5.4.242-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 5.4.242-rc1 review
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.4.242-rc1
Ekaterina Orlova <[email protected]>
ASN.1: Fix check for strdup() success
Dan Carpenter <[email protected]>
iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
Uwe Kleine-König <[email protected]>
pwm: meson: Explicitly set .polarity in .get_state()
Gao Xiang <[email protected]>
xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
Kuniyuki Iwashima <[email protected]>
sctp: Call inet6_destroy_sock() via sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
dccp: Call inet6_destroy_sock() via sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
Kuniyuki Iwashima <[email protected]>
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
Kuniyuki Iwashima <[email protected]>
udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
Baokun Li <[email protected]>
ext4: fix use-after-free in ext4_xattr_set_entry
Ritesh Harjani <[email protected]>
ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
Tudor Ambarus <[email protected]>
Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
Pingfan Liu <[email protected]>
x86/purgatory: Don't generate debug info for purgatory.ro
Jiaxun Yang <[email protected]>
MIPS: Define RUNTIME_DISCARD_EXIT in LD script
Bhavya Kapoor <[email protected]>
mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
Greg Kroah-Hartman <[email protected]>
memstick: fix memory leak if card device is never registered
Ryusuke Konishi <[email protected]>
nilfs2: initialize unused bytes in segment summary blocks
Brian Masney <[email protected]>
iio: light: tsl2772: fix reading proximity-diodes from device tree
Juergen Gross <[email protected]>
xen/netback: use same error messages for same errors
Sagi Grimberg <[email protected]>
nvme-tcp: fix a possible UAF when failing to allocate an io queue
Heiko Carstens <[email protected]>
s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
Álvaro Fernández Rojas <[email protected]>
net: dsa: b53: mmap: add phy ops
Damien Le Moal <[email protected]>
scsi: core: Improve scsi_vpd_inquiry() checks
Tomas Henzl <[email protected]>
scsi: megaraid_sas: Fix fw_crash_buffer_show()
Nick Desaulniers <[email protected]>
selftests: sigaltstack: fix -Wuninitialized
Jonathan Denose <[email protected]>
Input: i8042 - add quirk for Fujitsu Lifebook A574/H
Douglas Raillard <[email protected]>
f2fs: Fix f2fs_truncate_partial_nodes ftrace event
Sebastian Basierski <[email protected]>
e1000e: Disable TSO on i219-LM card to increase speed
Daniel Borkmann <[email protected]>
bpf: Fix incorrect verifier pruning due to missing register precision taints
Nikita Zhandarovich <[email protected]>
mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
Aleksandr Loktionov <[email protected]>
i40e: fix i40e_setup_misc_vector() error handling
Aleksandr Loktionov <[email protected]>
i40e: fix accessing vsi->active_filters without holding lock
Florian Westphal <[email protected]>
netfilter: nf_tables: fix ifdef to also consider nf_tables=m
Xuan Zhuo <[email protected]>
virtio_net: bugfix overflow inside xdp_linearize_page()
Gwangun Jung <[email protected]>
net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
Cristian Ciocaltea <[email protected]>
regulator: fan53555: Explicitly include bits header
Florian Westphal <[email protected]>
netfilter: br_netfilter: fix recent physdev match breakage
Marc Gonzalez <[email protected]>
arm64: dts: meson-g12-common: specify full DMC range
Jianqun Xu <[email protected]>
ARM: dts: rockchip: fix a typo error for rk3288 spdif node
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/rk3288.dtsi | 2 +- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 3 +- arch/mips/kernel/vmlinux.lds.S | 2 + arch/s390/kernel/ptrace.c | 8 +--- arch/x86/purgatory/Makefile | 5 ++- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- drivers/iio/light/tsl2772.c | 1 + drivers/input/serio/i8042-x86ia64io.h | 8 ++++ drivers/memstick/core/memstick.c | 5 ++- drivers/mmc/host/sdhci_am654.c | 2 - drivers/net/dsa/b53/b53_mmap.c | 14 ++++++ drivers/net/ethernet/intel/e1000e/netdev.c | 51 +++++++++++----------- drivers/net/ethernet/intel/i40e/i40e_main.c | 9 ++-- .../ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c | 2 + drivers/net/virtio_net.c | 8 +++- drivers/net/xen-netback/netback.c | 6 +-- drivers/nvme/host/tcp.c | 46 ++++++++++--------- drivers/pwm/pwm-meson.c | 7 +++ drivers/regulator/fan53555.c | 11 ++--- drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- drivers/scsi/scsi.c | 11 ++++- fs/ext4/inline.c | 11 +++-- fs/ext4/xattr.c | 26 +---------- fs/ext4/xattr.h | 6 +-- fs/nilfs2/segment.c | 20 +++++++++ fs/xfs/libxfs/xfs_attr_leaf.c | 8 +++- include/linux/skbuff.h | 5 ++- include/net/ipv6.h | 2 + include/net/udp.h | 2 +- include/net/udplite.h | 8 ---- include/trace/events/f2fs.h | 2 +- kernel/bpf/verifier.c | 15 +++++++ net/bridge/br_netfilter_hooks.c | 17 +++++--- net/dccp/dccp.h | 1 + net/dccp/ipv6.c | 15 ++++--- net/dccp/proto.c | 8 +++- net/ipv4/udp.c | 9 ++-- net/ipv4/udplite.c | 8 ++++ net/ipv6/af_inet6.c | 15 ++++++- net/ipv6/ipv6_sockglue.c | 20 ++++----- net/ipv6/ping.c | 6 --- net/ipv6/raw.c | 2 - net/ipv6/tcp_ipv6.c | 8 +--- net/ipv6/udp.c | 17 ++++++-- net/ipv6/udp_impl.h | 1 + net/ipv6/udplite.c | 9 +++- net/l2tp/l2tp_ip6.c | 2 - net/sched/sch_qfq.c | 13 +++--- net/sctp/socket.c | 29 ++++++++---- scripts/asn1_compiler.c | 2 +- .../selftests/sigaltstack/current_stack_pointer.h | 23 ++++++++++ tools/testing/selftests/sigaltstack/sas.c | 7 +-- 53 files changed, 329 insertions(+), 197 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/39 ARM: dts: rockchip: fix a typo error for rk3288 spdif node
From: Jianqun Xu <[email protected]>
[ Upstream commit 02c84f91adb9a64b75ec97d772675c02a3e65ed7 ]
Fix the address in the spdif node name.
--- arch/arm/boot/dts/rk3288.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/rk3288.dtsi +1 -1
@@ -942,7 +942,7 @@ status = "disabled"; }; - spdif: sound@ff88b0000 { + spdif: sound@ff8b0000 { compatible = "rockchip,rk3288-spdif", "rockchip,rk3066-spdif"; reg = <0x0 0xff8b0000 0x0 0x10000>; #sound-dai-cells = <0>;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 2/39 arm64: dts: meson-g12-common: specify full DMC range
In reply to Greg Kroah-HartmanFrom: Marc Gonzalez <[email protected]>
[ Upstream commit aec4353114a408b3a831a22ba34942d05943e462 ]
According to S905X2 Datasheet - Revision 07:
DRAM Memory Controller (DMC) register area spans ff638000-ff63a000.
According to DeviceTree Specification - Release v0.4-rc1:
simple-bus nodes do not require reg property.
--- arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm64/boot/dts/amlogic/meson-g12-common.dtsi +1 -2
@@ -1376,10 +1376,9 @@ dmc: bus@38000 { compatible = "simple-bus"; - reg = <0x0 0x38000 0x0 0x400>; #address-cells = <2>; #size-cells = <2>; - ranges = <0x0 0x0 0x0 0x38000 0x0 0x400>; + ranges = <0x0 0x0 0x0 0x38000 0x0 0x2000>; canvas: video-lut@48 { compatible = "amlogic,canvas";
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 3/39 netfilter: br_netfilter: fix recent physdev match breakage
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 94623f579ce338b5fa61b5acaa5beb8aa657fb9e ]
Recent attempt to ensure PREROUTING hook is executed again when a decrypted ipsec packet received on a bridge passes through the network stack a second time broke the physdev match in INPUT hook.
We can't discard the nf_bridge info strct from sabotage_in hook, as this is needed by the physdev match.
Keep the struct around and handle this with another conditional instead.
--- include/linux/skbuff.h | 1 + net/bridge/br_netfilter_hooks.c | 17 +++++++++++------ 2 files changed, 12 insertions(+), 6 deletions(-)
include/linux/skbuff.h +1 -0
@@ -257,6 +257,7 @@ struct nf_bridge_info { u8 pkt_otherhost:1; u8 in_prerouting:1; u8 bridged_dnat:1; + u8 sabotage_in_done:1;__u16 frag_max_size;struct net_device *physindev;
net/bridge/br_netfilter_hooks.c +11 -6
@@ -868,12 +868,17 @@ static unsigned int ip_sabotage_in(void *priv, {struct nf_bridge_info *nf_bridge =nf_bridge_info_get (skb); -if (nf_bridge && !nf_bridge->in_prerouting && - !netif_is_l3_master (skb->dev) && - !netif_is_l3_slave (skb->dev)) { -nf_bridge_info_free (skb); - state->okfn (state->net, state->sk, skb); -return NF_STOLEN ; +if (nf_bridge) { +if (nf_bridge->sabotage_in_done) +return NF_ACCEPT ; + +if (!nf_bridge->in_prerouting && + !netif_is_l3_master (skb->dev) && + !netif_is_l3_slave (skb->dev)) { + nf_bridge->sabotage_in_done =1 ; + state->okfn (state->net, state->sk, skb); +return NF_STOLEN ; + } }return NF_ACCEPT ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 4/39 regulator: fan53555: Explicitly include bits header
In reply to Greg Kroah-HartmanFrom: Cristian Ciocaltea <[email protected]>
[ Upstream commit 4fb9a5060f73627303bc531ceaab1b19d0a24aef ]
Since commit f2a9eb975ab2 ("regulator: fan53555: Add support for FAN53526") the driver makes use of the BIT() macro, but relies on the bits header being implicitly included.
Explicitly pull the header in to avoid potential build failures in some configurations.
While here, reorder include directives alphabetically.
--- drivers/regulator/fan53555.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
drivers/regulator/fan53555.c +6 -5
@@ -8,18 +8,19 @@// Copyright (c) 2012 Marvell Technology Ltd. // Yunfan Zhang <[email protected]> +#include <linux/bits.h> +#include <linux/err.h> +#include <linux/i2c.h> #include <linux/module.h> +#include <linux/of_device.h> #include <linux/param.h> -#include <linux/err.h> #include <linux/platform_device.h> +#include <linux/regmap.h> #include <linux/regulator/driver.h> +#include <linux/regulator/fan53555.h> #include <linux/regulator/machine.h> #include <linux/regulator/of_regulator.h> -#include <linux/of_device.h> -#include <linux/i2c.h> #include <linux/slab.h> -#include <linux/regmap.h> -#include <linux/regulator/fan53555.h> /* Voltage setting */ #define FAN53555_VSEL0 0x00
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 5/39 net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
In reply to Greg Kroah-HartmanFrom: Gwangun Jung <[email protected]>
[ Upstream commit 3037933448f60f9acb705997eae62013ecb81e0d ]
If the TCA_QFQ_LMAX value is not offered through nlattr, lmax is determined by the MTU value of the network device. The MTU of the loopback device can be set up to 2^31-1.
As a result, it is possible to have an lmax value that exceeds QFQ_MIN_LMAX.
Due to the invalid lmax value, an index is generated that exceeds the QFQ_MAX_INDEX(=24) value, causing out-of-bounds read/write errors.
