4.14.290-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.14.290-rc1 review
This is the start of the stable review cycle for the 4.14.290 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 29 Jul 2022 16:09:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.290-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.290-rc1
Jeffrey Hugo <[email protected]>
PCI: hv: Fix interrupt mapping for multi-MSI
Jeffrey Hugo <[email protected]>
PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
Jeffrey Hugo <[email protected]>
PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
Jeffrey Hugo <[email protected]>
PCI: hv: Fix multi-MSI to allow more than one MSI vector
Jose Alonso <[email protected]>
net: usb: ax88179_178a needs FLAG_SEND_ZLP
Jiri Slaby <[email protected]>
tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
Jiri Slaby <[email protected]>
tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
Jiri Slaby <[email protected]>
tty: drop tty_schedule_flip()
Jiri Slaby <[email protected]>
tty: the rest, stop using tty_schedule_flip()
Jiri Slaby <[email protected]>
tty: drivers/tty/, stop using tty_schedule_flip()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Fix sco_send_frame returning skb->len
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Fix passing NULL to PTR_ERR
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
Luiz Augusto von Dentz <[email protected]>
Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Add bt_skb_sendmmsg helper
Luiz Augusto von Dentz <[email protected]>
Bluetooth: Add bt_skb_sendmsg helper
Takashi Iwai <[email protected]>
ALSA: memalloc: Align buffer allocations in page size
Xiaomeng Tong <[email protected]>
tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
Jyri Sarha <[email protected]>
drm/tilcdc: Remove obsolete crtc_mode_valid() hack
Eric Dumazet <[email protected]>
bpf: Make sure mac_header was set before using it
Wang Cheng <[email protected]>
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
Jason A. Donenfeld <[email protected]>
Revert "Revert "char/random: silence a lockdep splat with printk()""
Hristo Venev <[email protected]>
be2net: Fix buffer overflow in be_get_module_eeprom
Kuniyuki Iwashima <[email protected]>
tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
Kuniyuki Iwashima <[email protected]>
igmp: Fix a data-race around sysctl_igmp_max_memberships.
Kuniyuki Iwashima <[email protected]>
igmp: Fix data-races around sysctl_igmp_llm_reports.
Junxiao Chang <[email protected]>
net: stmmac: fix dma queue left shift overflow issue
Robert Hancock <[email protected]>
i2c: cadence: Change large transfer count reset logic to be unconditional
Kuniyuki Iwashima <[email protected]>
tcp: Fix a data-race around sysctl_tcp_probe_interval.
Kuniyuki Iwashima <[email protected]>
tcp: Fix a data-race around sysctl_tcp_probe_threshold.
Kuniyuki Iwashima <[email protected]>
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
Kuniyuki Iwashima <[email protected]>
ip: Fix a data-race around sysctl_fwmark_reflect.
Peter Zijlstra <[email protected]>
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
Miaoqian Lin <[email protected]>
power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
Hangyu Hua <[email protected]>
xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
Demi Marie Obenour <[email protected]>
xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
-------------
Diffstat:
Makefile | 4 +- arch/alpha/kernel/srmcons.c | 2 +- drivers/char/random.c | 4 +- drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 28 +++--- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 - drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 - drivers/gpu/drm/tilcdc/tilcdc_external.c | 96 +++----------------- drivers/gpu/drm/tilcdc/tilcdc_external.h | 1 - drivers/gpu/drm/tilcdc/tilcdc_panel.c | 9 -- drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 9 -- drivers/i2c/busses/i2c-cadence.c | 30 ++----- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +-- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- drivers/net/ethernet/emulex/benet/be_ethtool.c | 31 ++++--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 3 + drivers/net/usb/ax88179_178a.c | 16 ++-- drivers/pci/host/pci-hyperv.c | 101 ++++++++++++++++++---- drivers/power/reset/arm-versatile-reboot.c | 1 + drivers/s390/char/keyboard.h | 4 +- drivers/staging/speakup/spk_ttyio.c | 4 +- drivers/tty/cyclades.c | 6 +- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 +- drivers/tty/pty.c | 14 +-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/tty_buffer.c | 66 +++++++++----- drivers/tty/vt/keyboard.c | 6 +- drivers/tty/vt/vt.c | 2 +- drivers/xen/gntdev.c | 3 +- include/linux/tty_flip.h | 4 +- include/net/bluetooth/bluetooth.h | 65 ++++++++++++++ include/net/inet_sock.h | 3 +- include/net/ip.h | 2 +- include/net/tcp.h | 2 +- kernel/bpf/core.c | 8 +- kernel/events/core.c | 45 +++++++--- mm/mempolicy.c | 2 +- net/bluetooth/rfcomm/core.c | 50 +++++++++-- net/bluetooth/rfcomm/sock.c | 46 +++------- net/bluetooth/sco.c | 30 +++---- net/ipv4/igmp.c | 23 +++-- net/ipv4/tcp_output.c | 4 +- net/xfrm/xfrm_policy.c | 5 +- sound/core/memalloc.c | 1 + 44 files changed, 410 insertions(+), 343 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/37 xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE
From: Demi Marie Obenour <[email protected]>
commit 166d3863231667c4f64dee72b77d1102cdfad11f upstream.
The error paths of gntdev_mmap() can call unmap_grant_pages() even though not all of the pages have been successfully mapped. This will trigger the WARN_ON()s in __unmap_grant_pages_done(). The number of warnings can be very large; I have observed thousands of lines of warnings in the systemd journal.
Avoid this problem by only warning on unmapping failure if the handle being unmapped is not INVALID_GRANT_HANDLE. The handle field of any page that was not successfully mapped will be INVALID_GRANT_HANDLE, so this catches all cases where unmapping can legitimately fail.
--- drivers/xen/gntdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/xen/gntdev.c +2 -1
@@ -393,7 +393,8 @@ static void __unmap_grant_pages_done(intunsigned int offset = data->unmap_ops - map->unmap_ops;for (i =0 ; i < data->count; i++) { -WARN_ON (map->unmap_ops[offset+i].status); +WARN_ON (map->unmap_ops[offset+i].status && + map->unmap_ops[offset+i].handle !=-1 );pr_debug ("unmap handle=%d st=%d\n" , map->unmap_ops[offset+i].handle, map->unmap_ops[offset+i].status);
Greg Kroah-Hartman
maintainerPATCH 2/37 xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit f85daf0e725358be78dfd208dea5fd665d8cb901 ]
xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of pols[0]. This refcount can be dropped in xfrm_expand_policies() when xfrm_expand_policies() return error. pols[0]'s refcount is balanced in here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with num_pols == 1 to drop this refcount when xfrm_expand_policies() return error.
This patch also fix an illegal address access. pols[0] will save a error point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve an illegal address in xfrm_bundle_lookup's error path.
Fix these by setting num_pols = 0 in xfrm_expand_policies()'s error path.
--- net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/xfrm/xfrm_policy.c +4 -1
@@ -1673,8 +1673,10 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family, *num_xfrms =0 ;return 0 ; } -if (IS_ERR (pols[0 ])) +if (IS_ERR (pols[0 ])) { + *num_pols =0 ;return PTR_ERR (pols[0 ]); + } *num_xfrms = pols[0 ]->xfrm_nr;
@@ -1688,6 +1690,7 @@ static int xfrm_expand_policies(const struct flowi *fl, u16 family,if (pols[1 ]) {if (IS_ERR (pols[1 ])) {xfrm_pols_put (pols, *num_pols); + *num_pols =0 ;return PTR_ERR (pols[1 ]); } (*num_pols)++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 3/37 power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 80192eff64eee9b3bc0594a47381937b94b9d65a ]
of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/power/reset/arm-versatile-reboot.c | 1 + 1 file changed, 1 insertion(+)
drivers/power/reset/arm-versatile-reboot.c +1 -0
@@ -150,6 +150,7 @@ static int __init versatile_reboot_probe(void) versatile_reboot_type = (enum versatile_reboot )reboot_id->data; syscon_regmap =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 4/37 perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit 68e3c69803dada336893640110cb87221bb01dcf ]
Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close():
CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest = true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list)
After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more:
again:
mutex_lock(&e->mmap_mutex);
if (event->rb) {
...
if (!atomic_inc_not_zero(&e->rb->mmap_count)) {
...
mutex_unlock(&e->mmap_mutex);
goto again;
}
}The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race.
Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress.
--- kernel/events/core.c | 45 ++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-)
kernel/events/core.c +31 -14
@@ -5429,10 +5429,10 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma)if (!atomic_inc_not_zero (&event->rb->mmap_count)) {/* -* Raced against perf_mmap_close() through -* perf_event_set_output(). Try again, hope for better -* luck. +* Raced against perf_mmap_close(); remove the +* event and try again. */ +ring_buffer_attach (event,NULL );mutex_unlock (&event->mmap_mutex); goto again; }
@@ -9859,14 +9859,25 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, goto out; } +static void mutex_lock_double (struct mutex *a,struct mutex *b) +{ +if (b < a) +swap (a, b); + +mutex_lock (a); +mutex_lock_nested (b,SINGLE_DEPTH_NESTING ); +} +static int perf_event_set_output (struct perf_event *event,struct perf_event *output_event) {struct ring_buffer *rb =NULL ;int ret = -EINVAL ; -if (!output_event) +if (!output_event) { +mutex_lock (&event->mmap_mutex); goto set; + }/* don't allow circular references */ if (event == output_event)
@@ -9904,8 +9915,15 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) event->pmu != output_event->pmu) goto out; +/* +* Hold both mmap_mutex to serialize against perf_mmap_close(). Since +* output_event is already on rb->event_list, and the list iteration +* restarts after every removal, it is guaranteed this new event is +* observed *OR* if output_event is already removed, it's guaranteed we +* observe !rb->mmap_count. +*/ +mutex_lock_double (&event->mmap_mutex, &output_event->mmap_mutex); set: -mutex_lock (&event->mmap_mutex);/* Can't redirect output if we've got an active mmap() */ if (atomic_read (&event->mmap_count)) goto unlock;
@@ -9915,6 +9933,12 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) rb =ring_buffer_get (output_event);if (!rb) goto unlock; + +/* did we race against perf_mmap_close() */ +if (!atomic_read (&rb->mmap_count)) { +ring_buffer_put (rb); + goto unlock; + } }ring_buffer_attach (event, rb);
@@ -9922,20 +9946,13 @@ perf_event_set_output(struct perf_event *event, struct perf_event *output_event) ret =0 ; unlock:mutex_unlock (&event->mmap_mutex); +if (output_event) +mutex_unlock (&output_event->mmap_mutex); out:return ret; } -static void mutex_lock_double (struct mutex *a,struct mutex *b) -{ -if (b < a) -swap (a, b); - -mutex_lock (a); -mutex_lock_nested (b,SINGLE_DEPTH_NESTING ); -} -static int perf_event_set_clock (struct perf_event *event,clockid_t clk_id) {bool nmi_safe = false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 5/37 ip: Fix a data-race around sysctl_fwmark_reflect.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9a ]
While reading sysctl_fwmark_reflect, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- include/net/ip.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/ip.h +1 -1
@@ -305,7 +305,7 @@ void ipfrag_init(void);void ip_static_sysctl_init (void );#define IP4_REPLY_MARK (net, mark) \ - ((net)->ipv4.sysctl_fwmark_reflect ? (mark) : 0) + (READ_ONCE((net)->ipv4.sysctl_fwmark_reflect) ? (mark) : 0)static inline bool ip_is_fragment (const struct iphdr *iph) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 6/37 tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 1a0008f9df59451d0a17806c1ee1a19857032fa8 ]
While reading sysctl_tcp_fwmark_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- include/net/inet_sock.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/net/inet_sock.h +2 -1
@@ -110,7 +110,8 @@ static inline struct inet_request_sock *inet_rsk(const struct request_sock *sk)static inline u32 inet_request_mark (const struct sock *sk,struct sk_buff *skb) { -if (!sk->sk_mark &&sock_net (sk)->ipv4.sysctl_tcp_fwmark_accept) +if (!sk->sk_mark && +READ_ONCE (sock_net (sk)->ipv4.sysctl_tcp_fwmark_accept))return skb->mark;return sk->sk_mark;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/37 tcp: Fix a data-race around sysctl_tcp_probe_threshold.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 92c0aa4175474483d6cf373314343d4e624e882a ]
While reading sysctl_tcp_probe_threshold, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_output.c +1 -1
@@ -2087,7 +2087,7 @@ static int tcp_mtu_probe(struct sock *sk)* probing process by not resetting search range to its orignal. */ if (probe_size >tcp_mtu_to_mss (sk, icsk->icsk_mtup.search_high) || - interval < net->ipv4.sysctl_tcp_probe_threshold) { + interval <READ_ONCE (net->ipv4.sysctl_tcp_probe_threshold)) {/* Check whether enough time has elaplased for * another round of probing. */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/37 tcp: Fix a data-race around sysctl_tcp_probe_interval.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 2a85388f1d94a9f8b5a529118a2c5eaa0520d85c ]
While reading sysctl_tcp_probe_interval, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/tcp_output.c +1 -1
@@ -2005,7 +2005,7 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk)u32 interval;s32 delta; - interval = net->ipv4.sysctl_tcp_probe_interval; + interval =READ_ONCE (net->ipv4.sysctl_tcp_probe_interval); delta = tcp_jiffies32 - icsk->icsk_mtup.probe_timestamp;if (unlikely (delta >= interval *HZ )) {int mss =tcp_current_mss (sk);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 9/37 i2c: cadence: Change large transfer count reset logic to be unconditional
In reply to Greg Kroah-HartmanFrom: Robert Hancock <[email protected]>
[ Upstream commit 4ca8ca873d454635c20d508261bfc0081af75cf8 ]
Problems were observed on the Xilinx ZynqMP platform with large I2C reads. When a read of 277 bytes was performed, the controller NAKed the transfer after only 252 bytes were transferred and returned an ENXIO error on the transfer.
