4.14.324-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.324-rc1 review
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.324-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.324-rc1
Rob Clark <[email protected]>
dma-buf/sw_sync: Avoid recursive lock during fence signal
Zhu Wang <[email protected]>
scsi: core: raid_class: Remove raid_component_add()
Zhu Wang <[email protected]>
scsi: snic: Fix double free in snic_tgt_create()
Ido Schimmel <[email protected]>
rtnetlink: Reject negative ifindexes in RTM_NEWLINK
Feng Tang <[email protected]>
x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
Wei Chen <[email protected]>
media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
Helge Deller <[email protected]>
lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
Remi Pommarel <[email protected]>
batman-adv: Fix batadv_v_ogm_aggr_send memory leak
Remi Pommarel <[email protected]>
batman-adv: Fix TT global entry leak when client roamed back
Remi Pommarel <[email protected]>
batman-adv: Do not get eth header before batadv_check_management_packet
Sven Eckelmann <[email protected]>
batman-adv: Trigger events for auto adjusted MTU
Michael Ellerman <[email protected]>
ibmveth: Use dcbf rather than dcbfl
Sishuai Gong <[email protected]>
ipvs: fix racy memcpy in proc_do_sync_threshold
Junwei Hu <[email protected]>
ipvs: Improve robustness to the ipvs sysctl
Alessio Igor Bogani <[email protected]>
igb: Avoid starting unnecessary workqueues
Eric Dumazet <[email protected]>
sock: annotate data-races around prot->memory_pressure
Zheng Yejian <[email protected]>
tracing: Fix memleak due to race between current_tracer and trace
Justin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810
Lin Ma <[email protected]>
net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
Jason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
Kuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Zhang Shurong <[email protected]>
ASoC: rt5665: add missed regulator_bulk_disable
Xin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
Mirsad Goran Todorovac <[email protected]>
test_firmware: prevent race conditions by a correct implementation of locking
Qi Zheng <[email protected]>
binder: fix memory leak in binder_init()
Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()
Yang Yingliang <[email protected]>
mmc: wbsd: fix double mmc_free_host() in wbsd_init()
Russell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.
dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
Eric Dumazet <[email protected]>
net: do not allow gso_size to be set to GSO_BY_FRAGS
Abel Wu <[email protected]>
sock: Fix misuse of sk_under_memory_pressure()
Andrii Staikov <[email protected]>
i40e: fix misleading debug logs
Ziyang Xuan <[email protected]>
team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: disallow object maps
Lin Ma <[email protected]>
xfrm: add NULL check in xfrm_update_ae_params
Zhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free in decode_session6
Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free in decode_session6
Lin Ma <[email protected]>
net: af_key: fix sadb_x_filter validation
Lin Ma <[email protected]>
net: xfrm: Fix xfrm_address_filter OOB read
Nathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objects
Yuanjun Gong <[email protected]>
fbdev: mmp: fix value check in mmphw_probe()
shanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2
Zhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-free
Armin Wolf <[email protected]>
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
Tuo Li <[email protected]>
gfs2: Fix possible data races in gfs2_show_options()
Hans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereference
Yunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Immad Mir <[email protected]>
FS: JFS: Check for read-only mounted filesystem in txBegin
Immad Mir <[email protected]>
FS: JFS: Fix null-ptr-deref Read in txBegin
Gustavo A. R. Silva <[email protected]>
MIPS: dec: prom: Address -Warray-bounds warning
Yogesh <[email protected]>
fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
Jan Kara <[email protected]>
udf: Fix uninitialized array access for some pathnames
Ye Bin <[email protected]>
quota: fix warning in dqgrab()
Jan Kara <[email protected]>
quota: Properly disable quotas when add_dquot_ref() fails
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: roll up loops in DSP setup code for Audigy
hackyzh002 <[email protected]>
drm/radeon: Fix integer overflow in radeon_cs_parser_init
Nathan Chancellor <[email protected]>
lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
-------------
Diffstat:
Makefile | 4 +- arch/mips/include/asm/dec/prom.h | 2 +- arch/powerpc/kernel/rtas_flash.c | 6 +- arch/x86/kernel/fpu/xstate.c | 8 ++ drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 ++ drivers/android/binder_alloc.h | 1 + drivers/dma-buf/sw_sync.c | 18 ++-- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 + drivers/gpu/drm/radeon/radeon_cs.c | 3 +- drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 2 + drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 +- drivers/mmc/host/wbsd.c | 2 - drivers/net/ethernet/ibm/ibmveth.c | 2 +- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-- drivers/net/ethernet/intel/igb/igb_ptp.c | 24 ++--- drivers/net/phy/broadcom.c | 13 +++ drivers/net/team/team.c | 4 +- drivers/pcmcia/rsrc_nonstatic.c | 2 + drivers/scsi/raid_class.c | 48 --------- drivers/scsi/snic/snic_disc.c | 3 +- drivers/tty/serial/8250/8250_port.c | 1 + drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +- fs/cifs/file.c | 2 +- fs/gfs2/super.c | 26 +++-- fs/jfs/jfs_dmap.c | 3 + fs/jfs/jfs_txnmgr.c | 5 + fs/jfs/namei.c | 5 + fs/quota/dquot.c | 5 +- fs/udf/unicode.c | 2 +- include/linux/raid_class.h | 4 - include/linux/virtio_net.h | 4 + include/media/v4l2-mem2mem.h | 18 +++- include/net/sock.h | 11 +- kernel/trace/trace.c | 9 +- kernel/trace/trace_irqsoff.c | 3 +- kernel/trace/trace_sched_wakeup.c | 2 + lib/clz_ctz.c | 32 ++---- lib/mpi/longlong.h | 36 +------ lib/test_firmware.c | 39 +++++-- net/batman-adv/bat_v_elp.c | 3 +- net/batman-adv/bat_v_ogm.c | 7 +- net/batman-adv/hard-interface.c | 2 +- net/batman-adv/translation-table.c | 1 - net/bluetooth/l2cap_core.c | 5 + net/core/rtnetlink.c | 5 +- net/core/sock.c | 2 +- net/ipv4/ip_vti.c | 4 +- net/ipv4/tcp_timer.c | 4 +- net/ipv6/ip6_vti.c | 4 +- net/key/af_key.c | 4 +- net/netfilter/ipvs/ip_vs_ctl.c | 74 +++++++------- net/netfilter/nf_conntrack_proto_sctp.c | 6 +- net/netfilter/nft_dynset.c | 3 + net/sctp/socket.c | 2 +- net/unix/af_unix.c | 9 +- net/xfrm/xfrm_user.c | 13 ++- sound/pci/emu10k1/emufx.c | 112 ++------------------- sound/soc/codecs/rt5665.c | 2 + sound/usb/quirks-table.h | 29 ++++++ 60 files changed, 325 insertions(+), 351 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/57 lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit b0c091ae04f6746f541b9be91809e1f4f43e9a65 upstream.
Clang errors out when building this macro:
lib/mpi/generic_mpih-mul1.c:37:24: error: invalid use of a cast in a inline asm context requiring an l-value: remove the cast or build with -fheinous-gnu-extensions
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/longlong.h:652:20: note: expanded from macro 'umul_ppmm'
: "=l" ((USItype)(w0)), \
~~~~~~~~~~^~~
lib/mpi/generic_mpih-mul1.c:37:3: error: invalid output constraint '=h'
in asm
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
^
lib/mpi/longlong.h:653:7: note: expanded from macro 'umul_ppmm'
"=h" ((USItype)(w1)) \
^2 errors generated.
The C version that is used for GCC 4.4 and up works well with clang; however, it is not currently being used because Clang masks itself as GCC 4.2.1 for compatibility reasons. As Nick points out, we require GCC 4.6 and newer in the kernel so we can eliminate all of the versioning checks and just use the C version of umul_ppmm for all supported compilers.
--- lib/mpi/longlong.h | 36 +----------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-)
lib/mpi/longlong.h +1 -35
@@ -639,30 +639,12 @@ do { \************** MIPS ***************** ***************************************/ #if defined(__mips__) &&W_TYPE_SIZE ==32 -#if (__GNUC__ >=5 ) || (__GNUC__ >=4 && __GNUC_MINOR__ >=4 )#define umul_ppmm (w1, w0, u, v) \ do { \ UDItype __ll = (UDItype)(u) * (v); \ w1 = __ll >> 32; \ w0 = __ll; \ } while (0) -#elif __GNUC__ >2 || __GNUC_MINOR__ >=7 -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("multu %2,%3" \ - : "=l" ((USItype)(w0)), \ - "=h" ((USItype)(w1)) \ - : "d" ((USItype)(u)), \ - "d" ((USItype)(v))) -#else -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("multu %2,%3\n" \ - "mflo %0\n" \ - "mfhi %1" \ - : "=d" ((USItype)(w0)), \ - "=d" ((USItype)(w1)) \ - : "d" ((USItype)(u)), \ - "d" ((USItype)(v))) -#endif #define UMUL_TIME 10#define UDIV_TIME 100#endif /* __mips__ */
@@ -687,7 +669,7 @@ do { \ : "d" ((UDItype)(u)), \ "d" ((UDItype)(v))); \ } while (0) -#elif (__GNUC__ >=5 ) || (__GNUC__ >=4 && __GNUC_MINOR__ >=4 ) +#else#define umul_ppmm (w1, w0, u, v) \ do { \ typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \
@@ -695,22 +677,6 @@ do { \ w1 = __ll >>64 ; \ w0 = __ll; \ } while (0) -#elif __GNUC__ >2 || __GNUC_MINOR__ >=7 -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("dmultu %2,%3" \ - : "=l" ((UDItype)(w0)), \ - "=h" ((UDItype)(w1)) \ - : "d" ((UDItype)(u)), \ - "d" ((UDItype)(v))) -#else -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("dmultu %2,%3\n" \ - "mflo %0\n" \ - "mfhi %1" \ - : "=d" ((UDItype)(w0)), \ - "=d" ((UDItype)(w1)) \ - : "d" ((UDItype)(u)), \ - "d" ((UDItype)(v))) #endif#define UMUL_TIME 20#define UDIV_TIME 140
Greg Kroah-Hartman
maintainerPATCH 2/57 drm/radeon: Fix integer overflow in radeon_cs_parser_init
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: hackyzh002 <[email protected]>
[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ]
The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later
--- drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_cs.c +2 -1
@@ -265,7 +265,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) {struct drm_radeon_cs *cs = data;uint64_t *chunk_array_ptr; -unsigned size, i; +u64 size; +unsigned i;u32 ring =RADEON_CS_RING_GFX ;s32 priority =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/57 ALSA: emu10k1: roll up loops in DSP setup code for Audigy
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 8cabf83c7aa54530e699be56249fb44f9505c4f3 ]
There is no apparent reason for the massive code duplication.
