI host controllers to claim that there isn't enough bandwidth to support additional devices.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -86,6 +86,9 @@ static const struct usb_device_id usb_qu/* Logitech PTZ Pro Camera */ { USB_DEVICE(0x046d, 0x0853), .driver_info = USB_QUIRK_DELAY_INIT }, + /* Logitech Screen Share */ + { USB_DEVICE(0x046d, 0x086c), .driver_info = USB_QUIRK_NO_LPM }, + /* Logitech Quickcam Fusion */ { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
Greg Kroah-Hartman
maintainerPATCH 94/126 usb: core: hub: fix unhandled return by employing a void function
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit 63d6d7ed475c53dc1cabdfedf63de1fd8dcd72ee upstream.
Address below Coverity complaint (Feb 25, 2020, 8:06 AM CET):
--- drivers/usb/core/hub.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/core/hub.c +1 -1
@@ -1818,7 +1818,7 @@ static int hub_probe(struct usb_interfacif (id->driver_info &HUB_QUIRK_DISABLE_AUTOSUSPEND ) { hub->quirk_disable_autosuspend =1 ; -usb_autopm_get_interface (intf); +usb_autopm_get_interface_no_resume (intf); }if (hub_configure (hub, &desc->endpoint[0 ].desc) >=0 )
Greg Kroah-Hartman
maintainerPATCH 95/126 usb: core: hub: do error out if usb_autopm_get_interface() fails
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit 60e3f6e4ac5b0fda43dad01c32e09409ec710045 upstream.
Reviewing a fresh portion of coverity defects in USB core (specifically CID 1458999), Alan Stern noted below in [1]:
Quoted 5 lines · Alan Stern
A revised search finds line 997 in
drivers/usb/core/hub.cand lines 216, 269 indrivers/usb/core/port.c. (I didn't try looking in any other directories.) AFAICT all three of these should check the return value, although a error message in the kernel log probably isn't needed.
Factor out the usb_remove_device() change into a standalone patch to allow conflict-free integration on top of the earliest stable branches.
[1] https://lore.kernel.org/lkml/[email protected]
--- drivers/usb/core/hub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +5 -1
@@ -958,13 +958,17 @@ int usb_remove_device(struct usb_device {struct usb_hub *hub;struct usb_interface *intf; +int ret;if (!udev->parent)/* Can't remove a root hub */ return -EINVAL ; hub =usb_hub_to_struct_hub (udev->parent); intf =to_usb_interface (hub->intfdev); -usb_autopm_get_interface (intf); + ret =usb_autopm_get_interface (intf); +if (ret <0 ) +return ret; +set_bit (udev->portnum, hub->removed_bits);hub_port_logical_disconnect (hub, udev->portnum);usb_autopm_put_interface (intf);
Greg Kroah-Hartman
maintainerPATCH 96/126 usb: core: port: do error out if usb_autopm_get_interface() fails
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit 1f8b39bc99a31759e97a0428a5c3f64802c1e61d upstream.
Reviewing a fresh portion of coverity defects in USB core (specifically CID 1458999), Alan Stern noted below in [1]:
Quoted 5 lines · Alan Stern
A revised search finds line 997 in
drivers/usb/core/hub.cand lines 216, 269 indrivers/usb/core/port.c. (I didn't try looking in any other directories.) AFAICT all three of these should check the return value, although a error message in the kernel log probably isn't needed.
Factor out the usb_port_runtime_{resume,suspend}() changes into a standalone patch to allow conflict-free porting on top of stable v3.9+.
[1] https://lore.kernel.org/lkml/[email protected]
--- drivers/usb/core/port.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/usb/core/port.c +8 -2
@@ -179,7 +179,10 @@ static int usb_port_runtime_resume(strucif (!port_dev->is_superspeed && peer)pm_runtime_get_sync (&peer->dev); -usb_autopm_get_interface (intf); + retval =usb_autopm_get_interface (intf); +if (retval <0 ) +return retval; + retval =usb_hub_set_port_power (hdev, hub, port1, true);msleep (hub_power_on_good_delay (hub));if (udev && !retval) {
@@ -232,7 +235,10 @@ static int usb_port_runtime_suspend(struif (usb_port_block_power_off)return -EBUSY ; -usb_autopm_get_interface (intf); + retval =usb_autopm_get_interface (intf); +if (retval <0 ) +return retval; + retval =usb_hub_set_port_power (hdev, hub, port1, false);usb_clear_port_feature (hdev, port1,USB_PORT_FEAT_C_CONNECTION );if (!port_dev->is_superspeed)
Greg Kroah-Hartman
maintainerPATCH 97/126 vgacon: Fix a UAF in vgacon_invert_region
In reply to Greg Kroah-HartmanFrom: Zhang Xiaoxu <[email protected]>
commit 513dc792d6060d5ef572e43852683097a8420f56 upstream.
When syzkaller tests, there is a UAF:
BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr
ffff880000100000
Read of size 2 by task syz-executor.1/16489
page:ffffea0000004000 count:0 mapcount:-127 mapping: (null)
index:0x0
page flags: 0xfffff00000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014
Call Trace:
[<ffffffffb119f309>] dump_stack+0x1e/0x20
[<ffffffffb04af957>] kasan_report+0x577/0x950
[<ffffffffb04ae652>] __asan_load2+0x62/0x80
[<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110
[<ffffffffb0a39d95>] invert_screen+0xe5/0x470
[<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0
[<ffffffffb0a3bfae>] tioclinux+0xee/0x490
[<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670
[<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10
[<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40
[<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170
[<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27
Memory state around the buggy address:
ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00
>ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff
ff ff ffIt can be reproduce in the linux mainline by the program:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <linux/vt.h>
struct tiocl_selection {
unsigned short xs; /* X start */
unsigned short ys; /* Y start */
unsigned short xe; /* X end */
unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */
};
#define TIOCL_SETSEL 2
struct tiocl {
unsigned char type;
unsigned char pad;
struct tiocl_selection sel;
};
int main()
{
int fd = 0;
const char *dev = "/dev/char/4:1"; struct vt_consize v = {0};
struct tiocl tioc = {0};
fd = open(dev, O_RDWR, 0);
v.v_rows = 3346;
ioctl(fd, VT_RESIZEX, &v);
tioc.type = TIOCL_SETSEL;
ioctl(fd, TIOCLINUX, &tioc);
return 0;}
When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access.
Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen.
So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647.
Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits:
if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL;
Reference: CVE-2020-8647 and CVE-2020-8649
--- drivers/video/console/vgacon.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/video/console/vgacon.c +3 -0
@@ -1309,6 +1309,9 @@ static int vgacon_font_get(struct vc_datstatic int vgacon_resize (struct vc_data *c,unsigned int width,unsigned int height,unsigned int user) { +if ((width <<1 ) * height > vga_vram_size) +return -EINVAL ; +if (width %2 || width > screen_info.orig_video_cols || height > (screen_info.orig_video_lines * vga_default_font_height)/ c->vc_font.height)
Greg Kroah-Hartman
maintainerPATCH 98/126 mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa
In reply to Greg Kroah-HartmanFrom: Mel Gorman <[email protected]>
commit 8b272b3cbbb50a6a8e62d8a15affd473a788e184 upstream.
: A user reported a bug against a distribution kernel while running a : proprietary workload described as "memory intensive that is not swapping" : that is expected to apply to mainline kernels. The workload is : read/write/modifying ranges of memory and checking the contents. They : reported that within a few hours that a bad PMD would be reported followed : by a memory corruption where expected data was all zeros. A partial : report of the bad PMD looked like
:
: [ 5195.338482] ../mm/pgtable-generic.c:33: bad pmd ffff8888157ba008(000002e0396009e2) : [ 5195.341184] ------------[ cut here ]------------ : [ 5195.356880] kernel BUG at ../mm/pgtable-generic.c:35! : .... : [ 5195.410033] Call Trace: : [ 5195.410471] [<ffffffff811bc75d>] change_protection_range+0x7dd/0x930 : [ 5195.410716] [<ffffffff811d4be8>] change_prot_numa+0x18/0x30 : [ 5195.410918] [<ffffffff810adefe>] task_numa_work+0x1fe/0x310 : [ 5195.411200] [<ffffffff81098322>] task_work_run+0x72/0x90 : [ 5195.411246] [<ffffffff81077139>] exit_to_usermode_loop+0x91/0xc2 : [ 5195.411494] [<ffffffff81003a51>] prepare_exit_to_usermode+0x31/0x40 : [ 5195.411739] [<ffffffff815e56af>] retint_user+0x8/0x10
:
: Decoding revealed that the PMD was a valid prot_numa PMD and the bad PMD : was a false detection. The bug does not trigger if automatic NUMA : balancing or transparent huge pages is disabled.
:
: The bug is due a race in change_pmd_range between a pmd_trans_huge and : pmd_nond_or_clear_bad check without any locks held. During the : pmd_trans_huge check, a parallel protection update under lock can have : cleared the PMD and filled it with a prot_numa entry between the transhuge : check and the pmd_none_or_clear_bad check.
