4.4.231-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.4.231-rc1 review
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.231-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.231-rc1
Vincent Guittot <[email protected]>
sched/fair: handle case of task_h_load() returning 0
Michał Mirosław <[email protected]>
misc: atmel-ssc: lock with mutex instead of spinlock
Krzysztof Kozlowski <[email protected]>
dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
Vishwas M <[email protected]>
hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
Huacai Chen <[email protected]>
MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
Esben Haabendal <[email protected]>
uio_pdrv_genirq: fix use without device tree and no interrupt
David Pedersen <[email protected]>
Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
Alexander Usyskin <[email protected]>
mei: bus: don't clean driver pointer
Chirantan Ekbote <[email protected]>
fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
Alexander Lobakin <[email protected]>
virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
AceLan Kao <[email protected]>
USB: serial: option: add Quectel EG95 LTE modem
Jörgen Storvist <[email protected]>
USB: serial: option: add GosunCn GM500 series
Igor Moura <[email protected]>
USB: serial: ch341: add new Product ID for CH340
James Hilliard <[email protected]>
USB: serial: cypress_m8: enable Simply Automated UPB PIM
Johan Hovold <[email protected]>
USB: serial: iuu_phoenix: fix memory corruption
Zhang Qiang <[email protected]>
usb: gadget: function: fix missing spinlock in f_uac1_legacy
Peter Chen <[email protected]>
usb: chipidea: core: add wakeup support for extcon
Tom Rix <[email protected]>
USB: c67x00: fix use after free in c67x00_giveback_urb
Takashi Iwai <[email protected]>
ALSA: usb-audio: Fix race against the error recovery URB submission
Takashi Iwai <[email protected]>
ALSA: line6: Perform sanity check for each URB creation
Takashi Iwai <[email protected]>
usb: core: Add a helper function to check the validity of EP type in URB
Dmitry Torokhov <[email protected]>
HID: magicmouse: do not set up autorepeat
Álvaro Fernández Rojas <[email protected]>
mtd: rawnand: brcmnand: fix CS0 layout
Jin Yao <[email protected]>
perf stat: Zero all the 'ena' and 'run' array slot stats for interval mode
Dan Carpenter <[email protected]>
staging: comedi: verify array index is correct before using it
Michał Mirosław <[email protected]>
usb: gadget: udc: atmel: fix uninitialized read in debug printk
Sasha Levin <[email protected]>
Revert "usb/ohci-platform: Fix a warning when hibernating"
Sasha Levin <[email protected]>
Revert "usb/xhci-plat: Set PM runtime as active on resume"
Sasha Levin <[email protected]>
Revert "usb/ehci-platform: Set PM runtime as active on resume"
Andy Shevchenko <[email protected]>
i2c: eg20t: Load module automatically if ID matches
Eric Dumazet <[email protected]>
tcp: md5: allow changing MD5 keys in all socket states
Eric Dumazet <[email protected]>
tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
Eric Dumazet <[email protected]>
tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
Christoph Paasch <[email protected]>
tcp: make sure listeners don't initialize congestion-control state
Sean Tranchetti <[email protected]>
genetlink: remove genl_bind
Martin Varghese <[email protected]>
net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
Eric Dumazet <[email protected]>
llc: make sure applications use ARPHRD_ETHER
Xin Long <[email protected]>
l2tp: remove skb_dst_set() from l2tp_xmit_skb()
Sabrina Dubroca <[email protected]>
ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
Davide Caratti <[email protected]>
bnxt_en: fix NULL dereference in case SR-IOV configuration fails
Vineet Gupta <[email protected]>
ARC: elf: use right ELF_ARCH
Vineet Gupta <[email protected]>
ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
Tom Rix <[email protected]>
drm/radeon: fix double free
Boris Burkov <[email protected]>
btrfs: fix fatal extent_buffer readahead vs releasepage race
Greg Kroah-Hartman <[email protected]>
Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
Paolo Bonzini <[email protected]>
KVM: x86: bit 8 of non-leaf PDPEs is not reserved
Hector Martin <[email protected]>
ALSA: usb-audio: add quirk for MacroSilicon MS2109
Hui Wang <[email protected]>
ALSA: hda - let hs_mic be picked ahead of hp_mic
xidongwang <[email protected]>
ALSA: opl3: fix infoleak in opl3
Wei Li <[email protected]>
arm64: kgdb: Fix single-step exception handling oops
Vinod Koul <[email protected]>
ALSA: compress: fix partial_drain completion state
Andre Edich <[email protected]>
smsc95xx: avoid memory leak in smsc95xx_bind
Andre Edich <[email protected]>
smsc95xx: check return value of smsc95xx_reset
Li Heng <[email protected]>
net: cxgb4: fix return error value in t4_prep_fw
Tomas Henzl <[email protected]>
scsi: mptscsih: Fix read sense data size
Zhenzhong Duan <[email protected]>
spi: spidev: fix a potential use-after-free in spidev_release()
Zhenzhong Duan <[email protected]>
spi: spidev: fix a race between spidev_release and spidev_remove
Christian Borntraeger <[email protected]>
KVM: s390: reduce number of IO pins to 1
-------------
Diffstat:
Makefile | 4 +- arch/arc/include/asm/elf.h | 2 +- arch/arc/kernel/entry.S | 16 +++----- arch/arm64/kernel/kgdb.c | 2 +- arch/mips/kernel/time.c | 13 ++----- arch/s390/include/asm/kvm_host.h | 8 ++-- arch/x86/kvm/mmu.c | 2 +- drivers/char/virtio_console.c | 3 +- drivers/dma/fsl-edma.c | 7 ++++ drivers/gpu/drm/radeon/ci_dpm.c | 7 ++-- drivers/hid/hid-magicmouse.c | 6 +++ drivers/hwmon/emc2103.c | 2 +- drivers/i2c/busses/i2c-eg20t.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 7 ++++ drivers/message/fusion/mptscsih.c | 4 +- drivers/misc/atmel-ssc.c | 24 ++++++------ drivers/misc/mei/bus.c | 3 +- drivers/mtd/nand/brcmnand/brcmnand.c | 5 ++- drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++-- drivers/net/usb/smsc95xx.c | 9 ++++- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 ++++++----------------- drivers/net/wireless/ath/ath9k/hif_usb.h | 5 --- drivers/spi/spidev.c | 24 ++++++------ drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++-- drivers/uio/uio_pdrv_genirq.c | 2 +- drivers/usb/c67x00/c67x00-sched.c | 2 +- drivers/usb/chipidea/core.c | 24 ++++++++++++ drivers/usb/core/urb.c | 30 ++++++++++++-- drivers/usb/gadget/function/f_uac1.c | 2 + drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- drivers/usb/host/ehci-platform.c | 5 --- drivers/usb/host/ohci-platform.c | 5 --- drivers/usb/host/xhci-plat.c | 11 +----- drivers/usb/serial/ch341.c | 1 + drivers/usb/serial/cypress_m8.c | 2 + drivers/usb/serial/cypress_m8.h | 3 ++ drivers/usb/serial/iuu_phoenix.c | 8 ++-- drivers/usb/serial/option.c | 6 +++ fs/btrfs/extent_io.c | 40 +++++++++++-------- fs/fuse/file.c | 12 +++++- include/linux/usb.h | 2 + include/net/dst.h | 10 ++++- include/net/genetlink.h | 8 ---- include/sound/compress_driver.h | 10 ++++- kernel/sched/fair.c | 10 ++++- net/ipv4/ping.c | 3 ++ net/ipv4/tcp.c | 13 ++++--- net/ipv4/tcp_cong.c | 2 +- net/ipv4/tcp_ipv4.c | 15 +++++-- net/l2tp/l2tp_core.c | 5 +-- net/llc/af_llc.c | 10 +++-- net/netlink/genetlink.c | 52 ------------------------- sound/core/compress_offload.c | 4 ++ sound/drivers/opl3/opl3_synth.c | 2 + sound/pci/hda/hda_auto_parser.c | 6 +++ sound/usb/line6/capture.c | 2 + sound/usb/line6/playback.c | 2 + sound/usb/midi.c | 17 +++++--- sound/usb/quirks-table.h | 52 +++++++++++++++++++++++++ tools/perf/util/stat.c | 6 ++- 61 files changed, 358 insertions(+), 250 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/58 KVM: s390: reduce number of IO pins to 1
From: Christian Borntraeger <[email protected]>
[ Upstream commit 774911290c589e98e3638e73b24b0a4d4530e97c ]
The current number of KVM_IRQCHIP_NUM_PINS results in an order 3 allocation (32kb) for each guest start/restart. This can result in OOM killer activity even with free swap when the memory is fragmented enough:
kernel: qemu-system-s39 invoked oom-killer: gfp_mask=0x440dc0(GFP_KERNEL_ACCOUNT|__GFP_COMP|__GFP_ZERO), order=3, oom_score_adj=0 kernel: CPU: 1 PID: 357274 Comm: qemu-system-s39 Kdump: loaded Not tainted 5.4.0-29-generic #33-Ubuntu kernel: Hardware name: IBM 8562 T02 Z06 (LPAR) kernel: Call Trace: kernel: ([<00000001f848fe2a>] show_stack+0x7a/0xc0) kernel: [<00000001f8d3437a>] dump_stack+0x8a/0xc0 kernel: [<00000001f8687032>] dump_header+0x62/0x258 kernel: [<00000001f8686122>] oom_kill_process+0x172/0x180 kernel: [<00000001f8686abe>] out_of_memory+0xee/0x580 kernel: [<00000001f86e66b8>] __alloc_pages_slowpath+0xd18/0xe90 kernel: [<00000001f86e6ad4>] __alloc_pages_nodemask+0x2a4/0x320 kernel: [<00000001f86b1ab4>] kmalloc_order+0x34/0xb0 kernel: [<00000001f86b1b62>] kmalloc_order_trace+0x32/0xe0 kernel: [<00000001f84bb806>] kvm_set_irq_routing+0xa6/0x2e0 kernel: [<00000001f84c99a4>] kvm_arch_vm_ioctl+0x544/0x9e0 kernel: [<00000001f84b8936>] kvm_vm_ioctl+0x396/0x760 kernel: [<00000001f875df66>] do_vfs_ioctl+0x376/0x690 kernel: [<00000001f875e304>] ksys_ioctl+0x84/0xb0 kernel: [<00000001f875e39a>] __s390x_sys_ioctl+0x2a/0x40 kernel: [<00000001f8d55424>] system_call+0xd8/0x2c8
As far as I can tell s390x does not use the iopins as we bail our for anything other than KVM_IRQ_ROUTING_S390_ADAPTER and the chip/pin is only used for KVM_IRQ_ROUTING_IRQCHIP. So let us use a small number to reduce the memory footprint.
--- arch/s390/include/asm/kvm_host.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/s390/include/asm/kvm_host.h +4 -4
@@ -29,12 +29,12 @@#define KVM_USER_MEM_SLOTS 32/* -* These seem to be used for allocating ->chip in the routing table, -* which we don't use. 4096 is an out-of-thin-air value. If we need -* to look at ->chip later on, we'll need to revisit this. +* These seem to be used for allocating ->chip in the routing table, which we +* don't use. 1 is as small as we can get to reduce the needed memory. If we +* need to look at ->chip later on, we'll need to revisit this. */ #define KVM_NR_IRQCHIPS 1 -#define KVM_IRQCHIP_NUM_PINS 4096 +#define KVM_IRQCHIP_NUM_PINS 1#define KVM_HALT_POLL_NS_DEFAULT 0#define SIGP_CTRL_C 0x80
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 2/58 spi: spidev: fix a race between spidev_release and spidev_remove
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ]
Imagine below scene, spidev is referenced after it's freed.
spidev_release() spidev_remove()
...
spin_lock_irq(&spidev->spi_lock);
spidev->spi = NULL;
spin_unlock_irq(&spidev->spi_lock);
mutex_lock(&device_list_lock);
dofree = (spidev->spi == NULL);
if (dofree)
kfree(spidev);
mutex_unlock(&device_list_lock);
mutex_lock(&device_list_lock);
list_del(&spidev->device_entry);
device_destroy(spidev_class, spidev->devt);
clear_bit(MINOR(spidev->devt), minors);
if (spidev->users == 0)
kfree(spidev);
mutex_unlock(&device_list_lock);Fix it by resetting spidev->spi in device_list_lock's protection.
--- drivers/spi/spidev.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/spi/spidev.c +2 -2
@@ -769,13 +769,13 @@ static int spidev_remove(struct spi_device *spi) {struct spidev_data *spidev =spi_get_drvdata (spi); +/* prevent new opens */ +mutex_lock (&device_list_lock);/* make sure ops on existing fds can abort cleanly */ spin_lock_irq (&spidev->spi_lock); spidev->spi =NULL ;spin_unlock_irq (&spidev->spi_lock); -/* prevent new opens */ -mutex_lock (&device_list_lock);list_del (&spidev->device_entry);device_destroy (spidev_class, spidev->devt);clear_bit (MINOR (spidev->devt), minors);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 3/58 spi: spidev: fix a potential use-after-free in spidev_release()
In reply to Greg Kroah-HartmanFrom: Zhenzhong Duan <[email protected]>
[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ]
If an spi device is unbounded from the driver before the release process, there will be an NULL pointer reference when it's referenced in spi_slave_abort().
Fix it by checking it's already freed before reference.
--- drivers/spi/spidev.c | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-)
drivers/spi/spidev.c +10 -10
@@ -635,15 +635,20 @@ err_find_dev:static int spidev_release (struct inode *inode,struct file *filp) {struct spidev_data *spidev; +int dofree;mutex_lock (&device_list_lock); spidev = filp->private_data; filp->private_data =NULL ; +spin_lock_irq (&spidev->spi_lock); +/* ... after we unbound from the underlying device? */ + dofree = (spidev->spi ==NULL ); +spin_unlock_irq (&spidev->spi_lock); +/* last close? */ spidev->users--;if (!spidev->users) { -int dofree;kfree (spidev->tx_buffer); spidev->tx_buffer =NULL ;
@@ -651,19 +656,14 @@ static int spidev_release(struct inode *inode, struct file *filp)kfree (spidev->rx_buffer); spidev->rx_buffer =NULL ; -spin_lock_irq (&spidev->spi_lock); -if (spidev->spi) - spidev->speed_hz = spidev->spi->max_speed_hz; - -/* ... after we unbound from the underlying device? */ - dofree = (spidev->spi ==NULL ); -spin_unlock_irq (&spidev->spi_lock); -if (dofree)kfree (spidev); +else + spidev->speed_hz = spidev->spi->max_speed_hz; }#ifdef CONFIG_SPI_SLAVE -spi_slave_abort (spidev->spi); +if (!dofree) +spi_slave_abort (spidev->spi);#endif mutex_unlock (&device_list_lock);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 4/58 scsi: mptscsih: Fix read sense data size
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ]
The sense data buffer in sense_buf_pool is allocated with size of MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96) is used when reading the data. That may lead to a read from unallocated area, sometimes from another (unallocated) page. To fix this, limit the read size to MPT_SENSE_BUFFER_ALLOC.
--- drivers/message/fusion/mptscsih.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/message/fusion/mptscsih.c +1 -3
@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state);int mptscsih_resume (struct pci_dev *pdev);#endif -#define SNS_LEN (scp) SCSI_SENSE_BUFFERSIZE -/*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ /*
@@ -2427,7 +2425,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR/* Copy the sense received into the scsi command block. */ req_index =le16_to_cpu (mf->u.frame.hwhdr.msgctxu.fld.req_idx); sense_data = ((u8 *)ioc->sense_buf_pool + (req_index *MPT_SENSE_BUFFER_ALLOC )); -memcpy (sc->sense_buffer, sense_data,SNS_LEN (sc)); +memcpy (sc->sense_buffer, sense_data,MPT_SENSE_BUFFER_ALLOC );/* Log SMART data (asc = 0x5D, non-IM case only) if required. */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 5/58 net: cxgb4: fix return error value in t4_prep_fw
In reply to Greg Kroah-HartmanFrom: Li Heng <[email protected]>
[ Upstream commit 8a259e6b73ad8181b0b2ef338b35043433db1075 ]
t4_prep_fw goto bye tag with positive return value when something bad happened and which can not free resource in adap_init0. so fix it to return negative value.
--- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +4 -4
@@ -3093,7 +3093,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info, drv_fw = &fw_info->fw_hdr;/* Read the header of the firmware on the card */ - ret = -t4_read_flash (adap,FLASH_FW_START , + ret =t4_read_flash (adap,FLASH_FW_START ,sizeof (*card_fw) /sizeof (uint32_t ), (uint32_t *)card_fw,1 );if (ret ==0 ) {
@@ -3122,8 +3122,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,should_install_fs_fw (adap, card_fw_usable,be32_to_cpu (fs_fw->fw_ver), be32_to_cpu(card_fw->fw_ver))) { - ret = -t4_fw_upgrade(adap, adap->mbox, fw_data, - fw_size,0 ); + ret = t4_fw_upgrade(adap, adap->mbox, fw_data, + fw_size,0 );if (ret !=0 ) {dev_err (adap->pdev_dev,"failed to install firmware: %d\n" , ret);
@@ -3154,7 +3154,7 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,FW_HDR_FW_VER_MICRO_G (c),FW_HDR_FW_VER_BUILD_G (c),FW_HDR_FW_VER_MAJOR_G (k),FW_HDR_FW_VER_MINOR_G (k), FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); - ret =EINVAL ; + ret = -EINVAL ; goto bye; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 6/58 smsc95xx: check return value of smsc95xx_reset
In reply to Greg Kroah-HartmanFrom: Andre Edich <[email protected]>
[ Upstream commit 7c8b1e855f94f88a0c569be6309fc8d5c8844cd1 ]
The return value of the function smsc95xx_reset() must be checked to avoid returning false success from the function smsc95xx_bind().
--- drivers/net/usb/smsc95xx.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/smsc95xx.c +6 -0
@@ -1136,6 +1136,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)/* Init all registers */ ret =smsc95xx_reset (dev); +if (ret) + goto free_pdata;/* detect device revision as different features may be available */ ret =smsc95xx_read_reg (dev,ID_REV , &val);
@@ -1157,6 +1159,10 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf) dev->net->hard_header_len +=SMSC95XX_TX_OVERHEAD_CSUM ; dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;return 0 ; + +free_pdata: +kfree (pdata); +return ret; }static void smsc95xx_unbind (struct usbnet *dev,struct usb_interface *intf)
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 7/58 smsc95xx: avoid memory leak in smsc95xx_bind
In reply to Greg Kroah-HartmanFrom: Andre Edich <[email protected]>
[ Upstream commit 3ed58f96a70b85ef646d5427258f677f1395b62f ]
In a case where the ID_REV register read is failed, the memory for a private data structure has to be freed before returning error from the function smsc95xx_bind.
--- drivers/net/usb/smsc95xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/smsc95xx.c +2 -1
@@ -1142,7 +1142,8 @@ static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)/* detect device revision as different features may be available */ ret =smsc95xx_read_reg (dev,ID_REV , &val);if (ret <0 ) -return ret; + goto free_pdata; + val >>=16 ; if ((val == ID_REV_CHIP_ID_9500A_) || (val == ID_REV_CHIP_ID_9530_) ||
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 8/58 ALSA: compress: fix partial_drain completion state
In reply to Greg Kroah-HartmanFrom: Vinod Koul <[email protected]>
[ Upstream commit f79a732a8325dfbd570d87f1435019d7e5501c6d ]
On partial_drain completion we should be in SNDRV_PCM_STATE_RUNNING state, so set that for partially draining streams in snd_compr_drain_notify() and use a flag for partially draining streams
While at it, add locks for stream state change insnd_compr_drain_notify() as well.
--- include/sound/compress_driver.h | 10 +++++++++- sound/core/compress_offload.c | 4 ++++ 2 files changed, 13 insertions(+), 1 deletion(-)
include/sound/compress_driver.h +9 -1
@@ -71,6 +71,7 @@ struct snd_compr_runtime {* @direction: stream direction, playback/recording * @metadata_set: metadata set flag, true when set * @next_track: has userspace signal next track transition, true when set +* @partial_drain: undergoing partial_drain for stream, true when set * @private_data: pointer to DSP private data */ struct snd_compr_stream {
@@ -81,6 +82,7 @@ struct snd_compr_stream {enum snd_compr_direction direction;bool metadata_set;bool next_track; +bool partial_drain;void *private_data; };
@@ -178,7 +180,13 @@ static inline void snd_compr_drain_notify(struct snd_compr_stream *stream)if (snd_BUG_ON (!stream))return ; - stream->runtime->state =SNDRV_PCM_STATE_SETUP ; +/* for partial_drain case we are back to running state on success */ +if (stream->partial_drain) { + stream->runtime->state =SNDRV_PCM_STATE_RUNNING ; + stream->partial_drain = false;/* clear this flag as well */ + }else { + stream->runtime->state =SNDRV_PCM_STATE_SETUP ; + }wake_up (&stream->runtime->sleep); }
sound/core/compress_offload.c +4 -0
@@ -699,6 +699,9 @@ static int snd_compr_stop(struct snd_compr_stream *stream) retval = stream->ops->trigger (stream,SNDRV_PCM_TRIGGER_STOP );if (!retval) { +/* clear flags and stop any drain wait */ + stream->partial_drain = false; + stream->metadata_set = false;snd_compr_drain_notify (stream); stream->runtime->total_bytes_available =0 ; stream->runtime->total_bytes_transferred =0 ;
@@ -809,6 +812,7 @@ static int snd_compr_partial_drain(struct snd_compr_stream *stream)if (stream->next_track == false)return -EPERM ; + stream->partial_drain = true; retval = stream->ops->trigger (stream,SND_COMPR_TRIGGER_PARTIAL_DRAIN );if (retval) {pr_debug ("Partial drain returned failure\n" );
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 9/58 arm64: kgdb: Fix single-step exception handling oops
In reply to Greg Kroah-HartmanFrom: Wei Li <[email protected]>
[ Upstream commit 8523c006264df65aac7d77284cc69aac46a6f842 ]
After entering kdb due to breakpoint, when we execute 'ss' or 'go' (will delay installing breakpoints, do single-step first), it won't work correctly, and it will enter kdb due to oops.
It's because the reason gotten in kdb_stub() is not as expected, and it seems that the ex_vector for single-step should be 0, like what arch powerpc/sh/parisc has implemented.
Before the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry [0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
is enabled addr at ffff8000101486cc, hardtype=0 installed=0
[0]kdb> g
/ # echo h > /proc/sysrq-trigger
Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 due to Breakpoint @ 0xffff8000101486cc [3]kdb> ss
Entering kdb (current=0xffff0000fa878040, pid 266) on processor 3 Oops: (null) due to oops @ 0xffff800010082ab8
CPU: 3 PID: 266 Comm: sh Not tainted 5.7.0-rc4-13839-gf0e5ad491718 #6 Hardware name: linux,dummy-virt (DT) pstate: 00000085 (nzcv daIf -PAN -UAO) pc : el1_irq+0x78/0x180 lr : __handle_sysrq+0x80/0x190
sp : ffff800015003bf0
x29: ffff800015003d20 x28: ffff0000fa878040
x27: 0000000000000000 x26: ffff80001126b1f0
x25: ffff800011b6a0d8 x24: 0000000000000000
x23: 0000000080200005 x22: ffff8000101486cc
x21: ffff800015003d30 x20: 0000ffffffffffff
x19: ffff8000119f2000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : 0000000000000000 x8 : ffff800015003e50
x7 : 0000000000000002 x6 : 00000000380b9990
x5 : ffff8000106e99e8 x4 : ffff0000fadd83c0
x3 : 0000ffffffffffff x2 : ffff800011b6a0d8
x1 : ffff800011b6a000 x0 : ffff80001130c9d8
Call trace: el1_irq+0x78/0x180 printk+0x0/0x84 write_sysrq_trigger+0xb0/0x118 proc_reg_write+0xb4/0xe0 __vfs_write+0x18/0x40 vfs_write+0xb0/0x1b8 ksys_write+0x64/0xf0 __arm64_sys_write+0x14/0x20 el0_svc_common.constprop.2+0xb0/0x168 do_el0_svc+0x20/0x98 el0_sync_handler+0xec/0x1a8 el0_sync+0x140/0x180
[3]kdb>
After the patch:
Entering kdb (current=0xffff8000119e2dc0, pid 0) on processor 0 due to Keyboard Entry [0]kdb> bp printk
Instruction(i) BP #0 at 0xffff8000101486cc (printk)
is enabled addr at ffff8000101486cc, hardtype=0 installed=0
[0]kdb> g
/ # echo h > /proc/sysrq-trigger
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc [0]kdb> g
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to Breakpoint @ 0xffff8000101486cc [0]kdb> ss
Entering kdb (current=0xffff0000fa852bc0, pid 268) on processor 0 due to SS trap @ 0xffff800010082ab8 [0]kdb>
--- arch/arm64/kernel/kgdb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/kernel/kgdb.c +1 -1
@@ -238,7 +238,7 @@ static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)if (user_mode (regs))return DBG_HOOK_ERROR ; -kgdb_handle_exception (1 ,SIGTRAP ,0 , regs); +kgdb_handle_exception (0 ,SIGTRAP ,0 , regs);return DBG_HOOK_HANDLED ; }
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 10/58 ALSA: opl3: fix infoleak in opl3
In reply to Greg Kroah-HartmanFrom: xidongwang <[email protected]>
commit ad155712bb1ea2151944cf06a0e08c315c70c1e3 upstream.
The stack object “info” in snd_opl3_ioctl() has a leaking problem. It has 2 padding bytes which are not initialized and leaked via “copy_to_user”.
--- sound/drivers/opl3/opl3_synth.c | 2 ++ 1 file changed, 2 insertions(+)
sound/drivers/opl3/opl3_synth.c +2 -0
@@ -104,6 +104,8 @@ int snd_opl3_ioctl(struct snd_hwdep * hw {struct snd_dm_fm_info info; +memset (&info,0 ,sizeof (info)); + info.fm_mode = opl3->fm_mode; info.rhythm = opl3->rhythm;if (copy_to_user (argp, &info,sizeof (struct snd_dm_fm_info )))
Greg Kroah-Hartman
maintainerPATCH 11/58 ALSA: hda - let hs_mic be picked ahead of hp_mic
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit 6a6ca7881b1ab1c13fe0d70bae29211a65dd90de upstream.
We have a Dell AIO, there is neither internal speaker nor internal mic, only a multi-function audio jack on it.
Users reported that after freshly installing the OS and plug a headset to the audio jack, the headset can't output sound. I reproduced this bug, at that moment, the Input Source is as below:
Simple mixer control 'Input Source',0
Capabilities: cenum
Items: 'Headphone Mic' 'Headset Mic'
Item0: 'Headphone Mic'
That is because the patch_realtek will set this audio jack as mic_in mode if Input Source's value is hp_mic.
If it is not fresh installing, this issue will not happen since the systemd will run alsactl restore -f /var/lib/alsa/asound.state, this will set the 'Input Source' according to history value.
If there is internal speaker or internal mic, this issue will not happen since there is valid sink/source in the pulseaudio, the PA will set the 'Input Source' according to active_port.
To fix this issue, change the parser function to let the hs_mic be stored ahead of hp_mic.
--- sound/pci/hda/hda_auto_parser.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/pci/hda/hda_auto_parser.c +6 -0
@@ -76,6 +76,12 @@ static int compare_input_type(const voidif (a->type != b->type)return (int )(a->type - b->type); +/* If has both hs_mic and hp_mic, pick the hs_mic ahead of hp_mic. */ +if (a->is_headset_mic && b->is_headphone_mic) +return -1 ;/* don't swap */ +else if (a->is_headphone_mic && b->is_headset_mic) +return 1 ;/* swap */ +/* In case one has boost and the other one has not, pick the one with boost first. */ return (int )(b->has_boost_on_pin - a->has_boost_on_pin);
Greg Kroah-Hartman
maintainerPATCH 12/58 ALSA: usb-audio: add quirk for MacroSilicon MS2109
In reply to Greg Kroah-HartmanFrom: Hector Martin <[email protected]>
commit e337bf19f6af38d5c3fa6d06cd594e0f890ca1ac upstream.
These devices claim to be 96kHz mono, but actually are 48kHz stereo with swapped channels and unaligned transfers.
--- sound/usb/quirks-table.h | 52 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+)
sound/usb/quirks-table.h +52 -0
@@ -3323,4 +3323,56 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge } }, +/* +* MacroSilicon MS2109 based HDMI capture cards +* +* These claim 96kHz 1ch in the descriptors, but are actually 48kHz 2ch. +* They also need QUIRK_AUDIO_ALIGN_TRANSFER, which makes one wonder if +* they pretend to be 96kHz mono as a workaround for stereo being broken +* by that... +* +* They also have swapped L-R channels, but that's for userspace to deal +* with. +*/ +{ + USB_DEVICE(0x534d, 0x2109), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="MacroSilicon" , + .product_name ="MS2109" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = &(const struct snd_usb_audio_quirk []) { + { + .ifnum =2 , + .type =QUIRK_AUDIO_ALIGN_TRANSFER , + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_STANDARD_MIXER , + }, + { + .ifnum =3 , + .type =QUIRK_AUDIO_FIXED_ENDPOINT , + .data = &(const struct audioformat ) { + .formats =SNDRV_PCM_FMTBIT_S16_LE , + .channels =2 , + .iface =3 , + .altsetting =1 , + .altset_idx =1 , + .attributes =0 , + .endpoint =0x82 , + .ep_attr =USB_ENDPOINT_XFER_ISOC | +USB_ENDPOINT_SYNC_ASYNC , + .rates =SNDRV_PCM_RATE_CONTINUOUS , + .rate_min =48000 , + .rate_max =48000 , + } + }, + { + .ifnum =-1 + } + } + } +}, + #undef USB_DEVICE_VENDOR_SPEC
Greg Kroah-Hartman
maintainerPATCH 13/58 KVM: x86: bit 8 of non-leaf PDPEs is not reserved
In reply to Greg Kroah-HartmanFrom: Paolo Bonzini <[email protected]>
commit 5ecad245de2ae23dc4e2dbece92f8ccfbaed2fa7 upstream.
Bit 8 would be the "global" bit, which does not quite make sense for non-leaf page table entries. Intel ignores it; AMD ignores it in PDEs and PDPEs, but reserves it in PML4Es.
Probably, earlier versions of the AMD manual documented it as reserved in PDPEs as well, and that behavior made it into KVM as well as kvm-unit-tests; fix it.
--- arch/x86/kvm/mmu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/kvm/mmu.c +1 -1
@@ -3679,7 +3679,7 @@ __reset_rsvds_bits_mask(struct kvm_vcpu nonleaf_bit8_rsvd |rsvd_bits (7 ,7 ) |rsvd_bits (maxphyaddr,51 ); rsvd_check->rsvd_bits_mask[0 ][2 ] = exb_bit_rsvd | - nonleaf_bit8_rsvd | gbpages_bit_rsvd | + gbpages_bit_rsvd |rsvd_bits (maxphyaddr,51 ); rsvd_check->rsvd_bits_mask[0 ][1 ] = exb_bit_rsvd |rsvd_bits (maxphyaddr,51 );
Greg Kroah-Hartman
maintainerPATCH 14/58 Revert "ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb"
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
This reverts commit 90ecba9f1041f436ed2b35ba7a970c7cc5d0df23 which is commit 2bbcaaee1fcbd83272e29f31e2bb7e70d8c49e05 upstream.
It is being reverted upstream, just hasn't made it there yet and is causing lots of problems.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 48 +++++++------------------------ drivers/net/wireless/ath/ath9k/hif_usb.h | 5 --- 2 files changed, 11 insertions(+), 42 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +11 -37
@@ -639,9 +639,9 @@ err:static void ath9k_hif_usb_rx_cb (struct urb *urb) { -struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -struct hif_device_usb *hif_dev = rx_buf->hif_dev; -struct sk_buff *skb = rx_buf->skb; +struct sk_buff *skb = (struct sk_buff *) urb->context; +struct hif_device_usb *hif_dev = +usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -681,15 +681,14 @@ resubmit:return ; free:kfree_skb (skb); -kfree (rx_buf); }static void ath9k_hif_usb_reg_in_cb (struct urb *urb) { -struct rx_buf *rx_buf = (struct rx_buf *)urb->context; -struct hif_device_usb *hif_dev = rx_buf->hif_dev; -struct sk_buff *skb = rx_buf->skb; +struct sk_buff *skb = (struct sk_buff *) urb->context;struct sk_buff *nskb; +struct hif_device_usb *hif_dev = +usb_get_intfdata (usb_ifnum_to_if (urb->dev,0 ));int ret;if (!skb)
@@ -747,7 +746,6 @@ resubmit:return ; free:kfree_skb (skb); -kfree (rx_buf); urb->context =NULL ; }
@@ -793,7 +791,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(sinit_usb_anchor (&hif_dev->mgmt_submitted);for (i =0 ; i <MAX_TX_URB_NUM ; i++) { - tx_buf =kzalloc (sizeof (*tx_buf),GFP_KERNEL ); + tx_buf =kzalloc (sizeof (struct tx_buf ),GFP_KERNEL );if (!tx_buf) goto err;
@@ -830,9 +828,8 @@ static void ath9k_hif_usb_dealloc_rx_urbstatic int ath9k_hif_usb_alloc_rx_urbs (struct hif_device_usb *hif_dev) { -struct rx_buf *rx_buf =NULL ; -struct sk_buff *skb =NULL ;struct urb *urb =NULL ; +struct sk_buff *skb =NULL ;int i, ret;init_usb_anchor (&hif_dev->rx_submitted);
@@ -840,12 +837,6 @@ static int ath9k_hif_usb_alloc_rx_urbs(sfor (i =0 ; i <MAX_RX_URB_NUM ; i++) { - rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); -if (!rx_buf) { - ret = -ENOMEM ; - goto err_rxb; - } -/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -860,14 +851,11 @@ static int ath9k_hif_usb_alloc_rx_urbs(s goto err_skb; } - rx_buf->hif_dev = hif_dev; - rx_buf->skb = skb; -usb_fill_bulk_urb (urb, hif_dev->udev,usb_rcvbulkpipe (hif_dev->udev,USB_WLAN_RX_PIPE ), skb->data,MAX_RX_BUF_SIZE , - ath9k_hif_usb_rx_cb, rx_buf); + ath9k_hif_usb_rx_cb, skb);/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->rx_submitted);
@@ -893,8 +881,6 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: -kfree (rx_buf); -err_rxb:ath9k_hif_usb_dealloc_rx_urbs (hif_dev);return ret; }
@@ -906,21 +892,14 @@ static void ath9k_hif_usb_dealloc_reg_instatic int ath9k_hif_usb_alloc_reg_in_urbs (struct hif_device_usb *hif_dev) { -struct rx_buf *rx_buf =NULL ; -struct sk_buff *skb =NULL ;struct urb *urb =NULL ; +struct sk_buff *skb =NULL ;int i, ret;init_usb_anchor (&hif_dev->reg_in_submitted);for (i =0 ; i <MAX_REG_IN_URB_NUM ; i++) { - rx_buf =kzalloc (sizeof (*rx_buf),GFP_KERNEL ); -if (!rx_buf) { - ret = -ENOMEM ; - goto err_rxb; - } -/* Allocate URB */ urb =usb_alloc_urb (0 ,GFP_KERNEL );if (urb ==NULL ) {
@@ -935,14 +914,11 @@ static int ath9k_hif_usb_alloc_reg_in_ur goto err_skb; } - rx_buf->hif_dev = hif_dev; - rx_buf->skb = skb; -usb_fill_int_urb (urb, hif_dev->udev,usb_rcvintpipe (hif_dev->udev,USB_REG_IN_PIPE ), skb->data,MAX_REG_IN_BUF_SIZE , - ath9k_hif_usb_reg_in_cb, rx_buf,1 ); + ath9k_hif_usb_reg_in_cb, skb,1 );/* Anchor URB */ usb_anchor_urb (urb, &hif_dev->reg_in_submitted);
@@ -968,8 +944,6 @@ err_submit: err_skb:usb_free_urb (urb); err_urb: -kfree (rx_buf); -err_rxb:ath9k_hif_usb_dealloc_reg_in_urbs (hif_dev);return ret; }
drivers/net/wireless/ath/ath9k/hif_usb.h +0 -5
@@ -84,11 +84,6 @@ struct tx_buf {struct list_head list; }; -struct rx_buf { -struct sk_buff *skb; -struct hif_device_usb *hif_dev; -}; -#define HIF_USB_TX_STOP BIT(0)#define HIF_USB_TX_FLUSH BIT(1)
Greg Kroah-Hartman
maintainerPATCH 15/58 btrfs: fix fatal extent_buffer readahead vs releasepage race
In reply to Greg Kroah-HartmanFrom: Boris Burkov <[email protected]>
commit 6bf9cd2eed9aee6d742bb9296c994a91f5316949 upstream.
Under somewhat convoluted conditions, it is possible to attempt to release an extent_buffer that is under io, which triggers a BUG_ON in btrfs_release_extent_buffer_pages.
This relies on a few different factors. First, extent_buffer reads done as readahead for searching use WAIT_NONE, so they free the local extent buffer reference while the io is outstanding. However, they should still be protected by TREE_REF. However, if the system is doing signficant reclaim, and simultaneously heavily accessing the extent_buffers, it is possible for releasepage to race with two concurrent readahead attempts in a way that leaves TREE_REF unset when the readahead extent buffer is released.
Essentially, if two tasks race to allocate a new extent_buffer, but the winner who attempts the first io is rebuffed by a page being locked (likely by the reclaim itself) then the loser will still go ahead with issuing the readahead. The loser's call to find_extent_buffer must also race with the reclaim task reading the extent_buffer's refcount as 1 in a way that allows the reclaim to re-clear the TREE_REF checked by find_extent_buffer.
The following represents an example execution demonstrating the race:
CPU0 CPU1 CPU2reada_for_search reada_for_search
readahead_tree_block readahead_tree_block
find_create_tree_block find_create_tree_block
alloc_extent_buffer alloc_extent_buffer
find_extent_buffer // not found
allocates eb
lock pages
associate pages to eb
insert eb into radix tree
set TREE_REF, refs == 2
unlock pages
read_extent_buffer_pages // WAIT_NONE
not uptodate (brand new eb)
lock_page
if !trylock_page
goto unlock_exit // not an error
free_extent_buffer
release_extent_buffer
atomic_dec_and_test refs to 1
find_extent_buffer // found
try_release_extent_buffer
take refs_lock reads refs == 1; no io
atomic_inc_not_zero refs to 2
mark_buffer_accessed
check_buffer_tree_ref
// not STALE, won't take refs_lock
refs == 2; TREE_REF set // no action
read_extent_buffer_pages // WAIT_NONE
clear TREE_REF release_extent_buffer
atomic_dec_and_test refs to 1 unlock_page
still not uptodate (CPU1 read failed on trylock_page)
locks pages
set io_pages > 0
submit io
return
free_extent_buffer
release_extent_buffer
dec refs to 0
delete from radix tree
btrfs_release_extent_buffer_pages
BUG_ON(io_pages > 0)!!!
We observe this at a very low rate in production and were also able to reproduce it in a test environment by introducing some spurious delays and by introducing probabilistic trylock_page failures.
To fix it, we apply check_tree_ref at a point where it could not possibly be unset by a competing task: after io_pages has been incremented. All the codepaths that clear TREE_REF check for io, so they would not be able to clear it after this point until the io is done.
Stack trace, for reference:
[1417839.424739] ------------[ cut here ]------------ [1417839.435328] kernel BUG at fs/btrfs/extent_io.c:4841! [1417839.447024] invalid opcode: 0000 [#1] SMP [1417839.502972] RIP: 0010:btrfs_release_extent_buffer_pages+0x20/0x1f0 [1417839.517008] Code: ed e9 ... [1417839.558895] RSP: 0018:ffffc90020bcf798 EFLAGS: 00010202 [1417839.570816] RAX: 0000000000000002 RBX: ffff888102d6def0 RCX: 0000000000000028 [1417839.586962] RDX: 0000000000000002 RSI: ffff8887f0296482 RDI: ffff888102d6def0 [1417839.603108] RBP: ffff88885664a000 R08: 0000000000000046 R09: 0000000000000238 [1417839.619255] R10: 0000000000000028 R11: ffff88885664af68 R12: 0000000000000000 [1417839.635402] R13: 0000000000000000 R14: ffff88875f573ad0 R15: ffff888797aafd90 [1417839.651549] FS: 00007f5a844fa700(0000) GS:ffff88885f680000(0000) knlGS:0000000000000000 [1417839.669810] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [1417839.682887] CR2: 00007f7884541fe0 CR3: 000000049f609002 CR4: 00000000003606e0 [1417839.699037] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [1417839.715187] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [1417839.731320] Call Trace: [1417839.737103] release_extent_buffer+0x39/0x90 [1417839.746913] read_block_for_search.isra.38+0x2a3/0x370 [1417839.758645] btrfs_search_slot+0x260/0x9b0 [1417839.768054] btrfs_lookup_file_extent+0x4a/0x70 [1417839.778427] btrfs_get_extent+0x15f/0x830 [1417839.787665] ? submit_extent_page+0xc4/0x1c0 [1417839.797474] ? __do_readpage+0x299/0x7a0 [1417839.806515] __do_readpage+0x33b/0x7a0 [1417839.815171] ? btrfs_releasepage+0x70/0x70 [1417839.824597] extent_readpages+0x28f/0x400 [1417839.833836] read_pages+0x6a/0x1c0 [1417839.841729] ? startup_64+0x2/0x30 [1417839.849624] __do_page_cache_readahead+0x13c/0x1a0 [1417839.860590] filemap_fault+0x6c7/0x990 [1417839.869252] ? xas_load+0x8/0x80 [1417839.876756] ? xas_find+0x150/0x190 [1417839.884839] ? filemap_map_pages+0x295/0x3b0 [1417839.894652] __do_fault+0x32/0x110 [1417839.902540] __handle_mm_fault+0xacd/0x1000 [1417839.912156] handle_mm_fault+0xaa/0x1c0 [1417839.921004] __do_page_fault+0x242/0x4b0 [1417839.930044] ? page_fault+0x8/0x30 [1417839.937933] page_fault+0x1e/0x30 [1417839.945631] RIP: 0033:0x33c4bae [1417839.952927] Code: Bad RIP value. [1417839.960411] RSP: 002b:00007f5a844f7350 EFLAGS: 00010206 [1417839.972331] RAX: 000000000000006e RBX: 1614b3ff6a50398a RCX: 0000000000000000 [1417839.988477] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000002 [1417840.004626] RBP: 00007f5a844f7420 R08: 000000000000006e R09: 00007f5a94aeccb8 [1417840.020784] R10: 00007f5a844f7350 R11: 0000000000000000 R12: 00007f5a94aecc79 [1417840.036932] R13: 00007f5a94aecc78 R14: 00007f5a94aecc90 R15: 00007f5a94aecc40
--- fs/btrfs/extent_io.c | 40 ++++++++++++++++++++++++---------------- 1 file changed, 24 insertions(+), 16 deletions(-)
fs/btrfs/extent_io.c +24 -16
@@ -4861,25 +4861,28 @@ err:static void check_buffer_tree_ref (struct extent_buffer *eb) {int refs; -/* the ref bit is tricky. We have to make sure it is set -* if we have the buffer dirty. Otherwise the -* code to free a buffer can end up dropping a dirty -* page +/* +* The TREE_REF bit is first set when the extent_buffer is added +* to the radix tree. It is also reset, if unset, when a new reference +* is created by find_extent_buffer. * -* Once the ref bit is set, it won't go away while the -* buffer is dirty or in writeback, and it also won't -* go away while we have the reference count on the -* eb bumped. +* It is only cleared in two cases: freeing the last non-tree +* reference to the extent_buffer when its STALE bit is set or +* calling releasepage when the tree reference is the only reference. * -* We can't just set the ref bit without bumping the -* ref on the eb because free_extent_buffer might -* see the ref bit and try to clear it. If this happens -* free_extent_buffer might end up dropping our original -* ref by mistake and freeing the page before we are able -* to add one more ref. +* In both cases, care is taken to ensure that the extent_buffer's +* pages are not under io. However, releasepage can be concurrently +* called with creating new references, which is prone to race +* conditions between the calls to check_buffer_tree_ref in those +* codepaths and clearing TREE_REF in try_release_extent_buffer. * -* So bump the ref count first, then set the bit. If someone -* beat us to it, drop the ref we added. +* The actual lifetime of the extent_buffer in the radix tree is +* adequately protected by the refcount, but the TREE_REF bit and +* its corresponding reference are not. To protect against this +* class of races, we call check_buffer_tree_ref from the codepaths +* which trigger io after they set eb->io_pages. Note that once io is +* initiated, TREE_REF can no longer be cleared, so that is the +* moment at which any such race is best fixed. */ refs =atomic_read (&eb->refs);if (refs >=2 &&test_bit (EXTENT_BUFFER_TREE_REF , &eb->bflags))
@@ -5346,6 +5349,11 @@ int read_extent_buffer_pages(struct exteclear_bit (EXTENT_BUFFER_READ_ERR , &eb->bflags); eb->read_mirror =0 ;atomic_set (&eb->io_pages, num_reads); +/* +* It is possible for releasepage to clear the TREE_REF bit before we +* set io_pages. See check_buffer_tree_ref for a more detailed comment. +*/ +check_buffer_tree_ref (eb);for (i = start_i; i < num_pages; i++) { page = eb->pages[i];if (!PageUptodate (page)) {
Greg Kroah-Hartman
maintainerPATCH 16/58 drm/radeon: fix double free
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 41855a898650803e24b284173354cc3e44d07725 upstream.
clang static analysis flags this error
drivers/gpu/drm/radeon/ci_dpm.c:5652:9: warning: Use of memory after it is freed [unix.Malloc]
kfree(rdev->pm.dpm.ps[i].ps_priv);
^~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/gpu/drm/radeon/ci_dpm.c:5654:2: warning: Attempt to free released memory [unix.Malloc]
kfree(rdev->pm.dpm.ps);
^~~~~~~~~~~~~~~~~~~~~~problem is reported in ci_dpm_fini, with these code blocks.
for (i = 0; i < rdev->pm.dpm.num_ps; i++) {
kfree(rdev->pm.dpm.ps[i].ps_priv);
}
kfree(rdev->pm.dpm.ps);The first free happens in ci_parse_power_table where it cleans up locally on a failure. ci_dpm_fini also does a cleanup.
ret = ci_parse_power_table(rdev);
if (ret) {
ci_dpm_fini(rdev);
return ret;
}So remove the cleanup in ci_parse_power_table and move the num_ps calculation to inside the loop so ci_dpm_fini will know how many array elements to free.
--- drivers/gpu/drm/radeon/ci_dpm.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/ci_dpm.c +3 -4
@@ -5554,6 +5554,7 @@ static int ci_parse_power_table(struct rif (!rdev->pm.dpm.ps)return -ENOMEM ; power_state_offset = (u8 *)state_array->states; + rdev->pm.dpm.num_ps =0 ;for (i =0 ; i < state_array->ucNumEntries; i++) {u8 *idx; power_state = (union pplib_power_state *)power_state_offset;
@@ -5563,10 +5564,8 @@ static int ci_parse_power_table(struct rif (!rdev->pm.power_state[i].clock_info)return -EINVAL ; ps =kzalloc (sizeof (struct ci_ps ),GFP_KERNEL ); -if (ps ==NULL ) { -kfree (rdev->pm.dpm.ps); +if (ps ==NULL )return -ENOMEM ; - } rdev->pm.dpm.ps[i].ps_priv = ps; ci_parse_pplib_non_clock_info(rdev, &rdev->pm.dpm.ps[i], non_clock_info,
@@ -5588,8 +5587,8 @@ static int ci_parse_power_table(struct r k++; } power_state_offset +=2 + power_state->v2.ucNumDPMLevels; + rdev->pm.dpm.num_ps = i +1 ; } - rdev->pm.dpm.num_ps = state_array->ucNumEntries;/* fill in the vce power states */ for (i =0 ; i <RADEON_MAX_VCE_LEVELS ; i++) {
Greg Kroah-Hartman
maintainerPATCH 17/58 ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit 00fdec98d9881bf5173af09aebd353ab3b9ac729 upstream.
Trap handler for syscall tracing reads EFA (Exception Fault Address), in case strace wants PC of trap instruction (EFA is not part of pt_regs as of current code).
However this EFA read is racy as it happens after dropping to pure kernel mode (re-enabling interrupts). A taken interrupt could context-switch, trigger a different task's trap, clobbering EFA for this execution context.
Fix this by reading EFA early, before re-enabling interrupts. A slight side benefit is de-duplication of FAKE_RET_FROM_EXCPN in trap handler. The trap handler is common to both ARCompact and ARCv2 builds too.
This just came out of code rework/review and no real problem was reported but is clearly a potential problem specially for strace.
--- arch/arc/kernel/entry.S | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-)
arch/arc/kernel/entry.S +5 -11
@@ -168,7 +168,6 @@ END(EV_Extension) tracesys: ; save EFA in case tracer wants the PC of traced task ; using ERET won't work since next-PC has already committed - lr r12, [efa] GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
@@ -211,15 +210,9 @@ tracesys_exit: ; Breakpoint TRAP ; --------------------------------------------- trap_with_param: - - ; stop_pc info by gdb needs this info - lr r0, [efa] + mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc mov r1, sp - ; Now that we have read EFA, it is safe to do "fake" rtie - ; and get out of CPU exception mode - FAKE_RET_FROM_EXCPN - ; Save callee regs in case gdb wants to have a look ; SP will grow up by size of CALLEE Reg-File ; NOTE: clobbers r12
@@ -246,6 +239,10 @@ ENTRY(EV_Trap) EXCEPTION_PROLOGUE + lr r12, [efa] + + FAKE_RET_FROM_EXCPN + ;============ TRAP 1 :breakpoints ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) bmsk.f 0, r9, 7
@@ -253,9 +250,6 @@ ENTRY(EV_Trap) ;============ TRAP (no param): syscall top level - ; First return from Exception to pure K mode (Exception/IRQs renabled) - FAKE_RET_FROM_EXCPN - ; If syscall tracing ongoing, invoke pre-post-hooks GET_CURR_THR_INFO_FLAGS r10 btst r10, TIF_SYSCALL_TRACE
Greg Kroah-Hartman
maintainerPATCH 18/58 ARC: elf: use right ELF_ARCH
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit b7faf971081a4e56147f082234bfff55135305cb upstream.
--- arch/arc/include/asm/elf.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arc/include/asm/elf.h +1 -1
@@ -27,7 +27,7 @@#define R_ARC_S25W_PCREL 0x11/*to set parameters in the core dumps */ -#define ELF_ARCH EM_ARCOMPACT +#define ELF_ARCH EM_ARC_INUSE#define ELF_CLASS ELFCLASS32#ifdef CONFIG_CPU_BIG_ENDIAN
Greg Kroah-Hartman
maintainerPATCH 19/58 bnxt_en: fix NULL dereference in case SR-IOV configuration fails
In reply to Greg Kroah-HartmanFrom: Davide Caratti <[email protected]>
commit c8b1d7436045d3599bae56aef1682813ecccaad7 upstream.
we need to set 'active_vfs' back to 0, if something goes wrong during the allocation of SR-IOV resources: otherwise, further VF configurations will wrongly assume that bp->pf.vf[x] are valid memory locations, and commands like the ones in the following sequence:
# echo 2 >/sys/bus/pci/devices/${ADDR}/sriov_numvfs
# ip link set dev ens1f0np0 up
# ip link set dev ens1f0np0 vf 0 trust onwill cause a kernel crash similar to this:
bnxt_en 0000:3b:00.0: not enough MMIO resources for SR-IOV
BUG: kernel NULL pointer dereference, address: 0000000000000014 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP PTI CPU: 43 PID: 2059 Comm: ip Tainted: G I 5.8.0-rc2.upstream+ #871 Hardware name: Dell Inc. PowerEdge R740/08D89F, BIOS 2.2.11 06/13/2019 RIP: 0010:bnxt_set_vf_trust+0x5b/0x110 [bnxt_en] Code: 44 24 58 31 c0 e8 f5 fb ff ff 85 c0 0f 85 b6 00 00 00 48 8d 1c 5b 41 89 c6 b9 0b 00 00 00 48 c1 e3 04 49 03 9c 24 f0 0e 00 00 <8b> 43 14 89 c2 83 c8 10 83 e2 ef 45 84 ed 49 89 e5 0f 44 c2 4c 89 RSP: 0018:ffffac6246a1f570 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000000b RDX: 0000000000000001 RSI: 0000000000000000 RDI: ffff98b28f538900 RBP: ffff98b28f538900 R08: 0000000000000000 R09: 0000000000000008 R10: ffffffffb9515be0 R11: ffffac6246a1f678 R12: ffff98b28f538000 R13: 0000000000000001 R14: 0000000000000000 R15: ffffffffc05451e0 FS: 00007fde0f688800(0000) GS:ffff98baffd40000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000014 CR3: 000000104bb0a003 CR4: 00000000007606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: do_setlink+0x994/0xfe0 __rtnl_newlink+0x544/0x8d0 rtnl_newlink+0x47/0x70 rtnetlink_rcv_msg+0x29f/0x350 netlink_rcv_skb+0x4a/0x110 netlink_unicast+0x21d/0x300 netlink_sendmsg+0x329/0x450 sock_sendmsg+0x5b/0x60 ____sys_sendmsg+0x204/0x280 ___sys_sendmsg+0x88/0xd0 __sys_sendmsg+0x5e/0xa0 do_syscall_64+0x47/0x80 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +1 -1
@@ -295,6 +295,7 @@ static void bnxt_free_vf_resources(struc } } + bp->pf.active_vfs =0 ;kfree (bp->pf.vf); bp->pf.vf =NULL ; }
@@ -535,7 +536,6 @@ void bnxt_sriov_disable(struct bnxt *bp)bnxt_free_vf_resources (bp); - bp->pf.active_vfs =0 ; bp->pf.max_pf_rx_rings = bp->pf.max_rx_rings; bp->pf.max_pf_tx_rings = bp->pf.max_tx_rings; }
Greg Kroah-Hartman
maintainerPATCH 20/58 ipv4: fill fl4_icmp_{type,code} in ping_v4_sendmsg
In reply to Greg Kroah-HartmanFrom: Sabrina Dubroca <[email protected]>
[ Upstream commit 5eff06902394425c722f0a44d9545909a8800f79 ]
IPv4 ping sockets don't set fl4.fl4_icmp_{type,code}, which leads to incomplete IPsec ACQUIRE messages being sent to userspace. Currently, both raw sockets and IPv6 ping sockets set those fields.
Expected output of "ip xfrm monitor":
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 8 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>Currently with ping sockets:
acquire proto esp
sel src 10.0.2.15/32 dst 8.8.8.8/32 proto icmp type 0 code 0 dev ens4
policy src 10.0.2.15/32 dst 8.8.8.8/32
<snip>The Libreswan test suite found this problem after Fedora changed the value for the sysctl net.ipv4.ping_group_range.
--- net/ipv4/ping.c | 3 +++ 1 file changed, 3 insertions(+)
net/ipv4/ping.c +3 -0
@@ -802,6 +802,9 @@ static int ping_v4_sendmsg(struct sock *RT_SCOPE_UNIVERSE , sk->sk_protocol, inet_sk_flowi_flags(sk), faddr, saddr, 0, 0); + fl4.fl4_icmp_type = user_icmph.type; + fl4.fl4_icmp_code = user_icmph.code; +security_sk_classify_flow (sk,flowi4_to_flowi (&fl4)); rt =ip_route_output_flow (net, &fl4, sk);if (IS_ERR (rt)) {
Greg Kroah-Hartman
maintainerPATCH 21/58 l2tp: remove skb_dst_set() from l2tp_xmit_skb()
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit 27d53323664c549b5bb2dfaaf6f7ad6e0376a64e ]
In the tx path of l2tp, l2tp_xmit_skb() calls skb_dst_set() to set skb's dst. However, it will eventually call inet6_csk_xmit() or ip_queue_xmit() where skb's dst will be overwritten by:
skb_dst_set_noref(skb, dst);
without releasing the old dst in skb. Then it causes dst/dev refcnt leak:
unregister_netdevice: waiting for eth0 to become free. Usage count = 1
This can be reproduced by simply running:
# modprobe l2tp_eth && modprobe l2tp_ip # sh ./tools/testing/selftests/net/l2tp.sh
So before going to inet6_csk_xmit() or ip_queue_xmit(), skb's dst should be dropped. This patch is to fix it by removing skb_dst_set() from l2tp_xmit_skb() and moving skb_dst_drop() into l2tp_xmit_core().
--- net/l2tp/l2tp_core.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/l2tp/l2tp_core.c +1 -4
@@ -1139,6 +1139,7 @@ static int l2tp_xmit_core(struct l2tp_se/* Queue the packet to IP for output */ skb->ignore_df =1 ; +skb_dst_drop (skb);#if IS_ENABLED (CONFIG_IPV6 )if (tunnel->sock->sk_family ==PF_INET6 && !tunnel->v4mapped) error =inet6_csk_xmit (tunnel->sock, skb,NULL );
@@ -1203,10 +1204,6 @@ int l2tp_xmit_skb(struct l2tp_session *s goto out_unlock; } -/* Get routing info from the tunnel socket */ -skb_dst_drop (skb); -skb_dst_set (skb,sk_dst_check (sk,0 )); - inet =inet_sk (sk); fl = &inet->cork.fl;switch (tunnel->encap) {
Greg Kroah-Hartman
maintainerPATCH 22/58 llc: make sure applications use ARPHRD_ETHER
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a9b1110162357689a34992d5c925852948e5b9fd ]
syzbot was to trigger a bug by tricking AF_LLC with non sensible addr->sllc_arphrd
It seems clear LLC requires an Ethernet device.
Back in commit abf9d537fea2 ("llc: add support for SO_BINDTODEVICE") Octavian Purdila added possibility for application to use a zero value for sllc_arphrd, convert it to ARPHRD_ETHER to not cause regressions on existing applications.
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:199 [inline]
BUG: KASAN: use-after-free in list_empty include/linux/list.h:268 [inline]
BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:126 [inline]
BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:160 [inline]
BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2092 [inline]
BUG: KASAN: use-after-free in sock_def_write_space+0x642/0x670 net/core/sock.c:2813
Read of size 8 at addr ffff88801e0b4078 by task ksoftirqd/3/27
CPU: 3 PID: 27 Comm: ksoftirqd/3 Not tainted 5.5.0-rc1-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x197/0x210 lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374
__kasan_report.cold+0x1b/0x41 mm/kasan/report.c:506
kasan_report+0x12/0x20 mm/kasan/common.c:639
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
__read_once_size include/linux/compiler.h:199 [inline]
list_empty include/linux/list.h:268 [inline]
waitqueue_active include/linux/wait.h:126 [inline]
wq_has_sleeper include/linux/wait.h:160 [inline]
skwq_has_sleeper include/net/sock.h:2092 [inline]
sock_def_write_space+0x642/0x670 net/core/sock.c:2813
sock_wfree+0x1e1/0x260 net/core/sock.c:1958
skb_release_head_state+0xeb/0x260 net/core/skbuff.c:652
skb_release_all+0x16/0x60 net/core/skbuff.c:663
__kfree_skb net/core/skbuff.c:679 [inline]
consume_skb net/core/skbuff.c:838 [inline]
consume_skb+0xfb/0x410 net/core/skbuff.c:832
__dev_kfree_skb_any+0xa4/0xd0 net/core/dev.c:2967
dev_kfree_skb_any include/linux/netdevice.h:3650 [inline]
e1000_unmap_and_free_tx_resource.isra.0+0x21b/0x3a0 drivers/net/ethernet/intel/e1000/e1000_main.c:1963
e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3854 [inline]
e1000_clean+0x4cc/0x1d10 drivers/net/ethernet/intel/e1000/e1000_main.c:3796
napi_poll net/core/dev.c:6532 [inline]
net_rx_action+0x508/0x1120 net/core/dev.c:6600
__do_softirq+0x262/0x98c kernel/softirq.c:292
run_ksoftirqd kernel/softirq.c:603 [inline]
run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595
smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Allocated by task 8247:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
__kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:486
kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:521
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc mm/slab.c:3320 [inline]
kmem_cache_alloc+0x121/0x710 mm/slab.c:3484
sock_alloc_inode+0x1c/0x1d0 net/socket.c:240
alloc_inode+0x68/0x1e0 fs/inode.c:230
new_inode_pseudo+0x19/0xf0 fs/inode.c:919
sock_alloc+0x41/0x270 net/socket.c:560
__sock_create+0xc2/0x730 net/socket.c:1384
sock_create net/socket.c:1471 [inline]
__sys_socket+0x103/0x220 net/socket.c:1513
__do_sys_socket net/socket.c:1522 [inline]
__se_sys_socket net/socket.c:1520 [inline]
__ia32_sys_socket+0x73/0xb0 net/socket.c:1520
do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
do_fast_syscall_32+0x27b/0xe16 arch/x86/entry/common.c:408
entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139
Freed by task 17:
save_stack+0x23/0x90 mm/kasan/common.c:72
set_track mm/kasan/common.c:80 [inline]
kasan_set_free_info mm/kasan/common.c:335 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/common.c:474
kasan_slab_free+0xe/0x10 mm/kasan/common.c:483
__cache_free mm/slab.c:3426 [inline]
kmem_cache_free+0x86/0x320 mm/slab.c:3694
sock_free_inode+0x20/0x30 net/socket.c:261
i_callback+0x44/0x80 fs/inode.c:219
__rcu_reclaim kernel/rcu/rcu.h:222 [inline]
rcu_do_batch kernel/rcu/tree.c:2183 [inline]
rcu_core+0x570/0x1540 kernel/rcu/tree.c:2408
rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2417
__do_softirq+0x262/0x98c kernel/softirq.c:292
The buggy address belongs to the object at ffff88801e0b4000
which belongs to the cache sock_inode_cache of size 1152
The buggy address is located 120 bytes inside of
1152-byte region [ffff88801e0b4000, ffff88801e0b4480)
The buggy address belongs to the page:
page:ffffea0000782d00 refcount:1 mapcount:0 mapping:ffff88807aa59c40 index:0xffff88801e0b4ffd
raw: 00fffe0000000200 ffffea00008e6c88 ffffea0000782d48 ffff88807aa59c40
raw: ffff88801e0b4ffd ffff88801e0b4000 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801e0b3f00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88801e0b3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801e0b4000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801e0b4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801e0b4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb--- net/llc/af_llc.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/llc/af_llc.c +7 -3
@@ -271,6 +271,10 @@ static int llc_ui_autobind(struct socketif (!sock_flag (sk,SOCK_ZAPPED )) goto out; +if (!addr->sllc_arphrd) + addr->sllc_arphrd =ARPHRD_ETHER ; +if (addr->sllc_arphrd !=ARPHRD_ETHER ) + goto out; rc = -ENODEV ;if (sk->sk_bound_dev_if) { llc->dev =dev_get_by_index (&init_net, sk->sk_bound_dev_if);
@@ -328,15 +332,15 @@ static int llc_ui_bind(struct socket *soif (unlikely (!sock_flag (sk,SOCK_ZAPPED ) || addrlen !=sizeof (*addr))) goto out; rc = -EAFNOSUPPORT ; -if (unlikely (addr->sllc_family !=AF_LLC )) +if (!addr->sllc_arphrd) + addr->sllc_arphrd =ARPHRD_ETHER ; +if (unlikely (addr->sllc_family !=AF_LLC || addr->sllc_arphrd !=ARPHRD_ETHER )) goto out; rc = -ENODEV ;rcu_read_lock ();if (sk->sk_bound_dev_if) { llc->dev =dev_get_by_index_rcu (&init_net, sk->sk_bound_dev_if);if (llc->dev) { -if (!addr->sllc_arphrd) - addr->sllc_arphrd = llc->dev->type;if (is_zero_ether_addr (addr->sllc_mac))memcpy (addr->sllc_mac, llc->dev->dev_addr,IFHWADDRLEN );
Greg Kroah-Hartman
maintainerPATCH 23/58 net: Added pointer check for dst->ops->neigh_lookup in dst_neigh_lookup_skb
In reply to Greg Kroah-HartmanFrom: Martin Varghese <[email protected]>
[ Upstream commit 394de110a73395de2ca4516b0de435e91b11b604 ]
The packets from tunnel devices (eg bareudp) may have only metadata in the dst pointer of skb. Hence a pointer check of neigh_lookup is needed in dst_neigh_lookup_skb
Kernel crashes when packets from bareudp device is processed in the kernel neighbour subsytem.
[ 133.384484] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 133.385240] #PF: supervisor instruction fetch in kernel mode [ 133.385828] #PF: error_code(0x0010) - not-present page [ 133.386603] PGD 0 P4D 0 [ 133.386875] Oops: 0010 [#1] SMP PTI [ 133.387275] CPU: 0 PID: 5045 Comm: ping Tainted: G W 5.8.0-rc2+ #15 [ 133.388052] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 [ 133.391076] RIP: 0010:0x0 [ 133.392401] Code: Bad RIP value. [ 133.394029] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.396656] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.399018] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.399685] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.400350] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.401010] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.401667] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.402412] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.402948] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.403611] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.404270] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.404933] Call Trace: [ 133.405169] <IRQ> [ 133.405367] __neigh_update+0x5a4/0x8f0 [ 133.405734] arp_process+0x294/0x820 [ 133.406076] ? __netif_receive_skb_core+0x866/0xe70 [ 133.406557] arp_rcv+0x129/0x1c0 [ 133.406882] __netif_receive_skb_one_core+0x95/0xb0 [ 133.407340] process_backlog+0xa7/0x150 [ 133.407705] net_rx_action+0x2af/0x420 [ 133.408457] __do_softirq+0xda/0x2a8 [ 133.408813] asm_call_on_stack+0x12/0x20 [ 133.409290] </IRQ> [ 133.409519] do_softirq_own_stack+0x39/0x50 [ 133.410036] do_softirq+0x50/0x60 [ 133.410401] __local_bh_enable_ip+0x50/0x60 [ 133.410871] ip_finish_output2+0x195/0x530 [ 133.411288] ip_output+0x72/0xf0 [ 133.411673] ? __ip_finish_output+0x1f0/0x1f0 [ 133.412122] ip_send_skb+0x15/0x40 [ 133.412471] raw_sendmsg+0x853/0xab0 [ 133.412855] ? insert_pfn+0xfe/0x270 [ 133.413827] ? vvar_fault+0xec/0x190 [ 133.414772] sock_sendmsg+0x57/0x80 [ 133.415685] __sys_sendto+0xdc/0x160 [ 133.416605] ? syscall_trace_enter+0x1d4/0x2b0 [ 133.417679] ? __audit_syscall_exit+0x1d9/0x280 [ 133.418753] ? __prepare_exit_to_usermode+0x5d/0x1a0 [ 133.419819] __x64_sys_sendto+0x24/0x30 [ 133.420848] do_syscall_64+0x4d/0x90 [ 133.421768] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 133.422833] RIP: 0033:0x7fe013689c03 [ 133.423749] Code: Bad RIP value. [ 133.424624] RSP: 002b:00007ffc7288f418 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 133.425940] RAX: ffffffffffffffda RBX: 000056151fc63720 RCX: 00007fe013689c03 [ 133.427225] RDX: 0000000000000040 RSI: 000056151fc63720 RDI: 0000000000000003 [ 133.428481] RBP: 00007ffc72890b30 R08: 000056151fc60500 R09: 0000000000000010 [ 133.429757] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 133.431041] R13: 000056151fc636e0 R14: 000056151fc616bc R15: 0000000000000080 [ 133.432481] Modules linked in: mpls_iptunnel act_mirred act_tunnel_key cls_flower sch_ingress veth mpls_router ip_tunnel bareudp ip6_udp_tunnel udp_tunnel macsec udp_diag inet_diag unix_diag af_packet_diag netlink_diag binfmt_misc xt_MASQUERADE iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter bridge stp llc ebtable_filter ebtables overlay ip6table_filter ip6_tables iptable_filter sunrpc ext4 mbcache jbd2 pcspkr i2c_piix4 virtio_balloon joydev ip_tables xfs libcrc32c ata_generic qxl pata_acpi drm_ttm_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm ata_piix libata virtio_net net_failover virtio_console failover virtio_blk i2c_core virtio_pci virtio_ring serio_raw floppy virtio dm_mirror dm_region_hash dm_log dm_mod [ 133.444045] CR2: 0000000000000000 [ 133.445082] ---[ end trace f4aeee1958fd1638 ]--- [ 133.446236] RIP: 0010:0x0 [ 133.447180] Code: Bad RIP value. [ 133.448152] RSP: 0018:ffffb79980003d50 EFLAGS: 00010246 [ 133.449363] RAX: 0000000080000102 RBX: ffff9de2fe0d6600 RCX: ffff9de2fe5e9d00 [ 133.450835] RDX: 0000000000000000 RSI: ffff9de2fe5e9d00 RDI: ffff9de2fc21b400 [ 133.452237] RBP: ffff9de2fe5e9d00 R08: 0000000000000000 R09: 0000000000000000 [ 133.453722] R10: ffff9de2fbc6be22 R11: ffff9de2fe0d6600 R12: ffff9de2fc21b400 [ 133.455149] R13: ffff9de2fe0d6628 R14: 0000000000000001 R15: 0000000000000003 [ 133.456520] FS: 00007fe014918740(0000) GS:ffff9de2fec00000(0000) knlGS:0000000000000000 [ 133.458046] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 133.459342] CR2: ffffffffffffffd6 CR3: 000000003bb72000 CR4: 00000000000006f0 [ 133.460782] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 133.462240] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 133.463697] Kernel panic - not syncing: Fatal exception in interrupt [ 133.465226] Kernel Offset: 0xfa00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 133.467025] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
--- include/net/dst.h | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
include/net/dst.h +9 -1
@@ -470,7 +470,15 @@ static inline struct neighbour *dst_neigstatic inline struct neighbour *dst_neigh_lookup_skb (const struct dst_entry *dst,struct sk_buff *skb) { -struct neighbour *n = dst->ops->neigh_lookup (dst, skb,NULL ); +struct neighbour *n =NULL ; + +/* The packets from tunnel devices (eg bareudp) may have only +* metadata in the dst pointer of skb. Hence a pointer check of +* neigh_lookup is needed. +*/ +if (dst->ops->neigh_lookup) + n = dst->ops->neigh_lookup (dst, skb,NULL ); +return IS_ERR (n) ?NULL : n; }
Greg Kroah-Hartman
maintainerPATCH 24/58 genetlink: remove genl_bind
In reply to Greg Kroah-HartmanFrom: Sean Tranchetti <[email protected]>
[ Upstream commit 1e82a62fec613844da9e558f3493540a5b7a7b67 ]
A potential deadlock can occur during registering or unregistering a new generic netlink family between the main nl_table_lock and the cb_lock where each thread wants the lock held by the other, as demonstrated below.
1) Thread 1 is performing a netlink_bind() operation on a socket. As part of this call, it will call netlink_lock_table(), incrementing the nl_table_users count to 1.
2) Thread 2 is registering (or unregistering) a genl_family via the genl_(un)register_family() API. The cb_lock semaphore will be taken for writing.
3) Thread 1 will call genl_bind() as part of the bind operation to handle subscribing to GENL multicast groups at the request of the user. It will attempt to take the cb_lock semaphore for reading, but it will fail and be scheduled away, waiting for Thread 2 to finish the write.
4) Thread 2 will call netlink_table_grab() during the (un)registration call. However, as Thread 1 has incremented nl_table_users, it will not be able to proceed, and both threads will be stuck waiting for the other.
genl_bind() is a noop, unless a genl_family implements the mcast_bind() function to handle setting up family-specific multicast operations. Since no one in-tree uses this functionality as Cong pointed out, simply removing the genl_bind() function will remove the possibility for deadlock, as there is no attempt by Thread 1 above to take the cb_lock semaphore.
--- include/net/genetlink.h | 8 ------- net/netlink/genetlink.c | 52 ------------------------------------------------ 2 files changed, 60 deletions(-)
include/net/genetlink.h +0 -8
@@ -33,12 +33,6 @@ struct genl_info;* do additional, common, filtering and return an error * @post_doit: called after an operation's doit callback, it may * undo operations done by pre_doit, for example release locks -* @mcast_bind: a socket bound to the given multicast group (which -* is given as the offset into the groups array) -* @mcast_unbind: a socket was unbound from the given multicast group. -* Note that unbind() will not be called symmetrically if the -* generic netlink family is removed while there are still open -* sockets. * @attrbuf: buffer to store parsed attributes * @family_list: family list * @mcgrps: multicast groups used by this family (private)
@@ -61,8 +55,6 @@ struct genl_family {void (*post_doit)(const struct genl_ops *ops,struct sk_buff *skb,struct genl_info *info); -int (*mcast_bind)(struct net *net,int group); -void (*mcast_unbind)(struct net *net,int group);struct nlattr ** attrbuf;/* private */ const struct genl_ops * ops;/* private */ const struct genl_multicast_group *mcgrps;/* private */
net/netlink/genetlink.c +0 -52
63 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 25/58 tcp: make sure listeners dont initialize congestion-control state
In reply to Greg Kroah-HartmanFrom: Christoph Paasch <[email protected]>
[ Upstream commit ce69e563b325f620863830c246a8698ccea52048 ]
syzkaller found its way into setsockopt with TCP_CONGESTION "cdg". tcp_cdg_init() does a kcalloc to store the gradients. As sk_clone_lock just copies all the memory, the allocated pointer will be copied as well, if the app called setsockopt(..., TCP_CONGESTION) on the listener. If now the socket will be destroyed before the congestion-control has properly been initialized (through a call to tcp_init_transfer), we will end up freeing memory that does not belong to that particular socket, opening the door to a double-free:
[ 11.413102] ================================================================== [ 11.414181] BUG: KASAN: double-free or invalid-free in tcp_cleanup_congestion_control+0x58/0xd0 [ 11.415329] [ 11.415560] CPU: 3 PID: 4884 Comm: syz-executor.5 Not tainted 5.8.0-rc2 #80 [ 11.416544] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 11.418148] Call Trace: [ 11.418534] <IRQ> [ 11.418834] dump_stack+0x7d/0xb0 [ 11.419297] print_address_description.constprop.0+0x1a/0x210 [ 11.422079] kasan_report_invalid_free+0x51/0x80 [ 11.423433] __kasan_slab_free+0x15e/0x170 [ 11.424761] kfree+0x8c/0x230 [ 11.425157] tcp_cleanup_congestion_control+0x58/0xd0 [ 11.425872] tcp_v4_destroy_sock+0x57/0x5a0 [ 11.426493] inet_csk_destroy_sock+0x153/0x2c0 [ 11.427093] tcp_v4_syn_recv_sock+0xb29/0x1100 [ 11.427731] tcp_get_cookie_sock+0xc3/0x4a0 [ 11.429457] cookie_v4_check+0x13d0/0x2500 [ 11.433189] tcp_v4_do_rcv+0x60e/0x780 [ 11.433727] tcp_v4_rcv+0x2869/0x2e10 [ 11.437143] ip_protocol_deliver_rcu+0x23/0x190 [ 11.437810] ip_local_deliver+0x294/0x350 [ 11.439566] __netif_receive_skb_one_core+0x15d/0x1a0 [ 11.441995] process_backlog+0x1b1/0x6b0 [ 11.443148] net_rx_action+0x37e/0xc40 [ 11.445361] __do_softirq+0x18c/0x61a [ 11.445881] asm_call_on_stack+0x12/0x20 [ 11.446409] </IRQ> [ 11.446716] do_softirq_own_stack+0x34/0x40 [ 11.447259] do_softirq.part.0+0x26/0x30 [ 11.447827] __local_bh_enable_ip+0x46/0x50 [ 11.448406] ip_finish_output2+0x60f/0x1bc0 [ 11.450109] __ip_queue_xmit+0x71c/0x1b60 [ 11.451861] __tcp_transmit_skb+0x1727/0x3bb0 [ 11.453789] tcp_rcv_state_process+0x3070/0x4d3a [ 11.456810] tcp_v4_do_rcv+0x2ad/0x780 [ 11.457995] __release_sock+0x14b/0x2c0 [ 11.458529] release_sock+0x4a/0x170 [ 11.459005] __inet_stream_connect+0x467/0xc80 [ 11.461435] inet_stream_connect+0x4e/0xa0 [ 11.462043] __sys_connect+0x204/0x270 [ 11.465515] __x64_sys_connect+0x6a/0xb0 [ 11.466088] do_syscall_64+0x3e/0x70 [ 11.466617] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 11.467341] RIP: 0033:0x7f56046dc469 [ 11.467844] Code: Bad RIP value. [ 11.468282] RSP: 002b:00007f5604dccdd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 11.469326] RAX: ffffffffffffffda RBX: 000000000068bf00 RCX: 00007f56046dc469 [ 11.470379] RDX: 0000000000000010 RSI: 0000000020000000 RDI: 0000000000000004 [ 11.471311] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 [ 11.472286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 11.473341] R13: 000000000041427c R14: 00007f5604dcd5c0 R15: 0000000000000003 [ 11.474321] [ 11.474527] Allocated by task 4884: [ 11.475031] save_stack+0x1b/0x40 [ 11.475548] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 11.476182] tcp_cdg_init+0xf0/0x150 [ 11.476744] tcp_init_congestion_control+0x9b/0x3a0 [ 11.477435] tcp_set_congestion_control+0x270/0x32f [ 11.478088] do_tcp_setsockopt.isra.0+0x521/0x1a00 [ 11.478744] __sys_setsockopt+0xff/0x1e0 [ 11.479259] __x64_sys_setsockopt+0xb5/0x150 [ 11.479895] do_syscall_64+0x3e/0x70 [ 11.480395] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 11.481097] [ 11.481321] Freed by task 4872: [ 11.481783] save_stack+0x1b/0x40 [ 11.482230] __kasan_slab_free+0x12c/0x170 [ 11.482839] kfree+0x8c/0x230 [ 11.483240] tcp_cleanup_congestion_control+0x58/0xd0 [ 11.483948] tcp_v4_destroy_sock+0x57/0x5a0 [ 11.484502] inet_csk_destroy_sock+0x153/0x2c0 [ 11.485144] tcp_close+0x932/0xfe0 [ 11.485642] inet_release+0xc1/0x1c0 [ 11.486131] __sock_release+0xc0/0x270 [ 11.486697] sock_close+0xc/0x10 [ 11.487145] __fput+0x277/0x780 [ 11.487632] task_work_run+0xeb/0x180 [ 11.488118] __prepare_exit_to_usermode+0x15a/0x160 [ 11.488834] do_syscall_64+0x4a/0x70 [ 11.489326] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Wei Wang fixed a part of these CDG-malloc issues with commit c12014440750 ("tcp: memset ca_priv data to 0 properly").
This patch here fixes the listener-scenario: We make sure that listeners setting the congestion-control through setsockopt won't initialize it (thus CDG never allocates on listeners). For those who use AF_UNSPEC to reuse a socket, tcp_disconnect() is changed to cleanup afterwards.
(The issue can be reproduced at least down to v4.4.x.)
--- net/ipv4/tcp.c | 3 +++ net/ipv4/tcp_cong.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +3 -0
@@ -2259,6 +2259,9 @@ int tcp_disconnect(struct sock *sk, int tp->snd_ssthresh =TCP_INFINITE_SSTHRESH ; tp->snd_cwnd_cnt =0 ; tp->window_clamp =0 ; +if (icsk->icsk_ca_ops->release) + icsk->icsk_ca_ops->release (sk); +memset (icsk->icsk_ca_priv,0 ,sizeof (icsk->icsk_ca_priv));tcp_set_ca_state (sk, TCP_CA_Open);tcp_clear_retrans (tp); tp->total_retrans =0 ;
net/ipv4/tcp_cong.c +1 -1
@@ -201,7 +201,7 @@ static void tcp_reinit_congestion_contro icsk->icsk_ca_ops = ca; icsk->icsk_ca_setsockopt =1 ; -if (sk->sk_state !=TCP_CLOSE ) +if (!((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )))tcp_init_congestion_control (sk); }
Greg Kroah-Hartman
maintainerPATCH 26/58 tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 6a2febec338df7e7699a52d00b2e1207dcf65b28 ]
MD5 keys are read with RCU protection, and tcp_md5_do_add() might update in-place a prior key.
Normally, typical RCU updates would allocate a new piece of memory. In this case only key->key and key->keylen might be updated, and we do not care if an incoming packet could see the old key, the new one, or some intermediate value, since changing the key on a live flow is known to be problematic anyway.
We only want to make sure that in the case key->keylen is changed, cpus in tcp_md5_hash_key() wont try to use uninitialized data, or crash because key->keylen was read twice to feed sg_init_one() and ahash_request_set_crypt()
--- net/ipv4/tcp.c | 5 ++++- net/ipv4/tcp_ipv4.c | 3 +++ 2 files changed, 7 insertions(+), 1 deletion(-)
net/ipv4/tcp.c +4 -1
@@ -3088,9 +3088,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);int tcp_md5_hash_key (struct tcp_md5sig_pool *hp,const struct tcp_md5sig_key *key) { +u8 keylen = key->keylen;struct scatterlist sg; -sg_init_one (&sg, key->key, key->keylen); +smp_rmb ();/* paired with smp_wmb() in tcp_md5_do_add() */ + +sg_init_one (&sg, key->key, keylen);return crypto_hash_update (&hp->md5_desc, &sg, key->keylen); }EXPORT_SYMBOL (tcp_md5_hash_key);
net/ipv4/tcp_ipv4.c +3 -0
@@ -933,6 +933,9 @@ int tcp_md5_do_add(struct sock *sk, consif (key) {/* Pre-existing entry - just update that one. */ memcpy (key->key, newkey, newkeylen); + +smp_wmb ();/* pairs with smp_rmb() in tcp_md5_hash_key() */ + key->keylen = newkeylen;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 27/58 tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit e6ced831ef11a2a06e8d00aad9d4fc05b610bf38 ]
My prior fix went a bit too far, according to Herbert and Mathieu.
Since we accept that concurrent TCP MD5 lookups might see inconsistent keys, we can use READ_ONCE()/WRITE_ONCE() instead of smp_rmb()/smp_wmb()
Clearing all key->key[] is needed to avoid possible KMSAN reports, if key->keylen is increased. Since tcp_md5_do_add() is not fast path, using __GFP_ZERO to clear all struct tcp_md5sig_key is simpler.
data_race() was added in linux-5.8 and will prevent KCSAN reports, this can safely be removed in stable backports, if data_race() is not yet backported.
v2: use data_race() both in tcp_md5_hash_key() and tcp_md5_do_add()
--- net/ipv4/tcp.c | 6 +++--- net/ipv4/tcp_ipv4.c | 14 ++++++++++---- 2 files changed, 13 insertions(+), 7 deletions(-)
net/ipv4/tcp.c +3 -3
@@ -3088,12 +3088,12 @@ EXPORT_SYMBOL(tcp_md5_hash_skb_data);int tcp_md5_hash_key (struct tcp_md5sig_pool *hp,const struct tcp_md5sig_key *key) { -u8 keylen = key->keylen; +u8 keylen =READ_ONCE (key->keylen);/* paired with WRITE_ONCE() in tcp_md5_do_add */ struct scatterlist sg; -smp_rmb ();/* paired with smp_wmb() in tcp_md5_do_add() */ -sg_init_one (&sg, key->key, keylen); + +/* tcp_md5_do_add() might change key->key under us */ return crypto_hash_update (&hp->md5_desc, &sg, key->keylen); }EXPORT_SYMBOL (tcp_md5_hash_key);
net/ipv4/tcp_ipv4.c +10 -4
@@ -931,12 +931,18 @@ int tcp_md5_do_add(struct sock *sk, cons key =tcp_md5_do_lookup (sk, addr, family);if (key) { -/* Pre-existing entry - just update that one. */ +/* Pre-existing entry - just update that one. +* Note that the key might be used concurrently. +*/ memcpy (key->key, newkey, newkeylen); -smp_wmb ();/* pairs with smp_rmb() in tcp_md5_hash_key() */ +/* Pairs with READ_ONCE() in tcp_md5_hash_key(). +* Also note that a reader could catch new key->keylen value +* but old key->key[], this is the reason we use __GFP_ZERO +* at sock_kmalloc() time below these lines. +*/ +WRITE_ONCE (key->keylen, newkeylen); - key->keylen = newkeylen;return 0 ; }
@@ -953,7 +959,7 @@ int tcp_md5_do_add(struct sock *sk, consrcu_assign_pointer (tp->md5sig_info, md5sig); } - key =sock_kmalloc (sk,sizeof (*key), gfp); + key =sock_kmalloc (sk,sizeof (*key), gfp | __GFP_ZERO);if (!key)return -ENOMEM ;if (!tcp_alloc_md5sig_pool ()) {
Greg Kroah-Hartman
maintainerPATCH 28/58 tcp: md5: allow changing MD5 keys in all socket states
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 1ca0fafd73c5268e8fc4b997094b8bb2bfe8deea ]
This essentially reverts commit 721230326891 ("tcp: md5: reject TCP_MD5SIG or TCP_MD5SIG_EXT on established sockets")
Mathieu reported that many vendors BGP implementations can actually switch TCP MD5 on established flows.
