4.4.250-rc1 review
Greg Kroah-Hartman
maintainercover 4.4.250-rc1 review
This is the start of the stable review cycle for the 4.4.250 release. There are 19 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 09 Jan 2021 14:08:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.250-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.250-rc1
Jonathan Cameron <[email protected]>
iio:magnetometer:mag3110: Fix alignment and data leak issues.
Jessica Yu <[email protected]>
module: delay kobject uevent until after module init call
Qinglang Miao <[email protected]>
powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe()
Jan Kara <[email protected]>
quota: Don't overflow quota file offsets
Miroslav Benes <[email protected]>
module: set MODULE_STATE_GOING state when a module fails to load
Takashi Iwai <[email protected]>
ALSA: seq: Use bool for snd_seq_queue internal flags
Mauro Carvalho Chehab <[email protected]>
media: gp8psk: initialize stats at power control logic
Anant Thazhemadam <[email protected]>
misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
Rustam Kovhaev <[email protected]>
reiserfs: add check for an invalid ih_entry_count
Johan Hovold <[email protected]>
of: fix linker-section match-table corruption
Petr Vorel <[email protected]>
uapi: move constants from <linux/kernel.h> to <linux/const.h>
Johan Hovold <[email protected]>
USB: serial: digi_acceleport: fix write-wakeup deadlocks
Stefan Haberland <[email protected]>
s390/dasd: fix hanging device offline processing
Kailang Yang <[email protected]>
ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
Hui Wang <[email protected]>
ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
Kailang Yang <[email protected]>
ALSA: hda/realtek - Support Dell headset mode for ALC3271
Johan Hovold <[email protected]>
ALSA: usb-audio: fix sync-ep altsetting sanity check
Alberto Aguirre <[email protected]>
ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk
Takashi Iwai <[email protected]>
ALSA: hda/ca0132 - Fix work handling in delayed HP detection
-------------
Diffstat:
Makefile | 4 +-- arch/powerpc/sysdev/mpic_msgr.c | 2 +- drivers/iio/magnetometer/mag3110.c | 13 +++++++--- drivers/media/usb/dvb-usb/gp8psk.c | 2 +- drivers/misc/vmw_vmci/vmci_context.c | 2 +- drivers/s390/block/dasd_alias.c | 10 +++++++- drivers/usb/serial/digi_acceleport.c | 45 ++++++++++----------------------- fs/quota/quota_tree.c | 8 +++--- fs/reiserfs/stree.c | 6 +++++ include/linux/of.h | 1 + include/uapi/linux/const.h | 5 ++++ include/uapi/linux/lightnvm.h | 2 +- include/uapi/linux/netfilter/x_tables.h | 2 +- include/uapi/linux/netlink.h | 2 +- include/uapi/linux/sysctl.h | 2 +- kernel/module.c | 6 +++-- sound/core/seq/seq_queue.h | 8 +++--- sound/pci/hda/patch_ca0132.c | 16 ++++++++++-- sound/pci/hda/patch_realtek.c | 25 +++++++++++++++--- sound/usb/pcm.c | 38 ++++++++++++---------------- 20 files changed, 116 insertions(+), 83 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/19 ALSA: hda/ca0132 - Fix work handling in delayed HP detection
From: Takashi Iwai <[email protected]>
commit 42fb6b1d41eb5905d77c06cad2e87b70289bdb76 upstream
CA0132 has the delayed HP jack detection code that is invoked from the unsol handler, but it does a few weird things: it contains the cancel of a work inside the work handler, and yet it misses the cancel-sync call at (runtime-)suspend. This patch addresses those issues.
