4.19.207-rc1 review
Subsystems (6)
Greg Kroah-Hartman
maintainercover 4.19.207-rc1 review
This is the start of the stable review cycle for the 4.19.207 release. There are 293 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 22 Sep 2021 16:38:49 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.207-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.207-rc1
Yoshihiro Shimoda <[email protected]>
net: renesas: sh_eth: Fix freeing wrong tx descriptor
Willem de Bruijn <[email protected]>
ip_gre: validate csum_start only on pull
Dinghao Liu <[email protected]>
qlcnic: Remove redundant unlock in qlcnic_pinit_from_rom
Eric Dumazet <[email protected]>
fq_codel: reject silly quantum parameters
Benjamin Hesmans <[email protected]>
netfilter: socket: icmp6: fix use-after-scope
Rafał Miłecki <[email protected]>
net: dsa: b53: Fix calculating number of switch ports
Randy Dunlap <[email protected]>
ARC: export clear_user_page() for modules
Christophe JAILLET <[email protected]>
mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()'
Andy Shevchenko <[email protected]>
PCI: Sync __pci_register_driver() stub for CONFIG_PCI=n
Oliver Upton <[email protected]>
KVM: arm64: Handle PSCI resets before userspace touches vCPU state
Dan Carpenter <[email protected]>
PCI: Fix pci_dev_str_match_path() alloc while atomic bug
Hans de Goede <[email protected]>
mfd: axp20x: Update AXP288 volatile ranges
Yang Li <[email protected]>
NTB: perf: Fix an error code in perf_setup_inbuf()
Yang Li <[email protected]>
ethtool: Fix an error code in cxgb2.c
Paolo Valente <[email protected]>
block, bfq: honor already-setup queue merges
Daniele Palmas <[email protected]>
net: usb: cdc_mbim: avoid altsetting toggling for Telit LN920
George Cherian <[email protected]>
PCI: Add ACS quirks for Cavium multi-function devices
Marc Zyngier <[email protected]>
mfd: Don't use irq_create_mapping() to resolve a mapping
Miquel Raynal <[email protected]>
dt-bindings: mtd: gpmc: Fix the ECC bytes vs. OOB bytes equation
Halil Pasic <[email protected]>
KVM: s390: index kvm->arch.idle_mask by vcpu_idx
David Hildenbrand <[email protected]>
mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
Yufeng Mo <[email protected]>
net: hns3: pad the short tunnel frame before sending to hardware
Sukadev Bhattiprolu <[email protected]>
ibmvnic: check failover_pending in login response
Shai Malin <[email protected]>
qed: Handle management FW error
zhenggy <[email protected]>
tcp: fix tp->undo_retrans accounting in tcp_sacktag_one()
Vladimir Oltean <[email protected]>
net: dsa: destroy the phylink instance on any error in dsa_slave_phy_setup
Eric Dumazet <[email protected]>
net/af_unix: fix a data-race in unix_dgram_poll
Baptiste Lepers <[email protected]>
events: Reuse value read using READ_ONCE instead of re-reading it
Maor Gottlieb <[email protected]>
net/mlx5: Fix potential sleeping in atomic context
Michael Petlan <[email protected]>
perf machine: Initialize srcline string member in add_location struct
Hoang Le <[email protected]>
tipc: increase timeout in tipc_sk_enqueue()
Florian Fainelli <[email protected]>
r6040: Restore MDIO clock frequency after MAC reset
Xiyu Yang <[email protected]>
net/l2tp: Fix reference count leak in l2tp_udp_recv_core
Lin, Zhenpeng <[email protected]>
dccp: don't duplicate ccid when cloning dccp sock
Randy Dunlap <[email protected]>
ptp: dp83640: don't define PAGE0
Eric Dumazet <[email protected]>
net-caif: avoid user-triggerable WARN_ON(1)
Xin Long <[email protected]>
tipc: fix an use-after-free issue in tipc_recvmsg
Mike Rapoport <[email protected]>
x86/mm: Fix kern_addr_valid() to cope with existing but not present entries
Evan Quan <[email protected]>
PCI: Add AMD GPU multi-function power dependencies
Juergen Gross <[email protected]>
PM: base: power: don't try to use non-existing RTC for storing data
Mark Brown <[email protected]>
arm64/sve: Use correct size when reinitialising SVE state
Adrian Bunk <[email protected]>
bnx2x: Fix enabling network interfaces without VFs
Juergen Gross <[email protected]>
xen: reset legacy rtc flag for PV domU
Ye Bin <[email protected]>
dm thin metadata: Fix use-after-free in dm_bm_set_read_only
Andrey Grodzovsky <[email protected]>
drm/amdgpu: Fix BUG_ON assert
Patryk Duda <[email protected]>
platform/chrome: cros_ec_proto: Send command again when timeout occurs
Vasily Averin <[email protected]>
memcg: enable accounting for pids in nested pid namespaces
Liu Zixian <[email protected]>
mm/hugetlb: initialize hugetlb_usage in mm_init
Pratik R. Sampat <[email protected]>
cpufreq: powernv: Fix init_chip_info initialization in numa=off
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Sync queue idx with queue_pair_map idx
Maciej W. Rozycki <[email protected]>
scsi: BusLogic: Fix missing pr_cont() use
chenying <[email protected]>
ovl: fix BUG_ON() in may_delete() when called from ovl_cleanup()
Mikulas Patocka <[email protected]>
parisc: fix crash with signals and alloca
Yang Yingliang <[email protected]>
net: w5100: check return value after calling platform_get_resource()
王贇 <[email protected]>
net: fix NULL pointer reference in cipso_v4_doi_free
Miaoqing Pan <[email protected]>
ath9k: fix sleeping in atomic context
Zekun Shen <[email protected]>
ath9k: fix OOB read ar9300_eeprom_restore_internal
Colin Ian King <[email protected]>
parport: remove non-zero check on count
Xiaotan Luo <[email protected]>
ASoC: rockchip: i2s: Fixup config for DAIFMT_DSP_A/B
Sugar Zhang <[email protected]>
ASoC: rockchip: i2s: Fix regmap_ops hang
Shuah Khan <[email protected]>
usbip:vhci_hcd USB port can get stuck in the disabled state
Anirudh Rayabharam <[email protected]>
usbip: give back URBs for unsent unlink requests during cleanup
Nadezda Lutovinova <[email protected]>
usb: musb: musb_dsps: request_irq() after initializing musb
Mathias Nyman <[email protected]>
Revert "USB: xhci: fix U1/U2 handling for hardware with XHCI_INTEL_HOST quirk set"
Ding Hui <[email protected]>
cifs: fix wrong release in sess_alloc_buffer() failed path
Nishad Kamdar <[email protected]>
mmc: core: Return correct emmc response in case of ioctl error
Li Zhijian <[email protected]>
selftests/bpf: Enlarge select() timeout for test_maps
Thomas Hebb <[email protected]>
mmc: rtsx_pci: Fix long reads when clock is prescaled
Manish Narani <[email protected]>
mmc: sdhci-of-arasan: Check return value of non-void funtions
Marc Zyngier <[email protected]>
of: Don't allow __of_attached_node_sysfs() without CONFIG_SYSFS
Bob Peterson <[email protected]>
gfs2: Don't call dlm after protocol is unmounted
Kees Cook <[email protected]>
staging: rts5208: Fix get_ms_information() heap buffer size
J. Bruce Fields <[email protected]>
rpc: fix gss_svc_init cleanup on failure
Luke Hsiao <[email protected]>
tcp: enable data-less, empty-cookie SYN with TFO_SERVER_COOKIE_NOT_REQD
Ulrich Hecht <[email protected]>
serial: sh-sci: fix break handling for sysrq
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix handling of LE Enhanced Connection Complete
Andreas Obergschwandtner <[email protected]>
ARM: tegra: tamonten: Fix UART pad setting
Tuo Li <[email protected]>
gpu: drm: amd: amdgpu: amdgpu_i2c: fix possible uninitialized-variable access in amdgpu_i2c_router_select_ddc_port()
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: avoid circular locks in sco_sock_connect
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: schedule SCO timeouts with delayed_work
Nathan Chancellor <[email protected]>
net: ethernet: stmmac: Do not use unreachable() in ipq806x_gmac_probe()
Vinod Koul <[email protected]>
arm64: dts: qcom: sdm660: use reg value for memory node
Sebastian Reichel <[email protected]>
ARM: dts: imx53-ppd: Fix ACHC entry
Evgeny Novikov <[email protected]>
media: tegra-cec: Handle errors of clk_prepare_enable()
Krzysztof Hałasa <[email protected]>
media: TDA1997x: fix tda1997x_query_dv_timings() return value
Hans Verkuil <[email protected]>
media: v4l2-dv-timings.c: fix wrong condition in two for-loops
Umang Jain <[email protected]>
media: imx258: Limit the max analogue gain to 480
Laurent Pinchart <[email protected]>
media: imx258: Rectify mismatch of VTS value
Hans de Goede <[email protected]>
ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output
Yufeng Mo <[email protected]>
bonding: 3ad: fix the concurrency between __bond_release_one() and bond_3ad_state_machine_handler()
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: skip invalid hci_sync_conn_complete_evt
Andy Shevchenko <[email protected]>
ata: sata_dwc_460ex: No need to call phy_exit() befre phy_init()
Juhee Kang <[email protected]>
samples: bpf: Fix tracex7 error raised on the missing argument
Christophe JAILLET <[email protected]>
staging: ks7010: Fix the initialization of the 'sleep_status' structure
Greg Kroah-Hartman <[email protected]>
serial: 8250_pci: make setup_port() parameters explicitly unsigned
Jiri Slaby <[email protected]>
hvsi: don't panic on tty_register_driver failure
Jiri Slaby <[email protected]>
xtensa: ISS: don't panic in rs_init
Maciej W. Rozycki <[email protected]>
serial: 8250: Define RX trigger levels for OxSemi 950 devices
Heiko Carstens <[email protected]>
s390/jump_label: print real address in a case of a jump label bug
Gustavo A. R. Silva <[email protected]>
flow_dissector: Fix out-of-bounds warnings
Gustavo A. R. Silva <[email protected]>
ipv4: ip_output.c: Fix out-of-bounds warning in ip_copy_addrs()
Zheyu Ma <[email protected]>
video: fbdev: riva: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: kyro: Error out if 'pixclock' equals zero
Zheyu Ma <[email protected]>
video: fbdev: asiliantfb: Error out if 'pixclock' equals zero
Johan Almbladh <[email protected]>
bpf/tests: Do not PASS tests without actually testing the result
Johan Almbladh <[email protected]>
bpf/tests: Fix copy-and-paste error in double word test
Anson Jacob <[email protected]>
drm/amd/amdgpu: Update debugfs link_settings output link_rate field in hex
Zheyu Ma <[email protected]>
tty: serial: jsm: hold port lock when reporting modem line changes
Geert Uytterhoeven <[email protected]>
staging: board: Fix uninitialized spinlock when attaching genpd
Jack Pham <[email protected]>
usb: gadget: composite: Allow bMaxPower=0 if self-powered
Maciej Żenczykowski <[email protected]>
usb: gadget: u_ether: fix a potential null pointer dereference
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the actual_length of an iso packet
Kelly Devilliv <[email protected]>
usb: host: fotg210: fix the endpoint's transactional opportunities calculation
Tianjia Zhang <[email protected]>
Smack: Fix wrong semantics in smk_access_entry()
Yajun Deng <[email protected]>
netlink: Deal with ESRCH error in nlmsg_notify()
Zheyu Ma <[email protected]>
video: fbdev: kyro: fix a DoS bug by restricting user input
David Heidelberg <[email protected]>
ARM: dts: qcom: apq8064: correct clock names
Jonathan Cameron <[email protected]>
iio: dac: ad5624r: Fix incorrect handling of an optional regulator.
Xin Long <[email protected]>
tipc: keep the skb in rcv queue until the whole data is read
Rafael J. Wysocki <[email protected]>
PCI: Use pci_update_current_state() in pci_enable_device_flags()
Sean Anderson <[email protected]>
crypto: mxs-dcp - Use sg_mapping_iter to copy data
Mauro Carvalho Chehab <[email protected]>
media: dib8000: rewrite the init prbs logic
Nadav Amit <[email protected]>
userfaultfd: prevent concurrent API initialization
Oleksij Rempel <[email protected]>
MIPS: Malta: fix alignment of the devicetree buffer
Chao Yu <[email protected]>
f2fs: fix to unmap pages from userspace process in punch_hole()
Chao Yu <[email protected]>
f2fs: fix to account missing .skipped_gc_rwsem
David Howells <[email protected]>
fscache: Fix cookie key hashing
Hans de Goede <[email protected]>
platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call
Dan Carpenter <[email protected]>
scsi: qedi: Fix error codes in qedi_alloc_global_queues()
Zhen Lei <[email protected]>
pinctrl: single: Fix error return code in pcs_parse_bits_in_pinctrl_entry()
Randy Dunlap <[email protected]>
openrisc: don't printk() unconditionally
Michal Suchanek <[email protected]>
powerpc/stacktrace: Include linux/delay.h
Jason Gunthorpe <[email protected]>
vfio: Use config not menuconfig for VFIO_NOIOMMU
Jaehyoung Choi <[email protected]>
pinctrl: samsung: Fix pinctrl bank pin count
Leon Romanovsky <[email protected]>
docs: Fix infiniband uverbs minor number
Leon Romanovsky <[email protected]>
RDMA/iwcm: Release resources if iw_cm module initialization fails
Dmitry Torokhov <[email protected]>
HID: input: do not report stylus battery state as "full"
Pali Rohár <[email protected]>
PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
Pali Rohár <[email protected]>
PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
Hyun Kwon <[email protected]>
PCI: xilinx-nwl: Enable the clock through CCF
Krzysztof Wilczyński <[email protected]>
PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
Marek Behún <[email protected]>
PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
David Heidelberg <[email protected]>
ARM: 9105/1: atags_to_fdt: don't warn about stack size
Hans de Goede <[email protected]>
libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
Sean Young <[email protected]>
media: rc-loopback: return number of emitters rather than error
Mauro Carvalho Chehab <[email protected]>
media: uvc: don't do DMA on stack
Wang Hai <[email protected]>
VMCI: fix NULL pointer dereference when unmapping queue pair
Arne Welzel <[email protected]>
dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
Krzysztof Kozlowski <[email protected]>
power: supply: max17042: handle fails of reading status register
Damien Le Moal <[email protected]>
block: bfq: fix bfq_set_next_ioprio_data()
zhenwei pi <[email protected]>
crypto: public_key: fix overflow during implicit conversion
Mark Rutland <[email protected]>
arm64: head: avoid over-mapping in map_memory
Iwona Winiarska <[email protected]>
soc: aspeed: lpc-ctrl: Fix boundary check for mmap
Rolf Eike Beer <[email protected]>
tools/thermal/tmon: Add cross compiling support
Daniel Borkmann <[email protected]>
bpf: Fix pointer arithmetic mask tightening under state pruning
Lorenz Bauer <[email protected]>
bpf: verifier: Allocate idmap scratch in verifier env
Daniel Borkmann <[email protected]>
bpf: Fix leakage due to insufficient speculative store bypass mitigation
Daniel Borkmann <[email protected]>
bpf: Introduce BPF nospec instruction for mitigating Spectre v4
Alexei Starovoitov <[email protected]>
selftests/bpf: fix tests due to const spill/fill
Alexei Starovoitov <[email protected]>
bpf: track spill/fill of constants
Andrey Ignatov <[email protected]>
selftests/bpf: Test variable offset stack access
Andrey Ignatov <[email protected]>
bpf: Sanity check max value for var_off stack access
Andrey Ignatov <[email protected]>
bpf: Reject indirect var_off stack access in unpriv mode
Andrey Ignatov <[email protected]>
bpf: Reject indirect var_off stack access in raw mode
Andrey Ignatov <[email protected]>
bpf: Support variable offset stack access from helpers
Jiong Wang <[email protected]>
bpf: correct slot_type marking logic to allow more stack slot sharing
Edward Cree <[email protected]>
bpf/verifier: per-register parent pointers
Harshvardhan Jha <[email protected]>
9p/xen: Fix end of loop tests for list_for_each_entry
Andy Shevchenko <[email protected]>
include/linux/list.h: add a macro to test if entry is pointing to the head
Juergen Gross <[email protected]>
xen: fix setting of max_pfn in shared_info
Kajol Jain <[email protected]>
powerpc/perf/hv-gpci: Fix counter value parsing
Marek Marczykowski-Górecki <[email protected]>
PCI/MSI: Skip masking MSI-X on Xen PV
Niklas Cassel <[email protected]>
blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
Niklas Cassel <[email protected]>
blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
Desmond Cheong Zhi Xi <[email protected]>
btrfs: reset replace target device to allocation state on close
Dmitry Osipenko <[email protected]>
rtc: tps65910: Correct driver module alias
Linus Walleij <[email protected]>
clk: kirkwood: Fix a clocking boot regression
Daniel Thompson <[email protected]>
backlight: pwm_bl: Improve bootloader/kernel device handover
Tetsuo Handa <[email protected]>
fbmem: don't allow too huge resolutions
THOBY Simon <[email protected]>
IMA: remove the dependency on CRYPTO_MD5
Austin Kim <[email protected]>
IMA: remove -Wmissing-prototypes warning
Zelin Deng <[email protected]>
KVM: x86: Update vCPU's hv_clock before back to guest when tsc_offset is adjusted
Babu Moger <[email protected]>
x86/resctrl: Fix a maybe-uninitialized build warning treated as error
Nguyen Dinh Phi <[email protected]>
tty: Fix data race between tiocsti() and flush_to_ldisc()
Eric Biggers <[email protected]>
ubifs: report correct st_size for encrypted symlinks
Eric Biggers <[email protected]>
f2fs: report correct st_size for encrypted symlinks
Eric Biggers <[email protected]>
ext4: report correct st_size for encrypted symlinks
Eric Biggers <[email protected]>
fscrypt: add fscrypt_symlink_getattr() for computing st_size
Guillaume Nault <[email protected]>
netns: protect netns ID lookups with RCU
Eric Dumazet <[email protected]>
ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
Stefan Wahren <[email protected]>
net: qualcomm: fix QCA7000 checksum handling
Xiyu Yang <[email protected]>
net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
Eric Dumazet <[email protected]>
ipv4: make exception cache less predictible
Zenghui Yu <[email protected]>
bcma: Fix memory leak for internally-handled cores
Dan Carpenter <[email protected]>
ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
Andy Duan <[email protected]>
tty: serial: fsl_lpuart: fix the wrong mapbase value
Christophe JAILLET <[email protected]>
usb: bdc: Fix an error handling path in 'bdc_probe()' when no suitable DMA config is available
Evgeny Novikov <[email protected]>
usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
Sergey Shtylyov <[email protected]>
i2c: mt65xx: fix IRQ check
Len Baker <[email protected]>
CIFS: Fix a potencially linear read overflow
Tony Lindgren <[email protected]>
mmc: moxart: Fix issue with uninitialized dma_slave_config
Tony Lindgren <[email protected]>
mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
Sergey Shtylyov <[email protected]>
i2c: s3c2410: fix IRQ check
Sergey Shtylyov <[email protected]>
i2c: iop3xx: fix deferred probing
Pavel Skripkin <[email protected]>
Bluetooth: add timeout sanity check to hci_inquiry
Nadezda Lutovinova <[email protected]>
usb: gadget: mv_u3d: request_irq() after initializing UDC
Chih-Kang Chang <[email protected]>
mac80211: Fix insufficient headroom issue for AMSDU
Sergey Shtylyov <[email protected]>
usb: phy: tahvo: add IRQ check
Sergey Shtylyov <[email protected]>
usb: host: ohci-tmio: add IRQ check
Kai-Heng Feng <[email protected]>
Bluetooth: Move shutdown callback before flushing tx and rx queue
Sergey Shtylyov <[email protected]>
usb: phy: twl6030: add IRQ checks
Sergey Shtylyov <[email protected]>
usb: phy: fsl-usb: add IRQ check
Sergey Shtylyov <[email protected]>
usb: gadget: udc: at91: add IRQ check
Christophe JAILLET <[email protected]>
drm/msm/dsi: Fix some reference counted resource leaks
Desmond Cheong Zhi Xi <[email protected]>
Bluetooth: fix repeated calls to sco_sock_kill
Krzysztof Kozlowski <[email protected]>
arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
Dmitry Baryshkov <[email protected]>
drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
Colin Ian King <[email protected]>
Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
Stephan Gerhold <[email protected]>
soc: qcom: smsm: Fix missed interrupts if state changes while masked
Rafael J. Wysocki <[email protected]>
PCI: PM: Enable PME if it can be signaled from D3cold
Rafael J. Wysocki <[email protected]>
PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
Colin Ian King <[email protected]>
media: venus: venc: Fix potential null pointer dereference on pointer fmt
Dongliang Mu <[email protected]>
media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
Sergey Shtylyov <[email protected]>
i2c: highlander: add IRQ check
Pavel Skripkin <[email protected]>
net: cipso: fix warnings in netlbl_cipsov4_add_std
Martin KaFai Lau <[email protected]>
tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
Dan Carpenter <[email protected]>
Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
Pavel Skripkin <[email protected]>
media: go7007: remove redundant initialization
Dongliang Mu <[email protected]>
media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
Dongliang Mu <[email protected]>
media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
Geert Uytterhoeven <[email protected]>
soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
Krzysztof Hałasa <[email protected]>
media: TDA1997x: enable EDID support
Chunyan Zhang <[email protected]>
spi: sprd: Fix the wrong WDG_LOAD_VAL
Stefan Berger <[email protected]>
certs: Trigger creation of RSA module signing key if it's not an RSA key
Giovanni Cabiddu <[email protected]>
crypto: qat - use proper type for vf_mask
Phong Hoang <[email protected]>
clocksource/drivers/sh_cmt: Fix wrong setting if don't request IRQ for clock source channel
Hongbo Li <[email protected]>
lib/mpi: use kcalloc in mpi_resize
Tony Lindgren <[email protected]>
spi: spi-pic32: Fix issue with uninitialized dma_slave_config
Tony Lindgren <[email protected]>
spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
Pavel Skripkin <[email protected]>
m68k: emu: Fix invalid free in nfeth_cleanup()
Stian Skjelstad <[email protected]>
udf_get_extendedattr() had no boundary checks.
Desmond Cheong Zhi Xi <[email protected]>
fcntl: fix potential deadlock for &fasync_struct.fa_lock
Giovanni Cabiddu <[email protected]>
crypto: qat - do not export adf_iov_putmsg()
Marco Chiappero <[email protected]>
crypto: qat - fix naming for init/shutdown VF to PF notifications
Marco Chiappero <[email protected]>
crypto: qat - fix reuse of completion variable
Giovanni Cabiddu <[email protected]>
crypto: qat - handle both source of interrupt in VF ISR
Giovanni Cabiddu <[email protected]>
crypto: qat - do not ignore errors from enable_vf2pf_comms()
Damien Le Moal <[email protected]>
libata: fix ata_host_start()
Vineeth Vijayan <[email protected]>
s390/cio: add dev_busid sysfs entry for each subchannel
Sebastian Krzyszkowiak <[email protected]>
power: supply: max17042_battery: fix typo in MAx17042_TOFF
Ruozhu Li <[email protected]>
nvme-rdma: don't update queue count when failing to set io queues
Christoph Hellwig <[email protected]>
bcache: add proper error unwinding in bcache_device_init
Pali Rohár <[email protected]>
isofs: joliet: Fix iocharset=utf8 mount option
Jan Kara <[email protected]>
udf: Check LVID earlier
Thomas Gleixner <[email protected]>
hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
Dietmar Eggemann <[email protected]>
sched/deadline: Fix missing clock update in migrate_task_rq_dl()
Tony Lindgren <[email protected]>
crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
Hans de Goede <[email protected]>
power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
Quentin Perret <[email protected]>
sched/deadline: Fix reset_on_fork reporting of DL tasks
Sean Anderson <[email protected]>
crypto: mxs-dcp - Check for DMA mapping errors
Jeongtae Park <[email protected]>
regmap: fix the offset of register error log
Peter Zijlstra <[email protected]>
locking/mutex: Fix HANDOFF condition
Marek Behún <[email protected]>
PCI: Call Max Payload Size-related fixup quirks early
Paul Gortmaker <[email protected]>
x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
Chunfeng Yun <[email protected]>
usb: mtu3: fix the wrong HS mult value
Chunfeng Yun <[email protected]>
usb: mtu3: use @mult for HS isoc or intr
Yoshihiro Shimoda <[email protected]>
usb: host: xhci-rcar: Don't reload firmware after the completion
Alexander Tsoy <[email protected]>
ALSA: usb-audio: Add registration quirk for JBL Quantum 800
Qu Wenruo <[email protected]>
Revert "btrfs: compression: don't try to compress if we don't have enough pages"
Muchun Song <[email protected]>
mm/page_alloc: speed up the iteration of max_order
Esben Haabendal <[email protected]>
net: ll_temac: Remove left-over debug message
Fangrui Song <[email protected]>
powerpc/boot: Delete unneeded .globl _zimage_start
Michael Ellerman <[email protected]>
powerpc/module64: Fix comment in R_PPC64_ENTRY handling
Christophe Leroy <[email protected]>
crypto: talitos - reduce max key size for SEC1
Trond Myklebust <[email protected]>
SUNRPC/nfs: Fix return value for nfs4_callback_compound()
Mathieu Desnoyers <[email protected]>
ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
Tom Rix <[email protected]>
USB: serial: mos7720: improve OOM-handling in read_mos_reg()
Liu Jian <[email protected]>
igmp: Add ip_mc_list lock in ip_check_mc_rcu
Colin Ian King <[email protected]>
ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
Yang Yingliang <[email protected]>
ARM: imx: add missing clk_disable_unprepare()
Pavel Skripkin <[email protected]>
media: stkwebcam: fix memory leak in stk_camera_probe
Greg Kroah-Hartman <[email protected]>
clk: fix build warning for orphan_list
Zubin Mithra <[email protected]>
ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
Ben Dooks <[email protected]>
ARM: 8918/2: only build return_address() if needed
Christoph Hellwig <[email protected]>
cryptoloop: add a deprecation warning
Kim Phillips <[email protected]>
perf/x86/amd/ibs: Work around erratum #1197
Xiaoyao Li <[email protected]>
perf/x86/intel/pt: Fix mask of num_address_ranges
Shai Malin <[email protected]>
qede: Fix memset corruption
Harini Katakam <[email protected]>
net: macb: Add a NULL check on desc_ptp
Shai Malin <[email protected]>
qed: Fix the VF msix vectors flow
Krzysztof Hałasa <[email protected]>
gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
Randy Dunlap <[email protected]>
xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
Theodore Ts'o <[email protected]>
ext4: fix race writing to an inline_data file while its xattrs are changing
-------------
Diffstat:
Documentation/admin-guide/devices.txt | 6 +- .../devicetree/bindings/mtd/gpmc-nand.txt | 2 +- Makefile | 4 +- arch/arc/mm/cache.c | 2 +- arch/arm/boot/compressed/Makefile | 2 + arch/arm/boot/dts/imx53-ppd.dts | 23 +- arch/arm/boot/dts/qcom-apq8064.dtsi | 6 +- arch/arm/boot/dts/tegra20-tamonten.dtsi | 14 +- arch/arm/kernel/Makefile | 6 +- arch/arm/kernel/return_address.c | 4 - arch/arm/mach-imx/mmdc.c | 14 +- arch/arm/net/bpf_jit_32.c | 3 + arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- arch/arm64/boot/dts/qcom/ipq8074-hk01.dts | 2 +- arch/arm64/include/asm/kernel-pgtable.h | 4 +- arch/arm64/kernel/fpsimd.c | 2 +- arch/arm64/kernel/head.S | 11 +- arch/arm64/net/bpf_jit_comp.c | 13 + arch/m68k/emu/nfeth.c | 4 +- arch/mips/mti-malta/malta-dtshim.c | 2 +- arch/mips/net/ebpf_jit.c | 3 + arch/openrisc/kernel/entry.S | 2 + arch/parisc/kernel/signal.c | 6 + arch/powerpc/boot/crt0.S | 3 - arch/powerpc/kernel/module_64.c | 2 +- arch/powerpc/kernel/stacktrace.c | 1 + arch/powerpc/net/bpf_jit_comp64.c | 6 + arch/powerpc/perf/hv-gpci.c | 2 +- arch/s390/kernel/jump_label.c | 2 +- arch/s390/kvm/interrupt.c | 4 +- arch/s390/kvm/kvm-s390.h | 2 +- arch/s390/net/bpf_jit_comp.c | 5 + arch/sparc/net/bpf_jit_comp_64.c | 3 + arch/x86/events/amd/ibs.c | 8 + arch/x86/events/intel/pt.c | 2 +- arch/x86/kernel/cpu/intel_rdt_monitor.c | 6 + arch/x86/kernel/reboot.c | 3 +- arch/x86/kvm/x86.c | 4 + arch/x86/mm/init_64.c | 6 +- arch/x86/net/bpf_jit_comp.c | 7 + arch/x86/net/bpf_jit_comp32.c | 6 + arch/x86/xen/enlighten_pv.c | 7 + arch/x86/xen/p2m.c | 4 +- arch/xtensa/Kconfig | 2 +- arch/xtensa/platforms/iss/console.c | 17 +- block/bfq-iosched.c | 18 +- block/blk-zoned.c | 6 - certs/Makefile | 8 + drivers/ata/libata-core.c | 6 +- drivers/ata/sata_dwc_460ex.c | 12 +- drivers/base/power/trace.c | 10 + drivers/base/regmap/regmap.c | 2 +- drivers/bcma/main.c | 6 +- drivers/block/Kconfig | 4 +- drivers/block/cryptoloop.c | 2 + drivers/clk/clk.c | 10 +- drivers/clk/mvebu/kirkwood.c | 1 + drivers/clocksource/sh_cmt.c | 30 +- drivers/cpufreq/powernv-cpufreq.c | 16 +- drivers/crypto/mxs-dcp.c | 81 ++-- drivers/crypto/omap-sham.c | 2 +- .../crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 +- drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 +- drivers/crypto/qat/qat_common/adf_common_drv.h | 8 +- drivers/crypto/qat/qat_common/adf_init.c | 5 +- drivers/crypto/qat/qat_common/adf_isr.c | 7 +- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 3 +- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 +- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 +- .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 +- drivers/crypto/talitos.c | 4 + drivers/gpu/drm/amd/amdgpu/amdgpu_i2c.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 2 +- .../drm/amd/display/amdgpu_dm/amdgpu_dm_debugfs.c | 16 +- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 +- drivers/gpu/drm/msm/dsi/dsi.c | 6 +- drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +- drivers/hid/hid-input.c | 2 - drivers/i2c/busses/i2c-highlander.c | 2 +- drivers/i2c/busses/i2c-iop3xx.c | 6 +- drivers/i2c/busses/i2c-mt65xx.c | 2 +- drivers/i2c/busses/i2c-s3c2410.c | 2 +- drivers/iio/dac/ad5624r_spi.c | 18 +- drivers/infiniband/core/iwcm.c | 19 +- drivers/md/bcache/super.c | 16 +- drivers/md/dm-crypt.c | 7 +- drivers/md/dm-thin-metadata.c | 2 +- drivers/md/persistent-data/dm-block-manager.c | 14 +- drivers/media/dvb-frontends/dib8000.c | 58 ++- drivers/media/i2c/imx258.c | 4 +- drivers/media/i2c/tda1997x.c | 6 +- drivers/media/platform/qcom/venus/venc.c | 2 + drivers/media/platform/tegra-cec/tegra_cec.c | 10 +- drivers/media/rc/rc-loopback.c | 2 +- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 +- drivers/media/usb/dvb-usb/vp702x.c | 12 +- drivers/media/usb/em28xx/em28xx-input.c | 1 - drivers/media/usb/go7007/go7007-driver.c | 26 -- drivers/media/usb/stkwebcam/stk-webcam.c | 6 +- drivers/media/usb/uvc/uvc_v4l2.c | 34 +- drivers/media/v4l2-core/v4l2-dv-timings.c | 4 +- drivers/mfd/ab8500-core.c | 2 +- drivers/mfd/axp20x.c | 3 +- drivers/mfd/stmpe.c | 4 +- drivers/mfd/tc3589x.c | 2 +- drivers/mfd/wm8994-irq.c | 2 +- drivers/misc/aspeed-lpc-ctrl.c | 2 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 +- drivers/mmc/core/block.c | 3 +- drivers/mmc/host/dw_mmc.c | 1 + drivers/mmc/host/moxart-mmc.c | 1 + drivers/mmc/host/rtsx_pci_sdmmc.c | 36 +- drivers/mmc/host/sdhci-of-arasan.c | 18 +- drivers/mtd/nand/raw/cafe_nand.c | 4 +- drivers/net/bonding/bond_main.c | 3 +- drivers/net/dsa/b53/b53_common.c | 3 +- drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 2 +- drivers/net/ethernet/cadence/macb_ptp.c | 11 +- drivers/net/ethernet/chelsio/cxgb/cxgb2.c | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 9 +- drivers/net/ethernet/ibm/ibmvnic.c | 8 + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 5 +- drivers/net/ethernet/qlogic/qed/qed_main.c | 7 +- drivers/net/ethernet/qlogic/qed/qed_mcp.c | 6 +- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c | 1 - drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- drivers/net/ethernet/rdc/r6040.c | 9 +- drivers/net/ethernet/renesas/sh_eth.c | 1 + .../net/ethernet/stmicro/stmmac/dwmac-ipq806x.c | 18 +- drivers/net/ethernet/wiznet/w5100.c | 2 + drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +- drivers/net/phy/dp83640_reg.h | 2 +- drivers/net/usb/cdc_mbim.c | 5 + drivers/net/wireless/ath/ath6kl/wmi.c | 4 +- drivers/net/wireless/ath/ath9k/ar9003_eeprom.c | 3 +- drivers/net/wireless/ath/ath9k/hw.c | 12 +- drivers/ntb/test/ntb_perf.c | 1 + drivers/nvme/host/rdma.c | 4 +- drivers/of/kobj.c | 2 +- drivers/parport/ieee1284_ops.c | 2 +- drivers/pci/controller/pci-aardvark.c | 11 +- drivers/pci/controller/pcie-xilinx-nwl.c | 12 + drivers/pci/msi.c | 3 + drivers/pci/pci.c | 33 +- drivers/pci/quirks.c | 26 +- drivers/pci/syscall.c | 4 +- drivers/pinctrl/pinctrl-single.c | 1 + drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 9 + drivers/platform/x86/dell-smbios-wmi.c | 1 + drivers/power/supply/axp288_fuel_gauge.c | 4 +- drivers/power/supply/max17042_battery.c | 8 +- drivers/rtc/rtc-tps65910.c | 2 +- drivers/s390/cio/css.c | 17 + drivers/scsi/BusLogic.c | 4 +- drivers/scsi/qedi/qedi_main.c | 14 +- drivers/scsi/qla2xxx/qla_nvme.c | 5 +- drivers/soc/qcom/smsm.c | 11 +- drivers/soc/rockchip/Kconfig | 4 +- drivers/spi/spi-fsl-dspi.c | 1 + drivers/spi/spi-pic32.c | 1 + drivers/spi/spi-sprd-adi.c | 2 +- drivers/staging/board/board.c | 7 +- drivers/staging/ks7010/ks7010_sdio.c | 2 +- drivers/staging/rts5208/rtsx_scsi.c | 10 +- drivers/tty/hvc/hvsi.c | 19 +- drivers/tty/serial/8250/8250_pci.c | 2 +- drivers/tty/serial/8250/8250_port.c | 3 +- drivers/tty/serial/fsl_lpuart.c | 2 +- drivers/tty/serial/jsm/jsm_neo.c | 2 + drivers/tty/serial/jsm/jsm_tty.c | 3 + drivers/tty/serial/sh-sci.c | 7 +- drivers/tty/tty_io.c | 4 +- drivers/usb/gadget/composite.c | 8 +- drivers/usb/gadget/function/u_ether.c | 5 +- drivers/usb/gadget/udc/at91_udc.c | 4 +- drivers/usb/gadget/udc/bdc/bdc_core.c | 3 +- drivers/usb/gadget/udc/mv_u3d_core.c | 19 +- drivers/usb/host/ehci-orion.c | 8 +- drivers/usb/host/fotg210-hcd.c | 41 +- drivers/usb/host/fotg210.h | 5 - drivers/usb/host/ohci-tmio.c | 3 + drivers/usb/host/xhci-rcar.c | 7 + drivers/usb/host/xhci.c | 24 +- drivers/usb/mtu3/mtu3_gadget.c | 6 +- drivers/usb/musb/musb_dsps.c | 13 +- drivers/usb/phy/phy-fsl-usb.c | 2 + drivers/usb/phy/phy-tahvo.c | 4 +- drivers/usb/phy/phy-twl6030-usb.c | 5 + drivers/usb/serial/mos7720.c | 4 +- drivers/usb/usbip/vhci_hcd.c | 32 +- drivers/vfio/Kconfig | 2 +- drivers/video/backlight/pwm_bl.c | 54 +-- drivers/video/fbdev/asiliantfb.c | 3 + drivers/video/fbdev/core/fbmem.c | 6 + drivers/video/fbdev/kyro/fbdev.c | 8 + drivers/video/fbdev/riva/fbdev.c | 3 + fs/btrfs/inode.c | 2 +- fs/btrfs/volumes.c | 3 + fs/cifs/cifs_unicode.c | 9 +- fs/cifs/sess.c | 2 +- fs/crypto/hooks.c | 44 ++ fs/ext4/inline.c | 6 + fs/ext4/symlink.c | 11 +- fs/f2fs/file.c | 4 +- fs/f2fs/gc.c | 4 +- fs/f2fs/namei.c | 11 +- fs/fcntl.c | 5 +- fs/fscache/cookie.c | 14 +- fs/fscache/internal.h | 2 + fs/fscache/main.c | 39 ++ fs/gfs2/lock_dlm.c | 5 + fs/isofs/inode.c | 27 +- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +- fs/nfs/callback_xdr.c | 2 +- fs/overlayfs/dir.c | 6 +- fs/ubifs/file.c | 12 +- fs/udf/misc.c | 13 +- fs/udf/super.c | 25 +- fs/userfaultfd.c | 93 ++-- include/crypto/public_key.h | 4 +- include/linux/bpf_verifier.h | 19 +- include/linux/filter.h | 15 + include/linux/fscrypt_notsupp.h | 6 + include/linux/fscrypt_supp.h | 1 + include/linux/hugetlb.h | 9 + include/linux/list.h | 29 +- include/linux/memory_hotplug.h | 4 +- include/linux/pci.h | 5 +- include/linux/power/max17042_battery.h | 2 +- include/linux/skbuff.h | 2 +- include/linux/sunrpc/svc.h | 2 + include/uapi/linux/pkt_sched.h | 2 + include/uapi/linux/serial_reg.h | 1 + kernel/bpf/core.c | 18 +- kernel/bpf/disasm.c | 16 +- kernel/bpf/verifier.c | 498 ++++++++++----------- kernel/events/core.c | 2 +- kernel/fork.c | 1 + kernel/locking/mutex.c | 15 +- kernel/pid_namespace.c | 3 +- kernel/sched/deadline.c | 8 +- kernel/sched/sched.h | 2 + kernel/time/hrtimer.c | 60 ++- lib/mpi/mpiutil.c | 2 +- lib/test_bpf.c | 13 +- mm/memory_hotplug.c | 4 +- mm/page_alloc.c | 8 +- net/9p/trans_xen.c | 4 +- net/bluetooth/cmtp/cmtp.h | 2 +- net/bluetooth/hci_core.c | 14 + net/bluetooth/hci_event.c | 108 +++-- net/bluetooth/sco.c | 85 ++-- net/caif/chnl_net.c | 19 +- net/core/flow_dissector.c | 12 +- net/core/net_namespace.c | 18 +- net/dccp/minisocks.c | 2 + net/dsa/slave.c | 12 +- net/ipv4/icmp.c | 23 +- net/ipv4/igmp.c | 2 + net/ipv4/ip_gre.c | 9 +- net/ipv4/ip_output.c | 5 +- net/ipv4/route.c | 48 +- net/ipv4/tcp_fastopen.c | 3 +- net/ipv4/tcp_input.c | 2 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv6/netfilter/nf_socket_ipv6.c | 4 +- net/l2tp/l2tp_core.c | 4 +- net/mac80211/tx.c | 4 +- net/netlabel/netlabel_cipso_v4.c | 12 +- net/netlink/af_netlink.c | 4 +- net/sched/sch_cbq.c | 2 +- net/sched/sch_fq_codel.c | 12 +- net/sunrpc/auth_gss/svcauth_gss.c | 2 +- net/sunrpc/svc.c | 27 +- net/tipc/socket.c | 36 +- net/unix/af_unix.c | 2 +- samples/bpf/test_override_return.sh | 1 + samples/bpf/tracex7_user.c | 5 + security/integrity/ima/Kconfig | 1 - security/integrity/ima/ima_mok.c | 2 +- security/smack/smack_access.c | 17 +- sound/core/pcm_lib.c | 2 +- sound/soc/intel/boards/bytcr_rt5640.c | 9 +- sound/soc/rockchip/rockchip_i2s.c | 35 +- sound/usb/quirks.c | 1 + tools/perf/util/machine.c | 1 + tools/testing/selftests/bpf/test_maps.c | 2 +- tools/testing/selftests/bpf/test_verifier.c | 144 +++++- tools/thermal/tmon/Makefile | 2 +- virt/kvm/arm/arm.c | 8 + 294 files changed, 2182 insertions(+), 1183 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/293 ext4: fix race writing to an inline_data file while its xattrs are changing
From: Theodore Ts'o <[email protected]>
commit a54c4613dac1500b40e4ab55199f7c51f028e848 upstream.
The location of the system.data extended attribute can change whenever xattr_sem is not taken. So we need to recalculate the i_inline_off field since it mgiht have changed between ext4_write_begin() and ext4_write_end().
This means that caching i_inline_off is probably not helpful, so in the long run we should probably get rid of it and shrink the in-memory ext4 inode slightly, but let's fix the race the simple way for now.
--- fs/ext4/inline.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/inline.c +6 -0
@@ -750,6 +750,12 @@ int ext4_write_inline_data_end(struct inext4_write_lock_xattr (inode, &no_expand);BUG_ON (!ext4_has_inline_data (inode)); +/* +* ei->i_inline_off may have changed since ext4_write_begin() +* called ext4_try_to_write_inline_data() +*/ + (void )ext4_find_inline_data_nolock (inode); + kaddr =kmap_atomic (page);ext4_write_inline_data (inode, &iloc, kaddr, pos, len);kunmap_atomic (kaddr);
Greg Kroah-Hartman
maintainerPATCH 2/293 xtensa: fix kconfig unmet dependency warning for HAVE_FUTEX_CMPXCHG
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
commit ed5aacc81cd41efc4d561e14af408d1003f7b855 upstream.
XTENSA should only select HAVE_FUTEX_CMPXCHG when FUTEX is set/enabled. This prevents a kconfig warning.
WARNING: unmet direct dependencies detected for HAVE_FUTEX_CMPXCHG
Depends on [n]: FUTEX [=n]
Selected by [y]:
- XTENSA [=y] && !MMU [=n]
Message-Id: <[email protected]>
--- arch/xtensa/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/xtensa/Kconfig +1 -1
@@ -25,7 +25,7 @@ config XTENSA select HAVE_DMA_CONTIGUOUS select HAVE_EXIT_THREAD select HAVE_FUNCTION_TRACER - select HAVE_FUTEX_CMPXCHG if !MMU + select HAVE_FUTEX_CMPXCHG if !MMU && FUTEX select HAVE_HW_BREAKPOINT if PERF_EVENTS select HAVE_IRQ_TIME_ACCOUNTING select HAVE_MEMBLOCK
Greg Kroah-Hartman
maintainerPATCH 3/293 gpu: ipu-v3: Fix i.MX IPU-v3 offset calculations for (semi)planar U/V formats
In reply to Greg Kroah-HartmanFrom: Krzysztof Hałasa <[email protected]>
[ Upstream commit 7cca7c8096e2c8a4149405438329b5035d0744f0 ]
Video captured in 1400x1050 resolution (bytesperline aka stride = 1408 bytes) is invalid. Fix it.
--- drivers/gpu/ipu-v3/ipu-cpmem.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/gpu/ipu-v3/ipu-cpmem.c +15 -15
@@ -545,21 +545,21 @@ static const struct ipu_rgb def_bgra_16 = { .bits_per_pixel = 16, }; -#define Y_OFFSET (pix, x, y) ((x) + pix->width * (y)) -#define U_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * ((y) / 2) / 2) + (x) / 2) -#define V_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * pix->height / 4) + \ - (pix->width * ((y) / 2) / 2) + (x) / 2) -#define U2_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * (y) / 2) + (x) / 2) -#define V2_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * pix->height / 2) + \ - (pix->width * (y) / 2) + (x) / 2) -#define UV_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * ((y) / 2)) + (x)) -#define UV2_OFFSET (pix, x, y) ((pix->width * pix->height) + \ - (pix->width * y) + (x)) +#define Y_OFFSET (pix, x, y) ((x) + pix->bytesperline * (y)) +#define U_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * ((y) / 2) / 2) + (x) / 2) +#define V_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * pix->height / 4) + \ + (pix->bytesperline * ((y) / 2) / 2) + (x) / 2) +#define U2_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * (y) / 2) + (x) / 2) +#define V2_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * pix->height / 2) + \ + (pix->bytesperline * (y) / 2) + (x) / 2) +#define UV_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * ((y) / 2)) + (x)) +#define UV2_OFFSET (pix, x, y) ((pix->bytesperline * pix->height) + \ + (pix->bytesperline * y) + (x))#define NUM_ALPHA_CHANNELS 7
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 4/293 qed: Fix the VF msix vectors flow
In reply to Greg Kroah-HartmanFrom: Shai Malin <[email protected]>
[ Upstream commit b0cd08537db8d2fbb227cdb2e5835209db295a24 ]
For VFs we should return with an error in case we didn't get the exact number of msix vectors as we requested.
Not doing that will lead to a crash when starting queues for this VF.
--- drivers/net/ethernet/qlogic/qed/qed_main.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qed/qed_main.c +6 -1
@@ -439,7 +439,12 @@ static int qed_enable_msix(struct qed_dev *cdev, rc = cnt; } -if (rc >0 ) { +/* For VFs, we should return with an error in case we didn't get the +* exact number of msix vectors as we requested. +* Not doing that will lead to a crash when starting queues for +* this VF. +*/ +if ((IS_PF (cdev) && rc >0 ) || (IS_VF (cdev) && rc == cnt)) {/* MSI-x configuration was achieved */ int_params->out.int_mode =QED_INT_MODE_MSIX ; int_params->out.num_vectors = rc;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 5/293 net: macb: Add a NULL check on desc_ptp
In reply to Greg Kroah-HartmanFrom: Harini Katakam <[email protected]>
[ Upstream commit 85520079afce885b80647fbd0d13d8f03d057167 ]
macb_ptp_desc will not return NULL under most circumstances with correct Kconfig and IP design config register. But for the sake of the extreme corner case, check for NULL when using the helper. In case of rx_tstamp, no action is necessary except to return (similar to timestamp disabled) and warn. In case of TX, return -EINVAL to let the skb be free. Perform this check before marking skb in progress.
Fixes coverity warning:
(4) Event dereference:
Dereferencing a null pointer "desc_ptp"
--- drivers/net/ethernet/cadence/macb_ptp.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/net/ethernet/cadence/macb_ptp.c +10 -1
@@ -286,6 +286,12 @@ void gem_ptp_rxstamp(struct macb *bp, struct sk_buff *skb,if (GEM_BFEXT (DMA_RXVALID , desc->addr)) { desc_ptp =macb_ptp_desc (bp, desc); +/* Unlikely but check */ +if (!desc_ptp) { +dev_warn_ratelimited (&bp->pdev->dev, +"Timestamp not supported in BD\n" ); +return ; + }gem_hw_timestamp (bp, desc_ptp->ts_1, desc_ptp->ts_2, &ts);memset (shhwtstamps,0 ,sizeof (struct skb_shared_hwtstamps )); shhwtstamps->hwtstamp =ktime_set (ts.tv_sec, ts.tv_nsec);
@@ -318,8 +324,11 @@ int gem_ptp_txstamp(struct macb_queue *queue, struct sk_buff *skb,if (CIRC_SPACE (head, tail,PTP_TS_BUFFER_SIZE ) ==0 )return -ENOMEM ; -skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; desc_ptp =macb_ptp_desc (queue->bp, desc); +/* Unlikely but check */ +if (!desc_ptp) +return -EINVAL ; +skb_shinfo (skb)->tx_flags |=SKBTX_IN_PROGRESS ; tx_timestamp = &queue->tx_timestamps[head]; tx_timestamp->skb = skb;/* ensure ts_1/ts_2 is loaded after ctrl (TX_USED check) */
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 6/293 qede: Fix memset corruption
In reply to Greg Kroah-HartmanFrom: Shai Malin <[email protected]>
[ Upstream commit e543468869e2532f5d7926e8f417782b48eca3dc ]
Thanks to Kees Cook who detected the problem of memset that starting from not the first member, but sized for the whole struct. The better change will be to remove the redundant memset and to clear only the msix_cnt member.
--- drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/qlogic/qede/qede_main.c +1 -1
@@ -1676,6 +1676,7 @@ static void qede_sync_free_irqs(struct qede_dev *edev) } edev->int_info.used_cnt =0 ; + edev->int_info.msix_cnt =0 ; }static int qede_req_msix_irqs (struct qede_dev *edev)
@@ -2193,7 +2194,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode, goto out; err4:qede_sync_free_irqs (edev); -memset (&edev->int_info.msix_cnt,0 ,sizeof (struct qed_int_info )); err3:qede_napi_disable_remove (edev); err2:
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 7/293 perf/x86/intel/pt: Fix mask of num_address_ranges
In reply to Greg Kroah-HartmanFrom: Xiaoyao Li <[email protected]>
[ Upstream commit c53c6b7409f4cd9e542991b53d597fbe2751d7db ]
Per SDM, bit 2:0 of CPUID(0x14,1).EAX[2:0] reports the number of configurable address ranges for filtering, not bit 1:0.
--- arch/x86/events/intel/pt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/events/intel/pt.c +1 -1
@@ -69,7 +69,7 @@ static struct pt_cap_desc {PT_CAP (topa_multiple_entries,0 ,CPUID_ECX ,BIT (1 )),PT_CAP (single_range_output,0 ,CPUID_ECX ,BIT (2 )),PT_CAP (payloads_lip,0 ,CPUID_ECX ,BIT (31 )), -PT_CAP (num_address_ranges,1 ,CPUID_EAX ,0x3 ), +PT_CAP (num_address_ranges,1 ,CPUID_EAX ,0x7 ),PT_CAP (mtc_periods,1 ,CPUID_EAX ,0xffff0000 ),PT_CAP (cycle_thresholds,1 ,CPUID_EBX ,0xffff ), PT_CAP(psb_periods, 1, CPUID_EBX, 0xffff0000),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 8/293 perf/x86/amd/ibs: Work around erratum #1197
In reply to Greg Kroah-HartmanFrom: Kim Phillips <[email protected]>
[ Upstream commit 26db2e0c51fe83e1dd852c1321407835b481806e ]
Erratum #1197 "IBS (Instruction Based Sampling) Register State May be Incorrect After Restore From CC6" is published in a document:
"Revision Guide for AMD Family 19h Models 00h-0Fh Processors" 56683 Rev. 1.04 July 2021
https://bugzilla.kernel.org/show_bug.cgi?id=206537
Implement the erratum's suggested workaround and ignore IBS samples if MSRC001_1031 == 0.
--- arch/x86/events/amd/ibs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/events/amd/ibs.c +8 -0
@@ -90,6 +90,7 @@ struct perf_ibs {unsigned long offset_mask[1 ];int offset_max; unsigned int fetch_count_reset_broken : 1; + unsigned int fetch_ignore_if_zero_rip : 1;struct cpu_perf_ibs __percpu *pcpu;struct attribute **format_attrs;
@@ -674,6 +675,10 @@ fail:if (check_rip && (ibs_data.regs[2 ] &IBS_RIP_INVALID )) { regs.flags &= ~PERF_EFLAGS_EXACT ; }else { +/* Workaround for erratum #1197 */ +if (perf_ibs->fetch_ignore_if_zero_rip && !(ibs_data.regs[1 ])) + goto out; +set_linear_ip (®s, ibs_data.regs[1 ]); regs.flags |=PERF_EFLAGS_EXACT ; }
@@ -767,6 +772,9 @@ static __init void perf_event_ibs_init(void)if (boot_cpu_data.x86 >=0x16 && boot_cpu_data.x86 <=0x18 ) perf_ibs_fetch.fetch_count_reset_broken =1 ; +if (boot_cpu_data.x86 ==0x19 && boot_cpu_data.x86_model <0x10 ) + perf_ibs_fetch.fetch_ignore_if_zero_rip =1 ; +perf_ibs_pmu_init (&perf_ibs_fetch,"ibs_fetch" );if (ibs_caps &IBS_CAPS_OPCNT ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 9/293 cryptoloop: add a deprecation warning
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 222013f9ac30b9cec44301daa8dbd0aae38abffb ]
Support for cryptoloop has been officially marked broken and deprecated in favor of dm-crypt (which supports the same broken algorithms if needed) in Linux 2.6.4 (released in March 2004), and support for it has been entirely removed from losetup in util-linux 2.23 (released in April 2013). Add a warning and a deprecation schedule.
--- drivers/block/Kconfig | 4 ++-- drivers/block/cryptoloop.c | 2 ++ 2 files changed, 4 insertions(+), 2 deletions(-)
drivers/block/Kconfig +2 -2
@@ -242,7 +242,7 @@ config BLK_DEV_LOOP_MIN_COUNT dynamically allocated with the /dev/loop-control interface. config BLK_DEV_CRYPTOLOOP - tristate "Cryptoloop Support" + tristate "Cryptoloop Support (DEPRECATED)" select CRYPTO select CRYPTO_CBC depends on BLK_DEV_LOOP
@@ -254,7 +254,7 @@ config BLK_DEV_CRYPTOLOOP WARNING: This device is not safe for journaled file systems like ext3 or Reiserfs. Please use the Device Mapper crypto module instead, which can be configured to be on-disk compatible with the - cryptoloop device. + cryptoloop device. cryptoloop support will be removed in Linux 5.16. source "drivers/block/drbd/Kconfig"
drivers/block/cryptoloop.c +2 -0
@@ -201,6 +201,8 @@ init_cryptoloop(void)if (rc)printk (KERN_ERR "cryptoloop: loop_register_transfer failed\n" ); +else +pr_warn ("the cryptoloop driver has been deprecated and will be removed in in Linux 5.16\n" );return rc; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 10/293 ARM: 8918/2: only build return_address() if needed
In reply to Greg Kroah-HartmanFrom: Ben Dooks <[email protected]>
commit fb033c95c94ca1ee3d16e04ebdb85d65fb55fff8 upstream.
The system currently warns if the config conditions for
building return_address in arch/arm/kernel/return_address.c
are not met, leaving just an EXPORT_SYMBOL_GPL(return_address)
of a function defined to be 'static linline'.
This is a result of aeea3592a13b ("ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h").
Since we're not going to build anything other than an exported symbol for something that is already being defined to be an inline-able return of NULL, just avoid building the code to remove the following warning:
--- arch/arm/kernel/Makefile | 6 +++++- arch/arm/kernel/return_address.c | 4 ---- 2 files changed, 5 insertions(+), 5 deletions(-)
arch/arm/kernel/Makefile +5 -1
@@ -17,10 +17,14 @@ CFLAGS_REMOVE_return_address.o = -pg # Object file lists. obj-y := elf.o entry-common.o irq.o opcodes.o \ - process.o ptrace.o reboot.o return_address.o \ + process.o ptrace.o reboot.o \ setup.o signal.o sigreturn_codes.o \ stacktrace.o sys_arm.o time.o traps.o +ifneq ($(CONFIG_ARM_UNWIND),y) +obj-$(CONFIG_FRAME_POINTER) += return_address.o +endif + obj-$(CONFIG_ATAGS) += atags_parse.o obj-$(CONFIG_ATAGS_PROC) += atags_proc.o obj-$(CONFIG_DEPRECATED_PARAM_STRUCT) += atags_compat.o
arch/arm/kernel/return_address.c +0 -4
@@ -10,8 +10,6 @@*/ #include <linux/export.h> #include <linux/ftrace.h> - -#if defined(CONFIG_FRAME_POINTER ) && !defined(CONFIG_ARM_UNWIND )#include <linux/sched.h> #include <asm/stacktrace.h>
@@ -56,6 +54,4 @@ void *return_address(unsigned int level)return NULL ; } -#endif /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */ -EXPORT_SYMBOL_GPL (return_address);
Greg Kroah-Hartman
maintainerPATCH 11/293 ALSA: pcm: fix divide error in snd_pcm_lib_ioctl
In reply to Greg Kroah-HartmanFrom: Zubin Mithra <[email protected]>
commit f3eef46f0518a2b32ca1244015820c35a22cfe4a upstream.
Syzkaller reported a divide error in snd_pcm_lib_ioctl. fifo_size is of type snd_pcm_uframes_t(unsigned long). If frame_size is 0x100000000, the error occurs.
--- sound/core/pcm_lib.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/pcm_lib.c +1 -1
@@ -1751,7 +1751,7 @@ static int snd_pcm_lib_ioctl_fifo_size(s channels =params_channels (params); frame_size =snd_pcm_format_size (format, channels);if (frame_size >0 ) - params->fifo_size /= (unsigned )frame_size; + params->fifo_size /= frame_size; }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 12/293 clk: fix build warning for orphan_list
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
In the backport of commit bdcf1dc25324 ("clk: Evict unregistered clks from parent caches") to the 4.19.y and 4.14.y stable trees, the orphan_list structure was placed in the wrong location, causing loads of build warnings on systems that do not define CONFIG_DEBUG_FS.
Fix this up by moving the structure to the correct place in the file.
--- drivers/clk/clk.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/clk/clk.c +5 -5
@@ -46,11 +46,6 @@ static struct hlist_head *all_lists[] = NULL, }; -static struct hlist_head *orphan_list[] = { - &clk_orphan_list, -NULL , -}; -/*** private data structures ***/ struct clk_core {
@@ -2629,6 +2624,11 @@ static int inited = 0;static DEFINE_MUTEX (clk_debug_lock);static HLIST_HEAD (clk_debug_list); +static struct hlist_head *orphan_list[] = { + &clk_orphan_list, +NULL , +}; +static void clk_summary_show_one (struct seq_file *s,struct clk_core *c,int level) {
Greg Kroah-Hartman
maintainerPATCH 13/293 media: stkwebcam: fix memory leak in stk_camera_probe
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
commit 514e97674400462cc09c459a1ddfb9bf39017223 upstream.
My local syzbot instance hit memory leak in usb_set_configuration(). The problem was in unputted usb interface. In case of errors after usb_get_intf() the reference should be putted to correclty free memory allocated for this interface.
--- drivers/media/usb/stkwebcam/stk-webcam.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/stkwebcam/stk-webcam.c +4 -2
@@ -1355,7 +1355,7 @@ static int stk_camera_probe(struct usb_iif (!dev->isoc_ep) {pr_err ("Could not find isoc-in endpoint\n" ); err = -ENODEV ; - goto error; + goto error_put; } dev->vsettings.palette =V4L2_PIX_FMT_RGB565 ; dev->vsettings.mode =MODE_VGA ;
@@ -1368,10 +1368,12 @@ static int stk_camera_probe(struct usb_i err =stk_register_video_device (dev);if (err) - goto error; + goto error_put;return 0 ; +error_put: +usb_put_intf (interface); error:v4l2_ctrl_handler_free (hdl);v4l2_device_unregister (&dev->v4l2_dev);
Greg Kroah-Hartman
maintainerPATCH 14/293 ARM: imx: add missing clk_disable_unprepare()
In reply to Greg Kroah-HartmanFrom: Yang Yingliang <[email protected]>
commit f07ec85365807b3939f32d0094a6dd5ce065d1b9 upstream.
clock source is prepared and enabled by clk_prepare_enable() in probe function, but no disable or unprepare in remove and error path.
--- arch/arm/mach-imx/mmdc.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
arch/arm/mach-imx/mmdc.c +9 -3
@@ -109,6 +109,7 @@ struct mmdc_pmu {struct perf_event *mmdc_events[MMDC_NUM_COUNTERS ];struct hlist_node node;struct fsl_mmdc_devtype_data *devtype_data; +struct clk *mmdc_ipg_clk; };/*
@@ -474,11 +475,13 @@ static int imx_mmdc_remove(struct platfocpuhp_state_remove_instance_nocalls (cpuhp_mmdc_state, &pmu_mmdc->node);perf_pmu_unregister (&pmu_mmdc->pmu);iounmap (pmu_mmdc->mmdc_base); +clk_disable_unprepare (pmu_mmdc->mmdc_ipg_clk);kfree (pmu_mmdc);return 0 ; } -static int imx_mmdc_perf_init (struct platform_device *pdev,void __iomem *mmdc_base) +static int imx_mmdc_perf_init (struct platform_device *pdev,void __iomem *mmdc_base, +struct clk *mmdc_ipg_clk) {struct mmdc_pmu *pmu_mmdc;char *name;
@@ -506,6 +509,7 @@ static int imx_mmdc_perf_init(struct pla } mmdc_num =mmdc_pmu_init (pmu_mmdc, mmdc_base, &pdev->dev); + pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk;if (mmdc_num ==0 ) name ="mmdc" ;else
@@ -579,9 +583,11 @@ static int imx_mmdc_probe(struct platfor val &= ~(1 <<BP_MMDC_MAPSR_PSD );writel_relaxed (val, reg); - err =imx_mmdc_perf_init (pdev, mmdc_base); -if (err) + err =imx_mmdc_perf_init (pdev, mmdc_base, mmdc_ipg_clk); +if (err) {iounmap (mmdc_base); +clk_disable_unprepare (mmdc_ipg_clk); + }return err; }
Greg Kroah-Hartman
maintainerPATCH 15/293 ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
commit 20fb73911fec01f06592de1cdbca00b66602ebd7 upstream.
The function imx_mmdc_perf_init recently had a 3rd argument added to it but the equivalent macro was not updated and is still the older 2 argument version. Fix this by adding in the missing 3rd argumement mmdc_ipg_clk.
--- arch/arm/mach-imx/mmdc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/mach-imx/mmdc.c +1 -1
@@ -545,7 +545,7 @@ pmu_free:#else #define imx_mmdc_remove NULL -#define imx_mmdc_perf_init (pdev, mmdc_base) 0 +#define imx_mmdc_perf_init (pdev, mmdc_base, mmdc_ipg_clk) 0#endif static int imx_mmdc_probe (struct platform_device *pdev)
Greg Kroah-Hartman
maintainerPATCH 16/293 igmp: Add ip_mc_list lock in ip_check_mc_rcu
In reply to Greg Kroah-HartmanFrom: Liu Jian <[email protected]>
commit 23d2b94043ca8835bd1e67749020e839f396a1c2 upstream.
I got below panic when doing fuzz test:
Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 4056 Comm: syz-executor.3 Tainted: G B 5.14.0-rc1-00195-gcff5c4254439-dirty #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Call Trace: dump_stack_lvl+0x7a/0x9b panic+0x2cd/0x5af end_report.cold+0x5a/0x5a kasan_report+0xec/0x110 ip_check_mc_rcu+0x556/0x5d0 __mkroute_output+0x895/0x1740 ip_route_output_key_hash_rcu+0x2d0/0x1050 ip_route_output_key_hash+0x182/0x2e0 ip_route_output_flow+0x28/0x130 udp_sendmsg+0x165d/0x2280 udpv6_sendmsg+0x121e/0x24f0 inet6_sendmsg+0xf7/0x140 sock_sendmsg+0xe9/0x180 ____sys_sendmsg+0x2b8/0x7a0 ___sys_sendmsg+0xf0/0x160 __sys_sendmmsg+0x17e/0x3c0 __x64_sys_sendmmsg+0x9e/0x100 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x462eb9 Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f3df5af1c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000462eb9 RDX: 0000000000000312 RSI: 0000000020001700 RDI: 0000000000000007 RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f3df5af26bc R13: 00000000004c372d R14: 0000000000700b10 R15: 00000000ffffffff
It is one use-after-free in ip_check_mc_rcu.
In ip_mc_del_src, the ip_sf_list of pmc has been freed under pmc->lock protection. But access to ip_sf_list in ip_check_mc_rcu is not protected by the lock.
--- net/ipv4/igmp.c | 2 ++ 1 file changed, 2 insertions(+)
net/ipv4/igmp.c +2 -0
@@ -2743,6 +2743,7 @@ int ip_check_mc_rcu(struct in_device *in rv =1 ; }else if (im) {if (src_addr) { +spin_lock_bh (&im->lock);for (psf = im->sources; psf; psf = psf->sf_next) {if (psf->sf_inaddr == src_addr)break ;
@@ -2753,6 +2754,7 @@ int ip_check_mc_rcu(struct in_device *in im->sfcount[MCAST_EXCLUDE ]; else rv = im->sfcount[MCAST_EXCLUDE ] !=0 ; +spin_unlock_bh (&im->lock); }else rv =1 ;/* unspecified source; tentatively allow */ }
Greg Kroah-Hartman
maintainerPATCH 17/293 USB: serial: mos7720: improve OOM-handling in read_mos_reg()
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 161a582bd1d8681095f158d11bc679a58f1d026b upstream.
clang static analysis reports this problem
mos7720.c:352:2: warning: Undefined or garbage value returned to caller
return d;
^~~~~~~~In the parport_mos7715_read_data()'s call to read_mos_reg(), 'd' is only set after the alloc block.
buf = kmalloc(1, GFP_KERNEL); if (!buf) return -ENOMEM;
Although the problem is reported in parport_most7715_read_data(), none of the callee's of read_mos_reg() check the return status.
Make sure to clear the return-value buffer also on allocation failures.
--- drivers/usb/serial/mos7720.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/serial/mos7720.c +3 -1
@@ -226,8 +226,10 @@ static int read_mos_reg(struct usb_seriaint status; buf =kmalloc (1 ,GFP_KERNEL ); -if (!buf) +if (!buf) { + *data =0 ;return -ENOMEM ; + } status =usb_control_msg (usbdev, pipe, request, requesttype, value, index, buf,1 ,MOS_WDR_TIMEOUT );
Greg Kroah-Hartman
maintainerPATCH 18/293 ipv4/icmp: l3mdev: Perform icmp error route lookup on source device routing table (v2)
In reply to Greg Kroah-HartmanFrom: Mathieu Desnoyers <[email protected]>
commit e1e84eb58eb494b77c8389fc6308b5042dcce791 upstream.
As per RFC792, ICMP errors should be sent to the source host.
However, in configurations with Virtual Routing and Forwarding tables, looking up which routing table to use is currently done by using the destination net_device.
commit 9d1a6c4ea43e ("net: icmp_route_lookup should use rt dev to determine L3 domain") changes the interface passed to l3mdev_master_ifindex() and inet_addr_type_dev_table() from skb_in->dev to skb_dst(skb_in)->dev. This effectively uses the destination device rather than the source device for choosing which routing table should be used to lookup where to send the ICMP error.
Therefore, if the source and destination interfaces are within separate VRFs, or one in the global routing table and the other in a VRF, looking up the source host in the destination interface's routing table will fail if the destination interface's routing table contains no route to the source host.
One observable effect of this issue is that traceroute does not work in the following cases:
- Route leaking between global routing table and VRF
- Route leaking between VRFs
Preferably use the source device routing table when sending ICMP error messages. If no source device is set, fall-back on the destination device routing table. Else, use the main routing table (index 0).
[ It has been pointed out that a similar issue may exist with ICMP
errors triggered when forwarding between network namespaces. It would be worthwhile to investigate, but is outside of the scope of this investigation. ]
[ It has also been pointed out that a similar issue exists with
unreachable / fragmentation needed messages, which can be triggered by changing the MTU of eth1 in r1 to 1400 and running:
ip netns exec h1 ping -s 1450 -Mdo -c1 172.16.2.2
Some investigation points to raw_icmp_error() and raw_err() as being involved in this last scenario. The focus of this patch is TTL expired ICMP messages, which go through icmp_route_lookup. Investigation of failure modes related to raw_icmp_error() is beyond this investigation's scope. ]
--- net/ipv4/icmp.c | 23 +++++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-)
net/ipv4/icmp.c +21 -2
@@ -465,6 +465,23 @@ out_bh_enable:local_bh_enable (); } +/* +* The device used for looking up which routing table to use for sending an ICMP +* error is preferably the source whenever it is set, which should ensure the +* icmp error can be sent to the source host, else lookup using the routing +* table of the destination device, else use the main routing table (index 0). +*/ +static struct net_device *icmp_get_route_lookup_dev (struct sk_buff *skb) +{ +struct net_device *route_lookup_dev =NULL ; + +if (skb->dev) + route_lookup_dev = skb->dev; +else if (skb_dst (skb)) + route_lookup_dev =skb_dst (skb)->dev; +return route_lookup_dev; +} + static struct rtable *icmp_route_lookup(struct net *net, struct flowi4 *fl4, struct sk_buff *skb_in,
@@ -473,6 +490,7 @@ static struct rtable *icmp_route_lookup( int type, int code, struct icmp_bxm *param) { + struct net_device *route_lookup_dev;struct rtable *rt, *rt2;struct flowi4 fl4_dec;int err;
@@ -487,7 +505,8 @@ static struct rtable *icmp_route_lookup( fl4->flowi4_proto =IPPROTO_ICMP ; fl4->fl4_icmp_type = type; fl4->fl4_icmp_code = code; - fl4->flowi4_oif =l3mdev_master_ifindex (skb_dst (skb_in)->dev); + route_lookup_dev =icmp_get_route_lookup_dev (skb_in); + fl4->flowi4_oif =l3mdev_master_ifindex (route_lookup_dev);security_skb_classify_flow (skb_in,flowi4_to_flowi (fl4)); rt =ip_route_output_key_hash (net, fl4, skb_in);
@@ -511,7 +530,7 @@ static struct rtable *icmp_route_lookup(if (err) goto relookup_failed; -if (inet_addr_type_dev_table (net,skb_dst (skb_in)->dev, +if (inet_addr_type_dev_table (net, route_lookup_dev, fl4_dec.saddr) ==RTN_LOCAL ) { rt2 =__ip_route_output_key (net, &fl4_dec);if (IS_ERR (rt2))
Greg Kroah-Hartman
maintainerPATCH 19/293 SUNRPC/nfs: Fix return value for nfs4_callback_compound()
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 83dd59a0b9afc3b1a2642fb5c9b0585b1c08768f upstream.
RPC server procedures are normally expected to return a __be32 encoded status value of type 'enum rpc_accept_stat', however at least one function wants to return an authentication status of type 'enum rpc_auth_stat' in the case where authentication fails.
This patch adds functionality to allow this.
--- fs/nfs/callback_xdr.c | 2 +- include/linux/sunrpc/svc.h | 2 ++ net/sunrpc/svc.c | 27 ++++++++++++++++++++++----- 3 files changed, 25 insertions(+), 6 deletions(-)
fs/nfs/callback_xdr.c +1 -1
@@ -991,7 +991,7 @@ static __be32 nfs4_callback_compound(str out_invalidcred:pr_warn_ratelimited ("NFS: NFSv4 callback contains invalid cred\n" ); -return rpc_autherr_badcred; +return svc_return_autherr (rqstp, rpc_autherr_badcred); }/*
include/linux/sunrpc/svc.h +2 -0
@@ -271,6 +271,7 @@ struct svc_rqst {#define RQ_VICTIM (5)/* about to be shut down */ #define RQ_BUSY (6)/* request is busy */ #define RQ_DATA (7)/* request has data */ +#define RQ_AUTHERR (8)/* Request status is auth error */ unsigned long rq_flags;/* flags field */ ktime_t rq_qtime;/* enqueue time */
@@ -504,6 +505,7 @@ unsigned int svc_fill_write_vector(stchar *svc_fill_symlink_pathname (struct svc_rqst *rqstp,struct kvec *first,void *p,size_t total); +__be32 svc_return_autherr (struct svc_rqst *rqstp,__be32 auth_err);#define RPC_MAX_ADDRBUFLEN (63U)
net/sunrpc/svc.c +22 -5
@@ -1146,6 +1146,22 @@ static __printf(2,3) void svc_printk(strextern void svc_tcp_prep_reply_hdr (struct svc_rqst *); +__be32 +svc_return_autherr (struct svc_rqst *rqstp,__be32 auth_err) +{ +set_bit (RQ_AUTHERR , &rqstp->rq_flags); +return auth_err; +} +EXPORT_SYMBOL_GPL (svc_return_autherr); + +static __be32 +svc_get_autherr (struct svc_rqst *rqstp,__be32 *statp) +{ +if (test_and_clear_bit (RQ_AUTHERR , &rqstp->rq_flags)) +return *statp; +return rpc_auth_ok; +} +/* * Common routine for processing the RPC request. */
@@ -1296,11 +1312,9 @@ svc_process_common(struct svc_rqst *rqst procp->pc_release (rqstp); goto dropit; } -if (*statp == rpc_autherr_badcred) { -if (procp->pc_release) - procp->pc_release (rqstp); - goto err_bad_auth; - } + auth_stat =svc_get_autherr (rqstp, statp); +if (auth_stat != rpc_auth_ok) + goto err_release_bad_auth;if (*statp == rpc_success && procp->pc_encode && !procp->pc_encode (rqstp, resv->iov_base + resv->iov_len)) {dprintk ("svc: failed to encode reply\n" );
@@ -1359,6 +1373,9 @@ err_bad_rpc:svc_putnl (resv,2 ); goto sendit; +err_release_bad_auth: +if (procp->pc_release) + procp->pc_release (rqstp); err_bad_auth:dprintk ("svc: authentication failed (%d)\n" ,ntohl (auth_stat)); serv->sv_stats->rpcbadauth++;
Greg Kroah-Hartman
maintainerPATCH 20/293 crypto: talitos - reduce max key size for SEC1
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
commit b8fbdc2bc4e71b62646031d5df5f08aafe15d5ad upstream.
SEC1 doesn't support SHA384/512, so it doesn't require longer keys.
This patch reduces the max key size when the driver is built for SEC1 only.
--- drivers/crypto/talitos.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/crypto/talitos.c +4 -0
@@ -853,7 +853,11 @@ static void talitos_unregister_rng(struc* HMAC_SNOOP_NO_AFEA (HSNA) instead of type IPSEC_ESP */ #define TALITOS_CRA_PRIORITY_AEAD_HSNA (TALITOS_CRA_PRIORITY - 1) +#ifdef CONFIG_CRYPTO_DEV_TALITOS_SEC2 #define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE) +#else +#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA256_BLOCK_SIZE) +#endif #define TALITOS_MAX_IV_LENGTH 16/* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */ struct talitos_ctx {
Greg Kroah-Hartman
maintainerPATCH 21/293 powerpc/module64: Fix comment in R_PPC64_ENTRY handling
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 2fb0a2c989837c976b68233496bbaefb47cd3d6f upstream.
The comment here is wrong, the addi reads from r2 not r12. The code is correct, 0x38420000 = addi r2,r2,0.
--- arch/powerpc/kernel/module_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/kernel/module_64.c +1 -1
@@ -719,7 +719,7 @@ int apply_relocate_add(Elf64_Shdr *sechd/* * If found, replace it with: * addis r2, r12, (.TOC.-func)@ha -* addi r2, r12, (.TOC.-func)@l +* addi r2, r2, (.TOC.-func)@l */ ((uint32_t *)location)[0 ] =0x3c4c0000 +PPC_HA (value); ((uint32_t *)location)[1 ] =0x38420000 +PPC_LO (value);
Greg Kroah-Hartman
maintainerPATCH 22/293 powerpc/boot: Delete unneeded .globl _zimage_start
In reply to Greg Kroah-HartmanFrom: Fangrui Song <[email protected]>
commit 968339fad422a58312f67718691b717dac45c399 upstream.
.globl sets the symbol binding to STB_GLOBAL while .weak sets the binding to STB_WEAK. GNU as let .weak override .globl since binutils-gdb 5ca547dc2399a0a5d9f20626d4bf5547c3ccfddd (1996). Clang integrated assembler let the last win but it may error in the future.
Since it is a convention that only one binding directive is used, just delete .globl.
--- arch/powerpc/boot/crt0.S | 3 --- 1 file changed, 3 deletions(-)
arch/powerpc/boot/crt0.S +0 -3
@@ -49,9 +49,6 @@ p_end: .long _end p_pstack: .long _platform_stack_top #endif - .globl _zimage_start - /* Clang appears to require the .weak directive to be after the symbol - * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ .weak _zimage_start _zimage_start: .globl _zimage_start_lib
Greg Kroah-Hartman
maintainerPATCH 23/293 net: ll_temac: Remove left-over debug message
In reply to Greg Kroah-HartmanFrom: Esben Haabendal <[email protected]>
commit ce03b94ba682a67e8233c9ee3066071656ded58f upstream.
--- drivers/net/ethernet/xilinx/ll_temac_main.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/net/ethernet/xilinx/ll_temac_main.c +1 -3
@@ -736,10 +736,8 @@ temac_start_xmit(struct sk_buff *skb, st/* Kick off the transfer */ lp->dma_out (lp,TX_TAILDESC_PTR , tail_p);/* DMA start */ -if (temac_check_tx_bd_space (lp,MAX_SKB_FRAGS +1 )) { -netdev_info (ndev,"%s -> netif_stop_queue\n" , __func__); +if (temac_check_tx_bd_space (lp,MAX_SKB_FRAGS +1 ))netif_stop_queue (ndev); - }return NETDEV_TX_OK ; }
Greg Kroah-Hartman
maintainerPATCH 24/293 mm/page_alloc: speed up the iteration of max_order
In reply to Greg Kroah-HartmanFrom: Muchun Song <[email protected]>
commit 7ad69832f37e3cea8557db6df7c793905f1135e8 upstream.
When we free a page whose order is very close to MAX_ORDER and greater than pageblock_order, it wastes some CPU cycles to increase max_order to MAX_ORDER one by one and check the pageblock migratetype of that page repeatedly especially when MAX_ORDER is much larger than pageblock_order.
We also should not be checking migratetype of buddy when "order == MAX_ORDER - 1" as the buddy pfn may be invalid, so adjust the condition. With the new check, we don't need the max_order check anymore, so we replace it.
Also adjust max_order initialization so that it's lower by one than previously, which makes the code hopefully more clear.
--- mm/page_alloc.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
mm/page_alloc.c +4 -4
@@ -807,7 +807,7 @@ static inline void __free_one_page(strucstruct page *buddy;unsigned int max_order; - max_order = min_t(unsigned int, MAX_ORDER, pageblock_order + 1); + max_order = min_t(unsigned int, MAX_ORDER - 1, pageblock_order);VM_BUG_ON (!zone_is_initialized (zone));VM_BUG_ON_PAGE (page->flags &PAGE_FLAGS_CHECK_AT_PREP , page);
@@ -820,7 +820,7 @@ static inline void __free_one_page(strucVM_BUG_ON_PAGE (bad_range (zone, page), page); continue_merging: -while (order < max_order -1 ) { +while (order < max_order) { buddy_pfn =__find_buddy_pfn (pfn, order); buddy = page + (buddy_pfn - pfn);
@@ -844,7 +844,7 @@ continue_merging: pfn = combined_pfn; order++; } -if (max_order <MAX_ORDER ) { +if (order <MAX_ORDER -1 ) {/* If we are here, it means order is >= pageblock_order. * We want to prevent merge between freepages on isolate * pageblock and normal pageblock. Without this, pageblock
@@ -865,7 +865,7 @@ continue_merging: is_migrate_isolate(buddy_mt))) goto done_merging; } - max_order++; + max_order = order +1 ; goto continue_merging; }
Greg Kroah-Hartman
maintainerPATCH 25/293 Revert "btrfs: compression: dont try to compress if we dont have enough pages"
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit 4e9655763b82a91e4c341835bb504a2b1590f984 upstream.
This reverts commit f2165627319ffd33a6217275e5690b1ab5c45763.
[BUG]
It's no longer possible to create compressed inline extent after commit f2165627319f ("btrfs: compression: don't try to compress if we don't have enough pages").
[CAUSE]
For compression code, there are several possible reasons we have a range that needs to be compressed while it's no more than one page.
- Compressed inline write
The data is always smaller than one sector and the test lacks the condition to properly recognize a non-inline extent.
- Compressed subpage write
For the incoming subpage compressed write support, we require page alignment of the delalloc range.
And for 64K page size, we can compress just one page into smaller sectors.
For those reasons, the requirement for the data to be more than one page is not correct, and is already causing regression for compressed inline data writeback. The idea of skipping one page to avoid wasting CPU time could be revisited in the future.
[FIX]
Fix it by reverting the offending commit.
--- fs/btrfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/btrfs/inode.c +1 -1
@@ -530,7 +530,7 @@ again:* inode has not been flagged as nocompress. This flag can * change at any time if we discover bad compression ratios. */ -if (nr_pages >1 &&inode_need_compress (inode, start, end)) { +if (inode_need_compress (inode, start, end)) {WARN_ON (pages); pages =kcalloc (nr_pages,sizeof (struct page *),GFP_NOFS );if (!pages) {
Greg Kroah-Hartman
maintainerPATCH 26/293 ALSA: usb-audio: Add registration quirk for JBL Quantum 800
In reply to Greg Kroah-HartmanFrom: Alexander Tsoy <[email protected]>
commit c8b177b6e3a005bd8fb0395a4bc5db3470301c28 upstream.
Add another device ID for JBL Quantum 800. It requires the same quirk as other JBL Quantum devices.
--- sound/usb/quirks.c | 1 + 1 file changed, 1 insertion(+)
sound/usb/quirks.c +1 -0
@@ -1554,6 +1554,7 @@ static const struct registration_quirk rREG_QUIRK_ENTRY (0x0951 ,0x16ed ,2 ),/* Kingston HyperX Cloud Alpha S */ REG_QUIRK_ENTRY (0x0951 ,0x16ea ,2 ),/* Kingston HyperX Cloud Flight S */ REG_QUIRK_ENTRY (0x0ecb ,0x1f46 ,2 ),/* JBL Quantum 600 */ +REG_QUIRK_ENTRY (0x0ecb ,0x1f47 ,2 ),/* JBL Quantum 800 */ REG_QUIRK_ENTRY (0x0ecb ,0x2039 ,2 ),/* JBL Quantum 400 */ REG_QUIRK_ENTRY (0x0ecb ,0x203c ,2 ),/* JBL Quantum 600 */ REG_QUIRK_ENTRY(0x0ecb, 0x203e, 2), /* JBL Quantum 800 */
Greg Kroah-Hartman
maintainerPATCH 27/293 usb: host: xhci-rcar: Dont reload firmware after the completion
In reply to Greg Kroah-HartmanFrom: Yoshihiro Shimoda <[email protected]>
commit 57f3ffdc11143f56f1314972fe86fe17a0dcde85 upstream.
According to the datasheet, "Upon the completion of FW Download, there is no need to write or reload FW.". Otherwise, it's possible to cause unexpected behaviors. So, adds such a condition.
--- drivers/usb/host/xhci-rcar.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/usb/host/xhci-rcar.c +7 -0
@@ -143,6 +143,13 @@ static int xhci_rcar_download_firmware(sconst struct soc_device_attribute *attr;const char *firmware_name; +/* +* According to the datasheet, "Upon the completion of FW Download, +* there is no need to write or reload FW". +*/ +if (readl (regs +RCAR_USB3_DL_CTRL ) &RCAR_USB3_DL_CTRL_FW_SUCCESS ) +return 0 ; + attr =soc_device_match (rcar_quirks_match);if (attr) quirks = (uintptr_t )attr->data;
Greg Kroah-Hartman
maintainerPATCH 28/293 usb: mtu3: use @mult for HS isoc or intr
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit fd7cb394ec7efccc3985feb0978cee4d352e1817 upstream.
For HS isoc or intr, should use @mult but not @burst to save mult value.
--- drivers/usb/mtu3/mtu3_gadget.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/mtu3/mtu3_gadget.c +1 -1
@@ -97,7 +97,7 @@ static int mtu3_ep_enable(struct mtu3_ep usb_endpoint_xfer_int(desc)) { interval = desc->bInterval; interval =clamp_val (interval,1 ,16 ) -1 ; - burst = (max_packet &GENMASK (12 ,11 )) >>11 ; + mult = (max_packet &GENMASK (12 ,11 )) >>11 ; }break ;default :
Greg Kroah-Hartman
maintainerPATCH 29/293 usb: mtu3: fix the wrong HS mult value
In reply to Greg Kroah-HartmanFrom: Chunfeng Yun <[email protected]>
commit 44e4439d8f9f8d0e9da767d1f31e7c211081feca upstream.
usb_endpoint_maxp() returns actual max packet size, @mult will always be zero, fix it by using usb_endpoint_maxp_mult() instead to get mult.
--- drivers/usb/mtu3/mtu3_gadget.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/usb/mtu3/mtu3_gadget.c +2 -4
@@ -69,14 +69,12 @@ static int mtu3_ep_enable(struct mtu3_epu32 interval =0 ;u32 mult =0 ;u32 burst =0 ; -int max_packet;int ret; desc = mep->desc; comp_desc = mep->comp_desc; mep->type =usb_endpoint_type (desc); - max_packet =usb_endpoint_maxp (desc); - mep->maxp = max_packet &GENMASK (10 ,0 ); + mep->maxp =usb_endpoint_maxp (desc);switch (mtu->g.speed) {case USB_SPEED_SUPER :
@@ -97,7 +95,7 @@ static int mtu3_ep_enable(struct mtu3_ep usb_endpoint_xfer_int(desc)) { interval = desc->bInterval; interval =clamp_val (interval,1 ,16 ) -1 ; - mult = (max_packet &GENMASK (12 ,11 )) >>11 ; + mult =usb_endpoint_maxp_mult (desc) -1 ; }break ;default :
Greg Kroah-Hartman
maintainerPATCH 30/293 x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions
In reply to Greg Kroah-HartmanFrom: Paul Gortmaker <[email protected]>
commit a729691b541f6e63043beae72e635635abe5dc09 upstream.
When this platform was relatively new in November 2011, with early BIOS revisions, a reboot quirk was added in commit 6be30bb7d750 ("x86/reboot:
Blacklist Dell OptiPlex 990 known to require PCI reboot")
However, this quirk (and several others) are open-ended to all BIOS versions and left no automatic expiry if/when the system BIOS fixed the issue, meaning that nobody is likely to come along and re-test.
What is really problematic with using PCI reboot as this quirk does, is that it causes this platform to do a full power down, wait one second, and then power back on. This is less than ideal if one is using it for boot testing and/or bisecting kernels when legacy rotating hard disks are installed.
It was only by chance that the quirk was noticed in dmesg - and when disabled it turned out that it wasn't required anymore (BIOS A24), and a default reboot would work fine without the "harshness" of power cycling the machine (and disks) down and up like the PCI reboot does.
Doing a bit more research, it seems that the "newest" BIOS for which the issue was reported[1] was version A06, however Dell[2] seemed to suggest only up to and including version A05, with the A06 having a large number of fixes[3] listed.
As is typical with a new platform, the initial BIOS updates come frequently and then taper off (and in this case, with a revival for CPU CVEs); a search for O990-A<ver>.exe reveals the following dates:
A02 16 Mar 2011
A03 11 May 2011
A06 14 Sep 2011
A07 24 Oct 2011
A10 08 Dec 2011
A14 06 Sep 2012
A16 15 Oct 2012
A18 30 Sep 2013
A19 23 Sep 2015
A20 02 Jun 2017
A23 07 Mar 2018
A24 21 Aug 2018While it's overkill to flash and test each of the above, it would seem likely that the issue was contained within A0x BIOS versions, given the dates above and the dates of issue reports[4] from distros. So rather than just throw out the quirk entirely, limit the scope to just those early BIOS versions, in case people are still running systems from 2011 with the original as-shipped early A0x BIOS versions.
[1] https://lore.kernel.org/lkml/[email protected]/
[2] https://www.dell.com/support/kbdoc/en-ca/000131908/linux-based-operating-systems-stall-upon-reboot-on-optiplex-390-790-990-systems
[3] https://www.dell.com/support/home/en-ca/drivers/driversdetails?driverid=85j10
[4] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/768039
--- arch/x86/kernel/reboot.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kernel/reboot.c +2 -1
@@ -388,10 +388,11 @@ static const struct dmi_system_id reboot }, {/* Handle problems with rebooting on the OptiPlex 990. */ .callback = set_pci_reboot, - .ident = "Dell OptiPlex 990", + .ident = "Dell OptiPlex 990 BIOS A0x", .matches = {DMI_MATCH (DMI_SYS_VENDOR ,"Dell Inc." ),DMI_MATCH (DMI_PRODUCT_NAME ,"OptiPlex 990" ), + DMI_MATCH(DMI_BIOS_VERSION, "A0"), }, }, { /* Handle problems with rebooting on Dell 300's */
Greg Kroah-Hartman
maintainerPATCH 31/293 PCI: Call Max Payload Size-related fixup quirks early
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit b8da302e2955fe4d41eb9d48199242674d77dbe0 upstream.
pci_device_add() calls HEADER fixups after pci_configure_device(), which configures Max Payload Size.
Convert MPS-related fixups to EARLY fixups so pci_configure_mps() takes them into account.
--- drivers/pci/quirks.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/quirks.c +6 -6
@@ -3152,12 +3152,12 @@ static void fixup_mpss_256(struct pci_de { dev->pcie_mpss =1 ;/* 256 bytes */ } -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_SOLARFLARE , -PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0 , fixup_mpss_256); -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_SOLARFLARE , -PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1 , fixup_mpss_256); -DECLARE_PCI_FIXUP_HEADER (PCI_VENDOR_ID_SOLARFLARE , -PCI_DEVICE_ID_SOLARFLARE_SFC4000B , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE , +PCI_DEVICE_ID_SOLARFLARE_SFC4000A_0 , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE , +PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1 , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE , +PCI_DEVICE_ID_SOLARFLARE_SFC4000B , fixup_mpss_256);/* * Intel 5000 and 5100 Memory controllers have an erratum with read completion
Greg Kroah-Hartman
maintainerPATCH 32/293 locking/mutex: Fix HANDOFF condition
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 048661a1f963e9517630f080687d48af79ed784c ]
Yanfei reported that setting HANDOFF should not depend on recomputing @first, only on @first state. Which would then give:
if (ww_ctx || !first)
first = __mutex_waiter_is_first(lock, &waiter);
if (first)
__mutex_set_flag(lock, MUTEX_FLAG_HANDOFF);But because 'ww_ctx || !first' is basically 'always' and the test for first is relatively cheap, omit that first branch entirely.
--- kernel/locking/mutex.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-)
kernel/locking/mutex.c +5 -10
@@ -911,7 +911,6 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass, struct ww_acquire_ctx *ww_ctx, const bool use_ww_ctx) { struct mutex_waiter waiter; -bool first = false;struct ww_mutex *ww;int ret;
@@ -986,6 +985,8 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,set_current_state (state);for (;;) { +bool first; +/* * Once we hold wait_lock, we're serialized against * mutex_unlock() handing the lock off to us, do a trylock
@@ -1014,15 +1015,9 @@ __mutex_lock_common(struct mutex *lock, long state, unsigned int subclass,spin_unlock (&lock->wait_lock);schedule_preempt_disabled (); -/* -* ww_mutex needs to always recheck its position since its waiter -* list is not FIFO ordered. -*/ -if (ww_ctx || !first) { - first =__mutex_waiter_is_first (lock, &waiter); -if (first) -__mutex_set_flag (lock,MUTEX_FLAG_HANDOFF ); - } + first =__mutex_waiter_is_first (lock, &waiter); +if (first) +__mutex_set_flag (lock,MUTEX_FLAG_HANDOFF );set_current_state (state);/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 33/293 regmap: fix the offset of register error log
In reply to Greg Kroah-HartmanFrom: Jeongtae Park <[email protected]>
[ Upstream commit 1852f5ed358147095297a09cc3c6f160208a676d ]
This patch fixes the offset of register error log
by using regmap_get_offset().
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1479,7 +1479,7 @@ static int _regmap_raw_write_impl(struct regmap *map, unsigned int reg,if (ret) {dev_err (map->dev,"Error in caching of register: %x ret: %d\n" , - reg + i, ret); + reg +regmap_get_offset (map, i), ret);return ret; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 34/293 crypto: mxs-dcp - Check for DMA mapping errors
In reply to Greg Kroah-HartmanFrom: Sean Anderson <[email protected]>
[ Upstream commit df6313d707e575a679ada3313358289af24454c0 ]
After calling dma_map_single(), we must also call dma_mapping_error(). This fixes the following warning when compiling with CONFIG_DMA_API_DEBUG:
[ 311.241478] WARNING: CPU: 0 PID: 428 at kernel/dma/debug.c:1027 check_unmap+0x79c/0x96c [ 311.249547] DMA-API: mxs-dcp 2280000.crypto: device driver failed to check map error[device address=0x00000000860cb080] [size=32 bytes] [mapped as single]
--- drivers/crypto/mxs-dcp.c | 45 +++++++++++++++++++++++++++++++--------- 1 file changed, 35 insertions(+), 10 deletions(-)
drivers/crypto/mxs-dcp.c +35 -10
@@ -167,15 +167,19 @@ static struct dcp *global_sdcp;static int mxs_dcp_start_dma (struct dcp_async_ctx *actx) { +int dma_err;struct dcp *sdcp = global_sdcp;const int chan = actx->chan;uint32_t stat;unsigned long ret;struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan]; -dma_addr_t desc_phys =dma_map_single (sdcp->dev, desc,sizeof (*desc),DMA_TO_DEVICE ); + dma_err =dma_mapping_error (sdcp->dev, desc_phys); +if (dma_err) +return dma_err; +reinit_completion (&sdcp->completion[chan]);/* Clear status register. */
@@ -213,18 +217,29 @@ static int mxs_dcp_start_dma(struct dcp_async_ctx *actx)static int mxs_dcp_run_aes (struct dcp_async_ctx *actx,struct ablkcipher_request *req,int init) { +dma_addr_t key_phys, src_phys, dst_phys;struct dcp *sdcp = global_sdcp;struct dcp_dma_desc *desc = &sdcp->coh->desc[actx->chan];struct dcp_aes_req_ctx *rctx =ablkcipher_request_ctx (req);int ret; -dma_addr_t key_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_key, -2 *AES_KEYSIZE_128 , -DMA_TO_DEVICE ); -dma_addr_t src_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_in_buf, -DCP_BUF_SZ ,DMA_TO_DEVICE ); -dma_addr_t dst_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_out_buf, -DCP_BUF_SZ ,DMA_FROM_DEVICE ); + key_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_key, +2 *AES_KEYSIZE_128 ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, key_phys); +if (ret) +return ret; + + src_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_in_buf, +DCP_BUF_SZ ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, src_phys); +if (ret) + goto err_src; + + dst_phys =dma_map_single (sdcp->dev, sdcp->coh->aes_out_buf, +DCP_BUF_SZ ,DMA_FROM_DEVICE ); + ret =dma_mapping_error (sdcp->dev, dst_phys); +if (ret) + goto err_dst;if (actx->fill %AES_BLOCK_SIZE ) {dev_err (sdcp->dev,"Invalid block size!\n" );
@@ -262,10 +277,12 @@ static int mxs_dcp_run_aes(struct dcp_async_ctx *actx, ret =mxs_dcp_start_dma (actx); aes_done_run: +dma_unmap_single (sdcp->dev, dst_phys,DCP_BUF_SZ ,DMA_FROM_DEVICE ); +err_dst: +dma_unmap_single (sdcp->dev, src_phys,DCP_BUF_SZ ,DMA_TO_DEVICE ); +err_src:dma_unmap_single (sdcp->dev, key_phys,2 *AES_KEYSIZE_128 ,DMA_TO_DEVICE ); -dma_unmap_single (sdcp->dev, src_phys,DCP_BUF_SZ ,DMA_TO_DEVICE ); -dma_unmap_single (sdcp->dev, dst_phys,DCP_BUF_SZ ,DMA_FROM_DEVICE );return ret; }
@@ -565,6 +582,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)dma_addr_t buf_phys =dma_map_single (sdcp->dev, sdcp->coh->sha_in_buf,DCP_BUF_SZ ,DMA_TO_DEVICE ); + ret =dma_mapping_error (sdcp->dev, buf_phys); +if (ret) +return ret; +/* Fill in the DMA descriptor. */ desc->control0 =MXS_DCP_CONTROL0_DECR_SEMAPHORE | MXS_DCP_CONTROL0_INTERRUPT |
@@ -597,6 +618,10 @@ static int mxs_dcp_run_sha(struct ahash_request *req)if (rctx->fini) { digest_phys =dma_map_single (sdcp->dev, sdcp->coh->sha_out_buf,DCP_SHA_PAY_SZ ,DMA_FROM_DEVICE ); + ret =dma_mapping_error (sdcp->dev, digest_phys); +if (ret) + goto done_run; + desc->control0 |=MXS_DCP_CONTROL0_HASH_TERM ; desc->payload = digest_phys; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 35/293 sched/deadline: Fix reset_on_fork reporting of DL tasks
In reply to Greg Kroah-HartmanFrom: Quentin Perret <[email protected]>
[ Upstream commit f95091536f78971b269ec321b057b8d630b0ad8a ]
It is possible for sched_getattr() to incorrectly report the state of the reset_on_fork flag when called on a deadline task.
Indeed, if the flag was set on a deadline task using sched_setattr() with flags (SCHED_FLAG_RESET_ON_FORK | SCHED_FLAG_KEEP_PARAMS), then p->sched_reset_on_fork will be set, but __setscheduler() will bail out early, which means that the dl_se->flags will not get updated by __setscheduler_params()->__setparam_dl(). Consequently, if sched_getattr() is then called on the task, __getparam_dl() will override kattr.sched_flags with the now out-of-date copy in dl_se->flags and report the stale value to userspace.
To fix this, make sure to only copy the flags that are relevant to sched_deadline to and from the dl_se->flags field.
--- kernel/sched/deadline.c | 7 ++++--- kernel/sched/sched.h | 2 ++ 2 files changed, 6 insertions(+), 3 deletions(-)
kernel/sched/deadline.c +4 -3
@@ -2615,7 +2615,7 @@ void __setparam_dl(struct task_struct *p, const struct sched_attr *attr) dl_se->dl_runtime = attr->sched_runtime; dl_se->dl_deadline = attr->sched_deadline; dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline; - dl_se->flags = attr->sched_flags; + dl_se->flags = attr->sched_flags &SCHED_DL_FLAGS ; dl_se->dl_bw =to_ratio (dl_se->dl_period, dl_se->dl_runtime); dl_se->dl_density =to_ratio (dl_se->dl_deadline, dl_se->dl_runtime); }
@@ -2628,7 +2628,8 @@ void __getparam_dl(struct task_struct *p, struct sched_attr *attr) attr->sched_runtime = dl_se->dl_runtime; attr->sched_deadline = dl_se->dl_deadline; attr->sched_period = dl_se->dl_period; - attr->sched_flags = dl_se->flags; + attr->sched_flags &= ~SCHED_DL_FLAGS ; + attr->sched_flags |= dl_se->flags; }/*
@@ -2703,7 +2704,7 @@ bool dl_param_changed(struct task_struct *p, const struct sched_attr *attr)if (dl_se->dl_runtime != attr->sched_runtime || dl_se->dl_deadline != attr->sched_deadline || dl_se->dl_period != attr->sched_period || - dl_se->flags != attr->sched_flags) + dl_se->flags != (attr->sched_flags &SCHED_DL_FLAGS ))return true;return false;
kernel/sched/sched.h +2 -0
@@ -209,6 +209,8 @@ static inline int task_has_dl_policy(struct task_struct *p)*/ #define SCHED_FLAG_SUGOV 0x10000000 +#define SCHED_DL_FLAGS (SCHED_FLAG_RECLAIM | SCHED_FLAG_DL_OVERRUN | SCHED_FLAG_SUGOV) +static inline bool dl_entity_is_special (struct sched_dl_entity *dl_se) {#ifdef CONFIG_CPU_FREQ_GOV_SCHEDUTIL
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 36/293 power: supply: axp288_fuel_gauge: Report register-address on readb / writeb errors
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
[ Upstream commit caa534c3ba40c6e8352b42cbbbca9ba481814ac8 ]
When fuel_gauge_reg_readb()/_writeb() fails, report which register we were trying to read / write when the error happened.
Also reword the message a bit:
- Drop the axp288 prefix, dev_err() already prints this
- Switch from telegram / abbreviated style to a normal sentence, aligning the message with those from fuel_gauge_read_*bit_word()
--- drivers/power/supply/axp288_fuel_gauge.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/axp288_fuel_gauge.c +2 -2
@@ -158,7 +158,7 @@ static int fuel_gauge_reg_readb(struct axp288_fg_info *info, int reg) }if (ret <0 ) { -dev_err (&info->pdev->dev,"axp288 reg read err:%d\n" , ret); +dev_err (&info->pdev->dev,"Error reading reg 0x%02x err: %d\n" , reg, ret);return ret; }
@@ -172,7 +172,7 @@ static int fuel_gauge_reg_writeb(struct axp288_fg_info *info, int reg, u8 val) ret =regmap_write (info->regmap, reg, (unsigned int )val);if (ret <0 ) -dev_err (&info->pdev->dev,"axp288 reg write err:%d\n" , ret); +dev_err (&info->pdev->dev,"Error writing reg 0x%02x err: %d\n" , reg, ret);return ret; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 37/293 crypto: omap-sham - clear dma flags only after omap_sham_update_dma_stop()
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit fe28140b3393b0ba1eb95cc109f974a7e58b26fd ]
We should not clear FLAGS_DMA_ACTIVE before omap_sham_update_dma_stop() is done calling dma_unmap_sg(). We already clear FLAGS_DMA_ACTIVE at the end of omap_sham_update_dma_stop().
The early clearing of FLAGS_DMA_ACTIVE is not causing issues as we do not need to defer anything based on FLAGS_DMA_ACTIVE currently. So this can be applied as clean-up.
--- drivers/crypto/omap-sham.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/crypto/omap-sham.c +1 -1
@@ -1739,7 +1739,7 @@ static void omap_sham_done_task(unsigned long data)if (test_and_clear_bit (FLAGS_OUTPUT_READY , &dd->flags)) goto finish; }else if (test_bit (FLAGS_DMA_READY , &dd->flags)) { -if (test_and_clear_bit (FLAGS_DMA_ACTIVE , &dd->flags)) { +if (test_bit (FLAGS_DMA_ACTIVE , &dd->flags)) {omap_sham_update_dma_stop (dd);if (dd->err) { err = dd->err;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 38/293 sched/deadline: Fix missing clock update in migrate_task_rq_dl()
In reply to Greg Kroah-HartmanFrom: Dietmar Eggemann <[email protected]>
[ Upstream commit b4da13aa28d4fd0071247b7b41c579ee8a86c81a ]
A missing clock update is causing the following warning:
rq->clock_update_flags < RQCF_ACT_SKIP
WARNING: CPU: 112 PID: 2041 at kernel/sched/sched.h:1453 sub_running_bw.isra.0+0x190/0x1a0 ... CPU: 112 PID: 2041 Comm: sugov:112 Tainted: G W 5.14.0-rc1 #1 Hardware name: WIWYNN Mt.Jade Server System B81.030Z1.0007/Mt.Jade Motherboard, BIOS 1.6.20210526 (SCP: 1.06.20210526) 2021/05/26 ... Call trace: sub_running_bw.isra.0+0x190/0x1a0 migrate_task_rq_dl+0xf8/0x1e0 set_task_cpu+0xa8/0x1f0 try_to_wake_up+0x150/0x3d4 wake_up_q+0x64/0xc0 __up_write+0xd0/0x1c0 up_write+0x4c/0x2b0 cppc_set_perf+0x120/0x2d0 cppc_cpufreq_set_target+0xe0/0x1a4 [cppc_cpufreq] __cpufreq_driver_target+0x74/0x140 sugov_work+0x64/0x80 kthread_worker_fn+0xe0/0x230 kthread+0x138/0x140 ret_from_fork+0x10/0x18
The task causing this is the cppc_fie DL task introduced by commit 1eb5dde674f5 ("cpufreq: CPPC: Add support for frequency invariance").
With CONFIG_ACPI_CPPC_CPUFREQ_FIE=y and schedutil cpufreq governor on slow-switching system (like on this Ampere Altra WIWYNN Mt. Jade Arm Server):
DL task curr=sugov:112 lets p=cppc_fie migrate and since the latter is in non_contending state, migrate_task_rq_dl() calls
sub_running_bw()->__sub_running_bw()->cpufreq_update_util()-> rq_clock()->assert_clock_updated()
on p.
Fix this by updating the clock for a non_contending task in migrate_task_rq_dl() before calling sub_running_bw().
--- kernel/sched/deadline.c | 1 + 1 file changed, 1 insertion(+)
kernel/sched/deadline.c +1 -0
@@ -1654,6 +1654,7 @@ static void migrate_task_rq_dl(struct task_struct *p, int new_cpu __maybe_unused*/ raw_spin_lock (&rq->lock);if (p->dl.dl_non_contending) { +update_rq_clock (rq);sub_running_bw (&p->dl, &rq->dl); p->dl.dl_non_contending =0 ;/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 39/293 hrtimer: Avoid double reprogramming in __hrtimer_start_range_ns()
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
[ Upstream commit 627ef5ae2df8eeccb20d5af0e4cfa4df9e61ed28 ]
If __hrtimer_start_range_ns() is invoked with an already armed hrtimer then the timer has to be canceled first and then added back. If the timer is the first expiring timer then on removal the clockevent device is reprogrammed to the next expiring timer to avoid that the pending expiry fires needlessly.
If the new expiry time ends up to be the first expiry again then the clock event device has to reprogrammed again.
Avoid this by checking whether the timer is the first to expire and in that case, keep the timer on the current CPU and delay the reprogramming up to the point where the timer has been enqueued again.
--- kernel/time/hrtimer.c | 60 ++++++++++++++++++++++++++++++++++++++----- 1 file changed, 53 insertions(+), 7 deletions(-)
kernel/time/hrtimer.c +53 -7
@@ -1020,12 +1020,13 @@ static void __remove_hrtimer(struct hrtimer *timer,* remove hrtimer, called with base lock held */ static inline int -remove_hrtimer (struct hrtimer *timer,struct hrtimer_clock_base *base,bool restart) +remove_hrtimer (struct hrtimer *timer,struct hrtimer_clock_base *base, +bool restart,bool keep_local) {u8 state = timer->state;if (state &HRTIMER_STATE_ENQUEUED ) { -int reprogram; +bool reprogram;/* * Remove the timer and force reprogramming when high
@@ -1038,8 +1039,16 @@ remove_hrtimer(struct hrtimer *timer, struct hrtimer_clock_base *base, bool restdebug_deactivate (timer); reprogram = base->cpu_base ==this_cpu_ptr (&hrtimer_bases); +/* +* If the timer is not restarted then reprogramming is +* required if the timer is local. If it is local and about +* to be restarted, avoid programming it twice (on removal +* and a moment later when it's requeued). +*/ if (!restart) state =HRTIMER_STATE_INACTIVE ; +else + reprogram &= !keep_local;__remove_hrtimer (timer, base, state, reprogram);return 1 ;
@@ -1093,9 +1102,31 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim, struct hrtimer_clock_base *base) {struct hrtimer_clock_base *new_base; +bool force_local, first; -/* Remove an active timer from the queue: */ -remove_hrtimer (timer, base, true); +/* +* If the timer is on the local cpu base and is the first expiring +* timer then this might end up reprogramming the hardware twice +* (on removal and on enqueue). To avoid that by prevent the +* reprogram on removal, keep the timer local to the current CPU +* and enforce reprogramming after it is queued no matter whether +* it is the new first expiring timer again or not. +*/ + force_local = base->cpu_base ==this_cpu_ptr (&hrtimer_bases); + force_local &= base->cpu_base->next_timer == timer; + +/* +* Remove an active timer from the queue. In case it is not queued +* on the current CPU, make sure that remove_hrtimer() updates the +* remote data correctly. +* +* If it's on the current CPU and the first expiring timer, then +* skip reprogramming, keep the timer local and enforce +* reprogramming later if it was the first expiring timer. This +* avoids programming the underlying clock event twice (once at +* removal and once after enqueue). +*/ +remove_hrtimer (timer, base, true, force_local);if (mode &HRTIMER_MODE_REL ) tim =ktime_add_safe (tim, base->get_time ());
@@ -1105,9 +1136,24 @@ static int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,hrtimer_set_expires_range_ns (timer, tim, delta_ns);/* Switch the timer base, if necessary: */ - new_base =switch_hrtimer_base (timer, base, mode &HRTIMER_MODE_PINNED ); +if (!force_local) { + new_base =switch_hrtimer_base (timer, base, + mode &HRTIMER_MODE_PINNED ); + }else { + new_base = base; + } + + first =enqueue_hrtimer (timer, new_base, mode); +if (!force_local) +return first; -return enqueue_hrtimer (timer, new_base, mode); +/* +* Timer was forced to stay on the current CPU to avoid +* reprogramming on removal and enqueue. Force reprogram the +* hardware by evaluating the new first expiring timer. +*/ +hrtimer_force_reprogram (new_base->cpu_base,1 ); +return 0 ; }/**
@@ -1168,7 +1214,7 @@ int hrtimer_try_to_cancel(struct hrtimer *timer) base =lock_hrtimer_base (timer, &flags);if (!hrtimer_callback_running (timer)) - ret =remove_hrtimer (timer, base, false); + ret =remove_hrtimer (timer, base, false, false);unlock_hrtimer_base (timer, &flags);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 40/293 udf: Check LVID earlier
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit 781d2a9a2fc7d0be53a072794dc03ef6de770f3d ]
We were checking validity of LVID entries only when getting implementation use information from LVID in udf_sb_lvidiu(). However if the LVID is suitably corrupted, it can cause problems also to code such as udf_count_free() which doesn't use udf_sb_lvidiu(). So check validity of LVID already when loading it from the disk and just disable LVID altogether when it is not valid.
--- fs/udf/super.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-)
fs/udf/super.c +16 -9
@@ -112,16 +112,10 @@ struct logicalVolIntegrityDescImpUse *udf_sb_lvidiu(struct super_block *sb)return NULL ; lvid = (struct logicalVolIntegrityDesc *)UDF_SB (sb)->s_lvid_bh->b_data; partnum =le32_to_cpu (lvid->numOfPartitions); -if ((sb->s_blocksize -sizeof (struct logicalVolIntegrityDescImpUse ) - - offsetof(struct logicalVolIntegrityDesc , impUse)) / - (2 *sizeof (uint32_t )) < partnum) { -udf_err (sb,"Logical volume integrity descriptor corrupted " -"(numOfPartitions = %u)!\n" , partnum); -return NULL ; - }/* The offset is to skip freeSpaceTable and sizeTable arrays */ offset = partnum *2 *sizeof (uint32_t ); -return (struct logicalVolIntegrityDescImpUse *)&(lvid->impUse[offset]); +return (struct logicalVolIntegrityDescImpUse *) + (((uint8_t *)(lvid +1 )) + offset); }/* UDF filesystem type */
@@ -1529,6 +1523,7 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_struct udf_sb_info *sbi =UDF_SB (sb);struct logicalVolIntegrityDesc *lvid;int indirections =0 ; +u32 parts, impuselen;while (++indirections <=UDF_MAX_LVID_NESTING ) { final_bh =NULL ;
@@ -1555,15 +1550,27 @@ static void udf_load_logicalvolint(struct super_block *sb, struct kernel_extent_ lvid = (struct logicalVolIntegrityDesc *)final_bh->b_data;if (lvid->nextIntegrityExt.extLength ==0 ) -return ; + goto check; loc =leea_to_cpu (lvid->nextIntegrityExt); }udf_warn (sb,"Too many LVID indirections (max %u), ignoring.\n" ,UDF_MAX_LVID_NESTING ); +out_err:brelse (sbi->s_lvid_bh); sbi->s_lvid_bh =NULL ; +return ; +check: + parts =le32_to_cpu (lvid->numOfPartitions); + impuselen =le32_to_cpu (lvid->lengthOfImpUse); +if (parts >= sb->s_blocksize || impuselen >= sb->s_blocksize || +sizeof (struct logicalVolIntegrityDesc ) + impuselen + +2 * parts *sizeof (u32) > sb->s_blocksize) { +udf_warn (sb,"Corrupted LVID (parts=%u, impuselen=%u), " +"ignoring.\n" , parts, impuselen); + goto out_err; + } }/*
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 41/293 isofs: joliet: Fix iocharset=utf8 mount option
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 28ce50f8d96ec9035f60c9348294ea26b94db944 ]
Currently iocharset=utf8 mount option is broken. To use UTF-8 as iocharset, it is required to use utf8 mount option.
Fix iocharset=utf8 mount option to use be equivalent to the utf8 mount option.
If UTF-8 as iocharset is used then s_nls_iocharset is set to NULL. So simplify code around, remove s_utf8 field as to distinguish between UTF-8 and non-UTF-8 it is needed just to check if s_nls_iocharset is set to NULL or not.
--- fs/isofs/inode.c | 27 +++++++++++++-------------- fs/isofs/isofs.h | 1 - fs/isofs/joliet.c | 4 +--- 3 files changed, 14 insertions(+), 18 deletions(-)
fs/isofs/inode.c +13 -14
@@ -157,7 +157,6 @@ struct iso9660_options{ unsigned int overriderockperm:1; unsigned int uid_set:1; unsigned int gid_set:1; - unsigned int utf8:1;unsigned char map;unsigned char check;unsigned int blocksize;
@@ -357,7 +356,6 @@ static int parse_options(char *options, struct iso9660_options *popt) popt->gid =GLOBAL_ROOT_GID ; popt->uid =GLOBAL_ROOT_UID ; popt->iocharset =NULL ; - popt->utf8 =0 ; popt->overriderockperm =0 ; popt->session=-1 ; popt->sbsector=-1 ;
@@ -390,10 +388,13 @@ static int parse_options(char *options, struct iso9660_options *popt)case Opt_cruft: popt->cruft =1 ;break ; +#ifdef CONFIG_JOLIET case Opt_utf8: - popt->utf8 =1 ; +kfree (popt->iocharset); + popt->iocharset =kstrdup ("utf8" ,GFP_KERNEL ); +if (!popt->iocharset) +return 0 ;break ; -#ifdef CONFIG_JOLIET case Opt_iocharset:kfree (popt->iocharset); popt->iocharset =match_strdup (&args[0 ]);
@@ -496,7 +497,6 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)if (sbi->s_nocompress)seq_puts (m,",nocompress" );if (sbi->s_overriderockperm)seq_puts (m,",overriderockperm" );if (sbi->s_showassoc)seq_puts (m,",showassoc" ); -if (sbi->s_utf8)seq_puts (m,",utf8" );if (sbi->s_check)seq_printf (m,",check=%c" , sbi->s_check);if (sbi->s_mapping)seq_printf (m,",map=%c" , sbi->s_mapping);
@@ -519,9 +519,10 @@ static int isofs_show_options(struct seq_file *m, struct dentry *root)seq_printf (m,",fmode=%o" , sbi->s_fmode);#ifdef CONFIG_JOLIET -if (sbi->s_nls_iocharset && -strcmp (sbi->s_nls_iocharset->charset,CONFIG_NLS_DEFAULT ) !=0 ) +if (sbi->s_nls_iocharset)seq_printf (m,",iocharset=%s" , sbi->s_nls_iocharset->charset); +else +seq_puts (m,",iocharset=utf8" );#endif return 0 ; }
@@ -865,14 +866,13 @@ root_found: sbi->s_nls_iocharset =NULL ;#ifdef CONFIG_JOLIET -if (joliet_level && opt.utf8 ==0 ) { +if (joliet_level) {char *p = opt.iocharset ? opt.iocharset :CONFIG_NLS_DEFAULT ; - sbi->s_nls_iocharset =load_nls (p); -if (! sbi->s_nls_iocharset) { -/* Fail only if explicit charset specified */ -if (opt.iocharset) +if (strcmp (p,"utf8" ) !=0 ) { + sbi->s_nls_iocharset = opt.iocharset ? +load_nls (opt.iocharset) :load_nls_default (); +if (!sbi->s_nls_iocharset) goto out_freesbi; - sbi->s_nls_iocharset =load_nls_default (); } }#endif
@@ -888,7 +888,6 @@ root_found: sbi->s_gid = opt.gid; sbi->s_uid_set = opt.uid_set; sbi->s_gid_set = opt.gid_set; - sbi->s_utf8 = opt.utf8; sbi->s_nocompress = opt.nocompress; sbi->s_overriderockperm = opt.overriderockperm;/*
fs/isofs/isofs.h +0 -1
@@ -44,7 +44,6 @@ struct isofs_sb_info {unsigned char s_session; unsigned int s_high_sierra:1; unsigned int s_rock:2; - unsigned int s_utf8:1; unsigned int s_cruft:1; /* Broken disks with high byte of length* containing junk */ unsigned int s_nocompress:1;
fs/isofs/joliet.c +1 -3
@@ -41,14 +41,12 @@ uni16_to_x8(unsigned char *ascii, __be16 *uni, int len, struct nls_table *nls)int get_joliet_filename (struct iso_directory_record * de,unsigned char *outname,struct inode * inode) { -unsigned char utf8;struct nls_table *nls;unsigned char len =0 ; - utf8 =ISOFS_SB (inode->i_sb)->s_utf8; nls =ISOFS_SB (inode->i_sb)->s_nls_iocharset; -if (utf8) { +if (!nls) { len =utf16s_to_utf8s ((const wchar_t *) de->name, de->name_len[0 ] >>1 ,UTF16_BIG_ENDIAN , outname,PAGE_SIZE );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 42/293 bcache: add proper error unwinding in bcache_device_init
In reply to Greg Kroah-HartmanFrom: Christoph Hellwig <[email protected]>
[ Upstream commit 224b0683228c5f332f9cee615d85e75e9a347170 ]
Except for the IDA none of the allocations in bcache_device_init is unwound on error, fix that.
--- drivers/md/bcache/super.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
drivers/md/bcache/super.c +11 -5
@@ -824,20 +824,20 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size, n =BITS_TO_LONGS (d->nr_stripes) *sizeof (unsigned long ); d->full_dirty_stripes =kvzalloc (n,GFP_KERNEL );if (!d->full_dirty_stripes) -return -ENOMEM ; + goto out_free_stripe_sectors_dirty; idx =ida_simple_get (&bcache_device_idx,0 ,BCACHE_DEVICE_IDX_MAX ,GFP_KERNEL );if (idx <0 ) -return idx; + goto out_free_full_dirty_stripes;if (bioset_init (&d->bio_split,4 , offsetof(struct bbio , bio),BIOSET_NEED_BVECS |BIOSET_NEED_RESCUER )) - goto err; + goto out_ida_remove; d->disk =alloc_disk (BCACHE_MINORS );if (!d->disk) - goto err; + goto out_bioset_exit;set_capacity (d->disk, sectors);snprintf (d->disk->disk_name,DISK_NAME_LEN ,"bcache%i" , idx);
@@ -872,8 +872,14 @@ static int bcache_device_init(struct bcache_device *d, unsigned int block_size,return 0 ; -err: +out_bioset_exit: +bioset_exit (&d->bio_split); +out_ida_remove:ida_simple_remove (&bcache_device_idx, idx); +out_free_full_dirty_stripes: +kvfree (d->full_dirty_stripes); +out_free_stripe_sectors_dirty: +kvfree (d->stripe_sectors_dirty);return -ENOMEM ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 43/293 nvme-rdma: dont update queue count when failing to set io queues
In reply to Greg Kroah-HartmanFrom: Ruozhu Li <[email protected]>
[ Upstream commit 85032874f80ba17bf187de1d14d9603bf3f582b8 ]
We update ctrl->queue_count and schedule another reconnect when io queue count is zero.But we will never try to create any io queue in next reco- nnection, because ctrl->queue_count already set to zero.We will end up having an admin-only session in Live state, which is exactly what we try to avoid in the original patch.
Update ctrl->queue_count after queue_count zero checking to fix it.
--- drivers/nvme/host/rdma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/nvme/host/rdma.c +2 -2
@@ -643,13 +643,13 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl)if (ret)return ret; - ctrl->ctrl.queue_count = nr_io_queues +1 ; -if (ctrl->ctrl.queue_count <2 ) { +if (nr_io_queues ==0 ) {dev_err (ctrl->ctrl.device,"unable to set any I/O queues\n" );return -ENOMEM ; } + ctrl->ctrl.queue_count = nr_io_queues +1 ;dev_info (ctrl->ctrl.device,"creating %d I/O queues.\n" , nr_io_queues);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 44/293 power: supply: max17042_battery: fix typo in MAx17042_TOFF
In reply to Greg Kroah-HartmanFrom: Sebastian Krzyszkowiak <[email protected]>
[ Upstream commit ed0d0a0506025f06061325cedae1bbebd081620a ]
--- drivers/power/supply/max17042_battery.c | 2 +- include/linux/power/max17042_battery.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/power/supply/max17042_battery.c +1 -1
@@ -740,7 +740,7 @@ static inline void max17042_override_por_values(struct max17042_chip *chip)struct max17042_config_data *config = chip->pdata->config_data;max17042_override_por (map,MAX17042_TGAIN , config->tgain); -max17042_override_por (map, MAx17042_TOFF, config->toff); +max17042_override_por (map,MAX17042_TOFF , config->toff);max17042_override_por (map,MAX17042_CGAIN , config->cgain);max17042_override_por (map,MAX17042_COFF , config->coff);
include/linux/power/max17042_battery.h +1 -1
@@ -82,7 +82,7 @@ enum max17042_register { MAX17042_RelaxCFG =0x2A , MAX17042_MiscCFG =0x2B ,MAX17042_TGAIN =0x2C , - MAx17042_TOFF =0x2D , +MAX17042_TOFF =0x2D ,MAX17042_CGAIN =0x2E , MAX17042_COFF = 0x2F,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 45/293 s390/cio: add dev_busid sysfs entry for each subchannel
In reply to Greg Kroah-HartmanFrom: Vineeth Vijayan <[email protected]>
[ Upstream commit d3683c055212bf910d4e318f7944910ce10dbee6 ]
Introduce dev_busid, which exports the device-id associated with the io-subchannel (and message-subchannel). The dev_busid indicates that of the device which may be physically installed on the corrosponding subchannel. The dev_busid value "none" indicates that the subchannel is not valid, there is no I/O device currently associated with the subchannel.
The dev_busid information would be helpful to write device-specific udev-rules associated with the subchannel. The dev_busid interface would be available even when the sch is not bound to any driver or if there is no operational device connected on it. Hence this attribute can be used to write udev-rules which are specific to the device associated with the subchannel.
--- drivers/s390/cio/css.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
drivers/s390/cio/css.c +17 -0
@@ -364,9 +364,26 @@ static ssize_t pimpampom_show(struct device *dev, }static DEVICE_ATTR_RO (pimpampom); +static ssize_t dev_busid_show (struct device *dev, +struct device_attribute *attr, +char *buf) +{ +struct subchannel *sch =to_subchannel (dev); +struct pmcw *pmcw = &sch->schib.pmcw; + +if ((pmcw->st ==SUBCHANNEL_TYPE_IO || + pmcw->st ==SUBCHANNEL_TYPE_MSG ) && pmcw->dnv) +return sysfs_emit (buf,"0.%x.%04x\n" , sch->schid.ssid, + pmcw->dev); +else +return sysfs_emit (buf,"none\n" ); +} +static DEVICE_ATTR_RO (dev_busid); +static struct attribute *io_subchannel_type_attrs[] = { &dev_attr_chpids.attr, &dev_attr_pimpampom.attr, + &dev_attr_dev_busid.attr,NULL , };ATTRIBUTE_GROUPS (io_subchannel_type);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 46/293 libata: fix ata_host_start()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit 355a8031dc174450ccad2a61c513ad7222d87a97 ]
The loop on entry of ata_host_start() may not initialize host->ops to a non NULL value. The test on the host_stop field of host->ops must then be preceded by a check that host->ops is not NULL.
--- drivers/ata/libata-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ata/libata-core.c +1 -1
@@ -6412,7 +6412,7 @@ int ata_host_start(struct ata_host *host) have_stop =1 ; } -if (host->ops->host_stop) +if (host->ops && host->ops->host_stop) have_stop =1 ;if (have_stop) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 47/293 crypto: qat - do not ignore errors from enable_vf2pf_comms()
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 5147f0906d50a9d26f2b8698cd06b5680e9867ff ]
The function adf_dev_init() ignores the error code reported by enable_vf2pf_comms(). If the latter fails, e.g. the VF is not compatible with the pf, then the load of the VF driver progresses.
This patch changes adf_dev_init() so that the error code from enable_vf2pf_comms() is returned to the caller.
--- drivers/crypto/qat/qat_common/adf_init.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/crypto/qat/qat_common/adf_init.c +3 -2
@@ -105,6 +105,7 @@ int adf_dev_init(struct adf_accel_dev *accel_dev)struct service_hndl *service;struct list_head *list_itr;struct adf_hw_device_data *hw_data = accel_dev->hw_device; +int ret;if (!hw_data) { dev_err(&GET_DEV(accel_dev),
@@ -171,9 +172,9 @@ int adf_dev_init(struct adf_accel_dev *accel_dev) } hw_data->enable_error_correction (accel_dev); - hw_data->enable_vf2pf_comms (accel_dev); + ret = hw_data->enable_vf2pf_comms (accel_dev); -return 0 ; +return ret; }EXPORT_SYMBOL_GPL (adf_dev_init);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 48/293 crypto: qat - handle both source of interrupt in VF ISR
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 0a73c762e1eee33a5e5dc0e3488f1b7cd17249b3 ]
The top half of the VF drivers handled only a source at the time. If an interrupt for PF2VF and bundle occurred at the same time, the ISR scheduled only the bottom half for PF2VF.
This patch fixes the VF top half so that if both sources of interrupt trigger at the same time, both bottom halves are scheduled.
This patch is based on earlier work done by Conor McLoughlin.
--- drivers/crypto/qat/qat_common/adf_vf_isr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_common/adf_vf_isr.c +4 -3
@@ -203,6 +203,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)struct adf_bar *pmisc = &GET_BARS (accel_dev)[hw_data->get_misc_bar_id (hw_data)];void __iomem *pmisc_bar_addr = pmisc->virt_addr; +bool handled = false;u32 v_int;/* Read VF INT source CSR to determine the source of VF interrupt */
@@ -215,7 +216,7 @@ static irqreturn_t adf_isr(int irq, void *privdata)/* Schedule tasklet to handle interrupt BH */ tasklet_hi_schedule (&accel_dev->vf.pf2vf_bh_tasklet); -return IRQ_HANDLED ; + handled = true; }/* Check bundle interrupt */
@@ -227,10 +228,10 @@ static irqreturn_t adf_isr(int irq, void *privdata)WRITE_CSR_INT_FLAG_AND_COL (bank->csr_addr, bank->bank_number,0 );tasklet_hi_schedule (&bank->resp_handler); -return IRQ_HANDLED ; + handled = true; } -return IRQ_NONE ; +return handled ?IRQ_HANDLED :IRQ_NONE ; }static int adf_request_msi_irq (struct adf_accel_dev *accel_dev)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 49/293 crypto: qat - fix reuse of completion variable
In reply to Greg Kroah-HartmanFrom: Marco Chiappero <[email protected]>
[ Upstream commit 3d655732b0199562267a05c7ff69ecdd11632939 ]
Use reinit_completion() to set to a clean state a completion variable, used to coordinate the VF to PF request-response flow, before every new VF request.
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +2 -0
@@ -361,6 +361,8 @@ static int adf_vf2pf_request_version(struct adf_accel_dev *accel_dev) msg |=ADF_PFVF_COMPATIBILITY_VERSION <<ADF_VF2PF_COMPAT_VER_REQ_SHIFT ;BUILD_BUG_ON (ADF_PFVF_COMPATIBILITY_VERSION >255 ); +reinit_completion (&accel_dev->vf.iov_msg_completion); +/* Send request from VF to PF */ ret =adf_iov_putmsg (accel_dev, msg,0 );if (ret) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 50/293 crypto: qat - fix naming for init/shutdown VF to PF notifications
In reply to Greg Kroah-HartmanFrom: Marco Chiappero <[email protected]>
[ Upstream commit b90c1c4d3fa8cd90f4e8245b13564380fd0bfad1 ]
At start and shutdown, VFs notify the PF about their state. These notifications are carried out through a message exchange using the PFVF protocol.
Function names lead to believe they do perform init or shutdown logic. This is to fix the naming to better reflect their purpose.
--- drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c | 4 ++-- drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c | 4 ++-- drivers/crypto/qat/qat_common/adf_common_drv.h | 8 ++++---- drivers/crypto/qat/qat_common/adf_vf2pf_msg.c | 12 ++++++------ .../qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c | 4 ++-- 5 files changed, 16 insertions(+), 16 deletions(-)
drivers/crypto/qat/qat_c3xxxvf/adf_c3xxxvf_hw_data.c +2 -2
@@ -123,10 +123,10 @@ void adf_init_hw_data_c3xxxiov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
drivers/crypto/qat/qat_c62xvf/adf_c62xvf_hw_data.c +2 -2
@@ -123,10 +123,10 @@ void adf_init_hw_data_c62xiov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
drivers/crypto/qat/qat_common/adf_common_drv.h +4 -4
@@ -239,8 +239,8 @@ void adf_enable_vf2pf_interrupts(struct adf_accel_dev *accel_dev,void adf_enable_pf2vf_interrupts (struct adf_accel_dev *accel_dev);void adf_disable_pf2vf_interrupts (struct adf_accel_dev *accel_dev); -int adf_vf2pf_init (struct adf_accel_dev *accel_dev); -void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev); +int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev); +void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev);int adf_init_pf_wq (void );void adf_exit_pf_wq (void );int adf_init_vf_wq (void );
@@ -263,12 +263,12 @@ static inline void adf_disable_pf2vf_interrupts(struct adf_accel_dev *accel_dev) { } -static inline int adf_vf2pf_init (struct adf_accel_dev *accel_dev) +static inline int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev) {return 0 ; } -static inline void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev) +static inline void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev) { }
drivers/crypto/qat/qat_common/adf_vf2pf_msg.c +6 -6
@@ -49,14 +49,14 @@#include "adf_pf2vf_msg.h" /** -* adf_vf2pf_init() - send init msg to PF +* adf_vf2pf_notify_init() - send init msg to PF * @accel_dev: Pointer to acceleration VF device. * * Function sends an init messge from the VF to a PF * * Return: 0 on success, error code otherwise. */ -int adf_vf2pf_init (struct adf_accel_dev *accel_dev) +int adf_vf2pf_notify_init (struct adf_accel_dev *accel_dev) {u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | (ADF_VF2PF_MSGTYPE_INIT <<ADF_VF2PF_MSGTYPE_SHIFT ));
@@ -69,17 +69,17 @@ int adf_vf2pf_init(struct adf_accel_dev *accel_dev)set_bit (ADF_STATUS_PF_RUNNING , &accel_dev->status);return 0 ; } -EXPORT_SYMBOL_GPL (adf_vf2pf_init); +EXPORT_SYMBOL_GPL (adf_vf2pf_notify_init);/** -* adf_vf2pf_shutdown() - send shutdown msg to PF +* adf_vf2pf_notify_shutdown() - send shutdown msg to PF * @accel_dev: Pointer to acceleration VF device. * * Function sends a shutdown messge from the VF to a PF * * Return: void */ -void adf_vf2pf_shutdown (struct adf_accel_dev *accel_dev) +void adf_vf2pf_notify_shutdown (struct adf_accel_dev *accel_dev) {u32 msg = (ADF_VF2PF_MSGORIGIN_SYSTEM | (ADF_VF2PF_MSGTYPE_SHUTDOWN <<ADF_VF2PF_MSGTYPE_SHIFT ));
@@ -89,4 +89,4 @@ void adf_vf2pf_shutdown(struct adf_accel_dev *accel_dev)dev_err (&GET_DEV (accel_dev),"Failed to send Shutdown event to PF\n" ); } -EXPORT_SYMBOL_GPL (adf_vf2pf_shutdown); +EXPORT_SYMBOL_GPL (adf_vf2pf_notify_shutdown);
drivers/crypto/qat/qat_dh895xccvf/adf_dh895xccvf_hw_data.c +2 -2
@@ -123,10 +123,10 @@ void adf_init_hw_data_dh895xcciov(struct adf_hw_device_data *hw_data) hw_data->enable_error_correction = adf_vf_void_noop; hw_data->init_admin_comms = adf_vf_int_noop; hw_data->exit_admin_comms = adf_vf_void_noop; - hw_data->send_admin_init = adf_vf2pf_init; + hw_data->send_admin_init = adf_vf2pf_notify_init; hw_data->init_arb = adf_vf_int_noop; hw_data->exit_arb = adf_vf_void_noop; - hw_data->disable_iov = adf_vf2pf_shutdown; + hw_data->disable_iov = adf_vf2pf_notify_shutdown; hw_data->get_accel_mask = get_accel_mask; hw_data->get_ae_mask = get_ae_mask; hw_data->get_num_accels = get_num_accels;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 51/293 crypto: qat - do not export adf_iov_putmsg()
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 645ae0af1840199086c33e4f841892ebee73f615 ]
The function adf_iov_putmsg() is only used inside the intel_qat module therefore should not be exported.
Remove EXPORT_SYMBOL for the function adf_iov_putmsg().
--- drivers/crypto/qat/qat_common/adf_pf2vf_msg.c | 1 - 1 file changed, 1 deletion(-)
drivers/crypto/qat/qat_common/adf_pf2vf_msg.c +0 -1
@@ -231,7 +231,6 @@ int adf_iov_putmsg(struct adf_accel_dev *accel_dev, u32 msg, u8 vf_nr)return ret; } -EXPORT_SYMBOL_GPL (adf_iov_putmsg);void adf_vf2pf_req_hndl (struct adf_accel_vf_info *vf_info) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 52/293 fcntl: fix potential deadlock for &fasync_struct.fa_lock
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit 2f488f698fda820f8e6fa0407630154eceb145d6 ]
There is an existing lock hierarchy of &dev->event_lock --> &fasync_struct.fa_lock --> &f->f_owner.lock from the following call chain:
input_inject_event():
spin_lock_irqsave(&dev->event_lock,...);
input_handle_event():
input_pass_values():
input_to_handler():
evdev_events():
evdev_pass_values():
spin_lock(&client->buffer_lock);
__pass_event():
kill_fasync():
kill_fasync_rcu():
read_lock(&fa->fa_lock);
send_sigio():
read_lock_irqsave(&fown->lock,...);&dev->event_lock is HARDIRQ-safe, so interrupts have to be disabled while grabbing &fasync_struct.fa_lock, otherwise we invert the lock hierarchy. However, since kill_fasync which calls kill_fasync_rcu is an exported symbol, it may not necessarily be called with interrupts disabled.
As kill_fasync_rcu may be called with interrupts disabled (for example, in the call chain above), we replace calls to read_lock/read_unlock on &fasync_struct.fa_lock in kill_fasync_rcu with read_lock_irqsave/read_unlock_irqrestore.
--- fs/fcntl.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
fs/fcntl.c +3 -2
@@ -993,13 +993,14 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band) {while (fa) {struct fown_struct *fown; +unsigned long flags;if (fa->magic !=FASYNC_MAGIC ) {printk (KERN_ERR "kill_fasync: bad magic number in " "fasync_struct!\n" );return ; } -read_lock (&fa->fa_lock); +read_lock_irqsave (&fa->fa_lock, flags);if (fa->fa_file) { fown = &fa->fa_file->f_owner;/* Don't send SIGURG to processes which have not set a
@@ -1008,7 +1009,7 @@ static void kill_fasync_rcu(struct fasync_struct *fa, int sig, int band)if (!(sig ==SIGURG && fown->signum ==0 ))send_sigio (fown, fa->fa_fd, band); } -read_unlock (&fa->fa_lock); +read_unlock_irqrestore (&fa->fa_lock, flags); fa =rcu_dereference (fa->fa_next); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 53/293 udf_get_extendedattr() had no boundary checks.
In reply to Greg Kroah-HartmanFrom: Stian Skjelstad <[email protected]>
[ Upstream commit 58bc6d1be2f3b0ceecb6027dfa17513ec6aa2abb ]
When parsing the ExtendedAttr data, malicous or corrupt attribute length could cause kernel hangs and buffer overruns in some special cases.
--- fs/udf/misc.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
fs/udf/misc.c +11 -2
@@ -173,13 +173,22 @@ struct genericFormat *udf_get_extendedattr(struct inode *inode, uint32_t type,else offset =le32_to_cpu (eahd->appAttrLocation); -while (offset < iinfo->i_lenEAttr) { +while (offset +sizeof (*gaf) < iinfo->i_lenEAttr) { +uint32_t attrLength; + gaf = (struct genericFormat *)&ea[offset]; + attrLength =le32_to_cpu (gaf->attrLength); + +/* Detect undersized elements and buffer overflows */ +if ((attrLength <sizeof (*gaf)) || + (attrLength > (iinfo->i_lenEAttr - offset))) +break ; +if (le32_to_cpu (gaf->attrType) == type && gaf->attrSubtype == subtype)return gaf;else - offset +=le32_to_cpu (gaf->attrLength); + offset += attrLength; } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 54/293 m68k: emu: Fix invalid free in nfeth_cleanup()
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 761608f5cf70e8876c2f0e39ca54b516bdcb7c12 ]
In the for loop all nfeth_dev array members should be freed, not only the first one. Freeing only the first array member can cause double-free bugs and memory leaks.
--- arch/m68k/emu/nfeth.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/m68k/emu/nfeth.c +2 -2
@@ -258,8 +258,8 @@ static void __exit nfeth_cleanup(void)for (i =0 ; i <MAX_UNIT ; i++) {if (nfeth_dev[i]) { -unregister_netdev (nfeth_dev[0 ]); -free_netdev (nfeth_dev[0 ]); +unregister_netdev (nfeth_dev[i]); +free_netdev (nfeth_dev[i]); } }free_irq (nfEtherIRQ, nfeth_interrupt);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 55/293 spi: spi-fsl-dspi: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 209ab223ad5b18e437289235e3bde12593b94ac4 ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For spi-fsl-dspi, this is probably not currently an issue but is still good to fix though.
--- drivers/spi/spi-fsl-dspi.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-fsl-dspi.c +1 -0
@@ -430,6 +430,7 @@ static int dspi_request_dma(struct fsl_dspi *dspi, phys_addr_t phy_addr) goto err_rx_dma_buf; } +memset (&cfg,0 ,sizeof (cfg)); cfg.src_addr = phy_addr +SPI_POPR ; cfg.dst_addr = phy_addr +SPI_PUSHR ; cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 56/293 spi: spi-pic32: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit 976c1de1de147bb7f4e0d87482f375221c05aeaf ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For spi-pic32, this is probably not currently an issue but is still good to fix though.
--- drivers/spi/spi-pic32.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-pic32.c +1 -0
@@ -369,6 +369,7 @@ static int pic32_spi_dma_config(struct pic32_spi *pic32s, u32 dma_width)struct dma_slave_config cfg;int ret; +memset (&cfg,0 ,sizeof (cfg)); cfg.device_fc = true; cfg.src_addr = pic32s->dma_base + buf_offset; cfg.dst_addr = pic32s->dma_base + buf_offset;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 57/293 lib/mpi: use kcalloc in mpi_resize
In reply to Greg Kroah-HartmanFrom: Hongbo Li <[email protected]>
[ Upstream commit b6f756726e4dfe75be1883f6a0202dcecdc801ab ]
We should set the additional space to 0 in mpi_resize(). So use kcalloc() instead of kmalloc_array().
In lib/mpi/ec.c:
/****************
* Resize the array of A to NLIMBS. the additional space is cleared
* (set to 0) [done by m_realloc()]
*/
int mpi_resize(MPI a, unsigned nlimbs)
Like the comment of kernel's mpi_resize() said, the additional space need to be set to 0, but when a->d is not NULL, it does not set.
The kernel's mpi lib is from libgcrypt, the mpi resize in libgcrypt is _gcry_mpi_resize() which set the additional space to 0.
This bug may cause mpi api which use mpi_resize() get wrong result under the condition of using the additional space without initiation. If this condition is not met, the bug would not be triggered. Currently in kernel, rsa, sm2 and dh use mpi lib, and they works well, so the bug is not triggered in these cases.
add_points_edwards() use the additional space directly, so it will get a wrong result.
--- lib/mpi/mpiutil.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
lib/mpi/mpiutil.c +1 -1
@@ -91,7 +91,7 @@ int mpi_resize(MPI a, unsigned nlimbs)return 0 ;/* no need to do it */ if (a->d) { - p =kmalloc_array (nlimbs,sizeof (mpi_limb_t),GFP_KERNEL ); + p =kcalloc (nlimbs,sizeof (mpi_limb_t),GFP_KERNEL );if (!p)return -ENOMEM ;memcpy (p, a->d, a->alloced *sizeof (mpi_limb_t));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 58/293 clocksource/drivers/sh_cmt: Fix wrong setting if dont request IRQ for clock source channel
In reply to Greg Kroah-HartmanFrom: Phong Hoang <[email protected]>
[ Upstream commit be83c3b6e7b8ff22f72827a613bf6f3aa5afadbb ]
If CMT instance has at least two channels, one channel will be used as a clock source and another one used as a clock event device. In that case, IRQ is not requested for clock source channel so sh_cmt_clock_event_program_verify() might work incorrectly. Besides, when a channel is only used for clock source, don't need to re-set the next match_value since it should be maximum timeout as it still is.
On the other hand, due to no IRQ, total_cycles is not counted up when reaches compare match time (timer counter resets to zero), so sh_cmt_clocksource_read() returns unexpected value. Therefore, use 64-bit clocksoure's mask for 32-bit or 16-bit variants will also lead to wrong delta calculation. Hence, this mask should correspond to timer counter width, and above function just returns the raw value of timer counter register.
--- drivers/clocksource/sh_cmt.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-)
drivers/clocksource/sh_cmt.c +18 -12
@@ -576,7 +576,8 @@ static int sh_cmt_start(struct sh_cmt_channel *ch, unsigned long flag) ch->flags |= flag;/* setup timeout if no clockevent */ -if ((flag ==FLAG_CLOCKSOURCE ) && (!(ch->flags &FLAG_CLOCKEVENT ))) +if (ch->cmt->num_channels ==1 && + flag ==FLAG_CLOCKSOURCE && (!(ch->flags &FLAG_CLOCKEVENT )))__sh_cmt_set_next (ch, ch->max_match_value); out:raw_spin_unlock_irqrestore (&ch->lock, flags);
@@ -612,20 +613,25 @@ static struct sh_cmt_channel *cs_to_sh_cmt(struct clocksource *cs)static u64 sh_cmt_clocksource_read (struct clocksource *cs) {struct sh_cmt_channel *ch =cs_to_sh_cmt (cs); -unsigned long flags;u32 has_wrapped; -u64 value; -u32 raw; -raw_spin_lock_irqsave (&ch->lock, flags); - value = ch->total_cycles; - raw =sh_cmt_get_counter (ch, &has_wrapped); +if (ch->cmt->num_channels ==1 ) { +unsigned long flags; +u64 value; +u32 raw; -if (unlikely (has_wrapped)) - raw += ch->match_value +1 ; -raw_spin_unlock_irqrestore (&ch->lock, flags); +raw_spin_lock_irqsave (&ch->lock, flags); + value = ch->total_cycles; + raw =sh_cmt_get_counter (ch, &has_wrapped); + +if (unlikely (has_wrapped)) + raw += ch->match_value +1 ; +raw_spin_unlock_irqrestore (&ch->lock, flags); + +return value + raw; + } -return value + raw; +return sh_cmt_get_counter (ch, &has_wrapped); }static int sh_cmt_clocksource_enable (struct clocksource *cs)
@@ -688,7 +694,7 @@ static int sh_cmt_register_clocksource(struct sh_cmt_channel *ch, cs->disable = sh_cmt_clocksource_disable; cs->suspend = sh_cmt_clocksource_suspend; cs->resume = sh_cmt_clocksource_resume; - cs->mask =CLOCKSOURCE_MASK (sizeof (u64) *8 ); + cs->mask =CLOCKSOURCE_MASK (ch->cmt->info->width); cs->flags =CLOCK_SOURCE_IS_CONTINUOUS ; dev_info(&ch->cmt->pdev->dev, "ch%u: used as clock source\n",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 59/293 crypto: qat - use proper type for vf_mask
In reply to Greg Kroah-HartmanFrom: Giovanni Cabiddu <[email protected]>
[ Upstream commit 462354d986b6a89c6449b85f17aaacf44e455216 ]
Replace vf_mask type with unsigned long to avoid a stack-out-of-bound.
This is to fix the following warning reported by KASAN the first time adf_msix_isr_ae() gets called.
[ 692.091987] BUG: KASAN: stack-out-of-bounds in find_first_bit+0x28/0x50
[ 692.092017] Read of size 8 at addr ffff88afdf789e60 by task swapper/32/0
[ 692.092076] Call Trace:
[ 692.092089] <IRQ>
[ 692.092101] dump_stack+0x9c/0xcf
[ 692.092132] print_address_description.constprop.0+0x18/0x130
[ 692.092164] ? find_first_bit+0x28/0x50
[ 692.092185] kasan_report.cold+0x7f/0x111
[ 692.092213] ? static_obj+0x10/0x80
[ 692.092234] ? find_first_bit+0x28/0x50
[ 692.092262] find_first_bit+0x28/0x50
[ 692.092288] adf_msix_isr_ae+0x16e/0x230 [intel_qat]--- drivers/crypto/qat/qat_common/adf_isr.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/crypto/qat/qat_common/adf_isr.c +4 -3
@@ -59,6 +59,8 @@#include "adf_transport_access_macros.h" #include "adf_transport_internal.h" +#define ADF_MAX_NUM_VFS 32 +static int adf_enable_msix (struct adf_accel_dev *accel_dev) {struct adf_accel_pci *pci_dev_info = &accel_dev->accel_pci_dev;
@@ -111,7 +113,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)struct adf_bar *pmisc = &GET_BARS (accel_dev)[hw_data->get_misc_bar_id (hw_data)];void __iomem *pmisc_bar_addr = pmisc->virt_addr; -u32 vf_mask; +unsigned long vf_mask;/* Get the interrupt sources triggered by VFs */ vf_mask = ((ADF_CSR_RD(pmisc_bar_addr, ADF_ERRSOU5) &
@@ -132,8 +134,7 @@ static irqreturn_t adf_msix_isr_ae(int irq, void *dev_ptr)* unless the VF is malicious and is attempting to * flood the host OS with VF2PF interrupts. */ -for_each_set_bit (i, (const unsigned long *)&vf_mask, - (sizeof (vf_mask) *BITS_PER_BYTE )) { +for_each_set_bit (i, &vf_mask,ADF_MAX_NUM_VFS ) { vf_info = accel_dev->pf.vf_info + i;if (!__ratelimit (&vf_info->vf2pf_ratelimit)) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 60/293 certs: Trigger creation of RSA module signing key if its not an RSA key
In reply to Greg Kroah-HartmanFrom: Stefan Berger <[email protected]>
[ Upstream commit ea35e0d5df6c92fa2e124bb1b91d09b2240715ba ]
Address a kbuild issue where a developer created an ECDSA key for signing kernel modules and then builds an older version of the kernel, when bi- secting the kernel for example, that does not support ECDSA keys.
If openssl is installed, trigger the creation of an RSA module signing key if it is not an RSA key.
--- certs/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+)
certs/Makefile +8 -0
@@ -46,11 +46,19 @@ endif redirect_openssl = 2>&1 quiet_redirect_openssl = 2>&1 silent_redirect_openssl = 2>/dev/null +openssl_available = $(shell openssl help 2>/dev/null && echo yes) # We do it this way rather than having a boolean option for enabling an # external private key, because 'make randconfig' might enable such a # boolean option and we unfortunately can't make it depend on !RANDCONFIG. ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") + +ifeq ($(openssl_available),yes) +X509TEXT=$(shell openssl x509 -in "certs/signing_key.pem" -text 2>/dev/null) + +$(if $(findstring rsaEncryption,$(X509TEXT)),,$(shell rm -f "certs/signing_key.pem")) +endif + $(obj)/signing_key.pem: $(obj)/x509.genkey @$(kecho) "###" @$(kecho) "### Now generating an X.509 key pair to be used for signing modules."
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 61/293 spi: sprd: Fix the wrong WDG_LOAD_VAL
In reply to Greg Kroah-HartmanFrom: Chunyan Zhang <[email protected]>
[ Upstream commit 245ca2cc212bb2a078332ec99afbfbb202f44c2d ]
Use 50ms as default timeout value and the time clock is 32768HZ. The original value of WDG_LOAD_VAL is not correct, so this patch fixes it.
--- drivers/spi/spi-sprd-adi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/spi/spi-sprd-adi.c +1 -1
@@ -99,7 +99,7 @@#define HWRST_STATUS_SPRDISK 0xc0/* Use default timeout 50 ms that converts to watchdog values */ -#define WDG_LOAD_VAL ((50 * 1000) / 32768) +#define WDG_LOAD_VAL ((50 * 32768) / 1000)#define WDG_LOAD_MASK GENMASK(15, 0)#define WDG_UNLOCK_KEY 0xe551
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 62/293 media: TDA1997x: enable EDID support
In reply to Greg Kroah-HartmanFrom: Krzysztof Hałasa <[email protected]>
[ Upstream commit ea3e1c36e38810427485f06c2becc1f29e54521d ]
Without this patch, the TDA19971 chip's EDID is inactive. EDID never worked with this driver, it was all tested with HDMI signal sources which don't need EDID support.
--- drivers/media/i2c/tda1997x.c | 1 + 1 file changed, 1 insertion(+)
drivers/media/i2c/tda1997x.c +1 -0
@@ -2229,6 +2229,7 @@ static int tda1997x_core_init(struct v4l2_subdev *sd)/* get initial HDMI status */ state->hdmi_status =io_read (sd,REG_HDMI_FLAGS ); +io_write (sd,REG_EDID_ENABLE ,EDID_ENABLE_A_EN |EDID_ENABLE_B_EN );return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 63/293 soc: rockchip: ROCKCHIP_GRF should not default to y, unconditionally
In reply to Greg Kroah-HartmanFrom: Geert Uytterhoeven <[email protected]>
[ Upstream commit 2a1c55d4762dd34a8b0f2e36fb01b7b16b60735b ]
Merely enabling CONFIG_COMPILE_TEST should not enable additional code. To fix this, restrict the automatic enabling of ROCKCHIP_GRF to ARCH_ROCKCHIP, and ask the user in case of compile-testing.
--- drivers/soc/rockchip/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/soc/rockchip/Kconfig +2 -2
@@ -5,8 +5,8 @@ if ARCH_ROCKCHIP || COMPILE_TEST # config ROCKCHIP_GRF - bool - default y + bool "Rockchip General Register Files support" if COMPILE_TEST + default y if ARCH_ROCKCHIP help The General Register Files are a central component providing special additional settings registers for a lot of soc-components.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 64/293 media: dvb-usb: fix uninit-value in dvb_usb_adapter_dvb_init
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit c5453769f77ce19a5b03f1f49946fd3f8a374009 ]
If dibusb_read_eeprom_byte fails, the mac address is not initialized. And nova_t_read_mac_address does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of dibusb_read_eeprom_byte.
--- drivers/media/usb/dvb-usb/nova-t-usb2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/usb/dvb-usb/nova-t-usb2.c +4 -2
@@ -133,7 +133,7 @@ ret:static int nova_t_read_mac_address (struct dvb_usb_device *d,u8 mac[6 ]) { -int i; +int i, ret;u8 b; mac[0 ] =0x00 ;
@@ -142,7 +142,9 @@ static int nova_t_read_mac_address (struct dvb_usb_device *d, u8 mac[6])/* this is a complete guess, but works for my box */ for (i =136 ; i <139 ; i++) { -dibusb_read_eeprom_byte (d,i, &b); + ret =dibusb_read_eeprom_byte (d, i, &b); +if (ret) +return ret; mac[5 - (i -136 )] = b; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 65/293 media: dvb-usb: fix uninit-value in vp702x_read_mac_addr
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 797c061ad715a9a1480eb73f44b6939fbe3209ed ]
If vp702x_usb_in_op fails, the mac address is not initialized. And vp702x_read_mac_addr does not handle this failure, which leads to the uninit-value in dvb_usb_adapter_dvb_init.
Fix this by handling the failure of vp702x_usb_in_op.
--- drivers/media/usb/dvb-usb/vp702x.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/media/usb/dvb-usb/vp702x.c +9 -3
@@ -294,16 +294,22 @@ static int vp702x_rc_query(struct dvb_usb_device *d, u32 *event, int *state)static int vp702x_read_mac_addr (struct dvb_usb_device *d,u8 mac[6 ]) {u8 i, *buf; +int ret;struct vp702x_device_state *st = d->priv;mutex_lock (&st->buf_mutex); buf = st->buf; -for (i =6 ; i <12 ; i++) -vp702x_usb_in_op (d,READ_EEPROM_REQ , i,1 , &buf[i -6 ],1 ); +for (i =6 ; i <12 ; i++) { + ret =vp702x_usb_in_op (d,READ_EEPROM_REQ , i,1 , + &buf[i -6 ],1 ); +if (ret <0 ) + goto err; + }memcpy (mac, buf,6 ); +err:mutex_unlock (&st->buf_mutex); -return 0 ; +return ret; }static int vp702x_frontend_attach (struct dvb_usb_adapter *adap)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 66/293 media: go7007: remove redundant initialization
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 6f5885a7750545973bf1a942d2f0f129aef0aa06 ]
In go7007_alloc() kzalloc() is used for struct go7007 allocation. It means that there is no need in zeroing any members, because kzalloc will take care of it.
Removing these reduntant initialization steps increases execution speed a lot:
Before:
+ 86.802 us | go7007_alloc();
After:
+ 29.595 us | go7007_alloc();
--- drivers/media/usb/go7007/go7007-driver.c | 26 ------------------------ 1 file changed, 26 deletions(-)
drivers/media/usb/go7007/go7007-driver.c +0 -26
@@ -699,49 +699,23 @@ struct go7007 *go7007_alloc(const struct go7007_board_info *board, struct device *dev) {struct go7007 *go; -int i; go =kzalloc (sizeof (struct go7007 ),GFP_KERNEL );if (go ==NULL )return NULL ; go->dev = dev; go->board_info = board; - go->board_id =0 ; go->tuner_type =-1 ; - go->channel_number =0 ; - go->name[0 ] =0 ;mutex_init (&go->hw_lock);init_waitqueue_head (&go->frame_waitq);spin_lock_init (&go->spinlock); go->status =STATUS_INIT ; -memset (&go->i2c_adapter,0 ,sizeof (go->i2c_adapter)); - go->i2c_adapter_online =0 ; - go->interrupt_available =0 ;init_waitqueue_head (&go->interrupt_waitq); - go->input =0 ;go7007_update_board (go); - go->encoder_h_halve =0 ; - go->encoder_v_halve =0 ; - go->encoder_subsample =0 ; go->format =V4L2_PIX_FMT_MJPEG ; go->bitrate =1500000 ; go->fps_scale =1 ; - go->pali =0 ; go->aspect_ratio =GO7007_RATIO_1_1 ; - go->gop_size =0 ; - go->ipb =0 ; - go->closed_gop =0 ; - go->repeat_seqhead =0 ; - go->seq_header_enable =0 ; - go->gop_header_enable =0 ; - go->dvd_mode =0 ; - go->interlace_coding =0 ; -for (i =0 ; i <4 ; ++i) - go->modet[i].enable =0 ; -for (i =0 ; i <1624 ; ++i) - go->modet_map[i] =0 ; - go->audio_deliver =NULL ; - go->audio_enabled =0 ;return go; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 67/293 Bluetooth: sco: prevent information leak in sco_conn_defer_accept()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 59da0b38bc2ea570ede23a3332ecb3e7574ce6b2 ]
Smatch complains that some of these struct members are not initialized leading to a stack information disclosure:
net/bluetooth/sco.c:778 sco_conn_defer_accept() warn:
check that 'cp.retrans_effort' doesn't leak information
This seems like a valid warning. I've added a default case to fix this issue.
--- net/bluetooth/sco.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/sco.c +5 -0
@@ -761,6 +761,11 @@ static void sco_conn_defer_accept(struct hci_conn *conn, u16 setting) cp.max_latency =cpu_to_le16 (0xffff ); cp.retrans_effort =0xff ;break ; +default : +/* use CVSD settings as fallback */ + cp.max_latency =cpu_to_le16 (0xffff ); + cp.retrans_effort =0xff ; +break ; } hci_send_cmd(hdev, HCI_OP_ACCEPT_SYNC_CONN_REQ,
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 68/293 tcp: seq_file: Avoid skipping sk during tcp_seek_last_pos
In reply to Greg Kroah-HartmanFrom: Martin KaFai Lau <[email protected]>
[ Upstream commit 525e2f9fd0229eb10cb460a9e6d978257f24804e ]
st->bucket stores the current bucket number.st->offset stores the offset within this bucket that is the sk to be seq_show(). Thus, st->offset only makes sense within the same st->bucket.
These two variables are an optimization for the common no-lseek case. When resuming the seq_file iteration (i.e. seq_start()), tcp_seek_last_pos() tries to continue from the st->offset at bucket st->bucket.
However, it is possible that the bucket pointed by st->bucket has changed and st->offset may end up skipping the whole st->bucket without finding a sk. In this case, tcp_seek_last_pos() currently continues to satisfy the offset condition in the next (and incorrect) bucket. Instead, regardless of the offset value, the first sk of the next bucket should be returned. Thus, "bucket == st->bucket" check is added to tcp_seek_last_pos().
The chance of hitting this is small and the issue is a decade old, so targeting for the next tree.
--- net/ipv4/tcp_ipv4.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
net/ipv4/tcp_ipv4.c +3 -2
@@ -2177,6 +2177,7 @@ static void *tcp_get_idx(struct seq_file *seq, loff_t pos)static void *tcp_seek_last_pos (struct seq_file *seq) {struct tcp_iter_state *st = seq->private; +int bucket = st->bucket;int offset = st->offset;int orig_num = st->num;void *rc =NULL ;
@@ -2187,7 +2188,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)break ; st->state =TCP_SEQ_STATE_LISTENING ; rc =listening_get_next (seq,NULL ); -while (offset-- && rc) +while (offset-- && rc && bucket == st->bucket) rc =listening_get_next (seq, rc);if (rc)break ;
@@ -2198,7 +2199,7 @@ static void *tcp_seek_last_pos(struct seq_file *seq)if (st->bucket > tcp_hashinfo.ehash_mask)break ; rc =established_get_first (seq); -while (offset-- && rc) +while (offset-- && rc && bucket == st->bucket) rc =established_get_next (seq, rc); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 69/293 net: cipso: fix warnings in netlbl_cipsov4_add_std
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 8ca34a13f7f9b3fa2c464160ffe8cc1a72088204 ]
Syzbot reported warning in netlbl_cipsov4_add(). The problem was in too big doi_def->map.std->lvl.local_size passed to kcalloc(). Since this value comes from userpace there is no need to warn if value is not correct.
The same problem may occur with other kcalloc() calls in this function, so, I've added __GFP_NOWARN flag to all kcalloc() calls there.
--- net/netlabel/netlabel_cipso_v4.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
net/netlabel/netlabel_cipso_v4.c +4 -4
@@ -198,14 +198,14 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, } doi_def->map.std->lvl.local =kcalloc (doi_def->map.std->lvl.local_size,sizeof (u32), -GFP_KERNEL ); +GFP_KERNEL | __GFP_NOWARN);if (doi_def->map.std->lvl.local ==NULL ) { ret_val = -ENOMEM ; goto add_std_failure; } doi_def->map.std->lvl.cipso =kcalloc (doi_def->map.std->lvl.cipso_size,sizeof (u32), -GFP_KERNEL ); +GFP_KERNEL | __GFP_NOWARN);if (doi_def->map.std->lvl.cipso ==NULL ) { ret_val = -ENOMEM ; goto add_std_failure;
@@ -273,7 +273,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, doi_def->map.std->cat.local =kcalloc ( doi_def->map.std->cat.local_size,sizeof (u32), -GFP_KERNEL ); +GFP_KERNEL | __GFP_NOWARN);if (doi_def->map.std->cat.local ==NULL ) { ret_val = -ENOMEM ; goto add_std_failure;
@@ -281,7 +281,7 @@ static int netlbl_cipsov4_add_std(struct genl_info *info, doi_def->map.std->cat.cipso =kcalloc ( doi_def->map.std->cat.cipso_size,sizeof (u32), -GFP_KERNEL ); +GFP_KERNEL | __GFP_NOWARN);if (doi_def->map.std->cat.cipso ==NULL ) { ret_val = -ENOMEM ; goto add_std_failure;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 70/293 i2c: highlander: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit f16a3bb69aa6baabf8f0aca982c8cf21e2a4f6bc ]
The driver is written as if platform_get_irq() returns 0 on errors (while actually it returns a negative error code), blithely passing these error codes to request_irq() (which takes *unsigned* IRQ #) -- which fails with -EINVAL. Add the necessary error check to the pre-existing *if* statement forcing the driver into the polling mode...
--- drivers/i2c/busses/i2c-highlander.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-highlander.c +1 -1
@@ -379,7 +379,7 @@ static int highlander_i2c_probe(struct platform_device *pdev)platform_set_drvdata (pdev, dev); dev->irq =platform_get_irq (pdev,0 ); -if (iic_force_poll) +if (dev->irq <0 || iic_force_poll) dev->irq =0 ;if (dev->irq) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 71/293 media: em28xx-input: fix refcount bug in em28xx_usb_disconnect
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
[ Upstream commit 6fa54bc713c262e1cfbc5613377ef52280d7311f ]
If em28xx_ir_init fails, it would decrease the refcount of dev. However, in the em28xx_ir_fini, when ir is NULL, it goes to ref_put and decrease the refcount of dev. This will lead to a refcount bug.
Fix this bug by removing the kref_put in the error handling code of em28xx_ir_init.
refcount_t: underflow; use-after-free.
WARNING: CPU: 0 PID: 7 at lib/refcount.c:28 refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 Modules linked in: CPU: 0 PID: 7 Comm: kworker/0:1 Not tainted 5.13.0 #3 Workqueue: usb_hub_wq hub_event RIP: 0010:refcount_warn_saturate+0x18e/0x1a0 lib/refcount.c:28 Call Trace: kref_put.constprop.0+0x60/0x85 include/linux/kref.h:69 em28xx_usb_disconnect.cold+0xd7/0xdc drivers/media/usb/em28xx/em28xx-cards.c:4150 usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458 __device_release_driver drivers/base/dd.c:1201 [inline] device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1232 bus_remove_device+0x108/0x160 drivers/base/bus.c:529 device_del+0x1fe/0x510 drivers/base/core.c:3540 usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419 usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2221 hub_port_connect drivers/usb/core/hub.c:5151 [inline] hub_port_connect_change drivers/usb/core/hub.c:5440 [inline] port_event drivers/usb/core/hub.c:5586 [inline] hub_event+0xf81/0x1d40 drivers/usb/core/hub.c:5668 process_one_work+0x2c9/0x610 kernel/workqueue.c:2276 process_scheduled_works kernel/workqueue.c:2338 [inline] worker_thread+0x333/0x5b0 kernel/workqueue.c:2424 kthread+0x188/0x1d0 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
--- drivers/media/usb/em28xx/em28xx-input.c | 1 - 1 file changed, 1 deletion(-)
drivers/media/usb/em28xx/em28xx-input.c +0 -1
@@ -865,7 +865,6 @@ error:kfree (ir); ref_put:em28xx_shutdown_buttons (dev); -kref_put (&dev->ref, em28xx_free_device);return err; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 72/293 media: venus: venc: Fix potential null pointer dereference on pointer fmt
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 09ea9719a423fc675d40dd05407165e161ea0c48 ]
Currently the call to find_format can potentially return a NULL to fmt and the nullpointer is later dereferenced on the assignment of pixmp->num_planes = fmt->num_planes. Fix this by adding a NULL pointer check and returning NULL for the failure case.
Addresses-Coverity: ("Dereference null return")
--- drivers/media/platform/qcom/venus/venc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/qcom/venus/venc.c +2 -0
@@ -316,6 +316,8 @@ venc_try_fmt_common(struct venus_inst *inst, struct v4l2_format *f)else return NULL ; fmt =find_format (inst, pixmp->pixelformat, f->type); +if (!fmt) +return NULL ; } pixmp->width = clamp(pixmp->width, frame_width_min(inst),
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 73/293 PCI: PM: Avoid forcing PCI_D0 for wakeup reasons inconsistently
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit da9f2150684ea684a7ddd6d7f0e38b2bdf43dcd8 ]
It is inconsistent to return PCI_D0 from pci_target_state() instead of the original target state if 'wakeup' is true and the device cannot signal PME from D0.
This only happens when the device cannot signal PME from the original target state and any shallower power states (including D0) and that case is effectively equivalent to the one in which PME singaling is not supported at all. Since the original target state is returned in the latter case, make the function do that in the former one too.
--- drivers/pci/pci.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/pci/pci.c +10 -6
@@ -2274,16 +2274,20 @@ static pci_power_t pci_target_state(struct pci_dev *dev, bool wakeup)if (dev->current_state == PCI_D3cold) target_state = PCI_D3cold; -if (wakeup) { +if (wakeup && dev->pme_support) { +pci_power_t state = target_state; +/* * Find the deepest state from which the device can generate * PME#. */ -if (dev->pme_support) { -while (target_state - && !(dev->pme_support & (1 << target_state))) - target_state--; - } +while (state && !(dev->pme_support & (1 << state))) + state--; + +if (state) +return state; +else if (dev->pme_support &1 ) +return PCI_D0 ; }return target_state;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 74/293 PCI: PM: Enable PME if it can be signaled from D3cold
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit 0e00392a895c95c6d12d42158236c8862a2f43f2 ]
PME signaling is only enabled by __pci_enable_wake() if the target device can signal PME from the given target power state (to avoid pointless reconfiguration of the device), but if the hierarchy above the device goes into D3cold, the device itself will end up in D3cold too, so if it can signal PME from D3cold, it should be enabled to do so in __pci_enable_wake().
[Note that if the device does not end up in D3cold and it cannot
signal PME from the original target power state, it will not signal PME, so in that case the behavior does not change.]
--- drivers/pci/pci.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/pci/pci.c +8 -1
@@ -2170,7 +2170,14 @@ static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enableif (enable) {int error; -if (pci_pme_capable (dev, state)) +/* +* Enable PME signaling if the device can signal PME from +* D3cold regardless of whether or not it can signal PME from +* the current target state, because that will allow it to +* signal PME when the hierarchy above it goes into D3cold and +* the device itself ends up in D3cold as a result of that. +*/ +if (pci_pme_capable (dev, state) ||pci_pme_capable (dev, PCI_D3cold))pci_pme_active (dev, true);else ret =1 ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 75/293 soc: qcom: smsm: Fix missed interrupts if state changes while masked
In reply to Greg Kroah-HartmanFrom: Stephan Gerhold <[email protected]>
[ Upstream commit e3d4571955050736bbf3eda0a9538a09d9fcfce8 ]
The SMSM driver detects interrupt edges by tracking the last state it has seen (and has triggered the interrupt handler for). This works fine, but only if the interrupt does not change state while masked.
For example, if an interrupt is unmasked while the state is HIGH, the stored last_value for that interrupt might still be LOW. Then, when the remote processor triggers smsm_intr() we assume that nothing has changed, even though the state might have changed from HIGH to LOW.
Attempt to fix this by checking the current remote state before unmasking an IRQ. Use atomic operations to avoid the interrupt handler from interfering with the unmask function.
This fixes modem crashes in some edge cases with the BAM-DMUX driver. Specifically, the BAM-DMUX interrupt handler is not called for the HIGH -> LOW smsm state transition if the BAM-DMUX driver is loaded (and therefore unmasks the interrupt) after the modem was already started:
qcom-q6v5-mss 4080000.remoteproc: fatal error received: a2_task.c:3188:
Assert FALSE failed: A2 DL PER deadlock timer expired waiting for Apps ACK
--- drivers/soc/qcom/smsm.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
drivers/soc/qcom/smsm.c +8 -3
@@ -117,7 +117,7 @@ struct smsm_entry {DECLARE_BITMAP (irq_enabled,32 );DECLARE_BITMAP (irq_rising,32 );DECLARE_BITMAP (irq_falling,32 ); -u32 last_value; +unsigned long last_value;u32 *remote_state;u32 *subscription;
@@ -212,8 +212,7 @@ static irqreturn_t smsm_intr(int irq, void *data)u32 val; val =readl (entry->remote_state); - changed = val ^ entry->last_value; - entry->last_value = val; + changed = val ^xchg (&entry->last_value, val);for_each_set_bit (i, entry->irq_enabled,32 ) {if (!(changed &BIT (i)))
@@ -274,6 +273,12 @@ static void smsm_unmask_irq(struct irq_data *irqd)struct qcom_smsm *smsm = entry->smsm;u32 val; +/* Make sure our last cached state is up-to-date */ +if (readl (entry->remote_state) &BIT (irq)) +set_bit (irq, &entry->last_value); +else +clear_bit (irq, &entry->last_value); +set_bit (irq, entry->irq_enabled);if (entry->subscription) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 76/293 Bluetooth: increase BTNAMSIZ to 21 chars to fix potential buffer overflow
In reply to Greg Kroah-HartmanFrom: Colin Ian King <[email protected]>
[ Upstream commit 713baf3dae8f45dc8ada4ed2f5fdcbf94a5c274d ]
An earlier commit replaced using batostr to using %pMR sprintf for the construction of session->name. Static analysis detected that this new method can use a total of 21 characters (including the trailing '\0') so we need to increase the BTNAMSIZ from 18 to 21 to fix potential buffer overflows.
Addresses-Coverity: ("Out-of-bounds write")
--- net/bluetooth/cmtp/cmtp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/bluetooth/cmtp/cmtp.h +1 -1
@@ -26,7 +26,7 @@#include <linux/types.h> #include <net/bluetooth/bluetooth.h> -#define BTNAMSIZ 18 +#define BTNAMSIZ 21/* CMTP ioctl defines */ #define CMTPCONNADD _IOW('C', 200, int)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 77/293 drm/msm/dpu: make dpu_hw_ctl_clear_all_blendstages clear necessary LMs
In reply to Greg Kroah-HartmanFrom: Dmitry Baryshkov <[email protected]>
[ Upstream commit a41cdb693595ae1904dd793fc15d6954f4295e27 ]
dpu_hw_ctl_clear_all_blendstages() clears settings for the few first LMs instead of mixers actually used for the CTL. Change it to clear necessary data, using provided mixer ids.
--- drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +6 -4
@@ -296,10 +296,12 @@ static void dpu_hw_ctl_clear_all_blendstages(struct dpu_hw_ctl *ctx)int i;for (i =0 ; i < ctx->mixer_count; i++) { -DPU_REG_WRITE (c,CTL_LAYER (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT2 (LM_0 + i),0 ); -DPU_REG_WRITE (c,CTL_LAYER_EXT3 (LM_0 + i),0 ); +enum dpu_lm mixer_id = ctx->mixer_hw_caps[i].id; + +DPU_REG_WRITE (c,CTL_LAYER (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT2 (mixer_id),0 ); +DPU_REG_WRITE (c,CTL_LAYER_EXT3 (mixer_id),0 ); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 78/293 arm64: dts: exynos: correct GIC CPU interfaces address range on Exynos7
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 01c72cad790cb6cd3ccbe4c1402b6cb6c6bbffd0 ]
The GIC-400 CPU interfaces address range is defined as 0x2000-0x3FFF (by ARM).
--- arch/arm64/boot/dts/exynos/exynos7.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm64/boot/dts/exynos/exynos7.dtsi +1 -1
@@ -91,7 +91,7 @@ #address-cells = <0>; interrupt-controller; reg = <0x11001000 0x1000>, - <0x11002000 0x1000>, + <0x11002000 0x2000>, <0x11004000 0x2000>, <0x11006000 0x2000>; };
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 79/293 Bluetooth: fix repeated calls to sco_sock_kill
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
[ Upstream commit e1dee2c1de2b4dd00eb44004a4bda6326ed07b59 ]
In commit 4e1a720d0312 ("Bluetooth: avoid killing an already killed socket"), a check was added to sco_sock_kill to skip killing a socket if the SOCK_DEAD flag was set.
This was done after a trace for a use-after-free bug showed that the same sock pointer was being killed twice.
Unfortunately, this check prevents sco_sock_kill from running on any socket. sco_sock_kill kills a socket only if it's zapped and orphaned, however sock_orphan announces that the socket is dead before detaching it. i.e., orphaned sockets have the SOCK_DEAD flag set.
To fix this, we remove the check for SOCK_DEAD, and avoid repeated calls to sco_sock_kill by removing incorrect calls in:
1. sco_sock_timeout. The socket should not be killed on timeout as further processing is expected to be done. For example, sco_sock_connect sets the timer then waits for the socket to be connected or for an error to be returned.
2. sco_conn_del. This function should clean up resources for the connection, but the socket itself should be cleaned up in sco_sock_release.
3. sco_sock_close. Calls to sco_sock_close in sco_sock_cleanup_listen and sco_sock_release are followed by sco_sock_kill. Hence the duplicated call should be removed.
--- net/bluetooth/sco.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-)
net/bluetooth/sco.c +1 -5
@@ -84,7 +84,6 @@ static void sco_sock_timeout(struct timer_list *t) sk->sk_state_change (sk);bh_unlock_sock (sk); -sco_sock_kill (sk);sock_put (sk); }
@@ -176,7 +175,6 @@ static void sco_conn_del(struct hci_conn *hcon, int err)sco_sock_clear_timer (sk);sco_chan_del (sk, err);bh_unlock_sock (sk); -sco_sock_kill (sk);sock_put (sk); }
@@ -393,8 +391,7 @@ static void sco_sock_cleanup_listen(struct sock *parent)*/ static void sco_sock_kill (struct sock *sk) { -if (!sock_flag (sk,SOCK_ZAPPED ) || sk->sk_socket || -sock_flag (sk,SOCK_DEAD )) +if (!sock_flag (sk,SOCK_ZAPPED ) || sk->sk_socket)return ;BT_DBG ("sk %p state %d" , sk, sk->sk_state);
@@ -446,7 +443,6 @@ static void sco_sock_close(struct sock *sk)lock_sock (sk);__sco_sock_close (sk);release_sock (sk); -sco_sock_kill (sk); }static void sco_sock_init (struct sock *sk,struct sock *parent)
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 80/293 drm/msm/dsi: Fix some reference counted resource leaks
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 6977cc89c87506ff17e6c05f0e37f46752256e82 ]
'of_find_device_by_node()' takes a reference that must be released when not needed anymore.
This is expected to be done in 'dsi_destroy()'.
However, there are 2 issues in 'dsi_get_phy()'.
First, if 'of_find_device_by_node()' succeeds but 'platform_get_drvdata()' returns NULL, 'msm_dsi->phy_dev' will still be NULL, and the reference won't be released in 'dsi_destroy()'.
Secondly, as 'of_find_device_by_node()' already takes a reference, there is no need for an additional 'get_device()'.
Move the assignment to 'msm_dsi->phy_dev' a few lines above and remove the unneeded 'get_device()' to solve both issues.
--- drivers/gpu/drm/msm/dsi/dsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/msm/dsi/dsi.c +3 -3
@@ -34,8 +34,10 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi) } phy_pdev =of_find_device_by_node (phy_node); -if (phy_pdev) +if (phy_pdev) { msm_dsi->phy =platform_get_drvdata (phy_pdev); + msm_dsi->phy_dev = &phy_pdev->dev; + }of_node_put (phy_node);
@@ -44,8 +46,6 @@ static int dsi_get_phy(struct msm_dsi *msm_dsi)return -EPROBE_DEFER ; } - msm_dsi->phy_dev =get_device (&phy_pdev->dev); -return 0 ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 81/293 usb: gadget: udc: at91: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 50855c31573b02963f0aa2aacfd4ea41c31ae0e0 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to devm_request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling devm_request_irq() with the invalid IRQ #s.
--- drivers/usb/gadget/udc/at91_udc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/at91_udc.c +3 -1
@@ -1879,7 +1879,9 @@ static int at91udc_probe(struct platform_device *pdev)clk_disable (udc->iclk);/* request UDC and maybe VBUS irqs */ - udc->udp_irq =platform_get_irq (pdev,0 ); + udc->udp_irq = retval =platform_get_irq (pdev,0 ); +if (retval <0 ) + goto err_unprepare_iclk; retval =devm_request_irq (dev, udc->udp_irq, at91_udc_irq,0 , driver_name, udc);if (retval) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 82/293 usb: phy: fsl-usb: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit ecc2f30dbb25969908115c81ec23650ed982b004 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling request_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-fsl-usb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/phy/phy-fsl-usb.c +2 -0
@@ -873,6 +873,8 @@ int usb_otg_start(struct platform_device *pdev)/* request irq */ p_otg->irq =platform_get_irq (pdev,0 ); +if (p_otg->irq <0 ) +return p_otg->irq; status =request_irq (p_otg->irq, fsl_otg_isr,IRQF_SHARED , driver_name, p_otg);if (status) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 83/293 usb: phy: twl6030: add IRQ checks
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0881e22c06e66af0b64773c91c8868ead3d01aa1 ]
The driver neglects to check the result of platform_get_irq()'s calls and blithely passes the negative error codes to request_threaded_irq() (which takes *unsigned* IRQ #), causing them both to fail with -EINVAL, overriding an original error code. Stop calling request_threaded_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-twl6030-usb.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/usb/phy/phy-twl6030-usb.c +5 -0
@@ -342,6 +342,11 @@ static int twl6030_usb_probe(struct platform_device *pdev) twl->irq2 =platform_get_irq (pdev,1 ); twl->linkstat =MUSB_UNKNOWN ; +if (twl->irq1 <0 ) +return twl->irq1; +if (twl->irq2 <0 ) +return twl->irq2; + twl->comparator.set_vbus = twl6030_set_vbus; twl->comparator.start_srp = twl6030_start_srp;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 84/293 Bluetooth: Move shutdown callback before flushing tx and rx queue
In reply to Greg Kroah-HartmanFrom: Kai-Heng Feng <[email protected]>
[ Upstream commit 0ea53674d07fb6db2dd7a7ec2fdc85a12eb246c2 ]
Commit 0ea9fd001a14 ("Bluetooth: Shutdown controller after workqueues are flushed or cancelled") introduced a regression that makes mtkbtsdio driver stops working:
[ 36.593956] Bluetooth: hci0: Firmware already downloaded [ 46.814613] Bluetooth: hci0: Execution of wmt command timed out [ 46.814619] Bluetooth: hci0: Failed to send wmt func ctrl (-110)
The shutdown callback depends on the result of hdev->rx_work, so we should call it before flushing rx_work:
-> btmtksdio_shutdown()
-> mtk_hci_wmt_sync()
-> __hci_cmd_send()
-> wait for BTMTKSDIO_TX_WAIT_VND_EVT gets cleared
-> btmtksdio_recv_event()
-> hci_recv_frame()
-> queue_work(hdev->workqueue, &hdev->rx_work)
-> clears BTMTKSDIO_TX_WAIT_VND_EVT
So move the shutdown callback before flushing TX/RX queue to resolve the issue.
--- net/bluetooth/hci_core.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/bluetooth/hci_core.c +8 -0
@@ -1622,6 +1622,14 @@ int hci_dev_do_close(struct hci_dev *hdev)hci_request_cancel_all (hdev);hci_req_sync_lock (hdev); +if (!hci_dev_test_flag (hdev,HCI_UNREGISTER ) && + !hci_dev_test_flag (hdev,HCI_USER_CHANNEL ) && +test_bit (HCI_UP , &hdev->flags)) { +/* Execute vendor specific shutdown routine */ +if (hdev->shutdown) + hdev->shutdown (hdev); + } +if (!test_and_clear_bit (HCI_UP , &hdev->flags)) {cancel_delayed_work_sync (&hdev->cmd_timer);hci_req_sync_unlock (hdev);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 85/293 usb: host: ohci-tmio: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 4ac5132e8a4300637a2da8f5d6bc7650db735b8a ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to usb_add_hcd() (which takes *unsigned* IRQ #), causing request_irq() that it calls to fail with -EINVAL, overriding an original error code. Stop calling usb_add_hcd() with the invalid IRQ #s.
--- drivers/usb/host/ohci-tmio.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/usb/host/ohci-tmio.c +3 -0
@@ -199,6 +199,9 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev)if (!cell)return -EINVAL ; +if (irq <0 ) +return irq; + hcd =usb_create_hcd (&ohci_tmio_hc_driver, &dev->dev,dev_name (&dev->dev));if (!hcd) { ret = -ENOMEM ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 86/293 usb: phy: tahvo: add IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 0d45a1373e669880b8beaecc8765f44cb0241e47 ]
The driver neglects to check the result of platform_get_irq()'s call and blithely passes the negative error codes to request_threaded_irq() (which takes *unsigned* IRQ #), causing it to fail with -EINVAL, overriding an original error code. Stop calling request_threaded_irq() with the invalid IRQ #s.
--- drivers/usb/phy/phy-tahvo.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/phy/phy-tahvo.c +3 -1
@@ -396,7 +396,9 @@ static int tahvo_usb_probe(struct platform_device *pdev)dev_set_drvdata (&pdev->dev, tu); - tu->irq =platform_get_irq (pdev,0 ); + tu->irq = ret =platform_get_irq (pdev,0 ); +if (ret <0 ) +return ret; ret =request_threaded_irq (tu->irq,NULL , tahvo_usb_vbus_interrupt,IRQF_ONESHOT ,"tahvo-vbus" , tu);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 87/293 mac80211: Fix insufficient headroom issue for AMSDU
In reply to Greg Kroah-HartmanFrom: Chih-Kang Chang <[email protected]>
[ Upstream commit f50d2ff8f016b79a2ff4acd5943a1eda40c545d4 ]
ieee80211_amsdu_realloc_pad() fails to account for extra_tx_headroom, the original reserved headroom might be eaten. Add the necessary extra_tx_headroom.
--- net/mac80211/tx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/mac80211/tx.c +3 -1
@@ -3142,7 +3142,9 @@ static bool ieee80211_amsdu_prepare_head(struct ieee80211_sub_if_data *sdata,if (info->control.flags &IEEE80211_TX_CTRL_AMSDU )return true; -if (!ieee80211_amsdu_realloc_pad (local, skb,sizeof (*amsdu_hdr))) +if (!ieee80211_amsdu_realloc_pad (local, skb, +sizeof (*amsdu_hdr) + + local->hw.extra_tx_headroom))return false; data =skb_push (skb,sizeof (*amsdu_hdr));
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 88/293 usb: gadget: mv_u3d: request_irq() after initializing UDC
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
[ Upstream commit 2af0c5ffadaf9d13eca28409d4238b4e672942d3 ]
If IRQ occurs between calling request_irq() and mv_u3d_eps_init(), then null pointer dereference occurs since u3d->eps[] wasn't initialized yet but used in mv_u3d_nuke().
The patch puts registration of the interrupt handler after initializing of neccesery data.
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/gadget/udc/mv_u3d_core.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-)
drivers/usb/gadget/udc/mv_u3d_core.c +10 -9
@@ -1922,14 +1922,6 @@ static int mv_u3d_probe(struct platform_device *dev) goto err_get_irq; } u3d->irq = r->start; -if (request_irq (u3d->irq, mv_u3d_irq, -IRQF_SHARED , driver_name, u3d)) { - u3d->irq =0 ; -dev_err (&dev->dev,"Request irq %d for u3d failed\n" , - u3d->irq); - retval = -ENODEV ; - goto err_request_irq; - }/* initialize gadget structure */ u3d->gadget.ops = &mv_u3d_ops;/* usb_gadget_ops */
@@ -1942,6 +1934,15 @@ static int mv_u3d_probe(struct platform_device *dev)mv_u3d_eps_init (u3d); +if (request_irq (u3d->irq, mv_u3d_irq, +IRQF_SHARED , driver_name, u3d)) { + u3d->irq =0 ; +dev_err (&dev->dev,"Request irq %d for u3d failed\n" , + u3d->irq); + retval = -ENODEV ; + goto err_request_irq; + } +/* external vbus detection */ if (u3d->vbus) { u3d->clock_gating =1 ;
@@ -1965,8 +1966,8 @@ static int mv_u3d_probe(struct platform_device *dev) err_unregister:free_irq (u3d->irq, u3d); -err_request_irq: err_get_irq: +err_request_irq:kfree (u3d->status_req); err_alloc_status_req:kfree (u3d->eps);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 89/293 Bluetooth: add timeout sanity check to hci_inquiry
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit f41a4b2b5eb7872109723dab8ae1603bdd9d9ec1 ]
Syzbot hit "task hung" bug in hci_req_sync(). The problem was in unreasonable huge inquiry timeout passed from userspace. Fix it by adding sanity check for timeout value to hci_inquiry().
Since hci_inquiry() is the only user of hci_req_sync() with user controlled timeout value, it makes sense to check timeout value in hci_inquiry() and don't touch hci_req_sync().
--- net/bluetooth/hci_core.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/bluetooth/hci_core.c +6 -0
@@ -1296,6 +1296,12 @@ int hci_inquiry(void __user *arg) goto done; } +/* Restrict maximum inquiry length to 60 seconds */ +if (ir.length >60 ) { + err = -EINVAL ; + goto done; + } +hci_dev_lock (hdev);if (inquiry_cache_age (hdev) >INQUIRY_CACHE_AGE_MAX ||inquiry_cache_empty (hdev) || ir.flags &IREQ_CACHE_FLUSH ) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 90/293 i2c: iop3xx: fix deferred probing
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit a1299505162ad00def3573260c2c68b9c8e8d697 ]
When adding the code to handle platform_get_irq*() errors in the commit 489447380a29 ("handle errors returned by platform_get_irq*()"), the actual error code was enforced to be -ENXIO in the driver for some strange reason. This didn't matter much until the deferred probing was introduced -- which requires an actual error code to be propagated upstream from the failure site.
While fixing this, also stop overriding the errors from request_irq() to -EIO (done since the pre-git era).
--- drivers/i2c/busses/i2c-iop3xx.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/i2c/busses/i2c-iop3xx.c +2 -4
@@ -456,16 +456,14 @@ iop3xx_i2c_probe(struct platform_device *pdev) irq =platform_get_irq (pdev,0 );if (irq <0 ) { - ret = -ENXIO ; + ret = irq; goto unmap; } ret =request_irq (irq, iop3xx_i2c_irq_handler,0 , pdev->name, adapter_data); -if (ret) { - ret = -EIO ; +if (ret) goto unmap; - }memcpy (new_adapter->name, pdev->name,strlen (pdev->name)); new_adapter->owner =THIS_MODULE ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 91/293 i2c: s3c2410: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit d6840a5e370b7ea4fde16ce2caf431bcc87f9a75 ]
Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-s3c2410.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-s3c2410.c +1 -1
@@ -1179,7 +1179,7 @@ static int s3c24xx_i2c_probe(struct platform_device *pdev)*/ if (!(i2c->quirks &QUIRK_POLL )) { i2c->irq = ret =platform_get_irq (pdev,0 ); -if (ret <=0 ) { +if (ret <0 ) {dev_err (&pdev->dev,"cannot find IRQ\n" );clk_unprepare (i2c->clk);return ret;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 92/293 mmc: dw_mmc: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit c3ff0189d3bc9c03845fe37472c140f0fefd0c79 ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For dw_mmc, this is probably not currently an issue but is still good to fix though.
--- drivers/mmc/host/dw_mmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/dw_mmc.c +1 -0
@@ -808,6 +808,7 @@ static int dw_mci_edmac_start_dma(struct dw_mci *host,int ret =0 ;/* Set external dma config: burst size, burst width */ +memset (&cfg,0 ,sizeof (cfg)); cfg.dst_addr = host->phy_regs + fifo_offset; cfg.src_addr = cfg.dst_addr; cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 93/293 mmc: moxart: Fix issue with uninitialized dma_slave_config
In reply to Greg Kroah-HartmanFrom: Tony Lindgren <[email protected]>
[ Upstream commit ee5165354d498e5bceb0b386e480ac84c5f8c28c ]
Depending on the DMA driver being used, the struct dma_slave_config may need to be initialized to zero for the unused data.
For example, we have three DMA drivers using src_port_window_size and dst_port_window_size. If these are left uninitialized, it can cause DMA failures.
For moxart, this is probably not currently an issue but is still good to fix though.
--- drivers/mmc/host/moxart-mmc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/moxart-mmc.c +1 -0
@@ -631,6 +631,7 @@ static int moxart_probe(struct platform_device *pdev) host->dma_chan_tx, host->dma_chan_rx); host->have_dma = true; +memset (&cfg,0 ,sizeof (cfg)); cfg.src_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ; cfg.dst_addr_width =DMA_SLAVE_BUSWIDTH_4_BYTES ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 94/293 CIFS: Fix a potencially linear read overflow
In reply to Greg Kroah-HartmanFrom: Len Baker <[email protected]>
[ Upstream commit f980d055a0f858d73d9467bb0b570721bbfcdfb8 ]
strlcpy() reads the entire source buffer first. This read may exceed the destination size limit. This is both inefficient and can lead to linear read overflows if a source string is not NUL-terminated.
Also, the strnlen() call does not avoid the read overflow in the strlcpy function when a not NUL-terminated string is passed.
So, replace this block by a call to kstrndup() that avoids this type of overflow and does the same.
--- fs/cifs/cifs_unicode.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
fs/cifs/cifs_unicode.c +2 -7
@@ -371,14 +371,9 @@ cifs_strndup_from_utf16(const char *src, const int maxlen,if (!dst)return NULL ;cifs_from_utf16 (dst, (__le16 *) src, len, maxlen, codepage, -NO_MAP_UNI_RSVD ); +NO_MAP_UNI_RSVD ); }else { - len =strnlen (src, maxlen); - len++; - dst =kmalloc (len,GFP_KERNEL ); -if (!dst) -return NULL ; -strlcpy (dst, src, len); + dst =kstrndup (src, maxlen,GFP_KERNEL ); }return dst;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 95/293 i2c: mt65xx: fix IRQ check
In reply to Greg Kroah-HartmanFrom: Sergey Shtylyov <[email protected]>
[ Upstream commit 58fb7c643d346e2364404554f531cfa6a1a3917c ]
Iff platform_get_irq() returns 0, the driver's probe() method will return 0 early (as if the method's call was successful). Let's consider IRQ0 valid for simplicity -- devm_request_irq() can always override that decision...
--- drivers/i2c/busses/i2c-mt65xx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/i2c/busses/i2c-mt65xx.c +1 -1
@@ -804,7 +804,7 @@ static int mtk_i2c_probe(struct platform_device *pdev)return PTR_ERR (i2c->pdmabase); irq =platform_get_irq (pdev,0 ); -if (irq <=0 ) +if (irq <0 )return irq;init_completion (&i2c->msg_complete);
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 96/293 usb: ehci-orion: Handle errors of clk_prepare_enable() in probe
In reply to Greg Kroah-HartmanFrom: Evgeny Novikov <[email protected]>
[ Upstream commit 4720f1bf4ee4a784d9ece05420ba33c9222a3004 ]
ehci_orion_drv_probe() did not account for possible errors of clk_prepare_enable() that in particular could cause invocation of clk_disable_unprepare() on clocks that were not prepared/enabled yet, e.g. in remove or on handling errors of usb_add_hcd() in probe. Though, there were several patches fixing different issues with clocks in this driver, they did not solve this problem.
Add handling of errors of clk_prepare_enable() in ehci_orion_drv_probe() to avoid calls of clk_disable_unprepare() without previous successful invocation of clk_prepare_enable().
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/usb/host/ehci-orion.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/usb/host/ehci-orion.c +6 -2
@@ -250,8 +250,11 @@ static int ehci_orion_drv_probe(struct platform_device *pdev)* the clock does not exists. */ priv->clk =devm_clk_get (&pdev->dev,NULL ); -if (!IS_ERR (priv->clk)) -clk_prepare_enable (priv->clk); +if (!IS_ERR (priv->clk)) { + err =clk_prepare_enable (priv->clk); +if (err) + goto err_put_hcd; + } priv->phy =devm_phy_optional_get (&pdev->dev,"usb" );if (IS_ERR (priv->phy)) {
@@ -312,6 +315,7 @@ err_phy_init: err_phy_get:if (!IS_ERR (priv->clk))clk_disable_unprepare (priv->clk); +err_put_hcd:usb_put_hcd (hcd); err: dev_err(&pdev->dev, "init %s fail, %d\n",
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 97/293 usb: bdc: Fix an error handling path in bdc_probe() when no suitable DMA config is available
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit d2f42e09393c774ab79088d8e3afcc62b3328fc9 ]
If no suitable DMA configuration is available, a previous 'bdc_phy_init()' call must be undone by a corresponding 'bdc_phy_exit()' call.
Branch to the existing error handling path instead of returning directly.
--- drivers/usb/gadget/udc/bdc/bdc_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/usb/gadget/udc/bdc/bdc_core.c +2 -1
@@ -568,7 +568,8 @@ static int bdc_probe(struct platform_device *pdev)if (ret) {dev_err (dev,"No suitable DMA config available, abort\n" ); -return -ENOTSUPP ; + ret = -ENOTSUPP ; + goto phycleanup; }dev_dbg (dev,"Using 32-bit address\n" ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 98/293 tty: serial: fsl_lpuart: fix the wrong mapbase value
In reply to Greg Kroah-HartmanFrom: Andy Duan <[email protected]>
[ Upstream commit d5c38948448abc2bb6b36dbf85a554bf4748885e ]
Register offset needs to be applied on mapbase also. dma_tx/rx_request use the physical address of UARTDATA. Register offset is currently only applied to membase (the corresponding virtual addr) but not on mapbase.
--- drivers/tty/serial/fsl_lpuart.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/fsl_lpuart.c +1 -1
@@ -2164,7 +2164,7 @@ static int lpuart_probe(struct platform_device *pdev)return PTR_ERR (sport->port.membase); sport->port.membase += sdata->reg_off; - sport->port.mapbase = res->start; + sport->port.mapbase = res->start + sdata->reg_off; sport->port.dev = &pdev->dev; sport->port.type =PORT_LPUART ; ret =platform_get_irq (pdev,0 );
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 99/293 ath6kl: wmi: fix an error code in ath6kl_wmi_sync_point()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit fd6729ec534cffbbeb3917761e6d1fe6a412d3fe ]
This error path is unlikely because of it checked for NULL and returned -ENOMEM earlier in the function. But it should return an error code here as well if we ever do hit it because of a race condition or something.
--- drivers/net/wireless/ath/ath6kl/wmi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/wireless/ath/ath6kl/wmi.c +3 -1
@@ -2513,8 +2513,10 @@ static int ath6kl_wmi_sync_point(struct wmi *wmi, u8 if_idx) goto free_data_skb;for (index =0 ; index < num_pri_streams; index++) { -if (WARN_ON (!data_sync_bufs[index].skb)) +if (WARN_ON (!data_sync_bufs[index].skb)) { + ret = -ENOMEM ; goto free_data_skb; + } ep_id = ath6kl_ac2_endpoint_id(wmi->parent_dev, data_sync_bufs[index].
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 100/293 bcma: Fix memory leak for internally-handled cores
In reply to Greg Kroah-HartmanFrom: Zenghui Yu <[email protected]>
[ Upstream commit b63aed3ff195130fef12e0af590f4838cf0201d8 ]
kmemleak reported that dev_name() of internally-handled cores were leaked on driver unbinding. Let's use device_initialize() to take refcounts for them and put_device() to properly free the related stuff.
While looking at it, there's another potential issue for those which should be *registered* into driver core. If device_register() failed, we put device once and freed bcma_device structures. In bcma_unregister_cores(), they're treated as unregistered and we hit both UAF and double-free. That smells not good and has also been fixed now.
--- drivers/bcma/main.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/bcma/main.c +3 -3
@@ -236,6 +236,7 @@ EXPORT_SYMBOL(bcma_core_irq);void bcma_prepare_core (struct bcma_bus *bus,struct bcma_device *core) { +device_initialize (&core->dev); core->dev.release = bcma_release_core_dev; core->dev.bus = &bcma_bus_type;dev_set_name (&core->dev,"bcma%d:%d" , bus->num, core->core_index);
@@ -299,11 +300,10 @@ static void bcma_register_core(struct bcma_bus *bus, struct bcma_device *core) {int err; - err =device_register (&core->dev); + err =device_add (&core->dev);if (err) {bcma_err (bus,"Could not register dev for core 0x%03X\n" , core->id.id); -put_device (&core->dev);return ; } core->dev_registered = true;
@@ -394,7 +394,7 @@ void bcma_unregister_cores(struct bcma_bus *bus)/* Now noone uses internally-handled cores, we can free them */ list_for_each_entry_safe (core, tmp, &bus->cores, list) {list_del (&core->list); -kfree (core); +put_device (&core->dev); } }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 101/293 ipv4: make exception cache less predictible
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 67d6d681e15b578c1725bad8ad079e05d1c48a8e ]
Even after commit 6457378fe796 ("ipv4: use siphash instead of Jenkins in fnhe_hashfun()"), an attacker can still use brute force to learn some secrets from a victim linux host.
One way to defeat these attacks is to make the max depth of the hash table bucket a random value.
Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack.
After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets.
This is slightly increasing memory size used by the hash table, by 50% in average, we do not expect this to be a problem.
This patch is more complex than the prior one (IPv6 equivalent), because IPv4 was reusing the oldest entry.
Since we need to be able to evict more than one entry per update_or_create_fnhe() call, I had to replace fnhe_oldest() with fnhe_remove_oldest().
Also note that we will queue extra kfree_rcu() calls under stress, which hopefully wont be a too big issue.
--- net/ipv4/route.c | 46 ++++++++++++++++++++++++++++++---------------- 1 file changed, 30 insertions(+), 16 deletions(-)
net/ipv4/route.c +30 -16
@@ -604,18 +604,25 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe) } } -static struct fib_nh_exception *fnhe_oldest (struct fnhe_hash_bucket *hash) +static void fnhe_remove_oldest (struct fnhe_hash_bucket *hash) { -struct fib_nh_exception *fnhe, *oldest; +struct fib_nh_exception __rcu **fnhe_p, **oldest_p; +struct fib_nh_exception *fnhe, *oldest =NULL ; - oldest =rcu_dereference (hash->chain); -for (fnhe =rcu_dereference (oldest->fnhe_next); fnhe; - fnhe =rcu_dereference (fnhe->fnhe_next)) { -if (time_before (fnhe->fnhe_stamp, oldest->fnhe_stamp)) +for (fnhe_p = &hash->chain; ; fnhe_p = &fnhe->fnhe_next) { + fnhe =rcu_dereference_protected (*fnhe_p, +lockdep_is_held (&fnhe_lock)); +if (!fnhe) +break ; +if (!oldest || +time_before (fnhe->fnhe_stamp, oldest->fnhe_stamp)) { oldest = fnhe; + oldest_p = fnhe_p; + } }fnhe_flush_routes (oldest); -return oldest; + *oldest_p = oldest->fnhe_next; +kfree_rcu (oldest, rcu); }static inline u32 fnhe_hashfun (__be32 daddr)
@@ -692,16 +699,21 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw,if (rt)fill_route_from_fnhe (rt, fnhe); }else { -if (depth >FNHE_RECLAIM_DEPTH ) - fnhe =fnhe_oldest (hash); -else { - fnhe =kzalloc (sizeof (*fnhe),GFP_ATOMIC ); -if (!fnhe) - goto out_unlock; - - fnhe->fnhe_next = hash->chain; -rcu_assign_pointer (hash->chain, fnhe); +/* Randomize max depth to avoid some side channels attacks. */ +int max_depth =FNHE_RECLAIM_DEPTH + +prandom_u32_max (FNHE_RECLAIM_DEPTH ); + +while (depth > max_depth) { +fnhe_remove_oldest (hash); + depth--; } + + fnhe =kzalloc (sizeof (*fnhe),GFP_ATOMIC ); +if (!fnhe) + goto out_unlock; + + fnhe->fnhe_next = hash->chain; + fnhe->fnhe_genid = genid; fnhe->fnhe_daddr = daddr; fnhe->fnhe_gw = gw;
@@ -709,6 +721,8 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, fnhe->fnhe_mtu_locked = lock; fnhe->fnhe_expires =max (1UL , expires); +rcu_assign_pointer (hash->chain, fnhe); +/* Exception created; mark the cached routes for the nexthop * stale, so anyone caching it rechecks if this exception * applies to them.
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 102/293 net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed
In reply to Greg Kroah-HartmanFrom: Xiyu Yang <[email protected]>
[ Upstream commit c66070125837900163b81a03063ddd657a7e9bfb ]
The reference counting issue happens in one exception handling path of cbq_change_class(). When failing to get tcf_block, the function forgets to decrease the refcount of "rtab" increased by qdisc_put_rtab(), causing a refcount leak.
Fix this issue by jumping to "failure" label when get tcf_block failed.
--- net/sched/sch_cbq.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/sch_cbq.c +1 -1
@@ -1616,7 +1616,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t err =tcf_block_get (&cl->block, &cl->filter_list, sch, extack);if (err) {kfree (cl); -return err; + goto failure; }if (tca[TCA_RATE ]) {
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 103/293 net: qualcomm: fix QCA7000 checksum handling
In reply to Greg Kroah-HartmanFrom: Stefan Wahren <[email protected]>
[ Upstream commit 429205da6c834447a57279af128bdd56ccd5225e ]
Based on tests the QCA7000 doesn't support checksum offloading. So assume ip_summed is CHECKSUM_NONE and let the kernel take care of the checksum handling. This fixes data transfer issues in noisy environments.
--- drivers/net/ethernet/qualcomm/qca_spi.c | 2 +- drivers/net/ethernet/qualcomm/qca_uart.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/qualcomm/qca_spi.c +1 -1
@@ -413,7 +413,7 @@ qcaspi_receive(struct qcaspi *qca)skb_put (qca->rx_skb, retcode); qca->rx_skb->protocol =eth_type_trans ( qca->rx_skb, qca->rx_skb->dev); - qca->rx_skb->ip_summed =CHECKSUM_UNNECESSARY ; +skb_checksum_none_assert (qca->rx_skb);netif_rx_ni (qca->rx_skb); qca->rx_skb =netdev_alloc_skb_ip_align (net_dev, net_dev->mtu +VLAN_ETH_HLEN );
drivers/net/ethernet/qualcomm/qca_uart.c +1 -1
@@ -107,7 +107,7 @@ qca_tty_receive(struct serdev_device *serdev, const unsigned char *data,skb_put (qca->rx_skb, retcode); qca->rx_skb->protocol =eth_type_trans ( qca->rx_skb, qca->rx_skb->dev); - qca->rx_skb->ip_summed =CHECKSUM_UNNECESSARY ; +skb_checksum_none_assert (qca->rx_skb);netif_rx_ni (qca->rx_skb); qca->rx_skb = netdev_alloc_skb_ip_align(netdev, netdev->mtu +
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 104/293 ipv4: fix endianness issue in inet_rtm_getroute_build_skb()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 92548b0ee220e000d81c27ac9a80e0ede895a881 ]
The UDP length field should be in network order.
This removes the following sparse error:
net/ipv4/route.c:3173:27: warning: incorrect type in assignment (different base types)net/ipv4/route.c:3173:27: expected restricted __be16 [usertype] lennet/ipv4/route.c:3173:27: got unsigned long
--- net/ipv4/route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/route.c +1 -1
@@ -2815,7 +2815,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst, udph =skb_put_zero (skb,sizeof (struct udphdr )); udph->source = sport; udph->dest = dport; - udph->len =sizeof (struct udphdr ); + udph->len =htons (sizeof (struct udphdr )); udph->check =0 ;break ; }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 105/293 netns: protect netns ID lookups with RCU
In reply to Greg Kroah-HartmanFrom: Guillaume Nault <[email protected]>
commit 2dce224f469f060b9998a5a869151ef83c08ce77 upstream.
__peernet2id() can be protected by RCU as it only calls idr_for_each(), which is RCU-safe, and never modifies the nsid table.
rtnl_net_dumpid() can also do lockless lookups. It does two nested idr_for_each() calls on nsid tables (one direct call and one indirect call because of rtnl_net_dumpid_one() calling __peernet2id()). The netnsid tables are never updated. Therefore it is safe to not take the nsid_lock and run within an RCU-critical section instead.
--- net/core/net_namespace.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-)
net/core/net_namespace.c +10 -8
@@ -192,9 +192,9 @@ static int net_eq_idr(int id, void *net,return 0 ; } -/* Should be called with nsid_lock held. If a new id is assigned, the bool alloc -* is set to true, thus the caller knows that the new id must be notified via -* rtnl. +/* Must be called from RCU-critical section or with nsid_lock held. If +* a new id is assigned, the bool alloc is set to true, thus the +* caller knows that the new id must be notified via rtnl. */ static int __peernet2id_alloc (struct net *net,struct net *peer,bool *alloc) {
@@ -218,7 +218,7 @@ static int __peernet2id_alloc(struct netreturn NETNSA_NSID_NOT_ASSIGNED ; } -/* should be called with nsid_lock held */ +/* Must be called from RCU-critical section or with nsid_lock held */ static int __peernet2id (struct net *net,struct net *peer) {bool no = false;
@@ -261,9 +261,10 @@ int peernet2id(struct net *net, struct n {int id; -spin_lock_bh (&net->nsid_lock); +rcu_read_lock (); id =__peernet2id (net, peer); -spin_unlock_bh (&net->nsid_lock); +rcu_read_unlock (); +return id; }EXPORT_SYMBOL (peernet2id);
@@ -837,6 +838,7 @@ struct rtnl_net_dump_cb {int s_idx; }; +/* Runs in RCU-critical section. */ static int rtnl_net_dumpid_one (int id,void *peer,void *data) {struct rtnl_net_dump_cb *net_cb = (struct rtnl_net_dump_cb *)data;
@@ -867,9 +869,9 @@ static int rtnl_net_dumpid(struct sk_buf .s_idx = cb->args[0], }; -spin_lock_bh (&net->nsid_lock); +rcu_read_lock ();idr_for_each (&net->netns_ids, rtnl_net_dumpid_one, &net_cb); -spin_unlock_bh (&net->nsid_lock); +rcu_read_unlock (); cb->args[0 ] = net_cb.idx;return skb->len;
Greg Kroah-Hartman
maintainerPATCH 106/293 fscrypt: add fscrypt_symlink_getattr() for computing st_size
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit d18760560593e5af921f51a8c9b64b6109d634c2 upstream.
Add a helper function fscrypt_symlink_getattr() which will be called from the various filesystems' ->getattr() methods to read and decrypt the target of encrypted symlinks in order to report the correct st_size.
Detailed explanation:
As required by POSIX and as documented in various man pages, st_size for a symlink is supposed to be the length of the symlink target. Unfortunately, st_size has always been wrong for encrypted symlinks because st_size is populated from i_size from disk, which intentionally contains the length of the encrypted symlink target. That's slightly greater than the length of the decrypted symlink target (which is the symlink target that userspace usually sees), and usually won't match the length of the no-key encoded symlink target either.
This hadn't been fixed yet because reporting the correct st_size would require reading the symlink target from disk and decrypting or encoding it, which historically has been considered too heavyweight to do in ->getattr(). Also historically, the wrong st_size had only broken a test (LTP lstat03) and there were no known complaints from real users. (This is probably because the st_size of symlinks isn't used too often, and when it is, typically it's for a hint for what buffer size to pass to readlink() -- which a slightly-too-large size still works for.)
However, a couple things have changed now. First, there have recently been complaints about the current behavior from real users:
- Breakage in rpmbuild:
https://github.com/rpm-software-management/rpm/issues/1682
https://github.com/google/fscrypt/issues/305
- Breakage in toybox cpio:
https://www.mail-archive.com/[email protected]/msg07193.html
- Breakage in libgit2: https://issuetracker.google.com/issues/189629152
(on Android public issue tracker, requires login)
Second, we now cache decrypted symlink targets in ->i_link. Therefore, taking the performance hit of reading and decrypting the symlink target in ->getattr() wouldn't be as big a deal as it used to be, since usually it will just save having to do the same thing later.
Also note that eCryptfs ended up having to read and decrypt symlink targets in ->getattr() as well, to fix this same issue; see commit 3a60a1686f0d ("eCryptfs: Decrypt symlink target for stat size").
So, let's just bite the bullet, and read and decrypt the symlink target in ->getattr() in order to report the correct st_size. Add a function fscrypt_symlink_getattr() which the filesystems will call to do this.
(Alternatively, we could store the decrypted size of symlinks on-disk. But there isn't a great place to do so, and encryption is meant to hide the original size to some extent; that property would be lost.)
--- fs/crypto/hooks.c | 44 ++++++++++++++++++++++++++++++++++++++++ include/linux/fscrypt_notsupp.h | 6 +++++ include/linux/fscrypt_supp.h | 1 3 files changed, 51 insertions(+)
fs/crypto/hooks.c +44 -0
@@ -279,3 +279,47 @@ err_kfree:return ERR_PTR (err); }EXPORT_SYMBOL_GPL (fscrypt_get_symlink); + +/** +* fscrypt_symlink_getattr() - set the correct st_size for encrypted symlinks +* @path: the path for the encrypted symlink being queried +* @stat: the struct being filled with the symlink's attributes +* +* Override st_size of encrypted symlinks to be the length of the decrypted +* symlink target (or the no-key encoded symlink target, if the key is +* unavailable) rather than the length of the encrypted symlink target. This is +* necessary for st_size to match the symlink target that userspace actually +* sees. POSIX requires this, and some userspace programs depend on it. +* +* This requires reading the symlink target from disk if needed, setting up the +* inode's encryption key if possible, and then decrypting or encoding the +* symlink target. This makes lstat() more heavyweight than is normally the +* case. However, decrypted symlink targets will be cached in ->i_link, so +* usually the symlink won't have to be read and decrypted again later if/when +* it is actually followed, readlink() is called, or lstat() is called again. +* +* Return: 0 on success, -errno on failure +*/ +int fscrypt_symlink_getattr (const struct path *path,struct kstat *stat) +{ +struct dentry *dentry = path->dentry; +struct inode *inode =d_inode (dentry); +const char *link; +DEFINE_DELAYED_CALL (done); + +/* +* To get the symlink target that userspace will see (whether it's the +* decrypted target or the no-key encoded target), we can just get it in +* the same way the VFS does during path resolution and readlink(). +*/ + link =READ_ONCE (inode->i_link); +if (!link) { + link = inode->i_op->get_link (dentry, inode, &done); +if (IS_ERR (link)) +return PTR_ERR (link); + } + stat->size =strlen (link); +do_delayed_call (&done); +return 0 ; +} +EXPORT_SYMBOL_GPL (fscrypt_symlink_getattr);
include/linux/fscrypt_notsupp.h +6 -0
@@ -234,4 +234,10 @@ static inline const char *fscrypt_get_sy return ERR_PTR(-EOPNOTSUPP); } +static inline int fscrypt_symlink_getattr (const struct path *path, +struct kstat *stat) +{ +return -EOPNOTSUPP ; +} +#endif /* _LINUX_FSCRYPT_NOTSUPP_H */
include/linux/fscrypt_supp.h +1 -0
@@ -231,5 +231,6 @@ extern int __fscrypt_encrypt_symlink(strextern const char *fscrypt_get_symlink (struct inode *inode,const void *caddr,unsigned int max_size,struct delayed_call *done); +int fscrypt_symlink_getattr (const struct path *path,struct kstat *stat);#endif /* _LINUX_FSCRYPT_SUPP_H */
Greg Kroah-Hartman
maintainerPATCH 107/293 ext4: report correct st_size for encrypted symlinks
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 8c4bca10ceafc43b1ca0a9fab5fa27e13cbce99e upstream.
The stat() family of syscalls report the wrong size for encrypted symlinks, which has caused breakage in several userspace programs.
Fix this by calling fscrypt_symlink_getattr() after ext4_getattr() for encrypted symlinks. This function computes the correct size by reading and decrypting the symlink target (if it's not already cached).
For more details, see the commit which added fscrypt_symlink_getattr().
--- fs/ext4/symlink.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/ext4/symlink.c +10 -1
@@ -52,10 +52,19 @@ static const char *ext4_encrypted_get_lireturn paddr; } +static int ext4_encrypted_symlink_getattr (const struct path *path, +struct kstat *stat,u32 request_mask, +unsigned int query_flags) +{ +ext4_getattr (path, stat, request_mask, query_flags); + +return fscrypt_symlink_getattr (path, stat); +} +const struct inode_operations ext4_encrypted_symlink_inode_operations = { .get_link = ext4_encrypted_get_link, .setattr = ext4_setattr, - .getattr = ext4_getattr, + .getattr = ext4_encrypted_symlink_getattr, .listxattr = ext4_listxattr, };
Greg Kroah-Hartman
maintainerPATCH 108/293 f2fs: report correct st_size for encrypted symlinks
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 461b43a8f92e68e96c4424b31e15f2b35f1bbfa9 upstream.
The stat() family of syscalls report the wrong size for encrypted symlinks, which has caused breakage in several userspace programs.
Fix this by calling fscrypt_symlink_getattr() after f2fs_getattr() for encrypted symlinks. This function computes the correct size by reading and decrypting the symlink target (if it's not already cached).
For more details, see the commit which added fscrypt_symlink_getattr().
--- fs/f2fs/namei.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
fs/f2fs/namei.c +10 -1
@@ -1219,9 +1219,18 @@ static const char *f2fs_encrypted_get_lireturn target; } +static int f2fs_encrypted_symlink_getattr (const struct path *path, +struct kstat *stat,u32 request_mask, +unsigned int query_flags) +{ +f2fs_getattr (path, stat, request_mask, query_flags); + +return fscrypt_symlink_getattr (path, stat); +} +const struct inode_operations f2fs_encrypted_symlink_inode_operations = { .get_link = f2fs_encrypted_get_link, - .getattr = f2fs_getattr, + .getattr = f2fs_encrypted_symlink_getattr, .setattr = f2fs_setattr, #ifdef CONFIG_F2FS_FS_XATTR .listxattr = f2fs_listxattr,
Greg Kroah-Hartman
maintainerPATCH 109/293 ubifs: report correct st_size for encrypted symlinks
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 064c734986011390b4d111f1a99372b7f26c3850 upstream.
The stat() family of syscalls report the wrong size for encrypted symlinks, which has caused breakage in several userspace programs.
Fix this by calling fscrypt_symlink_getattr() after ubifs_getattr() for encrypted symlinks. This function computes the correct size by reading and decrypting the symlink target (if it's not already cached).
For more details, see the commit which added fscrypt_symlink_getattr().
--- fs/ubifs/file.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
fs/ubifs/file.c +11 -1
@@ -1642,6 +1642,16 @@ static const char *ubifs_get_link(structreturn fscrypt_get_symlink (inode, ui->data, ui->data_len, done); } +static int ubifs_symlink_getattr (const struct path *path,struct kstat *stat, +u32 request_mask,unsigned int query_flags) +{ +ubifs_getattr (path, stat, request_mask, query_flags); + +if (IS_ENCRYPTED (d_inode (path->dentry))) +return fscrypt_symlink_getattr (path, stat); +return 0 ; +} +const struct address_space_operations ubifs_file_address_operations = { .readpage = ubifs_readpage, .writepage = ubifs_writepage,
@@ -1669,7 +1679,7 @@ const struct inode_operations ubifs_fileconst struct inode_operations ubifs_symlink_inode_operations = { .get_link = ubifs_get_link, .setattr = ubifs_setattr, - .getattr = ubifs_getattr, + .getattr = ubifs_symlink_getattr, #ifdef CONFIG_UBIFS_FS_XATTR .listxattr = ubifs_listxattr, #endif
Greg Kroah-Hartman
maintainerPATCH 110/293 tty: Fix data race between tiocsti() and flush_to_ldisc()
In reply to Greg Kroah-HartmanFrom: Nguyen Dinh Phi <[email protected]>
commit bb2853a6a421a052268eee00fd5d3f6b3504b2b1 upstream.
The ops->receive_buf() may be accessed concurrently from these two functions. If the driver flushes data to the line discipline receive_buf() method while tiocsti() is waiting for the ops->receive_buf() to finish its work, the data race will happen.
For example:tty_ioctl |tty_ldisc_receive_buf
->tioctsi | ->tty_port_default_receive_buf
| ->tty_ldisc_receive_buf
->hci_uart_tty_receive | ->hci_uart_tty_receive
->h4_recv | ->h4_recvIn this case, the h4 receive buffer will be overwritten by the latecomer, and we will lost the data.
Hence, change tioctsi() function to use the exclusive lock interface from tty_buffer to avoid the data race.
--- drivers/tty/tty_io.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/tty_io.c +2 -2
@@ -2173,8 +2173,6 @@ static int tty_fasync(int fd, struct fil* Locking: * Called functions take tty_ldiscs_lock * current->signal->tty check is safe without locks -* -* FIXME: may race normal receive processing */ static int tiocsti (struct tty_struct *tty,char __user *p)
@@ -2190,8 +2188,10 @@ static int tiocsti(struct tty_struct *tt ld =tty_ldisc_ref_wait (tty);if (!ld)return -EIO ; +tty_buffer_lock_exclusive (tty->port);if (ld->ops->receive_buf) ld->ops->receive_buf (tty, &ch, &mbz,1 ); +tty_buffer_unlock_exclusive (tty->port);tty_ldisc_deref (ld);return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 111/293 x86/resctrl: Fix a maybe-uninitialized build warning treated as error
In reply to Greg Kroah-HartmanFrom: Babu Moger <[email protected]>
commit 527f721478bce3f49b513a733bacd19d6f34b08c upstream.
The recent commit
064855a69003 ("x86/resctrl: Fix default monitoring groups reporting")
caused a RHEL build failure with an uninitialized variable warning treated as an error because it removed the default case snippet.
The RHEL Makefile uses '-Werror=maybe-uninitialized' to force possibly uninitialized variable warnings to be treated as errors. This is also reported by smatch via the 0day robot.
The error from the RHEL build is:
arch/x86/kernel/cpu/resctrl/monitor.c: In function ‘__mon_event_count’:
arch/x86/kernel/cpu/resctrl/monitor.c:261:12: error: ‘m’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
m->chunks += chunks;
^~The upstream Makefile does not build using '-Werror=maybe-uninitialized'. So, the problem is not seen there. Fix the problem by putting back the default case snippet.
[ bp: note that there's nothing wrong with the code and other compilers
do not trigger this warning - this is being done just so the RHEL compiler is happy. ]
--- arch/x86/kernel/cpu/intel_rdt_monitor.c | 6 ++++++ 1 file changed, 6 insertions(+)
arch/x86/kernel/cpu/intel_rdt_monitor.c +6 -0
@@ -252,6 +252,12 @@ static u64 __mon_event_count(u32 rmid, scase QOS_L3_MBM_LOCAL_EVENT_ID : m = &rr->d->mbm_local[rmid];break ; +default : +/* +* Code would never reach here because an invalid +* event id would fail the __rmid_read. +*/ +return RMID_VAL_ERROR ; }if (rr->first) {
Greg Kroah-Hartman
maintainerPATCH 112/293 KVM: x86: Update vCPUs hv_clock before back to guest when tsc_offset is adjusted
In reply to Greg Kroah-HartmanFrom: Zelin Deng <[email protected]>
commit d9130a2dfdd4b21736c91b818f87dbc0ccd1e757 upstream.
When MSR_IA32_TSC_ADJUST is written by guest due to TSC ADJUST feature especially there's a big tsc warp (like a new vCPU is hot-added into VM which has been up for a long time), tsc_offset is added by a large value then go back to guest. This causes system time jump as tsc_timestamp is not adjusted in the meantime and pvclock monotonic character. To fix this, just notify kvm to update vCPU's guest time before back to guest.
Message-Id: <[email protected]>
--- arch/x86/kvm/x86.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/x86.c +4 -0
@@ -2511,6 +2511,10 @@ int kvm_set_msr_common(struct kvm_vcpu *if (!msr_info->host_initiated) {s64 adj = data - vcpu->arch.ia32_tsc_adjust_msr;adjust_tsc_offset_guest (vcpu, adj); +/* Before back to guest, tsc_timestamp must be adjusted +* as well, otherwise guest's percpu pvclock time could jump. +*/ +kvm_make_request (KVM_REQ_CLOCK_UPDATE , vcpu); } vcpu->arch.ia32_tsc_adjust_msr = data; }
Greg Kroah-Hartman
maintainerPATCH 113/293 IMA: remove -Wmissing-prototypes warning
In reply to Greg Kroah-HartmanFrom: Austin Kim <[email protected]>
commit a32ad90426a9c8eb3915eed26e08ce133bd9e0da upstream.
With W=1 build, the compiler throws warning message as below:
security/integrity/ima/ima_mok.c:24:12: warning:
no previous prototype for ‘ima_mok_init’ [-Wmissing-prototypes]
__init int ima_mok_init(void)
Silence the warning by adding static keyword to ima_mok_init().
--- security/integrity/ima/ima_mok.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/ima_mok.c +1 -1
@@ -26,7 +26,7 @@ struct key *ima_blacklist_keyring;/* * Allocate the IMA blacklist keyring */ -__init int ima_mok_init (void ) +static __init int ima_mok_init (void ) {struct key_restriction *restriction;
Greg Kroah-Hartman
maintainerPATCH 114/293 IMA: remove the dependency on CRYPTO_MD5
In reply to Greg Kroah-HartmanFrom: THOBY Simon <[email protected]>
commit 8510505d55e194d3f6c9644c9f9d12c4f6b0395a upstream.
MD5 is a weak digest algorithm that shouldn't be used for cryptographic operation. It hinders the efficiency of a patch set that aims to limit the digests allowed for the extended file attribute namely security.ima. MD5 is no longer a requirement for IMA, nor should it be used there.
The sole place where we still use the MD5 algorithm inside IMA is setting the ima_hash algorithm to MD5, if the user supplies 'ima_hash=md5' parameter on the command line. With commit ab60368ab6a4 ("ima: Fallback to the builtin hash algorithm"), setting "ima_hash=md5" fails gracefully when CRYPTO_MD5 is not set:
ima: Can not allocate md5 (reason: -2)
ima: Allocating md5 failed, going to use default hash algorithm sha256
Remove the CRYPTO_MD5 dependency for IMA.
[[email protected]: include commit number in patch description for stable.]
--- security/integrity/ima/Kconfig | 1 - 1 file changed, 1 deletion(-)
security/integrity/ima/Kconfig +0 -1
@@ -5,7 +5,6 @@ config IMA select SECURITYFS select CRYPTO select CRYPTO_HMAC - select CRYPTO_MD5 select CRYPTO_SHA1 select CRYPTO_HASH_INFO select TCG_TPM if HAS_IOMEM && !UML
Greg Kroah-Hartman
maintainerPATCH 115/293 fbmem: dont allow too huge resolutions
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
commit 8c28051cdcbe9dfcec6bd0a4709d67a09df6edae upstream.
syzbot is reporting page fault at vga16fb_fillrect() [1], for vga16fb_check_var() is failing to detect multiplication overflow.
if (vxres * vyres > maxmem) {
vyres = maxmem / vxres;
if (vyres < yres)
return -ENOMEM;
}Since no module would accept too huge resolutions where multiplication overflow happens, let's reject in the common path.
--- drivers/video/fbdev/core/fbmem.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/video/fbdev/core/fbmem.c +6 -0
@@ -971,6 +971,7 @@ fb_set_var(struct fb_info *info, structif ((var->activate &FB_ACTIVATE_FORCE ) ||memcmp (&info->var, var,sizeof (struct fb_var_screeninfo ))) {u32 activate = var->activate; +u32 unused;/* When using FOURCC mode, make sure the red, green, blue and * transp fields are set to 0.
@@ -995,6 +996,11 @@ fb_set_var(struct fb_info *info, structif (var->xres <8 || var->yres <8 )return -EINVAL ; +/* Too huge resolution causes multiplication overflow. */ +if (check_mul_overflow (var->xres, var->yres, &unused) || +check_mul_overflow (var->xres_virtual, var->yres_virtual, &unused)) +return -EINVAL ; + ret = info->fbops->fb_check_var (var, info);if (ret)
Greg Kroah-Hartman
maintainerPATCH 116/293 backlight: pwm_bl: Improve bootloader/kernel device handover
In reply to Greg Kroah-HartmanFrom: Daniel Thompson <[email protected]>
commit 79fad92f2e596f5a8dd085788a24f540263ef887 upstream.
Currently there are (at least) two problems in the way pwm_bl starts managing the enable_gpio pin. Both occur when the backlight is initially off and the driver finds the pin not already in output mode and, as a result, unconditionally switches it to output-mode and asserts the signal.
Problem 1: This could cause the backlight to flicker since, at this stage in driver initialisation, we have no idea what the PWM and regulator are doing (an unconfigured PWM could easily "rest" at 100% duty cycle).
Problem 2: This will cause us not to correctly honour the post_pwm_on_delay (which also risks flickers).
Fix this by moving the code to configure the GPIO output mode until after we have examines the handover state. That allows us to initialize enable_gpio to off if the backlight is currently off and on if the backlight is on.
--- drivers/video/backlight/pwm_bl.c | 54 ++++++++++++++++++++------------------- 1 file changed, 28 insertions(+), 26 deletions(-)
drivers/video/backlight/pwm_bl.c +28 -26
@@ -400,6 +400,33 @@ int pwm_backlight_brightness_default(strstatic int pwm_backlight_initial_power_state (const struct pwm_bl_data *pb) {struct device_node *node = pb->dev->of_node; +bool active = true; + +/* +* If the enable GPIO is present, observable (either as input +* or output) and off then the backlight is not currently active. +* */ +if (pb->enable_gpio &&gpiod_get_value_cansleep (pb->enable_gpio) ==0 ) + active = false; + +if (!regulator_is_enabled (pb->power_supply)) + active = false; + +if (!pwm_is_enabled (pb->pwm)) + active = false; + +/* +* Synchronize the enable_gpio with the observed state of the +* hardware. +*/ +if (pb->enable_gpio) +gpiod_direction_output (pb->enable_gpio, active); + +/* +* Do not change pb->enabled here! pb->enabled essentially +* tells us if we own one of the regulator's use counts and +* right now we do not. +*/ /* Not booted with device tree or no phandle link to the node */ if (!node || !node->phandle)
@@ -411,20 +438,7 @@ static int pwm_backlight_initial_power_s* assume that another driver will enable the backlight at the * appropriate time. Therefore, if it is disabled, keep it so. */ - -/* if the enable GPIO is disabled, do not enable the backlight */ -if (pb->enable_gpio &&gpiod_get_value_cansleep (pb->enable_gpio) ==0 ) -return FB_BLANK_POWERDOWN ; - -/* The regulator is disabled, do not enable the backlight */ -if (!regulator_is_enabled (pb->power_supply)) -return FB_BLANK_POWERDOWN ; - -/* The PWM is disabled, keep it like this */ -if (!pwm_is_enabled (pb->pwm)) -return FB_BLANK_POWERDOWN ; - -return FB_BLANK_UNBLANK ; +return active ?FB_BLANK_UNBLANK :FB_BLANK_POWERDOWN ; }static int pwm_backlight_probe (struct platform_device *pdev)
@@ -494,18 +508,6 @@ static int pwm_backlight_probe(struct pl pb->enable_gpio =gpio_to_desc (data->enable_gpio); } -/* -* If the GPIO is not known to be already configured as output, that -* is, if gpiod_get_direction returns either 1 or -EINVAL, change the -* direction to output and set the GPIO as active. -* Do not force the GPIO to active when it was already output as it -* could cause backlight flickering or we would enable the backlight too -* early. Leave the decision of the initial backlight state for later. -*/ -if (pb->enable_gpio && -gpiod_get_direction (pb->enable_gpio) !=0 ) -gpiod_direction_output (pb->enable_gpio,1 ); - pb->power_supply =devm_regulator_get (&pdev->dev,"power" );if (IS_ERR (pb->power_supply)) { ret =PTR_ERR (pb->power_supply);
Greg Kroah-Hartman
maintainerPATCH 117/293 clk: kirkwood: Fix a clocking boot regression
In reply to Greg Kroah-HartmanFrom: Linus Walleij <[email protected]>
commit aaedb9e00e5400220a8871180d23a83e67f29f63 upstream.
Since a few kernel releases the Pogoplug 4 has crashed like this during boot:
Unable to handle kernel NULL pointer dereference at virtual address 00000002
(...)
[<c04116ec>] (strlen) from [<c00ead80>] (kstrdup+0x1c/0x4c)
[<c00ead80>] (kstrdup) from [<c04591d8>] (__clk_register+0x44/0x37c)
[<c04591d8>] (__clk_register) from [<c04595ec>] (clk_hw_register+0x20/0x44)
[<c04595ec>] (clk_hw_register) from [<c045bfa8>] (__clk_hw_register_mux+0x198/0x1e4) [<c045bfa8>] (__clk_hw_register_mux) from [<c045c050>] (clk_register_mux_table+0x5c/0x6c) [<c045c050>] (clk_register_mux_table) from [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0+0x13c/0x1ac) [<c0acf3e0>] (kirkwood_clk_muxing_setup.constprop.0) from [<c0aceae0>] (of_clk_init+0x12c/0x214) [<c0aceae0>] (of_clk_init) from [<c0ab576c>] (time_init+0x20/0x2c)
[<c0ab576c>] (time_init) from [<c0ab3d18>] (start_kernel+0x3dc/0x56c)
[<c0ab3d18>] (start_kernel) from [<00000000>] (0x0)
Code: e3130020 1afffffb e12fff1e c08a1078 (e5d03000)
This is because the "powersave" mux clock 0 was provided in an unterminated array, which is required by the loop in the driver:
/* Count, allocate, and register clock muxes */
for (n = 0; desc[n].name;)
n++;Here n will go out of bounds and then call clk_register_mux() on random memory contents after the mux clock.
Fix this by terminating the array with a blank entry.
--- drivers/clk/mvebu/kirkwood.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/mvebu/kirkwood.c +1 -0
@@ -254,6 +254,7 @@ static const char *powersave_parents[] =static const struct clk_muxing_soc_desc kirkwood_mux_desc[]__initconst = { {"powersave" , powersave_parents,ARRAY_SIZE (powersave_parents),11 ,1 ,0 }, + { } }; static struct clk *clk_muxing_get_src(
Greg Kroah-Hartman
maintainerPATCH 118/293 rtc: tps65910: Correct driver module alias
In reply to Greg Kroah-HartmanFrom: Dmitry Osipenko <[email protected]>
commit 8d448fa0a8bb1c8d94eef7647edffe9ac81a281e upstream.
The TPS65910 RTC driver module doesn't auto-load because of the wrong module alias that doesn't match the device name, fix it.
--- drivers/rtc/rtc-tps65910.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/rtc/rtc-tps65910.c +1 -1
@@ -470,6 +470,6 @@ static struct platform_driver tps65910_r };module_platform_driver (tps65910_rtc_driver); -MODULE_ALIAS ("platform:rtc-tps65910" ); +MODULE_ALIAS ("platform:tps65910-rtc" );MODULE_AUTHOR ("Venu Byravarasu <[email protected]>" );MODULE_LICENSE ("GPL" );
Greg Kroah-Hartman
maintainerPATCH 119/293 btrfs: reset replace target device to allocation state on close
In reply to Greg Kroah-HartmanFrom: Desmond Cheong Zhi Xi <[email protected]>
commit 0d977e0eba234e01a60bdde27314dc21374201b3 upstream.
This crash was observed with a failed assertion on device close:
BTRFS: Transaction aborted (error -28)
WARNING: CPU: 1 PID: 3902 at fs/btrfs/extent-tree.c:2150 btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] Modules linked in: btrfs blake2b_generic libcrc32c crc32c_intel xor zstd_decompress zstd_compress xxhash lzo_compress lzo_decompress raid6_pq loop CPU: 1 PID: 3902 Comm: kworker/u8:4 Not tainted 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 Workqueue: events_unbound btrfs_async_reclaim_metadata_space [btrfs] RIP: 0010:btrfs_run_delayed_refs+0x1d2/0x1e0 [btrfs] RSP: 0018:ffffb7a5452d7d80 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000001 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff97834176a378 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff97835195d388 R13: 0000000005b08000 R14: ffff978385484000 R15: 000000000000016c FS: 0000000000000000(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190d003fe8 CR3: 000000002a81e005 CR4: 0000000000170ea0 Call Trace: flush_space+0x197/0x2f0 [btrfs] btrfs_async_reclaim_metadata_space+0x139/0x300 [btrfs] process_one_work+0x262/0x5e0 worker_thread+0x4c/0x320 ? process_one_work+0x5e0/0x5e0 kthread+0x144/0x170 ? set_kthread_struct+0x40/0x40 ret_from_fork+0x1f/0x30 irq event stamp: 19334989 hardirqs last enabled at (19334997): [<ffffffffab0e0c87>] console_unlock+0x2b7/0x400 hardirqs last disabled at (19335006): [<ffffffffab0e0d0d>] console_unlock+0x33d/0x400 softirqs last enabled at (19334900): [<ffffffffaba0030d>] __do_softirq+0x30d/0x574 softirqs last disabled at (19334893): [<ffffffffab0721ec>] irq_exit_rcu+0x12c/0x140 ---[ end trace 45939e308e0dd3c7 ]--- BTRFS: error (device vdd) in btrfs_run_delayed_refs:2150: errno=-28 No space left BTRFS info (device vdd): forced readonly BTRFS warning (device vdd): failed setting block group ro: -30 BTRFS info (device vdd): suspending dev_replace for unmount assertion failed: !test_bit(BTRFS_DEV_STATE_REPLACE_TGT, &device->dev_state), in fs/btrfs/volumes.c:1150 ------------[ cut here ]------------ kernel BUG at fs/btrfs/ctree.h:3431! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 3982 Comm: umount Tainted: G W 5.14.0-rc5-default+ #1532 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba527-rebuilt.opensuse.org 04/01/2014 RIP: 0010:assertfail.constprop.0+0x18/0x1a [btrfs] RSP: 0018:ffffb7a5454c7db8 EFLAGS: 00010246 RAX: 0000000000000068 RBX: ffff978364b91c00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffffabee13c4 RDI: 00000000ffffffff RBP: ffff9783523a4c00 R08: 0000000000000001 R09: 0000000000000001 R10: 0000000000000000 R11: 0000000000000001 R12: ffff9783523a4d18 R13: 0000000000000000 R14: 0000000000000004 R15: 0000000000000003 FS: 00007f61c8f42800(0000) GS:ffff9783bd800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056190cffa810 CR3: 0000000030b96002 CR4: 0000000000170ea0 Call Trace: btrfs_close_one_device.cold+0x11/0x55 [btrfs] close_fs_devices+0x44/0xb0 [btrfs] btrfs_close_devices+0x48/0x160 [btrfs] generic_shutdown_super+0x69/0x100 kill_anon_super+0x14/0x30 btrfs_kill_super+0x12/0x20 [btrfs] deactivate_locked_super+0x2c/0xa0 cleanup_mnt+0x144/0x1b0 task_work_run+0x59/0xa0 exit_to_user_mode_loop+0xe7/0xf0 exit_to_user_mode_prepare+0xaf/0xf0 syscall_exit_to_user_mode+0x19/0x50 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae
This happens when close_ctree is called while a dev_replace hasn't completed. In close_ctree, we suspend the dev_replace, but keep the replace target around so that we can resume the dev_replace procedure when we mount the root again. This is the call trace:
close_ctree():
btrfs_dev_replace_suspend_for_unmount();
btrfs_close_devices():
btrfs_close_fs_devices():
btrfs_close_one_device():
ASSERT(!test_bit(BTRFS_DEV_STATE_REPLACE_TGT,
&device->dev_state));However, since the replace target sticks around, there is a device with BTRFS_DEV_STATE_REPLACE_TGT set on close, and we fail the assertion in btrfs_close_one_device.
To fix this, if we come across the replace target device when closing, we should properly reset it back to allocation state. This fix also ensures that if a non-target device has a corrupted state and has the BTRFS_DEV_STATE_REPLACE_TGT bit set, the assertion will still catch the error.
--- fs/btrfs/volumes.c | 3 +++ 1 file changed, 3 insertions(+)
fs/btrfs/volumes.c +3 -0
@@ -1048,6 +1048,9 @@ static void btrfs_close_one_device(struc fs_devices->rw_devices--; } +if (device->devid ==BTRFS_DEV_REPLACE_DEVID ) +clear_bit (BTRFS_DEV_STATE_REPLACE_TGT , &device->dev_state); +if (test_bit (BTRFS_DEV_STATE_MISSING , &device->dev_state)) fs_devices->missing_devices--;
Greg Kroah-Hartman
maintainerPATCH 120/293 blk-zoned: allow zone management send operations without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit ead3b768bb51259e3a5f2287ff5fc9041eb6f450 upstream.
Zone management send operations (BLKRESETZONE, BLKOPENZONE, BLKCLOSEZONE and BLKFINISHZONE) should be allowed under the same permissions as write(). (write() does not require CAP_SYS_ADMIN).
Additionally, other ioctls like BLKSECDISCARD and BLKZEROOUT only check if the fd was successfully opened with FMODE_WRITE.
(They do not require CAP_SYS_ADMIN).
Currently, zone management send operations require both CAP_SYS_ADMIN and that the fd was successfully opened with FMODE_WRITE.
Remove the CAP_SYS_ADMIN requirement, so that zone management send operations match the access control requirement of write(), BLKSECDISCARD and BLKZEROOUT.
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -380,9 +380,6 @@ int blkdev_reset_zones_ioctl(struct blocif (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (!(mode &FMODE_WRITE ))return -EBADF ;
Greg Kroah-Hartman
maintainerPATCH 121/293 blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
In reply to Greg Kroah-HartmanFrom: Niklas Cassel <[email protected]>
commit 4d643b66089591b4769bcdb6fd1bfeff2fe301b8 upstream.
A user space process should not need the CAP_SYS_ADMIN capability set in order to perform a BLKREPORTZONE ioctl.
Getting the zone report is required in order to get the write pointer. Neither read() nor write() requires CAP_SYS_ADMIN, so it is reasonable that a user space process that can read/write from/to the device, also can get the write pointer. (Since e.g. writes have to be at the write pointer.)
--- block/blk-zoned.c | 3 --- 1 file changed, 3 deletions(-)
block/blk-zoned.c +0 -3
@@ -319,9 +319,6 @@ int blkdev_report_zones_ioctl(struct bloif (!blk_queue_is_zoned (q))return -ENOTTY ; -if (!capable (CAP_SYS_ADMIN )) -return -EACCES ; -if (copy_from_user (&rep, argp,sizeof (struct blk_zone_report )))return -EFAULT ;
Greg Kroah-Hartman
maintainerPATCH 122/293 PCI/MSI: Skip masking MSI-X on Xen PV
In reply to Greg Kroah-HartmanFrom: Marek Marczykowski-Górecki <[email protected]>
commit 1a519dc7a73c977547d8b5108d98c6e769c89f4b upstream.
When running as Xen PV guest, masking MSI-X is a responsibility of the hypervisor. The guest has no write access to the relevant BAR at all - when it tries to, it results in a crash like this:
BUG: unable to handle page fault for address: ffffc9004069100c
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation
RIP: e030:__pci_enable_msix_range.part.0+0x26b/0x5f0
e1000e_set_interrupt_capability+0xbf/0xd0 [e1000e]
e1000_probe+0x41f/0xdb0 [e1000e]
local_pci_probe+0x42/0x80
(...)The recently introduced function msix_mask_all() does not check the global variable pci_msi_ignore_mask which is set by XEN PV to bypass the masking of MSI[-X] interrupts.
Add the check to make this function XEN PV compatible.
--- drivers/pci/msi.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/pci/msi.c +3 -0
@@ -754,6 +754,9 @@ static void msix_mask_all(void __iomem *u32 ctrl =PCI_MSIX_ENTRY_CTRL_MASKBIT ;int i; +if (pci_msi_ignore_mask) +return ; +for (i =0 ; i < tsize; i++, base +=PCI_MSIX_ENTRY_SIZE )writel (ctrl, base +PCI_MSIX_ENTRY_VECTOR_CTRL ); }
Greg Kroah-Hartman
maintainerPATCH 123/293 powerpc/perf/hv-gpci: Fix counter value parsing
In reply to Greg Kroah-HartmanFrom: Kajol Jain <[email protected]>
commit f9addd85fbfacf0d155e83dbee8696d6df5ed0c7 upstream.
H_GetPerformanceCounterInfo (0xF080) hcall returns the counter data in the result buffer. Result buffer has specific format defined in the PAPR specification. One of the fields is counter offset and width of the counter data returned.
Counter data are returned in a unsigned char array in big endian byte order. To get the final counter data, the values must be left shifted byte at a time. But commit 220a0c609ad17 ("powerpc/perf: Add support for the hv gpci (get performance counter info) interface") made the shifting bitwise and also assumed little endian order. Because of that, hcall counters values are reported incorrectly.
In particular this can lead to counters go backwards which messes up the counter prev vs now calculation and leads to huge counter value reporting:
#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
-C 0 -I 1000
time counts unit events
1.000078854 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
2.000213293 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
3.000320107 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
4.000428392 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
5.000537864 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
6.000649087 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
7.000760312 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
8.000865218 16,448 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
9.000978985 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
10.001088891 16,384 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
11.001201435 0 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
12.001307937 18,446,744,073,709,535,232 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/
Fix the shifting logic to correct match the format, ie. read bytes in big endian order.
--- arch/powerpc/perf/hv-gpci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/perf/hv-gpci.c +1 -1
@@ -168,7 +168,7 @@ static unsigned long single_gpci_request*/ count =0 ;for (i = offset; i < offset + length; i++) - count |= arg->bytes[i] << (i - offset); + count |= (u64)(arg->bytes[i]) << ((length -1 - (i - offset)) *8 ); *value = count; out:
Greg Kroah-Hartman
maintainerPATCH 124/293 xen: fix setting of max_pfn in shared_info
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
commit 4b511d5bfa74b1926daefd1694205c7f1bcf677f upstream.
Xen PV guests are specifying the highest used PFN via the max_pfn field in shared_info. This value is used by the Xen tools when saving or migrating the guest.
Unfortunately this field is misnamed, as in reality it is specifying the number of pages (including any memory holes) of the guest, so it is the highest used PFN + 1. Renaming isn't possible, as this is a public Xen hypervisor interface which needs to be kept stable.
The kernel will set the value correctly initially at boot time, but when adding more pages (e.g. due to memory hotplug or ballooning) a real PFN number is stored in max_pfn. This is done when expanding the p2m array, and the PFN stored there is even possibly wrong, as it should be the last possible PFN of the just added P2M frame, and not one which led to the P2M expansion.
Fix that by setting shared_info->max_pfn to the last possible PFN + 1.
--- arch/x86/xen/p2m.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/xen/p2m.c +2 -2
@@ -613,8 +613,8 @@ int xen_alloc_p2m_entry(unsigned long pf }/* Expanded the p2m? */ -if (pfn > xen_p2m_last_pfn) { - xen_p2m_last_pfn = pfn; +if (pfn >= xen_p2m_last_pfn) { + xen_p2m_last_pfn =ALIGN (pfn +1 ,P2M_PER_PAGE ); HYPERVISOR_shared_info->arch.max_pfn = xen_p2m_last_pfn; }
Greg Kroah-Hartman
maintainerPATCH 125/293 include/linux/list.h: add a macro to test if entry is pointing to the head
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
commit e130816164e244b692921de49771eeb28205152d upstream.
Add a macro to test if entry is pointing to the head of the list which is useful in cases like:
list_for_each_entry(pos, &head, member) {
if (cond)
break;
}
if (list_entry_is_head(pos, &head, member))
return -ERRNO;that allows to avoid additional variable to be added to track if loop has not been stopped in the middle.
While here, convert list_for_each_entry*() family of macros to use a new one.
--- include/linux/list.h | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-)
include/linux/list.h +19 -10
@@ -485,6 +485,15 @@ static inline void list_splice_tail_init pos = n, n = pos->prev)/** +* list_entry_is_head - test if the entry points to the head of the list +* @pos: the type * to cursor +* @head: the head for your list. +* @member: the name of the list_head within the struct. +*/ +#define list_entry_is_head (pos, head, member) \ + (&pos->member == (head)) + +/** * list_for_each_entry - iterate over list of given type * @pos: the type * to use as a loop cursor. * @head: the head for your list.
@@ -492,7 +501,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry (pos, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -503,7 +512,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_reverse (pos, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -528,7 +537,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_continue (pos, head, member) \ for (pos = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -542,7 +551,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_continue_reverse (pos, head, member) \ for (pos = list_prev_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -554,7 +563,7 @@ static inline void list_splice_tail_init* Iterate over list of given type, continuing from current position. */ #define list_for_each_entry_from (pos, head, member) \ - for (; &pos->member != (head); \ + for (; !list_entry_is_head(pos, head, member); \ pos = list_next_entry(pos, member))/**
@@ -567,7 +576,7 @@ static inline void list_splice_tail_init* Iterate backwards over list of given type, continuing from current position. */ #define list_for_each_entry_from_reverse (pos, head, member) \ - for (; &pos->member != (head); \ + for (; !list_entry_is_head(pos, head, member); \ pos = list_prev_entry(pos, member))/**
@@ -580,7 +589,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe (pos, n, head, member) \ for (pos = list_first_entry(head, typeof(*pos), member), \ n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -596,7 +605,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe_continue (pos, n, head, member) \ for (pos = list_next_entry(pos, member), \ n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -611,7 +620,7 @@ static inline void list_splice_tail_init*/ #define list_for_each_entry_safe_from (pos, n, head, member) \ for (n = list_next_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_next_entry(n, member))/**
@@ -627,7 +636,7 @@ static inline void list_splice_tail_init#define list_for_each_entry_safe_reverse (pos, n, head, member) \ for (pos = list_last_entry(head, typeof(*pos), member), \ n = list_prev_entry(pos, member); \ - &pos->member != (head); \ + !list_entry_is_head(pos, head, member); \ pos = n, n = list_prev_entry(n, member))/**
Greg Kroah-Hartman
maintainerPATCH 126/293 9p/xen: Fix end of loop tests for list_for_each_entry
In reply to Greg Kroah-HartmanFrom: Harshvardhan Jha <[email protected]>
commit 732b33d0dbf17e9483f0b50385bf606f724f50a2 upstream.
This patch addresses the following problems:
- priv can never be NULL, so this part of the check is useless
- if the loop ran through the whole list, priv->client is invalid and
it is more appropriate and sufficient to check for the end of list_for_each_entry loop condition.
--- net/9p/trans_xen.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/9p/trans_xen.c +2 -2
@@ -138,7 +138,7 @@ static bool p9_xen_write_todo(struct xenstatic int p9_xen_request (struct p9_client *client,struct p9_req_t *p9_req) { -struct xen_9pfs_front_priv *priv =NULL ; +struct xen_9pfs_front_priv *priv;RING_IDX cons, prod, masked_cons, masked_prod;unsigned long flags;u32 size = p9_req->tc.size;
@@ -151,7 +151,7 @@ static int p9_xen_request(struct p9_cliebreak ; }read_unlock (&xen_9pfs_lock); -if (!priv || priv->client != client) +if (list_entry_is_head (priv, &xen_9pfs_devs, list))return -EINVAL ; num = p9_req->tc.tag % priv->num_rings;
Greg Kroah-Hartman
maintainerPATCH 127/293 bpf/verifier: per-register parent pointers
In reply to Greg Kroah-HartmanFrom: Edward Cree <[email protected]>
commit 679c782de14bd48c19dd74cd1af20a2bc05dd936 upstream.
By giving each register its own liveness chain, we elide the skip_callee()
logic. Instead, each register's parent is the state it inherits from; both check_func_call() and prepare_func_exit() automatically connect reg states to the correct chain since when they copy the reg state across (r1-r5 into the callee as args, and r0 out as the return value) they also
copy the parent pointer.
--- include/linux/bpf_verifier.h | 8 - kernel/bpf/verifier.c | 183 ++++++++++--------------------------------- 2 files changed, 47 insertions(+), 144 deletions(-)
include/linux/bpf_verifier.h +3 -5
@@ -41,6 +41,7 @@ enum bpf_reg_liveness { };struct bpf_reg_state { +/* Ordering of fields matters. See states_equal() */ enum bpf_reg_type type;union {/* valid when type == PTR_TO_PACKET */
@@ -62,7 +63,6 @@ struct bpf_reg_state {* came from, when one is tested for != NULL. */ u32 id; -/* Ordering of fields matters. See states_equal() */ /* For scalar types (SCALAR_VALUE), this represents our knowledge of * the actual value. * For pointer types, this represents the variable part of the offset
@@ -79,15 +79,15 @@ struct bpf_reg_state {s64 smax_value;/* maximum possible (s64)value */ u64 umin_value;/* minimum possible (u64)value */ u64 umax_value;/* maximum possible (u64)value */ +/* parentage chain for liveness checking */ +struct bpf_reg_state *parent;/* Inside the callee two registers can be both PTR_TO_STACK like * R1=fp-8 and R2=fp-8, but one of them points to this function stack * while another to the caller's stack. To differentiate them 'frameno' * is used which is an index in bpf_verifier_state->frame[] array * pointing to bpf_func_state. -* This field must be second to last, for states_equal() reasons. */ u32 frameno; -/* This field must be last, for states_equal() reasons. */ enum bpf_reg_liveness live; };
@@ -110,7 +110,6 @@ struct bpf_stack_state {*/ struct bpf_func_state {struct bpf_reg_state regs[MAX_BPF_REG ]; -struct bpf_verifier_state *parent;/* index of call instruction that called into this func */ int callsite;/* stack frame number of this function state from pov of
@@ -132,7 +131,6 @@ struct bpf_func_state {struct bpf_verifier_state {/* call stack tracking */ struct bpf_func_state *frame[MAX_CALL_FRAMES ]; -struct bpf_verifier_state *parent;u32 curframe;bool speculative; };
kernel/bpf/verifier.c +44 -139
311 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 128/293 bpf: correct slot_type marking logic to allow more stack slot sharing
In reply to Greg Kroah-HartmanFrom: Jiong Wang <[email protected]>
commit 0bae2d4d62d523f06ff1a8e88ce38b45400acd28 upstream.
Verifier is supposed to support sharing stack slot allocated to ptr with SCALAR_VALUE for privileged program. However this doesn't happen for some cases.
The reason is verifier is not clearing slot_type STACK_SPILL for all bytes, it only clears part of them, while verifier is using:
slot_type[0] == STACK_SPILL
as a convention to check one slot is ptr type.
So, the consequence of partial clearing slot_type is verifier could treat a partially overridden ptr slot, which should now be a SCALAR_VALUE slot, still as ptr slot, and rejects some valid programs.
Before this patch, test_xdp_noinline.o under bpf selftests, bpf_lxc.o and bpf_netdev.o under Cilium bpf repo, when built with -mattr=+alu32 are rejected due to this issue. After this patch, they all accepted.
There is no processed insn number change before and after this patch on Cilium bpf programs.
--- kernel/bpf/verifier.c | 5 ++++ tools/testing/selftests/bpf/test_verifier.c | 34 ++++++++++++++++++++++++++-- 2 files changed, 37 insertions(+), 2 deletions(-)
kernel/bpf/verifier.c +5 -0
@@ -1039,6 +1039,10 @@ static int check_stack_write(struct bpf_/* regular write of data into stack destroys any spilled ptr */ state->stack[spi].spilled_ptr.type =NOT_INIT ; +/* Mark slots as STACK_MISC if they belonged to spilled ptr. */ +if (state->stack[spi].slot_type[0 ] ==STACK_SPILL ) +for (i =0 ; i <BPF_REG_SIZE ; i++) + state->stack[spi].slot_type[i] =STACK_MISC ;/* only mark the slot as written if all 8 bytes were written * otherwise read propagation may incorrectly stop too soon
@@ -1056,6 +1060,7 @@ static int check_stack_write(struct bpf_ register_is_null(&cur->regs[value_regno])) type =STACK_ZERO ; +/* Mark slots affected by this stack write. */ for (i =0 ; i < size; i++) state->stack[spi].slot_type[(slot - i) %BPF_REG_SIZE ] = type;
tools/testing/selftests/bpf/test_verifier.c +32 -2
@@ -956,16 +956,46 @@ static struct bpf_test tests[] = {BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_1 ,-8 ),/* mess up with R1 pointer on stack */ BPF_ST_MEM (BPF_B ,BPF_REG_10 ,-7 ,0x23 ), -/* fill back into R0 should fail */ +/* fill back into R0 is fine for priv. +* R0 now becomes SCALAR_VALUE. +*/ BPF_LDX_MEM (BPF_DW ,BPF_REG_0 ,BPF_REG_10 ,-8 ), +/* Load from R0 should fail. */ +BPF_LDX_MEM (BPF_DW ,BPF_REG_0 ,BPF_REG_0 ,8 ), BPF_EXIT_INSN(), }, .errstr_unpriv ="attempt to corrupt spilled" , - .errstr = "corrupted spill", + .errstr = "R0 invalid mem access 'inv", .result = REJECT, .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, }, { +"check corrupted spill/fill, LSB" , + .insns = { +BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_1 ,-8 ), +BPF_ST_MEM (BPF_H ,BPF_REG_10 ,-8 ,0xcafe ), +BPF_LDX_MEM (BPF_DW ,BPF_REG_0 ,BPF_REG_10 ,-8 ), + BPF_EXIT_INSN(), + }, + .errstr_unpriv ="attempt to corrupt spilled" , + .result_unpriv = REJECT, + .result = ACCEPT, + .retval = POINTER_VALUE, + }, + { +"check corrupted spill/fill, MSB" , + .insns = { +BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_1 ,-8 ), +BPF_ST_MEM (BPF_W ,BPF_REG_10 ,-4 ,0x12345678 ), +BPF_LDX_MEM (BPF_DW ,BPF_REG_0 ,BPF_REG_10 ,-8 ), + BPF_EXIT_INSN(), + }, + .errstr_unpriv ="attempt to corrupt spilled" , + .result_unpriv = REJECT, + .result = ACCEPT, + .retval = POINTER_VALUE, + }, + {"invalid src register in STX" , .insns = { BPF_STX_MEM(BPF_B, BPF_REG_10, -1, -1),
Greg Kroah-Hartman
maintainerPATCH 129/293 bpf: Support variable offset stack access from helpers
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
commit 2011fccfb61bbd1d7c8864b2b3ed7012342e9ba3 upstream.
Currently there is a difference in how verifier checks memory access for helper arguments for PTR_TO_MAP_VALUE and PTR_TO_STACK with regard to variable part of offset.
check_map_access, that is used for PTR_TO_MAP_VALUE, can handle variable offsets just fine, so that BPF program can call a helper like this:
some_helper(map_value_ptr + off, size);
, where offset is unknown at load time, but is checked by program to be in a safe rage (off >= 0 && off + size < map_value_size).
But it's not the case for check_stack_boundary, that is used for PTR_TO_STACK, and same code with pointer to stack is rejected by verifier:
some_helper(stack_value_ptr + off, size);
For example:
0: (7a) *(u64 *)(r10 -16) = 0
1: (7a) *(u64 *)(r10 -8) = 0
2: (61) r2 = *(u32 *)(r1 +0)
3: (57) r2 &= 4
4: (17) r2 -= 16
5: (0f) r2 += r10
6: (18) r1 = 0xffff888111343a80
8: (85) call bpf_map_lookup_elem#1
invalid variable stack read R2 var_off=(0xfffffffffffffff0; 0x4)
Add support for variable offset access to check_stack_boundary so that if offset is checked by program to be in a safe range it's accepted by verifier.
--- kernel/bpf/verifier.c | 75 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 54 insertions(+), 21 deletions(-)
kernel/bpf/verifier.c +54 -21
@@ -1755,6 +1755,29 @@ static int check_xadd(struct bpf_verifie BPF_SIZE(insn->code), BPF_WRITE, -1, true); } +static int __check_stack_boundary (struct bpf_verifier_env *env,u32 regno, +int off,int access_size, +bool zero_size_allowed) +{ +struct bpf_reg_state *reg =cur_regs (env) + regno; + +if (off >=0 || off < -MAX_BPF_STACK || off + access_size >0 || + access_size <0 || (access_size ==0 && !zero_size_allowed)) { +if (tnum_is_const (reg->var_off)) { +verbose (env,"invalid stack type R%d off=%d access_size=%d\n" , + regno, off, access_size); + }else { +char tn_buf[48 ]; + +tnum_strn (tn_buf,sizeof (tn_buf), reg->var_off); +verbose (env,"invalid stack type R%d var_off=%s access_size=%d\n" , + regno, tn_buf, access_size); + } +return -EACCES ; + } +return 0 ; +} +/* when register 'regno' is passed into function that will read 'access_size' * bytes from that pointer, make sure that it's within stack boundary * and all elements of stack are initialized.
@@ -1767,7 +1790,7 @@ static int check_stack_boundary(struct b {struct bpf_reg_state *reg =cur_regs (env) + regno;struct bpf_func_state *state =func (env, reg); -int off, i, slot, spi; +int err, min_off, max_off, i, slot, spi;if (reg->type !=PTR_TO_STACK ) {/* Allow zero-byte read from NULL, regardless of pointer type */
@@ -1781,21 +1804,23 @@ static int check_stack_boundary(struct breturn -EACCES ; } -/* Only allow fixed-offset stack reads */ -if (!tnum_is_const (reg->var_off)) { -char tn_buf[48 ]; - -tnum_strn (tn_buf,sizeof (tn_buf), reg->var_off); -verbose (env,"invalid variable stack read R%d var_off=%s\n" , - regno, tn_buf); -return -EACCES ; - } - off = reg->off + reg->var_off.value; -if (off >=0 || off < -MAX_BPF_STACK || off + access_size >0 || - access_size <0 || (access_size ==0 && !zero_size_allowed)) { -verbose (env,"invalid stack type R%d off=%d access_size=%d\n" , - regno, off, access_size); -return -EACCES ; +if (tnum_is_const (reg->var_off)) { + min_off = max_off = reg->var_off.value + reg->off; + err =__check_stack_boundary (env, regno, min_off, access_size, + zero_size_allowed); +if (err) +return err; + }else { + min_off = reg->smin_value + reg->off; + max_off = reg->umax_value + reg->off; + err =__check_stack_boundary (env, regno, min_off, access_size, + zero_size_allowed); +if (err) +return err; + err =__check_stack_boundary (env, regno, max_off, access_size, + zero_size_allowed); +if (err) +return err; }if (meta && meta->raw_mode) {
@@ -1804,10 +1829,10 @@ static int check_stack_boundary(struct breturn 0 ; } -for (i =0 ; i < access_size; i++) { +for (i = min_off; i < max_off + access_size; i++) {u8 *stype; - slot = -(off + i) -1 ; + slot = -i -1 ; spi = slot /BPF_REG_SIZE ;if (state->allocated_stack <= slot) goto err;
@@ -1820,8 +1845,16 @@ static int check_stack_boundary(struct b goto mark; } err: -verbose (env,"invalid indirect read from stack off %d+%d size %d\n" , - off, i, access_size); +if (tnum_is_const (reg->var_off)) { +verbose (env,"invalid indirect read from stack off %d+%d size %d\n" , + min_off, i - min_off, access_size); + }else { +char tn_buf[48 ]; + +tnum_strn (tn_buf,sizeof (tn_buf), reg->var_off); +verbose (env,"invalid indirect read from stack var_off %s+%d size %d\n" , + tn_buf, i - min_off, access_size); + }return -EACCES ; mark:/* reading any byte out of 8-byte 'spill_slot' will cause
@@ -1830,7 +1863,7 @@ mark:mark_reg_read (env, &state->stack[spi].spilled_ptr, state->stack[spi].spilled_ptr.parent); } -return update_stack_depth (env, state, off); +return update_stack_depth (env, state, min_off); } static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
Greg Kroah-Hartman
maintainerPATCH 130/293 bpf: Reject indirect var_off stack access in raw mode
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
commit f2bcd05ec7b839ff826d2008506ad2d2dff46a59 upstream.
It's hard to guarantee that whole memory is marked as initialized on helper return if uninitialized stack is accessed with variable offset since specific bounds are unknown to verifier. This may cause uninitialized stack leaking.
Reject such an access in check_stack_boundary to prevent possible leaking.
There are no known use-cases for indirect uninitialized stack access with variable offset so it shouldn't break anything.
--- kernel/bpf/verifier.c | 9 +++++++++ 1 file changed, 9 insertions(+)
kernel/bpf/verifier.c +9 -0
@@ -1811,6 +1811,15 @@ static int check_stack_boundary(struct bif (err)return err; }else { +/* Only initialized buffer on stack is allowed to be accessed +* with variable offset. With uninitialized buffer it's hard to +* guarantee that whole memory is marked as initialized on +* helper return since specific bounds are unknown what may +* cause uninitialized stack leaking. +*/ +if (meta && meta->raw_mode) + meta =NULL ; + min_off = reg->smin_value + reg->off; max_off = reg->umax_value + reg->off; err = __check_stack_boundary(env, regno, min_off, access_size,
Greg Kroah-Hartman
maintainerPATCH 131/293 bpf: Reject indirect var_off stack access in unpriv mode
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
commit 088ec26d9c2da9d879ab73e3f4117f9df6c566ee upstream.
Proper support of indirect stack access with variable offset in unprivileged mode (!root) requires corresponding support in Spectre masking for stack ALU in retrieve_ptr_limit().
There are no use-case for variable offset in unprivileged mode though so make verifier reject such accesses for simplicity.
Pointer arithmetics is one (and only?) way to cause variable offset and it's already rejected in unpriv mode so that verifier won't even get to helper function whose argument contains variable offset, e.g.:
0: (7a) *(u64 *)(r10 -16) = 0
1: (7a) *(u64 *)(r10 -8) = 0
2: (61) r2 = *(u32 *)(r1 +0)
3: (57) r2 &= 4
4: (17) r2 -= 16
5: (0f) r2 += r10
variable stack access var_off=(0xfffffffffffffff0; 0x4) off=-16 size=1R2 stack pointer arithmetic goes out of range, prohibited for !root
Still it looks like a good idea to reject variable offset indirect stack access for unprivileged mode in check_stack_boundary() explicitly.
--- kernel/bpf/verifier.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
kernel/bpf/verifier.c +13 -0
@@ -1811,6 +1811,19 @@ static int check_stack_boundary(struct bif (err)return err; }else { +/* Variable offset is prohibited for unprivileged mode for +* simplicity since it requires corresponding support in +* Spectre masking for stack ALU. +* See also retrieve_ptr_limit(). +*/ +if (!env->allow_ptr_leaks) { +char tn_buf[48 ]; + +tnum_strn (tn_buf,sizeof (tn_buf), reg->var_off); +verbose (env,"R%d indirect variable offset stack access prohibited for !root, var_off=%s\n" , + regno, tn_buf); +return -EACCES ; + }/* Only initialized buffer on stack is allowed to be accessed * with variable offset. With uninitialized buffer it's hard to * guarantee that whole memory is marked as initialized on
Greg Kroah-Hartman
maintainerPATCH 132/293 bpf: Sanity check max value for var_off stack access
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
commit 107c26a70ca81bfc33657366ad69d02fdc9efc9d upstream.
As discussed in [1] max value of variable offset has to be checked for overflow on stack access otherwise verifier would accept code like this:
0: (b7) r2 = 6 1: (b7) r3 = 28 2: (7a) *(u64 *)(r10 -16) = 0 3: (7a) *(u64 *)(r10 -8) = 0 4: (79) r4 = *(u64 *)(r1 +168) 5: (c5) if r4 s< 0x0 goto pc+4 R1=ctx(id=0,off=0,imm=0) R2=inv6 R3=inv28 R4=inv(id=0,umax_value=9223372036854775807,var_off=(0x0; 0x7fffffffffffffff)) R10=fp0,call_-1 fp-8=mmmmmmmm fp-16=mmmmmmmm 6: (17) r4 -= 16 7: (0f) r4 += r10 8: (b7) r5 = 8 9: (85) call bpf_getsockopt#57 10: (b7) r0 = 0 11: (95) exit
, where R4 obviosly has unbounded max value.
Fix it by checking that reg->smax_value is inside (-BPF_MAX_VAR_OFF; BPF_MAX_VAR_OFF) range.
reg->smax_value is used instead of reg->umax_value because stack pointers are calculated using negative offset from fp. This is opposite to e.g. map access where offset must be non-negative and where umax_value is used.
Also dedicated verbose logs are added for both min and max bound check failures to have diagnostics consistent with variable offset handling in check_map_access().
[1] https://marc.info/?l=linux-netdev&m=155433357510597&w=2
--- kernel/bpf/verifier.c | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-)
kernel/bpf/verifier.c +15 -3
@@ -1833,16 +1833,28 @@ static int check_stack_boundary(struct bif (meta && meta->raw_mode) meta =NULL ; +if (reg->smax_value >=BPF_MAX_VAR_OFF || + reg->smax_value <= -BPF_MAX_VAR_OFF ) { +verbose (env,"R%d unbounded indirect variable offset stack access\n" , + regno); +return -EACCES ; + } min_off = reg->smin_value + reg->off; - max_off = reg->umax_value + reg->off; + max_off = reg->smax_value + reg->off; err =__check_stack_boundary (env, regno, min_off, access_size, zero_size_allowed); -if (err) +if (err) { +verbose (env,"R%d min value is outside of stack bound\n" , + regno);return err; + } err =__check_stack_boundary (env, regno, max_off, access_size, zero_size_allowed); -if (err) +if (err) { +verbose (env,"R%d max value is outside of stack bound\n" , + regno);return err; + } }if (meta && meta->raw_mode) {
Greg Kroah-Hartman
maintainerPATCH 133/293 selftests/bpf: Test variable offset stack access
In reply to Greg Kroah-HartmanFrom: Andrey Ignatov <[email protected]>
commit 8ff80e96e3ccea5ff0a890d4f18997e0344dbec2 upstream.
Test different scenarios of indirect variable-offset stack access: out of bound access (>0), min_off below initialized part of the stack, max_off+size above initialized part of the stack, initialized stack.
Example of output:
...
#856/p indirect variable-offset stack access, out of bound OK #857/p indirect variable-offset stack access, max_off+size > max_initialized OK #858/p indirect variable-offset stack access, min_off < min_initialized OK #859/p indirect variable-offset stack access, ok OK
...
--- tools/testing/selftests/bpf/test_verifier.c | 79 +++++++++++++++++++++++++++- 1 file changed, 77 insertions(+), 2 deletions(-)
tools/testing/selftests/bpf/test_verifier.c +77 -2
@@ -8495,7 +8495,7 @@ static struct bpf_test tests[] = { .prog_type = BPF_PROG_TYPE_LWT_IN, }, { - "indirect variable-offset stack access", + "indirect variable-offset stack access, out of bound", .insns = {/* Fill the top 8 bytes of the stack */ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
@@ -8516,11 +8516,86 @@ static struct bpf_test tests[] = { BPF_EXIT_INSN(), }, .fixup_map1 = { 5 }, - .errstr = "variable stack read R2", + .errstr = "invalid stack type R2 var_off", .result = REJECT, .prog_type =BPF_PROG_TYPE_LWT_IN , }, { +"indirect variable-offset stack access, max_off+size > max_initialized" , + .insns = { +/* Fill only the second from top 8 bytes of the stack. */ +BPF_ST_MEM (BPF_DW ,BPF_REG_10 ,-16 ,0 ), +/* Get an unknown value. */ +BPF_LDX_MEM (BPF_W ,BPF_REG_2 ,BPF_REG_1 ,0 ), +/* Make it small and 4-byte aligned. */ +BPF_ALU64_IMM (BPF_AND ,BPF_REG_2 ,4 ), +BPF_ALU64_IMM (BPF_SUB ,BPF_REG_2 ,16 ), +/* Add it to fp. We now have either fp-12 or fp-16, but we don't know +* which. fp-12 size 8 is partially uninitialized stack. +*/ +BPF_ALU64_REG (BPF_ADD ,BPF_REG_2 ,BPF_REG_10 ), +/* Dereference it indirectly. */ +BPF_LD_MAP_FD (BPF_REG_1 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_map_lookup_elem), +BPF_MOV64_IMM (BPF_REG_0 ,0 ), + BPF_EXIT_INSN(), + }, + .fixup_map1 = { 5 }, + .errstr = "invalid indirect read from stack var_off", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, + { +"indirect variable-offset stack access, min_off < min_initialized" , + .insns = { +/* Fill only the top 8 bytes of the stack. */ +BPF_ST_MEM (BPF_DW ,BPF_REG_10 ,-8 ,0 ), +/* Get an unknown value */ +BPF_LDX_MEM (BPF_W ,BPF_REG_2 ,BPF_REG_1 ,0 ), +/* Make it small and 4-byte aligned. */ +BPF_ALU64_IMM (BPF_AND ,BPF_REG_2 ,4 ), +BPF_ALU64_IMM (BPF_SUB ,BPF_REG_2 ,16 ), +/* Add it to fp. We now have either fp-12 or fp-16, but we don't know +* which. fp-16 size 8 is partially uninitialized stack. +*/ +BPF_ALU64_REG (BPF_ADD ,BPF_REG_2 ,BPF_REG_10 ), +/* Dereference it indirectly. */ +BPF_LD_MAP_FD (BPF_REG_1 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_map_lookup_elem), +BPF_MOV64_IMM (BPF_REG_0 ,0 ), + BPF_EXIT_INSN(), + }, + .fixup_map1 = { 5 }, + .errstr = "invalid indirect read from stack var_off", + .result = REJECT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, + { +"indirect variable-offset stack access, ok" , + .insns = { +/* Fill the top 16 bytes of the stack. */ +BPF_ST_MEM (BPF_DW ,BPF_REG_10 ,-16 ,0 ), +BPF_ST_MEM (BPF_DW ,BPF_REG_10 ,-8 ,0 ), +/* Get an unknown value. */ +BPF_LDX_MEM (BPF_W ,BPF_REG_2 ,BPF_REG_1 ,0 ), +/* Make it small and 4-byte aligned. */ +BPF_ALU64_IMM (BPF_AND ,BPF_REG_2 ,4 ), +BPF_ALU64_IMM (BPF_SUB ,BPF_REG_2 ,16 ), +/* Add it to fp. We now have either fp-12 or fp-16, we don't know +* which, but either way it points to initialized stack. +*/ +BPF_ALU64_REG (BPF_ADD ,BPF_REG_2 ,BPF_REG_10 ), +/* Dereference it indirectly. */ +BPF_LD_MAP_FD (BPF_REG_1 ,0 ), +BPF_EMIT_CALL (BPF_FUNC_map_lookup_elem), +BPF_MOV64_IMM (BPF_REG_0 ,0 ), + BPF_EXIT_INSN(), + }, + .fixup_map1 = { 6 }, + .result = ACCEPT, + .prog_type = BPF_PROG_TYPE_LWT_IN, + }, + {"direct stack access with 32-bit wraparound. test1" , .insns = { BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
Greg Kroah-Hartman
maintainerPATCH 134/293 bpf: track spill/fill of constants
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
commit f7cf25b2026dc8441e0fa3a202c2aa8a56211e30 upstream.
Compilers often spill induction variables into the stack, hence it is necessary for the verifier to track scalar values of the registers through stack slots.
Also few bpf programs were incorrectly rejected in the past, since the verifier was not able to track such constants while they were used to compute offsets into packet headers.
Tracking constants through the stack significantly decreases the chances of state pruning, since two different constants are considered to be different by state equivalency.
End result that cilium tests suffer serious degradation in the number of states processed and corresponding verification time increase.
before after bpf_lb-DLB_L3.o 1838 6441 bpf_lb-DLB_L4.o 3218 5908 bpf_lb-DUNKNOWN.o 1064 1064 bpf_lxc-DDROP_ALL.o 26935 93790 bpf_lxc-DUNKNOWN.o 34439 123886 bpf_netdev.o 9721 31413 bpf_overlay.o 6184 18561 bpf_lxc_jit.o 39389 359445
After further debugging turned out that cillium progs are getting hurt by clang due to the same constant tracking issue. Newer clang generates better code by spilling less to the stack. Instead it keeps more constants in the registers which
hurts state pruning since the verifier already tracks constants in the registers:
old clang new clang
(no spill/fill tracking introduced by this patch)
bpf_lb-DLB_L3.o 1838 1923 bpf_lb-DLB_L4.o 3218 3077 bpf_lb-DUNKNOWN.o 1064 1062 bpf_lxc-DDROP_ALL.o 26935 166729 bpf_lxc-DUNKNOWN.o 34439 174607 bpf_netdev.o 9721 8407 bpf_overlay.o 6184 5420 bpf_lcx_jit.o 39389 39389
The final table is depressing:
old clang old clang new clang new clang
const spill/fill const spill/fill
bpf_lb-DLB_L3.o 1838 6441 1923 8128 bpf_lb-DLB_L4.o 3218 5908 3077 6707 bpf_lb-DUNKNOWN.o 1064 1064 1062 1062 bpf_lxc-DDROP_ALL.o 26935 93790 166729 380712 bpf_lxc-DUNKNOWN.o 34439 123886 174607 440652 bpf_netdev.o 9721 31413 8407 31904 bpf_overlay.o 6184 18561 5420 23569 bpf_lxc_jit.o 39389 359445 39389 359445
Tracking constants in the registers hurts state pruning already. Adding tracking of constants through stack hurts pruning even more. The later patch address this general constant tracking issue with coarse/precise logic.
[OP: - drop verbose_linfo() calls, as the function is not implemented in 4.19
- adjust mark_reg_read() calls to match the prototype in 4.19]
--- kernel/bpf/verifier.c | 88 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 64 insertions(+), 24 deletions(-)
kernel/bpf/verifier.c +64 -24
@@ -963,6 +963,23 @@ static bool register_is_null(struct bpf_return reg->type ==SCALAR_VALUE &&tnum_equals_const (reg->var_off,0 ); } +static bool register_is_const (struct bpf_reg_state *reg) +{ +return reg->type ==SCALAR_VALUE &&tnum_is_const (reg->var_off); +} + +static void save_register_state (struct bpf_func_state *state, +int spi,struct bpf_reg_state *reg) +{ +int i; + + state->stack[spi].spilled_ptr = *reg; + state->stack[spi].spilled_ptr.live |=REG_LIVE_WRITTEN ; + +for (i =0 ; i <BPF_REG_SIZE ; i++) + state->stack[spi].slot_type[i] =STACK_SPILL ; +} +/* check_stack_read/write functions track spill/fill of registers, * stack boundary and alignment are checked in check_mem_access() */
@@ -972,7 +989,7 @@ static int check_stack_write(struct bpf_ {struct bpf_func_state *cur;/* state of the current function */ int i, slot = -off -1 , spi = slot /BPF_REG_SIZE , err; -enum bpf_reg_type type; +struct bpf_reg_state *reg =NULL ; err =realloc_func_state (state,round_up (slot +1 ,BPF_REG_SIZE ), true);
@@ -989,27 +1006,36 @@ static int check_stack_write(struct bpf_ } cur = env->cur_state->frame[env->cur_state->curframe]; -if (value_regno >=0 && -is_spillable_regtype ((type = cur->regs[value_regno].type))) { +if (value_regno >=0 ) + reg = &cur->regs[value_regno]; +if (reg && size ==BPF_REG_SIZE &®ister_is_const (reg) && + !register_is_null (reg) && env->allow_ptr_leaks) { +save_register_state (state, spi, reg); + }else if (reg &&is_spillable_regtype (reg->type)) {/* register containing pointer is being spilled into stack */ if (size !=BPF_REG_SIZE ) {verbose (env,"invalid size of register spill\n" );return -EACCES ; } -if (state != cur && type ==PTR_TO_STACK ) { +if (state != cur && reg->type ==PTR_TO_STACK ) {verbose (env,"cannot spill pointers to stack into stack frame of the caller\n" );return -EINVAL ; } -/* save register state */ - state->stack[spi].spilled_ptr = cur->regs[value_regno]; - state->stack[spi].spilled_ptr.live |=REG_LIVE_WRITTEN ; - -for (i =0 ; i <BPF_REG_SIZE ; i++) { -if (state->stack[spi].slot_type[i] ==STACK_MISC && - !env->allow_ptr_leaks) { +if (!env->allow_ptr_leaks) { +bool sanitize = false; + +if (state->stack[spi].slot_type[0 ] ==STACK_SPILL && +register_is_const (&state->stack[spi].spilled_ptr)) + sanitize = true; +for (i =0 ; i <BPF_REG_SIZE ; i++) +if (state->stack[spi].slot_type[i] ==STACK_MISC ) { + sanitize = true; +break ; + } +if (sanitize) {int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off;int soff = (-spi -1 ) *BPF_REG_SIZE ;
@@ -1032,8 +1058,8 @@ static int check_stack_write(struct bpf_ } *poff = soff; } - state->stack[spi].slot_type[i] =STACK_SPILL ; } +save_register_state (state, spi, reg); }else {u8 type =STACK_MISC ;
@@ -1056,8 +1082,7 @@ static int check_stack_write(struct bpf_ state->stack[spi].spilled_ptr.live |=REG_LIVE_WRITTEN ;/* when we zero initialize stack slots mark them as such */ -if (value_regno >=0 && -register_is_null (&cur->regs[value_regno])) +if (reg &®ister_is_null (reg)) type =STACK_ZERO ;/* Mark slots affected by this stack write. */
@@ -1075,6 +1100,7 @@ static int check_stack_read(struct bpf_vstruct bpf_verifier_state *vstate = env->cur_state;struct bpf_func_state *state = vstate->frame[vstate->curframe];int i, slot = -off -1 , spi = slot /BPF_REG_SIZE ; +struct bpf_reg_state *reg;u8 *stype;if (reg_state->allocated_stack <= slot) {
@@ -1083,11 +1109,20 @@ static int check_stack_read(struct bpf_vreturn -EACCES ; } stype = reg_state->stack[spi].slot_type; + reg = ®_state->stack[spi].spilled_ptr;if (stype[0 ] ==STACK_SPILL ) {if (size !=BPF_REG_SIZE ) { -verbose (env,"invalid size of register spill\n" ); -return -EACCES ; +if (reg->type !=SCALAR_VALUE ) { +verbose (env,"invalid size of register fill\n" ); +return -EACCES ; + } +if (value_regno >=0 ) { +mark_reg_unknown (env, state->regs, value_regno); + state->regs[value_regno].live |=REG_LIVE_WRITTEN ; + } +mark_reg_read (env, reg, reg->parent); +return 0 ; }for (i =1 ; i <BPF_REG_SIZE ; i++) {if (stype[(slot - i) %BPF_REG_SIZE ] !=STACK_SPILL ) {
@@ -1098,16 +1133,14 @@ static int check_stack_read(struct bpf_vif (value_regno >=0 ) {/* restore register state from stack */ - state->regs[value_regno] = reg_state->stack[spi].spilled_ptr; + state->regs[value_regno] = *reg;/* mark reg as written since spilled pointer state likely * has its liveness marks cleared by is_state_visited() * which resets stack/reg liveness for state transitions */ state->regs[value_regno].live |=REG_LIVE_WRITTEN ; } -mark_reg_read (env, ®_state->stack[spi].spilled_ptr, - reg_state->stack[spi].spilled_ptr.parent); -return 0 ; +mark_reg_read (env, reg, reg->parent); }else {int zeros =0 ;
@@ -1122,8 +1155,7 @@ static int check_stack_read(struct bpf_v off, i, size);return -EACCES ; } -mark_reg_read (env, ®_state->stack[spi].spilled_ptr, - reg_state->stack[spi].spilled_ptr.parent); +mark_reg_read (env, reg, reg->parent);if (value_regno >=0 ) {if (zeros == size) {/* any size read into register is zero extended,
@@ -1136,8 +1168,8 @@ static int check_stack_read(struct bpf_v } state->regs[value_regno].live |=REG_LIVE_WRITTEN ; } -return 0 ; } +return 0 ; } static int check_stack_access(struct bpf_verifier_env *env,
@@ -1790,7 +1822,7 @@ static int check_stack_boundary(struct b {struct bpf_reg_state *reg =cur_regs (env) + regno;struct bpf_func_state *state =func (env, reg); -int err, min_off, max_off, i, slot, spi; +int err, min_off, max_off, i, j, slot, spi;if (reg->type !=PTR_TO_STACK ) {/* Allow zero-byte read from NULL, regardless of pointer type */
@@ -1878,6 +1910,14 @@ static int check_stack_boundary(struct b *stype =STACK_MISC ; goto mark; } +if (state->stack[spi].slot_type[0 ] ==STACK_SPILL && + state->stack[spi].spilled_ptr.type ==SCALAR_VALUE ) { +__mark_reg_unknown (&state->stack[spi].spilled_ptr); +for (j =0 ; j <BPF_REG_SIZE ; j++) + state->stack[spi].slot_type[j] =STACK_MISC ; + goto mark; + } + err:if (tnum_is_const (reg->var_off)) { verbose(env, "invalid indirect read from stack off %d+%d size %d\n",
Greg Kroah-Hartman
maintainerPATCH 135/293 selftests/bpf: fix tests due to const spill/fill
In reply to Greg Kroah-HartmanFrom: Alexei Starovoitov <[email protected]>
commit fc559a70d57c6ee5443f7a750858503e94cdc941 upstream.
fix tests that incorrectly assumed that the verifier cannot track constants through stack.
--- tools/testing/selftests/bpf/test_verifier.c | 31 +++++++++++++++------------- 1 file changed, 17 insertions(+), 14 deletions(-)
tools/testing/selftests/bpf/test_verifier.c +17 -14
@@ -3888,7 +3888,8 @@ static struct bpf_test tests[] = { offsetof(struct __sk_buff, data)),BPF_LDX_MEM (BPF_W ,BPF_REG_3 ,BPF_REG_1 , offsetof(struct __sk_buff , data_end)), -BPF_MOV64_IMM (BPF_REG_0 ,0xffffffff ), +BPF_LDX_MEM (BPF_W ,BPF_REG_0 ,BPF_REG_1 , + offsetof(struct __sk_buff , mark)),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_0 ,-8 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_0 ,BPF_REG_10 ,-8 ), BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 0xffff),
@@ -6560,9 +6561,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, bitwise AND, zero included", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
@@ -6577,9 +6578,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, bitwise AND + JMP, wrong max", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 65),
@@ -6653,9 +6654,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, JMP, bounds + offset", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 5),
@@ -6674,9 +6675,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, JMP, wrong max", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 65, 4),
@@ -6694,9 +6695,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, JMP, no max check", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_MOV64_IMM(BPF_REG_4, 0),
@@ -6714,9 +6715,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, JMP, no min check", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_JMP_IMM(BPF_JGT, BPF_REG_2, 64, 3),
@@ -6732,9 +6733,9 @@ static struct bpf_test tests[] = { { "helper access to variable memory: stack, JMP (signed), no min check", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), -BPF_MOV64_IMM (BPF_REG_2 ,16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_1 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,-128 ), BPF_JMP_IMM(BPF_JSGT, BPF_REG_2, 64, 3),
@@ -6776,6 +6777,7 @@ static struct bpf_test tests[] = { { "helper access to variable memory: map, JMP, wrong max", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_6 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_2 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_2 ,-8 ), BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
@@ -6783,7 +6785,7 @@ static struct bpf_test tests[] = {BPF_EMIT_CALL (BPF_FUNC_map_lookup_elem),BPF_JMP_IMM (BPF_JEQ ,BPF_REG_0 ,0 ,10 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_0 ), -BPF_MOV64_IMM (BPF_REG_2 ,sizeof (struct test_val )), +BPF_MOV64_REG (BPF_REG_2 ,BPF_REG_6 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_10 ,-128 ), BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
@@ -6795,7 +6797,7 @@ static struct bpf_test tests[] = {BPF_MOV64_IMM (BPF_REG_0 ,0 ), BPF_EXIT_INSN(), }, - .fixup_map2 = { 3 }, + .fixup_map2 = { 4 }, .errstr = "invalid access to map value, value_size=48 off=0 size=49", .result = REJECT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
@@ -6830,6 +6832,7 @@ static struct bpf_test tests[] = { { "helper access to variable memory: map adjusted, JMP, wrong max", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_6 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_2 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_2 ,-8 ), BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),
@@ -6838,7 +6841,7 @@ static struct bpf_test tests[] = {BPF_JMP_IMM (BPF_JEQ ,BPF_REG_0 ,0 ,11 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_0 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,20 ), -BPF_MOV64_IMM (BPF_REG_2 ,sizeof (struct test_val )), +BPF_MOV64_REG (BPF_REG_2 ,BPF_REG_6 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_10 ,-128 ), BPF_JMP_IMM(BPF_JSGT, BPF_REG_2,
@@ -6850,7 +6853,7 @@ static struct bpf_test tests[] = {BPF_MOV64_IMM (BPF_REG_0 ,0 ), BPF_EXIT_INSN(), }, - .fixup_map2 = { 3 }, + .fixup_map2 = { 4 }, .errstr = "R1 min value is outside of the array range", .result = REJECT, .prog_type = BPF_PROG_TYPE_TRACEPOINT,
@@ -6872,8 +6875,8 @@ static struct bpf_test tests[] = { { "helper access to variable memory: size > 0 not allowed on NULL (ARG_PTR_TO_MEM_OR_NULL)", .insns = { +BPF_LDX_MEM (BPF_W ,BPF_REG_2 ,BPF_REG_1 ,0 ),BPF_MOV64_IMM (BPF_REG_1 ,0 ), -BPF_MOV64_IMM (BPF_REG_2 ,1 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_10 ,-128 ), BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 64),
@@ -7100,6 +7103,7 @@ static struct bpf_test tests[] = { { "helper access to variable memory: 8 bytes leak", .insns = { +BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_1 ,8 ),BPF_MOV64_REG (BPF_REG_1 ,BPF_REG_10 ),BPF_ALU64_IMM (BPF_ADD ,BPF_REG_1 ,-64 ), BPF_MOV64_IMM(BPF_REG_0, 0),
@@ -7110,7 +7114,6 @@ static struct bpf_test tests[] = {BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_0 ,-24 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_0 ,-16 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_0 ,-8 ), -BPF_MOV64_IMM (BPF_REG_2 ,1 ),BPF_STX_MEM (BPF_DW ,BPF_REG_10 ,BPF_REG_2 ,-128 ),BPF_LDX_MEM (BPF_DW ,BPF_REG_2 ,BPF_REG_10 ,-128 ), BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 63),
Greg Kroah-Hartman
maintainerPATCH 136/293 bpf: Introduce BPF nospec instruction for mitigating Spectre v4
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit f5e81d1117501546b7be050c5fbafa6efd2c722c upstream.
In case of JITs, each of the JIT backends compiles the BPF nospec instruction /either/ to a machine instruction which emits a speculation barrier /or/ to /no/ machine instruction in case the underlying architecture is not affected by Speculative Store Bypass or has different mitigations in place already.
This covers both x86 and (implicitly) arm64: In case of x86, we use 'lfence' instruction for mitigation. In case of arm64, we rely on the firmware mitigation as controlled via the ssbd kernel parameter. Whenever the mitigation is enabled, it works for all of the kernel code with no need to provide any additional instructions here (hence only comment in arm64 JIT). Other archs can follow as needed. The BPF nospec instruction is specifically targeting Spectre v4 since i) we don't use a serialization barrier for the Spectre v1 case, and ii) mitigation instructions for v1 and v4 might be different on some archs.
The BPF nospec is required for a future commit, where the BPF verifier does annotate intermediate BPF programs with speculation barriers.
--- arch/arm/net/bpf_jit_32.c | 3 +++ arch/arm64/net/bpf_jit_comp.c | 13 +++++++++++++ arch/mips/net/ebpf_jit.c | 3 +++ arch/powerpc/net/bpf_jit_comp64.c | 6 ++++++ arch/s390/net/bpf_jit_comp.c | 5 +++++ arch/sparc/net/bpf_jit_comp_64.c | 3 +++ arch/x86/net/bpf_jit_comp.c | 7 +++++++ arch/x86/net/bpf_jit_comp32.c | 6 ++++++ include/linux/filter.h | 15 +++++++++++++++ kernel/bpf/core.c | 18 +++++++++++++++++- kernel/bpf/disasm.c | 16 +++++++++------- 11 files changed, 87 insertions(+), 8 deletions(-)
arch/arm/net/bpf_jit_32.c +3 -0
@@ -1578,6 +1578,9 @@ exit: rn =arm_bpf_get_reg32 (src_lo, tmp2[1 ], ctx);emit_ldx_r (dst, rn, off, ctx,BPF_SIZE (code));break ; +/* speculation barrier */ +case BPF_ST |BPF_NOSPEC : +break ;/* ST: *(size *)(dst + off) = imm */ case BPF_ST |BPF_MEM |BPF_W :case BPF_ST |BPF_MEM |BPF_H :
arch/arm64/net/bpf_jit_comp.c +13 -0
@@ -685,6 +685,19 @@ emit_cond_jmp: }break ; +/* speculation barrier */ +case BPF_ST |BPF_NOSPEC : +/* +* Nothing required here. +* +* In case of arm64, we rely on the firmware mitigation of +* Speculative Store Bypass as controlled via the ssbd kernel +* parameter. Whenever the mitigation is enabled, it works +* for all of the kernel code with no need to provide any +* additional instructions. +*/ +break ; +/* ST: *(size *)(dst + off) = imm */ case BPF_ST |BPF_MEM |BPF_W :case BPF_ST |BPF_MEM |BPF_H :
arch/mips/net/ebpf_jit.c +3 -0
@@ -1282,6 +1282,9 @@ jeq_common: }break ; +case BPF_ST |BPF_NOSPEC :/* speculation barrier */ +break ; +case BPF_ST |BPF_B |BPF_MEM :case BPF_ST |BPF_H |BPF_MEM :case BPF_ST |BPF_W |BPF_MEM :
arch/powerpc/net/bpf_jit_comp64.c +6 -0
@@ -597,6 +597,12 @@ emit_clear:break ;/* +* BPF_ST NOSPEC (speculation barrier) +*/ +case BPF_ST |BPF_NOSPEC : +break ; + +/* * BPF_ST(X) */ case BPF_STX |BPF_MEM |BPF_B :/* *(u8 *)(dst + off) = src */
arch/s390/net/bpf_jit_comp.c +5 -0
@@ -884,6 +884,11 @@ static noinline int bpf_jit_insn(struct }break ;/* +* BPF_NOSPEC (speculation barrier) +*/ +case BPF_ST |BPF_NOSPEC : +break ; +/* * BPF_ST(X) */ case BPF_STX |BPF_MEM |BPF_B :/* *(u8 *)(dst + off) = src_reg */
arch/sparc/net/bpf_jit_comp_64.c +3 -0
@@ -1261,6 +1261,9 @@ static int build_insn(const struct bpf_iemit (opcode |RS1 (src) | rs2 |RD (dst), ctx);break ; } +/* speculation barrier */ +case BPF_ST |BPF_NOSPEC : +break ;/* ST: *(size *)(dst + off) = imm */ case BPF_ST |BPF_MEM |BPF_W :case BPF_ST |BPF_MEM |BPF_H :
arch/x86/net/bpf_jit_comp.c +7 -0
@@ -731,6 +731,13 @@ static int do_jit(struct bpf_prog *bpf_p }break ; +/* speculation barrier */ +case BPF_ST |BPF_NOSPEC : +if (boot_cpu_has (X86_FEATURE_XMM2 )) +/* Emit 'lfence' */ +EMIT3 (0x0F ,0xAE ,0xE8 ); +break ; +/* ST: *(u8*)(dst_reg + off) = imm */ case BPF_ST |BPF_MEM |BPF_B :if (is_ereg (dst_reg))
arch/x86/net/bpf_jit_comp32.c +6 -0
@@ -1683,6 +1683,12 @@ static int do_jit(struct bpf_prog *bpf_p i++;break ; } +/* speculation barrier */ +case BPF_ST |BPF_NOSPEC : +if (boot_cpu_has (X86_FEATURE_XMM2 )) +/* Emit 'lfence' */ +EMIT3 (0x0F ,0xAE ,0xE8 ); +break ;/* ST: *(u8*)(dst_reg + off) = imm */ case BPF_ST |BPF_MEM |BPF_H :case BPF_ST |BPF_MEM |BPF_B :
include/linux/filter.h +15 -0
@@ -64,6 +64,11 @@ struct sock_reuseport;/* unused opcode to mark call to interpreter with arguments */ #define BPF_CALL_ARGS 0xe0 +/* unused opcode to mark speculation barrier for mitigating +* Speculative Store Bypass +*/ +#define BPF_NOSPEC 0xc0 +/* As per nm, we expose JITed images as text (code) section for * kallsyms. That way, tools like perf can find it to match * addresses.
@@ -352,6 +357,16 @@ struct sock_reuseport; .dst_reg = 0, \ .src_reg = 0, \ .off = 0, \ + .imm = 0 }) + +/* Speculation barrier */ + +#define BPF_ST_NOSPEC () \ + ((struct bpf_insn) { \ + .code = BPF_ST | BPF_NOSPEC, \ + .dst_reg = 0, \ + .src_reg = 0, \ + .off = 0, \ .imm = 0 })/* Internal classic blocks for direct assignment */
kernel/bpf/core.c +17 -1
@@ -33,6 +33,7 @@#include <linux/rcupdate.h> #include <linux/perf_event.h> +#include <asm/barrier.h> #include <asm/unaligned.h> /* Registers */
@@ -1050,6 +1051,7 @@ static u64 ___bpf_prog_run(u64 *regs, co/* Non-UAPI available opcodes. */ [BPF_JMP | BPF_CALL_ARGS] = &&JMP_CALL_ARGS, [BPF_JMP | BPF_TAIL_CALL] = &&JMP_TAIL_CALL, + [BPF_ST | BPF_NOSPEC] = &&ST_NOSPEC, };#undef BPF_INSN_3_LBL#undef BPF_INSN_2_LBL
@@ -1356,7 +1358,21 @@ out: JMP_EXIT:return BPF_R0 ; -/* STX and ST and LDX*/ +/* ST, STX and LDX*/ + ST_NOSPEC: +/* Speculation barrier for mitigating Speculative Store Bypass. +* In case of arm64, we rely on the firmware mitigation as +* controlled via the ssbd kernel parameter. Whenever the +* mitigation is enabled, it works for all of the kernel code +* with no need to provide any additional instructions here. +* In case of x86, we use 'lfence' insn for mitigation. We +* reuse preexisting logic from Spectre v1 mitigation that +* happens to produce the required code on x86 for v4 as well. +*/ +#ifdef CONFIG_X86 +barrier_nospec (); +#endif +CONT ;#define LDST (SIZEOP ,SIZE ) \ STX_MEM_##SIZEOP: \ *(SIZE *)(unsigned long) (DST + insn->off) = SRC; \
kernel/bpf/disasm.c +9 -7
@@ -171,15 +171,17 @@ void print_bpf_insn(const struct bpf_inselse verbose (cbs->private_data,"BUG_%02x\n" , insn->code); }else if (class ==BPF_ST ) { -if (BPF_MODE (insn->code) !=BPF_MEM ) { +if (BPF_MODE (insn->code) ==BPF_MEM ) { +verbose (cbs->private_data,"(%02x) *(%s *)(r%d %+d) = %d\n" , + insn->code, + bpf_ldst_string[BPF_SIZE (insn->code) >>3 ], + insn->dst_reg, + insn->off, insn->imm); + }else if (BPF_MODE (insn->code) ==0xc0 /* BPF_NOSPEC, no UAPI */ ) { +verbose (cbs->private_data,"(%02x) nospec\n" , insn->code); + }else {verbose (cbs->private_data,"BUG_st_%02x\n" , insn->code); -return ; } -verbose (cbs->private_data,"(%02x) *(%s *)(r%d %+d) = %d\n" , - insn->code, - bpf_ldst_string[BPF_SIZE (insn->code) >>3 ], - insn->dst_reg, - insn->off, insn->imm); }else if (class ==BPF_LDX ) {if (BPF_MODE (insn->code) !=BPF_MEM ) {verbose (cbs->private_data,"BUG_ldx_%02x\n" , insn->code);
Greg Kroah-Hartman
maintainerPATCH 137/293 bpf: Fix leakage due to insufficient speculative store bypass mitigation
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit 2039f26f3aca5b0e419b98f65dd36481337b86ee upstream.
Spectre v4 gadgets make use of memory disambiguation, which is a set of techniques that execute memory access instructions, that is, loads and stores, out of program order; Intel's optimization manual, section 2.4.4.5:
A load instruction micro-op may depend on a preceding store. Many microarchitectures block loads until all preceding store addresses are known. The memory disambiguator predicts which loads will not depend on any previous stores. When the disambiguator predicts that a load does not have such a dependency, the load takes its data from the L1 data cache. Eventually, the prediction is verified. If an actual conflict is detected, the load and all succeeding instructions are re-executed.
af86ca4e3088 ("bpf: Prevent memory disambiguation attack") tried to mitigate this attack by sanitizing the memory locations through preemptive "fast" (low latency) stores of zero prior to the actual "slow" (high latency) store of a pointer value such that upon dependency misprediction the CPU then speculatively executes the load of the pointer value and retrieves the zero value instead of the attacker controlled scalar value previously stored at that location, meaning, subsequent access in the speculative domain is then redirected to the "zero page".
The sanitized preemptive store of zero prior to the actual "slow" store is done through a simple ST instruction based on r10 (frame pointer) with relative offset to the stack location that the verifier has been tracking on the original used register for STX, which does not have to be r10. Thus, there are no memory dependencies for this store, since it's only using r10 and immediate constant of zero; hence af86ca4e3088 /assumed/ a low latency operation.
However, a recent attack demonstrated that this mitigation is not sufficient since the preemptive store of zero could also be turned into a "slow" store and is thus bypassed as well:
[...]
// r2 = oob address (e.g. scalar)
// r7 = pointer to map value
31: (7b) *(u64 *)(r10 -16) = r2
// r9 will remain "fast" register, r10 will become "slow" register below 32: (bf) r9 = r10
// JIT maps BPF reg to x86 reg:
// r9 -> r15 (callee saved)
// r10 -> rbp
// train store forward prediction to break dependency link between both r9 // and r10 by evicting them from the predictor's LRU table.
33: (61) r0 = *(u32 *)(r7 +24576)
34: (63) *(u32 *)(r7 +29696) = r0
35: (61) r0 = *(u32 *)(r7 +24580)
36: (63) *(u32 *)(r7 +29700) = r0
37: (61) r0 = *(u32 *)(r7 +24584)
38: (63) *(u32 *)(r7 +29704) = r0
39: (61) r0 = *(u32 *)(r7 +24588)
40: (63) *(u32 *)(r7 +29708) = r0
[...]
543: (61) r0 = *(u32 *)(r7 +25596)
544: (63) *(u32 *)(r7 +30716) = r0
// prepare call to bpf_ringbuf_output() helper. the latter will cause rbp // to spill to stack memory while r13/r14/r15 (all callee saved regs) remain // in hardware registers. rbp becomes slow due to push/pop latency. below is // disasm of bpf_ringbuf_output() helper for better visual context:
//
// ffffffff8117ee20: 41 54 push r12 // ffffffff8117ee22: 55 push rbp // ffffffff8117ee23: 53 push rbx // ffffffff8117ee24: 48 f7 c1 fc ff ff ff test rcx,0xfffffffffffffffc // ffffffff8117ee2b: 0f 85 af 00 00 00 jne ffffffff8117eee0 <-- jump taken // [...] // ffffffff8117eee0: 49 c7 c4 ea ff ff ff mov r12,0xffffffffffffffea // ffffffff8117eee7: 5b pop rbx // ffffffff8117eee8: 5d pop rbp // ffffffff8117eee9: 4c 89 e0 mov rax,r12 // ffffffff8117eeec: 41 5c pop r12 // ffffffff8117eeee: c3 ret 545: (18) r1 = map[id:4] 547: (bf) r2 = r7 548: (b7) r3 = 0 549: (b7) r4 = 4 550: (85) call bpf_ringbuf_output#194288 // instruction 551 inserted by verifier \ 551: (7a) *(u64 *)(r10 -16) = 0 | /both/ are now slow stores here // storing map value pointer r7 at fp-16 | since value of r10 is "slow". 552: (7b) *(u64 *)(r10 -16) = r7 /
// following "fast" read to the same memory location, but due to dependency // misprediction it will speculatively execute before insn 551/552 completes. 553: (79) r2 = *(u64 *)(r9 -16)
// in speculative domain contains attacker controlled r2. in non-speculative // domain this contains r7, and thus accesses r7 +0 below.
554: (71) r3 = *(u8 *)(r2 +0)
// leak r3
As can be seen, the current speculative store bypass mitigation which the verifier inserts at line 551 is insufficient since /both/, the write of the zero sanitation as well as the map value pointer are a high latency instruction due to prior memory access via push/pop of r10 (rbp) in contrast to the low latency read in line 553 as r9 (r15) which stays in hardware registers. Thus, architecturally, fp-16 is r7, however, microarchitecturally, fp-16 can still be r2.
Initial thoughts to address this issue was to track spilled pointer loads from stack and enforce their load via LDX through r10 as well so that /both/ the preemptive store of zero /as well as/ the load use the /same/ register such that a dependency is created between the store and load. However, this option is not sufficient either since it can be bypassed as well under speculation. An updated attack with pointer spill/fills now _all_ based on r10 would look as follows:
[...]
// r2 = oob address (e.g. scalar)
// r7 = pointer to map value
[...]
// longer store forward prediction training sequence than before. 2062: (61) r0 = *(u32 *)(r7 +25588)
2063: (63) *(u32 *)(r7 +30708) = r0
2064: (61) r0 = *(u32 *)(r7 +25592)
2065: (63) *(u32 *)(r7 +30712) = r0
2066: (61) r0 = *(u32 *)(r7 +25596)
2067: (63) *(u32 *)(r7 +30716) = r0
// store the speculative load address (scalar) this time after the store // forward prediction training.
2068: (7b) *(u64 *)(r10 -16) = r2
// preoccupy the CPU store port by running sequence of dummy stores. 2069: (63) *(u32 *)(r7 +29696) = r0
2070: (63) *(u32 *)(r7 +29700) = r0
2071: (63) *(u32 *)(r7 +29704) = r0
2072: (63) *(u32 *)(r7 +29708) = r0
2073: (63) *(u32 *)(r7 +29712) = r0
2074: (63) *(u32 *)(r7 +29716) = r0
2075: (63) *(u32 *)(r7 +29720) = r0
2076: (63) *(u32 *)(r7 +29724) = r0
2077: (63) *(u32 *)(r7 +29728) = r0
2078: (63) *(u32 *)(r7 +29732) = r0
2079: (63) *(u32 *)(r7 +29736) = r0
2080: (63) *(u32 *)(r7 +29740) = r0
2081: (63) *(u32 *)(r7 +29744) = r0
2082: (63) *(u32 *)(r7 +29748) = r0
2083: (63) *(u32 *)(r7 +29752) = r0
2084: (63) *(u32 *)(r7 +29756) = r0
2085: (63) *(u32 *)(r7 +29760) = r0
2086: (63) *(u32 *)(r7 +29764) = r0
2087: (63) *(u32 *)(r7 +29768) = r0
2088: (63) *(u32 *)(r7 +29772) = r0
2089: (63) *(u32 *)(r7 +29776) = r0
2090: (63) *(u32 *)(r7 +29780) = r0
2091: (63) *(u32 *)(r7 +29784) = r0
2092: (63) *(u32 *)(r7 +29788) = r0
2093: (63) *(u32 *)(r7 +29792) = r0
2094: (63) *(u32 *)(r7 +29796) = r0
2095: (63) *(u32 *)(r7 +29800) = r0
2096: (63) *(u32 *)(r7 +29804) = r0
2097: (63) *(u32 *)(r7 +29808) = r0
2098: (63) *(u32 *)(r7 +29812) = r0
// overwrite scalar with dummy pointer; same as before, also including the // sanitation store with 0 from the current mitigation by the verifier.
2099: (7a) *(u64 *)(r10 -16) = 0 | /both/ are now slow stores here
2100: (7b) *(u64 *)(r10 -16) = r7 | since store unit is still busy.
// load from stack intended to bypass stores.
2101: (79) r2 = *(u64 *)(r10 -16)
2102: (71) r3 = *(u8 *)(r2 +0)
// leak r3
[...]
Looking at the CPU microarchitecture, the scheduler might issue loads (such as seen in line 2101) before stores (line 2099,2100) because the load execution units become available while the store execution unit is still busy with the sequence of dummy stores (line 2069-2098). And so the load may use the prior stored scalar from r2 at address r10 -16 for speculation. The updated attack may work less reliable on CPU microarchitectures where loads and stores share execution resources.
This concludes that the sanitizing with zero stores from af86ca4e3088 ("bpf:
Prevent memory disambiguation attack") is insufficient. Moreover, the detection of stack reuse from af86ca4e3088 where previously data (STACK_MISC) has been written to a given stack slot where a pointer value is now to be stored does not have sufficient coverage as precondition for the mitigation either; for several reasons outlined as follows:
1) Stack content from prior program runs could still be preserved and is therefore not "random", best example is to split a speculative store bypass attack between tail calls, program A would prepare and store the oob address at a given stack slot and then tail call into program B which does the "slow" store of a pointer to the stack with subsequent "fast" read. From program B PoV such stack slot type is STACK_INVALID, and therefore also must be subject to mitigation.
2) The STACK_SPILL must not be coupled to register_is_const(&stack->spilled_ptr) condition, for example, the previous content of that memory location could also be a pointer to map or map value. Without the fix, a speculative store bypass is not mitigated in such precondition and can then lead to a type confusion in the speculative domain leaking kernel memory near these pointer types.
While brainstorming on various alternative mitigation possibilities, we also stumbled upon a retrospective from Chrome developers [0]:
[...] For variant 4, we implemented a mitigation to zero the unused memory of the heap prior to allocation, which cost about 1% when done concurrently and 4% for scavenging. Variant 4 defeats everything we could think of. We explored more mitigations for variant 4 but the threat proved to be more pervasive and dangerous than we anticipated. For example, stack slots used by the register allocator in the optimizing compiler could be subject to type confusion, leading to pointer crafting. Mitigating type confusion for stack slots alone would have required a complete redesign of the backend of the optimizing compiler, perhaps man years of work, without a guarantee of completeness. [...]
Quoted 1 line
From BPF side, the problem space is reduced, however, options are rather
limited. One idea that has been explored was to xor-obfuscate pointer spills to the BPF stack:
[...]
// preoccupy the CPU store port by running sequence of dummy stores. [...]
2106: (63) *(u32 *)(r7 +29796) = r0
2107: (63) *(u32 *)(r7 +29800) = r0
2108: (63) *(u32 *)(r7 +29804) = r0
2109: (63) *(u32 *)(r7 +29808) = r0
2110: (63) *(u32 *)(r7 +29812) = r0
// overwrite scalar with dummy pointer; xored with random 'secret' value // of 943576462 before store ...
2111: (b4) w11 = 943576462
2112: (af) r11 ^= r7
2113: (7b) *(u64 *)(r10 -16) = r11
2114: (79) r11 = *(u64 *)(r10 -16)
2115: (b4) w2 = 943576462
2116: (af) r2 ^= r11
// ... and restored with the same 'secret' value with the help of AX reg. 2117: (71) r3 = *(u8 *)(r2 +0)
[...]
While the above would not prevent speculation, it would make data leakage infeasible by directing it to random locations. In order to be effective and prevent type confusion under speculation, such random secret would have to be regenerated for each store. The additional complexity involved for a tracking mechanism that prevents jumps such that restoring spilled pointers would not get corrupted is not worth the gain for unprivileged. Hence, the fix in here eventually opted for emitting a non-public BPF_ST | BPF_NOSPEC instruction which the x86 JIT translates into a lfence opcode. Inserting the latter in between the store and load instruction is one of the mitigations options [1]. The x86 instruction manual notes:
[...] An LFENCE that follows an instruction that stores to memory might complete before the data being stored have become globally visible. [...]
The latter meaning that the preceding store instruction finished execution and the store is at minimum guaranteed to be in the CPU's store queue, but it's not guaranteed to be in that CPU's L1 cache at that point (globally visible). The latter would only be guaranteed via sfence. So the load which is guaranteed to execute after the lfence for that local CPU would have to rely on store-to-load forwarding. [2], in section 2.3 on store buffers says:
[...] For every store operation that is added to the ROB, an entry is allocated in the store buffer. This entry requires both the virtual and physical address of the target. Only if there is no free entry in the store buffer, the frontend stalls until there is an empty slot available in the store buffer again. Otherwise, the CPU can immediately continue adding subsequent instructions to the ROB and execute them out of order. On Intel CPUs, the store buffer has up to 56 entries. [...]
One small upside on the fix is that it lifts constraints from af86ca4e3088 where the sanitize_stack_off relative to r10 must be the same when coming from different paths. The BPF_ST | BPF_NOSPEC gets emitted after a BPF_STX or BPF_ST instruction. This happens either when we store a pointer or data value to the BPF stack for the first time, or upon later pointer spills. The former needs to be enforced since otherwise stale stack data could be leaked under speculation as outlined earlier. For non-x86 JITs the BPF_ST | BPF_NOSPEC mapping is currently optimized away, but others could emit a speculation barrier as well if necessary. For real-world unprivileged programs e.g. generated by LLVM, pointer spill/fill is only generated upon register pressure and LLVM only tries to do that for pointers which are not used often. The program main impact will be the initial BPF_ST | BPF_NOSPEC sanitation for the STACK_INVALID case when the first write to a stack slot occurs e.g. upon map lookup. In future we might refine ways to mitigate the latter cost.
[0] https://arxiv.org/pdf/1902.05178.pdf
[1] https://msrc-blog.microsoft.com/2018/05/21/analysis-and-mitigation-of-speculative-store-bypass-cve-2018-3639/
[2] https://arxiv.org/pdf/1905.05725.pdf
[OP: - apply check_stack_write_fixed_off() changes in check_stack_write()
- replace env->bypass_spec_v4 -> env->allow_ptr_leaks]
--- include/linux/bpf_verifier.h | 2 kernel/bpf/verifier.c | 88 ++++++++++++++++--------------------------- 2 files changed, 34 insertions(+), 56 deletions(-)
include/linux/bpf_verifier.h +1 -1
@@ -158,8 +158,8 @@ struct bpf_insn_aux_data {u32 alu_limit;/* limit for add/sub register with pointer */ };int ctx_field_size;/* the ctx field size for load insn, maybe 0 */ -int sanitize_stack_off;/* stack slot to be cleared */ bool seen;/* this insn was processed by the verifier */ +bool sanitize_stack_spill;/* subject to Spectre v4 sanitation */ u8 alu_state;/* used in combination with alu_limit */ };
kernel/bpf/verifier.c +33 -55
126 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 138/293 bpf: verifier: Allocate idmap scratch in verifier env
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
commit c9e73e3d2b1eb1ea7ff068e05007eec3bd8ef1c9 upstream.
func_states_equal makes a very short lived allocation for idmap, probably because it's too large to fit on the stack. However the function is called quite often, leading to a lot of alloc / free churn. Replace the temporary allocation with dedicated scratch space in struct bpf_verifier_env.
--- include/linux/bpf_verifier.h | 8 ++++++++ kernel/bpf/verifier.c | 42 +++++++++++++----------------------------- 2 files changed, 21 insertions(+), 29 deletions(-)
include/linux/bpf_verifier.h +8 -0
@@ -127,6 +127,13 @@ struct bpf_func_state {struct bpf_stack_state *stack; }; +struct bpf_id_pair { +u32 old; +u32 cur; +}; + +/* Maximum number of register states that can exist at once */ +#define BPF_ID_MAP_SIZE (MAX_BPF_REG + MAX_BPF_STACK / BPF_REG_SIZE)#define MAX_CALL_FRAMES 8struct bpf_verifier_state {/* call stack tracking */
@@ -213,6 +220,7 @@ struct bpf_verifier_env {struct bpf_insn_aux_data *insn_aux_data;/* array of per-insn state */ struct bpf_verifier_log log;struct bpf_subprog_info subprog_info[BPF_MAX_SUBPROGS +1 ]; +struct bpf_id_pair idmap_scratch[BPF_ID_MAP_SIZE ];u32 subprog_cnt; };
kernel/bpf/verifier.c +13 -29
87 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 139/293 bpf: Fix pointer arithmetic mask tightening under state pruning
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
commit e042aa532c84d18ff13291d00620502ce7a38dda upstream.
In 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask") we narrowed the offset mask for unprivileged pointer arithmetic in order to mitigate a corner case where in the speculative domain it is possible to advance, for example, the map value pointer by up to value_size-1 out-of- bounds in order to leak kernel memory via side-channel to user space.
The verifier's state pruning for scalars leaves one corner case open where in the first verification path R_x holds an unknown scalar with an aux->alu_limit of e.g. 7, and in a second verification path that same register R_x, here denoted as R_x', holds an unknown scalar which has tighter bounds and would thus satisfy range_within(R_x, R_x') as well as tnum_in(R_x, R_x') for state pruning, yielding an aux->alu_limit of 3:
Given the second path fits the register constraints for pruning, the final generated mask from aux->alu_limit will remain at 7. While technically not wrong for the non-speculative domain, it would however be possible to craft similar cases where the mask would be too wide as in 7fedb63a8307.
One way to fix it is to detect the presence of unknown scalar map pointer arithmetic and force a deeper search on unknown scalars to ensure that we do not run into a masking mismatch.
--- include/linux/bpf_verifier.h | 1 + kernel/bpf/verifier.c | 27 +++++++++++++++++---------- 2 files changed, 18 insertions(+), 10 deletions(-)
include/linux/bpf_verifier.h +1 -0
@@ -215,6 +215,7 @@ struct bpf_verifier_env {struct bpf_map *used_maps[MAX_USED_MAPS ];/* array of map's used by eBPF program */ u32 used_map_cnt;/* number of used maps */ u32 id_gen;/* used to generate unique reg IDs */ +bool explore_alu_limits;bool allow_ptr_leaks;bool seen_direct_write;struct bpf_insn_aux_data *insn_aux_data;/* array of per-insn state */
kernel/bpf/verifier.c +17 -10
@@ -2871,6 +2871,12 @@ static int sanitize_ptr_alu(struct bpf_v alu_state |= off_is_imm ?BPF_ALU_IMMEDIATE :0 ; alu_state |= ptr_is_dst_reg ?BPF_ALU_SANITIZE_SRC :BPF_ALU_SANITIZE_DST ; + +/* Limit pruning on unknown scalars to enable deep search for +* potential masking differences from other program paths. +*/ +if (!off_is_imm) + env->explore_alu_limits = true; } err =update_alu_sanitation_state (aux, alu_state, alu_limit);
@@ -4813,8 +4819,8 @@ static bool check_ids(u32 old_id, u32 cu }/* Returns true if (rold safe implies rcur safe) */ -static bool regsafe (struct bpf_reg_state *rold,struct bpf_reg_state *rcur, -struct bpf_id_pair *idmap) +static bool regsafe (struct bpf_verifier_env *env,struct bpf_reg_state *rold, +struct bpf_reg_state *rcur,struct bpf_id_pair *idmap) {bool equal;
@@ -4840,6 +4846,8 @@ static bool regsafe(struct bpf_reg_statereturn false;switch (rold->type) {case SCALAR_VALUE : +if (env->explore_alu_limits) +return false;if (rcur->type ==SCALAR_VALUE ) {/* new val must satisfy old val knowledge */ return range_within(rold, rcur) &&
@@ -4916,9 +4924,8 @@ static bool regsafe(struct bpf_reg_statereturn false; } -static bool stacksafe (struct bpf_func_state *old, -struct bpf_func_state *cur, -struct bpf_id_pair *idmap) +static bool stacksafe (struct bpf_verifier_env *env,struct bpf_func_state *old, +struct bpf_func_state *cur,struct bpf_id_pair *idmap) {int i, spi;
@@ -4960,9 +4967,8 @@ static bool stacksafe(struct bpf_func_stcontinue ;if (old->stack[spi].slot_type[0 ] !=STACK_SPILL )continue ; -if (!regsafe (&old->stack[spi].spilled_ptr, - &cur->stack[spi].spilled_ptr, - idmap)) +if (!regsafe (env, &old->stack[spi].spilled_ptr, + &cur->stack[spi].spilled_ptr, idmap))/* when explored and current stack slot are both storing * spilled registers, check that stored pointers types * are the same as well.
@@ -5011,10 +5017,11 @@ static bool func_states_equal(struct bpfmemset (env->idmap_scratch,0 ,sizeof (env->idmap_scratch));for (i =0 ; i <MAX_BPF_REG ; i++) -if (!regsafe (&old->regs[i], &cur->regs[i], env->idmap_scratch)) +if (!regsafe (env, &old->regs[i], &cur->regs[i], + env->idmap_scratch))return false; -if (!stacksafe (old, cur, env->idmap_scratch)) +if (!stacksafe (env, old, cur, env->idmap_scratch))return false;return true;
Greg Kroah-Hartman
maintainerPATCH 140/293 tools/thermal/tmon: Add cross compiling support
In reply to Greg Kroah-HartmanFrom: Rolf Eike Beer <[email protected]>
commit b5f7912bb604b47a0fe024560488a7556dce8ee7 upstream.
Default to prefixed pkg-config when crosscompiling, this matches what other parts of the tools/ directory already do.
[dlezcano] : Reworked description
--- tools/thermal/tmon/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/thermal/tmon/Makefile +1 -1
@@ -10,7 +10,7 @@ CFLAGS+= -O1 ${WARNFLAGS} # Add "-fstack-protector" only if toolchain supports it. CFLAGS+= $(call cc-option,-fstack-protector) CC?= $(CROSS_COMPILE)gcc -PKG_CONFIG?= pkg-config +PKG_CONFIG?= $(CROSS_COMPILE)pkg-config CFLAGS+=-D VERSION=\"$(VERSION)\" LDFLAGS+=
Greg Kroah-Hartman
maintainerPATCH 141/293 soc: aspeed: lpc-ctrl: Fix boundary check for mmap
In reply to Greg Kroah-HartmanFrom: Iwona Winiarska <[email protected]>
commit b49a0e69a7b1a68c8d3f64097d06dabb770fec96 upstream.
The check mixes pages (vm_pgoff) with bytes (vm_start, vm_end) on one side of the comparison, and uses resource address (rather than just the resource size) on the other side of the comparison.
This can allow malicious userspace to easily bypass the boundary check and map pages that are located outside memory-region reserved by the driver.
--- drivers/misc/aspeed-lpc-ctrl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/misc/aspeed-lpc-ctrl.c +1 -1
@@ -50,7 +50,7 @@ static int aspeed_lpc_ctrl_mmap(struct funsigned long vsize = vma->vm_end - vma->vm_start;pgprot_t prot = vma->vm_page_prot; -if (vma->vm_pgoff + vsize > lpc_ctrl->mem_base + lpc_ctrl->mem_size) +if (vma->vm_pgoff +vma_pages (vma) > lpc_ctrl->mem_size >>PAGE_SHIFT )return -EINVAL ;/* ast2400/2500 AHB accesses are not cache coherent */
Greg Kroah-Hartman
maintainerPATCH 142/293 arm64: head: avoid over-mapping in map_memory
In reply to Greg Kroah-HartmanFrom: Mark Rutland <[email protected]>
commit 90268574a3e8a6b883bd802d702a2738577e1006 upstream.
The compute_indices and populate_entries macros operate on inclusive bounds, and thus the map_memory macro which uses them also operates on inclusive bounds.
We pass _end and _idmap_text_end to map_memory, but these are exclusive bounds, and if one of these is sufficiently aligned (as a result of kernel configuration, physical placement, and KASLR), then:
* In compute_indices, the computed iend will be in the page/block *after* the final byte of the intended mapping.
* In populate_entries, an unnecessary entry will be created at the end of each level of table. At the leaf level, this entry will map up to SWAPPER_BLOCK_SIZE bytes of physical addresses that we did not intend to map.
As we may map up to SWAPPER_BLOCK_SIZE bytes more than intended, we may violate the boot protocol and map physical address past the 2MiB-aligned end address we are permitted to map. As we map these with Normal memory attributes, this may result in further problems depending on what these physical addresses correspond to.
The final entry at each level may require an additional table at that level. As EARLY_ENTRIES() calculates an inclusive bound, we allocate enough memory for this.
Avoid the extraneous mapping by having map_memory convert the exclusive end address to an inclusive end address by subtracting one, and do likewise in EARLY_ENTRIES() when calculating the number of required tables. For clarity, comments are updated to more clearly document which boundaries the macros operate on. For consistency with the other macros, the comments in map_memory are also updated to describe vstart and vend as virtual addresses.
--- arch/arm64/include/asm/kernel-pgtable.h | 4 ++-- arch/arm64/kernel/head.S | 11 ++++++----- 2 files changed, 8 insertions(+), 7 deletions(-)
arch/arm64/include/asm/kernel-pgtable.h +2 -2
@@ -76,8 +76,8 @@#define EARLY_KASLR (0)#endif -#define EARLY_ENTRIES (vstart, vend, shift) (((vend) >> (shift)) \ - - ((vstart) >> (shift)) + 1 + EARLY_KASLR) +#define EARLY_ENTRIES (vstart, vend, shift) \ + ((((vend) - 1) >> (shift)) - ((vstart) >> (shift)) + 1 + EARLY_KASLR)#define EARLY_PGDS (vstart, vend) (EARLY_ENTRIES(vstart, vend, PGDIR_SHIFT))
arch/arm64/kernel/head.S +6 -5
@@ -202,7 +202,7 @@ ENDPROC(preserve_boot_args) * to be composed of multiple pages. (This effectively scales the end index). * * vstart: virtual address of start of range - * vend: virtual address of end of range + * vend: virtual address of end of range - we map [vstart, vend] * shift: shift used to transform virtual address into index * ptrs: number of entries in page table * istart: index in table corresponding to vstart
@@ -239,17 +239,18 @@ ENDPROC(preserve_boot_args) * * tbl: location of page table * rtbl: address to be used for first level page table entry (typically tbl + PAGE_SIZE) - * vstart: start address to map - * vend: end address to map - we map [vstart, vend] + * vstart: virtual address of start of range + * vend: virtual address of end of range - we map [vstart, vend - 1] * flags: flags to use to map last level entries * phys: physical address corresponding to vstart - physical memory is contiguous * pgds: the number of pgd entries * * Temporaries: istart, iend, tmp, count, sv - these need to be different registers - * Preserves: vstart, vend, flags - * Corrupts: tbl, rtbl, istart, iend, tmp, count, sv + * Preserves: vstart, flags + * Corrupts: tbl, rtbl, vend, istart, iend, tmp, count, sv */ .macro map_memory, tbl, rtbl, vstart, vend, flags, phys, pgds, istart, iend, tmp, count, sv + sub \vend, \vend, #1 add \rtbl, \tbl, #PAGE_SIZE mov \sv, \rtbl mov \count, #0
Greg Kroah-Hartman
maintainerPATCH 143/293 crypto: public_key: fix overflow during implicit conversion
In reply to Greg Kroah-HartmanFrom: zhenwei pi <[email protected]>
commit f985911b7bc75d5c98ed24d8aaa8b94c590f7c6a upstream.
Hit kernel warning like this, it can be reproduced by verifying 256 bytes datafile by keyctl command, run script:
RAWDATA=rawdata
SIGDATA=sigdata
modprobe pkcs8_key_parser
rm -rf *.der *.pem *.pfx
rm -rf $RAWDATA
dd if=/dev/random of=$RAWDATA bs=256 count=1
openssl req -nodes -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem \
-subj "/C=CN/ST=GD/L=SZ/O=vihoo/OU=dev/CN=xx.com/[email protected]"
KEY_ID=`openssl pkcs8 -in key.pem -topk8 -nocrypt -outform DER | keyctl \
padd asymmetric 123 @s`
keyctl pkey_sign $KEY_ID 0 $RAWDATA enc=pkcs1 hash=sha1 > $SIGDATA keyctl pkey_verify $KEY_ID 0 $RAWDATA $SIGDATA enc=pkcs1 hash=sha1
Then the kernel reports:
WARNING: CPU: 5 PID: 344556 at crypto/rsa-pkcs1pad.c:540 pkcs1pad_verify+0x160/0x190 ... Call Trace: public_key_verify_signature+0x282/0x380 ? software_key_query+0x12d/0x180 ? keyctl_pkey_params_get+0xd6/0x130 asymmetric_key_verify_signature+0x66/0x80 keyctl_pkey_verify+0xa5/0x100 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
The reason of this issue, in function 'asymmetric_key_verify_signature':
'.digest_size(u8) = params->in_len(u32)' leads overflow of an u8 value, so use u32 instead of u8 for digest_size field. And reorder struct public_key_signature, it saves 8 bytes on a 64-bit machine.
--- include/crypto/public_key.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/crypto/public_key.h +2 -2
@@ -35,9 +35,9 @@ extern void public_key_free(struct publistruct public_key_signature {struct asymmetric_key_id *auth_ids[2 ];u8 *s;/* Signature */ -u32 s_size;/* Number of bytes in signature */ u8 *digest; -u8 digest_size;/* Number of bytes in digest */ +u32 s_size;/* Number of bytes in signature */ +u32 digest_size;/* Number of bytes in digest */ const char *pkey_algo;const char *hash_algo; };
Greg Kroah-Hartman
maintainerPATCH 144/293 block: bfq: fix bfq_set_next_ioprio_data()
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit a680dd72ec336b81511e3bff48efac6dbfa563e7 upstream.
For a request that has a priority level equal to or larger than IOPRIO_BE_NR, bfq_set_next_ioprio_data() prints a critical warning but defaults to setting the request new_ioprio field to IOPRIO_BE_NR. This is not consistent with the warning and the allowed values for priority levels. Fix this by setting the request new_ioprio field to IOPRIO_BE_NR - 1, the lowest priority level allowed.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -4241,7 +4241,7 @@ bfq_set_next_ioprio_data(struct bfq_queuif (bfqq->new_ioprio >=IOPRIO_BE_NR ) {pr_crit ("bfq_set_next_ioprio_data: new_ioprio %d\n" , bfqq->new_ioprio); - bfqq->new_ioprio =IOPRIO_BE_NR ; + bfqq->new_ioprio =IOPRIO_BE_NR -1 ; } bfqq->entity.new_weight =bfq_ioprio_to_weight (bfqq->new_ioprio);
Greg Kroah-Hartman
maintainerPATCH 145/293 power: supply: max17042: handle fails of reading status register
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
commit 54784ffa5b267f57161eb8fbb811499f22a0a0bf upstream.
Reading status register can fail in the interrupt handler. In such case, the regmap_read() will not store anything useful under passed 'val' variable and random stack value will be used to determine type of interrupt.
Handle the regmap_read() failure to avoid handling interrupt type and triggering changed power supply event based on random stack value.
--- drivers/power/supply/max17042_battery.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +5 -1
@@ -856,8 +856,12 @@ static irqreturn_t max17042_thread_handl {struct max17042_chip *chip = dev;u32 val; +int ret; + + ret =regmap_read (chip->regmap,MAX17042_STATUS , &val); +if (ret) +return IRQ_HANDLED ; -regmap_read (chip->regmap,MAX17042_STATUS , &val);if ((val &STATUS_INTR_SOCMIN_BIT ) || (val &STATUS_INTR_SOCMAX_BIT )) {dev_info (&chip->client->dev,"SOC threshold INTR\n" );
Greg Kroah-Hartman
maintainerPATCH 146/293 dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc()
In reply to Greg Kroah-HartmanFrom: Arne Welzel <[email protected]>
commit 528b16bfc3ae5f11638e71b3b63a81f9999df727 upstream.
On systems with many cores using dm-crypt, heavy spinlock contention in percpu_counter_compare() can be observed when the page allocation limit for a given device is reached or close to be reached. This is due to percpu_counter_compare() taking a spinlock to compute an exact result on potentially many CPUs at the same time.
Switch to non-exact comparison of allocated and allowed pages by using the value returned by percpu_counter_read_positive() to avoid taking the percpu_counter spinlock.
This may over/under estimate the actual number of allocated pages by at most (batch-1) * num_online_cpus().
Currently, batch is bounded by 32. The system on which this issue was first observed has 256 CPUs and 512GB of RAM. With a 4k page size, this change may over/under estimate by 31MB. With ~10G (2%) allowed dm-crypt allocations, this seems an acceptable error. Certainly preferred over running into the spinlock contention.
This behavior was reproduced on an EC2 c5.24xlarge instance with 96 CPUs and 192GB RAM as follows, but can be provoked on systems with less CPUs as well.
* Disable swap
* Tune vm settings to promote regular writeback
$ echo 50 > /proc/sys/vm/dirty_expire_centisecs
$ echo 25 > /proc/sys/vm/dirty_writeback_centisecs
$ echo $((128 * 1024 * 1024)) > /proc/sys/vm/dirty_background_bytes * Create 8 dmcrypt devices based on files on a tmpfs
* Create and mount an ext4 filesystem on each crypt devices
* Run stress-ng --hdd 8 within one of above filesystems
Total %system usage collected from sysstat goes to ~35%. Write throughput on the underlying loop device is ~2GB/s. perf profiling an individual kworker kcryptd thread shows the following profile, indicating spinlock contention in percpu_counter_compare():
99.98% 0.00% kworker/u193:46 [kernel.kallsyms] [k] ret_from_fork
|
--ret_from_fork
kthread
worker_thread
|
--99.92%--process_one_work
|
|--80.52%--kcryptd_crypt
| |
| |--62.58%--mempool_alloc
| | |
| | --62.24%--crypt_page_alloc
| | |
| | --61.51%--__percpu_counter_compare
| | |
| | --61.34%--__percpu_counter_sum
| | |
| | |--58.68%--_raw_spin_lock_irqsave
| | | |
| | | --58.30%--native_queued_spin_lock_slowpath
| | |
| | --0.69%--cpumask_next
| | |
| | --0.51%--_find_next_bit
| |
| |--10.61%--crypt_convert
| | |
| | |--6.05%--xts_crypt
...After applying this patch and running the same test, %system usage is lowered to ~7% and write throughput on the loop device increases to ~2.7GB/s. perf report shows mempool_alloc() as ~8% rather than ~62% in the profile and not hitting the percpu_counter() spinlock anymore.
|--8.15%--mempool_alloc
| |
| |--3.93%--crypt_page_alloc
| | |
| | --3.75%--__alloc_pages
| | |
| | --3.62%--get_page_from_freelist
| | |
| | --3.22%--rmqueue_bulk
| | |
| | --2.59%--_raw_spin_lock
| | |
| | --2.57%--native_queued_spin_lock_slowpath
| |
| --3.05%--_raw_spin_lock_irqsave
| |
| --2.49%--native_queued_spin_lock_slowpath--- drivers/md/dm-crypt.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/md/dm-crypt.c +6 -1
@@ -2181,7 +2181,12 @@ static void *crypt_page_alloc(gfp_t gfp_struct crypt_config *cc = pool_data;struct page *page; -if (unlikely (percpu_counter_compare (&cc->n_allocated_pages, dm_crypt_pages_per_client) >=0 ) && +/* +* Note, percpu_counter_read_positive() may over (and under) estimate +* the current usage by at most (batch - 1) * num_online_cpus() pages, +* but avoids potential spinlock contention of an exact result. +*/ +if (unlikely (percpu_counter_read_positive (&cc->n_allocated_pages) >= dm_crypt_pages_per_client) &&likely (gfp_mask & __GFP_NORETRY))return NULL ;
Greg Kroah-Hartman
maintainerPATCH 147/293 VMCI: fix NULL pointer dereference when unmapping queue pair
In reply to Greg Kroah-HartmanFrom: Wang Hai <[email protected]>
commit a30dc6cf0dc51419021550152e435736aaef8799 upstream.
I got a NULL pointer dereference report when doing fuzz test:
Call Trace: qp_release_pages+0xae/0x130 qp_host_unregister_user_memory.isra.25+0x2d/0x80 vmci_qp_broker_unmap+0x191/0x320 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 vmci_host_unlocked_ioctl+0x59f/0xd50 ? do_vfs_ioctl+0x14b/0xa10 ? tomoyo_file_ioctl+0x28/0x30 ? vmci_host_do_alloc_queuepair.isra.9+0x1c0/0x1c0 __x64_sys_ioctl+0xea/0x120 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x44/0xae
When a queue pair is created by the following call, it will not register the user memory if the page_store is NULL, and the entry->state will be set to VMCIQPB_CREATED_NO_MEM.
vmci_host_unlocked_ioctl
vmci_host_do_alloc_queuepair
vmci_qp_broker_alloc
qp_broker_alloc
qp_broker_create // set entry->state = VMCIQPB_CREATED_NO_MEM;When unmapping this queue pair, qp_host_unregister_user_memory() will be called to unregister the non-existent user memory, which will result in a null pointer reference. It will also change VMCIQPB_CREATED_NO_MEM to VMCIQPB_CREATED_MEM, which should not be present in this operation.
Only when the qp broker has mem, it can unregister the user memory when unmapping the qp broker.
Only when the qp broker has no mem, it can register the user memory when mapping the qp broker.
--- drivers/misc/vmw_vmci/vmci_queue_pair.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/misc/vmw_vmci/vmci_queue_pair.c +4 -2
@@ -2249,7 +2249,8 @@ int vmci_qp_broker_map(struct vmci_handl result =VMCI_SUCCESS ; -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && + !QPBROKERSTATE_HAS_MEM (entry)) {struct vmci_qp_page_store page_store; page_store.pages = guest_mem;
@@ -2356,7 +2357,8 @@ int vmci_qp_broker_unmap(struct vmci_han goto out; } -if (context_id !=VMCI_HOST_CONTEXT_ID ) { +if (context_id !=VMCI_HOST_CONTEXT_ID && +QPBROKERSTATE_HAS_MEM (entry)) {qp_acquire_queue_mutex (entry->produce_q); result =qp_save_headers (entry);if (result <VMCI_SUCCESS )
Greg Kroah-Hartman
maintainerPATCH 148/293 media: uvc: dont do DMA on stack
In reply to Greg Kroah-HartmanFrom: Mauro Carvalho Chehab <[email protected]>
commit 1a10d7fdb6d0e235e9d230916244cc2769d3f170 upstream.
As warned by smatch:
drivers/media/usb/uvc/uvc_v4l2.c:911 uvc_ioctl_g_input() error: doing dma on the stack (&i) drivers/media/usb/uvc/uvc_v4l2.c:943 uvc_ioctl_s_input() error: doing dma on the stack (&i)
those two functions call uvc_query_ctrl passing a pointer to a data at the DMA stack. those are used to send URBs via usb_control_msg(). Using DMA stack is not supported and should not work anymore on modern Linux versions.
So, use a kmalloc'ed buffer.
--- drivers/media/usb/uvc/uvc_v4l2.c | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-)
drivers/media/usb/uvc/uvc_v4l2.c +23 -11
@@ -900,8 +900,8 @@ static int uvc_ioctl_g_input(struct file {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u8 i;if (chain->selector ==NULL || (chain->dev->quirks &UVC_QUIRK_IGNORE_SELECTOR_UNIT )) {
@@ -909,22 +909,27 @@ static int uvc_ioctl_g_input(struct filereturn 0 ; } + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + ret =uvc_query_ctrl (chain->dev,UVC_GET_CUR , chain->selector->id, chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); -if (ret <0 ) -return ret; + buf,1 ); +if (!ret) + *input = *buf -1 ; - *input = i -1 ; -return 0 ; +kfree (buf); + +return ret; }static int uvc_ioctl_s_input (struct file *file,void *fh,unsigned int input) {struct uvc_fh *handle = fh;struct uvc_video_chain *chain = handle->chain; +u8 *buf;int ret; -u32 i; ret =uvc_acquire_privileges (handle);if (ret <0 )
@@ -940,10 +945,17 @@ static int uvc_ioctl_s_input(struct fileif (input >= chain->selector->bNrInPins)return -EINVAL ; - i = input +1 ; -return uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, - chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , - &i,1 ); + buf =kmalloc (1 ,GFP_KERNEL ); +if (!buf) +return -ENOMEM ; + + *buf = input +1 ; + ret =uvc_query_ctrl (chain->dev,UVC_SET_CUR , chain->selector->id, + chain->dev->intfnum,UVC_SU_INPUT_SELECT_CONTROL , + buf,1 ); +kfree (buf); + +return ret; } static int uvc_ioctl_queryctrl(struct file *file, void *fh,
Greg Kroah-Hartman
maintainerPATCH 149/293 media: rc-loopback: return number of emitters rather than error
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit 6b7f554be8c92319d7e6df92fd247ebb9beb4a45 upstream.
The LIRC_SET_TRANSMITTER_MASK ioctl should return the number of emitters if an invalid list was set.
--- drivers/media/rc/rc-loopback.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/rc/rc-loopback.c +1 -1
@@ -52,7 +52,7 @@ static int loop_set_tx_mask(struct rc_deif ((mask & (RXMASK_REGULAR |RXMASK_LEARNING )) != mask) {dprintk ("invalid tx mask: %u\n" , mask); -return -EINVAL ; +return 2 ; }dprintk ("setting tx mask: %u\n" , mask);
Greg Kroah-Hartman
maintainerPATCH 150/293 libata: add ATA_HORKAGE_NO_NCQ_TRIM for Samsung 860 and 870 SSDs
In reply to Greg Kroah-HartmanFrom: Hans de Goede <[email protected]>
commit 8a6430ab9c9c87cb64c512e505e8690bbaee190b upstream.
Commit ca6bfcb2f6d9 ("libata: Enable queued TRIM for Samsung SSD 860") limited the existing ATA_HORKAGE_NO_NCQ_TRIM quirk from "Samsung SSD 8*", covering all Samsung 800 series SSDs, to only apply to "Samsung SSD 840*" and "Samsung SSD 850*" series based on information from Samsung.
But there is a large number of users which is still reporting issues with the Samsung 860 and 870 SSDs combined with Intel, ASmedia or Marvell SATA controllers and all reporters also report these problems going away when disabling queued trims.
Note that with AMD SATA controllers users are reporting even worse issues and only completely disabling NCQ helps there, this will be addressed in a separate patch.
--- drivers/ata/libata-core.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/ata/libata-core.c +4 -0
@@ -4574,6 +4574,10 @@ static const struct ata_blacklist_entry ATA_HORKAGE_ZERO_AFTER_TRIM, }, {"Samsung SSD 850*" ,NULL ,ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 860*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 870*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, },
Greg Kroah-Hartman
maintainerPATCH 151/293 ARM: 9105/1: atags_to_fdt: dont warn about stack size
In reply to Greg Kroah-HartmanFrom: David Heidelberg <[email protected]>
commit b30d0289de72c62516df03fdad8d53f552c69839 upstream.
The merge_fdt_bootargs() function by definition consumes more than 1024 bytes of stack because it has a 1024 byte command line on the stack, meaning that we always get a warning when building this file:
arch/arm/boot/compressed/atags_to_fdt.c: In function 'merge_fdt_bootargs':arch/arm/boot/compressed/atags_to_fdt.c:98:1: warning: the frame size of 1032 bytes is larger than 1024 bytes [-Wframe-larger-than=]
However, as this is the decompressor and we know that it has a very shallow call chain, and we do not actually risk overflowing the kernel stack at runtime here.
This just shuts up the warning by disabling the warning flag for this file.
Tested on Nexus 7 2012 builds.
--- arch/arm/boot/compressed/Makefile | 2 ++ 1 file changed, 2 insertions(+)
arch/arm/boot/compressed/Makefile +2 -0
@@ -90,6 +90,8 @@ $(addprefix $(obj)/,$(libfdt_objs) atags $(addprefix $(obj)/,$(libfdt_hdrs)) ifeq ($(CONFIG_ARM_ATAG_DTB_COMPAT),y) +CFLAGS_REMOVE_atags_to_fdt.o += -Wframe-larger-than=${CONFIG_FRAME_WARN} +CFLAGS_atags_to_fdt.o += -Wframe-larger-than=1280 OBJS += $(libfdt_objs) atags_to_fdt.o endif
Greg Kroah-Hartman
maintainerPATCH 152/293 PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
In reply to Greg Kroah-HartmanFrom: Marek Behún <[email protected]>
commit b12d93e9958e028856cbcb061b6e64728ca07755 upstream.
The ASMedia ASM1062 SATA controller advertises Max_Payload_Size_Supported of 512, but in fact it cannot handle incoming TLPs with payload size of 512.
We discovered this issue on PCIe controllers capable of MPS = 512 (Aardvark and DesignWare), where the issue presents itself as an External Abort. Bjorn Helgaas says:
Probably ASM1062 reports a Malformed TLP error when it receives a data payload of 512 bytes, and Aardvark, DesignWare, etc convert this to an arm64 External Abort. [1]
To avoid this problem, limit the ASM1062 Max Payload Size Supported to 256 bytes, so we set the Max Payload Size of devices that may send TLPs to the ASM1062 to 256 or less.
[1] https://lore.kernel.org/linux-pci/20210601170907.GA1949035@bjorn-Precision-5520/
--- drivers/pci/quirks.c | 1 + 1 file changed, 1 insertion(+)
drivers/pci/quirks.c +1 -0
@@ -3158,6 +3158,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SO PCI_DEVICE_ID_SOLARFLARE_SFC4000A_1, fixup_mpss_256);DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_SOLARFLARE ,PCI_DEVICE_ID_SOLARFLARE_SFC4000B , fixup_mpss_256); +DECLARE_PCI_FIXUP_EARLY (PCI_VENDOR_ID_ASMEDIA ,0x0612 , fixup_mpss_256);/* * Intel 5000 and 5100 Memory controllers have an erratum with read completion
Greg Kroah-Hartman
maintainerPATCH 153/293 PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
In reply to Greg Kroah-HartmanFrom: Krzysztof Wilczyński <[email protected]>
commit a8bd29bd49c4156ea0ec5a97812333e2aeef44e7 upstream.
The pciconfig_read() syscall reads PCI configuration space using hardware-dependent config accessors.
If the read fails on PCI, most accessors don't return an error; they pretend the read was successful and got ~0 data from the device, so the syscall returns success with ~0 data in the buffer.
When the accessor does return an error, pciconfig_read() normally fills the user's buffer with ~0 and returns an error in errno. But after e4585da22ad0 ("pci syscall.c: Switch to refcounting API"), we don't fill the buffer with ~0 for the EPERM "user lacks CAP_SYS_ADMIN" error.
Userspace may rely on the ~0 data to detect errors, but after e4585da22ad0, that would not detect CAP_SYS_ADMIN errors.
Restore the original behaviour of filling the buffer with ~0 when the CAP_SYS_ADMIN check fails.
[bhelgaas: commit log, fold in Nathan's fix
https://lore.kernel.org/r/[email protected]]
--- drivers/pci/syscall.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/pci/syscall.c +3 -1
@@ -21,8 +21,10 @@ SYSCALL_DEFINE5(pciconfig_read, unsignedlong err;int cfg_ret; + err = -EPERM ; + dev =NULL ;if (!capable (CAP_SYS_ADMIN )) -return -EPERM ; + goto error; err = -ENODEV ; dev =pci_get_domain_bus_and_slot (0 , bus, dfn);
Greg Kroah-Hartman
maintainerPATCH 154/293 PCI: xilinx-nwl: Enable the clock through CCF
In reply to Greg Kroah-HartmanFrom: Hyun Kwon <[email protected]>
commit de0a01f5296651d3a539f2d23d0db8f359483696 upstream.
Enable PCIe reference clock. There is no remove function that's why this should be enough for simple operation.
Normally this clock is enabled by default by firmware but there are usecases where this clock should be enabled by driver itself. It is also good that PCIe clock is recorded in a clock framework.
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/pci/controller/pcie-xilinx-nwl.c +12 -0
@@ -6,6 +6,7 @@* (C) Copyright 2014 - 2015, Xilinx, Inc. */ +#include <linux/clk.h> #include <linux/delay.h> #include <linux/interrupt.h> #include <linux/irq.h>
@@ -169,6 +170,7 @@ struct nwl_pcie {u8 root_busno;struct nwl_msi msi;struct irq_domain *legacy_irq_domain; +struct clk *clk;raw_spinlock_t leg_mask_lock; };
@@ -849,6 +851,16 @@ static int nwl_pcie_probe(struct platforreturn err; } + pcie->clk =devm_clk_get (dev,NULL ); +if (IS_ERR (pcie->clk)) +return PTR_ERR (pcie->clk); + + err =clk_prepare_enable (pcie->clk); +if (err) { +dev_err (dev,"can't enable PCIe ref clock\n" ); +return err; + } + err =nwl_pcie_bridge_init (pcie);if (err) {dev_err (dev,"HW Initialization failed\n" );
Greg Kroah-Hartman
maintainerPATCH 155/293 PCI: aardvark: Increase polling delay to 1.5s while waiting for PIO response
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 02bcec3ea5591720114f586960490b04b093a09e upstream.
Measurements in different conditions showed that aardvark hardware PIO response can take up to 1.44s. Increase wait timeout from 1ms to 1.5s to ensure that we do not miss responses from hardware. After 1.44s hardware returns errors (e.g. Completer abort).
The previous two patches fixed checking for PIO status, so now we can use it to also catch errors which are reported by hardware after 1.44s.
After applying this patch, kernel can detect and print PIO errors to dmesg:
[ 6.879999] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100004
[ 6.896436] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004
[ 6.913049] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100010
[ 6.929663] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100010
[ 6.953558] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100014
[ 6.970170] advk-pcie d0070000.pcie: Non-posted PIO Response Status: CA, 0xe00 @ 0x100014
[ 6.994328] advk-pcie d0070000.pcie: Posted PIO Response Status: COMP_ERR, 0x804 @ 0x100004Without this patch kernel prints only a generic error to dmesg:
[ 5.246847] advk-pcie d0070000.pcie: config read/write timed out
--- drivers/pci/controller/pci-aardvark.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pci/controller/pci-aardvark.c +1 -1
@@ -166,7 +166,7 @@ (PCIE_CONF_BUS (bus) |PCIE_CONF_DEV (PCI_SLOT (devfn)) | \ PCIE_CONF_FUNC(PCI_FUNC(devfn)) | PCIE_CONF_REG(where)) -#define PIO_RETRY_CNT 500 +#define PIO_RETRY_CNT 750000/* 1.5 s */ #define PIO_RETRY_DELAY 2/* 2 us*/ #define LINK_WAIT_MAX_RETRIES 10
Greg Kroah-Hartman
maintainerPATCH 156/293 PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit d212dcee27c1f89517181047e5485fcbba4a25c2 upstream.
irq_mask and irq_unmask callbacks need to be properly guarded by raw spin locks as masking/unmasking procedure needs atomic read-modify-write operation on hardware register.
--- drivers/pci/controller/pci-aardvark.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/pci/controller/pci-aardvark.c +9 -0
@@ -181,6 +181,7 @@ struct advk_pcie {struct list_head resources;struct irq_domain *irq_domain;struct irq_chip irq_chip; +raw_spinlock_t irq_lock;struct irq_domain *msi_domain;struct irq_domain *msi_inner_domain;struct irq_chip msi_bottom_irq_chip;
@@ -603,22 +604,28 @@ static void advk_pcie_irq_mask(struct ir {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask |=PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); }static void advk_pcie_irq_unmask (struct irq_data *d) {struct advk_pcie *pcie = d->domain->host_data;irq_hw_number_t hwirq =irqd_to_hwirq (d); +unsigned long flags;u32 mask; +raw_spin_lock_irqsave (&pcie->irq_lock, flags); mask =advk_readl (pcie,PCIE_ISR1_MASK_REG ); mask &= ~PCIE_ISR1_INTX_ASSERT (hwirq);advk_writel (pcie, mask,PCIE_ISR1_MASK_REG ); +raw_spin_unlock_irqrestore (&pcie->irq_lock, flags); } static int advk_pcie_irq_map(struct irq_domain *h,
@@ -701,6 +708,8 @@ static int advk_pcie_init_irq_domain(strstruct device_node *pcie_intc_node;struct irq_chip *irq_chip; +raw_spin_lock_init (&pcie->irq_lock); + pcie_intc_node =of_get_next_child (node,NULL );if (!pcie_intc_node) {dev_err (dev,"No PCIe Intc node found\n" );
Greg Kroah-Hartman
maintainerPATCH 157/293 HID: input: do not report stylus battery state as "full"
In reply to Greg Kroah-HartmanFrom: Dmitry Torokhov <[email protected]>
[ Upstream commit f4abaa9eebde334045ed6ac4e564d050f1df3013 ]
The power supply states of discharging, charging, full, etc, represent state of charging, not the capacity level of the battery (for which we have a separate property). Current HID usage tables to not allow for expressing charging state of the batteries found in generic styli, so we should simply assume that the battery is discharging even if current capacity is at 100% when battery strength reporting is done via HID interface. In fact, we were doing just that before commit 581c4484769e.
This change helps UIs to not mis-represent fully charged batteries in styli as being charging/topping-off.
--- drivers/hid/hid-input.c | 2 -- 1 file changed, 2 deletions(-)
drivers/hid/hid-input.c +0 -2
@@ -427,8 +427,6 @@ static int hidinput_get_battery_property(struct power_supply *psy,if (dev->battery_status ==HID_BATTERY_UNKNOWN ) val->intval =POWER_SUPPLY_STATUS_UNKNOWN ; -else if (dev->battery_capacity ==100 ) - val->intval =POWER_SUPPLY_STATUS_FULL ;else val->intval =POWER_SUPPLY_STATUS_DISCHARGING ;break ;
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 158/293 RDMA/iwcm: Release resources if iw_cm module initialization fails
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit e677b72a0647249370f2635862bf0241c86f66ad ]
The failure during iw_cm module initialization partially left the system with unreleased memory and other resources. Rewrite the module init/exit routines in such way that netlink commands will be opened only after successful initialization.
--- drivers/infiniband/core/iwcm.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-)
drivers/infiniband/core/iwcm.c +12 -7
@@ -1173,29 +1173,34 @@ static int __init iw_cm_init(void) ret =iwpm_init (RDMA_NL_IWCM );if (ret) -pr_err ("iw_cm: couldn't init iwpm\n" ); -else -rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table); +return ret; + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 );if (!iwcm_wq) -return -ENOMEM ; + goto err_alloc; iwcm_ctl_table_hdr =register_net_sysctl (&init_net,"net/iw_cm" , iwcm_ctl_table);if (!iwcm_ctl_table_hdr) {pr_err ("iw_cm: couldn't register sysctl paths\n" ); -destroy_workqueue (iwcm_wq); -return -ENOMEM ; + goto err_sysctl; } +rdma_nl_register (RDMA_NL_IWCM , iwcm_nl_cb_table);return 0 ; + +err_sysctl: +destroy_workqueue (iwcm_wq); +err_alloc: +iwpm_exit (RDMA_NL_IWCM ); +return -ENOMEM ; } static void __exit iw_cm_cleanup(void) { +rdma_nl_unregister (RDMA_NL_IWCM );unregister_net_sysctl_table (iwcm_ctl_table_hdr);destroy_workqueue (iwcm_wq); -rdma_nl_unregister (RDMA_NL_IWCM );iwpm_exit (RDMA_NL_IWCM ); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 159/293 docs: Fix infiniband uverbs minor number
In reply to Greg Kroah-HartmanFrom: Leon Romanovsky <[email protected]>
[ Upstream commit 8d7e415d55610d503fdb8815344846b72d194a40 ]
Starting from the beginning of infiniband subsystem, the uverbs char devices start from 192 as a minor number, see
commit bc38a6abdd5a ("[PATCH] IB uverbs: core implementation").
This patch updates the admin guide documentation to reflect it.
--- Documentation/admin-guide/devices.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
Documentation/admin-guide/devices.txt +3 -3
@@ -2993,10 +2993,10 @@ 65 = /dev/infiniband/issm1 Second InfiniBand IsSM device ... 127 = /dev/infiniband/issm63 63rd InfiniBand IsSM device - 128 = /dev/infiniband/uverbs0 First InfiniBand verbs device - 129 = /dev/infiniband/uverbs1 Second InfiniBand verbs device + 192 = /dev/infiniband/uverbs0 First InfiniBand verbs device + 193 = /dev/infiniband/uverbs1 Second InfiniBand verbs device ... - 159 = /dev/infiniband/uverbs31 31st InfiniBand verbs device + 223 = /dev/infiniband/uverbs31 31st InfiniBand verbs device 232 char Biometric Devices 0 = /dev/biometric/sensor0/fingerprint first fingerprint sensor on first device
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 160/293 pinctrl: samsung: Fix pinctrl bank pin count
In reply to Greg Kroah-HartmanFrom: Jaehyoung Choi <[email protected]>
[ Upstream commit 70115558ab02fe8d28a6634350b3491a542aaa02 ]
Commit 1abd18d1a51a ("pinctrl: samsung: Register pinctrl before GPIO") changes the order of GPIO and pinctrl registration: now pinctrl is registered before GPIO. That means gpio_chip->ngpio is not set when samsung_pinctrl_register() called, and one cannot rely on that value anymore. Use pin_bank->nr_pins' instead of pin_bank->gpio_chip.ngpio' to fix mentioned inconsistency.
--- drivers/pinctrl/samsung/pinctrl-samsung.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/pinctrl/samsung/pinctrl-samsung.c +1 -1
@@ -918,7 +918,7 @@ static int samsung_pinctrl_register(struct platform_device *pdev, pin_bank->grange.pin_base = drvdata->pin_base + pin_bank->pin_base; pin_bank->grange.base = pin_bank->grange.pin_base; - pin_bank->grange.npins = pin_bank->gpio_chip.ngpio; + pin_bank->grange.npins = pin_bank->nr_pins; pin_bank->grange.gc = &pin_bank->gpio_chip;pinctrl_add_gpio_range (drvdata->pctl_dev, &pin_bank->grange); }
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 161/293 vfio: Use config not menuconfig for VFIO_NOIOMMU
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
[ Upstream commit 26c22cfde5dd6e63f25c48458b0185dcb0fbb2fd ]
VFIO_NOIOMMU is supposed to be an element in the VFIO menu, not start a new menu. Correct this copy-paste mistake.
--- drivers/vfio/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/vfio/Kconfig +1 -1
@@ -29,7 +29,7 @@ menuconfig VFIO If you don't know what to do here, say N. -menuconfig VFIO_NOIOMMU +config VFIO_NOIOMMU bool "VFIO No-IOMMU support" depends on VFIO help
Signature · 1 line
2.30.2
Greg Kroah-Hartman
maintainerPATCH 162/293 powerpc/stacktrace: Include linux/delay.h
In reply to Greg Kroah-HartmanFrom: Michal Suchanek <[email protected]>
[ Upstream commit a6cae77f1bc89368a4e2822afcddc45c3062d499 ]
commit 7c6986ade69e ("powerpc/stacktrace: Fix spurious "stale" traces in raise_backtrace_ipi()") introduces udelay() call without including the linux/delay.h header.
This may happen to work on master but the header that declares the functionshould be included nonetheless.
--- arch/powerpc/kernel/stacktrace.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/kernel/stacktrace.c +1 -0
@@ -8,6 +8,7 @@* Copyright 2018 Nick Piggin, Michael Ellerman, IBM Corp. */ +#include <linux/delay.h> #include <linux/export.h> #include <linux/kallsyms.h> #include <linux/module.h>
Signature · 1 line
2.30.2