--- sound/pci/emu10k1/emufx.c | 112 +++----------------------------------- 1 file changed, 9 insertions(+), 103 deletions(-)
sound/pci/emu10k1/emufx.c +9 -103
@@ -1557,14 +1557,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) gpr +=2 ;/* Master volume (will be renamed later) */ -A_OP (icode, &ptr, iMAC0,A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS )); +for (z =0 ; z <8 ; z++) +A_OP (icode, &ptr, iMAC0,A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ));snd_emu10k1_init_mono_control (&controls[nctl++],"Wave Master Playback Volume" , gpr,0 ); gpr +=2 ;
@@ -1648,102 +1642,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))dev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n", gpr, tmp); */ -/* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */ -/* A_P16VIN(0) is delayed by one sample, -* so all other A_P16VIN channels will need to also be delayed -*/ -/* Left ADC in. 1 of 2 */ snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_P16VIN (0x0 ),A_FXBUS2 (0 ) ); -/* Right ADC in 1 of 2 */ - gpr_map[gpr++] =0x00000000 ; -/* Delaying by one sample: instead of copying the input -* value A_P16VIN to output A_FXBUS2 as in the first channel, -* we use an auxiliary register, delaying the value by one -* sample -*/ -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (2 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x1 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (4 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x2 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (6 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x3 ),A_C_00000000 ,A_C_00000000 ); -/* For 96kHz mode */ -/* Left ADC in. 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0x8 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x4 ),A_C_00000000 ,A_C_00000000 ); -/* Right ADC in 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xa ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x5 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xc ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x6 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xe ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x7 ),A_C_00000000 ,A_C_00000000 ); -/* Pavel Hofman - we still have voices, A_FXBUS2s, and -* A_P16VINs available - -* let's add 8 more capture channels - total of 16 -*/ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x10 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x8 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x12 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x9 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x14 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xa ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x16 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xb ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x18 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xc ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1a )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xd ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1c )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xe ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1e )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xf ), -A_C_00000000 ,A_C_00000000 ); +/* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels +* will need to also be delayed; we use an auxiliary register for that. */ +for (z =1 ; z <0x10 ; z++) { +snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr),A_FXBUS2 (z *2 ) ); +A_OP (icode, &ptr, iACC3,A_GPR (gpr),A_P16VIN (z),A_C_00000000 ,A_C_00000000 ); + gpr_map[gpr++] =0x00000000 ; + } }#if 0
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/57 quota: Properly disable quotas when add_dquot_ref() fails
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 6a4e3363792e30177cc3965697e34ddcea8b900b ]
When add_dquot_ref() fails (usually due to IO error or ENOMEM), we want to disable quotas we are trying to enable. However dquot_disable() call was passed just the flags we are enabling so in case flags == DQUOT_USAGE_ENABLED dquot_disable() call will just fail with EINVAL instead of properly disabling quotas. Fix the problem by always passing DQUOT_LIMITS_ENABLED | DQUOT_USAGE_ENABLED to dquot_disable() in this case.
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/quota/dquot.c +2 -1
@@ -2387,7 +2387,8 @@ static int vfs_load_quota_inode(struct inode *inode, int type, int format_id, error =add_dquot_ref (sb, type);if (error) -dquot_disable (sb, type, flags); +dquot_disable (sb, type, +DQUOT_USAGE_ENABLED |DQUOT_LIMITS_ENABLED );return error; out_file_init:
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/57 quota: fix warning in dqgrab()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit d6a95db3c7ad160bc16b89e36449705309b52bcb ]
There's issue as follows when do fault injection:
WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Above issue may happens as follows:
ProcessA ProcessB ProcessCsys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_suspend -> suspend all type quota
sys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_resume
ret = dquot_load_quota_sb
add_dquot_ref
do_open -> open file O_RDWR
vfs_open
do_dentry_open
get_write_access
atomic_inc_unless_negative(&inode->i_writecount)
ext4_file_open
dquot_file_open
dquot_initialize
__dquot_initialize
dqget
atomic_inc(&dquot->dq_count);
__dquot_initialize
__dquot_initialize
dqget
if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
ext4_acquire_dquot
-> Return error DQ_ACTIVE_B flag isn't set
dquot_disable
invalidate_dquots
if (atomic_read(&dquot->dq_count))
dqgrab
WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
-> Trigger warningIn the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab().
To solve above issue just replace the dqgrab() use in invalidate_dquots() with atomic_inc(&dquot->dq_count).
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/quota/dquot.c +1 -1
@@ -540,7 +540,7 @@ static void invalidate_dquots(struct super_block *sb, int type)continue ;/* Wait for dquot users */ if (atomic_read (&dquot->dq_count)) { -dqgrab (dquot); +atomic_inc (&dquot->dq_count);spin_unlock (&dq_list_lock);/* * Once dqput() wakes us up, we know it's time to free
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/57 udf: Fix uninitialized array access for some pathnames
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ]
For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this.
--- fs/udf/unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/udf/unicode.c +1 -1
@@ -268,7 +268,7 @@ static int udf_name_from_CS0(uint8_t *str_o, int str_max_len, }if (translate) { -if (str_o_len <=2 && str_o[0 ] =='.' && +if (str_o_len >0 && str_o_len <=2 && str_o[0 ] =='.' && (str_o_len ==1 || str_o[1 ] =='.' )) needsCRC =1 ;if (needsCRC) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/57 fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh <[email protected]>
[ Upstream commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 ]
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 index -84 is out of range for type 's8[341]' (aka 'signed char[341]') CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 lookup_open fs/namei.c:3492 [inline] open_last_lookups fs/namei.c:3560 [inline] path_openat+0x13df/0x3170 fs/namei.c:3788 do_filp_open+0x234/0x490 fs/namei.c:3818 do_sys_openat2+0x13f/0x500 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1f4e33f7e9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>
The bug occurs when the dbAllocDmapLev()function attempts to access dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative.
To rectify this, the patch introduces a safeguard within the dbAllocDmapLev() function. A check has been added to verify if leafidx is negative. If it is, the function immediately returns an I/O error, preventing any further execution that could potentially cause harm.
Tested via syzbot.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -2040,6 +2040,9 @@ dbAllocDmapLev(struct bmap * bmp,if (dbFindLeaf ((dmtree_t *) & dp->tree, l2nb, &leafidx))return -ENOSPC ; +if (leafidx <0 ) +return -EIO ; +/* determine the block number within the file system corresponding * to the leaf at which free space was found. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/57 MIPS: dec: prom: Address -Warray-bounds warning
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 ]
Zero-length arrays are deprecated, and we are replacing them with flexible array members instead. So, replace zero-length array with flexible-array member in struct memmap.
Address the following warning found after building (with GCC-13) mips64
with decstation_64_defconfig:
In function 'rex_setup_memory_region',
inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3:arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=]
72 | if (bm->bitmap[i] == 0xff)
| ~~~~~~~~~~^~~
In file included from arch/mips/dec/prom/memory.c:16:./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit':./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap'
73 | unsigned char bitmap[0];
This helps with the ongoing efforts to globally enable -Warray-bounds.
This results in no differences in binary output.
--- arch/mips/include/asm/dec/prom.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/dec/prom.h +1 -1
@@ -74,7 +74,7 @@ static inline bool prom_is_rex(u32 magic)*/ typedef struct {int pagesize; -unsigned char bitmap[0 ]; +unsigned char bitmap[]; }memmap ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/57 FS: JFS: Fix null-ptr-deref Read in txBegin
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Immad Mir <[email protected]>
[ Upstream commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 ]
Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code.
--- fs/jfs/namei.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/namei.c +5 -0
@@ -813,6 +813,11 @@ static int jfs_link(struct dentry *old_dentry,if (rc) goto out; +if (isReadOnly (ip)) { +jfs_error (ip->i_sb,"read-only filesystem\n" ); +return -EROFS ; + } + tid =txBegin (ip->i_sb,0 );mutex_lock_nested (&JFS_IP (dir)->commit_mutex,COMMIT_MUTEX_PARENT );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/57 FS: JFS: Check for read-only mounted filesystem in txBegin
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Immad Mir <[email protected]>
[ Upstream commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc ]
This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref.
--- fs/jfs/jfs_txnmgr.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_txnmgr.c +5 -0
@@ -367,6 +367,11 @@ tid_t txBegin(struct super_block *sb, int flag)jfs_info ("txBegin: flag = 0x%x" , flag); log =JFS_SBI (sb)->log; +if (!log) { +jfs_error (sb,"read-only filesystem\n" ); +return 0 ; + } +TXN_LOCK ();INCREMENT (TxStat.txBegin);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/57 media: v4l2-mem2mem: add lock to protect parameter num_rdy
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ]
Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
--- include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
include/media/v4l2-mem2mem.h +16 -2
@@ -392,7 +392,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,static inline unsigned int v4l2_m2m_num_src_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->out_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
@@ -404,7 +411,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)static inline unsigned int v4l2_m2m_num_dst_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->cap_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/57 media: platform: mediatek: vpu: fix NULL ptr dereference
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ]
If pdev is NULL, then it is still dereferenced.
This fixes this smatch warning:
drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'
--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/mtk-vpu/mtk_vpu.c +4 -2
@@ -536,16 +536,18 @@ static int load_requested_vpu(struct mtk_vpu *vpu,int vpu_load_firmware (struct platform_device *pdev) {struct mtk_vpu *vpu; -struct device *dev = &pdev->dev; +struct device *dev;struct vpu_run *run;const struct firmware *vpu_fw =NULL ;int ret;if (!pdev) { -dev_err (dev,"VPU platform device is invalid\n" ); +pr_err ("VPU platform device is invalid\n" );return -EINVAL ; } + dev = &pdev->dev; + vpu =platform_get_drvdata (pdev); run = &vpu->run;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/57 gfs2: Fix possible data races in gfs2_show_options()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuo Li <[email protected]>
[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ]
Some fields such as gt_logd_secs of the struct gfs2_tune are accessed without holding the lock gt_spin in gfs2_show_options():
val = sdp->sd_tune.gt_logd_secs;
if (val != 30)
seq_printf(s, ",commit=%d", val);And thus can cause data races when gfs2_show_options() and other functions such as gfs2_reconfigure() are concurrently executed:
spin_lock(>->gt_spin); gt->gt_logd_secs = newargs->ar_commit;
To fix these possible data races, the lock sdp->sd_tune.gt_spin is acquired before accessing the fields of gfs2_tune and released after these accesses.
Further changes by Andreas:
- Don't hold the spin lock over the seq_printf operations.
--- fs/gfs2/super.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/gfs2/super.c +15 -11
@@ -1363,7 +1363,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) {struct gfs2_sbd *sdp = root->d_sb->s_fs_info;struct gfs2_args *args = &sdp->sd_args; -int val; +unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum; + +spin_lock (&sdp->sd_tune.gt_spin); + logd_secs = sdp->sd_tune.gt_logd_secs; + quota_quantum = sdp->sd_tune.gt_quota_quantum; + statfs_quantum = sdp->sd_tune.gt_statfs_quantum; + statfs_slow = sdp->sd_tune.gt_statfs_slow; +spin_unlock (&sdp->sd_tune.gt_spin);if (is_ancestor (root, sdp->sd_master_dir))seq_puts (s,",meta" );
@@ -1418,17 +1425,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) }if (args->ar_discard)seq_puts (s,",discard" ); - val = sdp->sd_tune.gt_logd_secs; -if (val !=30 ) -seq_printf (s,",commit=%d" , val); - val = sdp->sd_tune.gt_statfs_quantum; -if (val !=30 ) -seq_printf (s,",statfs_quantum=%d" , val); -else if (sdp->sd_tune.gt_statfs_slow) +if (logd_secs !=30 ) +seq_printf (s,",commit=%d" , logd_secs); +if (statfs_quantum !=30 ) +seq_printf (s,",statfs_quantum=%d" , statfs_quantum); +else if (statfs_slow)seq_puts (s,",statfs_quantum=0" ); - val = sdp->sd_tune.gt_quota_quantum; -if (val !=60 ) -seq_printf (s,",quota_quantum=%d" , val); +if (quota_quantum !=60 ) +seq_printf (s,",quota_quantum=%d" , quota_quantum);if (args->ar_statfs_percent)seq_printf (s,",statfs_percent=%d" , args->ar_statfs_percent);if (args->ar_errors !=GFS2_ERRORS_DEFAULT ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/57 pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket_data too, causing a memory leak observable with kmemleak:
unreferenced object 0xc28d1000 (size 64):
comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
[<7e51f0c8>] kmalloc_trace+0x31/0xa4
[<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
[<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
[<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
[<c48fac39>] pci_device_probe+0x99/0x194
[<84b7c690>] really_probe+0x181/0x45c
[<8060fe6e>] __driver_probe_device+0x75/0x1f4
[<b9b76f43>] driver_probe_device+0x28/0xac
[<648b766f>] __driver_attach+0xeb/0x1e4
[<6e9659eb>] bus_for_each_dev+0x61/0xb4
[<25a669f3>] driver_attach+0x1e/0x28
[<d8671d6b>] bus_add_driver+0x102/0x20c
[<df0d323c>] driver_register+0x5b/0x120
[<942cd8a4>] __pci_register_driver+0x44/0x4c
[<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]Fix this by freeing socket_data too.
Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding the yenta_cardbus driver (yenta_socket).
Message-ID: <[email protected]>
--- drivers/pcmcia/rsrc_nonstatic.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pcmcia/rsrc_nonstatic.c +2 -0
@@ -1056,6 +1056,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s) q = p->next;kfree (p); } + +kfree (data); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/57 Bluetooth: L2CAP: Fix use-after-free
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengping Jiang <[email protected]>
[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ]
Fix potential use-after-free in l2cap_le_command_rej.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -5705,9 +5705,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,if (!chan) goto done; + chan =l2cap_chan_hold_unless_zero (chan); +if (!chan) + goto done; +l2cap_chan_lock (chan);l2cap_chan_del (chan,ECONNREFUSED );l2cap_chan_unlock (chan); +l2cap_chan_put (chan); done:mutex_unlock (&conn->chan_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/57 drm/amdgpu: Fix potential fence use-after-free v2
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: shanzhulig <[email protected]>
[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ]
fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free.
v2 (chk): actually fix the use after free and not just move it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +3 -0
@@ -1343,6 +1343,9 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,continue ; r =dma_fence_wait_timeout (fence, true, timeout); +if (r >0 && fence->error) + r = fence->error; +dma_fence_put (fence);if (r <0 )return r;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/57 fbdev: mmp: fix value check in mmphw_probe()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <[email protected]>
commit 0872b2c0abc0e84ac82472959c8e14e35277549c upstream.
in mmphw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value.
--- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/mmp/hw/mmp_ctrl.c +3 -1
@@ -525,7 +525,9 @@ static int mmphw_probe(struct platform_d ret = -ENOENT ; goto failed; } -clk_prepare_enable (ctrl->clk); + ret =clk_prepare_enable (ctrl->clk); +if (ret) + goto failed;/* init global regs */ ctrl_set_default (ctrl);
Greg Kroah-Hartman
maintainerPATCH 18/57 powerpc/rtas_flash: allow user copy to flash block cache objects
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit 4f3175979e62de3b929bfa54a0db4b87d36257a7 upstream.
With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2
Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries
NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000
REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+)
MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c
CFAR: c0000000001fbd34 IRQMASK: 0
[ ... GPRs omitted ... ]
NIP usercopy_abort+0xa0/0xb0
LR usercopy_abort+0x9c/0xb0
Call Trace:
usercopy_abort+0x9c/0xb0 (unreliable)
__check_heap_object+0x1b4/0x1d0
__check_object_size+0x2d0/0x380
rtas_flash_write+0xe4/0x250
proc_reg_write+0xfc/0x160
vfs_write+0xfc/0x4e0
ksys_write+0x90/0x160
system_call_exception+0x178/0x320
system_call_common+0x160/0x2c4The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access.
--- arch/powerpc/kernel/rtas_flash.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/kernel/rtas_flash.c +3 -3
@@ -714,9 +714,9 @@ static int __init rtas_flash_init(void)if (!rtas_validate_flash_data.buf)return -ENOMEM ; - flash_block_cache =kmem_cache_create ("rtas_flash_cache" , -RTAS_BLK_SIZE ,RTAS_BLK_SIZE ,0 , -NULL ); + flash_block_cache =kmem_cache_create_usercopy ("rtas_flash_cache" , +RTAS_BLK_SIZE ,RTAS_BLK_SIZE , +0 ,0 ,RTAS_BLK_SIZE ,NULL );if (!flash_block_cache) {printk (KERN_ERR "%s: failed to create block cache\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 19/57 net: xfrm: Fix xfrm_address_filter OOB read
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
We found below OOB crash:
[ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] <TASK> [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] </TASK> [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ==================================================================
By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak.
if (attrs[XFRMA_ADDRESS_FILTER]) {
filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
// NO MORE CHECKS HERE !!!
}This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function.
--- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/xfrm/xfrm_user.c +9 -0
@@ -1000,6 +1000,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL);if (filter ==NULL )return -ENOMEM ; + +/* see addr_match(), (prefix length >> 5) << 2 +* will be used to compare xfrm_address_t +*/ +if (filter->splen > (sizeof (xfrm_address_t) <<3 ) || + filter->dplen > (sizeof (xfrm_address_t) <<3 )) { +kfree (filter); +return -EINVAL ; + } }if (attrs[XFRMA_PROTO ])
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/57 net: af_key: fix sadb_x_filter validation
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 75065a8929069bc93181848818e23f147a73f83a ]
When running xfrm_state_walk_init(), the xfrm_address_filter being used is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3. This commit replaces >= to > to make sure the boundary checking is correct.
--- net/key/af_key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/key/af_key.c +2 -2
@@ -1858,9 +1858,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msif (ext_hdrs[SADB_X_EXT_FILTER -1 ]) {struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER -1 ]; -if ((xfilter->sadb_x_filter_splen >= +if ((xfilter->sadb_x_filter_splen > (sizeof (xfrm_address_t) <<3 )) || - (xfilter->sadb_x_filter_dplen >= + (xfilter->sadb_x_filter_dplen > (sizeof (xfrm_address_t) <<3 ))) {mutex_unlock (&pfk->dump_lock);return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/57 ip6_vti: fix slab-use-after-free in decode_session6
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 ]
When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv6/ip6_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ip6_vti.c +2 -2
@@ -570,12 +570,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) vti6_addr_conflict(t, ipv6h)) goto tx_err; -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;default : goto tx_err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/57 ip_vti: fix potential slab-use-after-free in decode_session6
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]
When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv4/ip_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/ip_vti.c +2 -2
@@ -325,12 +325,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)switch (skb->protocol) {case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;case htons (ETH_P_IPV6 ): -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;default : dev->stats.tx_errors++;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/57 xfrm: add NULL check in xfrm_update_ae_params
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 00374d9b6d9f932802b55181be9831aa948e5b7c ]
Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700
This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -521,7 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,struct nlattr *et = attrs[XFRMA_ETIMER_THRESH ];struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH ]; -if (re) { +if (re && x->replay_esn && x->preplay_esn) {struct xfrm_replay_state_esn *replay_esn; replay_esn =nla_data (re); memcpy(x->replay_esn, replay_esn,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/57 netfilter: nft_dynset: disallow object maps
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 23185c6aed1ffb8fc44087880ba2767aba493779 ]
Do not allow to insert elements from datapath to objects maps.
--- net/netfilter/nft_dynset.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nft_dynset.c +3 -0
@@ -137,6 +137,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,if (IS_ERR (set))return PTR_ERR (set); +if (set->flags &NFT_SET_OBJECT ) +return -EOPNOTSUPP ; +if (set->ops->update ==NULL )return -EOPNOTSUPP ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/57 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f ]
Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info) in unregister_vlan_dev() with the following testcase:
# ip netns add ns1 # ip netns exec ns1 ip link add team1 type team # ip netns exec ns1 ip link add team_slave type veth peer veth2 # ip netns exec ns1 ip link set team_slave master team1 # ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set team_slave nomaster # ip netns del ns1
Add S-VLAN tag related features support to team driver. So the team driver will always propagate the VLAN info to its slaves.
--- drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/team/team.c +3 -1
@@ -2160,7 +2160,9 @@ static void team_setup(struct net_device *dev) dev->hw_features =TEAM_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX | -NETIF_F_HW_VLAN_CTAG_FILTER ; +NETIF_F_HW_VLAN_CTAG_FILTER | +NETIF_F_HW_VLAN_STAG_RX | +NETIF_F_HW_VLAN_STAG_FILTER ; dev->hw_features |=NETIF_F_GSO_ENCAP_ALL ; dev->features |= dev->hw_features;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/57 i40e: fix misleading debug logs
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Staikov <[email protected]>
[ Upstream commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f ]
Change "write" into the actual "read" word.
Change parameters description.
--- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_nvm.c +8 -8
@@ -233,11 +233,11 @@ static i40e_status i40e_read_nvm_word_srctl(struct i40e_hw *hw, u16 offset,* @hw: pointer to the HW structure. * @module_pointer: module pointer location in words from the NVM beginning * @offset: offset in words from module start -* @words: number of words to write -* @data: buffer with words to write to the Shadow RAM +* @words: number of words to read +* @data: buffer with words to read to the Shadow RAM * @last_command: tells the AdminQ that this is the last command * -* Writes a 16 bit words buffer to the Shadow RAM using the admin command. +* Reads a 16 bit words buffer to the Shadow RAM using the admin command. **/ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw, u8 module_pointer, u32 offset, u16 words, void *data,
@@ -256,18 +256,18 @@ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw, u8 module_pointer,*/ if ((offset + words) > hw->nvm.sr_size)i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: offset %d beyond Shadow RAM limit %d\n" , +"NVM read error: offset %d beyond Shadow RAM limit %d\n" , (offset + words), hw->nvm.sr_size);else if (words >I40E_SR_SECTOR_SIZE_IN_WORDS ) -/* We can write only up to 4KB (one sector), in one AQ write */ +/* We can read only up to 4KB (one sector), in one AQ write */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write fail error: tried to write %d words, limit is %d.\n" , +"NVM read fail error: tried to read %d words, limit is %d.\n" , words,I40E_SR_SECTOR_SIZE_IN_WORDS );else if (((offset + (words -1 )) /I40E_SR_SECTOR_SIZE_IN_WORDS ) != (offset /I40E_SR_SECTOR_SIZE_IN_WORDS )) -/* A single write cannot spread over two sectors */ +/* A single read cannot spread over two sectors */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n" , +"NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n" , offset, words);else ret_code = i40e_aq_read_nvm(hw, module_pointer,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/57 sock: Fix misuse of sk_under_memory_pressure()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Wu <[email protected]>
[ Upstream commit 2d0c88e84e483982067a82073f6125490ddf3614 ]
The status of global socket memory pressure is updated when:
a) __sk_mem_raise_allocated():
enter: sk_memory_allocated(sk) > sysctl_mem[1]
leave: sk_memory_allocated(sk) <= sysctl_mem[0]
b) __sk_mem_reduce_allocated():
leave: sk_under_memory_pressure(sk) && sk_memory_allocated(sk) < sysctl_mem[0]
So the conditions of leaving global pressure are inconstant, which may lead to the situation that one pressured net-memcg prevents the global pressure from being cleared when there is indeed no global pressure, thus the global constrains are still in effect unexpectedly on the other sockets.
This patch fixes this by ignoring the net-memcg's pressure when deciding whether should leave global memory pressure.
--- include/net/sock.h | 6 ++++++ net/core/sock.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
include/net/sock.h +6 -0
@@ -1211,6 +1211,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)return sk->sk_prot->memory_pressure !=NULL ; } +static inline bool sk_under_global_memory_pressure (const struct sock *sk) +{ +return sk->sk_prot->memory_pressure && + !!*sk->sk_prot->memory_pressure; +} +static inline bool sk_under_memory_pressure (const struct sock *sk) {if (!sk->sk_prot->memory_pressure)
net/core/sock.c +1 -1
@@ -2459,7 +2459,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)if (mem_cgroup_sockets_enabled && sk->sk_memcg)mem_cgroup_uncharge_skmem (sk->sk_memcg, amount); -if (sk_under_memory_pressure (sk) && +if (sk_under_global_memory_pressure (sk) && (sk_memory_allocated (sk) <sk_prot_mem_limits (sk,0 )))sk_leave_memory_pressure (sk); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/57 net: do not allow gso_size to be set to GSO_BY_FRAGS
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 ]
One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1]
Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel.
[1]
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550 __sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff27cdb34d9
--- include/linux/virtio_net.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/virtio_net.h +4 -0
@@ -146,6 +146,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (gso_type &SKB_GSO_UDP ) nh_off -= thlen; +/* Kernel has a special handling for GSO_BY_FRAGS. */ +if (gso_size ==GSO_BY_FRAGS ) +return -EINVAL ; +/* Too small packets are not really GSO ones. */ if (skb->len - nh_off > gso_size) { shinfo->gso_size = gso_size;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/57 ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: dengxiang <[email protected]>
commit 788449ae57f4273111b779bbcaad552b67f517d5 upstream.
This patch adds a USB quirk for Mythware XA001AU USB interface.
--- sound/usb/quirks-table.h | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
sound/usb/quirks-table.h +29 -0
@@ -3540,5 +3540,34 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge } } }, +{ +/* Advanced modes of the Mythware XA001AU. +* For the standard mode, Mythware XA001AU has ID ffad:a001 +*/ + USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="Mythware" , + .product_name ="XA001AU" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_IGNORE_INTERFACE , + }, + { + .ifnum =1 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =-1 + } + } + } +}, #undef USB_DEVICE_VENDOR_SPEC
Greg Kroah-Hartman
maintainerPATCH 30/57 cifs: Release folio lock on fscache read hit.
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Harmon via samba-technical <[email protected]>
commit 69513dd669e243928f7450893190915a88f84a2b upstream.
Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as:
Quoted 2 lines
The filesystem should unlock the folio once the read has completed, whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead.
--- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/file.c +1 -1
@@ -3939,9 +3939,9 @@ static int cifs_readpage_worker(struct f io_error:kunmap (page); -unlock_page (page); read_complete: +unlock_page (page);return rc; }
Greg Kroah-Hartman
maintainerPATCH 31/57 mmc: wbsd: fix double mmc_free_host() in wbsd_init()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
commit d83035433701919ac6db15f7737cbf554c36c1a6 upstream.
mmc_free_host() has already be called in wbsd_free_mmc(), remove the mmc_free_host() in error path in wbsd_init().
--- drivers/mmc/host/wbsd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/wbsd.c +0 -2
@@ -1723,8 +1723,6 @@ static int wbsd_init(struct device *dev,wbsd_release_resources (host);wbsd_free_mmc (dev); - -mmc_free_host (mmc);return ret; }
Greg Kroah-Hartman
maintainerPATCH 32/57 serial: 8250: Fix oops for port->pm on uart_change_pm()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534 upstream.
Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm().
Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm().
--- drivers/tty/serial/8250/8250_port.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_port.c +1 -0
@@ -3191,6 +3191,7 @@ void serial8250_init_port(struct uart_82struct uart_port *port = &up->port;spin_lock_init (&port->lock); + port->pm =NULL ; port->ops = &serial8250_pops; up->cur_iotype =0xFF ;
Greg Kroah-Hartman
maintainerPATCH 33/57 binder: fix memory leak in binder_init()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Zheng <[email protected]>
commit adb9743d6a08778b78d62d16b4230346d3508986 upstream.
In binder_init(), the destruction of binder_alloc_shrinker_init() is not performed in the wrong path, which will cause memory leaks. So this commit introduces binder_alloc_shrinker_exit() and calls it in the wrong path to fix that.
--- drivers/android/binder.c | 1 + drivers/android/binder_alloc.c | 6 ++++++ drivers/android/binder_alloc.h | 1 + 3 files changed, 8 insertions(+)
drivers/android/binder.c +1 -0
@@ -5658,6 +5658,7 @@ err_init_binder_device_failed: err_alloc_device_names_failed:debugfs_remove_recursive (binder_debugfs_dir_entry_root); +binder_alloc_shrinker_exit ();return ret; }
drivers/android/binder_alloc.c +6 -0
@@ -1033,3 +1033,9 @@ void binder_alloc_shrinker_init(void)list_lru_init (&binder_alloc_lru);register_shrinker (&binder_shrinker); } + +void binder_alloc_shrinker_exit (void ) +{ +unregister_shrinker (&binder_shrinker); +list_lru_destroy (&binder_alloc_lru); +}
drivers/android/binder_alloc.h +1 -0
@@ -128,6 +128,7 @@ extern struct binder_buffer *binder_allo int is_async);extern void binder_alloc_init (struct binder_alloc *alloc);void binder_alloc_shrinker_init (void ); +extern void binder_alloc_shrinker_exit (void );extern void binder_alloc_vma_close (struct binder_alloc *alloc);extern struct binder_buffer * binder_alloc_prepare_to_free(struct binder_alloc *alloc,
Greg Kroah-Hartman
maintainerPATCH 34/57 test_firmware: prevent race conditions by a correct implementation of locking
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Goran Todorovac <[email protected]>
commit 4acfe3dfde685a5a9eaec5555351918e2d7266a1 upstream.
Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
u8 val;
int ret;
ret = kstrtou8(buf, 10, &val);
if (ret)
return ret;
mutex_lock(&test_fw_mutex);
*(u8 *)cfg = val;
mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
}static ssize_t config_num_requests_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
int rc;
mutex_lock(&test_fw_mutex);
if (test_fw_config->reqs) {
pr_err("Must call release_all_firmware prior to changing config\n");
rc = -EINVAL;
mutex_unlock(&test_fw_mutex);
goto out;
}
mutex_unlock(&test_fw_mutex);
rc = test_dev_config_update_u8(buf, count,
&test_fw_config->num_requests);out:
return rc; }
static ssize_t config_read_fw_idx_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
return test_dev_config_update_u8(buf, count,
&test_fw_config->read_fw_idx);
}
The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer.
To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition.
Having two locks wouldn't assure a race-proof mutual exclusion.
This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
int ret;
mutex_lock(&test_fw_mutex);
ret = __test_dev_config_update_u8(buf, size, cfg);
mutex_unlock(&test_fw_mutex);
return ret;
}doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code.
The similar approach was applied to all functions called from the locked and the unlocked context, which safely mitigates both deadlocks and race conditions in the driver.
__test_dev_config_update_bool(), __test_dev_config_update_u8() and __test_dev_config_update_size_t() unlocked versions of the functions were introduced to be called from the locked contexts as a workaround without releasing the main driver's lock and thereof causing a race condition.
The test_dev_config_update_bool(), test_dev_config_update_u8() and test_dev_config_update_size_t() locked versions of the functions are being called from driver methods without the unnecessary multiplying of the locking and unlocking code for each method, and complicating the code with saving of the return value across lock.
--- lib/test_firmware.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-)
lib/test_firmware.c +28 -9
@@ -283,16 +283,26 @@ static ssize_t config_test_show_str(charreturn len; } -static int test_dev_config_update_bool (const char *buf,size_t size, -bool *cfg) +static inline int __test_dev_config_update_bool (const char *buf,size_t size, +bool *cfg) {int ret; -mutex_lock (&test_fw_mutex);if (strtobool (buf, cfg) <0 ) ret = -EINVAL ;else ret = size; + +return ret; +} + +static int test_dev_config_update_bool (const char *buf,size_t size, +bool *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_bool (buf, size, cfg);mutex_unlock (&test_fw_mutex);return ret;
@@ -322,7 +332,7 @@ static ssize_t test_dev_config_show_int(return snprintf (buf,PAGE_SIZE ,"%d\n" , val); } -static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +static inline int __test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) {int ret;long new;
@@ -334,14 +344,23 @@ static int test_dev_config_update_u8(conif (new >U8_MAX )return -EINVAL ; -mutex_lock (&test_fw_mutex); *(u8 *)cfg = new; -mutex_unlock (&test_fw_mutex);/* Always return full write size even if we didn't consume all */ return size; } +static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_u8 (buf, size, cfg); +mutex_unlock (&test_fw_mutex); + +return ret; +} +static ssize_t test_dev_config_show_u8 (char *buf,u8 cfg) {u8 val;
@@ -374,10 +393,10 @@ static ssize_t config_num_requests_storemutex_unlock (&test_fw_mutex); goto out; } -mutex_unlock (&test_fw_mutex); - rc =test_dev_config_update_u8 (buf, count, - &test_fw_config->num_requests); + rc =__test_dev_config_update_u8 (buf, count, + &test_fw_config->num_requests); +mutex_unlock (&test_fw_mutex); out:return rc;
Greg Kroah-Hartman
maintainerPATCH 35/57 netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c upstream.
In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300 msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
As Paolo Valerio noticed, this might cause unwanted expiration of the ct entry. In my test, with 1s tc netem delay set on the NAT path, after the SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is sent back from the peer, the sctp ct entry has expired and been deleted, and then the SHUTDOWN_ACK has to be dropped.
Also, it is confusing these two sysctl options always show 0 due to all timeout values using sec as unit:
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0 net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
This patch fixes it by also using 3 secs for sctp shutdown send and recv state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV was probably used for a rare scenario where SHUTDOWN is sent on 1st path but SHUTDOWN_ACK is replied on 2nd path, then a new connection started immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV to CLOSE when receiving INIT in the ORIGINAL direction.
--- net/netfilter/nf_conntrack_proto_sctp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +3 -3
@@ -57,8 +57,8 @@ static unsigned int sctp_timeouts[SCTP_C [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS, [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS, [SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS, - [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000, - [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000, + [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS, + [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS, [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS, [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
@@ -116,7 +116,7 @@ static const u8 sctp_conntracks[2][11][S {/* ORIGINAL */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ -/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA}, +/* init */ {sCW, sCW, sCW, sCE, sES, sCL, sCL, sSA, sCW, sHA}, /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA}, /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
Greg Kroah-Hartman
maintainerPATCH 36/57 ASoC: rt5665: add missed regulator_bulk_disable
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
commit c163108e706909570f8aa9aa5bcf6806e2b4c98c upstream.
The driver forgets to call regulator_bulk_disable()
Add the missed call to fix it.
--- sound/soc/codecs/rt5665.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/rt5665.c +2 -0
@@ -4957,6 +4957,8 @@ static void rt5665_i2c_shutdown(struct istruct rt5665_priv *rt5665 =i2c_get_clientdata (client);regmap_write (rt5665->regmap,RT5665_RESET ,0 ); + +regulator_bulk_disable (ARRAY_SIZE (rt5665->supplies), rt5665->supplies); }#ifdef CONFIG_OF
Greg Kroah-Hartman
maintainerPATCH 37/57 af_unix: Fix null-ptr-deref in unix_stream_sendpage().
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection.
The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>
--- net/unix/af_unix.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/unix/af_unix.c +4 -5
@@ -1988,6 +1988,7 @@ static ssize_t unix_stream_sendpage(struif (false) { alloc_skb: +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock); newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
@@ -2027,6 +2028,7 @@ alloc_skb: init_scm = false; } +spin_lock (&other->sk_receive_queue.lock); skb =skb_peek_tail (&other->sk_receive_queue);if (tail && tail == skb) { skb = newskb;
@@ -2057,14 +2059,11 @@ alloc_skb:refcount_add (size, &sk->sk_wmem_alloc);if (newskb) { - err =unix_scm_to_skb (&scm, skb, false); -if (err) - goto err_state_unlock; -spin_lock (&other->sk_receive_queue.lock); +unix_scm_to_skb (&scm, skb, false);__skb_queue_tail (&other->sk_receive_queue, newskb); -spin_unlock (&other->sk_receive_queue.lock); } +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock);
Greg Kroah-Hartman
maintainerPATCH 38/57 net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 upstream.
In the real workload, I encountered an issue which could cause the RTO timer to retransmit the skb per 1ms with linear option enabled. The amount of lost-retransmitted skbs can go up to 1000+ instantly.
The root cause is that if the icsk_rto happens to be zero in the 6th round (which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero due to the changed calculation method in tcp_retransmit_timer() as follows:
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
Above line could be converted toicsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0
Therefore, the timer expires so quickly without any doubt.
I read through the RFC 6298 and found that the RTO value can be rounded up to a certain value, in Linux, say TCP_RTO_MIN as default, which is regarded as the lower bound in this patch as suggested by Eric.