Quoting Mathieu :
Here is a list of a few network vendors along with their behavior with respect to TCP MD5:
- Cisco: Allows for password to be changed, but within the hold-down
timer (~180 seconds).
- Juniper: When password is initially set on active connection it will reset, but after that any subsequent password changes no network resets.
- Nokia: No notes on if they flap the tcp connection or not.
- Ericsson/RedBack: Allows for 2 password (old/new) to co-exist until both sides are ok with new passwords.
- Meta-Switch: Expects the password to be set before a connection is attempted, but no further info on whether they reset the TCP connection on a change.
- Avaya: Disable the neighbor, then set password, then re-enable.
- Zebos: Would normally allow the change when socket connected.
We can revert my prior change because commit 9424e2e7ad93 ("tcp: md5: fix potential overestimation of TCP option space") removed the leak of 4 kernel bytes to the wire that was the main reason for my patch.
While doing my investigations, I found a bug when a MD5 key is changed, leading to these commits that stable teams want to consider before backporting this revert :
Commit 6a2febec338d ("tcp: md5: add missing memory barriers in tcp_md5_do_add()/tcp_md5_hash_key()") Commit e6ced831ef11 ("tcp: md5: refine tcp_md5_do_add()/tcp_md5_hash_key() barriers")
--- net/ipv4/tcp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
net/ipv4/tcp.c +1 -4
@@ -2596,10 +2596,7 @@ static int do_tcp_setsockopt(struct sock#ifdef CONFIG_TCP_MD5SIG case TCP_MD5SIG : -if ((1 << sk->sk_state) & (TCPF_CLOSE |TCPF_LISTEN )) - err = tp->af_specific->md5_parse (sk, optval, optlen); -else - err = -EINVAL ; + err = tp->af_specific->md5_parse (sk, optval, optlen);break ;#endif case TCP_USER_TIMEOUT :
Greg Kroah-Hartman
maintainerPATCH 29/58 i2c: eg20t: Load module automatically if ID matches
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit 5f90786b31fb7d1e199a8999d46c4e3aea672e11 ]
The driver can't be loaded automatically because it misses module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() call to the driver.
--- drivers/i2c/busses/i2c-eg20t.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/busses/i2c-eg20t.c +1 -0
@@ -189,6 +189,7 @@ static const struct pci_device_id pch_pcidev_id[] = { { PCI_VDEVICE(ROHM, PCI_DEVICE_ID_ML7831_I2C), 1, }, {0,} }; +MODULE_DEVICE_TABLE (pci, pch_pcidev_id);static irqreturn_t pch_i2c_handler (int irq,void *pData);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 30/58 Revert "usb/ehci-platform: Set PM runtime as active on resume"
In reply to Greg Kroah-HartmanThis reverts commit 13af14dfadcb95030dc8e2e0cacbffc1990a9772.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/ehci-platform.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/usb/host/ehci-platform.c +0 -5
@@ -375,11 +375,6 @@ static int ehci_platform_resume(struct device *dev) }ehci_resume (hcd, priv->reset_on_resume); - -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -return 0 ; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 31/58 Revert "usb/xhci-plat: Set PM runtime as active on resume"
In reply to Greg Kroah-HartmanThis reverts commit 737c975db35b0117fc5c702072ca2df6f2f7eb63.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/xhci-plat.c | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-)
drivers/usb/host/xhci-plat.c +1 -10
@@ -249,17 +249,8 @@ static int xhci_plat_resume(struct device *dev) {struct usb_hcd *hcd =dev_get_drvdata (dev);struct xhci_hcd *xhci =hcd_to_xhci (hcd); -int ret; - - ret =xhci_resume (xhci,0 ); -if (ret) -return ret; -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); - -return 0 ; +return xhci_resume (xhci,0 ); }static const struct dev_pm_ops xhci_plat_pm_ops = {
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 32/58 Revert "usb/ohci-platform: Fix a warning when hibernating"
In reply to Greg Kroah-HartmanThis reverts commit 652def4c63b99029fe8b898740f97329c26a2fd3.
Eugeniu Rosca writes:
Quoted 12 lines · Eugeniu Rosca
After integrating v4.14.186 commit
5410d158ca2a50("usb/ehci-platform:
Set PM runtime as active on resume") into downstream v4.14.x, we started to consistently experience below panic [1] on every second s2ram of R-Car H3 Salvator-X Renesas reference board.After some investigations, we concluded the following:
- the issue does not exist in vanilla v5.8-rc4+
- [bisecting shows that] the panic on v4.14.186 is caused by the lack of v5.6-rc1 commit987351e1ea7772("phy: core: Add consumer device link support"). Getting evidence for that is easy. Reverting987351e1ea7772in vanilla leads to a similar backtrace [2].
Quoted 9 lines
Questions:
- Backporting987351e1ea7772("phy: core: Add consumer device link support") to v4.14.187 looks challenging enough, so probably not worth it. Anybody to contradict this?
- Assuming no plans to backport the missing mainline commit to v4.14.x, should the following three v4.14.186 commits be reverted on v4.14.x?
*baef809ea497a4("usb/ohci-platform: Fix a warning when hibernating")
*9f33eff4958885("usb/xhci-plat: Set PM runtime as active on resume")
*5410d158ca2a50("usb/ehci-platform: Set PM runtime as active on resume")
--- drivers/usb/host/ohci-platform.c | 5 ----- 1 file changed, 5 deletions(-)
drivers/usb/host/ohci-platform.c +0 -5
@@ -339,11 +339,6 @@ static int ohci_platform_resume(struct device *dev) }ohci_resume (hcd, false); - -pm_runtime_disable (dev); -pm_runtime_set_active (dev); -pm_runtime_enable (dev); -return 0 ; }#endif /* CONFIG_PM_SLEEP */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 33/58 usb: gadget: udc: atmel: fix uninitialized read in debug printk
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
[ Upstream commit 30517ffeb3bff842e1355cbc32f1959d9dbb5414 ]
Fixed commit moved the assignment of 'req', but did not update a reference in the DBG() call. Use the argument as it was renamed.
--- drivers/usb/gadget/udc/atmel_usba_udc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/atmel_usba_udc.c +1 -1
@@ -843,7 +843,7 @@ static int usba_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)u32 status;DBG (DBG_GADGET |DBG_QUEUE ,"ep_dequeue: %s, req %p\n" , - ep->ep.name, req); + ep->ep.name, _req);spin_lock_irqsave (&udc->lock, flags);
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 34/58 staging: comedi: verify array index is correct before using it
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit ef75e14a6c935eec82abac07ab68e388514e39bc ]
This code reads from the array before verifying that "trig" is a valid index. If the index is wildly out of bounds then reading from an invalid address could lead to an Oops.
--- drivers/staging/comedi/drivers/addi_apci_1500.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/staging/comedi/drivers/addi_apci_1500.c +7 -3
@@ -465,9 +465,9 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,unsigned int lo_mask = data[5 ] << shift;unsigned int chan_mask = hi_mask | lo_mask;unsigned int old_mask = (1 << shift) -1 ; -unsigned int pm = devpriv->pm[trig] & old_mask; -unsigned int pt = devpriv->pt[trig] & old_mask; -unsigned int pp = devpriv->pp[trig] & old_mask; +unsigned int pm; +unsigned int pt; +unsigned int pp;if (trig >1 ) { dev_dbg(dev->class_dev,
@@ -480,6 +480,10 @@ static int apci1500_di_cfg_trig(struct comedi_device *dev,return -EINVAL ; } + pm = devpriv->pm[trig] & old_mask; + pt = devpriv->pt[trig] & old_mask; + pp = devpriv->pp[trig] & old_mask; +switch (data[2 ]) {case COMEDI_DIGITAL_TRIG_DISABLE :/* clear trigger configuration */
Signature · 1 line
2.25.1
Greg Kroah-Hartman
maintainerPATCH 35/58 perf stat: Zero all the ena and run array slot stats for interval mode
In reply to Greg Kroah-HartmanFrom: Jin Yao <[email protected]>
commit 0e0bf1ea1147fcf74eab19c2d3c853cc3740a72f upstream.
As the code comments in perf_stat_process_counter() say, we calculate counter's data every interval, and the display code shows ps->res_stats avg value. We need to zero the stats for interval mode.
But the current code only zeros the res_stats[0], it doesn't zero the res_stats[1] and res_stats[2], which are for ena and run of counter.
This patch zeros the whole res_stats[] for interval mode.
--- tools/perf/util/stat.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/perf/util/stat.c +4 -2
@@ -318,8 +318,10 @@ int perf_stat_process_counter(struct per* interval mode, otherwise overall avg running * averages will be shown for each interval. */ -if (config->interval) -init_stats (ps->res_stats); +if (config->interval) { +for (i =0 ; i <3 ; i++) +init_stats (&ps->res_stats[i]); + }if (counter->per_pkg)zero_per_pkg (counter);
Greg Kroah-Hartman
maintainerPATCH 36/58 mtd: rawnand: brcmnand: fix CS0 layout
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
commit 3d3fb3c5be9ce07fa85d8f67fb3922e4613b955b upstream.
Only v3.3-v5.0 have a different CS0 layout. Controllers before v3.3 use the same layout for every CS.
--- drivers/mtd/nand/brcmnand/brcmnand.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/mtd/nand/brcmnand/brcmnand.c +3 -2
@@ -455,8 +455,9 @@ static int brcmnand_revision_init(struct }else { ctrl->cs_offsets = brcmnand_cs_offsets; -/* v5.0 and earlier has a different CS0 offset layout */ -if (ctrl->nand_version <=0x0500 ) +/* v3.3-5.0 have a different CS0 offset layout */ +if (ctrl->nand_version >=0x0303 && + ctrl->nand_version <=0x0500 ) ctrl->cs0_offsets = brcmnand_cs_offsets_cs0; }
Greg Kroah-Hartman
maintainerPATCH 37/58 HID: magicmouse: do not set up autorepeat
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
commit 6363d2065cd399cf9d6dc9d08c437f8658831100 upstream.
Neither the trackpad, nor the mouse want input core to generate autorepeat events for their buttons, so let's reset the bit (as hid-input sets it for these devices based on the usage vendor code).
--- drivers/hid/hid-magicmouse.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/hid/hid-magicmouse.c +6 -0
@@ -451,6 +451,12 @@ static int magicmouse_setup_input(struct__set_bit (MSC_RAW , input->mscbit); } +/* +* hid-input may mark device as using autorepeat, but neither +* the trackpad, nor the mouse actually want it. +*/ +__clear_bit (EV_REP , input->evbit); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 38/58 usb: core: Add a helper function to check the validity of EP type in URB
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit e901b9873876ca30a09253731bd3a6b00c44b5b0 upstream.
This patch adds a new helper function to perform a sanity check of the given URB to see whether it contains a valid endpoint. It's a light- weight version of what usb_submit_urb() does, but without the kernel warning followed by the stack trace, just returns an error code.
Especially for a driver that doesn't parse the descriptor but fills the URB with the fixed endpoint (e.g. some quirks for non-compliant devices), this kind of check is preferable at the probe phase before actually submitting the urb.
--- drivers/usb/core/urb.c | 30 ++++++++++++++++++++++++++---- include/linux/usb.h | 2 ++ 2 files changed, 28 insertions(+), 4 deletions(-)
drivers/usb/core/urb.c +26 -4
@@ -185,6 +185,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);/*-------------------------------------------------------------------*/ +static const int pipetypes[4 ] = { +PIPE_CONTROL ,PIPE_ISOCHRONOUS ,PIPE_BULK ,PIPE_INTERRUPT +}; + +/** +* usb_urb_ep_type_check - sanity check of endpoint in the given urb +* @urb: urb to be checked +* +* This performs a light-weight sanity check for the endpoint in the +* given urb. It returns 0 if the urb contains a valid endpoint, otherwise +* a negative error code. +*/ +int usb_urb_ep_type_check (const struct urb *urb) +{ +const struct usb_host_endpoint *ep; + + ep =usb_pipe_endpoint (urb->dev, urb->pipe); +if (!ep) +return -EINVAL ; +if (usb_pipetype (urb->pipe) != pipetypes[usb_endpoint_type (&ep->desc)]) +return -EINVAL ; +return 0 ; +} +EXPORT_SYMBOL_GPL (usb_urb_ep_type_check); +/** * usb_submit_urb - issue an asynchronous transfer request for an endpoint * @urb: pointer to the urb describing the request
@@ -324,9 +349,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);*/ int usb_submit_urb (struct urb *urb,gfp_t mem_flags) { -static int pipetypes[4 ] = { -PIPE_CONTROL ,PIPE_ISOCHRONOUS ,PIPE_BULK ,PIPE_INTERRUPT - };int xfertype, max;struct usb_device *dev;struct usb_host_endpoint *ep;
@@ -445,7 +467,7 @@ int usb_submit_urb(struct urb *urb, gfp_*/ /* Check that the pipe's type matches the endpoint's type */ -if (usb_pipetype (urb->pipe) != pipetypes[xfertype]) +if (usb_urb_ep_type_check (urb))dev_WARN (&dev->dev,"BOGUS urb xfer, pipe %x != type %x\n" ,usb_pipetype (urb->pipe), pipetypes[xfertype]);
include/linux/usb.h +2 -0
@@ -1655,6 +1655,8 @@ static inline int usb_urb_dir_out(structreturn (urb->transfer_flags &URB_DIR_MASK ) ==URB_DIR_OUT ; } +int usb_urb_ep_type_check (const struct urb *urb); +void *usb_alloc_coherent (struct usb_device *dev,size_t size,gfp_t mem_flags,dma_addr_t *dma); void usb_free_coherent(struct usb_device *dev, size_t size,
Greg Kroah-Hartman
maintainerPATCH 39/58 ALSA: line6: Perform sanity check for each URB creation
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 6e8a914ad619042c5f25a4feb663357c4170fd8d upstream.
LINE6 drivers create stream URBs with a fixed pipe without checking its validity, and this may lead to a kernel WARNING at the submission when a malformed USB descriptor is passed.
For avoiding the kernel warning, perform the similar sanity checks for each pipe type at creating a URB.
--- sound/usb/line6/capture.c | 2 ++ sound/usb/line6/playback.c | 2 ++ 2 files changed, 4 insertions(+)
sound/usb/line6/capture.c +2 -0
@@ -269,6 +269,8 @@ int line6_create_audio_in_urbs(struct sn urb->interval =LINE6_ISO_INTERVAL ; urb->error_count =0 ; urb->complete = audio_in_callback; +if (usb_urb_ep_type_check (urb)) +return -EINVAL ; }return 0 ;
sound/usb/line6/playback.c +2 -0
@@ -423,6 +423,8 @@ int line6_create_audio_out_urbs(struct s urb->interval =LINE6_ISO_INTERVAL ; urb->error_count =0 ; urb->complete = audio_out_callback; +if (usb_urb_ep_type_check (urb)) +return -EINVAL ; }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 40/58 ALSA: usb-audio: Fix race against the error recovery URB submission
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 9b7e5208a941e2e491a83eb5fa83d889e888fa2f upstream.
USB MIDI driver has an error recovery mechanism to resubmit the URB in the delayed timer handler, and this may race with the standard start / stop operations. Although both start and stop operations themselves don't race with each other due to the umidi->mutex protection, but this isn't applied to the timer handler.
For fixing this potential race, the following changes are applied:
- Since the timer handler can't use the mutex, we apply the umidi->disc_lock protection at each input stream URB submission; this also needs to change the GFP flag to GFP_ATOMIC
- Add a check of the URB refcount and skip if already submitted
- Move the timer cancel call at disconnection to the beginning of the procedure; this assures the in-flight timer handler is gone properly before killing all pending URBs
--- sound/usb/midi.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-)
sound/usb/midi.c +12 -5
@@ -1475,6 +1475,8 @@ void snd_usbmidi_disconnect(struct list_spin_unlock_irq (&umidi->disc_lock);up_write (&umidi->disc_rwsem); +del_timer_sync (&umidi->error_timer); +for (i =0 ; i <MIDI_MAX_ENDPOINTS ; ++i) {struct snd_usb_midi_endpoint *ep = &umidi->endpoints[i];if (ep->out)
@@ -1501,7 +1503,6 @@ void snd_usbmidi_disconnect(struct list_ ep->in =NULL ; } } -del_timer_sync (&umidi->error_timer); }EXPORT_SYMBOL (snd_usbmidi_disconnect);
@@ -2258,16 +2259,22 @@ void snd_usbmidi_input_stop(struct list_ }EXPORT_SYMBOL (snd_usbmidi_input_stop); -static void snd_usbmidi_input_start_ep (struct snd_usb_midi_in_endpoint *ep) +static void snd_usbmidi_input_start_ep (struct snd_usb_midi *umidi, +struct snd_usb_midi_in_endpoint *ep) {unsigned int i; +unsigned long flags;if (!ep)return ;for (i =0 ; i <INPUT_URBS ; ++i) {struct urb *urb = ep->urbs[i]; - urb->dev = ep->umidi->dev; -snd_usbmidi_submit_urb (urb,GFP_KERNEL ); +spin_lock_irqsave (&umidi->disc_lock, flags); +if (!atomic_read (&urb->use_count)) { + urb->dev = ep->umidi->dev; +snd_usbmidi_submit_urb (urb,GFP_ATOMIC ); + } +spin_unlock_irqrestore (&umidi->disc_lock, flags); } }
@@ -2283,7 +2290,7 @@ void snd_usbmidi_input_start(struct listif (umidi->input_running || !umidi->opened[1 ])return ;for (i =0 ; i <MIDI_MAX_ENDPOINTS ; ++i) -snd_usbmidi_input_start_ep (umidi->endpoints[i].in); +snd_usbmidi_input_start_ep (umidi, umidi->endpoints[i].in); umidi->input_running =1 ; }EXPORT_SYMBOL (snd_usbmidi_input_start);
Greg Kroah-Hartman
maintainerPATCH 41/58 USB: c67x00: fix use after free in c67x00_giveback_urb
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 211f08347355cba1f769bbf3355816a12b3ddd55 upstream.
clang static analysis flags this error
c67x00-sched.c:489:55: warning: Use of memory after it is freed [unix.Malloc]
usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
^~~~~~~~~~~~Problem happens in this block of code
c67x00_release_urb(c67x00, urb); usb_hcd_unlink_urb_from_ep(c67x00_hcd_to_hcd(c67x00), urb); spin_unlock(&c67x00->lock); usb_hcd_giveback_urb(c67x00_hcd_to_hcd(c67x00), urb, urbp->status);
In the call to c67x00_release_urb has this freeing of urbp
urbp = urb->hcpriv; urb->hcpriv = NULL; list_del(&urbp->hep_node); kfree(urbp);
And so urbp is freed before usb_hcd_giveback_urb uses it as its 3rd parameter.
Since all is required is the status, pass the status directly as is done in c64x00_urb_dequeue
--- drivers/usb/c67x00/c67x00-sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/c67x00/c67x00-sched.c +1 -1
@@ -500,7 +500,7 @@ c67x00_giveback_urb(struct c67x00_hcd *cc67x00_release_urb (c67x00, urb);usb_hcd_unlink_urb_from_ep (c67x00_hcd_to_hcd (c67x00), urb);spin_unlock (&c67x00->lock); -usb_hcd_giveback_urb (c67x00_hcd_to_hcd (c67x00), urb, urbp->status); +usb_hcd_giveback_urb (c67x00_hcd_to_hcd (c67x00), urb, status);spin_lock (&c67x00->lock); }
Greg Kroah-Hartman
maintainerPATCH 42/58 usb: chipidea: core: add wakeup support for extcon
In reply to Greg Kroah-HartmanFrom: Peter Chen <[email protected]>
commit 876d4e1e8298ad1f94d9e9392fc90486755437b4 upstream.
If wakeup event occurred by extcon event, it needs to call ci_irq again since the first ci_irq calling at extcon notifier only wakes up controller, but do noop for event handling, it causes the extcon use case can't work well from low power mode.
--- drivers/usb/chipidea/core.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+)
drivers/usb/chipidea/core.c +24 -0
@@ -1122,6 +1122,29 @@ static void ci_controller_suspend(structenable_irq (ci->irq); } +/* +* Handle the wakeup interrupt triggered by extcon connector +* We need to call ci_irq again for extcon since the first +* interrupt (wakeup int) only let the controller be out of +* low power mode, but not handle any interrupts. +*/ +static void ci_extcon_wakeup_int (struct ci_hdrc *ci) +{ +struct ci_hdrc_cable *cable_id, *cable_vbus; +u32 otgsc =hw_read_otgsc (ci, ~0 ); + + cable_id = &ci->platdata->id_extcon; + cable_vbus = &ci->platdata->vbus_extcon; + +if (!IS_ERR (cable_id->edev) && ci->is_otg && + (otgsc &OTGSC_IDIE ) && (otgsc &OTGSC_IDIS )) +ci_irq (ci->irq, ci); + +if (!IS_ERR (cable_vbus->edev) && ci->is_otg && + (otgsc &OTGSC_BSVIE ) && (otgsc &OTGSC_BSVIS )) +ci_irq (ci->irq, ci); +} +static int ci_controller_resume (struct device *dev) {struct ci_hdrc *ci =dev_get_drvdata (dev);
@@ -1148,6 +1171,7 @@ static int ci_controller_resume(struct denable_irq (ci->irq);if (ci_otg_is_fsm_mode (ci))ci_otg_fsm_wakeup_by_srp (ci); +ci_extcon_wakeup_int (ci); }return 0 ;
Greg Kroah-Hartman
maintainerPATCH 43/58 usb: gadget: function: fix missing spinlock in f_uac1_legacy
In reply to Greg Kroah-HartmanFrom: Zhang Qiang <[email protected]>
commit 8778eb0927ddcd3f431805c37b78fa56481aeed9 upstream.
Add a missing spinlock protection for play_queue, because the play_queue may be destroyed when the "playback_work" work func and "f_audio_out_ep_complete" callback func operate this paly_queue at the same time.
--- drivers/usb/gadget/function/f_uac1.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/gadget/function/f_uac1.c +2 -0
@@ -336,7 +336,9 @@ static int f_audio_out_ep_complete(struc/* Copy buffer is full, add it to the play_queue */ if (audio_buf_size - copy_buf->actual < req->actual) { +spin_lock_irq (&audio->lock);list_add_tail (©_buf->list, &audio->play_queue); +spin_unlock_irq (&audio->lock);schedule_work (&audio->playback_work); copy_buf =f_audio_buffer_alloc (audio_buf_size);if (IS_ERR (copy_buf))
Greg Kroah-Hartman
maintainerPATCH 44/58 USB: serial: iuu_phoenix: fix memory corruption
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit e7b931bee739e8a77ae216e613d3b99342b6dec0 upstream.
The driver would happily overwrite its write buffer with user data in 256 byte increments due to a removed buffer-space sanity check.
--- drivers/usb/serial/iuu_phoenix.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/usb/serial/iuu_phoenix.c +5 -3
@@ -717,14 +717,16 @@ static int iuu_uart_write(struct tty_strstruct iuu_private *priv =usb_get_serial_port_data (port);unsigned long flags; -if (count >256 ) -return -ENOMEM ; -spin_lock_irqsave (&priv->lock, flags); + count =min (count,256 - priv->writelen); +if (count ==0 ) + goto out; +/* fill the buffer */ memcpy (priv->writebuf + priv->writelen, buf, count); priv->writelen += count; +out:spin_unlock_irqrestore (&priv->lock, flags);return count;
Greg Kroah-Hartman
maintainerPATCH 45/58 USB: serial: cypress_m8: enable Simply Automated UPB PIM
In reply to Greg Kroah-HartmanFrom: James Hilliard <[email protected]>
commit 5c45d04c5081c1830d674f4d22d4400ea2083afe upstream.
This is a UPB (Universal Powerline Bus) PIM (Powerline Interface Module) which allows for controlling multiple UPB compatible devices from Linux using the standard serial interface.
Based on vendor application source code there are two different models of USB based PIM devices in addition to a number of RS232 based PIM's.
The vendor UPB application source contains the following USB ID's:
#define USB_PCS_VENDOR_ID 0x04b4 #define USB_PCS_PIM_PRODUCT_ID 0x5500 #define USB_SAI_VENDOR_ID 0x17dd #define USB_SAI_PIM_PRODUCT_ID 0x5500
The first set of ID's correspond to the PIM variant sold by Powerline Control Systems while the second corresponds to the Simply Automated Incorporated PIM. As the product ID for both of these match the default cypress HID->COM RS232 product ID it assumed that they both use an internal variant of this HID->COM RS232 converter hardware. However as the vendor ID for the Simply Automated variant is different we need to also add it to the cypress_M8 driver so that it is properly detected.
--- drivers/usb/serial/cypress_m8.c | 2 ++ drivers/usb/serial/cypress_m8.h | 3 +++ 2 files changed, 5 insertions(+)
drivers/usb/serial/cypress_m8.c +2 -0
@@ -63,6 +63,7 @@ static const struct usb_device_id id_tabstatic const struct usb_device_id id_table_cyphidcomrs232[] = { {USB_DEVICE (VENDOR_ID_CYPRESS ,PRODUCT_ID_CYPHIDCOM ) }, + {USB_DEVICE (VENDOR_ID_SAI ,PRODUCT_ID_CYPHIDCOM ) }, {USB_DEVICE (VENDOR_ID_POWERCOM ,PRODUCT_ID_UPS ) }, {USB_DEVICE (VENDOR_ID_FRWD ,PRODUCT_ID_CYPHIDCOM_FRWD ) }, { }/* Terminating entry */
@@ -77,6 +78,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB) }, { USB_DEVICE(VENDOR_ID_DELORME, PRODUCT_ID_EARTHMATEUSB_LT20) }, { USB_DEVICE(VENDOR_ID_CYPRESS, PRODUCT_ID_CYPHIDCOM) }, + { USB_DEVICE(VENDOR_ID_SAI, PRODUCT_ID_CYPHIDCOM) }, { USB_DEVICE(VENDOR_ID_POWERCOM, PRODUCT_ID_UPS) }, { USB_DEVICE(VENDOR_ID_FRWD, PRODUCT_ID_CYPHIDCOM_FRWD) }, { USB_DEVICE(VENDOR_ID_DAZZLE, PRODUCT_ID_CA42) },
drivers/usb/serial/cypress_m8.h +3 -0
@@ -24,6 +24,9 @@#define VENDOR_ID_CYPRESS 0x04b4#define PRODUCT_ID_CYPHIDCOM 0x5500 +/* Simply Automated HID->COM UPB PIM (using Cypress PID 0x5500) */ +#define VENDOR_ID_SAI 0x17dd +/* FRWD Dongle - a GPS sports watch */ #define VENDOR_ID_FRWD 0x6737#define PRODUCT_ID_CYPHIDCOM_FRWD 0x0001
Greg Kroah-Hartman
maintainerPATCH 46/58 USB: serial: ch341: add new Product ID for CH340
In reply to Greg Kroah-HartmanFrom: Igor Moura <[email protected]>
commit 5d0136f8e79f8287e6a36780601f0ce797cf11c2 upstream.
Add PID for CH340 that's found on some ESP8266 dev boards made by LilyGO. The specific device that contains such serial converter can be seen here: https://github.com/LilyGO/LILYGO-T-OI.
Apparently, it's a regular CH340, but I've confirmed with others that also bought this board that the PID found on this device (0x7522) differs from other devices with the "same" converter (0x7523). Simply adding its PID to the driver and rebuilding it made it work as expected.
--- drivers/usb/serial/ch341.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/ch341.c +1 -0
@@ -71,6 +71,7 @@static const struct usb_device_id id_table[] = { {USB_DEVICE (0x4348 ,0x5523 ) }, + {USB_DEVICE (0x1a86 ,0x7522 ) }, {USB_DEVICE (0x1a86 ,0x7523 ) }, {USB_DEVICE (0x1a86 ,0x5523 ) }, { },
Greg Kroah-Hartman
maintainerPATCH 47/58 USB: serial: option: add GosunCn GM500 series
In reply to Greg Kroah-HartmanFrom: Jörgen Storvist <[email protected]>
commit 08d4ef5cc9203a113702f24725f6cf4db476c958 upstream.
Add USB IDs for GosunCn GM500 series cellular modules.
RNDIS config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 12 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1404 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 1 Cls=e0(wlcon) Sub=01 Prot=03 Driver=rndis_host I: If#=0x1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=rndis_host I: If#=0x2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
MBIM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 11 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1405 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
ECM config:
usb-devices
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 13 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 P: Vendor=305a ProdID=1406 Rev=03.18 S: Manufacturer=Android S: Product=Android S: SerialNumber= C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option I: If#=0x3 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether I: If#=0x4 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -2019,6 +2019,9 @@ static const struct usb_device_id option .driver_info = RSVD(4) | RSVD(5) }, { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff), /* Fibocom NL678 series */ .driver_info = RSVD(6) }, + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) }, /* GosunCn GM500 RNDIS */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) }, /* GosunCn GM500 MBIM */ + { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */ { } /* Terminating entry */ };MODULE_DEVICE_TABLE (usb, option_ids);
Greg Kroah-Hartman
maintainerPATCH 48/58 USB: serial: option: add Quectel EG95 LTE modem
In reply to Greg Kroah-HartmanFrom: AceLan Kao <[email protected]>
commit da6902e5b6dbca9081e3d377f9802d4fd0c5ea59 upstream.
Add support for Quectel Wireless Solutions Co., Ltd. EG95 LTE modem
T: Bus=01 Lev=01 Prnt=01 Port=02 Cnt=02 Dev#= 5 Spd=480 MxCh= 0 D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1 P: Vendor=2c7c ProdID=0195 Rev=03.18 S: Manufacturer=Android S: Product=Android C: #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA I: If#=0x0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none) I: If#=0x1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=(none) I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
--- drivers/usb/serial/option.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/serial/option.c +3 -0
@@ -248,6 +248,7 @@ static void option_instat_callback(struc/* These Quectel products use Quectel's vendor ID */ #define QUECTEL_PRODUCT_EC21 0x0121#define QUECTEL_PRODUCT_EC25 0x0125 +#define QUECTEL_PRODUCT_EG95 0x0195#define QUECTEL_PRODUCT_BG96 0x0296#define QUECTEL_PRODUCT_EP06 0x0306
@@ -1095,6 +1096,8 @@ static const struct usb_device_id option .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), .driver_info = RSVD(4) }, + { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG95), + .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = RSVD(4) }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EP06),
Greg Kroah-Hartman
maintainerPATCH 49/58 virtio: virtio_console: add missing MODULE_DEVICE_TABLE() for rproc serial
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 897c44f0bae574c5fb318c759b060bebf9dd6013 upstream.
rproc_serial_id_table lacks an exposure to module devicetable, so when remoteproc firmware requests VIRTIO_ID_RPROC_SERIAL, no uevent is generated and no module autoloading occurs.
Add missing MODULE_DEVICE_TABLE() annotation and move the existing one for VIRTIO_ID_CONSOLE right to the table itself.
--- drivers/char/virtio_console.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/char/virtio_console.c +2 -1
@@ -2155,6 +2155,7 @@ static struct virtio_device_id id_table[ { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID }, { 0 }, }; +MODULE_DEVICE_TABLE (virtio, id_table);static unsigned int features[] = { VIRTIO_CONSOLE_F_SIZE,
@@ -2167,6 +2168,7 @@ static struct virtio_device_id rproc_ser#endif { 0 }, }; +MODULE_DEVICE_TABLE (virtio, rproc_serial_id_table);static unsigned int rproc_serial_features[] = { };
@@ -2319,6 +2321,5 @@ static void __exit fini(void)module_init (init);module_exit (fini); -MODULE_DEVICE_TABLE (virtio, id_table);MODULE_DESCRIPTION ("Virtio console driver" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 50/58 fuse: Fix parameter for FS_IOC_{GET,SET}FLAGS
In reply to Greg Kroah-HartmanFrom: Chirantan Ekbote <[email protected]>
commit 31070f6ccec09f3bd4f1e28cd1e592fa4f3ba0b6 upstream.
The ioctl encoding for this parameter is a long but the documentation says it should be an int and the kernel drivers expect it to be an int. If the fuse driver treats this as a long it might end up scribbling over the stack of a userspace process that only allocated enough space for an int.
This was previously discussed in [1] and a patch for fuse was proposed in [2]. From what I can tell the patch in [2] was nacked in favor of adding new, "fixed" ioctls and using those from userspace. However there is still no "fixed" version of these ioctls and the fact is that it's sometimes infeasible to change all userspace to use the new one.
Handling the ioctls specially in the fuse driver seems like the most pragmatic way for fuse servers to support them without causing crashes in userspace applications that call them.
[1]: https://lore.kernel.org/linux-fsdevel/[email protected]/T/
[2]: https://sourceforge.net/p/fuse/mailman/message/31771759/
--- fs/fuse/file.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/fuse/file.c +11 -1
@@ -17,6 +17,7 @@#include <linux/swap.h> #include <linux/falloc.h> #include <linux/uio.h> +#include <linux/fs.h> static const struct file_operations fuse_direct_io_file_operations;
@@ -2517,7 +2518,16 @@ long fuse_do_ioctl(struct file *file, unstruct iovec *iov = iov_page; iov->iov_base = (void __user *)arg; - iov->iov_len =_IOC_SIZE (cmd); + +switch (cmd) { +case FS_IOC_GETFLAGS : +case FS_IOC_SETFLAGS : + iov->iov_len =sizeof (int ); +break ; +default : + iov->iov_len =_IOC_SIZE (cmd); +break ; + }if (_IOC_DIR (cmd) & _IOC_WRITE) { in_iov = iov;
Greg Kroah-Hartman
maintainerPATCH 51/58 mei: bus: dont clean driver pointer
In reply to Greg Kroah-HartmanFrom: Alexander Usyskin <[email protected]>
commit e852c2c251ed9c23ae6e3efebc5ec49adb504207 upstream.
It's not needed to set driver to NULL in mei_cl_device_remove() which is bus_type remove() handler as this is done anyway in __device_release_driver().
Actually this is causing an endless loop in driver_detach() on ubuntu patched kernel, while removing (rmmod) the mei_hdcp module. The reason list_empty(&drv->p->klist_devices.k_list) is always not-empty. as the check is always true in __device_release_driver()
if (dev->driver != drv) return;
The non upstream patch is causing this behavior, titled:
'vfio -- release device lock before userspace requests'
Nevertheless the fix is correct also for the upstream.
--- drivers/misc/mei/bus.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/misc/mei/bus.c +1 -2
@@ -626,9 +626,8 @@ static int mei_cl_device_remove(struct d ret = cldrv->remove (cldev);module_put (THIS_MODULE ); - dev->driver =NULL ; -return ret; +return ret; } static ssize_t name_show(struct device *dev, struct device_attribute *a,
Greg Kroah-Hartman
maintainerPATCH 52/58 Input: i8042 - add Lenovo XiaoXin Air 12 to i8042 nomux list
In reply to Greg Kroah-HartmanFrom: David Pedersen <[email protected]>
commit 17d51429da722cd8fc77a365a112f008abf4f8b3 upstream.
This fixes two finger trackpad scroll on the Lenovo XiaoXin Air 12. Without nomux, the trackpad behaves as if only one finger is present and moves the cursor when trying to scroll.
--- drivers/input/serio/i8042-x86ia64io.h | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +7 -0
@@ -430,6 +430,13 @@ static const struct dmi_system_id __init }, }, { +/* Lenovo XiaoXin Air 12 */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"LENOVO" ), + DMI_MATCH(DMI_PRODUCT_NAME, "80UN"), + }, + }, + { .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Acer" ), DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1360"),
Greg Kroah-Hartman
maintainerPATCH 53/58 uio_pdrv_genirq: fix use without device tree and no interrupt
In reply to Greg Kroah-HartmanFrom: Esben Haabendal <[email protected]>
commit bf12fdf0ab728ca8e5933aac46dd972c0dd0421e upstream.
While e3a3c3a20555 ("UIO: fix uio_pdrv_genirq with device tree but no interrupt") added support for using uio_pdrv_genirq for devices without interrupt for device tree platforms, the removal of uio_pdrv in 26dac3c49d56 ("uio: Remove uio_pdrv and use uio_pdrv_genirq instead") broke the support for non device tree platforms.
This change fixes this, so that uio_pdrv_genirq can be used without interrupt on all platforms.
This still leaves the support that uio_pdrv had for custom interrupt handler lacking, as uio_pdrv_genirq does not handle it (yet).
--- drivers/uio/uio_pdrv_genirq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/uio/uio_pdrv_genirq.c +1 -1
@@ -148,7 +148,7 @@ static int uio_pdrv_genirq_probe(structif (!uioinfo->irq) { ret =platform_get_irq (pdev,0 ); uioinfo->irq = ret; -if (ret == -ENXIO && pdev->dev.of_node) +if (ret == -ENXIO ) uioinfo->irq =UIO_IRQ_NONE ;else if (ret <0 ) {dev_err (&pdev->dev,"failed to get IRQ\n" );
Greg Kroah-Hartman
maintainerPATCH 54/58 MIPS: Fix build for LTS kernel caused by backporting lpj adjustment
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
Commit ed26aacfb5f71eecb20a ("mips: Add udelay lpj numbers adjustment") has backported to 4.4~5.4, but the "struct cpufreq_freqs" (and also the cpufreq notifier machanism) of 4.4~4.19 are different from the upstream kernel. These differences cause build errors, and this patch can fix the build.
--- arch/mips/kernel/time.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/mips/kernel/time.c +4 -9
@@ -40,10 +40,8 @@ static unsigned long glb_lpj_ref_freq;static int cpufreq_callback (struct notifier_block *nb,unsigned long val,void *data) { -struct cpufreq_freqs *freq = data; -struct cpumask *cpus = freq->policy->cpus; -unsigned long lpj;int cpu; +struct cpufreq_freqs *freq = data;/* * Skip lpj numbers adjustment if the CPU-freq transition is safe for
@@ -64,6 +62,7 @@ static int cpufreq_callback(struct notif } } + cpu = freq->cpu;/* * Adjust global lpj variable and per-CPU udelay_val number in * accordance with the new CPU frequency.
@@ -74,12 +73,8 @@ static int cpufreq_callback(struct notif glb_lpj_ref_freq, freq->new); -for_each_cpu (cpu, cpus) { - lpj =cpufreq_scale (per_cpu (pcp_lpj_ref, cpu), -per_cpu (pcp_lpj_ref_freq, cpu), - freq->new); - cpu_data[cpu].udelay_val = (unsigned int )lpj; - } + cpu_data[cpu].udelay_val =cpufreq_scale (per_cpu (pcp_lpj_ref, cpu), +per_cpu (pcp_lpj_ref_freq, cpu), freq->new); }return NOTIFY_OK ;
Greg Kroah-Hartman
maintainerPATCH 55/58 hwmon: (emc2103) fix unable to change fan pwm1_enable attribute
In reply to Greg Kroah-HartmanFrom: Vishwas M <[email protected]>
commit 14b0e83dc4f1e52b94acaeb85a18fd7fdd46d2dc upstream.
This patch fixes a bug which does not let FAN mode to be changed from sysfs(pwm1_enable). i.e pwm1_enable can not be set to 3, it will always remain at 0.
This is caused because the device driver handles the result of "read_u8_from_i2c(client, REG_FAN_CONF1, &conf_reg)" incorrectly. The driver thinks an error has occurred if the (result != 0). This has been fixed by changing the condition to (result < 0).
--- drivers/hwmon/emc2103.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/emc2103.c +1 -1
@@ -452,7 +452,7 @@ static ssize_t set_pwm_enable(struct dev } result =read_u8_from_i2c (client,REG_FAN_CONF1 , &conf_reg); -if (result) { +if (result <0 ) { count = result; goto err; }
Greg Kroah-Hartman
maintainerPATCH 56/58 dmaengine: fsl-edma: Fix NULL pointer exception in fsl_edma_tx_handler
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit f5e5677c420346b4e9788051c2e4d750996c428c upstream.
NULL pointer exception happens occasionally on serial output initiated by login timeout. This was reproduced only if kernel was built with significant debugging options and EDMA driver is used with serial console.
col-vf50 login: root
Password:
Login timed out after 60 seconds.
Unable to handle kernel NULL pointer dereference at virtual address 00000044
Internal error: Oops: 5 [#1] ARM
CPU: 0 PID: 157 Comm: login Not tainted 5.7.0-next-20200610-dirty #4
Hardware name: Freescale Vybrid VF5xx/VF6xx (Device Tree)
(fsl_edma_tx_handler) from [<8016eb10>] (__handle_irq_event_percpu+0x64/0x304)
(__handle_irq_event_percpu) from [<8016eddc>] (handle_irq_event_percpu+0x2c/0x7c)
(handle_irq_event_percpu) from [<8016ee64>] (handle_irq_event+0x38/0x5c)
(handle_irq_event) from [<801729e4>] (handle_fasteoi_irq+0xa4/0x160)
(handle_fasteoi_irq) from [<8016ddcc>] (generic_handle_irq+0x34/0x44)
(generic_handle_irq) from [<8016e40c>] (__handle_domain_irq+0x54/0xa8)
(__handle_domain_irq) from [<80508bc8>] (gic_handle_irq+0x4c/0x80)
(gic_handle_irq) from [<80100af0>] (__irq_svc+0x70/0x98)
Exception stack(0x8459fe80 to 0x8459fec8)
fe80: 72286b00 e3359f64 00000001 0000412d a0070013 85c98840 85c98840 a0070013
fea0: 8054e0d4 00000000 00000002 00000000 00000002 8459fed0 8081fbe8 8081fbec
fec0: 60070013 ffffffff
(__irq_svc) from [<8081fbec>] (_raw_spin_unlock_irqrestore+0x30/0x58)
(_raw_spin_unlock_irqrestore) from [<8056cb48>] (uart_flush_buffer+0x88/0xf8)
(uart_flush_buffer) from [<80554e60>] (tty_ldisc_hangup+0x38/0x1ac)
(tty_ldisc_hangup) from [<8054c7f4>] (__tty_hangup+0x158/0x2bc)
(__tty_hangup) from [<80557b90>] (disassociate_ctty.part.1+0x30/0x23c)
(disassociate_ctty.part.1) from [<8011fc18>] (do_exit+0x580/0xba0)
(do_exit) from [<801214f8>] (do_group_exit+0x3c/0xb4)
(do_group_exit) from [<80121580>] (__wake_up_parent+0x0/0x14)Issue looks like race condition between interrupt handler fsl_edma_tx_handler() (called as result of fsl_edma_xfer_desc()) and terminating the transfer with fsl_edma_terminate_all().
The fsl_edma_tx_handler() handles interrupt for a transfer with already freed edesc and idle==true.
--- drivers/dma/fsl-edma.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/dma/fsl-edma.c +7 -0
@@ -671,6 +671,13 @@ static irqreturn_t fsl_edma_tx_handler(i fsl_chan = &fsl_edma->chans[ch];spin_lock (&fsl_chan->vchan.lock); + +if (!fsl_chan->edesc) { +/* terminate_all called before */ +spin_unlock (&fsl_chan->vchan.lock); +continue ; + } +if (!fsl_chan->edesc->iscyclic) {list_del (&fsl_chan->edesc->vdesc.node);vchan_cookie_complete (&fsl_chan->edesc->vdesc);
Greg Kroah-Hartman
maintainerPATCH 57/58 misc: atmel-ssc: lock with mutex instead of spinlock
In reply to Greg Kroah-HartmanFrom: Michał Mirosław <[email protected]>
commit b037d60a3b1d1227609fd858fa34321f41829911 upstream.
Uninterruptible context is not needed in the driver and causes lockdep warning because of mutex taken in of_alias_get_id(). Convert the lock to mutex to avoid the issue.
--- drivers/misc/atmel-ssc.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/misc/atmel-ssc.c +12 -12
@@ -13,7 +13,7 @@#include <linux/clk.h> #include <linux/err.h> #include <linux/io.h> -#include <linux/spinlock.h> +#include <linux/mutex.h> #include <linux/atmel-ssc.h> #include <linux/slab.h> #include <linux/module.h>
@@ -21,7 +21,7 @@#include <linux/of.h> /* Serialize access to ssc_list and user count */ -static DEFINE_SPINLOCK (user_lock); +static DEFINE_MUTEX (user_lock);static LIST_HEAD (ssc_list);struct ssc_device *ssc_request (unsigned int ssc_num)
@@ -29,7 +29,7 @@ struct ssc_device *ssc_request(unsignedint ssc_valid =0 ;struct ssc_device *ssc; -spin_lock (&user_lock); +mutex_lock (&user_lock);list_for_each_entry (ssc, &ssc_list, list) {if (ssc->pdev->dev.of_node) { if (of_alias_get_id(ssc->pdev->dev.of_node, "ssc")
@@ -44,18 +44,18 @@ struct ssc_device *ssc_request(unsigned }if (!ssc_valid) { -spin_unlock (&user_lock); +mutex_unlock (&user_lock);pr_err ("ssc: ssc%d platform device is missing\n" , ssc_num);return ERR_PTR (-ENODEV ); }if (ssc->user) { -spin_unlock (&user_lock); +mutex_unlock (&user_lock);dev_dbg (&ssc->pdev->dev,"module busy\n" );return ERR_PTR (-EBUSY ); } ssc->user++; -spin_unlock (&user_lock); +mutex_unlock (&user_lock);clk_prepare (ssc->clk);
@@ -67,14 +67,14 @@ void ssc_free(struct ssc_device *ssc) {bool disable_clk = true; -spin_lock (&user_lock); +mutex_lock (&user_lock);if (ssc->user) ssc->user--;else { disable_clk = false;dev_dbg (&ssc->pdev->dev,"device already free\n" ); } -spin_unlock (&user_lock); +mutex_unlock (&user_lock);if (disable_clk)clk_unprepare (ssc->clk);
@@ -194,9 +194,9 @@ static int ssc_probe(struct platform_devreturn -ENXIO ; } -spin_lock (&user_lock); +mutex_lock (&user_lock);list_add_tail (&ssc->list, &ssc_list); -spin_unlock (&user_lock); +mutex_unlock (&user_lock);platform_set_drvdata (pdev, ssc);
@@ -210,9 +210,9 @@ static int ssc_remove(struct platform_de {struct ssc_device *ssc =platform_get_drvdata (pdev); -spin_lock (&user_lock); +mutex_lock (&user_lock);list_del (&ssc->list); -spin_unlock (&user_lock); +mutex_unlock (&user_lock);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 58/58 sched/fair: handle case of task_h_load() returning 0
In reply to Greg Kroah-HartmanFrom: Vincent Guittot <[email protected]>
commit 01cfcde9c26d8555f0e6e9aea9d6049f87683998 upstream.
task_h_load() can return 0 in some situations like running stress-ng mmapfork, which forks thousands of threads, in a sched group on a 224 cores system. The load balance doesn't handle this correctly because env->imbalance never decreases and it will stop pulling tasks only after reaching loop_max, which can be equal to the number of running tasks of the cfs. Make sure that imbalance will be decreased by at least 1.
misfit task is the other feature that doesn't handle correctly such situation although it's probably more difficult to face the problem because of the smaller number of CPUs and running tasks on heterogenous system.
We can't simply ensure that task_h_load() returns at least one because it would imply to handle underflow in other places.
--- kernel/sched/fair.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/sched/fair.c +9 -1
@@ -5939,7 +5939,15 @@ static int detach_tasks(struct lb_env *eif (!can_migrate_task (p, env)) goto next; - load =task_h_load (p); +/* +* Depending of the number of CPUs and tasks and the +* cgroup hierarchy, task_h_load() can return a null +* value. Make sure that env->imbalance decreases +* otherwise detach_tasks() will stop only after +* detaching up to loop_max tasks. +*/ + load = max_t(unsigned long, task_h_load(p), 1); +if (sched_feat (LB_MIN ) && load <16 && !env->sd->nr_balance_failed) goto next;
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.4.231-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: ecea46f8864653c4a4fa6c4f0b690500ba217149
git describe: v4.4.230-59-gecea46f88646
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.230-59-gecea46f88646
No regressions (compared to build v4.4.230)
No fixes (compared to build v4.4.230)
Ran 17639 total tests in the following environments and test suites.
Environments
--------------
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* kselftest
* kselftest/drivers
* kselftest/filesystems
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* perf
* v4l2-compliance
* kvm-unit-tests
* install-android-platform-tools-r2800
Summary
------------------------------------------------------------------------
kernel: 4.4.231-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.231-rc1-hikey-20200720-772
git commit: 89cea942179d0a31521a87d7de038e694b36a952
git describe: 4.4.231-rc1-hikey-20200720-772
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.231-rc1-hikey-20200720-772
No regressions (compared to build 4.4.231-rc1-hikey-20200717-769)
No fixes (compared to build 4.4.231-rc1-hikey-20200717-769)
Ran 1840 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* kselftest/drivers
* kselftest/filesystems
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Hi!
Quoted 5 lines
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Quoted 8 lines
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.
This, too, seems to pass CIP project testing:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/168665031
Best regards,
Pavel
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.231-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.4:
6 builds: 6 pass, 0 fail
12 boots: 12 pass, 0 fail
25 tests: 25 pass, 0 failLinux version: 4.4.231-rc1-gecea46f88646
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra30-cardhu-a04Cheers,
Thierry
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.231 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Jul 2020 15:27:31 +0000. Anything received after that time might be too late.
Build results:
total: 169 pass: 169 fail: 0 Qemu test results: total: 332 pass: 332 fail: 0
Guenter