The following reports a oob access:
[ 84.582666] BUG: KASAN: slab-out-of-bounds in qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.583267] Read of size 4 at addr ffff88810f676948 by task ping/301 [ 84.583686] [ 84.583797] CPU: 3 PID: 301 Comm: ping Not tainted 6.3.0-rc5 #1 [ 84.584164] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 [ 84.584644] Call Trace: [ 84.584787] <TASK> [ 84.584906] dump_stack_lvl (lib/dump_stack.c:107 (discriminator 1)) [ 84.585108] print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) [ 84.585570] kasan_report (mm/kasan/report.c:538) [ 84.585988] qfq_activate_agg.constprop.0 (net/sched/sch_qfq.c:1027 net/sched/sch_qfq.c:1060 net/sched/sch_qfq.c:1313) [ 84.586599] qfq_enqueue (net/sched/sch_qfq.c:1255) [ 84.587607] dev_qdisc_enqueue (net/core/dev.c:3776) [ 84.587749] __dev_queue_xmit (./include/net/sch_generic.h:186 net/core/dev.c:3865 net/core/dev.c:4212) [ 84.588763] ip_finish_output2 (./include/net/neighbour.h:546 net/ipv4/ip_output.c:228) [ 84.589460] ip_output (net/ipv4/ip_output.c:430) [ 84.590132] ip_push_pending_frames (./include/net/dst.h:444 net/ipv4/ip_output.c:126 net/ipv4/ip_output.c:1586 net/ipv4/ip_output.c:1606) [ 84.590285] raw_sendmsg (net/ipv4/raw.c:649) [ 84.591960] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.592084] __sys_sendto (net/socket.c:2142) [ 84.593306] __x64_sys_sendto (net/socket.c:2150) [ 84.593779] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.593902] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.594070] RIP: 0033:0x7fe568032066 [ 84.594192] Code: 0e 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c09[ 84.594796] RSP: 002b:00007ffce388b4e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
Code starting with the faulting instruction
===========================================
[ 84.595047] RAX: ffffffffffffffda RBX: 00007ffce388cc70 RCX: 00007fe568032066 [ 84.595281] RDX: 0000000000000040 RSI: 00005605fdad6d10 RDI: 0000000000000003 [ 84.595515] RBP: 00005605fdad6d10 R08: 00007ffce388eeec R09: 0000000000000010 [ 84.595749] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040 [ 84.595984] R13: 00007ffce388cc30 R14: 00007ffce388b4f0 R15: 0000001d00000001 [ 84.596218] </TASK> [ 84.596295] [ 84.596351] Allocated by task 291: [ 84.596467] kasan_save_stack (mm/kasan/common.c:46) [ 84.596597] kasan_set_track (mm/kasan/common.c:52) [ 84.596725] __kasan_kmalloc (mm/kasan/common.c:384) [ 84.596852] __kmalloc_node (./include/linux/kasan.h:196 mm/slab_common.c:967 mm/slab_common.c:974) [ 84.596979] qdisc_alloc (./include/linux/slab.h:610 ./include/linux/slab.h:731 net/sched/sch_generic.c:938) [ 84.597100] qdisc_create (net/sched/sch_api.c:1244) [ 84.597222] tc_modify_qdisc (net/sched/sch_api.c:1680) [ 84.597357] rtnetlink_rcv_msg (net/core/rtnetlink.c:6174) [ 84.597495] netlink_rcv_skb (net/netlink/af_netlink.c:2574) [ 84.597627] netlink_unicast (net/netlink/af_netlink.c:1340 net/netlink/af_netlink.c:1365) [ 84.597759] netlink_sendmsg (net/netlink/af_netlink.c:1942) [ 84.597891] sock_sendmsg (net/socket.c:724 net/socket.c:747) [ 84.598016] ____sys_sendmsg (net/socket.c:2501) [ 84.598147] ___sys_sendmsg (net/socket.c:2557) [ 84.598275] __sys_sendmsg (./include/linux/file.h:31 net/socket.c:2586) [ 84.598399] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) [ 84.598520] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) [ 84.598688] [ 84.598744] The buggy address belongs to the object at ffff88810f674000 [ 84.598744] which belongs to the cache kmalloc-8k of size 8192 [ 84.599135] The buggy address is located 2664 bytes to the right of [ 84.599135] allocated 7904-byte region [ffff88810f674000, ffff88810f675ee0) [ 84.599544] [ 84.599598] The buggy address belongs to the physical page: [ 84.599777] page:00000000e638567f refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10f670 [ 84.600074] head:00000000e638567f order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 84.600330] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 84.600517] raw: 0200000000010200 ffff888100043180 dead000000000122 0000000000000000 [ 84.600764] raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000 [ 84.601009] page dumped because: kasan: bad access detected [ 84.601187] [ 84.601241] Memory state around the buggy address: [ 84.601396] ffff88810f676800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601620] ffff88810f676880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.601845] >ffff88810f676900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602069] ^ [ 84.602243] ffff88810f676980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602468] ffff88810f676a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 84.602693] ================================================================== [ 84.602924] Disabling lock debugging due to kernel taint
--- net/sched/sch_qfq.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
net/sched/sch_qfq.c +7 -6
@@ -421,15 +421,16 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, }else weight =1 ; -if (tb[TCA_QFQ_LMAX ]) { +if (tb[TCA_QFQ_LMAX ]) lmax =nla_get_u32 (tb[TCA_QFQ_LMAX ]); -if (lmax <QFQ_MIN_LMAX || lmax > (1UL <<QFQ_MTU_SHIFT )) { -pr_notice ("qfq: invalid max length %u\n" , lmax); -return -EINVAL ; - } - }else +else lmax =psched_mtu (qdisc_dev (sch)); +if (lmax <QFQ_MIN_LMAX || lmax > (1UL <<QFQ_MTU_SHIFT )) { +pr_notice ("qfq: invalid max length %u\n" , lmax); +return -EINVAL ; + } + inv_w =ONE_FP / weight; weight =ONE_FP / inv_w;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 6/39 virtio_net: bugfix overflow inside xdp_linearize_page()
In reply to Greg Kroah-HartmanFrom: Xuan Zhuo <[email protected]>
[ Upstream commit 853618d5886bf94812f31228091cd37d308230f7 ]
Here we copy the data from the original buf to the new page. But we not check that it may be overflow.
As long as the size received(including vnethdr) is greater than 3840 (PAGE_SIZE -VIRTIO_XDP_HEADROOM). Then the memcpy will overflow.
And this is completely possible, as long as the MTU is large, such as 4096. In our test environment, this will cause crash. Since crash is caused by the written memory, it is meaningless, so I do not include it.
--- drivers/net/virtio_net.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +6 -2
@@ -646,8 +646,13 @@ static struct page *xdp_linearize_page(struct receive_queue *rq,int page_off, unsigned int *len) { - struct page *page = alloc_page(GFP_ATOMIC); + int tailroom = SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); +struct page *page; +if (page_off + *len + tailroom >PAGE_SIZE ) +return NULL ; + + page =alloc_page (GFP_ATOMIC );if (!page)return NULL ;
@@ -655,7 +660,6 @@ static struct page *xdp_linearize_page(struct receive_queue *rq, page_off += *len;while (--*num_buf) { -int tailroom =SKB_DATA_ALIGN (sizeof (struct skb_shared_info ));unsigned int buflen;void *buf;int off;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 7/39 netfilter: nf_tables: fix ifdef to also consider nf_tables=m
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit c55c0e91c813589dc55bea6bf9a9fbfaa10ae41d ]
nftables can be built as a module, so fix the preprocessor conditional accordingly.
--- include/linux/skbuff.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
include/linux/skbuff.h +2 -2
@@ -4227,7 +4227,7 @@ static inline void nf_reset_ct(struct sk_buff *skb)static inline void nf_reset_trace (struct sk_buff *skb) { -#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) || defined(CONFIG_NF_TABLES ) +#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) ||IS_ENABLED (CONFIG_NF_TABLES ) skb->nf_trace =0 ;#endif }
@@ -4247,7 +4247,7 @@ static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src, dst->_nfct = src->_nfct;nf_conntrack_get (skb_nfct (src));#endif -#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) || defined(CONFIG_NF_TABLES ) +#if IS_ENABLED (CONFIG_NETFILTER_XT_TARGET_TRACE ) ||IS_ENABLED (CONFIG_NF_TABLES )if (copy) dst->nf_trace = src->nf_trace;#endif
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 8/39 i40e: fix accessing vsi->active_filters without holding lock
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit 8485d093b076e59baff424552e8aecfc5bd2d261 ]
Fix accessing vsi->active_filters without holding the mac_filter_hash_lock. Move vsi->active_filters = 0 inside critical section and
move clear_bit(__I40E_VSI_OVERFLOW_PROMISC, vsi->state) after the critical section to ensure the new filters from other threads can be added only after filters cleaning in the critical section is finished.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +2 -2
@@ -13463,15 +13463,15 @@ static int i40e_add_vsi(struct i40e_vsi *vsi) vsi->id = ctxt.vsi_number; } - vsi->active_filters =0 ; -clear_bit (__I40E_VSI_OVERFLOW_PROMISC, vsi->state);spin_lock_bh (&vsi->mac_filter_hash_lock); + vsi->active_filters =0 ;/* If macvlan filters already exist, force them to get loaded */ hash_for_each_safe (vsi->mac_filter_hash, bkt, h, f, hlist) { f->state =I40E_FILTER_NEW ; f_count++; }spin_unlock_bh (&vsi->mac_filter_hash_lock); +clear_bit (__I40E_VSI_OVERFLOW_PROMISC, vsi->state);if (f_count) { vsi->flags |=I40E_VSI_FLAG_FILTER_CHANGED ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 9/39 i40e: fix i40e_setup_misc_vector() error handling
In reply to Greg Kroah-HartmanFrom: Aleksandr Loktionov <[email protected]>
[ Upstream commit c86c00c6935505929cc9adb29ddb85e48c71f828 ]
Add error handling of i40e_setup_misc_vector() in i40e_rebuild(). In case interrupt vectors setup fails do not re-open vsi-s and do not bring up vf-s, we have no interrupts to serve a traffic anyway.
--- drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/i40e/i40e_main.c +4 -1
@@ -10336,8 +10336,11 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) pf->hw.aq.asq_last_status)); }/* reinit the misc interrupt */ -if (pf->flags &I40E_FLAG_MSIX_ENABLED ) +if (pf->flags &I40E_FLAG_MSIX_ENABLED ) { ret =i40e_setup_misc_vector (pf); +if (ret) + goto end_unlock; + }/* Add a filter to drop all Flow control frames from any VSI from being * transmitted. By doing so we stop a malicious VF from sending out
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 10/39 mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next()
In reply to Greg Kroah-HartmanFrom: Nikita Zhandarovich <[email protected]>
[ Upstream commit c0e73276f0fcbbd3d4736ba975d7dc7a48791b0c ]
Function mlxfw_mfa2_tlv_multi_get() returns NULL if 'tlv' in question does not pass checks in mlxfw_mfa2_tlv_payload_get(). This behaviour may lead to NULL pointer dereference in 'multi->total_len'. Fix this issue by testing mlxfw_mfa2_tlv_multi_get()'s return value against NULL.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlxfw/mlxfw_mfa2_tlv_multi.c +2 -0
@@ -31,6 +31,8 @@ mlxfw_mfa2_tlv_next(const struct mlxfw_mfa2_file *mfa2_file,if (tlv->type ==MLXFW_MFA2_TLV_MULTI_PART ) { multi =mlxfw_mfa2_tlv_multi_get (mfa2_file, tlv); +if (!multi) +return NULL ; tlv_len =NLA_ALIGN (tlv_len +be16_to_cpu (multi->total_len)); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 11/39 bpf: Fix incorrect verifier pruning due to missing register precision taints
In reply to Greg Kroah-HartmanFrom: Daniel Borkmann <[email protected]>
[ Upstream commit 71b547f561247897a0a14f3082730156c0533fed ]
Juan Jose et al reported an issue found via fuzzing where the verifier's pruning logic prematurely marks a program path as safe.
Consider the following program:
0: (b7) r6 = 1024
1: (b7) r7 = 0
2: (b7) r8 = 0
3: (b7) r9 = -2147483648
4: (97) r6 %= 1025
5: (05) goto pc+0
6: (bd) if r6 <= r9 goto pc+2
7: (97) r6 %= 1
8: (b7) r9 = 0
9: (bd) if r6 <= r9 goto pc+1
10: (b7) r6 = 0
11: (b7) r0 = 0
12: (63) *(u32 *)(r10 -4) = r0
13: (18) r4 = 0xffff888103693400 // map_ptr(ks=4,vs=48) 15: (bf) r1 = r4
16: (bf) r2 = r10
17: (07) r2 += -4
18: (85) call bpf_map_lookup_elem#1
19: (55) if r0 != 0x0 goto pc+1
20: (95) exit
21: (77) r6 >>= 10
22: (27) r6 *= 8192
23: (bf) r1 = r0
24: (0f) r0 += r6
25: (79) r3 = *(u64 *)(r0 +0)
26: (7b) *(u64 *)(r1 +0) = r3
27: (95) exit
The verifier treats this as safe, leading to oob read/write access due to an incorrect verifier conclusion:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff00000000; 0xffffffff)) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 19
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
regs=40 stack=0 before 10: (b7) r6 = 0
25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
27: (95) exit
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff8ad3886c2a00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4
18: (85) call bpf_map_lookup_elem#1
frame 0: propagating r6
last_idx 19 first_idx 11
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff8ad3886c2a00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=0 R10=fp0 last_idx 8 first_idx 0
regs=40 stack=0 before 8: (b7) r9 = 0
regs=40 stack=0 before 7: (97) r6 %= 1
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=40 stack=0 before 5: (05) goto pc+0
regs=40 stack=0 before 4: (97) r6 %= 1025
regs=40 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
19: safe
frame 0: propagating r6
last_idx 9 first_idx 0
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=40 stack=0 before 5: (05) goto pc+0
regs=40 stack=0 before 4: (97) r6 %= 1025
regs=40 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
from 6 to 9: safe
verification time 110 usec
stack depth 4
processed 36 insns (limit 1000000) max_states_per_insn 0 total_states 3 peak_states 3 mark_read 2
The verifier considers this program as safe by mistakenly pruning unsafe code paths. In the above func#0, code lines 0-10 are of interest. In line 0-3 registers r6 to r9 are initialized with known scalar values. In line 4 the register r6 is reset to an unknown scalar given the verifier does not track modulo operations. Due to this, the verifier can also not determine precisely which branches in line 6 and 9 are taken, therefore it needs to explore them both.