There is some code in cdns_i2c_master_isr to handle this case by resetting the transfer count in the controller before it reaches 0, to allow larger transfers to work, but it was conditional on the CDNS_I2C_BROKEN_HOLD_BIT quirk being set on the controller, and ZynqMP uses the r1p14 version of the core where this quirk is not being set. The requirement to do this to support larger reads seems like an inherently required workaround due to the core only having an 8-bit transfer size register, so it does not appear that this should be conditional on the broken HOLD bit quirk which is used elsewhere in the driver.
Remove the dependency on the CDNS_I2C_BROKEN_HOLD_BIT for this transfer size reset logic to fix this problem.
--- drivers/i2c/busses/i2c-cadence.c | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-)
drivers/i2c/busses/i2c-cadence.c +5 -25
@@ -203,9 +203,9 @@ static inline bool cdns_is_holdquirk(struct cdns_i2c *id, bool hold_wrkaround)*/ static irqreturn_t cdns_i2c_isr (int irq,void *ptr) { -unsigned int isr_status, avail_bytes, updatetx; +unsigned int isr_status, avail_bytes;unsigned int bytes_to_send; -bool hold_quirk; +bool updatetx;struct cdns_i2c *id = ptr;/* Signal completion only after everything is updated */ int done_flag =0 ;
@@ -224,11 +224,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)* Check if transfer size register needs to be updated again for a * large data receive operation. */ - updatetx =0 ; -if (id->recv_count > id->curr_recv_count) - updatetx =1 ; - - hold_quirk = (id->quirks &CDNS_I2C_BROKEN_HOLD_BIT ) && updatetx; + updatetx = id->recv_count > id->curr_recv_count;/* When receiving, handle data interrupt and completion interrupt */ if (id->p_recv_buf &&
@@ -251,7 +247,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) id->recv_count--; id->curr_recv_count--; -if (cdns_is_holdquirk (id, hold_quirk)) +if (cdns_is_holdquirk (id, updatetx))break ; }
@@ -262,7 +258,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr)* maintain transfer size non-zero while performing a large * receive operation. */ -if (cdns_is_holdquirk (id, hold_quirk)) { +if (cdns_is_holdquirk (id, updatetx)) {/* wait while fifo is full */ while (cdns_i2c_readreg (CDNS_I2C_XFER_SIZE_OFFSET ) != (id->curr_recv_count -CDNS_I2C_FIFO_DEPTH ))
@@ -284,22 +280,6 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) CDNS_I2C_XFER_SIZE_OFFSET); id->curr_recv_count = id->recv_count; } - }else if (id->recv_count && !hold_quirk && - !id->curr_recv_count) { - -/* Set the slave address in address register*/ -cdns_i2c_writereg (id->p_msg->addr &CDNS_I2C_ADDR_MASK , -CDNS_I2C_ADDR_OFFSET ); - -if (id->recv_count >CDNS_I2C_TRANSFER_SIZE ) { -cdns_i2c_writereg (CDNS_I2C_TRANSFER_SIZE , -CDNS_I2C_XFER_SIZE_OFFSET ); - id->curr_recv_count =CDNS_I2C_TRANSFER_SIZE ; - }else { -cdns_i2c_writereg (id->recv_count, -CDNS_I2C_XFER_SIZE_OFFSET ); - id->curr_recv_count = id->recv_count; - } }/* Clear hold (if not repeated start) and signal completion */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 10/37 net: stmmac: fix dma queue left shift overflow issue
In reply to Greg Kroah-HartmanFrom: Junxiao Chang <[email protected]>
[ Upstream commit 613b065ca32e90209024ec4a6bb5ca887ee70980 ]
When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1.
If CONFIG_UBSAN is enabled, kernel dumps below warning:
[ 10.363842] ================================================================== [ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8e6Tf4/ linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c:224:12 [ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' [ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003-intel-iotg [ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.15.11 12/22/2021 [ 10.363958] Call Trace: [ 10.363960] <TASK> [ 10.363963] dump_stack_lvl+0x4a/0x5f [ 10.363971] dump_stack+0x10/0x12 [ 10.363974] ubsan_epilogue+0x9/0x45 [ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e [ 10.363979] ? wake_up_klogd+0x4a/0x50 [ 10.363983] ? vprintk_emit+0x8f/0x240 [ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac] [ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac] [ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac] [ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac] [ 10.364030] ? page_pool_alloc_pages+0x4d/0x70 [ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac] [ 10.364042] stmmac_open+0x39e/0x920 [stmmac] [ 10.364050] __dev_open+0xf0/0x1a0 [ 10.364054] __dev_change_flags+0x188/0x1f0 [ 10.364057] dev_change_flags+0x26/0x60 [ 10.364059] do_setlink+0x908/0xc40 [ 10.364062] ? do_setlink+0xb10/0xc40 [ 10.364064] ? __nla_validate_parse+0x4c/0x1a0 [ 10.364068] __rtnl_newlink+0x597/0xa10 [ 10.364072] ? __nla_reserve+0x41/0x50 [ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0 [ 10.364079] ? pskb_expand_head+0x75/0x310 [ 10.364082] ? nla_reserve_64bit+0x21/0x40 [ 10.364086] ? skb_free_head+0x65/0x80 [ 10.364089] ? security_sock_rcv_skb+0x2c/0x50 [ 10.364094] ? __cond_resched+0x19/0x30 [ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420 [ 10.364100] rtnl_newlink+0x49/0x70
This change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue mapping warning.
--- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +3 -0
@@ -217,6 +217,9 @@ static void dwmac4_map_mtl_dma(struct mac_device_info *hw, u32 queue, u32 chan)if (queue ==0 || queue ==4 ) { value &= ~MTL_RXQ_DMA_Q04MDMACH_MASK ; value |=MTL_RXQ_DMA_Q04MDMACH (chan); + }else if (queue >4 ) { + value &= ~MTL_RXQ_DMA_QXMDMACH_MASK (queue -4 ); + value |=MTL_RXQ_DMA_QXMDMACH (chan, queue -4 ); }else { value &= ~MTL_RXQ_DMA_QXMDMACH_MASK (queue); value |=MTL_RXQ_DMA_QXMDMACH (chan, queue);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 11/37 igmp: Fix data-races around sysctl_igmp_llm_reports.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit f6da2267e71106474fbc0943dc24928b9cb79119 ]
While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers.
This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next.
if (ipv4_is_local_multicast(pmc->multiaddr) &&
!READ_ONCE(net->ipv4.sysctl_igmp_llm_reports))
--- net/ipv4/igmp.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
net/ipv4/igmp.c +13 -8
@@ -474,7 +474,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc,if (pmc->multiaddr ==IGMP_ALL_HOSTS )return skb; -if (ipv4_is_local_multicast (pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) +if (ipv4_is_local_multicast (pmc->multiaddr) && + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))return skb; mtu =READ_ONCE (dev->mtu);
@@ -600,7 +601,7 @@ static int igmpv3_send_report(struct in_device *in_dev, struct ip_mc_list *pmc)if (pmc->multiaddr ==IGMP_ALL_HOSTS )continue ;if (ipv4_is_local_multicast (pmc->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))continue ;spin_lock_bh (&pmc->lock);if (pmc->sfcount[MCAST_EXCLUDE ])
@@ -743,7 +744,8 @@ static int igmp_send_report(struct in_device *in_dev, struct ip_mc_list *pmc,if (type ==IGMPV3_HOST_MEMBERSHIP_REPORT )return igmpv3_send_report (in_dev, pmc); -if (ipv4_is_local_multicast (group) && !net->ipv4.sysctl_igmp_llm_reports) +if (ipv4_is_local_multicast (group) && + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))return 0 ;if (type ==IGMP_HOST_LEAVE_MESSAGE )
@@ -921,7 +923,8 @@ static bool igmp_heard_report(struct in_device *in_dev, __be32 group)if (group ==IGMP_ALL_HOSTS )return false; -if (ipv4_is_local_multicast (group) && !net->ipv4.sysctl_igmp_llm_reports) +if (ipv4_is_local_multicast (group) && + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))return false;rcu_read_lock ();
@@ -1031,7 +1034,7 @@ static bool igmp_heard_query(struct in_device *in_dev, struct sk_buff *skb,if (im->multiaddr ==IGMP_ALL_HOSTS )continue ;if (ipv4_is_local_multicast (im->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))continue ;spin_lock_bh (&im->lock);if (im->tm_running)
@@ -1280,7 +1283,8 @@ static void igmp_group_dropped(struct ip_mc_list *im)#ifdef CONFIG_IP_MULTICAST if (im->multiaddr ==IGMP_ALL_HOSTS )return ; -if (ipv4_is_local_multicast (im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) +if (ipv4_is_local_multicast (im->multiaddr) && + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))return ; reporter = im->reporter;
@@ -1317,7 +1321,8 @@ static void igmp_group_added(struct ip_mc_list *im)#ifdef CONFIG_IP_MULTICAST if (im->multiaddr ==IGMP_ALL_HOSTS )return ; -if (ipv4_is_local_multicast (im->multiaddr) && !net->ipv4.sysctl_igmp_llm_reports) +if (ipv4_is_local_multicast (im->multiaddr) && + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))return ;if (in_dev->dead)
@@ -1629,7 +1634,7 @@ static void ip_mc_rejoin_groups(struct in_device *in_dev)if (im->multiaddr ==IGMP_ALL_HOSTS )continue ;if (ipv4_is_local_multicast (im->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE (net->ipv4.sysctl_igmp_llm_reports))continue ;/* a failover is happening and switches
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 12/37 igmp: Fix a data-race around sysctl_igmp_max_memberships.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 6305d821e3b9b5379d348528e5b5faf316383bc2 ]
While reading sysctl_igmp_max_memberships, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- net/ipv4/igmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/ipv4/igmp.c +1 -1
@@ -2179,7 +2179,7 @@ int ip_mc_join_group(struct sock *sk, struct ip_mreqn *imr) count++; } err = -ENOBUFS ; -if (count >= net->ipv4.sysctl_igmp_max_memberships) +if (count >=READ_ONCE (net->ipv4.sysctl_igmp_max_memberships)) goto done; iml =sock_kmalloc (sk,sizeof (*iml),GFP_KERNEL );if (!iml)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 13/37 tcp: Fix a data-race around sysctl_tcp_notsent_lowat.
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 55be873695ed8912eb77ff46d1d1cadf028bd0f3 ]
While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
--- include/net/tcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/tcp.h +1 -1
@@ -1882,7 +1882,7 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 saddr, __be32 daddr);static inline u32 tcp_notsent_lowat (const struct tcp_sock *tp) {struct net *net =sock_net ((struct sock *)tp); -return tp->notsent_lowat ?: net->ipv4.sysctl_tcp_notsent_lowat; +return tp->notsent_lowat ?:READ_ONCE (net->ipv4.sysctl_tcp_notsent_lowat); }static inline bool tcp_stream_memory_free (const struct sock *sk)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 14/37 be2net: Fix buffer overflow in be_get_module_eeprom
In reply to Greg Kroah-HartmanFrom: Hristo Venev <[email protected]>
[ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ]
be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case.
Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once.
--- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- 3 files changed, 25 insertions(+), 18 deletions(-)
drivers/net/ethernet/emulex/benet/be_cmds.c +5 -5
@@ -2291,7 +2291,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state)/* Uses sync mcc */ int be_cmd_read_port_transceiver_data (struct be_adapter *adapter, -u8 page_num,u8 *data) +u8 page_num,u32 off,u32 len,u8 *data) {struct be_dma_mem cmd;struct be_mcc_wrb *wrb;
@@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, req->port =cpu_to_le32 (adapter->hba_port_num); req->page_num =cpu_to_le32 (page_num); status =be_mcc_notify_wait (adapter); -if (!status) { +if (!status && len >0 ) {struct be_cmd_resp_port_type *resp = cmd.va; -memcpy (data, resp->page_data,PAGE_DATA_LEN ); +memcpy (data, resp->page_data + off, len); } err:mutex_unlock (&adapter->mcc_lock);
@@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapter)int status; status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A0 , - page_data); +0 ,PAGE_DATA_LEN , page_data);if (!status) {switch (adapter->phy.interface_type) {case PHY_TYPE_QSFP :
@@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter)int status; status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A0 , - page_data); +0 ,PAGE_DATA_LEN , page_data);if (!status) {strlcpy (adapter->phy.vendor_name, page_data +SFP_VENDOR_NAME_OFFSET ,SFP_VENDOR_NAME_LEN -1 );
drivers/net/ethernet/emulex/benet/be_cmds.h +1 -1
@@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapter, u8 port_num, u8 beacon,int be_cmd_get_beacon_state (struct be_adapter *adapter,u8 port_num,u32 *state);int be_cmd_read_port_transceiver_data (struct be_adapter *adapter, -u8 page_num,u8 *data); +u8 page_num,u32 off,u32 len,u8 *data);int be_cmd_query_cable_type (struct be_adapter *adapter);int be_cmd_query_sfp_info (struct be_adapter *adapter); int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
drivers/net/ethernet/emulex/benet/be_ethtool.c +19 -12
@@ -1340,7 +1340,7 @@ static int be_get_module_info(struct net_device *netdev,return -EOPNOTSUPP ; status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A0 , - page_data); +0 ,PAGE_DATA_LEN , page_data);if (!status) {if (!page_data[SFP_PLUS_SFF_8472_COMP ]) { modinfo->type =ETH_MODULE_SFF_8079 ;
@@ -1358,25 +1358,32 @@ static int be_get_module_eeprom(struct net_device *netdev, {struct be_adapter *adapter =netdev_priv (netdev);int status; +u32 begin, end;if (!check_privilege (adapter,MAX_PRIVILEGES ))return -EOPNOTSUPP ; - status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A0 , - data); -if (status) - goto err; + begin = eeprom->offset; + end = eeprom->offset + eeprom->len; + +if (begin <PAGE_DATA_LEN ) { + status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A0 , begin, +min_t (u32, end,PAGE_DATA_LEN ) - begin, + data); +if (status) + goto err; + + data +=PAGE_DATA_LEN - begin; + begin =PAGE_DATA_LEN ; + } -if (eeprom->offset + eeprom->len >PAGE_DATA_LEN ) { - status =be_cmd_read_port_transceiver_data (adapter, -TR_PAGE_A2 , - data + -PAGE_DATA_LEN ); +if (end >PAGE_DATA_LEN ) { + status =be_cmd_read_port_transceiver_data (adapter,TR_PAGE_A2 , + begin -PAGE_DATA_LEN , + end - begin, data);if (status) goto err; } -if (eeprom->offset) -memcpy (data, data + eeprom->offset, eeprom->len); err:return be_cmd_status (status); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 15/37 Revert "Revert "char/random: silence a lockdep splat with printk()""
In reply to Greg Kroah-HartmanFrom: "Jason A. Donenfeld" <[email protected]>
In 2019, Sergey fixed a lockdep splat with 15341b1dd409 ("char/random:
silence a lockdep splat with printk()"), but that got reverted soon after from 4.19 because back then it apparently caused various problems. But the issue it was fixing is still there, and more generally, many patches turning printk() into printk_deferred() have landed since, making me suspect it's okay to try this out again.
This should fix the following deadlock found by the kernel test robot:
[ 18.287691] WARNING: possible circular locking dependency detected
[ 18.287692] 4.19.248-00165-g3d1f971aa81f #1 Not tainted
[ 18.287693] ------------------------------------------------------
[ 18.287712] stop/202 is trying to acquire lock:
[ 18.287713] (ptrval) (console_owner){..-.}, at: console_unlock (??:?)
[ 18.287717]
[ 18.287718] but task is already holding lock:
[ 18.287718] (ptrval) (&(&port->lock)->rlock){-...}, at: pty_write (pty.c:?)
[ 18.287722]
[ 18.287722] which lock already depends on the new lock.
[ 18.287723]
[ 18.287724]
[ 18.287725] the existing dependency chain (in reverse order) is:
[ 18.287725]
[ 18.287726] -> #2 (&(&port->lock)->rlock){-...}:
[ 18.287729] validate_chain+0x84a/0xe00
[ 18.287729] __lock_acquire (lockdep.c:?)
[ 18.287730] lock_acquire (??:?)
[ 18.287731] _raw_spin_lock_irqsave (??:?)
[ 18.287732] tty_port_tty_get (??:?)
[ 18.287733] tty_port_default_wakeup (tty_port.c:?)
[ 18.287734] tty_port_tty_wakeup (??:?)
[ 18.287734] uart_write_wakeup (??:?)
[ 18.287735] serial8250_tx_chars (??:?)
[ 18.287736] serial8250_handle_irq (??:?)
[ 18.287737] serial8250_default_handle_irq (8250_port.c:?)
[ 18.287738] serial8250_interrupt (8250_core.c:?)
[ 18.287738] __handle_irq_event_percpu (??:?)
[ 18.287739] handle_irq_event_percpu (??:?)
[ 18.287740] handle_irq_event (??:?)
[ 18.287741] handle_edge_irq (??:?)
[ 18.287742] handle_irq (??:?)
[ 18.287742] do_IRQ (??:?)
[ 18.287743] common_interrupt (entry_32.o:?)
[ 18.287744] _raw_spin_unlock_irqrestore (??:?)
[ 18.287745] uart_write (serial_core.c:?)
[ 18.287746] process_output_block (n_tty.c:?)
[ 18.287747] n_tty_write (n_tty.c:?)
[ 18.287747] tty_write (tty_io.c:?)
[ 18.287748] __vfs_write (??:?)
[ 18.287749] vfs_write (??:?)
[ 18.287750] ksys_write (??:?)
[ 18.287750] sys_write (??:?)
[ 18.287751] do_fast_syscall_32 (??:?)
[ 18.287752] entry_SYSENTER_32 (??:?)
[ 18.287752]
[ 18.287753] -> #1 (&port_lock_key){-.-.}:
[ 18.287756]
[ 18.287756] -> #0 (console_owner){..-.}:
[ 18.287759] check_prevs_add (lockdep.c:?)
[ 18.287760] validate_chain+0x84a/0xe00
[ 18.287761] __lock_acquire (lockdep.c:?)
[ 18.287761] lock_acquire (??:?)
[ 18.287762] console_unlock (??:?)
[ 18.287763] vprintk_emit (??:?)
[ 18.287764] vprintk_default (??:?)
[ 18.287764] vprintk_func (??:?)
[ 18.287765] printk (??:?)
[ 18.287766] get_random_u32 (??:?)
[ 18.287767] shuffle_freelist (slub.c:?)
[ 18.287767] allocate_slab (slub.c:?)
[ 18.287768] new_slab (slub.c:?)
[ 18.287769] ___slab_alloc+0x6d0/0xb20
[ 18.287770] __slab_alloc+0xd6/0x2e0
[ 18.287770] __kmalloc (??:?)
[ 18.287771] tty_buffer_alloc (tty_buffer.c:?)
[ 18.287772] __tty_buffer_request_room (tty_buffer.c:?)
[ 18.287773] tty_insert_flip_string_fixed_flag (??:?)
[ 18.287774] pty_write (pty.c:?)
[ 18.287775] process_output_block (n_tty.c:?)
[ 18.287776] n_tty_write (n_tty.c:?)
[ 18.287777] tty_write (tty_io.c:?)
[ 18.287778] __vfs_write (??:?)
[ 18.287779] vfs_write (??:?)
[ 18.287780] ksys_write (??:?)
[ 18.287780] sys_write (??:?)
[ 18.287781] do_fast_syscall_32 (??:?)
[ 18.287782] entry_SYSENTER_32 (??:?)
[ 18.287783]
[ 18.287783] other info that might help us debug this:
[ 18.287784]
[ 18.287785] Chain exists of:
[ 18.287785] console_owner --> &port_lock_key --> &(&port->lock)->rlock
[ 18.287789]
[ 18.287790] Possible unsafe locking scenario:
[ 18.287790]
[ 18.287791] CPU0 CPU1
[ 18.287792] ---- ----
[ 18.287792] lock(&(&port->lock)->rlock);
[ 18.287794] lock(&port_lock_key);
[ 18.287814] lock(&(&port->lock)->rlock);
[ 18.287815] lock(console_owner);
[ 18.287817]
[ 18.287818] *** DEADLOCK ***
[ 18.287818]
[ 18.287819] 6 locks held by stop/202:
[ 18.287820] #0: (ptrval) (&tty->ldisc_sem){++++}, at: ldsem_down_read (??:?)
[ 18.287823] #1: (ptrval) (&tty->atomic_write_lock){+.+.}, at: tty_write_lock (tty_io.c:?)
[ 18.287826] #2: (ptrval) (&o_tty->termios_rwsem/1){++++}, at: n_tty_write (n_tty.c:?)
[ 18.287830] #3: (ptrval) (&ldata->output_lock){+.+.}, at: process_output_block (n_tty.c:?)
[ 18.287834] #4: (ptrval) (&(&port->lock)->rlock){-...}, at: pty_write (pty.c:?)
[ 18.287838] #5: (ptrval) (console_lock){+.+.}, at: console_trylock_spinning (printk.c:?)
[ 18.287841]
[ 18.287842] stack backtrace:
[ 18.287843] CPU: 0 PID: 202 Comm: stop Not tainted 4.19.248-00165-g3d1f971aa81f #1
[ 18.287843] Call Trace:
[ 18.287844] dump_stack (??:?)
[ 18.287845] print_circular_bug.cold+0x78/0x8b
[ 18.287846] check_prev_add+0x66a/0xd20
[ 18.287847] check_prevs_add (lockdep.c:?)