--- sound/pci/hda/patch_ca0132.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
sound/pci/hda/patch_ca0132.c +14 -2
@@ -4443,11 +4443,10 @@ static void hp_callback(struct hda_codec/* Delay enabling the HP amp, to let the mic-detection * state machine run. */ -cancel_delayed_work (&spec->unsol_hp_work); -schedule_delayed_work (&spec->unsol_hp_work,msecs_to_jiffies (500 )); tbl =snd_hda_jack_tbl_get (codec, cb->nid);if (tbl) tbl->block_report =1 ; +schedule_delayed_work (&spec->unsol_hp_work,msecs_to_jiffies (500 )); }static void amic_callback (struct hda_codec *codec,struct hda_jack_callback *cb)
@@ -4625,12 +4624,25 @@ static void ca0132_free(struct hda_codeckfree (codec->spec); } +#ifdef CONFIG_PM +static int ca0132_suspend (struct hda_codec *codec) +{ +struct ca0132_spec *spec = codec->spec; + +cancel_delayed_work_sync (&spec->unsol_hp_work); +return 0 ; +} +#endif +static struct hda_codec_ops ca0132_patch_ops = { .build_controls = ca0132_build_controls, .build_pcms = ca0132_build_pcms, .init = ca0132_init, .free = ca0132_free, .unsol_event = snd_hda_jack_unsol_event, +#ifdef CONFIG_PM + .suspend = ca0132_suspend, +#endif };static void ca0132_config (struct hda_codec *codec)
Greg Kroah-Hartman
maintainerPATCH 2/19 ALSA: usb-audio: simplify set_sync_ep_implicit_fb_quirk
In reply to Greg Kroah-HartmanFrom: Alberto Aguirre <[email protected]>
commit 103e9625647ad74d201e26fb74afcd8479142a37 upstream
--- sound/usb/pcm.c | 38 ++++++++++++++++---------------------- 1 file changed, 16 insertions(+), 22 deletions(-)
sound/usb/pcm.c +16 -22
@@ -324,6 +324,7 @@ static int set_sync_ep_implicit_fb_quirkstruct usb_host_interface *alts;struct usb_interface *iface;unsigned int ep; +unsigned int ifnum;/* Implicit feedback sync EPs consumers are always playback EPs */ if (subs->direction !=SNDRV_PCM_STREAM_PLAYBACK )
@@ -334,34 +335,19 @@ static int set_sync_ep_implicit_fb_quirkcase USB_ID (0x0763 ,0x2031 ):/* M-Audio Fast Track C600 */ case USB_ID (0x22f0 ,0x0006 ):/* Allen&Heath Qu-16 */ ep =0x81 ; - iface =usb_ifnum_to_if (dev,3 ); - -if (!iface || iface->num_altsetting ==0 ) -return -EINVAL ; - - alts = &iface->altsetting[1 ]; - goto add_sync_ep; -break ; + ifnum =3 ; + goto add_sync_ep_from_ifnum;case USB_ID (0x0763 ,0x2080 ):/* M-Audio FastTrack Ultra */ case USB_ID (0x0763 ,0x2081 ): ep =0x81 ; - iface =usb_ifnum_to_if (dev,2 ); - -if (!iface || iface->num_altsetting ==0 ) -return -EINVAL ; - - alts = &iface->altsetting[1 ]; - goto add_sync_ep; + ifnum =2 ; + goto add_sync_ep_from_ifnum;case USB_ID (0x1397 ,0x0002 ): ep =0x81 ; - iface =usb_ifnum_to_if (dev,1 ); - -if (!iface || iface->num_altsetting ==0 ) -return -EINVAL ; - - alts = &iface->altsetting[1 ]; - goto add_sync_ep; + ifnum =1 ; + goto add_sync_ep_from_ifnum; } + if (attr == USB_ENDPOINT_SYNC_ASYNC && altsd->bInterfaceClass == USB_CLASS_VENDOR_SPEC && altsd->bInterfaceProtocol == 2 &&
@@ -376,6 +362,14 @@ static int set_sync_ep_implicit_fb_quirk/* No quirk */ return 0 ; +add_sync_ep_from_ifnum: + iface =usb_ifnum_to_if (dev, ifnum); + +if (!iface || iface->num_altsetting ==0 ) +return -EINVAL ; + + alts = &iface->altsetting[1 ]; + add_sync_ep: subs->sync_endpoint = snd_usb_add_endpoint(subs->stream->chip, alts, ep, !subs->direction,
Greg Kroah-Hartman
maintainerPATCH 3/19 ALSA: usb-audio: fix sync-ep altsetting sanity check
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 5d1b71226dc4d44b4b65766fa9d74492f9d4587b upstream
The altsetting sanity check in set_sync_ep_implicit_fb_quirk() was checking for there to be at least one altsetting but then went on to access the second one, which may not exist.
This could lead to random slab data being used to initialise the sync endpoint in snd_usb_add_endpoint().
--- sound/usb/pcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/pcm.c +1 -1
@@ -365,7 +365,7 @@ static int set_sync_ep_implicit_fb_quirk add_sync_ep_from_ifnum: iface =usb_ifnum_to_if (dev, ifnum); -if (!iface || iface->num_altsetting ==0 ) +if (!iface || iface->num_altsetting <2 )return -EINVAL ; alts = &iface->altsetting[1 ];
Greg Kroah-Hartman
maintainerPATCH 4/19 ALSA: hda/realtek - Support Dell headset mode for ALC3271
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit fcc6c877a01f83cbce1cca885ea62df6a10d33c3 upstream
Add DELL4_MIC_NO_PRESENCE model.
Add the pin configuration value of this machine into the pin_quirk table to make DELL4_MIC_NO_PRESENCE apply to this machine.