As can be seen, the verifier starts with exploring the false/fall-through paths first. The 'from 19 to 21' path has both r6=0 and r9=0 and the pointer arithmetic on r0 += r6 is therefore considered safe. Given the arithmetic, r6 is correctly marked for precision tracking where backtracking kicks in where it walks back the current path all the way where r6 was set to 0 in the fall-through branch.
Next, the pruning logics pops the path 'from 9 to 11' from the stack. Also here, the state of the registers is the same, that is, r6=0 and r9=0, so that at line 19 the path can be pruned as it is considered safe. It is interesting to note that the conditional in line 9 turned r6 into a more precise state, that is, in the fall-through path at the beginning of line 10, it is R6=scalar(umin=1), and in the branch-taken path (which is analyzed here) at the beginning of line 11, r6 turned into a known const r6=0 as r9=0 prior to that and therefore (unsigned) r6 <= 0 concludes that r6 must be 0 (**):
[...] ; R6_w=scalar()
9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0
[...]
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 [...]
The next path is 'from 6 to 9'. The verifier considers the old and current state equivalent, and therefore prunes the search incorrectly. Looking into the two states which are being compared by the pruning logic at line 9, the old state consists of R6_rwD=Pscalar() R9_rwD=0 R10=fp0 and the new state consists of R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0. While r6 had the reg->precise flag correctly set in the old state, r9 did not. Both r6'es are considered as equivalent given the old one is a superset of the current, more precise one, however, r9's actual values (0 vs 0x80000000) mismatch. Given the old r9 did not have reg->precise flag set, the verifier does not consider the register as contributing to the precision state of r6, and therefore it considered both r9 states as equivalent. However, for this specific pruned path (which is also the actual path taken at runtime), register r6 will be 0x400 and r9 0x80000000 when reaching line 21, thus oob-accessing the map.
The purpose of precision tracking is to initially mark registers (including spilled ones) as imprecise to help verifier's pruning logic finding equivalent states it can then prune if they don't contribute to the program's safety aspects. For example, if registers are used for pointer arithmetic or to pass constant length to a helper, then the verifier sets reg->precise flag and backtracks the BPF program instruction sequence and chain of verifier states to ensure that the given register or stack slot including their dependencies are marked as precisely tracked scalar. This also includes any other registers and slots that contribute to a tracked state of given registers/stack slot. This backtracking relies on recorded jmp_history and is able to traverse entire chain of parent states. This process ends only when all the necessary registers/slots and their transitive dependencies are marked as precise.
The backtrack_insn() is called from the current instruction up to the first instruction, and its purpose is to compute a bitmask of registers and stack slots that need precision tracking in the parent's verifier state. For example, if a current instruction is r6 = r7, then r6 needs precision after this instruction and r7 needs precision before this instruction, that is, in the parent state. Hence for the latter r7 is marked and r6 unmarked.
For the class of jmp/jmp32 instructions, backtrack_insn() today only looks at call and exit instructions and for all other conditionals the masks remain as-is. However, in the given situation register r6 has a dependency on r9 (as described above in **), so also that one needs to be marked for precision tracking. In other words, if an imprecise register influences a precise one, then the imprecise register should also be marked precise. Meaning, in the parent state both dest and src register need to be tracked for precision and therefore the marking must be more conservative by setting reg->precise flag for both. The precision propagation needs to cover both for the conditional: if the src reg was marked but not the dst reg and vice versa.
After the fix the program is correctly rejected:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (b7) r6 = 1024 ; R6_w=1024 1: (b7) r7 = 0 ; R7_w=0 2: (b7) r8 = 0 ; R8_w=0 3: (b7) r9 = -2147483648 ; R9_w=-2147483648 4: (97) r6 %= 1025 ; R6_w=scalar() 5: (05) goto pc+0 6: (bd) if r6 <= r9 goto pc+2 ; R6_w=scalar(umin=18446744071562067969,var_off=(0xffffffff80000000; 0x7fffffff),u32_min=-2147483648) R9_w=-2147483648 7: (97) r6 %= 1 ; R6_w=scalar() 8: (b7) r9 = 0 ; R9=0 9: (bd) if r6 <= r9 goto pc+1 ; R6=scalar(umin=1) R9=0 10: (b7) r6 = 0 ; R6_w=0 11: (b7) r0 = 0 ; R0_w=0 12: (63) *(u32 *)(r10 -4) = r0 last_idx 12 first_idx 9 regs=1 stack=0 before 11: (b7) r0 = 0 13: R0_w=0 R10=fp0 fp-8=0000???? 13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=0 22: (27) r6 *= 8192 ; R6_w=0 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 19
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
parent didn't have regs=40 stack=0 marks: R0_rw=map_value_or_null(id=1,off=0,ks=4,vs=48,imm=0) R6_rw=P0 R7=0 R8=0 R9=0 R10=fp0 fp-8=mmmm???? last_idx 18 first_idx 9
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
regs=40 stack=0 before 10: (b7) r6 = 0
25: (79) r3 = *(u64 *)(r0 +0) ; R0_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
26: (7b) *(u64 *)(r1 +0) = r3 ; R1_w=map_value(off=0,ks=4,vs=48,imm=0) R3_w=scalar()
27: (95) exit
from 9 to 11: R1=ctx(off=0,imm=0) R6=0 R7=0 R8=0 R9=0 R10=fp0
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4
18: (85) call bpf_map_lookup_elem#1
frame 0: propagating r6
last_idx 19 first_idx 11
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_r=P0 R7=0 R8=0 R9=0 R10=fp0 last_idx 9 first_idx 9
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
parent didn't have regs=240 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar() R7_w=0 R8_w=0 R9_rw=P0 R10=fp0 last_idx 8 first_idx 0
regs=240 stack=0 before 8: (b7) r9 = 0
regs=40 stack=0 before 7: (97) r6 %= 1
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
19: safe
from 6 to 9: R1=ctx(off=0,imm=0) R6_w=scalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 9: (bd) if r6 <= r9 goto pc+1
last_idx 9 first_idx 0
regs=40 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
last_idx 9 first_idx 0
regs=200 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
11: R6=scalar(umax=18446744071562067968) R9=-2147483648
11: (b7) r0 = 0 ; R0_w=0
12: (63) *(u32 *)(r10 -4) = r0
last_idx 12 first_idx 11
regs=1 stack=0 before 11: (b7) r0 = 0
13: R0_w=0 R10=fp0 fp-8=0000????
13: (18) r4 = 0xffff9290dc5bfe00 ; R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 15: (bf) r1 = r4 ; R1_w=map_ptr(off=0,ks=4,vs=48,imm=0) R4_w=map_ptr(off=0,ks=4,vs=48,imm=0) 16: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 17: (07) r2 += -4 ; R2_w=fp-4 18: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null(id=3,off=0,ks=4,vs=48,imm=0) 19: (55) if r0 != 0x0 goto pc+1 ; R0_w=0
20: (95) exit
from 19 to 21: R0=map_value(off=0,ks=4,vs=48,imm=0) R6=scalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm????
21: (77) r6 >>= 10 ; R6_w=scalar(umax=18014398507384832,var_off=(0x0; 0x3fffffffffffff)) 22: (27) r6 *= 8192 ; R6_w=scalar(smax=9223372036854767616,umax=18446744073709543424,var_off=(0x0; 0xffffffffffffe000),s32_max=2147475456,u32_max=-8192) 23: (bf) r1 = r0 ; R0=map_value(off=0,ks=4,vs=48,imm=0) R1_w=map_value(off=0,ks=4,vs=48,imm=0)
24: (0f) r0 += r6
last_idx 24 first_idx 21
regs=40 stack=0 before 23: (bf) r1 = r0
regs=40 stack=0 before 22: (27) r6 *= 8192
regs=40 stack=0 before 21: (77) r6 >>= 10
parent didn't have regs=40 stack=0 marks: R0_rw=map_value(off=0,ks=4,vs=48,imm=0) R6_r=Pscalar(umax=18446744071562067968) R7=0 R8=0 R9=-2147483648 R10=fp0 fp-8=mmmm???? last_idx 19 first_idx 11
regs=40 stack=0 before 19: (55) if r0 != 0x0 goto pc+1
regs=40 stack=0 before 18: (85) call bpf_map_lookup_elem#1
regs=40 stack=0 before 17: (07) r2 += -4
regs=40 stack=0 before 16: (bf) r2 = r10
regs=40 stack=0 before 15: (bf) r1 = r4
regs=40 stack=0 before 13: (18) r4 = 0xffff9290dc5bfe00
regs=40 stack=0 before 12: (63) *(u32 *)(r10 -4) = r0
regs=40 stack=0 before 11: (b7) r0 = 0
parent didn't have regs=40 stack=0 marks: R1=ctx(off=0,imm=0) R6_rw=Pscalar(umax=18446744071562067968) R7_w=0 R8_w=0 R9_w=-2147483648 R10=fp0 last_idx 9 first_idx 0
regs=40 stack=0 before 9: (bd) if r6 <= r9 goto pc+1
regs=240 stack=0 before 6: (bd) if r6 <= r9 goto pc+2
regs=240 stack=0 before 5: (05) goto pc+0
regs=240 stack=0 before 4: (97) r6 %= 1025
regs=240 stack=0 before 3: (b7) r9 = -2147483648
regs=40 stack=0 before 2: (b7) r8 = 0
regs=40 stack=0 before 1: (b7) r7 = 0
regs=40 stack=0 before 0: (b7) r6 = 1024
math between map_value pointer and register with unbounded min value is not allowed
verification time 886 usec
stack depth 4
processed 49 insns (limit 1000000) max_states_per_insn 1 total_states 5 peak_states 5 mark_read 2
--- kernel/bpf/verifier.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
kernel/bpf/verifier.c +15 -0
@@ -1563,6 +1563,21 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, } }else if (opcode ==BPF_EXIT ) {return -ENOTSUPP ; + }else if (BPF_SRC (insn->code) ==BPF_X ) { +if (!(*reg_mask & (dreg | sreg))) +return 0 ; +/* dreg <cond> sreg +* Both dreg and sreg need precision before +* this insn. If only sreg was marked precise +* before it would be equally necessary to +* propagate it to dreg. +*/ + *reg_mask |= (sreg | dreg); +/* else dreg <cond> K +* Only dreg still needs precision before +* this insn, so for the K-based conditional +* there is nothing new to be marked. +*/ } }else if (class ==BPF_LD ) {if (!(*reg_mask & dreg))
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 12/39 e1000e: Disable TSO on i219-LM card to increase speed
In reply to Greg Kroah-HartmanFrom: Sebastian Basierski <[email protected]>
[ Upstream commit 67d47b95119ad589b0a0b16b88b1dd9a04061ced ]
While using i219-LM card currently it was only possible to achieve about 60% of maximum speed due to regression introduced in Linux 5.8. This was caused by TSO not being disabled by default despite commit f29801030ac6 ("e1000e: Disable TSO for buffer overrun workaround"). Fix that by disabling TSO during driver probe.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 51 +++++++++++----------- 1 file changed, 26 insertions(+), 25 deletions(-)
drivers/net/ethernet/intel/e1000e/netdev.c +26 -25
@@ -5270,31 +5270,6 @@ static void e1000_watchdog_task(struct work_struct *work)ew32 (TARC (0 ), tarc0); } -/* disable TSO for pcie and 10/100 speeds, to avoid -* some hardware issues -*/ -if (!(adapter->flags &FLAG_TSO_FORCE )) { -switch (adapter->link_speed) { -case SPEED_10 : -case SPEED_100 : -e_info ("10/100 speed: disabling TSO\n" ); - netdev->features &= ~NETIF_F_TSO ; - netdev->features &= ~NETIF_F_TSO6 ; -break ; -case SPEED_1000 : - netdev->features |=NETIF_F_TSO ; - netdev->features |=NETIF_F_TSO6 ; -break ; -default : -/* oops */ -break ; - } -if (hw->mac.type == e1000_pch_spt) { - netdev->features &= ~NETIF_F_TSO ; - netdev->features &= ~NETIF_F_TSO6 ; - } - } -/* enable transmits in the hardware, need to do this * after setting TARC(0) */
@@ -7223,6 +7198,32 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)NETIF_F_RXCSUM | NETIF_F_HW_CSUM); +/* disable TSO for pcie and 10/100 speeds to avoid +* some hardware issues and for i219 to fix transfer +* speed being capped at 60% +*/ +if (!(adapter->flags &FLAG_TSO_FORCE )) { +switch (adapter->link_speed) { +case SPEED_10 : +case SPEED_100 : +e_info ("10/100 speed: disabling TSO\n" ); + netdev->features &= ~NETIF_F_TSO ; + netdev->features &= ~NETIF_F_TSO6 ; +break ; +case SPEED_1000 : + netdev->features |=NETIF_F_TSO ; + netdev->features |=NETIF_F_TSO6 ; +break ; +default : +/* oops */ +break ; + } +if (hw->mac.type == e1000_pch_spt) { + netdev->features &= ~NETIF_F_TSO ; + netdev->features &= ~NETIF_F_TSO6 ; + } + } +/* Set user-changeable features (subset of all device features) */ netdev->hw_features = netdev->features; netdev->hw_features |=NETIF_F_RXFCS ;
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 13/39 f2fs: Fix f2fs_truncate_partial_nodes ftrace event
In reply to Greg Kroah-HartmanFrom: Douglas Raillard <[email protected]>
[ Upstream commit 0b04d4c0542e8573a837b1d81b94209e48723b25 ]
Fix the nid_t field so that its size is correctly reported in the text format embedded in trace.dat files. As it stands, it is reported as being of size 4:
field:nid_t nid[3]; offset:24; size:4; signed:0;
Instead of 12:
field:nid_t nid[3]; offset:24; size:12; signed:0;
This also fixes the reported offset of subsequent fields so that they match with the actual struct layout.
--- include/trace/events/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/trace/events/f2fs.h +1 -1
@@ -499,7 +499,7 @@ TRACE_EVENT(f2fs_truncate_partial_nodes,TP_STRUCT__entry (__field (dev_t ,dev )__field (ino_t, ino) - __field(nid_t, nid[3]) +__array (nid_t, nid,3 )__field (int, depth)__field (int, err) ),
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 14/39 Input: i8042 - add quirk for Fujitsu Lifebook A574/H
In reply to Greg Kroah-HartmanFrom: Jonathan Denose <[email protected]>
[ Upstream commit f5bad62f9107b701a6def7cac1f5f65862219b83 ]
Fujitsu Lifebook A574/H requires the nomux option to properly probe the touchpad, especially when waking from sleep.
--- drivers/input/serio/i8042-x86ia64io.h | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/input/serio/i8042-x86ia64io.h +8 -0
@@ -601,6 +601,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = { }, .driver_data = (void *)(SERIO_QUIRK_NOMUX) }, + { +/* Fujitsu Lifebook A574/H */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "FMVA0501PZ"), + }, + .driver_data = (void *)(SERIO_QUIRK_NOMUX ) + }, {/* Gigabyte M912 */ .matches = {
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 15/39 selftests: sigaltstack: fix -Wuninitialized
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
[ Upstream commit 05107edc910135d27fe557267dc45be9630bf3dd ]
Building sigaltstack with clang via:
$ ARCH=x86 make LLVM=1 -C tools/testing/selftests/sigaltstack/
produces the following warning:
warning: variable 'sp' is uninitialized when used here [-Wuninitialized] if (sp < (unsigned long)sstack ||
^~
Clang expects these to be declared at global scope; we've fixed this in the kernel proper by using the macro current_stack_pointer. This is defined in different headers for different target architectures, so just create a new header that defines the arch-specific register names for the stack pointer register, and define it for more targets (at least the ones that support current_stack_pointer/ARCH_HAS_CURRENT_STACK_POINTER).
--- .../sigaltstack/current_stack_pointer.h | 23 +++++++++++++++++++ tools/testing/selftests/sigaltstack/sas.c | 7 +----- 2 files changed, 24 insertions(+), 6 deletions(-) create mode 100644 tools/testing/selftests/sigaltstack/current_stack_pointer.h
tools/testing/selftests/sigaltstack/current_stack_pointer.h new file +23 -0
@@ -0,0 +1,23 @@ +/* SPDX-License-Identifier: GPL-2.0 */ + +#if __alpha__ +registerunsigned long sp asm("$30" ); +#elif __arm__ || __aarch64__ || __csky__ || __m68k__ || __mips__ || __riscv +registerunsigned long sp asm("sp" ); +#elif __i386__ +registerunsigned long sp asm("esp" ); +#elif __loongarch64 +registerunsigned long sp asm("$sp" ); +#elif __ppc__ +registerunsigned long sp asm("r1" ); +#elif __s390x__ +registerunsigned long sp asm("%15" ); +#elif __sh__ +registerunsigned long sp asm("r15" ); +#elif __x86_64__ +registerunsigned long sp asm("rsp" ); +#elif __XTENSA__ +registerunsigned long sp asm("a1" ); +#else +#error "implement current_stack_pointer equivalent" +#endif
tools/testing/selftests/sigaltstack/sas.c +1 -6
@@ -19,6 +19,7 @@#include <errno.h> #include "../kselftest.h" +#include "current_stack_pointer.h" #ifndef SS_AUTODISARM #define SS_AUTODISARM (1U << 31)
@@ -40,12 +41,6 @@ void my_usr1(int sig, siginfo_t *si, void *u)stack_t stk;struct stk_data *p; -#if __s390x__ - registerunsigned long sp asm("%15" ); -#else - registerunsigned long sp asm("sp" ); -#endif -if (sp < (unsigned long )sstack || sp >= (unsigned long )sstack +SIGSTKSZ ) {ksft_exit_fail_msg ("SP is not on sigaltstack\n" );
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 16/39 scsi: megaraid_sas: Fix fw_crash_buffer_show()
In reply to Greg Kroah-HartmanFrom: Tomas Henzl <[email protected]>
[ Upstream commit 0808ed6ebbc292222ca069d339744870f6d801da ]
If crash_dump_buf is not allocated then crash dump can't be available. Replace logical 'and' with 'or'.
--- drivers/scsi/megaraid/megaraid_sas_base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/megaraid/megaraid_sas_base.c +1 -1
@@ -3235,7 +3235,7 @@ fw_crash_buffer_show(struct device *cdev,spin_lock_irqsave (&instance->crashdump_lock, flags); buff_offset = instance->fw_crash_buffer_offset; -if (!instance->crash_dump_buf && +if (!instance->crash_dump_buf || !((instance->fw_crash_state ==AVAILABLE ) || (instance->fw_crash_state ==COPYING ))) { dev_err(&instance->pdev->dev,
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 17/39 scsi: core: Improve scsi_vpd_inquiry() checks
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
[ Upstream commit f0aa59a33d2ac2267d260fe21eaf92500df8e7b4 ]
Some USB-SATA adapters have broken behavior when an unsupported VPD page is
probed: Depending on the VPD page number, a 4-byte header with a valid VPD page number but with a 0 length is returned. Currently, scsi_vpd_inquiry() only checks that the page number is valid to determine if the page is valid, which results in receiving only the 4-byte header for the non-existent page. This error manifests itself very often with page 0xb9 for the Concurrent Positioning Ranges detection done by sd_read_cpr(), resulting in the following error message:
sd 0:0:0:0: [sda] Invalid Concurrent Positioning Ranges VPD page
Prevent such misleading error message by adding a check in scsi_vpd_inquiry() to verify that the page length is not 0.
--- drivers/scsi/scsi.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
drivers/scsi/scsi.c +9 -2
@@ -331,11 +331,18 @@ static int scsi_vpd_inquiry(struct scsi_device *sdev, unsigned char *buffer,if (result)return -EIO ; -/* Sanity check that we got the page back that we asked for */ +/* +* Sanity check that we got the page back that we asked for and that +* the page size is not 0. +*/ if (buffer[1 ] != page)return -EIO ; -return get_unaligned_be16 (&buffer[2 ]) +4 ; + result =get_unaligned_be16 (&buffer[2 ]); +if (!result) +return -EIO ; + +return result +4 ; }/**
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 18/39 net: dsa: b53: mmap: add phy ops
In reply to Greg Kroah-HartmanFrom: Álvaro Fernández Rojas <[email protected]>
[ Upstream commit 45977e58ce65ed0459edc9a0466d9dfea09463f5 ]
Implement phy_read16() and phy_write16() ops for B53 MMAP to avoid accessing B53_PORT_MII_PAGE registers which hangs the device.
This access should be done through the MDIO Mux bus controller.
--- drivers/net/dsa/b53/b53_mmap.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/net/dsa/b53/b53_mmap.c +14 -0
@@ -215,6 +215,18 @@ static int b53_mmap_write64(struct b53_device *dev, u8 page, u8 reg,return 0 ; } +static int b53_mmap_phy_read16 (struct b53_device *dev,int addr,int reg, +u16 *value) +{ +return -EIO ; +} + +static int b53_mmap_phy_write16 (struct b53_device *dev,int addr,int reg, +u16 value) +{ +return -EIO ; +} +static const struct b53_io_ops b53_mmap_ops = { .read8 = b53_mmap_read8, .read16 = b53_mmap_read16,
@@ -226,6 +238,8 @@ static const struct b53_io_ops b53_mmap_ops = { .write32 = b53_mmap_write32, .write48 = b53_mmap_write48, .write64 = b53_mmap_write64, + .phy_read16 = b53_mmap_phy_read16, + .phy_write16 = b53_mmap_phy_write16, };static int b53_mmap_probe (struct platform_device *pdev)
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 19/39 s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling
In reply to Greg Kroah-HartmanFrom: Heiko Carstens <[email protected]>
[ Upstream commit f9bbf25e7b2b74b52b2f269216a92657774f239c ]
Return -EFAULT if put_user() for the PTRACE_GET_LAST_BREAK request fails, instead of silently ignoring it.
--- arch/s390/kernel/ptrace.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
arch/s390/kernel/ptrace.c +2 -6
@@ -502,9 +502,7 @@ long arch_ptrace(struct task_struct *child, long request, }return 0 ;case PTRACE_GET_LAST_BREAK : -put_user (child->thread.last_break, - (unsigned long __user *) data); -return 0 ; +return put_user (child->thread.last_break, (unsigned long __user *)data);case PTRACE_ENABLE_TE :if (!MACHINE_HAS_TE )return -EIO ;
@@ -856,9 +854,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, }return 0 ;case PTRACE_GET_LAST_BREAK : -put_user (child->thread.last_break, - (unsigned int __user *) data); -return 0 ; +return put_user (child->thread.last_break, (unsigned int __user *)data); }return compat_ptrace_request (child, request, addr, data); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 20/39 nvme-tcp: fix a possible UAF when failing to allocate an io queue
In reply to Greg Kroah-HartmanFrom: Sagi Grimberg <[email protected]>
[ Upstream commit 88eaba80328b31ef81813a1207b4056efd7006a6 ]
When we allocate a nvme-tcp queue, we set the data_ready callback before we actually need to use it. This creates the potential that if a stray controller sends us data on the socket before we connect, we can trigger the io_work and start consuming the socket.
In this case reported: we failed to allocate one of the io queues, and as we start releasing the queues that we already allocated, we get a UAF [1] from the io_work which is running before it should really.
Fix this by setting the socket ops callbacks only before we start the queue, so that we can't accidentally schedule the io_work in the initialization phase before the queue started. While we are at it, rename nvme_tcp_restore_sock_calls to pair with nvme_tcp_setup_sock_ops.