[ 18.287848] validate_chain+0x84a/0xe00
[ 18.287848] __lock_acquire (lockdep.c:?)
[ 18.287849] lock_acquire (??:?)
[ 18.287850] ? console_unlock (??:?)
[ 18.287851] console_unlock (??:?)
[ 18.287851] ? console_unlock (??:?)
[ 18.287852] ? native_save_fl (??:?)
[ 18.287853] vprintk_emit (??:?)
[ 18.287854] vprintk_default (??:?)
[ 18.287855] vprintk_func (??:?)
[ 18.287855] printk (??:?)
[ 18.287856] get_random_u32 (??:?)
[ 18.287857] ? shuffle_freelist (slub.c:?)
[ 18.287858] shuffle_freelist (slub.c:?)
[ 18.287858] ? page_address (??:?)
[ 18.287859] allocate_slab (slub.c:?)
[ 18.287860] new_slab (slub.c:?)
[ 18.287861] ? pvclock_clocksource_read (??:?)
[ 18.287862] ___slab_alloc+0x6d0/0xb20
[ 18.287862] ? kvm_sched_clock_read (kvmclock.c:?)
[ 18.287863] ? __slab_alloc+0xbc/0x2e0
[ 18.287864] ? native_wbinvd (paravirt.c:?)
[ 18.287865] __slab_alloc+0xd6/0x2e0
[ 18.287865] __kmalloc (??:?)
[ 18.287866] ? __lock_acquire (lockdep.c:?)
[ 18.287867] ? tty_buffer_alloc (tty_buffer.c:?)
[ 18.287868] tty_buffer_alloc (tty_buffer.c:?)
[ 18.287869] __tty_buffer_request_room (tty_buffer.c:?)
[ 18.287869] tty_insert_flip_string_fixed_flag (??:?)
[ 18.287870] pty_write (pty.c:?)
[ 18.287871] process_output_block (n_tty.c:?)
[ 18.287872] n_tty_write (n_tty.c:?)
[ 18.287873] ? print_dl_stats (??:?)
[ 18.287874] ? n_tty_ioctl (n_tty.c:?)
[ 18.287874] tty_write (tty_io.c:?)
[ 18.287875] ? n_tty_ioctl (n_tty.c:?)
[ 18.287876] ? tty_write_unlock (tty_io.c:?)
[ 18.287877] __vfs_write (??:?)
[ 18.287877] vfs_write (??:?)
[ 18.287878] ? __fget_light (file.c:?)
[ 18.287879] ksys_write (??:?)--- drivers/char/random.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/random.c +2 -2
@@ -183,8 +183,8 @@ static void __cold process_random_ready_#define warn_unseeded_randomness () \ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \ - pr_notice("%s called from %pS with crng_init=%d\n", \ - __func__, (void *)_RET_IP_, crng_init) + printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init=%d\n", \ + __func__, (void *)_RET_IP_, crng_init)/*********************************************************************
Greg Kroah-Hartman
maintainerPATCH 16/37 mm/mempolicy: fix uninit-value in mpol_rebind_policy()
In reply to Greg Kroah-HartmanFrom: Wang Cheng <[email protected]>
commit 018160ad314d75b1409129b2247b614a9f35894c upstream.
mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c).
BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
Uninit was created at:
slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae
KMSAN: uninit-value in mpol_rebind_task (2)
https://syzkaller.appspot.com/bug?id=d6eb90f952c2a5de9ea718a1b873c55cb13b59dc
This patch seems to fix below bug too.
KMSAN: uninit-value in mpol_rebind_mm (2)
https://syzkaller.appspot.com/bug?id=f2fecd0d7013f54ec4162f60743a2b28df40926b
The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(),
mpol_new() mm/mempolicy.c
do_mbind() mm/mempolicy.c
kernel_mbind() mm/mempolicy.c
mode is 1(MPOL_PREFERRED), nodes_empty(*nodes) is true and flags is 0. Then
mode = MPOL_LOCAL; ... policy->mode = mode; policy->flags = flags;
will be executed. So in mpol_set_nodemask(),
mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind()
pol->mode is 4 (MPOL_LOCAL), that nodemask in pol is not initialized, which will be accessed in mpol_rebind_policy().
--- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/mempolicy.c +1 -1
@@ -347,7 +347,7 @@ static void mpol_rebind_preferred(struct*/ static void mpol_rebind_policy (struct mempolicy *pol,const nodemask_t *newmask) { -if (!pol) +if (!pol || pol->mode ==MPOL_LOCAL )return ;if (!mpol_store_user_nodemask (pol) && !(pol->flags &MPOL_F_LOCAL ) &&nodes_equal (pol->w.cpuset_mems_allowed, *newmask))
Greg Kroah-Hartman
maintainerPATCH 17/37 bpf: Make sure mac_header was set before using it
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 0326195f523a549e0a9d7fd44c70b26fd7265090 upstream.
Classic BPF has a way to load bytes starting from the mac header.
Some skbs do not have a mac header, and skb_mac_header() in this case is returning a pointer that 65535 bytes after skb->head.
Existing range check in bpf_internal_load_pointer_neg_helper() was properly kicking and no illegal access was happening.
New sanity check in skb_mac_header() is firing, so we need to avoid it.
WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 skb_mac_header include/linux/skbuff.h:2785 [inline] WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.c:74 Modules linked in: CPU: 1 PID: 28990 Comm: syz-executor.0 Not tainted 5.19.0-rc4-syzkaller-00865-g4874fb9484be #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:skb_mac_header include/linux/skbuff.h:2785 [inline] RIP: 0010:bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.c:74 Code: ff ff 45 31 f6 e9 5a ff ff ff e8 aa 27 40 00 e9 3b ff ff ff e8 90 27 40 00 e9 df fe ff ff e8 86 27 40 00 eb 9e e8 2f 2c f3 ff <0f> 0b eb b1 e8 96 27 40 00 e9 79 fe ff ff 90 41 57 41 56 41 55 41 RSP: 0018:ffffc9000309f668 EFLAGS: 00010216 RAX: 0000000000000118 RBX: ffffffffffeff00c RCX: ffffc9000e417000 RDX: 0000000000040000 RSI: ffffffff81873f21 RDI: 0000000000000003 RBP: ffff8880842878c0 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000001 R12: 0000000000000004 R13: ffff88803ac56c00 R14: 000000000000ffff R15: dffffc0000000000 FS: 00007f5c88a16700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdaa9f6c058 CR3: 000000003a82c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ____bpf_skb_load_helper_32 net/core/filter.c:276 [inline] bpf_skb_load_helper_32+0x191/0x220 net/core/filter.c:264
--- kernel/bpf/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
kernel/bpf/core.c +5 -3
@@ -64,11 +64,13 @@ void *bpf_internal_load_pointer_neg_help {u8 *ptr =NULL ; -if (k >=SKF_NET_OFF ) +if (k >=SKF_NET_OFF ) { ptr =skb_network_header (skb) + k -SKF_NET_OFF ; -else if (k >=SKF_LL_OFF ) + }else if (k >=SKF_LL_OFF ) { +if (unlikely (!skb_mac_header_was_set (skb))) +return NULL ; ptr =skb_mac_header (skb) + k -SKF_LL_OFF ; - + }if (ptr >= skb->head && ptr + size <=skb_tail_pointer (skb))return ptr;
Greg Kroah-Hartman
maintainerPATCH 18/37 drm/tilcdc: Remove obsolete crtc_mode_valid() hack
In reply to Greg Kroah-HartmanFrom: Jyri Sarha <[email protected]>
[ Upstream commit 57d8396504b3a93f284e51b866740a3e7419a3d9 ]
Earlier there were no mode_valid() helper for crtc and tilcdc had a hack to over come this limitation. But now the mode_valid() helper is there (has been since v4.13), so it is about time to get rid of that hack.
--- drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 28 +++----- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 - drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 - drivers/gpu/drm/tilcdc/tilcdc_external.c | 88 +++--------------------- drivers/gpu/drm/tilcdc/tilcdc_external.h | 1 - drivers/gpu/drm/tilcdc/tilcdc_panel.c | 9 --- drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 9 --- 7 files changed, 19 insertions(+), 119 deletions(-)
drivers/gpu/drm/tilcdc/tilcdc_crtc.c +11 -17
@@ -707,9 +707,6 @@ static bool tilcdc_crtc_mode_fixup(struct drm_crtc *crtc,static int tilcdc_crtc_atomic_check (struct drm_crtc *crtc,struct drm_crtc_state *state) { -struct drm_display_mode *mode = &state->mode; -int ret; -/* If we are not active we don't care */ if (!state->active)return 0 ;
@@ -721,12 +718,6 @@ static int tilcdc_crtc_atomic_check(struct drm_crtc *crtc,return -EINVAL ; } - ret =tilcdc_crtc_mode_valid (crtc, mode); -if (ret) { -dev_dbg (crtc->dev->dev,"Mode \"%s\" not valid" , mode->name); -return -EINVAL ; - } -return 0 ; }
@@ -750,13 +741,6 @@ static const struct drm_crtc_funcs tilcdc_crtc_funcs = { .disable_vblank = tilcdc_crtc_disable_vblank, }; -static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs = { - .mode_fixup = tilcdc_crtc_mode_fixup, - .atomic_check = tilcdc_crtc_atomic_check, - .atomic_enable = tilcdc_crtc_atomic_enable, - .atomic_disable = tilcdc_crtc_atomic_disable, -}; -int tilcdc_crtc_max_width (struct drm_crtc *crtc) {struct drm_device *dev = crtc->dev;
@@ -771,7 +755,9 @@ int tilcdc_crtc_max_width(struct drm_crtc *crtc)return max_width; } -int tilcdc_crtc_mode_valid (struct drm_crtc *crtc,struct drm_display_mode *mode) +static enum drm_mode_status +tilcdc_crtc_mode_valid (struct drm_crtc *crtc, +const struct drm_display_mode *mode) {struct tilcdc_drm_private *priv = crtc->dev->dev_private;unsigned int bandwidth;
@@ -859,6 +845,14 @@ int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode *mode)return MODE_OK ; } +static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs = { + .mode_valid = tilcdc_crtc_mode_valid, + .mode_fixup = tilcdc_crtc_mode_fixup, + .atomic_check = tilcdc_crtc_atomic_check, + .atomic_enable = tilcdc_crtc_atomic_enable, + .atomic_disable = tilcdc_crtc_atomic_disable, +}; +void tilcdc_crtc_set_panel_info (struct drm_crtc *crtc,const struct tilcdc_panel_info *info) {
drivers/gpu/drm/tilcdc/tilcdc_drv.c +0 -1
@@ -208,7 +208,6 @@ static void tilcdc_fini(struct drm_device *dev)drm_irq_uninstall (dev);drm_mode_config_cleanup (dev); -tilcdc_remove_external_device (dev);if (priv->clk)clk_put (priv->clk);
drivers/gpu/drm/tilcdc/tilcdc_drv.h +0 -2
@@ -91,7 +91,6 @@ struct tilcdc_drm_private {struct drm_encoder *external_encoder;struct drm_connector *external_connector; -const struct drm_connector_helper_funcs *connector_funcs;bool is_registered;bool is_componentized;
@@ -173,7 +172,6 @@ void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc, const struct tilcdc_panel_info *info);void tilcdc_crtc_set_simulate_vesa_sync (struct drm_crtc *crtc,bool simulate_vesa_sync); -int tilcdc_crtc_mode_valid (struct drm_crtc *crtc,struct drm_display_mode *mode);int tilcdc_crtc_max_width (struct drm_crtc *crtc);void tilcdc_crtc_shutdown (struct drm_crtc *crtc); int tilcdc_crtc_update_fb(struct drm_crtc *crtc,
drivers/gpu/drm/tilcdc/tilcdc_external.c +8 -80
127 lines not on this page · raw message
drivers/gpu/drm/tilcdc/tilcdc_external.h +0 -1
@@ -19,7 +19,6 @@#define __TILCDC_EXTERNAL_H__int tilcdc_add_component_encoder (struct drm_device *dev); -void tilcdc_remove_external_device (struct drm_device *dev);int tilcdc_get_external_components (struct device *dev,struct component_match **match);int tilcdc_attach_external_device (struct drm_device *ddev);
drivers/gpu/drm/tilcdc/tilcdc_panel.c +0 -9
@@ -176,14 +176,6 @@ static int panel_connector_get_modes(struct drm_connector *connector)return i; } -static int panel_connector_mode_valid (struct drm_connector *connector, -struct drm_display_mode *mode) -{ -struct tilcdc_drm_private *priv = connector->dev->dev_private; -/* our only constraints are what the crtc can generate: */ -return tilcdc_crtc_mode_valid (priv->crtc, mode); -} -static struct drm_encoder *panel_connector_best_encoder (struct drm_connector *connector) {
@@ -201,7 +193,6 @@ static const struct drm_connector_funcs panel_connector_funcs = {static const struct drm_connector_helper_funcs panel_connector_helper_funcs = { .get_modes = panel_connector_get_modes, - .mode_valid = panel_connector_mode_valid, .best_encoder = panel_connector_best_encoder, };
drivers/gpu/drm/tilcdc/tilcdc_tfp410.c +0 -9
@@ -185,14 +185,6 @@ static int tfp410_connector_get_modes(struct drm_connector *connector)return ret; } -static int tfp410_connector_mode_valid (struct drm_connector *connector, -struct drm_display_mode *mode) -{ -struct tilcdc_drm_private *priv = connector->dev->dev_private; -/* our only constraints are what the crtc can generate: */ -return tilcdc_crtc_mode_valid (priv->crtc, mode); -} -static struct drm_encoder *tfp410_connector_best_encoder (struct drm_connector *connector) {
@@ -211,7 +203,6 @@ static const struct drm_connector_funcs tfp410_connector_funcs = {static const struct drm_connector_helper_funcs tfp410_connector_helper_funcs = { .get_modes = tfp410_connector_get_modes, - .mode_valid = tfp410_connector_mode_valid, .best_encoder = tfp410_connector_best_encoder, };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 19/37 tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator
In reply to Greg Kroah-HartmanFrom: Xiaomeng Tong <[email protected]>
[ Upstream commit 8b917cbe38e9b0d002492477a9fc2bfee2412ce4 ]
The bug is here:
if (!encoder) {The list iterator value 'encoder' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found.
To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'encoder' as a dedicated pointer to point to the found element.
--- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/gpu/drm/tilcdc/tilcdc_external.c +5 -3
@@ -61,11 +61,13 @@ struct drm_connector *tilcdc_encoder_find_connector(struct drm_device *ddev,int tilcdc_add_component_encoder (struct drm_device *ddev) {struct tilcdc_drm_private *priv = ddev->dev_private; -struct drm_encoder *encoder; +struct drm_encoder *encoder =NULL , *iter; -list_for_each_entry (encoder, &ddev->mode_config.encoder_list, head) -if (encoder->possible_crtcs & (1 << priv->crtc->index)) +list_for_each_entry (iter, &ddev->mode_config.encoder_list, head) +if (iter->possible_crtcs & (1 << priv->crtc->index)) { + encoder = iter;break ; + }if (!encoder) {dev_err (ddev->dev,"%s: No suitable encoder found\n" , __func__);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 20/37 ALSA: memalloc: Align buffer allocations in page size
In reply to Greg Kroah-HartmanFrom: Takashi Iwai <[email protected]>
commit 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e upstream.
Currently the standard memory allocator (snd_dma_malloc_pages*()) passes the byte size to allocate as is. Most of the backends allocates real pages, hence the actual allocations are aligned in page size. However, the genalloc doesn't seem assuring the size alignment, hence it may result in the access outside the buffer when the whole memory pages are exposed via mmap.
For avoiding such inconsistencies, this patch makes the allocation size always to be aligned in page size.
Note that, after this change, snd_dma_buffer.bytes field contains the aligned size, not the originally requested size. This value is also used for releasing the pages in return.
--- sound/core/memalloc.c | 1 + 1 file changed, 1 insertion(+)
sound/core/memalloc.c +1 -0
@@ -179,6 +179,7 @@ int snd_dma_alloc_pages(int type, structif (WARN_ON (!dmab))return -ENXIO ; + size =PAGE_ALIGN (size); dmab->dev.type = type; dmab->dev.dev = device; dmab->bytes =0 ;
Greg Kroah-Hartman
maintainerPATCH 21/37 Bluetooth: Add bt_skb_sendmsg helper
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 38f64f650dc0e44c146ff88d15a7339efa325918 upstream.
bt_skb_sendmsg helps takes care of allocation the skb and copying the the contents of msg over to the skb while checking for possible errors so it should be safe to call it without holding lock_sock.
--- include/net/bluetooth/bluetooth.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+)
include/net/bluetooth/bluetooth.h +28 -0
@@ -367,6 +367,34 @@ out:return NULL ; } +/* Shall not be called with lock_sock held */ +static inline struct sk_buff *bt_skb_sendmsg (struct sock *sk, +struct msghdr *msg, +size_t len,size_t mtu, +size_t headroom,size_t tailroom) +{ +struct sk_buff *skb; +size_t size =min_t (size_t, len, mtu); +int err; + + skb =bt_skb_send_alloc (sk, size + headroom + tailroom, + msg->msg_flags &MSG_DONTWAIT , &err); +if (!skb) +return ERR_PTR (err); + +skb_reserve (skb, headroom); +skb_tailroom_reserve (skb, mtu, tailroom); + +if (!copy_from_iter_full (skb_put (skb, size), size, &msg->msg_iter)) { +kfree_skb (skb); +return ERR_PTR (-EFAULT ); + } + + skb->priority = sk->sk_priority; + +return skb; +} +int bt_to_errno (u16 code);void hci_sock_set_flag (struct sock *sk,int nr);
Greg Kroah-Hartman
maintainerPATCH 22/37 Bluetooth: Add bt_skb_sendmmsg helper
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 97e4e80299844bb5f6ce5a7540742ffbffae3d97 upstream.
This works similarly to bt_skb_sendmsg but can split the msg into multiple skb fragments which is useful for stream sockets.
--- include/net/bluetooth/bluetooth.h | 38 ++++++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+)
include/net/bluetooth/bluetooth.h +38 -0
@@ -395,6 +395,44 @@ static inline struct sk_buff *bt_skb_senreturn skb; } +/* Similar to bt_skb_sendmsg but can split the msg into multiple fragments +* accourding to the MTU. +*/ +static inline struct sk_buff *bt_skb_sendmmsg (struct sock *sk, +struct msghdr *msg, +size_t len,size_t mtu, +size_t headroom,size_t tailroom) +{ +struct sk_buff *skb, **frag; + + skb =bt_skb_sendmsg (sk, msg, len, mtu, headroom, tailroom); +if (IS_ERR_OR_NULL (skb)) +return skb; + + len -= skb->len; +if (!len) +return skb; + +/* Add remaining data over MTU as continuation fragments */ + frag = &skb_shinfo (skb)->frag_list; +while (len) { +struct sk_buff *tmp; + + tmp =bt_skb_sendmsg (sk, msg, len, mtu, headroom, tailroom); +if (IS_ERR_OR_NULL (tmp)) { +kfree_skb (skb); +return tmp; + } + + len -= tmp->len; + + *frag = tmp; + frag = &(*frag)->next; + } + +return skb; +} +int bt_to_errno (u16 code);void hci_sock_set_flag (struct sock *sk,int nr);
Greg Kroah-Hartman
maintainerPATCH 23/37 Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 0771cbb3b97d3c1d68eecd7f00055f599954c34e upstream.
This makes use of bt_skb_sendmsg instead of allocating a different buffer to be used with memcpy_from_msg which cause one extra copy.
--- net/bluetooth/sco.c | 34 +++++++++++----------------------- 1 file changed, 11 insertions(+), 23 deletions(-)
net/bluetooth/sco.c +11 -23
@@ -279,27 +279,19 @@ static int sco_connect(struct hci_dev *hreturn err; } -static int sco_send_frame (struct sock *sk,void *buf,int len, -unsigned int msg_flags) +static int sco_send_frame (struct sock *sk,struct sk_buff *skb) {struct sco_conn *conn =sco_pi (sk)->conn; -struct sk_buff *skb; -int err;/* Check outgoing MTU */ -if (len > conn->mtu) +if (skb->len > conn->mtu)return -EINVAL ; -BT_DBG ("sk %p len %d" , sk, len); - - skb =bt_skb_send_alloc (sk, len, msg_flags &MSG_DONTWAIT , &err); -if (!skb) -return err; +BT_DBG ("sk %p len %d" , sk, skb->len); -memcpy (skb_put (skb, len), buf, len);hci_send_sco (conn->hcon, skb); -return len; +return skb->len; }static void sco_recv_frame (struct sco_conn *conn,struct sk_buff *skb)
@@ -716,7 +708,7 @@ static int sco_sock_sendmsg(struct socke size_t len) {struct sock *sk = sock->sk; -void *buf; +struct sk_buff *skb;int err;BT_DBG ("sock %p, sk %p" , sock, sk);
@@ -728,24 +720,20 @@ static int sco_sock_sendmsg(struct sockeif (msg->msg_flags &MSG_OOB )return -EOPNOTSUPP ; - buf =kmalloc (len,GFP_KERNEL ); -if (!buf) -return -ENOMEM ; - -if (memcpy_from_msg (buf, msg, len)) { -kfree (buf); -return -EFAULT ; - } + skb =bt_skb_sendmsg (sk, msg, len, len,0 ,0 ); +if (IS_ERR_OR_NULL (skb)) +return PTR_ERR (skb);lock_sock (sk);if (sk->sk_state ==BT_CONNECTED ) - err =sco_send_frame (sk, buf, len, msg->msg_flags); + err =sco_send_frame (sk, skb);else err = -ENOTCONN ;release_sock (sk); -kfree (buf); +if (err) +kfree_skb (skb);return err; }
Greg Kroah-Hartman
maintainerPATCH 24/37 Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 81be03e026dc0c16dc1c64e088b2a53b73caa895 upstream.
This makes use of bt_skb_sendmmsg instead using memcpy_from_msg which is not considered safe to be used when lock_sock is held.
Also make rfcomm_dlc_send handle skb with fragments and queue them all atomically.
--- net/bluetooth/rfcomm/core.c | 50 +++++++++++++++++++++++++++++++++++++------- net/bluetooth/rfcomm/sock.c | 50 ++++++++++---------------------------------- 2 files changed, 55 insertions(+), 45 deletions(-)
net/bluetooth/rfcomm/core.c +43 -7
@@ -552,22 +552,58 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bdareturn dlc; } +static int rfcomm_dlc_send_frag (struct rfcomm_dlc *d,struct sk_buff *frag) +{ +int len = frag->len; + +BT_DBG ("dlc %p mtu %d len %d" , d, d->mtu, len); + +if (len > d->mtu) +return -EINVAL ; + +rfcomm_make_uih (frag, d->addr); +__skb_queue_tail (&d->tx_queue, frag); + +return len; +} +int rfcomm_dlc_send (struct rfcomm_dlc *d,struct sk_buff *skb) { -int len = skb->len; +unsigned long flags; +struct sk_buff *frag, *next; +int len;if (d->state !=BT_CONNECTED )return -ENOTCONN ; -BT_DBG ("dlc %p mtu %d len %d" , d, d->mtu, len); + frag =skb_shinfo (skb)->frag_list; +skb_shinfo (skb)->frag_list =NULL ; -if (len > d->mtu) -return -EINVAL ; +/* Queue all fragments atomically. */ +spin_lock_irqsave (&d->tx_queue.lock, flags); + + len =rfcomm_dlc_send_frag (d, skb); +if (len <0 || !frag) + goto unlock; + +for (; frag; frag = next) { +int ret; + + next = frag->next; + + ret =rfcomm_dlc_send_frag (d, frag); +if (ret <0 ) { +kfree_skb (frag); + goto unlock; + } + + len += ret; + } -rfcomm_make_uih (skb, d->addr); -skb_queue_tail (&d->tx_queue, skb); +unlock: +spin_unlock_irqrestore (&d->tx_queue.lock, flags); -if (!test_bit (RFCOMM_TX_THROTTLED , &d->flags)) +if (len >0 && !test_bit (RFCOMM_TX_THROTTLED , &d->flags))rfcomm_schedule ();return len; }
net/bluetooth/rfcomm/sock.c +12 -38
59 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 25/37 Bluetooth: Fix passing NULL to PTR_ERR
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 266191aa8d14b84958aaeb5e96ee4e97839e3d87 upstream.
Passing NULL to PTR_ERR will result in 0 (success), also since the likes of bt_skb_sendmsg does never return NULL it is safe to replace the instances of IS_ERR_OR_NULL with IS_ERR when checking its return.
--- include/net/bluetooth/bluetooth.h | 2 +- net/bluetooth/rfcomm/sock.c | 2 +- net/bluetooth/sco.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-)
include/net/bluetooth/bluetooth.h +1 -1
@@ -419,7 +419,7 @@ static inline struct sk_buff *bt_skb_senstruct sk_buff *tmp; tmp =bt_skb_sendmsg (sk, msg, len, mtu, headroom, tailroom); -if (IS_ERR_OR_NULL (tmp)) { +if (IS_ERR (tmp)) {kfree_skb (skb);return tmp; }
net/bluetooth/rfcomm/sock.c +1 -1
@@ -586,7 +586,7 @@ static int rfcomm_sock_sendmsg(struct so skb =bt_skb_sendmmsg (sk, msg, len, d->mtu,RFCOMM_SKB_HEAD_RESERVE ,RFCOMM_SKB_TAIL_RESERVE ); -if (IS_ERR_OR_NULL (skb)) +if (IS_ERR (skb))return PTR_ERR (skb); sent =rfcomm_dlc_send (d, skb);
net/bluetooth/sco.c +1 -1
@@ -721,7 +721,7 @@ static int sco_sock_sendmsg(struct sockereturn -EOPNOTSUPP ; skb =bt_skb_sendmsg (sk, msg, len, len,0 ,0 ); -if (IS_ERR_OR_NULL (skb)) +if (IS_ERR (skb))return PTR_ERR (skb);lock_sock (sk);
Greg Kroah-Hartman
maintainerPATCH 26/37 Bluetooth: SCO: Fix sco_send_frame returning skb->len
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 037ce005af6b8a3e40ee07c6e9266c8997e6a4d6 upstream.
The skb in modified by hci_send_sco which pushes SCO headers thus changing skb->len causing sco_sock_sendmsg to fail.
--- net/bluetooth/sco.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
net/bluetooth/sco.c +6 -4
@@ -282,16 +282,17 @@ static int sco_connect(struct hci_dev *hstatic int sco_send_frame (struct sock *sk,struct sk_buff *skb) {struct sco_conn *conn =sco_pi (sk)->conn; +int len = skb->len;/* Check outgoing MTU */ -if (skb->len > conn->mtu) +if (len > conn->mtu)return -EINVAL ; -BT_DBG ("sk %p len %d" , sk, skb->len); +BT_DBG ("sk %p len %d" , sk, len);hci_send_sco (conn->hcon, skb); -return skb->len; +return len; }static void sco_recv_frame (struct sco_conn *conn,struct sk_buff *skb)
@@ -732,7 +733,8 @@ static int sco_sock_sendmsg(struct socke err = -ENOTCONN ;release_sock (sk); -if (err) + +if (err <0 )kfree_skb (skb);return err; }
Greg Kroah-Hartman
maintainerPATCH 27/37 Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 29fb608396d6a62c1b85acc421ad7a4399085b9f upstream.
Since bt_skb_sendmmsg can be used with the likes of SOCK_STREAM it shall return the partial chunks it could allocate instead of freeing everything as otherwise it can cause problems like bellow.
--- include/net/bluetooth/bluetooth.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
include/net/bluetooth/bluetooth.h +1 -2
@@ -420,8 +420,7 @@ static inline struct sk_buff *bt_skb_sen tmp =bt_skb_sendmsg (sk, msg, len, mtu, headroom, tailroom);if (IS_ERR (tmp)) { -kfree_skb (skb); -return tmp; +return skb; } len -= tmp->len;
Greg Kroah-Hartman
maintainerPATCH 28/37 tty: drivers/tty/, stop using tty_schedule_flip()
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream.
Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/.
--- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-)
drivers/tty/cyclades.c +3 -3
@@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_ } info->idle_stats.recv_idle = jiffies; } -tty_schedule_flip (port); +tty_flip_buffer_push (port);/* end of service */ cyy_writeb (info, CyRIR, save_xir &0x3f );
@@ -998,7 +998,7 @@ static void cyz_handle_rx(struct cyclade jiffies + 1);#endif info->idle_stats.recv_idle = jiffies; -tty_schedule_flip (&info->port); +tty_flip_buffer_push (&info->port);/* Update rx_get */ cy_writel (&buf_ctrl->rx_get, new_rx_get);
@@ -1174,7 +1174,7 @@ static void cyz_handle_cmd(struct cycladif (delta_count)wake_up_interruptible (&info->port.delta_msr_wait);if (special_count) -tty_schedule_flip (&info->port); +tty_flip_buffer_push (&info->port); } }
drivers/tty/goldfish.c +1 -1
@@ -159,7 +159,7 @@ static irqreturn_t goldfish_tty_interrup address = (unsigned long )(void *)buf;goldfish_tty_rw (qtty, address, count,0 ); -tty_schedule_flip (&qtty->port); +tty_flip_buffer_push (&qtty->port);return IRQ_HANDLED ; }
drivers/tty/moxa.c +2 -2
@@ -1397,7 +1397,7 @@ static int moxa_poll_port(struct moxa_poif (inited && !tty_throttled (tty) &&MoxaPortRxQueue (p) >0 ) {/* RX */ MoxaPortReadData (p); -tty_schedule_flip (&p->port); +tty_flip_buffer_push (&p->port); } }else {clear_bit (EMPTYWAIT , &p->statusflags);
@@ -1422,7 +1422,7 @@ static int moxa_poll_port(struct moxa_poif (tty && (intr & IntrBreak) && !I_IGNBRK (tty)) {/* BREAK */ tty_insert_flip_char (&p->port,0 ,TTY_BREAK ); -tty_schedule_flip (&p->port); +tty_flip_buffer_push (&p->port); }if (intr & IntrLine)
drivers/tty/serial/lpc32xx_hs.c +1 -1
@@ -350,7 +350,7 @@ static irqreturn_t serial_lpc32xx_interr LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++;tty_insert_flip_char (tport,0 ,TTY_OVERRUN ); -tty_schedule_flip (tport); +tty_flip_buffer_push (tport); }/* Data received? */
drivers/tty/vt/keyboard.c +3 -3
@@ -309,7 +309,7 @@ int kbd_rate(struct kbd_repeat *rpt)static void put_queue (struct vc_data *vc,int ch) {tty_insert_flip_char (&vc->port, ch,0 ); -tty_schedule_flip (&vc->port); +tty_flip_buffer_push (&vc->port); }static void puts_queue (struct vc_data *vc,char *cp)
@@ -318,7 +318,7 @@ static void puts_queue(struct vc_data *vtty_insert_flip_char (&vc->port, *cp,0 ); cp++; } -tty_schedule_flip (&vc->port); +tty_flip_buffer_push (&vc->port); }static void applkey (struct vc_data *vc,int key,char mode)
@@ -563,7 +563,7 @@ static void fn_inc_console(struct vc_datstatic void fn_send_intr (struct vc_data *vc) {tty_insert_flip_char (&vc->port,0 ,TTY_BREAK ); -tty_schedule_flip (&vc->port); +tty_flip_buffer_push (&vc->port); }static void fn_scroll_forw (struct vc_data *vc)
drivers/tty/vt/vt.c +1 -1
@@ -1482,7 +1482,7 @@ static void respond_string(const char *ptty_insert_flip_char (port, *p,0 ); p++; } -tty_schedule_flip (port); +tty_flip_buffer_push (port); }static void cursor_report (struct vc_data *vc,struct tty_struct *tty)
Greg Kroah-Hartman
maintainerPATCH 29/37 tty: the rest, stop using tty_schedule_flip()
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit b68b914494df4f79b4e9b58953110574af1cb7a2 upstream.
Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in the rest of the users.
--- arch/alpha/kernel/srmcons.c | 2 +- drivers/s390/char/keyboard.h | 4 ++-- drivers/staging/speakup/spk_ttyio.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-)
arch/alpha/kernel/srmcons.c +1 -1
@@ -59,7 +59,7 @@ srmcons_do_receive_chars(struct tty_port }while ((result.bits.status &1 ) && (++loops <10 ));if (count) -tty_schedule_flip (port); +tty_flip_buffer_push (port);return count; }
drivers/s390/char/keyboard.h +2 -2
@@ -45,7 +45,7 @@ static inline void kbd_put_queue(struct tty_port *port, int ch) { tty_insert_flip_char(port, ch, 0); -tty_schedule_flip (port); +tty_flip_buffer_push (port); } static inline void
@@ -53,5 +53,5 @@ kbd_puts_queue(struct tty_port *port, ch {while (*cp)tty_insert_flip_char (port, *cp++,0 ); -tty_schedule_flip (port); +tty_flip_buffer_push (port); }
drivers/staging/speakup/spk_ttyio.c +2 -2
@@ -87,7 +87,7 @@ static int spk_ttyio_receive_buf2(struct }if (!ldisc_data->buf_free) -/* ttyio_in will tty_schedule_flip */ +/* ttyio_in will tty_flip_buffer_push */ return 0 ;/* Make sure the consumer has read buf before we have seen
@@ -299,7 +299,7 @@ static unsigned char ttyio_in(int timeoumb (); ldisc_data->buf_free = true;/* Let TTY push more characters */ -tty_schedule_flip (speakup_tty->port); +tty_flip_buffer_push (speakup_tty->port);return rv; }
Greg Kroah-Hartman
maintainerPATCH 30/37 tty: drop tty_schedule_flip()
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 5db96ef23bda6c2a61a51693c85b78b52d03f654 upstream.
Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). All users were converted in the previous patches, so remove tty_schedule_flip() completely while inlining its body into tty_flip_buffer_push().
One less exported function.
--- drivers/tty/tty_buffer.c | 30 ++++++++---------------------- include/linux/tty_flip.h | 1 - 2 files changed, 8 insertions(+), 23 deletions(-)
drivers/tty/tty_buffer.c +8 -22
@@ -389,27 +389,6 @@ int __tty_insert_flip_char(struct tty_poEXPORT_SYMBOL (__tty_insert_flip_char);/** -* tty_schedule_flip - push characters to ldisc -* @port: tty port to push from -* -* Takes any pending buffers and transfers their ownership to the -* ldisc side of the queue. It then schedules those characters for -* processing by the line discipline. -*/ - -void tty_schedule_flip (struct tty_port *port) -{ -struct tty_bufhead *buf = &port->buf; - -/* paired w/ acquire in flush_to_ldisc(); ensures -* flush_to_ldisc() sees buffer data. -*/ -smp_store_release (&buf->tail->commit, buf->tail->used); -queue_work (system_unbound_wq, &buf->work); -} -EXPORT_SYMBOL (tty_schedule_flip); - -/** * tty_prepare_flip_string - make room for characters * @port: tty port * @chars: return pointer for character write area
@@ -551,7 +530,14 @@ static void flush_to_ldisc(struct work_svoid tty_flip_buffer_push (struct tty_port *port) { -tty_schedule_flip (port); +struct tty_bufhead *buf = &port->buf; + +/* +* Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees +* buffer data. +*/ +smp_store_release (&buf->tail->commit, buf->tail->used); +queue_work (system_unbound_wq, &buf->work); }EXPORT_SYMBOL (tty_flip_buffer_push);
include/linux/tty_flip.h +0 -1
@@ -12,7 +12,6 @@ extern int tty_insert_flip_string_fixed_extern int tty_prepare_flip_string (struct tty_port *port,unsigned char **chars,size_t size);extern void tty_flip_buffer_push (struct tty_port *port); -void tty_schedule_flip (struct tty_port *port);int __tty_insert_flip_char (struct tty_port *port,unsigned char ch,char flag); static inline int tty_insert_flip_char(struct tty_port *port,
Greg Kroah-Hartman
maintainerPATCH 31/37 tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push()
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit 716b10580283fda66f2b88140e3964f8a7f9da89 upstream.
We will need this new helper in the next patch.
--- drivers/tty/tty_buffer.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/tty/tty_buffer.c +10 -5
@@ -517,6 +517,15 @@ static void flush_to_ldisc(struct work_s } +static inline void tty_flip_buffer_commit (struct tty_buffer *tail) +{ +/* +* Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees +* buffer data. +*/ +smp_store_release (&tail->commit, tail->used); +} +/** * tty_flip_buffer_push - terminal * @port: tty port to push
@@ -532,11 +541,7 @@ void tty_flip_buffer_push(struct tty_por {struct tty_bufhead *buf = &port->buf; -/* -* Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees -* buffer data. -*/ -smp_store_release (&buf->tail->commit, buf->tail->used); +tty_flip_buffer_commit (buf->tail);queue_work (system_unbound_wq, &buf->work); }EXPORT_SYMBOL (tty_flip_buffer_push);
Greg Kroah-Hartman
maintainerPATCH 32/37 tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()
In reply to Greg Kroah-HartmanFrom: Jiri Slaby <[email protected]>
commit a501ab75e7624d133a5a3c7ec010687c8b961d23 upstream.
There is a race in pty_write(). pty_write() can be called in parallel with e.g. ioctl(TIOCSTI) or ioctl(TCXONC) which also inserts chars to the buffer. Provided, tty_flip_buffer_push() in pty_write() is called outside the lock, it can commit inconsistent tail. This can lead to out of bounds writes and other issues. See the Link below.
To fix this, we have to introduce a new helper called tty_insert_flip_string_and_push_buffer(). It does both tty_insert_flip_string() and tty_flip_buffer_commit() under the port lock. It also calls queue_work(), but outside the lock. See 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty_write) for the reasons.
Keep the helper internal-only (in drivers' tty.h). It is not intended to be used widely.
--- drivers/tty/pty.c | 14 ++------------ drivers/tty/tty_buffer.c | 31 +++++++++++++++++++++++++++++++ include/linux/tty_flip.h | 3 +++ 3 files changed, 36 insertions(+), 12 deletions(-)
drivers/tty/pty.c +2 -12
@@ -111,21 +111,11 @@ static void pty_unthrottle(struct tty_ststatic int pty_write (struct tty_struct *tty,const unsigned char *buf,int c) {struct tty_struct *to = tty->link; -unsigned long flags; -if (tty->stopped) +if (tty->stopped || !c)return 0 ; -if (c >0 ) { -spin_lock_irqsave (&to->port->lock, flags); -/* Stuff the data into the input queue of the other end */ - c =tty_insert_flip_string (to->port, buf, c); -spin_unlock_irqrestore (&to->port->lock, flags); -/* And shovel */ -if (c) -tty_flip_buffer_push (to->port); - } -return c; +return tty_insert_flip_string_and_push_buffer (to->port, buf, c); }/**
drivers/tty/tty_buffer.c +31 -0
@@ -547,6 +547,37 @@ void tty_flip_buffer_push(struct tty_porEXPORT_SYMBOL (tty_flip_buffer_push);/** +* tty_insert_flip_string_and_push_buffer - add characters to the tty buffer and +* push +* @port: tty port +* @chars: characters +* @size: size +* +* The function combines tty_insert_flip_string() and tty_flip_buffer_push() +* with the exception of properly holding the @port->lock. +* +* To be used only internally (by pty currently). +* +* Returns: the number added. +*/ +int tty_insert_flip_string_and_push_buffer (struct tty_port *port, +const unsigned char *chars,size_t size) +{ +struct tty_bufhead *buf = &port->buf; +unsigned long flags; + +spin_lock_irqsave (&port->lock, flags); + size =tty_insert_flip_string (port, chars, size); +if (size) +tty_flip_buffer_commit (buf->tail); +spin_unlock_irqrestore (&port->lock, flags); + +queue_work (system_unbound_wq, &buf->work); + +return size; +} + +/** * tty_buffer_init - prepare a tty buffer structure * @tty: tty to initialise *
include/linux/tty_flip.h +3 -0
@@ -39,4 +39,7 @@ static inline int tty_insert_flip_stringextern void tty_buffer_lock_exclusive (struct tty_port *port);extern void tty_buffer_unlock_exclusive (struct tty_port *port); +int tty_insert_flip_string_and_push_buffer (struct tty_port *port, +const unsigned char *chars,size_t cnt); +#endif /* _LINUX_TTY_FLIP_H */
Greg Kroah-Hartman
maintainerPATCH 33/37 net: usb: ax88179_178a needs FLAG_SEND_ZLP
In reply to Greg Kroah-HartmanFrom: Jose Alonso <[email protected]>
commit 36a15e1cb134c0395261ba1940762703f778438c upstream.
The extra byte inserted by usbnet.c when
(length % dev->maxpacket == 0) is causing problems to device.
This patch sets FLAG_SEND_ZLP to avoid this.
Tested with: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet
Problems observed:
======================================================================
1) Using ssh/sshfs. The remote sshd daemon can abort with the message:
"message authentication code incorrect"
This happens because the tcp message sent is corrupted during the USB "Bulk out". The device calculate the tcp checksum and send a valid tcp message to the remote sshd. Then the encryption detects the error and aborts.
2) NETDEV WATCHDOG: ... (ax88179_178a): transmit queue 0 timed out
3) Stop normal work without any log message.
The "Bulk in" continue receiving packets normally.
The host sends "Bulk out" and the device responds with -ECONNRESET. (The netusb.c code tx_complete ignore -ECONNRESET)
Under normal conditions these errors take days to happen and in intense usage take hours.
A test with ping gives packet loss, showing that something is wrong:
ping -4 -s 462 {destination} # 462 = 512 - 42 - 8
Not all packets fail.
My guess is that the device tries to find another packet starting at the extra byte and will fail or not depending on the next bytes (old buffer content).
======================================================================
--- drivers/net/usb/ax88179_178a.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/usb/ax88179_178a.c +8 -8
@@ -1707,7 +1707,7 @@ static const struct driver_info ax88179_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1720,7 +1720,7 @@ static const struct driver_info ax88178a .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1733,7 +1733,7 @@ static const struct driver_info cypress_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1746,7 +1746,7 @@ static const struct driver_info dlink_du .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1759,7 +1759,7 @@ static const struct driver_info sitecom_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1772,7 +1772,7 @@ static const struct driver_info samsung_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1785,7 +1785,7 @@ static const struct driver_info lenovo_i .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1798,7 +1798,7 @@ static const struct driver_info belkin_i .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX, + .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
Greg Kroah-Hartman
maintainerPATCH 34/37 PCI: hv: Fix multi-MSI to allow more than one MSI vector
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit 08e61e861a0e47e5e1a3fb78406afd6b0cea6b6d upstream.
If the allocation of multiple MSI vectors for multi-MSI fails in the core PCI framework, the framework will retry the allocation as a single MSI vector, assuming that meets the min_vecs specified by the requesting driver.
Hyper-V advertises that multi-MSI is supported, but reuses the VECTOR domain to implement that for x86. The VECTOR domain does not support multi-MSI, so the alloc will always fail and fallback to a single MSI allocation.
In short, Hyper-V advertises a capability it does not implement.
Hyper-V can support multi-MSI because it coordinates with the hypervisor to map the MSIs in the IOMMU's interrupt remapper, which is something the VECTOR domain does not have. Therefore the fix is simple - copy what the x86 IOMMU drivers (AMD/Intel-IR) do by removing X86_IRQ_ALLOC_CONTIGUOUS_VECTORS after calling the VECTOR domain's pci_msi_prepare().
4.14 backport - file location change to host/pci-hyperv.c. adds the hv_msi_prepare wrapper function. X86_IRQ_ALLOC_TYPE_PCI_MSI changed to X86_IRQ_ALLOC_TYPE_MSI (same value).
--- drivers/pci/host/pci-hyperv.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
drivers/pci/host/pci-hyperv.c +16 -1
@@ -908,6 +908,21 @@ static void hv_irq_mask(struct irq_datapci_msi_mask_irq (data); } +static int hv_msi_prepare (struct irq_domain *domain,struct device *dev, +int nvec,msi_alloc_info_t *info) +{ +int ret =pci_msi_prepare (domain, dev, nvec, info); + +/* +* By using the interrupt remapper in the hypervisor IOMMU, contiguous +* CPU vectors is not needed for multi-MSI +*/ +if (info->type ==X86_IRQ_ALLOC_TYPE_MSI ) + info->flags &= ~X86_IRQ_ALLOC_CONTIGUOUS_VECTORS ; + +return ret; +} +/** * hv_irq_unmask() - "Unmask" the IRQ by setting its current * affinity.
@@ -1259,7 +1274,7 @@ static irq_hw_number_t hv_msi_domain_opsstatic struct msi_domain_ops hv_msi_ops = { .get_hwirq = hv_msi_domain_ops_get_hwirq, - .msi_prepare = pci_msi_prepare, + .msi_prepare = hv_msi_prepare, .set_desc = pci_msi_set_desc, .msi_free = hv_msi_free, };
Greg Kroah-Hartman
maintainerPATCH 35/37 PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit 455880dfe292a2bdd3b4ad6a107299fce610e64b upstream.
In the multi-MSI case, hv_arch_irq_unmask() will only operate on the first MSI of the N allocated. This is because only the first msi_desc is cached and it is shared by all the MSIs of the multi-MSI block. This means that hv_arch_irq_unmask() gets the correct address, but the wrong data (always 0).
This can break MSIs.
Lets assume MSI0 is vector 34 on CPU0, and MSI1 is vector 33 on CPU0.
hv_arch_irq_unmask() is called on MSI0. It uses a hypercall to configure the MSI address and data (0) to vector 34 of CPU0. This is correct. Then hv_arch_irq_unmask is called on MSI1. It uses another hypercall to configure the MSI address and data (0) to vector 33 of CPU0. This is wrong, and results in both MSI0 and MSI1 being routed to vector 33. Linux will observe extra instances of MSI1 and no instances of MSI0 despite the endpoint device behaving correctly.
For the multi-MSI case, we need unique address and data info for each MSI, but the cached msi_desc does not provide that. However, that information can be gotten from the int_desc cached in the chip_data by compose_msi_msg(). Fix the multi-MSI case to use that cached information instead. Since hv_set_msi_entry_from_desc() is no longer applicable, remove it.
4.14 backport - moved to host/pci-hyperv.c. hv_set_msi_entry_from_desc doesn't exist to be removed. int_entry replaces msi_entry for location int_desc is written to.
--- drivers/pci/host/pci-hyperv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/pci/host/pci-hyperv.c +4 -2
@@ -938,6 +938,7 @@ static void hv_irq_unmask(struct irq_datstruct msi_desc *msi_desc =irq_data_get_msi_desc (data);struct irq_cfg *cfg =irqd_cfg (data);struct retarget_msi_interrupt *params; +struct tran_int_desc *int_desc;struct hv_pcibus_device *hbus;struct cpumask *dest;struct pci_bus *pbus;
@@ -952,6 +953,7 @@ static void hv_irq_unmask(struct irq_dat pdev =msi_desc_to_pci_dev (msi_desc); pbus = pdev->bus; hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata); + int_desc = data->chip_data;spin_lock_irqsave (&hbus->retarget_msi_interrupt_lock, flags);
@@ -959,8 +961,8 @@ static void hv_irq_unmask(struct irq_datmemset (params,0 ,sizeof (*params)); params->partition_id =HV_PARTITION_ID_SELF ; params->int_entry.source =1 ;/* MSI(-X) */ - params->int_entry.address = msi_desc->msg.address_lo; - params->int_entry.data = msi_desc->msg.data; + params->int_entry.address = int_desc->address &0xffffffff ; + params->int_entry.data = int_desc->data; params->device_id = (hbus->hdev->dev_instance.b[5 ] <<24 ) | (hbus->hdev->dev_instance.b[4 ] <<16 ) | (hbus->hdev->dev_instance.b[7] << 8) |
Greg Kroah-Hartman
maintainerPATCH 36/37 PCI: hv: Reuse existing IRTE allocation in compose_msi_msg()
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit b4b77778ecc5bfbd4e77de1b2fd5c1dd3c655f1f upstream.
Currently if compose_msi_msg() is called multiple times, it will free any previous IRTE allocation, and generate a new allocation. While nothing prevents this from occurring, it is extraneous when Linux could just reuse the existing allocation and avoid a bunch of overhead.
However, when future IRTE allocations operate on blocks of MSIs instead of a single line, freeing the allocation will impact all of the lines. This could cause an issue where an allocation of N MSIs occurs, then some of the lines are retargeted, and finally the allocation is freed/reallocated. The freeing of the allocation removes all of the configuration for the entire block, which requires all the lines to be retargeted, which might not happen since some lines might already be unmasked/active.
4.14 backport - driver location change to host/pci-hyperv.c
--- drivers/pci/host/pci-hyperv.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-)
drivers/pci/host/pci-hyperv.c +9 -7
@@ -1128,6 +1128,15 @@ static void hv_compose_msi_msg(struct iru32 size;int ret; +/* Reuse the previous allocation */ +if (data->chip_data) { + int_desc = data->chip_data; + msg->address_hi = int_desc->address >>32 ; + msg->address_lo = int_desc->address &0xffffffff ; + msg->data = int_desc->data; +return ; + } + pdev =msi_desc_to_pci_dev (irq_data_get_msi_desc (data)); dest =irq_data_get_effective_affinity_mask (data); pbus = pdev->bus;
@@ -1136,13 +1145,6 @@ static void hv_compose_msi_msg(struct irif (!hpdev) goto return_null_message; -/* Free any previous message that might have already been composed. */ -if (data->chip_data) { - int_desc = data->chip_data; - data->chip_data =NULL ; -hv_int_desc_free (hpdev, int_desc); - } - int_desc =kzalloc (sizeof (*int_desc),GFP_ATOMIC );if (!int_desc) goto drop_reference;
Greg Kroah-Hartman
maintainerPATCH 37/37 PCI: hv: Fix interrupt mapping for multi-MSI
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit a2bad844a67b1c7740bda63e87453baf63c3a7f7 upstream.
According to Dexuan, the hypervisor folks beleive that multi-msi allocations are not correct. compose_msi_msg() will allocate multi-msi one by one. However, multi-msi is a block of related MSIs, with alignment requirements. In order for the hypervisor to allocate properly aligned and consecutive entries in the IOMMU Interrupt Remapping Table, there should be a single mapping request that requests all of the multi-msi vectors in one shot.
Dexuan suggests detecting the multi-msi case and composing a single request related to the first MSI. Then for the other MSIs in the same block, use the cached information. This appears to be viable, so do it.
4.14 backport - file moved to host/pci-hyperv.c. add hv_msi_get_int_vector helper function. Fixed merge conflict due to delivery_mode name change (APIC_DELIVERY_MODE_FIXED is the value given to dest_Fixed). Removed unused variable in hv_compose_msi_msg. Fixed reference to msi_desc->pci to point to the same is_msix variable. Removed changes to compose_msi_req_v3 since it doesn't exist yet. Added "reason" to put_pcichild (unused in function).
--- drivers/pci/host/pci-hyperv.c | 62 ++++++++++++++++++++++++++++++++++++------ 1 file changed, 54 insertions(+), 8 deletions(-)
drivers/pci/host/pci-hyperv.c +54 -8
@@ -846,6 +846,11 @@ static void hv_int_desc_free(struct hv_pu8 buffer[sizeof (struct pci_delete_interrupt )]; } ctxt; +if (!int_desc->vector_count) { +kfree (int_desc); +return ; + } +memset (&ctxt,0 ,sizeof (ctxt)); int_pkt = (struct pci_delete_interrupt *)&ctxt.pkt.message; int_pkt->message_type.type =
@@ -908,6 +913,13 @@ static void hv_irq_mask(struct irq_datapci_msi_mask_irq (data); } +static unsigned int hv_msi_get_int_vector (struct irq_data *data) +{ +struct irq_cfg *cfg =irqd_cfg (data); + +return cfg->vector; +} +static int hv_msi_prepare (struct irq_domain *domain,struct device *dev,int nvec,msi_alloc_info_t *info) {
@@ -1050,12 +1062,12 @@ static void hv_pci_compose_compl(void *cstatic u32 hv_compose_msi_req_v1 (struct pci_create_interrupt *int_pkt,struct cpumask *affinity, -u32 slot,u8 vector) +u32 slot,u8 vector,u8 vector_count) { int_pkt->message_type.type =PCI_CREATE_INTERRUPT_MESSAGE ; int_pkt->wslot.slot = slot; int_pkt->int_desc.vector = vector; - int_pkt->int_desc.vector_count =1 ; + int_pkt->int_desc.vector_count = vector_count; int_pkt->int_desc.delivery_mode = (apic->irq_delivery_mode == dest_LowestPrio) ? dest_LowestPrio : dest_Fixed;
@@ -1071,14 +1083,14 @@ static u32 hv_compose_msi_req_v1(static u32 hv_compose_msi_req_v2 (struct pci_create_interrupt2 *int_pkt,struct cpumask *affinity, -u32 slot,u8 vector) +u32 slot,u8 vector,u8 vector_count) {int cpu; int_pkt->message_type.type =PCI_CREATE_INTERRUPT_MESSAGE2 ; int_pkt->wslot.slot = slot; int_pkt->int_desc.vector = vector; - int_pkt->int_desc.vector_count =1 ; + int_pkt->int_desc.vector_count = vector_count; int_pkt->int_desc.delivery_mode = (apic->irq_delivery_mode == dest_LowestPrio) ? dest_LowestPrio : dest_Fixed;
@@ -1108,7 +1120,6 @@ static u32 hv_compose_msi_req_v2(*/ static void hv_compose_msi_msg (struct irq_data *data,struct msi_msg *msg) { -struct irq_cfg *cfg =irqd_cfg (data);struct hv_pcibus_device *hbus;struct hv_pci_dev *hpdev;struct pci_bus *pbus;
@@ -1117,6 +1128,8 @@ static void hv_compose_msi_msg(struct irunsigned long flags;struct compose_comp_ctxt comp;struct tran_int_desc *int_desc; +struct msi_desc *msi_desc; +u8 vector, vector_count; struct { struct pci_packet pci_pkt; union {
@@ -1137,7 +1150,8 @@ static void hv_compose_msi_msg(struct irreturn ; } - pdev =msi_desc_to_pci_dev (irq_data_get_msi_desc (data)); + msi_desc =irq_data_get_msi_desc (data); + pdev =msi_desc_to_pci_dev (msi_desc); dest =irq_data_get_effective_affinity_mask (data); pbus = pdev->bus; hbus = container_of(pbus->sysdata, struct hv_pcibus_device, sysdata);
@@ -1149,6 +1163,36 @@ static void hv_compose_msi_msg(struct irif (!int_desc) goto drop_reference; +if (!msi_desc->msi_attrib.is_msix && msi_desc->nvec_used >1 ) { +/* +* If this is not the first MSI of Multi MSI, we already have +* a mapping. Can exit early. +*/ +if (msi_desc->irq != data->irq) { + data->chip_data = int_desc; + int_desc->address = msi_desc->msg.address_lo | + (u64 )msi_desc->msg.address_hi <<32 ; + int_desc->data = msi_desc->msg.data + + (data->irq - msi_desc->irq); + msg->address_hi = msi_desc->msg.address_hi; + msg->address_lo = msi_desc->msg.address_lo; + msg->data = int_desc->data; +put_pcichild (hpdev, hv_pcidev_ref_by_slot); +return ; + } +/* +* The vector we select here is a dummy value. The correct +* value gets sent to the hypervisor in unmask(). This needs +* to be aligned with the count, and also not zero. Multi-msi +* is powers of 2 up to 32, so 32 will always work here. +*/ + vector =32 ; + vector_count = msi_desc->nvec_used; + }else { + vector =hv_msi_get_int_vector (data); + vector_count =1 ; + } +memset (&ctxt,0 ,sizeof (ctxt));init_completion (&comp.comp_pkt.host_event); ctxt.pci_pkt.completion_func = hv_pci_compose_compl;
@@ -1159,14 +1203,16 @@ static void hv_compose_msi_msg(struct ir size =hv_compose_msi_req_v1 (&ctxt.int_pkts.v1, dest, hpdev->desc.win_slot.slot, - cfg->vector); + vector, + vector_count);break ;case PCI_PROTOCOL_VERSION_1_2 : size =hv_compose_msi_req_v2 (&ctxt.int_pkts.v2, dest, hpdev->desc.win_slot.slot, - cfg->vector); + vector, + vector_count);break ;default :
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.290 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 29 Jul 2022 16:09:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.290-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
## Build
* kernel: 4.14.290-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-4.14.y
* git commit: 7df53ec6e7ae929b9bbdd245504a491e962d6631
* git describe: v4.14.289-38-g7df53ec6e7ae
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.14.y/build/v4.14.289-38-g7df53ec6e7ae
## Test Regressions (compared to v4.14.289)
No test regressions found.
## Metric Regressions (compared to v4.14.289)
No metric regressions found.
## Test Fixes (compared to v4.14.289)
No test fixes found.
## Metric Fixes (compared to v4.14.289)
No metric fixes found.
## Test result summary
total: 88981, pass: 78369, fail: 158, skip: 9183, xfail: 1271
## Build Summary
* arc: 10 total, 10 passed, 0 failed
* arm: 286 total, 281 passed, 5 failed
* arm64: 50 total, 47 passed, 3 failed
* i386: 26 total, 25 passed, 1 failed
* mips: 30 total, 30 passed, 0 failed
* parisc: 12 total, 12 passed, 0 failed
* powerpc: 16 total, 16 passed, 0 failed
* s390: 12 total, 9 passed, 3 failed
* sh: 24 total, 24 passed, 0 failed
* sparc: 12 total, 12 passed, 0 failed
* x86_64: 48 total, 47 passed, 1 failed
## Test suites summary
* fwts
* igt-gpu-tools
* kunit
* kvm-unit-tests
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-open-posix-tests
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* packetdrill
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.290 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 29 Jul 2022 16:09:50 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.290-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.14.290-rc1-g7df53ec6e7ae
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.290 release. There are 37 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 29 Jul 2022 16:09:50 +0000. Anything received after that time might be too late.
Build results:
total: 170 pass: 170 fail: 0 Qemu test results: total: 424 pass: 424 fail: 0
Guenter