--- net/ipv4/tcp_timer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +3 -1
@@ -540,7 +540,9 @@ out_reset_timer: tcp_stream_is_thin(tp) && icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) { icsk->icsk_backoff = 0; - icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX); + icsk->icsk_rto = clamp(__tcp_set_rto(tp), + tcp_rto_min(sk), + TCP_RTO_MAX); } else {/* Use normal (exponential) backoff */ icsk->icsk_rto =min (icsk->icsk_rto <<1 ,TCP_RTO_MAX );
Greg Kroah-Hartman
maintainerPATCH 39/57 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
commit d1e0e61d617ba17aa516db707aa871387566bbf7 upstream.
According to all consumers code of attrs[XFRMA_SEC_CTX], like
* verify_sec_ctx_len(), convert to xfrm_user_sec_ctx*
* xfrm_state_construct(), call security_xfrm_state_alloc whose prototype is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx);
* copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx *
...
It seems that the expected parsing result for XFRMA_SEC_CTX should be structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing and misleading (Luckily, they happen to have same size 8 bytes).
This commit amend the policy structure to xfrm_user_sec_ctx to avoid ambiguity.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -2514,7 +2514,7 @@ static const struct nla_policy xfrma_pol [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, - [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, + [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
Greg Kroah-Hartman
maintainerPATCH 40/57 net: phy: broadcom: stub c45 read/write for 54810
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
commit 096516d092d54604d590827d05b1022c8f326639 upstream.
The 54810 does not support c45. The mmd_phy_indirect accesses return arbirtary values leading to odd behavior like saying it supports EEE when it doesn't. We also see that reading/writing these non-existent MMD registers leads to phy instability in some cases.
--- drivers/net/phy/broadcom.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/phy/broadcom.c +13 -0
@@ -403,6 +403,17 @@ static int bcm5482_read_status(struct phreturn err; } +static int bcm54810_read_mmd (struct phy_device *phydev,int devnum,u16 regnum) +{ +return -EOPNOTSUPP ; +} + +static int bcm54810_write_mmd (struct phy_device *phydev,int devnum,u16 regnum, +u16 val) +{ +return -EOPNOTSUPP ; +} +static int bcm5481_config_aneg (struct phy_device *phydev) {struct device_node *np = phydev->mdio.dev.of_node;
@@ -650,6 +661,8 @@ static struct phy_driver broadcom_driver .name = "Broadcom BCM54810", .features = PHY_GBIT_FEATURES, .flags = PHY_HAS_INTERRUPT, + .read_mmd = bcm54810_read_mmd, + .write_mmd = bcm54810_write_mmd, .config_init = bcm54xx_config_init, .config_aneg = bcm5481_config_aneg, .read_status = genphy_read_status,
Greg Kroah-Hartman
maintainerPATCH 41/57 tracing: Fix memleak due to race between current_tracer and trace
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit eecb91b9f98d6427d4af5fdb8f108f52572a39e7 ]
Kmemleak report a leak in graph_trace_open():
unreferenced object 0xffff0040b95f4a00 (size 128):
comm "cat", pid 204981, jiffies 4301155872 (age 99771.964s)
hex dump (first 32 bytes):
e0 05 e7 b4 ab 7d 00 00 0b 00 01 00 00 00 00 00 .....}..........
f4 00 01 10 00 a0 ff ff 00 00 00 00 65 00 10 00 ............e...
backtrace:
[<000000005db27c8b>] kmem_cache_alloc_trace+0x348/0x5f0
[<000000007df90faa>] graph_trace_open+0xb0/0x344
[<00000000737524cd>] __tracing_open+0x450/0xb10
[<0000000098043327>] tracing_open+0x1a0/0x2a0
[<00000000291c3876>] do_dentry_open+0x3c0/0xdc0
[<000000004015bcd6>] vfs_open+0x98/0xd0
[<000000002b5f60c9>] do_open+0x520/0x8d0
[<00000000376c7820>] path_openat+0x1c0/0x3e0
[<00000000336a54b5>] do_filp_open+0x14c/0x324
[<000000002802df13>] do_sys_openat2+0x2c4/0x530
[<0000000094eea458>] __arm64_sys_openat+0x130/0x1c4
[<00000000a71d7881>] el0_svc_common.constprop.0+0xfc/0x394
[<00000000313647bf>] do_el0_svc+0xac/0xec
[<000000002ef1c651>] el0_svc+0x20/0x30
[<000000002fd4692a>] el0_sync_handler+0xb0/0xb4
[<000000000c309c35>] el0_sync+0x160/0x180The root cause is descripted as follows:
__tracing_open() { // 1. File 'trace' is being opened;
...
*iter->trace = *tr->current_trace; // 2. Tracer 'function_graph' is
// currently set;
...
iter->trace->open(iter); // 3. Call graph_trace_open() here,
// and memory are allocated in it;
...}
s_start() { // 4. The opened file is being read;
...
*iter->trace = *tr->current_trace; // 5. If tracer is switched to
// 'nop' or others, then memory
// in step 3 are leaked!!!
...}
To fix it, in s_start(), close tracer before switching then reopen the new tracer after switching. And some tracers like 'wakeup' may not update 'iter->private' in some cases when reopen, then it should be cleared to avoid being mistakenly closed again.
--- kernel/trace/trace.c | 9 ++++++++- kernel/trace/trace_irqsoff.c | 3 ++- kernel/trace/trace_sched_wakeup.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-)
kernel/trace/trace.c +8 -1
@@ -3275,8 +3275,15 @@ static void *s_start(struct seq_file *m, loff_t *pos)* will point to the same string as current_trace->name. */ mutex_lock (&trace_types_lock); -if (unlikely (tr->current_trace && iter->trace->name != tr->current_trace->name)) +if (unlikely (tr->current_trace && iter->trace->name != tr->current_trace->name)) { +/* Close iter->trace before switching to the new current tracer */ +if (iter->trace->close) + iter->trace->close (iter); *iter->trace = *tr->current_trace; +/* Reopen the new current tracer */ +if (iter->trace->open) + iter->trace->open (iter); + }mutex_unlock (&trace_types_lock);#ifdef CONFIG_TRACER_MAX_TRACE
kernel/trace/trace_irqsoff.c +2 -1
@@ -218,7 +218,8 @@ static void irqsoff_trace_open(struct trace_iterator *iter) {if (is_graph (iter->tr))graph_trace_open (iter); - +else + iter->private =NULL ; }static void irqsoff_trace_close (struct trace_iterator *iter)
kernel/trace/trace_sched_wakeup.c +2 -0
@@ -287,6 +287,8 @@ static void wakeup_trace_open(struct trace_iterator *iter) {if (is_graph (iter->tr))graph_trace_open (iter); +else + iter->private =NULL ; }static void wakeup_trace_close (struct trace_iterator *iter)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 42/57 sock: annotate data-races around prot->memory_pressure
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 76f33296d2e09f63118db78125c95ef56df438e9 ]
*prot->memory_pressure is read/writen locklessly, we need to add proper annotations.
A recent commit added a new race, it is time to audit all accesses.
--- include/net/sock.h | 7 ++++--- net/sctp/socket.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-)
include/net/sock.h +4 -3
@@ -1115,6 +1115,7 @@ struct proto {/* * Pressure flag: try to collapse. * Technical note: it is used by multiple contexts non atomically. +* Make sure to use READ_ONCE()/WRITE_ONCE() for all reads/writes. * All the __sk_mem_schedule() is of this nature: accounting * is strict, actions are advisory and have some latency. */
@@ -1214,7 +1215,7 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)static inline bool sk_under_global_memory_pressure (const struct sock *sk) {return sk->sk_prot->memory_pressure && - !!*sk->sk_prot->memory_pressure; + !!READ_ONCE (*sk->sk_prot->memory_pressure); }static inline bool sk_under_memory_pressure (const struct sock *sk)
@@ -1226,7 +1227,7 @@ static inline bool sk_under_memory_pressure(const struct sock *sk) mem_cgroup_under_socket_pressure(sk->sk_memcg))return true; -return !!*sk->sk_prot->memory_pressure; +return !!READ_ONCE (*sk->sk_prot->memory_pressure); } static inline long
@@ -1280,7 +1281,7 @@ proto_memory_pressure(struct proto *prot) {if (!prot->memory_pressure)return false; -return !!*prot->memory_pressure; +return !!READ_ONCE (*prot->memory_pressure); }
net/sctp/socket.c +1 -1
@@ -110,7 +110,7 @@ struct percpu_counter sctp_sockets_allocated;static void sctp_enter_memory_pressure (struct sock *sk) { - sctp_memory_pressure =1 ; +WRITE_ONCE (sctp_memory_pressure,1 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 43/57 igb: Avoid starting unnecessary workqueues
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessio Igor Bogani <[email protected]>
[ Upstream commit b888c510f7b3d64ca75fc0f43b4a4bd1a611312f ]
If ptp_clock_register() fails or CONFIG_PTP isn't enabled, avoid starting PTP related workqueues.
In this way we can fix this:
BUG: unable to handle page fault for address: ffffc9000440b6f8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1001e0067 PMD 107dc5067 PTE 0 Oops: 0000 [#1] PREEMPT SMP [...] Workqueue: events igb_ptp_overflow_check RIP: 0010:igb_rd32+0x1f/0x60 [...] Call Trace: igb_ptp_read_82580+0x20/0x50 timecounter_read+0x15/0x60 igb_ptp_overflow_check+0x1a/0x50 process_one_work+0x1cb/0x3c0 worker_thread+0x53/0x3f0 ? rescuer_thread+0x370/0x370 kthread+0x142/0x160 ? kthread_associate_blkcg+0xc0/0xc0 ret_from_fork+0x1f/0x30
--- drivers/net/ethernet/intel/igb/igb_ptp.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/igb/igb_ptp.c +12 -12
@@ -1195,18 +1195,6 @@ void igb_ptp_init(struct igb_adapter *adapter)return ; } -spin_lock_init (&adapter->tmreg_lock); -INIT_WORK (&adapter->ptp_tx_work, igb_ptp_tx_work); - -if (adapter->ptp_flags &IGB_PTP_OVERFLOW_CHECK ) -INIT_DELAYED_WORK (&adapter->ptp_overflow_work, - igb_ptp_overflow_check); - - adapter->tstamp_config.rx_filter =HWTSTAMP_FILTER_NONE ; - adapter->tstamp_config.tx_type =HWTSTAMP_TX_OFF ; - -igb_ptp_reset (adapter); - adapter->ptp_clock =ptp_clock_register (&adapter->ptp_caps, &adapter->pdev->dev);if (IS_ERR (adapter->ptp_clock)) {
@@ -1216,6 +1204,18 @@ void igb_ptp_init(struct igb_adapter *adapter)dev_info (&adapter->pdev->dev,"added PHC on %s\n" , adapter->netdev->name); adapter->ptp_flags |=IGB_PTP_ENABLED ; + +spin_lock_init (&adapter->tmreg_lock); +INIT_WORK (&adapter->ptp_tx_work, igb_ptp_tx_work); + +if (adapter->ptp_flags &IGB_PTP_OVERFLOW_CHECK ) +INIT_DELAYED_WORK (&adapter->ptp_overflow_work, + igb_ptp_overflow_check); + + adapter->tstamp_config.rx_filter =HWTSTAMP_FILTER_NONE ; + adapter->tstamp_config.tx_type =HWTSTAMP_TX_OFF ; + +igb_ptp_reset (adapter); } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/57 ipvs: Improve robustness to the ipvs sysctl
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junwei Hu <[email protected]>
commit 1b90af292e71b20d03b837d39406acfbdc5d4b2a upstream.
The ipvs module parse the user buffer and save it to sysctl, then check if the value is valid. invalid value occurs over a period of time.
Here, I add a variable, struct ctl_table tmp, used to read the value from the user buffer, and save only when it is valid. I delete proc_do_sync_mode and use extra1/2 in table for the proc_dointvec_minmax call.
--- net/netfilter/ipvs/ip_vs_ctl.c | 70 +++++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 34 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +36 -34
@@ -1648,6 +1648,7 @@ static int ip_vs_zero_all(struct netns_i#ifdef CONFIG_SYSCTL static int zero; +static int one =1 ;static int three =3 ; static int
@@ -1659,12 +1660,18 @@ proc_do_defense_mode(struct ctl_table *tint val = *valp;int rc; - rc =proc_dointvec (table, write, buffer, lenp, ppos); +struct ctl_table tmp = { + .data = &val, + .maxlen =sizeof (int ), + .mode = table->mode, + }; + + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write && (*valp != val)) { -if ((*valp <0 ) || (*valp >3 )) { -/* Restore the correct value */ - *valp = val; +if (val <0 || val >3 ) { + rc = -EINVAL ; }else { + *valp = val;update_defense_level (ipvs); } }
@@ -1678,33 +1685,20 @@ proc_do_sync_threshold(struct ctl_tableint *valp = table->data;int val[2 ];int rc; +struct ctl_table tmp = { + .data = &val, + .maxlen = table->maxlen, + .mode = table->mode, + }; -/* backup the value first */ memcpy (val, valp,sizeof (val)); - - rc =proc_dointvec (table, write, buffer, lenp, ppos); -if (write && (valp[0 ] <0 || valp[1 ] <0 || - (valp[0 ] >= valp[1 ] && valp[1 ]))) { -/* Restore the correct value */ -memcpy (valp, val,sizeof (val)); - } -return rc; -} - -static int -proc_do_sync_mode (struct ctl_table *table,int write, -void __user *buffer,size_t *lenp,loff_t *ppos) -{ -int *valp = table->data; -int val = *valp; -int rc; - - rc =proc_dointvec (table, write, buffer, lenp, ppos); -if (write && (*valp != val)) { -if ((*valp <0 ) || (*valp >1 )) { -/* Restore the correct value */ - *valp = val; - } + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos); +if (write) { +if (val[0 ] <0 || val[1 ] <0 || + (val[0 ] >= val[1 ] && val[1 ])) + rc = -EINVAL ; +else +memcpy (valp, val,sizeof (val)); }return rc; }
@@ -1717,12 +1711,18 @@ proc_do_sync_ports(struct ctl_table *tabint val = *valp;int rc; - rc =proc_dointvec (table, write, buffer, lenp, ppos); +struct ctl_table tmp = { + .data = &val, + .maxlen =sizeof (int ), + .mode = table->mode, + }; + + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write && (*valp != val)) { -if (*valp <1 || !is_power_of_2 (*valp)) { -/* Restore the correct value */ +if (val <1 || !is_power_of_2 (val)) + rc = -EINVAL ; +else *valp = val; - } }return rc; }
@@ -1782,7 +1782,9 @@ static struct ctl_table vs_vars[] = { .procname = "sync_version", .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_do_sync_mode, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, }, { .procname = "sync_ports",
Greg Kroah-Hartman
maintainerPATCH 45/57 ipvs: fix racy memcpy in proc_do_sync_threshold
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sishuai Gong <[email protected]>
commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 upstream.
When two threads run proc_do_sync_threshold() in parallel, data races could happen between the two memcpy():
Thread-1 Thread-2
memcpy(val, valp, sizeof(val)); memcpy(valp, val, sizeof(val));
This race might mess up the (struct ctl_table *) table->data, so we add a mutex lock to serialize them.
--- net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +4 -0
@@ -1682,6 +1682,7 @@ static int proc_do_sync_threshold(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { + struct netns_ipvs *ipvs = table->extra2;int *valp = table->data;int val[2 ];int rc;
@@ -1691,6 +1692,7 @@ proc_do_sync_threshold(struct ctl_table .mode = table->mode, }; +mutex_lock (&ipvs->sync_mutex);memcpy (val, valp,sizeof (val)); rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write) {
@@ -1700,6 +1702,7 @@ proc_do_sync_threshold(struct ctl_tableelse memcpy (valp, val,sizeof (val)); } +mutex_unlock (&ipvs->sync_mutex);return rc; }
@@ -3976,6 +3979,7 @@ static int __net_init ip_vs_control_net_ ipvs->sysctl_sync_threshold[0 ] =DEFAULT_SYNC_THRESHOLD ; ipvs->sysctl_sync_threshold[1 ] =DEFAULT_SYNC_PERIOD ; tbl[idx].data = &ipvs->sysctl_sync_threshold; + tbl[idx].extra2 = ipvs; tbl[idx++].maxlen =sizeof (ipvs->sysctl_sync_threshold); ipvs->sysctl_sync_refresh_period =DEFAULT_SYNC_REFRESH_PERIOD ; tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
Greg Kroah-Hartman
maintainerPATCH 46/57 ibmveth: Use dcbf rather than dcbfl
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit bfedba3b2c7793ce127680bc8f70711e05ec7a17 upstream.
When building for power4, newer binutils don't recognise the "dcbfl" extended mnemonic.
dcbfl RA, RB is equivalent to dcbf RA, RB, 1.
Switch to "dcbf" to avoid the build error.
--- drivers/net/ethernet/ibm/ibmveth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ibm/ibmveth.c +1 -1
@@ -209,7 +209,7 @@ static inline void ibmveth_flush_buffer(unsigned long offset;for (offset =0 ; offset < length; offset +=SMP_CACHE_BYTES ) - asm("dcbfl %0,%1" ::"b" (addr),"r" (offset)); + asm("dcbf %0,%1,1" ::"b" (addr),"r" (offset)); }/* replenish the buffers for a pool. note that we don't need to
Greg Kroah-Hartman
maintainerPATCH 47/57 batman-adv: Trigger events for auto adjusted MTU
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit c6a953cce8d0438391e6da48c8d0793d3fbfcfa6 upstream.
If an interface changes the MTU, it is expected that an NETDEV_PRECHANGEMTU and NETDEV_CHANGEMTU notification events is triggered. This worked fine for .ndo_change_mtu based changes because core networking code took care of it. But for auto-adjustments after hard-interfaces changes, these events were simply missing.
Due to this problem, non-batman-adv components weren't aware of MTU changes and thus couldn't perform their own tasks correctly.
--- net/batman-adv/hard-interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/hard-interface.c +1 -1
@@ -625,7 +625,7 @@ out:/* adjusts the MTU if a new interface with a smaller MTU appeared. */ void batadv_update_min_mtu (struct net_device *soft_iface) { - soft_iface->mtu =batadv_hardif_min_mtu (soft_iface); +dev_set_mtu (soft_iface,batadv_hardif_min_mtu (soft_iface));/* Check if the local translate table should be cleaned up to match a * new (and smaller) MTU.
Greg Kroah-Hartman
maintainerPATCH 48/57 batman-adv: Do not get eth header before batadv_check_management_packet
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit eac27a41ab641de074655d2932fc7f8cdb446881 upstream.
If received skb in batadv_v_elp_packet_recv or batadv_v_ogm_packet_recv is either cloned or non linearized then its data buffer will be reallocated by batadv_check_management_packet when skb_cow or skb_linearize get called. Thus geting ethernet header address inside skb data buffer before batadv_check_management_packet had any chance to reallocate it could lead to the following kernel panic:
Unable to handle kernel paging request at virtual address ffffff8020ab069a
Mem abort info:
ESR = 0x96000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007
CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000040f45000
[ffffff8020ab069a] pgd=180000007fffa003, p4d=180000007fffa003, pud=180000007fffa003, pmd=180000007fefe003, pte=0068000020ab0706
Internal error: Oops: 96000007 [#1] SMP
Modules linked in: ahci_mvebu libahci_platform libahci dvb_usb_af9035 dvb_usb_dib0700 dib0070 dib7000m dibx000_common ath11k_pci ath10k_pci ath10k_core mwl8k_new nf_nat_sip nf_conntrack_sip xhci_plat_hcd xhci_hcd nf_nat_pptp nf_conntrack_pptp at24 sbsa_gwdt
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.15.42-00066-g3242268d425c-dirty #550
Hardware name: A8k (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : batadv_is_my_mac+0x60/0xc0
lr : batadv_v_ogm_packet_recv+0x98/0x5d0
sp : ffffff8000183820
x29: ffffff8000183820 x28: 0000000000000001 x27: ffffff8014f9af00
x26: 0000000000000000 x25: 0000000000000543 x24: 0000000000000003
x23: ffffff8020ab0580 x22: 0000000000000110 x21: ffffff80168ae880
x20: 0000000000000000 x19: ffffff800b561000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 00dc098924ae0032
x14: 0f0405433e0054b0 x13: ffffffff00000080 x12: 0000004000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffffffc076dae000 x6 : ffffff8000183700
x5 : ffffffc00955e698 x4 : ffffff80168ae000 x3 : ffffff80059cf000
x2 : ffffff800b561000 x1 : ffffff8020ab0696 x0 : ffffff80168ae880
Call trace:
batadv_is_my_mac+0x60/0xc0
batadv_v_ogm_packet_recv+0x98/0x5d0
batadv_batman_skb_recv+0x1b8/0x244
__netif_receive_skb_core.isra.0+0x440/0xc74
__netif_receive_skb_one_core+0x14/0x20
netif_receive_skb+0x68/0x140
br_pass_frame_up+0x70/0x80
br_handle_frame_finish+0x108/0x284
br_handle_frame+0x190/0x250
__netif_receive_skb_core.isra.0+0x240/0xc74
__netif_receive_skb_list_core+0x6c/0x90
netif_receive_skb_list_internal+0x1f4/0x310
napi_complete_done+0x64/0x1d0
gro_cell_poll+0x7c/0xa0
__napi_poll+0x34/0x174
net_rx_action+0xf8/0x2a0
_stext+0x12c/0x2ac
run_ksoftirqd+0x4c/0x7c
smpboot_thread_fn+0x120/0x210
kthread+0x140/0x150
ret_from_fork+0x10/0x20
Code: f9403844 eb03009f 54fffee1 f94Thus ethernet header address should only be fetched after batadv_check_management_packet has been called.
--- net/batman-adv/bat_v_elp.c | 3 ++- net/batman-adv/bat_v_ogm.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/batman-adv/bat_v_elp.c +2 -1
@@ -507,7 +507,7 @@ int batadv_v_elp_packet_recv(struct sk_bstruct batadv_priv *bat_priv =netdev_priv (if_incoming->soft_iface);struct batadv_elp_packet *elp_packet;struct batadv_hard_iface *primary_if; -struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header (skb); +struct ethhdr *ethhdr;bool res;int ret =NET_RX_DROP ;
@@ -515,6 +515,7 @@ int batadv_v_elp_packet_recv(struct sk_bif (!res) goto free_skb; + ethhdr =eth_hdr (skb);if (batadv_is_my_mac (bat_priv, ethhdr->h_source)) goto free_skb;
net/batman-adv/bat_v_ogm.c +2 -1
@@ -831,7 +831,7 @@ int batadv_v_ogm_packet_recv(struct sk_b {struct batadv_priv *bat_priv =netdev_priv (if_incoming->soft_iface);struct batadv_ogm2_packet *ogm_packet; -struct ethhdr *ethhdr =eth_hdr (skb); +struct ethhdr *ethhdr;int ogm_offset;u8 *packet_pos;int ret =NET_RX_DROP ;
@@ -845,6 +845,7 @@ int batadv_v_ogm_packet_recv(struct sk_bif (!batadv_check_management_packet (skb, if_incoming,BATADV_OGM2_HLEN )) goto free_skb; + ethhdr =eth_hdr (skb);if (batadv_is_my_mac (bat_priv, ethhdr->h_source)) goto free_skb;
Greg Kroah-Hartman
maintainerPATCH 49/57 batman-adv: Fix TT global entry leak when client roamed back
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit d25ddb7e788d34cf27ff1738d11a87cb4b67d446 upstream.
When a client roamed back to a node before it got time to destroy the pending local entry (i.e. within the same originator interval) the old global one is directly removed from hash table and left as such.
But because this entry had an extra reference taken at lookup (i.e using batadv_tt_global_hash_find) there is no way its memory will be reclaimed at any time causing the following memory leak:
unreferenced object 0xffff0000073c8000 (size 18560):
comm "softirq", pid 0, jiffies 4294907738 (age 228.644s)
hex dump (first 32 bytes):
06 31 ac 12 c7 7a 05 00 01 00 00 00 00 00 00 00 .1...z..........
2c ad be 08 00 80 ff ff 6c b6 be 08 00 80 ff ff ,.......l.......
backtrace:
[<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300
[<000000000ff2fdbc>] batadv_tt_global_add+0x700/0xe20
[<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790
[<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110
[<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10
[<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0
[<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4
[<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0
[<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90
[<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74
[<000000000f39a009>] __netif_receive_skb+0x48/0xe0
[<00000000f2cd8888>] process_backlog+0x174/0x344
[<00000000507d6564>] __napi_poll+0x58/0x1f4
[<00000000b64ef9eb>] net_rx_action+0x504/0x590
[<00000000056fa5e4>] _stext+0x1b8/0x418
[<00000000878879d6>] run_ksoftirqd+0x74/0xa4
unreferenced object 0xffff00000bae1a80 (size 56):
comm "softirq", pid 0, jiffies 4294910888 (age 216.092s)
hex dump (first 32 bytes):
00 78 b1 0b 00 00 ff ff 0d 50 00 00 00 00 00 00 .x.......P......
00 00 00 00 00 00 00 00 50 c8 3c 07 00 00 ff ff ........P.<.....
backtrace:
[<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300
[<00000000d9aaa49e>] batadv_tt_global_add+0x53c/0xe20
[<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790
[<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110
[<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10
[<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0
[<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4
[<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0
[<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90
[<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74
[<000000000f39a009>] __netif_receive_skb+0x48/0xe0
[<00000000f2cd8888>] process_backlog+0x174/0x344
[<00000000507d6564>] __napi_poll+0x58/0x1f4
[<00000000b64ef9eb>] net_rx_action+0x504/0x590
[<00000000056fa5e4>] _stext+0x1b8/0x418
[<00000000878879d6>] run_ksoftirqd+0x74/0xa4Releasing the extra reference from batadv_tt_global_hash_find even at roam back when batadv_tt_global_free is called fixes this memory leak.
Signed-off-by; Sven Eckelmann <[email protected]>
--- net/batman-adv/translation-table.c | 1 - 1 file changed, 1 deletion(-)
net/batman-adv/translation-table.c +0 -1
@@ -791,7 +791,6 @@ check_roaming:if (roamed_back) {batadv_tt_global_free (bat_priv, tt_global,"Roaming canceled" ); - tt_global =NULL ; }else {/* The global entry has to be marked as ROAMING and * has to be kept for consistency purpose
Greg Kroah-Hartman
maintainerPATCH 50/57 batman-adv: Fix batadv_v_ogm_aggr_send memory leak
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit 421d467dc2d483175bad4fb76a31b9e5a3d744cf upstream.
When batadv_v_ogm_aggr_send is called for an inactive interface, the skb is silently dropped by batadv_v_ogm_send_to_if() but never freed causing the following memory leak:
unreferenced object 0xffff00000c164800 (size 512):
comm "kworker/u8:1", pid 2648, jiffies 4295122303 (age 97.656s)
hex dump (first 32 bytes):
00 80 af 09 00 00 ff ff e1 09 00 00 75 01 60 83 ............u.`.
1f 00 00 00 b8 00 00 00 15 00 05 00 da e3 d3 64 ...............d
backtrace:
[<0000000007ad20f6>] __kmalloc_track_caller+0x1a8/0x310
[<00000000d1029e55>] kmalloc_reserve.constprop.0+0x70/0x13c
[<000000008b9d4183>] __alloc_skb+0xec/0x1fc
[<00000000c7af5051>] __netdev_alloc_skb+0x48/0x23c
[<00000000642ee5f5>] batadv_v_ogm_aggr_send+0x50/0x36c
[<0000000088660bd7>] batadv_v_ogm_aggr_work+0x24/0x40
[<0000000042fc2606>] process_one_work+0x3b0/0x610
[<000000002f2a0b1c>] worker_thread+0xa0/0x690
[<0000000059fae5d4>] kthread+0x1fc/0x210
[<000000000c587d3a>] ret_from_fork+0x10/0x20Free the skb in that case to fix this leak.
--- net/batman-adv/bat_v_ogm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/batman-adv/bat_v_ogm.c +3 -1
@@ -118,8 +118,10 @@ static void batadv_v_ogm_send_to_if(stru {struct batadv_priv *bat_priv =netdev_priv (hard_iface->soft_iface); -if (hard_iface->if_status !=BATADV_IF_ACTIVE ) +if (hard_iface->if_status !=BATADV_IF_ACTIVE ) { +kfree_skb (skb);return ; + }batadv_inc_counter (bat_priv,BATADV_CNT_MGMT_TX ); batadv_add_counter(bat_priv, BATADV_CNT_MGMT_TX_BYTES,
Greg Kroah-Hartman
maintainerPATCH 51/57 lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 382d4cd1847517ffcb1800fd462b625db7b2ebea upstream.
The gcc compiler translates on some architectures the 64-bit __builtin_clzll() function to a call to the libgcc function __clzdi2(), which should take a 64-bit parameter on 32- and 64-bit platforms.
But in the current kernel code, the built-in __clzdi2() function is defined to operate (wrongly) on 32-bit parameters if BITS_PER_LONG == 32, thus the return values on 32-bit kernels are in the range from [0..31] instead of the expected [0..63] range.
This patch fixes the in-kernel functions __clzdi2() and __ctzdi2() to take a 64-bit parameter on 32-bit kernels as well, thus it makes the functions identical for 32- and 64-bit kernels.
This bug went unnoticed since kernel 3.11 for over 10 years, and here are some possible reasons for that:
a) Some architectures have assembly instructions to count the bits and which are used instead of calling __clzdi2(), e.g. on x86 the bsr instruction and on ppc cntlz is used. On such architectures the wrong __clzdi2() implementation isn't used and as such the bug has no effect and won't be noticed.
b) Some architectures link to libgcc.a, and the in-kernel weak functions get replaced by the correct 64-bit variants from libgcc.a.
c) __builtin_clzll() and __clzdi2() doesn't seem to be used in many places in the kernel, and most likely only in uncritical functions, e.g. when printing hex values via seq_put_hex_ll(). The wrong return value will still print the correct number, but just in a wrong formatting (e.g. with too many leading zeroes).
d) 32-bit kernels aren't used that much any longer, so they are less tested.
A trivial testcase to verify if the currently running 32-bit kernel is affected by the bug is to look at the output of /proc/self/maps:
Here the kernel uses a correct implementation of __clzdi2():
root@debian:~# cat /proc/self/maps 00010000-00019000 r-xp 00000000 08:05 787324 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:05 787324 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] f7551000-f770d000 r-xp 00000000 08:05 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ...
and this kernel uses the broken implementation of __clzdi2():
root@debian:~# cat /proc/self/maps 0000000010000-0000000019000 r-xp 00000000 000000008:000000005 787324 /usr/bin/cat 0000000019000-000000001a000 rwxp 000000009000 000000008:000000005 787324 /usr/bin/cat 000000001a000-000000003b000 rwxp 00000000 00:00 0 [heap] 00000000f73d1000-00000000f758d000 r-xp 00000000 000000008:000000005 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ...
--- lib/clz_ctz.c | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-)
lib/clz_ctz.c +6 -26
@@ -30,36 +30,16 @@ int __weak __clzsi2(int val) }EXPORT_SYMBOL (__clzsi2); -int __weak __clzdi2 (long val); -int __weak __ctzdi2 (long val); -#if BITS_PER_LONG ==32 - -int __weak __clzdi2 (long val) +int __weak __clzdi2 (u64 val); +int __weak __clzdi2 (u64 val) { -return 32 -fls ((int )val); +return 64 -fls64 (val); }EXPORT_SYMBOL (__clzdi2); -int __weak __ctzdi2 (long val) +int __weak __ctzdi2 (u64 val); +int __weak __ctzdi2 (u64 val) { -return __ffs ((u32 )val); +return __ffs64 (val); }EXPORT_SYMBOL (__ctzdi2); - -#elif BITS_PER_LONG ==64 - -int __weak __clzdi2 (long val) -{ -return 64 -fls64 ((u64 )val); -} -EXPORT_SYMBOL (__clzdi2); - -int __weak __ctzdi2 (long val) -{ -return __ffs64 ((u64 )val); -} -EXPORT_SYMBOL (__ctzdi2); - -#else -#error BITS_PER_LONG not 32 or 64 -#endif
Greg Kroah-Hartman
maintainerPATCH 52/57 media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Chen <[email protected]>
commit e7f2e65699e2290fd547ec12a17008764e5d9620 upstream.
variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds.
Fix this bug by checking *nplanes against the array size.
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c +2 -0
@@ -766,6 +766,8 @@ static int vb2ops_venc_queue_setup(strucreturn -EINVAL ;if (*nplanes) { +if (*nplanes != q_data->fmt->num_planes) +return -EINVAL ;for (i =0 ; i < *nplanes; i++)if (sizes[i] < q_data->sizeimage[i])return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 53/57 x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit 2c66ca3949dc701da7f4c9407f2140ae425683a5 upstream.
0-Day found a 34.6% regression in stress-ng's 'af-alg' test case, and bisected it to commit b81fac906a8f ("x86/fpu: Move FPU initialization into arch_cpu_finalize_init()"), which optimizes the FPU init order, and moves the CR4_OSXSAVE enabling into a later place:
arch_cpu_finalize_init
identify_boot_cpu
identify_cpu
generic_identify
get_cpu_cap --> setup cpu capability
...
fpu__init_cpu
fpu__init_cpu_xstate
cr4_set_bits(X86_CR4_OSXSAVE);As the FPU is not yet initialized the CPU capability setup fails to set X86_FEATURE_OSXSAVE. Many security module like 'camellia_aesni_avx_x86_64' depend on this feature and therefore fail to load, causing the regression.
Cure this by setting X86_FEATURE_OSXSAVE feature right after OSXSAVE enabling.
[ tglx: Moved it into the actual BSP FPU initialization code and added a comment ]
--- arch/x86/kernel/fpu/xstate.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/fpu/xstate.c +8 -0
@@ -811,6 +811,14 @@ void __init fpu__init_system_xstate(voidfpu__init_prepare_fx_sw_frame ();setup_init_fpu_buf ();setup_xstate_comp (); + +/* +* CPU capabilities initialization runs before FPU init. So +* X86_FEATURE_OSXSAVE is not set. Now that XSAVE is completely +* functional, set the feature bit so depending code works. +*/ +setup_force_cpu_cap (X86_FEATURE_OSXSAVE ); +print_xstate_offset_size (); pr_info("x86/fpu: Enabled xstate features 0x%llx, context size is %d bytes, using '%s' format.\n",
Greg Kroah-Hartman
maintainerPATCH 54/57 rtnetlink: Reject negative ifindexes in RTM_NEWLINK
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ]
Negative ifindexes are illegal, but the kernel does not validate the ifindex in the ancillary header of RTM_NEWLINK messages, resulting in the kernel generating a warning [1] when such an ifindex is specified.
Fix by rejecting negative ifindexes.
[1]
WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 [...] Call Trace: <TASK> register_netdevice+0x69a/0x1490 net/core/dev.c:10081 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:728 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:751 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- net/core/rtnetlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/rtnetlink.c +4 -1
@@ -2311,7 +2311,10 @@ static int rtnl_setlink(struct sk_buff * ifm =nlmsg_data (nlh);if (ifm->ifi_index >0 ) dev =__dev_get_by_index (net, ifm->ifi_index); -else if (tb[IFLA_IFNAME ]) +else if (ifm->ifi_index <0 ) { +NL_SET_ERR_MSG (extack,"ifindex can't be negative" ); +return -EINVAL ; + }else if (tb[IFLA_IFNAME ]) dev =__dev_get_by_name (net, ifname);else goto errout;
Greg Kroah-Hartman
maintainerPATCH 55/57 scsi: snic: Fix double free in snic_tgt_create()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Wang <[email protected]>
commit 1bd3a76880b2bce017987cf53780b372cf59528e upstream.
Commit 41320b18a0e0 ("scsi: snic: Fix possible memory leak if device_add() fails") fixed the memory leak caused by dev_set_name() when device_add() failed. However, it did not consider that 'tgt' has already been released when put_device(&tgt->dev) is called. Remove kfree(tgt) in the error path to avoid double free of 'tgt' and move put_device(&tgt->dev) after the removed kfree(tgt) to avoid a use-after-free.
--- drivers/scsi/snic/snic_disc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/snic/snic_disc.c +1 -2
@@ -316,12 +316,11 @@ snic_tgt_create(struct snic *snic, struc"Snic Tgt: device_add, with err = %d\n" , ret); -put_device (&tgt->dev);put_device (&snic->shost->shost_gendev);spin_lock_irqsave (snic->shost->host_lock, flags);list_del (&tgt->list);spin_unlock_irqrestore (snic->shost->host_lock, flags); -kfree (tgt); +put_device (&tgt->dev); tgt =NULL ;return tgt;
Greg Kroah-Hartman
maintainerPATCH 56/57 scsi: core: raid_class: Remove raid_component_add()
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Wang <[email protected]>
commit 60c5fd2e8f3c42a5abc565ba9876ead1da5ad2b7 upstream.
The raid_component_add() function was added to the kernel tree via patch "[SCSI] embryonic RAID class" (2005). Remove this function since it never has had any callers in the Linux kernel. And also raid_component_release() is only used in raid_component_add(), so it is also removed.
--- drivers/scsi/raid_class.c | 48 --------------------------------------------- include/linux/raid_class.h | 4 --- 2 files changed, 52 deletions(-)
drivers/scsi/raid_class.c +0 -48
@@ -209,54 +209,6 @@ raid_attr_ro_state(level);raid_attr_ro_fn (resync);raid_attr_ro_state_fn (state); -static void raid_component_release (struct device *dev) -{ -struct raid_component *rc = - container_of(dev, struct raid_component, dev); -dev_printk (KERN_ERR , rc->dev.parent,"COMPONENT RELEASE\n" ); -put_device (rc->dev.parent); -kfree (rc); -} - -int raid_component_add (struct raid_template *r,struct device *raid_dev, -struct device *component_dev) -{ -struct device *cdev = -attribute_container_find_class_device (&r->raid_attrs.ac, - raid_dev); -struct raid_component *rc; -struct raid_data *rd =dev_get_drvdata (cdev); -int err; - - rc =kzalloc (sizeof (*rc),GFP_KERNEL ); -if (!rc) -return -ENOMEM ; - -INIT_LIST_HEAD (&rc->node); -device_initialize (&rc->dev); - rc->dev.release = raid_component_release; - rc->dev.parent =get_device (component_dev); - rc->num = rd->component_count++; - -dev_set_name (&rc->dev,"component-%d" , rc->num); -list_add_tail (&rc->node, &rd->component_list); - rc->dev.class = &raid_class.class; - err =device_add (&rc->dev); -if (err) - goto err_out; - -return 0 ; - -err_out: -put_device (&rc->dev); -list_del (&rc->node); - rd->component_count--; -put_device (component_dev); -kfree (rc); -return err; -} -EXPORT_SYMBOL (raid_component_add); -struct raid_template *raid_class_attach (struct raid_function_template *ft) {
include/linux/raid_class.h +0 -4
@@ -77,7 +77,3 @@ DEFINE_RAID_ATTRIBUTE(enum raid_state, sstruct raid_template *raid_class_attach (struct raid_function_template *);void raid_class_release (struct raid_template *); - -int __must_check raid_component_add (struct raid_template *,struct device *, -struct device *); -
Greg Kroah-Hartman
maintainerPATCH 57/57 dma-buf/sw_sync: Avoid recursive lock during fence signal
In reply to Greg Kroah-Hartman4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ]
If a signal callback releases the sw_sync fence, that will trigger a deadlock as the timeline_fence_release recurses onto the fence->lock (used both for signaling and the the timeline tree).
To avoid that, temporarily hold an extra reference to the signalled fences until after we drop the lock.
(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
which avoids some potential UAF issues with the original patch.)
v2: Remove now obsolete comment, use list_move_tail() and
list_del_init()
--- drivers/dma-buf/sw_sync.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/dma-buf/sw_sync.c +9 -9
@@ -201,6 +201,7 @@ static const struct dma_fence_ops timeline_fence_ops = {*/ static void sync_timeline_signal (struct sync_timeline *obj,unsigned int inc) { +LIST_HEAD (signalled);struct sync_pt *pt, *next;trace_sync_timeline (obj);
@@ -213,21 +214,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)if (!timeline_fence_signaled (&pt->base))break ; -list_del_init (&pt->link); +dma_fence_get (&pt->base); + +list_move_tail (&pt->link, &signalled);rb_erase (&pt->node, &obj->pt_tree); -/* -* A signal callback may release the last reference to this -* fence, causing it to be freed. That operation has to be -* last to avoid a use after free inside this loop, and must -* be after we remove the fence from the timeline in order to -* prevent deadlocking on timeline->lock inside -* timeline_fence_release(). -*/ dma_fence_signal_locked (&pt->base); }spin_unlock_irq (&obj->lock); + +list_for_each_entry_safe (pt, next, &signalled, link) { +list_del_init (&pt->link); +dma_fence_put (&pt->base); + } }/**
Signature · 1 line
2.40.1
Hello!
Quoted 24 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.324-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 4.14.324-rc1
[...]
Quoted 2 lines
Nathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objects
[...]
We see this build regression on PowerPC with GCC-8 and GCC-12:
-----8<-----
/builds/linux/arch/powerpc/kernel/rtas_flash.c: In function 'rtas_flash_init':
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:22: error: implicit declaration of function 'kmem_cache_create_usercopy'; did you mean 'kmem_cache_create'? [-Werror=implicit-function-declaration]
flash_block_cache = kmem_cache_create_usercopy("rtas_flash_cache",
^~~~~~~~~~~~~~~~~~~~~~~~~~
kmem_cache_create
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:20: error: assignment to 'struct kmem_cache *' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
flash_block_cache = kmem_cache_create_usercopy("rtas_flash_cache",
^
----->8-----
That's on defconfig and cell_defconfig.
Bisection points to "powerpc/rtas_flash: allow user copy to flash block cache objects" (5190538c66e5). Reverting that patch makes the build pass again.
Tuxmake reproducer:
#pip3 install -U tuxmake tuxmake --runtime podman --target-arch powerpc --toolchain gcc-8 --kconfig defconfig git revert 5190538c66e5e8e7cdbf694afec8291f421e6bcf tuxmake --runtime podman --target-arch powerpc --toolchain gcc-8 --kconfig defconfig
Greetings!
Daniel Díaz
[email protected]
Quoted 13 lines · Daniel Díaz
We see this build regression on PowerPC with GCC-8 and GCC-12:
-----8<-----
/builds/linux/arch/powerpc/kernel/rtas_flash.c: In function 'rtas_flash_init':
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:22: error: implicit declaration of function 'kmem_cache_create_usercopy'; did you mean 'kmem_cache_create'? [-Werror=implicit-function-declaration]
flash_block_cache= kmem_cache_create_usercopy("rtas_flash_cache",
^~~~~~~~~~~~~~~~~~~~~~~~~~
kmem_cache_create
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:20: error: assignment to 'structkmem_cache*' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
flash_block_cache= kmem_cache_create_usercopy("rtas_flash_cache",
^
----->8-----
Quoted 5 lines
That's on defconfig and
cell_defconfig.Bisection points to "powerpc/rtas_flash: allow user copy to flash block cache objects" (
5190538c66e5). Reverting that patch makes the build pass again.
That change should not be applied to 4.14.x. The problem it fixes is not present in that version.
Greg Kroah-Hartman
maintainerQuoted 44 lines · Daniel Díaz
Hello!
Quoted 24 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.324-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:Greg Kroah-Hartman <[email protected]>
Linux 4.14.324-rc1[...]
Quoted 2 lines
Nathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objects[...]
We see this build regression on PowerPC with GCC-8 and GCC-12:
-----8<-----
/builds/linux/arch/powerpc/kernel/rtas_flash.c: In function 'rtas_flash_init':
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:22: error: implicit declaration of function 'kmem_cache_create_usercopy'; did you mean 'kmem_cache_create'? [-Werror=implicit-function-declaration]
flash_block_cache= kmem_cache_create_usercopy("rtas_flash_cache",
^~~~~~~~~~~~~~~~~~~~~~~~~~
kmem_cache_create
/builds/linux/arch/powerpc/kernel/rtas_flash.c:717:20: error: assignment to 'structkmem_cache*' from 'int' makes pointer from integer without a cast [-Werror=int-conversion]
flash_block_cache= kmem_cache_create_usercopy("rtas_flash_cache",
^
----->8-----
Quoted 3 lines
That's on defconfig and
cell_defconfig.Bisection points to "powerpc/rtas_flash: allow user copy to flash block cache objects" (
5190538c66e5). Reverting that patch makes the build pass again.
Now dropped, thanks.
greg k-h
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Build results:
total: 139 pass: 133 fail: 6
Failed builds:
arm:ep93xx_defconfig
mips:mtx1_defconfig
mips:db1xxx_defconfig
powerpc:defconfig
powerpc:allmodconfig
powerpc:cell_defconfig
Qemu test results:
total: 431 pass: 414 fail: 17 Failed tests: <all ppc64:pseries>
arm:ep93xx_defconfig
Error log:arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error: platform.h
That is really an older problem, caused by commit 2e50d55578b0 ("ARM:
ep93xx: fix missing-prototype warnings") which instead of fixing anything in v4.14.y broke its build.
mips:mtx1_defconfig
arch/mips/alchemy/common/dbdma.c:33:10: fatal error: linux/dma-map-ops.h: No such file or directory
Again, an older problem, caused by commit 10130470bb0 ("MIPS: Alchemy:
fix dbdma2").
powerpc:defconfig, powerpc:allmodconfig, powerpc:cell_defconfig
arch/powerpc/kernel/rtas_flash.c: In function 'rtas_flash_init':arch/powerpc/kernel/rtas_flash.c:717:29: error: implicit declaration of function 'kmem_cache_create_usercopy'
ppc64 boot tests fail to compile with the same error.
Guenter
Greg Kroah-Hartman
maintainerQuoted 33 lines · Guenter Roeck
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Build results:
total: 139 pass: 133 fail: 6Failed builds:
arm:ep93xx_defconfig
mips:mtx1_defconfig
mips:db1xxx_defconfig
powerpc:defconfig
powerpc:allmodconfig
powerpc:cell_defconfig
Qemu test results:total: 431 pass: 414 fail: 17 Failed tests: <all ppc64:pseries>arm:ep93xx_defconfig
Error log:
arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error:platform.hThat is really an older problem, caused by commit
2e50d55578b0("ARM:
ep93xx: fix missing-prototype warnings") which instead of fixing anything in v4.14.y broke its build.
Quoted 6 lines
mips:mtx1_defconfig
arch/mips/alchemy/common/dbdma.c:33:10: fatal error:linux/dma-map-ops.h: No such file or directoryAgain, an older problem, caused by commit
10130470bb0("MIPS: Alchemy:
fix dbdma2").
Thanks, I'll work on these after this release.
Quoted 6 lines
powerpc:defconfig, powerpc:allmodconfig, powerpc:cell_defconfig
arch/powerpc/kernel/rtas_flash.c: In function 'rtas_flash_init':arch/powerpc/kernel/rtas_flash.c:717:29: error: implicit declaration of function 'kmem_cache_create_usercopy'ppc64 boot tests fail to compile with the same error.
This one is now dropped.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.324-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.14.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.14:
11 builds: 11 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.14.324-rc1-g01b341fdf42f
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 4.14.324 release. There are 57 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-4.14.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany