4.9.242-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.9.242-rc1 review
This is the start of the stable review cycle for the 4.9.242 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Nov 2020 12:50:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.242-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.242-rc1
Vineet Gupta <[email protected]>
Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
Vineet Gupta <[email protected]>
ARC: stack unwinding: avoid indefinite looping
Alan Stern <[email protected]>
USB: Add NO_LPM quirk for Kingston flash drive
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN980 composition 0x1055
Daniele Palmas <[email protected]>
USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
Johan Hovold <[email protected]>
USB: serial: cyberjack: fix write-URB completion race
Qinglang Miao <[email protected]>
serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
Claire Chang <[email protected]>
serial: 8250_mtk: Fix uart_get_baud_rate warning
Eddy Wu <[email protected]>
fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
Daniel Vetter <[email protected]>
vt: Disable KD_FONT_OP_COPY
Zhang Qilong <[email protected]>
ACPI: NFIT: Fix comparison to '-ENXIO'
Jeff Vander Stoep <[email protected]>
vsock: use ns_capable_noaudit() on socket create
Ming Lei <[email protected]>
scsi: core: Don't start concurrent async scan on same host
Vincent Whitchurch <[email protected]>
of: Fix reserved-memory overlap detection
Kairui Song <[email protected]>
x86/kexec: Use up-to-dated screen_info copy to fill boot params
Clément Péron <[email protected]>
ARM: dts: sun4i-a10: fix cpu_alert temperature
Qiujun Huang <[email protected]>
tracing: Fix out of bounds write in get_trace_buf
Steven Rostedt (VMware) <[email protected]>
ftrace: Handle tracing when switching between context
Steven Rostedt (VMware) <[email protected]>
ftrace: Fix recursion check for NMI test
Zqiang <[email protected]>
kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
Geoffrey D. Bennett <[email protected]>
ALSA: usb-audio: Add implicit feedback quirk for Qu-16
Lee Jones <[email protected]>
Fonts: Replace discarded const qualifier
Claudiu Manoil <[email protected]>
gianfar: Account for Tx PTP timestamp in the skb headroom
Claudiu Manoil <[email protected]>
gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
Hoang Huu Le <[email protected]>
tipc: fix use-after-free in tipc_bcast_get_mode
Juergen Gross <[email protected]>
xen/events: don't use chip_data for legacy IRQs
Alexander Sverdlin <[email protected]>
staging: octeon: Drop on uncorrectable alignment or FCS error
Alexander Sverdlin <[email protected]>
staging: octeon: repair "fixed-link" support
Ian Abbott <[email protected]>
staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
Marc Zyngier <[email protected]>
KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
Andy Shevchenko <[email protected]>
device property: Don't clear secondary pointer for shared primary firmware node
Andy Shevchenko <[email protected]>
device property: Keep secondary firmware node secondary by type
Krzysztof Kozlowski <[email protected]>
ARM: s3c24xx: fix missing system reset
Krzysztof Kozlowski <[email protected]>
ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
Helge Deller <[email protected]>
hil/parisc: Disable HIL driver when it gets stuck
Matthew Wilcox (Oracle) <[email protected]>
cachefiles: Handle readpage error correctly
Jisheng Zhang <[email protected]>
arm64: berlin: Select DW_APB_TIMER_OF
Linus Torvalds <[email protected]>
tty: make FONTX ioctl use the tty pointer they were actually passed
Bartosz Golaszewski <[email protected]>
rtc: rx8010: don't modify the global rtc ops
Stefano Garzarella <[email protected]>
vringh: fix __vringh_iov() when riov and wiov are different
Qiujun Huang <[email protected]>
ring-buffer: Return 0 on success from ring_buffer_resize()
Matthew Wilcox (Oracle) <[email protected]>
9P: Cast to loff_t before multiplying
Ilya Dryomov <[email protected]>
libceph: clear con->out_msg on Policy::stateful_server faults
Matthew Wilcox (Oracle) <[email protected]>
ceph: promote to unsigned long long before shifting
Krzysztof Kozlowski <[email protected]>
ia64: fix build error with !COREDUMP
Zhihao Cheng <[email protected]>
ubi: check kthread_should_stop() after the setting of task state
Zhihao Cheng <[email protected]>
ubifs: dent: Fix some potential memory leaks while iterating entries
Mahesh Salgaonkar <[email protected]>
powerpc/powernv/elog: Fix race while processing OPAL error log event.
Joel Stanley <[email protected]>
powerpc: Warn about use of smt_snooze_delay
Jonathan Cameron <[email protected]>
iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
Jonathan Cameron <[email protected]>
iio:adc:ti-adc12138 Fix alignment issue with timestamp
Jonathan Cameron <[email protected]>
iio:light:si1145: Fix timestamp alignment and prevent data leak.
Paul Cercueil <[email protected]>
dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
Jiri Slaby <[email protected]>
vt: keyboard, extend func_buf_lock to readers
Jiri Slaby <[email protected]>
vt: keyboard, simplify vt_kdgkbsent
Ran Wang <[email protected]>
usb: host: fsl-mph-dr-of: check return of dma_set_mask()
Li Jun <[email protected]>
usb: dwc3: core: don't trigger runtime pm when remove driver
Li Jun <[email protected]>
usb: dwc3: core: add phy cleanup for probe error handling
Filipe Manana <[email protected]>
btrfs: fix use-after-free on readahead extent after failure to create it
Josef Bacik <[email protected]>
btrfs: cleanup cow block on error
Filipe Manana <[email protected]>
btrfs: reschedule if necessary when logging directory items
Helge Deller <[email protected]>
scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
Martin Fuzzey <[email protected]>
w1: mxc_w1: Fix timeout resolution problem leading to bus error
Wei Huang <[email protected]>
acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
Jamie Iles <[email protected]>
ACPI: debug: don't allow debugging when ACPI is disabled
Alex Hung <[email protected]>
ACPI: video: use ACPI backlight for HP 635 Notebook
Ben Hutchings <[email protected]>
ACPI / extlog: Check for RDMSR failure
Ashish Sangwan <[email protected]>
NFS: fix nfs_path in case of a rename retry
Jan Kara <[email protected]>
fs: Don't invalidate page buffers in block_write_full_page()
Marek Behún <[email protected]>
leds: bcm6328, bcm6358: use devres LED registering function
Kim Phillips <[email protected]>
perf/x86/amd/ibs: Fix raw sample data accumulation
Kim Phillips <[email protected]>
perf/x86/amd/ibs: Don't include randomized bits in get_ibs_op_count()
Song Liu <[email protected]>
md/raid5: fix oops during stripe resizing
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: remove dedicated 'audio-subsystem' node
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: move PMU node out of clock controller
Krzysztof Kozlowski <[email protected]>
ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
Dan Carpenter <[email protected]>
memory: emif: Remove bogus debugfs error handling
Anant Thazhemadam <[email protected]>
gfs2: add validation checks for size of superblock
Jan Kara <[email protected]>
ext4: Detect already used quota file early
Madhuparna Bhowmik <[email protected]>
drivers: watchdog: rdc321x_wdt: Fix race condition bugs
Anant Thazhemadam <[email protected]>
net: 9p: initialize sun_server.sun_path to have addr's value only when addr is valid
Tero Kristo <[email protected]>
clk: ti: clockdomain: fix static checker warning
Zhao Heming <[email protected]>
md/bitmap: md_bitmap_get_counter returns wrong blocks
Xiongfeng Wang <[email protected]>
power: supply: test_power: add missing newlines when printing parameters by sysfs
Diana Craciun <[email protected]>
bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
Xie He <[email protected]>
drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
Zhengyuan Liu <[email protected]>
arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
Oliver Neukum <[email protected]>
USB: adutux: fix debugging
Alain Volmat <[email protected]>
cpufreq: sti-cpufreq: add stih418 support
Douglas Anderson <[email protected]>
kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
John Ogness <[email protected]>
printk: reduce LOG_BUF_SHIFT range for H8300
Madhuparna Bhowmik <[email protected]>
mmc: via-sdmmc: Fix data race bug
Tom Rix <[email protected]>
media: tw5864: check status of tw5864_frameinterval_get
Sathishkumar Muruganandam <[email protected]>
ath10k: fix VHT NSS calculation when STBC is enabled
Tom Rix <[email protected]>
video: fbdev: pvr2fb: initialize variables
Darrick J. Wong <[email protected]>
xfs: fix realtime bitmap/summary file truncation when growing rt volume
Douglas Anderson <[email protected]>
ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
Johannes Berg <[email protected]>
um: change sigio_spinlock to a mutex
Chao Yu <[email protected]>
f2fs: fix to check segment boundary during SIT page readahead
Zhang Qilong <[email protected]>
f2fs: add trace exit in exception path
Nicholas Piggin <[email protected]>
sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
Oliver O'Halloran <[email protected]>
powerpc/powernv/smp: Fix spurious DBG() warning
Amit Cohen <[email protected]>
mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
Eric Biggers <[email protected]>
fscrypt: use EEXIST when file already uses different policy
Eric Biggers <[email protected]>
fscrypto: move ioctl processing more fully into common code
Eric Biggers <[email protected]>
fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
Geert Uytterhoeven <[email protected]>
ata: sata_rcar: Fix DMA boundary mask
Gustavo A. R. Silva <[email protected]>
mtd: lpddr: Fix bad logic in print_drs_error
Jia-Ju Bai <[email protected]>
p54: avoid accessing the data mapped to streaming DMA
Miklos Szeredi <[email protected]>
fuse: fix page dereference after free
Kim Phillips <[email protected]>
arch/x86/amd/ibs: Fix re-arming IBS Fetch
Tung Nguyen <[email protected]>
tipc: fix memory leak caused by tipc_buf_append()
Andrew Gabbasov <[email protected]>
ravb: Fix bit fields checking in ravb_hwtstamp_get()
Michael Schaller <[email protected]>
efivarfs: Replace invalid slashes with exclamation marks in dentries.
Mukesh Ojha <[email protected]>
powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler
Rasmus Villemoes <[email protected]>
scripts/setlocalversion: make git describe output more reliable
NeilBrown <[email protected]>
SUNRPC: ECONNREFUSED should cause a rebind.
-------------
Diffstat:
Makefile | 4 +- arch/arc/kernel/entry.S | 16 ++-- arch/arc/kernel/stacktrace.c | 7 +- arch/arm/Kconfig | 2 + arch/arm/boot/dts/s5pv210.dtsi | 127 +++++++++++++---------------- arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- arch/arm/kernel/hw_breakpoint.c | 100 ++++++++++++++++------- arch/arm/plat-samsung/Kconfig | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/include/asm/numa.h | 3 + arch/arm64/kvm/sys_regs.c | 6 +- arch/arm64/mm/numa.c | 6 +- arch/ia64/kernel/Makefile | 2 +- arch/powerpc/kernel/sysfs.c | 42 ++++------ arch/powerpc/platforms/powernv/opal-dump.c | 9 +- arch/powerpc/platforms/powernv/opal-elog.c | 33 ++++++-- arch/powerpc/platforms/powernv/smp.c | 2 +- arch/sparc/kernel/smp_64.c | 65 ++++----------- arch/um/kernel/sigio.c | 6 +- arch/x86/events/amd/ibs.c | 53 ++++++++---- arch/x86/include/asm/msr-index.h | 1 + arch/x86/kernel/kexec-bzimage64.c | 3 +- drivers/acpi/acpi_dbg.c | 3 + drivers/acpi/acpi_extlog.c | 6 +- drivers/acpi/nfit/core.c | 2 +- drivers/acpi/video_detect.c | 9 ++ drivers/ata/sata_rcar.c | 2 +- drivers/base/core.c | 4 +- drivers/clk/ti/clockdomain.c | 2 + drivers/cpufreq/acpi-cpufreq.c | 3 +- drivers/cpufreq/sti-cpufreq.c | 6 +- drivers/dma/dma-jz4780.c | 7 +- drivers/iio/adc/ti-adc12138.c | 13 ++- drivers/iio/gyro/itg3200_buffer.c | 15 +++- drivers/iio/light/si1145.c | 19 +++-- drivers/input/serio/hil_mlc.c | 21 ++++- drivers/input/serio/hp_sdc_mlc.c | 8 +- drivers/leds/leds-bcm6328.c | 2 +- drivers/leds/leds-bcm6358.c | 2 +- drivers/md/bitmap.c | 2 +- drivers/md/raid5.c | 4 +- drivers/media/pci/tw5864/tw5864-video.c | 6 ++ drivers/memory/emif.c | 33 ++------ drivers/message/fusion/mptscsih.c | 13 +-- drivers/mmc/host/via-sdmmc.c | 3 + drivers/mtd/ubi/wl.c | 13 +++ drivers/net/ethernet/freescale/gianfar.c | 14 +--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 + drivers/net/ethernet/renesas/ravb_main.c | 10 ++- drivers/net/wan/hdlc_fr.c | 98 +++++++++++----------- drivers/net/wireless/ath/ath10k/htt_rx.c | 8 +- drivers/net/wireless/intersil/p54/p54pci.c | 4 +- drivers/of/of_reserved_mem.c | 13 ++- drivers/power/supply/test_power.c | 6 ++ drivers/rtc/rtc-rx8010.c | 24 ++++-- drivers/scsi/scsi_scan.c | 7 +- drivers/staging/comedi/drivers/cb_pcidas.c | 1 + drivers/staging/fsl-mc/bus/mc-io.c | 7 +- drivers/staging/octeon/ethernet-mdio.c | 6 -- drivers/staging/octeon/ethernet-rx.c | 34 ++++---- drivers/staging/octeon/ethernet.c | 9 ++ drivers/tty/serial/8250/8250_mtk.c | 2 +- drivers/tty/serial/serial_txx9.c | 3 + drivers/tty/vt/keyboard.c | 39 +++++---- drivers/tty/vt/vt.c | 24 +----- drivers/tty/vt/vt_ioctl.c | 32 ++++---- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/core.c | 15 +++- drivers/usb/host/fsl-mph-dr-of.c | 9 +- drivers/usb/misc/adutux.c | 1 + drivers/usb/serial/cyberjack.c | 7 +- drivers/usb/serial/option.c | 8 ++ drivers/vhost/vringh.c | 9 +- drivers/video/fbdev/pvr2fb.c | 2 + drivers/w1/masters/mxc_w1.c | 14 ++-- drivers/watchdog/rdc321x_wdt.c | 5 +- drivers/xen/events/events_base.c | 29 +++++-- fs/9p/vfs_file.c | 4 +- fs/btrfs/ctree.c | 6 ++ fs/btrfs/reada.c | 2 + fs/btrfs/tree-log.c | 8 ++ fs/buffer.c | 16 ---- fs/cachefiles/rdwr.c | 3 +- fs/ceph/addr.c | 2 +- fs/crypto/policy.c | 39 +++++---- fs/efivarfs/super.c | 3 + fs/ext4/ext4.h | 4 +- fs/ext4/ioctl.c | 34 ++------ fs/ext4/namei.c | 6 +- fs/ext4/super.c | 5 ++ fs/f2fs/checkpoint.c | 8 +- fs/f2fs/f2fs.h | 4 +- fs/f2fs/file.c | 19 +---- fs/f2fs/namei.c | 6 +- fs/fuse/dev.c | 28 ++++--- fs/gfs2/ops_fstype.c | 18 ++-- fs/nfs/namespace.c | 12 ++- fs/ubifs/debug.c | 1 + fs/xfs/xfs_rtalloc.c | 10 ++- include/linux/fscrypto.h | 12 +-- include/linux/hil_mlc.h | 2 +- include/linux/mtd/pfow.h | 2 +- init/Kconfig | 3 +- kernel/debug/debug_core.c | 22 +++-- kernel/fork.c | 10 +-- kernel/kthread.c | 3 +- kernel/trace/ring_buffer.c | 8 +- kernel/trace/trace.c | 2 +- kernel/trace/trace.h | 26 +++++- kernel/trace/trace_selftest.c | 9 +- lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- net/9p/trans_fd.c | 2 +- net/ceph/messenger.c | 5 ++ net/sunrpc/clnt.c | 8 ++ net/tipc/core.c | 5 ++ net/tipc/msg.c | 5 +- net/vmw_vsock/af_vsock.c | 2 +- scripts/setlocalversion | 21 +++-- sound/usb/pcm.c | 1 + 130 files changed, 894 insertions(+), 650 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/117 SUNRPC: ECONNREFUSED should cause a rebind.
From: NeilBrown <[email protected]>
commit fd01b2597941d9c17980222999b0721648b383b8 upstream.
If you
- mount and NFSv3 filesystem
- do some file locking which requires the server
to make a GRANT call back
- unmount
- mount again and do the same locking
then the second attempt at locking suffers a 30 second delay. Unmounting and remounting causes lockd to stop and restart, which causes it to bind to a new port.
The server still thinks the old port is valid and gets ECONNREFUSED when trying to contact it.
ECONNREFUSED should be seen as a hard error that is not worth retrying. Rebinding is the only reasonable response.
This patch forces a rebind if that makes sense.
--- net/sunrpc/clnt.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/sunrpc/clnt.c +8 -0
@@ -1936,6 +1936,14 @@ call_connect_status(struct rpc_task *tas task->tk_status =0 ;switch (status) {case -ECONNREFUSED : +/* A positive refusal suggests a rebind is needed. */ +if (RPC_IS_SOFTCONN (task)) +break ; +if (clnt->cl_autobind) { +rpc_force_rebind (clnt); + task->tk_action = call_bind; +return ; + }case -ECONNRESET :case -ECONNABORTED :case -ENETUNREACH :
Greg Kroah-Hartman
maintainerPATCH 2/117 scripts/setlocalversion: make git describe output more reliable
In reply to Greg Kroah-HartmanFrom: Rasmus Villemoes <[email protected]>
commit 548b8b5168c90c42e88f70fcf041b4ce0b8e7aa8 upstream.
When building for an embedded target using Yocto, we're sometimes observing that the version string that gets built into vmlinux (and thus what uname -a reports) differs from the path under /lib/modules/ where modules get installed in the rootfs, but only in the length of the -gabc123def suffix. Hence modprobe always fails.
The problem is that Yocto has the concept of "sstate" (shared state), which allows different developers/buildbots/etc. to share build artifacts, based on a hash of all the metadata that went into building that artifact - and that metadata includes all dependencies (e.g. the compiler used etc.). That normally works quite well; usually a clean build (without using any sstate cache) done by one developer ends up being binary identical to a build done on another host. However, one thing that can cause two developers to end up with different builds [and thus make one's vmlinux package incompatible with the other's kernel-dev package], which is not captured by the metadata hashing, is this git describe: The output of that can be affected by
(1) git version: before 2.11 git defaulted to a minimum of 7, since 2.11 (git.git commit e6c587) the default is dynamic based on the number of objects in the repo
(2) hence even if both run the same git version, the output can differ based on how many remotes are being tracked (or just lots of local development branches or plain old garbage)
(3) and of course somebody could have a core.abbrev config setting in ~/.gitconfig
So in order to avoid uname -a output relying on such random details of the build environment which are rather hard to ensure are consistent between developers and buildbots, make sure the abbreviated sha1 always consists of exactly 12 hex characters. That is consistent with the current rule for -stable patches, and is almost always enough to identify the head commit unambigously - in the few cases where it does not, the v5.4.3-00021- prefix would certainly nail it down.
--- scripts/setlocalversion | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-)
scripts/setlocalversion +15 -4
@@ -44,7 +44,7 @@ scm_version() # Check for git and a git repo. if test -z "$(git rev-parse --show-cdup 2>/dev/null)" && - head=`git rev-parse --verify --short HEAD 2>/dev/null`; then + head=$(git rev-parse --verify HEAD 2>/dev/null); then # If we are at a tagged commit (like "v2.6.30-rc6"), we ignore # it, because this version is defined in the top level Makefile.
@@ -58,11 +58,22 @@ scm_version() fi # If we are past a tagged commit (like # "v2.6.30-rc5-302-g72357d5"), we pretty print it. - if atag="`git describe 2>/dev/null`"; then - echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),$(NF))}' + # + # Ensure the abbreviated sha1 has exactly 12 + # hex characters, to make the output + # independent of git version, local + # core.abbrev settings and/or total number of + # objects in the current repository - passing + # --abbrev=12 ensures a minimum of 12, and the + # awk substr() then picks the 'g' and first 12 + # hex chars. + if atag="$(git describe --abbrev=12 2>/dev/null)"; then + echo "$atag" | awk -F- '{printf("-%05d-%s", $(NF-1),substr($(NF),0,13))}' - # If we don't have a tag at all we print -g{commitish}. + # If we don't have a tag at all we print -g{commitish}, + # again using exactly 12 hex chars. else + head="$(echo $head | cut -c1-12)" printf '%s%s' -g $head fi fi
Greg Kroah-Hartman
maintainerPATCH 3/117 powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler
In reply to Greg Kroah-HartmanFrom: Mukesh Ojha <[email protected]>
commit b29336c0e1785a28bc40a9fd47c2321671e9792e upstream.
Converts all the return explicit number to a more proper IRQ_HANDLED, which looks proper incase of interrupt handler returning case.
Here, It also removes error message like "nobody cared" which was getting unveiled while returning -1 or 0 from handler.
--- arch/powerpc/platforms/powernv/opal-dump.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
arch/powerpc/platforms/powernv/opal-dump.c +3 -6
@@ -385,13 +385,12 @@ static irqreturn_t process_dump(int irq, {int rc;uint32_t dump_id, dump_size, dump_type; -struct dump_obj *dump;char name[22 ];struct kobject *kobj; rc =dump_read_info (&dump_id, &dump_size, &dump_type);if (rc !=OPAL_SUCCESS ) -return rc; +return IRQ_HANDLED ;sprintf (name,"0x%x-0x%x" , dump_type, dump_id);
@@ -403,12 +402,10 @@ static irqreturn_t process_dump(int irq,if (kobj) {/* Drop reference added by kset_find_obj() */ kobject_put (kobj); -return 0 ; +return IRQ_HANDLED ; } - dump =create_dump_obj (dump_id, dump_size, dump_type); -if (!dump) -return -1 ; +create_dump_obj (dump_id, dump_size, dump_type);return IRQ_HANDLED ; }
Greg Kroah-Hartman
maintainerPATCH 4/117 efivarfs: Replace invalid slashes with exclamation marks in dentries.
In reply to Greg Kroah-HartmanFrom: Michael Schaller <[email protected]>
commit 336af6a4686d885a067ecea8c3c3dd129ba4fc75 upstream.
Without this patch efivarfs_alloc_dentry creates dentries with slashes in their name if the respective EFI variable has slashes in its name. This in turn causes EIO on getdents64, which prevents a complete directory listing of /sys/firmware/efi/efivars/.
This patch replaces the invalid shlashes with exclamation marks like kobject_set_name_vargs does for /sys/firmware/efi/vars/ to have consistently named dentries under /sys/firmware/efi/vars/ and /sys/firmware/efi/efivars/.
--- fs/efivarfs/super.c | 3 +++ 1 file changed, 3 insertions(+)
fs/efivarfs/super.c +3 -0
@@ -146,6 +146,9 @@ static int efivarfs_callback(efi_char16_ name[len +EFI_VARIABLE_GUID_LEN +1 ] ='\0' ; +/* replace invalid slashes like kobject_set_name_vargs does for /sys/firmware/efi/vars. */ +strreplace (name,'/' ,'!' ); + inode =efivarfs_get_inode (sb,d_inode (root),S_IFREG |0644 ,0 , is_removable);if (!inode)
Greg Kroah-Hartman
maintainerPATCH 5/117 ravb: Fix bit fields checking in ravb_hwtstamp_get()
In reply to Greg Kroah-HartmanFrom: Andrew Gabbasov <[email protected]>
[ Upstream commit 68b9f0865b1ef545da180c57d54b82c94cb464a4 ]
In the function ravb_hwtstamp_get() in ravb_main.c with the existing values for RAVB_RXTSTAMP_TYPE_V2_L2_EVENT (0x2) and RAVB_RXTSTAMP_TYPE_ALL (0x6)
if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_V2_L2_EVENT)
config.rx_filter = HWTSTAMP_FILTER_PTP_V2_L2_EVENT; else if (priv->tstamp_rx_ctrl & RAVB_RXTSTAMP_TYPE_ALL) config.rx_filter = HWTSTAMP_FILTER_ALL;
if the test on RAVB_RXTSTAMP_TYPE_ALL should be true, it will never be reached.
This issue can be verified with 'hwtstamp_config' testing program (tools/testing/selftests/net/hwtstamp_config.c). Setting filter type to ALL and subsequent retrieving it gives incorrect value:
$ hwtstamp_config eth0 OFF ALL flags = 0 tx_type = OFF rx_filter = ALL $ hwtstamp_config eth0 flags = 0 tx_type = OFF rx_filter = PTP_V2_L2_EVENT
Correct this by converting if-else's to switch.
--- drivers/net/ethernet/renesas/ravb_main.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/renesas/ravb_main.c +7 -3
@@ -1729,12 +1729,16 @@ static int ravb_hwtstamp_get(struct net_ config.flags =0 ; config.tx_type = priv->tstamp_tx_ctrl ?HWTSTAMP_TX_ON :HWTSTAMP_TX_OFF ; -if (priv->tstamp_rx_ctrl &RAVB_RXTSTAMP_TYPE_V2_L2_EVENT ) +switch (priv->tstamp_rx_ctrl &RAVB_RXTSTAMP_TYPE ) { +case RAVB_RXTSTAMP_TYPE_V2_L2_EVENT : config.rx_filter =HWTSTAMP_FILTER_PTP_V2_L2_EVENT ; -else if (priv->tstamp_rx_ctrl &RAVB_RXTSTAMP_TYPE_ALL ) +break ; +case RAVB_RXTSTAMP_TYPE_ALL : config.rx_filter =HWTSTAMP_FILTER_ALL ; -else +break ; +default : config.rx_filter =HWTSTAMP_FILTER_NONE ; + }return copy_to_user (req->ifr_data, &config,sizeof (config)) ? -EFAULT :0 ;
Greg Kroah-Hartman
maintainerPATCH 6/117 tipc: fix memory leak caused by tipc_buf_append()
In reply to Greg Kroah-HartmanFrom: Tung Nguyen <[email protected]>
[ Upstream commit ceb1eb2fb609c88363e06618b8d4bbf7815a4e03 ]
Commit ed42989eab57 ("tipc: fix the skb_unshare() in tipc_buf_append()") replaced skb_unshare() with skb_copy() to not reduce the data reference counter of the original skb intentionally. This is not the correct way to handle the cloned skb because it causes memory leak in 2 following cases:
1/ Sending multicast messages via broadcast link
The original skb list is cloned to the local skb list for local destination. After that, the data reference counter of each skb in the original list has the value of 2. This causes each skb not to be freed after receiving ACK:
tipc_link_advance_transmq()
{
...
/* release skb */
__skb_unlink(skb, &l->transmq);
kfree_skb(skb); <-- memory exists after being freed
}
2/ Sending multicast messages via replicast link
Similar to the above case, each skb cannot be freed after purging the skb list:
tipc_mcast_xmit()
{
...
__skb_queue_purge(pkts); <-- memory exists after being freed
}
This commit fixes this issue by using skb_unshare() instead. Besides, to avoid use-after-free error reported by KASAN, the pointer to the fragment is set to NULL before calling skb_unshare() to make sure that the original skb is not freed after freeing the fragment 2 times in case skb_unshare() returns NULL.
--- net/tipc/msg.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
net/tipc/msg.c +2 -3
@@ -140,12 +140,11 @@ int tipc_buf_append(struct sk_buff **heaif (fragid ==FIRST_FRAGMENT ) {if (unlikely (head)) goto err; -if (skb_cloned (frag)) - frag =skb_copy (frag,GFP_ATOMIC ); + *buf =NULL ; + frag =skb_unshare (frag,GFP_ATOMIC );if (unlikely (!frag)) goto err; head = *headbuf = frag; - *buf =NULL ;TIPC_SKB_CB (head)->tail =NULL ;if (skb_is_nonlinear (head)) { skb_walk_frags(head, tail) {
Greg Kroah-Hartman
maintainerPATCH 7/117 arch/x86/amd/ibs: Fix re-arming IBS Fetch
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
commit 221bfce5ebbdf72ff08b3bf2510ae81058ee568b upstream.
Stephane Eranian found a bug in that IBS' current Fetch counter was not being reset when the driver would write the new value to clear it along with the enable bit set, and found that adding an MSR write that would first disable IBS Fetch would make IBS Fetch reset its current count.
Indeed, the PPR for AMD Family 17h Model 31h B0 55803 Rev 0.54 - Sep 12, 2019 states "The periodic fetch counter is set to IbsFetchCnt [...] when IbsFetchEn is changed from 0 to 1."
Explicitly set IbsFetchEn to 0 and then to 1 when re-enabling IBS Fetch, so the driver properly resets the internal counter to 0 and IBS Fetch starts counting again.
A family 15h machine tested does not have this problem, and the extra wrmsr is also not needed on Family 19h, so only do the extra wrmsr on families 16h through 18h.
--- arch/x86/events/amd/ibs.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-)
arch/x86/events/amd/ibs.c +14 -1
@@ -88,6 +88,7 @@ struct perf_ibs {u64 max_period;unsigned long offset_mask[1 ];int offset_max; + unsigned int fetch_count_reset_broken : 1;struct cpu_perf_ibs __percpu *pcpu;struct attribute **format_attrs;
@@ -374,7 +375,12 @@ perf_ibs_event_update(struct perf_ibs *pstatic inline void perf_ibs_enable_event (struct perf_ibs *perf_ibs,struct hw_perf_event *hwc,u64 config) { -wrmsrl (hwc->config_base, hwc->config | config | perf_ibs->enable_mask); +u64 tmp = hwc->config | config; + +if (perf_ibs->fetch_count_reset_broken) +wrmsrl (hwc->config_base, tmp & ~perf_ibs->enable_mask); + +wrmsrl (hwc->config_base, tmp | perf_ibs->enable_mask); }/*
@@ -743,6 +749,13 @@ static __init void perf_event_ibs_init(v {struct attribute **attr = ibs_op_format_attrs; +/* +* Some chips fail to reset the fetch count when it is written; instead +* they need a 0-1 transition of IbsFetchEn. +*/ +if (boot_cpu_data.x86 >=0x16 && boot_cpu_data.x86 <=0x18 ) + perf_ibs_fetch.fetch_count_reset_broken =1 ; +perf_ibs_pmu_init (&perf_ibs_fetch,"ibs_fetch" );if (ibs_caps &IBS_CAPS_OPCNT ) {
Greg Kroah-Hartman
maintainerPATCH 8/117 fuse: fix page dereference after free
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit d78092e4937de9ce55edcb4ee4c5e3c707be0190 upstream.
After unlock_request() pages from the ap->pages[] array may be put (e.g. by aborting the connection) and the pages can be freed.
Prevent use after free by grabbing a reference to the page before calling unlock_request().
The original patch was created by Pradeep P V K.
--- fs/fuse/dev.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-)
fs/fuse/dev.c +18 -10
@@ -846,15 +846,16 @@ static int fuse_try_move_page(struct fusstruct page *newpage;struct pipe_buffer *buf = cs->pipebufs; +get_page (oldpage); err =unlock_request (cs->req);if (err) -return err; + goto out_put_old;fuse_copy_finish (cs); err =pipe_buf_confirm (cs->pipe, buf);if (err) -return err; + goto out_put_old;BUG_ON (!cs->nr_segs); cs->currbuf = buf;
@@ -894,7 +895,7 @@ static int fuse_try_move_page(struct fus err =replace_page_cache_page (oldpage, newpage,GFP_KERNEL );if (err) {unlock_page (newpage); -return err; + goto out_put_old; }get_page (newpage);
@@ -913,14 +914,19 @@ static int fuse_try_move_page(struct fusif (err) {unlock_page (newpage);put_page (newpage); -return err; + goto out_put_old; }unlock_page (oldpage); +/* Drop ref for ap->pages[] array */ put_page (oldpage); cs->len =0 ; -return 0 ; + err =0 ; +out_put_old: +/* Drop ref obtained in this function */ +put_page (oldpage); +return err; out_fallback_unlock:unlock_page (newpage);
@@ -929,10 +935,10 @@ out_fallback: cs->offset = buf->offset; err =lock_request (cs->req); -if (err) -return err; +if (!err) + err =1 ; -return 1 ; + goto out_put_old; } static int fuse_ref_page(struct fuse_copy_state *cs, struct page *page,
@@ -944,14 +950,16 @@ static int fuse_ref_page(struct fuse_copif (cs->nr_segs == cs->pipe->buffers)return -EIO ; +get_page (page); err =unlock_request (cs->req); -if (err) +if (err) { +put_page (page);return err; + }fuse_copy_finish (cs); buf = cs->pipebufs; -get_page (page); buf->page = page; buf->offset = offset; buf->len = count;
Greg Kroah-Hartman
maintainerPATCH 9/117 p54: avoid accessing the data mapped to streaming DMA
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
commit 478762855b5ae9f68fa6ead1edf7abada70fcd5f upstream.
In p54p_tx(), skb->data is mapped to streaming DMA on line 337:
mapping = pci_map_single(..., skb->data, ...);
Then skb->data is accessed on line 349:
desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;
This access may cause data inconsistency between CPU cache and hardware.
To fix this problem, ((struct p54_hdr *)skb->data)->req_id is stored in a local variable before DMA mapping, and then the driver accesses this local variable instead of skb->data.
--- drivers/net/wireless/intersil/p54/p54pci.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/intersil/p54/p54pci.c +3 -1
@@ -332,10 +332,12 @@ static void p54p_tx(struct ieee80211_hwstruct p54p_desc *desc;dma_addr_t mapping;u32 idx, i; +__le32 device_addr;spin_lock_irqsave (&priv->lock, flags); idx =le32_to_cpu (ring_control->host_idx[1 ]); i = idx %ARRAY_SIZE (ring_control->tx_data); + device_addr = ((struct p54_hdr *)skb->data)->req_id; mapping =pci_map_single (priv->pdev, skb->data, skb->len,PCI_DMA_TODEVICE );
@@ -349,7 +351,7 @@ static void p54p_tx(struct ieee80211_hw desc = &ring_control->tx_data[i]; desc->host_addr =cpu_to_le32 (mapping); - desc->device_addr = ((struct p54_hdr *)skb->data)->req_id; + desc->device_addr = device_addr; desc->len =cpu_to_le16 (skb->len); desc->flags =0 ;
Greg Kroah-Hartman
maintainerPATCH 10/117 mtd: lpddr: Fix bad logic in print_drs_error
In reply to Greg Kroah-HartmanFrom: Gustavo A. R. Silva <[email protected]>
commit 1c9c02bb22684f6949d2e7ddc0a3ff364fd5a6fc upstream.
Update logic for broken test. Use a more common logging style.
It appears the logic in this function is broken for the consecutive tests of
if (prog_status & 0x3)
...
else if (prog_status & 0x2)
...
else (prog_status & 0x1)
...Likely the first test should be
if ((prog_status & 0x3) == 0x3)
Found by inspection of include files using printk.
--- include/linux/mtd/pfow.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/mtd/pfow.h +1 -1
@@ -127,7 +127,7 @@ static inline void print_drs_error(unsigif (!(dsr &DSR_AVAILABLE ))printk (KERN_NOTICE "DSR.15: (0) Device not Available\n" ); -if (prog_status &0x03 ) +if ((prog_status &0x03 ) ==0x03 )printk (KERN_NOTICE "DSR.9,8: (11) Attempt to program invalid " "half with 41h command\n" );else if (prog_status &0x02 )
Greg Kroah-Hartman
maintainerPATCH 11/117 ata: sata_rcar: Fix DMA boundary mask
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
commit df9c590986fdb6db9d5636d6cd93bc919c01b451 upstream.
Before commit 9495b7e92f716ab2 ("driver core: platform: Initialize dma_parms for platform devices"), the R-Car SATA device didn't have DMA parameters. Hence the DMA boundary mask supplied by its driver was silently ignored, as __scsi_init_queue() doesn't check the return value of dma_set_seg_boundary(), and the default value of 0xffffffff was used.
Now the device has gained DMA parameters, the driver-supplied value is used, and the following warning is printed on Salvator-XS:
DMA-API: sata_rcar ee300000.sata: mapping sg segment across boundary [start=0x00000000ffffe000] [end=0x00000000ffffefff] [boundary=0x000000001ffffffe]
WARNING: CPU: 5 PID: 38 at kernel/dma/debug.c:1233 debug_dma_map_sg+0x298/0x300(the range of start/end values depend on whether IOMMU support is
enabled or not)
The issue here is that SATA_RCAR_DMA_BOUNDARY doesn't have bit 0 set, so any typical end value, which is odd, will trigger the check.
Fix this by increasing the DMA boundary value by 1.
This also fixes the following WRITE DMA EXT timeout issue:
# dd if=/dev/urandom of=/mnt/de1/file1-1024M bs=1M count=1024
ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x6 frozen
ata1.00: failed command: WRITE DMA EXT
ata1.00: cmd 35/00:00:00:e6:0c/00:0a:00:00:00/e0 tag 0 dma 1310720 out
res 40/00:01:00:00:00/00:00:00:00:00/00 Emask 0x4 (timeout)
ata1.00: status: { DRDY }as seen by Shimoda-san since commit 429120f3df2dba2b ("block: fix splitting segments on boundary masks").
--- drivers/ata/sata_rcar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/sata_rcar.c +1 -1
@@ -122,7 +122,7 @@/* Descriptor table word 0 bit (when DTA32M = 1) */ #define SATA_RCAR_DTEND BIT(0) -#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFEUL +#define SATA_RCAR_DMA_BOUNDARY 0x1FFFFFFFUL/* Gen2 Physical Layer Control Registers */ #define RCAR_GEN2_PHY_CTL1_REG 0x1704
Greg Kroah-Hartman
maintainerPATCH 12/117 fscrypt: return -EXDEV for incompatible rename or link into encrypted dir
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit f5e55e777cc93eae1416f0fa4908e8846b6d7825 upstream.
Currently, trying to rename or link a regular file, directory, or symlink into an encrypted directory fails with EPERM when the source file is unencrypted or is encrypted with a different encryption policy, and is on the same mountpoint. It is correct for the operation to fail, but the choice of EPERM breaks tools like 'mv' that know to copy rather than rename if they see EXDEV, but don't know what to do with EPERM.
Our original motivation for EPERM was to encourage users to securely handle their data. Encrypting files by "moving" them into an encrypted directory can be insecure because the unencrypted data may remain in free space on disk, where it can later be recovered by an attacker. It's much better to encrypt the data from the start, or at least try to securely delete the source data e.g. using the 'shred' program.
However, the current behavior hasn't been effective at achieving its goal because users tend to be confused, hack around it, and complain; see e.g. https://github.com/google/fscrypt/issues/76. And in some cases it's actually inconsistent or unnecessary. For example, 'mv'-ing files between differently encrypted directories doesn't work even in cases where it can be secure, such as when in userspace the same passphrase protects both directories. Yet, you *can* already 'mv' unencrypted files into an encrypted directory if the source files are on a different mountpoint, even though doing so is often insecure.
There are probably better ways to teach users to securely handle their files. For example, the 'fscrypt' userspace tool could provide a command that migrates unencrypted files into an encrypted directory, acting like 'shred' on the source files and providing appropriate warnings depending on the type of the source filesystem and disk.
Receiving errors on unimportant files might also force some users to disable encryption, thus making the behavior counterproductive. It's desirable to make encryption as unobtrusive as possible.
Therefore, change the error code from EPERM to EXDEV so that tools looking for EXDEV will fall back to a copy.
This, of course, doesn't prevent users from still doing the right things to securely manage their files. Note that this also matches the behavior when a file is renamed between two project quota hierarchies; so there's precedent for using EXDEV for things other than mountpoints.
xfstests generic/398 will require an update with this change.
[Rewritten from an earlier patch series by Michael Halcrow.]
--- fs/crypto/policy.c | 3 +-- fs/ext4/namei.c | 6 +++--- fs/f2fs/namei.c | 6 +++--- 3 files changed, 7 insertions(+), 8 deletions(-)
fs/crypto/policy.c +1 -2
@@ -180,8 +180,7 @@ EXPORT_SYMBOL(fscrypt_get_policy);* malicious offline violations of this constraint, while the link and rename * checks are needed to prevent online violations of this constraint. * -* Return: 1 if permitted, 0 if forbidden. If forbidden, the caller must fail -* the filesystem operation with EPERM. +* Return: 1 if permitted, 0 if forbidden. */ int fscrypt_has_permitted_context (struct inode *parent,struct inode *child) {
fs/ext4/namei.c +3 -3
@@ -3259,7 +3259,7 @@ static int ext4_link(struct dentry *old_return -EMLINK ;if (ext4_encrypted_inode (dir) && !fscrypt_has_permitted_context (dir, inode)) -return -EPERM ; +return -EXDEV ; if ((ext4_test_inode_flag(dir, EXT4_INODE_PROJINHERIT)) && (!projid_eq(EXT4_I(dir)->i_projid,
@@ -3597,7 +3597,7 @@ static int ext4_rename(struct inode *oldif ((old.dir != new.dir) &&ext4_encrypted_inode (new.dir) && !fscrypt_has_permitted_context (new.dir, old.inode)) { - retval = -EPERM ; + retval = -EXDEV ; goto end_rename; }
@@ -3776,7 +3776,7 @@ static int ext4_cross_rename(struct inod (old_dir != new_dir) && (!fscrypt_has_permitted_context(new_dir, old.inode) || !fscrypt_has_permitted_context(old_dir, new.inode))) -return -EPERM ; +return -EXDEV ; if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT) && !projid_eq(EXT4_I(new_dir)->i_projid,
fs/f2fs/namei.c +3 -3
@@ -177,7 +177,7 @@ static int f2fs_link(struct dentry *old_if (f2fs_encrypted_inode (dir) && !fscrypt_has_permitted_context (dir, inode)) -return -EPERM ; +return -EXDEV ;f2fs_balance_fs (sbi, true);
@@ -667,7 +667,7 @@ static int f2fs_rename(struct inode *oldif ((old_dir != new_dir) &&f2fs_encrypted_inode (new_dir) && !fscrypt_has_permitted_context (new_dir, old_inode)) { - err = -EPERM ; + err = -EXDEV ; goto out; }
@@ -855,7 +855,7 @@ static int f2fs_cross_rename(struct inod (old_dir != new_dir) && (!fscrypt_has_permitted_context (new_dir, old_inode) || !fscrypt_has_permitted_context(old_dir, new_inode))) - return -EPERM; + return -EXDEV; old_entry =f2fs_find_entry (old_dir, &old_dentry->d_name, &old_page);if (!old_entry) {
Greg Kroah-Hartman
maintainerPATCH 13/117 fscrypto: move ioctl processing more fully into common code
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit db717d8e26c2d1b0dba3e08668a1e6a7f665adde upstream.
Multiple bugs were recently fixed in the "set encryption policy" ioctl. To make it clear that fscrypt_process_policy() and fscrypt_get_policy() implement ioctls and therefore their implementations must take standard security and correctness precautions, rename them to fscrypt_ioctl_set_policy() and fscrypt_ioctl_get_policy(). Make the latter take in a struct file * to make it consistent with the former.
--- fs/crypto/policy.c | 34 +++++++++++++++++++++------------- fs/ext4/ext4.h | 4 ++-- fs/ext4/ioctl.c | 32 ++++---------------------------- fs/f2fs/f2fs.h | 4 ++-- fs/f2fs/file.c | 19 ++----------------- include/linux/fscrypto.h | 12 ++++++------ 6 files changed, 37 insertions(+), 68 deletions(-)
fs/crypto/policy.c +21 -13
@@ -93,16 +93,19 @@ static int create_encryption_context_froreturn inode->i_sb->s_cop->set_context (inode, &ctx,sizeof (ctx),NULL ); } -int fscrypt_process_policy (struct file *filp, -const struct fscrypt_policy *policy) +int fscrypt_ioctl_set_policy (struct file *filp,const void __user *arg) { +struct fscrypt_policy policy;struct inode *inode =file_inode (filp);int ret; +if (copy_from_user (&policy, arg,sizeof (policy))) +return -EFAULT ; +if (!inode_owner_or_capable (inode))return -EACCES ; -if (policy->version !=0 ) +if (policy.version !=0 )return -EINVAL ; ret =mnt_want_write_file (filp);
@@ -122,9 +125,9 @@ int fscrypt_process_policy(struct file * ret = -ENOTEMPTY ; else ret =create_encryption_context_from_policy (inode, - policy); + &policy); }else if (!is_encryption_context_consistent_with_policy (inode, - policy)) { + &policy)) {printk (KERN_WARNING "%s: Policy inconsistent with encryption context\n" , __func__);
@@ -136,11 +139,13 @@ int fscrypt_process_policy(struct file *mnt_drop_write_file (filp);return ret; } -EXPORT_SYMBOL (fscrypt_process_policy); +EXPORT_SYMBOL (fscrypt_ioctl_set_policy); -int fscrypt_get_policy (struct inode *inode,struct fscrypt_policy *policy) +int fscrypt_ioctl_get_policy (struct file *filp,void __user *arg) { +struct inode *inode =file_inode (filp);struct fscrypt_context ctx; +struct fscrypt_policy policy;int res; if (!inode->i_sb->s_cop->get_context ||
@@ -153,15 +158,18 @@ int fscrypt_get_policy(struct inode *inoif (ctx.format !=FS_ENCRYPTION_CONTEXT_FORMAT_V1 )return -EINVAL ; - policy->version =0 ; - policy->contents_encryption_mode = ctx.contents_encryption_mode; - policy->filenames_encryption_mode = ctx.filenames_encryption_mode; - policy->flags = ctx.flags; -memcpy (&policy->master_key_descriptor, ctx.master_key_descriptor, + policy.version =0 ; + policy.contents_encryption_mode = ctx.contents_encryption_mode; + policy.filenames_encryption_mode = ctx.filenames_encryption_mode; + policy.flags = ctx.flags; +memcpy (policy.master_key_descriptor, ctx.master_key_descriptor,FS_KEY_DESCRIPTOR_SIZE ); + +if (copy_to_user (arg, &policy,sizeof (policy))) +return -EFAULT ;return 0 ; } -EXPORT_SYMBOL (fscrypt_get_policy); +EXPORT_SYMBOL (fscrypt_ioctl_get_policy);/** * fscrypt_has_permitted_context() - is a file's encryption policy permitted
fs/ext4/ext4.h +2 -2
@@ -2354,8 +2354,8 @@ static inline void ext4_fname_free_filen#define fscrypt_pullback_bio_page fscrypt_notsupp_pullback_bio_page#define fscrypt_restore_control_page fscrypt_notsupp_restore_control_page#define fscrypt_zeroout_range fscrypt_notsupp_zeroout_range -#define fscrypt_process_policy fscrypt_notsupp_process_policy -#define fscrypt_get_policy fscrypt_notsupp_get_policy +#define fscrypt_ioctl_set_policy fscrypt_notsupp_ioctl_set_policy +#define fscrypt_ioctl_get_policy fscrypt_notsupp_ioctl_get_policy#define fscrypt_has_permitted_context fscrypt_notsupp_has_permitted_context#define fscrypt_inherit_context fscrypt_notsupp_inherit_context#define fscrypt_get_encryption_info fscrypt_notsupp_get_encryption_info
fs/ext4/ioctl.c +4 -28
@@ -774,22 +774,12 @@ resizefs_out: }case EXT4_IOC_PRECACHE_EXTENTS :return ext4_ext_precache (inode); -case EXT4_IOC_SET_ENCRYPTION_POLICY : { -#ifdef CONFIG_EXT4_FS_ENCRYPTION -struct fscrypt_policy policy; +case EXT4_IOC_SET_ENCRYPTION_POLICY :if (!ext4_has_feature_encrypt (sb))return -EOPNOTSUPP ; +return fscrypt_ioctl_set_policy (filp, (const void __user *)arg); -if (copy_from_user (&policy, - (struct fscrypt_policy __user *)arg, -sizeof (policy))) -return -EFAULT ; -return fscrypt_process_policy (filp, &policy); -#else -return -EOPNOTSUPP ; -#endif - }case EXT4_IOC_GET_ENCRYPTION_PWSALT : {int err, err2;struct ext4_sb_info *sbi =EXT4_SB (sb);
@@ -826,23 +816,9 @@ resizefs_out:return -EFAULT ;return 0 ; } -case EXT4_IOC_GET_ENCRYPTION_POLICY : { -#ifdef CONFIG_EXT4_FS_ENCRYPTION -struct fscrypt_policy policy; -int err =0 ; +case EXT4_IOC_GET_ENCRYPTION_POLICY : +return fscrypt_ioctl_get_policy (filp, (void __user *)arg); -if (!ext4_encrypted_inode (inode)) -return -ENOENT ; - err =fscrypt_get_policy (inode, &policy); -if (err) -return err; -if (copy_to_user ((void __user *)arg, &policy,sizeof (policy))) -return -EFAULT ; -return 0 ; -#else -return -EOPNOTSUPP ; -#endif - }case EXT4_IOC_FSGETXATTR : {struct fsxattr fa;
fs/f2fs/f2fs.h +2 -2
@@ -2513,8 +2513,8 @@ static inline bool f2fs_may_encrypt(stru#define fscrypt_pullback_bio_page fscrypt_notsupp_pullback_bio_page#define fscrypt_restore_control_page fscrypt_notsupp_restore_control_page#define fscrypt_zeroout_range fscrypt_notsupp_zeroout_range -#define fscrypt_process_policy fscrypt_notsupp_process_policy -#define fscrypt_get_policy fscrypt_notsupp_get_policy +#define fscrypt_ioctl_set_policy fscrypt_notsupp_ioctl_set_policy +#define fscrypt_ioctl_get_policy fscrypt_notsupp_ioctl_get_policy#define fscrypt_has_permitted_context fscrypt_notsupp_has_permitted_context#define fscrypt_inherit_context fscrypt_notsupp_inherit_context#define fscrypt_get_encryption_info fscrypt_notsupp_get_encryption_info
fs/f2fs/file.c +2 -17
@@ -1774,31 +1774,16 @@ static bool uuid_is_nonzero(__u8 u[16])static int f2fs_ioc_set_encryption_policy (struct file *filp,unsigned long arg) { -struct fscrypt_policy policy;struct inode *inode =file_inode (filp); -if (copy_from_user (&policy, (struct fscrypt_policy __user *)arg, -sizeof (policy))) -return -EFAULT ; -f2fs_update_time (F2FS_I_SB (inode),REQ_TIME ); -return fscrypt_process_policy (filp, &policy); +return fscrypt_ioctl_set_policy (filp, (const void __user *)arg); }static int f2fs_ioc_get_encryption_policy (struct file *filp,unsigned long arg) { -struct fscrypt_policy policy; -struct inode *inode =file_inode (filp); -int err; - - err =fscrypt_get_policy (inode, &policy); -if (err) -return err; - -if (copy_to_user ((struct fscrypt_policy __user *)arg, &policy,sizeof (policy))) -return -EFAULT ; -return 0 ; +return fscrypt_ioctl_get_policy (filp, (void __user *)arg); }static int f2fs_ioc_get_encryption_pwsalt (struct file *filp,unsigned long arg)
include/linux/fscrypto.h +6 -6
@@ -249,8 +249,8 @@ extern void fscrypt_restore_control_pageextern int fscrypt_zeroout_range (struct inode *,pgoff_t ,sector_t ,unsigned int );/* policy.c */ -extern int fscrypt_process_policy (struct file *,const struct fscrypt_policy *); -extern int fscrypt_get_policy (struct inode *,struct fscrypt_policy *); +extern int fscrypt_ioctl_set_policy (struct file *,const void __user *); +extern int fscrypt_ioctl_get_policy (struct file *,void __user *);extern int fscrypt_has_permitted_context (struct inode *,struct inode *);extern int fscrypt_inherit_context (struct inode *,struct inode *,void *,bool );
@@ -318,14 +318,14 @@ static inline int fscrypt_notsupp_zeroou }/* policy.c */ -static inline int fscrypt_notsupp_process_policy (struct file *f, -const struct fscrypt_policy *p) +static inline int fscrypt_notsupp_ioctl_set_policy (struct file *f, +const void __user *arg) {return -EOPNOTSUPP ; } -static inline int fscrypt_notsupp_get_policy (struct inode *i, -struct fscrypt_policy *p) +static inline int fscrypt_notsupp_ioctl_get_policy (struct file *f, +void __user *arg) {return -EOPNOTSUPP ; }
Greg Kroah-Hartman
maintainerPATCH 14/117 fscrypt: use EEXIST when file already uses different policy
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 8488cd96ff88966ccb076e4f3654f59d84ba686d upstream.
As part of an effort to clean up fscrypt-related error codes, make FS_IOC_SET_ENCRYPTION_POLICY fail with EEXIST when the file already uses a different encryption policy. This is more descriptive than EINVAL, which was ambiguous with some of the other error cases.
I am not aware of any users who might be relying on the previous error code of EINVAL, which was never documented anywhere.
This failure case will be exercised by an xfstest.
--- fs/crypto/policy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/crypto/policy.c +1 -1
@@ -131,7 +131,7 @@ int fscrypt_ioctl_set_policy(struct fileprintk (KERN_WARNING "%s: Policy inconsistent with encryption context\n" , __func__); - ret = -EINVAL ; + ret = -EEXIST ; }inode_unlock (inode);
Greg Kroah-Hartman
maintainerPATCH 15/117 mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish()
In reply to Greg Kroah-HartmanFrom: Amit Cohen <[email protected]>
[ Upstream commit 0daf2bf5a2dcf33d446b76360908f109816e2e21 ]
Each EMAD transaction stores the skb used to issue the EMAD request ('trans->tx_skb') so that the request could be retried in case of a timeout. The skb can be freed when a corresponding response is received or as part of the retry logic (e.g., failed retransmit, exceeded maximum number of retries).
The two tasks (i.e., response processing and retransmits) are synchronized by the atomic 'trans->active' field which ensures that responses to inactive transactions are ignored.
In case of a failed retransmit the transaction is finished and all of its resources are freed. However, the current code does not mark it as inactive. Syzkaller was able to hit a race condition in which a concurrent response is processed while the transaction's resources are being freed, resulting in a use-after-free [1].
Fix the issue by making sure to mark the transaction as inactive after a failed retransmit and free its resources only if a concurrent task did not already do that.
[1]
BUG: KASAN: use-after-free in consume_skb+0x30/0x370
net/core/skbuff.c:833
Read of size 4 at addr ffff88804f570494 by task syz-executor.0/1004
CPU: 0 PID: 1004 Comm: syz-executor.0 Not tainted 5.8.0-rc7+ #68
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xf6/0x16e lib/dump_stack.c:118
print_address_description.constprop.0+0x1c/0x250
mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
check_memory_region_inline mm/kasan/generic.c:186 [inline]
check_memory_region+0x14e/0x1b0 mm/kasan/generic.c:192
instrument_atomic_read include/linux/instrumented.h:56 [inline]
atomic_read include/asm-generic/atomic-instrumented.h:27 [inline]
refcount_read include/linux/refcount.h:147 [inline]
skb_unref include/linux/skbuff.h:1044 [inline]
consume_skb+0x30/0x370 net/core/skbuff.c:833
mlxsw_emad_trans_finish+0x64/0x1c0 drivers/net/ethernet/mellanox/mlxsw/core.c:592
mlxsw_emad_process_response drivers/net/ethernet/mellanox/mlxsw/core.c:651 [inline]
mlxsw_emad_rx_listener_func+0x5c9/0xac0 drivers/net/ethernet/mellanox/mlxsw/core.c:672
mlxsw_core_skb_receive+0x4df/0x770 drivers/net/ethernet/mellanox/mlxsw/core.c:2063
mlxsw_pci_cqe_rdq_handle drivers/net/ethernet/mellanox/mlxsw/pci.c:595 [inline]
mlxsw_pci_cq_tasklet+0x12a6/0x2520 drivers/net/ethernet/mellanox/mlxsw/pci.c:651
tasklet_action_common.isra.0+0x13f/0x3e0 kernel/softirq.c:550
__do_softirq+0x223/0x964 kernel/softirq.c:292
asm_call_on_stack+0x12/0x20 arch/x86/entry/entry_64.S:711
Allocated by task 1006:
save_stack+0x1b/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc mm/kasan/common.c:494 [inline]
__kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:467
slab_post_alloc_hook mm/slab.h:586 [inline]
slab_alloc_node mm/slub.c:2824 [inline]
slab_alloc mm/slub.c:2832 [inline]
kmem_cache_alloc+0xcd/0x2e0 mm/slub.c:2837
__build_skb+0x21/0x60 net/core/skbuff.c:311
__netdev_alloc_skb+0x1e2/0x360 net/core/skbuff.c:464
netdev_alloc_skb include/linux/skbuff.h:2810 [inline]
mlxsw_emad_alloc drivers/net/ethernet/mellanox/mlxsw/core.c:756 [inline]
mlxsw_emad_reg_access drivers/net/ethernet/mellanox/mlxsw/core.c:787 [inline]
mlxsw_core_reg_access_emad+0x1ab/0x1420 drivers/net/ethernet/mellanox/mlxsw/core.c:1817
mlxsw_reg_trans_query+0x39/0x50 drivers/net/ethernet/mellanox/mlxsw/core.c:1831
mlxsw_sp_sb_pm_occ_clear drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c:260 [inline]
mlxsw_sp_sb_occ_max_clear+0xbff/0x10a0 drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c:1365
mlxsw_devlink_sb_occ_max_clear+0x76/0xb0 drivers/net/ethernet/mellanox/mlxsw/core.c:1037
devlink_nl_cmd_sb_occ_max_clear_doit+0x1ec/0x280 net/core/devlink.c:1765
genl_family_rcv_msg_doit net/netlink/genetlink.c:669 [inline]
genl_family_rcv_msg net/netlink/genetlink.c:714 [inline]
genl_rcv_msg+0x617/0x980 net/netlink/genetlink.c:731
netlink_rcv_skb+0x152/0x440 net/netlink/af_netlink.c:2470
genl_rcv+0x24/0x40 net/netlink/genetlink.c:742
netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
netlink_unicast+0x53a/0x750 net/netlink/af_netlink.c:1330
netlink_sendmsg+0x850/0xd90 net/netlink/af_netlink.c:1919
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0x150/0x190 net/socket.c:671
____sys_sendmsg+0x6d8/0x840 net/socket.c:2359
___sys_sendmsg+0xff/0x170 net/socket.c:2413
__sys_sendmsg+0xe5/0x1b0 net/socket.c:2446
do_syscall_64+0x56/0xa0 arch/x86/entry/common.c:384
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 73:
save_stack+0x1b/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
kasan_set_free_info mm/kasan/common.c:316 [inline]
__kasan_slab_free+0x12c/0x170 mm/kasan/common.c:455
slab_free_hook mm/slub.c:1474 [inline]
slab_free_freelist_hook mm/slub.c:1507 [inline]
slab_free mm/slub.c:3072 [inline]
kmem_cache_free+0xbe/0x380 mm/slub.c:3088
kfree_skbmem net/core/skbuff.c:622 [inline]
kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:616
__kfree_skb net/core/skbuff.c:679 [inline]
consume_skb net/core/skbuff.c:837 [inline]
consume_skb+0xe1/0x370 net/core/skbuff.c:831
mlxsw_emad_trans_finish+0x64/0x1c0 drivers/net/ethernet/mellanox/mlxsw/core.c:592
mlxsw_emad_transmit_retry.isra.0+0x9d/0xc0 drivers/net/ethernet/mellanox/mlxsw/core.c:613
mlxsw_emad_trans_timeout_work+0x43/0x50 drivers/net/ethernet/mellanox/mlxsw/core.c:625
process_one_work+0xa3e/0x17a0 kernel/workqueue.c:2269
worker_thread+0x9e/0x1050 kernel/workqueue.c:2415
kthread+0x355/0x470 kernel/kthread.c:291
ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:293
The buggy address belongs to the object at ffff88804f5703c0
which belongs to the cache skbuff_head_cache of size 224
The buggy address is located 212 bytes inside of
224-byte region [ffff88804f5703c0, ffff88804f5704a0)
The buggy address belongs to the page:
page:ffffea00013d5c00 refcount:1 mapcount:0 mapping:0000000000000000
index:0x0
flags: 0x100000000000200(slab)
raw: 0100000000000200 dead000000000100 dead000000000122 ffff88806c625400
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88804f570380: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
ffff88804f570400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804f570480: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88804f570500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88804f570580: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc--- drivers/net/ethernet/mellanox/mlxsw/core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/mellanox/mlxsw/core.c +3 -0
@@ -485,6 +485,9 @@ static void mlxsw_emad_transmit_retry(struct mlxsw_core *mlxsw_core, err =mlxsw_emad_transmit (trans->core, trans);if (err ==0 )return ; + +if (!atomic_dec_and_test (&trans->active)) +return ; }else { err = -EIO ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 16/117 powerpc/powernv/smp: Fix spurious DBG() warning
In reply to Greg Kroah-HartmanFrom: Oliver O'Halloran <[email protected]>
[ Upstream commit f6bac19cf65c5be21d14a0c9684c8f560f2096dd ]
When building with W=1 we get the following warning:
arch/powerpc/platforms/powernv/smp.c: In function ‘pnv_smp_cpu_kill_self’:
arch/powerpc/platforms/powernv/smp.c:276:16: error: suggest braces around
empty body in an ‘if’ statement [-Werror=empty-body]
276 | cpu, srr1);
| ^
cc1: all warnings being treated as errors
The full context is this block:
if (srr1 && !generic_check_cpu_restart(cpu))
DBG("CPU%d Unexpected exit while offline srr1=%lx!\n",
cpu, srr1);
When building with DEBUG undefined DBG() expands to nothing and GCC emits the warning due to the lack of braces around an empty statement.
--- arch/powerpc/platforms/powernv/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/platforms/powernv/smp.c +1 -1
@@ -41,7 +41,7 @@#include <asm/udbg.h> #define DBG(fmt...) udbg_printf(fmt)#else -#define DBG(fmt...) +#define DBG(fmt...) do { } while (0)#endif static void pnv_smp_setup_cpu (int cpu)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 17/117 sparc64: remove mm_cpumask clearing to fix kthread_use_mm race
In reply to Greg Kroah-HartmanFrom: Nicholas Piggin <[email protected]>
[ Upstream commit bafb056ce27940c9994ea905336aa8f27b4f7275 ]
The de facto (and apparently uncommented) standard for using an mm had, thanks to this code in sparc if nothing else, been that you must have a reference on mm_users *and that reference must have been obtained with mmget()*, i.e., from a thread with a reference to mm_users that had used the mm.
The introduction of mmget_not_zero() in commit d2005e3f41d4 ("userfaultfd: don't pin the user memory in userfaultfd_file_create()") allowed mm_count holders to aoperate on user mappings asynchronously from the actual threads using the mm, but they were not to load those mappings into their TLB (i.e., walking vmas and page tables is okay, kthread_use_mm() is not).
io_uring 2b188cc1bb857 ("Add io_uring IO interface") added code which does a kthread_use_mm() from a mmget_not_zero() refcount.
The problem with this is code which previously assumed mm == current->mm and mm->mm_users == 1 implies the mm will remain single-threaded at least until this thread creates another mm_users reference, has now broken.
arch/sparc/kernel/smp_64.c:
if (atomic_read(&mm->mm_users) == 1) {
cpumask_copy(mm_cpumask(mm), cpumask_of(cpu));
goto local_flush_and_out;
}vs fs/io_uring.c
if (unlikely(!(ctx->flags & IORING_SETUP_SQPOLL) ||
!mmget_not_zero(ctx->sqo_mm)))
return -EFAULT;
kthread_use_mm(ctx->sqo_mm);mmget_not_zero() could come in right after the mm_users == 1 test, then kthread_use_mm() which sets its CPU in the mm_cpumask. That update could be lost if cpumask_copy() occurs afterward.
I propose we fix this by allowing mmget_not_zero() to be a first-class reference, and not have this obscure undocumented and unchecked restriction.
The basic fix for sparc64 is to remove its mm_cpumask clearing code. The optimisation could be effectively restored by sending IPIs to mm_cpumask members and having them remove themselves from mm_cpumask. This is more tricky so I leave it as an exercise for someone with a sparc64 SMP. powerpc has a (currently similarly broken) example.
--- arch/sparc/kernel/smp_64.c | 65 ++++++++------------------------------ 1 file changed, 14 insertions(+), 51 deletions(-)
arch/sparc/kernel/smp_64.c +14 -51
@@ -1034,38 +1034,9 @@ void smp_fetch_global_pmu(void)* are flush_tlb_*() routines, and these run after flush_cache_*() * which performs the flushw. * -* The SMP TLB coherency scheme we use works as follows: -* -* 1) mm->cpu_vm_mask is a bit mask of which cpus an address -* space has (potentially) executed on, this is the heuristic -* we use to avoid doing cross calls. -* -* Also, for flushing from kswapd and also for clones, we -* use cpu_vm_mask as the list of cpus to make run the TLB. -* -* 2) TLB context numbers are shared globally across all processors -* in the system, this allows us to play several games to avoid -* cross calls. -* -* One invariant is that when a cpu switches to a process, and -* that processes tsk->active_mm->cpu_vm_mask does not have the -* current cpu's bit set, that tlb context is flushed locally. -* -* If the address space is non-shared (ie. mm->count == 1) we avoid -* cross calls when we want to flush the currently running process's -* tlb state. This is done by clearing all cpu bits except the current -* processor's in current->mm->cpu_vm_mask and performing the -* flush locally only. This will force any subsequent cpus which run -* this task to flush the context from the local tlb if the process -* migrates to another cpu (again). -* -* 3) For shared address spaces (threads) and swapping we bite the -* bullet for most cases and perform the cross call (but only to -* the cpus listed in cpu_vm_mask). -* -* The performance gain from "optimizing" away the cross call for threads is -* questionable (in theory the big win for threads is the massive sharing of -* address space state across processors). +* mm->cpu_vm_mask is a bit mask of which cpus an address +* space has (potentially) executed on, this is the heuristic +* we use to limit cross calls. */ /* This currently is only used by the hugetlb arch pre-fault
@@ -1075,18 +1046,13 @@ void smp_fetch_global_pmu(void)void smp_flush_tlb_mm (struct mm_struct *mm) {u32 ctx =CTX_HWBITS (mm->context); -int cpu =get_cpu (); -if (atomic_read (&mm->mm_users) ==1 ) { -cpumask_copy (mm_cpumask (mm),cpumask_of (cpu)); - goto local_flush_and_out; - } +get_cpu ();smp_cross_call_masked (&xcall_flush_tlb_mm, ctx,0 ,0 ,mm_cpumask (mm)); -local_flush_and_out:__flush_tlb_mm (ctx,SECONDARY_CONTEXT );put_cpu ();
@@ -1109,17 +1075,15 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned long {u32 ctx =CTX_HWBITS (mm->context);struct tlb_pending_info info; -int cpu =get_cpu (); + +get_cpu (); info.ctx = ctx; info.nr = nr; info.vaddrs = vaddrs; -if (mm == current->mm &&atomic_read (&mm->mm_users) ==1 ) -cpumask_copy (mm_cpumask (mm),cpumask_of (cpu)); -else -smp_call_function_many (mm_cpumask (mm), tlb_pending_func, - &info,1 ); +smp_call_function_many (mm_cpumask (mm), tlb_pending_func, + &info,1 );__flush_tlb_pending (ctx, nr, vaddrs);
@@ -1129,14 +1093,13 @@ void smp_flush_tlb_pending(struct mm_struct *mm, unsigned long nr, unsigned longvoid smp_flush_tlb_page (struct mm_struct *mm,unsigned long vaddr) {unsigned long context =CTX_HWBITS (mm->context); -int cpu =get_cpu (); -if (mm == current->mm &&atomic_read (&mm->mm_users) ==1 ) -cpumask_copy (mm_cpumask (mm),cpumask_of (cpu)); -else -smp_cross_call_masked (&xcall_flush_tlb_page, - context, vaddr,0 , -mm_cpumask (mm)); +get_cpu (); + +smp_cross_call_masked (&xcall_flush_tlb_page, + context, vaddr,0 , +mm_cpumask (mm)); +__flush_tlb_page (context, vaddr);put_cpu ();
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 18/117 f2fs: add trace exit in exception path
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 9b66482282888d02832b7d90239e1cdb18e4b431 ]
Missing the trace exit in f2fs_sync_dirty_inodes
--- fs/f2fs/checkpoint.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
fs/f2fs/checkpoint.c +5 -1
@@ -904,8 +904,12 @@ int sync_dirty_inodes(struct f2fs_sb_info *sbi, enum inode_type type)get_pages (sbi, is_dir ? F2FS_DIRTY_DENTS : F2FS_DIRTY_DATA)); retry: -if (unlikely (f2fs_cp_error (sbi))) +if (unlikely (f2fs_cp_error (sbi))) { +trace_f2fs_sync_dirty_inodes_exit (sbi->sb, is_dir, +get_pages (sbi, is_dir ? +F2FS_DIRTY_DENTS :F2FS_DIRTY_DATA ));return -EIO ; + }spin_lock (&sbi->inode_lock[type]);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 19/117 f2fs: fix to check segment boundary during SIT page readahead
In reply to Greg Kroah-HartmanFrom: Chao Yu <[email protected]>
[ Upstream commit 6a257471fa42c8c9c04a875cd3a2a22db148e0f0 ]
As syzbot reported:
kernel BUG at fs/f2fs/segment.h:657!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 16220 Comm: syz-executor.0 Not tainted 5.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:f2fs_ra_meta_pages+0xa51/0xdc0 fs/f2fs/segment.h:657 Call Trace: build_sit_entries fs/f2fs/segment.c:4195 [inline] f2fs_build_segment_manager+0x4b8a/0xa3c0 fs/f2fs/segment.c:4779 f2fs_fill_super+0x377d/0x6b80 fs/f2fs/super.c:3633 mount_bdev+0x32e/0x3f0 fs/super.c:1417 legacy_get_tree+0x105/0x220 fs/fs_context.c:592 vfs_get_tree+0x89/0x2f0 fs/super.c:1547 do_new_mount fs/namespace.c:2875 [inline] path_mount+0x1387/0x2070 fs/namespace.c:3192 do_mount fs/namespace.c:3205 [inline] __do_sys_mount fs/namespace.c:3413 [inline] __se_sys_mount fs/namespace.c:3390 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3390 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
@blkno in f2fs_ra_meta_pages could exceed max segment count, causing panic in following sanity check in current_sit_addr(), add check condition to avoid this issue.
--- fs/f2fs/checkpoint.c | 2 ++ 1 file changed, 2 insertions(+)
fs/f2fs/checkpoint.c +2 -0
@@ -201,6 +201,8 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages, blkno * NAT_ENTRY_PER_BLOCK);break ;case META_SIT : +if (unlikely (blkno >=TOTAL_SEGS (sbi))) + goto out;/* get sit block addr */ fio.new_blkaddr =current_sit_addr (sbi, blkno *SIT_ENTRY_PER_BLOCK );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 20/117 um: change sigio_spinlock to a mutex
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit f2d05059e15af3f70502074f4e3a504530af504a ]
Lockdep complains at boot:
=============================
[ BUG: Invalid wait context ]
5.7.0-05093-g46d91ecd597b #98 Not tainted
-----------------------------
swapper/1 is trying to lock:0000000060931b98 (&desc[i].request_mutex){+.+.}-{3:3}, at: __setup_irq+0x11d/0x623 other info that might help us debug this:
context-{4:4}
1 lock held by swapper/1:
#0: 000000006074fed8 (sigio_spinlock){+.+.}-{2:2}, at: sigio_lock+0x1a/0x1c
stack backtrace: CPU: 0 PID: 1 Comm: swapper Not tainted 5.7.0-05093-g46d91ecd597b #98 Stack: 7fa4fab0 6028dfd1 0000002a 6008bea5 7fa50700 7fa50040 7fa4fac0 6028e016 7fa4fb50 6007f6da 60959c18 00000000 Call Trace: [<60023a0e>] show_stack+0x13b/0x155 [<6028e016>] dump_stack+0x2a/0x2c [<6007f6da>] __lock_acquire+0x515/0x15f2 [<6007eb50>] lock_acquire+0x245/0x273 [<6050d9f1>] __mutex_lock+0xbd/0x325 [<6050dc76>] mutex_lock_nested+0x1d/0x1f [<6008e27e>] __setup_irq+0x11d/0x623 [<6008e8ed>] request_threaded_irq+0x169/0x1a6 [<60021eb0>] um_request_irq+0x1ee/0x24b [<600234ee>] write_sigio_irq+0x3b/0x76 [<600383ca>] sigio_broken+0x146/0x2e4 [<60020bd8>] do_one_initcall+0xde/0x281
Because we hold sigio_spinlock and then get into requesting an interrupt with a mutex.
Change the spinlock to a mutex to avoid that.
--- arch/um/kernel/sigio.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/um/kernel/sigio.c +3 -3
@@ -36,14 +36,14 @@ int write_sigio_irq(int fd) }/* These are called from os-Linux/sigio.c to protect its pollfds arrays. */ -static DEFINE_SPINLOCK (sigio_spinlock); +static DEFINE_MUTEX (sigio_mutex);void sigio_lock (void ) { -spin_lock (&sigio_spinlock); +mutex_lock (&sigio_mutex); }void sigio_unlock (void ) { -spin_unlock (&sigio_spinlock); +mutex_unlock (&sigio_mutex); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 21/117 ARM: 8997/2: hw_breakpoint: Handle inexact watchpoint addresses
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit 22c9e58299e5f18274788ce54c03d4fb761e3c5d ]
This is commit fdfeff0f9e3d ("arm64: hw_breakpoint: Handle inexact watchpoint addresses") but ported to arm32, which has the same problem.
This problem was found by Android CTS tests, notably the "watchpoint_imprecise" test [1]. I tested locally against a copycat (simplified) version of the test though.
[1] https://android.googlesource.com/platform/bionic/+/master/tests/sys_ptrace_test.cpp
--- arch/arm/kernel/hw_breakpoint.c | 100 +++++++++++++++++++++++--------- 1 file changed, 72 insertions(+), 28 deletions(-)
arch/arm/kernel/hw_breakpoint.c +72 -28
@@ -688,6 +688,40 @@ static void disable_single_step(struct perf_event *bp)arch_install_hw_breakpoint (bp); } +/* +* Arm32 hardware does not always report a watchpoint hit address that matches +* one of the watchpoints set. It can also report an address "near" the +* watchpoint if a single instruction access both watched and unwatched +* addresses. There is no straight-forward way, short of disassembling the +* offending instruction, to map that address back to the watchpoint. This +* function computes the distance of the memory access from the watchpoint as a +* heuristic for the likelyhood that a given access triggered the watchpoint. +* +* See this same function in the arm64 platform code, which has the same +* problem. +* +* The function returns the distance of the address from the bytes watched by +* the watchpoint. In case of an exact match, it returns 0. +*/ +static u32 get_distance_from_watchpoint (unsigned long addr,u32 val, +struct arch_hw_breakpoint_ctrl *ctrl) +{ +u32 wp_low, wp_high; +u32 lens, lene; + + lens =__ffs (ctrl->len); + lene =__fls (ctrl->len); + + wp_low = val + lens; + wp_high = val + lene; +if (addr < wp_low) +return wp_low - addr; +else if (addr > wp_high) +return addr - wp_high; +else +return 0 ; +} +static int watchpoint_fault_on_uaccess (struct pt_regs *regs,struct arch_hw_breakpoint *info) {
@@ -697,23 +731,25 @@ static int watchpoint_fault_on_uaccess(struct pt_regs *regs,static void watchpoint_handler (unsigned long addr,unsigned int fsr,struct pt_regs *regs) { -int i, access; -u32 val, ctrl_reg, alignment_mask; +int i, access, closest_match =0 ; +u32 min_dist =-1 , dist; +u32 val, ctrl_reg;struct perf_event *wp, **slots;struct arch_hw_breakpoint *info;struct arch_hw_breakpoint_ctrl ctrl; slots =this_cpu_ptr (wp_on_reg); +/* +* Find all watchpoints that match the reported address. If no exact +* match is found. Attribute the hit to the closest watchpoint. +*/ +rcu_read_lock ();for (i =0 ; i < core_num_wrps; ++i) { -rcu_read_lock (); - wp = slots[i]; -if (wp ==NULL ) - goto unlock; +continue ; - info =counter_arch_bp (wp);/* * The DFAR is an unknown value on debug architectures prior * to 7.1. Since we only allow a single watchpoint on these
@@ -722,33 +758,31 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,*/ if (debug_arch <ARM_DEBUG_ARCH_V7_1 ) {BUG_ON (i >0 ); + info =counter_arch_bp (wp); info->trigger = wp->attr.bp_addr; }else { -if (info->ctrl.len ==ARM_BREAKPOINT_LEN_8 ) - alignment_mask =0x7 ; -else - alignment_mask =0x3 ; - -/* Check if the watchpoint value matches. */ - val =read_wb_reg (ARM_BASE_WVR + i); -if (val != (addr & ~alignment_mask)) - goto unlock; - -/* Possible match, check the byte address select. */ - ctrl_reg =read_wb_reg (ARM_BASE_WCR + i); -decode_ctrl_reg (ctrl_reg, &ctrl); -if (!((1 << (addr & alignment_mask)) & ctrl.len)) - goto unlock; -/* Check that the access type matches. */ if (debug_exception_updates_fsr ()) { access = (fsr &ARM_FSR_ACCESS_MASK ) ?HW_BREAKPOINT_W :HW_BREAKPOINT_R ;if (!(access &hw_breakpoint_type (wp))) - goto unlock; +continue ; } + val =read_wb_reg (ARM_BASE_WVR + i); + ctrl_reg =read_wb_reg (ARM_BASE_WCR + i); +decode_ctrl_reg (ctrl_reg, &ctrl); + dist =get_distance_from_watchpoint (addr, val, &ctrl); +if (dist < min_dist) { + min_dist = dist; + closest_match = i; + } +/* Is this an exact match? */ +if (dist !=0 ) +continue ; +/* We have a winner. */ + info =counter_arch_bp (wp); info->trigger = addr; }
@@ -770,13 +804,23 @@ static void watchpoint_handler(unsigned long addr, unsigned int fsr,* we can single-step over the watchpoint trigger. */ if (!is_default_overflow_handler (wp)) - goto unlock; - +continue ; step:enable_single_step (wp,instruction_pointer (regs)); -unlock: -rcu_read_unlock (); } + +if (min_dist >0 && min_dist !=-1 ) { +/* No exact match found. */ + wp = slots[closest_match]; + info =counter_arch_bp (wp); + info->trigger = addr; +pr_debug ("watchpoint fired: address = 0x%x\n" , info->trigger); +perf_bp_event (wp, regs); +if (is_default_overflow_handler (wp)) +enable_single_step (wp,instruction_pointer (regs)); + } + +rcu_read_unlock (); }static void watchpoint_single_step_handler (unsigned long pc)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 22/117 xfs: fix realtime bitmap/summary file truncation when growing rt volume
In reply to Greg Kroah-HartmanFrom: Darrick J. Wong <[email protected]>
[ Upstream commit f4c32e87de7d66074d5612567c5eac7325024428 ]
The realtime bitmap and summary files are regular files that are hidden away from the directory tree. Since they're regular files, inode inactivation will try to purge what it thinks are speculative preallocations beyond the incore size of the file. Unfortunately, xfs_growfs_rt forgets to update the incore size when it resizes the inodes, with the result that inactivating the rt inodes at unmount time will cause their contents to be truncated.
Fix this by updating the incore size when we change the ondisk size as part of updating the superblock. Note that we don't do this when we're allocating blocks to the rt inodes because we actually want those blocks to get purged if the growfs fails.
This fixes corruption complaints from the online rtsummary checker when running xfs/233. Since that test requires rmap, one can also trigger this by growing an rt volume, cycling the mount, and creating rt files.
--- fs/xfs/xfs_rtalloc.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/xfs/xfs_rtalloc.c +8 -2
@@ -1014,10 +1014,13 @@ xfs_growfs_rt(xfs_ilock (mp->m_rbmip,XFS_ILOCK_EXCL );xfs_trans_ijoin (tp, mp->m_rbmip,XFS_ILOCK_EXCL );/* -* Update the bitmap inode's size. +* Update the bitmap inode's size ondisk and incore. We need +* to update the incore size so that inode inactivation won't +* punch what it thinks are "posteof" blocks. */ mp->m_rbmip->i_d.di_size = nsbp->sb_rbmblocks * nsbp->sb_blocksize; +i_size_write (VFS_I (mp->m_rbmip), mp->m_rbmip->i_d.di_size);xfs_trans_log_inode (tp, mp->m_rbmip,XFS_ILOG_CORE );/* * Get the summary inode into the transaction.
@@ -1025,9 +1028,12 @@ xfs_growfs_rt(xfs_ilock (mp->m_rsumip,XFS_ILOCK_EXCL );xfs_trans_ijoin (tp, mp->m_rsumip,XFS_ILOCK_EXCL );/* -* Update the summary inode's size. +* Update the summary inode's size. We need to update the +* incore size so that inode inactivation won't punch what it +* thinks are "posteof" blocks. */ mp->m_rsumip->i_d.di_size = nmp->m_rsumsize; +i_size_write (VFS_I (mp->m_rsumip), mp->m_rsumip->i_d.di_size);xfs_trans_log_inode (tp, mp->m_rsumip,XFS_ILOG_CORE );/* * Copy summary data from old to new sizes.
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 23/117 video: fbdev: pvr2fb: initialize variables
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 8e1ba47c60bcd325fdd097cd76054639155e5d2e ]
clang static analysis reports this repesentative error
pvr2fb.c:1049:2: warning: 1st function call argument
is an uninitialized value [core.CallAndMessage]
if (*cable_arg)
^~~~~~~~~~~~~~~Problem is that cable_arg depends on the input loop to set the cable_arg[0]. If it does not, then some random value from the stack is used.
A similar problem exists for output_arg.
So initialize cable_arg and output_arg.
--- drivers/video/fbdev/pvr2fb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/pvr2fb.c +2 -0
@@ -1029,6 +1029,8 @@ static int __init pvr2fb_setup(char *options)if (!options || !*options)return 0 ; + cable_arg[0 ] = output_arg[0 ] =0 ; +while ((this_opt =strsep (&options,"," ))) {if (!*this_opt)continue ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 24/117 ath10k: fix VHT NSS calculation when STBC is enabled
In reply to Greg Kroah-HartmanFrom: Sathishkumar Muruganandam <[email protected]>
[ Upstream commit 99f41b8e43b8b4b31262adb8ac3e69088fff1289 ]
When STBC is enabled, NSTS_SU value need to be accounted for VHT NSS calculation for SU case.
Without this fix, 1SS + STBC enabled case was reported wrongly as 2SS in radiotap header on monitor mode capture.
Tested-on: QCA9984 10.4-3.10-00047
--- drivers/net/wireless/ath/ath10k/htt_rx.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath10k/htt_rx.c +7 -1
@@ -620,6 +620,7 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,u8 preamble =0 ;u8 group_id;u32 info1, info2, info3; +u32 stbc, nsts_su; info1 =__le32_to_cpu (rxd->ppdu_start.info1); info2 =__le32_to_cpu (rxd->ppdu_start.info2);
@@ -663,11 +664,16 @@ static void ath10k_htt_rx_h_rates(struct ath10k *ar,TODO check this */ bw = info2 &3 ; sgi = info3 &1 ; + stbc = (info2 >>3 ) &1 ; group_id = (info2 >>4 ) &0x3F ;if (GROUP_ID_IS_SU_MIMO (group_id)) { mcs = (info3 >>4 ) &0x0F ; - nss = ((info2 >>10 ) &0x07 ) +1 ; + nsts_su = ((info2 >>10 ) &0x07 ); +if (stbc) + nss = (nsts_su >>2 ) +1 ; +else + nss = (nsts_su +1 ); }else {/* Hardware doesn't decode VHT-SIG-B into Rx descriptor * so it's impossible to decode MCS. Also since
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 25/117 media: tw5864: check status of tw5864_frameinterval_get
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
[ Upstream commit 780d815dcc9b34d93ae69385a8465c38d423ff0f ]
clang static analysis reports this problem
tw5864-video.c:773:32: warning: The left expression of the compound
assignment is an uninitialized value.
The computed value will also be garbage
fintv->stepwise.max.numerator *= std_max_fps;
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^stepwise.max is set with frameinterval, which comes from
ret = tw5864_frameinterval_get(input, &frameinterval); fintv->stepwise.step = frameinterval; fintv->stepwise.min = frameinterval; fintv->stepwise.max = frameinterval; fintv->stepwise.max.numerator *= std_max_fps;
When tw5864_frameinterval_get() fails, frameinterval is not set. So check the status and fix another similar problem.
--- drivers/media/pci/tw5864/tw5864-video.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/media/pci/tw5864/tw5864-video.c +6 -0
@@ -767,6 +767,9 @@ static int tw5864_enum_frameintervals(struct file *file, void *priv, fintv->type =V4L2_FRMIVAL_TYPE_STEPWISE ; ret =tw5864_frameinterval_get (input, &frameinterval); +if (ret) +return ret; + fintv->stepwise.step = frameinterval; fintv->stepwise.min = frameinterval; fintv->stepwise.max = frameinterval;
@@ -785,6 +788,9 @@ static int tw5864_g_parm(struct file *file, void *priv, cp->capability =V4L2_CAP_TIMEPERFRAME ; ret =tw5864_frameinterval_get (input, &cp->timeperframe); +if (ret) +return ret; + cp->timeperframe.numerator *= input->frame_interval; cp->capturemode =0 ; cp->readbuffers =2 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 26/117 mmc: via-sdmmc: Fix data race bug
In reply to Greg Kroah-HartmanFrom: Madhuparna Bhowmik <[email protected]>
[ Upstream commit 87d7ad089b318b4f319bf57f1daa64eb6d1d10ad ]
via_save_pcictrlreg() should be called with host->lock held as it writes to pm_pcictrl_reg, otherwise there can be a race condition between via_sd_suspend() and via_sdc_card_detect(). The same pattern is used in the function via_reset_pcictrl() as well, where via_save_pcictrlreg() is called with host->lock held.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/mmc/host/via-sdmmc.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/mmc/host/via-sdmmc.c +3 -0
@@ -1269,11 +1269,14 @@ static void via_init_sdc_pm(struct via_crdr_mmc_host *host)static int via_sd_suspend (struct pci_dev *pcidev,pm_message_t state) {struct via_crdr_mmc_host *host; +unsigned long flags; host =pci_get_drvdata (pcidev); +spin_lock_irqsave (&host->lock, flags);via_save_pcictrlreg (host);via_save_sdcreg (host); +spin_unlock_irqrestore (&host->lock, flags);pci_save_state (pcidev);pci_enable_wake (pcidev,pci_choose_state (pcidev, state),0 );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 27/117 printk: reduce LOG_BUF_SHIFT range for H8300
In reply to Greg Kroah-HartmanFrom: John Ogness <[email protected]>
[ Upstream commit 550c10d28d21bd82a8bb48debbb27e6ed53262f6 ]
The .bss section for the h8300 is relatively small. A value of CONFIG_LOG_BUF_SHIFT that is larger than 19 will create a static printk ringbuffer that is too large. Limit the range appropriately for the H8300.
--- init/Kconfig | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
init/Kconfig +2 -1
@@ -822,7 +822,8 @@ config IKCONFIG_PROC config LOG_BUF_SHIFT int "Kernel log buffer size (16 => 64KB, 17 => 128KB)" - range 12 25 + range 12 25 if !H8300 + range 12 19 if H8300 default 17 depends on PRINTK help
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 28/117 kgdb: Make "kgdbcon" work properly with "kgdb_earlycon"
In reply to Greg Kroah-HartmanFrom: Douglas Anderson <[email protected]>
[ Upstream commit b18b099e04f450cdc77bec72acefcde7042bd1f3 ]
On my system the kernel processes the "kgdb_earlycon" parameter before the "kgdbcon" parameter. When we setup "kgdb_earlycon" we'll end up in kgdb_register_callbacks() and "kgdb_use_con" won't have been set yet so we'll never get around to starting "kgdbcon". Let's remedy this by detecting that the IO module was already registered when setting "kgdb_use_con" and registering the console then.
As part of this, to avoid pre-declaring things, move the handling of the "kgdbcon" further down in the file.
--- kernel/debug/debug_core.c | 22 ++++++++++++++-------- 1 file changed, 14 insertions(+), 8 deletions(-)
kernel/debug/debug_core.c +14 -8
@@ -94,14 +94,6 @@ int dbg_switch_cpu;/* Use kdb or gdbserver mode */ int dbg_kdb_mode =1 ; -static int __init opt_kgdb_con (char *str) -{ - kgdb_use_con =1 ; -return 0 ; -} - -early_param ("kgdbcon" , opt_kgdb_con); -module_param (kgdb_use_con, int,0644 );module_param (kgdbreboot, int,0644 );
@@ -811,6 +803,20 @@ static struct console kgdbcons = { .index = -1, }; +static int __init opt_kgdb_con (char *str) +{ + kgdb_use_con =1 ; + +if (kgdb_io_module_registered && !kgdb_con_registered) { +register_console (&kgdbcons); + kgdb_con_registered =1 ; + } + +return 0 ; +} + +early_param ("kgdbcon" , opt_kgdb_con); +#ifdef CONFIG_MAGIC_SYSRQ static void sysrq_handle_dbg (int key) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 29/117 cpufreq: sti-cpufreq: add stih418 support
In reply to Greg Kroah-HartmanFrom: Alain Volmat <[email protected]>
[ Upstream commit 01a163c52039e9426c7d3d3ab16ca261ad622597 ]
The STiH418 can be controlled the same way as STiH407 & STiH410 regarding cpufreq.
--- drivers/cpufreq/sti-cpufreq.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/cpufreq/sti-cpufreq.c +4 -2
@@ -144,7 +144,8 @@ static const struct reg_field sti_stih407_dvfs_regfields[DVFS_MAX_REGFIELDS] = {static const struct reg_field *sti_cpufreq_match (void ) {if (of_machine_is_compatible ("st,stih407" ) || -of_machine_is_compatible ("st,stih410" )) +of_machine_is_compatible ("st,stih410" ) || +of_machine_is_compatible ("st,stih418" ))return sti_stih407_dvfs_regfields;return NULL ;
@@ -260,7 +261,8 @@ static int sti_cpufreq_init(void)int ret;if ((!of_machine_is_compatible ("st,stih407" )) && - (!of_machine_is_compatible ("st,stih410" ))) + (!of_machine_is_compatible ("st,stih410" )) && + (!of_machine_is_compatible ("st,stih418" )))return -ENODEV ; ddata.cpu =get_cpu_device (0 );
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 30/117 USB: adutux: fix debugging
In reply to Greg Kroah-HartmanFrom: Oliver Neukum <[email protected]>
[ Upstream commit c56150c1bc8da5524831b1dac2eec3c67b89f587 ]
Handling for removal of the controller was missing at one place. Add it.
--- drivers/usb/misc/adutux.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/misc/adutux.c +1 -0
@@ -210,6 +210,7 @@ static void adu_interrupt_out_callback(struct urb *urb)if (status !=0 ) {if ((status != -ENOENT ) && + (status != -ESHUTDOWN ) && (status != -ECONNRESET )) { dev_dbg(&dev->udev->dev, "%s :nonzero status received: %d\n", __func__,
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 31/117 arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE
In reply to Greg Kroah-HartmanFrom: Zhengyuan Liu <[email protected]>
[ Upstream commit a194c5f2d2b3a05428805146afcabe5140b5d378 ]
The @node passed to cpumask_of_node() can be NUMA_NO_NODE, in that case it will trigger the following WARN_ON(node >= nr_node_ids) due to mismatched data types of @node and @nr_node_ids. Actually we should return cpu_all_mask just like most other architectures do if passed NUMA_NO_NODE.
Also add a similar check to the inline cpumask_of_node() in numa.h.
--- arch/arm64/include/asm/numa.h | 3 +++ arch/arm64/mm/numa.c | 6 +++++- 2 files changed, 8 insertions(+), 1 deletion(-)
arch/arm64/include/asm/numa.h +3 -0
@@ -25,6 +25,9 @@ const struct cpumask *cpumask_of_node(int node);/* Returns a pointer to the cpumask of CPUs on Node 'node'. */ static inline const struct cpumask *cpumask_of_node (int node) { +if (node ==NUMA_NO_NODE ) +return cpu_all_mask; +return node_to_cpumask_map[node]; }#endif
arch/arm64/mm/numa.c +5 -1
@@ -58,7 +58,11 @@ EXPORT_SYMBOL(node_to_cpumask_map);*/ const struct cpumask *cpumask_of_node (int node) { -if (WARN_ON (node >= nr_node_ids)) + +if (node ==NUMA_NO_NODE ) +return cpu_all_mask; + +if (WARN_ON (node <0 || node >= nr_node_ids))return cpu_none_mask;if (WARN_ON (node_to_cpumask_map[node] ==NULL ))
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 32/117 drivers/net/wan/hdlc_fr: Correctly handle special skb->protocol values
In reply to Greg Kroah-HartmanFrom: Xie He <[email protected]>
[ Upstream commit 8306266c1d51aac9aa7aa907fe99032a58c6382c ]
The fr_hard_header function is used to prepend the header to skbs before transmission. It is used in 3 situations:
1) When a control packet is generated internally in this driver;
2) When a user sends an skb on an Ethernet-emulating PVC device;
3) When a user sends an skb on a normal PVC device.
These 3 situations need to be handled differently by fr_hard_header. Different headers should be prepended to the skb in different situations.
Currently fr_hard_header distinguishes these 3 situations using skb->protocol. For situation 1 and 2, a special skb->protocol value will be assigned before calling fr_hard_header, so that it can recognize these 2 situations. All skb->protocol values other than these special ones are treated by fr_hard_header as situation 3.
However, it is possible that in situation 3, the user sends an skb with one of the special skb->protocol values. In this case, fr_hard_header would incorrectly treat it as situation 1 or 2.
This patch tries to solve this issue by using skb->dev instead of skb->protocol to distinguish between these 3 situations. For situation 1, skb->dev would be NULL; for situation 2, skb->dev->type would be ARPHRD_ETHER; and for situation 3, skb->dev->type would be ARPHRD_DLCI.
This way fr_hard_header would be able to distinguish these 3 situations correctly regardless what skb->protocol value the user tries to use in situation 3.
--- drivers/net/wan/hdlc_fr.c | 98 ++++++++++++++++++++------------------- 1 file changed, 51 insertions(+), 47 deletions(-)
drivers/net/wan/hdlc_fr.c +51 -47
@@ -275,63 +275,69 @@ static inline struct net_device **get_dev_p(struct pvc_device *pvc,static int fr_hard_header (struct sk_buff **skb_p,u16 dlci) { -u16 head_len;struct sk_buff *skb = *skb_p; -switch (skb->protocol) { -case cpu_to_be16 (NLPID_CCITT_ANSI_LMI ): - head_len =4 ; -skb_push (skb, head_len); - skb->data[3 ] =NLPID_CCITT_ANSI_LMI ; -break ; - -case cpu_to_be16 (NLPID_CISCO_LMI ): - head_len =4 ; -skb_push (skb, head_len); - skb->data[3 ] =NLPID_CISCO_LMI ; -break ; - -case cpu_to_be16 (ETH_P_IP ): - head_len =4 ; -skb_push (skb, head_len); - skb->data[3 ] =NLPID_IP ; -break ; - -case cpu_to_be16 (ETH_P_IPV6 ): - head_len =4 ; -skb_push (skb, head_len); - skb->data[3 ] =NLPID_IPV6 ; -break ; - -case cpu_to_be16 (ETH_P_802_3 ): - head_len =10 ; -if (skb_headroom (skb) < head_len) { -struct sk_buff *skb2 =skb_realloc_headroom (skb, - head_len); +if (!skb->dev) {/* Control packets */ +switch (dlci) { +case LMI_CCITT_ANSI_DLCI : +skb_push (skb,4 ); + skb->data[3 ] =NLPID_CCITT_ANSI_LMI ; +break ; + +case LMI_CISCO_DLCI : +skb_push (skb,4 ); + skb->data[3 ] =NLPID_CISCO_LMI ; +break ; + +default : +return -EINVAL ; + } + + }else if (skb->dev->type ==ARPHRD_DLCI ) { +switch (skb->protocol) { +case htons (ETH_P_IP ): +skb_push (skb,4 ); + skb->data[3 ] =NLPID_IP ; +break ; + +case htons (ETH_P_IPV6 ): +skb_push (skb,4 ); + skb->data[3 ] =NLPID_IPV6 ; +break ; + +default : +skb_push (skb,10 ); + skb->data[3 ] =FR_PAD ; + skb->data[4 ] =NLPID_SNAP ; +/* OUI 00-00-00 indicates an Ethertype follows */ + skb->data[5 ] =0x00 ; + skb->data[6 ] =0x00 ; + skb->data[7 ] =0x00 ; +/* This should be an Ethertype: */ + *(__be16 *)(skb->data +8 ) = skb->protocol; + } + + }else if (skb->dev->type ==ARPHRD_ETHER ) { +if (skb_headroom (skb) <10 ) { +struct sk_buff *skb2 =skb_realloc_headroom (skb,10 );if (!skb2)return -ENOBUFS ;dev_kfree_skb (skb); skb = *skb_p = skb2; } -skb_push (skb, head_len); +skb_push (skb,10 ); skb->data[3 ] =FR_PAD ; skb->data[4 ] =NLPID_SNAP ; - skb->data[5 ] =FR_PAD ; +/* OUI 00-80-C2 stands for the 802.1 organization */ + skb->data[5 ] =0x00 ; skb->data[6 ] =0x80 ; skb->data[7 ] =0xC2 ; +/* PID 00-07 stands for Ethernet frames without FCS */ skb->data[8 ] =0x00 ; - skb->data[9 ] =0x07 ;/* bridged Ethernet frame w/out FCS */ -break ; + skb->data[9 ] =0x07 ; -default : - head_len =10 ; -skb_push (skb, head_len); - skb->data[3 ] =FR_PAD ; - skb->data[4 ] =NLPID_SNAP ; - skb->data[5 ] =FR_PAD ; - skb->data[6 ] =FR_PAD ; - skb->data[7 ] =FR_PAD ; - *(__be16 *)(skb->data +8 ) = skb->protocol; + }else { +return -EINVAL ; }dlci_to_q922 (skb->data, dlci);
@@ -427,8 +433,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)skb_put (skb, pad);memset (skb->data + len,0 , pad); } - skb->protocol =cpu_to_be16 (ETH_P_802_3 ); } + skb->dev = dev;if (!fr_hard_header (&skb, pvc->dlci)) { dev->stats.tx_bytes += skb->len; dev->stats.tx_packets++;
@@ -496,10 +502,8 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)memset (skb->data,0 , len);skb_reserve (skb,4 );if (lmi ==LMI_CISCO ) { - skb->protocol =cpu_to_be16 (NLPID_CISCO_LMI );fr_hard_header (&skb,LMI_CISCO_DLCI ); }else { - skb->protocol =cpu_to_be16 (NLPID_CCITT_ANSI_LMI );fr_hard_header (&skb,LMI_CCITT_ANSI_DLCI ); } data =skb_tail_pointer (skb);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 33/117 bus/fsl_mc: Do not rely on caller to provide non NULL mc_io
In reply to Greg Kroah-HartmanFrom: Diana Craciun <[email protected]>
[ Upstream commit 5026cf605143e764e1785bbf9158559d17f8d260 ]
Before destroying the mc_io, check first that it was allocated.
--- drivers/staging/fsl-mc/bus/mc-io.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/staging/fsl-mc/bus/mc-io.c +6 -1
@@ -167,7 +167,12 @@ error_destroy_mc_io:*/ void fsl_destroy_mc_io (struct fsl_mc_io *mc_io) { -struct fsl_mc_device *dpmcp_dev = mc_io->dpmcp_dev; +struct fsl_mc_device *dpmcp_dev; + +if (!mc_io) +return ; + + dpmcp_dev = mc_io->dpmcp_dev;if (dpmcp_dev)fsl_mc_io_unset_dpmcp (mc_io);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 34/117 power: supply: test_power: add missing newlines when printing parameters by sysfs
In reply to Greg Kroah-HartmanFrom: Xiongfeng Wang <[email protected]>
[ Upstream commit c07fa6c1631333f02750cf59f22b615d768b4d8f ]
When I cat some module parameters by sysfs, it displays as follows. It's better to add a newline for easy reading.
root@syzkaller:~# cd /sys/module/test_power/parameters/ root@syzkaller:/sys/module/test_power/parameters# cat ac_online onroot@syzkaller:/sys/module/test_power/parameters# cat battery_present trueroot@syzkaller:/sys/module/test_power/parameters# cat battery_health goodroot@syzkaller:/sys/module/test_power/parameters# cat battery_status dischargingroot@syzkaller:/sys/module/test_power/parameters# cat battery_technology LIONroot@syzkaller:/sys/module/test_power/parameters# cat usb_online onroot@syzkaller:/sys/module/test_power/parameters#
--- drivers/power/supply/test_power.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/power/supply/test_power.c +6 -0
@@ -344,6 +344,7 @@ static int param_set_ac_online(const char *key, const struct kernel_param *kp)static int param_get_ac_online (char *buffer,const struct kernel_param *kp) {strcpy (buffer,map_get_key (map_ac_online, ac_online,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
@@ -357,6 +358,7 @@ static int param_set_usb_online(const char *key, const struct kernel_param *kp)static int param_get_usb_online (char *buffer,const struct kernel_param *kp) {strcpy (buffer,map_get_key (map_ac_online, usb_online,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
@@ -371,6 +373,7 @@ static int param_set_battery_status(const char *key,static int param_get_battery_status (char *buffer,const struct kernel_param *kp) {strcpy (buffer,map_get_key (map_status, battery_status,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
@@ -385,6 +388,7 @@ static int param_set_battery_health(const char *key,static int param_get_battery_health (char *buffer,const struct kernel_param *kp) {strcpy (buffer,map_get_key (map_health, battery_health,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
@@ -400,6 +404,7 @@ static int param_get_battery_present(char *buffer, const struct kernel_param *kp) {strcpy (buffer,map_get_key (map_present, battery_present,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
@@ -417,6 +422,7 @@ static int param_get_battery_technology(char *buffer, {strcpy (buffer,map_get_key (map_technology, battery_technology,"unknown" )); +strcat (buffer,"\n" );return strlen (buffer); }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 35/117 md/bitmap: md_bitmap_get_counter returns wrong blocks
In reply to Greg Kroah-HartmanFrom: Zhao Heming <[email protected]>
[ Upstream commit d837f7277f56e70d82b3a4a037d744854e62f387 ]
md_bitmap_get_counter() has code:
```
if (bitmap->bp[page].hijacked ||
bitmap->bp[page].map == NULL)
csize = ((sector_t)1) << (bitmap->chunkshift +
PAGE_COUNTER_SHIFT - 1);
```The minus 1 is wrong, this branch should report 2048 bits of space. With "-1" action, this only report 1024 bit of space.
This bug code returns wrong blocks, but it doesn't inflence bitmap logic:
1. Most callers focus this function return value (the counter of offset), not the parameter blocks.
2. The bug is only triggered when hijacked is true or map is NULL. the hijacked true condition is very rare.
the "map == null" only true when array is creating or resizing.
3. Even the caller gets wrong blocks, current code makes caller just to call md_bitmap_get_counter() one more time.
--- drivers/md/bitmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/bitmap.c +1 -1
@@ -1339,7 +1339,7 @@ __acquires(bitmap->lock)if (bitmap->bp[page].hijacked || bitmap->bp[page].map ==NULL ) csize = ((sector_t )1 ) << (bitmap->chunkshift + -PAGE_COUNTER_SHIFT -1 ); +PAGE_COUNTER_SHIFT );else csize = ((sector_t )1 ) << bitmap->chunkshift; *blocks = csize - (offset & (csize -1 ));
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 36/117 clk: ti: clockdomain: fix static checker warning
In reply to Greg Kroah-HartmanFrom: Tero Kristo <[email protected]>
[ Upstream commit b7a7943fe291b983b104bcbd2f16e8e896f56590 ]
Fix a memory leak induced by not calling clk_put after doing of_clk_get.
--- drivers/clk/ti/clockdomain.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/clk/ti/clockdomain.c +2 -0
@@ -124,10 +124,12 @@ static void __init of_ti_clockdomain_setup(struct device_node *node)if (clk_hw_get_flags (clk_hw) &CLK_IS_BASIC ) {pr_warn ("can't setup clkdm for basic clk %s\n" ,__clk_get_name (clk)); +clk_put (clk);continue ; }to_clk_hw_omap (clk_hw)->clkdm_name = clkdm_name;omap2_init_clk_clkdm (clk_hw); +clk_put (clk); } }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 37/117 net: 9p: initialize sun_server.sun_path to have addrs value only when addr is valid
In reply to Greg Kroah-HartmanFrom: Anant Thazhemadam <[email protected]>
[ Upstream commit 7ca1db21ef8e0e6725b4d25deed1ca196f7efb28 ]
In p9_fd_create_unix, checking is performed to see if the addr (passed as an argument) is NULL or not.
However, no check is performed to see if addr is a valid address, i.e., it doesn't entirely consist of only 0's.
The initialization of sun_server.sun_path to be equal to this faulty addr value leads to an uninitialized variable, as detected by KMSAN. Checking for this (faulty addr) and returning a negative error number appropriately, resolves this issue.
--- net/9p/trans_fd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/9p/trans_fd.c +1 -1
@@ -1013,7 +1013,7 @@ p9_fd_create_unix(struct p9_client *client, const char *addr, char *args) csocket =NULL ; -if (addr ==NULL ) +if (!addr || !strlen (addr))return -EINVAL ;if (strlen (addr) >=UNIX_PATH_MAX ) {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 38/117 drivers: watchdog: rdc321x_wdt: Fix race condition bugs
In reply to Greg Kroah-HartmanFrom: Madhuparna Bhowmik <[email protected]>
[ Upstream commit 4b2e7f99cdd314263c9d172bc17193b8b6bba463 ]
In rdc321x_wdt_probe(), rdc321x_wdt_device.queue is initialized after misc_register(), hence if ioctl is called before its initialization which can call rdc321x_wdt_start() function, it will see an uninitialized value of rdc321x_wdt_device.queue, hence initialize it before misc_register().
Also, rdc321x_wdt_device.default_ticks is accessed in reset() function called from write callback, thus initialize it before misc_register().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/watchdog/rdc321x_wdt.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/watchdog/rdc321x_wdt.c +2 -3
@@ -244,6 +244,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) rdc321x_wdt_device.sb_pdev = pdata->sb_pdev; rdc321x_wdt_device.base_reg = r->start; + rdc321x_wdt_device.queue =0 ; + rdc321x_wdt_device.default_ticks = ticks; err =misc_register (&rdc321x_wdt_misc);if (err <0 ) {
@@ -258,14 +260,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) rdc321x_wdt_device.base_reg, RDC_WDT_RST);init_completion (&rdc321x_wdt_device.stop); - rdc321x_wdt_device.queue =0 ;clear_bit (0 , &rdc321x_wdt_device.inuse);setup_timer (&rdc321x_wdt_device.timer, rdc321x_wdt_trigger,0 ); - rdc321x_wdt_device.default_ticks = ticks; -dev_info (&pdev->dev,"watchdog init success\n" );return 0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 39/117 ext4: Detect already used quota file early
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit e0770e91424f694b461141cbc99adf6b23006b60 ]
When we try to use file already used as a quota file again (for the same or different quota type), strange things can happen. At the very least lockdep annotations may be wrong but also inode flags may be wrongly set / reset. When the file is used for two quota types at once we can even corrupt the file and likely crash the kernel. Catch all these cases by checking whether passed file is already used as quota file and bail early in that case.
This fixes occasional generic/219 failure due to lockdep complaint.
--- fs/ext4/super.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/ext4/super.c +5 -0
@@ -5412,6 +5412,11 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,/* Quotafile not on the same filesystem? */ if (path->dentry->d_sb != sb)return -EXDEV ; + +/* Quota already enabled for this file? */ +if (IS_NOQUOTA (d_inode (path->dentry))) +return -EBUSY ; +/* Journaling quota? */ if (EXT4_SB (sb)->s_qf_names[type]) {/* Quotafile not in fs root? */
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 40/117 gfs2: add validation checks for size of superblock
In reply to Greg Kroah-HartmanFrom: Anant Thazhemadam <[email protected]>
[ Upstream commit 0ddc5154b24c96f20e94d653b0a814438de6032b ]
In gfs2_check_sb(), no validation checks are performed with regards to the size of the superblock.
syzkaller detected a slab-out-of-bounds bug that was primarily caused because the block size for a superblock was set to zero.
A valid size for a superblock is a power of 2 between 512 and PAGE_SIZE. Performing validation checks and ensuring that the size of the superblock is valid fixes this bug.
--- fs/gfs2/ops_fstype.c | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-)
fs/gfs2/ops_fstype.c +11 -7
@@ -160,15 +160,19 @@ static int gfs2_check_sb(struct gfs2_sbd *sdp, int silent)return -EINVAL ; } -/* If format numbers match exactly, we're done. */ - -if (sb->sb_fs_format ==GFS2_FORMAT_FS && - sb->sb_multihost_format ==GFS2_FORMAT_MULTI ) -return 0 ; +if (sb->sb_fs_format !=GFS2_FORMAT_FS || + sb->sb_multihost_format !=GFS2_FORMAT_MULTI ) { +fs_warn (sdp,"Unknown on-disk format, unable to mount\n" ); +return -EINVAL ; + } -fs_warn (sdp,"Unknown on-disk format, unable to mount\n" ); +if (sb->sb_bsize <512 || sb->sb_bsize >PAGE_SIZE || + (sb->sb_bsize & (sb->sb_bsize -1 ))) { +pr_warn ("Invalid superblock size\n" ); +return -EINVAL ; + } -return -EINVAL ; +return 0 ; }static void end_bio_io_page (struct bio *bio)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 41/117 memory: emif: Remove bogus debugfs error handling
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit fd22781648080cc400772b3c68aa6b059d2d5420 ]
Callers are generally not supposed to check the return values from debugfs functions. Debugfs functions never return NULL so this error handling will never trigger. (Historically debugfs functions used to return a mix of NULL and error pointers but it was eventually deemed too complicated for something which wasn't intended to be used in normal situations).
Delete all the error handling.
--- drivers/memory/emif.c | 33 +++++---------------------------- 1 file changed, 5 insertions(+), 28 deletions(-)
drivers/memory/emif.c +5 -28
@@ -165,35 +165,12 @@ static const struct file_operations emif_mr4_fops = { static int __init_or_module emif_debugfs_init(struct emif_data *emif) { -struct dentry *dentry; -int ret; - - dentry =debugfs_create_dir (dev_name (emif->dev),NULL ); -if (!dentry) { - ret = -ENOMEM ; - goto err0; - } - emif->debugfs_root = dentry; - - dentry =debugfs_create_file ("regcache_dump" ,S_IRUGO , - emif->debugfs_root, emif, &emif_regdump_fops); -if (!dentry) { - ret = -ENOMEM ; - goto err1; - } - - dentry =debugfs_create_file ("mr4" ,S_IRUGO , - emif->debugfs_root, emif, &emif_mr4_fops); -if (!dentry) { - ret = -ENOMEM ; - goto err1; - } - + emif->debugfs_root =debugfs_create_dir (dev_name (emif->dev),NULL ); +debugfs_create_file ("regcache_dump" ,S_IRUGO , emif->debugfs_root, emif, + &emif_regdump_fops); +debugfs_create_file ("mr4" ,S_IRUGO , emif->debugfs_root, emif, + &emif_mr4_fops);return 0 ; -err1: -debugfs_remove_recursive (emif->debugfs_root); -err0: -return ret; } static void __exit emif_debugfs_exit(struct emif_data *emif)
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 42/117 ARM: dts: s5pv210: remove DMA controller bus node name to fix dtschema warnings
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit ea4e792f3c8931fffec4d700cf6197d84e9f35a6 ]
There is no need to keep DMA controller nodes under AMBA bus node. Remove the "amba" node to fix dtschema warnings like:
amba: $nodename:0: 'amba' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
--- arch/arm/boot/dts/s5pv210.dtsi | 49 +++++++++++++++------------------- 1 file changed, 21 insertions(+), 28 deletions(-)
arch/arm/boot/dts/s5pv210.dtsi +21 -28
@@ -129,35 +129,28 @@ }; }; - amba { - #address-cells = <1>; - #size-cells = <1>; - compatible = "simple-bus"; - ranges; - - pdma0: dma@e0900000 { - compatible = "arm,pl330", "arm,primecell"; - reg = <0xe0900000 0x1000>; - interrupt-parent = <&vic0>; - interrupts = <19>; - clocks = <&clocks CLK_PDMA0>; - clock-names = "apb_pclk"; - #dma-cells = <1>; - #dma-channels = <8>; - #dma-requests = <32>; - }; + pdma0: dma@e0900000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0xe0900000 0x1000>; + interrupt-parent = <&vic0>; + interrupts = <19>; + clocks = <&clocks CLK_PDMA0>; + clock-names = "apb_pclk"; + #dma-cells = <1>; + #dma-channels = <8>; + #dma-requests = <32>; + }; - pdma1: dma@e0a00000 { - compatible = "arm,pl330", "arm,primecell"; - reg = <0xe0a00000 0x1000>; - interrupt-parent = <&vic0>; - interrupts = <20>; - clocks = <&clocks CLK_PDMA1>; - clock-names = "apb_pclk"; - #dma-cells = <1>; - #dma-channels = <8>; - #dma-requests = <32>; - }; + pdma1: dma@e0a00000 { + compatible = "arm,pl330", "arm,primecell"; + reg = <0xe0a00000 0x1000>; + interrupt-parent = <&vic0>; + interrupts = <20>; + clocks = <&clocks CLK_PDMA1>; + clock-names = "apb_pclk"; + #dma-cells = <1>; + #dma-channels = <8>; + #dma-requests = <32>; }; spi0: spi@e1300000 {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 43/117 ARM: dts: s5pv210: move PMU node out of clock controller
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit bb98fff84ad1ea321823759edaba573a16fa02bd ]
The Power Management Unit (PMU) is a separate device which has little common with clock controller. Moving it to one level up (from clock controller child to SoC) allows to remove fake simple-bus compatible and dtbs_check warnings like:
clock-controller@e0100000: $nodename:0:
'clock-controller@e0100000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
--- arch/arm/boot/dts/s5pv210.dtsi | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-)
arch/arm/boot/dts/s5pv210.dtsi +5 -8
@@ -101,19 +101,16 @@ }; clocks: clock-controller@e0100000 { - compatible = "samsung,s5pv210-clock", "simple-bus"; + compatible = "samsung,s5pv210-clock"; reg = <0xe0100000 0x10000>; clock-names = "xxti", "xusbxti"; clocks = <&xxti>, <&xusbxti>; #clock-cells = <1>; - #address-cells = <1>; - #size-cells = <1>; - ranges; + }; - pmu_syscon: syscon@e0108000 { - compatible = "samsung-s5pv210-pmu", "syscon"; - reg = <0xe0108000 0x8000>; - }; + pmu_syscon: syscon@e0108000 { + compatible = "samsung-s5pv210-pmu", "syscon"; + reg = <0xe0108000 0x8000>; }; pinctrl0: pinctrl@e0200000 {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 44/117 ARM: dts: s5pv210: remove dedicated audio-subsystem node
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 6c17a2974abf68a58517f75741b15c4aba42b4b8 ]
The 'audio-subsystem' node is an artificial creation, not representing real hardware. The hardware is described by its nodes - AUDSS clock controller and I2S0.
Remove the 'audio-subsystem' node along with its undocumented compatible to fix dtbs_check warnings like:
audio-subsystem: $nodename:0: 'audio-subsystem' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$'
--- arch/arm/boot/dts/s5pv210.dtsi | 65 +++++++++++++++------------------- 1 file changed, 29 insertions(+), 36 deletions(-)
arch/arm/boot/dts/s5pv210.dtsi +29 -36
@@ -220,43 +220,36 @@ status = "disabled"; }; - audio-subsystem { - compatible = "samsung,s5pv210-audss", "simple-bus"; - #address-cells = <1>; - #size-cells = <1>; - ranges; - - clk_audss: clock-controller@eee10000 { - compatible = "samsung,s5pv210-audss-clock"; - reg = <0xeee10000 0x1000>; - clock-names = "hclk", "xxti", - "fout_epll", - "sclk_audio0"; - clocks = <&clocks DOUT_HCLKP>, <&xxti>, - <&clocks FOUT_EPLL>, - <&clocks SCLK_AUDIO0>; - #clock-cells = <1>; - }; + clk_audss: clock-controller@eee10000 { + compatible = "samsung,s5pv210-audss-clock"; + reg = <0xeee10000 0x1000>; + clock-names = "hclk", "xxti", + "fout_epll", + "sclk_audio0"; + clocks = <&clocks DOUT_HCLKP>, <&xxti>, + <&clocks FOUT_EPLL>, + <&clocks SCLK_AUDIO0>; + #clock-cells = <1>; + }; - i2s0: i2s@eee30000 { - compatible = "samsung,s5pv210-i2s"; - reg = <0xeee30000 0x1000>; - interrupt-parent = <&vic2>; - interrupts = <16>; - dma-names = "rx", "tx", "tx-sec"; - dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; - clock-names = "iis", - "i2s_opclk0", - "i2s_opclk1"; - clocks = <&clk_audss CLK_I2S>, - <&clk_audss CLK_I2S>, - <&clk_audss CLK_DOUT_AUD_BUS>; - samsung,idma-addr = <0xc0010000>; - pinctrl-names = "default"; - pinctrl-0 = <&i2s0_bus>; - #sound-dai-cells = <0>; - status = "disabled"; - }; + i2s0: i2s@eee30000 { + compatible = "samsung,s5pv210-i2s"; + reg = <0xeee30000 0x1000>; + interrupt-parent = <&vic2>; + interrupts = <16>; + dma-names = "rx", "tx", "tx-sec"; + dmas = <&pdma1 9>, <&pdma1 10>, <&pdma1 11>; + clock-names = "iis", + "i2s_opclk0", + "i2s_opclk1"; + clocks = <&clk_audss CLK_I2S>, + <&clk_audss CLK_I2S>, + <&clk_audss CLK_DOUT_AUD_BUS>; + samsung,idma-addr = <0xc0010000>; + pinctrl-names = "default"; + pinctrl-0 = <&i2s0_bus>; + #sound-dai-cells = <0>; + status = "disabled"; }; i2s1: i2s@e2100000 {
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 45/117 md/raid5: fix oops during stripe resizing
In reply to Greg Kroah-HartmanFrom: Song Liu <[email protected]>
commit b44c018cdf748b96b676ba09fdbc5b34fc443ada upstream.
KoWei reported crash during raid5 reshape:
[ 1032.252932] Oops: 0002 [#1] SMP PTI [...] [ 1032.252943] RIP: 0010:memcpy_erms+0x6/0x10 [...] [ 1032.252947] RSP: 0018:ffffba1ac0c03b78 EFLAGS: 00010286 [ 1032.252949] RAX: 0000784ac0000000 RBX: ffff91bec3d09740 RCX: 0000000000001000 [ 1032.252951] RDX: 0000000000001000 RSI: ffff91be6781c000 RDI: 0000784ac0000000 [ 1032.252953] RBP: ffffba1ac0c03bd8 R08: 0000000000001000 R09: ffffba1ac0c03bf8 [ 1032.252954] R10: 0000000000000000 R11: 0000000000000000 R12: ffffba1ac0c03bf8 [ 1032.252955] R13: 0000000000001000 R14: 0000000000000000 R15: 0000000000000000 [ 1032.252958] FS: 0000000000000000(0000) GS:ffff91becf500000(0000) knlGS:0000000000000000 [ 1032.252959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1032.252961] CR2: 0000784ac0000000 CR3: 000000031780a002 CR4: 00000000001606e0 [ 1032.252962] Call Trace: [ 1032.252969] ? async_memcpy+0x179/0x1000 [async_memcpy] [ 1032.252977] ? raid5_release_stripe+0x8e/0x110 [raid456] [ 1032.252982] handle_stripe_expansion+0x15a/0x1f0 [raid456] [ 1032.252988] handle_stripe+0x592/0x1270 [raid456] [ 1032.252993] handle_active_stripes.isra.0+0x3cb/0x5a0 [raid456] [ 1032.252999] raid5d+0x35c/0x550 [raid456] [ 1032.253002] ? schedule+0x42/0xb0 [ 1032.253006] ? schedule_timeout+0x10e/0x160 [ 1032.253011] md_thread+0x97/0x160 [ 1032.253015] ? wait_woken+0x80/0x80 [ 1032.253019] kthread+0x104/0x140 [ 1032.253022] ? md_start_sync+0x60/0x60 [ 1032.253024] ? kthread_park+0x90/0x90 [ 1032.253027] ret_from_fork+0x35/0x40
This is because cache_size_mutex was unlocked too early in resize_stripes, which races with grow_one_stripe() that grow_one_stripe() allocates a stripe with wrong pool_size.
Fix this issue by unlocking cache_size_mutex after updating pool_size.
--- drivers/md/raid5.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/raid5.c +2 -2
@@ -2259,8 +2259,6 @@ static int resize_stripes(struct r5conf }else err = -ENOMEM ; -mutex_unlock (&conf->cache_size_mutex); - conf->slab_cache = sc; conf->active_name =1 -conf->active_name;
@@ -2283,6 +2281,8 @@ static int resize_stripes(struct r5confif (!err) conf->pool_size = newsize; +mutex_unlock (&conf->cache_size_mutex); +return err; }
Greg Kroah-Hartman
maintainerPATCH 46/117 perf/x86/amd/ibs: Dont include randomized bits in get_ibs_op_count()
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
commit 680d69635005ba0e58fe3f4c52fc162b8fc743b0 upstream.
get_ibs_op_count() adds hardware's current count (IbsOpCurCnt) bits to its count regardless of hardware's valid status.
According to the PPR for AMD Family 17h Model 31h B0 55803 Rev 0.54, if the counter rolls over, valid status is set, and the lower 7 bits of IbsOpCurCnt are randomized by hardware.
Don't include those bits in the driver's event count.
--- arch/x86/events/amd/ibs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
arch/x86/events/amd/ibs.c +8 -4
@@ -346,11 +346,15 @@ static u64 get_ibs_op_count(u64 config) {u64 count =0 ; +/* +* If the internal 27-bit counter rolled over, the count is MaxCnt +* and the lower 7 bits of CurCnt are randomized. +* Otherwise CurCnt has the full 27-bit current counter value. +*/ if (config &IBS_OP_VAL ) - count += (config &IBS_OP_MAX_CNT ) <<4 ;/* cnt rolled over */ - -if (ibs_caps &IBS_CAPS_RDWROPCNT ) - count += (config &IBS_OP_CUR_CNT ) >>32 ; + count = (config &IBS_OP_MAX_CNT ) <<4 ; +else if (ibs_caps &IBS_CAPS_RDWROPCNT ) + count = (config &IBS_OP_CUR_CNT ) >>32 ;return count; }
Greg Kroah-Hartman
maintainerPATCH 47/117 perf/x86/amd/ibs: Fix raw sample data accumulation
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
commit 36e1be8ada994d509538b3b1d0af8b63c351e729 upstream.
Neither IbsBrTarget nor OPDATA4 are populated in IBS Fetch mode. Don't accumulate them into raw sample user data in that case.
Also, in Fetch mode, add saving the IBS Fetch Control Extended MSR.
Technically, there is an ABI change here with respect to the IBS raw sample data format, but I don't see any perf driver version information being included in perf.data file headers, but, existing users can detect whether the size of the sample record has reduced by 8 bytes to determine whether the IBS driver has this fix.
--- arch/x86/events/amd/ibs.c | 26 ++++++++++++++++---------- arch/x86/include/asm/msr-index.h | 1 + 2 files changed, 17 insertions(+), 10 deletions(-)
arch/x86/events/amd/ibs.c +16 -10
@@ -646,18 +646,24 @@ fail: perf_ibs->offset_max, offset + 1); }while (offset < offset_max); +/* +* Read IbsBrTarget, IbsOpData4, and IbsExtdCtl separately +* depending on their availability. +* Can't add to offset_max as they are staggered +*/ if (event->attr.sample_type &PERF_SAMPLE_RAW ) { -/* -* Read IbsBrTarget and IbsOpData4 separately -* depending on their availability. -* Can't add to offset_max as they are staggered -*/ -if (ibs_caps &IBS_CAPS_BRNTRGT ) { -rdmsrl (MSR_AMD64_IBSBRTARGET , *buf++); - size++; +if (perf_ibs == &perf_ibs_op) { +if (ibs_caps &IBS_CAPS_BRNTRGT ) { +rdmsrl (MSR_AMD64_IBSBRTARGET , *buf++); + size++; + } +if (ibs_caps &IBS_CAPS_OPDATA4 ) { +rdmsrl (MSR_AMD64_IBSOPDATA4 , *buf++); + size++; + } } -if (ibs_caps &IBS_CAPS_OPDATA4 ) { -rdmsrl (MSR_AMD64_IBSOPDATA4 , *buf++); +if (perf_ibs == &perf_ibs_fetch && (ibs_caps &IBS_CAPS_FETCHCTLEXTD )) { +rdmsrl (MSR_AMD64_ICIBSEXTDCTL , *buf++); size++; } }
arch/x86/include/asm/msr-index.h +1 -0
@@ -356,6 +356,7 @@#define MSR_AMD64_IBSOP_REG_MASK ((1UL<<MSR_AMD64_IBSOP_REG_COUNT)-1)#define MSR_AMD64_IBSCTL 0xc001103a#define MSR_AMD64_IBSBRTARGET 0xc001103b +#define MSR_AMD64_ICIBSEXTDCTL 0xc001103c#define MSR_AMD64_IBSOPDATA4 0xc001103d#define MSR_AMD64_IBS_REG_COUNT_MAX 8/* includes MSR_AMD64_IBSBRTARGET */
Greg Kroah-Hartman
maintainerPATCH 48/117 leds: bcm6328, bcm6358: use devres LED registering function
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit ff5c89d44453e7ad99502b04bf798a3fc32c758b upstream.
These two drivers do not provide remove method and use devres for allocation of other resources, yet they use led_classdev_register instead of the devres variant, devm_led_classdev_register.
Fix this.
--- drivers/leds/leds-bcm6328.c | 2 +- drivers/leds/leds-bcm6358.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/leds/leds-bcm6328.c +1 -1
@@ -336,7 +336,7 @@ static int bcm6328_led(struct device *de led->cdev.brightness_set = bcm6328_led_set; led->cdev.blink_set = bcm6328_blink_set; - rc =led_classdev_register (dev, &led->cdev); + rc =devm_led_classdev_register (dev, &led->cdev);if (rc <0 )return rc;
drivers/leds/leds-bcm6358.c +1 -1
@@ -141,7 +141,7 @@ static int bcm6358_led(struct device *de led->cdev.brightness_set = bcm6358_led_set; - rc =led_classdev_register (dev, &led->cdev); + rc =devm_led_classdev_register (dev, &led->cdev);if (rc <0 )return rc;
Greg Kroah-Hartman
maintainerPATCH 49/117 fs: Dont invalidate page buffers in block_write_full_page()
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
commit 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b upstream.
If block_write_full_page() is called for a page that is beyond current inode size, it will truncate page buffers for the page and return 0. This logic has been added in 2.5.62 in commit 81eb69062588 ("fix ext3 BUG due to race with truncate") in history.git tree to fix a problem with ext3 in data=ordered mode. This particular problem doesn't exist anymore because ext3 is long gone and ext4 handles ordered data differently. Also normally buffers are invalidated by truncate code and there's no need to specially handle this in ->writepage() code.
This invalidation of page buffers in block_write_full_page() is causing issues to filesystems (e.g. ext4 or ocfs2) when block device is shrunk under filesystem's hands and metadata buffers get discarded while being tracked by the journalling layer. Although it is obviously "not supported" it can cause kernel crashes like:
[ 7986.689400] BUG: unable to handle kernel NULL pointer dereference at +0000000000000008 [ 7986.697197] PGD 0 P4D 0 [ 7986.699724] Oops: 0002 [#1] SMP PTI [ 7986.703200] CPU: 4 PID: 203778 Comm: jbd2/dm-3-8 Kdump: loaded Tainted: G +O --------- - - 4.18.0-147.5.0.5.h126.eulerosv2r9.x86_64 #1 [ 7986.716438] Hardware name: Huawei RH2288H V3/BC11HGSA0, BIOS 1.57 08/11/2015 [ 7986.723462] RIP: 0010:jbd2_journal_grab_journal_head+0x1b/0x40 [jbd2] ... [ 7986.810150] Call Trace: [ 7986.812595] __jbd2_journal_insert_checkpoint+0x23/0x70 [jbd2] [ 7986.818408] jbd2_journal_commit_transaction+0x155f/0x1b60 [jbd2] [ 7986.836467] kjournald2+0xbd/0x270 [jbd2]
which is not great. The crash happens because bh->b_private is suddently NULL although BH_JBD flag is still set (this is because block_invalidatepage() cleared BH_Mapped flag and subsequent bh lookup found buffer without BH_Mapped set, called init_page_buffers() which has rewritten bh->b_private). So just remove the invalidation in block_write_full_page().
Note that the buffer cache invalidation when block device changes size is already careful to avoid similar problems by using invalidate_mapping_pages() which skips busy buffers so it was only this odd block_write_full_page() behavior that could tear down bdev buffers under filesystem's hands.
--- fs/buffer.c | 16 ---------------- 1 file changed, 16 deletions(-)
fs/buffer.c +0 -16
@@ -2753,16 +2753,6 @@ int nobh_writepage(struct page *page, ge/* Is the page fully outside i_size? (truncate in progress) */ offset = i_size & (PAGE_SIZE -1 );if (page->index >= end_index+1 || !offset) { -/* -* The page may have dirty, unmapped buffers. For example, -* they may have been added in ext3_writepage(). Make them -* freeable here, so the page does not leak. -*/ -#if 0 -/* Not really sure about this - do we need this ? */ -if (page->mapping->a_ops->invalidatepage) - page->mapping->a_ops->invalidatepage (page, offset); -#endif unlock_page (page);return 0 ;/* don't care */ }
@@ -2957,12 +2947,6 @@ int block_write_full_page(struct page *p/* Is the page fully outside i_size? (truncate in progress) */ offset = i_size & (PAGE_SIZE -1 );if (page->index >= end_index+1 || !offset) { -/* -* The page may have dirty, unmapped buffers. For example, -* they may have been added in ext3_writepage(). Make them -* freeable here, so the page does not leak. -*/ -do_invalidatepage (page,0 ,PAGE_SIZE );unlock_page (page);return 0 ;/* don't care */ }
Greg Kroah-Hartman
maintainerPATCH 50/117 NFS: fix nfs_path in case of a rename retry
In reply to Greg Kroah-HartmanFrom: Ashish Sangwan <[email protected]>
commit 247db73560bc3e5aef6db50c443c3c0db115bc93 upstream.
We are generating incorrect path in case of rename retry because we are restarting from wrong dentry. We should restart from the dentry which was received in the call to nfs_path.
--- fs/nfs/namespace.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/nfs/namespace.c +8 -4
@@ -30,9 +30,9 @@ int nfs_mountpoint_expiry_timeout = 500/* * nfs_path - reconstruct the path given an arbitrary dentry * @base - used to return pointer to the end of devname part of path -* @dentry - pointer to dentry +* @dentry_in - pointer to dentry * @buffer - result buffer -* @buflen - length of buffer +* @buflen_in - length of buffer * @flags - options (see below) * * Helper function for constructing the server pathname
@@ -47,15 +47,19 @@ int nfs_mountpoint_expiry_timeout = 500* the original device (export) name * (if unset, the original name is returned verbatim) */ -char *nfs_path (char **p,struct dentry *dentry,char *buffer,ssize_t buflen, -unsigned flags) +char *nfs_path (char **p,struct dentry *dentry_in,char *buffer, +ssize_t buflen_in,unsigned flags) {char *end;int namelen;unsigned seq;const char *base; +struct dentry *dentry; +ssize_t buflen; rename_retry: + buflen = buflen_in; + dentry = dentry_in; end = buffer+buflen; *--end ='\0' ; buflen--;
Greg Kroah-Hartman
maintainerPATCH 51/117 ACPI / extlog: Check for RDMSR failure
In reply to Greg Kroah-HartmanFrom: Ben Hutchings <[email protected]>
commit 7cecb47f55e00282f972a1e0b09136c8cd938221 upstream.
extlog_init() uses rdmsrl() to read an MSR, which on older CPUs provokes a error message at boot:
unchecked MSR access error: RDMSR from 0x179 at rIP: 0xcd047307 (native_read_msr+0x7/0x40)
Use rdmsrl_safe() instead, and return -ENODEV if it fails.
--- drivers/acpi/acpi_extlog.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/acpi/acpi_extlog.c +3 -3
@@ -223,9 +223,9 @@ static int __init extlog_init(void)u64 cap;int rc; -rdmsrl (MSR_IA32_MCG_CAP , cap); - -if (!(cap &MCG_ELOG_P ) || !extlog_get_l1addr ()) +if (rdmsrl_safe (MSR_IA32_MCG_CAP , &cap) || + !(cap &MCG_ELOG_P ) || + !extlog_get_l1addr ())return -ENODEV ;if (get_edac_report_status () ==EDAC_REPORTING_FORCE ) {
Greg Kroah-Hartman
maintainerPATCH 52/117 ACPI: video: use ACPI backlight for HP 635 Notebook
In reply to Greg Kroah-HartmanFrom: Alex Hung <[email protected]>
commit b226faab4e7890bbbccdf794e8b94276414f9058 upstream.
The default backlight interface is AMD's radeon_bl0 which does not work on this system, so use the ACPI backlight interface on it instead.
--- drivers/acpi/video_detect.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/video_detect.c +9 -0
@@ -268,6 +268,15 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_PRODUCT_NAME, "530U4E/540U4E"), }, }, +/* https://bugs.launchpad.net/bugs/1894667 */ + { + .callback = video_detect_force_video, + .ident = "HP 635 Notebook", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"Hewlett-Packard" ), + DMI_MATCH(DMI_PRODUCT_NAME, "HP 635 Notebook PC"), + }, + }, /* Non win8 machines which need native backlight nevertheless */ {
Greg Kroah-Hartman
maintainerPATCH 53/117 ACPI: debug: dont allow debugging when ACPI is disabled
In reply to Greg Kroah-HartmanFrom: Jamie Iles <[email protected]>
commit 0fada277147ffc6d694aa32162f51198d4f10d94 upstream.
If ACPI is disabled then loading the acpi_dbg module will result in the following splat when lock debugging is enabled.
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 0 PID: 1 at kernel/locking/mutex.c:938 __mutex_lock+0xa10/0x1290 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.9.0-rc8+ #103 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x4d8 show_stack+0x34/0x48 dump_stack+0x174/0x1f8 panic+0x360/0x7a0 __warn+0x244/0x2ec report_bug+0x240/0x398 bug_handler+0x50/0xc0 call_break_hook+0x160/0x1d8 brk_handler+0x30/0xc0 do_debug_exception+0x184/0x340 el1_dbg+0x48/0xb0 el1_sync_handler+0x170/0x1c8 el1_sync+0x80/0x100 __mutex_lock+0xa10/0x1290 mutex_lock_nested+0x6c/0xc0 acpi_register_debugger+0x40/0x88 acpi_aml_init+0xc4/0x114 do_one_initcall+0x24c/0xb10 kernel_init_freeable+0x690/0x728 kernel_init+0x20/0x1e8 ret_from_fork+0x10/0x18
This is because acpi_debugger.lock has not been initialized as acpi_debugger_init() is not called when ACPI is disabled. Fail module loading to avoid this and any subsequent problems that might arise by trying to debug AML when ACPI is disabled.
--- drivers/acpi/acpi_dbg.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_dbg.c +3 -0
@@ -757,6 +757,9 @@ int __init acpi_aml_init(void) goto err_exit; } +if (acpi_disabled) +return -ENODEV ; +/* Initialize AML IO interface */ mutex_init (&acpi_aml_io.lock);init_waitqueue_head (&acpi_aml_io.wait);
Greg Kroah-Hartman
maintainerPATCH 54/117 acpi-cpufreq: Honor _PSD table setting on new AMD CPUs
In reply to Greg Kroah-HartmanFrom: Wei Huang <[email protected]>
commit 5368512abe08a28525d9b24abbfc2a72493e8dba upstream.
acpi-cpufreq has a old quirk that overrides the _PSD table supplied by BIOS on AMD CPUs. However the _PSD table of new AMD CPUs (Family 19h+) now accurately reports the P-state dependency of CPU cores. Hence this quirk needs to be fixed in order to support new CPUs' frequency control.
--- drivers/cpufreq/acpi-cpufreq.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/cpufreq/acpi-cpufreq.c +2 -1
@@ -720,7 +720,8 @@ static int acpi_cpufreq_cpu_init(structcpumask_copy (policy->cpus,topology_core_cpumask (cpu)); } -if (check_amd_hwpstate_cpu (cpu) && !acpi_pstate_strict) { +if (check_amd_hwpstate_cpu (cpu) && boot_cpu_data.x86 <0x19 && + !acpi_pstate_strict) {cpumask_clear (policy->cpus);cpumask_set_cpu (cpu, policy->cpus); cpumask_copy(data->freqdomain_cpus,
Greg Kroah-Hartman
maintainerPATCH 55/117 w1: mxc_w1: Fix timeout resolution problem leading to bus error
In reply to Greg Kroah-HartmanFrom: Martin Fuzzey <[email protected]>
commit c9723750a699c3bd465493ac2be8992b72ccb105 upstream.
On my platform (i.MX53) bus access sometimes fails with
w1_search: max_slave_count 64 reached, will continue next search.
The reason is the use of jiffies to implement a 200us timeout in mxc_w1_ds2_touch_bit().
On some platforms the jiffies timer resolution is insufficient for this.
Fix by replacing jiffies by ktime_get().
For consistency apply the same change to the other use of jiffies in mxc_w1_ds2_reset_bus().
--- drivers/w1/masters/mxc_w1.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/w1/masters/mxc_w1.c +7 -7
@@ -15,7 +15,7 @@#include <linux/clk.h> #include <linux/delay.h> #include <linux/io.h> -#include <linux/jiffies.h> +#include <linux/ktime.h> #include <linux/module.h> #include <linux/platform_device.h>
@@ -48,12 +48,12 @@ struct mxc_w1_device {static u8 mxc_w1_ds2_reset_bus (void *data) {struct mxc_w1_device *dev = data; -unsigned long timeout; +ktime_t timeout;writeb (MXC_W1_CONTROL_RPP , dev->regs +MXC_W1_CONTROL );/* Wait for reset sequence 511+512us, use 1500us for sure */ - timeout = jiffies +usecs_to_jiffies (1500 ); + timeout =ktime_add_us (ktime_get (),1500 );udelay (511 +512 );
@@ -63,7 +63,7 @@ static u8 mxc_w1_ds2_reset_bus(void *dat/* PST bit is valid after the RPP bit is self-cleared */ if (!(ctrl &MXC_W1_CONTROL_RPP ))return !(ctrl &MXC_W1_CONTROL_PST ); - }while (time_is_after_jiffies (timeout)); + }while (ktime_before (ktime_get (), timeout));return 1 ; }
@@ -76,12 +76,12 @@ static u8 mxc_w1_ds2_reset_bus(void *datstatic u8 mxc_w1_ds2_touch_bit (void *data,u8 bit) {struct mxc_w1_device *dev = data; -unsigned long timeout; +ktime_t timeout;writeb (MXC_W1_CONTROL_WR (bit), dev->regs +MXC_W1_CONTROL );/* Wait for read/write bit (60us, Max 120us), use 200us for sure */ - timeout = jiffies +usecs_to_jiffies (200 ); + timeout =ktime_add_us (ktime_get (),200 );udelay (60 );
@@ -91,7 +91,7 @@ static u8 mxc_w1_ds2_touch_bit(void *dat/* RDST bit is valid after the WR1/RD bit is self-cleared */ if (!(ctrl &MXC_W1_CONTROL_WR (bit)))return !!(ctrl &MXC_W1_CONTROL_RDST ); - }while (time_is_after_jiffies (timeout)); + }while (ktime_before (ktime_get (), timeout));return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 56/117 scsi: mptfusion: Fix null pointer dereferences in mptscsih_remove()
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 2f4843b172c2c0360ee7792ad98025fae7baefde upstream.
The mptscsih_remove() function triggers a kernel oops if the Scsi_Host pointer (ioc->sh) is NULL, as can be seen in this syslog:
ioc0: LSI53C1030 B2: Capabilities={Initiator,Target}
Begin: Waiting for root file system ...
scsi host2: error handler thread failed to spawn, error = -4
mptspi: ioc0: WARNING - Unable to register controller with SCSI subsystem
Backtrace: [<000000001045b7cc>] mptspi_probe+0x248/0x3d0 [mptspi] [<0000000040946470>] pci_device_probe+0x1ac/0x2d8 [<0000000040add668>] really_probe+0x1bc/0x988 [<0000000040ade704>] driver_probe_device+0x160/0x218 [<0000000040adee24>] device_driver_attach+0x160/0x188 [<0000000040adef90>] __driver_attach+0x144/0x320 [<0000000040ad7c78>] bus_for_each_dev+0xd4/0x158 [<0000000040adc138>] driver_attach+0x4c/0x80 [<0000000040adb3ec>] bus_add_driver+0x3e0/0x498 [<0000000040ae0130>] driver_register+0xf4/0x298 [<00000000409450c4>] __pci_register_driver+0x78/0xa8 [<000000000007d248>] mptspi_init+0x18c/0x1c4 [mptspi]
This patch adds the necessary NULL-pointer checks. Successfully tested on a HP C8000 parisc workstation with buggy SCSI drives.
--- drivers/message/fusion/mptscsih.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
drivers/message/fusion/mptscsih.c +8 -5
@@ -1176,8 +1176,10 @@ mptscsih_remove(struct pci_dev *pdev)scsi_remove_host (host); -if ((hd =shost_priv (host)) ==NULL ) -return ; +if (host ==NULL ) + hd =NULL ; +else + hd =shost_priv (host);mptscsih_shutdown (pdev);
@@ -1193,14 +1195,15 @@ mptscsih_remove(struct pci_dev *pdev)"Free'd ScsiLookup (%d) memory\n" , ioc->name, sz1)); -kfree (hd->info_kbuf); +if (hd) +kfree (hd->info_kbuf);/* NULL the Scsi_Host pointer */ ioc->sh =NULL ; -scsi_host_put (host); - +if (host) +scsi_host_put (host);mpt_detach (pdev); }
Greg Kroah-Hartman
maintainerPATCH 57/117 btrfs: reschedule if necessary when logging directory items
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit bb56f02f26fe23798edb1b2175707419b28c752a upstream.
Logging directories with many entries can take a significant amount of time, and in some cases monopolize a cpu/core for a long time if the logging task doesn't happen to block often enough.
Johannes and Lu Fengqi reported test case generic/041 triggering a soft lockup when the kernel has CONFIG_SOFTLOCKUP_DETECTOR=y. For this test case we log an inode with 3002 hard links, and because the test removed one hard link before fsyncing the file, the inode logging causes the parent directory do be logged as well, which has 6004 directory items to log (3002 BTRFS_DIR_ITEM_KEY items plus 3002 BTRFS_DIR_INDEX_KEY items), so it can take a significant amount of time and trigger the soft lockup.
So just make tree-log.c:log_dir_items() reschedule when necessary, releasing the current search path before doing so and then resume from where it was before the reschedule.
The stack trace produced when the soft lockup happens is the following:
[10480.277653] watchdog: BUG: soft lockup - CPU#2 stuck for 22s! [xfs_io:28172] [10480.279418] Modules linked in: dm_thin_pool dm_persistent_data (...) [10480.284915] irq event stamp: 29646366 [10480.285987] hardirqs last enabled at (29646365): [<ffffffff85249b66>] __slab_alloc.constprop.0+0x56/0x60 [10480.288482] hardirqs last disabled at (29646366): [<ffffffff8579b00d>] irqentry_enter+0x1d/0x50 [10480.290856] softirqs last enabled at (4612): [<ffffffff85a00323>] __do_softirq+0x323/0x56c [10480.293615] softirqs last disabled at (4483): [<ffffffff85800dbf>] asm_call_on_stack+0xf/0x20 [10480.296428] CPU: 2 PID: 28172 Comm: xfs_io Not tainted 5.9.0-rc4-default+ #1248 [10480.298948] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 [10480.302455] RIP: 0010:__slab_alloc.constprop.0+0x19/0x60 [10480.304151] Code: 86 e8 31 75 21 00 66 66 2e 0f 1f 84 00 00 00 (...) [10480.309558] RSP: 0018:ffffadbe09397a58 EFLAGS: 00000282 [10480.311179] RAX: ffff8a495ab92840 RBX: 0000000000000282 RCX: 0000000000000006 [10480.313242] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff85249b66 [10480.315260] RBP: ffff8a497d04b740 R08: 0000000000000001 R09: 0000000000000001 [10480.317229] R10: ffff8a497d044800 R11: ffff8a495ab93c40 R12: 0000000000000000 [10480.319169] R13: 0000000000000000 R14: 0000000000000c40 R15: ffffffffc01daf70 [10480.321104] FS: 00007fa1dc5c0e40(0000) GS:ffff8a497da00000(0000) knlGS:0000000000000000 [10480.323559] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [10480.325235] CR2: 00007fa1dc5befb8 CR3: 0000000004f8a006 CR4: 0000000000170ea0 [10480.327259] Call Trace: [10480.328286] ? overwrite_item+0x1f0/0x5a0 [btrfs] [10480.329784] __kmalloc+0x831/0xa20 [10480.331009] ? btrfs_get_32+0xb0/0x1d0 [btrfs] [10480.332464] overwrite_item+0x1f0/0x5a0 [btrfs] [10480.333948] log_dir_items+0x2ee/0x570 [btrfs] [10480.335413] log_directory_changes+0x82/0xd0 [btrfs] [10480.336926] btrfs_log_inode+0xc9b/0xda0 [btrfs] [10480.338374] ? init_once+0x20/0x20 [btrfs] [10480.339711] btrfs_log_inode_parent+0x8d3/0xd10 [btrfs] [10480.341257] ? dget_parent+0x97/0x2e0 [10480.342480] btrfs_log_dentry_safe+0x3a/0x50 [btrfs] [10480.343977] btrfs_sync_file+0x24b/0x5e0 [btrfs] [10480.345381] do_fsync+0x38/0x70 [10480.346483] __x64_sys_fsync+0x10/0x20 [10480.347703] do_syscall_64+0x2d/0x70 [10480.348891] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [10480.350444] RIP: 0033:0x7fa1dc80970b [10480.351642] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 (...) [10480.356952] RSP: 002b:00007fffb3d081d0 EFLAGS: 00000293 ORIG_RAX: 000000000000004a [10480.359458] RAX: ffffffffffffffda RBX: 0000562d93d45e40 RCX: 00007fa1dc80970b [10480.361426] RDX: 0000562d93d44ab0 RSI: 0000562d93d45e60 RDI: 0000000000000003 [10480.363367] RBP: 0000000000000001 R08: 0000000000000000 R09: 00007fa1dc7b2a40 [10480.365317] R10: 0000562d93d0e366 R11: 0000000000000293 R12: 0000000000000001 [10480.367299] R13: 0000562d93d45290 R14: 0000562d93d45e40 R15: 0000562d93d45e60
--- fs/btrfs/tree-log.c | 8 ++++++++ 1 file changed, 8 insertions(+)
fs/btrfs/tree-log.c +8 -0
@@ -3357,6 +3357,7 @@ static noinline int log_dir_items(struct* search and this search we'll not find the key again and can just * bail. */ +search: ret =btrfs_search_slot (NULL , root, &min_key, path,0 ,0 );if (ret !=0 ) goto done;
@@ -3376,6 +3377,13 @@ static noinline int log_dir_items(structif (min_key.objectid != ino || min_key.type != key_type) goto done; + +if (need_resched ()) { +btrfs_release_path (path); +cond_resched (); + goto search; + } + ret =overwrite_item (trans, log, dst_path, src, i, &min_key);if (ret) {
Greg Kroah-Hartman
maintainerPATCH 58/117 btrfs: cleanup cow block on error
In reply to Greg Kroah-HartmanFrom: Josef Bacik <[email protected]>
commit 572c83acdcdafeb04e70aa46be1fa539310be20c upstream.
In fstest btrfs/064 a transaction abort in __btrfs_cow_block could lead to a system lockup. It gets stuck trying to write back inodes, and the write back thread was trying to lock an extent buffer:
$ cat /proc/2143497/stack [<0>] __btrfs_tree_lock+0x108/0x250 [<0>] lock_extent_buffer_for_io+0x35e/0x3a0 [<0>] btree_write_cache_pages+0x15a/0x3b0 [<0>] do_writepages+0x28/0xb0 [<0>] __writeback_single_inode+0x54/0x5c0 [<0>] writeback_sb_inodes+0x1e8/0x510 [<0>] wb_writeback+0xcc/0x440 [<0>] wb_workfn+0xd7/0x650 [<0>] process_one_work+0x236/0x560 [<0>] worker_thread+0x55/0x3c0 [<0>] kthread+0x13a/0x150 [<0>] ret_from_fork+0x1f/0x30
This is because we got an error while COWing a block, specifically here
if (test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) {
ret = btrfs_reloc_cow_block(trans, root, buf, cow);
if (ret) {
btrfs_abort_transaction(trans, ret);
return ret;
}
}[16402.241552] BTRFS: Transaction aborted (error -2) [16402.242362] WARNING: CPU: 1 PID: 2563188 at fs/btrfs/ctree.c:1074 __btrfs_cow_block+0x376/0x540 [16402.249469] CPU: 1 PID: 2563188 Comm: fsstress Not tainted 5.9.0-rc6+ #8 [16402.249936] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 [16402.250525] RIP: 0010:__btrfs_cow_block+0x376/0x540 [16402.252417] RSP: 0018:ffff9cca40e578b0 EFLAGS: 00010282 [16402.252787] RAX: 0000000000000025 RBX: 0000000000000002 RCX: ffff9132bbd19388 [16402.253278] RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff9132bbd19380 [16402.254063] RBP: ffff9132b41a49c0 R08: 0000000000000000 R09: 0000000000000000 [16402.254887] R10: 0000000000000000 R11: ffff91324758b080 R12: ffff91326ef17ce0 [16402.255694] R13: ffff91325fc0f000 R14: ffff91326ef176b0 R15: ffff9132815e2000 [16402.256321] FS: 00007f542c6d7b80(0000) GS:ffff9132bbd00000(0000) knlGS:0000000000000000 [16402.256973] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [16402.257374] CR2: 00007f127b83f250 CR3: 0000000133480002 CR4: 0000000000370ee0 [16402.257867] Call Trace: [16402.258072] btrfs_cow_block+0x109/0x230 [16402.258356] btrfs_search_slot+0x530/0x9d0 [16402.258655] btrfs_lookup_file_extent+0x37/0x40 [16402.259155] __btrfs_drop_extents+0x13c/0xd60 [16402.259628] ? btrfs_block_rsv_migrate+0x4f/0xb0 [16402.259949] btrfs_replace_file_extents+0x190/0x820 [16402.260873] btrfs_clone+0x9ae/0xc00 [16402.261139] btrfs_extent_same_range+0x66/0x90 [16402.261771] btrfs_remap_file_range+0x353/0x3b1 [16402.262333] vfs_dedupe_file_range_one.part.0+0xd5/0x140 [16402.262821] vfs_dedupe_file_range+0x189/0x220 [16402.263150] do_vfs_ioctl+0x552/0x700 [16402.263662] __x64_sys_ioctl+0x62/0xb0 [16402.264023] do_syscall_64+0x33/0x40 [16402.264364] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [16402.264862] RIP: 0033:0x7f542c7d15cb [16402.266901] RSP: 002b:00007ffd35944ea8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [16402.267627] RAX: ffffffffffffffda RBX: 00000000009d1968 RCX: 00007f542c7d15cb [16402.268298] RDX: 00000000009d2490 RSI: 00000000c0189436 RDI: 0000000000000003 [16402.268958] RBP: 00000000009d2520 R08: 0000000000000036 R09: 00000000009d2e64 [16402.269726] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [16402.270659] R13: 000000000001f000 R14: 00000000009d1970 R15: 00000000009d2e80 [16402.271498] irq event stamp: 0 [16402.271846] hardirqs last enabled at (0): [<0000000000000000>] 0x0 [16402.272497] hardirqs last disabled at (0): [<ffffffff910dbf59>] copy_process+0x6b9/0x1ba0 [16402.273343] softirqs last enabled at (0): [<ffffffff910dbf59>] copy_process+0x6b9/0x1ba0 [16402.273905] softirqs last disabled at (0): [<0000000000000000>] 0x0 [16402.274338] ---[ end trace 737874a5a41a8236 ]--- [16402.274669] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry [16402.276179] BTRFS info (device dm-9): forced readonly [16402.277046] BTRFS: error (device dm-9) in btrfs_replace_file_extents:2723: errno=-2 No such entry [16402.278744] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry [16402.279968] BTRFS: error (device dm-9) in __btrfs_cow_block:1074: errno=-2 No such entry [16402.280582] BTRFS info (device dm-9): balance: ended with status: -30
The problem here is that as soon as we allocate the new block it is locked and marked dirty in the btree inode. This means that we could attempt to writeback this block and need to lock the extent buffer. However we're not unlocking it here and thus we deadlock.
Fix this by unlocking the cow block if we have any errors inside of __btrfs_cow_block, and also free it so we do not leak it.
--- fs/btrfs/ctree.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/btrfs/ctree.c +6 -0
@@ -1122,6 +1122,8 @@ static noinline int __btrfs_cow_block(st ret =update_ref_for_cow (trans, root, buf, cow, &last_ref);if (ret) { +btrfs_tree_unlock (cow); +free_extent_buffer (cow);btrfs_abort_transaction (trans, ret);return ret; }
@@ -1129,6 +1131,8 @@ static noinline int __btrfs_cow_block(stif (test_bit (BTRFS_ROOT_REF_COWS , &root->state)) { ret =btrfs_reloc_cow_block (trans, root, buf, cow);if (ret) { +btrfs_tree_unlock (cow); +free_extent_buffer (cow);btrfs_abort_transaction (trans, ret);return ret; }
@@ -1160,6 +1164,8 @@ static noinline int __btrfs_cow_block(stif (last_ref) { ret =tree_mod_log_free_eb (root->fs_info, buf);if (ret) { +btrfs_tree_unlock (cow); +free_extent_buffer (cow);btrfs_abort_transaction (trans, ret);return ret; }
Greg Kroah-Hartman
maintainerPATCH 59/117 btrfs: fix use-after-free on readahead extent after failure to create it
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 83bc1560e02e25c6439341352024ebe8488f4fbd upstream.
If we fail to find suitable zones for a new readahead extent, we end up leaving a stale pointer in the global readahead extents radix tree (fs_info->reada_tree), which can trigger the following trace later on:
[13367.696354] BUG: kernel NULL pointer dereference, address: 00000000000000b0 [13367.696802] #PF: supervisor read access in kernel mode [13367.697249] #PF: error_code(0x0000) - not-present page [13367.697721] PGD 0 P4D 0 [13367.698171] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC PTI [13367.698632] CPU: 6 PID: 851214 Comm: btrfs Tainted: G W 5.9.0-rc6-btrfs-next-69 #1 [13367.699100] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [13367.700069] RIP: 0010:__lock_acquire+0x20a/0x3970 [13367.700562] Code: ff 1f 0f b7 c0 48 0f (...) [13367.701609] RSP: 0018:ffffb14448f57790 EFLAGS: 00010046 [13367.702140] RAX: 0000000000000000 RBX: 29b935140c15e8cf RCX: 0000000000000000 [13367.702698] RDX: 0000000000000002 RSI: ffffffffb3d66bd0 RDI: 0000000000000046 [13367.703240] RBP: ffff8a52ba8ac040 R08: 00000c2866ad9288 R09: 0000000000000001 [13367.703783] R10: 0000000000000001 R11: 00000000b66d9b53 R12: ffff8a52ba8ac9b0 [13367.704330] R13: 0000000000000000 R14: ffff8a532b6333e8 R15: 0000000000000000 [13367.704880] FS: 00007fe1df6b5700(0000) GS:ffff8a5376600000(0000) knlGS:0000000000000000 [13367.705438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [13367.705995] CR2: 00000000000000b0 CR3: 000000022cca8004 CR4: 00000000003706e0 [13367.706565] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [13367.707127] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [13367.707686] Call Trace: [13367.708246] ? ___slab_alloc+0x395/0x740 [13367.708820] ? reada_add_block+0xae/0xee0 [btrfs] [13367.709383] lock_acquire+0xb1/0x480 [13367.709955] ? reada_add_block+0xe0/0xee0 [btrfs] [13367.710537] ? reada_add_block+0xae/0xee0 [btrfs] [13367.711097] ? rcu_read_lock_sched_held+0x5d/0x90 [13367.711659] ? kmem_cache_alloc_trace+0x8d2/0x990 [13367.712221] ? lock_acquired+0x33b/0x470 [13367.712784] _raw_spin_lock+0x34/0x80 [13367.713356] ? reada_add_block+0xe0/0xee0 [btrfs] [13367.713966] reada_add_block+0xe0/0xee0 [btrfs] [13367.714529] ? btrfs_root_node+0x15/0x1f0 [btrfs] [13367.715077] btrfs_reada_add+0x117/0x170 [btrfs] [13367.715620] scrub_stripe+0x21e/0x10d0 [btrfs] [13367.716141] ? kvm_sched_clock_read+0x5/0x10 [13367.716657] ? __lock_acquire+0x41e/0x3970 [13367.717184] ? scrub_chunk+0x60/0x140 [btrfs] [13367.717697] ? find_held_lock+0x32/0x90 [13367.718254] ? scrub_chunk+0x60/0x140 [btrfs] [13367.718773] ? lock_acquired+0x33b/0x470 [13367.719278] ? scrub_chunk+0xcd/0x140 [btrfs] [13367.719786] scrub_chunk+0xcd/0x140 [btrfs] [13367.720291] scrub_enumerate_chunks+0x270/0x5c0 [btrfs] [13367.720787] ? finish_wait+0x90/0x90 [13367.721281] btrfs_scrub_dev+0x1ee/0x620 [btrfs] [13367.721762] ? rcu_read_lock_any_held+0x8e/0xb0 [13367.722235] ? preempt_count_add+0x49/0xa0 [13367.722710] ? __sb_start_write+0x19b/0x290 [13367.723192] btrfs_ioctl+0x7f5/0x36f0 [btrfs] [13367.723660] ? __fget_files+0x101/0x1d0 [13367.724118] ? find_held_lock+0x32/0x90 [13367.724559] ? __fget_files+0x101/0x1d0 [13367.724982] ? __x64_sys_ioctl+0x83/0xb0 [13367.725399] __x64_sys_ioctl+0x83/0xb0 [13367.725802] do_syscall_64+0x33/0x80 [13367.726188] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [13367.726574] RIP: 0033:0x7fe1df7add87 [13367.726948] Code: 00 00 00 48 8b 05 09 91 (...) [13367.727763] RSP: 002b:00007fe1df6b4d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [13367.728179] RAX: ffffffffffffffda RBX: 000055ce1fb596a0 RCX: 00007fe1df7add87 [13367.728604] RDX: 000055ce1fb596a0 RSI: 00000000c400941b RDI: 0000000000000003 [13367.729021] RBP: 0000000000000000 R08: 00007fe1df6b5700 R09: 0000000000000000 [13367.729431] R10: 00007fe1df6b5700 R11: 0000000000000246 R12: 00007ffd922b07de [13367.729842] R13: 00007ffd922b07df R14: 00007fe1df6b4e40 R15: 0000000000802000 [13367.730275] Modules linked in: btrfs blake2b_generic xor (...) [13367.732638] CR2: 00000000000000b0 [13367.733166] ---[ end trace d298b6805556acd9 ]---
What happens is the following:
1) At reada_find_extent() we don't find any existing readahead extent for the metadata extent starting at logical address X;
2) So we proceed to create a new one. We then call btrfs_map_block() to get information about which stripes contain extent X;
3) After that we iterate over the stripes and create only one zone for the readahead extent - only one because reada_find_zone() returned NULL for all iterations except for one, either because a memory allocation failed or it couldn't find the block group of the extent (it may have just been deleted);
4) We then add the new readahead extent to the readahead extents radix tree at fs_info->reada_tree;
5) Then we iterate over each zone of the new readahead extent, and find that the device used for that zone no longer exists, because it was removed or it was the source device of a device replace operation. Since this left 'have_zone' set to 0, after finishing the loop we jump to the 'error' label, call kfree() on the new readahead extent and return without removing it from the radix tree at fs_info->reada_tree;
6) Any future call to reada_find_extent() for the logical address X will find the stale pointer in the readahead extents radix tree, increment its reference counter, which can trigger the use-after-free right away or return it to the caller reada_add_block() that results in the use-after-free of the example trace above.
So fix this by making sure we delete the readahead extent from the radix tree if we fail to setup zones for it (when 'have_zone = 0').
--- fs/btrfs/reada.c | 2 ++ 1 file changed, 2 insertions(+)
fs/btrfs/reada.c +2 -0
@@ -456,6 +456,8 @@ static struct reada_extent *reada_find_e } have_zone =1 ; } +if (!have_zone) +radix_tree_delete (&fs_info->reada_tree, index);spin_unlock (&fs_info->reada_lock);btrfs_dev_replace_unlock (&fs_info->dev_replace,0 );
Greg Kroah-Hartman
maintainerPATCH 60/117 usb: dwc3: core: add phy cleanup for probe error handling
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 03c1fd622f72c7624c81b64fdba4a567ae5ee9cb upstream.
Add the phy cleanup if dwc3 mode init fail, which is the missing part of de-init for dwc3 core init.
--- drivers/usb/dwc3/core.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/usb/dwc3/core.c +11 -0
@@ -1148,6 +1148,17 @@ static int dwc3_probe(struct platform_de err5:dwc3_event_buffers_cleanup (dwc); + +usb_phy_shutdown (dwc->usb2_phy); +usb_phy_shutdown (dwc->usb3_phy); +phy_exit (dwc->usb2_generic_phy); +phy_exit (dwc->usb3_generic_phy); + +usb_phy_set_suspend (dwc->usb2_phy,1 ); +usb_phy_set_suspend (dwc->usb3_phy,1 ); +phy_power_off (dwc->usb2_generic_phy); +phy_power_off (dwc->usb3_generic_phy); +dwc3_ulpi_exit (dwc); err4:
Greg Kroah-Hartman
maintainerPATCH 61/117 usb: dwc3: core: dont trigger runtime pm when remove driver
In reply to Greg Kroah-HartmanFrom: Li Jun <[email protected]>
commit 266d0493900ac5d6a21cdbe6b1624ed2da94d47a upstream.
No need to trigger runtime pm in driver removal, otherwise if user disable auto suspend via sys file, runtime suspend may be entered, which will call dwc3_core_exit() again and there will be clock disable not balance warning:
[ 2026.820154] xhci-hcd xhci-hcd.0.auto: remove, state 4 [ 2026.825268] usb usb2: USB disconnect, device number 1 [ 2026.831017] xhci-hcd xhci-hcd.0.auto: USB bus 2 deregistered [ 2026.836806] xhci-hcd xhci-hcd.0.auto: remove, state 4 [ 2026.842029] usb usb1: USB disconnect, device number 1 [ 2026.848029] xhci-hcd xhci-hcd.0.auto: USB bus 1 deregistered [ 2026.865889] ------------[ cut here ]------------ [ 2026.870506] usb2_ctrl_root_clk already disabled [ 2026.875082] WARNING: CPU: 0 PID: 731 at drivers/clk/clk.c:958 clk_core_disable+0xa0/0xa8 [ 2026.883170] Modules linked in: dwc3(-) phy_fsl_imx8mq_usb [last unloaded: dwc3] [ 2026.890488] CPU: 0 PID: 731 Comm: rmmod Not tainted 5.8.0-rc7-00280-g9d08cca-dirty #245 [ 2026.898489] Hardware name: NXP i.MX8MQ EVK (DT) [ 2026.903020] pstate: 20000085 (nzCv daIf -PAN -UAO BTYPE=--) [ 2026.908594] pc : clk_core_disable+0xa0/0xa8 [ 2026.912777] lr : clk_core_disable+0xa0/0xa8 [ 2026.916958] sp : ffff8000121b39a0 [ 2026.920271] x29: ffff8000121b39a0 x28: ffff0000b11f3700 [ 2026.925583] x27: 0000000000000000 x26: ffff0000b539c700 [ 2026.930895] x25: 000001d7e44e1232 x24: ffff0000b76fa800 [ 2026.936208] x23: ffff0000b76fa6f8 x22: ffff800008d01040 [ 2026.941520] x21: ffff0000b539ce00 x20: ffff0000b7105000 [ 2026.946832] x19: ffff0000b7105000 x18: 0000000000000010 [ 2026.952144] x17: 0000000000000001 x16: 0000000000000000 [ 2026.957456] x15: ffff0000b11f3b70 x14: ffffffffffffffff [ 2026.962768] x13: ffff8000921b36f7 x12: ffff8000121b36ff [ 2026.968080] x11: ffff8000119e1000 x10: ffff800011bf26d0 [ 2026.973392] x9 : 0000000000000000 x8 : ffff800011bf3000 [ 2026.978704] x7 : ffff800010695d68 x6 : 0000000000000252 [ 2026.984016] x5 : ffff0000bb9881f0 x4 : 0000000000000000 [ 2026.989327] x3 : 0000000000000027 x2 : 0000000000000023 [ 2026.994639] x1 : ac2fa471aa7cab00 x0 : 0000000000000000 [ 2026.999951] Call trace: [ 2027.002401] clk_core_disable+0xa0/0xa8 [ 2027.006238] clk_core_disable_lock+0x20/0x38 [ 2027.010508] clk_disable+0x1c/0x28 [ 2027.013911] clk_bulk_disable+0x34/0x50 [ 2027.017758] dwc3_core_exit+0xec/0x110 [dwc3] [ 2027.022122] dwc3_suspend_common+0x84/0x188 [dwc3] [ 2027.026919] dwc3_runtime_suspend+0x74/0x9c [dwc3] [ 2027.031712] pm_generic_runtime_suspend+0x28/0x40 [ 2027.036419] genpd_runtime_suspend+0xa0/0x258 [ 2027.040777] __rpm_callback+0x88/0x140 [ 2027.044526] rpm_callback+0x20/0x80 [ 2027.048015] rpm_suspend+0xd0/0x418 [ 2027.051503] __pm_runtime_suspend+0x58/0xa0 [ 2027.055693] dwc3_runtime_idle+0x7c/0x90 [dwc3] [ 2027.060224] __rpm_callback+0x88/0x140 [ 2027.063973] rpm_idle+0x78/0x150 [ 2027.067201] __pm_runtime_idle+0x58/0xa0 [ 2027.071130] dwc3_remove+0x64/0xc0 [dwc3] [ 2027.075140] platform_drv_remove+0x28/0x48 [ 2027.079239] device_release_driver_internal+0xf4/0x1c0 [ 2027.084377] driver_detach+0x4c/0xd8 [ 2027.087954] bus_remove_driver+0x54/0xa8 [ 2027.091877] driver_unregister+0x2c/0x58 [ 2027.095799] platform_driver_unregister+0x10/0x18 [ 2027.100509] dwc3_driver_exit+0x14/0x1408 [dwc3] [ 2027.105129] __arm64_sys_delete_module+0x178/0x218 [ 2027.109922] el0_svc_common.constprop.0+0x68/0x160 [ 2027.114714] do_el0_svc+0x20/0x80 [ 2027.118031] el0_sync_handler+0x88/0x190 [ 2027.121953] el0_sync+0x140/0x180 [ 2027.125267] ---[ end trace 027f4f8189958f1f ]--- [ 2027.129976] ------------[ cut here ]------------
--- drivers/usb/dwc3/core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/usb/dwc3/core.c +2 -2
@@ -1205,9 +1205,9 @@ static int dwc3_remove(struct platform_ddwc3_core_exit (dwc);dwc3_ulpi_exit (dwc); -pm_runtime_put_sync (&pdev->dev); -pm_runtime_allow (&pdev->dev);pm_runtime_disable (&pdev->dev); +pm_runtime_put_noidle (&pdev->dev); +pm_runtime_set_suspended (&pdev->dev);dwc3_free_event_buffers (dwc);dwc3_free_scratch_buffers (dwc);
Greg Kroah-Hartman
maintainerPATCH 62/117 usb: host: fsl-mph-dr-of: check return of dma_set_mask()
In reply to Greg Kroah-HartmanFrom: Ran Wang <[email protected]>
commit 3cd54a618834430a26a648d880dd83d740f2ae30 upstream.
fsl_usb2_device_register() should stop init if dma_set_mask() return error.
--- drivers/usb/host/fsl-mph-dr-of.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
drivers/usb/host/fsl-mph-dr-of.c +6 -3
@@ -98,10 +98,13 @@ static struct platform_device *fsl_usb2_ pdev->dev.coherent_dma_mask = ofdev->dev.coherent_dma_mask; -if (!pdev->dev.dma_mask) +if (!pdev->dev.dma_mask) { pdev->dev.dma_mask = &ofdev->dev.coherent_dma_mask; -else -dma_set_mask (&pdev->dev,DMA_BIT_MASK (32 )); + }else { + retval =dma_set_mask (&pdev->dev,DMA_BIT_MASK (32 )); +if (retval) + goto error; + } retval =platform_device_add_data (pdev, pdata,sizeof (*pdata));if (retval)
Greg Kroah-Hartman
maintainerPATCH 63/117 vt: keyboard, simplify vt_kdgkbsent
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 6ca03f90527e499dd5e32d6522909e2ad390896b upstream.
Use 'strlen' of the string, add one for NUL terminator and simply do 'copy_to_user' instead of the explicit 'for' loop. This makes the KDGKBSENT case more compact.
The only thing we need to take care about is NULL 'func_table[i]'. Use an empty string in that case.
The original check for overflow could never trigger as the func_buf strings are always shorter or equal to 'struct kbsentry's.
--- drivers/tty/vt/keyboard.c | 28 +++++++++------------------- 1 file changed, 9 insertions(+), 19 deletions(-)
drivers/tty/vt/keyboard.c +9 -19
@@ -1963,9 +1963,7 @@ out:int vt_do_kdgkb_ioctl (int cmd,struct kbsentry __user *user_kdgkb,int perm) {struct kbsentry *kbs; -char *p;u_char *q; -u_char __user *up;int sz, fnw_sz;int delta;char *first_free, *fj, *fnw;
@@ -1991,23 +1989,15 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb i = kbs->kb_func;switch (cmd) { -case KDGKBSENT : - sz =sizeof (kbs->kb_string) -1 ;/* sz should have been -a struct member */ - up = user_kdgkb->kb_string; - p = func_table[i]; -if (p) -for ( ; *p && sz; p++, sz--) -if (put_user (*p, up++)) { - ret = -EFAULT ; - goto reterr; - } -if (put_user ('\0' , up)) { - ret = -EFAULT ; - goto reterr; - } -kfree (kbs); -return ((p && *p) ? -EOVERFLOW :0 ); +case KDGKBSENT : { +/* size should have been a struct member */ +unsigned char *from = func_table[i] ? :"" ; + + ret =copy_to_user (user_kdgkb->kb_string, from, +strlen (from) +1 ) ? -EFAULT :0 ; + + goto reterr; + }case KDSKBSENT :if (!perm) { ret = -EPERM ;
Greg Kroah-Hartman
maintainerPATCH 64/117 vt: keyboard, extend func_buf_lock to readers
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 82e61c3909db51d91b9d3e2071557b6435018b80 upstream.
Both read-side users of func_table/func_buf need locking. Without that, one can easily confuse the code by repeatedly setting altering strings like:
while (1)
for (a = 0; a < 2; a++) {
struct kbsentry kbs = {};
strcpy((char *)kbs.kb_string, a ? ".\n" : "88888\n");
ioctl(fd, KDSKBSENT, &kbs);
}When that program runs, one can get unexpected output by holding F1 (note the unxpected period on the last line):
.
88888
.8888
So protect all accesses to 'func_table' (and func_buf) by preexisting 'func_buf_lock'.
It is easy in 'k_fn' handler as 'puts_queue' is expected not to sleep. On the other hand, KDGKBSENT needs a local (atomic) copy of the string because copy_to_user can sleep. Use already allocated, but unused 'kbs->kb_string' for that purpose.
Note that the program above needs at least CAP_SYS_TTY_CONFIG.
This depends on the previous patch and on the func_buf_lock lock added in commit 46ca3f735f34 (tty/vt: fix write/write race in ioctl(KDSKBSENT) handler) in 5.2.
Likely fixes CVE-2020-25656.
--- drivers/tty/vt/keyboard.c | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-)
drivers/tty/vt/keyboard.c +13 -4
@@ -712,8 +712,13 @@ static void k_fn(struct vc_data *vc, unsreturn ;if ((unsigned )value <ARRAY_SIZE (func_table)) { +unsigned long flags; + +spin_lock_irqsave (&func_buf_lock, flags);if (func_table[value])puts_queue (vc, func_table[value]); +spin_unlock_irqrestore (&func_buf_lock, flags); + }else pr_err ("k_fn called with value=%d\n" , value); }
@@ -1959,7 +1964,7 @@ out:#undef s#undef v -/* FIXME: This one needs untangling and locking */ +/* FIXME: This one needs untangling */ int vt_do_kdgkb_ioctl (int cmd,struct kbsentry __user *user_kdgkb,int perm) {struct kbsentry *kbs;
@@ -1991,10 +1996,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbswitch (cmd) {case KDGKBSENT : {/* size should have been a struct member */ -unsigned char *from = func_table[i] ? :"" ; +ssize_t len =sizeof (user_kdgkb->kb_string); + +spin_lock_irqsave (&func_buf_lock, flags); + len =strlcpy (kbs->kb_string, func_table[i] ? :"" , len); +spin_unlock_irqrestore (&func_buf_lock, flags); - ret =copy_to_user (user_kdgkb->kb_string, from, -strlen (from) +1 ) ? -EFAULT :0 ; + ret =copy_to_user (user_kdgkb->kb_string, kbs->kb_string, + len +1 ) ? -EFAULT :0 ; goto reterr; }
Greg Kroah-Hartman
maintainerPATCH 65/117 dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status
In reply to Greg Kroah-HartmanFrom: Paul Cercueil <[email protected]>
commit baf6fd97b16ea8f981b8a8b04039596f32fc2972 upstream.
The jz4780_dma_tx_status() function would check if a channel's cookie state was set to 'completed', and if not, it would enter the critical section. However, in that time frame, the jz4780_dma_chan_irq() function was able to set the cookie to 'completed', and clear the jzchan->vchan pointer, which was deferenced in the critical section of the first function.
Fix this race by checking the channel's cookie state after entering the critical function and not before.
--- drivers/dma/dma-jz4780.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/dma/dma-jz4780.c +4 -3
@@ -567,11 +567,11 @@ static enum dma_status jz4780_dma_tx_staenum dma_status status;unsigned long flags; +spin_lock_irqsave (&jzchan->vchan.lock, flags); + status =dma_cookie_status (chan, cookie, txstate);if ((status ==DMA_COMPLETE ) || (txstate ==NULL )) -return status; - -spin_lock_irqsave (&jzchan->vchan.lock, flags); + goto out_unlock_irqrestore; vdesc =vchan_find_desc (&jzchan->vchan, cookie);if (vdesc) {
@@ -588,6 +588,7 @@ static enum dma_status jz4780_dma_tx_sta && jzchan->desc->status & (JZ_DMA_DCS_AR | JZ_DMA_DCS_HLT)) status =DMA_ERROR ; +out_unlock_irqrestore:spin_unlock_irqrestore (&jzchan->vchan.lock, flags);return status; }
Greg Kroah-Hartman
maintainerPATCH 66/117 iio:light:si1145: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 0456ecf34d466261970e0ff92b2b9c78a4908637 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 24 byte array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable array in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak appart from previous readings.
Depending on the enabled channels, the location of the timestamp can be at various aligned offsets through the buffer. As such we any use of a structure to enforce this alignment would incorrectly suggest a single location for the timestamp. Comments adjusted to express this clearly in the code.
--- drivers/iio/light/si1145.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)
drivers/iio/light/si1145.c +11 -8
@@ -172,6 +172,7 @@ struct si1145_part_info {* @part_info: Part information * @trig: Pointer to iio trigger * @meas_rate: Value of MEAS_RATE register. Only set in HW in auto mode +* @buffer: Used to pack data read from sensor. */ struct si1145_data {struct i2c_client *client;
@@ -183,6 +184,14 @@ struct si1145_data {bool autonomous;struct iio_trigger *trig;int meas_rate; +/* +* Ensure timestamp will be naturally aligned if present. +* Maximum buffer size (may be only partly used if not all +* channels are enabled): +* 6*2 bytes channels data + 4 bytes alignment + +* 8 bytes timestamp +*/ +u8 buffer[24 ]__aligned(8) ; };/**
@@ -444,12 +453,6 @@ static irqreturn_t si1145_trigger_handlestruct iio_poll_func *pf = private;struct iio_dev *indio_dev = pf->indio_dev;struct si1145_data *data =iio_priv (indio_dev); -/* -* Maximum buffer size: -* 6*2 bytes channels data + 4 bytes alignment + -* 8 bytes timestamp -*/ -u8 buffer[24 ];int i, j =0 ;int ret;u8 irq_status =0 ;
@@ -482,7 +485,7 @@ static irqreturn_t si1145_trigger_handle ret =i2c_smbus_read_i2c_block_data_or_emulated ( data->client, indio_dev->channels[i].address, -sizeof (u16) * run, &buffer[j]); +sizeof (u16) * run, &data->buffer[j]);if (ret <0 ) goto done; j += run *sizeof (u16);
@@ -497,7 +500,7 @@ static irqreturn_t si1145_trigger_handle goto done; } -iio_push_to_buffers_with_timestamp (indio_dev, buffer, +iio_push_to_buffers_with_timestamp (indio_dev, data->buffer,iio_get_time_ns (indio_dev)); done:
Greg Kroah-Hartman
maintainerPATCH 67/117 iio:adc:ti-adc12138 Fix alignment issue with timestamp
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 293e809b2e8e608b65a949101aaf7c0bd1224247 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack.
We move to a suitable structure in the iio_priv() data with alignment explicitly requested. This data is allocated with kzalloc so no data can leak apart from previous readings. Note that previously no leak at all could occur, but previous readings should never be a problem.
In this case the timestamp location depends on what other channels are enabled. As such we can't use a structure without misleading by suggesting only one possible timestamp location.
--- drivers/iio/adc/ti-adc12138.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/iio/adc/ti-adc12138.c +9 -4
@@ -50,6 +50,12 @@ struct adc12138 {struct completion complete;/* The number of cclk periods for the S/H's acquisition time */ unsigned int acquisition_time; +/* +* Maximum size needed: 16x 2 bytes ADC data + 8 bytes timestamp. +* Less may be need if not all channels are enabled, as long as +* the 8 byte alignment of the timestamp is maintained. +*/ +__be16 data[20 ]__aligned(8) ;u8 tx_buf[2 ]____cacheline_aligned ;u8 rx_buf[2 ];
@@ -333,7 +339,6 @@ static irqreturn_t adc12138_trigger_handstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct adc12138 *adc =iio_priv (indio_dev); -__be16 data[20 ] = { };/* 16x 2 bytes ADC data + 8 bytes timestamp */ __be16 trash;int ret;int scan_index;
@@ -349,7 +354,7 @@ static irqreturn_t adc12138_trigger_handreinit_completion (&adc->complete); ret =adc12138_start_and_read_conv (adc, scan_chan, - i ? &data[i -1 ] : &trash); + i ? &adc->data[i -1 ] : &trash);if (ret) {dev_warn (&adc->spi->dev,"failed to start conversion\n" );
@@ -366,7 +371,7 @@ static irqreturn_t adc12138_trigger_hand }if (i) { - ret =adc12138_read_conv_data (adc, &data[i -1 ]); + ret =adc12138_read_conv_data (adc, &adc->data[i -1 ]);if (ret) {dev_warn (&adc->spi->dev,"failed to get conversion data\n" );
@@ -374,7 +379,7 @@ static irqreturn_t adc12138_trigger_hand } } -iio_push_to_buffers_with_timestamp (indio_dev, data, +iio_push_to_buffers_with_timestamp (indio_dev, adc->data,iio_get_time_ns (indio_dev)); out:mutex_unlock (&adc->lock);
Greg Kroah-Hartman
maintainerPATCH 68/117 iio:gyro:itg3200: Fix timestamp alignment and prevent data leak.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 10ab7cfd5522f0041028556dac864a003e158556 upstream.
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses a 16 byte array of smaller elements on the stack. This is fixed by using an explicit c structure. As there are no holes in the structure, there is no possiblity of data leakage in this case.
The explicit alignment of ts is not strictly necessary but potentially makes the code slightly less fragile. It also removes the possibility of this being cut and paste into another driver where the alignment isn't already true.
--- drivers/iio/gyro/itg3200_buffer.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/iio/gyro/itg3200_buffer.c +10 -3
@@ -49,13 +49,20 @@ static irqreturn_t itg3200_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct itg3200 *st =iio_priv (indio_dev); -__be16 buf[ITG3200_SCAN_ELEMENTS +sizeof (s64)/sizeof (u16)]; +/* +* Ensure correct alignment and padding including for the +* timestamp that may be inserted. +*/ +struct { +__be16 buf[ITG3200_SCAN_ELEMENTS ]; +s64 ts__aligned(8) ; + } scan; -int ret =itg3200_read_all_channels (st->i2c, buf); +int ret =itg3200_read_all_channels (st->i2c, scan.buf);if (ret <0 ) goto error_ret; -iio_push_to_buffers_with_timestamp (indio_dev, buf, pf->timestamp); +iio_push_to_buffers_with_timestamp (indio_dev, &scan, pf->timestamp);iio_trigger_notify_done (indio_dev->trig);
Greg Kroah-Hartman
maintainerPATCH 69/117 powerpc: Warn about use of smt_snooze_delay
In reply to Greg Kroah-HartmanFrom: Joel Stanley <[email protected]>
commit a02f6d42357acf6e5de6ffc728e6e77faf3ad217 upstream.
It's not done anything for a long time. Save the percpu variable, and emit a warning to remind users to not expect it to do anything.
This uses pr_warn_once instead of pr_warn_ratelimit as testing 'ppc64_cpu --smt=off' on a 24 core / 4 SMT system showed the warning to be noisy, as the online/offline loop is slow.
--- arch/powerpc/kernel/sysfs.c | 42 +++++++++++++++++------------------------- 1 file changed, 17 insertions(+), 25 deletions(-)
arch/powerpc/kernel/sysfs.c +17 -25
@@ -28,29 +28,27 @@ static DEFINE_PER_CPU(struct cpu, cpu_devices); -/* -* SMT snooze delay stuff, 64-bit only for now -*/ -#ifdef CONFIG_PPC64 -/* Time in microseconds we delay before sleeping in the idle loop */ -static DEFINE_PER_CPU(long, smt_snooze_delay) = { 100 }; +/* +* Snooze delay has not been hooked up since 3fa8cad82b94 ("powerpc/pseries/cpuidle: +* smt-snooze-delay cleanup.") and has been broken even longer. As was foretold in +* 2014: +* +* "ppc64_util currently utilises it. Once we fix ppc64_util, propose to clean +* up the kernel code." +* +* powerpc-utils stopped using it as of 1.3.8. At some point in the future this +* code should be removed. +*/ static ssize_t store_smt_snooze_delay (struct device *dev,struct device_attribute *attr,const char *buf,size_t count) { - struct cpu *cpu = container_of(dev, struct cpu, dev); -ssize_t ret; -long snooze; - - ret =sscanf (buf,"%ld" , &snooze); -if (ret !=1 ) -return -EINVAL ; - -per_cpu (smt_snooze_delay, cpu->dev.id) = snooze; +pr_warn_once ("%s (%d) stored to unsupported smt_snooze_delay, which has no effect.\n" , + current->comm, current->pid);return count; }
@@ -58,9 +56,9 @@ static ssize_t show_smt_snooze_delay(str struct device_attribute *attr, char *buf) { - struct cpu *cpu = container_of(dev, struct cpu, dev); - -return sprintf (buf,"%ld\n" ,per_cpu (smt_snooze_delay, cpu->dev.id)); + pr_warn_once("%s (%d) read from unsupported smt_snooze_delay\n", + current->comm, current->pid); +return sprintf (buf,"100\n" ); } static DEVICE_ATTR(smt_snooze_delay, 0644, show_smt_snooze_delay,
@@ -68,16 +66,10 @@ static DEVICE_ATTR(smt_snooze_delay, 064static int __init setup_smt_snooze_delay (char *str) { -unsigned int cpu; -long snooze; -if (!cpu_has_feature (CPU_FTR_SMT ))return 1 ; - snooze =simple_strtol (str,NULL ,10 ); -for_each_possible_cpu (cpu) -per_cpu (smt_snooze_delay, cpu) = snooze; - +pr_warn ("smt-snooze-delay command line option has no effect\n" );return 1 ; }__setup ("smt-snooze-delay=" , setup_smt_snooze_delay);
Greg Kroah-Hartman
maintainerPATCH 70/117 powerpc/powernv/elog: Fix race while processing OPAL error log event.
In reply to Greg Kroah-HartmanFrom: Mahesh Salgaonkar <[email protected]>
commit aea948bb80b478ddc2448f7359d574387521a52d upstream.
Every error log reported by OPAL is exported to userspace through a sysfs interface and notified using kobject_uevent(). The userspace daemon (opal_errd) then reads the error log and acknowledges the error log is saved safely to disk. Once acknowledged the kernel removes the respective sysfs file entry causing respective resources to be released including kobject.
However it's possible the userspace daemon may already be scanning elog entries when a new sysfs elog entry is created by the kernel. User daemon may read this new entry and ack it even before kernel can notify userspace about it through kobject_uevent() call. If that happens then we have a potential race between elog_ack_store->kobject_put() and kobject_uevent which can lead to use-after-free of a kernfs object resulting in a kernel crash. eg:
BUG: Unable to handle kernel data access on read at 0x6b6b6b6b6b6b6bfb
Faulting instruction address: 0xc0000000008ff2a0
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA PowerNV
CPU: 27 PID: 805 Comm: irq/29-opal-elo Not tainted 5.9.0-rc2-gcc-8.2.0-00214-g6f56a67bcbb5-dirty #363
...
NIP kobject_uevent_env+0xa0/0x910
LR elog_event+0x1f4/0x2d0
Call Trace:
0x5deadbeef0000122 (unreliable)
elog_event+0x1f4/0x2d0
irq_thread_fn+0x4c/0xc0
irq_thread+0x1c0/0x2b0
kthread+0x1c4/0x1d0
ret_from_kernel_thread+0x5c/0x6cThis patch fixes this race by protecting the sysfs file creation/notification by holding a reference count on kobject until we safely send kobject_uevent().
The function create_elog_obj() returns the elog object which if used by caller function will end up in use-after-free problem again. However, the return value of create_elog_obj() function isn't being used today and there is no need as well. Hence change it to return void to make this fix complete.
--- arch/powerpc/platforms/powernv/opal-elog.c | 33 ++++++++++++++++++++++------- 1 file changed, 26 insertions(+), 7 deletions(-)
arch/powerpc/platforms/powernv/opal-elog.c +26 -7
@@ -183,14 +183,14 @@ static ssize_t raw_attr_read(struct filereturn count; } -static struct elog_obj *create_elog_obj (uint64_t id,size_t size,uint64_t type) +static void create_elog_obj (uint64_t id,size_t size,uint64_t type) {struct elog_obj *elog;int rc; elog =kzalloc (sizeof (*elog),GFP_KERNEL );if (!elog) -return NULL ; +return ; elog->kobj.kset = elog_kset;
@@ -223,18 +223,37 @@ static struct elog_obj *create_elog_obj( rc =kobject_add (&elog->kobj,NULL ,"0x%llx" , id);if (rc) {kobject_put (&elog->kobj); -return NULL ; +return ; } +/* +* As soon as the sysfs file for this elog is created/activated there is +* a chance the opal_errd daemon (or any userspace) might read and +* acknowledge the elog before kobject_uevent() is called. If that +* happens then there is a potential race between +* elog_ack_store->kobject_put() and kobject_uevent() which leads to a +* use-after-free of a kernfs object resulting in a kernel crash. +* +* To avoid that, we need to take a reference on behalf of the bin file, +* so that our reference remains valid while we call kobject_uevent(). +* We then drop our reference before exiting the function, leaving the +* bin file to drop the last reference (if it hasn't already). +*/ + +/* Take a reference for the bin file */ +kobject_get (&elog->kobj); rc =sysfs_create_bin_file (&elog->kobj, &elog->raw_attr); -if (rc) { +if (rc ==0 ) { +kobject_uevent (&elog->kobj,KOBJ_ADD ); + }else { +/* Drop the reference taken for the bin file */ kobject_put (&elog->kobj); -return NULL ; } -kobject_uevent (&elog->kobj,KOBJ_ADD ); +/* Drop our reference */ +kobject_put (&elog->kobj); -return elog; +return ; }static irqreturn_t elog_event (int irq,void *data)
Greg Kroah-Hartman
maintainerPATCH 71/117 ubifs: dent: Fix some potential memory leaks while iterating entries
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit 58f6e78a65f1fcbf732f60a7478ccc99873ff3ba upstream.
Fix some potential memory leaks in error handling branches while iterating dent entries. For example, function dbg_check_dir() forgets to free pdent if it exists.
--- fs/ubifs/debug.c | 1 + 1 file changed, 1 insertion(+)
fs/ubifs/debug.c +1 -0
@@ -1125,6 +1125,7 @@ int dbg_check_dir(struct ubifs_info *c, err =PTR_ERR (dent);if (err == -ENOENT )break ; +kfree (pdent);return err; }
Greg Kroah-Hartman
maintainerPATCH 72/117 ubi: check kthread_should_stop() after the setting of task state
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
commit d005f8c6588efcfbe88099b6edafc6f58c84a9c1 upstream.
A detach hung is possible when a race occurs between the detach process and the ubi background thread. The following sequences outline the race:
ubi thread: if (list_empty(&ubi->works)...
ubi detach: set_bit(KTHREAD_SHOULD_STOP, &kthread->flags)
=> by kthread_stop()
wake_up_process()
=> ubi thread is still running, so 0 is returned
ubi thread: set_current_state(TASK_INTERRUPTIBLE)
schedule()
=> ubi thread will never be scheduled again
ubi detach: wait_for_completion()
=> hung task!
To fix that, we need to check kthread_should_stop() after we set the task state, so the ubi thread will either see the stop bit and exit or the task state is reset to runnable such that it isn't scheduled out indefinitely.
--- drivers/mtd/ubi/wl.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/mtd/ubi/wl.c +13 -0
@@ -1478,6 +1478,19 @@ int ubi_thread(void *u) !ubi->thread_enabled || ubi_dbg_is_bgt_disabled(ubi)) {set_current_state (TASK_INTERRUPTIBLE );spin_unlock (&ubi->wl_lock); + +/* +* Check kthread_should_stop() after we set the task +* state to guarantee that we either see the stop bit +* and exit or the task state is reset to runnable such +* that it's not scheduled out indefinitely and detects +* the stop bit at kthread_should_stop(). +*/ +if (kthread_should_stop ()) { +set_current_state (TASK_RUNNING ); +break ; + } +schedule ();continue ; }
Greg Kroah-Hartman
maintainerPATCH 73/117 ia64: fix build error with !COREDUMP
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 7404840d87557c4092bf0272bce5e0354c774bf9 upstream.
Fix linkage error when CONFIG_BINFMT_ELF is selected but CONFIG_COREDUMP is not:
ia64-linux-ld: arch/ia64/kernel/elfcore.o: in function `elf_core_write_extra_phdrs':
elfcore.c:(.text+0x172): undefined reference to `dump_emit'
ia64-linux-ld: arch/ia64/kernel/elfcore.o: in function `elf_core_write_extra_data':
elfcore.c:(.text+0x2b2): undefined reference to `dump_emit'
--- arch/ia64/kernel/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/kernel/Makefile +1 -1
@@ -42,7 +42,7 @@ endif obj-$(CONFIG_INTEL_IOMMU) += pci-dma.o obj-$(CONFIG_SWIOTLB) += pci-swiotlb.o -obj-$(CONFIG_BINFMT_ELF) += elfcore.o +obj-$(CONFIG_ELF_CORE) += elfcore.o # fp_emulate() expects f2-f5,f16-f31 to contain the user-level state. CFLAGS_traps.o += -mfixed-range=f2-f5,f16-f31
Greg Kroah-Hartman
maintainerPATCH 74/117 ceph: promote to unsigned long long before shifting
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit c403c3a2fbe24d4ed33e10cabad048583ebd4edf upstream.
On 32-bit systems, this shift will overflow for files larger than 4GB.
--- fs/ceph/addr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ceph/addr.c +1 -1
@@ -1392,7 +1392,7 @@ static int ceph_filemap_fault(struct vm_struct ceph_inode_info *ci =ceph_inode (inode);struct ceph_file_info *fi = vma->vm_file->private_data;struct page *pinned_page =NULL ; -loff_t off = vmf->pgoff <<PAGE_SHIFT ; +loff_t off = (loff_t )vmf->pgoff <<PAGE_SHIFT ;int want, got, ret;sigset_t oldset;
Greg Kroah-Hartman
maintainerPATCH 75/117 libceph: clear con->out_msg on Policy::stateful_server faults
In reply to Greg Kroah-HartmanFrom: Ilya Dryomov <[email protected]>
commit 28e1581c3b4ea5f98530064a103c6217bedeea73 upstream.
con->out_msg must be cleared on Policy::stateful_server (!CEPH_MSG_CONNECT_LOSSY) faults. Not doing so botches the reconnection attempt, because after writing the banner the messenger moves on to writing the data section of that message (either from where it got interrupted by the connection reset or from the beginning) instead of writing struct ceph_msg_connect. This results in a bizarre error message because the server sends CEPH_MSGR_TAG_BADPROTOVER but we think we wrote struct ceph_msg_connect:
libceph: mds0 (1)172.21.15.45:6828 socket error on write
ceph: mds0 reconnect start
libceph: mds0 (1)172.21.15.45:6829 socket closed (con state OPEN)
libceph: mds0 (1)172.21.15.45:6829 protocol version mismatch, my 32 != server's 32
libceph: mds0 (1)172.21.15.45:6829 protocol version mismatch
AFAICT this bug goes back to the dawn of the kernel client. The reason it survived for so long is that only MDS sessions are stateful and only two MDS messages have a data section:CEPH_MSG_CLIENT_RECONNECT (always, but reconnecting is rare) and CEPH_MSG_CLIENT_REQUEST (only when xattrs are involved). The connection has to get reset precisely when such message is being sent -- in this case it was the former.
--- net/ceph/messenger.c | 5 +++++ 1 file changed, 5 insertions(+)
net/ceph/messenger.c +5 -0
@@ -2983,6 +2983,11 @@ static void con_fault(struct ceph_connecceph_msg_put (con->in_msg); con->in_msg =NULL ; } +if (con->out_msg) { +BUG_ON (con->out_msg->con != con); +ceph_msg_put (con->out_msg); + con->out_msg =NULL ; + }/* Requeue anything that hasn't been acked */ list_splice_init (&con->out_sent, &con->out_queue);
Greg Kroah-Hartman
maintainerPATCH 76/117 9P: Cast to loff_t before multiplying
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit f5f7ab168b9a60e12a4b8f2bb6fcc91321dc23c1 upstream.
On 32-bit systems, this multiplication will overflow for files larger than 4GB.
--- fs/9p/vfs_file.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/9p/vfs_file.c +2 -2
@@ -624,9 +624,9 @@ static void v9fs_mmap_vm_close(struct vmstruct writeback_control wbc = { .nr_to_write =LONG_MAX , .sync_mode =WB_SYNC_ALL , - .range_start = vma->vm_pgoff *PAGE_SIZE , + .range_start = (loff_t )vma->vm_pgoff *PAGE_SIZE ,/* absolute end, byte at end included */ - .range_end = vma->vm_pgoff *PAGE_SIZE + + .range_end = (loff_t )vma->vm_pgoff *PAGE_SIZE + (vma->vm_end - vma->vm_start -1 ), };
Greg Kroah-Hartman
maintainerPATCH 77/117 ring-buffer: Return 0 on success from ring_buffer_resize()
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit 0a1754b2a97efa644aa6e84d1db5b17c42251483 upstream.
We don't need to check the new buffer size, and the return value had confused resize_buffer_duplicate_size().
...
ret = ring_buffer_resize(trace_buf->buffer, per_cpu_ptr(size_buf->data,cpu_id)->entries, cpu_id); if (ret == 0) per_cpu_ptr(trace_buf->data, cpu_id)->entries = per_cpu_ptr(size_buf->data, cpu_id)->entries;
...
--- kernel/trace/ring_buffer.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
kernel/trace/ring_buffer.c +4 -4
@@ -1650,18 +1650,18 @@ int ring_buffer_resize(struct ring_buffe {struct ring_buffer_per_cpu *cpu_buffer;unsigned long nr_pages; -int cpu, err =0 ; +int cpu, err;/* * Always succeed at resizing a non-existent buffer: */ if (!buffer) -return size; +return 0 ;/* Make sure the requested buffer exists */ if (cpu_id !=RING_BUFFER_ALL_CPUS && !cpumask_test_cpu (cpu_id, buffer->cpumask)) -return size; +return 0 ; nr_pages =DIV_ROUND_UP (size,BUF_PAGE_SIZE );
@@ -1801,7 +1801,7 @@ int ring_buffer_resize(struct ring_buffe }mutex_unlock (&buffer->mutex); -return size; +return 0 ; out_err:for_each_buffer_cpu (buffer, cpu) {
Greg Kroah-Hartman
maintainerPATCH 78/117 vringh: fix __vringh_iov() when riov and wiov are different
In reply to Greg Kroah-HartmanFrom: Stefano Garzarella <[email protected]>
commit 5745bcfbbf89b158416075374254d3c013488f21 upstream.
If riov and wiov are both defined and they point to different objects, only riov is initialized. If the wiov is not initialized by the caller, the function fails returning -EINVAL and printing "Readable desc 0x... after writable" error message.
This issue happens when descriptors have both readable and writable buffers (eg. virtio-blk devices has virtio_blk_outhdr in the readable buffer and status as last byte of writable buffer) and we call __vringh_iov() to get both type of buffers in two different iovecs.
Let's replace the 'else if' clause with 'if' to initialize both riov and wiov if they are not NULL.
As checkpatch pointed out, we also avoid crashing the kernel when riov and wiov are both NULL, replacing BUG() with WARN_ON() and returning -EINVAL.
--- drivers/vhost/vringh.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/vhost/vringh.c +5 -4
@@ -272,13 +272,14 @@ __vringh_iov(struct vringh *vrh, u16 i, desc_max = vrh->vring.num; up_next =-1 ; +/* You must want something! */ +if (WARN_ON (!riov && !wiov)) +return -EINVAL ; +if (riov) riov->i = riov->used =0 ; -else if (wiov) +if (wiov) wiov->i = wiov->used =0 ; -else -/* You must want something! */ -BUG ();for (;;) {void *addr;
Greg Kroah-Hartman
maintainerPATCH 79/117 rtc: rx8010: dont modify the global rtc ops
In reply to Greg Kroah-HartmanFrom: Bartosz Golaszewski <[email protected]>
commit d3b14296da69adb7825022f3224ac6137eb30abf upstream.
The way the driver is implemented is buggy for the (admittedly unlikely) use case where there are two RTCs with one having an interrupt configured and the second not. This is caused by the fact that we use a global rtc_class_ops struct which we modify depending on whether the irq number is present or not.
Fix it by using two const ops structs with and without alarm operations. While at it: not being able to request a configured interrupt is an error so don't ignore it and bail out of probe().
--- drivers/rtc/rtc-rx8010.c | 24 +++++++++++++++++------- 1 file changed, 17 insertions(+), 7 deletions(-)
drivers/rtc/rtc-rx8010.c +17 -7
@@ -423,16 +423,26 @@ static int rx8010_ioctl(struct device *d } } -static struct rtc_class_ops rx8010_rtc_ops = { +static const struct rtc_class_ops rx8010_rtc_ops_default = { .read_time = rx8010_get_time, .set_time = rx8010_set_time, .ioctl = rx8010_ioctl, }; +static const struct rtc_class_ops rx8010_rtc_ops_alarm = { + .read_time = rx8010_get_time, + .set_time = rx8010_set_time, + .ioctl = rx8010_ioctl, + .read_alarm = rx8010_read_alarm, + .set_alarm = rx8010_set_alarm, + .alarm_irq_enable = rx8010_alarm_irq_enable, +}; +static int rx8010_probe (struct i2c_client *client,const struct i2c_device_id *id) {struct i2c_adapter *adapter =to_i2c_adapter (client->dev.parent); +const struct rtc_class_ops *rtc_ops;struct rx8010_data *rx8010;int err =0 ;
@@ -463,16 +473,16 @@ static int rx8010_probe(struct i2c_clienif (err) {dev_err (&client->dev,"unable to request IRQ\n" ); - client->irq =0 ; - }else { - rx8010_rtc_ops.read_alarm = rx8010_read_alarm; - rx8010_rtc_ops.set_alarm = rx8010_set_alarm; - rx8010_rtc_ops.alarm_irq_enable = rx8010_alarm_irq_enable; +return err; } + + rtc_ops = &rx8010_rtc_ops_alarm; + }else { + rtc_ops = &rx8010_rtc_ops_default; } rx8010->rtc =devm_rtc_device_register (&client->dev, client->name, - &rx8010_rtc_ops,THIS_MODULE ); + rtc_ops,THIS_MODULE );if (IS_ERR (rx8010->rtc)) {dev_err (&client->dev,"unable to register the class device\n" );
Greg Kroah-Hartman
maintainerPATCH 80/117 tty: make FONTX ioctl use the tty pointer they were actually passed
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 90bfdeef83f1d6c696039b6a917190dcbbad3220 upstream.
Some of the font tty ioctl's always used the current foreground VC for their operations. Don't do that then.
This fixes a data race on fg_console.
Side note: both Michael Ellerman and Jiri Slaby point out that all these ioctls are deprecated, and should probably have been removed long ago, and everything seems to be using the KDFONTOP ioctl instead.
In fact, Michael points out that it looks like busybox's loadfont program seems to have switched over to using KDFONTOP exactly _because_ of this bug (ahem.. 12 years ago ;-).
--- drivers/tty/vt/vt_ioctl.c | 32 +++++++++++++++++--------------- 1 file changed, 17 insertions(+), 15 deletions(-)
drivers/tty/vt/vt_ioctl.c +17 -15
@@ -243,7 +243,7 @@ int vt_waitactive(int n)static inline int -do_fontx_ioctl (int cmd,struct consolefontdesc __user *user_cfd,int perm,struct console_font_op *op) +do_fontx_ioctl (struct vc_data *vc,int cmd,struct consolefontdesc __user *user_cfd,int perm,struct console_font_op *op) {struct consolefontdesc cfdarg;int i;
@@ -261,15 +261,16 @@ do_fontx_ioctl(int cmd, struct consolefo op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = cfdarg.chardata; -return con_font_op (vc_cons[fg_console].d, op); -case GIO_FONTX : { +return con_font_op (vc, op); + +case GIO_FONTX : op->op =KD_FONT_OP_GET ; op->flags =KD_FONT_FLAG_OLD ; op->width =8 ; op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data = cfdarg.chardata; - i =con_font_op (vc_cons[fg_console].d, op); + i =con_font_op (vc, op);if (i)return i; cfdarg.charheight = op->height;
@@ -277,7 +278,6 @@ do_fontx_ioctl(int cmd, struct consolefoif (copy_to_user (user_cfd, &cfdarg,sizeof (struct consolefontdesc )))return -EFAULT ;return 0 ; - } }return -EINVAL ; }
@@ -927,7 +927,7 @@ int vt_ioctl(struct tty_struct *tty, op.height =0 ; op.charcount =256 ; op.data = up; - ret =con_font_op (vc_cons[fg_console].d, &op); + ret =con_font_op (vc, &op);break ; }
@@ -938,7 +938,7 @@ int vt_ioctl(struct tty_struct *tty, op.height =32 ; op.charcount =256 ; op.data = up; - ret =con_font_op (vc_cons[fg_console].d, &op); + ret =con_font_op (vc, &op);break ; }
@@ -955,7 +955,7 @@ int vt_ioctl(struct tty_struct *tty,case PIO_FONTX :case GIO_FONTX : - ret =do_fontx_ioctl (cmd, up, perm, &op); + ret =do_fontx_ioctl (vc, cmd, up, perm, &op);break ;case PIO_FONTRESET :
@@ -972,11 +972,11 @@ int vt_ioctl(struct tty_struct *tty, { op.op =KD_FONT_OP_SET_DEFAULT ; op.data =NULL ; - ret =con_font_op (vc_cons[fg_console].d, &op); + ret =con_font_op (vc, &op);if (ret)break ;console_lock (); -con_set_default_unimap (vc_cons[fg_console].d); +con_set_default_unimap (vc);console_unlock ();break ; }
@@ -1103,8 +1103,9 @@ struct compat_consolefontdesc { };static inline int -compat_fontx_ioctl (int cmd,struct compat_consolefontdesc __user *user_cfd, -int perm,struct console_font_op *op) +compat_fontx_ioctl (struct vc_data *vc,int cmd, +struct compat_consolefontdesc __user *user_cfd, +int perm,struct console_font_op *op) {struct compat_consolefontdesc cfdarg;int i;
@@ -1122,7 +1123,8 @@ compat_fontx_ioctl(int cmd, struct compa op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data =compat_ptr (cfdarg.chardata); -return con_font_op (vc_cons[fg_console].d, op); +return con_font_op (vc, op); +case GIO_FONTX : op->op =KD_FONT_OP_GET ; op->flags =KD_FONT_FLAG_OLD ;
@@ -1130,7 +1132,7 @@ compat_fontx_ioctl(int cmd, struct compa op->height = cfdarg.charheight; op->charcount = cfdarg.charcount; op->data =compat_ptr (cfdarg.chardata); - i =con_font_op (vc_cons[fg_console].d, op); + i =con_font_op (vc, op);if (i)return i; cfdarg.charheight = op->height;
@@ -1225,7 +1227,7 @@ long vt_compat_ioctl(struct tty_struct **/ case PIO_FONTX :case GIO_FONTX : - ret =compat_fontx_ioctl (cmd, up, perm, &op); + ret =compat_fontx_ioctl (vc, cmd, up, perm, &op);break ;case KDFONTOP :
Greg Kroah-Hartman
maintainerPATCH 81/117 arm64: berlin: Select DW_APB_TIMER_OF
In reply to Greg Kroah-HartmanFrom: Jisheng Zhang <[email protected]>
commit b0fc70ce1f028e14a37c186d9f7a55e51439b83a upstream.
Berlin SoCs always contain some DW APB timers which can be used as an always-on broadcast timer.
--- arch/arm64/Kconfig.platforms | 1 + 1 file changed, 1 insertion(+)
arch/arm64/Kconfig.platforms +1 -0
@@ -41,6 +41,7 @@ config ARCH_BCM_IPROC config ARCH_BERLIN bool "Marvell Berlin SoC Family" select DW_APB_ICTL + select DW_APB_TIMER_OF select GPIOLIB select PINCTRL help
Greg Kroah-Hartman
maintainerPATCH 82/117 cachefiles: Handle readpage error correctly
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox (Oracle) <[email protected]>
commit 9480b4e75b7108ee68ecf5bc6b4bd68e8031c521 upstream.
If ->readpage returns an error, it has already unlocked the page.
--- fs/cachefiles/rdwr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/cachefiles/rdwr.c +2 -1
@@ -125,7 +125,7 @@ static int cachefiles_read_reissue(struc_debug ("reissue read" ); ret = bmapping->a_ops->readpage (NULL , backpage);if (ret <0 ) - goto unlock_discard; + goto discard; }/* but the page may have been read before the monitor was installed, so
@@ -142,6 +142,7 @@ static int cachefiles_read_reissue(struc unlock_discard:unlock_page (backpage); +discard:spin_lock_irq (&object->work_lock);list_del (&monitor->op_link);spin_unlock_irq (&object->work_lock);
Greg Kroah-Hartman
maintainerPATCH 83/117 hil/parisc: Disable HIL driver when it gets stuck
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit 879bc2d27904354b98ca295b6168718e045c4aa2 upstream.
When starting a HP machine with HIL driver but without an HIL keyboard or HIL mouse attached, it may happen that data written to the HIL loop gets stuck (e.g. because the transaction queue is full). Usually one will then have to reboot the machine because all you see is and endless output of:
Transaction add failed: transaction already queued?
In the higher layers hp_sdc_enqueue_transaction() is called to queued up a HIL packet. This function returns an error code, and this patch adds the necessary checks for this return code and disables the HIL driver if further packets can't be sent.
Tested on a HP 730 and a HP 715/64 machine.
--- drivers/input/serio/hil_mlc.c | 21 ++++++++++++++++++--- drivers/input/serio/hp_sdc_mlc.c | 8 ++++---- include/linux/hil_mlc.h | 2 +- 3 files changed, 23 insertions(+), 8 deletions(-)
drivers/input/serio/hil_mlc.c +18 -3
@@ -74,7 +74,7 @@ EXPORT_SYMBOL(hil_mlc_unregister);static LIST_HEAD (hil_mlcs);static DEFINE_RWLOCK (hil_mlcs_lock);static struct timer_list hil_mlcs_kicker; -static int hil_mlcs_probe; +static int hil_mlcs_probe, hil_mlc_stop;static void hil_mlcs_process (unsigned long unused); static DECLARE_TASKLET_DISABLED(hil_mlcs_tasklet, hil_mlcs_process, 0);
@@ -704,9 +704,13 @@ static int hilse_donode(hil_mlc *mlc)if (!mlc->ostarted) { mlc->ostarted =1 ; mlc->opacket = pack; - mlc->out (mlc); + rc = mlc->out (mlc); nextidx =HILSEN_DOZE ;write_unlock_irqrestore (&mlc->lock, flags); +if (rc) { + hil_mlc_stop =1 ; +return 1 ; + }break ; } mlc->ostarted =0 ;
@@ -717,8 +721,13 @@ static int hilse_donode(hil_mlc *mlc)case HILSE_CTS :write_lock_irqsave (&mlc->lock, flags); - nextidx = mlc->cts (mlc) ? node->bad : node->good; + rc = mlc->cts (mlc); + nextidx = rc ? node->bad : node->good;write_unlock_irqrestore (&mlc->lock, flags); +if (rc) { + hil_mlc_stop =1 ; +return 1 ; + }break ;default :
@@ -786,6 +795,12 @@ static void hil_mlcs_process(unsigned lostatic void hil_mlcs_timer (unsigned long data) { +if (hil_mlc_stop) { +/* could not send packet - stop immediately. */ +pr_warn (PREFIX "HIL seems stuck - Disabling HIL MLC.\n" ); +return ; + } + hil_mlcs_probe =1 ;tasklet_schedule (&hil_mlcs_tasklet);/* Re-insert the periodic task. */
drivers/input/serio/hp_sdc_mlc.c +4 -4
@@ -213,7 +213,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc) priv->tseq[2 ] =1 ; priv->tseq[3 ] =0 ; priv->tseq[4 ] =0 ; -__hp_sdc_enqueue_transaction (&priv->trans); +return __hp_sdc_enqueue_transaction (&priv->trans); busy:return 1 ; done:
@@ -222,7 +222,7 @@ static int hp_sdc_mlc_cts(hil_mlc *mlc)return 0 ; } -static void hp_sdc_mlc_out (hil_mlc *mlc) +static int hp_sdc_mlc_out (hil_mlc *mlc) {struct hp_sdc_mlc_priv_s *priv;
@@ -237,7 +237,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc) do_data:if (priv->emtestmode) {up (&mlc->osem); -return ; +return 0 ; }/* Shouldn't be sending commands when loop may be busy */ BUG_ON (down_trylock (&mlc->csem));
@@ -299,7 +299,7 @@ static void hp_sdc_mlc_out(hil_mlc *mlc)BUG_ON (down_trylock (&mlc->csem)); } enqueue: -hp_sdc_enqueue_transaction (&priv->trans); +return hp_sdc_enqueue_transaction (&priv->trans); }static int __init hp_sdc_mlc_init (void )
include/linux/hil_mlc.h +1 -1
@@ -103,7 +103,7 @@ struct hilse_node {/* Methods for back-end drivers, e.g. hp_sdc_mlc */ typedef int (hil_mlc_cts ) (hil_mlc *mlc); -typedef void (hil_mlc_out ) (hil_mlc *mlc); +typedef int (hil_mlc_out ) (hil_mlc *mlc);typedef int (hil_mlc_in ) (hil_mlc *mlc,suseconds_t timeout);struct hil_mlc_devinfo {
Greg Kroah-Hartman
maintainerPATCH 84/117 ARM: samsung: fix PM debug build with DEBUG_LL but !MMU
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 7be0d19c751b02db778ca95e3274d5ea7f31891c upstream.
Selecting CONFIG_SAMSUNG_PM_DEBUG (depending on CONFIG_DEBUG_LL) but without CONFIG_MMU leads to build errors:
arch/arm/plat-samsung/pm-debug.c: In function ‘s3c_pm_uart_base’:
arch/arm/plat-samsung/pm-debug.c:57:2: error:
implicit declaration of function ‘debug_ll_addr’ [-Werror=implicit-function-declaration]
--- arch/arm/plat-samsung/Kconfig | 1 + 1 file changed, 1 insertion(+)
arch/arm/plat-samsung/Kconfig +1 -0
@@ -242,6 +242,7 @@ config SAMSUNG_PM_DEBUG bool "Samsung PM Suspend debug" depends on PM && DEBUG_KERNEL depends on DEBUG_EXYNOS_UART || DEBUG_S3C24XX_UART || DEBUG_S3C2410_UART + depends on DEBUG_LL && MMU help Say Y here if you want verbose debugging from the PM Suspend and Resume code. See <file:Documentation/arm/Samsung-S3C24XX/Suspend.txt>
Greg Kroah-Hartman
maintainerPATCH 85/117 ARM: s3c24xx: fix missing system reset
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit f6d7cde84f6c5551586c8b9b68d70f8e6dc9a000 upstream.
Commit f6361c6b3880 ("ARM: S3C24XX: remove separate restart code") removed usage of the watchdog reset platform code in favor of the Samsung SoC watchdog driver. However the latter was not selected thus S3C24xx platforms lost reset abilities.
--- arch/arm/Kconfig | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/Kconfig +2 -0
@@ -601,7 +601,9 @@ config ARCH_S3C24XX select HAVE_S3C_RTC if RTC_CLASS select MULTI_IRQ_HANDLER select NEED_MACH_IO_H + select S3C2410_WATCHDOG select SAMSUNG_ATAGS + select WATCHDOG help Samsung S3C2410, S3C2412, S3C2413, S3C2416, S3C2440, S3C2442, S3C2443 and S3C2450 SoCs based systems, such as the Simtec Electronics BAST
Greg Kroah-Hartman
maintainerPATCH 86/117 device property: Keep secondary firmware node secondary by type
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit d5dcce0c414fcbfe4c2037b66ac69ea5f9b3f75c upstream.
Behind primary and secondary we understand the type of the nodes which might define their ordering. However, if primary node gone, we can't maintain the ordering by definition of the linked list. Thus, by ordering secondary node becomes first in the list. But in this case the meaning of it is still secondary (or auxiliary). The type of the node is maintained by the secondary pointer in it:
secondary pointer Meaning
NULL or valid primary node
ERR_PTR(-ENODEV) secondary node
So, if by some reason we do the following sequence of calls
set_primary_fwnode(dev, NULL); set_primary_fwnode(dev, primary);
we should preserve secondary node.
This concept is supported by the description of set_primary_fwnode() along with implementation of set_secondary_fwnode(). Hence, fix the commit c15e1bdda436 to follow this as well.
--- drivers/base/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/core.c +1 -1
@@ -2362,7 +2362,7 @@ void set_primary_fwnode(struct device *d }else {if (fwnode_is_primary (fn)) { dev->fwnode = fn->secondary; - fn->secondary =NULL ; + fn->secondary =ERR_PTR (-ENODEV ); }else { dev->fwnode =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 87/117 device property: Dont clear secondary pointer for shared primary firmware node
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit 99aed9227073fb34ce2880cbc7063e04185a65e1 upstream.
It appears that firmware nodes can be shared between devices. In such case when a (child) device is about to be deleted, its firmware node may be shared and ACPI_COMPANION_SET(..., NULL) call for it breaks the secondary link of the shared primary firmware node.
In order to prevent that, check, if the device has a parent and parent's firmware node is shared with its child, and avoid crashing the link.
--- drivers/base/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/base/core.c +3 -1
@@ -2348,6 +2348,7 @@ static inline bool fwnode_is_primary(str*/ void set_primary_fwnode (struct device *dev,struct fwnode_handle *fwnode) { +struct device *parent = dev->parent;struct fwnode_handle *fn = dev->fwnode;if (fwnode) {
@@ -2362,7 +2363,8 @@ void set_primary_fwnode(struct device *d }else {if (fwnode_is_primary (fn)) { dev->fwnode = fn->secondary; - fn->secondary =ERR_PTR (-ENODEV ); +if (!(parent && fn == parent->fwnode)) + fn->secondary =ERR_PTR (-ENODEV ); }else { dev->fwnode =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 88/117 KVM: arm64: Fix AArch32 handling of DBGD{CCINT,SCRext} and DBGVCR
In reply to Greg Kroah-HartmanFrom: Marc Zyngier <[email protected]>
commit 4a1c2c7f63c52ccb11770b5ae25920a6b79d3548 upstream.
The DBGD{CCINT,SCRext} and DBGVCR register entries in the cp14 array are missing their target register, resulting in all accesses being targetted at the guard sysreg (indexed by __INVALID_SYSREG__).
Point the emulation code at the actual register entries.
--- arch/arm64/include/asm/kvm_host.h | 1 + arch/arm64/kvm/sys_regs.c | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-)
arch/arm64/include/asm/kvm_host.h +1 -0
@@ -188,6 +188,7 @@ enum vcpu_sysreg {#define cp14_DBGWCR0 (DBGWCR0_EL1 * 2)#define cp14_DBGWVR0 (DBGWVR0_EL1 * 2)#define cp14_DBGDCCINT (MDCCINT_EL1 * 2) +#define cp14_DBGVCR (DBGVCR32_EL2 * 2)#define NR_COPRO_REGS (NR_SYS_REGS * 2)
arch/arm64/kvm/sys_regs.c +3 -3
@@ -1207,9 +1207,9 @@ static const struct sys_reg_desc cp14_re { Op1( 0), CRn( 0), CRm( 1), Op2( 0), trap_raz_wi },DBG_BCR_BVR_WCR_WVR (1 ),/* DBGDCCINT */ - { Op1( 0), CRn( 0), CRm( 2), Op2( 0), trap_debug32 }, + { Op1( 0), CRn( 0), CRm( 2), Op2( 0), trap_debug32, NULL, cp14_DBGDCCINT },/* DBGDSCRext */ - { Op1( 0), CRn( 0), CRm( 2), Op2( 2), trap_debug32 }, + { Op1( 0), CRn( 0), CRm( 2), Op2( 2), trap_debug32, NULL, cp14_DBGDSCRext },DBG_BCR_BVR_WCR_WVR (2 ),/* DBGDTR[RT]Xint */ { Op1( 0), CRn( 0), CRm( 3), Op2( 0), trap_raz_wi },
@@ -1224,7 +1224,7 @@ static const struct sys_reg_desc cp14_re { Op1( 0), CRn( 0), CRm( 6), Op2( 2), trap_raz_wi },DBG_BCR_BVR_WCR_WVR (6 ),/* DBGVCR */ - { Op1( 0), CRn( 0), CRm( 7), Op2( 0), trap_debug32 }, + { Op1( 0), CRn( 0), CRm( 7), Op2( 0), trap_debug32, NULL, cp14_DBGVCR },DBG_BCR_BVR_WCR_WVR (7 ),DBG_BCR_BVR_WCR_WVR (8 ), DBG_BCR_BVR_WCR_WVR(9),
Greg Kroah-Hartman
maintainerPATCH 89/117 staging: comedi: cb_pcidas: Allow 2-channel commands for AO subdevice
In reply to Greg Kroah-HartmanFrom: Ian Abbott <[email protected]>
commit 647a6002cb41d358d9ac5de101a8a6dc74748a59 upstream.
The "cb_pcidas" driver supports asynchronous commands on the analog output (AO) subdevice for those boards that have an AO FIFO. The code (in cb_pcidas_ao_check_chanlist() and cb_pcidas_ao_cmd()) to validate and set up the command supports output to a single channel or to two channels simultaneously (the boards have two AO channels). However, the code in cb_pcidas_auto_attach() that initializes the subdevices neglects to initialize the AO subdevice's len_chanlist member, leaving it set to 0, but the Comedi core will "correct" it to 1 if the driver neglected to set it. This limits commands to use a single channel (either channel 0 or 1), but the limit should be two channels. Set the AO subdevice's len_chanlist member to be the same value as the n_chan member, which will be 2.
--- drivers/staging/comedi/drivers/cb_pcidas.c | 1 + 1 file changed, 1 insertion(+)
drivers/staging/comedi/drivers/cb_pcidas.c +1 -0
@@ -1351,6 +1351,7 @@ static int cb_pcidas_auto_attach(structif (dev->irq && board->has_ao_fifo) { dev->write_subdev = s; s->subdev_flags |=SDF_CMD_WRITE ; + s->len_chanlist = s->n_chan; s->do_cmdtest = cb_pcidas_ao_cmdtest; s->do_cmd = cb_pcidas_ao_cmd; s->cancel = cb_pcidas_ao_cancel;
Greg Kroah-Hartman
maintainerPATCH 90/117 staging: octeon: repair "fixed-link" support
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
commit 179f5dc36b0a1aa31538d7d8823deb65c39847b3 upstream.
The PHYs must be registered once in device probe function, not in device open callback because it's only possible to register them once.
--- drivers/staging/octeon/ethernet-mdio.c | 6 ------ drivers/staging/octeon/ethernet.c | 9 +++++++++ 2 files changed, 9 insertions(+), 6 deletions(-)
drivers/staging/octeon/ethernet-mdio.c +0 -6
@@ -155,12 +155,6 @@ int cvm_oct_phy_setup_device(struct net_ phy_node =of_parse_phandle (priv->of_node,"phy-handle" ,0 );if (!phy_node &&of_phy_is_fixed_link (priv->of_node)) { -int rc; - - rc =of_phy_register_fixed_link (priv->of_node); -if (rc) -return rc; - phy_node =of_node_get (priv->of_node); }if (!phy_node)
drivers/staging/octeon/ethernet.c +9 -0
@@ -16,6 +16,7 @@#include <linux/phy.h> #include <linux/slab.h> #include <linux/interrupt.h> +#include <linux/of_mdio.h> #include <linux/of_net.h> #include <linux/if_ether.h> #include <linux/if_vlan.h>
@@ -880,6 +881,14 @@ static int cvm_oct_probe(struct platformbreak ; } +if (priv->of_node &&of_phy_is_fixed_link (priv->of_node)) { +if (of_phy_register_fixed_link (priv->of_node)) { +netdev_err (dev,"Failed to register fixed link for interface %d, port %d\n" , + interface, priv->port); + dev->netdev_ops =NULL ; + } + } +if (!dev->netdev_ops) {free_netdev (dev); }else if (register_netdev (dev) <0 ) {
Greg Kroah-Hartman
maintainerPATCH 91/117 staging: octeon: Drop on uncorrectable alignment or FCS error
In reply to Greg Kroah-HartmanFrom: Alexander Sverdlin <[email protected]>
commit 49d28ebdf1e30d806410eefc7de0a7a1ca5d747c upstream.
Currently in case of alignment or FCS error if the packet cannot be corrected it's still not dropped. Report the error properly and drop the packet while making the code around a little bit more readable.
--- drivers/staging/octeon/ethernet-rx.c | 34 +++++++++++++++++++--------------- 1 file changed, 19 insertions(+), 15 deletions(-)
drivers/staging/octeon/ethernet-rx.c +19 -15
@@ -83,15 +83,17 @@ static inline int cvm_oct_check_rcv_erroelse port = work->word1.cn38xx.ipprt; -if ((work->word2.snoip.err_code ==10 ) && (work->word1.len <=64 )) { +if ((work->word2.snoip.err_code ==10 ) && (work->word1.len <=64 ))/* * Ignore length errors on min size packets. Some * equipment incorrectly pads packets to 64+4FCS * instead of 60+4FCS. Note these packets still get * counted as frame errors. */ - }else if (work->word2.snoip.err_code ==5 || - work->word2.snoip.err_code ==7 ) { +return 0 ; + +if (work->word2.snoip.err_code ==5 || + work->word2.snoip.err_code ==7 ) {/* * We received a packet with either an alignment error * or a FCS error. This may be signalling that we are
@@ -122,7 +124,10 @@ static inline int cvm_oct_check_rcv_erro/* Port received 0xd5 preamble */ work->packet_ptr.s.addr += i +1 ; work->word1.len -= i +5 ; - }else if ((*ptr &0xf ) ==0xd ) { +return 0 ; + } + +if ((*ptr &0xf ) ==0xd ) {/* Port received 0xd preamble */ work->packet_ptr.s.addr += i; work->word1.len -= i +4 ;
@@ -132,21 +137,20 @@ static inline int cvm_oct_check_rcv_erro ((*(ptr +1 ) &0xf ) <<4 ); ptr++; } - }else { -printk_ratelimited ("Port %d unknown preamble, packet dropped\n" , - port); -cvm_oct_free_work (work); -return 1 ; +return 0 ; } + +printk_ratelimited ("Port %d unknown preamble, packet dropped\n" , + port); +cvm_oct_free_work (work); +return 1 ; } - }else { -printk_ratelimited ("Port %d receive error code %d, packet dropped\n" , - port, work->word2.snoip.err_code); -cvm_oct_free_work (work); -return 1 ; } -return 0 ; +printk_ratelimited ("Port %d receive error code %d, packet dropped\n" , + port, work->word2.snoip.err_code); +cvm_oct_free_work (work); +return 1 ; }static int cvm_oct_poll (struct oct_rx_group *rx_group,int budget)
Greg Kroah-Hartman
maintainerPATCH 92/117 xen/events: dont use chip_data for legacy IRQs
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 0891fb39ba67bd7ae023ea0d367297ffff010781 upstream.
Since commit c330fb1ddc0a ("XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.") Xen is using the chip_data pointer for storing IRQ specific data. When
running as a HVM domain this can result in problems for legacy IRQs, as
those might use chip_data for their own purposes.
Use a local array for this purpose in case of legacy IRQs, avoiding the double use.
--- drivers/xen/events/events_base.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/xen/events/events_base.c +21 -8
@@ -91,6 +91,8 @@ static bool (*pirq_needs_eoi)(unsigned i/* Xen will never allocate port zero for any purpose. */ #define VALID_EVTCHN (chn) ((chn) != 0) +static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY ]; +static struct irq_chip xen_dynamic_chip;static struct irq_chip xen_percpu_chip;static struct irq_chip xen_pirq_chip;
@@ -155,7 +157,18 @@ int get_evtchn_to_irq(unsigned evtchn)/* Get info for IRQ */ struct irq_info *info_for_irq (unsigned irq) { -return irq_get_chip_data (irq); +if (irq <nr_legacy_irqs ()) +return legacy_info_ptrs[irq]; +else +return irq_get_chip_data (irq); +} + +static void set_info_for_irq (unsigned int irq,struct irq_info *info) +{ +if (irq <nr_legacy_irqs ()) + legacy_info_ptrs[irq] = info; +else +irq_set_chip_data (irq, info); }/* Constructors for packed IRQ information. */
@@ -384,7 +397,7 @@ static void xen_irq_init(unsigned irq) info->type =IRQT_UNBOUND ; info->refcnt =-1 ; -irq_set_chip_data (irq, info); +set_info_for_irq (irq, info);list_add_tail (&info->list, &xen_irq_list_head); }
@@ -433,14 +446,14 @@ static int __must_check xen_allocate_irqstatic void xen_free_irq (unsigned irq) { -struct irq_info *info =irq_get_chip_data (irq); +struct irq_info *info =info_for_irq (irq);if (WARN_ON (!info))return ;list_del (&info->list); -irq_set_chip_data (irq,NULL ); +set_info_for_irq (irq,NULL );WARN_ON (info->refcnt >0 );
@@ -610,7 +623,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);static void __unbind_from_irq (unsigned int irq) {int evtchn =evtchn_from_irq (irq); -struct irq_info *info =irq_get_chip_data (irq); +struct irq_info *info =info_for_irq (irq);if (info->refcnt >0 ) { info->refcnt--;
@@ -1114,7 +1127,7 @@ int bind_ipi_to_irqhandler(enum ipi_vectvoid unbind_from_irqhandler (unsigned int irq,void *dev_id) { -struct irq_info *info =irq_get_chip_data (irq); +struct irq_info *info =info_for_irq (irq);if (WARN_ON (!info))return ;
@@ -1148,7 +1161,7 @@ int evtchn_make_refcounted(unsigned intif (irq ==-1 )return -ENOENT ; - info =irq_get_chip_data (irq); + info =info_for_irq (irq);if (!info)return -ENOENT ;
@@ -1176,7 +1189,7 @@ int evtchn_get(unsigned int evtchn)if (irq ==-1 ) goto done; - info =irq_get_chip_data (irq); + info =info_for_irq (irq);if (!info) goto done;
Greg Kroah-Hartman
maintainerPATCH 93/117 tipc: fix use-after-free in tipc_bcast_get_mode
In reply to Greg Kroah-HartmanFrom: Hoang Huu Le <[email protected]>
commit fdeba99b1e58ecd18c2940c453e19e4ef20ff591 upstream.
Syzbot has reported those issues as:
==================================================================
BUG: KASAN: use-after-free in tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 Read of size 1 at addr ffff88805e6b3571 by task kworker/0:6/3850 CPU: 0 PID: 3850 Comm: kworker/0:6 Not tainted 5.8.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work
Thread 1's call trace:
[...]
kfree+0x103/0x2c0 mm/slab.c:3757 <- bcbase releasing tipc_bcast_stop+0x1b0/0x2f0 net/tipc/bcast.c:721 tipc_exit_net+0x24/0x270 net/tipc/core.c:112
[...]
Thread 2's call trace:
[...]
tipc_bcast_get_mode+0x3ab/0x400 net/tipc/bcast.c:759 <- bcbase
has already been freed by Thread 1
tipc_node_broadcast+0x9e/0xcc0 net/tipc/node.c:1744 tipc_nametbl_publish+0x60b/0x970 net/tipc/name_table.c:752 tipc_net_finalize net/tipc/net.c:141 [inline] tipc_net_finalize+0x1fa/0x310 net/tipc/net.c:131 tipc_net_finalize_work+0x55/0x80 net/tipc/net.c:150
[...]
==================================================================
BUG: KASAN: use-after-free in tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 Read of size 8 at addr ffff888052ab2000 by task kworker/0:13/30628 CPU: 0 PID: 30628 Comm: kworker/0:13 Not tainted 5.8.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events tipc_net_finalize_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1f0/0x31e lib/dump_stack.c:118 print_address_description+0x66/0x5a0 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report+0x132/0x1d0 mm/kasan/report.c:530 tipc_named_reinit+0xef/0x290 net/tipc/name_distr.c:344 tipc_net_finalize+0x85/0xe0 net/tipc/net.c:138 tipc_net_finalize_work+0x50/0x70 net/tipc/net.c:150 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293 [...] Freed by task 14058: save_stack mm/kasan/common.c:48 [inline] set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0x114/0x170 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kfree+0x10a/0x220 mm/slab.c:3757 tipc_exit_net+0x29/0x50 net/tipc/core.c:113 ops_exit_list net/core/net_namespace.c:186 [inline] cleanup_net+0x708/0xba0 net/core/net_namespace.c:603 process_one_work+0x789/0xfc0 kernel/workqueue.c:2269 worker_thread+0xaa4/0x1460 kernel/workqueue.c:2415 kthread+0x37e/0x3a0 drivers/block/aoe/aoecmd.c:1234 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:293
Fix it by calling flush_scheduled_work() to make sure the tipc_net_finalize_work() stopped before releasing bcbase object.
--- net/tipc/core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/tipc/core.c +5 -0
@@ -89,6 +89,11 @@ out_sk_rht: static void __net_exit tipc_exit_net(struct net *net) {tipc_net_stop (net); + +/* Make sure the tipc_net_finalize_work stopped +* before releasing the resources. +*/ +flush_scheduled_work ();tipc_bcast_stop (net);tipc_nametbl_stop (net);tipc_sk_rht_destroy (net);
Greg Kroah-Hartman
maintainerPATCH 94/117 gianfar: Replace skb_realloc_headroom with skb_cow_head for PTP
In reply to Greg Kroah-HartmanFrom: Claudiu Manoil <[email protected]>
[ Upstream commit d145c9031325fed963a887851d9fa42516efd52b ]
When PTP timestamping is enabled on Tx, the controller inserts the Tx timestamp at the beginning of the frame buffer, between SFD and the L2 frame header. This means that the skb provided by the stack is required to have enough headroom otherwise a new skb needs to be created by the driver to accommodate the timestamp inserted by h/w. Up until now the driver was relying on skb_realloc_headroom() to create new skbs to accommodate PTP frames. Turns out that this method is not reliable in this context at least, as skb_realloc_headroom() for PTP frames can cause random crashes, mostly in subsequent skb_*() calls, when multiple concurrent TCP streams are run at the same time with the PTP flow on the same device (as seen in James' report). I also noticed that when the system is loaded by sending multiple TCP streams, the driver receives cloned skbs in large numbers. skb_cow_head() instead proves to be stable in this scenario, and not only handles cloned skbs too but it's also more efficient and widely used in other drivers.
The commit introducing skb_realloc_headroom in the driver goes back to 2009, commit 93c1285c5d92
("gianfar: reallocate skb when headroom is not enough for fcb"). For practical purposes I'm referencing a newer commit (from 2012) that brings the code to its current structure (and fixes the PTP case).
--- drivers/net/ethernet/freescale/gianfar.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-)
drivers/net/ethernet/freescale/gianfar.c +2 -10
@@ -2367,20 +2367,12 @@ static int gfar_start_xmit(struct sk_buf fcb_len =GMAC_FCB_LEN +GMAC_TXPAL_LEN ;/* make space for additional header when fcb is needed */ -if (fcb_len &&unlikely (skb_headroom (skb) < fcb_len)) { -struct sk_buff *skb_new; - - skb_new =skb_realloc_headroom (skb, fcb_len); -if (!skb_new) { +if (fcb_len) { +if (unlikely (skb_cow_head (skb, fcb_len))) { dev->stats.tx_errors++;dev_kfree_skb_any (skb);return NETDEV_TX_OK ; } - -if (skb->sk) -skb_set_owner_w (skb_new, skb->sk); -dev_consume_skb_any (skb); - skb = skb_new; }/* total number of fragments in the SKB */
Greg Kroah-Hartman
maintainerPATCH 95/117 gianfar: Account for Tx PTP timestamp in the skb headroom
In reply to Greg Kroah-HartmanFrom: Claudiu Manoil <[email protected]>
[ Upstream commit d6a076d68c6b5d6a5800f3990a513facb7016dea ]
When PTP timestamping is enabled on Tx, the controller inserts the Tx timestamp at the beginning of the frame buffer, between SFD and the L2 frame header. This means that the skb provided by the stack is required to have enough headroom otherwise a new skb needs to be created by the driver to accommodate the timestamp inserted by h/w. Up until now the driver was relying on the second option, using skb_realloc_headroom() to create a new skb to accommodate PTP frames. Turns out that this method is not reliable, as reallocation of skbs for PTP frames along with the required overhead (skb_set_owner_w, consume_skb) is causing random crashes in subsequent skb_*() calls, when multiple concurrent TCP streams are run at the same time on the same device (as seen in James' report).
Note that these crashes don't occur with a single TCP stream, nor with multiple concurrent UDP streams, but only when multiple TCP streams are run concurrently with the PTP packet flow (doing skb reallocation).
This patch enforces the first method, by requesting enough headroom from the stack to accommodate PTP frames, and so avoiding skb_realloc_headroom() & co, and the crashes no longer occur. There's no reason not to set needed_headroom to a large enough value to accommodate PTP frames, so in this regard this patch is a fix.
--- drivers/net/ethernet/freescale/gianfar.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/freescale/gianfar.c +1 -1
@@ -1385,7 +1385,7 @@ static int gfar_probe(struct platform_deif (dev->features &NETIF_F_IP_CSUM || priv->device_flags &FSL_GIANFAR_DEV_HAS_TIMER ) - dev->needed_headroom =GMAC_FCB_LEN ; + dev->needed_headroom =GMAC_FCB_LEN +GMAC_TXPAL_LEN ;/* Initializing some of the rx/tx queue level parameters */ for (i =0 ; i < priv->num_tx_queues; i++) {
Greg Kroah-Hartman
maintainerPATCH 96/117 Fonts: Replace discarded const qualifier
In reply to Greg Kroah-HartmanFrom: Lee Jones <[email protected]>
commit 9522750c66c689b739e151fcdf895420dc81efc0 upstream.
Commit 6735b4632def ("Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts") introduced the following error when building rpc_defconfig (only this build appears to be affected):
acorndata_8x8' referenced in section .text' of arch/arm/boot/compressed/ll_char_wr.o:
defined in discarded section `.data' of arch/arm/boot/compressed/font.o
acorndata_8x8' referenced in section .data.rel.ro' of arch/arm/boot/compressed/font.o:
defined in discarded section `.data' of arch/arm/boot/compressed/font.o
make[3]: *** [/scratch/linux/arch/arm/boot/compressed/Makefile:191: arch/arm/boot/compressed/vmlinux] Error 1 make[2]: *** [/scratch/linux/arch/arm/boot/Makefile:61: arch/arm/boot/compressed/vmlinux] Error 2 make[1]: *** [/scratch/linux/arch/arm/Makefile:317: zImage] Error 2
The .data section is discarded at link time. Reinstating acorndata_8x8 as const ensures it is still available after linking. Do the same for the other 12 built-in fonts as well, for consistency purposes.
--- lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-)
lib/fonts/font_10x18.c +1 -1
@@ -7,7 +7,7 @@#define FONTDATAMAX 9216 -static struct font_data fontdata_10x18 = { +static const struct font_data fontdata_10x18 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,0x00 ,/* 0000000000 */
lib/fonts/font_6x10.c +1 -1
@@ -2,7 +2,7 @@#define FONTDATAMAX 2560 -static struct font_data fontdata_6x10 = { +static const struct font_data fontdata_6x10 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 00000000 */
lib/fonts/font_6x11.c +1 -1
@@ -8,7 +8,7 @@#define FONTDATAMAX (11*256) -static struct font_data fontdata_6x11 = { +static const struct font_data fontdata_6x11 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 00000000 */
lib/fonts/font_7x14.c +1 -1
@@ -7,7 +7,7 @@#define FONTDATAMAX 3584 -static struct font_data fontdata_7x14 = { +static const struct font_data fontdata_7x14 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 0000000 */
lib/fonts/font_8x16.c +1 -1
@@ -9,7 +9,7 @@#define FONTDATAMAX 4096 -static struct font_data fontdata_8x16 = { +static const struct font_data fontdata_8x16 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 00000000 */
lib/fonts/font_8x8.c +1 -1
@@ -8,7 +8,7 @@#define FONTDATAMAX 2048 -static struct font_data fontdata_8x8 = { +static const struct font_data fontdata_8x8 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 00000000 */
lib/fonts/font_acorn_8x8.c +1 -1
@@ -4,7 +4,7 @@#define FONTDATAMAX 2048 -static struct font_data acorndata_8x8 = { +static const struct font_data acorndata_8x8 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 00 */ 0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,/* ^@ */ /* 01 */ 0x7e ,0x81 ,0xa5 ,0x81 ,0xbd ,0x99 ,0x81 ,0x7e ,/* ^A */
lib/fonts/font_mini_4x6.c +1 -1
@@ -43,7 +43,7 @@ __END__;#define FONTDATAMAX 1536 -static struct font_data fontdata_mini_4x6 = { +static const struct font_data fontdata_mini_4x6 = { {0 ,0 ,FONTDATAMAX ,0 }, {/*{*/ /* Char 0: ' ' */
lib/fonts/font_pearl_8x8.c +1 -1
@@ -13,7 +13,7 @@#define FONTDATAMAX 2048 -static struct font_data fontdata_pearl8x8 = { +static const struct font_data fontdata_pearl8x8 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,/* 00000000 */
lib/fonts/font_sun12x22.c +1 -1
@@ -2,7 +2,7 @@#define FONTDATAMAX 11264 -static struct font_data fontdata_sun12x22 = { +static const struct font_data fontdata_sun12x22 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* 0 0x00 '^@' */ 0x00 ,0x00 ,/* 000000000000 */
lib/fonts/font_sun8x16.c +1 -1
@@ -2,7 +2,7 @@#define FONTDATAMAX 4096 -static struct font_data fontdata_sun8x16 = { +static const struct font_data fontdata_sun8x16 = { {0 ,0 ,FONTDATAMAX ,0 }, {/* */ 0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,0x00 ,/* */ 0x00 ,0x00 ,0x7e ,0x81 ,0xa5 ,0x81 ,0x81 ,0xbd ,0x99 ,0x81 ,0x81 ,0x7e ,0x00 ,0x00 ,0x00 ,0x00 ,
Greg Kroah-Hartman
maintainerPATCH 97/117 ALSA: usb-audio: Add implicit feedback quirk for Qu-16
In reply to Greg Kroah-HartmanFrom: Geoffrey D. Bennett <[email protected]>
commit 0938ecae432e7ac8b01080c35dd81d50a1e43033 upstream.
This patch fixes audio distortion on playback for the Allen&Heath Qu-16.
--- sound/usb/pcm.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/pcm.c +1 -0
@@ -332,6 +332,7 @@ static int set_sync_ep_implicit_fb_quirkswitch (subs->stream->chip->usb_id) {case USB_ID (0x0763 ,0x2030 ):/* M-Audio Fast Track C400 */ case USB_ID (0x0763 ,0x2031 ):/* M-Audio Fast Track C600 */ +case USB_ID (0x22f0 ,0x0006 ):/* Allen&Heath Qu-16 */ ep =0x81 ; iface =usb_ifnum_to_if (dev,3 );
Greg Kroah-Hartman
maintainerPATCH 98/117 kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled
In reply to Greg Kroah-HartmanFrom: Zqiang <[email protected]>
commit 6993d0fdbee0eb38bfac350aa016f65ad11ed3b1 upstream.
There is a small race window when a delayed work is being canceled and the work still might be queued from the timer_fn:
CPU0 CPU1
kthread_cancel_delayed_work_sync()
__kthread_cancel_work_sync()
__kthread_cancel_work()
work->canceling++;
kthread_delayed_work_timer_fn()
kthread_insert_work();BUG: kthread_insert_work() should not get called when work->canceling is
set.
--- kernel/kthread.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/kthread.c +2 -1
@@ -828,7 +828,8 @@ void kthread_delayed_work_timer_fn(unsig/* Move the work from worker->delayed_work_list. */ WARN_ON_ONCE (list_empty (&work->node));list_del_init (&work->node); -kthread_insert_work (worker, work, &worker->work_list); +if (!work->canceling) +kthread_insert_work (worker, work, &worker->work_list);spin_unlock (&worker->lock); }
Greg Kroah-Hartman
maintainerPATCH 99/117 ftrace: Fix recursion check for NMI test
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit ee11b93f95eabdf8198edd4668bf9102e7248270 upstream.
The code that checks recursion will work to only do the recursion check once if there's nested checks. The top one will do the check, the other nested checks will see recursion was already checked and return zero for its "bit". On the return side, nothing will be done if the "bit" is zero.
The problem is that zero is returned for the "good" bit when in NMI context. This will set the bit for NMIs making it look like *all* NMI tracing is recursing, and prevent tracing of anything in NMI context!
The simple fix is to return "bit + 1" and subtract that bit on the end to get the real bit.
--- kernel/trace/trace.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/trace/trace.h +2 -1
@@ -542,7 +542,7 @@ static __always_inline int trace_test_an current->trace_recursion = val;barrier (); -return bit; +return bit +1 ; } static __always_inline void trace_clear_recursion(int bit)
@@ -552,6 +552,7 @@ static __always_inline void trace_clear_if (!bit)return ; + bit--; bit =1 << bit; val &= ~bit;
Greg Kroah-Hartman
maintainerPATCH 100/117 ftrace: Handle tracing when switching between context
In reply to Greg Kroah-HartmanFrom: Steven Rostedt (VMware) <[email protected]>
commit 726b3d3f141fba6f841d715fc4d8a4a84f02c02a upstream.
When an interrupt or NMI comes in and switches the context, there's a delay from when the preempt_count() shows the update. As the preempt_count() is used to detect recursion having each context have its own bit get set when tracing starts, and if that bit is already set, it is considered a recursion and the function exits. But if this happens in that section where context has changed but preempt_count() has not been updated, this will be incorrectly flagged as a recursion.
To handle this case, create another bit call TRANSITION and test it if the current context bit is already set. Flag the call as a recursion if the TRANSITION bit is already set, and if not, set it and continue. The TRANSITION bit will be cleared normally on the return of the function that set it, or if the current context bit is clear, set it and clear the TRANSITION bit to allow for another transition between the current context and an even higher one.
--- kernel/trace/trace.h | 23 +++++++++++++++++++++-- kernel/trace/trace_selftest.c | 9 +++++++-- 2 files changed, 28 insertions(+), 4 deletions(-)
kernel/trace/trace.h +21 -2
@@ -491,6 +491,12 @@ enum {* can only be modified by current, we can reuse trace_recursion. */ TRACE_IRQ_BIT , + +/* +* When transitioning between context, the preempt_count() may +* not be correct. Allow for a single recursion to cover this case. +*/ + TRACE_TRANSITION_BIT, };#define trace_recursion_set (bit) do { (current)->trace_recursion |= (1<<(bit)); } while (0)
@@ -535,8 +541,21 @@ static __always_inline int trace_test_anreturn 0 ; bit =trace_get_context_bit () + start; -if (unlikely (val & (1 << bit))) -return -1 ; +if (unlikely (val & (1 << bit))) { +/* +* It could be that preempt_count has not been updated during +* a switch between contexts. Allow for a single recursion. +*/ + bit =TRACE_TRANSITION_BIT ; +if (trace_recursion_test (bit)) +return -1 ; +trace_recursion_set (bit); +barrier (); +return bit +1 ; + } + +/* Normal check passed, clear the transition to allow it again */ +trace_recursion_clear (TRACE_TRANSITION_BIT ); val |=1 << bit; current->trace_recursion = val;
kernel/trace/trace_selftest.c +7 -2
@@ -490,8 +490,13 @@ trace_selftest_function_recursion(void)unregister_ftrace_function (&test_rec_probe); ret =-1 ; -if (trace_selftest_recursion_cnt !=1 ) { -pr_cont ("*callback not called once (%d)* " , +/* +* Recursion allows for transitions between context, +* and may call the callback twice. +*/ +if (trace_selftest_recursion_cnt !=1 && + trace_selftest_recursion_cnt !=2 ) { +pr_cont ("*callback not called once (or twice) (%d)* " , trace_selftest_recursion_cnt); goto out; }
Greg Kroah-Hartman
maintainerPATCH 101/117 tracing: Fix out of bounds write in get_trace_buf
In reply to Greg Kroah-HartmanFrom: Qiujun Huang <[email protected]>
commit c1acb4ac1a892cf08d27efcb964ad281728b0545 upstream.
The nesting count of trace_printk allows for 4 levels of nesting. The nesting counter starts at zero and is incremented before being used to retrieve the current context's buffer. But the index to the buffer uses the nesting counter after it was incremented, and not its original number, which in needs to do.
--- kernel/trace/trace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/trace/trace.c +1 -1
@@ -2382,7 +2382,7 @@ static char *get_trace_buf(void)/* Interrupts must see nesting incremented before we use the buffer */ barrier (); -return &buffer->buffer[buffer->nesting][0 ]; +return &buffer->buffer[buffer->nesting -1 ][0 ]; }static void put_trace_buf (void )
Greg Kroah-Hartman
maintainerPATCH 102/117 ARM: dts: sun4i-a10: fix cpu_alert temperature
In reply to Greg Kroah-HartmanFrom: Clément Péron <[email protected]>
[ Upstream commit dea252fa41cd8ce332d148444e4799235a8a03ec ]
When running dtbs_check thermal_zone warn about the temperature declared.
thermal-zones: cpu-thermal:trips:cpu-alert0:temperature:0:0: 850000 is greater than the maximum of 200000
It's indeed wrong the real value is 85°C and not 850°C.
--- arch/arm/boot/dts/sun4i-a10.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sun4i-a10.dtsi +1 -1
@@ -144,7 +144,7 @@ trips { cpu_alert0: cpu_alert0 { /* milliCelsius */ - temperature = <850000>; + temperature = <85000>; hysteresis = <2000>; type = "passive"; };
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 103/117 x86/kexec: Use up-to-dated screen_info copy to fill boot params
In reply to Greg Kroah-HartmanFrom: Kairui Song <[email protected]>
[ Upstream commit afc18069a2cb7ead5f86623a5f3d4ad6e21f940d ]
kexec_file_load() currently reuses the old boot_params.screen_info, but if drivers have change the hardware state, boot_param.screen_info could contain invalid info.
For example, the video type might be no longer VGA, or the frame buffer address might be changed. If the kexec kernel keeps using the old screen_info, kexec'ed kernel may attempt to write to an invalid framebuffer memory region.
There are two screen_info instances globally available, boot_params.screen_info and screen_info. Later one is a copy, and is updated by drivers.
So let kexec_file_load use the updated copy.
[ mingo: Tidied up the changelog. ]
--- arch/x86/kernel/kexec-bzimage64.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/x86/kernel/kexec-bzimage64.c +1 -2
@@ -211,8 +211,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params, params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;/* Copying screen_info will do? */ -memcpy (¶ms->screen_info, &boot_params.screen_info, -sizeof (struct screen_info )); +memcpy (¶ms->screen_info, &screen_info,sizeof (struct screen_info ));/* Fill in memsize later */ params->screen_info.ext_mem_k =0 ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 104/117 of: Fix reserved-memory overlap detection
In reply to Greg Kroah-HartmanFrom: Vincent Whitchurch <[email protected]>
[ Upstream commit ca05f33316559a04867295dd49f85aeedbfd6bfd ]
The reserved-memory overlap detection code fails to detect overlaps if either of the regions starts at address 0x0. The code explicitly checks for and ignores such regions, apparently in order to ignore dynamically allocated regions which have an address of 0x0 at this point. These dynamically allocated regions also have a size of 0x0 at this point, so fix this by removing the check and sorting the dynamically allocated regions ahead of any static regions at address 0x0.
For example, there are two overlaps in this case but they are not currently reported:
foo@0 {
reg = <0x0 0x2000>;
};
bar@0 {
reg = <0x0 0x1000>;
};
baz@1000 {
reg = <0x1000 0x1000>;
};
quux {
size = <0x1000>;
};but they are after this patch:
OF: reserved mem: OVERLAP DETECTED!
bar@0 (0x00000000--0x00001000) overlaps with foo@0 (0x00000000--0x00002000)
OF: reserved mem: OVERLAP DETECTED!
foo@0 (0x00000000--0x00002000) overlaps with baz@1000 (0x00001000--0x00002000)
--- drivers/of/of_reserved_mem.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/of/of_reserved_mem.c +11 -2
@@ -222,6 +222,16 @@ static int __init __rmem_cmp(const void *a, const void *b)if (ra->base > rb->base)return 1 ; +/* +* Put the dynamic allocations (address == 0, size == 0) before static +* allocations at address 0x0 so that overlap detection works +* correctly. +*/ +if (ra->size < rb->size) +return -1 ; +if (ra->size > rb->size) +return 1 ; +return 0 ; }
@@ -239,8 +249,7 @@ static void __init __rmem_check_for_overlap(void) this = &reserved_mem[i]; next = &reserved_mem[i +1 ]; -if (!(this->base && next->base)) -continue ; +if (this->base + this->size > next->base) {phys_addr_t this_end, next_end;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 105/117 scsi: core: Dont start concurrent async scan on same host
In reply to Greg Kroah-HartmanFrom: Ming Lei <[email protected]>
[ Upstream commit 831e3405c2a344018a18fcc2665acc5a38c3a707 ]
The current scanning mechanism is supposed to fall back to a synchronous host scan if an asynchronous scan is in progress. However, this rule isn't strictly respected, scsi_prep_async_scan() doesn't hold scan_mutex when checking shost->async_scan. When scsi_scan_host() is called concurrently, two async scans on same host can be started and a hang in do_scan_async() is observed.
Fixes this issue by checking & setting shost->async_scan atomically with shost->scan_mutex.
--- drivers/scsi/scsi_scan.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/scsi/scsi_scan.c +4 -3
@@ -1734,15 +1734,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)*/ static struct async_scan_data *scsi_prep_async_scan (struct Scsi_Host *shost) { -struct async_scan_data *data; +struct async_scan_data *data =NULL ;unsigned long flags;if (strncmp (scsi_scan_type,"sync" ,4 ) ==0 )return NULL ; +mutex_lock (&shost->scan_mutex);if (shost->async_scan) {shost_printk (KERN_DEBUG , shost,"%s called twice\n" , __func__); -return NULL ; + goto err; } data =kmalloc (sizeof (*data),GFP_KERNEL );
@@ -1753,7 +1754,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost) goto err;init_completion (&data->prev_finished); -mutex_lock (&shost->scan_mutex);spin_lock_irqsave (shost->host_lock, flags); shost->async_scan =1 ;spin_unlock_irqrestore (shost->host_lock, flags);
@@ -1768,6 +1768,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)return data; err: +mutex_unlock (&shost->scan_mutex);kfree (data);return NULL ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 106/117 vsock: use ns_capable_noaudit() on socket create
In reply to Greg Kroah-HartmanFrom: Jeff Vander Stoep <[email protected]>
[ Upstream commit af545bb5ee53f5261db631db2ac4cde54038bdaf ]
During __vsock_create() CAP_NET_ADMIN is used to determine if the vsock_sock->trusted should be set to true. This value is used later for determing if a remote connection should be allowed to connect to a restricted VM. Unfortunately, if the caller doesn't have CAP_NET_ADMIN, an audit message such as an selinux denial is generated even if the caller does not want a trusted socket.
Logging errors on success is confusing. To avoid this, switch the capable(CAP_NET_ADMIN) check to the noaudit version.
https://android-review.googlesource.com/c/device/generic/goldfish/+/1468545/
--- net/vmw_vsock/af_vsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/vmw_vsock/af_vsock.c +1 -1
@@ -651,7 +651,7 @@ struct sock *__vsock_create(struct net *net, vsk->owner =get_cred (psk->owner); vsk->connect_timeout = psk->connect_timeout; }else { - vsk->trusted =capable (CAP_NET_ADMIN ); + vsk->trusted =ns_capable_noaudit (&init_user_ns,CAP_NET_ADMIN ); vsk->owner =get_current_cred (); vsk->connect_timeout =VSOCK_DEFAULT_CONNECT_TIMEOUT ; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 107/117 ACPI: NFIT: Fix comparison to -ENXIO
In reply to Greg Kroah-HartmanFrom: Zhang Qilong <[email protected]>
[ Upstream commit 85f971b65a692b68181438e099b946cc06ed499b ]
Initial value of rc is '-ENXIO', and we should
use the initial value to check it.
--- drivers/acpi/nfit/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/acpi/nfit/core.c +1 -1
@@ -1219,7 +1219,7 @@ static ssize_t format1_show(struct device *dev, le16_to_cpu(nfit_dcr->dcr->code));break ; } -if (rc !=ENXIO ) +if (rc != -ENXIO )break ; }mutex_unlock (&acpi_desc->init_mutex);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 108/117 vt: Disable KD_FONT_OP_COPY
In reply to Greg Kroah-HartmanFrom: Daniel Vetter <[email protected]>
commit 3c4e0dff2095c579b142d5a0693257f1c58b4804 upstream.
It's buggy:
Quoted 7 lines · Minh Yuan
We recently discovered a slab-out-of-bounds read in fbcon in the latest kernel ( v5.10-rc2 for now ). The root cause of this vulnerability is that "
fbcon_do_set_font" did not handle "vc->vc_font.data" and "vc->vc_font.height" correctly, and the patch
<https://lkml.org/lkml/2020/9/27/223> forVT_RESIZEXcan't handle this issue.
Quoted 6 lines
Specifically, we use
KD_FONT_OP_SETto set a small font.data for tty6, and useKD_FONT_OP_SETagain to set a large font.height for tty1. After that, we useKD_FONT_OP_COPYto assign tty6's vc_font.data to tty1's vc_font.data in "fbcon_do_set_font", while tty1 retains the original larger height. Obviously, this will cause an out-of-bounds read, because we can access a smaller vc_font.data with a larger vc_font.height.
Further there was only one user ever.
- Android's loadfont, busybox and console-tools only ever use OP_GET and OP_SET
- fbset documentation only mentions the kernel cmdline font: option, not anything else.
- systemd used OP_COPY before release 232 published in Nov 2016
Now unfortunately the crucial report seems to have gone down with gmane, and the commit message doesn't say much. But the pull request hints at OP_COPY being broken
https://github.com/systemd/systemd/pull/3651
So in other words, this never worked, and the only project which foolishly every tried to use it, realized that rather quickly too.
Instead of trying to fix security issues here on dead code by adding missing checks, fix the entire thing by removing the functionality.
Note that systemd code using the OP_COPY function ignored the return value, so it doesn't matter what we're doing here really - just in case a lone server somewhere happens to be extremely unlucky and running an affected old version of systemd. The relevant code from font_copy_to_all_vcs() in systemd was:
/* copy font from active VT, where the font was uploaded to */ cfo.op = KD_FONT_OP_COPY; cfo.height = vcs.v_active-1; /* tty1 == index 0 */ (void) ioctl(vcfd, KDFONTOP, &cfo);
Note this just disables the ioctl, garbage collecting the now unused callbacks is left for -next.
v2: Tetsuo found the old mail, which allowed me to find it on another archive. Add the link too.
--- drivers/tty/vt/vt.c | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-)
drivers/tty/vt/vt.c +2 -22
@@ -4235,27 +4235,6 @@ static int con_font_default(struct vc_dareturn rc; } -static int con_font_copy (struct vc_data *vc,struct console_font_op *op) -{ -int con = op->height; -int rc; - - -console_lock (); -if (vc->vc_mode !=KD_TEXT ) - rc = -EINVAL ; -else if (!vc->vc_sw->con_font_copy) - rc = -ENOSYS ; -else if (con <0 || !vc_cons_allocated (con)) - rc = -ENOTTY ; -else if (con == vc->vc_num)/* nothing to do */ - rc =0 ; -else - rc = vc->vc_sw->con_font_copy (vc, con); -console_unlock (); -return rc; -} -int con_font_op (struct vc_data *vc,struct console_font_op *op) {switch (op->op) {
@@ -4266,7 +4245,8 @@ int con_font_op(struct vc_data *vc, strucase KD_FONT_OP_SET_DEFAULT :return con_font_default (vc, op);case KD_FONT_OP_COPY : -return con_font_copy (vc, op); +/* was buggy and never really used */ +return -EINVAL ; }return -ENOSYS ; }
Greg Kroah-Hartman
maintainerPATCH 109/117 fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent
In reply to Greg Kroah-HartmanFrom: Eddy Wu <[email protected]>
commit b4e00444cab4c3f3fec876dc0cccc8cbb0d1a948 upstream.
current->group_leader->exit_signal may change during copy_process() if current->real_parent exits.
Move the assignment inside tasklist_lock to avoid the race.
--- kernel/fork.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
kernel/fork.c +5 -5
@@ -1734,14 +1734,9 @@ static __latent_entropy struct task_stru/* ok, now we should be set up.. */ p->pid =pid_nr (pid);if (clone_flags &CLONE_THREAD ) { - p->exit_signal =-1 ; p->group_leader = current->group_leader; p->tgid = current->tgid; }else { -if (clone_flags &CLONE_PARENT ) - p->exit_signal = current->group_leader->exit_signal; -else - p->exit_signal = (clone_flags &CSIGNAL ); p->group_leader = p; p->tgid = p->pid; }
@@ -1786,9 +1781,14 @@ static __latent_entropy struct task_struif (clone_flags & (CLONE_PARENT |CLONE_THREAD )) { p->real_parent = current->real_parent; p->parent_exec_id = current->parent_exec_id; +if (clone_flags &CLONE_THREAD ) + p->exit_signal =-1 ; +else + p->exit_signal = current->group_leader->exit_signal; }else { p->real_parent = current; p->parent_exec_id = current->self_exec_id; + p->exit_signal = (clone_flags &CSIGNAL ); }spin_lock (¤t->sighand->siglock);
Greg Kroah-Hartman
maintainerPATCH 110/117 serial: 8250_mtk: Fix uart_get_baud_rate warning
In reply to Greg Kroah-HartmanFrom: Claire Chang <[email protected]>
commit 912ab37c798770f21b182d656937072b58553378 upstream.
Mediatek 8250 port supports speed higher than uartclk / 16. If the baud rates in both the new and the old termios setting are higher than uartclk / 16, the WARN_ON in uart_get_baud_rate() will be triggered. Passing NULL as the old termios so uart_get_baud_rate() will use uartclk / 16 - 1 as the new baud rate which will be replaced by the original baud rate later by tty_termios_encode_baud_rate() in mtk8250_set_termios().
--- drivers/tty/serial/8250/8250_mtk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/8250/8250_mtk.c +1 -1
@@ -56,7 +56,7 @@ mtk8250_set_termios(struct uart_port *po*/ baud =tty_termios_baud_rate (termios); -serial8250_do_set_termios (port, termios, old); +serial8250_do_set_termios (port, termios,NULL );tty_termios_encode_baud_rate (termios, baud, baud);
Greg Kroah-Hartman
maintainerPATCH 111/117 serial: txx9: add missing platform_driver_unregister() on error in serial_txx9_init
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
commit 0c5fc92622ed5531ff324b20f014e9e3092f0187 upstream.
Add the missing platform_driver_unregister() before return from serial_txx9_init in the error handling case when failed to register serial_txx9_pci_driver with macro ENABLE_SERIAL_TXX9_PCI defined.
--- drivers/tty/serial/serial_txx9.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/tty/serial/serial_txx9.c +3 -0
@@ -1287,6 +1287,9 @@ static int __init serial_txx9_init(void)#ifdef ENABLE_SERIAL_TXX9_PCI ret =pci_register_driver (&serial_txx9_pci_driver); +if (ret) { +platform_driver_unregister (&serial_txx9_plat_driver); + }#endif if (ret ==0 ) goto out;
Greg Kroah-Hartman
maintainerPATCH 112/117 USB: serial: cyberjack: fix write-URB completion race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 985616f0457d9f555fff417d0da56174f70cc14f upstream.
The write-URB busy flag was being cleared before the completion handler was done with the URB, something which could lead to corrupt transfers due to a racing write request if the URB is resubmitted.
--- drivers/usb/serial/cyberjack.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/usb/serial/cyberjack.c +6 -1
@@ -367,11 +367,12 @@ static void cyberjack_write_bulk_callbacstruct cyberjack_private *priv =usb_get_serial_port_data (port);struct device *dev = &port->dev;int status = urb->status; +bool resubmitted = false; -set_bit (0 , &port->write_urbs_free);if (status) {dev_dbg (dev,"%s - nonzero write bulk status received: %d\n" , __func__, status); +set_bit (0 , &port->write_urbs_free);return ; }
@@ -404,6 +405,8 @@ static void cyberjack_write_bulk_callbac goto exit; } + resubmitted = true; +dev_dbg (dev,"%s - priv->wrsent=%d\n" , __func__, priv->wrsent);dev_dbg (dev,"%s - priv->wrfilled=%d\n" , __func__, priv->wrfilled);
@@ -420,6 +423,8 @@ static void cyberjack_write_bulk_callbac exit:spin_unlock (&priv->lock); +if (!resubmitted) +set_bit (0 , &port->write_urbs_free);usb_serial_port_softint (port); }
Greg Kroah-Hartman
maintainerPATCH 113/117 USB: serial: option: add LE910Cx compositions 0x1203, 0x1230, 0x1231
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
commit 489979b4aab490b6b917c11dc02d81b4b742784a upstream.
Add following Telit LE910Cx compositions:
0x1203: rndis, tty, adb, tty, tty, tty, tty 0x1230: tty, adb, rmnet, audio, tty, tty, tty, tty 0x1231: rndis, tty, adb, audio, tty, tty, tty, tty
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -1186,6 +1186,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff), /* Telit LE910Cx (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
@@ -1200,6 +1202,10 @@ static const struct usb_device_id option { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff), /* Telit LE910Cx (rmnet) */ + .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff), /* Telit LE910Cx (RNDIS) */ + .driver_info = NCTRL(2) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1260), .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
Greg Kroah-Hartman
maintainerPATCH 114/117 USB: serial: option: add Telit FN980 composition 0x1055
In reply to Greg Kroah-HartmanFrom: Daniele Palmas <[email protected]>
commit db0362eeb22992502764e825c79b922d7467e0eb upstream.
Add the following Telit FN980 composition:
0x1055: tty, adb, tty, tty, tty, tty
--- drivers/usb/serial/option.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/serial/option.c +2 -0
@@ -1174,6 +1174,8 @@ static const struct usb_device_id option .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff), /* Telit FT980-KS */ .driver_info = NCTRL(2) | RSVD(3) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff), /* Telit FN980 (PCIe) */ + .driver_info = NCTRL(0) | RSVD(1) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
Greg Kroah-Hartman
maintainerPATCH 115/117 USB: Add NO_LPM quirk for Kingston flash drive
In reply to Greg Kroah-HartmanFrom: Alan Stern <[email protected]>
commit afaa2e745a246c5ab95103a65b1ed00101e1bc63 upstream.
In Bugzilla #208257, Julien Humbert reports that a 32-GB Kingston flash drive spontaneously disconnects and reconnects, over and over. Testing revealed that disabling Link Power Management for the drive fixed the problem.
This patch adds a quirk entry for that drive to turn off LPM permanently.
--- drivers/usb/core/quirks.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/core/quirks.c +3 -0
@@ -217,6 +217,9 @@ static const struct usb_device_id usb_qu { USB_DEVICE(0x0926, 0x3333), .driver_info = USB_QUIRK_CONFIG_INTF_STRINGS }, + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
Greg Kroah-Hartman
maintainerPATCH 116/117 ARC: stack unwinding: avoid indefinite looping
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
commit 328d2168ca524d501fc4b133d6be076142bd305c upstream.
Currently stack unwinder is a while(1) loop which relies on the dwarf unwinder to signal termination, which in turn relies on dwarf info to do so. This in theory could cause an infinite loop if the dwarf info was somehow messed up or the register contents were etc.
This fix thus detects the excessive looping and breaks the loop.
| Mem: 26184K used, 1009136K free, 0K shrd, 0K buff, 14416K cached | CPU: 0.0% usr 72.8% sys 0.0% nic 27.1% idle 0.0% io 0.0% irq 0.0% sirq | Load average: 4.33 2.60 1.11 2/74 139 | PID PPID USER STAT VSZ %VSZ CPU %CPU COMMAND | 133 2 root SWN 0 0.0 3 22.9 [rcu_torture_rea] | 132 2 root SWN 0 0.0 0 22.0 [rcu_torture_rea] | 131 2 root SWN 0 0.0 3 21.5 [rcu_torture_rea] | 126 2 root RW 0 0.0 2 5.4 [rcu_torture_wri] | 129 2 root SWN 0 0.0 0 0.2 [rcu_torture_fak] | 137 2 root SW 0 0.0 0 0.2 [rcu_torture_cbf] | 127 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] | 138 115 root R 1464 0.1 2 0.1 top | 130 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] | 128 2 root SWN 0 0.0 0 0.1 [rcu_torture_fak] | 115 1 root S 1472 0.1 1 0.0 -/bin/sh | 104 1 root S 1464 0.1 0 0.0 inetd | 1 0 root S 1456 0.1 2 0.0 init | 78 1 root S 1456 0.1 0 0.0 syslogd -O /var/log/messages | 134 2 root SW 0 0.0 2 0.0 [rcu_torture_sta] | 10 2 root IW 0 0.0 1 0.0 [rcu_preempt] | 88 2 root IW 0 0.0 1 0.0 [kworker/1:1-eve] | 66 2 root IW 0 0.0 2 0.0 [kworker/2:2-eve] | 39 2 root IW 0 0.0 2 0.0 [kworker/2:1-eve] | unwinder looping too long, aborting !
--- arch/arc/kernel/stacktrace.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/arc/kernel/stacktrace.c +6 -1
@@ -113,7 +113,7 @@ arc_unwind_core(struct task_struct *tsk, int (*consumer_fn) (unsigned int, void *), void *arg) { #ifdef CONFIG_ARC_DW2_UNWIND - int ret = 0; + int ret = 0, cnt = 0;unsigned int address;struct unwind_frame_info frame_info;
@@ -133,6 +133,11 @@ arc_unwind_core(struct task_struct *tsk,break ; frame_info.regs.r63 = frame_info.regs.r31; + +if (cnt++ >128 ) { +printk ("unwinder looping too long, aborting !\n" ); +return 0 ; + } }return address;/* return the last address it saw */
Greg Kroah-Hartman
maintainerPATCH 117/117 Revert "ARC: entry: fix potential EFA clobber when TIF_SYSCALL_TRACE"
In reply to Greg Kroah-HartmanFrom: Vineet Gupta <[email protected]>
This reverts commit 00fdec98d9881bf5173af09aebd353ab3b9ac729. (but only from 5.2 and prior kernels)
The original commit was a preventive fix based on code-review and was auto-picked for stable back-port (for better or worse).
It was OK for v5.3+ kernels, but turned up needing an implicit change 68e5c6f073bcf70 "(ARC: entry: EV_Trap expects r10 (vs. r9) to have
exception cause)" merged in v5.3 which itself was not backported.
So to summarize the stable backport of this patch for v5.2 and prior kernels is busted and it won't boot.
The obvious solution is backport 68e5c6f073bcf70 but that is a pain as it doesn't revert cleanly and each of affected kernels (so far v4.19, v4.14, v4.9, v4.4) needs a slightly different massaged varaint. So the easier fix is to simply revert the backport from 5.2 and prior. The issue was not a big deal as it would cause strace to sporadically not work correctly.
Waldemar Brodkorb first reported this when running ARC uClibc regressions on latest stable kernels (with offending backport). Once he bisected it, the analysis was trivial, so thx to him for this.
--- arch/arc/kernel/entry.S | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
arch/arc/kernel/entry.S +11 -5
@@ -156,6 +156,7 @@ END(EV_Extension) tracesys: ; save EFA in case tracer wants the PC of traced task ; using ERET won't work since next-PC has already committed + lr r12, [efa] GET_CURR_TASK_FIELD_PTR TASK_THREAD, r11 st r12, [r11, THREAD_FAULT_ADDR] ; thread.fault_address
@@ -198,9 +199,15 @@ tracesys_exit: ; Breakpoint TRAP ; --------------------------------------------- trap_with_param: - mov r0, r12 ; EFA in case ptracer/gdb wants stop_pc + + ; stop_pc info by gdb needs this info + lr r0, [efa] mov r1, sp + ; Now that we have read EFA, it is safe to do "fake" rtie + ; and get out of CPU exception mode + FAKE_RET_FROM_EXCPN + ; Save callee regs in case gdb wants to have a look ; SP will grow up by size of CALLEE Reg-File ; NOTE: clobbers r12
@@ -227,10 +234,6 @@ ENTRY(EV_Trap) EXCEPTION_PROLOGUE - lr r12, [efa] - - FAKE_RET_FROM_EXCPN - ;============ TRAP 1 :breakpoints ; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR) bmsk.f 0, r9, 7
@@ -238,6 +241,9 @@ ENTRY(EV_Trap) ;============ TRAP (no param): syscall top level + ; First return from Exception to pure K mode (Exception/IRQs renabled) + FAKE_RET_FROM_EXCPN + ; If syscall tracing ongoing, invoke pre-post-hooks GET_CURR_THR_INFO_FLAGS r10 btst r10, TIF_SYSCALL_TRACE
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.242 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Nov 2020 12:50:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
10 boots: 10 pass, 0 fail
16 tests: 16 pass, 0 failLinux version: 4.9.242-rc1-g8c35ccda0e15
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.242 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Nov 2020 12:50:04 +0000. Anything received after that time might be too late.
Build results:
total: 168 pass: 168 fail: 0 Qemu test results: total: 382 pass: 382 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.242 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Nov 2020 12:50:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my new AMD Ryzen 7 4700G test system. No major errors/warns to report. This is the baseline for this release.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.242 release. There are 117 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 11 Nov 2020 12:50:04 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.242-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 8c35ccda0e15d9e502046f5a33f6a1e0fdea56d5
git describe: v4.9.241-118-g8c35ccda0e15
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.9.y/build/v4.9.241-118-g8c35ccda0e15
No regressions (compared to build v4.9.241)
No fixes (compared to build v4.9.241)
Ran 29032 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- qemu-arm64-kasan
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- x15 - arm
- x86_64
- x86-kasan
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* perf
* ltp-cve-tests
* network-basic-tests
* v4l2-compliance
* ltp-open-posix-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* kvm-unit-tests
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org