--- sound/pci/hda/patch_realtek.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
sound/pci/hda/patch_realtek.c +16 -0
@@ -4848,6 +4848,7 @@ enum {ALC269_FIXUP_DELL1_MIC_NO_PRESENCE ,ALC269_FIXUP_DELL2_MIC_NO_PRESENCE ,ALC269_FIXUP_DELL3_MIC_NO_PRESENCE , +ALC269_FIXUP_DELL4_MIC_NO_PRESENCE ,ALC269_FIXUP_HEADSET_MODE ,ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC , ALC269_FIXUP_ASPIRE_HEADSET_MIC,
@@ -5150,6 +5151,16 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id =ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC }, + [ALC269_FIXUP_DELL4_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x19 ,0x01a1913c },/* use as headset mic, without its own jack detect */ + {0x1b ,0x01a1913d },/* use as headphone mic, without its own jack detect */ + { } + }, + .chained = true, + .chain_id =ALC269_FIXUP_HEADSET_MODE + }, [ALC269_FIXUP_HEADSET_MODE] = { .type = HDA_FIXUP_FUNC, .v.func = alc_fixup_headset_mode,
@@ -6194,6 +6205,11 @@ static const struct snd_hda_pin_quirk al {0x17, 0x90170110}, {0x1a, 0x03011020}, {0x21, 0x03211030}), +SND_HDA_PIN_QUIRK (0x10ec0299 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE , +ALC225_STANDARD_PINS , + {0x12, 0xb7a60130}, + {0x13, 0xb8a60140}, + {0x17, 0x90170110}), {} };
Greg Kroah-Hartman
maintainerPATCH 5/19 ALSA: hda - Fix a wrong FIXUP for alc289 on Dell machines
In reply to Greg Kroah-HartmanFrom: Hui Wang <[email protected]>
commit d5078193e56bb24f4593f00102a3b5e07bb84ee0 upstream
With the alc289, the Pin 0x1b is Headphone-Mic, so we should assign ALC269_FIXUP_DELL4_MIC_NO_PRESENCE rather than ALC225_FIXUP_DELL1_MIC_NO_PRESENCE to it. And this change is suggested by Kailang of Realtek and is verified on the machine.
--- sound/pci/hda/patch_realtek.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/patch_realtek.c +1 -1
@@ -6121,7 +6121,7 @@ static const struct snd_hda_pin_quirk al {0x12, 0x90a60120}, {0x14, 0x90170110}, {0x21, 0x0321101f}), -SND_HDA_PIN_QUIRK (0x10ec0289 ,0x1028 ,"Dell" ,ALC225_FIXUP_DELL1_MIC_NO_PRESENCE , +SND_HDA_PIN_QUIRK (0x10ec0289 ,0x1028 ,"Dell" ,ALC269_FIXUP_DELL4_MIC_NO_PRESENCE , {0x12, 0xb7a60130}, {0x14, 0x90170110}, {0x21, 0x04211020}),
Greg Kroah-Hartman
maintainerPATCH 6/19 ALSA: hda/realtek - Dell headphone has noise on unmute for ALC236
In reply to Greg Kroah-HartmanFrom: Kailang Yang <[email protected]>
commit e1e8c1fdce8b00fce08784d9d738c60ebf598ebc upstream
headphone have noise even the volume is very small. Let it fill up pcbeep hidden register to default value. The issue was gone.
--- sound/pci/hda/patch_realtek.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
sound/pci/hda/patch_realtek.c +5 -2
@@ -330,9 +330,7 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0225 :case 0x10ec0233 :case 0x10ec0235 : -case 0x10ec0236 :case 0x10ec0255 : -case 0x10ec0256 :case 0x10ec0282 :case 0x10ec0283 :case 0x10ec0286 :
@@ -342,6 +340,11 @@ static void alc_fill_eapd_coef(struct hdcase 0x10ec0299 :alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 );break ; +case 0x10ec0236 : +case 0x10ec0256 : +alc_write_coef_idx (codec,0x36 ,0x5757 ); +alc_update_coef_idx (codec,0x10 ,1 <<9 ,0 ); +break ;case 0x10ec0285 :case 0x10ec0293 :alc_update_coef_idx (codec,0xa ,1 <<13 ,0 );
Greg Kroah-Hartman
maintainerPATCH 7/19 s390/dasd: fix hanging device offline processing
In reply to Greg Kroah-HartmanFrom: Stefan Haberland <[email protected]>
[ Upstream commit 658a337a606f48b7ebe451591f7681d383fa115e ]
For an LCU update a read unit address configuration IO is required. This is started using sleep_on(), which has early exit paths in case the device is not usable for IO. For example when it is in offline processing.
In those cases the LCU update should fail and not be retried. Therefore lcu_update_work checks if EOPNOTSUPP is returned or not.
Commit 41995342b40c ("s390/dasd: fix endless loop after read unit address configuration") accidentally removed the EOPNOTSUPP return code from read_unit_address_configuration(), which in turn might lead to an endless loop of the LCU update in offline processing.
Fix by returning EOPNOTSUPP again if the device is not able to perform the request.
--- drivers/s390/block/dasd_alias.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/s390/block/dasd_alias.c +9 -1
@@ -475,11 +475,19 @@ static int read_unit_address_configuration(struct dasd_device *device,spin_unlock_irqrestore (&lcu->lock, flags); rc =dasd_sleep_on (cqr); -if (rc && !suborder_not_supported (cqr)) { +if (!rc) + goto out; + +if (suborder_not_supported (cqr)) { +/* suborder not supported or device unusable for IO */ + rc = -EOPNOTSUPP ; + }else { +/* IO failed but should be retried */ spin_lock_irqsave (&lcu->lock, flags); lcu->flags |=NEED_UAC_UPDATE ;spin_unlock_irqrestore (&lcu->lock, flags); } +out:dasd_kfree_request (cqr, cqr->memdev);return rc; }
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 8/19 USB: serial: digi_acceleport: fix write-wakeup deadlocks
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 5098e77962e7c8947f87bd8c5869c83e000a522a ]
The driver must not call tty_wakeup() while holding its private lock as line disciplines are allowed to call back into write() from write_wakeup(), leading to a deadlock.
Also remove the unneeded work struct that was used to defer wakeup in order to work around a possible race in ancient times (see comment about n_tty write_chan() in commit 14b54e39b412 ("USB: serial: remove changelogs and old todo entries")).
--- drivers/usb/serial/digi_acceleport.c | 45 ++++++++++------------------------- 1 file changed, 13 insertions(+), 32 deletions(-)
drivers/usb/serial/digi_acceleport.c +13 -32
@@ -23,7 +23,6 @@#include <linux/tty_flip.h> #include <linux/module.h> #include <linux/spinlock.h> -#include <linux/workqueue.h> #include <linux/uaccess.h> #include <linux/usb.h> #include <linux/wait.h>
@@ -201,14 +200,12 @@ struct digi_port {int dp_throttle_restart;wait_queue_head_t dp_flush_wait;wait_queue_head_t dp_close_wait;/* wait queue for close */ -struct work_struct dp_wakeup_work;struct usb_serial_port *dp_port; };/* Local Function Declarations */ -static void digi_wakeup_write_lock (struct work_struct *work);static int digi_write_oob_command (struct usb_serial_port *port,unsigned char *buf,int count,int interruptible); static int digi_write_inb_command(struct usb_serial_port *port,
@@ -355,26 +352,6 @@ __releases(lock)return timeout; } - -/* -* Digi Wakeup Write -* -* Wake up port, line discipline, and tty processes sleeping -* on writes. -*/ - -static void digi_wakeup_write_lock (struct work_struct *work) -{ -struct digi_port *priv = - container_of(work, struct digi_port, dp_wakeup_work); -struct usb_serial_port *port = priv->dp_port; -unsigned long flags; - -spin_lock_irqsave (&priv->dp_port_lock, flags); -tty_port_tty_wakeup (&port->port); -spin_unlock_irqrestore (&priv->dp_port_lock, flags); -} -/* * Digi Write OOB Command *
@@ -986,6 +963,7 @@ static void digi_write_bulk_callback(strstruct digi_serial *serial_priv;int ret =0 ;int status = urb->status; +bool wakeup;/* port and serial sanity check */ if (port ==NULL || (priv =usb_get_serial_port_data (port)) ==NULL ) {
@@ -1012,6 +990,7 @@ static void digi_write_bulk_callback(str }/* try to send any buffered data on this port */ + wakeup = true;spin_lock (&priv->dp_port_lock); priv->dp_write_urb_in_use =0 ;if (priv->dp_out_buf_len >0 ) {
@@ -1027,19 +1006,18 @@ static void digi_write_bulk_callback(strif (ret ==0 ) { priv->dp_write_urb_in_use =1 ; priv->dp_out_buf_len =0 ; + wakeup = false; } } -/* wake up processes sleeping on writes immediately */ -tty_port_tty_wakeup (&port->port); -/* also queue up a wakeup at scheduler time, in case we */ -/* lost the race in write_chan(). */ -schedule_work (&priv->dp_wakeup_work); -spin_unlock (&priv->dp_port_lock); +if (ret && ret != -EPERM )dev_err_console (port,"%s: usb_submit_urb failed, ret=%d, port=%d\n" , __func__, ret, priv->dp_port_num); + +if (wakeup) +tty_port_tty_wakeup (&port->port); }static int digi_write_room (struct tty_struct *tty)
@@ -1239,7 +1217,6 @@ static int digi_port_init(struct usb_serinit_waitqueue_head (&priv->dp_transmit_idle_wait);init_waitqueue_head (&priv->dp_flush_wait);init_waitqueue_head (&priv->dp_close_wait); -INIT_WORK (&priv->dp_wakeup_work, digi_wakeup_write_lock); priv->dp_port = port;init_waitqueue_head (&port->write_wait);
@@ -1525,13 +1502,14 @@ static int digi_read_oob_callback(struct rts = tty->termios.c_cflag &CRTSCTS ;if (tty && opcode ==DIGI_CMD_READ_INPUT_SIGNALS ) { +bool wakeup = false; +spin_lock (&priv->dp_port_lock);/* convert from digi flags to termiox flags */ if (val &DIGI_READ_INPUT_SIGNALS_CTS ) { priv->dp_modem_signals |=TIOCM_CTS ; -/* port must be open to use tty struct */ if (rts) -tty_port_tty_wakeup (&port->port); + wakeup = true; }else { priv->dp_modem_signals &= ~TIOCM_CTS ;/* port must be open to use tty struct */
@@ -1550,6 +1528,9 @@ static int digi_read_oob_callback(struct priv->dp_modem_signals &= ~TIOCM_CD ;spin_unlock (&priv->dp_port_lock); + +if (wakeup) +tty_port_tty_wakeup (&port->port); }else if (opcode ==DIGI_CMD_TRANSMIT_IDLE ) {spin_lock (&priv->dp_port_lock); priv->dp_transmit_idle =1 ;
Greg Kroah-Hartman
maintainerPATCH 9/19 uapi: move constants from <linux/kernel.h> to <linux/const.h>
In reply to Greg Kroah-HartmanFrom: Petr Vorel <[email protected]>
commit a85cbe6159ffc973e5702f70a3bd5185f8f3c38d upstream.
and include <linux/const.h> in UAPI headers instead of <linux/kernel.h>.
The reason is to avoid indirect <linux/sysinfo.h> include when using some network headers: <linux/netlink.h> or others -> <linux/kernel.h> -> <linux/sysinfo.h>.
This indirect include causes on MUSL redefinition of struct sysinfo when included both <sys/sysinfo.h> and some of UAPI headers:
In file included from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/kernel.h:5,
from x86_64-buildroot-linux-musl/sysroot/usr/include/linux/netlink.h:5,
from ../include/tst_netlink.h:14,
from tst_crypto.c:13:
x86_64-buildroot-linux-musl/sysroot/usr/include/linux/sysinfo.h:8:8: error: redefinition of `struct sysinfo'
struct sysinfo {
^~~~~~~
In file included from ../include/tst_safe_macros.h:15,
from ../include/tst_test.h:93,
from tst_crypto.c:11:
x86_64-buildroot-linux-musl/sysroot/usr/include/sys/sysinfo.h:10:8: note: originally defined here--- include/uapi/linux/const.h | 5 +++++ include/uapi/linux/lightnvm.h | 2 +- include/uapi/linux/netfilter/x_tables.h | 2 +- include/uapi/linux/netlink.h | 2 +- include/uapi/linux/sysctl.h | 2 +- 5 files changed, 9 insertions(+), 4 deletions(-)
include/uapi/linux/const.h +5 -0
@@ -24,4 +24,9 @@#define _BITUL (x) (_AC(1,UL) << (x))#define _BITULL (x) (_AC(1,ULL) << (x)) +#define __ALIGN_KERNEL (x, a) __ALIGN_KERNEL_MASK(x, (typeof(x))(a) - 1) +#define __ALIGN_KERNEL_MASK (x, mask) (((x) + (mask)) & ~(mask)) + +#define __KERNEL_DIV_ROUND_UP (n, d) (((n) + (d) - 1) / (d)) +#endif /* !(_LINUX_CONST_H) */
include/uapi/linux/lightnvm.h +1 -1
@@ -20,7 +20,7 @@#define _UAPI_LINUX_LIGHTNVM_H#ifdef __KERNEL__ -#include <linux/kernel.h> +#include <linux/const.h> #include <linux/ioctl.h> #else /* __KERNEL__ */ #include <stdio.h>
include/uapi/linux/netfilter/x_tables.h +1 -1
@@ -1,6 +1,6 @@#ifndef _UAPI_X_TABLES_H#define _UAPI_X_TABLES_H -#include <linux/kernel.h> +#include <linux/const.h> #include <linux/types.h> #define XT_FUNCTION_MAXNAMELEN 30
include/uapi/linux/netlink.h +1 -1
@@ -1,7 +1,7 @@#ifndef _UAPI__LINUX_NETLINK_H#define _UAPI__LINUX_NETLINK_H -#include <linux/kernel.h> +#include <linux/const.h> #include <linux/socket.h> /* for __kernel_sa_family_t */ #include <linux/types.h>
include/uapi/linux/sysctl.h +1 -1
@@ -22,7 +22,7 @@#ifndef _UAPI_LINUX_SYSCTL_H#define _UAPI_LINUX_SYSCTL_H -#include <linux/kernel.h> +#include <linux/const.h> #include <linux/types.h> #include <linux/compiler.h>
Greg Kroah-Hartman
maintainerPATCH 10/19 of: fix linker-section match-table corruption
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 5812b32e01c6d86ba7a84110702b46d8a8531fe9 upstream.
Specify type alignment when declaring linker-section match-table entries to prevent gcc from increasing alignment and corrupting the various tables with padding (e.g. timers, irqchips, clocks, reserved memory).
This is specifically needed on x86 where gcc (typically) aligns larger objects like struct of_device_id with static extent on 32-byte boundaries which at best prevents matching on anything but the first entry. Specifying alignment when declaring variables suppresses this optimisation.
Here's a 64-bit example where all entries are corrupt as 16 bytes of padding has been inserted before the first entry:
ffffffff8266b4b0 D __clk_of_table ffffffff8266b4c0 d __of_table_fixed_factor_clk ffffffff8266b5a0 d __of_table_fixed_clk ffffffff8266b680 d __clk_of_table_sentinel
And here's a 32-bit example where the 8-byte-aligned table happens to be placed on a 32-byte boundary so that all but the first entry are corrupt due to the 28 bytes of padding inserted between entries:
812b3ec0 D __irqchip_of_table 812b3ec0 d __of_table_irqchip1 812b3fa0 d __of_table_irqchip2 812b4080 d __of_table_irqchip3 812b4160 d irqchip_of_match_end
Verified on x86 using gcc-9.3 and gcc-4.9 (which uses 64-byte alignment), and on arm using gcc-7.2.
Note that there are no in-tree users of these tables on x86 currently (even if they are included in the image).
--- include/linux/of.h | 1 + 1 file changed, 1 insertion(+)
include/linux/of.h +1 -0
@@ -941,6 +941,7 @@ static inline int of_get_available_child#define _OF_DECLARE (table, name, compat, fn, fn_type) \ static const struct of_device_id __of_table_##name \ __used __section(__##table##_of_table) \ + __aligned(__alignof__(struct of_device_id)) \ = { .compatible = compat, \ .data = (fn == (fn_type)NULL) ? fn : fn }#else
Greg Kroah-Hartman
maintainerPATCH 11/19 reiserfs: add check for an invalid ih_entry_count
In reply to Greg Kroah-HartmanFrom: Rustam Kovhaev <[email protected]>
commit d24396c5290ba8ab04ba505176874c4e04a2d53c upstream.
when directory item has an invalid value set for ih_entry_count it might trigger use-after-free or out-of-bounds read in bin_search_in_dir_item()
ih_entry_count * IH_SIZE for directory item should not be larger than ih_item_len
--- fs/reiserfs/stree.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/reiserfs/stree.c +6 -0
@@ -453,6 +453,12 @@ static int is_leaf(char *buf, int blocks "(second one): %h", ih);return 0 ; } +if (is_direntry_le_ih (ih) && (ih_item_len (ih) < (ih_entry_count (ih) *IH_SIZE ))) { +reiserfs_warning (NULL ,"reiserfs-5093" , +"item entry count seems wrong %h" , + ih); +return 0 ; + } prev_location =ih_location (ih); }
Greg Kroah-Hartman
maintainerPATCH 12/19 misc: vmw_vmci: fix kernel info-leak by initializing dbells in vmci_ctx_get_chkpt_doorbells()
In reply to Greg Kroah-HartmanFrom: Anant Thazhemadam <[email protected]>
commit 31dcb6c30a26d32650ce134820f27de3c675a45a upstream.
A kernel-infoleak was reported by syzbot, which was caused because dbells was left uninitialized.
Using kzalloc() instead of kmalloc() fixes this issue.
--- drivers/misc/vmw_vmci/vmci_context.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/vmw_vmci/vmci_context.c +1 -1
@@ -750,7 +750,7 @@ static int vmci_ctx_get_chkpt_doorbells(return VMCI_ERROR_MORE_DATA ; } - dbells =kmalloc (data_size,GFP_ATOMIC ); + dbells =kzalloc (data_size,GFP_ATOMIC );if (!dbells)return VMCI_ERROR_NO_MEM ;
Greg Kroah-Hartman
maintainerPATCH 13/19 media: gp8psk: initialize stats at power control logic
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
commit d0ac1a26ed5943127cb0156148735f5f52a07075 upstream.
As reported on:
https://lore.kernel.org/linux-media/[email protected]/
if gp8psk_usb_in_op() returns an error, the status var is not initialized. Yet, this var is used later on, in order to identify:
- if the device was already started;
- if firmware has loaded;
- if the LNBf was powered on.
Using status = 0 seems to ensure that everything will be properly powered up.
So, instead of the proposed solution, let's just set status = 0.
--- drivers/media/usb/dvb-usb/gp8psk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/dvb-usb/gp8psk.c +1 -1
@@ -163,7 +163,7 @@ out_rel_fw:static int gp8psk_power_ctrl (struct dvb_usb_device *d,int onoff) { -u8 status, buf; +u8 status =0 , buf;int gp_product_id =le16_to_cpu (d->udev->descriptor.idProduct);if (onoff) {
Greg Kroah-Hartman
maintainerPATCH 14/19 ALSA: seq: Use bool for snd_seq_queue internal flags
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 4ebd47037027c4beae99680bff3b20fdee5d7c1e upstream.
