4.14.181-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.181-rc1 review
This is the start of the stable review cycle for the 4.14.181 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 May 2020 17:32:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.181-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.181-rc1
Sergei Trofimovich <[email protected]>
Makefile: disallow data races on gcc-10 as well
Jim Mattson <[email protected]>
KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
Geert Uytterhoeven <[email protected]>
ARM: dts: r8a7740: Add missing extal2 to CPG node
Geert Uytterhoeven <[email protected]>
ARM: dts: r8a73a4: Add missing CMT1 interrupts
Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
Chen-Yu Tsai <[email protected]>
arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards
Kai-Heng Feng <[email protected]>
Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
Wei Yongjun <[email protected]>
usb: gadget: legacy: fix error return code in cdc_bind()
Wei Yongjun <[email protected]>
usb: gadget: legacy: fix error return code in gncm_bind()
Christophe JAILLET <[email protected]>
usb: gadget: audio: Fix a missing error return value in audio_bind()
Christophe JAILLET <[email protected]>
usb: gadget: net2272: Fix a memory leak in an error handling path in 'net2272_plat_probe()'
Justin Swartz <[email protected]>
clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks
Eric W. Biederman <[email protected]>
exec: Move would_dump into flush_old_exec
Josh Poimboeuf <[email protected]>
x86/unwind/orc: Fix error handling in __unwind_start()
Sriharsha Allenki <[email protected]>
usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
Kyungtae Kim <[email protected]>
USB: gadget: fix illegal array access in binding with UDC
Li Jun <[email protected]>
usb: host: xhci-plat: keep runtime active when removing host
Eugeniu Rosca <[email protected]>
usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
Jesus Ramos <[email protected]>
ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
Borislav Petkov <[email protected]>
x86: Fix early boot crash on gcc-10, third try
Fabio Estevam <[email protected]>
ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
Kishon Vijay Abraham I <[email protected]>
ARM: dts: dra7: Fix bus_dma_limit for PCIe
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
Takashi Iwai <[email protected]>
ALSA: rawmidi: Initialize allocated buffers
Takashi Iwai <[email protected]>
ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
Kelly Littlepage <[email protected]>
net: tcp: fix rx timestamp behavior for tcp_recvmsg
Zefan Li <[email protected]>
netprio_cgroup: Fix unlimited memory leak of v2 cgroups
Paolo Abeni <[email protected]>
net: ipv4: really enforce backoff for redirects
Florian Fainelli <[email protected]>
net: dsa: loop: Add module soft dependency
Luo bin <[email protected]>
hinic: fix a bug of ndo_stop
Maciej Żenczykowski <[email protected]>
Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
Heiner Kallweit <[email protected]>
net: phy: fix aneg restart in phy_ethtool_set_eee
Paolo Abeni <[email protected]>
netlabel: cope with NULL catmap
Cong Wang <[email protected]>
net: fix a potential recursive NETDEV_FEAT_CHANGE
Florian Fainelli <[email protected]>
net: phy: micrel: Use strlcpy() for ethtool::get_strings
Jan Beulich <[email protected]>
x86/asm: Add instruction suffixes to bitops
Linus Torvalds <[email protected]>
gcc-10: avoid shadowing standard library 'free()' in crypto
Linus Torvalds <[email protected]>
gcc-10: disable 'restrict' warning for now
Linus Torvalds <[email protected]>
gcc-10: disable 'stringop-overflow' warning for now
Linus Torvalds <[email protected]>
gcc-10: disable 'array-bounds' warning for now
Linus Torvalds <[email protected]>
gcc-10: disable 'zero-length-bounds' warning for now
Linus Torvalds <[email protected]>
Stop the ad-hoc games with -Wno-maybe-initialized
Masahiro Yamada <[email protected]>
kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
Linus Torvalds <[email protected]>
gcc-10 warnings: fix low-hanging fruit
Jason Gunthorpe <[email protected]>
pnp: Use list_for_each_entry() instead of open coding
Samu Nuutamo <[email protected]>
hwmon: (da9052) Synchronize access with mfd
Jack Morgenstein <[email protected]>
IB/mlx4: Test return value of calls to ib_get_cached_pkey
Arnd Bergmann <[email protected]>
netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
Dan Carpenter <[email protected]>
i40iw: Fix error handling in i40iw_manage_arp_cache()
Grace Kao <[email protected]>
pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
Andy Shevchenko <[email protected]>
pinctrl: baytrail: Enable pin configuration setting for GPIO chip
Gustavo A. R. Silva <[email protected]>
ipmi: Fix NULL pointer dereference in ssif_probe
Josh Poimboeuf <[email protected]>
x86/entry/64: Fix unwind hints in register clearing code
Kai-Heng Feng <[email protected]>
ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
Vasily Averin <[email protected]>
ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
Vasily Averin <[email protected]>
drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
Kai Vehmanen <[email protected]>
ALSA: hda/hdmi: fix race in monitor detection during probe
Chris Wilson <[email protected]>
cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once
Lubomir Rintel <[email protected]>
dmaengine: mmp_tdma: Reset channel error on release
Madhuparna Bhowmik <[email protected]>
dmaengine: pch_dma.c: Avoid data race between probe and irq handler
Wu Bo <[email protected]>
scsi: sg: add sg_remove_request in sg_write
Stefan Hajnoczi <[email protected]>
virtio-blk: handle block_device_operations callbacks after hot unplug
Arnd Bergmann <[email protected]>
drop_monitor: work around gcc-10 stringop-overflow warning
Christophe JAILLET <[email protected]>
net: moxa: Fix a potential double 'free_irq()'
Christophe JAILLET <[email protected]>
net/sonic: Fix a resource leak in an error handling path in 'jazz_sonic_probe()'
Hugh Dickins <[email protected]>
shmem: fix possible deadlocks on shmlock_user_lock
Thierry Reding <[email protected]>
net: stmmac: Use mutex instead of spinlock
Randall Huang <[email protected]>
f2fs: fix to avoid memory leakage in f2fs_listxattr
Randall Huang <[email protected]>
f2fs: fix to avoid accessing xattr across the boundary
Jaegeuk Kim <[email protected]>
f2fs: sanity check of xattr entry size
Chao Yu <[email protected]>
f2fs: introduce read_xattr_block
Chao Yu <[email protected]>
f2fs: introduce read_inline_xattr
Cengiz Can <[email protected]>
blktrace: fix dereference after null check
Jan Kara <[email protected]>
blktrace: Protect q->blk_trace with RCU
Jens Axboe <[email protected]>
blktrace: fix trace mutex deadlock
Jens Axboe <[email protected]>
blktrace: fix unlocked access to init/start-stop/teardown
Sabrina Dubroca <[email protected]>
net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
Sabrina Dubroca <[email protected]>
net: ipv6: add net argument to ip6_dst_lookup_flow
Ivan Delalande <[email protected]>
scripts/decodecode: fix trapping instruction formatting
Josh Poimboeuf <[email protected]>
objtool: Fix stack offset tracking for indirect CFAs
Guillaume Nault <[email protected]>
netfilter: nat: never update the UDP checksum when it's 0
Josh Poimboeuf <[email protected]>
x86/unwind/orc: Fix error path for bad ORC entry type
Josh Poimboeuf <[email protected]>
x86/unwind/orc: Prevent unwinding before ORC initialization
Miroslav Benes <[email protected]>
x86/unwind/orc: Don't skip the first frame for inactive tasks
Jann Horn <[email protected]>
x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
Josh Poimboeuf <[email protected]>
x86/entry/64: Fix unwind hints in kernel exit path
Xiyu Yang <[email protected]>
batman-adv: Fix refcnt leak in batadv_v_ogm_process
Xiyu Yang <[email protected]>
batman-adv: Fix refcnt leak in batadv_store_throughput_override
Xiyu Yang <[email protected]>
batman-adv: Fix refcnt leak in batadv_show_throughput_override
George Spelvin <[email protected]>
batman-adv: fix batadv_nc_random_weight_tq
Luis Chamberlain <[email protected]>
coredump: fix crash when umh is disabled
David Hildenbrand <[email protected]>
mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
Marc Zyngier <[email protected]>
KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
Steven Rostedt (VMware) <[email protected]>
tracing: Add a vmalloc_sync_mappings() for safe measure
Oliver Neukum <[email protected]>
USB: serial: garmin_gps: add sanity checking for data length
Oliver Neukum <[email protected]>
USB: uas: add quirk for LaCie 2Big Quadra
Alan Stern <[email protected]>
HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
Hangbin Liu <[email protected]>
geneve: only configure or fill UDP_ZERO_CSUM6_RX/TX info when CONFIG_IPV6
Jason Gerecke <[email protected]>
HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
Sabrina Dubroca <[email protected]>
ipv6: fix cleanup ordering for ip6_mr failure
Willem de Bruijn <[email protected]>
net: stricter validation of untrusted gso packets
Michael Chan <[email protected]>
bnxt_en: Fix VF anti-spoof filter setup.
Michael Chan <[email protected]>
bnxt_en: Improve AER slot reset.
Moshe Shemesh <[email protected]>
net/mlx5: Fix command entry leak in Internal Error State
Moshe Shemesh <[email protected]>
net/mlx5: Fix forced completion access non initialized command entry
Michael Chan <[email protected]>
bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
Eric Dumazet <[email protected]>
sch_sfq: validate silly quantum values
Eric Dumazet <[email protected]>
sch_choke: avoid potential panic in choke_reset()
Matt Jolly <[email protected]>
net: usb: qmi_wwan: add support for DW5816e
Tariq Toukan <[email protected]>
net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
Scott Dial <[email protected]>
net: macsec: preserve ingress frame ordering
Eric Dumazet <[email protected]>
fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
Julia Lawall <[email protected]>
dp83640: reverse arguments to list_add_tail
Matt Jolly <[email protected]>
USB: serial: qcserial: Add DW5816e support
-------------
Diffstat:
Makefile | 25 +-- arch/arm/boot/dts/dra7.dtsi | 4 +- arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts | 4 +- arch/arm/boot/dts/r8a73a4.dtsi | 9 +- arch/arm/boot/dts/r8a7740.dtsi | 2 +- arch/arm64/boot/dts/rockchip/rk3328-evb.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 4 +- arch/x86/entry/calling.h | 38 +++-- arch/x86/entry/entry_64.S | 5 +- arch/x86/include/asm/bitops.h | 29 ++-- arch/x86/include/asm/percpu.h | 2 +- arch/x86/include/asm/stackprotector.h | 7 +- arch/x86/kernel/smpboot.c | 8 + arch/x86/kernel/unwind_orc.c | 20 +-- arch/x86/kvm/x86.c | 2 +- arch/x86/xen/smp_pv.c | 1 + crypto/lrw.c | 4 +- crypto/xts.c | 4 +- drivers/block/virtio_blk.c | 86 +++++++++- drivers/char/ipmi/ipmi_ssif.c | 4 +- drivers/clk/rockchip/clk-rk3228.c | 17 +- drivers/cpufreq/intel_pstate.c | 2 +- drivers/dma/mmp_tdma.c | 2 + drivers/dma/pch_dma.c | 2 +- drivers/gpu/drm/qxl/qxl_image.c | 3 +- drivers/hid/usbhid/hid-core.c | 37 ++++- drivers/hid/usbhid/usbhid.h | 1 + drivers/hid/wacom_sys.c | 4 +- drivers/hwmon/da9052-hwmon.c | 4 +- drivers/infiniband/core/addr.c | 7 +- drivers/infiniband/hw/i40iw/i40iw_hw.c | 2 +- drivers/infiniband/hw/mlx4/qp.c | 14 +- drivers/infiniband/sw/rxe/rxe_net.c | 8 +- drivers/net/dsa/dsa_loop.c | 1 + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 18 ++- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 - drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 9 +- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 16 +- drivers/net/ethernet/huawei/hinic/hinic_main.c | 16 +- drivers/net/ethernet/mellanox/mlx4/main.c | 4 +- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +- drivers/net/ethernet/moxa/moxart_ether.c | 2 +- drivers/net/ethernet/natsemi/jazzsonic.c | 6 +- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 +- .../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 12 +- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 31 ++-- drivers/net/geneve.c | 20 ++- drivers/net/macsec.c | 3 +- drivers/net/phy/dp83640.c | 2 +- drivers/net/phy/micrel.c | 4 +- drivers/net/phy/phy.c | 8 +- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/vxlan.c | 8 +- drivers/pinctrl/intel/pinctrl-baytrail.c | 1 + drivers/pinctrl/intel/pinctrl-cherryview.c | 4 + drivers/scsi/sg.c | 4 +- drivers/usb/core/hub.c | 6 +- drivers/usb/gadget/configfs.c | 3 + drivers/usb/gadget/legacy/audio.c | 4 +- drivers/usb/gadget/legacy/cdc2.c | 4 +- drivers/usb/gadget/legacy/ncm.c | 4 +- drivers/usb/gadget/udc/net2272.c | 2 + drivers/usb/host/xhci-plat.c | 4 +- drivers/usb/host/xhci-ring.c | 4 +- drivers/usb/serial/garmin_gps.c | 4 +- drivers/usb/serial/qcserial.c | 1 + drivers/usb/storage/unusual_uas.h | 7 + fs/coredump.c | 8 + fs/exec.c | 4 +- fs/f2fs/xattr.c | 176 ++++++++++++-------- fs/f2fs/xattr.h | 2 + include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 18 ++- include/linux/compiler.h | 6 + include/linux/fs.h | 2 +- include/linux/pnp.h | 29 ++-- include/linux/tty.h | 2 +- include/linux/virtio_net.h | 24 ++- include/net/addrconf.h | 6 +- include/net/ipv6.h | 2 +- include/net/netfilter/nf_conntrack.h | 2 +- include/sound/rawmidi.h | 1 + init/main.c | 2 + ipc/util.c | 12 +- kernel/trace/blktrace.c | 177 ++++++++++++++++----- kernel/trace/trace.c | 13 ++ kernel/umh.c | 5 + mm/page_alloc.c | 1 + mm/shmem.c | 7 +- net/batman-adv/bat_v_ogm.c | 2 +- net/batman-adv/network-coding.c | 9 +- net/batman-adv/sysfs.c | 3 +- net/core/dev.c | 4 +- net/core/drop_monitor.c | 11 +- net/core/netprio_cgroup.c | 2 + net/dccp/ipv6.c | 6 +- net/ipv4/cipso_ipv4.c | 6 +- net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 6 +- net/ipv6/addrconf_core.c | 11 +- net/ipv6/af_inet6.c | 10 +- net/ipv6/calipso.c | 3 +- net/ipv6/datagram.c | 2 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/ip6_output.c | 8 +- net/ipv6/raw.c | 2 +- net/ipv6/route.c | 6 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/l2tp/l2tp_ip6.c | 2 +- net/mpls/af_mpls.c | 7 +- net/netfilter/nf_conntrack_core.c | 4 +- net/netfilter/nf_nat_proto_udp.c | 5 +- net/netlabel/netlabel_kapi.c | 6 + net/sched/sch_choke.c | 3 +- net/sched/sch_fq_codel.c | 2 +- net/sched/sch_sfq.c | 9 ++ net/sctp/ipv6.c | 4 +- net/tipc/udp_media.c | 9 +- scripts/decodecode | 2 +- sound/core/rawmidi.c | 35 +++- sound/pci/hda/patch_hdmi.c | 2 + sound/pci/hda/patch_realtek.c | 28 +++- sound/usb/quirks.c | 9 +- tools/objtool/check.c | 2 +- virt/kvm/arm/vgic/vgic-mmio.c | 4 +- 128 files changed, 892 insertions(+), 443 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/114 USB: serial: qcserial: Add DW5816e support
From: Matt Jolly <[email protected]>
commit 78d6de3cfbd342918d31cf68d0d2eda401338aef upstream.
Add support for Dell Wireless 5816e to drivers/usb/serial/qcserial.c
--- drivers/usb/serial/qcserial.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/qcserial.c +1 -0
@@ -177,6 +177,7 @@ static const struct usb_device_id id_tab {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ + {DEVICE_SWI(0x413c, 0x81cc)}, /* Dell Wireless 5816e */ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */ {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */ {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */
Greg Kroah-Hartman
maintainerPATCH 2/114 dp83640: reverse arguments to list_add_tail
In reply to Greg Kroah-HartmanFrom: Julia Lawall <[email protected]>
[ Upstream commit 865308373ed49c9fb05720d14cbf1315349b32a9 ]
In this code, it appears that phyter_clocks is a list head, based on the previous list_for_each, and that clock->list is intended to be a list element, given that it has just been initialized in dp83640_clock_init. Accordingly, switch the arguments to list_add_tail, which takes the list head as the second argument.
--- drivers/net/phy/dp83640.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/phy/dp83640.c +1 -1
@@ -1110,7 +1110,7 @@ static struct dp83640_clock *dp83640_clo goto out; }dp83640_clock_init (clock, bus); -list_add_tail (&phyter_clocks, &clock->list); +list_add_tail (&clock->list, &phyter_clocks); out:mutex_unlock (&phyter_clocks_lock);
Greg Kroah-Hartman
maintainerPATCH 3/114 fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 14695212d4cd8b0c997f6121b6df8520038ce076 ]
My intent was to not let users set a zero drop_batch_size, it seems I once again messed with min()/max().
--- net/sched/sch_fq_codel.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_fq_codel.c +1 -1
@@ -427,7 +427,7 @@ static int fq_codel_change(struct Qdisc q->quantum =max (256U ,nla_get_u32 (tb[TCA_FQ_CODEL_QUANTUM ]));if (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE ]) - q->drop_batch_size =min (1U ,nla_get_u32 (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE ])); + q->drop_batch_size =max (1U ,nla_get_u32 (tb[TCA_FQ_CODEL_DROP_BATCH_SIZE ]));if (tb[TCA_FQ_CODEL_MEMORY_LIMIT ]) q->memory_limit =min (1U <<31 ,nla_get_u32 (tb[TCA_FQ_CODEL_MEMORY_LIMIT ]));
Greg Kroah-Hartman
maintainerPATCH 4/114 net: macsec: preserve ingress frame ordering
In reply to Greg Kroah-HartmanFrom: Scott Dial <[email protected]>
[ Upstream commit ab046a5d4be4c90a3952a0eae75617b49c0cb01b ]
MACsec decryption always occurs in a softirq context. Since the FPU may not be usable in the softirq context, the call to decrypt may be scheduled on the cryptd work queue. The cryptd work queue does not provide ordering guarantees. Therefore, preserving order requires masking out ASYNC implementations of gcm(aes).
For instance, an Intel CPU with AES-NI makes available the generic-gcm-aesni driver from the aesni_intel module to implement gcm(aes). However, this implementation requires the FPU, so it is not always available to use from a softirq context, and will fallback to the cryptd work queue, which does not preserve frame ordering. With this change, such a system would select gcm_base(ctr(aes-aesni),ghash-generic). While the aes-aesni implementation prefers to use the FPU, it will fallback to the aes-asm implementation if unavailable.
By using a synchronous version of gcm(aes), the decryption will complete before returning from crypto_aead_decrypt(). Therefore, the macsec_decrypt_done() callback will be called before returning from macsec_decrypt(). Thus, the order of calls to macsec_post_decrypt() for the frames is preserved.
While it's presumable that the pure AES-NI version of gcm(aes) is more performant, the hybrid solution is capable of gigabit speeds on modest hardware. Regardless, preserving the order of frames is paramount for many network protocols (e.g., triggering TCP retries). Within the MACsec driver itself, the replay protection is tripped by the out-of-order frames, and can cause frames to be dropped.
This bug has been present in this code since it was added in v4.6, however it may not have been noticed since not all CPUs have FPU offload available. Additionally, the bug manifests as occasional out-of-order packets that are easily misattributed to other network phenomena.
When this code was added in v4.6, the crypto/gcm.c code did not restrict selection of the ghash function based on the ASYNC flag. For instance, x86 CPUs with PCLMULQDQ would select the ghash-clmulni driver instead of ghash-generic, which submits to the cryptd work queue if the FPU is busy. However, this bug was was corrected in v4.8 by commit b30bdfa86431afbafe15284a3ad5ac19b49b88e3, and was backported all the way back to the v3.14 stable branch, so this patch should be applicable back to the v4.6 stable branch.
--- drivers/net/macsec.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/macsec.c +2 -1
@@ -1309,7 +1309,8 @@ static struct crypto_aead *macsec_alloc_struct crypto_aead *tfm;int ret; - tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,0 ); +/* Pick a sync gcm(aes) cipher to ensure order is preserved. */ + tfm =crypto_alloc_aead ("gcm(aes)" ,0 ,CRYPTO_ALG_ASYNC );if (IS_ERR (tfm))return tfm;
Greg Kroah-Hartman
maintainerPATCH 5/114 net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
In reply to Greg Kroah-HartmanFrom: Tariq Toukan <[email protected]>
[ Upstream commit 40e473071dbad04316ddc3613c3a3d1c75458299 ]
When ENOSPC is set the idx is still valid and gets set to the global MLX4_SINK_COUNTER_INDEX. However gcc's static analysis cannot tell that ENOSPC is impossible from mlx4_cmd_imm() and gives this warning:
drivers/net/ethernet/mellanox/mlx4/main.c:2552:28: warning: 'idx' may be used uninitialized in this function [-Wmaybe-uninitialized]
2552 | priv->def_counter[port] = idx;
Also, when ENOSPC is returned mlx4_allocate_default_counters should not fail.
--- drivers/net/ethernet/mellanox/mlx4/main.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx4/main.c +3 -1
@@ -2503,6 +2503,7 @@ static int mlx4_allocate_default_counterif (!err || err == -ENOSPC ) { priv->def_counter[port] = idx; + err =0 ; }else if (err == -ENOENT ) { err =0 ;continue ;
@@ -2553,7 +2554,8 @@ int mlx4_counter_alloc(struct mlx4_dev * MLX4_CMD_TIME_CLASS_A, MLX4_CMD_WRAPPED);if (!err) *idx =get_param_l (&out_param); - +if (WARN_ON (err == -ENOSPC )) + err = -EINVAL ;return err; }return __mlx4_counter_alloc (dev, idx);
Greg Kroah-Hartman
maintainerPATCH 6/114 net: usb: qmi_wwan: add support for DW5816e
In reply to Greg Kroah-HartmanFrom: Matt Jolly <[email protected]>
[ Upstream commit 57c7f2bd758eed867295c81d3527fff4fab1ed74 ]
Add support for Dell Wireless 5816e to drivers/net/usb/qmi_wwan.c
--- drivers/net/usb/qmi_wwan.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/usb/qmi_wwan.c +1 -0
@@ -1283,6 +1283,7 @@ static const struct usb_device_id produc {QMI_FIXED_INTF(0x413c, 0x81b3, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */ {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */ + {QMI_FIXED_INTF(0x413c, 0x81cc, 8)}, /* Dell Wireless 5816e */ {QMI_FIXED_INTF(0x413c, 0x81d7, 0)}, /* Dell Wireless 5821e */ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e preproduction config */ {QMI_FIXED_INTF(0x413c, 0x81e0, 0)}, /* Dell Wireless 5821e with eSIM support*/
Greg Kroah-Hartman
maintainerPATCH 7/114 sch_choke: avoid potential panic in choke_reset()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 8738c85c72b3108c9b9a369a39868ba5f8e10ae0 ]
If choke_init() could not allocate q->tab, we would crash later in choke_reset().
BUG: KASAN: null-ptr-deref in memset include/linux/string.h:366 [inline] BUG: KASAN: null-ptr-deref in choke_reset+0x208/0x340 net/sched/sch_choke.c:326 Write of size 8 at addr 0000000000000000 by task syz-executor822/7022 CPU: 1 PID: 7022 Comm: syz-executor822 Not tainted 5.7.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 __kasan_report.cold+0x5/0x4d mm/kasan/report.c:515 kasan_report+0x33/0x50 mm/kasan/common.c:625 check_memory_region_inline mm/kasan/generic.c:187 [inline] check_memory_region+0x141/0x190 mm/kasan/generic.c:193 memset+0x20/0x40 mm/kasan/common.c:85 memset include/linux/string.h:366 [inline] choke_reset+0x208/0x340 net/sched/sch_choke.c:326 qdisc_reset+0x6b/0x520 net/sched/sch_generic.c:910 dev_deactivate_queue.constprop.0+0x13c/0x240 net/sched/sch_generic.c:1138 netdev_for_each_tx_queue include/linux/netdevice.h:2197 [inline] dev_deactivate_many+0xe2/0xba0 net/sched/sch_generic.c:1195 dev_deactivate+0xf8/0x1c0 net/sched/sch_generic.c:1233 qdisc_graft+0xd25/0x1120 net/sched/sch_api.c:1051 tc_modify_qdisc+0xbab/0x1a00 net/sched/sch_api.c:1670 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5454 netlink_rcv_skb+0x15a/0x410 net/netlink/af_netlink.c:2469 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x537/0x740 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x882/0xe10 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x6bf/0x7e0 net/socket.c:2362 ___sys_sendmsg+0x100/0x170 net/socket.c:2416 __sys_sendmsg+0xec/0x1b0 net/socket.c:2449 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
--- net/sched/sch_choke.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/sched/sch_choke.c +2 -1
@@ -327,7 +327,8 @@ static void choke_reset(struct Qdisc *sc sch->q.qlen =0 ; sch->qstats.backlog =0 ; -memset (q->tab,0 , (q->tab_mask +1 ) *sizeof (struct sk_buff *)); +if (q->tab) +memset (q->tab,0 , (q->tab_mask +1 ) *sizeof (struct sk_buff *)); q->head = q->tail =0 ;red_restart (&q->vars); }
Greg Kroah-Hartman
maintainerPATCH 8/114 sch_sfq: validate silly quantum values
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit df4953e4e997e273501339f607b77953772e3559 ]
syzbot managed to set up sfq so that q->scaled_quantum was zero, triggering an infinite loop in sfq_dequeue()
More generally, we must only accept quantum between 1 and 2^18 - 7, meaning scaled_quantum must be in [1, 0x7FFF] range.
Otherwise, we also could have a loop in sfq_dequeue() if scaled_quantum happens to be 0x8000, since slot->allot could indefinitely switch between 0 and 0x8000.
--- net/sched/sch_sfq.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/sched/sch_sfq.c +9 -0
@@ -639,6 +639,15 @@ static int sfq_change(struct Qdisc *sch,if (ctl->divisor && (!is_power_of_2 (ctl->divisor) || ctl->divisor >65536 ))return -EINVAL ; + +/* slot->allot is a short, make sure quantum is not too big. */ +if (ctl->quantum) { +unsigned int scaled =SFQ_ALLOT_SIZE (ctl->quantum); + +if (scaled <=0 || scaled >SHRT_MAX ) +return -EINVAL ; + } +if (ctl_v1 && !red_check_params (ctl_v1->qth_min, ctl_v1->qth_max, ctl_v1->Wlog))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 9/114 bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit c72cb303aa6c2ae7e4184f0081c6d11bf03fb96b ]
The current logic in bnxt_fix_features() will inadvertently turn on both CTAG and STAG VLAN offload if the user tries to disable both. Fix it by checking that the user is trying to enable CTAG or STAG before enabling both. The logic is supposed to enable or disable both CTAG and STAG together.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -3
@@ -6827,6 +6827,7 @@ static netdev_features_t bnxt_fix_featur netdev_features_t features) {struct bnxt *bp =netdev_priv (dev); +netdev_features_t vlan_features;if ((features &NETIF_F_NTUPLE ) && !bnxt_rfs_capable (bp)) features &= ~NETIF_F_NTUPLE ;
@@ -6834,12 +6835,14 @@ static netdev_features_t bnxt_fix_featur/* Both CTAG and STAG VLAN accelaration on the RX side have to be * turned on or off together. */ -if ((features & (NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX )) != - (NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX )) { + vlan_features = features & (NETIF_F_HW_VLAN_CTAG_RX | +NETIF_F_HW_VLAN_STAG_RX ); +if (vlan_features != (NETIF_F_HW_VLAN_CTAG_RX | +NETIF_F_HW_VLAN_STAG_RX )) {if (dev->features &NETIF_F_HW_VLAN_CTAG_RX ) features &= ~(NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX ); -else +else if (vlan_features) features |=NETIF_F_HW_VLAN_CTAG_RX |NETIF_F_HW_VLAN_STAG_RX ; }
Greg Kroah-Hartman
maintainerPATCH 10/114 net/mlx5: Fix forced completion access non initialized command entry
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit f3cb3cebe26ed4c8036adbd9448b372129d3c371 ]
mlx5_cmd_flush() will trigger forced completions to all valid command entries. Triggered by an asynch event such as fast teardown it can happen at any stage of the command, including command initialization. It will trigger forced completion and that can lead to completion on an uninitialized command entry.
Setting MLX5_CMD_ENT_STATE_PENDING_COMP only after command entry is initialized will ensure force completion is treated only if command entry is initialized.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +1 -1
@@ -831,7 +831,6 @@ static void cmd_work_handler(struct work } cmd->ent_arr[ent->idx] = ent; -set_bit (MLX5_CMD_ENT_STATE_PENDING_COMP , &ent->state); lay =get_inst (cmd, ent->idx); ent->lay = lay;memset (lay,0 ,sizeof (*lay));
@@ -853,6 +852,7 @@ static void cmd_work_handler(struct workif (ent->callback)schedule_delayed_work (&ent->cb_timeout_work, cb_timeout); +set_bit (MLX5_CMD_ENT_STATE_PENDING_COMP , &ent->state);/* Skip sending command to fw if internal error */ if (pci_channel_offline(dev->pdev) ||
Greg Kroah-Hartman
maintainerPATCH 11/114 net/mlx5: Fix command entry leak in Internal Error State
In reply to Greg Kroah-HartmanFrom: Moshe Shemesh <[email protected]>
[ Upstream commit cece6f432cca9f18900463ed01b97a152a03600a ]
Processing commands by cmd_work_handler() while already in Internal Error State will result in entry leak, since the handler process force completion without doorbell. Forced completion doesn't release the entry and event completion will never arrive, so entry should be released.
--- drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/cmd.c +4 -0
@@ -865,6 +865,10 @@ static void cmd_work_handler(struct workMLX5_SET (mbox_out, ent->out, syndrome, drv_synd);mlx5_cmd_comp_handler (dev,1UL << ent->idx, true); +/* no doorbell, no need to keep the entry */ +free_ent (cmd, ent->idx); +if (ent->callback) +free_cmd (ent);return ; }
Greg Kroah-Hartman
maintainerPATCH 12/114 bnxt_en: Improve AER slot reset.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit bae361c54fb6ac6eba3b4762f49ce14beb73ef13 ]
Improve the slot reset sequence by disabling the device to prevent bad DMAs if slot reset fails. Return the proper result instead of always PCI_ERS_RESULT_RECOVERED to the caller.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.c +6 -3
@@ -8423,8 +8423,11 @@ static pci_ers_result_t bnxt_io_slot_res } } -if (result !=PCI_ERS_RESULT_RECOVERED &&netif_running (netdev)) -dev_close (netdev); +if (result !=PCI_ERS_RESULT_RECOVERED ) { +if (netif_running (netdev)) +dev_close (netdev); +pci_disable_device (pdev); + }rtnl_unlock ();
@@ -8435,7 +8438,7 @@ static pci_ers_result_t bnxt_io_slot_res err); /* non-fatal, continue */ } -return PCI_ERS_RESULT_RECOVERED ; +return result; }/**
Greg Kroah-Hartman
maintainerPATCH 13/114 bnxt_en: Fix VF anti-spoof filter setup.
In reply to Greg Kroah-HartmanFrom: Michael Chan <[email protected]>
[ Upstream commit c71c4e49afe173823a2a85b0cabc9b3f1176ffa2 ]
Fix the logic that sets the enable/disable flag for the source MAC filter according to firmware spec 1.7.1.
In the original firmware spec. before 1.7.1, the VF spoof check flags were not latched after making the HWRM_FUNC_CFG call, so there was a need to keep the func_flags so that subsequent calls would perserve the VF spoof check setting. A change was made in the 1.7.1 spec so that the flags became latched. So we now set or clear the anti- spoof setting directly without retrieving the old settings in the stored vf->func_flags which are no longer valid. We also remove the unneeded vf->func_flags.
--- drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 - drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 9 ++------- 2 files changed, 2 insertions(+), 8 deletions(-)
drivers/net/ethernet/broadcom/bnxt/bnxt.h +0 -1
@@ -774,7 +774,6 @@ struct bnxt_vf_info {#define BNXT_VF_SPOOFCHK 0x2#define BNXT_VF_LINK_FORCED 0x4#define BNXT_VF_LINK_UP 0x8 -u32 func_flags;/* func cfg flags */ u32 min_tx_rate;u32 max_tx_rate;void *hwrm_cmd_req_addr;
drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +2 -7
@@ -99,11 +99,10 @@ int bnxt_set_vf_spoofchk(struct net_deviif (old_setting == setting)return 0 ; - func_flags = vf->func_flags;if (setting) - func_flags |=FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_ENABLE ; + func_flags =FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_ENABLE ;else - func_flags |=FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_DISABLE ; + func_flags =FUNC_CFG_REQ_FLAGS_SRC_MAC_ADDR_CHECK_DISABLE ;/*TODO: if the driver supports VLAN filter on guest VLAN, * the spoof check should also include vlan anti-spoofing */
@@ -112,7 +111,6 @@ int bnxt_set_vf_spoofchk(struct net_devi req.flags =cpu_to_le32 (func_flags); rc =hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT );if (!rc) { - vf->func_flags = func_flags;if (setting) vf->flags |=BNXT_VF_SPOOFCHK ;else
@@ -176,7 +174,6 @@ int bnxt_set_vf_mac(struct net_device *dmemcpy (vf->mac_addr, mac,ETH_ALEN );bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_FUNC_CFG ,-1 ,-1 ); req.fid =cpu_to_le16 (vf->fw_fid); - req.flags =cpu_to_le32 (vf->func_flags); req.enables =cpu_to_le32 (FUNC_CFG_REQ_ENABLES_DFLT_MAC_ADDR );memcpy (req.dflt_mac_addr, mac,ETH_ALEN );return hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT );
@@ -214,7 +211,6 @@ int bnxt_set_vf_vlan(struct net_device *bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_FUNC_CFG ,-1 ,-1 ); req.fid =cpu_to_le16 (vf->fw_fid); - req.flags =cpu_to_le32 (vf->func_flags); req.dflt_vlan =cpu_to_le16 (vlan_tag); req.enables =cpu_to_le32 (FUNC_CFG_REQ_ENABLES_DFLT_VLAN ); rc =hwrm_send_message (bp, &req,sizeof (req),HWRM_CMD_TIMEOUT );
@@ -253,7 +249,6 @@ int bnxt_set_vf_bw(struct net_device *dereturn 0 ;bnxt_hwrm_cmd_hdr_init (bp, &req,HWRM_FUNC_CFG ,-1 ,-1 ); req.fid =cpu_to_le16 (vf->fw_fid); - req.flags =cpu_to_le32 (vf->func_flags); req.enables =cpu_to_le32 (FUNC_CFG_REQ_ENABLES_MAX_BW ); req.max_bw =cpu_to_le32 (max_tx_rate); req.enables |=cpu_to_le32 (FUNC_CFG_REQ_ENABLES_MIN_BW );
Greg Kroah-Hartman
maintainerPATCH 14/114 net: stricter validation of untrusted gso packets
In reply to Greg Kroah-HartmanFrom: Willem de Bruijn <[email protected]>
[ Upstream commit 9274124f023b5c56dc4326637d4f787968b03607 ]
Syzkaller again found a path to a kernel crash through bad gso input:
a packet with transport header extending beyond skb_headlen(skb).
Tighten validation at kernel entry:
- Verify that the transport header lies within the linear section.
To avoid pulling linux/tcp.h, verify just sizeof tcphdr. tcp_gso_segment will call pskb_may_pull (th->doff * 4) before use.
- Match the gso_type against the ip_proto found by the flow dissector.
--- include/linux/virtio_net.h | 24 ++++++++++++++++++++++-- 1 file changed, 22 insertions(+), 2 deletions(-)
include/linux/virtio_net.h +22 -2
@@ -3,6 +3,8 @@#define _LINUX_VIRTIO_NET_H#include <linux/if_vlan.h> +#include <uapi/linux/tcp.h> +#include <uapi/linux/udp.h> #include <uapi/linux/virtio_net.h> static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
@@ -28,17 +30,25 @@ static inline int virtio_net_hdr_to_skb( bool little_endian) {unsigned int gso_type =0 ; +unsigned int thlen =0 ; +unsigned int ip_proto;if (hdr->gso_type !=VIRTIO_NET_HDR_GSO_NONE ) {switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN ) {case VIRTIO_NET_HDR_GSO_TCPV4 : gso_type =SKB_GSO_TCPV4 ; + ip_proto =IPPROTO_TCP ; + thlen =sizeof (struct tcphdr );break ;case VIRTIO_NET_HDR_GSO_TCPV6 : gso_type =SKB_GSO_TCPV6 ; + ip_proto =IPPROTO_TCP ; + thlen =sizeof (struct tcphdr );break ;case VIRTIO_NET_HDR_GSO_UDP : gso_type =SKB_GSO_UDP ; + ip_proto =IPPROTO_UDP ; + thlen =sizeof (struct udphdr );break ;default :return -EINVAL ;
@@ -57,16 +67,20 @@ static inline int virtio_net_hdr_to_skb(if (!skb_partial_csum_set (skb, start, off))return -EINVAL ; + +if (skb_transport_offset (skb) + thlen >skb_headlen (skb)) +return -EINVAL ; }else {/* gso packets without NEEDS_CSUM do not set transport_offset. * probe and drop if does not match one of the above types. */ if (gso_type && skb->network_header) { +struct flow_keys keys; +if (!skb->protocol)virtio_net_hdr_set_proto (skb, hdr); retry: -skb_probe_transport_header (skb,-1 ); -if (!skb_transport_header_was_set (skb)) { +if (!skb_flow_dissect_flow_keys (skb, &keys,0 )) {/* UFO does not specify ipv4 or 6: try both */ if (gso_type &SKB_GSO_UDP && skb->protocol ==htons (ETH_P_IP )) {
@@ -75,6 +89,12 @@ retry: }return -EINVAL ; } + +if (keys.control.thoff + thlen >skb_headlen (skb) || + keys.basic.ip_proto != ip_proto) +return -EINVAL ; + +skb_set_transport_header (skb, keys.control.thoff); } }
Greg Kroah-Hartman
maintainerPATCH 15/114 ipv6: fix cleanup ordering for ip6_mr failure
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
commit afe49de44c27a89e8e9631c44b5ffadf6ace65e2 upstream.
Commit 15e668070a64 ("ipv6: reorder icmpv6_init() and ip6_mr_init()") moved the cleanup label for ipmr_fail, but should have changed the contents of the cleanup labels as well. Now we can end up cleaning up icmpv6 even though it hasn't been initialized (jump to icmp_fail or ipmr_fail).
Simply undo things in the reverse order of their initialization.
Example of panic (triggered by faking a failure of icmpv6_init):
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI
[...]
RIP: 0010:__list_del_entry_valid+0x79/0x160
[...]
Call Trace:
? lock_release+0x8a0/0x8a0
unregister_pernet_operations+0xd4/0x560
? ops_free_list+0x480/0x480
? down_write+0x91/0x130
? unregister_pernet_subsys+0x15/0x30
? down_read+0x1b0/0x1b0
? up_read+0x110/0x110
? kmem_cache_create_usercopy+0x1b4/0x240
unregister_pernet_subsys+0x1d/0x30
icmpv6_cleanup+0x1d/0x30
inet6_init+0x1b5/0x23f--- net/ipv6/af_inet6.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv6/af_inet6.c +3 -3
@@ -1088,11 +1088,11 @@ netfilter_fail: igmp_fail:ndisc_cleanup (); ndisc_fail: -ip6_mr_cleanup (); +icmpv6_cleanup (); icmp_fail: -unregister_pernet_subsys (&inet6_net_ops); +ip6_mr_cleanup (); ipmr_fail: -icmpv6_cleanup (); +unregister_pernet_subsys (&inet6_net_ops); register_pernet_fail:sock_unregister (PF_INET6 );rtnl_unregister_all (PF_INET6 );
Greg Kroah-Hartman
maintainerPATCH 16/114 HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
In reply to Greg Kroah-HartmanFrom: Jason Gerecke <[email protected]>
commit 778fbf4179991e7652e97d7f1ca1f657ef828422 upstream.
We've recently switched from extracting the value of HID_DG_CONTACTMAX at a fixed offset (which may not be correct for all tablets) to injecting the report into the driver for the generic codepath to handle. Unfortunately, this change was made for *all* tablets, even those which aren't generic. Because wacom_wac_report ignores reports from non- generic devices, the contact count never gets initialized. Ultimately this results in the touch device itself failing to probe, and thus the loss of touch input.
This commit adds back the fixed-offset extraction for non-generic devices.
--- drivers/hid/wacom_sys.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/wacom_sys.c +3 -1
@@ -132,9 +132,11 @@ static void wacom_feature_mapping(struct data[0 ] = field->report->id; ret =wacom_get_report (hdev,HID_FEATURE_REPORT , data, n,WAC_CMD_RETRIES ); -if (ret == n) { +if (ret == n && features->type ==HID_GENERIC ) { ret =hid_report_raw_event (hdev,HID_FEATURE_REPORT , data, n,0 ); + }else if (ret ==2 && features->type !=HID_GENERIC ) { + features->touch_max = data[1 ]; }else { features->touch_max =16 ; hid_warn(hdev, "wacom_feature_mapping: "
Greg Kroah-Hartman
maintainerPATCH 17/114 geneve: only configure or fill UDP_ZERO_CSUM6_RX/TX info when CONFIG_IPV6
In reply to Greg Kroah-HartmanFrom: Hangbin Liu <[email protected]>
commit f9094b7603c011d27db7ba109e69881c72fa611d upstream.
Stefano pointed that configure or show UDP_ZERO_CSUM6_RX/TX info doesn't make sense if we haven't enabled CONFIG_IPV6. Fix it by adding if IS_ENABLED(CONFIG_IPV6) check.
--- drivers/net/geneve.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-)
drivers/net/geneve.c +15 -1
@@ -1369,21 +1369,33 @@ static int geneve_nl2info(struct nlattr }if (data[IFLA_GENEVE_UDP_ZERO_CSUM6_TX ]) { +#if IS_ENABLED (CONFIG_IPV6 )if (changelink) { attrtype =IFLA_GENEVE_UDP_ZERO_CSUM6_TX ; goto change_notsup; }if (nla_get_u8 (data[IFLA_GENEVE_UDP_ZERO_CSUM6_TX ])) info->key.tun_flags &= ~TUNNEL_CSUM ; +#else +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_GENEVE_UDP_ZERO_CSUM6_TX ], +"IPv6 support not enabled in the kernel" ); +return -EPFNOSUPPORT ; +#endif }if (data[IFLA_GENEVE_UDP_ZERO_CSUM6_RX ]) { +#if IS_ENABLED (CONFIG_IPV6 )if (changelink) { attrtype =IFLA_GENEVE_UDP_ZERO_CSUM6_RX ; goto change_notsup; }if (nla_get_u8 (data[IFLA_GENEVE_UDP_ZERO_CSUM6_RX ])) *use_udp6_rx_checksums = false; +#else +NL_SET_ERR_MSG_ATTR (extack, data[IFLA_GENEVE_UDP_ZERO_CSUM6_RX ], +"IPv6 support not enabled in the kernel" ); +return -EPFNOSUPPORT ; +#endif }return 0 ;
@@ -1559,11 +1571,13 @@ static int geneve_fill_info(struct sk_bu goto nla_put_failure;if (metadata &&nla_put_flag (skb,IFLA_GENEVE_COLLECT_METADATA )) - goto nla_put_failure; + goto nla_put_failure; +#if IS_ENABLED (CONFIG_IPV6 )if (nla_put_u8 (skb,IFLA_GENEVE_UDP_ZERO_CSUM6_RX , !geneve->use_udp6_rx_checksums)) goto nla_put_failure; +#endif return 0 ;
Greg Kroah-Hartman
maintainerPATCH 18/114 HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit 0ed08faded1da03eb3def61502b27f81aef2e615 upstream.
The syzbot fuzzer discovered a bad race between in the usbhid driver between usbhid_stop() and usbhid_close(). In particular, usbhid_stop() does:
usb_free_urb(usbhid->urbin); ... usbhid->urbin = NULL; /* don't mess up next start */
and usbhid_close() does:
usb_kill_urb(usbhid->urbin);
with no mutual exclusion. If the two routines happen to run concurrently so that usb_kill_urb() is called in between the usb_free_urb() and the NULL assignment, it will access the deallocated urb structure -- a use-after-free bug.
This patch adds a mutex to the usbhid private structure and uses it to enforce mutual exclusion of the usbhid_start(), usbhid_stop(), usbhid_open() and usbhid_close() callbacks.
--- drivers/hid/usbhid/hid-core.c | 37 +++++++++++++++++++++++++++++-------- drivers/hid/usbhid/usbhid.h | 1 + 2 files changed, 30 insertions(+), 8 deletions(-)
drivers/hid/usbhid/hid-core.c +29 -8
@@ -680,16 +680,21 @@ static int usbhid_open(struct hid_devicestruct usbhid_device *usbhid = hid->driver_data;int res; +mutex_lock (&usbhid->mutex); +set_bit (HID_OPENED , &usbhid->iofl); -if (hid->quirks &HID_QUIRK_ALWAYS_POLL ) -return 0 ; +if (hid->quirks &HID_QUIRK_ALWAYS_POLL ) { + res =0 ; + goto Done; + } res =usb_autopm_get_interface (usbhid->intf);/* the device must be awake to reliably request remote wakeup */ if (res <0 ) {clear_bit (HID_OPENED , &usbhid->iofl); -return -EIO ; + res = -EIO ; + goto Done; } usbhid->intf->needs_remote_wakeup =1 ;
@@ -723,6 +728,9 @@ static int usbhid_open(struct hid_devicemsleep (50 );clear_bit (HID_RESUME_RUNNING , &usbhid->iofl); + + Done: +mutex_unlock (&usbhid->mutex);return res; }
@@ -730,6 +738,8 @@ static void usbhid_close(struct hid_devi {struct usbhid_device *usbhid = hid->driver_data; +mutex_lock (&usbhid->mutex); +/* * Make sure we don't restart data acquisition due to * a resumption we no longer care about by avoiding racing
@@ -741,12 +751,13 @@ static void usbhid_close(struct hid_deviclear_bit (HID_IN_POLLING , &usbhid->iofl);spin_unlock_irq (&usbhid->lock); -if (hid->quirks &HID_QUIRK_ALWAYS_POLL ) -return ; +if (!(hid->quirks &HID_QUIRK_ALWAYS_POLL )) { +hid_cancel_delayed_stuff (usbhid); +usb_kill_urb (usbhid->urbin); + usbhid->intf->needs_remote_wakeup =0 ; + } -hid_cancel_delayed_stuff (usbhid); -usb_kill_urb (usbhid->urbin); - usbhid->intf->needs_remote_wakeup =0 ; +mutex_unlock (&usbhid->mutex); }/*
@@ -1056,6 +1067,8 @@ static int usbhid_start(struct hid_devicunsigned int n, insize =0 ;int ret; +mutex_lock (&usbhid->mutex); +clear_bit (HID_DISCONNECTED , &usbhid->iofl); usbhid->bufsize =HID_MIN_BUFFER_SIZE ;
@@ -1170,6 +1183,8 @@ static int usbhid_start(struct hid_devicusbhid_set_leds (hid);device_set_wakeup_enable (&dev->dev,1 ); } + +mutex_unlock (&usbhid->mutex);return 0 ; fail:
@@ -1180,6 +1195,7 @@ fail: usbhid->urbout =NULL ; usbhid->urbctrl =NULL ;hid_free_buffers (dev, hid); +mutex_unlock (&usbhid->mutex);return ret; }
@@ -1195,6 +1211,8 @@ static void usbhid_stop(struct hid_devic usbhid->intf->needs_remote_wakeup =0 ; } +mutex_lock (&usbhid->mutex); +clear_bit (HID_STARTED , &usbhid->iofl);spin_lock_irq (&usbhid->lock);/* Sync with error and led handlers */ set_bit (HID_DISCONNECTED , &usbhid->iofl);
@@ -1215,6 +1233,8 @@ static void usbhid_stop(struct hid_devic usbhid->urbout =NULL ;hid_free_buffers (hid_to_usb_dev (hid), hid); + +mutex_unlock (&usbhid->mutex); }static int usbhid_power (struct hid_device *hid,int lvl)
@@ -1375,6 +1395,7 @@ static int usbhid_probe(struct usb_interINIT_WORK (&usbhid->reset_work, hid_reset);setup_timer (&usbhid->io_retry, hid_retry_timeout, (unsigned long ) hid);spin_lock_init (&usbhid->lock); +mutex_init (&usbhid->mutex); ret =hid_add_device (hid);if (ret) {
drivers/hid/usbhid/usbhid.h +1 -0
@@ -93,6 +93,7 @@ struct usbhid_device {dma_addr_t outbuf_dma;/* Output buffer dma */ unsigned long last_out;/* record of last output for timeouts */ +struct mutex mutex;/* start/stop/open/close */ spinlock_t lock;/* fifo spinlock */ unsigned long iofl;/* I/O flags (CTRL_RUNNING, OUT_RUNNING) */ struct timer_list io_retry;/* Retry timer */
Greg Kroah-Hartman
maintainerPATCH 19/114 USB: uas: add quirk for LaCie 2Big Quadra
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit 9f04db234af691007bb785342a06abab5fb34474 upstream.
This device needs US_FL_NO_REPORT_OPCODES to avoid going through prolonged error handling on enumeration.
--- drivers/usb/storage/unusual_uas.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/storage/unusual_uas.h +7 -0
@@ -41,6 +41,13 @@* and don't forget to CC: the USB development list <[email protected]> */ +/* Reported-by: Julian Groß <[email protected]> */ +UNUSUAL_DEV (0x059f ,0x105f ,0x0000 ,0x9999 , +"LaCie" , +"2Big Quadra USB3" , +USB_SC_DEVICE ,USB_PR_DEVICE ,NULL , + US_FL_NO_REPORT_OPCODES), +/* * Apricorn USB3 dongle sometimes returns "USBSUSBSUSBS" in response to SCSI * commands in UAS mode. Observed with the 1.28 firmware; are there others?
Greg Kroah-Hartman
maintainerPATCH 20/114 USB: serial: garmin_gps: add sanity checking for data length
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
commit e9b3c610a05c1cdf8e959a6d89c38807ff758ee6 upstream.
We must not process packets shorter than a packet ID
--- drivers/usb/serial/garmin_gps.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/serial/garmin_gps.c +2 -2
@@ -1161,8 +1161,8 @@ static void garmin_read_process(struct gsend it directly to the tty port */ if (garmin_data_p->flags &FLAGS_QUEUING ) {pkt_add (garmin_data_p, data, data_length); - }else if (bulk_data || -getLayerId (data) ==GARMIN_LAYERID_APPL ) { + }else if (bulk_data || (data_length >=sizeof (u32) && +getLayerId (data) ==GARMIN_LAYERID_APPL )) {spin_lock_irqsave (&garmin_data_p->lock, flags); garmin_data_p->flags |=APP_RESP_SEEN ;
Greg Kroah-Hartman
maintainerPATCH 21/114 tracing: Add a vmalloc_sync_mappings() for safe measure
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 11f5efc3ab66284f7aaacc926e9351d658e2577b upstream.
x86_64 lazily maps in the vmalloc pages, and the way this works with per_cpu areas can be complex, to say the least. Mappings may happen at boot up, and if nothing synchronizes the page tables, those page mappings may not be synced till they are used. This causes issues for anything that might touch one of those mappings in the path of the page fault handler. When one of those unmapped mappings is touched in the page fault handler, it will cause another page fault, which in turn will cause a page fault, and leave us in a loop of page faults.
Commit 763802b53a42 ("x86/mm: split vmalloc_sync_all()") split vmalloc_sync_all() into vmalloc_sync_unmappings() and vmalloc_sync_mappings(), as on system exit, it did not need to do a full sync on x86_64 (although it still needed to be done on x86_32). By chance, the vmalloc_sync_all() would synchronize the page mappings done at boot up and prevent the per cpu area from being a problem for tracing in the page fault handler. But when that synchronization in the exit of a task became a nop, it caused the problem to appear.
--- kernel/trace/trace.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
kernel/trace/trace.c +13 -0
@@ -7666,6 +7666,19 @@ static int allocate_trace_buffers(struct*/ allocate_snapshot = false;#endif + +/* +* Because of some magic with the way alloc_percpu() works on +* x86_64, we need to synchronize the pgd of all the tables, +* otherwise the trace events that happen in x86_64 page fault +* handlers can't cope with accessing the chance that a +* alloc_percpu()'d memory might be touched in the page fault trace +* event. Oh, and we need to audit all other alloc_percpu() and vmalloc() +* calls in tracing, because something might get triggered within a +* page fault trace event! +*/ +vmalloc_sync_mappings (); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 22/114 KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 1c32ca5dc6d00012f0c964e5fdd7042fcc71efb1 upstream.
When deciding whether a guest has to be stopped we check whether this is a private interrupt or not. Unfortunately, there's an off-by-one bug here, and we fail to recognize a whole range of interrupts as being global (GICv2 SPIs 32-63).
Fix the condition from > to be >=.
--- virt/kvm/arm/vgic/vgic-mmio.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
virt/kvm/arm/vgic/vgic-mmio.c +2 -2
@@ -260,7 +260,7 @@ static void vgic_mmio_change_active(strustatic void vgic_change_active_prepare (struct kvm_vcpu *vcpu,u32 intid) {if (vcpu->kvm->arch.vgic.vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 || - intid >VGIC_NR_PRIVATE_IRQS ) + intid >=VGIC_NR_PRIVATE_IRQS )kvm_arm_halt_guest (vcpu->kvm); }
@@ -268,7 +268,7 @@ static void vgic_change_active_prepare(sstatic void vgic_change_active_finish (struct kvm_vcpu *vcpu,u32 intid) {if (vcpu->kvm->arch.vgic.vgic_model ==KVM_DEV_TYPE_ARM_VGIC_V3 || - intid >VGIC_NR_PRIVATE_IRQS ) + intid >=VGIC_NR_PRIVATE_IRQS )kvm_arm_resume_guest (vcpu->kvm); }
Greg Kroah-Hartman
maintainerPATCH 23/114 mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
In reply to Greg Kroah-HartmanFrom: David Hildenbrand <[email protected]>
commit e84fe99b68ce353c37ceeecc95dce9696c976556 upstream.
Without CONFIG_PREEMPT, it can happen that we get soft lockups detected, e.g., while booting up.
watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [swapper/0:1] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.6.0-next-20200331+ #4 Hardware name: Red Hat KVM, BIOS 1.11.1-4.module+el8.1.0+4066+0f1aadab 04/01/2014 RIP: __pageblock_pfn_to_page+0x134/0x1c0 Call Trace: set_zone_contiguous+0x56/0x70 page_alloc_init_late+0x166/0x176 kernel_init_freeable+0xfa/0x255 kernel_init+0xa/0x106 ret_from_fork+0x35/0x40
The issue becomes visible when having a lot of memory (e.g., 4TB) assigned to a single NUMA node - a system that can easily be created using QEMU. Inside VMs on a hypervisor with quite some memory overcommit, this is fairly easy to trigger.
--- mm/page_alloc.c | 1 + 1 file changed, 1 insertion(+)
mm/page_alloc.c +1 -0
@@ -1405,6 +1405,7 @@ void set_zone_contiguous(struct zone *zoif (!__pageblock_pfn_to_page (block_start_pfn, block_end_pfn, zone))return ; +cond_resched (); }/* We confirm that there is no hole */
Greg Kroah-Hartman
maintainerPATCH 24/114 coredump: fix crash when umh is disabled
In reply to Greg Kroah-HartmanFrom: Luis Chamberlain <[email protected]>
commit 3740d93e37902b31159a82da2d5c8812ed825404 upstream.
Commit 64e90a8acb859 ("Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()") added the optiont to disable all call_usermodehelper() calls by setting STATIC_USERMODEHELPER_PATH to an empty string. When this is done, and crashdump is triggered, it will crash on null pointer dereference, since we make assumptions over what call_usermodehelper_exec() did.
This has been reported by Sergey when one triggers a a coredump with the following configuration:
``` CONFIG_STATIC_USERMODEHELPER=y CONFIG_STATIC_USERMODEHELPER_PATH="" kernel.core_pattern = |/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e ```
The way disabling the umh was designed was that call_usermodehelper_exec() would just return early, without an error. But coredump assumes certain variables are set up for us when this happens, and calls ile_start_write(cprm.file) with a NULL file.
[ 2.819676] BUG: kernel NULL pointer dereference, address: 0000000000000020 [ 2.819859] #PF: supervisor read access in kernel mode [ 2.820035] #PF: error_code(0x0000) - not-present page [ 2.820188] PGD 0 P4D 0 [ 2.820305] Oops: 0000 [#1] SMP PTI [ 2.820436] CPU: 2 PID: 89 Comm: a Not tainted 5.7.0-rc1+ #7 [ 2.820680] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190711_202441-buildvm-armv7-10.arm.fedoraproject.org-2.fc31 04/01/2014 [ 2.821150] RIP: 0010:do_coredump+0xd80/0x1060 [ 2.821385] Code: e8 95 11 ed ff 48 c7 c6 cc a7 b4 81 48 8d bd 28 ff ff ff 89 c2 e8 70 f1 ff ff 41 89 c2 85 c0 0f 84 72 f7 ff ff e9 b4 fe ff ff <48> 8b 57 20 0f b7 02 66 25 00 f0 66 3d 00 8 0 0f 84 9c 01 00 00 44 [ 2.822014] RSP: 0000:ffffc9000029bcb8 EFLAGS: 00010246 [ 2.822339] RAX: 0000000000000000 RBX: ffff88803f860000 RCX: 000000000000000a [ 2.822746] RDX: 0000000000000009 RSI: 0000000000000282 RDI: 0000000000000000 [ 2.823141] RBP: ffffc9000029bde8 R08: 0000000000000000 R09: ffffc9000029bc00 [ 2.823508] R10: 0000000000000001 R11: ffff88803dec90be R12: ffffffff81c39da0 [ 2.823902] R13: ffff88803de84400 R14: 0000000000000000 R15: 0000000000000000 [ 2.824285] FS: 00007fee08183540(0000) GS:ffff88803e480000(0000) knlGS:0000000000000000 [ 2.824767] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2.825111] CR2: 0000000000000020 CR3: 000000003f856005 CR4: 0000000000060ea0 [ 2.825479] Call Trace: [ 2.825790] get_signal+0x11e/0x720 [ 2.826087] do_signal+0x1d/0x670 [ 2.826361] ? force_sig_info_to_task+0xc1/0xf0 [ 2.826691] ? force_sig_fault+0x3c/0x40 [ 2.826996] ? do_trap+0xc9/0x100 [ 2.827179] exit_to_usermode_loop+0x49/0x90 [ 2.827359] prepare_exit_to_usermode+0x77/0xb0 [ 2.827559] ? invalid_op+0xa/0x30 [ 2.827747] ret_from_intr+0x20/0x20 [ 2.827921] RIP: 0033:0x55e2c76d2129 [ 2.828107] Code: 2d ff ff ff e8 68 ff ff ff 5d c6 05 18 2f 00 00 01 c3 0f 1f 80 00 00 00 00 c3 0f 1f 80 00 00 00 00 e9 7b ff ff ff 55 48 89 e5 <0f> 0b b8 00 00 00 00 5d c3 66 2e 0f 1f 84 0 0 00 00 00 00 0f 1f 40 [ 2.828603] RSP: 002b:00007fffeba5e080 EFLAGS: 00010246 [ 2.828801] RAX: 000055e2c76d2125 RBX: 0000000000000000 RCX: 00007fee0817c718 [ 2.829034] RDX: 00007fffeba5e188 RSI: 00007fffeba5e178 RDI: 0000000000000001 [ 2.829257] RBP: 00007fffeba5e080 R08: 0000000000000000 R09: 00007fee08193c00 [ 2.829482] R10: 0000000000000009 R11: 0000000000000000 R12: 000055e2c76d2040 [ 2.829727] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 2.829964] CR2: 0000000000000020 [ 2.830149] ---[ end trace ceed83d8c68a1bf1 ]---
```
--- fs/coredump.c | 8 ++++++++ kernel/umh.c | 5 +++++ 2 files changed, 13 insertions(+)
fs/coredump.c +8 -0
@@ -758,6 +758,14 @@ void do_coredump(const siginfo_t *siginfif (displaced)put_files_struct (displaced);if (!dump_interrupted ()) { +/* +* umh disabled with CONFIG_STATIC_USERMODEHELPER_PATH="" would +* have this set to NULL. +*/ +if (!cprm.file) { +pr_info ("Core dump to |%s disabled\n" , cn.corename); + goto close_fail; + }file_start_write (cprm.file); core_dumped = binfmt->core_dump (&cprm);file_end_write (cprm.file);
kernel/umh.c +5 -0
@@ -404,6 +404,11 @@ EXPORT_SYMBOL(call_usermodehelper_setup)* Runs a user-space application. The application is started * asynchronously if wait is not set, and runs as a child of system workqueues. * (ie. it runs with full root capabilities and optimized affinity). +* +* Note: successful return value does not guarantee the helper was called at +* all. You can't rely on sub_info->{init,cleanup} being called even for +* UMH_WAIT_* wait modes as STATIC_USERMODEHELPER_PATH="" turns all helpers +* into a successful no-op. */ int call_usermodehelper_exec (struct subprocess_info *sub_info,int wait) {
Greg Kroah-Hartman
maintainerPATCH 25/114 batman-adv: fix batadv_nc_random_weight_tq
In reply to Greg Kroah-HartmanFrom: George Spelvin <[email protected]>
commit fd0c42c4dea54335967c5a86f15fc064235a2797 upstream.
and change to pseudorandom numbers, as this is a traffic dithering operation that doesn't need crypto-grade.
The previous code operated in 4 steps:
1. Generate a random byte 0 <= rand_tq <= 255
2. Multiply it by BATADV_TQ_MAX_VALUE - tq
3. Divide by 255 (= BATADV_TQ_MAX_VALUE)
4. Return BATADV_TQ_MAX_VALUE - rand_tq
This would apperar to scale (BATADV_TQ_MAX_VALUE - tq) by a random value between 0/255 and 255/255.
But! The intermediate value between steps 3 and 4 is stored in a u8 variable. So it's truncated, and most of the time, is less than 255, after which the division produces 0. Specifically, if tq is odd, the product is always even, and can never be 255. If tq is even, there's exactly one random byte value that will produce a product byte of 255.
Thus, the return value is 255 (511/512 of the time) or 254 (1/512 of the time).
If we assume that the truncation is a bug, and the code is meant to scale the input, a simpler way of looking at it is that it's returning a random value between tq and BATADV_TQ_MAX_VALUE, inclusive.
Well, we have an optimized function for doing just that.
--- net/batman-adv/network-coding.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
net/batman-adv/network-coding.c +1 -8
@@ -1017,15 +1017,8 @@ static struct batadv_nc_path *batadv_nc_*/ static u8 batadv_nc_random_weight_tq (u8 tq) { -u8 rand_val, rand_tq; - -get_random_bytes (&rand_val,sizeof (rand_val)); -/* randomize the estimated packet loss (max TQ - estimated TQ) */ - rand_tq = rand_val * (BATADV_TQ_MAX_VALUE - tq); - -/* normalize the randomized packet loss */ - rand_tq /=BATADV_TQ_MAX_VALUE ; +u8 rand_tq =prandom_u32_max (BATADV_TQ_MAX_VALUE +1 - tq);/* convert to (randomized) estimated tq again */ return BATADV_TQ_MAX_VALUE - rand_tq;
Greg Kroah-Hartman
maintainerPATCH 26/114 batman-adv: Fix refcnt leak in batadv_show_throughput_override
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
commit f872de8185acf1b48b954ba5bd8f9bc0a0d14016 upstream.
batadv_show_throughput_override() invokes batadv_hardif_get_by_netdev(), which gets a batadv_hard_iface object from net_dev with increased refcnt and its reference is assigned to a local pointer 'hard_iface'.
When batadv_show_throughput_override() returns, "hard_iface" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The issue happens in the normal path of batadv_show_throughput_override(), which forgets to decrease the refcnt increased by batadv_hardif_get_by_netdev() before the function returns, causing a refcnt leak.
Fix this issue by calling batadv_hardif_put() before the batadv_show_throughput_override() returns in the normal path.
--- net/batman-adv/sysfs.c | 1 + 1 file changed, 1 insertion(+)
net/batman-adv/sysfs.c +1 -0
@@ -1114,6 +1114,7 @@ static ssize_t batadv_show_throughput_ov tp_override =atomic_read (&hard_iface->bat_v.throughput_override); +batadv_hardif_put (hard_iface);return sprintf (buff,"%u.%u MBit\n" , tp_override /10 , tp_override %10 ); }
Greg Kroah-Hartman
maintainerPATCH 27/114 batman-adv: Fix refcnt leak in batadv_store_throughput_override
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
commit 6107c5da0fca8b50b4d3215e94d619d38cc4a18c upstream.
batadv_show_throughput_override() invokes batadv_hardif_get_by_netdev(), which gets a batadv_hard_iface object from net_dev with increased refcnt and its reference is assigned to a local pointer 'hard_iface'.
When batadv_store_throughput_override() returns, "hard_iface" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The issue happens in one error path of batadv_store_throughput_override(). When batadv_parse_throughput() returns NULL, the refcnt increased by batadv_hardif_get_by_netdev() is not decreased, causing a refcnt leak.
Fix this issue by jumping to "out" label when batadv_parse_throughput() returns NULL.
--- net/batman-adv/sysfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/sysfs.c +1 -1
@@ -1081,7 +1081,7 @@ static ssize_t batadv_store_throughput_o ret =batadv_parse_throughput (net_dev, buff,"throughput_override" , &tp_override);if (!ret) -return count; + goto out; old_tp_override =atomic_read (&hard_iface->bat_v.throughput_override);if (old_tp_override == tp_override)
Greg Kroah-Hartman
maintainerPATCH 28/114 batman-adv: Fix refcnt leak in batadv_v_ogm_process
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
commit 6f91a3f7af4186099dd10fa530dd7e0d9c29747d upstream.
batadv_v_ogm_process() invokes batadv_hardif_neigh_get(), which returns a reference of the neighbor object to "hardif_neigh" with increased refcount.
When batadv_v_ogm_process() returns, "hardif_neigh" becomes invalid, so the refcount should be decreased to keep refcount balanced.
The reference counting issue happens in one exception handling paths of batadv_v_ogm_process(). When batadv_v_ogm_orig_get() fails to get the orig node and returns NULL, the refcnt increased by batadv_hardif_neigh_get() is not decreased, causing a refcnt leak.
Fix this issue by jumping to "out" label when batadv_v_ogm_orig_get() fails to get the orig node.
--- net/batman-adv/bat_v_ogm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/bat_v_ogm.c +1 -1
@@ -734,7 +734,7 @@ static void batadv_v_ogm_process(const s orig_node =batadv_v_ogm_orig_get (bat_priv, ogm_packet->orig);if (!orig_node) -return ; + goto out; neigh_node =batadv_neigh_node_get_or_create (orig_node, if_incoming, ethhdr->h_source);
Greg Kroah-Hartman
maintainerPATCH 29/114 x86/entry/64: Fix unwind hints in kernel exit path
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit 1fb143634a38095b641a3a21220774799772dc4c upstream.
In swapgs_restore_regs_and_return_to_usermode, after the stack is switched to the trampoline stack, the existing UNWIND_HINT_REGS hint is no longer valid, which can result in the following ORC unwinder warning:
WARNING: can't dereference registers at 000000003aeb0cdd for ip swapgs_restore_regs_and_return_to_usermode+0x93/0xa0
For full correctness, we could try to add complicated unwind hints so the unwinder could continue to find the registers, but when when it's this close to kernel exit, unwind hints aren't really needed anymore and it's fine to just use an empty hint which tells the unwinder to stop.
For consistency, also move the UNWIND_HINT_EMPTY in entry_SYSCALL_64_after_hwframe to a similar location.
--- arch/x86/entry/entry_64.S | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/entry/entry_64.S +2 -1
@@ -302,7 +302,6 @@ GLOBAL(entry_SYSCALL_64_after_hwframe) */ syscall_return_via_sysret: /* rcx and r11 are already restored (see code above) */ - UNWIND_HINT_EMPTY POP_REGS pop_rdi=0 skip_r11rcx=1 /*
@@ -311,6 +310,7 @@ syscall_return_via_sysret: */ movq %rsp, %rdi movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp + UNWIND_HINT_EMPTY pushq RSP-RDI(%rdi) /* RSP */ pushq (%rdi) /* RDI */
@@ -606,6 +606,7 @@ GLOBAL(swapgs_restore_regs_and_return_to */ movq %rsp, %rdi movq PER_CPU_VAR(cpu_tss_rw + TSS_sp0), %rsp + UNWIND_HINT_EMPTY /* Copy the IRET frame to the trampoline stack. */ pushq 6*8(%rdi) /* SS */
Greg Kroah-Hartman
maintainerPATCH 30/114 x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
In reply to Greg Kroah-HartmanFrom: Jann Horn <[email protected]>
commit f977df7b7ca45a4ac4b66d30a8931d0434c394b1 upstream.
The LEAQ instruction in rewind_stack_do_exit() moves the stack pointer directly below the pt_regs at the top of the task stack before calling do_exit(). Tell the unwinder to expect pt_regs.
--- arch/x86/entry/entry_64.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/entry/entry_64.S +1 -1
@@ -1649,7 +1649,7 @@ ENTRY(rewind_stack_do_exit) movq PER_CPU_VAR(cpu_current_top_of_stack), %rax leaq -PTREGS_SIZE(%rax), %rsp - UNWIND_HINT_FUNC sp_offset=PTREGS_SIZE + UNWIND_HINT_REGS call do_exit END(rewind_stack_do_exit)
Greg Kroah-Hartman
maintainerPATCH 31/114 x86/unwind/orc: Dont skip the first frame for inactive tasks
In reply to Greg Kroah-HartmanFrom: Miroslav Benes <[email protected]>
commit f1d9a2abff66aa8156fbc1493abed468db63ea48 upstream.
When unwinding an inactive task, the ORC unwinder skips the first frame by default. If both the 'regs' and 'first_frame' parameters of unwind_start() are NULL, 'state->sp' and 'first_frame' are later initialized to the same value for an inactive task. Given there is a "less than or equal to" comparison used at the end of __unwind_start() for skipping stack frames, the first frame is skipped.
Drop the equal part of the comparison and make the behavior equivalent to the frame pointer unwinder.
--- arch/x86/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/unwind_orc.c +1 -1
@@ -574,7 +574,7 @@ void __unwind_start(struct unwind_state/* Otherwise, skip ahead to the user-specified starting frame: */ while (!unwind_done (state) && (!on_stack (&state->stack_info, first_frame,sizeof (long )) || - state->sp <= (unsigned long )first_frame)) + state->sp < (unsigned long )first_frame))unwind_next_frame (state);return ;
Greg Kroah-Hartman
maintainerPATCH 32/114 x86/unwind/orc: Prevent unwinding before ORC initialization
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit 98d0c8ebf77e0ba7c54a9ae05ea588f0e9e3f46e upstream.
If the unwinder is called before the ORC data has been initialized, orc_find() returns NULL, and it tries to fall back to using frame pointers. This can cause some unexpected warnings during boot.
Move the 'orc_init' check from orc_find() to __unwind_init(), so that it doesn't even try to unwind from an uninitialized state.
--- arch/x86/kernel/unwind_orc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/x86/kernel/unwind_orc.c +3 -3
@@ -90,9 +90,6 @@ static struct orc_entry null_orc_entry =static struct orc_entry *orc_find (unsigned long ip) { -if (!orc_init) -return NULL ; -if (ip ==0 )return &null_orc_entry;
@@ -508,6 +505,9 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);void __unwind_start (struct unwind_state *state,struct task_struct *task,struct pt_regs *regs,unsigned long *first_frame) { +if (!orc_init) + goto done; +memset (state,0 ,sizeof (*state)); state->task = task;
Greg Kroah-Hartman
maintainerPATCH 33/114 x86/unwind/orc: Fix error path for bad ORC entry type
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit a0f81bf26888048100bf017fadf438a5bdffa8d8 upstream.
If the ORC entry type is unknown, nothing else can be done other than reporting an error. Exit the function instead of breaking out of the switch statement.
--- arch/x86/kernel/unwind_orc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kernel/unwind_orc.c +1 -1
@@ -457,7 +457,7 @@ bool unwind_next_frame(struct unwind_stadefault :orc_warn ("unknown .orc_unwind entry type %d for ip %pB\n" , orc->type, (void *)orig_ip); -break ; + goto done; }/* Find BP: */
Greg Kroah-Hartman
maintainerPATCH 34/114 netfilter: nat: never update the UDP checksum when its 0
In reply to Greg Kroah-HartmanFrom: Guillaume Nault <[email protected]>
commit ea64d8d6c675c0bb712689b13810301de9d8f77a upstream.
If the UDP header of a local VXLAN endpoint is NAT-ed, and the VXLAN device has disabled UDP checksums and enabled Tx checksum offloading, then the skb passed to udp_manip_pkt() has hdr->check == 0 (outer checksum disabled) and skb->ip_summed == CHECKSUM_PARTIAL (inner packet checksum offloaded).
Because of the ->ip_summed value, udp_manip_pkt() tries to update the outer checksum with the new address and port, leading to an invalid checksum sent on the wire, as the original null checksum obviously didn't take the old address and port into account.
So, we can't take ->ip_summed into account in udp_manip_pkt(), as it might not refer to the checksum we're acting on. Instead, we can base the decision to update the UDP checksum entirely on the value of hdr->check, because it's null if and only if checksum is disabled:
* A fully computed checksum can't be 0, since a 0 checksum is represented by the CSUM_MANGLED_0 value instead.
* A partial checksum can't be 0, since the pseudo-header always adds at least one non-zero value (the UDP protocol type 0x11) and adding more values to the sum can't make it wrap to 0 as the carry is then added to the wrapped number.
* A disabled checksum uses the special value 0.
The problem seems to be there from day one, although it was probably not visible before UDP tunnels were implemented.
--- net/netfilter/nf_nat_proto_udp.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/netfilter/nf_nat_proto_udp.c +2 -3
@@ -66,15 +66,14 @@ static bool udp_manip_pkt(struct sk_buff enum nf_nat_manip_type maniptype) {struct udphdr *hdr; -bool do_csum;if (!skb_make_writable (skb, hdroff +sizeof (*hdr)))return false; hdr = (struct udphdr *)(skb->data + hdroff); - do_csum = hdr->check || skb->ip_summed ==CHECKSUM_PARTIAL ; +__udp_manip_pkt (skb, l3proto, iphdroff, hdr, tuple, maniptype, + !!hdr->check); -__udp_manip_pkt (skb, l3proto, iphdroff, hdr, tuple, maniptype, do_csum);return true; }
Greg Kroah-Hartman
maintainerPATCH 35/114 objtool: Fix stack offset tracking for indirect CFAs
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit d8dd25a461e4eec7190cb9d66616aceacc5110ad upstream.
When the current frame address (CFA) is stored on the stack (i.e., cfa->base == CFI_SP_INDIRECT), objtool neglects to adjust the stack offset when there are subsequent pushes or pops. This results in bad ORC data at the end of the ENTER_IRQ_STACK macro, when it puts the previous stack pointer on the stack and does a subsequent push.
This fixes the following unwinder warning:
WARNING: can't dereference registers at 00000000f0a6bdba for ip interrupt_entry+0x9f/0xa0
--- tools/objtool/check.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/objtool/check.c +1 -1
@@ -1291,7 +1291,7 @@ static int update_insn_state_regs(structstruct cfi_reg *cfa = &state->cfa;struct stack_op *op = &insn->stack_op; -if (cfa->base !=CFI_SP ) +if (cfa->base !=CFI_SP && cfa->base !=CFI_SP_INDIRECT )return 0 ;/* push */
Greg Kroah-Hartman
maintainerPATCH 36/114 scripts/decodecode: fix trapping instruction formatting
In reply to Greg Kroah-HartmanFrom: Ivan Delalande <[email protected]>
commit e08df079b23e2e982df15aa340bfbaf50f297504 upstream.
If the trapping instruction contains a ':', for a memory access through segment registers for example, the sed substitution will insert the '*' marker in the middle of the instruction instead of the line address:
2b: 65 48 0f c7 0f cmpxchg16b %gs:*(%rdi) <-- trapping instruction
I started to think I had forgotten some quirk of the assembly syntax before noticing that it was actually coming from the script. Fix it to add the address marker at the right place for these instructions:
28: 49 8b 06 mov (%r14),%rax 2b:* 65 48 0f c7 0f cmpxchg16b %gs:(%rdi) <-- trapping instruction 30: 0f 94 c0 sete %al
--- scripts/decodecode | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/decodecode +1 -1
@@ -99,7 +99,7 @@ faultlinenum=$(( $(wc -l $T.oo | cut -d faultline=`cat $T.dis | head -1 | cut -d":" -f2-` faultline=`echo "$faultline" | sed -e 's/\[/\\\[/g; s/\]/\\\]/g'` -cat $T.oo | sed -e "${faultlinenum}s/^\(.*:\)\(.*\)/\1\*\2\t\t<-- trapping instruction/" +cat $T.oo | sed -e "${faultlinenum}s/^\([^:]*:\)\(.*\)/\1\*\2\t\t<-- trapping instruction/" echo cat $T.aa cleanup
Greg Kroah-Hartman
maintainerPATCH 37/114 net: ipv6: add net argument to ip6_dst_lookup_flow
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
commit c4e85f73afb6384123e5ef1bba3315b2e3ad031e upstream.
This will be used in the conversion of ipv6_stub to ip6_dst_lookup_flow, as some modules currently pass a net argument without a socket to ip6_dst_lookup. This is equivalent to commit 343d60aada5a ("ipv6: change ipv6_stub_impl.ipv6_dst_lookup to take net argument").
--- include/net/ipv6.h | 2 +- net/dccp/ipv6.c | 6 +++--- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/inet6_connection_sock.c | 4 ++-- net/ipv6/ip6_output.c | 8 ++++---- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 ++-- net/l2tp/l2tp_ip6.c | 2 +- net/sctp/ipv6.c | 4 ++-- 11 files changed, 19 insertions(+), 19 deletions(-)
include/net/ipv6.h +1 -1
@@ -862,7 +862,7 @@ static inline struct sk_buff *ip6_finishint ip6_dst_lookup (struct net *net,struct sock *sk,struct dst_entry **dst,struct flowi6 *fl6); -struct dst_entry *ip6_dst_lookup_flow (const struct sock *sk,struct flowi6 *fl6, +struct dst_entry *ip6_dst_lookup_flow (struct net *net,const struct sock *sk,struct flowi6 *fl6,const struct in6_addr *final_dst);struct dst_entry *ip6_sk_dst_lookup_flow (struct sock *sk,struct flowi6 *fl6,const struct in6_addr *final_dst);
net/dccp/ipv6.c +3 -3
@@ -211,7 +211,7 @@ static int dccp_v6_send_response(const s final_p =fl6_update_dst (&fl6,rcu_dereference (np->opt), &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); dst =NULL ;
@@ -282,7 +282,7 @@ static void dccp_v6_ctl_send_reset(constsecurity_skb_classify_flow (rxskb,flowi6_to_flowi (&fl6));/* sk = NULL, but it is safe for now. RST socket required. */ - dst =ip6_dst_lookup_flow (ctl_sk, &fl6,NULL ); + dst =ip6_dst_lookup_flow (sock_net (ctl_sk), ctl_sk, &fl6,NULL );if (!IS_ERR (dst)) {skb_dst_set (skb, dst);ip6_xmit (ctl_sk, skb, &fl6,0 ,NULL ,0 );
@@ -912,7 +912,7 @@ static int dccp_v6_connect(struct sock * opt =rcu_dereference_protected (np->opt,lockdep_sock_is_held (sk)); final_p =fl6_update_dst (&fl6, opt, &final); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto failure;
net/ipv6/af_inet6.c +1 -1
@@ -716,7 +716,7 @@ int inet6_sk_rebuild_header(struct sock &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { sk->sk_route_caps =0 ; sk->sk_err_soft = -PTR_ERR (dst);
net/ipv6/datagram.c +1 -1
@@ -88,7 +88,7 @@ int ip6_datagram_dst_update(struct sock final_p =fl6_update_dst (&fl6, opt, &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/ipv6/inet6_connection_sock.c +2 -2
@@ -52,7 +52,7 @@ struct dst_entry *inet6_csk_route_req(co fl6->flowi6_uid = sk->sk_uid;security_req_classify_flow (req,flowi6_to_flowi (fl6)); - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (IS_ERR (dst))return NULL ;
@@ -107,7 +107,7 @@ static struct dst_entry *inet6_csk_route dst =__inet6_csk_dst_check (sk, np->dst_cookie);if (!dst) { - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (!IS_ERR (dst))ip6_dst_store (sk, dst,NULL ,NULL );
net/ipv6/ip6_output.c +4 -4
@@ -1089,19 +1089,19 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup);* It returns a valid dst pointer on success, or a pointer encoded * error code. */ -struct dst_entry *ip6_dst_lookup_flow (const struct sock *sk,struct flowi6 *fl6, +struct dst_entry *ip6_dst_lookup_flow (struct net *net,const struct sock *sk,struct flowi6 *fl6,const struct in6_addr *final_dst) {struct dst_entry *dst =NULL ;int err; - err =ip6_dst_lookup_tail (sock_net (sk), sk, &dst, fl6); + err =ip6_dst_lookup_tail (net, sk, &dst, fl6);if (err)return ERR_PTR (err);if (final_dst) fl6->daddr = *final_dst; -return xfrm_lookup_route (sock_net (sk), dst,flowi6_to_flowi (fl6), sk,0 ); +return xfrm_lookup_route (net, dst,flowi6_to_flowi (fl6), sk,0 ); }EXPORT_SYMBOL_GPL (ip6_dst_lookup_flow);
@@ -1126,7 +1126,7 @@ struct dst_entry *ip6_sk_dst_lookup_flow dst =ip6_sk_dst_check (sk, dst, fl6);if (!dst) - dst =ip6_dst_lookup_flow (sk, fl6, final_dst); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_dst);return dst; }
net/ipv6/raw.c +1 -1
@@ -929,7 +929,7 @@ static int rawv6_sendmsg(struct sock *sk fl6.flowlabel =ip6_make_flowinfo (ipc6.tclass, fl6.flowlabel); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/ipv6/syncookies.c +1 -1
@@ -238,7 +238,7 @@ struct sock *cookie_v6_check(struct sock fl6.flowi6_uid = sk->sk_uid;security_req_classify_flow (req,flowi6_to_flowi (&fl6)); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) goto out_free; }
net/ipv6/tcp_ipv6.c +2 -2
@@ -252,7 +252,7 @@ static int tcp_v6_connect(struct sock *ssecurity_sk_classify_flow (sk,flowi6_to_flowi (&fl6)); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto failure;
@@ -865,7 +865,7 @@ static void tcp_v6_send_response(const s* Underlying function will use this to retrieve the network * namespace */ - dst =ip6_dst_lookup_flow (ctl_sk, &fl6,NULL ); + dst =ip6_dst_lookup_flow (sock_net (ctl_sk), ctl_sk, &fl6,NULL );if (!IS_ERR (dst)) {skb_dst_set (buff, dst);ip6_xmit (ctl_sk, buff, &fl6, fl6.flowi6_mark,NULL , tclass);
net/l2tp/l2tp_ip6.c +1 -1
@@ -629,7 +629,7 @@ static int l2tp_ip6_sendmsg(struct sock fl6.flowlabel =ip6_make_flowinfo (ipc6.tclass, fl6.flowlabel); - dst =ip6_dst_lookup_flow (sk, &fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, &fl6, final_p);if (IS_ERR (dst)) { err =PTR_ERR (dst); goto out;
net/sctp/ipv6.c +2 -2
@@ -271,7 +271,7 @@ static void sctp_v6_get_dst(struct sctp_ final_p =fl6_update_dst (fl6,rcu_dereference (np->opt), &final);rcu_read_unlock (); - dst =ip6_dst_lookup_flow (sk, fl6, final_p); + dst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (!asoc || saddr) { t->dst = dst;memcpy (fl, &_fl,sizeof (_fl));
@@ -329,7 +329,7 @@ static void sctp_v6_get_dst(struct sctp_ fl6->saddr = laddr->a.v6.sin6_addr; fl6->fl6_sport = laddr->a.v6.sin6_port; final_p =fl6_update_dst (fl6,rcu_dereference (np->opt), &final); - bdst =ip6_dst_lookup_flow (sk, fl6, final_p); + bdst =ip6_dst_lookup_flow (sock_net (sk), sk, fl6, final_p);if (IS_ERR (bdst))continue ;
Greg Kroah-Hartman
maintainerPATCH 38/114 net: ipv6_stub: use ip6_dst_lookup_flow instead of ip6_dst_lookup
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
commit 6c8991f41546c3c472503dff1ea9daaddf9331c2 upstream.
ipv6_stub uses the ip6_dst_lookup function to allow other modules to perform IPv6 lookups. However, this function skips the XFRM layer entirely.
All users of ipv6_stub->ip6_dst_lookup use ip_route_output_flow (via the ip_route_output_key and ip_route_output helpers) for their IPv4 lookups, which calls xfrm_lookup_route(). This patch fixes this inconsistent behavior by switching the stub to ip6_dst_lookup_flow, which also calls xfrm_lookup_route().
This requires some changes in all the callers, as these two functions take different arguments and have different return types.
[bwh: Backported to 4.14:
- Drop change in lwt_bpf.c
- Delete now-unused "ret" in mlx5e_route_lookup_ipv6()
- Initialise "out_dev" in mlx5e_create_encap_header_ipv6() to avoid introducing a spurious "may be used uninitialised" warning
- Adjust filenames, context, indentation]
--- drivers/infiniband/core/addr.c | 7 +++---- drivers/infiniband/sw/rxe/rxe_net.c | 8 +++++--- drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 11 +++++------ drivers/net/geneve.c | 4 +++- drivers/net/vxlan.c | 8 +++----- include/net/addrconf.h | 6 ++++-- net/ipv6/addrconf_core.c | 11 ++++++----- net/ipv6/af_inet6.c | 2 +- net/mpls/af_mpls.c | 7 +++---- net/tipc/udp_media.c | 9 ++++++--- 10 files changed, 39 insertions(+), 34 deletions(-)
drivers/infiniband/core/addr.c +3 -4
@@ -450,16 +450,15 @@ static int addr6_resolve(struct sockaddrstruct flowi6 fl6;struct dst_entry *dst;struct rt6_info *rt; -int ret;memset (&fl6,0 ,sizeof fl6); fl6.daddr = dst_in->sin6_addr; fl6.saddr = src_in->sin6_addr; fl6.flowi6_oif = addr->bound_dev_if; - ret = ipv6_stub->ipv6_dst_lookup (addr->net,NULL , &dst, &fl6); -if (ret <0 ) -return ret; + dst = ipv6_stub->ipv6_dst_lookup_flow (addr->net,NULL , &fl6,NULL ); +if (IS_ERR (dst)) +return PTR_ERR (dst); rt = (struct rt6_info *)dst;if (ipv6_addr_any (&src_in->sin6_addr)) {
drivers/infiniband/sw/rxe/rxe_net.c +5 -3
@@ -154,10 +154,12 @@ static struct dst_entry *rxe_find_route6memcpy (&fl6.daddr, daddr,sizeof (*daddr)); fl6.flowi6_proto =IPPROTO_UDP ; -if (unlikely (ipv6_stub->ipv6_dst_lookup (sock_net (recv_sockets.sk6->sk), - recv_sockets.sk6->sk, &ndst, &fl6))) { + ndst = ipv6_stub->ipv6_dst_lookup_flow (sock_net (recv_sockets.sk6->sk), + recv_sockets.sk6->sk, &fl6, +NULL ); +if (unlikely (IS_ERR (ndst))) {pr_err_ratelimited ("no route to %pI6\n" , daddr); - goto put; +return NULL ; }if (unlikely (ndst->error)) {
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +5 -6
@@ -1550,12 +1550,11 @@ static int mlx5e_route_lookup_ipv6(struc#if IS_ENABLED (CONFIG_INET ) &&IS_ENABLED (CONFIG_IPV6 )struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; -int ret; - ret = ipv6_stub->ipv6_dst_lookup (dev_net (mirred_dev),NULL , &dst, - fl6); -if (ret <0 ) -return ret; + dst = ipv6_stub->ipv6_dst_lookup_flow (dev_net (mirred_dev),NULL , fl6, +NULL ); +if (IS_ERR (dst)) +return PTR_ERR (dst); *out_ttl =ip6_dst_hoplimit (dst);
@@ -1754,7 +1753,7 @@ static int mlx5e_create_encap_header_ipvint max_encap_size =MLX5_CAP_ESW (priv->mdev, max_encap_header_size);int ipv6_encap_size =ETH_HLEN +sizeof (struct ipv6hdr ) +VXLAN_HLEN ;struct ip_tunnel_key *tun_key = &e->tun_info.key; -struct net_device *out_dev; +struct net_device *out_dev =NULL ;struct neighbour *n =NULL ;struct flowi6 fl6 = {};char *encap_header;
drivers/net/geneve.c +3 -1
@@ -796,7 +796,9 @@ static struct dst_entry *geneve_get_v6_dif (dst)return dst; } -if (ipv6_stub->ipv6_dst_lookup (geneve->net, gs6->sock->sk, &dst, fl6)) { + dst = ipv6_stub->ipv6_dst_lookup_flow (geneve->net, gs6->sock->sk, fl6, +NULL ); +if (IS_ERR (dst)) {netdev_dbg (dev,"no route to %pI6\n" , &fl6->daddr);return ERR_PTR (-ENETUNREACH ); }
drivers/net/vxlan.c +3 -5
@@ -1962,7 +1962,6 @@ static struct dst_entry *vxlan6_get_routbool use_cache =ip_tunnel_dst_cache_usable (skb, info);struct dst_entry *ndst;struct flowi6 fl6; -int err;if (!sock6)return ERR_PTR (-EIO );
@@ -1985,10 +1984,9 @@ static struct dst_entry *vxlan6_get_rout fl6.fl6_dport = dport; fl6.fl6_sport = sport; - err = ipv6_stub->ipv6_dst_lookup (vxlan->net, - sock6->sock->sk, - &ndst, &fl6); -if (unlikely (err <0 )) { + ndst = ipv6_stub->ipv6_dst_lookup_flow (vxlan->net, sock6->sock->sk, + &fl6,NULL ); +if (unlikely (IS_ERR (ndst))) {netdev_dbg (dev,"no route to %pI6\n" , daddr);return ERR_PTR (-ENETUNREACH ); }
include/net/addrconf.h +4 -2
@@ -223,8 +223,10 @@ struct ipv6_stub { const struct in6_addr *addr);int (*ipv6_sock_mc_drop)(struct sock *sk,int ifindex,const struct in6_addr *addr); -int (*ipv6_dst_lookup)(struct net *net,struct sock *sk, -struct dst_entry **dst,struct flowi6 *fl6); +struct dst_entry *(*ipv6_dst_lookup_flow)(struct net *net, +const struct sock *sk, +struct flowi6 *fl6, +const struct in6_addr *final_dst);void (*udpv6_encap_enable)(void ); void (*ndisc_send_na)(struct net_device *dev, const struct in6_addr *daddr, const struct in6_addr *solicited_addr,
net/ipv6/addrconf_core.c +6 -5
@@ -126,15 +126,16 @@ int inet6addr_validator_notifier_call_ch }EXPORT_SYMBOL (inet6addr_validator_notifier_call_chain); -static int eafnosupport_ipv6_dst_lookup (struct net *net,struct sock *u1, -struct dst_entry **u2, -struct flowi6 *u3) +static struct dst_entry *eafnosupport_ipv6_dst_lookup_flow (struct net *net, +const struct sock *sk, +struct flowi6 *fl6, +const struct in6_addr *final_dst) { -return -EAFNOSUPPORT ; +return ERR_PTR (-EAFNOSUPPORT ); }const struct ipv6_stub *ipv6_stub__read_mostly = &(struct ipv6_stub ) { - .ipv6_dst_lookup = eafnosupport_ipv6_dst_lookup, + .ipv6_dst_lookup_flow = eafnosupport_ipv6_dst_lookup_flow, };EXPORT_SYMBOL_GPL (ipv6_stub);
net/ipv6/af_inet6.c +1 -1
@@ -874,7 +874,7 @@ static struct pernet_operations inet6_nestatic const struct ipv6_stub ipv6_stub_impl = { .ipv6_sock_mc_join = ipv6_sock_mc_join, .ipv6_sock_mc_drop = ipv6_sock_mc_drop, - .ipv6_dst_lookup = ip6_dst_lookup, + .ipv6_dst_lookup_flow = ip6_dst_lookup_flow, .udpv6_encap_enable = udpv6_encap_enable, .ndisc_send_na = ndisc_send_na, .nd_tbl = &nd_tbl,
net/mpls/af_mpls.c +3 -4
@@ -587,16 +587,15 @@ static struct net_device *inet6_fib_lookstruct net_device *dev;struct dst_entry *dst;struct flowi6 fl6; -int err;if (!ipv6_stub)return ERR_PTR (-EAFNOSUPPORT );memset (&fl6,0 ,sizeof (fl6));memcpy (&fl6.daddr, addr,sizeof (struct in6_addr )); - err = ipv6_stub->ipv6_dst_lookup (net,NULL , &dst, &fl6); -if (err) -return ERR_PTR (err); + dst = ipv6_stub->ipv6_dst_lookup_flow (net,NULL , &fl6,NULL ); +if (IS_ERR (dst)) +return ERR_CAST (dst); dev = dst->dev;dev_hold (dev);
net/tipc/udp_media.c +6 -3
@@ -187,10 +187,13 @@ static int tipc_udp_xmit(struct net *net .saddr = src->ipv6, .flowi6_proto = IPPROTO_UDP }; - err = ipv6_stub->ipv6_dst_lookup (net, ub->ubsock->sk, &ndst, - &fl6); -if (err) + ndst = ipv6_stub->ipv6_dst_lookup_flow (net, + ub->ubsock->sk, + &fl6,NULL ); +if (IS_ERR (ndst)) { + err =PTR_ERR (ndst); goto tx_error; + } ttl =ip6_dst_hoplimit (ndst); err = udp_tunnel6_xmit_skb(ndst, ub->ubsock->sk, skb, NULL, &src->ipv6, &dst->ipv6, 0, ttl, 0,
Greg Kroah-Hartman
maintainerPATCH 39/114 blktrace: fix unlocked access to init/start-stop/teardown
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 1f2cac107c591c24b60b115d6050adc213d10fc0 upstream.
sg.c calls into the blktrace functions without holding the proper queue mutex for doing setup, start/stop, or teardown.
Add internal unlocked variants, and export the ones that do the proper locking.
--- kernel/trace/blktrace.c | 58 +++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 48 insertions(+), 10 deletions(-)
kernel/trace/blktrace.c +48 -10
@@ -352,7 +352,7 @@ static void blk_trace_cleanup(struct blkput_probe_ref (); } -int blk_trace_remove (struct request_queue *q) +static int __blk_trace_remove (struct request_queue *q) {struct blk_trace *bt;
@@ -365,6 +365,17 @@ int blk_trace_remove(struct request_queureturn 0 ; } + +int blk_trace_remove (struct request_queue *q) +{ +int ret; + +mutex_lock (&q->blk_trace_mutex); + ret =__blk_trace_remove (q); +mutex_unlock (&q->blk_trace_mutex); + +return ret; +}EXPORT_SYMBOL_GPL (blk_trace_remove); static ssize_t blk_dropped_read(struct file *filp, char __user *buffer,
@@ -565,9 +576,8 @@ err:return ret; } -int blk_trace_setup (struct request_queue *q,char *name,dev_t dev, -struct block_device *bdev, -char __user *arg) +static int __blk_trace_setup (struct request_queue *q,char *name,dev_t dev, +struct block_device *bdev,char __user *arg) {struct blk_user_trace_setup buts;int ret;
@@ -586,6 +596,19 @@ int blk_trace_setup(struct request_queue }return 0 ; } + +int blk_trace_setup (struct request_queue *q,char *name,dev_t dev, +struct block_device *bdev, +char __user *arg) +{ +int ret; + +mutex_lock (&q->blk_trace_mutex); + ret =__blk_trace_setup (q, name, dev, bdev, arg); +mutex_unlock (&q->blk_trace_mutex); + +return ret; +}EXPORT_SYMBOL_GPL (blk_trace_setup);#if defined(CONFIG_COMPAT ) && defined(CONFIG_X86_64 )
@@ -622,7 +645,7 @@ static int compat_blk_trace_setup(struct }#endif -int blk_trace_startstop (struct request_queue *q,int start) +static int __blk_trace_startstop (struct request_queue *q,int start) {int ret;struct blk_trace *bt = q->blk_trace;
@@ -661,6 +684,17 @@ int blk_trace_startstop(struct request_qreturn ret; } + +int blk_trace_startstop (struct request_queue *q,int start) +{ +int ret; + +mutex_lock (&q->blk_trace_mutex); + ret =__blk_trace_startstop (q, start); +mutex_unlock (&q->blk_trace_mutex); + +return ret; +}EXPORT_SYMBOL_GPL (blk_trace_startstop);/*
@@ -691,7 +725,7 @@ int blk_trace_ioctl(struct block_deviceswitch (cmd) {case BLKTRACESETUP :bdevname (bdev, b); - ret =blk_trace_setup (q, b, bdev->bd_dev, bdev, arg); + ret =__blk_trace_setup (q, b, bdev->bd_dev, bdev, arg);break ;#if defined(CONFIG_COMPAT ) && defined(CONFIG_X86_64 )case BLKTRACESETUP32 :
@@ -702,10 +736,10 @@ int blk_trace_ioctl(struct block_devicecase BLKTRACESTART : start =1 ;case BLKTRACESTOP : - ret =blk_trace_startstop (q, start); + ret =__blk_trace_startstop (q, start);break ;case BLKTRACETEARDOWN : - ret =blk_trace_remove (q); + ret =__blk_trace_remove (q);break ;default : ret = -ENOTTY ;
@@ -723,10 +757,14 @@ int blk_trace_ioctl(struct block_device**/ void blk_trace_shutdown (struct request_queue *q) { +mutex_lock (&q->blk_trace_mutex); +if (q->blk_trace) { -blk_trace_startstop (q,0 ); -blk_trace_remove (q); +__blk_trace_startstop (q,0 ); +__blk_trace_remove (q); } + +mutex_unlock (&q->blk_trace_mutex); }#ifdef CONFIG_BLK_CGROUP
Greg Kroah-Hartman
maintainerPATCH 40/114 blktrace: fix trace mutex deadlock
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
commit 2967acbb257a6a9bf912f4778b727e00972eac9b upstream.
A previous commit changed the locking around registration/cleanup, but direct callers of blk_trace_remove() were missed. This means that if we hit the error path in setup, we will deadlock on attempting to re-acquire the queue trace mutex.
--- kernel/trace/blktrace.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/trace/blktrace.c +2 -2
@@ -591,7 +591,7 @@ static int __blk_trace_setup(struct requreturn ret;if (copy_to_user (arg, &buts,sizeof (buts))) { -blk_trace_remove (q); +__blk_trace_remove (q);return -EFAULT ; }return 0 ;
@@ -637,7 +637,7 @@ static int compat_blk_trace_setup(structreturn ret;if (copy_to_user (arg, &buts.name,ARRAY_SIZE (buts.name))) { -blk_trace_remove (q); +__blk_trace_remove (q);return -EFAULT ; }
Greg Kroah-Hartman
maintainerPATCH 41/114 blktrace: Protect q->blk_trace with RCU
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit c780e86dd48ef6467a1146cf7d0fe1e05a635039 upstream.
KASAN is reporting that __blk_add_trace() has a use-after-free issue when accessing q->blk_trace. Indeed the switching of block tracing (and thus eventual freeing of q->blk_trace) is completely unsynchronized with the currently running tracing and thus it can happen that the blk_trace structure is being freed just while __blk_add_trace() works on it. Protect accesses to q->blk_trace by RCU during tracing and make sure we wait for the end of RCU grace period when shutting down tracing. Luckily that is rare enough event that we can afford that. Note that postponing the freeing of blk_trace to an RCU callback should better be avoided as it could have unexpected user visible side-effects as debugfs files would be still existing for a short while block tracing has been shut down.
--- include/linux/blkdev.h | 2 include/linux/blktrace_api.h | 18 ++++-- kernel/trace/blktrace.c | 114 +++++++++++++++++++++++++++++++------------ 3 files changed, 97 insertions(+), 37 deletions(-)
include/linux/blkdev.h +1 -1
@@ -568,7 +568,7 @@ struct request_queue {unsigned int sg_reserved_size;int node;#ifdef CONFIG_BLK_DEV_IO_TRACE -struct blk_trace *blk_trace; +struct blk_trace __rcu *blk_trace;struct mutex blk_trace_mutex;#endif /*
include/linux/blktrace_api.h +13 -5
@@ -51,9 +51,13 @@ void __trace_note_message(struct blk_tra**/ #define blk_add_cgroup_trace_msg (q, cg, fmt, ...) \ do { \ - struct blk_trace *bt = (q)->blk_trace; \ + struct blk_trace *bt; \ + \ + rcu_read_lock(); \ + bt = rcu_dereference((q)->blk_trace); \ if (unlikely(bt)) \ __trace_note_message(bt, cg, fmt, ##__VA_ARGS__);\ + rcu_read_unlock(); \ } while (0)#define blk_add_trace_msg (q, fmt, ...) \ blk_add_cgroup_trace_msg(q, NULL, fmt, ##__VA_ARGS__)
@@ -61,10 +65,14 @@ void __trace_note_message(struct blk_trastatic inline bool blk_trace_note_message_enabled (struct request_queue *q) { -struct blk_trace *bt = q->blk_trace; -if (likely (!bt)) -return false; -return bt->act_mask &BLK_TC_NOTIFY ; +struct blk_trace *bt; +bool ret; + +rcu_read_lock (); + bt =rcu_dereference (q->blk_trace); + ret = bt && (bt->act_mask &BLK_TC_NOTIFY ); +rcu_read_unlock (); +return ret; } extern void blk_add_driver_data(struct request_queue *q, struct request *rq,
kernel/trace/blktrace.c +83 -31
313 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 42/114 blktrace: fix dereference after null check
In reply to Greg Kroah-HartmanFrom: Cengiz Can <[email protected]>
commit 153031a301bb07194e9c37466cfce8eacb977621 upstream.
There was a recent change in blktrace.c that added a RCU protection to q->blk_trace in order to fix a use-after-free issue during access.
However the change missed an edge case that can lead to dereferencing of bt pointer even when it's NULL:
Coverity static analyzer marked this as a FORWARD_NULL issue with CID 1460458.
```
/kernel/trace/blktrace.c: 1904 in sysfs_blk_trace_attr_store()
1898 ret = 0;
1899 if (bt == NULL)
1900 ret = blk_trace_setup_queue(q, bdev);
1901
1902 if (ret == 0) {
1903 if (attr == &dev_attr_act_mask)
>>> CID 1460458: Null pointer dereferences (FORWARD_NULL)
>>> Dereferencing null pointer "bt".
1904 bt->act_mask = value;
1905 else if (attr == &dev_attr_pid)
1906 bt->pid = value;
1907 else if (attr == &dev_attr_start_lba)
1908 bt->start_lba = value;
1909 else if (attr == &dev_attr_end_lba)
```Added a reassignment with RCU annotation to fix the issue.
--- kernel/trace/blktrace.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/trace/blktrace.c +4 -1
@@ -1911,8 +1911,11 @@ static ssize_t sysfs_blk_trace_attr_stor } ret =0 ; -if (bt ==NULL ) +if (bt ==NULL ) { ret =blk_trace_setup_queue (q, bdev); + bt =rcu_dereference_protected (q->blk_trace, +lockdep_is_held (&q->blk_trace_mutex)); + }if (ret ==0 ) {if (attr == &dev_attr_act_mask)
Greg Kroah-Hartman
maintainerPATCH 43/114 f2fs: introduce read_inline_xattr
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit a5f433f7410530ae6bb907ebc049547d9dce665b upstream.
Commit ba38c27eb93e ("f2fs: enhance lookup xattr") introduces lookup_all_xattrs duplicating from read_all_xattrs, which leaves lots of similar codes in between them, so introduce new help read_inline_xattr to clean up redundant codes.
--- fs/f2fs/xattr.c | 59 +++++++++++++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 30 deletions(-)
fs/f2fs/xattr.c +29 -30
@@ -241,6 +241,29 @@ static struct f2fs_xattr_entry *__find_ireturn entry; } +static int read_inline_xattr (struct inode *inode,struct page *ipage, +void *txattr_addr) +{ +struct f2fs_sb_info *sbi =F2FS_I_SB (inode); +unsigned int inline_size =inline_xattr_size (inode); +struct page *page =NULL ; +void *inline_addr; + +if (ipage) { + inline_addr =inline_xattr_addr (ipage); + }else { + page =get_node_page (sbi, inode->i_ino); +if (IS_ERR (page)) +return PTR_ERR (page); + + inline_addr =inline_xattr_addr (page); + } +memcpy (txattr_addr, inline_addr, inline_size); +f2fs_put_page (page,1 ); + +return 0 ; +} + static int lookup_all_xattrs(struct inode *inode, struct page *ipage, unsigned int index, unsigned int len, const char *name, struct f2fs_xattr_entry **xe,
@@ -263,21 +286,9 @@ static int lookup_all_xattrs(struct inod/* read from inline xattr */ if (inline_size) { -struct page *page =NULL ; -void *inline_addr; - -if (ipage) { - inline_addr =inline_xattr_addr (ipage); - }else { - page =get_node_page (sbi, inode->i_ino); -if (IS_ERR (page)) { - err =PTR_ERR (page); - goto out; - } - inline_addr =inline_xattr_addr (page); - } -memcpy (txattr_addr, inline_addr, inline_size); -f2fs_put_page (page,1 ); + err =read_inline_xattr (inode, ipage, txattr_addr); +if (err) + goto out; *xe =__find_inline_xattr (txattr_addr, &last_addr, index, len, name);
@@ -339,21 +350,9 @@ static int read_all_xattrs(struct inode/* read from inline xattr */ if (inline_size) { -struct page *page =NULL ; -void *inline_addr; - -if (ipage) { - inline_addr =inline_xattr_addr (ipage); - }else { - page =get_node_page (sbi, inode->i_ino); -if (IS_ERR (page)) { - err =PTR_ERR (page); - goto fail; - } - inline_addr =inline_xattr_addr (page); - } -memcpy (txattr_addr, inline_addr, inline_size); -f2fs_put_page (page,1 ); + err =read_inline_xattr (inode, ipage, txattr_addr); +if (err) + goto fail; }/* read from xattr node block */
Greg Kroah-Hartman
maintainerPATCH 44/114 f2fs: introduce read_xattr_block
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
commit 63840695f68c20735df8861062343cf1faa3768d upstream.
Commit ba38c27eb93e ("f2fs: enhance lookup xattr") introduces lookup_all_xattrs duplicating from read_all_xattrs, which leaves lots of similar codes in between them, so introduce new help read_xattr_block to clean up redundant codes.
--- fs/f2fs/xattr.c | 50 ++++++++++++++++++++++++-------------------------- 1 file changed, 24 insertions(+), 26 deletions(-)
fs/f2fs/xattr.c +24 -26
@@ -264,12 +264,31 @@ static int read_inline_xattr(struct inodreturn 0 ; } +static int read_xattr_block (struct inode *inode,void *txattr_addr) +{ +struct f2fs_sb_info *sbi =F2FS_I_SB (inode); +nid_t xnid =F2FS_I (inode)->i_xattr_nid; +unsigned int inline_size =inline_xattr_size (inode); +struct page *xpage; +void *xattr_addr; + +/* The inode already has an extended attribute block. */ + xpage =get_node_page (sbi, xnid); +if (IS_ERR (xpage)) +return PTR_ERR (xpage); + + xattr_addr =page_address (xpage); +memcpy (txattr_addr + inline_size, xattr_addr,VALID_XATTR_BLOCK_SIZE ); +f2fs_put_page (xpage,1 ); + +return 0 ; +} +static int lookup_all_xattrs (struct inode *inode,struct page *ipage,unsigned int index,unsigned int len,const char *name,struct f2fs_xattr_entry **xe,void **base_addr) { -struct f2fs_sb_info *sbi =F2FS_I_SB (inode);void *cur_addr, *txattr_addr, *last_addr =NULL ;nid_t xnid =F2FS_I (inode)->i_xattr_nid;unsigned int size = xnid ?VALID_XATTR_BLOCK_SIZE :0 ;
@@ -298,19 +317,9 @@ static int lookup_all_xattrs(struct inod/* read from xattr node block */ if (xnid) { -struct page *xpage; -void *xattr_addr; - -/* The inode already has an extended attribute block. */ - xpage =get_node_page (sbi, xnid); -if (IS_ERR (xpage)) { - err =PTR_ERR (xpage); + err =read_xattr_block (inode, txattr_addr); +if (err) goto out; - } - - xattr_addr =page_address (xpage); -memcpy (txattr_addr + inline_size, xattr_addr, size); -f2fs_put_page (xpage,1 ); }if (last_addr)
@@ -335,7 +344,6 @@ out:static int read_all_xattrs (struct inode *inode,struct page *ipage,void **base_addr) { -struct f2fs_sb_info *sbi =F2FS_I_SB (inode);struct f2fs_xattr_header *header;nid_t xnid =F2FS_I (inode)->i_xattr_nid;unsigned int size =VALID_XATTR_BLOCK_SIZE ;
@@ -357,19 +365,9 @@ static int read_all_xattrs(struct inode/* read from xattr node block */ if (xnid) { -struct page *xpage; -void *xattr_addr; - -/* The inode already has an extended attribute block. */ - xpage =get_node_page (sbi, xnid); -if (IS_ERR (xpage)) { - err =PTR_ERR (xpage); + err =read_xattr_block (inode, txattr_addr); +if (err) goto fail; - } - - xattr_addr =page_address (xpage); -memcpy (txattr_addr + inline_size, xattr_addr, size); -f2fs_put_page (xpage,1 ); } header =XATTR_HDR (txattr_addr);
Greg Kroah-Hartman
maintainerPATCH 45/114 f2fs: sanity check of xattr entry size
In reply to Greg Kroah-HartmanFrom: Jaegeuk Kim <[email protected]>
commit 64beba0558fce7b59e9a8a7afd77290e82a22163 upstream.
There is a security report where f2fs_getxattr() has a hole to expose wrong memory region when the image is malformed like this.
f2fs_getxattr: entry->e_name_len: 4, size: 12288, buffer_size: 16384, len: 4
--- fs/f2fs/xattr.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-)
fs/f2fs/xattr.c +13 -5
@@ -287,7 +287,7 @@ static int read_xattr_block(struct inodestatic int lookup_all_xattrs (struct inode *inode,struct page *ipage,unsigned int index,unsigned int len,const char *name,struct f2fs_xattr_entry **xe, -void **base_addr) +void **base_addr,int *base_size) {void *cur_addr, *txattr_addr, *last_addr =NULL ;nid_t xnid =F2FS_I (inode)->i_xattr_nid;
@@ -298,8 +298,8 @@ static int lookup_all_xattrs(struct inodif (!size && !inline_size)return -ENODATA ; - txattr_addr =kzalloc (inline_size + size +XATTR_PADDING_SIZE , -GFP_F2FS_ZERO ); + *base_size = inline_size + size +XATTR_PADDING_SIZE ; + txattr_addr =kzalloc (*base_size,GFP_F2FS_ZERO );if (!txattr_addr)return -ENOMEM ;
@@ -311,8 +311,10 @@ static int lookup_all_xattrs(struct inod *xe =__find_inline_xattr (txattr_addr, &last_addr, index, len, name); -if (*xe) +if (*xe) { + *base_size = inline_size; goto check; + } }/* read from xattr node block */
@@ -462,6 +464,7 @@ int f2fs_getxattr(struct inode *inode, iint error =0 ;unsigned int size, len;void *base_addr =NULL ; +int base_size;if (name ==NULL )return -EINVAL ;
@@ -472,7 +475,7 @@ int f2fs_getxattr(struct inode *inode, idown_read (&F2FS_I (inode)->i_xattr_sem); error =lookup_all_xattrs (inode, ipage, index, len, name, - &entry, &base_addr); + &entry, &base_addr, &base_size);up_read (&F2FS_I (inode)->i_xattr_sem);if (error)return error;
@@ -486,6 +489,11 @@ int f2fs_getxattr(struct inode *inode, iif (buffer) {char *pval = entry->e_name + entry->e_name_len; + +if (base_size - (pval - (char *)base_addr) < size) { + error = -ERANGE ; + goto out; + }memcpy (buffer, pval, size); } error = size;
Greg Kroah-Hartman
maintainerPATCH 46/114 f2fs: fix to avoid accessing xattr across the boundary
In reply to Greg Kroah-HartmanFrom: Randall Huang <[email protected]>
commit 2777e654371dd4207a3a7f4fb5fa39550053a080 upstream.
When we traverse xattr entries via __find_xattr(),
if the raw filesystem content is faked or any hardware failure occurs, out-of-bound error can be detected by KASAN.
Fix the issue by introducing boundary check.
[ 38.402878] c7 1827 BUG: KASAN: slab-out-of-bounds in f2fs_getxattr+0x518/0x68c [ 38.402891] c7 1827 Read of size 4 at addr ffffffc0b6fb35dc by task [ 38.402935] c7 1827 Call trace: [ 38.402952] c7 1827 [<ffffff900809003c>] dump_backtrace+0x0/0x6bc [ 38.402966] c7 1827 [<ffffff9008090030>] show_stack+0x20/0x2c [ 38.402981] c7 1827 [<ffffff900871ab10>] dump_stack+0xfc/0x140 [ 38.402995] c7 1827 [<ffffff9008325c40>] print_address_description+0x80/0x2d8 [ 38.403009] c7 1827 [<ffffff900832629c>] kasan_report_error+0x198/0x1fc [ 38.403022] c7 1827 [<ffffff9008326104>] kasan_report_error+0x0/0x1fc [ 38.403037] c7 1827 [<ffffff9008325000>] __asan_load4+0x1b0/0x1b8 [ 38.403051] c7 1827 [<ffffff90085fcc44>] f2fs_getxattr+0x518/0x68c [ 38.403066] c7 1827 [<ffffff90085fc508>] f2fs_xattr_generic_get+0xb0/0xd0 [ 38.403080] c7 1827 [<ffffff9008395708>] __vfs_getxattr+0x1f4/0x1fc [ 38.403096] c7 1827 [<ffffff9008621bd0>] inode_doinit_with_dentry+0x360/0x938 [ 38.403109] c7 1827 [<ffffff900862d6cc>] selinux_d_instantiate+0x2c/0x38 [ 38.403123] c7 1827 [<ffffff900861b018>] security_d_instantiate+0x68/0x98 [ 38.403136] c7 1827 [<ffffff9008377db8>] d_splice_alias+0x58/0x348 [ 38.403149] c7 1827 [<ffffff900858d16c>] f2fs_lookup+0x608/0x774 [ 38.403163] c7 1827 [<ffffff900835eacc>] lookup_slow+0x1e0/0x2cc [ 38.403177] c7 1827 [<ffffff9008367fe0>] walk_component+0x160/0x520 [ 38.403190] c7 1827 [<ffffff9008369ef4>] path_lookupat+0x110/0x2b4 [ 38.403203] c7 1827 [<ffffff900835dd38>] filename_lookup+0x1d8/0x3a8 [ 38.403216] c7 1827 [<ffffff900835eeb0>] user_path_at_empty+0x54/0x68 [ 38.403229] c7 1827 [<ffffff9008395f44>] SyS_getxattr+0xb4/0x18c [ 38.403241] c7 1827 [<ffffff9008084200>] el0_svc_naked+0x34/0x38
--- fs/f2fs/xattr.c | 36 +++++++++++++++++++++++++++--------- fs/f2fs/xattr.h | 2 ++ 2 files changed, 29 insertions(+), 9 deletions(-)
fs/f2fs/xattr.c +27 -9
@@ -201,12 +201,17 @@ static inline const struct xattr_handlerreturn handler; } -static struct f2fs_xattr_entry *__find_xattr (void *base_addr,int index, -size_t len,const char *name) +static struct f2fs_xattr_entry *__find_xattr (void *base_addr, +void *last_base_addr,int index, +size_t len,const char *name) {struct f2fs_xattr_entry *entry;list_for_each_xattr (entry, base_addr) { +if ((void *)(entry) +sizeof (__u32) > last_base_addr || + (void *)XATTR_NEXT_ENTRY (entry) > last_base_addr) +return NULL ; +if (entry->e_name_index != index)continue ;if (entry->e_name_len != len)
@@ -289,20 +294,22 @@ static int lookup_all_xattrs(struct inod const char *name, struct f2fs_xattr_entry **xe, void **base_addr, int *base_size) { - void *cur_addr, *txattr_addr, *last_addr = NULL; + void *cur_addr, *txattr_addr, *last_txattr_addr; +void *last_addr =NULL ;nid_t xnid =F2FS_I (inode)->i_xattr_nid; -unsigned int size = xnid ?VALID_XATTR_BLOCK_SIZE :0 ;unsigned int inline_size =inline_xattr_size (inode);int err =0 ; -if (!size && !inline_size) +if (!xnid && !inline_size)return -ENODATA ; - *base_size = inline_size + size +XATTR_PADDING_SIZE ; + *base_size =XATTR_SIZE (xnid, inode) +XATTR_PADDING_SIZE ; txattr_addr =kzalloc (*base_size,GFP_F2FS_ZERO );if (!txattr_addr)return -ENOMEM ; + last_txattr_addr = (void *)txattr_addr +XATTR_SIZE (xnid, inode); +/* read from inline xattr */ if (inline_size) { err =read_inline_xattr (inode, ipage, txattr_addr);
@@ -329,7 +336,11 @@ static int lookup_all_xattrs(struct inodelse cur_addr = txattr_addr; - *xe =__find_xattr (cur_addr, index, len, name); + *xe =__find_xattr (cur_addr, last_txattr_addr, index, len, name); +if (!*xe) { + err = -EFAULT ; + goto out; + } check:if (IS_XATTR_LAST_ENTRY (*xe)) { err = -ENODATA ;
@@ -562,7 +573,8 @@ static int __f2fs_setxattr(struct inode struct page *ipage, int flags) {struct f2fs_xattr_entry *here, *last; -void *base_addr; +void *base_addr, *last_base_addr; +nid_t xnid =F2FS_I (inode)->i_xattr_nid;int found, newsize;size_t len;__u32 new_hsize;
@@ -586,8 +598,14 @@ static int __f2fs_setxattr(struct inodeif (error)return error; + last_base_addr = (void *)base_addr +XATTR_SIZE (xnid, inode); +/* find entry with wanted name. */ - here =__find_xattr (base_addr, index, len, name); + here =__find_xattr (base_addr, last_base_addr, index, len, name); +if (!here) { + error = -EFAULT ; + goto exit; + } found =IS_XATTR_LAST_ENTRY (here) ?0 :1 ;
fs/f2fs/xattr.h +2 -0
@@ -74,6 +74,8 @@ struct f2fs_xattr_entry { entry = XATTR_NEXT_ENTRY(entry))#define VALID_XATTR_BLOCK_SIZE (PAGE_SIZE - sizeof(struct node_footer))#define XATTR_PADDING_SIZE (sizeof(__u32)) +#define XATTR_SIZE (x,i) (((x) ? VALID_XATTR_BLOCK_SIZE : 0) + \ + (inline_xattr_size(i)))#define MIN_OFFSET (i) XATTR_ALIGN(inline_xattr_size(i) + \ VALID_XATTR_BLOCK_SIZE)
Greg Kroah-Hartman
maintainerPATCH 47/114 f2fs: fix to avoid memory leakage in f2fs_listxattr
In reply to Greg Kroah-HartmanFrom: Randall Huang <[email protected]>
commit 688078e7f36c293dae25b338ddc9e0a2790f6e06 upstream.
In f2fs_listxattr, there is no boundary check before memcpy e_name to buffer.
If the e_name_len is corrupted,
unexpected memory contents may be returned to the buffer.
--- fs/f2fs/xattr.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
fs/f2fs/xattr.c +14 -1
@@ -516,8 +516,9 @@ out:ssize_t f2fs_listxattr (struct dentry *dentry,char *buffer,size_t buffer_size) {struct inode *inode =d_inode (dentry); +nid_t xnid =F2FS_I (inode)->i_xattr_nid;struct f2fs_xattr_entry *entry; -void *base_addr; +void *base_addr, *last_base_addr;int error =0 ;size_t rest = buffer_size;
@@ -527,6 +528,8 @@ ssize_t f2fs_listxattr(struct dentry *deif (error)return error; + last_base_addr = (void *)base_addr +XATTR_SIZE (xnid, inode); +list_for_each_xattr (entry, base_addr) {const struct xattr_handler *handler =f2fs_xattr_handler (entry->e_name_index);
@@ -534,6 +537,16 @@ ssize_t f2fs_listxattr(struct dentry *desize_t prefix_len;size_t size; +if ((void *)(entry) +sizeof (__u32) > last_base_addr || + (void *)XATTR_NEXT_ENTRY (entry) > last_base_addr) { +f2fs_msg (dentry->d_sb,KERN_ERR , +"inode (%lu) has corrupted xattr" , + inode->i_ino); +set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_FSCK ); + error = -EFSCORRUPTED ; + goto cleanup; + } +if (!handler || (handler->list && !handler->list (dentry)))continue ;
Greg Kroah-Hartman
maintainerPATCH 48/114 net: stmmac: Use mutex instead of spinlock
In reply to Greg Kroah-HartmanFrom: Thierry Reding <[email protected]>
commit 29555fa3de865630570b5f53c847b953413daf1a upstream.
Some drivers, such as DWC EQOS on Tegra, need to perform operations that can sleep under this lock (clk_set_rate() in tegra_eqos_fix_speed()) for proper operation. Since there is no need for this lock to be a spinlock, convert it to a mutex instead.
--- drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 - drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 12 +++---- drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 31 ++++++++----------- 3 files changed, 21 insertions(+), 24 deletions(-)
drivers/net/ethernet/stmicro/stmmac/stmmac.h +1 -1
@@ -96,7 +96,7 @@ struct stmmac_priv {struct net_device *dev;struct device *device;struct mac_device_info *hw; -spinlock_t lock; +struct mutex lock;/* RX Queue */ struct stmmac_rx_queue rx_queue[MTL_MAX_RX_QUEUES ];
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c +6 -6
@@ -392,13 +392,13 @@ stmmac_ethtool_set_link_ksettings(struct ADVERTISED_10baseT_Half | ADVERTISED_10baseT_Full); -spin_lock (&priv->lock); +mutex_lock (&priv->lock);if (priv->hw->mac->pcs_ctrl_ane) priv->hw->mac->pcs_ctrl_ane (priv->ioaddr,1 , priv->hw->ps,0 ); -spin_unlock (&priv->lock); +mutex_unlock (&priv->lock);return 0 ; }
@@ -615,12 +615,12 @@ static void stmmac_get_wol(struct net_de {struct stmmac_priv *priv =netdev_priv (dev); -spin_lock_irq (&priv->lock); +mutex_lock (&priv->lock);if (device_can_wakeup (priv->device)) { wol->supported =WAKE_MAGIC |WAKE_UCAST ; wol->wolopts = priv->wolopts; } -spin_unlock_irq (&priv->lock); +mutex_unlock (&priv->lock); }static int stmmac_set_wol (struct net_device *dev,struct ethtool_wolinfo *wol)
@@ -649,9 +649,9 @@ static int stmmac_set_wol(struct net_devdisable_irq_wake (priv->wol_irq); } -spin_lock_irq (&priv->lock); +mutex_lock (&priv->lock); priv->wolopts = wol->wolopts; -spin_unlock_irq (&priv->lock); +mutex_unlock (&priv->lock);return 0 ; }
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +14 -17
@@ -365,7 +365,6 @@ bool stmmac_eee_init(struct stmmac_priv {struct net_device *ndev = priv->dev;int interface = priv->plat->interface; -unsigned long flags;bool ret = false; if ((interface != PHY_INTERFACE_MODE_MII) &&
@@ -392,7 +391,7 @@ bool stmmac_eee_init(struct stmmac_priv* changed). * In that case the driver disable own timers. */ -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock);if (priv->eee_active) {netdev_dbg (priv->dev,"disable EEE\n" );del_timer_sync (&priv->eee_ctrl_timer);
@@ -400,11 +399,11 @@ bool stmmac_eee_init(struct stmmac_priv tx_lpi_timer); } priv->eee_active =0 ; -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock); goto out; }/* Activate the EEE and start timers */ -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock);if (!priv->eee_active) { priv->eee_active =1 ; setup_timer(&priv->eee_ctrl_timer,
@@ -421,7 +420,7 @@ bool stmmac_eee_init(struct stmmac_priv priv->hw->mac->set_eee_pls (priv->hw, ndev->phydev->link); ret = true; -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock);netdev_dbg (priv->dev,"Energy-Efficient Ethernet initialized\n" ); }
@@ -799,13 +798,12 @@ static void stmmac_adjust_link(struct ne {struct stmmac_priv *priv =netdev_priv (dev);struct phy_device *phydev = dev->phydev; -unsigned long flags;bool new_state = false;if (!phydev)return ; -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock);if (phydev->link) {u32 ctrl =readl (priv->ioaddr +MAC_CTRL_REG );
@@ -864,7 +862,7 @@ static void stmmac_adjust_link(struct neif (new_state &&netif_msg_link (priv))phy_print_status (phydev); -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock);if (phydev->is_pseudo_fixed_link)/* Stop PHY layer to call the hook to adjust the link in case
@@ -4284,7 +4282,7 @@ int stmmac_dvr_probe(struct device *devi (8 * priv->plat->rx_queues_to_use)); } -spin_lock_init (&priv->lock); +mutex_init (&priv->lock);/* If a specific clk_csr value is passed from the platform * this means that the CSR Clock Range selection cannot be
@@ -4375,6 +4373,7 @@ int stmmac_dvr_remove(struct device *dev priv->hw->pcs != STMMAC_PCS_TBI && priv->hw->pcs != STMMAC_PCS_RTBI)stmmac_mdio_unregister (ndev); +mutex_destroy (&priv->lock);free_netdev (ndev);return 0 ;
@@ -4392,7 +4391,6 @@ int stmmac_suspend(struct device *dev) {struct net_device *ndev =dev_get_drvdata (dev);struct stmmac_priv *priv =netdev_priv (ndev); -unsigned long flags;if (!ndev || !netif_running (ndev))return 0 ;
@@ -4400,7 +4398,7 @@ int stmmac_suspend(struct device *dev)if (ndev->phydev)phy_stop (ndev->phydev); -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock);netif_device_detach (ndev);stmmac_stop_all_queues (priv);
@@ -4423,7 +4421,7 @@ int stmmac_suspend(struct device *dev)clk_disable_unprepare (priv->plat->pclk);clk_disable_unprepare (priv->plat->stmmac_clk); } -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock); priv->oldlink = false; priv->speed =SPEED_UNKNOWN ;
@@ -4467,7 +4465,6 @@ int stmmac_resume(struct device *dev) {struct net_device *ndev =dev_get_drvdata (dev);struct stmmac_priv *priv =netdev_priv (ndev); -unsigned long flags;if (!netif_running (ndev))return 0 ;
@@ -4479,9 +4476,9 @@ int stmmac_resume(struct device *dev)* from another devices (e.g. serial console). */ if (device_may_wakeup (priv->device)) { -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock); priv->hw->mac->pmt (priv->hw,0 ); -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock); priv->irq_wake =0 ; }else {pinctrl_pm_select_default_state (priv->device);
@@ -4497,7 +4494,7 @@ int stmmac_resume(struct device *dev)netif_device_attach (ndev); -spin_lock_irqsave (&priv->lock, flags); +mutex_lock (&priv->lock);stmmac_reset_queues_param (priv);
@@ -4516,7 +4513,7 @@ int stmmac_resume(struct device *dev)stmmac_start_all_queues (priv); -spin_unlock_irqrestore (&priv->lock, flags); +mutex_unlock (&priv->lock);if (ndev->phydev)phy_start (ndev->phydev);
Greg Kroah-Hartman
maintainerPATCH 49/114 shmem: fix possible deadlocks on shmlock_user_lock
In reply to Greg Kroah-HartmanFrom: Hugh Dickins <[email protected]>
[ Upstream commit ea0dfeb4209b4eab954d6e00ed136bc6b48b380d ]
Recent commit 71725ed10c40 ("mm: huge tmpfs: try to split_huge_page() when punching hole") has allowed syzkaller to probe deeper, uncovering a long-standing lockdep issue between the irq-unsafe shmlock_user_lock, the irq-safe xa_lock on mapping->i_pages, and shmem inode's info->lock which nests inside xa_lock (or tree_lock) since 4.8's shmem_uncharge().
user_shm_lock(), servicing SysV shmctl(SHM_LOCK), wants shmlock_user_lock while its caller shmem_lock() holds info->lock with interrupts disabled; but hugetlbfs_file_setup() calls user_shm_lock() with interrupts enabled, and might be interrupted by a writeback endio wanting xa_lock on i_pages.
This may not risk an actual deadlock, since shmem inodes do not take part in writeback accounting, but there are several easy ways to avoid it.
Requiring interrupts disabled for shmlock_user_lock would be easy, but it's a high-level global lock for which that seems inappropriate. Instead, recall that the use of info->lock to guard info->flags in shmem_lock() dates from pre-3.1 days, when races with SHMEM_PAGEIN and SHMEM_TRUNCATE could occur: nowadays it serves no purpose, the only flag added or removed is VM_LOCKED itself, and calls to shmem_lock() an inode are already serialized by the caller.
Take info->lock out of the chain and the possibility of deadlock or lockdep warning goes away.
--- mm/shmem.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
mm/shmem.c +5 -2
@@ -2129,7 +2129,11 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user)struct shmem_inode_info *info =SHMEM_I (inode);int retval = -ENOMEM ; -spin_lock_irq (&info->lock); +/* +* What serializes the accesses to info->flags? +* ipc_lock_object() when called from shmctl_do_lock(), +* no serialization needed when called from shm_destroy(). +*/ if (lock && !(info->flags &VM_LOCKED )) {if (!user_shm_lock (inode->i_size, user)) goto out_nomem;
@@ -2144,7 +2148,6 @@ int shmem_lock(struct file *file, int lock, struct user_struct *user) retval =0 ; out_nomem: -spin_unlock_irq (&info->lock);return retval; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 50/114 net/sonic: Fix a resource leak in an error handling path in jazz_sonic_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 10e3cc180e64385edc9890c6855acf5ed9ca1339 ]
A call to 'dma_alloc_coherent()' is hidden in 'sonic_alloc_descriptors()', called from 'sonic_probe1()'.
This is correctly freed in the remove function, but not in the error handling path of the probe function.
Fix it and add the missing 'dma_free_coherent()' call.
While at it, rename a label in order to be slightly more informative.
--- drivers/net/ethernet/natsemi/jazzsonic.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/natsemi/jazzsonic.c +4 -2
@@ -247,13 +247,15 @@ static int jazz_sonic_probe(struct platform_device *pdev) goto out; err =register_netdev (dev);if (err) - goto out1; + goto undo_probe1;printk ("%s: MAC %pM IRQ %d\n" , dev->name, dev->dev_addr, dev->irq);return 0 ; -out1: +undo_probe1: +dma_free_coherent (lp->device,SIZEOF_SONIC_DESC *SONIC_BUS_SCALE (lp->dma_bitmode), + lp->descriptors, lp->descriptors_laddr);release_mem_region (dev->base_addr,SONIC_MEM_SIZE ); out:free_netdev (dev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 51/114 net: moxa: Fix a potential double free_irq()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit ee8d2267f0e39a1bfd95532da3a6405004114b27 ]
Should an irq requested with 'devm_request_irq' be released explicitly, it should be done by 'devm_free_irq()', not 'free_irq()'.
--- drivers/net/ethernet/moxa/moxart_ether.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/moxa/moxart_ether.c +1 -1
@@ -561,7 +561,7 @@ static int moxart_remove(struct platform_device *pdev)struct net_device *ndev =platform_get_drvdata (pdev);unregister_netdev (ndev); -free_irq (ndev->irq, ndev); +devm_free_irq (&pdev->dev, ndev->irq, ndev);moxart_mac_free_memory (ndev);free_netdev (ndev);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 52/114 drop_monitor: work around gcc-10 stringop-overflow warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit dc30b4059f6e2abf3712ab537c8718562b21c45d ]
The current gcc-10 snapshot produces a false-positive warning:
net/core/drop_monitor.c: In function 'trace_drop_common.constprop':
cc1: error: writing 8 bytes into a region of size 0 [-Werror=stringop-overflow=]
In file included from net/core/drop_monitor.c:23:include/uapi/linux/net_dropmon.h:36:8: note: at offset 0 to object 'entries' with size 4 declared here
36 | __u32 entries;
| ^~~~~~~I reported this in the gcc bugzilla, but in case it does not get fixed in the release, work around it by using a temporary variable.
--- net/core/drop_monitor.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
net/core/drop_monitor.c +7 -4
@@ -154,6 +154,7 @@ static void sched_send_work(unsigned long _data)static void trace_drop_common (struct sk_buff *skb,void *location) {struct net_dm_alert_msg *msg; +struct net_dm_drop_point *point;struct nlmsghdr *nlh;struct nlattr *nla;int i;
@@ -172,11 +173,13 @@ static void trace_drop_common(struct sk_buff *skb, void *location) nlh = (struct nlmsghdr *)dskb->data; nla =genlmsg_data (nlmsg_data (nlh)); msg =nla_data (nla); + point = msg->points;for (i =0 ; i < msg->entries; i++) { -if (!memcmp (&location, msg->points[i].pc,sizeof (void *))) { - msg->points[i].count++; +if (!memcmp (&location, &point->pc,sizeof (void *))) { + point->count++; goto out; } + point++; }if (msg->entries == dm_hit_limit) goto out;
@@ -185,8 +188,8 @@ static void trace_drop_common(struct sk_buff *skb, void *location)*/ __nla_reserve_nohdr (dskb,sizeof (struct net_dm_drop_point )); nla->nla_len +=NLA_ALIGN (sizeof (struct net_dm_drop_point )); -memcpy (msg->points[msg->entries].pc, &location,sizeof (void *)); - msg->points[msg->entries].count =1 ; +memcpy (point->pc, &location,sizeof (void *)); + point->count =1 ; msg->entries++;if (!timer_pending (&data->send_timer)) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 53/114 virtio-blk: handle block_device_operations callbacks after hot unplug
In reply to Greg Kroah-HartmanFrom: Stefan Hajnoczi <[email protected]>
[ Upstream commit 90b5feb8c4bebc76c27fcaf3e1a0e5ca2d319e9e ]
A userspace process holding a file descriptor to a virtio_blk device can still invoke block_device_operations after hot unplug. This leads to a use-after-free accessing vblk->vdev in virtblk_getgeo() when ioctl(HDIO_GETGEO) is invoked:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000090 IP: [<ffffffffc00e5450>] virtio_check_driver_offered_feature+0x10/0x90 [virtio] PGD 800000003a92f067 PUD 3a930067 PMD 0 Oops: 0000 [#1] SMP CPU: 0 PID: 1310 Comm: hdio-getgeo Tainted: G OE ------------ 3.10.0-1062.el7.x86_64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 task: ffff9be5fbfb8000 ti: ffff9be5fa890000 task.ti: ffff9be5fa890000 RIP: 0010:[<ffffffffc00e5450>] [<ffffffffc00e5450>] virtio_check_driver_offered_feature+0x10/0x90 [virtio] RSP: 0018:ffff9be5fa893dc8 EFLAGS: 00010246 RAX: ffff9be5fc3f3400 RBX: ffff9be5fa893e30 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffff9be5fbc10b40 RBP: ffff9be5fa893dc8 R08: 0000000000000301 R09: 0000000000000301 R10: 0000000000000000 R11: 0000000000000000 R12: ffff9be5fdc24680 R13: ffff9be5fbc10b40 R14: ffff9be5fbc10480 R15: 0000000000000000 FS: 00007f1bfb968740(0000) GS:ffff9be5ffc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000090 CR3: 000000003a894000 CR4: 0000000000360ff0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffffc016ac37>] virtblk_getgeo+0x47/0x110 [virtio_blk] [<ffffffff8d3f200d>] ? handle_mm_fault+0x39d/0x9b0 [<ffffffff8d561265>] blkdev_ioctl+0x1f5/0xa20 [<ffffffff8d488771>] block_ioctl+0x41/0x50 [<ffffffff8d45d9e0>] do_vfs_ioctl+0x3a0/0x5a0 [<ffffffff8d45dc81>] SyS_ioctl+0xa1/0xc0
A related problem is that virtblk_remove() leaks the vd_index_ida index when something still holds a reference to vblk->disk during hot unplug. This causes virtio-blk device names to be lost (vda, vdb, etc).
Fix these issues by protecting vblk->vdev with a mutex and reference counting vblk so the vd_index_ida index can be removed in all cases.
--- drivers/block/virtio_blk.c | 86 ++++++++++++++++++++++++++++++++++---- 1 file changed, 78 insertions(+), 8 deletions(-)
drivers/block/virtio_blk.c +78 -8
@@ -31,6 +31,15 @@ struct virtio_blk_vq { }____cacheline_aligned_in_smp ;struct virtio_blk { +/* +* This mutex must be held by anything that may run after +* virtblk_remove() sets vblk->vdev to NULL. +* +* blk-mq, virtqueue processing, and sysfs attribute code paths are +* shut down before vblk->vdev is set to NULL and therefore do not need +* to hold this mutex. +*/ +struct mutex vdev_mutex;struct virtio_device *vdev;/* The disk structure for the kernel. */
@@ -42,6 +51,13 @@ struct virtio_blk {/* Process context for config space updates */ struct work_struct config_work; +/* +* Tracks references from block_device_operations open/release and +* virtio_driver probe/remove so this object can be freed once no +* longer in use. +*/ +refcount_t refs; +/* What host tells us, plus 2 for header & tailer. */ unsigned int sg_elems;
@@ -315,10 +331,55 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)return err; } +static void virtblk_get (struct virtio_blk *vblk) +{ +refcount_inc (&vblk->refs); +} + +static void virtblk_put (struct virtio_blk *vblk) +{ +if (refcount_dec_and_test (&vblk->refs)) { +ida_simple_remove (&vd_index_ida, vblk->index); +mutex_destroy (&vblk->vdev_mutex); +kfree (vblk); + } +} + +static int virtblk_open (struct block_device *bd,fmode_t mode) +{ +struct virtio_blk *vblk = bd->bd_disk->private_data; +int ret =0 ; + +mutex_lock (&vblk->vdev_mutex); + +if (vblk->vdev) +virtblk_get (vblk); +else + ret = -ENXIO ; + +mutex_unlock (&vblk->vdev_mutex); +return ret; +} + +static void virtblk_release (struct gendisk *disk,fmode_t mode) +{ +struct virtio_blk *vblk = disk->private_data; + +virtblk_put (vblk); +} +/* We provide getgeo only to please some old bootloader/partitioning tools */ static int virtblk_getgeo (struct block_device *bd,struct hd_geometry *geo) {struct virtio_blk *vblk = bd->bd_disk->private_data; +int ret =0 ; + +mutex_lock (&vblk->vdev_mutex); + +if (!vblk->vdev) { + ret = -ENXIO ; + goto out; + }/* see if the host passed in geometry config */ if (virtio_has_feature (vblk->vdev,VIRTIO_BLK_F_GEOMETRY )) {
@@ -334,12 +395,16 @@ static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo) geo->sectors =1 <<5 ; geo->cylinders =get_capacity (bd->bd_disk) >>11 ; } -return 0 ; +out: +mutex_unlock (&vblk->vdev_mutex); +return ret; }static const struct block_device_operations virtblk_fops = { .ioctl = virtblk_ioctl, .owner =THIS_MODULE , + .open = virtblk_open, + .release = virtblk_release, .getgeo = virtblk_getgeo, };
@@ -659,6 +724,10 @@ static int virtblk_probe(struct virtio_device *vdev) goto out_free_index; } +/* This reference is dropped in virtblk_remove(). */ +refcount_set (&vblk->refs,1 ); +mutex_init (&vblk->vdev_mutex); + vblk->vdev = vdev; vblk->sg_elems = sg_elems;
@@ -821,8 +890,6 @@ static int virtblk_probe(struct virtio_device *vdev)static void virtblk_remove (struct virtio_device *vdev) {struct virtio_blk *vblk = vdev->priv; -int index = vblk->index; -int refc;/* Make sure no work handler is accessing the device. */ flush_work (&vblk->config_work);
@@ -832,18 +899,21 @@ static void virtblk_remove(struct virtio_device *vdev)blk_mq_free_tag_set (&vblk->tag_set); +mutex_lock (&vblk->vdev_mutex); +/* Stop all the virtqueues. */ vdev->config->reset (vdev); - refc =kref_read (&disk_to_dev (vblk->disk)->kobj.kref); +/* Virtqueues are stopped, nothing can use vblk->vdev anymore. */ + vblk->vdev =NULL ; +put_disk (vblk->disk); vdev->config->del_vqs (vdev);kfree (vblk->vqs); -kfree (vblk); -/* Only free device id if we don't have any users */ -if (refc ==1 ) -ida_simple_remove (&vd_index_ida, index); +mutex_unlock (&vblk->vdev_mutex); + +virtblk_put (vblk); }#ifdef CONFIG_PM_SLEEP
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 54/114 scsi: sg: add sg_remove_request in sg_write
In reply to Greg Kroah-HartmanFrom: Wu Bo <[email protected]>
commit 83c6f2390040f188cc25b270b4befeb5628c1aee upstream.
If the __copy_from_user function failed we need to call sg_remove_request in sg_write.
--- drivers/scsi/sg.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/scsi/sg.c +3 -1
@@ -695,8 +695,10 @@ sg_write(struct file *filp, const char _ hp->flags = input_size;/* structure abuse ... */ hp->pack_id = old_hdr.pack_id; hp->usr_ptr =NULL ; -if (__copy_from_user (cmnd, buf, cmd_size)) +if (__copy_from_user (cmnd, buf, cmd_size)) { +sg_remove_request (sfp, srp);return -EFAULT ; + }/* * SG_DXFER_TO_FROM_DEV is functionally equivalent to SG_DXFER_FROM_DEV, * but is is possible that the app intended SG_DXFER_TO_DEV, because there
Greg Kroah-Hartman
maintainerPATCH 55/114 dmaengine: pch_dma.c: Avoid data race between probe and irq handler
In reply to Greg Kroah-HartmanFrom: Madhuparna Bhowmik <[email protected]>
[ Upstream commit 2e45676a4d33af47259fa186ea039122ce263ba9 ]
pd->dma.dev is read in irq handler pd_irq().
However, it is set to pdev->dev after request_irq(). Therefore, set pd->dma.dev to pdev->dev before request_irq() to avoid data race between pch_dma_probe() and pd_irq().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/dma/pch_dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/dma/pch_dma.c +1 -1
@@ -873,6 +873,7 @@ static int pch_dma_probe(struct pci_dev *pdev, }pci_set_master (pdev); + pd->dma.dev = &pdev->dev; err =request_irq (pdev->irq, pd_irq,IRQF_SHARED ,DRV_NAME , pd);if (err) {
@@ -888,7 +889,6 @@ static int pch_dma_probe(struct pci_dev *pdev, goto err_free_irq; } - pd->dma.dev = &pdev->dev;INIT_LIST_HEAD (&pd->dma.channels);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 56/114 dmaengine: mmp_tdma: Reset channel error on release
In reply to Greg Kroah-HartmanFrom: Lubomir Rintel <[email protected]>
[ Upstream commit 0c89446379218698189a47871336cb30286a7197 ]
When a channel configuration fails, the status of the channel is set to DEV_ERROR so that an attempt to submit it fails. However, this status sticks until the heat end of the universe, making it impossible to recover from the error.
Let's reset it when the channel is released so that further use of the channel with correct configuration is not impacted.
--- drivers/dma/mmp_tdma.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/dma/mmp_tdma.c +2 -0
@@ -362,6 +362,8 @@ static void mmp_tdma_free_descriptor(struct mmp_tdma_chan *tdmac)gen_pool_free (gpool, (unsigned long )tdmac->desc_arr, size); tdmac->desc_arr =NULL ; +if (tdmac->status ==DMA_ERROR ) + tdmac->status =DMA_COMPLETE ;return ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 57/114 cpufreq: intel_pstate: Only mention the BIOS disabling turbo mode once
In reply to Greg Kroah-HartmanFrom: Chris Wilson <[email protected]>
[ Upstream commit 8c539776ac83c0857395e1ccc9c6b516521a2d32 ]
Make a note of the first time we discover the turbo mode has been disabled by the BIOS, as otherwise we complain every time we try to update the mode.
--- drivers/cpufreq/intel_pstate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/intel_pstate.c +1 -1
@@ -935,7 +935,7 @@ static ssize_t store_no_turbo(struct kobject *a, struct kobj_attribute *b,update_turbo_state ();if (global.turbo_disabled) { -pr_warn ("Turbo disabled by BIOS or unavailable on processor\n" ); +pr_notice_once ("Turbo disabled by BIOS or unavailable on processor\n" );mutex_unlock (&intel_pstate_limits_lock);mutex_unlock (&intel_pstate_driver_lock);return -EPERM ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 58/114 ALSA: hda/hdmi: fix race in monitor detection during probe
In reply to Greg Kroah-HartmanFrom: Kai Vehmanen <[email protected]>
[ Upstream commit ca76282b6faffc83601c25bd2a95f635c03503ef ]
A race exists between build_pcms() and build_controls() phases of codec setup. Build_pcms() sets up notifier for jack events. If a monitor event is received before build_controls() is run, the initial jack state is lost and never reported via mixer controls.
The problem can be hit at least with SOF as the controller driver. SOF calls snd_hda_codec_build_controls() in its workqueue-based probe and this can be delayed enough to hit the race condition.
Fix the issue by invalidating the per-pin ELD information when build_controls() is called. The existing call to hdmi_present_sense() will update the ELD contents. This ensures initial monitor state is correctly reflected via mixer controls.
--- sound/pci/hda/patch_hdmi.c | 2 ++ 1 file changed, 2 insertions(+)
sound/pci/hda/patch_hdmi.c +2 -0
@@ -2212,7 +2212,9 @@ static int generic_hdmi_build_controls(struct hda_codec *codec)for (pin_idx =0 ; pin_idx < spec->num_pins; pin_idx++) {struct hdmi_spec_per_pin *per_pin =get_pin (spec, pin_idx); +struct hdmi_eld *pin_eld = &per_pin->sink_eld; + pin_eld->eld_valid = false;hdmi_present_sense (per_pin,0 ); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 59/114 drm/qxl: lost qxl_bo_kunmap_atomic_page in qxl_image_init_helper()
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 5b5703dbafae74adfbe298a56a81694172caf5e6 ]
v2: removed TODO reminder
--- drivers/gpu/drm/qxl/qxl_image.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/qxl/qxl_image.c +2 -1
@@ -210,7 +210,8 @@ qxl_image_init_helper(struct qxl_device *qdev,break ;default :DRM_ERROR ("unsupported image bit depth\n" ); -return -EINVAL ;/* TODO: cleanup */ +qxl_bo_kunmap_atomic_page (qdev, image_bo, ptr); +return -EINVAL ; } image->u.bitmap.flags =QXL_BITMAP_TOP_DOWN ; image->u.bitmap.x = width;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 60/114 ipc/util.c: sysvipc_find_ipc() incorrectly updates position index
In reply to Greg Kroah-HartmanFrom: Vasily Averin <[email protected]>
[ Upstream commit 5e698222c70257d13ae0816720dde57c56f81e15 ]
Commit 89163f93c6f9 ("ipc/util.c: sysvipc_find_ipc() should increase position index") is causing this bug (seen on 5.6.8):
# ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages
# ipcmk -Q Message queue id: 0 # ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages 0x82db8127 0 root 644 0 0
# ipcmk -Q Message queue id: 1 # ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages 0x82db8127 0 root 644 0 0 0x76d1fb2a 1 root 644 0 0
# ipcrm -q 0 # ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages 0x76d1fb2a 1 root 644 0 0 0x76d1fb2a 1 root 644 0 0
# ipcmk -Q Message queue id: 2 # ipcrm -q 2 # ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages 0x76d1fb2a 1 root 644 0 0 0x76d1fb2a 1 root 644 0 0
# ipcmk -Q Message queue id: 3 # ipcrm -q 1 # ipcs -q
------ Message Queues --------
key msqid owner perms used-bytes messages 0x7c982867 3 root 644 0 0 0x7c982867 3 root 644 0 0 0x7c982867 3 root 644 0 0 0x7c982867 3 root 644 0 0
Whenever an IPC item with a low id is deleted, the items with higher ids are duplicated, as if filling a hole.
new_pos should jump through hole of unused ids, pos can be updated inside "for" cycle.
--- ipc/util.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
ipc/util.c +6 -6
@@ -750,21 +750,21 @@ static struct kern_ipc_perm *sysvipc_find_ipc(struct ipc_ids *ids, loff_t pos, total++; } - *new_pos = pos +1 ; + ipc =NULL ;if (total >= ids->in_use) -return NULL ; + goto out;for (; pos <IPCMNI ; pos++) { ipc =idr_find (&ids->ipcs_idr, pos);if (ipc !=NULL ) {rcu_read_lock ();ipc_lock_object (ipc); -return ipc; +break ; } } - -/* Out of range - return NULL to terminate iteration */ -return NULL ; +out: + *new_pos = pos +1 ; +return ipc; }static void *sysvipc_proc_next (struct seq_file *s,void *it,loff_t *pos)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 61/114 ALSA: hda/realtek - Fix S3 pop noise on Dell Wyse
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 52e4e36807aeac1cdd07b14e509c8a64101e1a09 ]
Commit 317d9313925c ("ALSA: hda/realtek - Set default power save node to 0") makes the ALC225 have pop noise on S3 resume and cold boot.
The previous fix enable power save node universally for ALC225, however it makes some ALC225 systems unable to produce any sound.
So let's only enable power save node for the affected Dell Wyse platform.
--- sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
sound/pci/hda/patch_realtek.c +16 -0
@@ -5354,6 +5354,15 @@ static void alc233_alc662_fixup_lenovo_dual_codecs(struct hda_codec *codec, } } +static void alc225_fixup_s3_pop_noise (struct hda_codec *codec, +const struct hda_fixup *fix,int action) +{ +if (action !=HDA_FIXUP_ACT_PRE_PROBE ) +return ; + + codec->power_save_node =1 ; +} +/* Forcibly assign NID 0x03 to HP/LO while NID 0x02 to SPK for EQ */ static void alc274_fixup_bind_dacs (struct hda_codec *codec,const struct hda_fixup *fix,int action)
@@ -5507,6 +5516,7 @@ enum {ALC233_FIXUP_LENOVO_MULTI_CODECS ,ALC294_FIXUP_LENOVO_MIC_LOCATION ,ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE , +ALC225_FIXUP_S3_POP_NOISE ,ALC700_FIXUP_INTEL_REFERENCE ,ALC274_FIXUP_DELL_BIND_DACS , ALC274_FIXUP_DELL_AIO_LINEOUT_VERB,
@@ -6339,6 +6349,12 @@ static const struct hda_fixup alc269_fixups[] = { { } }, .chained = true, + .chain_id =ALC225_FIXUP_S3_POP_NOISE + }, + [ALC225_FIXUP_S3_POP_NOISE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc225_fixup_s3_pop_noise, + .chained = true, .chain_id =ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC }, [ALC700_FIXUP_INTEL_REFERENCE] = {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 62/114 x86/entry/64: Fix unwind hints in register clearing code
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
[ Upstream commit 06a9750edcffa808494d56da939085c35904e618 ]
The PUSH_AND_CLEAR_REGS macro zeroes each register immediately after pushing it. If an NMI or exception hits after a register is cleared, but before the UNWIND_HINT_REGS annotation, the ORC unwinder will wrongly think the previous value of the register was zero. This can confuse the unwinding process and cause it to exit early.
Because ORC is simpler than DWARF, there are a limited number of unwind annotation states, so it's not possible to add an individual unwind hint after each push/clear combination. Instead, the register clearing instructions need to be consolidated and moved to after the UNWIND_HINT_REGS annotation.
--- arch/x86/entry/calling.h | 38 +++++++++++++++++++++----------------- 1 file changed, 21 insertions(+), 17 deletions(-)
arch/x86/entry/calling.h +21 -17
@@ -98,13 +98,6 @@ For 32-bit we have the following conventions - kernel is built with#define SIZEOF_PTREGS 21*8 .macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0 -/* -* Push registers and sanitize registers of values that a -* speculation attack might otherwise want to exploit. The -* lower registers are likely clobbered well before they -* could be put to use in a speculative execution gadget. -* Interleave XOR with PUSH for better uop scheduling: -*/ .if \save_ret pushq %rsi /* pt_regs->si */ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */
@@ -117,29 +110,40 @@ For 32-bit we have the following conventions - kernel is built with pushq %rcx/* pt_regs->cx */ pushq \rax /* pt_regs->ax */ pushq %r8 /* pt_regs->r8 */ - xorl %r8d, %r8d /* nospec r8 */ pushq %r9 /* pt_regs->r9 */ - xorl %r9d, %r9d /* nospec r9 */ pushq %r10 /* pt_regs->r10 */ - xorl %r10d, %r10d /* nospec r10 */ pushq %r11 /* pt_regs->r11 */ - xorl %r11d, %r11d /* nospec r11*/ pushq %rbx /* pt_regs->rbx */ - xorl %ebx, %ebx /* nospec rbx*/ pushq %rbp /* pt_regs->rbp */ - xorl %ebp, %ebp /* nospec rbp*/ pushq %r12 /* pt_regs->r12 */ - xorl %r12d, %r12d /* nospec r12*/ pushq %r13 /* pt_regs->r13 */ - xorl %r13d, %r13d /* nospec r13*/ pushq %r14 /* pt_regs->r14 */ - xorl %r14d, %r14d /* nospec r14*/ pushq %r15 /* pt_regs->r15 */ - xorl %r15d, %r15d /* nospec r15*/UNWIND_HINT_REGS + .if \save_ret pushq %rsi /* return address on top of stack */ .endif + +/* +* Sanitize registers of values that a speculation attack might +* otherwise want to exploit. The lower registers are likely clobbered +* well before they could be put to use in a speculative execution +* gadget. +*/ + xorl %edx, %edx /* nospec dx */ + xorl %ecx, %ecx /* nospec cx */ + xorl %r8d, %r8d /* nospec r8 */ + xorl %r9d, %r9d /* nospec r9 */ + xorl %r10d, %r10d /* nospec r10 */ + xorl %r11d, %r11d /* nospec r11 */ + xorl %ebx, %ebx /* nospec rbx */ + xorl %ebp, %ebp /* nospec rbp */ + xorl %r12d, %r12d /* nospec r12 */ + xorl %r13d, %r13d /* nospec r13 */ + xorl %r14d, %r14d /* nospec r14 */ + xorl %r15d, %r15d /* nospec r15 */ + .endm .macro POP_REGS pop_rdi=1 skip_r11rcx=0
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 63/114 ipmi: Fix NULL pointer dereference in ssif_probe
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
[ Upstream commit a8627cda7cfffe1792c199660c2b4f03ba2bd97b ]
There is a potential execution path in which function ssif_info_find() returns NULL, hence there is a NULL pointer dereference when accessing pointer *addr_info*
Fix this by null checking *addr_info* before dereferencing it.
Addresses-Coverity-ID: 1473145 ("Explicit null dereferenced")
--- drivers/char/ipmi/ipmi_ssif.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/char/ipmi/ipmi_ssif.c +3 -1
@@ -1731,7 +1731,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id) out:if (rv) { - addr_info->client =NULL ; +if (addr_info) + addr_info->client =NULL ; +dev_err (&client->dev,"Unable to start IPMI SSIF: %d\n" , rv);kfree (ssif_info); }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 64/114 pinctrl: baytrail: Enable pin configuration setting for GPIO chip
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit ccd025eaddaeb99e982029446197c544252108e2 ]
It appears that pin configuration for GPIO chip hasn't been enabled yet due to absence of ->set_config() callback.
Enable it here for Intel Baytrail.
Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips")
--- drivers/pinctrl/intel/pinctrl-baytrail.c | 1 + 1 file changed, 1 insertion(+)
drivers/pinctrl/intel/pinctrl-baytrail.c +1 -0
@@ -1503,6 +1503,7 @@ static const struct gpio_chip byt_gpio_chip = { .direction_output = byt_gpio_direction_output, .get = byt_gpio_get, .set = byt_gpio_set, + .set_config = gpiochip_generic_config, .dbg_show = byt_gpio_dbg_show, };
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 65/114 pinctrl: cherryview: Add missing spinlock usage in chv_gpio_irq_handler
In reply to Greg Kroah-HartmanFrom: Grace Kao <[email protected]>
[ Upstream commit 69388e15f5078c961b9e5319e22baea4c57deff1 ]
According to Braswell NDA Specification Update (#557593), concurrent read accesses may result in returning 0xffffffff and write instructions may be dropped. We have an established format for the commit references, i.e.cdca06e4e859 ("pinctrl: baytrail: Add missing spinlock usage in byt_gpio_irq_handler")
--- drivers/pinctrl/intel/pinctrl-cherryview.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/pinctrl/intel/pinctrl-cherryview.c +4 -0
@@ -1514,11 +1514,15 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)struct chv_pinctrl *pctrl =gpiochip_get_data (gc);struct irq_chip *chip =irq_desc_get_chip (desc);unsigned long pending; +unsigned long flags;u32 intr_line;chained_irq_enter (chip, desc); +raw_spin_lock_irqsave (&chv_lock, flags); pending =readl (pctrl->regs +CHV_INTSTAT ); +raw_spin_unlock_irqrestore (&chv_lock, flags); +for_each_set_bit (intr_line, &pending, pctrl->community->nirqs) {unsigned irq, offset;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 66/114 i40iw: Fix error handling in i40iw_manage_arp_cache()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 37e31d2d26a4124506c24e95434e9baf3405a23a ]
The i40iw_arp_table() function can return -EOVERFLOW if i40iw_alloc_resource() fails so we can't just test for "== -1".
--- drivers/infiniband/hw/i40iw/i40iw_hw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/hw/i40iw/i40iw_hw.c +1 -1
@@ -483,7 +483,7 @@ void i40iw_manage_arp_cache(struct i40iw_device *iwdev,int arp_index; arp_index =i40iw_arp_table (iwdev, ip_addr, ipv4, mac_addr, action); -if (arp_index ==-1 ) +if (arp_index <0 )return ; cqp_request =i40iw_get_cqp_request (&iwdev->cqp, false);if (!cqp_request)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 67/114 netfilter: conntrack: avoid gcc-10 zero-length-bounds warning
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 2c407aca64977ede9b9f35158e919773cae2082f ]
gcc-10 warns around a suspicious access to an empty struct member:
net/netfilter/nf_conntrack_core.c: In function '__nf_conntrack_alloc':net/netfilter/nf_conntrack_core.c:1522:9: warning: array subscript 0 is outside the bounds of an interior zero-length array 'u8[0]' {aka 'unsigned char[0]'} [-Wzero-length-bounds]
1522 | memset(&ct->__nfct_init_offset[0], 0,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from net/netfilter/nf_conntrack_core.c:37:
include/net/netfilter/nf_conntrack.h:90:5: note: while referencing '__nfct_init_offset'
90 | u8 __nfct_init_offset[0];
| ^~~~~~~~~~~~~~~~~~The code is correct but a bit unusual. Rework it slightly in a way that does not trigger the warning, using an empty struct instead of an empty array. There are probably more elegant ways to do this, but this is the smallest change.
--- include/net/netfilter/nf_conntrack.h | 2 +- net/netfilter/nf_conntrack_core.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-)
include/net/netfilter/nf_conntrack.h +1 -1
@@ -80,7 +80,7 @@ struct nf_conn {struct hlist_node nat_bysource;#endif /* all members below initialized via memset */ -u8 __nfct_init_offset[0 ]; +struct { } __nfct_init_offset;/* If we were expected by an expectation, this will be it */ struct nf_conn *master;
net/netfilter/nf_conntrack_core.c +2 -2
@@ -1208,9 +1208,9 @@ __nf_conntrack_alloc(struct net *net, *(unsigned long *)(&ct->tuplehash[IP_CT_DIR_REPLY ].hnnode.pprev) = hash; ct->status =0 ;write_pnet (&ct->ct_net, net); -memset (&ct->__nfct_init_offset[0 ],0 , +memset (&ct->__nfct_init_offset,0 , offsetof(struct nf_conn , proto) - - offsetof(struct nf_conn, __nfct_init_offset[0])); + offsetof(struct nf_conn , __nfct_init_offset));nf_ct_zone_add (ct, zone);
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 68/114 IB/mlx4: Test return value of calls to ib_get_cached_pkey
In reply to Greg Kroah-HartmanFrom: Jack Morgenstein <[email protected]>
[ Upstream commit 6693ca95bd4330a0ad7326967e1f9bcedd6b0800 ]
In the mlx4_ib_post_send() flow, some functions call ib_get_cached_pkey() without checking its return value. If ib_get_cached_pkey() returns an error code, these functions should return failure.
--- drivers/infiniband/hw/mlx4/qp.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
drivers/infiniband/hw/mlx4/qp.c +11 -3
@@ -2917,6 +2917,7 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp,int send_size;int header_size;int spc; +int err;int i;if (wr->wr.opcode !=IB_WR_SEND )
@@ -2951,7 +2952,9 @@ static int build_sriov_qp0_header(struct mlx4_ib_sqp *sqp, sqp->ud_header.lrh.virtual_lane =0 ; sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags &IB_SEND_SOLICITED ); -ib_get_cached_pkey (ib_dev, sqp->qp.port,0 , &pkey); + err =ib_get_cached_pkey (ib_dev, sqp->qp.port,0 , &pkey); +if (err) +return err; sqp->ud_header.bth.pkey =cpu_to_be16 (pkey);if (sqp->qp.mlx4_ib_qp_type ==MLX4_IB_QPT_TUN_SMI_OWNER ) sqp->ud_header.bth.destination_qpn =cpu_to_be32 (wr->remote_qpn);
@@ -3240,9 +3243,14 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, struct ib_ud_wr *wr, } sqp->ud_header.bth.solicited_event = !!(wr->wr.send_flags &IB_SEND_SOLICITED );if (!sqp->qp.ibqp.qp_num) -ib_get_cached_pkey (ib_dev, sqp->qp.port, sqp->pkey_index, &pkey); + err =ib_get_cached_pkey (ib_dev, sqp->qp.port, sqp->pkey_index, + &pkey);else -ib_get_cached_pkey (ib_dev, sqp->qp.port, wr->pkey_index, &pkey); + err =ib_get_cached_pkey (ib_dev, sqp->qp.port, wr->pkey_index, + &pkey); +if (err) +return err; + sqp->ud_header.bth.pkey =cpu_to_be16 (pkey); sqp->ud_header.bth.destination_qpn =cpu_to_be32 (wr->remote_qpn); sqp->ud_header.bth.psn =cpu_to_be32 ((sqp->send_psn++) & ((1 <<24 ) -1 ));
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 69/114 hwmon: (da9052) Synchronize access with mfd
In reply to Greg Kroah-HartmanFrom: Samu Nuutamo <[email protected]>
[ Upstream commit 333e22db228f0bd0c839553015a6a8d3db4ba569 ]
When tsi-as-adc is configured it is possible for in7[0123]_input read to return an incorrect value if a concurrent read to in[456]_input is performed. This is caused by a concurrent manipulation of the mux channel without proper locking as hwmon and mfd use different locks for synchronization.
Switch hwmon to use the same lock as mfd when accessing the TSI channel.
--- drivers/hwmon/da9052-hwmon.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/hwmon/da9052-hwmon.c +2 -2
@@ -250,9 +250,9 @@ static ssize_t da9052_read_tsi(struct device *dev,int channel =to_sensor_dev_attr (devattr)->index;int ret; -mutex_lock (&hwmon->hwmon_lock); +mutex_lock (&hwmon->da9052->auxadc_lock); ret =__da9052_read_tsi (dev, channel); -mutex_unlock (&hwmon->hwmon_lock); +mutex_unlock (&hwmon->da9052->auxadc_lock);if (ret <0 )return ret;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 70/114 pnp: Use list_for_each_entry() instead of open coding
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit 01b2bafe57b19d9119413f138765ef57990921ce upstream.
Aside from good practice, this avoids a warning from gcc 10:
./include/linux/kernel.h:997:3: warning: array subscript -31 is outside array bounds of ‘struct list_head[1]’ [-Warray-bounds]
997 | ((type *)(__mptr - offsetof(type, member))); })
| ~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
./include/linux/list.h:493:2: note: in expansion of macro ‘container_of’
493 | container_of(ptr, type, member)
| ^~~~~~~~~~~~
./include/linux/pnp.h:275:30: note: in expansion of macro ‘list_entry’
275 | #define global_to_pnp_dev(n) list_entry(n, struct pnp_dev, global_list)
| ^~~~~~~~~~
./include/linux/pnp.h:281:11: note: in expansion of macro ‘global_to_pnp_dev’
281 | (dev) != global_to_pnp_dev(&pnp_global); \
| ^~~~~~~~~~~~~~~~~arch/x86/kernel/rtc.c:189:2: note: in expansion of macro ‘pnp_for_each_dev’
189 | pnp_for_each_dev(dev) {
Because the common code doesn't cast the starting list_head to the containing struct.
--- include/linux/pnp.h | 29 +++++++++-------------------- 1 file changed, 9 insertions(+), 20 deletions(-)
include/linux/pnp.h +9 -20
@@ -220,10 +220,8 @@ struct pnp_card {#define global_to_pnp_card (n) list_entry(n, struct pnp_card, global_list)#define protocol_to_pnp_card (n) list_entry(n, struct pnp_card, protocol_list)#define to_pnp_card (n) container_of(n, struct pnp_card, dev) -#define pnp_for_each_card (card) \ - for((card) = global_to_pnp_card(pnp_cards.next); \ - (card) != global_to_pnp_card(&pnp_cards); \ - (card) = global_to_pnp_card((card)->global_list.next)) +#define pnp_for_each_card (card) \ + list_for_each_entry(card, &pnp_cards, global_list)struct pnp_card_link {struct pnp_card *card;
@@ -276,14 +274,9 @@ struct pnp_dev {#define card_to_pnp_dev (n) list_entry(n, struct pnp_dev, card_list)#define protocol_to_pnp_dev (n) list_entry(n, struct pnp_dev, protocol_list)#define to_pnp_dev (n) container_of(n, struct pnp_dev, dev) -#define pnp_for_each_dev (dev) \ - for((dev) = global_to_pnp_dev(pnp_global.next); \ - (dev) != global_to_pnp_dev(&pnp_global); \ - (dev) = global_to_pnp_dev((dev)->global_list.next)) -#define card_for_each_dev (card,dev) \ - for((dev) = card_to_pnp_dev((card)->devices.next); \ - (dev) != card_to_pnp_dev(&(card)->devices); \ - (dev) = card_to_pnp_dev((dev)->card_list.next)) +#define pnp_for_each_dev (dev) list_for_each_entry(dev, &pnp_global, global_list) +#define card_for_each_dev (card, dev) \ + list_for_each_entry(dev, &(card)->devices, card_list)#define pnp_dev_name (dev) (dev)->namestatic inline void *pnp_get_drvdata (struct pnp_dev *pdev)
@@ -437,14 +430,10 @@ struct pnp_protocol { };#define to_pnp_protocol (n) list_entry(n, struct pnp_protocol, protocol_list) -#define protocol_for_each_card (protocol,card) \ - for((card) = protocol_to_pnp_card((protocol)->cards.next); \ - (card) != protocol_to_pnp_card(&(protocol)->cards); \ - (card) = protocol_to_pnp_card((card)->protocol_list.next)) -#define protocol_for_each_dev (protocol,dev) \ - for((dev) = protocol_to_pnp_dev((protocol)->devices.next); \ - (dev) != protocol_to_pnp_dev(&(protocol)->devices); \ - (dev) = protocol_to_pnp_dev((dev)->protocol_list.next)) +#define protocol_for_each_card (protocol, card) \ + list_for_each_entry(card, &(protocol)->cards, protocol_list) +#define protocol_for_each_dev (protocol, dev) \ + list_for_each_entry(dev, &(protocol)->devices, protocol_list)extern struct bus_type pnp_bus_type;
Greg Kroah-Hartman
maintainerPATCH 71/114 gcc-10 warnings: fix low-hanging fruit
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 9d82973e032e246ff5663c9805fbb5407ae932e3 upstream.
Due to a bug-report that was compiler-dependent, I updated one of my machines to gcc-10. That shows a lot of new warnings. Happily they seem to be mostly the valid kind, but it's going to cause a round of churn for getting rid of them..
This is the really low-hanging fruit of removing a couple of zero-sized arrays in some core code. We have had a round of these patches before, and we'll have many more coming, and there is nothing special about these except that they were particularly trivial, and triggered more warnings than most.
--- include/linux/fs.h | 2 +- include/linux/tty.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/linux/fs.h +1 -1
@@ -900,7 +900,7 @@ struct file_handle {__u32 handle_bytes;int handle_type;/* file identifier */ -unsigned char f_handle[0 ]; +unsigned char f_handle[]; };static inline struct file *get_file (struct file *f)
include/linux/tty.h +1 -1
@@ -65,7 +65,7 @@ struct tty_buffer {int read;int flags;/* Data points here */ -unsigned long data[0 ]; +unsigned long data[]; };/* Values for .flags field of tty_buffer */
Greg Kroah-Hartman
maintainerPATCH 72/114 kbuild: compute false-positive -Wmaybe-uninitialized cases in Kconfig
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
commit b303c6df80c9f8f13785aa83a0471fca7e38b24d upstream.
Since -Wmaybe-uninitialized was introduced by GCC 4.7, we have patched various false positives:
- commit e74fc973b6e5 ("Turn off -Wmaybe-uninitialized when building with -Os") turned off this option for -Os.
- commit 815eb71e7149 ("Kbuild: disable 'maybe-uninitialized' warning for CONFIG_PROFILE_ALL_BRANCHES") turned off this option for CONFIG_PROFILE_ALL_BRANCHES
- commit a76bcf557ef4 ("Kbuild: enable -Wmaybe-uninitialized warning for "make W=1"") turned off this option for GCC < 4.9 Arnd provided more explanation in https://lkml.org/lkml/2017/3/14/903
I think this looks better by shifting the logic from Makefile to Kconfig.
--- Makefile | 11 ++++------- init/Kconfig | 17 +++++++++++++++++ kernel/trace/Kconfig | 1 + 3 files changed, 22 insertions(+), 7 deletions(-)
Makefile +4 -7
@@ -656,17 +656,14 @@ KBUILD_CFLAGS += $(call cc-disable-warni KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE -KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) -else -ifdef CONFIG_PROFILE_ALL_BRANCHES -KBUILD_CFLAGS += -O2 $(call cc-disable-warning,maybe-uninitialized,) +KBUILD_CFLAGS += -Os else KBUILD_CFLAGS += -O2 endif -endif -KBUILD_CFLAGS += $(call cc-ifversion, -lt, 0409, \ - $(call cc-disable-warning,maybe-uninitialized,)) +ifdef CONFIG_CC_DISABLE_WARN_MAYBE_UNINITIALIZED +KBUILD_CFLAGS += -Wno-maybe-uninitialized +endif # Tell gcc to never replace conditional load with a non-conditional one KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
init/Kconfig +17 -0
@@ -16,6 +16,22 @@ config DEFCONFIG_LIST default "$ARCH_DEFCONFIG" default "arch/$ARCH/defconfig" +config CC_HAS_WARN_MAYBE_UNINITIALIZED + def_bool $(cc-option,-Wmaybe-uninitialized) + help + GCC >= 4.7 supports this option. + +config CC_DISABLE_WARN_MAYBE_UNINITIALIZED + bool + depends on CC_HAS_WARN_MAYBE_UNINITIALIZED + default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9 + help + GCC's -Wmaybe-uninitialized is not reliable by definition. + Lots of false positive warnings are produced in some cases. + + If this option is enabled, -Wno-maybe-uninitialzed is passed + to the compiler to suppress maybe-uninitialized warnings. + config CONSTRUCTORS bool depends on !UML
@@ -1044,6 +1060,7 @@ config CC_OPTIMIZE_FOR_PERFORMANCE config CC_OPTIMIZE_FOR_SIZE bool "Optimize for size" + imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives help Enabling this option will pass "-Os" instead of "-O2" to your compiler resulting in a smaller kernel.
kernel/trace/Kconfig +1 -0
@@ -345,6 +345,7 @@ config PROFILE_ANNOTATED_BRANCHES config PROFILE_ALL_BRANCHES bool "Profile all if conditionals" if !FORTIFY_SOURCE select TRACE_BRANCH_PROFILING + imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives help This tracer profiles all branch conditions. Every if () taken in the kernel is recorded whether it hit or miss.
Greg Kroah-Hartman
maintainerPATCH 73/114 Stop the ad-hoc games with -Wno-maybe-initialized
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 78a5255ffb6a1af189a83e493d916ba1c54d8c75 upstream.
We have some rather random rules about when we accept the "maybe-initialized" warnings, and when we don't.
For example, we consider it unreliable for gcc versions < 4.9, but also if -O3 is enabled, or if optimizing for size. And then various kernel config options disabled it, because they know that they trigger that warning by confusing gcc sufficiently (ie PROFILE_ALL_BRANCHES).
And now gcc-10 seems to be introducing a lot of those warnings too, so it falls under the same heading as 4.9 did.
At the same time, we have a very straightforward way to _enable_ that warning when wanted: use "W=2" to enable more warnings.
So stop playing these ad-hoc games, and just disable that warning by default, with the known and straight-forward "if you want to work on the extra compiler warnings, use W=123".
Would it be great to have code that is always so obvious that it never confuses the compiler whether a variable is used initialized or not? Yes, it would. In a perfect world, the compilers would be smarter, and our source code would be simpler.
That's currently not the world we live in, though.
--- Makefile | 7 +++---- init/Kconfig | 17 ----------------- kernel/trace/Kconfig | 1 - 3 files changed, 3 insertions(+), 22 deletions(-)
Makefile +3 -4
@@ -661,10 +661,6 @@ else KBUILD_CFLAGS += -O2 endif -ifdef CONFIG_CC_DISABLE_WARN_MAYBE_UNINITIALIZED -KBUILD_CFLAGS += -Wno-maybe-uninitialized -endif - # Tell gcc to never replace conditional load with a non-conditional one KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0)
@@ -804,6 +800,9 @@ KBUILD_CFLAGS += $(call cc-disable-warni # disable stringop warnings in gcc 8+ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) +# Enabled with W=2, disabled by default as noisy +KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized) + # disable invalid "can't wrap" optimizations for signed / pointers KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow)
init/Kconfig +0 -17
@@ -16,22 +16,6 @@ config DEFCONFIG_LIST default "$ARCH_DEFCONFIG" default "arch/$ARCH/defconfig" -config CC_HAS_WARN_MAYBE_UNINITIALIZED - def_bool $(cc-option,-Wmaybe-uninitialized) - help - GCC >= 4.7 supports this option. - -config CC_DISABLE_WARN_MAYBE_UNINITIALIZED - bool - depends on CC_HAS_WARN_MAYBE_UNINITIALIZED - default CC_IS_GCC && GCC_VERSION < 40900 # unreliable for GCC < 4.9 - help - GCC's -Wmaybe-uninitialized is not reliable by definition. - Lots of false positive warnings are produced in some cases. - - If this option is enabled, -Wno-maybe-uninitialzed is passed - to the compiler to suppress maybe-uninitialized warnings. - config CONSTRUCTORS bool depends on !UML
@@ -1060,7 +1044,6 @@ config CC_OPTIMIZE_FOR_PERFORMANCE config CC_OPTIMIZE_FOR_SIZE bool "Optimize for size" - imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives help Enabling this option will pass "-Os" instead of "-O2" to your compiler resulting in a smaller kernel.
kernel/trace/Kconfig +0 -1
@@ -345,7 +345,6 @@ config PROFILE_ANNOTATED_BRANCHES config PROFILE_ALL_BRANCHES bool "Profile all if conditionals" if !FORTIFY_SOURCE select TRACE_BRANCH_PROFILING - imply CC_DISABLE_WARN_MAYBE_UNINITIALIZED # avoid false positives help This tracer profiles all branch conditions. Every if () taken in the kernel is recorded whether it hit or miss.
Greg Kroah-Hartman
maintainerPATCH 74/114 gcc-10: disable zero-length-bounds warning for now
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 5c45de21a2223fe46cf9488c99a7fbcf01527670 upstream.
This is a fine warning, but we still have a number of zero-length arrays in the kernel that come from the traditional gcc extension. Yes, they are getting converted to flexible arrays, but in the meantime the gcc-10 warning about zero-length bounds is very verbose, and is hiding other issues.
I missed one actual build failure because it was hidden among hundreds of lines of warning. Thankfully I caught it on the second go before pushing things out, but it convinced me that I really need to disable the new warnings for now.
We'll hopefully be all done with our conversion to flexible arrays in the not too distant future, and we can then re-enable this warning.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -800,6 +800,9 @@ KBUILD_CFLAGS += $(call cc-disable-warni # disable stringop warnings in gcc 8+ KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) +# We'll want to enable this eventually, but it's not going away for 5.7 at least +KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds) + # Enabled with W=2, disabled by default as noisy KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
Greg Kroah-Hartman
maintainerPATCH 75/114 gcc-10: disable array-bounds warning for now
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 44720996e2d79e47d508b0abe99b931a726a3197 upstream.
This is another fine warning, related to the 'zero-length-bounds' one, but hitting the same historical code in the kernel.
Because C didn't historically support flexible array members, we have code that instead uses a one-sized array, the same way we have cases of zero-sized arrays.
The one-sized arrays come from either not wanting to use the gcc zero-sized array extension, or from a slight convenience-feature, where particularly for strings, the size of the structure now includes the allocation for the final NUL character.
So with a "char name[1];" at the end of a structure, you can do things like
v = my_malloc(sizeof(struct vendor) + strlen(name));
and avoid the "+1" for the terminator.
Yes, the modern way to do that is with a flexible array, and using 'offsetof()' instead of 'sizeof()', and adding the "+1" by hand. That also technically gets the size "more correct" in that it avoids any alignment (and thus padding) issues, but this is another long-term cleanup thing that will not happen for 5.7.
So disable the warning for now, even though it's potentially quite useful. Having a slew of warnings that then hide more urgent new issues is not an improvement.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -802,6 +802,7 @@ KBUILD_CFLAGS += $(call cc-disable-warni # We'll want to enable this eventually, but it's not going away for 5.7 at least KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds) +KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) # Enabled with W=2, disabled by default as noisy KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
Greg Kroah-Hartman
maintainerPATCH 76/114 gcc-10: disable stringop-overflow warning for now
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 5a76021c2eff7fcf2f0918a08fd8a37ce7922921 upstream.
This is the final array bounds warning removal for gcc-10 for now.
Again, the warning is good, and we should re-enable all these warnings when we have converted all the legacy array declaration cases to flexible arrays. But in the meantime, it's just noise.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -803,6 +803,7 @@ KBUILD_CFLAGS += $(call cc-disable-warni # We'll want to enable this eventually, but it's not going away for 5.7 at least KBUILD_CFLAGS += $(call cc-disable-warning, zero-length-bounds) KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) +KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) # Enabled with W=2, disabled by default as noisy KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
Greg Kroah-Hartman
maintainerPATCH 77/114 gcc-10: disable restrict warning for now
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit adc71920969870dfa54e8f40dac8616284832d02 upstream.
gcc-10 now warns about passing aliasing pointers to functions that take restricted pointers.
That's actually a great warning, and if we ever start using 'restrict' in the kernel, it might be quite useful. But right now we don't, and it turns out that the only thing this warns about is an idiom where we have declared a few functions to be "printf-like" (which seems to make gcc pick up the restricted pointer thing), and then we print to the same buffer that we also use as an input.
And people do that as an odd concatenation pattern, with code like this:
#define sysfs_show_gen_prop(buffer, fmt, ...) \
snprintf(buffer, PAGE_SIZE, "%s"fmt, buffer, __VA_ARGS__)where we have 'buffer' as both the destination of the final result, and as the initial argument.
Yes, it's a bit questionable. And outside of the kernel, people do have standard declarations like
int snprintf( char *restrict buffer, size_t bufsz,
const char *restrict format, ... );
where that output buffer is marked as a restrict pointer that cannot alias with any other arguments.
But in the context of the kernel, that 'use snprintf() to concatenate to the end result' does work, and the pattern shows up in multiple places. And we have not marked our own version of snprintf() as taking restrict pointers, so the warning is incorrect for now, and gcc picks it up on its own.
If we do start using 'restrict' in the kernel (and it might be a good idea if people find places where it matters), we'll need to figure out how to avoid this issue for snprintf and friends. But in the meantime, this warning is not useful.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -805,6 +805,9 @@ KBUILD_CFLAGS += $(call cc-disable-warni KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds) KBUILD_CFLAGS += $(call cc-disable-warning, stringop-overflow) +# Another good warning that we'll want to enable eventually +KBUILD_CFLAGS += $(call cc-disable-warning, restrict) + # Enabled with W=2, disabled by default as noisy KBUILD_CFLAGS += $(call cc-disable-warning, maybe-uninitialized)
Greg Kroah-Hartman
maintainerPATCH 78/114 gcc-10: avoid shadowing standard library free() in crypto
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 1a263ae60b04de959d9ce9caea4889385eefcc7b upstream.
gcc-10 has started warning about conflicting types for a few new built-in functions, particularly 'free()'.
This results in warnings like:
crypto/xts.c:325:13: warning: conflicting types for built-in function ‘free’; expected ‘void(void *)’ [-Wbuiltin-declaration-mismatch]
because the crypto layer had its local freeing functions called 'free()'.
Gcc-10 is in the wrong here, since that function is marked 'static', and thus there is no chance of confusion with any standard library function namespace.
But the simplest thing to do is to just use a different name here, and avoid this gcc mis-feature.
[ Side note: gcc knowing about 'free()' is in itself not the
mis-feature: the semantics of 'free()' are special enough that a compiler can validly do special things when seeing it.
So the mis-feature here is that gcc thinks that 'free()' is some restricted name, and you can't shadow it as a local static function.
Making the special 'free()' semantics be a function attribute rather than tied to the name would be the much better model ]
--- crypto/lrw.c | 4 ++-- crypto/xts.c | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-)
crypto/lrw.c +2 -2
@@ -531,7 +531,7 @@ static void exit_tfm(struct crypto_skcipcrypto_free_skcipher (ctx->child); } -static void free (struct skcipher_instance *inst) +static void free_inst (struct skcipher_instance *inst) {crypto_drop_skcipher (skcipher_instance_ctx (inst));kfree (inst);
@@ -642,7 +642,7 @@ static int create(struct crypto_template inst->alg.encrypt = encrypt; inst->alg.decrypt = decrypt; - inst->free = free; + inst->free = free_inst; err =skcipher_register_instance (tmpl, inst);if (err)
crypto/xts.c +2 -2
@@ -469,7 +469,7 @@ static void exit_tfm(struct crypto_skcipcrypto_free_cipher (ctx->tweak); } -static void free (struct skcipher_instance *inst) +static void free_inst (struct skcipher_instance *inst) {crypto_drop_skcipher (skcipher_instance_ctx (inst));kfree (inst);
@@ -580,7 +580,7 @@ static int create(struct crypto_template inst->alg.encrypt = encrypt; inst->alg.decrypt = decrypt; - inst->free = free; + inst->free = free_inst; err =skcipher_register_instance (tmpl, inst);if (err)
Greg Kroah-Hartman
maintainerPATCH 79/114 x86/asm: Add instruction suffixes to bitops
In reply to Greg Kroah-HartmanFrom: Jan Beulich <[email protected]>
commit 22636f8c9511245cb3c8412039f1dd95afb3aa59 upstream.
Omitting suffixes from instructions in AT&T mode is bad practice when operand size cannot be determined by the assembler from register operands, and is likely going to be warned about by upstream gas in the future (mine does already). Add the missing suffixes here. Note that for 64-bit this means some operations change from being 32-bit to 64-bit.
--- arch/x86/include/asm/bitops.h | 29 ++++++++++++++++------------- arch/x86/include/asm/percpu.h | 2 +- 2 files changed, 17 insertions(+), 14 deletions(-)
arch/x86/include/asm/bitops.h +16 -13
@@ -78,7 +78,7 @@ set_bit(long nr, volatile unsigned long : "iq" ((u8)CONST_MASK(nr)) : "memory"); } else { - asm volatile(LOCK_PREFIX "bts %1,%0" + asm volatile(LOCK_PREFIX __ASM_SIZE(bts) " %1,%0" : BITOP_ADDR(addr) : "Ir" (nr) : "memory"); } }
@@ -94,7 +94,7 @@ set_bit(long nr, volatile unsigned long*/ static __always_inline void __set_bit(long nr, volatile unsigned long *addr) { - asm volatile("bts %1,%0" : ADDR : "Ir" (nr) : "memory"); + asm volatile(__ASM_SIZE(bts) " %1,%0" : ADDR : "Ir" (nr) : "memory"); }/**
@@ -115,7 +115,7 @@ clear_bit(long nr, volatile unsigned lon : CONST_MASK_ADDR(nr, addr) : "iq" ((u8)~CONST_MASK(nr))); }else { - asm volatile(LOCK_PREFIX "btr %1,%0" + asm volatile(LOCK_PREFIX __ASM_SIZE(btr) " %1,%0" : BITOP_ADDR(addr) : "Ir" (nr)); }
@@ -137,7 +137,7 @@ static __always_inline void clear_bit_un static __always_inline void __clear_bit(long nr, volatile unsigned long *addr) { - asm volatile("btr %1,%0" : ADDR : "Ir" (nr)); + asm volatile(__ASM_SIZE(btr) " %1,%0" : ADDR : "Ir" (nr)); } static __always_inline bool clear_bit_unlock_is_negative_byte(long nr, volatile unsigned long *addr)
@@ -182,7 +182,7 @@ static __always_inline void __clear_bit_*/ static __always_inline void __change_bit(long nr, volatile unsigned long *addr) { - asm volatile("btc %1,%0" : ADDR : "Ir" (nr)); + asm volatile(__ASM_SIZE(btc) " %1,%0" : ADDR : "Ir" (nr)); }/**
@@ -201,7 +201,7 @@ static __always_inline void change_bit(l : CONST_MASK_ADDR(nr, addr) : "iq" ((u8)CONST_MASK(nr))); }else { - asm volatile(LOCK_PREFIX "btc %1,%0" + asm volatile(LOCK_PREFIX __ASM_SIZE(btc) " %1,%0" : BITOP_ADDR(addr) : "Ir" (nr)); }
@@ -217,7 +217,8 @@ static __always_inline void change_bit(l*/ static __always_inline bool test_and_set_bit(long nr, volatile unsigned long *addr) { -GEN_BINARY_RMWcc (LOCK_PREFIX "bts" , *addr,"Ir" , nr,"%0" , c); + GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(bts), + *addr, "Ir", nr, "%0", c); }/**
@@ -246,7 +247,7 @@ static __always_inline bool __test_and_s {bool oldbit; - asm("bts %2,%1" + asm(__ASM_SIZE(bts) " %2,%1" CC_SET(c) : CC_OUT(c) (oldbit), ADDR : "Ir" (nr));
@@ -263,7 +264,8 @@ static __always_inline bool __test_and_s*/ static __always_inline bool test_and_clear_bit(long nr, volatile unsigned long *addr) { -GEN_BINARY_RMWcc (LOCK_PREFIX "btr" , *addr,"Ir" , nr,"%0" , c); + GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btr), + *addr, "Ir", nr, "%0", c); }/**
@@ -286,7 +288,7 @@ static __always_inline bool __test_and_c {bool oldbit; - asm volatile("btr %2,%1" + asm volatile(__ASM_SIZE(btr) " %2,%1" CC_SET(c) : CC_OUT(c) (oldbit), ADDR : "Ir" (nr));
@@ -298,7 +300,7 @@ static __always_inline bool __test_and_c {bool oldbit; - asm volatile("btc %2,%1" + asm volatile(__ASM_SIZE(btc) " %2,%1" CC_SET(c) : CC_OUT(c) (oldbit), ADDR : "Ir" (nr) : "memory");
@@ -316,7 +318,8 @@ static __always_inline bool __test_and_c*/ static __always_inline bool test_and_change_bit(long nr, volatile unsigned long *addr) { -GEN_BINARY_RMWcc (LOCK_PREFIX "btc" , *addr,"Ir" , nr,"%0" , c); + GEN_BINARY_RMWcc(LOCK_PREFIX __ASM_SIZE(btc), + *addr, "Ir", nr, "%0", c); } static __always_inline bool constant_test_bit(long nr, const volatile unsigned long *addr)
@@ -329,7 +332,7 @@ static __always_inline bool variable_tes {bool oldbit; - asm volatile("bt %2,%1" + asm volatile(__ASM_SIZE(bt) " %2,%1" CC_SET(c) : CC_OUT(c) (oldbit) : "m" (*(unsigned long *)addr), "Ir" (nr));
arch/x86/include/asm/percpu.h +1 -1
@@ -526,7 +526,7 @@ static inline bool x86_this_cpu_variable {bool oldbit; - asm volatile("bt "__percpu_arg(2)",%1" + asm volatile("btl "__percpu_arg(2)",%1" CC_SET(c) : CC_OUT(c) (oldbit) : "m" (*(unsigned long __percpu *)addr), "Ir" (nr));
Greg Kroah-Hartman
maintainerPATCH 80/114 net: phy: micrel: Use strlcpy() for ethtool::get_strings
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
commit 55f53567afe5f0cd2fd9e006b174c08c31c466f8 upstream.
Our statistics strings are allocated at initialization without being bound to a specific size, yet, we would copy ETH_GSTRING_LEN bytes using memcpy() which would create out of bounds accesses, this was flagged by KASAN. Replace this with strlcpy() to make sure we are bound the source buffer size and we also always NUL-terminate strings.
--- drivers/net/phy/micrel.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/phy/micrel.c +2 -2
@@ -674,8 +674,8 @@ static void kszphy_get_strings(struct phint i;for (i =0 ; i <ARRAY_SIZE (kszphy_hw_stats); i++) { -memcpy (data + i *ETH_GSTRING_LEN , - kszphy_hw_stats[i].string,ETH_GSTRING_LEN ); +strlcpy (data + i *ETH_GSTRING_LEN , + kszphy_hw_stats[i].string,ETH_GSTRING_LEN ); } }
Greg Kroah-Hartman
maintainerPATCH 81/114 net: fix a potential recursive NETDEV_FEAT_CHANGE
In reply to Greg Kroah-HartmanFrom: Cong Wang <[email protected]>
[ Upstream commit dd912306ff008891c82cd9f63e8181e47a9cb2fb ]
syzbot managed to trigger a recursive NETDEV_FEAT_CHANGE event between bonding master and slave. I managed to find a reproducer for this:
ip li set bond0 up
ifenslave bond0 eth0
brctl addbr br0
ethtool -K eth0 lro off
brctl addif br0 bond0
ip li set br0 up
When a NETDEV_FEAT_CHANGE event is triggered on a bonding slave, it captures this and calls bond_compute_features() to fixup its master's and other slaves' features. However, when syncing with its lower devices by netdev_sync_lower_features() this event is triggered again on slaves when the LRO feature fails to change, so it goes back and forth recursively until the kernel stack is exhausted.
Commit 17b85d29e82c intentionally lets __netdev_update_features() return -1 for such a failure case, so we have to just rely on the existing check inside netdev_sync_lower_features() and skip NETDEV_FEAT_CHANGE event only for this specific failure case.
--- net/core/dev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/dev.c +3 -1
@@ -7282,11 +7282,13 @@ static void netdev_sync_lower_features(snetdev_dbg (upper,"Disabling feature %pNF on lower dev %s.\n" , &feature, lower->name); lower->wanted_features &= ~feature; -netdev_update_features (lower); +__netdev_update_features (lower);if (unlikely (lower->features & feature))netdev_WARN (upper,"failed to disable %pNF on %s!\n" , &feature, lower->name); +else +netdev_features_change (lower); } } }
Greg Kroah-Hartman
maintainerPATCH 82/114 netlabel: cope with NULL catmap
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit eead1c2ea2509fd754c6da893a94f0e69e83ebe4 ]
The cipso and calipso code can set the MLS_CAT attribute on successful parsing, even if the corresponding catmap has not been allocated, as per current configuration and external input.
Later, selinux code tries to access the catmap if the MLS_CAT flag is present via netlbl_catmap_getlong(). That may cause null ptr dereference while processing incoming network traffic.
Address the issue setting the MLS_CAT flag only if the catmap is really allocated. Additionally let netlbl_catmap_getlong() cope with NULL catmap.
--- net/ipv4/cipso_ipv4.c | 6 ++++-- net/ipv6/calipso.c | 3 ++- net/netlabel/netlabel_kapi.c | 6 ++++++ 3 files changed, 12 insertions(+), 3 deletions(-)
net/ipv4/cipso_ipv4.c +4 -2
@@ -1272,7 +1272,8 @@ static int cipso_v4_parsetag_rbm(const sreturn ret_val; } - secattr->flags |=NETLBL_SECATTR_MLS_CAT ; +if (secattr->attr.mls.cat) + secattr->flags |=NETLBL_SECATTR_MLS_CAT ; }return 0 ;
@@ -1453,7 +1454,8 @@ static int cipso_v4_parsetag_rng(const sreturn ret_val; } - secattr->flags |=NETLBL_SECATTR_MLS_CAT ; +if (secattr->attr.mls.cat) + secattr->flags |=NETLBL_SECATTR_MLS_CAT ; }return 0 ;
net/ipv6/calipso.c +2 -1
@@ -1061,7 +1061,8 @@ static int calipso_opt_getattr(const uns goto getattr_return; } - secattr->flags |=NETLBL_SECATTR_MLS_CAT ; +if (secattr->attr.mls.cat) + secattr->flags |=NETLBL_SECATTR_MLS_CAT ; } secattr->type =NETLBL_NLTYPE_CALIPSO ;
net/netlabel/netlabel_kapi.c +6 -0
@@ -748,6 +748,12 @@ int netlbl_catmap_getlong(struct netlbl_if ((off & (BITS_PER_LONG -1 )) !=0 )return -EINVAL ; +/* a null catmap is equivalent to an empty one */ +if (!catmap) { + *offset = (u32)-1 ; +return 0 ; + } +if (off < catmap->startbit) { off = catmap->startbit; *offset = off;
Greg Kroah-Hartman
maintainerPATCH 83/114 net: phy: fix aneg restart in phy_ethtool_set_eee
In reply to Greg Kroah-HartmanFrom: Heiner Kallweit <[email protected]>
[ Upstream commit 9de5d235b60a7cdfcdd5461e70c5663e713fde87 ]
phy_restart_aneg() enables aneg in the PHY. That's not what we want if phydev->autoneg is disabled. In this case still update EEE advertisement register, but don't enable aneg and don't trigger an aneg restart.
--- drivers/net/phy/phy.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/net/phy/phy.c +5 -3
@@ -1257,9 +1257,11 @@ int phy_ethtool_set_eee(struct phy_devic/* Restart autonegotiation so the new modes get sent to the * link partner. */ - ret =phy_restart_aneg (phydev); -if (ret <0 ) -return ret; +if (phydev->autoneg ==AUTONEG_ENABLE ) { + ret =phy_restart_aneg (phydev); +if (ret <0 ) +return ret; + } }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 84/114 Revert "ipv6: add mtu lock check in __ip6_rt_update_pmtu"
In reply to Greg Kroah-HartmanFrom: "Maciej Żenczykowski" <[email protected]>
[ Upstream commit 09454fd0a4ce23cb3d8af65066c91a1bf27120dd ]
This reverts commit 19bda36c4299ce3d7e5bce10bebe01764a655a6d:
| ipv6: add mtu lock check in __ip6_rt_update_pmtu | | Prior to this patch, ipv6 didn't do mtu lock check in ip6_update_pmtu. | It leaded to that mtu lock doesn't really work when receiving the pkt | of ICMPV6_PKT_TOOBIG. | | This patch is to add mtu lock check in __ip6_rt_update_pmtu just as ipv4 | did in __ip_rt_update_pmtu.
The above reasoning is incorrect. IPv6 *requires* icmp based pmtu to work. There's already a comment to this effect elsewhere in the kernel:
$ git grep -p -B1 -A3 'RTAX_MTU lock' net/ipv6/route.c=4813=
static int rt6_mtu_change_route(struct fib6_info *f6i, void *p_arg)
...
/* In IPv6 pmtu discovery is not optional,
so that RTAX_MTU lock cannot disable it.
We still use this lock to block changes
caused by addrconf/ndisc.
*/
This reverts to the pre-4.9 behaviour.
--- net/ipv6/route.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv6/route.c +4 -2
@@ -1479,8 +1479,10 @@ static void __ip6_rt_update_pmtu(structconst struct in6_addr *daddr, *saddr;struct rt6_info *rt6 = (struct rt6_info *)dst; -if (dst_metric_locked (dst,RTAX_MTU )) -return ; +/* Note: do *NOT* check dst_metric_locked(dst, RTAX_MTU) +* IPv6 pmtu discovery isn't optional, so 'mtu lock' cannot disable it. +* [see also comment in rt6_mtu_change_route()] +*/ if (iph) { daddr = &iph->daddr;
Greg Kroah-Hartman
maintainerPATCH 85/114 hinic: fix a bug of ndo_stop
In reply to Greg Kroah-HartmanFrom: Luo bin <[email protected]>
[ Upstream commit e8a1b0efd632d1c9db7d4e93da66377c7b524862 ]
if some function in ndo_stop interface returns failure because of hardware fault, must go on excuting rest steps rather than return failure directly, otherwise will cause memory leak.And bump the timeout for SET_FUNC_STATE to ensure that cmd won't return failure when hw is busy. Otherwise hw may stomp host memory if we free memory regardless of the return value of SET_FUNC_STATE.
--- drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c | 16 ++++++++++++---- drivers/net/ethernet/huawei/hinic/hinic_main.c | 18 +++--------------- 2 files changed, 15 insertions(+), 19 deletions(-)
drivers/net/ethernet/huawei/hinic/hinic_hw_mgmt.c +12 -4
@@ -54,6 +54,8 @@#define MGMT_MSG_TIMEOUT 5000 +#define SET_FUNC_PORT_MGMT_TIMEOUT 25000 +#define mgmt_to_pfhwdev (pf_mgmt) \ container_of(pf_mgmt, struct hinic_pfhwdev, pf_to_mgmt)
@@ -247,12 +249,13 @@ static int msg_to_mgmt_sync(struct hinic u8 *buf_in, u16 in_size, u8 *buf_out, u16 *out_size, enum mgmt_direction_type direction, - u16 resp_msg_id) + u16 resp_msg_id, u32 timeout) { struct hinic_hwif *hwif = pf_to_mgmt->hwif;struct pci_dev *pdev = hwif->pdev;struct hinic_recv_msg *recv_msg;struct completion *recv_done; +unsigned long timeo;u16 msg_id;int err;
@@ -276,8 +279,9 @@ static int msg_to_mgmt_sync(struct hinic goto unlock_sync_msg; } -if (!wait_for_completion_timeout (recv_done, -msecs_to_jiffies (MGMT_MSG_TIMEOUT ))) { + timeo =msecs_to_jiffies (timeout ? timeout :MGMT_MSG_TIMEOUT ); + +if (!wait_for_completion_timeout (recv_done, timeo)) {dev_err (&pdev->dev,"MGMT timeout, MSG id = %d\n" , msg_id); err = -ETIMEDOUT ; goto unlock_sync_msg;
@@ -351,6 +355,7 @@ int hinic_msg_to_mgmt(struct hinic_pf_to {struct hinic_hwif *hwif = pf_to_mgmt->hwif;struct pci_dev *pdev = hwif->pdev; +u32 timeout =0 ;if (sync !=HINIC_MGMT_MSG_SYNC ) {dev_err (&pdev->dev,"Invalid MGMT msg type\n" );
@@ -362,9 +367,12 @@ int hinic_msg_to_mgmt(struct hinic_pf_toreturn -EINVAL ; } +if (cmd ==HINIC_PORT_CMD_SET_FUNC_STATE ) + timeout =SET_FUNC_PORT_MGMT_TIMEOUT ; +return msg_to_mgmt_sync (pf_to_mgmt, mod, cmd, buf_in, in_size, buf_out, out_size,MGMT_DIRECT_SEND , -MSG_NOT_RESP ); +MSG_NOT_RESP , timeout); }/**
drivers/net/ethernet/huawei/hinic/hinic_main.c +3 -15
@@ -473,7 +473,6 @@ static int hinic_close(struct net_device {struct hinic_dev *nic_dev =netdev_priv (netdev);unsigned int flags; -int err;down (&nic_dev->mgmt_lock);
@@ -487,20 +486,9 @@ static int hinic_close(struct net_deviceup (&nic_dev->mgmt_lock); - err =hinic_port_set_func_state (nic_dev,HINIC_FUNC_PORT_DISABLE ); -if (err) { -netif_err (nic_dev, drv, netdev, -"Failed to set func port state\n" ); - nic_dev->flags |= (flags &HINIC_INTF_UP ); -return err; - } - - err =hinic_port_set_state (nic_dev,HINIC_PORT_DISABLE ); -if (err) { -netif_err (nic_dev, drv, netdev,"Failed to set port state\n" ); - nic_dev->flags |= (flags &HINIC_INTF_UP ); -return err; - } +hinic_port_set_state (nic_dev,HINIC_PORT_DISABLE ); + +hinic_port_set_func_state (nic_dev,HINIC_FUNC_PORT_DISABLE );free_rxqs (nic_dev);free_txqs (nic_dev);
Greg Kroah-Hartman
maintainerPATCH 86/114 net: dsa: loop: Add module soft dependency
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 3047211ca11bf77b3ecbce045c0aa544d934b945 ]
There is a soft dependency against dsa_loop_bdinfo.ko which sets up the MDIO device registration, since there are no symbols referenced by dsa_loop.ko, there is no automatic loading of dsa_loop_bdinfo.ko which is needed.
--- drivers/net/dsa/dsa_loop.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/dsa/dsa_loop.c +1 -0
@@ -357,6 +357,7 @@ static void __exit dsa_loop_exit(void) }module_exit (dsa_loop_exit); +MODULE_SOFTDEP ("pre: dsa_loop_bdinfo" );MODULE_LICENSE ("GPL" );MODULE_AUTHOR ("Florian Fainelli" );MODULE_DESCRIPTION ("DSA loopback driver" );
Greg Kroah-Hartman
maintainerPATCH 87/114 net: ipv4: really enforce backoff for redirects
In reply to Greg Kroah-HartmanFrom: Paolo Abeni <[email protected]>
[ Upstream commit 57644431a6c2faac5d754ebd35780cf43a531b1a ]
In commit b406472b5ad7 ("net: ipv4: avoid mixed n_redirects and rate_tokens usage") I missed the fact that a 0 'rate_tokens' will bypass the backoff algorithm.
Since rate_tokens is cleared after a redirect silence, and never incremented on redirects, if the host keeps receiving packets requiring redirect it will reply ignoring the backoff.
Additionally, the 'rate_last' field will be updated with the cadence of the ingress packet requiring redirect. If that rate is high enough, that will prevent the host from generating any other kind of ICMP messages
The check for a zero 'rate_tokens' value was likely a shortcut to avoid the more complex backoff algorithm after a redirect silence period. Address the issue checking for 'n_redirects' instead, which is incremented on successful redirect, and does not interfere with other ICMP replies.
--- net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/route.c +1 -1
@@ -921,7 +921,7 @@ void ip_rt_send_redirect(struct sk_buff/* Check for load limit; set rate_last to the latest sent * redirect. */ -if (peer->rate_tokens ==0 || +if (peer->n_redirects ==0 ||time_after (jiffies, (peer->rate_last + (ip_rt_redirect_load << peer->n_redirects)))) {
Greg Kroah-Hartman
maintainerPATCH 88/114 netprio_cgroup: Fix unlimited memory leak of v2 cgroups
In reply to Greg Kroah-HartmanFrom: Zefan Li <[email protected]>
[ Upstream commit 090e28b229af92dc5b40786ca673999d59e73056 ]
If systemd is configured to use hybrid mode which enables the use of both cgroup v1 and v2, systemd will create new cgroup on both the default root (v2) and netprio_cgroup hierarchy (v1) for a new session and attach task to the two cgroups. If the task does some network thing then the v2 cgroup can never be freed after the session exited.
One of our machines ran into OOM due to this memory leak.
In the scenario described above when sk_alloc() is called cgroup_sk_alloc() thought it's in v2 mode, so it stores the cgroup pointer in sk->sk_cgrp_data and increments the cgroup refcnt, but then sock_update_netprioidx() thought it's in v1 mode, so it stores netprioidx value in sk->sk_cgrp_data, so the cgroup refcnt will never be freed.
Currently we do the mode switch when someone writes to the ifpriomap cgroup control file. The easiest fix is to also do the switch when a task is attached to a new cgroup.
--- net/core/netprio_cgroup.c | 2 ++ 1 file changed, 2 insertions(+)
net/core/netprio_cgroup.c +2 -0
@@ -241,6 +241,8 @@ static void net_prio_attach(struct cgroustruct task_struct *p;struct cgroup_subsys_state *css; +cgroup_sk_alloc_disable (); +cgroup_taskset_for_each (p, css, tset) {void *v = (void *)(unsigned long )css->cgroup->id;
Greg Kroah-Hartman
maintainerPATCH 89/114 net: tcp: fix rx timestamp behavior for tcp_recvmsg
In reply to Greg Kroah-HartmanFrom: Kelly Littlepage <[email protected]>
[ Upstream commit cc4de047b33be247f9c8150d3e496743a49642b8 ]
The stated intent of the original commit is to is to "return the timestamp corresponding to the highest sequence number data returned." The current implementation returns the timestamp for the last byte of the last fully read skb, which is not necessarily the last byte in the recv buffer. This patch converts behavior to the original definition, and to the behavior of the previous draft versions of commit 98aaa913b4ed ("tcp: Extend SOF_TIMESTAMPING_RX_SOFTWARE to TCP recvmsg") which also match this behavior.
--- net/ipv4/tcp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
net/ipv4/tcp.c +4 -2
@@ -1977,13 +1977,15 @@ skip_copy: tp->urg_data =0 ;tcp_fast_path_check (sk); } -if (used + offset < skb->len) -continue ;if (TCP_SKB_CB (skb)->has_rxtstamp) {tcp_update_recv_tstamps (skb, &tss); has_tss = true; } + +if (used + offset < skb->len) +continue ; +if (TCP_SKB_CB (skb)->tcp_flags &TCPHDR_FIN ) goto found_fin_ok;if (!(flags &MSG_PEEK ))
Greg Kroah-Hartman
maintainerPATCH 90/114 ALSA: hda/realtek - Limit int mic boost for Thinkpad T530
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit b590b38ca305d6d7902ec7c4f7e273e0069f3bcc upstream.
Lenovo Thinkpad T530 seems to have a sensitive internal mic capture that needs to limit the mic boost like a few other Thinkpad models. Although we may change the quirk for ALC269_FIXUP_LENOVO_DOCK, this hits way too many other laptop models, so let's add a new fixup model that limits the internal mic boost on top of the existing quirk and apply to only T530.
--- sound/pci/hda/patch_realtek.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +9 -1
@@ -5433,6 +5433,7 @@ enum {ALC269_FIXUP_HP_LINE1_MIC1_LED ,ALC269_FIXUP_INV_DMIC ,ALC269_FIXUP_LENOVO_DOCK , +ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST ,ALC269_FIXUP_NO_SHUTUP ,ALC286_FIXUP_SONY_MIC_NO_PRESENCE , ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT,
@@ -5726,6 +5727,12 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT }, + [ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc269_fixup_limit_int_mic_boost, + .chained = true, + .chain_id = ALC269_FIXUP_LENOVO_DOCK, + }, [ALC269_FIXUP_PINCFG_NO_HP_TO_LINEOUT] = { .type = HDA_FIXUP_FUNC, .v.func = alc269_fixup_pincfg_no_hp_to_lineout,
@@ -6612,7 +6619,7 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x21b8 ,"Thinkpad Edge 14" ,ALC269_FIXUP_SKU_IGNORE ),SND_PCI_QUIRK (0x17aa ,0x21ca ,"Thinkpad L412" ,ALC269_FIXUP_SKU_IGNORE ),SND_PCI_QUIRK (0x17aa ,0x21e9 ,"Thinkpad Edge 15" ,ALC269_FIXUP_SKU_IGNORE ), -SND_PCI_QUIRK (0x17aa ,0x21f6 ,"Thinkpad T530" ,ALC269_FIXUP_LENOVO_DOCK ), +SND_PCI_QUIRK (0x17aa ,0x21f6 ,"Thinkpad T530" ,ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST ),SND_PCI_QUIRK (0x17aa ,0x21fa ,"Thinkpad X230" ,ALC269_FIXUP_LENOVO_DOCK ),SND_PCI_QUIRK (0x17aa ,0x21f3 ,"Thinkpad T430" ,ALC269_FIXUP_LENOVO_DOCK ), SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK),
@@ -6744,6 +6751,7 @@ static const struct hda_model_fixup alc2 {.id = ALC269_FIXUP_HEADSET_MODE, .name = "headset-mode"}, {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"}, {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"}, + {.id = ALC269_FIXUP_LENOVO_DOCK_LIMIT_BOOST, .name = "lenovo-dock-limit-boost"}, {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"}, {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"}, {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"},
Greg Kroah-Hartman
maintainerPATCH 91/114 ALSA: rawmidi: Initialize allocated buffers
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5a7b44a8df822e0667fc76ed7130252523993bda upstream.
syzbot reported the uninitialized value exposure in certain situations using virmidi loop. It's likely a very small race at writing and reading, and the influence is almost negligible. But it's safer to paper over this just by replacing the existing kvmalloc() with kvzalloc().
--- sound/core/rawmidi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/core/rawmidi.c +2 -2
@@ -125,7 +125,7 @@ static int snd_rawmidi_runtime_create(st runtime->avail =0 ; else runtime->avail = runtime->buffer_size; -if ((runtime->buffer =kmalloc (runtime->buffer_size,GFP_KERNEL )) ==NULL ) { +if ((runtime->buffer =kzalloc (runtime->buffer_size,GFP_KERNEL )) ==NULL ) {kfree (runtime);return -ENOMEM ; }
@@ -650,7 +650,7 @@ int snd_rawmidi_output_params(struct sndreturn -EINVAL ; }if (params->buffer_size != runtime->buffer_size) { - newbuf =kmalloc (params->buffer_size,GFP_KERNEL ); + newbuf =kzalloc (params->buffer_size,GFP_KERNEL );if (!newbuf)return -ENOMEM ;spin_lock_irq (&runtime->lock);
Greg Kroah-Hartman
maintainerPATCH 92/114 ALSA: rawmidi: Fix racy buffer resize under concurrent accesses
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit c1f6e3c818dd734c30f6a7eeebf232ba2cf3181d upstream.
The rawmidi core allows user to resize the runtime buffer via ioctl, and this may lead to UAF when performed during concurrent reads or
writes: the read/write functions unlock the runtime lock temporarily during copying form/to user-space, and that's the race window.
This patch fixes the hole by introducing a reference counter for the runtime buffer read/write access and returns -EBUSY error when the resize is performed concurrently against read/write.
Note that the ref count field is a simple integer instead of refcount_t here, since the all contexts accessing the buffer is basically protected with a spinlock, hence we need no expensive atomic ops. Also, note that this busy check is needed only against read / write functions, and not in receive/transmit callbacks; the race can happen only at the spinlock hole mentioned in the above, while the whole function is protected for receive / transmit callbacks.
--- include/sound/rawmidi.h | 1 + sound/core/rawmidi.c | 31 +++++++++++++++++++++++++++---- 2 files changed, 28 insertions(+), 4 deletions(-)
include/sound/rawmidi.h +1 -0
@@ -76,6 +76,7 @@ struct snd_rawmidi_runtime {size_t avail_min;/* min avail for wakeup */ size_t avail;/* max used buffer for wakeup */ size_t xruns;/* over/underruns counter */ +int buffer_ref;/* buffer reference count */ /* misc */ spinlock_t lock;wait_queue_head_t sleep;
sound/core/rawmidi.c +27 -4
@@ -108,6 +108,17 @@ static void snd_rawmidi_input_event_work runtime->event (runtime->substream); } +/* buffer refcount management: call with runtime->lock held */ +static inline void snd_rawmidi_buffer_ref (struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref++; +} + +static inline void snd_rawmidi_buffer_unref (struct snd_rawmidi_runtime *runtime) +{ + runtime->buffer_ref--; +} +static int snd_rawmidi_runtime_create (struct snd_rawmidi_substream *substream) {struct snd_rawmidi_runtime *runtime;
@@ -654,6 +665,11 @@ int snd_rawmidi_output_params(struct sndif (!newbuf)return -ENOMEM ;spin_lock_irq (&runtime->lock); +if (runtime->buffer_ref) { +spin_unlock_irq (&runtime->lock); +kfree (newbuf); +return -EBUSY ; + } oldbuf = runtime->buffer; runtime->buffer = newbuf; runtime->buffer_size = params->buffer_size;
@@ -962,8 +978,10 @@ static long snd_rawmidi_kernel_read1(strlong result =0 , count1;struct snd_rawmidi_runtime *runtime = substream->runtime;unsigned long appl_ptr; +int err =0 ;spin_lock_irqsave (&runtime->lock, flags); +snd_rawmidi_buffer_ref (runtime);while (count >0 && runtime->avail) { count1 = runtime->buffer_size - runtime->appl_ptr;if (count1 > count)
@@ -982,16 +1000,19 @@ static long snd_rawmidi_kernel_read1(strif (userbuf) {spin_unlock_irqrestore (&runtime->lock, flags);if (copy_to_user (userbuf + result, - runtime->buffer + appl_ptr, count1)) { -return result >0 ? result : -EFAULT ; - } + runtime->buffer + appl_ptr, count1)) + err = -EFAULT ;spin_lock_irqsave (&runtime->lock, flags); +if (err) + goto out; } result += count1; count -= count1; } + out: +snd_rawmidi_buffer_unref (runtime);spin_unlock_irqrestore (&runtime->lock, flags); -return result; +return result >0 ? result : err; } long snd_rawmidi_kernel_read(struct snd_rawmidi_substream *substream,
@@ -1262,6 +1283,7 @@ static long snd_rawmidi_kernel_write1(streturn -EAGAIN ; } } +snd_rawmidi_buffer_ref (runtime);while (count >0 && runtime->avail >0 ) { count1 = runtime->buffer_size - runtime->appl_ptr;if (count1 > count)
@@ -1293,6 +1315,7 @@ static long snd_rawmidi_kernel_write1(st } __end: count1 = runtime->avail < runtime->buffer_size; +snd_rawmidi_buffer_unref (runtime);spin_unlock_irqrestore (&runtime->lock, flags);if (count1)snd_rawmidi_output_trigger (substream,1 );
Greg Kroah-Hartman
maintainerPATCH 93/114 ARM: dts: dra7: Fix bus_dma_limit for PCIe
In reply to Greg Kroah-HartmanFrom: Kishon Vijay Abraham I <[email protected]>
commit 90d4d3f4ea45370d482fa609dbae4d2281b4074f upstream.
Even though commit cfb5d65f2595 ("ARM: dts: dra7: Add bus_dma_limit for L3 bus") added bus_dma_limit for L3 bus, the PCIe controller gets incorrect value of bus_dma_limit.
Fix it by adding empty dma-ranges property to axi@0 and axi@1 (parent device tree node of PCIe controller).
--- arch/arm/boot/dts/dra7.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/dra7.dtsi +2 -2
@@ -289,6 +289,7 @@ #address-cells = <1>; ranges = <0x51000000 0x51000000 0x3000 0x0 0x20000000 0x10000000>; + dma-ranges; /** * To enable PCI endpoint mode, disable the pcie1_rc * node and enable pcie1_ep mode.
@@ -303,7 +304,6 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x20013000 0x13000 0 0xffed000>; - dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>;
@@ -347,6 +347,7 @@ #address-cells = <1>; ranges = <0x51800000 0x51800000 0x3000 0x0 0x30000000 0x10000000>; + dma-ranges; status = "disabled"; pcie@51800000 { compatible = "ti,dra7-pcie";
@@ -358,7 +359,6 @@ device_type = "pci"; ranges = <0x81000000 0 0 0x03000 0 0x00010000 0x82000000 0 0x30013000 0x13000 0 0xffed000>; - dma-ranges = <0x02000000 0x0 0x00000000 0x00000000 0x1 0x00000000>; bus-range = <0x00 0xff>; #interrupt-cells = <1>; num-lanes = <1>;
Greg Kroah-Hartman
maintainerPATCH 94/114 ARM: dts: imx27-phytec-phycard-s-rdk: Fix the I2C1 pinctrl entries
In reply to Greg Kroah-HartmanFrom: Fabio Estevam <[email protected]>
commit 0caf34350a25907515d929a9c77b9b206aac6d1e upstream.
The I2C2 pins are already used and the following errors are seen:
imx27-pinctrl 10015000.iomuxc: pin MX27_PAD_I2C2_SDA already requested by 10012000.i2c; cannot claim for 1001d000.i2c imx27-pinctrl 10015000.iomuxc: pin-69 (1001d000.i2c) status -22
imx27-pinctrl 10015000.iomuxc: could not request pin 69 (MX27_PAD_I2C2_SDA) from group i2c2grp on device 10015000.iomuxc imx-i2c 1001d000.i2c: Error applying setting, reverse things back
imx-i2c: probe of 1001d000.i2c failed with error -22
Fix it by adding the correct I2C1 IOMUX entries for the pinctrl_i2c1 group.
--- arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/imx27-phytec-phycard-s-rdk.dts +2 -2
@@ -81,8 +81,8 @@ imx27-phycard-s-rdk { pinctrl_i2c1: i2c1grp { fsl,pins = < - MX27_PAD_I2C2_SDA__I2C2_SDA 0x0 - MX27_PAD_I2C2_SCL__I2C2_SCL 0x0 + MX27_PAD_I2C_DATA__I2C_DATA 0x0 + MX27_PAD_I2C_CLK__I2C_CLK 0x0 >; };
Greg Kroah-Hartman
maintainerPATCH 95/114 x86: Fix early boot crash on gcc-10, third try
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
commit a9a3ed1eff3601b63aea4fb462d8b3b92c7c1e7e upstream.
... or the odyssey of trying to disable the stack protector for the function which generates the stack canary value.
The whole story started with Sergei reporting a boot crash with a kernel built with gcc-10:
Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
Call Trace:
dump_stack
panic
? start_secondary
__stack_chk_fail
start_secondary
secondary_startup_64
-—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondaryThis happens because gcc-10 tail-call optimizes the last function call in start_secondary() - cpu_startup_entry() - and thus emits a stack canary check which fails because the canary value changes after the boot_init_stack_canary() call.
To fix that, the initial attempt was to mark the one function which generates the stack canary with:
__attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused)
however, using the optimize attribute doesn't work cumulatively as the attribute does not add to but rather replaces previously supplied optimization options - roughly all -fxxx options.
The key one among them being -fno-omit-frame-pointer and thus leading to not present frame pointer - frame pointer which the kernel needs.
The next attempt to prevent compilers from tail-call optimizing the last function call cpu_startup_entry(), shy of carving out start_secondary() into a separate compilation unit and building it with -fno-stack-protector, was to add an empty asm("").
This current solution was short and sweet, and reportedly, is supported by both compilers but we didn't get very far this time: future (LTO?) optimization passes could potentially eliminate this, which leads us to the third attempt: having an actual memory barrier there which the compiler cannot ignore or move around etc.
That should hold for a long time, but hey we said that about the other two solutions too so...
--- arch/x86/include/asm/stackprotector.h | 7 ++++++- arch/x86/kernel/smpboot.c | 8 ++++++++ arch/x86/xen/smp_pv.c | 1 + include/linux/compiler.h | 6 ++++++ init/main.c | 2 ++ 5 files changed, 23 insertions(+), 1 deletion(-)
arch/x86/include/asm/stackprotector.h +6 -1
@@ -55,8 +55,13 @@/* * Initialize the stackprotector canary value. * -* NOTE: this must only be called from functions that never return, +* NOTE: this must only be called from functions that never return * and it must always be inlined. +* +* In addition, it should be called from a compilation unit for which +* stack protector is disabled. Alternatively, the caller should not end +* with a function call which gets tail-call optimized as that would +* lead to checking a modified canary value. */ static __always_inline void boot_init_stack_canary(void) {
arch/x86/kernel/smpboot.c +8 -0
@@ -270,6 +270,14 @@ static void notrace start_secondary(voidwmb ();cpu_startup_entry (CPUHP_AP_ONLINE_IDLE ); + +/* +* Prevent tail call to cpu_startup_entry() because the stack protector +* guard has been changed a couple of function calls up, in +* boot_init_stack_canary() and must not be checked before tail calling +* another function. +*/ +prevent_tail_call_optimization (); }/**
arch/x86/xen/smp_pv.c +1 -0
@@ -89,6 +89,7 @@ asmlinkage __visible void cpu_bringup_an {cpu_bringup ();cpu_startup_entry (CPUHP_AP_ONLINE_IDLE ); +prevent_tail_call_optimization (); }void xen_smp_intr_free_pv (unsigned int cpu)
include/linux/compiler.h +6 -0
@@ -382,4 +382,10 @@ unsigned long read_word_at_a_time(const (_________p1); \ }) +/* +* This is needed in functions which generate the stack canary, see +* arch/x86/kernel/smpboot.c::start_secondary() for an example. +*/ +#define prevent_tail_call_optimization () mb() +#endif /* __LINUX_COMPILER_H */
init/main.c +2 -0
@@ -706,6 +706,8 @@ asmlinkage __visible void __init start_k/* Do the rest non-__init'ed, we're now alive */ rest_init (); + +prevent_tail_call_optimization (); }/* Call all constructor functions linked into the kernel. */
Greg Kroah-Hartman
maintainerPATCH 96/114 ALSA: usb-audio: Add control message quirk delay for Kingston HyperX headset
In reply to Greg Kroah-HartmanFrom: Jesus Ramos <[email protected]>
commit 073919e09ca445d4486968e3f851372ff44cf2b5 upstream.
Kingston HyperX headset with 0951:16ad also needs the same quirk for delaying the frequency controls.
--- sound/usb/quirks.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
sound/usb/quirks.c +5 -4
@@ -1318,13 +1318,14 @@ void snd_usb_ctl_msg_quirk(struct usb_de && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS)mdelay (20 ); -/* Zoom R16/24, Logitech H650e, Jabra 550a needs a tiny delay here, -* otherwise requests like get/set frequency return as failed despite -* actually succeeding. +/* Zoom R16/24, Logitech H650e, Jabra 550a, Kingston HyperX needs a tiny +* delay here, otherwise requests like get/set frequency return as +* failed despite actually succeeding. */ if ((chip->usb_id ==USB_ID (0x1686 ,0x00dd ) || chip->usb_id ==USB_ID (0x046d ,0x0a46 ) || - chip->usb_id ==USB_ID (0x0b0e ,0x0349 )) && + chip->usb_id ==USB_ID (0x0b0e ,0x0349 ) || + chip->usb_id ==USB_ID (0x0951 ,0x16ad )) && (requesttype &USB_TYPE_MASK ) ==USB_TYPE_CLASS )mdelay (1 ); }
Greg Kroah-Hartman
maintainerPATCH 97/114 usb: core: hub: limit HUB_QUIRK_DISABLE_AUTOSUSPEND to USB5534B
In reply to Greg Kroah-HartmanFrom: Eugeniu Rosca <[email protected]>
commit 76e1ef1d81a4129d7e2fb8c48c83b166d1c8e040 upstream.
On Tue, May 12, 2020 at 09:36:07PM +0800, Kai-Heng Feng wrote [1]:
Quoted 1 line
This patch prevents my Raven Ridge xHCI from getting runtime suspend.
The problem described in v5.6 commit 1208f9e1d758c9 ("USB: hub: Fix the broken detection of USB3 device in SMSC hub") applies solely to the USB5534B hub [2] present on the Kingfisher Infotainment Carrier Board, manufactured by Shimafuji Electric Inc [3].
Despite that, the aforementioned commit applied the quirk to _all_ hubs carrying vendor ID 0x424 (i.e. SMSC), of which there are more [4] than initially expected. Consequently, the quirk is now enabled on platforms carrying SMSC/Microchip hub models which potentially don't exhibit the original issue.
To avoid reports like [1], further limit the quirk's scope to USB5534B [2], by employing both Vendor and Product ID checks.
Tested on H3ULCB + Kingfisher rev. M05.
[1] https://lore.kernel.org/linux-renesas-soc/[email protected]/
[2] https://www.microchip.com/wwwproducts/en/USB5534B
[3] http://www.shimafuji.co.jp/wp/wp-content/uploads/2018/08/SBEV-RCAR-KF-M06Board_HWSpecificationEN_Rev130.pdf
[4] https://devicehunt.com/search/type/usb/vendor/0424/device/any
--- drivers/usb/core/hub.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/usb/core/hub.c +5 -1
@@ -37,6 +37,7 @@#define USB_VENDOR_GENESYS_LOGIC 0x05e3#define USB_VENDOR_SMSC 0x0424 +#define USB_PRODUCT_USB5534B 0x5534#define HUB_QUIRK_CHECK_PORT_AUTOSUSPEND 0x01#define HUB_QUIRK_DISABLE_AUTOSUSPEND 0x02
@@ -5317,8 +5318,11 @@ out_hdev_lock: }static const struct usb_device_id hub_id_table[] = { - { .match_flags =USB_DEVICE_ID_MATCH_VENDOR |USB_DEVICE_ID_MATCH_INT_CLASS , + { .match_flags =USB_DEVICE_ID_MATCH_VENDOR + |USB_DEVICE_ID_MATCH_PRODUCT + |USB_DEVICE_ID_MATCH_INT_CLASS , .idVendor =USB_VENDOR_SMSC , + .idProduct =USB_PRODUCT_USB5534B , .bInterfaceClass =USB_CLASS_HUB , .driver_info =HUB_QUIRK_DISABLE_AUTOSUSPEND }, { .match_flags =USB_DEVICE_ID_MATCH_VENDOR
Greg Kroah-Hartman
maintainerPATCH 98/114 usb: host: xhci-plat: keep runtime active when removing host
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 1449cb2c2253d37d998c3714aa9b95416d16d379 upstream.
While removing the host (e.g. for USB role switch from host to device), if runtime pm is enabled by user, below oops occurs on dwc3 and cdns3 platforms.
Keeping the xhci-plat device active during host removal, and disabling runtime pm before calling pm_runtime_set_suspended() fixes them.
oops1:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000240 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.4.3-00107-g64d454a-dirty Hardware name: FSL i.MX8MP EVK (DT) Workqueue: pm pm_runtime_work pstate: 60000005 (nZCv daif -PAN -UAO) pc : xhci_suspend+0x34/0x698 lr : xhci_plat_runtime_suspend+0x2c/0x38 sp : ffff800011ddbbc0 Call trace: xhci_suspend+0x34/0x698 xhci_plat_runtime_suspend+0x2c/0x38 pm_generic_runtime_suspend+0x28/0x40 __rpm_callback+0xd8/0x138 rpm_callback+0x24/0x98 rpm_suspend+0xe0/0x448 rpm_idle+0x124/0x140 pm_runtime_work+0xa0/0xf8 process_one_work+0x1dc/0x370 worker_thread+0x48/0x468 kthread+0xf0/0x120 ret_from_fork+0x10/0x1c
oops2:
usb 2-1: USB disconnect, device number 2
xhci-hcd xhci-hcd.1.auto: remove, state 4
usb usb2: USB disconnect, device number 1
xhci-hcd xhci-hcd.1.auto: USB bus 2 deregistered
xhci-hcd xhci-hcd.1.auto: remove, state 4
usb usb1: USB disconnect, device number 1
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000138 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 2 PID: 7 Comm: kworker/u8:0 Not tainted 5.6.0-rc4-next-20200304-03578 Hardware name: Freescale i.MX8QXP MEK (DT) Workqueue: 1-0050 tcpm_state_machine_work pstate: 20000005 (nzCv daif -PAN -UAO) pc : xhci_free_dev+0x214/0x270 lr : xhci_plat_runtime_resume+0x78/0x88 sp : ffff80001006b5b0 Call trace: xhci_free_dev+0x214/0x270 xhci_plat_runtime_resume+0x78/0x88 pm_generic_runtime_resume+0x30/0x48 __rpm_callback+0x90/0x148 rpm_callback+0x28/0x88 rpm_resume+0x568/0x758 rpm_resume+0x260/0x758 rpm_resume+0x260/0x758 __pm_runtime_resume+0x40/0x88 device_release_driver_internal+0xa0/0x1c8 device_release_driver+0x1c/0x28 bus_remove_device+0xd4/0x158 device_del+0x15c/0x3a0 usb_disable_device+0xb0/0x268 usb_disconnect+0xcc/0x300 usb_remove_hcd+0xf4/0x1dc xhci_plat_remove+0x78/0xe0 platform_drv_remove+0x30/0x50 device_release_driver_internal+0xfc/0x1c8 device_release_driver+0x1c/0x28 bus_remove_device+0xd4/0x158 device_del+0x15c/0x3a0 platform_device_del.part.0+0x20/0x90 platform_device_unregister+0x28/0x40 cdns3_host_exit+0x20/0x40 cdns3_role_stop+0x60/0x90 cdns3_role_set+0x64/0xd8 usb_role_switch_set_role.part.0+0x3c/0x68 usb_role_switch_set_role+0x20/0x30 tcpm_mux_set+0x60/0xf8 tcpm_reset_port+0xa4/0xf0 tcpm_detach.part.0+0x28/0x50 tcpm_state_machine_work+0x12ac/0x2360 process_one_work+0x1c8/0x470 worker_thread+0x50/0x428 kthread+0xfc/0x128 ret_from_fork+0x10/0x18 Code: c8037c02 35ffffa3 17ffe7c3 f9800011 (c85f7c01) ---[ end trace 45b1a173d2679e44 ]---
--- drivers/usb/host/xhci-plat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/host/xhci-plat.c +3 -1
@@ -334,6 +334,7 @@ static int xhci_plat_remove(struct platfstruct clk *clk = xhci->clk;struct usb_hcd *shared_hcd = xhci->shared_hcd; +pm_runtime_get_sync (&dev->dev); xhci->xhc_state |=XHCI_STATE_REMOVING ;usb_remove_hcd (shared_hcd);
@@ -347,8 +348,9 @@ static int xhci_plat_remove(struct platfclk_disable_unprepare (clk);usb_put_hcd (hcd); -pm_runtime_set_suspended (&dev->dev);pm_runtime_disable (&dev->dev); +pm_runtime_put_noidle (&dev->dev); +pm_runtime_set_suspended (&dev->dev);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 99/114 USB: gadget: fix illegal array access in binding with UDC
In reply to Greg Kroah-HartmanFrom: Kyungtae Kim <[email protected]>
commit 15753588bcd4bbffae1cca33c8ced5722477fe1f upstream.
FuzzUSB (a variant of syzkaller) found an illegal array access using an incorrect index while binding a gadget with UDC.
Reference: https://www.spinics.net/lists/linux-usb/msg194331.html
This bug occurs when a size variable used for a buffer
is misused to access its strcpy-ed buffer.
Given a buffer along with its size variable (taken from user input), from which, a new buffer is created using kstrdup().
Due to the original buffer containing 0 value in the middle,
the size of the kstrdup-ed buffer becomes smaller than that of the original. So accessing the kstrdup-ed buffer with the same size variable triggers memory access violation.
The fix makes sure no zero value in the buffer,
by comparing the strlen() of the orignal buffer with the size variable, so that the access to the kstrdup-ed buffer is safe.
BUG: KASAN: slab-out-of-bounds in gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 Read of size 1 at addr ffff88806a55dd7e by task syz-executor.0/17208 CPU: 2 PID: 17208 Comm: syz-executor.0 Not tainted 5.6.8 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132 gadget_dev_desc_UDC_store+0x1ba/0x200 drivers/usb/gadget/configfs.c:266 flush_write_buffer fs/configfs/file.c:251 [inline] configfs_write_file+0x2f1/0x4c0 fs/configfs/file.c:283 __vfs_write+0x85/0x110 fs/read_write.c:494 vfs_write+0x1cd/0x510 fs/read_write.c:558 ksys_write+0x18a/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x73/0xb0 fs/read_write.c:620 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe
--- drivers/usb/gadget/configfs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/gadget/configfs.c +3 -0
@@ -259,6 +259,9 @@ static ssize_t gadget_dev_desc_UDC_storechar *name;int ret; +if (strlen (page) < len) +return -EOVERFLOW ; + name =kstrdup (page,GFP_KERNEL );if (!name)return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 100/114 usb: xhci: Fix NULL pointer dereference when enqueuing trbs from urb sg list
In reply to Greg Kroah-HartmanFrom: Sriharsha Allenki <[email protected]>
commit 3c6f8cb92c9178fc0c66b580ea3df1fa3ac1155a upstream.
On platforms with IOMMU enabled, multiple SGs can be coalesced into one by the IOMMU driver. In that case the SG list processing as part of the completion of a urb on a bulk endpoint can result into a NULL pointer dereference with the below stack dump.
<6> Unable to handle kernel NULL pointer dereference at virtual address 0000000c <6> pgd = c0004000
<6> [0000000c] *pgd=00000000
<6> Internal error: Oops: 5 [#1] PREEMPT SMP ARM
<2> PC is at xhci_queue_bulk_tx+0x454/0x80c
<2> LR is at xhci_queue_bulk_tx+0x44c/0x80c
<2> pc : [<c08907c4>] lr : [<c08907bc>] psr: 000000d3
<2> sp : ca337c80 ip : 00000000 fp : ffffffff <2> r10: 00000000 r9 : 50037000 r8 : 00004000 <2> r7 : 00000000 r6 : 00004000 r5 : 00000000 r4 : 00000000 <2> r3 : 00000000 r2 : 00000082 r1 : c2c1a200 r0 : 00000000
<2> Flags: nzcv IRQs off FIQs off Mode SVC_32 ISA ARM Segment none <2> Control: 10c0383d Table: b412c06a DAC: 00000051
<6> Process usb-storage (pid: 5961, stack limit = 0xca336210) <snip>
<2> [<c08907c4>] (xhci_queue_bulk_tx)
<2> [<c0881b3c>] (xhci_urb_enqueue)
<2> [<c0831068>] (usb_hcd_submit_urb)
<2> [<c08350b4>] (usb_sg_wait)
<2> [<c089f384>] (usb_stor_bulk_transfer_sglist)
<2> [<c089f2c0>] (usb_stor_bulk_srb)
<2> [<c089fe38>] (usb_stor_Bulk_transport)
<2> [<c089f468>] (usb_stor_invoke_transport)
<2> [<c08a11b4>] (usb_stor_control_thread)
<2> [<c014a534>] (kthread)
The above NULL pointer dereference is the result of block_len and the sent_len set to zero after the first SG of the list when IOMMU driver is enabled. Because of this the loop of processing the SGs has run more than num_sgs which resulted in a sg_next on the last SG of the list which has SG_END set.
Fix this by check for the sg before any attributes of the sg are accessed.
--- drivers/usb/host/xhci-ring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/host/xhci-ring.c +2 -2
@@ -3403,8 +3403,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd */* New sg entry */ --num_sgs; sent_len -= block_len; -if (num_sgs !=0 ) { - sg =sg_next (sg); + sg =sg_next (sg); +if (num_sgs !=0 && sg) { block_len =sg_dma_len (sg); addr = (u64 )sg_dma_address (sg); addr += sent_len;
Greg Kroah-Hartman
maintainerPATCH 101/114 x86/unwind/orc: Fix error handling in __unwind_start()
In reply to Greg Kroah-HartmanFrom: Josh Poimboeuf <[email protected]>
commit 71c95825289f585014fe9741b051d32a7a916680 upstream.
The unwind_state 'error' field is used to inform the reliable unwinding code that the stack trace can't be trusted. Set this field for all errors in __unwind_start().
Also, move the zeroing out of the unwind_state struct to before the ORC table initialization check, to prevent the caller from reading uninitialized data if the ORC table is corrupted.
--- arch/x86/kernel/unwind_orc.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
arch/x86/kernel/unwind_orc.c +9 -7
@@ -505,23 +505,23 @@ EXPORT_SYMBOL_GPL(unwind_next_frame);void __unwind_start (struct unwind_state *state,struct task_struct *task,struct pt_regs *regs,unsigned long *first_frame) { -if (!orc_init) - goto done; -memset (state,0 ,sizeof (*state)); state->task = task; +if (!orc_init) + goto err; +/* * Refuse to unwind the stack of a task while it's executing on another * CPU. This check is racy, but that's ok: the unwinder has other * checks to prevent it from going off the rails. */ if (task_on_another_cpu (task)) - goto done; + goto err;if (regs) {if (user_mode (regs)) - goto done; + goto the_end; state->ip = regs->ip; state->sp =kernel_stack_pointer (regs);
@@ -554,6 +554,7 @@ void __unwind_start(struct unwind_state* generate some kind of backtrace if this happens. */ void *next_page = (void *)PAGE_ALIGN ((unsigned long )state->sp); + state->error = true;if (get_stack_info (next_page, state->task, &state->stack_info, &state->stack_mask))return ;
@@ -579,8 +580,9 @@ void __unwind_start(struct unwind_statereturn ; -done: +err: + state->error = true; +the_end: state->stack_info.type =STACK_TYPE_UNKNOWN ; -return ; }EXPORT_SYMBOL_GPL (__unwind_start);
Greg Kroah-Hartman
maintainerPATCH 102/114 exec: Move would_dump into flush_old_exec
In reply to Greg Kroah-HartmanFrom: Eric W. Biederman <[email protected]>
commit f87d1c9559164294040e58f5e3b74a162bf7c6e8 upstream.
I goofed when I added mm->user_ns support to would_dump. I missed the fact that in the case of binfmt_loader, binfmt_em86, binfmt_misc, and binfmt_script bprm->file is reassigned. Which made the move of would_dump from setup_new_exec to __do_execve_file before exec_binprm incorrect as it can result in would_dump running on the script instead of the interpreter of the script.
The net result is that the code stopped making unreadable interpreters undumpable. Which allows them to be ptraced and written to disk without special permissions. Oops.
The move was necessary because the call in set_new_exec was after bprm->mm was no longer valid.
To correct this mistake move the misplaced would_dump from __do_execve_file into flos_old_exec, before exec_mmap is called.
I tested and confirmed that without this fix I can attach with gdb to a script with an unreadable interpreter, and with this fix I can not.
--- fs/exec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/exec.c +2 -2
@@ -1264,6 +1264,8 @@ int flush_old_exec(struct linux_binprm **/ set_mm_exe_file (bprm->mm, bprm->file); +would_dump (bprm, bprm->file); +/* * Release all of the old mmap stuff */
@@ -1797,8 +1799,6 @@ static int do_execveat_common(int fd, stif (retval <0 ) goto out; -would_dump (bprm, bprm->file); - retval =exec_binprm (bprm);if (retval <0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 103/114 clk: rockchip: fix incorrect configuration of rk3228 aclk_gpu* clocks
In reply to Greg Kroah-HartmanFrom: Justin Swartz <[email protected]>
commit cec9d101d70a3509da9bd2e601e0b242154ce616 upstream.
The following changes prevent the unrecoverable freezes and rcu_sched stall warnings experienced in each of my attempts to take advantage of lima.
Replace the COMPOSITE_NOGATE definition of aclk_gpu_pre with a COMPOSITE that retains the selection of HDMIPHY as the PLL source, but instead makes uses of the aclk_gpu PLL source gate and parent names defined by mux_pll_src_4plls_p rather than mux_aclk_gpu_pre_p.
Remove the now unused mux_aclk_gpu_pre_p and the four named but also unused definitions (cpll_gpu, gpll_gpu, hdmiphy_gpu and usb480m_gpu) of the aclk_gpu PLL source gate.
Use the correct gate offset for aclk_gpu and aclk_gpu_noc.
--- drivers/clk/rockchip/clk-rk3228.c | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-)
drivers/clk/rockchip/clk-rk3228.c +4 -13
@@ -163,8 +163,6 @@ PNAME(mux_i2s_out_p) = { "i2s1_pre", "xPNAME (mux_i2s2_p) = {"i2s2_src" ,"i2s2_frac" ,"xin12m" };PNAME (mux_sclk_spdif_p) = {"sclk_spdif_src" ,"spdif_frac" ,"xin12m" }; -PNAME (mux_aclk_gpu_pre_p) = {"cpll_gpu" ,"gpll_gpu" ,"hdmiphy_gpu" ,"usb480m_gpu" }; -PNAME (mux_uart0_p) = {"uart0_src" ,"uart0_frac" ,"xin24m" };PNAME (mux_uart1_p) = {"uart1_src" ,"uart1_frac" ,"xin24m" };PNAME (mux_uart2_p) = {"uart2_src" ,"uart2_frac" ,"xin24m" };
@@ -475,16 +473,9 @@ static struct rockchip_clk_branch rk3228 RK2928_CLKSEL_CON(24), 6, 10, DFLAGS, RK2928_CLKGATE_CON(2), 8, GFLAGS), -GATE (0 ,"cpll_gpu" ,"cpll" ,0 , -RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), -GATE (0 ,"gpll_gpu" ,"gpll" ,0 , -RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), -GATE (0 ,"hdmiphy_gpu" ,"hdmiphy" ,0 , -RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), -GATE (0 ,"usb480m_gpu" ,"usb480m" ,0 , +COMPOSITE (0 ,"aclk_gpu_pre" , mux_pll_src_4plls_p,0 , +RK2928_CLKSEL_CON (34 ),5 ,2 ,MFLAGS ,0 ,5 ,DFLAGS ,RK2928_CLKGATE_CON (3 ),13 ,GFLAGS ), -COMPOSITE_NOGATE (0 ,"aclk_gpu_pre" , mux_aclk_gpu_pre_p,0 , -RK2928_CLKSEL_CON (34 ),5 ,2 ,MFLAGS ,0 ,5 ,DFLAGS ), COMPOSITE(SCLK_SPI0, "sclk_spi0", mux_pll_src_2plls_p, 0, RK2928_CLKSEL_CON(25), 8, 1, MFLAGS, 0, 7, DFLAGS,
@@ -589,8 +580,8 @@ static struct rockchip_clk_branch rk3228GATE (0 ,"pclk_peri_noc" ,"pclk_peri" ,CLK_IGNORE_UNUSED ,RK2928_CLKGATE_CON (12 ),2 ,GFLAGS ),/* PD_GPU */ -GATE (ACLK_GPU ,"aclk_gpu" ,"aclk_gpu_pre" ,0 ,RK2928_CLKGATE_CON (13 ),14 ,GFLAGS ), -GATE (0 ,"aclk_gpu_noc" ,"aclk_gpu_pre" ,0 ,RK2928_CLKGATE_CON (13 ),15 ,GFLAGS ), +GATE (ACLK_GPU ,"aclk_gpu" ,"aclk_gpu_pre" ,0 ,RK2928_CLKGATE_CON (7 ),14 ,GFLAGS ), +GATE (0 ,"aclk_gpu_noc" ,"aclk_gpu_pre" ,0 ,RK2928_CLKGATE_CON (7 ),15 ,GFLAGS ),/* PD_BUS */ GATE(0, "sclk_initmem_mbist", "aclk_cpu", 0, RK2928_CLKGATE_CON(8), 1, GFLAGS),
Greg Kroah-Hartman
maintainerPATCH 104/114 usb: gadget: net2272: Fix a memory leak in an error handling path in net2272_plat_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit ccaef7e6e354fb65758eaddd3eae8065a8b3e295 upstream.
'dev' is allocated in 'net2272_probe_init()'. It must be freed in the error handling path, as already done in the remove function (i.e. 'net2272_plat_remove()')
--- drivers/usb/gadget/udc/net2272.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/udc/net2272.c +2 -0
@@ -2666,6 +2666,8 @@ net2272_plat_probe(struct platform_devic err_req:release_mem_region (base, len); err: +kfree (dev); +return ret; }
Greg Kroah-Hartman
maintainerPATCH 105/114 usb: gadget: audio: Fix a missing error return value in audio_bind()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
commit 19b94c1f9c9a16d41a8de3ccbdb8536cf1aecdbf upstream.
If 'usb_otg_descriptor_alloc()' fails, we must return an error code, not 0.
--- drivers/usb/gadget/legacy/audio.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/audio.c +3 -1
@@ -303,8 +303,10 @@ static int audio_bind(struct usb_composistruct usb_descriptor_header *usb_desc; usb_desc =usb_otg_descriptor_alloc (cdev->gadget); -if (!usb_desc) +if (!usb_desc) { + status = -ENOMEM ; goto fail; + }usb_otg_descriptor_init (cdev->gadget, usb_desc); otg_desc[0 ] = usb_desc; otg_desc[1 ] =NULL ;
Greg Kroah-Hartman
maintainerPATCH 106/114 usb: gadget: legacy: fix error return code in gncm_bind()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
commit e27d4b30b71c66986196d8a1eb93cba9f602904a upstream.
If 'usb_otg_descriptor_alloc()' fails, we must return a negative error code -ENOMEM, not 0.
--- drivers/usb/gadget/legacy/ncm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/ncm.c +3 -1
@@ -162,8 +162,10 @@ static int gncm_bind(struct usb_compositstruct usb_descriptor_header *usb_desc; usb_desc =usb_otg_descriptor_alloc (gadget); -if (!usb_desc) +if (!usb_desc) { + status = -ENOMEM ; goto fail; + }usb_otg_descriptor_init (gadget, usb_desc); otg_desc[0 ] = usb_desc; otg_desc[1 ] =NULL ;
Greg Kroah-Hartman
maintainerPATCH 107/114 usb: gadget: legacy: fix error return code in cdc_bind()
In reply to Greg Kroah-HartmanFrom: Wei Yongjun <[email protected]>
commit e8f7f9e3499a6d96f7f63a4818dc7d0f45a7783b upstream.
If 'usb_otg_descriptor_alloc()' fails, we must return a negative error code -ENOMEM, not 0.
--- drivers/usb/gadget/legacy/cdc2.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/legacy/cdc2.c +3 -1
@@ -183,8 +183,10 @@ static int cdc_bind(struct usb_compositestruct usb_descriptor_header *usb_desc; usb_desc =usb_otg_descriptor_alloc (gadget); -if (!usb_desc) +if (!usb_desc) { + status = -ENOMEM ; goto fail1; + }usb_otg_descriptor_init (gadget, usb_desc); otg_desc[0 ] = usb_desc; otg_desc[1 ] =NULL ;
Greg Kroah-Hartman
maintainerPATCH 108/114 Revert "ALSA: hda/realtek: Fix pop noise on ALC225"
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
commit f41224efcf8aafe80ea47ac870c5e32f3209ffc8 upstream.
This reverts commit 3b36b13d5e69d6f51ff1c55d1b404a74646c9757.
Enable power save node breaks some systems with ACL225. Revert the patch and use a platform specific quirk for the original issue isntead.
--- sound/pci/hda/patch_realtek.c | 2 -- 1 file changed, 2 deletions(-)
sound/pci/hda/patch_realtek.c +0 -2
@@ -4691,8 +4691,6 @@ static void alc_determine_headset_type(s is_ctia = (val &0x1c02 ) ==0x1c02 ;break ;case 0x10ec0225 : - codec->power_save_node =1 ; -/* fall through */ case 0x10ec0295 :case 0x10ec0299 :alc_process_coef_fw (codec, alc225_pre_hsmode);
Greg Kroah-Hartman
maintainerPATCH 109/114 arm64: dts: rockchip: Replace RK805 PMIC node name with "pmic" on rk3328 boards
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
commit 83b994129fb4c18a8460fd395864a28740e5e7fb upstream.
In some board device tree files, "rk805" was used for the RK805 PMIC's node name. However the policy for device trees is that generic names should be used.
Replace the "rk805" node name with the generic "pmic" name.
--- arch/arm64/boot/dts/rockchip/rk3328-evb.dts | 2 +- arch/arm64/boot/dts/rockchip/rk3328-rock64.dts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3328-evb.dts +1 -1
@@ -91,7 +91,7 @@ &i2c1 { status = "okay"; - rk805: rk805@18 { + rk805: pmic@18 { compatible = "rockchip,rk805"; reg = <0x18>; interrupt-parent = <&gpio2>;
arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +1 -1
@@ -149,7 +149,7 @@ &i2c1 { status = "okay"; - rk805: rk805@18 { + rk805: pmic@18 { compatible = "rockchip,rk805"; reg = <0x18>; interrupt-parent = <&gpio2>;
Greg Kroah-Hartman
maintainerPATCH 110/114 arm64: dts: rockchip: Rename dwc3 device nodes on rk3399 to make dtc happy
In reply to Greg Kroah-HartmanFrom: Chen-Yu Tsai <[email protected]>
commit 190c7f6fd43a776d4a6da1dac44408104649e9b7 upstream.
The device tree compiler complains that the dwc3 nodes have regs properties but no matching unit addresses.
Add the unit addresses to the device node name. While at it, also rename the nodes from "dwc3" to "usb", as guidelines require device nodes have generic names.
--- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/rockchip/rk3399.dtsi +2 -2
@@ -402,7 +402,7 @@ "bus_clk", "grf_clk"; status = "disabled"; - usbdrd_dwc3_0: dwc3 { + usbdrd_dwc3_0: usb@fe800000 { compatible = "snps,dwc3"; reg = <0x0 0xfe800000 0x0 0x100000>; interrupts = <GIC_SPI 105 IRQ_TYPE_LEVEL_HIGH 0>;
@@ -430,7 +430,7 @@ "bus_clk", "grf_clk"; status = "disabled"; - usbdrd_dwc3_1: dwc3 { + usbdrd_dwc3_1: usb@fe900000 { compatible = "snps,dwc3"; reg = <0x0 0xfe900000 0x0 0x100000>; interrupts = <GIC_SPI 110 IRQ_TYPE_LEVEL_HIGH 0>;
Greg Kroah-Hartman
maintainerPATCH 111/114 ARM: dts: r8a73a4: Add missing CMT1 interrupts
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit 0f739fdfe9e5ce668bd6d3210f310df282321837 upstream.
The R-Mobile APE6 Compare Match Timer 1 generates 8 interrupts, one for each channel, but currently only 1 is described.
Fix this by adding the missing interrupts.
--- arch/arm/boot/dts/r8a73a4.dtsi | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
arch/arm/boot/dts/r8a73a4.dtsi +8 -1
@@ -133,7 +133,14 @@ cmt1: timer@e6130000 { compatible = "renesas,cmt-48-r8a73a4", "renesas,cmt-48-gen2"; reg = <0 0xe6130000 0 0x1004>; - interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>; + interrupts = <GIC_SPI 120 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 121 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 122 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 123 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 124 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 125 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 126 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 127 IRQ_TYPE_LEVEL_HIGH>; clocks = <&mstp3_clks R8A73A4_CLK_CMT1>; clock-names = "fck"; power-domains = <&pd_c5>;
Greg Kroah-Hartman
maintainerPATCH 112/114 ARM: dts: r8a7740: Add missing extal2 to CPG node
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit e47cb97f153193d4b41ca8d48127da14513d54c7 upstream.
The Clock Pulse Generator (CPG) device node lacks the extal2 clock. This may lead to a failure registering the "r" clock, or to a wrong parent for the "usb24s" clock, depending on MD_CK2 pin configuration and boot loader CPG_USBCKCR register configuration.
This went unnoticed, as this does not affect the single upstream board configuration, which relies on the first clock input only.
--- arch/arm/boot/dts/r8a7740.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/r8a7740.dtsi +1 -1
@@ -467,7 +467,7 @@ cpg_clocks: cpg_clocks@e6150000 { compatible = "renesas,r8a7740-cpg-clocks"; reg = <0xe6150000 0x10000>; - clocks = <&extal1_clk>, <&extalr_clk>; + clocks = <&extal1_clk>, <&extal2_clk>, <&extalr_clk>; #clock-cells = <1>; clock-output-names = "system", "pllc0", "pllc1", "pllc2", "r",
Greg Kroah-Hartman
maintainerPATCH 113/114 KVM: x86: Fix off-by-one error in kvm_vcpu_ioctl_x86_setup_mce
In reply to Greg Kroah-HartmanFrom: Jim Mattson <[email protected]>
commit c4e0e4ab4cf3ec2b3f0b628ead108d677644ebd9 upstream.
Bank_num is a one-based count of banks, not a zero-based index. It overflows the allocated space only when strictly greater than KVM_MAX_MCE_BANKS.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/x86.c +1 -1
@@ -3214,7 +3214,7 @@ static int kvm_vcpu_ioctl_x86_setup_mce(unsigned bank_num = mcg_cap &0xff , bank; r = -EINVAL ; -if (!bank_num || bank_num >=KVM_MAX_MCE_BANKS ) +if (!bank_num || bank_num >KVM_MAX_MCE_BANKS ) goto out;if (mcg_cap & ~(kvm_mce_cap_supported |0xff |0xff0000 )) goto out;
Greg Kroah-Hartman
maintainerPATCH 114/114 Makefile: disallow data races on gcc-10 as well
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
commit b1112139a103b4b1101d0d2d72931f2d33d8c978 upstream.
gcc-10 will rename --param=allow-store-data-races=0 to -fno-allow-store-data-races.
The flag change happened at https://gcc.gnu.org/PR92046.
--- Makefile | 1 + 1 file changed, 1 insertion(+)
Makefile +1 -0
@@ -663,6 +663,7 @@ endif # Tell gcc to never replace conditional load with a non-conditional one KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) +KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races) # check for 'asm goto' ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y)
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.181 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 May 2020 17:32:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.181-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.14.181-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.14.y
git commit: 53d55a576a17377e7713aa3aaeee0f35b06a1f73
git describe: v4.14.180-115-g53d55a576a17
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.14-oe/build/v4.14.180-115-g53d55a576a17
No regressions (compared to build v4.14.180)
No fixes (compared to build v4.14.180)
Ran 32429 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* install-android-platform-tools-r2800
* kselftest
* kselftest/drivers
* kselftest/filesystems
* kselftest/net
* kselftest/networking
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* v4l2-compliance
* ltp-fs-tests
* network-basic-tests
* ltp-open-posix-tests
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-native/drivers
* kselftest-vsyscall-mode-native/filesystems
* kselftest-vsyscall-mode-native/net
* kselftest-vsyscall-mode-native/networking
* kselftest-vsyscall-mode-none
* kselftest-vsyscall-mode-none/drivers
* kselftest-vsyscall-mode-none/filesystems
* kselftest-vsyscall-mode-none/net
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.181 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 May 2020 17:32:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.181-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
24 tests: 24 pass, 0 failLinux version: 4.14.181-rc1-gea63200ccd3f
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.181 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 May 2020 17:32:42 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.181-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.181 release. There are 114 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 20 May 2020 17:32:42 +0000. Anything received after that time might be too late.
Build results:
total: 171 pass: 171 fail: 0 Qemu test results: total: 408 pass: 408 fail: 0
Guenter