[1]:
[16802.107284] nvme nvme4: starting error recovery [16802.109166] nvme nvme4: Reconnecting in 10 seconds... [16812.173535] nvme nvme4: failed to connect socket: -111 [16812.173745] nvme nvme4: Failed reconnect attempt 1 [16812.173747] nvme nvme4: Reconnecting in 10 seconds... [16822.413555] nvme nvme4: failed to connect socket: -111 [16822.413762] nvme nvme4: Failed reconnect attempt 2 [16822.413765] nvme nvme4: Reconnecting in 10 seconds... [16832.661274] nvme nvme4: creating 32 I/O queues. [16833.919887] BUG: kernel NULL pointer dereference, address: 0000000000000088 [16833.920068] nvme nvme4: Failed reconnect attempt 3 [16833.920094] #PF: supervisor write access in kernel mode [16833.920261] nvme nvme4: Reconnecting in 10 seconds... [16833.920368] #PF: error_code(0x0002) - not-present page [16833.921086] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [16833.921191] RIP: 0010:_raw_spin_lock_bh+0x17/0x30 ... [16833.923138] Call Trace: [16833.923271] <TASK> [16833.923402] lock_sock_nested+0x1e/0x50 [16833.923545] nvme_tcp_try_recv+0x40/0xa0 [nvme_tcp] [16833.923685] nvme_tcp_io_work+0x68/0xa0 [nvme_tcp] [16833.923824] process_one_work+0x1e8/0x390 [16833.923969] worker_thread+0x53/0x3d0 [16833.924104] ? process_one_work+0x390/0x390 [16833.924240] kthread+0x124/0x150 [16833.924376] ? set_kthread_struct+0x50/0x50 [16833.924518] ret_from_fork+0x1f/0x30 [16833.924655] </TASK>
--- drivers/nvme/host/tcp.c | 46 +++++++++++++++++++++++------------------ 1 file changed, 26 insertions(+), 20 deletions(-)
drivers/nvme/host/tcp.c +26 -20
@@ -1387,22 +1387,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,if (ret) goto err_init_connect; - queue->rd_enabled = true;set_bit (NVME_TCP_Q_ALLOCATED , &queue->flags); -nvme_tcp_init_recv_ctx (queue); - -write_lock_bh (&queue->sock->sk->sk_callback_lock); - queue->sock->sk->sk_user_data = queue; - queue->state_change = queue->sock->sk->sk_state_change; - queue->data_ready = queue->sock->sk->sk_data_ready; - queue->write_space = queue->sock->sk->sk_write_space; - queue->sock->sk->sk_data_ready = nvme_tcp_data_ready; - queue->sock->sk->sk_state_change = nvme_tcp_state_change; - queue->sock->sk->sk_write_space = nvme_tcp_write_space; -#ifdef CONFIG_NET_RX_BUSY_POLL - queue->sock->sk->sk_ll_usec =1 ; -#endif -write_unlock_bh (&queue->sock->sk->sk_callback_lock);return 0 ;
@@ -1419,7 +1404,7 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl,return ret; } -static void nvme_tcp_restore_sock_calls (struct nvme_tcp_queue *queue) +static void nvme_tcp_restore_sock_ops (struct nvme_tcp_queue *queue) {struct socket *sock = queue->sock;
@@ -1434,7 +1419,7 @@ static void nvme_tcp_restore_sock_calls(struct nvme_tcp_queue *queue)static void __nvme_tcp_stop_queue (struct nvme_tcp_queue *queue) {kernel_sock_shutdown (queue->sock,SHUT_RDWR ); -nvme_tcp_restore_sock_calls (queue); +nvme_tcp_restore_sock_ops (queue);cancel_work_sync (&queue->io_work); }
@@ -1448,21 +1433,42 @@ static void nvme_tcp_stop_queue(struct nvme_ctrl *nctrl, int qid)__nvme_tcp_stop_queue (queue); } +static void nvme_tcp_setup_sock_ops (struct nvme_tcp_queue *queue) +{ +write_lock_bh (&queue->sock->sk->sk_callback_lock); + queue->sock->sk->sk_user_data = queue; + queue->state_change = queue->sock->sk->sk_state_change; + queue->data_ready = queue->sock->sk->sk_data_ready; + queue->write_space = queue->sock->sk->sk_write_space; + queue->sock->sk->sk_data_ready = nvme_tcp_data_ready; + queue->sock->sk->sk_state_change = nvme_tcp_state_change; + queue->sock->sk->sk_write_space = nvme_tcp_write_space; +#ifdef CONFIG_NET_RX_BUSY_POLL + queue->sock->sk->sk_ll_usec =1 ; +#endif +write_unlock_bh (&queue->sock->sk->sk_callback_lock); +} +static int nvme_tcp_start_queue (struct nvme_ctrl *nctrl,int idx) {struct nvme_tcp_ctrl *ctrl =to_tcp_ctrl (nctrl); +struct nvme_tcp_queue *queue = &ctrl->queues[idx];int ret; + queue->rd_enabled = true; +nvme_tcp_init_recv_ctx (queue); +nvme_tcp_setup_sock_ops (queue); +if (idx) ret =nvmf_connect_io_queue (nctrl, idx, false);else ret =nvmf_connect_admin_queue (nctrl);if (!ret) { -set_bit (NVME_TCP_Q_LIVE , &ctrl->queues[idx].flags); +set_bit (NVME_TCP_Q_LIVE , &queue->flags); }else { -if (test_bit (NVME_TCP_Q_ALLOCATED , &ctrl->queues[idx].flags)) -__nvme_tcp_stop_queue (&ctrl->queues[idx]); +if (test_bit (NVME_TCP_Q_ALLOCATED , &queue->flags)) +__nvme_tcp_stop_queue (queue);dev_err (nctrl->device,"failed to connect queue: %d ret=%d\n" , idx, ret); }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 21/39 xen/netback: use same error messages for same errors
In reply to Greg Kroah-HartmanFrom: Juergen Gross <[email protected]>
[ Upstream commit 2eca98e5b24d01c02b46c67be05a5f98cc9789b1 ]
Issue the same error message in case an illegal page boundary crossing has been detected in both cases where this is tested.
--- drivers/net/xen-netback/netback.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/xen-netback/netback.c +2 -4
@@ -989,10 +989,8 @@ static void xenvif_tx_build_gops(struct xenvif_queue *queue,/* No crossing a page as the payload mustn't fragment. */ if (unlikely ((txreq.offset + txreq.size) >XEN_PAGE_SIZE )) { -netdev_err (queue->vif->dev, -"txreq.offset: %u, size: %u, end: %lu\n" , - txreq.offset, txreq.size, - (unsigned long )(txreq.offset&~XEN_PAGE_MASK ) + txreq.size); +netdev_err (queue->vif->dev,"Cross page boundary, txreq.offset: %u, size: %u\n" , + txreq.offset, txreq.size);xenvif_fatal_tx_err (queue->vif);break ; }
Signature · 1 line
2.39.2
Greg Kroah-Hartman
maintainerPATCH 22/39 iio: light: tsl2772: fix reading proximity-diodes from device tree
In reply to Greg Kroah-HartmanFrom: Brian Masney <[email protected]>
commit b1cb00d51e361cf5af93649917d9790e1623647e upstream.
tsl2772_read_prox_diodes() will correctly parse the properties from device tree to determine which proximity diode(s) to read from, however it didn't actually set this value on the struct tsl2772_settings. Let's go ahead and fix that.
--- drivers/iio/light/tsl2772.c | 1 + 1 file changed, 1 insertion(+)
drivers/iio/light/tsl2772.c +1 -0
@@ -606,6 +606,7 @@ static int tsl2772_read_prox_diodes(strureturn -EINVAL ; } } + chip->settings.prox_diode = prox_diode_mask;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 23/39 nilfs2: initialize unused bytes in segment summary blocks
In reply to Greg Kroah-HartmanFrom: Ryusuke Konishi <[email protected]>
commit ef832747a82dfbc22a3702219cc716f449b24e4a upstream.
Syzbot still reports uninit-value in nilfs_add_checksums_on_logs() for KMSAN enabled kernels after applying commit 7397031622e0 ("nilfs2:
initialize "struct nilfs_binfo_dat"->bi_pad field").
This is because the unused bytes at the end of each block in segment summaries are not initialized. So this fixes the issue by padding the unused bytes with null bytes.
--- fs/nilfs2/segment.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
fs/nilfs2/segment.c +20 -0
@@ -435,6 +435,23 @@ static int nilfs_segctor_reset_segment_breturn 0 ; } +/** +* nilfs_segctor_zeropad_segsum - zero pad the rest of the segment summary area +* @sci: segment constructor object +* +* nilfs_segctor_zeropad_segsum() zero-fills unallocated space at the end of +* the current segment summary block. +*/ +static void nilfs_segctor_zeropad_segsum (struct nilfs_sc_info *sci) +{ +struct nilfs_segsum_pointer *ssp; + + ssp = sci->sc_blk_cnt >0 ? &sci->sc_binfo_ptr : &sci->sc_finfo_ptr; +if (ssp->offset < ssp->bh->b_size) +memset (ssp->bh->b_data + ssp->offset,0 , + ssp->bh->b_size - ssp->offset); +} +static int nilfs_segctor_feed_segment (struct nilfs_sc_info *sci) { sci->sc_nblk_this_inc += sci->sc_curseg->sb_sum.nblocks;
@@ -443,6 +460,7 @@ static int nilfs_segctor_feed_segment(st* The current segment is filled up * (internal code) */ +nilfs_segctor_zeropad_segsum (sci); sci->sc_curseg =NILFS_NEXT_SEGBUF (sci->sc_curseg);return nilfs_segctor_reset_segment_buffer (sci); }
@@ -547,6 +565,7 @@ static int nilfs_segctor_add_file_block( goto retry; }if (unlikely (required)) { +nilfs_segctor_zeropad_segsum (sci); err =nilfs_segbuf_extend_segsum (segbuf);if (unlikely (err)) goto failed;
@@ -1531,6 +1550,7 @@ static int nilfs_segctor_collect(struct nadd =min_t (int, nadd <<1 ,SC_MAX_SEGDELTA ); sci->sc_stage = prev_stage; } +nilfs_segctor_zeropad_segsum (sci);nilfs_segctor_truncate_segments (sci, sci->sc_curseg, nilfs->ns_sufile);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 24/39 memstick: fix memory leak if card device is never registered
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
commit 4b6d621c9d859ff89e68cebf6178652592676013 upstream.
When calling dev_set_name() memory is allocated for the name for the struct device. Once that structure device is registered, or attempted to be registerd, with the driver core, the driver core will handle cleaning up that memory when the device is removed from the system.
Unfortunatly for the memstick code, there is an error path that causes the struct device to never be registered, and so the memory allocated in dev_set_name will be leaked. Fix that leak by manually freeing it right before the memory for the device is freed.
--- drivers/memstick/core/memstick.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/memstick/core/memstick.c +4 -1
@@ -412,6 +412,7 @@ static struct memstick_dev *memstick_allreturn card; err_out: host->card = old_card; +kfree_const (card->dev.kobj.name);kfree (card);return NULL ; }
@@ -470,8 +471,10 @@ static void memstick_check(struct work_sput_device (&card->dev); host->card =NULL ; } - }else + }else { +kfree_const (card->dev.kobj.name);kfree (card); + } } out_power_off:
Greg Kroah-Hartman
maintainerPATCH 25/39 mmc: sdhci_am654: Set HIGH_SPEED_ENA for SDR12 and SDR25
In reply to Greg Kroah-HartmanFrom: Bhavya Kapoor <[email protected]>
commit 2265098fd6a6272fde3fd1be5761f2f5895bd99a upstream.
Timing Information in Datasheet assumes that HIGH_SPEED_ENA=1 should be set for SDR12 and SDR25 modes. But sdhci_am654 driver clears HIGH_SPEED_ENA register. Thus, Modify sdhci_am654 to not clear HIGH_SPEED_ENA (HOST_CONTROL[2]) bit for SDR12 and SDR25 speed modes.
--- drivers/mmc/host/sdhci_am654.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/sdhci_am654.c +0 -2
@@ -227,8 +227,6 @@ static void sdhci_am654_write_b(struct s*/ case MMC_TIMING_SD_HS :case MMC_TIMING_MMC_HS : -case MMC_TIMING_UHS_SDR12 : -case MMC_TIMING_UHS_SDR25 : val &= ~SDHCI_CTRL_HISPD ; } }
Greg Kroah-Hartman
maintainerPATCH 26/39 MIPS: Define RUNTIME_DISCARD_EXIT in LD script
In reply to Greg Kroah-HartmanFrom: Jiaxun Yang <[email protected]>
commit 6dcbd0a69c84a8ae7a442840a8cf6b1379dc8f16 upstream.
MIPS's exit sections are discarded at runtime as well.
Fixes link error:.exit.text' referenced in section __jump_table' of fs/fuse/inode.o:
defined in discarded section `.exit.text' of fs/fuse/inode.o
--- arch/mips/kernel/vmlinux.lds.S | 2 ++ 1 file changed, 2 insertions(+)
arch/mips/kernel/vmlinux.lds.S +2 -0
@@ -10,6 +10,8 @@ */ #define BSS_FIRST_SECTIONS *(.bss..swapper_pg_dir) +#define RUNTIME_DISCARD_EXIT + #include <asm-generic/vmlinux.lds.h> #undef mips
Greg Kroah-Hartman
maintainerPATCH 27/39 x86/purgatory: Dont generate debug info for purgatory.ro
In reply to Greg Kroah-HartmanFrom: Pingfan Liu <[email protected]>
commit 52416ffcf823ee11aa19792715664ab94757f111 upstream.
Purgatory.ro is a standalone binary that is not linked against the rest of the kernel. Its image is copied into an array that is linked to the kernel, and from there kexec relocates it wherever it desires.
Unlike the debug info for vmlinux, which can be used for analyzing crash such info is useless in purgatory.ro. And discarding them can save about 200K space.
Original:
259080 kexec-purgatory.o
Stripped debug info:
29152 kexec-purgatory.o
--- arch/x86/purgatory/Makefile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
arch/x86/purgatory/Makefile +4 -1
@@ -27,7 +27,7 @@ KCOV_INSTRUMENT := n # make up the standalone purgatory.ro PURGATORY_CFLAGS_REMOVE := -mcmodel=kernel -PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss +PURGATORY_CFLAGS := -mcmodel=large -ffreestanding -fno-zero-initialized-in-bss -g0 PURGATORY_CFLAGS += $(DISABLE_STACKLEAK_PLUGIN) -DDISABLE_BRANCH_PROFILING # Default KBUILD_CFLAGS can have -pg option set when FTRACE is enabled. That
@@ -58,6 +58,9 @@ CFLAGS_sha256.o += $(PURGATORY_CFLAGS) CFLAGS_REMOVE_string.o += $(PURGATORY_CFLAGS_REMOVE) CFLAGS_string.o += $(PURGATORY_CFLAGS) +AFLAGS_REMOVE_setup-x86_$(BITS).o += -g -Wa,-gdwarf-2 +AFLAGS_REMOVE_entry64.o += -g -Wa,-gdwarf-2 + $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE $(call if_changed,ld)
Greg Kroah-Hartman
maintainerPATCH 28/39 Revert "ext4: fix use-after-free in ext4_xattr_set_entry"
In reply to Greg Kroah-HartmanFrom: Tudor Ambarus <[email protected]>
This reverts commit bb8592efcf8ef2f62947745d3182ea05b5256a15 which is commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 upstream.
The order in which patches are queued to stable matters. This patch has a logical dependency on commit 310c097c2bdbea253d6ee4e064f3e65580ef93ac upstream, and failing to queue the latter results in a null-ptr-deref reported at the Link below.
In order to avoid conflicts on stable, revert the commit just so that we can queue its prerequisite patch first and then queue the same after.
--- fs/ext4/xattr.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
fs/ext4/xattr.c +2 -4
@@ -2210,9 +2210,8 @@ int ext4_xattr_ibody_find(struct inode *struct ext4_inode *raw_inode;int error; -if (!EXT4_INODE_HAS_XATTR_SPACE (inode)) +if (EXT4_I (inode)->i_extra_isize ==0 )return 0 ; - raw_inode =ext4_raw_inode (&is->iloc); header =IHDR (inode, raw_inode); is->s.base = is->s.first =IFIRST (header);
@@ -2240,9 +2239,8 @@ int ext4_xattr_ibody_inline_set(handle_tstruct ext4_xattr_search *s = &is->s;int error; -if (!EXT4_INODE_HAS_XATTR_SPACE (inode)) +if (EXT4_I (inode)->i_extra_isize ==0 )return -ENOSPC ; - error =ext4_xattr_set_entry (i, s, handle, inode, false/* is_block */ );if (error)return error;
Greg Kroah-Hartman
maintainerPATCH 29/39 ext4: remove duplicate definition of ext4_xattr_ibody_inline_set()
In reply to Greg Kroah-HartmanFrom: Ritesh Harjani <[email protected]>
[ Upstream commit 310c097c2bdbea253d6ee4e064f3e65580ef93ac ]
ext4_xattr_ibody_inline_set() & ext4_xattr_ibody_set() have the exact same definition. Hence remove ext4_xattr_ibody_inline_set() and all its call references. Convert the callers of it to call ext4_xattr_ibody_set() instead.
[ Modified to preserve ext4_xattr_ibody_set() and remove
ext4_xattr_ibody_inline_set() instead. -- TYT ]
--- fs/ext4/inline.c | 11 +++++------ fs/ext4/xattr.c | 26 +------------------------- fs/ext4/xattr.h | 6 +++--- 3 files changed, 9 insertions(+), 34 deletions(-)
fs/ext4/inline.c +5 -6
@@ -206,7 +206,7 @@ out:/* * write the buffer to the inline inode. * If 'create' is set, we don't need to do the extra copy in the xattr -* value since it is already handled by ext4_xattr_ibody_inline_set. +* value since it is already handled by ext4_xattr_ibody_set. * That saves us one memcpy. */ static void ext4_write_inline_data(struct inode *inode, struct ext4_iloc *iloc,
@@ -288,7 +288,7 @@ static int ext4_create_inline_data(handlBUG_ON (!is.s.not_found); - error =ext4_xattr_ibody_inline_set (handle, inode, &i, &is); + error =ext4_xattr_ibody_set (handle, inode, &i, &is);if (error) {if (error == -ENOSPC ) ext4_clear_inode_state(inode,
@@ -360,7 +360,7 @@ static int ext4_update_inline_data(handl i.value = value; i.value_len = len; - error =ext4_xattr_ibody_inline_set (handle, inode, &i, &is); + error =ext4_xattr_ibody_set (handle, inode, &i, &is);if (error) goto out;
@@ -433,7 +433,7 @@ static int ext4_destroy_inline_data_noloif (error) goto out; - error =ext4_xattr_ibody_inline_set (handle, inode, &i, &is); + error =ext4_xattr_ibody_set (handle, inode, &i, &is);if (error) goto out;
@@ -1969,8 +1969,7 @@ int ext4_inline_data_truncate(struct ino i.value = value; i.value_len = i_size >EXT4_MIN_INLINE_DATA_SIZE ? i_size -EXT4_MIN_INLINE_DATA_SIZE :0 ; - err =ext4_xattr_ibody_inline_set (handle, inode, - &i, &is); + err =ext4_xattr_ibody_set (handle, inode, &i, &is);if (err) goto out_error; }
fs/ext4/xattr.c +1 -25
@@ -2231,31 +2231,7 @@ int ext4_xattr_ibody_find(struct inode *return 0 ; } -int ext4_xattr_ibody_inline_set (handle_t *handle,struct inode *inode, -struct ext4_xattr_info *i, -struct ext4_xattr_ibody_find *is) -{ -struct ext4_xattr_ibody_header *header; -struct ext4_xattr_search *s = &is->s; -int error; - -if (EXT4_I (inode)->i_extra_isize ==0 ) -return -ENOSPC ; - error =ext4_xattr_set_entry (i, s, handle, inode, false/* is_block */ ); -if (error) -return error; - header =IHDR (inode,ext4_raw_inode (&is->iloc)); -if (!IS_LAST_ENTRY (s->first)) { - header->h_magic =cpu_to_le32 (EXT4_XATTR_MAGIC ); -ext4_set_inode_state (inode,EXT4_STATE_XATTR ); - }else { - header->h_magic =cpu_to_le32 (0 ); -ext4_clear_inode_state (inode,EXT4_STATE_XATTR ); - } -return 0 ; -} - -static int ext4_xattr_ibody_set (handle_t *handle,struct inode *inode, +int ext4_xattr_ibody_set (handle_t *handle,struct inode *inode,struct ext4_xattr_info *i,struct ext4_xattr_ibody_find *is) {
fs/ext4/xattr.h +3 -3
@@ -199,9 +199,9 @@ extern int ext4_xattr_ibody_find(structextern int ext4_xattr_ibody_get (struct inode *inode,int name_index,const char *name,void *buffer,size_t buffer_size); -extern int ext4_xattr_ibody_inline_set (handle_t *handle,struct inode *inode, -struct ext4_xattr_info *i, -struct ext4_xattr_ibody_find *is); +extern int ext4_xattr_ibody_set (handle_t *handle,struct inode *inode, +struct ext4_xattr_info *i, +struct ext4_xattr_ibody_find *is);extern struct mb_cache *ext4_xattr_create_cache (void );extern void ext4_xattr_destroy_cache (struct mb_cache *);
Greg Kroah-Hartman
maintainerPATCH 30/39 ext4: fix use-after-free in ext4_xattr_set_entry
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
[ Upstream commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 ]
Hulk Robot reported a issue:
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500 Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092 CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17 Call Trace: [...] memcpy+0x34/0x50 mm/kasan/kasan.c:303 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498 __vfs_setxattr+0x112/0x170 fs/xattr.c:149 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238 vfs_setxattr+0xed/0x270 fs/xattr.c:255 setxattr+0x235/0x330 fs/xattr.c:520 path_setxattr+0x176/0x190 fs/xattr.c:539 __do_sys_lsetxattr fs/xattr.c:561 [inline] __se_sys_lsetxattr fs/xattr.c:557 [inline] __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x459fe9 RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9 RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
[...]
==================================================================
Above issue may happen as follows:
-------------------------------------ext4_xattr_set
ext4_xattr_set_handle
ext4_xattr_ibody_find
>> s->end < s->base
>> no EXT4_STATE_XATTR
>> xattr_check_inode is not executed
ext4_xattr_ibody_set
ext4_xattr_set_entry
>> size_t min_offs = s->end - s->base
>> UAF in memcpy
we can easily reproduce this problem with the following commands:
mkfs.ext4 -F /dev/sda
mount -o debug_want_extra_isize=128 /dev/sda /mnt
touch /mnt/file
setfattr -n user.cat -v seq -s z 4096|tr -d '[:digit:]' /mnt/file
In ext4_xattr_ibody_find, we have the following assignment logic:
header = IHDR(inode, raw_inode)
= raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
is->s.base = IFIRST(header)
= header + sizeof(struct ext4_xattr_ibody_header)
is->s.end = raw_inode + s_inode_size
In ext4_xattr_set_entry
min_offs = s->end - s->base
= s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
sizeof(struct ext4_xattr_ibody_header)
last = s->first
free = min_offs - ((void *)last - s->base) - sizeof(__u32)
= s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32)
In the calculation formula, all values except s_inode_size and i_extra_size are fixed values. When i_extra_size is the maximum value s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8. The value overflows. As a result, the preceding issue is triggered when memcpy is executed.
Therefore, when finding xattr or setting xattr, check whether there is space for storing xattr in the inode to resolve this issue.
--- fs/ext4/xattr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +4 -2
@@ -2210,8 +2210,9 @@ int ext4_xattr_ibody_find(struct inode *struct ext4_inode *raw_inode;int error; -if (EXT4_I (inode)->i_extra_isize ==0 ) +if (!EXT4_INODE_HAS_XATTR_SPACE (inode))return 0 ; + raw_inode =ext4_raw_inode (&is->iloc); header =IHDR (inode, raw_inode); is->s.base = is->s.first =IFIRST (header);
@@ -2239,8 +2240,9 @@ int ext4_xattr_ibody_set(handle_t *handlstruct ext4_xattr_search *s = &is->s;int error; -if (EXT4_I (inode)->i_extra_isize ==0 ) +if (!EXT4_INODE_HAS_XATTR_SPACE (inode))return -ENOSPC ; + error =ext4_xattr_set_entry (i, s, handle, inode, false/* is_block */ );if (error)return error;
Greg Kroah-Hartman
maintainerPATCH 31/39 udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM).
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 21985f43376cee092702d6cb963ff97a9d2ede68 upstream.
Commit 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") forgot to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6 socket into IPv4 with IPV6_ADDRFORM. After conversion, sk_prot is changed to udp_prot and ->destroy() never cleans it up, resulting in a memory leak.
This is due to the discrepancy between inet6_destroy_sock() and IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM to remove the difference.
However, this is not enough for now because rxpmtu can be changed without lock_sock() after commit 03485f2adcde ("udpv6: Add lockless sendmsg() support"). We will fix this case in the following patch.
Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy() in the future.
--- include/net/ipv6.h | 1 + net/ipv6/af_inet6.c | 6 ++++++ net/ipv6/ipv6_sockglue.c | 20 ++++++++------------ 3 files changed, 15 insertions(+), 12 deletions(-)
include/net/ipv6.h +1 -0
@@ -1100,6 +1100,7 @@ void ipv6_icmp_error(struct sock *sk, stvoid ipv6_local_error (struct sock *sk,int err,struct flowi6 *fl6,u32 info);void ipv6_local_rxpmtu (struct sock *sk,struct flowi6 *fl6,u32 mtu); +void inet6_cleanup_sock (struct sock *sk);int inet6_release (struct socket *sock);int inet6_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
net/ipv6/af_inet6.c +6 -0
@@ -498,6 +498,12 @@ void inet6_destroy_sock(struct sock *sk) }EXPORT_SYMBOL_GPL (inet6_destroy_sock); +void inet6_cleanup_sock (struct sock *sk) +{ +inet6_destroy_sock (sk); +} +EXPORT_SYMBOL_GPL (inet6_cleanup_sock); +/* * This does both peername and sockname. */
net/ipv6/ipv6_sockglue.c +8 -12
@@ -176,9 +176,6 @@ static int do_ipv6_setsockopt(struct socif (optlen <sizeof (int )) goto e_inval;if (val ==PF_INET ) { -struct ipv6_txoptions *opt; -struct sk_buff *pktopt; -if (sk->sk_type ==SOCK_RAW )break ;
@@ -209,7 +206,6 @@ static int do_ipv6_setsockopt(struct socbreak ; } -fl6_free_socklist (sk);__ipv6_sock_mc_close (sk);__ipv6_sock_ac_close (sk);
@@ -244,14 +240,14 @@ static int do_ipv6_setsockopt(struct soc sk->sk_socket->ops = &inet_dgram_ops; sk->sk_family =PF_INET ; } - opt =xchg ((__force struct ipv6_txoptions **)&np->opt, -NULL ); -if (opt) { -atomic_sub (opt->tot_len, &sk->sk_omem_alloc); -txopt_put (opt); - } - pktopt =xchg (&np->pktoptions,NULL ); -kfree_skb (pktopt); + +/* Disable all options not to allocate memory anymore, +* but there is still a race. See the lockless path +* in udpv6_sendmsg() and ipv6_local_rxpmtu(). +*/ + np->rxopt.all =0 ; + +inet6_cleanup_sock (sk);/* * ... and add it to the refcnt debug socks count
Greg Kroah-Hartman
maintainerPATCH 32/39 tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit d38afeec26ed4739c640bf286c270559aab2ba5f upstream.
Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were able to clean them up by calling inet6_destroy_sock() during the IPv6 -> IPv4 conversion by IPV6_ADDRFORM. However, commit 03485f2adcde ("udpv6:
Add lockless sendmsg() support") added a lockless memory allocation path, which could cause a memory leak:
setsockopt(IPV6_ADDRFORM) sendmsg() +-----------------------+ +-------+ - do_ipv6_setsockopt(sk, ...) - udpv6_sendmsg(sk, ...)