:
: While this could be fixed with heavy locking, it's only necessary to make : a copy of the PMD on the stack during change_pmd_range and avoid races. A : new helper is created for this as the check if quite subtle and the : existing similar helpful is not suitable. This passed 154 hours of : testing (usually triggers between 20 minutes and 24 hours) without : detecting bad PMDs or corruption. A basic test of an autonuma-intensive : workload showed no significant change in behaviour.
Although Mel withdrew the patch on the face of LKML comment
https://lkml.org/lkml/2017/4/10/922 the race window aforementioned is still open, and we have reports of Linpack test reporting bad residuals after the bad PMD warning is observed. In addition to that, bad rss-counter and non-zero pgtables assertions are triggered on mm teardown for the task hitting the bad PMD.
host kernel: mm/pgtable-generic.c:40: bad pmd 00000000b3152f68(8000000d2d2008e7)
....
host kernel: BUG: Bad rss-counter state mm:00000000b583043d idx:1 val:512 host kernel: BUG: non-zero pgtables_bytes on freeing mm: 4096
The issue is observed on a v4.18-based distribution kernel, but the race window is expected to be applicable to mainline kernels, as well.
--- mm/mprotect.c | 38 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 36 insertions(+), 2 deletions(-)
mm/mprotect.c +36 -2
@@ -148,6 +148,31 @@ static unsigned long change_pte_range(streturn pages; } +/* +* Used when setting automatic NUMA hinting protection where it is +* critical that a numa hinting PMD is not confused with a bad PMD. +*/ +static inline int pmd_none_or_clear_bad_unless_trans_huge (pmd_t *pmd) +{ +pmd_t pmdval =pmd_read_atomic (pmd); + +/* See pmd_none_or_trans_huge_or_clear_bad for info on barrier */ +#ifdef CONFIG_TRANSPARENT_HUGEPAGE +barrier (); +#endif + +if (pmd_none (pmdval)) +return 1 ; +if (pmd_trans_huge (pmdval)) +return 0 ; +if (unlikely (pmd_bad (pmdval))) { +pmd_clear_bad (pmd); +return 1 ; + } + +return 0 ; +} +static inline unsigned long change_pmd_range (struct vm_area_struct *vma,pud_t *pud,unsigned long addr,unsigned long end,pgprot_t newprot,int dirty_accountable,int prot_numa)
@@ -164,8 +189,17 @@ static inline unsigned long change_pmd_runsigned long this_pages; next =pmd_addr_end (addr, end); -if (!is_swap_pmd (*pmd) && !pmd_trans_huge (*pmd) && !pmd_devmap (*pmd) - &&pmd_none_or_clear_bad (pmd)) + +/* +* Automatic NUMA balancing walks the tables with mmap_sem +* held for read. It's possible a parallel update to occur +* between pmd_trans_huge() and a pmd_none_or_clear_bad() +* check leading to a false positive and clearing. +* Hence, it's necessary to atomically read the PMD value +* for all the checks. +*/ +if (!is_swap_pmd (*pmd) && !pmd_devmap (*pmd) && +pmd_none_or_clear_bad_unless_trans_huge (pmd)) goto next;/* invoke the mmu notifier if the pmd is populated */
Greg Kroah-Hartman
maintainerPATCH 99/126 fat: fix uninit-memory access for partial initialized inode
In reply to Greg Kroah-HartmanFrom: OGAWA Hirofumi <[email protected]>
commit bc87302a093f0eab45cd4e250c2021299f712ec6 upstream.
When get an error in the middle of reading an inode, some fields in the inode might be still not initialized. And then the evict_inode path may access those fields via iput().
To fix, this makes sure that inode fields are initialized.
--- fs/fat/inode.c | 19 +++++++------------ 1 file changed, 7 insertions(+), 12 deletions(-)
fs/fat/inode.c +7 -12
@@ -736,6 +736,13 @@ static struct inode *fat_alloc_inode(strreturn NULL ;init_rwsem (&ei->truncate_lock); +/* Zeroing to allow iput() even if partial initialized inode. */ + ei->mmu_private =0 ; + ei->i_start =0 ; + ei->i_logstart =0 ; + ei->i_attrs =0 ; + ei->i_pos =0 ; +return &ei->vfs_inode; }
@@ -1366,16 +1373,6 @@ out:return 0 ; } -static void fat_dummy_inode_init (struct inode *inode) -{ -/* Initialize this dummy inode to work as no-op. */ -MSDOS_I (inode)->mmu_private =0 ; -MSDOS_I (inode)->i_start =0 ; -MSDOS_I (inode)->i_logstart =0 ; -MSDOS_I (inode)->i_attrs =0 ; -MSDOS_I (inode)->i_pos =0 ; -} -static int fat_read_root (struct inode *inode) {struct msdos_sb_info *sbi =MSDOS_SB (inode->i_sb);
@@ -1820,13 +1817,11 @@ int fat_fill_super(struct super_block *s fat_inode =new_inode (sb);if (!fat_inode) goto out_fail; -fat_dummy_inode_init (fat_inode); sbi->fat_inode = fat_inode; fsinfo_inode =new_inode (sb);if (!fsinfo_inode) goto out_fail; -fat_dummy_inode_init (fsinfo_inode); fsinfo_inode->i_ino =MSDOS_FSINFO_INO ; sbi->fsinfo_inode = fsinfo_inode;insert_inode_hash (fsinfo_inode);
Greg Kroah-Hartman
maintainerPATCH 100/126 arm: dts: dra76x: Fix mmc3 max-frequency
In reply to Greg Kroah-HartmanFrom: Faiz Abbas <[email protected]>
commit fa63c0039787b8fbacf4d6a51e3ff44288f5b90b upstream.
dra76x is not affected by i887 which requires mmc3 node to be limited to a max frequency of 64 MHz. Fix this by overwriting the correct value in the the dra76 specific dtsi.
--- arch/arm/boot/dts/dra76x.dtsi | 5 +++++ 1 file changed, 5 insertions(+)
arch/arm/boot/dts/dra76x.dtsi +5 -0
@@ -17,3 +17,8 @@ &crossbar_mpu { ti,irqs-skip = <10 67 68 133 139 140>; }; + +&mmc3 { + /* dra76x is not affected by i887 */ + max-frequency = <96000000>; +};
Greg Kroah-Hartman
maintainerPATCH 101/126 tty:serial:mvebu-uart:fix a wrong return
In reply to Greg Kroah-HartmanFrom: tangbin <[email protected]>
commit 4a3e208474204e879d22a310b244cb2f39e5b1f8 upstream.
in this place, the function should return a
negative value and the PTR_ERR already returns
a negative,so return -PTR_ERR() is wrong.
--- drivers/tty/serial/mvebu-uart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/mvebu-uart.c +1 -1
@@ -581,7 +581,7 @@ static int mvebu_uart_probe(struct platf port->membase =devm_ioremap_resource (&pdev->dev, reg);if (IS_ERR (port->membase)) -return -PTR_ERR (port->membase); +return PTR_ERR (port->membase); data =devm_kzalloc (&pdev->dev,sizeof (struct mvebu_uart_data ),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 102/126 serial: 8250_exar: add support for ACCES cards
In reply to Greg Kroah-HartmanFrom: Jay Dolan <[email protected]>
commit 10c5ccc3c6d32f3d7d6c07de1d3f0f4b52f3e3ab upstream.
Add ACCES VIDs and PIDs that use the Exar chips
--- drivers/tty/serial/8250/8250_exar.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+)
drivers/tty/serial/8250/8250_exar.c +33 -0
@@ -27,6 +27,14 @@#include "8250.h" +#define PCI_DEVICE_ID_ACCES_COM_2S 0x1052 +#define PCI_DEVICE_ID_ACCES_COM_4S 0x105d +#define PCI_DEVICE_ID_ACCES_COM_8S 0x106c +#define PCI_DEVICE_ID_ACCES_COM232_8 0x10a8 +#define PCI_DEVICE_ID_ACCES_COM_2SM 0x10d2 +#define PCI_DEVICE_ID_ACCES_COM_4SM 0x10db +#define PCI_DEVICE_ID_ACCES_COM_8SM 0x10ea +#define PCI_DEVICE_ID_COMMTECH_4224PCI335 0x0002#define PCI_DEVICE_ID_COMMTECH_4222PCI335 0x0004#define PCI_DEVICE_ID_COMMTECH_2324PCI335 0x000a
@@ -562,6 +570,22 @@ static int __maybe_unused exar_resume(st static SIMPLE_DEV_PM_OPS(exar_pci_pm, exar_suspend, exar_resume); +static const struct exar8250_board acces_com_2x = { + .num_ports =2 , + .setup = pci_xr17c154_setup, +}; + +static const struct exar8250_board acces_com_4x = { + .num_ports =4 , + .setup = pci_xr17c154_setup, +}; + +static const struct exar8250_board acces_com_8x = { + .num_ports =8 , + .setup = pci_xr17c154_setup, +}; + +static const struct exar8250_board pbn_fastcom335_2 = { .num_ports =2 , .setup = pci_fastcom335_setup,
@@ -632,6 +656,15 @@ static const struct exar8250_board pbn_e }static const struct pci_device_id exar_pci_tbl[] = { +EXAR_DEVICE (ACCESSIO ,ACCES_COM_2S , acces_com_2x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM_4S , acces_com_4x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM_8S , acces_com_8x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM232_8 , acces_com_8x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM_2SM , acces_com_2x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM_4SM , acces_com_4x), +EXAR_DEVICE (ACCESSIO ,ACCES_COM_8SM , acces_com_8x), + +CONNECT_DEVICE (XR17C152 ,UART_2_232 , pbn_connect),CONNECT_DEVICE (XR17C154 ,UART_4_232 , pbn_connect),CONNECT_DEVICE (XR17C158 ,UART_8_232 , pbn_connect),
Greg Kroah-Hartman
maintainerPATCH 103/126 vt: selection, close sel_buffer race
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 07e6124a1a46b4b5a9b3cacc0c306b50da87abf5 upstream.
syzkaller reported this UAF:
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 Read of size 1 at addr ffff8880089e40e9 by task syz-executor.1/13184 CPU: 0 PID: 13184 Comm: syz-executor.1 Not tainted 5.4.7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: ... kasan_report+0xe/0x20 mm/kasan/common.c:634 n_tty_receive_buf_common+0x2481/0x2940 drivers/tty/n_tty.c:1741 tty_ldisc_receive_buf+0xac/0x190 drivers/tty/tty_buffer.c:461 paste_selection+0x297/0x400 drivers/tty/vt/selection.c:372 tioclinux+0x20d/0x4e0 drivers/tty/vt/vt.c:3044 vt_ioctl+0x1bcf/0x28d0 drivers/tty/vt/vt_ioctl.c:364 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657 vfs_ioctl fs/ioctl.c:47 [inline]
It is due to a race between parallel paste_selection (TIOCL_PASTESEL) and set_selection_user (TIOCL_SETSEL) invocations. One uses sel_buffer, while the other frees it and reallocates a new one for another selection. Add a mutex to close this race.
The mutex takes care properly of sel_buffer and sel_buffer_lth only. The other selection global variables (like sel_start, sel_end, and sel_cons) are protected only in set_selection_user. The other functions need quite some more work to close the races of the variables there. This is going to happen later.
This likely fixes (I am unsure as there is no reproducer provided) bug 206361 too. It was marked as CVE-2020-8648.
--- drivers/tty/vt/selection.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
drivers/tty/vt/selection.c +17 -6
@@ -14,6 +14,7 @@#include <linux/tty.h> #include <linux/sched.h> #include <linux/mm.h> +#include <linux/mutex.h> #include <linux/slab.h> #include <linux/types.h>
@@ -43,6 +44,7 @@ static volatile int sel_start = -1; /*static int sel_end;static int sel_buffer_lth;static char *sel_buffer; +static DEFINE_MUTEX (sel_lock);/* clear_selection, highlight and highlight_pointer can be called from interrupt (via scrollback/front) */
@@ -162,7 +164,7 @@ int set_selection(const struct tiocl_selchar *bp, *obp;int i, ps, pe, multiplier;u16 c; -int mode; +int mode, ret =0 ;poke_blanked_console ();
@@ -202,6 +204,7 @@ int set_selection(const struct tiocl_sel pe = tmp; } +mutex_lock (&sel_lock);if (sel_cons != vc_cons[fg_console].d) {clear_selection (); sel_cons = vc_cons[fg_console].d;
@@ -247,9 +250,10 @@ int set_selection(const struct tiocl_selbreak ;case TIOCL_SELPOINTER :highlight_pointer (pe); -return 0 ; + goto unlock;default : -return -EINVAL ; + ret = -EINVAL ; + goto unlock; }/* remove the pointer */
@@ -271,7 +275,7 @@ int set_selection(const struct tiocl_selelse if (new_sel_start == sel_start) {if (new_sel_end == sel_end)/* no action required */ -return 0 ; + goto unlock;else if (new_sel_end > sel_end)/* extend to right */ highlight (sel_end +2 , new_sel_end);else /* contract from right */
@@ -298,7 +302,8 @@ int set_selection(const struct tiocl_selif (!bp) {printk (KERN_WARNING "selection: kmalloc() failed\n" );clear_selection (); -return -ENOMEM ; + ret = -ENOMEM ; + goto unlock; }kfree (sel_buffer); sel_buffer = bp;
@@ -323,7 +328,9 @@ int set_selection(const struct tiocl_sel } } sel_buffer_lth = bp - sel_buffer; -return 0 ; +unlock: +mutex_unlock (&sel_lock); +return ret; }/* Insert the contents of the selection buffer into the
@@ -352,6 +359,7 @@ int paste_selection(struct tty_struct *ttty_buffer_lock_exclusive (&vc->port);add_wait_queue (&vc->paste_wait, &wait); +mutex_lock (&sel_lock);while (sel_buffer && sel_buffer_lth > pasted) {set_current_state (TASK_INTERRUPTIBLE );if (signal_pending (current)) {
@@ -359,7 +367,9 @@ int paste_selection(struct tty_struct *tbreak ; }if (tty_throttled (tty)) { +mutex_unlock (&sel_lock);schedule (); +mutex_lock (&sel_lock);continue ; }__set_current_state (TASK_RUNNING );
@@ -368,6 +378,7 @@ int paste_selection(struct tty_struct *t count); pasted += count; } +mutex_unlock (&sel_lock);remove_wait_queue (&vc->paste_wait, &wait);__set_current_state (TASK_RUNNING );
Greg Kroah-Hartman
maintainerPATCH 104/126 vt: selection, push console lock down
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 4b70dd57a15d2f4685ac6e38056bad93e81e982f upstream.
We need to nest the console lock in sel_lock, so we have to push it down a bit. Fortunately, the callers of set_selection_* just lock the console lock around the function call. So moving it down is easy.
In the next patch, we switch the order.
--- drivers/tty/vt/selection.c | 13 ++++++++++++- drivers/tty/vt/vt.c | 2 -- 2 files changed, 12 insertions(+), 3 deletions(-)
drivers/tty/vt/selection.c +12 -1
@@ -157,7 +157,7 @@ static int store_utf8(u16 c, char *p)* The entire selection process is managed under the console_lock. It's * a lot under the lock but its hardly a performance path */ -int set_selection (const struct tiocl_selection __user *sel,struct tty_struct *tty) +static int __set_selection (const struct tiocl_selection __user *sel,struct tty_struct *tty) {struct vc_data *vc = vc_cons[fg_console].d;int sel_mode, new_sel_start, new_sel_end, spc;
@@ -333,6 +333,17 @@ unlock:return ret; } +int set_selection (const struct tiocl_selection __user *v,struct tty_struct *tty) +{ +int ret; + +console_lock (); + ret =__set_selection (v, tty); +console_unlock (); + +return ret; +} +/* Insert the contents of the selection buffer into the * queue of the tty associated with the current console. * Invoked by ioctl().
drivers/tty/vt/vt.c +0 -2
@@ -2688,9 +2688,7 @@ int tioclinux(struct tty_struct *tty, unswitch (type) {case TIOCL_SETSEL : -console_lock (); ret =set_selection ((struct tiocl_selection __user *)(p+1 ), tty); -console_unlock ();break ;case TIOCL_PASTESEL : ret =paste_selection (tty);
Greg Kroah-Hartman
maintainerPATCH 105/126 vt: selection, push sel_lock up
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit e8c75a30a23c6ba63f4ef6895cbf41fd42f21aa2 upstream.
sel_lock cannot nest in the console lock. Thanks to syzkaller, the kernel states firmly:
Quoted 11 lines
WARNING: possible circular locking dependency detected
5.6.0-rc3-syzkaller #0 Not tainted
------------------------------------------------------
syz-executor.4/20336 is trying to acquire lock:ffff8880a2e952a0(&tty->termios_rwsem){++++}, at:tty_unthrottle+0x22/0x100drivers/tty/tty_ioctl.c:136but task is already holding lock:
ffffffff89462e70(sel_lock){+.+.}, at:paste_selection+0x118/0x470drivers/tty/vt/selection.c:374which lock already depends on the new lock.
Quoted 8 lines
the existing dependency chain (in reverse order) is:
-> #2 (sel_lock){+.+.}:
mutex_lock_nested+0x1b/0x30 kernel/locking/mutex.c:1118 set_selection_kernel+0x3b8/0x18a0 drivers/tty/vt/selection.c:217 set_selection_user+0x63/0x80 drivers/tty/vt/selection.c:181 tioclinux+0x103/0x530 drivers/tty/vt/vt.c:3050 vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364
This is ioctl(TIOCL_SETSEL).
Locks held on the path: console_lock -> sel_lock
Quoted 6 lines
-> #1 (console_lock){+.+.}:
console_lock+0x46/0x70 kernel/printk/printk.c:2289 con_flush_chars+0x50/0x650 drivers/tty/vt/vt.c:3223 n_tty_write+0xeae/0x1200 drivers/tty/n_tty.c:2350 do_tty_write drivers/tty/tty_io.c:962 [inline] tty_write+0x5a1/0x950 drivers/tty/tty_io.c:1046
This is write().
Locks held on the path: termios_rwsem -> console_lock
Quoted 8 lines
-> #0 (&tty->termios_rwsem){++++}:
down_write+0x57/0x140 kernel/locking/rwsem.c:1534 tty_unthrottle+0x22/0x100 drivers/tty/tty_ioctl.c:136 mkiss_receive_buf+0x12aa/0x1340 drivers/net/hamradio/mkiss.c:902 tty_ldisc_receive_buf+0x12f/0x170 drivers/tty/tty_buffer.c:465 paste_selection+0x346/0x470 drivers/tty/vt/selection.c:389 tioclinux+0x121/0x530 drivers/tty/vt/vt.c:3055 vt_ioctl+0x3f1/0x3a30 drivers/tty/vt/vt_ioctl.c:364
This is ioctl(TIOCL_PASTESEL).
Locks held on the path: sel_lock -> termios_rwsem
Quoted 4 lines
other info that might help us debug this:
Chain exists of: &tty->termios_rwsem --> console_lock --> sel_lock
Clearly. From the above, we have:
console_lock -> sel_lock
sel_lock -> termios_rwsem
termios_rwsem -> console_lock
Fix this by reversing the console_lock -> sel_lock dependency in ioctl(TIOCL_SETSEL). First, lock sel_lock, then console_lock.
--- drivers/tty/vt/selection.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-)
drivers/tty/vt/selection.c +7 -9
@@ -204,7 +204,6 @@ static int __set_selection(const struct pe = tmp; } -mutex_lock (&sel_lock);if (sel_cons != vc_cons[fg_console].d) {clear_selection (); sel_cons = vc_cons[fg_console].d;
@@ -250,10 +249,9 @@ static int __set_selection(const structbreak ;case TIOCL_SELPOINTER :highlight_pointer (pe); - goto unlock; +return 0 ;default : - ret = -EINVAL ; - goto unlock; +return -EINVAL ; }/* remove the pointer */
@@ -275,7 +273,7 @@ static int __set_selection(const structelse if (new_sel_start == sel_start) {if (new_sel_end == sel_end)/* no action required */ - goto unlock; +return 0 ;else if (new_sel_end > sel_end)/* extend to right */ highlight (sel_end +2 , new_sel_end);else /* contract from right */
@@ -302,8 +300,7 @@ static int __set_selection(const structif (!bp) {printk (KERN_WARNING "selection: kmalloc() failed\n" );clear_selection (); - ret = -ENOMEM ; - goto unlock; +return -ENOMEM ; }kfree (sel_buffer); sel_buffer = bp;
@@ -328,8 +325,7 @@ static int __set_selection(const struct } } sel_buffer_lth = bp - sel_buffer; -unlock: -mutex_unlock (&sel_lock); +return ret; }
@@ -337,9 +333,11 @@ int set_selection(const struct tiocl_sel {int ret; +mutex_lock (&sel_lock);console_lock (); ret =__set_selection (v, tty);console_unlock (); +mutex_unlock (&sel_lock);return ret; }
Greg Kroah-Hartman
maintainerPATCH 106/126 x86/pkeys: Manually set X86_FEATURE_OSPKE to preserve existing changes
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 735a6dd02222d8d070c7bb748f25895239ca8c92 upstream.
Explicitly set X86_FEATURE_OSPKE via set_cpu_cap() instead of calling get_cpu_cap() to pull the feature bit from CPUID after enabling CR4.PKE. Invoking get_cpu_cap() effectively wipes out any {set,clear}_cpu_cap() changes that were made between this_cpu->c_init() and setup_pku(), as all non-synthetic feature words are reinitialized from the CPU's CPUID values.
Blasting away capability updates manifests most visibility when running on a VMX capable CPU, but with VMX disabled by BIOS. To indicate that VMX is disabled, init_ia32_feat_ctl() clears X86_FEATURE_VMX, using clear_cpu_cap() instead of setup_clear_cpu_cap() so that KVM can report which CPU is misconfigured (KVM needs to probe every CPU anyways). Restoring X86_FEATURE_VMX from CPUID causes KVM to think VMX is enabled, ultimately leading to an unexpected #GP when KVM attempts to do VMXON.
Arguably, init_ia32_feat_ctl() should use setup_clear_cpu_cap() and let KVM figure out a different way to report the misconfigured CPU, but VMX is not the only feature bit that is affected, i.e. there is precedent that tweaking feature bits via {set,clear}_cpu_cap() after ->c_init() is expected to work. Most notably, x86_init_rdrand()'s clearing of X86_FEATURE_RDRAND when RDRAND malfunctions is also overwritten.
--- arch/x86/kernel/cpu/common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/cpu/common.c +1 -1
@@ -360,7 +360,7 @@ static __always_inline void setup_pku(st* cpuid bit to be set. We need to ensure that we * update that bit in this CPU's "cpu_info". */ -get_cpu_cap (c); +set_cpu_cap (c,X86_FEATURE_OSPKE ); }#ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
Greg Kroah-Hartman
maintainerPATCH 107/126 dmaengine: tegra-apb: Fix use-after-free
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 94788af4ed039476ff3527b0e6a12c1dc42cb022 upstream.
I was doing some experiments with I2C and noticed that Tegra APB DMA driver crashes sometime after I2C DMA transfer termination. The crash happens because tegra_dma_terminate_all() bails out immediately if pending list is empty, and thus, it doesn't release the half-completed descriptors which are getting re-used before ISR tasklet kicks-in.
tegra-i2c 7000c400.i2c: DMA transfer timeout elants_i2c 0-0010: elants_i2c_irq: failed to read data: -110
------------[ cut here ]------------ WARNING: CPU: 0 PID: 142 at lib/list_debug.c:45 __list_del_entry_valid+0x45/0xac list_del corruption, ddbaac44->next is LIST_POISON1 (00000100) Modules linked in: CPU: 0 PID: 142 Comm: kworker/0:2 Not tainted 5.5.0-rc2-next-20191220-00175-gc3605715758d-dirty #538 Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) Workqueue: events_freezable_power_ thermal_zone_device_check [<c010e5c5>] (unwind_backtrace) from [<c010a1c5>] (show_stack+0x11/0x14) [<c010a1c5>] (show_stack) from [<c0973925>] (dump_stack+0x85/0x94) [<c0973925>] (dump_stack) from [<c011f529>] (__warn+0xc1/0xc4) [<c011f529>] (__warn) from [<c011f7e9>] (warn_slowpath_fmt+0x61/0x78) [<c011f7e9>] (warn_slowpath_fmt) from [<c042497d>] (__list_del_entry_valid+0x45/0xac) [<c042497d>] (__list_del_entry_valid) from [<c047a87f>] (tegra_dma_tasklet+0x5b/0x154) [<c047a87f>] (tegra_dma_tasklet) from [<c0124799>] (tasklet_action_common.constprop.0+0x41/0x7c) [<c0124799>] (tasklet_action_common.constprop.0) from [<c01022ab>] (__do_softirq+0xd3/0x2a8) [<c01022ab>] (__do_softirq) from [<c0124683>] (irq_exit+0x7b/0x98) [<c0124683>] (irq_exit) from [<c0168c19>] (__handle_domain_irq+0x45/0x80) [<c0168c19>] (__handle_domain_irq) from [<c043e429>] (gic_handle_irq+0x45/0x7c) [<c043e429>] (gic_handle_irq) from [<c0101aa5>] (__irq_svc+0x65/0x94) Exception stack(0xde2ebb90 to 0xde2ebbd8)
--- drivers/dma/tegra20-apb-dma.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/dma/tegra20-apb-dma.c +0 -4
@@ -755,10 +755,6 @@ static int tegra_dma_terminate_all(strucbool was_busy;spin_lock_irqsave (&tdc->lock, flags); -if (list_empty (&tdc->pending_sg_req)) { -spin_unlock_irqrestore (&tdc->lock, flags); -return 0 ; - }if (!tdc->busy) goto skip_dma_stop;
Greg Kroah-Hartman
maintainerPATCH 108/126 dmaengine: tegra-apb: Prevent race conditions of tasklet vs free list
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit c33ee1301c393a241d6424e36eff1071811b1064 upstream.
The interrupt handler puts a half-completed DMA descriptor on a free list and then schedules tasklet to process bottom half of the descriptor that executes client's callback, this creates possibility to pick up the busy descriptor from the free list. Thus, let's disallow descriptor's re-use until it is fully processed.
--- drivers/dma/tegra20-apb-dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/tegra20-apb-dma.c +1 -1
@@ -288,7 +288,7 @@ static struct tegra_dma_desc *tegra_dma_/* Do not allocate if desc are waiting for ack */ list_for_each_entry (dma_desc, &tdc->free_dma_desc, node) { -if (async_tx_test_ack (&dma_desc->txd)) { +if (async_tx_test_ack (&dma_desc->txd) && !dma_desc->cb_count) {list_del (&dma_desc->node);spin_unlock_irqrestore (&tdc->lock, flags); dma_desc->txd.flags =0 ;
Greg Kroah-Hartman
maintainerPATCH 109/126 dm cache: fix a crash due to incorrect work item cancelling
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 7cdf6a0aae1cccf5167f3f04ecddcf648b78e289 upstream.
The crash can be reproduced by running the lvm2 testsuite test lvconvert-thin-external-cache.sh for several minutes, e.g.:
while :; do make check T=shell/lvconvert-thin-external-cache.sh; done
The crash happens in this call chain:do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset -> memset -> __memset -- which accesses an invalid pointer in the vmalloc area.
The work entry on the workqueue is executed even after the bitmap was freed. The problem is that cancel_delayed_work doesn't wait for the running work item to finish, so the work item can continue running and re-submitting itself even after cache_postsuspend. In order to make sure that the work item won't be running, we must use cancel_delayed_work_sync.
Also, change flush_workqueue to drain_workqueue, so that if some work item submits itself or another work item, we are properly waiting for both of them.
--- drivers/md/dm-cache-target.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-cache-target.c +2 -2
@@ -2971,8 +2971,8 @@ static void cache_postsuspend(struct dm_prevent_background_work (cache);BUG_ON (atomic_read (&cache->nr_io_migrations)); -cancel_delayed_work (&cache->waker); -flush_workqueue (cache->wq); +cancel_delayed_work_sync (&cache->waker); +drain_workqueue (cache->wq);WARN_ON (cache->tracker.in_flight);/*
Greg Kroah-Hartman
maintainerPATCH 110/126 ARM: dts: ls1021a: Restore MDIO compatible to gianfar
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
commit 7155c44624d061692b4c13aa8343f119c67d4fc0 upstream.
The difference between "fsl,etsec2-mdio" and "gianfar" has to do with the .get_tbipa function, which calculates the address of the TBIPA register automatically, if not explicitly specified. [ see drivers/net/ethernet/freescale/fsl_pq_mdio.c ]. On LS1021A, the TBIPA register is at offset 0x30 within the port register block, which is what the "gianfar" method of calculating addresses actually does.
Luckily, the bad "compatible" is inconsequential for ls1021a.dtsi, because the TBIPA register is explicitly specified via the second "reg" (<0x0 0x2d10030 0x0 0x4>), so the "get_tbipa" function is dead code. Nonetheless it's good to restore it to its correct value.
Background discussion:
https://www.spinics.net/lists/stable/msg361156.html
--- arch/arm/boot/dts/ls1021a.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/ls1021a.dtsi +2 -2
@@ -562,7 +562,7 @@ }; mdio0: mdio@2d24000 { - compatible = "fsl,etsec2-mdio"; + compatible = "gianfar"; device_type = "mdio"; #address-cells = <1>; #size-cells = <0>;
@@ -570,7 +570,7 @@ }; mdio1: mdio@2d64000 { - compatible = "fsl,etsec2-mdio"; + compatible = "gianfar"; device_type = "mdio"; #address-cells = <1>; #size-cells = <0>;
Greg Kroah-Hartman
maintainerPATCH 111/126 ASoC: topology: Fix memleak in soc_tplg_link_elems_load()
In reply to Greg Kroah-HartmanFrom: Dragos Tarcatu <[email protected]>
commit 2b2d5c4db732c027a14987cfccf767dac1b45170 upstream.
If soc_tplg_link_config() fails, _link needs to be freed in case of topology ABI version mismatch. However the current code is returning directly and ends up leaking memory in this case.
This patch fixes that.
--- sound/soc/soc-topology.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
sound/soc/soc-topology.c +4 -1
@@ -2177,8 +2177,11 @@ static int soc_tplg_link_elems_load(stru } ret =soc_tplg_link_config (tplg, _link); -if (ret <0 ) +if (ret <0 ) { +if (!abi_match) +kfree (_link);return ret; + }/* offset by version-specific struct size and * real priv data size
Greg Kroah-Hartman
maintainerPATCH 112/126 ASoC: intel: skl: Fix pin debug prints
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 64bbacc5f08c01954890981c63de744df1f29a30 upstream.
skl_print_pins() loops over all given pins but it overwrites the text at the very same position while increasing the returned length. Fix this to show the all pin contents properly.
--- sound/soc/intel/skylake/skl-debug.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/soc/intel/skylake/skl-debug.c +3 -1
@@ -42,7 +42,7 @@ static ssize_t skl_print_pins(struct sklint i;ssize_t ret =0 ; -for (i =0 ; i < max_pin; i++) +for (i =0 ; i < max_pin; i++) { ret +=snprintf (buf + size,MOD_BUF - size,"%s %d\n\tModule %d\n\tInstance %d\n\t" "In-used %s\n\tType %s\n"
@@ -53,6 +53,8 @@ static ssize_t skl_print_pins(struct skl m_pin[i].in_use ?"Used" :"Unused" , m_pin[i].is_dynamic ?"Dynamic" :"Static" , m_pin[i].pin_state, i); + size += ret; + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 113/126 ASoC: intel: skl: Fix possible buffer overflow in debug outputs
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 549cd0ba04dcfe340c349cd983bd440480fae8ee upstream.
The debugfs output of intel skl driver writes strings with multiple snprintf() calls with the fixed size. This was supposed to avoid the buffer overflow but actually it still would, because snprintf() returns the expected size to be output, not the actual output size.
Fix it by replacing snprintf() calls with scnprintf().
--- sound/soc/intel/skylake/skl-debug.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-)
sound/soc/intel/skylake/skl-debug.c +14 -14
@@ -43,7 +43,7 @@ static ssize_t skl_print_pins(struct sklssize_t ret =0 ;for (i =0 ; i < max_pin; i++) { - ret += snprintf(buf + size, MOD_BUF - size, + ret += scnprintf(buf + size, MOD_BUF - size, "%s %d\n\tModule %d\n\tInstance %d\n\t" "In-used %s\n\tType %s\n" "\tState %d\n\tIndex %d\n",
@@ -61,7 +61,7 @@ static ssize_t skl_print_pins(struct sklstatic ssize_t skl_print_fmt (struct skl_module_fmt *fmt,char *buf,ssize_t size,bool direction) { - return snprintf(buf + size, MOD_BUF - size, + return scnprintf(buf + size, MOD_BUF - size, "%s\n\tCh %d\n\tFreq %d\n\tBit depth %d\n\t" "Valid bit depth %d\n\tCh config %#x\n\tInterleaving %d\n\t" "Sample Type %d\n\tCh Map %#x\n",
@@ -83,16 +83,16 @@ static ssize_t module_read(struct file *if (!buf)return -ENOMEM ; - ret =snprintf (buf,MOD_BUF ,"Module:\n\tUUID %pUL\n\tModule id %d\n" + ret =scnprintf (buf,MOD_BUF ,"Module:\n\tUUID %pUL\n\tModule id %d\n" "\tInstance id %d\n\tPvt_id %d\n" , mconfig->guid, mconfig->id.module_id, mconfig->id.instance_id, mconfig->id.pvt_id); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"Resources:\n\tMCPS %#x\n\tIBS %#x\n\tOBS %#x\t\n" , mconfig->mcps, mconfig->ibs, mconfig->obs); - ret += snprintf(buf + ret, MOD_BUF - ret, + ret += scnprintf(buf + ret, MOD_BUF - ret, "Module data:\n\tCore %d\n\tIn queue %d\n\t" "Out queue %d\n\tType %s\n", mconfig->core_id, mconfig->max_in_queue,
@@ -102,38 +102,38 @@ static ssize_t module_read(struct file * ret +=skl_print_fmt (mconfig->in_fmt, buf, ret, true); ret +=skl_print_fmt (mconfig->out_fmt, buf, ret, false); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"Fixup:\n\tParams %#x\n\tConverter %#x\n" , mconfig->params_fixup, mconfig->converter); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"Module Gateway:\n\tType %#x\n\tVbus %#x\n\tHW conn %#x\n\tSlot %#x\n" , mconfig->dev_type, mconfig->vbus_id, mconfig->hw_conn_type, mconfig->time_slot); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"Pipeline:\n\tID %d\n\tPriority %d\n\tConn Type %d\n\t" "Pages %#x\n" , mconfig->pipe->ppl_id, mconfig->pipe->pipe_priority, mconfig->pipe->conn_type, mconfig->pipe->memory_pages); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"\tParams:\n\t\tHost DMA %d\n\t\tLink DMA %d\n" , mconfig->pipe->p_params->host_dma_id, mconfig->pipe->p_params->link_dma_id); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"\tPCM params:\n\t\tCh %d\n\t\tFreq %d\n\t\tFormat %d\n" , mconfig->pipe->p_params->ch, mconfig->pipe->p_params->s_freq, mconfig->pipe->p_params->s_fmt); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"\tLink %#x\n\tStream %#x\n" , mconfig->pipe->p_params->linktype, mconfig->pipe->p_params->stream); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"\tState %d\n\tPassthru %s\n" , mconfig->pipe->state, mconfig->pipe->passthru ?"true" :"false" );
@@ -143,7 +143,7 @@ static ssize_t module_read(struct file * ret +=skl_print_pins (mconfig->m_out_pin, buf, mconfig->max_out_queue, ret, false); - ret +=snprintf (buf + ret,MOD_BUF - ret, + ret +=scnprintf (buf + ret,MOD_BUF - ret,"Other:\n\tDomain %d\n\tHomogenous Input %s\n\t" "Homogenous Output %s\n\tIn Queue Mask %d\n\t" "Out Queue Mask %d\n\tDMA ID %d\n\tMem Pages %d\n\t"
@@ -201,7 +201,7 @@ static ssize_t fw_softreg_read(struct fi__ioread32_copy (d->fw_read_buff, fw_reg_addr, w0_stat_sz >>2 );for (offset =0 ; offset <FW_REG_SIZE ; offset +=16 ) { - ret +=snprintf (tmp + ret,FW_REG_BUF - ret,"%#.4x: " , offset); + ret +=scnprintf (tmp + ret,FW_REG_BUF - ret,"%#.4x: " , offset);hex_dump_to_buffer (d->fw_read_buff + offset,16 ,16 ,4 , tmp + ret,FW_REG_BUF - ret,0 ); ret +=strlen (tmp + ret);
Greg Kroah-Hartman
maintainerPATCH 114/126 ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream.
dpcm_show_state() invokes multiple snprintf() calls to concatenate formatted strings on the fixed size buffer. The usage of snprintf() is supposed for avoiding the buffer overflow, but it doesn't work as expected because snprintf() doesn't return the actual output size but the size to be written.
Fix this bug by replacing all snprintf() calls with scnprintf() calls.
--- sound/soc/soc-pcm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
sound/soc/soc-pcm.c +8 -8
@@ -2957,16 +2957,16 @@ static ssize_t dpcm_show_state(struct snssize_t offset =0 ;/* FE state */ - offset +=snprintf (buf + offset, size - offset, + offset +=scnprintf (buf + offset, size - offset,"[%s - %s]\n" , fe->dai_link->name, stream ?"Capture" :"Playback" ); - offset +=snprintf (buf + offset, size - offset,"State: %s\n" , + offset +=scnprintf (buf + offset, size - offset,"State: %s\n" ,dpcm_state_string (fe->dpcm[stream].state));if ((fe->dpcm[stream].state >=SND_SOC_DPCM_STATE_HW_PARAMS ) && (fe->dpcm[stream].state <=SND_SOC_DPCM_STATE_STOP )) - offset += snprintf(buf + offset, size - offset, + offset += scnprintf(buf + offset, size - offset, "Hardware Params: " "Format = %s, Channels = %d, Rate = %d\n", snd_pcm_format_name(params_format(params)),
@@ -2974,10 +2974,10 @@ static ssize_t dpcm_show_state(struct sn params_rate(params));/* BEs state */ - offset +=snprintf (buf + offset, size - offset,"Backends:\n" ); + offset +=scnprintf (buf + offset, size - offset,"Backends:\n" );if (list_empty (&fe->dpcm[stream].be_clients)) { - offset +=snprintf (buf + offset, size - offset, + offset +=scnprintf (buf + offset, size - offset," No active DSP links\n" ); goto out; }
@@ -2986,16 +2986,16 @@ static ssize_t dpcm_show_state(struct snstruct snd_soc_pcm_runtime *be = dpcm->be; params = &dpcm->hw_params; - offset +=snprintf (buf + offset, size - offset, + offset +=scnprintf (buf + offset, size - offset,"- %s\n" , be->dai_link->name); - offset +=snprintf (buf + offset, size - offset, + offset +=scnprintf (buf + offset, size - offset," State: %s\n" ,dpcm_state_string (be->dpcm[stream].state));if ((be->dpcm[stream].state >=SND_SOC_DPCM_STATE_HW_PARAMS ) && (be->dpcm[stream].state <=SND_SOC_DPCM_STATE_STOP )) - offset += snprintf(buf + offset, size - offset, + offset += scnprintf(buf + offset, size - offset, " Hardware Params: " "Format = %s, Channels = %d, Rate = %d\n", snd_pcm_format_name(params_format(params)),
Greg Kroah-Hartman
maintainerPATCH 115/126 ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path
In reply to Greg Kroah-HartmanFrom: Matthias Reichl <[email protected]>
commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 upstream.
When we get a clock error during probe we have to call regulator_bulk_disable before bailing out, otherwise we trigger a warning in regulator_put.
Fix this by using "goto err" like in the error cases above.
--- sound/soc/codecs/pcm512x.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
sound/soc/codecs/pcm512x.c +5 -3
@@ -1438,13 +1438,15 @@ int pcm512x_probe(struct device *dev, st } pcm512x->sclk =devm_clk_get (dev,NULL ); -if (PTR_ERR (pcm512x->sclk) == -EPROBE_DEFER ) -return -EPROBE_DEFER ; +if (PTR_ERR (pcm512x->sclk) == -EPROBE_DEFER ) { + ret = -EPROBE_DEFER ; + goto err; + }if (!IS_ERR (pcm512x->sclk)) { ret =clk_prepare_enable (pcm512x->sclk);if (ret !=0 ) {dev_err (dev,"Failed to enable SCLK: %d\n" , ret); -return ret; + goto err; } }
Greg Kroah-Hartman
maintainerPATCH 116/126 ASoC: dapm: Correct DAPM handling of active widgets during shutdown
In reply to Greg Kroah-HartmanFrom: Charles Keepax <[email protected]>
commit 9b3193089e77d3b59b045146ff1c770dd899acb1 upstream.
commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a set of the power state during snd_soc_dapm_shutdown to ensure the widgets powered off. However, when commit 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written") added the new_power member of the widget structure, to differentiate between the current power state and the target power state, it did not update the shutdown to use the new_power member.
As new_power has not updated it will be left in the state set by the last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence for the shutdown proceeds it will turn the widgets on (despite them already being on) rather than turning them off.
--- sound/soc/soc-dapm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/soc-dapm.c +1 -1
@@ -4481,7 +4481,7 @@ static void soc_dapm_shutdown_dapm(struccontinue ;if (w->power) {dapm_seq_insert (w, &down_list, false); - w->power =0 ; + w->new_power =0 ; powerdown =1 ; } }
Greg Kroah-Hartman
maintainerPATCH 117/126 RDMA/iwcm: Fix iwcm work deallocation
In reply to Greg Kroah-HartmanFrom: Bernard Metzler <[email protected]>
commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad upstream.
The dealloc_work_entries() function must update the work_free_list pointer while freeing its entries, since potentially called again on same list. A second iteration of the work list caused system crash. This happens, if work allocation fails during cma_iw_listen() and free_cm_id() tries to free the list again during cleanup.
--- drivers/infiniband/core/iwcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/core/iwcm.c +3 -1
@@ -158,8 +158,10 @@ static void dealloc_work_entries(struct {struct list_head *e, *tmp; -list_for_each_safe (e, tmp, &cm_id_priv->work_free_list) +list_for_each_safe (e, tmp, &cm_id_priv->work_free_list) { +list_del (e);kfree (list_entry(e ,struct iwcm_work ,free_list )); + } }static int alloc_work_entries (struct iwcm_id_private *cm_id_priv,int count)
Greg Kroah-Hartman
maintainerPATCH 118/126 RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen()
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec upstream.
The algorithm pre-allocates a cm_id since allocation cannot be done while holding the cm.lock spinlock, however it doesn't free it on one error path, leading to a memory leak.
--- drivers/infiniband/core/cm.c | 1 + 1 file changed, 1 insertion(+)
drivers/infiniband/core/cm.c +1 -0
@@ -1143,6 +1143,7 @@ struct ib_cm_id *ib_cm_insert_listen(str/* Sharing an ib_cm_id with different handlers is not * supported */ spin_unlock_irqrestore (&cm.lock, flags); +ib_destroy_cm_id (cm_id);return ERR_PTR (-EINVAL ); }atomic_inc (&cm_id_priv->refcount);
Greg Kroah-Hartman
maintainerPATCH 119/126 IB/hfi1, qib: Ensure RCU is locked when accessing list
In reply to Greg Kroah-HartmanFrom: Dennis Dalessandro <[email protected]>
commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream.
The packet handling function, specifically the iteration of the qp list for mad packet processing misses locking RCU before running through the list. Not only is this incorrect, but the list_for_each_entry_rcu() call can not be called with a conditional check for lock dependency. Remedy this by invoking the rcu lock and unlock around the critical section.
This brings MAD packet processing in line with what is done for non-MAD packets.
--- drivers/infiniband/hw/hfi1/verbs.c | 4 +++- drivers/infiniband/hw/qib/qib_verbs.c | 2 ++ 2 files changed, 5 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/verbs.c +3 -1
@@ -593,10 +593,11 @@ static inline void hfi1_handle_packet(st opa_get_lid(packet->dlid, 9B));if (!mcast) goto drop; +rcu_read_lock ();list_for_each_entry_rcu (p, &mcast->qp_list, list) { packet->qp = p->qp;if (hfi1_do_pkey_check (packet)) - goto drop; + goto unlock_drop;spin_lock_irqsave (&packet->qp->r_lock, flags); packet_handler =qp_ok (packet);if (likely (packet_handler))
@@ -605,6 +606,7 @@ static inline void hfi1_handle_packet(st ibp->rvp.n_pkt_drops++;spin_unlock_irqrestore (&packet->qp->r_lock, flags); } +rcu_read_unlock ();/* * Notify rvt_multicast_detach() if it is waiting for us * to finish.
drivers/infiniband/hw/qib/qib_verbs.c +2 -0
@@ -360,8 +360,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcdif (mcast ==NULL ) goto drop;this_cpu_inc (ibp->pmastats->n_multicast_rcv); +rcu_read_lock ();list_for_each_entry_rcu (p, &mcast->qp_list, list)qib_qp_rcv (rcd, hdr,1 , data, tlen, p->qp); +rcu_read_unlock ();/* * Notify rvt_multicast_detach() if it is waiting for us * to finish.
Greg Kroah-Hartman
maintainerPATCH 120/126 ARM: imx: build v7_cpu_resume() unconditionally
In reply to Greg Kroah-HartmanFrom: Ahmad Fatoum <[email protected]>
commit 512a928affd51c2dc631401e56ad5ee5d5dd68b6 upstream.
This function is not only needed by the platform suspend code, but is also reused as the CPU resume function when the ARM cores can be powered down completely in deep idle, which is the case on i.MX6SX and i.MX6UL(L).
Providing the static inline stub whenever CONFIG_SUSPEND is disabled means that those platforms will hang on resume from cpuidle if suspend is disabled.
So there are two problems:
- The static inline stub masks the linker error
- The function is not available where needed
Fix both by just building the function unconditionally, when CONFIG_SOC_IMX6 is enabled. The actual code is three instructions long, so it's arguably ok to just leave it in for all i.MX6 kernel configurations.
--- arch/arm/mach-imx/Makefile | 2 ++ arch/arm/mach-imx/common.h | 4 ++-- arch/arm/mach-imx/resume-imx6.S | 24 ++++++++++++++++++++++++ arch/arm/mach-imx/suspend-imx6.S | 14 -------------- 4 files changed, 28 insertions(+), 16 deletions(-)
arch/arm/mach-imx/Makefile +2 -0
@@ -87,6 +87,8 @@ AFLAGS_suspend-imx6.o :=-Wa,-march=armv7 obj-$(CONFIG_SOC_IMX6) += suspend-imx6.o obj-$(CONFIG_SOC_IMX53) += suspend-imx53.o endif +AFLAGS_resume-imx6.o :=-Wa,-march=armv7-a +obj-$(CONFIG_SOC_IMX6) += resume-imx6.o obj-$(CONFIG_SOC_IMX6) += pm-imx6.o obj-$(CONFIG_SOC_IMX1) += mach-imx1.o
arch/arm/mach-imx/common.h +2 -2
@@ -111,17 +111,17 @@ void imx_cpu_die(unsigned int cpu);int imx_cpu_kill (unsigned int cpu);#ifdef CONFIG_SUSPEND -void v7_cpu_resume (void );void imx53_suspend (void __iomem *ocram_vbase);extern const u32 imx53_suspend_sz;void imx6_suspend (void __iomem *ocram_vbase);#else -static inline void v7_cpu_resume (void ) {}static inline void imx53_suspend (void __iomem *ocram_vbase) {}static const u32 imx53_suspend_sz;static inline void imx6_suspend (void __iomem *ocram_vbase) {}#endif +void v7_cpu_resume (void ); +void imx6_pm_ccm_init (const char *ccm_compat);void imx6q_pm_init (void );void imx6dl_pm_init (void );
arch/arm/mach-imx/resume-imx6.S new file +24 -0
@@ -0,0 +1,24 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Copyright 2014 Freescale Semiconductor, Inc. + */ + +#include <linux/linkage.h> +#include <asm/assembler.h> +#include <asm/asm-offsets.h> +#include <asm/hardware/cache-l2x0.h> +#include "hardware.h" + +/* + * The following code must assume it is running from physical address + * where absolute virtual addresses to the data section have to be + * turned into relative ones. + */ + +ENTRY(v7_cpu_resume) + bl v7_invalidate_l1 +#ifdef CONFIG_CACHE_L2X0 + bl l2c310_early_resume +#endif + b cpu_resume +ENDPROC(v7_cpu_resume)
arch/arm/mach-imx/suspend-imx6.S +0 -14
@@ -333,17 +333,3 @@ resume: ret lr ENDPROC(imx6_suspend) - -/* - * The following code must assume it is running from physical address - * where absolute virtual addresses to the data section have to be - * turned into relative ones. - */ - -ENTRY(v7_cpu_resume) - bl v7_invalidate_l1 -#ifdef CONFIG_CACHE_L2X0 - bl l2c310_early_resume -#endif - b cpu_resume -ENDPROC(v7_cpu_resume)
Greg Kroah-Hartman
maintainerPATCH 121/126 ARM: dts: imx6dl-colibri-eval-v3: fix sram compatible properties
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bcbf53a0dab50980867476994f6079c1ec5bb3a3 upstream.
The sram-node compatible properties have mistakingly combined the model-specific string with the generic "mtd-ram" string.
Note that neither "cy7c1019dv33-10zsxi, mtd-ram" or "cy7c1019dv33-10zsxi" are used by any in-kernel driver and they are not present in any binding.
The physmap driver will however bind to platform devices that specify "mtd-ram".
--- arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx6dl-colibri-eval-v3.dts +2 -2
@@ -231,7 +231,7 @@ /* SRAM on Colibri nEXT_CS0 */ sram@0,0 { - compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram"; + compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram"; reg = <0 0 0x00010000>; #address-cells = <1>; #size-cells = <1>;
@@ -242,7 +242,7 @@ /* SRAM on Colibri nEXT_CS1 */ sram@1,0 { - compatible = "cypress,cy7c1019dv33-10zsxi, mtd-ram"; + compatible = "cypress,cy7c1019dv33-10zsxi", "mtd-ram"; reg = <1 0 0x00010000>; #address-cells = <1>; #size-cells = <1>;
Greg Kroah-Hartman
maintainerPATCH 122/126 hwmon: (adt7462) Fix an error return in ADT7462_REG_VOLT()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 44f2f882909fedfc3a56e4b90026910456019743 upstream.
This is only called from adt7462_update_device(). The caller expects it to return zero on error. I fixed a similar issue earlier in commit a4bf06d58f21 ("hwmon: (adt7462) ADT7462_REG_VOLT_MAX() should return 0") but I missed this one.
--- drivers/hwmon/adt7462.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/adt7462.c +1 -1
@@ -426,7 +426,7 @@ static int ADT7462_REG_VOLT(struct adt74return 0x95 ;break ; } -return -ENODEV ; +return 0 ; }/* Provide labels for sysfs */
Greg Kroah-Hartman
maintainerPATCH 123/126 dmaengine: coh901318: Fix a double lock bug in dma_tc_handle()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 36d5d22090d13fd3a7a8c9663a711cbe6970aac8 upstream.
The caller is already holding the lock so this will deadlock.
--- drivers/dma/coh901318.c | 4 ---- 1 file changed, 4 deletions(-)
drivers/dma/coh901318.c +0 -4
@@ -1944,8 +1944,6 @@ static void dma_tc_handle(struct coh9013return ; } -spin_lock (&cohc->lock); -/* * When we reach this point, at least one queue item * should have been moved over from cohc->queue to
@@ -1966,8 +1964,6 @@ static void dma_tc_handle(struct coh9013if (coh901318_queue_start (cohc) ==NULL ) cohc->busy =0 ; -spin_unlock (&cohc->lock); -/* * This tasklet will remove items from cohc->active * and thus terminates them.
Greg Kroah-Hartman
maintainerPATCH 124/126 powerpc: fix hardware PMU exception bug on PowerVM compatibility mode systems
In reply to Greg Kroah-HartmanFrom: Desnes A. Nunes do Rosario <[email protected]>
commit fc37a1632d40c80c067eb1bc235139f5867a2667 upstream.
PowerVM systems running compatibility mode on a few Power8 revisions are still vulnerable to the hardware defect that loses PMU exceptions arriving prior to a context switch.
The software fix for this issue is enabled through the CPU_FTR_PMAO_BUG cpu_feature bit, nevertheless this bit also needs to be set for PowerVM compatibility mode systems.
--- arch/powerpc/kernel/cputable.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
arch/powerpc/kernel/cputable.c +3 -1
@@ -2232,11 +2232,13 @@ static struct cpu_spec * __init setup_cp* oprofile_cpu_type already has a value, then we are * possibly overriding a real PVR with a logical one, * and, in that case, keep the current value for -* oprofile_cpu_type. +* oprofile_cpu_type. Futhermore, let's ensure that the +* fix for the PMAO bug is enabled on compatibility mode. */ if (old.oprofile_cpu_type !=NULL ) { t->oprofile_cpu_type = old.oprofile_cpu_type; t->oprofile_type = old.oprofile_type; + t->cpu_features |= old.cpu_features &CPU_FTR_PMAO_BUG ; } }
Greg Kroah-Hartman
maintainerPATCH 125/126 dm integrity: fix a deadlock due to offloading to an incorrect workqueue
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 53770f0ec5fd417429775ba006bc4abe14002335 upstream.
If we need to perform synchronous I/O in dm_integrity_map_continue(), we must make sure that we are not in the map function - in order to avoid the deadlock due to bio queuing in generic_make_request. To avoid the deadlock, we offload the request to metadata_wq.
However, metadata_wq also processes metadata updates for write requests. If there are too many requests that get offloaded to metadata_wq at the beginning of dm_integrity_map_continue, the workqueue metadata_wq becomes clogged and the system is incapable of processing any metadata updates.
This causes a deadlock because all the requests that need to do metadata updates wait for metadata_wq to proceed and metadata_wq waits inside wait_and_add_new_range until some existing request releases its range lock (which doesn't happen because the range lock is released after metadata update).
In order to fix the deadlock, we create a new workqueue offload_wq and offload requests to it - so that processing of offload_wq is independent from processing of metadata_wq.
--- drivers/md/dm-integrity.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/md/dm-integrity.c +13 -2
@@ -187,6 +187,7 @@ struct dm_integrity_c {struct rb_root in_progress;wait_queue_head_t endio_wait;struct workqueue_struct *wait_wq; +struct workqueue_struct *offload_wq;unsigned char commit_seq;commit_id_t commit_ids[N_COMMIT_IDS ];
@@ -1157,7 +1158,7 @@ static void dec_in_flight(struct dm_inte dio->range.logical_sector += dio->range.n_sectors;bio_advance (bio, dio->range.n_sectors <<SECTOR_SHIFT );INIT_WORK (&dio->work, integrity_bio_wait); -queue_work (ic->wait_wq, &dio->work); +queue_work (ic->offload_wq, &dio->work);return ; }do_endio_flush (ic, dio);
@@ -1577,7 +1578,7 @@ static void dm_integrity_map_continue(stif (need_sync_io && from_map) {INIT_WORK (&dio->work, integrity_bio_wait); -queue_work (ic->metadata_wq, &dio->work); +queue_work (ic->offload_wq, &dio->work);return ; }
@@ -3005,6 +3006,14 @@ static int dm_integrity_ctr(struct dm_ta goto bad; } + ic->offload_wq =alloc_workqueue ("dm-integrity-offload" ,WQ_MEM_RECLAIM , +METADATA_WORKQUEUE_MAX_ACTIVE ); +if (!ic->offload_wq) { + ti->error ="Cannot allocate workqueue" ; + r = -ENOMEM ; + goto bad; + } + ic->commit_wq =alloc_workqueue ("dm-integrity-commit" ,WQ_MEM_RECLAIM ,1 );if (!ic->commit_wq) { ti->error ="Cannot allocate workqueue" ;
@@ -3189,6 +3198,8 @@ static void dm_integrity_dtr(struct dm_tdestroy_workqueue (ic->metadata_wq);if (ic->wait_wq)destroy_workqueue (ic->wait_wq); +if (ic->offload_wq) +destroy_workqueue (ic->offload_wq);if (ic->commit_wq)destroy_workqueue (ic->commit_wq);if (ic->writer_wq)
Greg Kroah-Hartman
maintainerPATCH 126/126 xhci: handle port status events for removed USB3 hcd
In reply to Greg Kroah-HartmanFrom: Mathias Nyman <[email protected]>
commit 1245374e9b8340fc255fd51b2015173a83050d03 upstream.
At xhci removal the USB3 hcd (shared_hcd) is removed before the primary USB2 hcd. Interrupts for port status changes may still occur for USB3 ports after the shared_hcd is freed, causing NULL pointer dereference.
Check if xhci->shared_hcd is still valid before handing USB3 port events
--- drivers/usb/host/xhci-ring.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/host/xhci-ring.c +6 -0
@@ -1640,6 +1640,12 @@ static void handle_port_status(struct xhif ((major_revision ==0x03 ) != (hcd->speed >=HCD_USB3 )) hcd = xhci->shared_hcd; +if (!hcd) { +xhci_dbg (xhci,"No hcd found for port %u event\n" , port_id); + bogus_port_status = true; + goto cleanup; + } +if (major_revision ==0 ) { xhci_warn(xhci, "Event for port %u not in " "Extended Capabilities, ignoring.\n",
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
24 tests: 24 pass, 0 failLinux version: 4.14.173-rc1-gd5b7f770c4ed
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. I have a new alert on my system:
RIP: kvm_mmu_set_mmio_spte_mask+0x34/0x40 [kvm] RSP: ffffb4f7415b7be8
I haven't tracked it yet.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 17 lines · shuah
Quoted 16 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
Quoted 8 lines
Quoted 2 lines
greg k-h
Compiled and booted on my test system. I have a new alert on my system:
RIP: kvm_mmu_set_mmio_spte_mask+0x34/0x40 [kvm] RSP: ffffb4f7415b7be8I haven't tracked it yet.
I think I know what this is, let me release a -rc2 with the proposed fix.
thanks,
greg k-h
Hi Shuah
Quoted 4 lines
Compiled and booted on my test system. I have a new alert on my system:
RIP: kvm_mmu_set_mmio_spte_mask+0x34/0x40 [kvm] RSP: ffffb4f7415b7be8
Our system did not catch this alert.
Please share your kernel config file and steps to reproduce and any extra kernel boot args ?
- Naresh
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
Build results:
total: 172 pass: 172 fail: 0 Qemu test results: total: 401 pass: 401 fail: 0
Guenter
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.173-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: d5b7f770c4ed8ec0f3efb2a110406d2199fab05e
git describe: v4.14.172-127-gd5b7f770c4ed
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.172-127-gd5b7f770c4ed
No regressions (compared to build v4.14.172)
No fixes (compared to build v4.14.172)
Ran 24996 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* kselftest
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* network-basic-tests
* kvm-unit-tests
* ltp-cap_bounds-64k-page_size-tests
* ltp-cap_bounds-kasan-tests
* ltp-commands-64k-page_size-tests
* ltp-commands-kasan-tests
* ltp-containers-64k-page_size-tests
* ltp-containers-kasan-tests
* ltp-cpuhotplug-64k-page_size-tests
* ltp-cpuhotplug-kasan-tests
* ltp-crypto-64k-page_size-tests
* ltp-crypto-kasan-tests
* ltp-cve-64k-page_size-tests
* ltp-cve-kasan-tests
* ltp-dio-64k-page_size-tests
* ltp-dio-kasan-tests
* ltp-fcntl-locktests-64k-page_size-tests
* ltp-fcntl-locktests-kasan-tests
* ltp-filecaps-64k-page_size-tests
* ltp-filecaps-kasan-tests
* ltp-fs-64k-page_size-tests
* ltp-fs-kasan-tests
* ltp-fs_bind-64k-page_size-tests
* ltp-fs_bind-kasan-tests
* ltp-fs_perms_simple-64k-page_size-tests
* ltp-fs_perms_simple-kasan-tests
* ltp-fsx-64k-page_size-tests
* ltp-fsx-kasan-tests
* ltp-hugetlb-64k-page_size-tests
* ltp-hugetlb-kasan-tests
* ltp-io-64k-page_size-tests
* ltp-io-kasan-tests
* ltp-ipc-64k-page_size-tests
* ltp-ipc-kasan-tests
* ltp-math-64k-page_size-tests
* ltp-math-kasan-tests
* ltp-mm-64k-page_size-tests
* ltp-nptl-64k-page_size-tests
* ltp-nptl-kasan-tests
* ltp-pty-64k-page_size-tests
* ltp-pty-kasan-tests
* ltp-sched-64k-page_size-tests
* ltp-sched-kasan-tests
* ltp-securebits-64k-page_size-tests
* ltp-securebits-kasan-tests
* ltp-syscalls-64k-page_size-tests
* ltp-syscalls-kasan-tests
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ltp-mm-kasan-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Greg Kroah-Hartman
maintainerQuoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.
I have pushed out a -rc2 release to resolve a reported KVM problem now.
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc2.gz
thanks,
greg k-h
Quoted 15 lines · Greg Kroah-Hartman
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.
Quoted 7 lines
I have pushed out a -rc2 release to resolve a reported KVM problem now.
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc2.gzthanks,
greg k-h
All clear now on rc2. The kvm problem is gone.
thanks,
-- Shuah
Greg Kroah-Hartman
maintainerQuoted 19 lines · shuah
Quoted 18 lines · Greg Kroah-Hartman
Quoted 5 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.173 release. There are 126 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Thu, 12 Mar 2020 12:41:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.I have pushed out a -rc2 release to resolve a reported KVM problem now.
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.173-rc2.gz
Quoted 6 lines
Quoted 4 lines
thanks,
greg k-h
All clear now on rc2. The kvm problem is gone.
Wonderful, thanks for testing and letting me know.
greg k-h