The snd_seq_queue struct contains various flags in the bit fields. Those are categorized to two different use cases, both of which are protected by different spinlocks. That implies that there are still potential risks of the bad operations for bit fields by concurrent accesses.
For addressing the problem, this patch rearranges those flags to be a standard bool instead of a bit field.
--- sound/core/seq/seq_queue.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
sound/core/seq/seq_queue.h +4 -4
@@ -40,10 +40,10 @@ struct snd_seq_queue {struct snd_seq_timer *timer;/* time keeper for this queue */ int owner;/* client that 'owns' the timer */ - unsigned int locked:1, /* timer is only accesibble by owner if set */ - klocked:1, /* kernel lock (after START) */ - check_again:1, - check_blocked:1; +bool locked;/* timer is only accesibble by owner if set */ +bool klocked;/* kernel lock (after START) */ +bool check_again;/* concurrent access happened during check */ +bool check_blocked;/* queue being checked */ unsigned int flags;/* status flags */ unsigned int info_flags;/* info for sync */
Greg Kroah-Hartman
maintainerPATCH 15/19 module: set MODULE_STATE_GOING state when a module fails to load
In reply to Greg Kroah-HartmanFrom: Miroslav Benes <[email protected]>
[ Upstream commit 5e8ed280dab9eeabc1ba0b2db5dbe9fe6debb6b5 ]
If a module fails to load due to an error in prepare_coming_module(), the following error handling in load_module() runs with MODULE_STATE_COMING in module's state. Fix it by correctly setting MODULE_STATE_GOING under "bug_cleanup" label.
--- kernel/module.c | 1 + 1 file changed, 1 insertion(+)
kernel/module.c +1 -0
@@ -3589,6 +3589,7 @@ static int load_module(struct load_info *info, const char __user *uargs,return do_init_module (mod); bug_cleanup: + mod->state =MODULE_STATE_GOING ;/* module_bug_cleanup needs module_mutex protection */ mutex_lock (&module_mutex);module_bug_cleanup (mod);
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 16/19 quota: Dont overflow quota file offsets
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 10f04d40a9fa29785206c619f80d8beedb778837 ]
The on-disk quota format supports quota files with upto 2^32 blocks. Be careful when computing quota file offsets in the quota files from block numbers as they can overflow 32-bit types. Since quota files larger than 4GB would require ~26 millions of quota users, this is mostly a theoretical concern now but better be careful, fuzzers would find the problem sooner or later anyway...
--- fs/quota/quota_tree.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
fs/quota/quota_tree.c +4 -4
@@ -55,7 +55,7 @@ static ssize_t read_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)memset (buf,0 , info->dqi_usable_bs);return sb->s_op->quota_read (sb, info->dqi_type, buf, - info->dqi_usable_bs, blk << info->dqi_blocksize_bits); + info->dqi_usable_bs, (loff_t )blk << info->dqi_blocksize_bits); }static ssize_t write_blk (struct qtree_mem_dqinfo *info,uint blk,char *buf)
@@ -64,7 +64,7 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf)ssize_t ret; ret = sb->s_op->quota_write (sb, info->dqi_type, buf, - info->dqi_usable_bs, blk << info->dqi_blocksize_bits); + info->dqi_usable_bs, (loff_t )blk << info->dqi_blocksize_bits);if (ret != info->dqi_usable_bs) {quota_error (sb,"dquota write failed" );if (ret >=0 )
@@ -277,7 +277,7 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, blk); goto out_buf; } - dquot->dq_off = (blk << info->dqi_blocksize_bits) + + dquot->dq_off = ((loff_t )blk << info->dqi_blocksize_bits) +sizeof (struct qt_disk_dqdbheader ) + i * info->dqi_entry_size;kfree (buf);
@@ -552,7 +552,7 @@ static loff_t find_block_dqentry(struct qtree_mem_dqinfo *info, ret = -EIO ; goto out_buf; }else { - ret = (blk << info->dqi_blocksize_bits) +sizeof (struct + ret = ((loff_t )blk << info->dqi_blocksize_bits) +sizeof (struct qt_disk_dqdbheader ) + i * info->dqi_entry_size; } out_buf:
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 17/19 powerpc: sysdev: add missing iounmap() on error in mpic_msgr_probe()
In reply to Greg Kroah-HartmanFrom: Qinglang Miao <[email protected]>
[ Upstream commit ffa1797040c5da391859a9556be7b735acbe1242 ]
I noticed that iounmap() of msgr_block_addr before return from mpic_msgr_probe() in the error handling case is missing. So use devm_ioremap() instead of just ioremap() when remapping the message register block, so the mapping will be automatically released on probe failure.
--- arch/powerpc/sysdev/mpic_msgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/sysdev/mpic_msgr.c +1 -1
@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)/* IO map the message register block. */ of_address_to_resource (np,0 , &rsrc); - msgr_block_addr =ioremap (rsrc.start,resource_size (&rsrc)); + msgr_block_addr =devm_ioremap (&dev->dev, rsrc.start,resource_size (&rsrc));if (!msgr_block_addr) {dev_err (&dev->dev,"Failed to iomap MPIC message registers" );return -EFAULT ;
Signature · 1 line
2.27.0
Greg Kroah-Hartman
maintainerPATCH 18/19 module: delay kobject uevent until after module init call
In reply to Greg Kroah-HartmanFrom: Jessica Yu <[email protected]>
[ Upstream commit 38dc717e97153e46375ee21797aa54777e5498f3 ]
Apparently there has been a longstanding race between udev/systemd and the module loader. Currently, the module loader sends a uevent right after sysfs initialization, but before the module calls its init function. However, some udev rules expect that the module has initialized already upon receiving the uevent.
This race has been triggered recently (see link in references) in some systemd mount unit files. For instance, the configfs module creates the /sys/kernel/config mount point in its init function, however the module loader issues the uevent before this happens. sys-kernel-config.mount expects to be able to mount /sys/kernel/config upon receipt of the module loading uevent, but if the configfs module has not called its init function yet, then this directory will not exist and the mount unit fails. A similar situation exists for sys-fs-fuse-connections.mount, as the fuse sysfs mount point is created during the fuse module's init function. If udev is faster than module initialization then the mount unit would fail in a similar fashion.
To fix this race, delay the module KOBJ_ADD uevent until after the module has finished calling its init routine.
--- kernel/module.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
kernel/module.c +3 -2
@@ -1779,7 +1779,6 @@ static int mod_sysfs_init(struct moduleif (err)mod_kobject_put (mod); -/* delay uevent until full sysfs population */ out:return err; }
@@ -1813,7 +1812,6 @@ static int mod_sysfs_setup(struct moduleadd_sect_attrs (mod, info);add_notes_attrs (mod, info); -kobject_uevent (&mod->mkobj.kobj,KOBJ_ADD );return 0 ; out_unreg_param:
@@ -3301,6 +3299,9 @@ static noinline int do_init_module(strucblocking_notifier_call_chain (&module_notify_list,MODULE_STATE_LIVE , mod); +/* Delay uevent until module has finished its init routine */ +kobject_uevent (&mod->mkobj.kobj,KOBJ_ADD ); +/* * We need to finish all async code before the module init sequence * is done. This has potential to deadlock. For example, a newly
Greg Kroah-Hartman
maintainerPATCH 19/19 iio:magnetometer:mag3110: Fix alignment and data leak issues.
In reply to Greg Kroah-HartmanFrom: Jonathan Cameron <[email protected]>
commit 89deb1334252ea4a8491d47654811e28b0790364 upstream
One of a class of bugs pointed out by Lars in a recent review. iio_push_to_buffers_with_timestamp() assumes the buffer used is aligned to the size of the timestamp (8 bytes). This is not guaranteed in this driver which uses an array of smaller elements on the stack. As Lars also noted this anti pattern can involve a leak of data to userspace and that indeed can happen here. We close both issues by moving to a suitable structure in the iio_priv() data.
This data is allocated with kzalloc() so no data can leak apart from previous readings.
The explicit alignment of ts is not necessary in this case but does make the code slightly less fragile so I have included it.
--- drivers/iio/magnetometer/mag3110.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
drivers/iio/magnetometer/mag3110.c +9 -4
@@ -52,6 +52,12 @@ struct mag3110_data {struct i2c_client *client;struct mutex lock;u8 ctrl_reg1; +/* Ensure natural alignment of timestamp */ +struct { +__be16 channels[3 ]; +u8 temperature; +s64 ts__aligned(8) ; + } scan; };static int mag3110_request (struct mag3110_data *data)
@@ -245,10 +251,9 @@ static irqreturn_t mag3110_trigger_handlstruct iio_poll_func *pf = p;struct iio_dev *indio_dev = pf->indio_dev;struct mag3110_data *data =iio_priv (indio_dev); -u8 buffer[16 ];/* 3 16-bit channels + 1 byte temp + padding + ts */ int ret; - ret =mag3110_read (data, (__be16 *) buffer); + ret =mag3110_read (data, data->scan.channels);if (ret <0 ) goto done;
@@ -257,10 +262,10 @@ static irqreturn_t mag3110_trigger_handl MAG3110_DIE_TEMP);if (ret <0 ) goto done; - buffer[6 ] = ret; + data->scan.temperature = ret; } -iio_push_to_buffers_with_timestamp (indio_dev, buffer, +iio_push_to_buffers_with_timestamp (indio_dev, &data->scan,iio_get_time_ns ()); done:
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.250 release. There are 19 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sat, 09 Jan 2021 14:08:13 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.250-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah