4.4.264-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.4.264-rc1 review
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.264-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.264-rc1
Markus Theil <[email protected]>
mac80211: fix double free in ibss_leave
Eric Dumazet <[email protected]>
net: sched: validate stab values
Martin Willi <[email protected]>
can: dev: Move device back to init netns on owning netns delete
Adrian Hunter <[email protected]>
perf auxtrace: Fix auxtrace queue conflict
Potnuri Bharat Teja <[email protected]>
RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
Johan Hovold <[email protected]>
net: cdc-phonet: fix data-interface release on probe failure
Johannes Berg <[email protected]>
mac80211: fix rate mask reset
Torin Cooper-Bennun <[email protected]>
can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
Tong Zhang <[email protected]>
can: c_can: move runtime PM enable/disable to c_can_platform
Tong Zhang <[email protected]>
can: c_can_pci: c_can_pci_remove(): fix use-after-free
Lv Yunlong <[email protected]>
net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
Dinghao Liu <[email protected]>
e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
Vitaly Lifshits <[email protected]>
e1000e: add rtnl_lock() to e1000_reset_task
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
Eric Dumazet <[email protected]>
macvlan: macvlan_count_rx() needs to be aware of preemption
Grygorii Strashko <[email protected]>
bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
Phillip Lougher <[email protected]>
squashfs: fix xattr id and id lookup sanity checks
Sean Nyekjaer <[email protected]>
squashfs: fix inode lookup sanity checks
Borislav Petkov <[email protected]>
x86/tlb: Flush global mappings when KAISER is disabled
Sergei Trofimovich <[email protected]>
ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
Sergei Trofimovich <[email protected]>
ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
J. Bruce Fields <[email protected]>
nfs: we don't support removing system.nfs4_acl
Peter Zijlstra <[email protected]>
u64_stats,lockdep: Fix u64_stats_init() vs lockdep
Tong Zhang <[email protected]>
atm: idt77252: fix null-ptr-dereference
Tong Zhang <[email protected]>
atm: uPD98402: fix incorrect allocation
Frank Sorenson <[email protected]>
NFS: Correct size calculation for create reply length
Timo Rothenpieler <[email protected]>
nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
Denis Efremov <[email protected]>
sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
Jia-Ju Bai <[email protected]>
net: tehuti: fix error return code in bdx_probe()
Tong Zhang <[email protected]>
atm: lanai: dont run lanai_dev_close if not open
Tong Zhang <[email protected]>
atm: eni: dont release is never initialized
Michael Ellerman <[email protected]>
powerpc/4xx: Fix build errors from mfdcr()
Heiko Thiery <[email protected]>
net: fec: ptp: avoid register access when ipg clock is disabled
-------------
Diffstat:
Makefile | 4 ++-- arch/ia64/include/asm/syscall.h | 2 +- arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++------ arch/powerpc/include/asm/dcr-native.h | 8 ++++---- arch/x86/include/asm/tlbflush.h | 11 ++++++---- drivers/atm/eni.c | 3 ++- drivers/atm/idt77105.c | 4 ++-- drivers/atm/lanai.c | 5 ++++- drivers/atm/uPD98402.c | 2 +- drivers/bus/omap_l3_noc.c | 4 ++-- drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- drivers/net/can/c_can/c_can.c | 24 +--------------------- drivers/net/can/c_can/c_can_pci.c | 3 ++- drivers/net/can/c_can/c_can_platform.c | 6 +++++- drivers/net/can/dev.c | 1 + drivers/net/can/m_can/m_can.c | 3 --- drivers/net/dsa/bcm_sf2.c | 6 ++++-- drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++ drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ drivers/net/ethernet/sun/niu.c | 2 -- drivers/net/ethernet/tehuti/tehuti.c | 1 + drivers/net/usb/cdc-phonet.c | 2 ++ fs/nfs/Kconfig | 2 +- fs/nfs/nfs3xdr.c | 3 ++- fs/nfs/nfs4proc.c | 3 +++ fs/squashfs/export.c | 8 ++++++-- fs/squashfs/id.c | 6 ++++-- fs/squashfs/squashfs_fs.h | 1 + fs/squashfs/xattr_id.c | 6 ++++-- include/linux/if_macvlan.h | 3 ++- include/linux/u64_stats_sync.h | 7 ++++--- include/net/red.h | 10 ++++++++- include/net/rtnetlink.h | 2 ++ net/core/dev.c | 2 +- net/mac80211/cfg.c | 4 ++-- net/mac80211/ibss.c | 2 ++ net/sched/sch_choke.c | 7 ++++--- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +++++-- net/sched/sch_sfq.c | 2 +- tools/perf/util/auxtrace.c | 4 ---- 43 files changed, 132 insertions(+), 86 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/33 net: fec: ptp: avoid register access when ipg clock is disabled
From: Heiko Thiery <[email protected]>
[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ]
When accessing the timecounter register on an i.MX8MQ the kernel hangs. This is only the case when the interface is down. This can be reproduced by reading with 'phc_ctrl eth0 get'.
Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900 the igp clock is disabled when the interface is down and leads to a system hang.
So we check if the ptp clock status before reading the timecounter register.
--- drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/freescale/fec_ptp.c +7 -0
@@ -396,9 +396,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)u64 ns;unsigned long flags; +mutex_lock (&adapter->ptp_clk_mutex); +/* Check the ptp clock */ +if (!adapter->ptp_clk_on) { +mutex_unlock (&adapter->ptp_clk_mutex); +return -EINVAL ; + }spin_lock_irqsave (&adapter->tmreg_lock, flags); ns =timecounter_read (&adapter->tc);spin_unlock_irqrestore (&adapter->tmreg_lock, flags); +mutex_unlock (&adapter->ptp_clk_mutex); *ts =ns_to_timespec64 (ns);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 2/33 powerpc/4xx: Fix build errors from mfdcr()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ]
lkp reported a build error in fsp2.o:
CC arch/powerpc/platforms/44x/fsp2.o
{standard input}:577: Error: unsupported relocation against base
Which comes from:
pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0));Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and passing that to the assembler, which obviously doesn't work.
The mfdcr() macro already checks that the argument is constant using __builtin_constant_p(), and if not calls the out-of-line version of mfdcr(). But in this case GCC is smart enough to notice that "base + PLB4OPB_GESR0" will be constant, even though it's not something we can immediately stringify into a register number.
Segher pointed out that passing the register number to the inline asm as a constant would be better, and in fact it fixes the build error, presumably because it gives GCC a chance to resolve the value.
While we're at it, change mtdcr() similarly.
--- arch/powerpc/include/asm/dcr-native.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/dcr-native.h +4 -4
@@ -64,8 +64,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mfdcr (rn) \ ({unsigned int rval; \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mfdcr %0," __stringify(rn) \ - : "=r" (rval)); \ + asm volatile("mfdcr %0, %1" : "=r" (rval) \ + : "n" (rn)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ rval = mfdcrx(rn); \ else \
@@ -75,8 +75,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mtdcr (rn, v) \ do { \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mtdcr " __stringify(rn) ",%0" \ - : : "r" (v)); \ + asm volatile("mtdcr %0, %1" \ + : : "n" (rn), "r" (v)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ mtdcrx(rn, v); \ else \
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 3/33 atm: eni: dont release is never initialized
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]
label err_eni_release is reachable when eni_start() fail.
In eni_start() it calls dev->phy->start() in the last step, if start() fail we don't need to call phy->stop(), if start() is never called, we neither need to call phy->stop(), otherwise null-ptr-deref will happen.
In order to fix this issue, don't call phy->stop() in label err_eni_release
[ 4.875714] ================================================================== [ 4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni] [ 4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95 [ 4.876778] [ 4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2 [ 4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94 [ 4.877876] Call Trace: [ 4.878009] dump_stack+0x7d/0xa3 [ 4.878191] kasan_report.cold+0x10c/0x10e [ 4.878410] ? __slab_free+0x2f0/0x340 [ 4.878612] ? suni_stop+0x47/0x100 [suni] [ 4.878832] suni_stop+0x47/0x100 [suni] [ 4.879043] eni_do_release+0x3b/0x70 [eni] [ 4.879269] eni_init_one.cold+0x1152/0x1747 [eni] [ 4.879528] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 4.879768] ? eni_ioctl+0x270/0x270 [eni] [ 4.879990] ? __mutex_lock_slowpath+0x10/0x10 [ 4.880226] ? eni_ioctl+0x270/0x270 [eni] [ 4.880448] local_pci_probe+0x6f/0xb0 [ 4.880650] pci_device_probe+0x171/0x240 [ 4.880864] ? pci_device_remove+0xe0/0xe0 [ 4.881086] ? kernfs_create_link+0xb6/0x110 [ 4.881315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 4.881594] really_probe+0x161/0x420 [ 4.881791] driver_probe_device+0x6d/0xd0 [ 4.882010] device_driver_attach+0x82/0x90 [ 4.882233] ? device_driver_attach+0x90/0x90 [ 4.882465] __driver_attach+0x60/0x100 [ 4.882671] ? device_driver_attach+0x90/0x90 [ 4.882903] bus_for_each_dev+0xe1/0x140 [ 4.883114] ? subsys_dev_iter_exit+0x10/0x10 [ 4.883346] ? klist_node_init+0x61/0x80 [ 4.883557] bus_add_driver+0x254/0x2a0 [ 4.883764] driver_register+0xd3/0x150 [ 4.883971] ? 0xffffffffc0038000 [ 4.884149] do_one_initcall+0x84/0x250 [ 4.884355] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 4.884674] ? unpoison_range+0xf/0x30 [ 4.884875] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.885150] ? unpoison_range+0xf/0x30 [ 4.885352] ? unpoison_range+0xf/0x30 [ 4.885557] do_init_module+0xf8/0x350 [ 4.885760] load_module+0x3fe6/0x4340 [ 4.885960] ? vm_unmap_ram+0x1d0/0x1d0 [ 4.886166] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.886441] ? module_frob_arch_sections+0x20/0x20 [ 4.886697] ? __do_sys_finit_module+0x108/0x170 [ 4.886941] __do_sys_finit_module+0x108/0x170 [ 4.887178] ? __ia32_sys_init_module+0x40/0x40 [ 4.887419] ? file_open_root+0x200/0x200 [ 4.887634] ? do_sys_open+0x85/0xe0 [ 4.887826] ? filp_open+0x50/0x50 [ 4.888009] ? fpregs_assert_state_consistent+0x4d/0x60 [ 4.888287] ? exit_to_user_mode_prepare+0x2f/0x130 [ 4.888547] do_syscall_64+0x33/0x40 [ 4.888739] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 4.889010] RIP: 0033:0x7ff62fcf1cf7 [ 4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71 [ 4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7 [ 4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003 [ 4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0 [ 4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001 [ 4.892439] ==================================================================
--- drivers/atm/eni.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/atm/eni.c +2 -1
@@ -2278,7 +2278,8 @@ static int eni_init_one(struct pci_dev *pci_dev,return rc; err_eni_release: -eni_do_release (dev); + dev->phy =NULL ; +iounmap (ENI_DEV (dev)->ioaddr); err_unregister:atm_dev_deregister (dev); err_free_consistent:
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 4/33 atm: lanai: dont run lanai_dev_close if not open
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the pci device is disabled. The caller, lanai_init_one(), then tries to run atm_dev_deregister(). This will subsequently call lanai_dev_close() and use the already released MMIO area.
To fix this issue, set the lanai->base to NULL if open fail, and test the flag in lanai_dev_close().
[ 8.324153] lanai: lanai_start() failed, err=19 [ 8.324819] lanai(itf 0): shutting down interface [ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024 [ 8.325781] #PF: supervisor write access in kernel mode [ 8.326215] #PF: error_code(0x0002) - not-present page [ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0 [ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI [ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12 [ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 [ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.334932] Call Trace: [ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm] [ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai] [ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai] [ 8.335831] local_pci_probe+0x6f/0xb0 [ 8.336039] pci_device_probe+0x171/0x240 [ 8.336255] ? pci_device_remove+0xe0/0xe0 [ 8.336475] ? kernfs_create_link+0xb6/0x110 [ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 8.336983] really_probe+0x161/0x420 [ 8.337181] driver_probe_device+0x6d/0xd0 [ 8.337401] device_driver_attach+0x82/0x90 [ 8.337626] ? device_driver_attach+0x90/0x90 [ 8.337859] __driver_attach+0x60/0x100 [ 8.338065] ? device_driver_attach+0x90/0x90 [ 8.338298] bus_for_each_dev+0xe1/0x140 [ 8.338511] ? subsys_dev_iter_exit+0x10/0x10 [ 8.338745] ? klist_node_init+0x61/0x80 [ 8.338956] bus_add_driver+0x254/0x2a0 [ 8.339164] driver_register+0xd3/0x150 [ 8.339370] ? 0xffffffffc0028000 [ 8.339550] do_one_initcall+0x84/0x250 [ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0 [ 8.340329] ? unpoison_range+0xf/0x30 [ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.340806] ? unpoison_range+0xf/0x30 [ 8.341014] ? unpoison_range+0xf/0x30 [ 8.341217] do_init_module+0xf8/0x350 [ 8.341419] load_module+0x3fe6/0x4340 [ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0 [ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.342101] ? module_frob_arch_sections+0x20/0x20 [ 8.342358] ? __do_sys_finit_module+0x108/0x170 [ 8.342604] __do_sys_finit_module+0x108/0x170 [ 8.342841] ? __ia32_sys_init_module+0x40/0x40 [ 8.343083] ? file_open_root+0x200/0x200 [ 8.343298] ? do_sys_open+0x85/0xe0 [ 8.343491] ? filp_open+0x50/0x50 [ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130 [ 8.343935] do_syscall_64+0x33/0x40 [ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 8.344401] RIP: 0033:0x7f08eb887cf7 [ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 [ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7 [ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003 [ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0 [ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001 [ 8.347836] Modules linked in: lanai(+) atm [ 8.348065] CR2: ffffc90000180024 [ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]--- [ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
--- drivers/atm/lanai.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/atm/lanai.c +4 -1
@@ -2239,6 +2239,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)conf1_write (lanai);#endif iounmap (lanai->base); + lanai->base =NULL ; error_pci:pci_disable_device (lanai->pci); error:
@@ -2251,6 +2252,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)static void lanai_dev_close (struct atm_dev *atmdev) {struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; +if (lanai->base==NULL ) +return ; printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", lanai->number);lanai_timed_poll_stop (lanai);
@@ -2560,7 +2563,7 @@ static int lanai_init_one(struct pci_dev *pci,struct atm_dev *atmdev;int result; - lanai =kmalloc (sizeof (*lanai),GFP_KERNEL ); + lanai =kzalloc (sizeof (*lanai),GFP_KERNEL );if (lanai ==NULL ) { printk(KERN_ERR DEV_LABEL ": couldn't allocate dev_data structure!\n");
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 5/33 net: tehuti: fix error return code in bdx_probe()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ]
When bdx_read_mac() fails, no error return code of bdx_probe() is assigned.
To fix this bug, err is assigned with -EFAULT as error return code.
--- drivers/net/ethernet/tehuti/tehuti.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/tehuti/tehuti.c +1 -0
@@ -2068,6 +2068,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)/*bdx_hw_reset(priv); */ if (bdx_read_mac (priv)) {pr_err ("load MAC address failed\n" ); + err = -EFAULT ; goto err_out_iomap; }SET_NETDEV_DEV (ndev, &pdev->dev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 6/33 sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ]
RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row in niu_xmac_interrupt(). Remove the second addition.
--- drivers/net/ethernet/sun/niu.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/sun/niu.c +0 -2
@@ -3948,8 +3948,6 @@ static void niu_xmac_interrupt(struct niu *np) mp->rx_mcasts +=RXMAC_MC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ; -if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) - mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXHIST1_CNT_EXP ) mp->rx_hist_cnt1 +=RXMAC_HIST_CNT1_COUNT ;if (val &XRXMAC_STATUS_RXHIST2_CNT_EXP )
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 7/33 nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
In reply to Greg Kroah-HartmanFrom: Timo Rothenpieler <[email protected]>
[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ]
This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13. With the default being m, it's impossible to build the module into the kernel.
--- fs/nfs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/Kconfig +1 -1
@@ -132,7 +132,7 @@ config PNFS_OBJLAYOUT config PNFS_FLEXFILE_LAYOUT tristate depends on NFS_V4_1 && NFS_V3 - default m + default NFS_V4 config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN string "NFSv4.1 Implementation ID Domain"
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 8/33 NFS: Correct size calculation for create reply length
In reply to Greg Kroah-HartmanFrom: Frank Sorenson <[email protected]>
[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ]
CREATE requests return a post_op_fh3, rather than nfs_fh3. The post_op_fh3 includes an extra word to indicate 'handle_follows'.
Without that additional word, create fails when full 64-byte filehandles are in use.
Add NFS3_post_op_fh_sz, and correct the size calculation for NFS3_createres_sz.
--- fs/nfs/nfs3xdr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/nfs3xdr.c +2 -1
@@ -33,6 +33,7 @@*/ #define NFS3_fhandle_sz (1+16)#define NFS3_fh_sz (NFS3_fhandle_sz)/* shorthand */ +#define NFS3_post_op_fh_sz (1+NFS3_fh_sz)#define NFS3_sattr_sz (15)#define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2))#define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2))
@@ -70,7 +71,7 @@#define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1)#define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3)#define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) -#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) +#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz))#define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 9/33 atm: uPD98402: fix incorrect allocation
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ]
dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock (i.e dev->phy_data->lock) will result in a null-ptr-dereference.
I believe this is a typo and what it actually want to do is to allocate phy_data instead of dev_data.
--- drivers/atm/uPD98402.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/atm/uPD98402.c +1 -1
@@ -210,7 +210,7 @@ static void uPD98402_int(struct atm_dev *dev)static int uPD98402_start (struct atm_dev *dev) {DPRINTK ("phy_start\n" ); -if (!(dev->dev_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL )))return -ENOMEM ;spin_lock_init (&PRIV (dev)->lock);memset (&PRIV (dev)->sonet_stats,0 ,sizeof (struct k_sonet_stats ));
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 10/33 atm: idt77252: fix null-ptr-dereference
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]
this one is similar to the phy_data allocation fix in uPD98402, the driver allocate the idt77105_priv and store to dev_data but later dereference using dev->dev_data, which will cause null-ptr-dereference.
fix this issue by changing dev_data to phy_data so that PRIV(dev) can work correctly.
--- drivers/atm/idt77105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/atm/idt77105.c +2 -2
@@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev) {unsigned long flags; -if (!(dev->dev_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL )))return -ENOMEM ;PRIV (dev)->dev = dev;spin_lock_irqsave (&idt77105_priv_lock, flags);
@@ -338,7 +338,7 @@ static int idt77105_stop(struct atm_dev *dev)else idt77105_all = walk->next; dev->phy =NULL ; - dev->dev_data =NULL ; + dev->phy_data =NULL ;kfree (walk);break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 11/33 u64_stats,lockdep: Fix u64_stats_init() vs lockdep
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ]
Jakub reported that:
static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
{
...
u64_stats_init(&tp->rx_stats.syncp);
u64_stats_init(&tp->tx_stats.syncp);
...
}results in lockdep getting confused between the RX and TX stats lock. This is because u64_stats_init() is an inline calling seqcount_init(), which is a macro using a static variable to generate a lockdep class.
By wrapping that in an inline, we negate the effect of the macro and fold the static key variable, hence the confusion.
Fix by also making u64_stats_init() a macro for the case where it matters, leaving the other case an inline for argument validation etc.
--- include/linux/u64_stats_sync.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/u64_stats_sync.h +4 -3
@@ -68,12 +68,13 @@ struct u64_stats_sync { }; +#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) +#define u64_stats_init (syncp) seqcount_init(&(syncp)->seq) +#else static inline void u64_stats_init (struct u64_stats_sync *syncp) { -#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) -seqcount_init (&syncp->seq); -#endif } +#endif static inline void u64_stats_update_begin (struct u64_stats_sync *syncp) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 12/33 nfs: we dont support removing system.nfs4_acl
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ]
The NFSv4 protocol doesn't have any notion of reomoving an attribute, so removexattr(path,"system.nfs4_acl") doesn't make sense.
There's no documented return value. Arguably it could be EOPNOTSUPP but I'm a little worried an application might take that to mean that we don't support ACLs or xattrs. How about EINVAL?
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -4848,6 +4848,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflunsigned int npages =DIV_ROUND_UP (buflen,PAGE_SIZE );int ret, i; +/* You can't remove system.nfs4_acl: */ +if (buflen ==0 ) +return -EINVAL ;if (!nfs4_server_supports_acls (server))return -EOPNOTSUPP ;if (npages >ARRAY_SIZE (pages))
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 13/33 ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not work for syscalls called via glibc's syscall() wrapper.
ia64 has two ways to call syscalls from userspace: via break and via eps instructions.
The difference is in stack layout:
1. eps creates simple stack frame: no locals, in{0..7} == out{0..8}
2. break uses userspace stack frame: may be locals (glibc provides one), in{0..7} == out{0..8}.
Both work fine in syscall handling cde itself.
But ptrace(PTRACE_GET_SYSCALL_INFO) uses unwind mechanism to re-extract syscall arguments but it does not account for locals.
The change always skips locals registers. It should not change eps path as kernel's handler already enforces locals=0 and fixes break.
Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
arch/ia64/kernel/ptrace.c +18 -6
@@ -2140,27 +2140,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) {struct syscall_get_set_args *args = data;struct pt_regs *pt = args->regs; -unsigned long *krbs, cfm, ndirty; +unsigned long *krbs, cfm, ndirty, nlocals, nouts;int i, count;if (unw_unwind_to_user (info) <0 )return ; +/* +* We get here via a few paths: +* - break instruction: cfm is shared with caller. +* syscall args are in out= regs, locals are non-empty. +* - epsinstruction: cfm is set by br.call +* locals don't exist. +* +* For both cases argguments are reachable in cfm.sof - cfm.sol. +* CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] +*/ cfm = pt->cr_ifs; + nlocals = (cfm >>7 ) &0x7f ;/* aka sol */ + nouts = (cfm &0x7f ) - nlocals;/* aka sof - sol */ krbs = (unsigned long *)info->task +IA64_RBS_OFFSET /8 ; ndirty =ia64_rse_num_regs (krbs, krbs + (pt->loadrs >>19 )); count =0 ;if (in_syscall (pt)) - count =min_t (int, args->n, cfm &0x7f ); + count =min_t (int, args->n, nouts); +/* Iterate over outs. */ for (i =0 ; i < count; i++) { +int j = ndirty + nlocals + i + args->i;if (args->rw) - *ia64_rse_skip_regs (krbs, ndirty + i + args->i) = - args->args[i]; + *ia64_rse_skip_regs (krbs, j) = args->args[i];else - args->args[i] = *ia64_rse_skip_regs (krbs, - ndirty + i + args->i); + args->args[i] = *ia64_rse_skip_regs (krbs, j); }if (!args->rw) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 14/33 ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not return error sign properly.
The bug is in mismatch between get/set errors:
static inline long syscall_get_error(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r10 == -1 ? regs->r8:0;
}static inline long syscall_get_return_value(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r8;
}static inline void syscall_set_return_value(struct task_struct *task,
struct pt_regs *regs, int error, long val)
{
if (error) {
/* error < 0, but ia64 uses > 0 return value */
regs->r8 = -error;
regs->r10 = -1;
} else {
regs->r8 = val;
regs->r10 = 0;
}
}Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/include/asm/syscall.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/include/asm/syscall.h +1 -1
@@ -35,7 +35,7 @@ static inline void syscall_rollback(struct task_struct *task,static inline long syscall_get_error (struct task_struct *task,struct pt_regs *regs) { -return regs->r10 ==-1 ? regs->r8:0 ; +return regs->r10 ==-1 ? -regs->r8:0 ; } static inline long syscall_get_return_value(struct task_struct *task,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 15/33 x86/tlb: Flush global mappings when KAISER is disabled
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
Jim Mattson reported that Debian 9 guests using a 4.9-stable kernel are exploding during alternatives patching:
kernel BUG at /build/linux-dqnRSc/linux-4.9.228/arch/x86/kernel/alternative.c:709! invalid opcode: 0000 [#1] SMP
Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.9.0-13-amd64 #1 Debian 4.9.228-1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: swap_entry_free swap_entry_free text_poke_bp swap_entry_free arch_jump_label_transform set_debug_rodata __jump_label_update static_key_slow_inc frontswap_register_ops init_zswap init_frontswap do_one_initcall set_debug_rodata kernel_init_freeable rest_init kernel_init ret_from_fork
triggering the BUG_ON in text_poke() which verifies whether patched instruction bytes have actually landed at the destination.
Further debugging showed that the TLB flush before that check is insufficient because there could be global mappings left in the TLB, leading to a stale mapping getting used.
I say "global mappings" because the hardware configuration is a new one:
machine is an AMD, which means, KAISER/PTI doesn't need to be enabled there, which also means there's no user/kernel pagetables split and therefore the TLB can have global mappings.
And the configuration is new one for a second reason: because that AMD machine supports PCID and INVPCID, which leads the CPU detection code to set the synthetic X86_FEATURE_INVPCID_SINGLE flag.
Now, __native_flush_tlb_single() does invalidate global mappings when X86_FEATURE_INVPCID_SINGLE is *not* set and returns.
When X86_FEATURE_INVPCID_SINGLE is set, however, it invalidates the requested address from both PCIDs in the KAISER-enabled case. But if KAISER is not enabled and the machine has global mappings in the TLB, then those global mappings do not get invalidated, which would lead to the above mismatch from using a stale TLB entry.
So make sure to flush those global mappings in the KAISER disabled case.
Co-debugged by Babu Moger <[email protected]>.
--- arch/x86/include/asm/tlbflush.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/include/asm/tlbflush.h +7 -4
@@ -245,12 +245,15 @@ static inline void __native_flush_tlb_single(unsigned long addr)* ASID. But, userspace flushes are probably much more * important performance-wise. * -* Make sure to do only a single invpcid when KAISER is -* disabled and we have only a single ASID. +* In the KAISER disabled case, do an INVLPG to make sure +* the mapping is flushed in case it is a global one. */ -if (kaiser_enabled) +if (kaiser_enabled) {invpcid_flush_one (X86_CR3_PCID_ASID_USER , addr); -invpcid_flush_one (X86_CR3_PCID_ASID_KERN , addr); +invpcid_flush_one (X86_CR3_PCID_ASID_KERN , addr); + }else { + asmvolatile ("invlpg (%0)" ::"r" (addr) :"memory" ); + } }static inline void __flush_tlb_all (void )
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 16/33 squashfs: fix inode lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Sean Nyekjaer <[email protected]>
commit c1b2028315c6b15e8d6725e0d5884b15887d3daa upstream.
When mouting a squashfs image created without inode compression it fails
with: "unable to read inode lookup table"
It turns out that the BLOCK_OFFSET is missing when checking the SQUASHFS_METADATA_SIZE agaist the actual size.
--- fs/squashfs/export.c | 8 ++++++-- fs/squashfs/squashfs_fs.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
fs/squashfs/export.c +6 -2
@@ -165,14 +165,18 @@ __le64 *squashfs_read_inode_lookup_table start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end + || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= lookup_table_start || (lookup_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= lookup_table_start || + (lookup_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/squashfs_fs.h +1 -0
@@ -30,6 +30,7 @@/* size of metadata (inode and directory) blocks */ #define SQUASHFS_METADATA_SIZE 8192 +#define SQUASHFS_BLOCK_OFFSET 2/* default size of block device I/O */ #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE
Greg Kroah-Hartman
maintainerPATCH 17/33 squashfs: fix xattr id and id lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Phillip Lougher <[email protected]>
commit 8b44ca2b634527151af07447a8090a5f3a043321 upstream.
The checks for maximum metadata block size is missing SQUASHFS_BLOCK_OFFSET (the two byte length count).
--- fs/squashfs/id.c | 6 ++++-- fs/squashfs/xattr_id.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
fs/squashfs/id.c +4 -2
@@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= id_table_start || (id_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= id_table_start || (id_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/xattr_id.c +4 -2
@@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= table_start || (table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= table_start || (table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
Greg Kroah-Hartman
maintainerPATCH 18/33 bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
In reply to Greg Kroah-HartmanFrom: Grygorii Strashko <[email protected]>
[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ]
The main purpose of l3 IRQs is to catch OCP bus access errors and identify corresponding code places by showing call stack, so it's important to handle L3 interconnect errors as fast as possible. On RT these IRQs will became threaded and will be scheduled much more late from the moment actual error occurred so showing completely useless information.
Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded on RT or if force_irqthreads = true.
--- drivers/bus/omap_l3_noc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bus/omap_l3_noc.c +2 -2
@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)*/ l3->debug_irq =platform_get_irq (pdev,0 ); ret =devm_request_irq (l3->dev, l3->debug_irq, l3_interrupt_handler, -0x0 ,"l3-dbg-irq" , l3); +IRQF_NO_THREAD ,"l3-dbg-irq" , l3);if (ret) {dev_err (l3->dev,"request_irq failed for %d\n" , l3->debug_irq);
@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) l3->app_irq =platform_get_irq (pdev,1 ); ret =devm_request_irq (l3->dev, l3->app_irq, l3_interrupt_handler, -0x0 ,"l3-app-irq" , l3); +IRQF_NO_THREAD ,"l3-app-irq" , l3);if (ret)dev_err (l3->dev,"request_irq failed for %d\n" , l3->app_irq);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 19/33 macvlan: macvlan_count_rx() needs to be aware of preemption
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]
macvlan_count_rx() can be called from process context, it is thus necessary to disable preemption before calling u64_stats_update_begin()
syzbot was able to spot this on 32bit arch:
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 Modules linked in: Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events macvlan_process_broadcast Backtrace: [<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) [<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)
--- include/linux/if_macvlan.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/if_macvlan.h +2 -1
@@ -70,13 +70,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,if (likely (success)) {struct vlan_pcpu_stats *pcpu_stats; - pcpu_stats =this_cpu_ptr (vlan->pcpu_stats); + pcpu_stats =get_cpu_ptr (vlan->pcpu_stats);u64_stats_update_begin (&pcpu_stats->syncp); pcpu_stats->rx_packets++; pcpu_stats->rx_bytes += len;if (multicast) pcpu_stats->rx_multicast++;u64_stats_update_end (&pcpu_stats->syncp); +put_cpu_ptr (vlan->pcpu_stats); }else {this_cpu_inc (vlan->pcpu_stats->rx_errors); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 20/33 net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ]
Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net:
bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to qualify the phydev->dev_flags based on whether the port is connected to an internal or external PHY otherwise we risk having a flags collision with a completely different interpretation depending on the driver.
--- drivers/net/dsa/bcm_sf2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/dsa/bcm_sf2.c +4 -2
@@ -1067,8 +1067,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)* in bits 15:8 and the patch level in bits 7:0 which is exactly what * the REG_PHY_REVISION register layout is. */ - -return priv->hw_params.gphy_rev; +if (priv->int_phy_mask &BIT (port)) +return priv->hw_params.gphy_rev; +else +return 0 ; } static int bcm_sf2_sw_indir_rw(struct dsa_switch *ds, int op, int addr,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 21/33 e1000e: add rtnl_lock() to e1000_reset_task
In reply to Greg Kroah-HartmanFrom: Vitaly Lifshits <[email protected]>
[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ]
A possible race condition was found in e1000_reset_task, after discovering a similar issue in igb driver via commit 024a8168b749 ("igb: reinit_locked() should be called with rtnl_lock").
Added rtnl_lock() and rtnl_unlock() to avoid this.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000e/netdev.c +5 -1
@@ -5875,15 +5875,19 @@ static void e1000_reset_task(struct work_struct *work)struct e1000_adapter *adapter; adapter = container_of(work, struct e1000_adapter, reset_task); +rtnl_lock ();/* don't run the task if already down */ -if (test_bit (__E1000_DOWN, &adapter->state)) +if (test_bit (__E1000_DOWN, &adapter->state)) { +rtnl_unlock ();return ; + }if (!(adapter->flags &FLAG_RESTART_NOW )) {e1000e_dump (adapter);e_err ("Reset adapter unexpectedly\n" ); }e1000e_reinit_locked (adapter); +rtnl_unlock (); }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 22/33 e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ]
There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 that we have caught its return value but lack further handling. Check and terminate the execution flow just like other e1e_wphy() in this function.
--- drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/e1000e/82571.c +2 -0
@@ -917,6 +917,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) }else { data &= ~IGP02E1000_PM_D0_LPLU ; ret_val =e1e_wphy (hw,IGP02E1000_PHY_POWER_MGMT , data); +if (ret_val) +return ret_val;/* LPLU and SmartSpeed are mutually exclusive. LPLU is used * during Dx states where the power conservation is most * important. During driver activity we should enable
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 23/33 net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ]
In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by vfree(). But unfortunately, it is used when extended is true.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +3 -0
@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)if (fw_dump->tmpl_hdr ==NULL || current_version > prev_version) {vfree (fw_dump->tmpl_hdr); + fw_dump->tmpl_hdr =NULL ;if (qlcnic_83xx_md_check_extended_dump_capability (adapter)) extended = !qlcnic_83xx_extend_md_capab (adapter);
@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)struct qlcnic_83xx_dump_template_hdr *hdr; hdr = fw_dump->tmpl_hdr; +if (!hdr) +return ; hdr->drv_cap_mask =0x1f ; fw_dump->cap_mask =0x1f ; dev_info(&pdev->dev,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 24/33 can: c_can_pci: c_can_pci_remove(): fix use-after-free
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]
There is a UAF in c_can_pci_remove(). dev is released by free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. To fix this issue, save the mmio address before releasing dev.
--- drivers/net/can/c_can/c_can_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/can/c_can/c_can_pci.c +2 -1
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) {struct net_device *dev =pci_get_drvdata (pdev);struct c_can_priv *priv =netdev_priv (dev); +void __iomem *addr = priv->base;unregister_c_can_dev (dev);free_c_can_dev (dev); -pci_iounmap (pdev, priv->base); +pci_iounmap (pdev, addr);pci_disable_msi (pdev);pci_clear_master (pdev);pci_release_regions (pdev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 25/33 can: c_can: move runtime PM enable/disable to c_can_platform
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ]
Currently doing modprobe c_can_pci will make the kernel complain:
Unbalanced pm_runtime_enable!
this is caused by pm_runtime_enable() called before pm is initialized.
This fix is similar to 227619c3ff7c, move those pm_enable/disable code to c_can_platform.
--- drivers/net/can/c_can/c_can.c | 24 +----------------------- drivers/net/can/c_can/c_can_platform.c | 6 +++++- 2 files changed, 6 insertions(+), 24 deletions(-)
drivers/net/can/c_can/c_can.c +1 -23
@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { .brp_inc = 1, }; -static inline void c_can_pm_runtime_enable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_enable (priv->device); -} - -static inline void c_can_pm_runtime_disable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_disable (priv->device); -} -static inline void c_can_pm_runtime_get_sync (const struct c_can_priv *priv) {if (priv->device)
@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = {int register_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev);int err;/* Deactivate pins to prevent DRA7 DCAN IP from being
@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev)*/ pinctrl_pm_select_sleep_state (dev->dev.parent); -c_can_pm_runtime_enable (priv); - dev->flags |=IFF_ECHO ;/* we support local echo */ dev->netdev_ops = &c_can_netdev_ops; err =register_candev (dev); -if (err) -c_can_pm_runtime_disable (priv); -else +if (!err)devm_can_led_init (dev); -return err; }EXPORT_SYMBOL_GPL (register_c_can_dev);void unregister_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev); -unregister_candev (dev); - -c_can_pm_runtime_disable (priv); }EXPORT_SYMBOL_GPL (unregister_c_can_dev);
drivers/net/can/c_can/c_can_platform.c +5 -1
@@ -29,6 +29,7 @@#include <linux/list.h> #include <linux/io.h> #include <linux/platform_device.h> +#include <linux/pm_runtime.h> #include <linux/clk.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev)platform_set_drvdata (pdev, dev);SET_NETDEV_DEV (dev, &pdev->dev); +pm_runtime_enable (priv->device); ret =register_c_can_dev (dev);if (ret) { dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev)return 0 ; exit_free_device: +pm_runtime_disable (priv->device);free_c_can_dev (dev); exit:dev_err (&pdev->dev,"probe failed\n" );
@@ -407,9 +410,10 @@ exit:static int c_can_plat_remove (struct platform_device *pdev) {struct net_device *dev =platform_get_drvdata (pdev); +struct c_can_priv *priv =netdev_priv (dev);unregister_c_can_dev (dev); - +pm_runtime_disable (priv->device);free_c_can_dev (dev);return 0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 26/33 can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
In reply to Greg Kroah-HartmanFrom: Torin Cooper-Bennun <[email protected]>
[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ]
Message loss from RX FIFO 0 is already handled in m_can_handle_lost_msg(), with netdev output included.
Removing this warning also improves driver performance under heavy load, where m_can_do_rx_poll() may be called many times before this interrupt is cleared, causing this message to be output many times (thanks Mariusz Madej for this report).
--- drivers/net/can/m_can/m_can.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/can/m_can/m_can.c +0 -3
@@ -428,9 +428,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) }while ((rxfs &RXFS_FFL_MASK ) && (quota >0 )) { -if (rxfs &RXFS_RFL ) -netdev_warn (dev,"Rx FIFO 0 Message Lost\n" ); -m_can_read_fifo (dev, rxfs); quota--;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 27/33 mac80211: fix rate mask reset
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ]
Coverity reported the strange "if (~...)" condition that's always true. It suggested that ! was intended instead of ~, but upon further analysis I'm convinced that what really was intended was a comparison to 0xff/0xffff (in HT/VHT cases respectively), since this indicates that all of the rates are enabled.
Change the comparison accordingly.
I'm guessing this never really mattered because a reset to not having a rate mask is basically equivalent to having a mask that enables all rates.
--- net/mac80211/cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/cfg.c +2 -2
@@ -2448,14 +2448,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,continue ;for (j =0 ; j <IEEE80211_HT_MCS_MASK_LEN ; j++) { -if (~sdata->rc_rateidx_mcs_mask[i][j]) { +if (sdata->rc_rateidx_mcs_mask[i][j] !=0xff ) { sdata->rc_has_mcs_mask[i] = true;break ; } }for (j =0 ; j <NL80211_VHT_NSS_MAX ; j++) { -if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { +if (sdata->rc_rateidx_vht_mcs_mask[i][j] !=0xffff ) { sdata->rc_has_vht_mcs_mask[i] = true;break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 28/33 net: cdc-phonet: fix data-interface release on probe failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ]
Set the disconnected flag before releasing the data interface in case netdev registration fails to avoid having the disconnect callback try to deregister the never registered netdev (and trigger a WARN_ON()).
--- drivers/net/usb/cdc-phonet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/cdc-phonet.c +2 -0
@@ -406,6 +406,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i err =register_netdev (dev);if (err) { +/* Set disconnected flag so that disconnect() returns early. */ + pnd->disconnected =1 ;usb_driver_release_interface (&usbpn_driver, data_intf); goto out; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 29/33 RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ]
Not setting the ipv6 bit while destroying ipv6 listening servers may result in potential fatal adapter errors due to lookup engine memory hash errors. Therefore always set ipv6 field while destroying ipv6 listening servers.
--- drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +2 -2
@@ -3441,13 +3441,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) ep->com.local_addr.ss_family == AF_INET) { err = cxgb4_remove_server_filter( ep->com.dev->rdev.lldi.ports[0], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0], 0); + ep->com.dev->rdev.lldi.rxq_ids[0], false); } else {struct sockaddr_in6 *sin6;c4iw_init_wr_wait (&ep->com.wr_wait); err =cxgb4_remove_server ( ep->com.dev->rdev.lldi.ports[0 ], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0 ],0 ); + ep->com.dev->rdev.lldi.rxq_ids[0 ], true);if (err) goto done; err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 30/33 perf auxtrace: Fix auxtrace queue conflict
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
[ Upstream commit b410ed2a8572d41c68bd9208555610e4b07d0703 ]
The only requirement of an auxtrace queue is that the buffers are in time order. That is achieved by making separate queues for separate perf buffer or AUX area buffer mmaps.
That generally means a separate queue per cpu for per-cpu contexts, and a separate queue per thread for per-task contexts.
When buffers are added to a queue, perf checks that the buffer cpu and thread id (tid) match the queue cpu and thread id.
However, generally, that need not be true, and perf will queue buffers correctly anyway, so the check is not needed.
In addition, the check gets erroneously hit when using sample mode to trace multiple threads.
Consequently, fix that case by removing the check.
--- tools/perf/util/auxtrace.c | 4 ---- 1 file changed, 4 deletions(-)
tools/perf/util/auxtrace.c +0 -4
@@ -239,10 +239,6 @@ static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues, queue->set = true; queue->tid = buffer->tid; queue->cpu = buffer->cpu; - }else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { -pr_err ("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n" , - queue->cpu, queue->tid, buffer->cpu, buffer->tid); -return -EINVAL ; } buffer->buffer_nr = queues->next_buffer_nr++;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 31/33 can: dev: Move device back to init netns on owning netns delete
In reply to Greg Kroah-HartmanFrom: Martin Willi <[email protected]>
commit 3a5ca857079ea022e0b1b17fc154f7ad7dbc150f upstream.
When a non-initial netns is destroyed, the usual policy is to delete all virtual network interfaces contained, but move physical interfaces back to the initial netns. This keeps the physical interface visible on the system.
CAN devices are somewhat special, as they define rtnl_link_ops even if they are physical devices. If a CAN interface is moved into a non-initial netns, destroying that netns lets the interface vanish instead of moving it back to the initial netns. default_device_exit() skips CAN interfaces due to having rtnl_link_ops set. Reproducer:
ip netns add foo
ip link set can0 netns foo
ip netns delete foo
WARNING: CPU: 1 PID: 84 at net/core/dev.c:11030 ops_exit_list+0x38/0x60 CPU: 1 PID: 84 Comm: kworker/u4:2 Not tainted 5.10.19 #1 Workqueue: netns cleanup_net [<c010e700>] (unwind_backtrace) from [<c010a1d8>] (show_stack+0x10/0x14) [<c010a1d8>] (show_stack) from [<c086dc10>] (dump_stack+0x94/0xa8) [<c086dc10>] (dump_stack) from [<c086b938>] (__warn+0xb8/0x114) [<c086b938>] (__warn) from [<c086ba10>] (warn_slowpath_fmt+0x7c/0xac) [<c086ba10>] (warn_slowpath_fmt) from [<c0629f20>] (ops_exit_list+0x38/0x60) [<c0629f20>] (ops_exit_list) from [<c062a5c4>] (cleanup_net+0x230/0x380) [<c062a5c4>] (cleanup_net) from [<c0142c20>] (process_one_work+0x1d8/0x438) [<c0142c20>] (process_one_work) from [<c0142ee4>] (worker_thread+0x64/0x5a8) [<c0142ee4>] (worker_thread) from [<c0148a98>] (kthread+0x148/0x14c) [<c0148a98>] (kthread) from [<c0100148>] (ret_from_fork+0x14/0x2c)
To properly restore physical CAN devices to the initial netns on owning netns exit, introduce a flag on rtnl_link_ops that can be set by drivers. For CAN devices setting this flag, default_device_exit() considers them non-virtual, applying the usual namespace move.
The issue was introduced in the commit mentioned below, as at that time CAN devices did not have a dellink() operation.
--- drivers/net/can/dev.c | 1 + include/net/rtnetlink.h | 2 ++ net/core/dev.c | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +1 -0
@@ -1054,6 +1054,7 @@ static void can_dellink(struct net_devicstatic struct rtnl_link_ops can_link_ops__read_mostly = { .kind ="can" , + .netns_refund = true, .maxtype =IFLA_CAN_MAX , .policy = can_policy, .setup = can_setup,
include/net/rtnetlink.h +2 -0
@@ -28,6 +28,7 @@ static inline int rtnl_msg_family(const* * @list: Used internally * @kind: Identifier +* @netns_refund: Physical device, move to init_net on netns exit * @maxtype: Highest device specific netlink attribute number * @policy: Netlink policy for device specific attribute validation * @validate: Optional validation function for netlink/changelink parameters
@@ -81,6 +82,7 @@ struct rtnl_link_ops {unsigned int (*get_num_tx_queues)(void );unsigned int (*get_num_rx_queues)(void ); +bool netns_refund;int slave_maxtype;const struct nla_policy *slave_policy; int (*slave_validate)(struct nlattr *tb[],
net/core/dev.c +1 -1
@@ -7773,7 +7773,7 @@ static void __net_exit default_device_excontinue ;/* Leave virtual devices for the generic cleanup */ -if (dev->rtnl_link_ops) +if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)continue ;/* Push remaining network devices to init_net */
Greg Kroah-Hartman
maintainerPATCH 32/33 net: sched: validate stab values
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit e323d865b36134e8c5c82c834df89109a5c60dab upstream.
iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports.
Add stab parameter to red_check_params() to validate user input.
syzbot reported:
UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
--- include/net/red.h | 10 +++++++++- net/sched/sch_choke.c | 7 ++++--- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +++++-- net/sched/sch_sfq.c | 2 +- 5 files changed, 20 insertions(+), 8 deletions(-)
include/net/red.h +9 -1
@@ -167,7 +167,8 @@ static inline void red_set_vars(struct r v->qcount =-1 ; } -static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog,u8 Scell_log) +static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog, +u8 Scell_log,u8 *stab) {if (fls (qth_min) + Wlog >32 )return false;
@@ -177,6 +178,13 @@ static inline bool red_check_params(u32return false;if (qth_max < qth_min)return false; +if (stab) { +int i; + +for (i =0 ; i <RED_STAB_SIZE ; i++) +if (stab[i] >=32 ) +return false; + }return true; }
net/sched/sch_choke.c +4 -3
@@ -423,6 +423,7 @@ static int choke_change(struct Qdisc *scstruct sk_buff **old =NULL ;unsigned int mask;u32 max_P; +u8 *stab;if (opt ==NULL )return -EINVAL ;
@@ -438,8 +439,8 @@ static int choke_change(struct Qdisc *sc max_P = tb[TCA_CHOKE_MAX_P ] ?nla_get_u32 (tb[TCA_CHOKE_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_CHOKE_PARMS ]); - -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_CHOKE_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))return -EINVAL ;if (ctl->limit >CHOKE_MAX_QUEUE )
@@ -492,7 +493,7 @@ static int choke_change(struct Qdisc *scred_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_CHOKE_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_gred.c +1 -1
@@ -389,7 +389,7 @@ static inline int gred_change_vq(structstruct gred_sched *table =qdisc_priv (sch);struct gred_sched_data *q = table->tab[dp]; -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))return -EINVAL ;if (!q) {
net/sched/sch_red.c +5 -2
@@ -188,6 +188,7 @@ static int red_change(struct Qdisc *sch,struct Qdisc *child =NULL ;int err;u32 max_P; +u8 *stab;if (opt ==NULL )return -EINVAL ;
@@ -203,7 +204,9 @@ static int red_change(struct Qdisc *sch, max_P = tb[TCA_RED_MAX_P ] ?nla_get_u32 (tb[TCA_RED_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_RED_PARMS ]); -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_RED_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Scell_log, stab))return -EINVAL ;if (ctl->limit >0 ) {
@@ -225,7 +228,7 @@ static int red_change(struct Qdisc *sch,red_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_RED_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_sfq.c +1 -1
@@ -645,7 +645,7 @@ static int sfq_change(struct Qdisc *sch, }if (ctl_v1 && !red_check_params (ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, ctl_v1->Scell_log)) + ctl_v1->Wlog, ctl_v1->Scell_log,NULL ))return -EINVAL ;if (ctl_v1 && ctl_v1->qth_min) { p =kmalloc (sizeof (*p),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 33/33 mac80211: fix double free in ibss_leave
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
commit 3bd801b14e0c5d29eeddc7336558beb3344efaa3 upstream.
Clear beacon ie pointer and ie length after free
in order to prevent double free.
==================================================================
BUG: KASAN: double-free or invalid-free \ in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355 ____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341 kasan_slab_free include/linux/kasan.h:192 [inline] __cache_free mm/slab.c:3424 [inline] kfree+0xed/0x270 mm/slab.c:3760 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline] __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172 cfg80211_leave net/wireless/core.c:1221 [inline] cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_close_many+0xee/0x2e0 net/core/dev.c:1586 __dev_close net/core/dev.c:1624 [inline] __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476 dev_change_flags+0x8a/0x160 net/core/dev.c:8549 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060 sock_ioctl+0x477/0x6a0 net/socket.c:1177 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- net/mac80211/ibss.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/ibss.c +2 -0
@@ -1860,6 +1860,8 @@ int ieee80211_ibss_leave(struct ieee8021/* remove beacon */ kfree (sdata->u.ibss.ie); + sdata->u.ibss.ie =NULL ; + sdata->u.ibss.ie_len =0 ;/* on the next join, re-program HT parameters */ memset (&ifibss->ht_capa,0 ,sizeof (ifibss->ht_capa));
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.4.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.19.y
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
Build results:
total: 160 pass: 160 fail: 0 Qemu test results: total: 328 pass: 328 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.4.264-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 5fccbcb46b8844500db24690cef618c294ac0ca5
git describe: v4.4.263-34-g5fccbcb46b88
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.4.y/build/v4.4.263-34-g5fccbcb46b88
No regressions (compared to build v4.4.263)
No fixes (compared to build v4.4.263)
Ran 34815 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- i386
- juno-64k_page_size
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- mips
- qemu-arm-debug
- qemu-arm64-debug
- qemu-arm64-kasan
- qemu-i386-debug
- qemu-x86_64-debug
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
- x86_64
Test Suites
-----------
* build
* linux-log-parser
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* ltp-dio-tests
* ltp-fs-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-open-posix-tests
* ltp-pty-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* network-basic-tests
* perf
* v4l2-compliance
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* kvm-unit-tests
* libhugetlbfs
* ltp-commands-tests
* ltp-cve-tests
* ltp-math-tests
* ltp-sched-tests
* ltp-tracing-tests
* install-android-platform-tools-r2600
* kselftest-sync
* fwts
* kselftest-lib
* kselftest-membarrier
* ssuite
Summary
------------------------------------------------------------------------
kernel: 4.4.264-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git branch: 4.4.264-rc1-hikey-20210329-975
git commit: 094469e4d2aa566c4760fef99d768edd36eeac85
git describe: 4.4.264-rc1-hikey-20210329-975
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.264-rc1-hikey-20210329-975
No regressions (compared to build 4.4.264-rc1-hikey-20210327-972)
No fixes (compared to build 4.4.264-rc1-hikey-20210327-972)
Ran 810 total tests in the following environments and test suites.
Environments
--------------
- hi6220-hikey - arm64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-lib
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-membarrier
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-zram
* libhugetlbfs
* linux-log-parser
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* perf
* v4l2-compliance
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.264 release. There are 33 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.4:
6 builds: 6 pass, 0 fail
12 boots: 12 pass, 0 fail
30 tests: 30 pass, 0 failLinux version: 4.4.264-rc1-g5fccbcb46b88
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra30-cardhu-a04
Jon