- sockopt_lock_sock(sk) ^._ called via udpv6_prot
- lock_sock(sk) before WRITE_ONCE()
- WRITE_ONCE(sk->sk_prot, &tcp_prot)
- inet6_destroy_sock() - if (!corkreq)
- sockopt_release_sock(sk) - ip6_make_skb(sk, ...)
- release_sock(sk) ^._ lockless fast path for
the non-corking case
- __ip6_append_data(sk, ...)
- ipv6_local_rxpmtu(sk, ...)
- xchg(&np->rxpmtu, skb) ^._ rxpmtu is never freed.
- goto out_no_dst;
- lock_sock(sk)
For now, rxpmtu is only the case, but not to miss the future change and a similar bug fixed in commit e27326009a3d ("net: ping6: Fix memleak in ipv6_renew_options()."), let's set a new function to IPv6 sk->sk_destruct() and call inet6_cleanup_sock() there. Since the conversion does not change sk->sk_destruct(), we can guarantee that we can clean up IPv6 resources finally.
We can now remove all inet6_destroy_sock() calls from IPv6 protocol specific ->destroy() functions, but such changes are invasive to backport. So they can be posted as a follow-up later for net-next.
--- include/net/ipv6.h | 1 + include/net/udp.h | 2 +- include/net/udplite.h | 8 -------- net/ipv4/udp.c | 9 ++++++--- net/ipv4/udplite.c | 8 ++++++++ net/ipv6/af_inet6.c | 8 +++++++- net/ipv6/udp.c | 15 ++++++++++++++- net/ipv6/udp_impl.h | 1 + net/ipv6/udplite.c | 9 ++++++++- 9 files changed, 46 insertions(+), 15 deletions(-)
include/net/ipv6.h +1 -0
@@ -1101,6 +1101,7 @@ void ipv6_local_error(struct sock *sk, ivoid ipv6_local_rxpmtu (struct sock *sk,struct flowi6 *fl6,u32 mtu);void inet6_cleanup_sock (struct sock *sk); +void inet6_sock_destruct (struct sock *sk);int inet6_release (struct socket *sock);int inet6_bind (struct socket *sock,struct sockaddr *uaddr,int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
include/net/udp.h +1 -1
@@ -261,7 +261,7 @@ static inline bool udp_sk_bound_dev_eq(s }/* net/ipv4/udp.c */ -void udp_destruct_sock (struct sock *sk); +void udp_destruct_common (struct sock *sk);void skb_consume_udp (struct sock *sk,struct sk_buff *skb,int len);int __udp_enqueue_schedule_skb (struct sock *sk,struct sk_buff *skb);void udp_skb_destructor (struct sock *sk,struct sk_buff *skb);
include/net/udplite.h +0 -8
@@ -24,14 +24,6 @@ static __inline__ int udplite_getfrag(voreturn copy_from_iter_full (to, len, &msg->msg_iter) ?0 : -EFAULT ; } -/* Designate sk as UDP-Lite socket */ -static inline int udplite_sk_init (struct sock *sk) -{ -udp_init_sock (sk); -udp_sk (sk)->pcflag =UDPLITE_BIT ; -return 0 ; -} -/* * Checksumming routines */
net/ipv4/udp.c +6 -3
@@ -1528,7 +1528,7 @@ drop: }EXPORT_SYMBOL_GPL (__udp_enqueue_schedule_skb); -void udp_destruct_sock (struct sock *sk) +void udp_destruct_common (struct sock *sk) {/* reclaim completely the forward allocated memory */ struct udp_sock *up =udp_sk (sk);
@@ -1541,10 +1541,14 @@ void udp_destruct_sock(struct sock *sk)kfree_skb (skb); }udp_rmem_release (sk, total,0 , true); +} +EXPORT_SYMBOL_GPL (udp_destruct_common); +static void udp_destruct_sock (struct sock *sk) +{ +udp_destruct_common (sk);inet_sock_destruct (sk); } -EXPORT_SYMBOL_GPL (udp_destruct_sock);int udp_init_sock (struct sock *sk) {
@@ -1552,7 +1556,6 @@ int udp_init_sock(struct sock *sk) sk->sk_destruct = udp_destruct_sock;return 0 ; } -EXPORT_SYMBOL_GPL (udp_init_sock);void skb_consume_udp (struct sock *sk,struct sk_buff *skb,int len) {
net/ipv4/udplite.c +8 -0
@@ -17,6 +17,14 @@struct udp_table udplite_table__read_mostly ;EXPORT_SYMBOL (udplite_table); +/* Designate sk as UDP-Lite socket */ +static int udplite_sk_init (struct sock *sk) +{ +udp_init_sock (sk); +udp_sk (sk)->pcflag =UDPLITE_BIT ; +return 0 ; +} +static int udplite_rcv (struct sk_buff *skb) {return __udp4_lib_rcv (skb, &udplite_table,IPPROTO_UDPLITE );
net/ipv6/af_inet6.c +7 -1
@@ -104,6 +104,12 @@ static __inline__ struct ipv6_pinfo *inereturn (struct ipv6_pinfo *)(((u8 *)sk) + offset); } +void inet6_sock_destruct (struct sock *sk) +{ +inet6_cleanup_sock (sk); +inet_sock_destruct (sk); +} +static int inet6_create (struct net *net,struct socket *sock,int protocol,int kern) {
@@ -196,7 +202,7 @@ lookup_protocol: inet->hdrincl =1 ; } - sk->sk_destruct = inet_sock_destruct; + sk->sk_destruct = inet6_sock_destruct; sk->sk_family =PF_INET6 ; sk->sk_protocol = protocol;
net/ipv6/udp.c +14 -1
@@ -54,6 +54,19 @@#include <trace/events/skb.h> #include "udp_impl.h" +static void udpv6_destruct_sock (struct sock *sk) +{ +udp_destruct_common (sk); +inet6_sock_destruct (sk); +} + +int udpv6_init_sock (struct sock *sk) +{ +skb_queue_head_init (&udp_sk (sk)->reader_queue); + sk->sk_destruct = udpv6_destruct_sock; +return 0 ; +} + static u32 udp6_ehashfn(const struct net *net, const struct in6_addr *laddr, const u16 lport,
@@ -1665,7 +1678,7 @@ struct proto udpv6_prot = { .connect = ip6_datagram_connect, .disconnect = udp_disconnect, .ioctl = udp_ioctl, - .init = udp_init_sock, + .init = udpv6_init_sock, .destroy = udpv6_destroy_sock, .setsockopt = udpv6_setsockopt, .getsockopt = udpv6_getsockopt,
net/ipv6/udp_impl.h +1 -0
@@ -12,6 +12,7 @@ int __udp6_lib_rcv(struct sk_buff *, strint __udp6_lib_err (struct sk_buff *,struct inet6_skb_parm *,u8 ,u8 ,int ,__be32 ,struct udp_table *); +int udpv6_init_sock (struct sock *sk);int udp_v6_get_port (struct sock *sk,unsigned short snum);void udp_v6_rehash (struct sock *sk);
net/ipv6/udplite.c +8 -1
@@ -12,6 +12,13 @@#include <linux/proc_fs.h> #include "udp_impl.h" +static int udplitev6_sk_init (struct sock *sk) +{ +udpv6_init_sock (sk); +udp_sk (sk)->pcflag =UDPLITE_BIT ; +return 0 ; +} +static int udplitev6_rcv (struct sk_buff *skb) {return __udp6_lib_rcv (skb, &udplite_table,IPPROTO_UDPLITE );
@@ -38,7 +45,7 @@ struct proto udplitev6_prot = { .connect = ip6_datagram_connect, .disconnect = udp_disconnect, .ioctl = udp_ioctl, - .init = udplite_sk_init, + .init = udplitev6_sk_init, .destroy = udpv6_destroy_sock, .setsockopt = udpv6_setsockopt, .getsockopt = udpv6_getsockopt,
Greg Kroah-Hartman
maintainerPATCH 33/39 inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit b5fc29233d28be7a3322848ebe73ac327559cdb9 upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
Now we can remove unnecessary inet6_destroy_sock() calls in sk->sk_prot->destroy().
DCCP and SCTP have their own sk->sk_destruct() function, so we change them separately in the following patches.
--- net/ipv6/ping.c | 6 ------ net/ipv6/raw.c | 2 -- net/ipv6/tcp_ipv6.c | 8 +------- net/ipv6/udp.c | 2 -- net/l2tp/l2tp_ip6.c | 2 -- 5 files changed, 1 insertion(+), 19 deletions(-)
net/ipv6/ping.c +0 -6
@@ -22,11 +22,6 @@#include <linux/proc_fs.h> #include <net/ping.h> -static void ping_v6_destroy (struct sock *sk) -{ -inet6_destroy_sock (sk); -} -/* Compatibility glue so we can support IPv6 when it's compiled as a module */ static int dummy_ipv6_recv_error (struct sock *sk,struct msghdr *msg,int len,int *addr_len)
@@ -170,7 +165,6 @@ struct proto pingv6_prot = { .owner = THIS_MODULE, .init = ping_init_sock, .close = ping_close, - .destroy = ping_v6_destroy, .connect = ip6_datagram_connect_v6_only, .disconnect = __udp_disconnect, .setsockopt = ipv6_setsockopt,
net/ipv6/raw.c +0 -2
@@ -1256,8 +1256,6 @@ static void raw6_destroy(struct sock *sklock_sock (sk);ip6_flush_pending_frames (sk);release_sock (sk); - -inet6_destroy_sock (sk); }static int rawv6_init_sk (struct sock *sk)
net/ipv6/tcp_ipv6.c +1 -7
@@ -1848,12 +1848,6 @@ static int tcp_v6_init_sock(struct sockreturn 0 ; } -static void tcp_v6_destroy_sock (struct sock *sk) -{ -tcp_v4_destroy_sock (sk); -inet6_destroy_sock (sk); -} -#ifdef CONFIG_PROC_FS /* Proc filesystem TCPv6 sock list dumping. */ static void get_openreq6(struct seq_file *seq,
@@ -2046,7 +2040,7 @@ struct proto tcpv6_prot = { .accept = inet_csk_accept, .ioctl = tcp_ioctl, .init = tcp_v6_init_sock, - .destroy = tcp_v6_destroy_sock, + .destroy = tcp_v4_destroy_sock, .shutdown = tcp_shutdown, .setsockopt = tcp_setsockopt, .getsockopt = tcp_getsockopt,
net/ipv6/udp.c +0 -2
@@ -1573,8 +1573,6 @@ void udpv6_destroy_sock(struct sock *sk)udp_encap_disable (); } } - -inet6_destroy_sock (sk); }/*
net/l2tp/l2tp_ip6.c +0 -2
@@ -268,8 +268,6 @@ static void l2tp_ip6_destroy_sock(structif (tunnel)l2tp_tunnel_delete (tunnel); - -inet6_destroy_sock (sk); }static int l2tp_ip6_bind (struct sock *sk,struct sockaddr *uaddr,int addr_len)
Greg Kroah-Hartman
maintainerPATCH 34/39 dccp: Call inet6_destroy_sock() via sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 1651951ebea54970e0bda60c638fc2eee7a6218f upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and DCCPv6 socket shares it by calling the same init function via dccp_v6_init_sock().
To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we export it and set dccp_v6_sk_destruct() in the init function.
--- net/dccp/dccp.h | 1 + net/dccp/ipv6.c | 15 ++++++++------- net/dccp/proto.c | 8 +++++++- net/ipv6/af_inet6.c | 1 + 4 files changed, 17 insertions(+), 8 deletions(-)
net/dccp/dccp.h +1 -0
@@ -288,6 +288,7 @@ int dccp_rcv_state_process(struct sock *int dccp_rcv_established (struct sock *sk,struct sk_buff *skb,const struct dccp_hdr *dh,const unsigned int len); +void dccp_destruct_common (struct sock *sk);int dccp_init_sock (struct sock *sk,const __u8 ctl_sock_initialized);void dccp_destroy_sock (struct sock *sk);
net/dccp/ipv6.c +8 -7
@@ -1000,6 +1000,12 @@ static const struct inet_connection_sock#endif }; +static void dccp_v6_sk_destruct (struct sock *sk) +{ +dccp_destruct_common (sk); +inet6_sock_destruct (sk); +} +/* NOTE: A lot of things set to zero explicitly by call to * sk_alloc() so need not be done here. */
@@ -1012,17 +1018,12 @@ static int dccp_v6_init_sock(struct sockif (unlikely (!dccp_v6_ctl_sock_initialized)) dccp_v6_ctl_sock_initialized =1 ;inet_csk (sk)->icsk_af_ops = &dccp_ipv6_af_ops; + sk->sk_destruct = dccp_v6_sk_destruct; }return err; } -static void dccp_v6_destroy_sock (struct sock *sk) -{ -dccp_destroy_sock (sk); -inet6_destroy_sock (sk); -} -static struct timewait_sock_ops dccp6_timewait_sock_ops = { .twsk_obj_size =sizeof (struct dccp6_timewait_sock ), };
@@ -1045,7 +1046,7 @@ static struct proto dccp_v6_prot = { .accept = inet_csk_accept, .get_port = inet_csk_get_port, .shutdown = dccp_shutdown, - .destroy = dccp_v6_destroy_sock, + .destroy = dccp_destroy_sock, .orphan_count = &dccp_orphan_count, .max_header = MAX_DCCP_HEADER, .obj_size = sizeof(struct dccp6_sock),
net/dccp/proto.c +7 -1
@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int tEXPORT_SYMBOL_GPL (dccp_packet_name); -static void dccp_sk_destruct (struct sock *sk) +void dccp_destruct_common (struct sock *sk) {struct dccp_sock *dp =dccp_sk (sk);ccid_hc_tx_delete (dp->dccps_hc_tx_ccid, sk); dp->dccps_hc_tx_ccid =NULL ; +} +EXPORT_SYMBOL_GPL (dccp_destruct_common); + +static void dccp_sk_destruct (struct sock *sk) +{ +dccp_destruct_common (sk);inet_sock_destruct (sk); }
net/ipv6/af_inet6.c +1 -0
@@ -109,6 +109,7 @@ void inet6_sock_destruct(struct sock *skinet6_cleanup_sock (sk);inet_sock_destruct (sk); } +EXPORT_SYMBOL_GPL (inet6_sock_destruct);static int inet6_create (struct net *net,struct socket *sock,int protocol,int kern)
Greg Kroah-Hartman
maintainerPATCH 35/39 sctp: Call inet6_destroy_sock() via sk->sk_destruct().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit 6431b0f6ff1633ae598667e4cdd93830074a03e8 upstream.
After commit d38afeec26ed ("tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in sk->sk_destruct() by setting inet6_sock_destruct() to it to make sure we do not leak inet6-specific resources.
SCTP sets its own sk->sk_destruct() in the sctp_init_sock(), and SCTPv6 socket reuses it as the init function.
To call inet6_sock_destruct() from SCTPv6 sk->sk_destruct(), we set sctp_v6_destruct_sock() in a new init function.
--- net/sctp/socket.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
net/sctp/socket.c +21 -8
@@ -5167,13 +5167,17 @@ static void sctp_destroy_sock(struct soc }/* Triggered when there are no references on the socket anymore */ -static void sctp_destruct_sock (struct sock *sk) +static void sctp_destruct_common (struct sock *sk) {struct sctp_sock *sp =sctp_sk (sk);/* Free up the HMAC transform. */ crypto_free_shash (sp->hmac); +} +static void sctp_destruct_sock (struct sock *sk) +{ +sctp_destruct_common (sk);inet_sock_destruct (sk); }
@@ -9308,7 +9312,7 @@ void sctp_copy_sock(struct sock *newsk,sctp_sk (newsk)->reuse = sp->reuse; newsk->sk_shutdown = sk->sk_shutdown; - newsk->sk_destruct = sctp_destruct_sock; + newsk->sk_destruct = sk->sk_destruct; newsk->sk_family = sk->sk_family; newsk->sk_protocol =IPPROTO_SCTP ; newsk->sk_backlog_rcv = sk->sk_prot->backlog_rcv;
@@ -9539,11 +9543,20 @@ struct proto sctp_prot = {#if IS_ENABLED (CONFIG_IPV6 ) -#include <net/transp_v6.h> -static void sctp_v6_destroy_sock (struct sock *sk) +static void sctp_v6_destruct_sock (struct sock *sk) +{ +sctp_destruct_common (sk); +inet6_sock_destruct (sk); +} + +static int sctp_v6_init_sock (struct sock *sk) { -sctp_destroy_sock (sk); -inet6_destroy_sock (sk); +int ret =sctp_init_sock (sk); + +if (!ret) + sk->sk_destruct = sctp_v6_destruct_sock; + +return ret; } struct proto sctpv6_prot = {
@@ -9553,8 +9566,8 @@ struct proto sctpv6_prot = { .disconnect = sctp_disconnect, .accept = sctp_accept, .ioctl = sctp_ioctl, - .init = sctp_init_sock, - .destroy = sctp_v6_destroy_sock, + .init = sctp_v6_init_sock, + .destroy = sctp_destroy_sock, .shutdown = sctp_shutdown, .setsockopt = sctp_setsockopt, .getsockopt = sctp_getsockopt,
Greg Kroah-Hartman
maintainerPATCH 36/39 xfs: fix forkoff miscalculation related to XFS_LITINO(mp)
In reply to Greg Kroah-HartmanFrom: Gao Xiang <[email protected]>
commit ada49d64fb3538144192181db05de17e2ffc3551 upstream.
Currently, commit e9e2eae89ddb dropped a (int) decoration from XFS_LITINO(mp), and since sizeof() expression is also involved, the result of XFS_LITINO(mp) is simply as the size_t type (commonly unsigned long).
Considering the expression in xfs_attr_shortform_bytesfit():
offset = (XFS_LITINO(mp) - bytes) >> 3;
let "bytes" be (int)340, and
"XFS_LITINO(mp)" be (unsigned long)336.
on 64-bit platform, the expression is
offset = ((unsigned long)336 - (int)340) >> 3 =
(int)(0xfffffffffffffffcUL >> 3) = -1
but on 32-bit platform, the expression is
offset = ((unsigned long)336 - (int)340) >> 3 =
(int)(0xfffffffcUL >> 3) = 0x1fffffff
instead.
so offset becomes a large positive number on 32-bit platform, and cause xfs_attr_shortform_bytesfit() returns maxforkoff rather than 0.
Therefore, one result is
"ASSERT(new_size <= XFS_IFORK_SIZE(ip, whichfork));"
assertion failure in xfs_idata_realloc(), which was also the root cause of the original bugreport from Dennis, see:
https://bugzilla.redhat.com/show_bug.cgi?id=1894177
And it can also be manually triggered with the following commands:
$ touch a; $ setfattr -n user.0 -v "`seq 0 80`" a; $ setfattr -n user.1 -v "`seq 0 80`" a
on 32-bit platform.
Fix the case in xfs_attr_shortform_bytesfit() by bailing out "XFS_LITINO(mp) < bytes" in advance suggested by Eric and a misleading comment together with this bugfix suggested by Darrick. It seems the other users of XFS_LITINO(mp) are not impacted.
--- fs/xfs/libxfs/xfs_attr_leaf.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
fs/xfs/libxfs/xfs_attr_leaf.c +7 -1
@@ -435,7 +435,7 @@ xfs_attr_copy_value(*========================================================================*/ /* -* Query whether the requested number of additional bytes of extended +* Query whether the total requested number of attr fork bytes of extended * attribute space will be able to fit inline. * * Returns zero if not, else the di_forkoff fork offset to be used in the
@@ -455,6 +455,12 @@ xfs_attr_shortform_bytesfit(int maxforkoff;int offset; +/* +* Check if the new size could fit at all first: +*/ +if (bytes >XFS_LITINO (mp)) +return 0 ; +/* rounded down */ offset = (XFS_LITINO (mp) - bytes) >>3 ;
Greg Kroah-Hartman
maintainerPATCH 37/39 pwm: meson: Explicitly set .polarity in .get_state()
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
commit 8caa81eb950cb2e9d2d6959b37d853162d197f57 upstream.
The driver only supports normal polarity. Complete the implementation of .get_state() by setting .polarity accordingly.
This fixes a regression that was possible since commit c73a3107624d ("pwm: Handle .get_state() failures") which stopped to zero-initialize the state passed to the .get_state() callback. This was reported at
https://forum.odroid.com/viewtopic.php?f=177&t=46360 . While this was an unintended side effect, the real issue is the driver's callback not setting the polarity.
There is a complicating fact, that the .apply() callback fakes support for inversed polarity. This is not (and cannot) be matched by .get_state(). As fixing this isn't easy, only point it out in a comment to prevent authors of other drivers from copying that approach.
--- drivers/pwm/pwm-meson.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/pwm/pwm-meson.c +7 -0
@@ -168,6 +168,12 @@ static int meson_pwm_calc(struct meson_p duty = state->duty_cycle; period = state->period; +/* +* Note this is wrong. The result is an output wave that isn't really +* inverted and so is wrongly identified by .get_state as normal. +* Fixing this needs some care however as some machines might rely on +* this. +*/ if (state->polarity ==PWM_POLARITY_INVERSED ) duty = period - duty;
@@ -366,6 +372,7 @@ static void meson_pwm_get_state(struct p state->period =0 ; state->duty_cycle =0 ; } + state->polarity =PWM_POLARITY_NORMAL ; }static const struct pwm_ops meson_pwm_ops = {
Greg Kroah-Hartman
maintainerPATCH 38/39 iio: adc: at91-sama5d2_adc: fix an error code in at91_adc_allocate_trigger()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 73a428b37b9b538f8f8fe61caa45e7f243bab87c upstream.
The at91_adc_allocate_trigger() function is supposed to return error pointers. Returning a NULL will cause an Oops.
--- drivers/iio/adc/at91-sama5d2_adc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/adc/at91-sama5d2_adc.c +1 -1
@@ -983,7 +983,7 @@ static struct iio_trigger *at91_adc_allo trig =devm_iio_trigger_alloc (&indio->dev,"%s-dev%d-%s" , indio->name, indio->id, trigger_name);if (!trig) -return NULL ; +return ERR_PTR (-ENOMEM ); trig->dev.parent = indio->dev.parent;iio_trigger_set_drvdata (trig, indio);
Greg Kroah-Hartman
maintainerPATCH 39/39 ASN.1: Fix check for strdup() success
In reply to Greg Kroah-HartmanFrom: Ekaterina Orlova <[email protected]>
commit 5a43001c01691dcbd396541e6faa2c0077378f48 upstream.
It seems there is a misprint in the check of strdup() return code that can lead to NULL pointer dereference.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- scripts/asn1_compiler.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/asn1_compiler.c +1 -1
@@ -625,7 +625,7 @@ int main(int argc, char **argv) p =strrchr (argv[1 ],'/' ); p = p ? p +1 : argv[1 ]; grammar_name =strdup (p); -if (!p) { +if (!grammar_name) {perror (NULL );exit (1 ); }
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 159 fail: 0 Qemu test results: total: 455 pass: 455 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v5.4:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
59 tests: 59 pass, 0 failLinux version: 5.4.242-rc1-g00161130fc23
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra210-p3450-0000,
tegra30-cardhu-a04Jon
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
NOTE:
----
FYI, This is not a show stopper but worth reporting.
As I reported on stable rc 4.19 kernel,
Following kernel warning notices on stable rc 5.4.242-rc1 from the previous releases 5.4.238-rc1 noticed on arm64, i386 and x86_64. After this kernel warning, the system is still stable and up and running.
This kernel is built with kselftest ftrace merge configs with all required Kconfigs.
[ 3.273073] WARNING: CPU: 1 PID: 0 at include/trace/events/lock.h:13 lock_acquire+0x142/0x150 [ 3.273847] WARNING: CPU: 0 PID: 0 at include/trace/events/lock.h:58 lock_release+0x1d7/0x260 [ 3.273847] Modules linked in: [ 3.273073] Modules linked in: [ 3.273847] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.242-rc1 #1 [ 3.273073] CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.4.242-rc1 #1 [ 3.273847] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 3.273847] RIP: 0010:lock_release+0x1d7/0x260 [ 3.273073] Hardware name: Supermicro SYS-5019S-ML/X11SSH-F, BIOS 2.0b 07/27/2017 [ 3.273073] RIP: 0010:lock_acquire+0x142/0x150
log:
- https://lkft.validation.linaro.org/scheduler/job/6288834#L860
- https://lkft.validation.linaro.org/scheduler/job/6373719#L867
## Build
* kernel: 5.4.242-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.4.y
* git commit: 00161130fc2321eeea08f3a2ffacfa653e685d5a
* git describe: v5.4.238-239-g00161130fc23
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.4.y/build/v5.4.238-239-g00161130fc23
## Test Regressions (compared to v5.4.238-199-g230f1bde44b6)
## Metric Regressions (compared to v5.4.238-199-g230f1bde44b6)
## Test Fixes (compared to v5.4.238-199-g230f1bde44b6)
## Metric Fixes (compared to v5.4.238-199-g230f1bde44b6)
## Test result summary
total: 135130, pass: 109048, fail: 3400, skip: 22432, xfail: 250
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 143 total, 142 passed, 1 failed
* arm64: 43 total, 39 passed, 4 failed
* i386: 26 total, 20 passed, 6 failed
* mips: 27 total, 27 passed, 0 failed
* parisc: 6 total, 6 passed, 0 failed
* powerpc: 30 total, 30 passed, 0 failed
* riscv: 12 total, 10 passed, 2 failed
* s390: 6 total, 6 passed, 0 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 36 total, 34 passed, 2 failed
## Test suites summary
* boot
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-vm
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
No problems seen on x86_64 and aarch64.
Thanks,
Harshit
Quoted 9 lines
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on BMIPS_GENERIC:
Signature · 1 line
Florian
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.4.242 release. There are 39 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 26 Apr 2023 13:11:11 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.242-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah