4.19.293-rc1 review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 4.19.293-rc1 review
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.293-rc1
Rob Clark <[email protected]>
dma-buf/sw_sync: Avoid recursive lock during fence signal
Biju Das <[email protected]>
clk: Fix undefined reference to `clk_rate_exclusive_{get,put}'
Zhu Wang <[email protected]>
scsi: core: raid_class: Remove raid_component_add()
Zhu Wang <[email protected]>
scsi: snic: Fix double free in snic_tgt_create()
Jiaxun Yang <[email protected]>
irqchip/mips-gic: Don't touch vl_map if a local interrupt is not routable
Ido Schimmel <[email protected]>
rtnetlink: Reject negative ifindexes in RTM_NEWLINK
Vamsi Krishna Brahmajosyula <[email protected]>
netfilter: nf_queue: fix socket leak
Pietro Borrello <[email protected]>
sched/rt: pick_next_rt_entity(): check list_entry
Yibin Ding <[email protected]>
mmc: block: Fix in_flight[issue_type] value error
Feng Tang <[email protected]>
x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
Igor Mammedov <[email protected]>
PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus
Wei Chen <[email protected]>
media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
Helge Deller <[email protected]>
lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
Remi Pommarel <[email protected]>
batman-adv: Fix batadv_v_ogm_aggr_send memory leak
Remi Pommarel <[email protected]>
batman-adv: Fix TT global entry leak when client roamed back
Remi Pommarel <[email protected]>
batman-adv: Do not get eth header before batadv_check_management_packet
Sven Eckelmann <[email protected]>
batman-adv: Don't increase MTU when set by user
Sven Eckelmann <[email protected]>
batman-adv: Trigger events for auto adjusted MTU
Benjamin Coddington <[email protected]>
nfsd: Fix race to FREE_STATEID and cl_revoked
Michael Ellerman <[email protected]>
ibmveth: Use dcbf rather than dcbfl
Sishuai Gong <[email protected]>
ipvs: fix racy memcpy in proc_do_sync_threshold
Junwei Hu <[email protected]>
ipvs: Improve robustness to the ipvs sysctl
Hangbin Liu <[email protected]>
bonding: fix macvlan over alb bond support
Jakub Kicinski <[email protected]>
net: remove bond_slave_has_mac_rcu()
Jamal Hadi Salim <[email protected]>
net/sched: fix a qdisc modification with ambiguous command request
Alessio Igor Bogani <[email protected]>
igb: Avoid starting unnecessary workqueues
Eric Dumazet <[email protected]>
dccp: annotate data-races in dccp_poll()
Eric Dumazet <[email protected]>
sock: annotate data-races around prot->memory_pressure
Zheng Yejian <[email protected]>
tracing: Fix memleak due to race between current_tracer and trace
Taimur Hassan <[email protected]>
drm/amd/display: check TG is non-null before checking if enabled
Josip Pavic <[email protected]>
drm/amd/display: do not wait for mpc idle if tg is disabled
Mark Brown <[email protected]>
regmap: Account for register length in SMBus I/O limits
Mikulas Patocka <[email protected]>
dm integrity: reduce vmalloc space footprint on 32-bit architectures
Mikulas Patocka <[email protected]>
dm integrity: increase RECALC_SECTORS to improve recalculate speed
Naveen N Rao <[email protected]>
powerpc: Fail build if using recordmcount with binutils v2.37
Masahiro Yamada <[email protected]>
powerpc: remove leftover code of old GCC version checks
Christophe Leroy <[email protected]>
powerpc/32: add stack protector support
Zhang Shurong <[email protected]>
fbdev: fix potential OOB read in fast_imageblit()
Thomas Zimmermann <[email protected]>
fbdev: Fix sys_imageblit() for arbitrary image widths
Thomas Zimmermann <[email protected]>
fbdev: Improve performance of sys_imageblit()
Sherry Sun <[email protected]>
tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
Alexander Stein <[email protected]>
Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
Jiaxun Yang <[email protected]>
MIPS: cpu-features: Use boot_cpu_type for CPU type based features
Jiaxun Yang <[email protected]>
MIPS: cpu-features: Enable octeon_cache by cpu_type
Alexander Aring <[email protected]>
fs: dlm: fix mismatch of plock results from userspace
Alexander Aring <[email protected]>
fs: dlm: use dlm_plock_info for do_unlock_close
Alexander Aring <[email protected]>
fs: dlm: change plock interrupted message to debug again
Alexander Aring <[email protected]>
fs: dlm: add pid to debug log
Jakob Koschel <[email protected]>
dlm: replace usage of found with dedicated list iterator variable
Alexander Aring <[email protected]>
dlm: improve plock logging if interrupted
Igor Mammedov <[email protected]>
PCI: acpiphp: Reassign resources on bridge if necessary
Justin Chen <[email protected]>
net: phy: broadcom: stub c45 read/write for 54810
Lin Ma <[email protected]>
net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
Jason Xing <[email protected]>
net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before reset
Jason Wang <[email protected]>
virtio-net: set queues after driver_ok
Kuniyuki Iwashima <[email protected]>
af_unix: Fix null-ptr-deref in unix_stream_sendpage().
Xin Long <[email protected]>
netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
Mirsad Goran Todorovac <[email protected]>
test_firmware: prevent race conditions by a correct implementation of locking
Yang Yingliang <[email protected]>
mmc: wbsd: fix double mmc_free_host() in wbsd_init()
Russell Harmon via samba-technical <[email protected]>
cifs: Release folio lock on fscache read hit.
dengxiang <[email protected]>
ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
Tony Lindgren <[email protected]>
serial: 8250: Fix oops for port->pm on uart_change_pm()
Jerome Brunet <[email protected]>
ASoC: meson: axg-tdm-formatter: fix channel slot allocation
Zhang Shurong <[email protected]>
ASoC: rt5665: add missed regulator_bulk_disable
Eric Dumazet <[email protected]>
net: do not allow gso_size to be set to GSO_BY_FRAGS
Abel Wu <[email protected]>
sock: Fix misuse of sk_under_memory_pressure()
Andrii Staikov <[email protected]>
i40e: fix misleading debug logs
Ziyang Xuan <[email protected]>
team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
Pablo Neira Ayuso <[email protected]>
netfilter: nft_dynset: disallow object maps
Petr Machata <[email protected]>
selftests: mirror_gre_changes: Tighten up the TTL test match
Lin Ma <[email protected]>
xfrm: add NULL check in xfrm_update_ae_params
Zhengchao Shao <[email protected]>
ip_vti: fix potential slab-use-after-free in decode_session6
Zhengchao Shao <[email protected]>
ip6_vti: fix slab-use-after-free in decode_session6
Zhengchao Shao <[email protected]>
xfrm: fix slab-use-after-free in decode_session6
Eyal Birger <[email protected]>
xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
Lin Ma <[email protected]>
net: af_key: fix sadb_x_filter validation
Lin Ma <[email protected]>
net: xfrm: Fix xfrm_address_filter OOB read
xiaoshoukui <[email protected]>
btrfs: fix BUG_ON condition in btrfs_cancel_balance
Nathan Lynch <[email protected]>
powerpc/rtas_flash: allow user copy to flash block cache objects
Yuanjun Gong <[email protected]>
fbdev: mmp: fix value check in mmphw_probe()
Wolfram Sang <[email protected]>
virtio-mmio: don't break lifecycle of vm_dev
Tang Bin <[email protected]>
virtio-mmio: Use to_virtio_mmio_device() to simply code
Yangtao Li <[email protected]>
virtio-mmio: convert to devm_platform_ioremap_resource
Trond Myklebust <[email protected]>
nfsd: Remove incorrect check in nfsd4_validate_stateid
J. Bruce Fields <[email protected]>
nfsd4: kill warnings on testing stateids with mismatched clientids
Michael Schmitz <[email protected]>
block: fix signed int overflow in Amiga partition support
Sergey Shtylyov <[email protected]>
mmc: sunxi: fix deferred probing
Sergey Shtylyov <[email protected]>
mmc: bcm2835: fix deferred probing
Stephen Boyd <[email protected]>
mmc: Remove dev_err() usage after platform_get_irq()
Masahiro Yamada <[email protected]>
mmc: tmio: move tmio_mmc_set_clock() to platform hook
Masahiro Yamada <[email protected]>
mmc: tmio: replace tmio_mmc_clk_stop() calls with tmio_mmc_set_clock()
Martin Hundebøll <[email protected]>
mmc: meson-gx: remove redundant mmc_request_done() call from irq context
Jerome Brunet <[email protected]>
mmc: meson-gx: remove useless lock
Johan Hovold <[email protected]>
USB: dwc3: qcom: fix NULL-deref on suspend
Sandeep Maheswaram <[email protected]>
usb: dwc3: qcom: Add helper functions to enable,disable wake irqs
Jiaxun Yang <[email protected]>
irqchip/mips-gic: Use raw spinlock for gic_lock
Marc Zyngier <[email protected]>
irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
Zhang Rui <[email protected]>
x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
Michael Ellerman <[email protected]>
powerpc/64s/radix: Fix soft dirty tracking
Christophe Leroy <[email protected]>
powerpc: Move page table dump files in a dedicated subdirectory
Christophe Leroy <[email protected]>
powerpc/mm: dump block address translation on book3s/32
Christophe Leroy <[email protected]>
powerpc/mm: dump segment registers on book3s/32
Christophe Leroy <[email protected]>
powerpc/mm: Move pgtable_t into platform headers
Christophe Leroy <[email protected]>
powerpc/mm: move platform specific mmu-xxx.h in platform directories
William Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition when converting analog-to-digital
William Breathitt Gray <[email protected]>
iio: addac: stx104: Fix race condition for stx104_write_raw()
William Breathitt Gray <[email protected]>
iio: adc: stx104: Implement and utilize register structures
William Breathitt Gray <[email protected]>
iio: adc: stx104: Utilize iomap interface
Cosmin Tanislav <[email protected]>
iio: add addac subdirectory
Randy Dunlap <[email protected]>
IMA: allow/fix UML builds
shanzhulig <[email protected]>
drm/amdgpu: Fix potential fence use-after-free v2
Zhengping Jiang <[email protected]>
Bluetooth: L2CAP: Fix use-after-free
Armin Wolf <[email protected]>
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
Tuo Li <[email protected]>
gfs2: Fix possible data races in gfs2_show_options()
Hans Verkuil <[email protected]>
media: platform: mediatek: vpu: fix NULL ptr dereference
Yunfei Dong <[email protected]>
media: v4l2-mem2mem: add lock to protect parameter num_rdy
Immad Mir <[email protected]>
FS: JFS: Check for read-only mounted filesystem in txBegin
Immad Mir <[email protected]>
FS: JFS: Fix null-ptr-deref Read in txBegin
Gustavo A. R. Silva <[email protected]>
MIPS: dec: prom: Address -Warray-bounds warning
Yogesh <[email protected]>
fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
Jan Kara <[email protected]>
udf: Fix uninitialized array access for some pathnames
Marco Morandini <[email protected]>
HID: add quirk for 03f0:464a HP Elite Presenter Mouse
Ye Bin <[email protected]>
quota: fix warning in dqgrab()
Jan Kara <[email protected]>
quota: Properly disable quotas when add_dquot_ref() fails
Oswald Buddenhagen <[email protected]>
ALSA: emu10k1: roll up loops in DSP setup code for Audigy
hackyzh002 <[email protected]>
drm/radeon: Fix integer overflow in radeon_cs_parser_init
Ido Schimmel <[email protected]>
selftests: forwarding: tc_flower: Relax success criterion
Nathan Chancellor <[email protected]>
lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
-------------
Diffstat:
Makefile | 4 +-
arch/mips/include/asm/cpu-features.h | 21 ++-
arch/mips/include/asm/dec/prom.h | 2 +-
arch/powerpc/Kconfig | 1 +
arch/powerpc/Kconfig.debug | 4 -
arch/powerpc/Makefile | 24 ++-
arch/powerpc/include/asm/book3s/32/mmu-hash.h | 6 +
arch/powerpc/include/asm/book3s/64/mmu.h | 9 ++
arch/powerpc/include/asm/mmu.h | 14 +-
arch/powerpc/include/asm/{ => nohash/32}/mmu-40x.h | 0
arch/powerpc/include/asm/{ => nohash/32}/mmu-44x.h | 0
arch/powerpc/include/asm/{ => nohash/32}/mmu-8xx.h | 0
arch/powerpc/include/asm/nohash/32/mmu.h | 23 +++
arch/powerpc/include/asm/nohash/64/mmu.h | 12 ++
arch/powerpc/include/asm/{ => nohash}/mmu-book3e.h | 0
arch/powerpc/include/asm/nohash/mmu.h | 11 ++
arch/powerpc/include/asm/page.h | 14 --
arch/powerpc/include/asm/stackprotector.h | 34 ++++
arch/powerpc/kernel/Makefile | 2 +
arch/powerpc/kernel/asm-offsets.c | 3 +
arch/powerpc/kernel/cpu_setup_fsl_booke.S | 2 +-
arch/powerpc/kernel/rtas_flash.c | 6 +-
arch/powerpc/kvm/e500.h | 2 +-
arch/powerpc/mm/Makefile | 10 +-
arch/powerpc/mm/pgtable-radix.c | 4 +-
.../{dump_linuxpagetables-8xx.c => ptdump/8xx.c} | 2 +-
arch/powerpc/mm/ptdump/Makefile | 9 ++
arch/powerpc/mm/ptdump/bats.c | 173 +++++++++++++++++++++
.../book3s64.c} | 2 +-
.../hashpagetable.c} | 0
.../mm/{dump_linuxpagetables.c => ptdump/ptdump.c} | 2 +-
.../mm/{dump_linuxpagetables.h => ptdump/ptdump.h} | 0
arch/powerpc/mm/ptdump/segment_regs.c | 64 ++++++++
.../shared.c} | 2 +-
arch/powerpc/platforms/powermac/Makefile | 1 +
arch/x86/kernel/cpu/topology.c | 5 +-
arch/x86/kernel/fpu/xstate.c | 8 +
block/partitions/amiga.c | 9 +-
drivers/base/regmap/regmap-i2c.c | 4 +-
drivers/bus/ti-sysc.c | 2 +
drivers/dma-buf/sw_sync.c | 18 +--
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +-
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 4 +-
drivers/gpu/drm/radeon/radeon_cs.c | 3 +-
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-quirks.c | 1 +
drivers/iio/Kconfig | 1 +
drivers/iio/Makefile | 1 +
drivers/iio/adc/stx104.c | 98 ++++++++----
drivers/iio/addac/Kconfig | 8 +
drivers/iio/addac/Makefile | 6 +
drivers/irqchip/irq-mips-gic.c | 65 +++++---
drivers/md/dm-integrity.c | 4 +-
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 2 +
drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 +-
drivers/mmc/core/block.c | 11 +-
drivers/mmc/host/bcm2835.c | 5 +-
drivers/mmc/host/jz4740_mmc.c | 1 -
drivers/mmc/host/meson-gx-mmc.c | 18 +--
drivers/mmc/host/mxcmmc.c | 4 +-
drivers/mmc/host/renesas_sdhi_core.c | 62 +++++++-
drivers/mmc/host/s3cmci.c | 1 -
drivers/mmc/host/sdhci-msm.c | 2 -
drivers/mmc/host/sdhci-pltfm.c | 1 -
drivers/mmc/host/sdhci-s3c.c | 4 +-
drivers/mmc/host/sdhci_f_sdh30.c | 4 +-
drivers/mmc/host/sunxi-mmc.c | 4 +-
drivers/mmc/host/tmio_mmc.c | 48 ++++++
drivers/mmc/host/tmio_mmc.h | 4 +-
drivers/mmc/host/tmio_mmc_core.c | 92 +----------
drivers/mmc/host/wbsd.c | 2 -
drivers/net/bonding/bond_alb.c | 6 +-
drivers/net/ethernet/ibm/ibmveth.c | 2 +-
drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 +-
drivers/net/ethernet/intel/igb/igb_ptp.c | 24 +--
drivers/net/phy/broadcom.c | 13 ++
drivers/net/team/team.c | 4 +-
drivers/net/virtio_net.c | 4 +-
drivers/pci/hotplug/acpiphp_glue.c | 9 +-
drivers/pcmcia/rsrc_nonstatic.c | 2 +
drivers/scsi/raid_class.c | 48 ------
drivers/scsi/snic/snic_disc.c | 3 +-
drivers/tty/serial/8250/8250_port.c | 1 +
drivers/tty/serial/fsl_lpuart.c | 2 +
drivers/usb/dwc3/dwc3-qcom.c | 69 ++++----
drivers/video/fbdev/core/sysimgblt.c | 64 +++++++-
drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +-
drivers/virtio/virtio_mmio.c | 23 +--
fs/btrfs/volumes.c | 3 +-
fs/cifs/file.c | 2 +-
fs/dlm/lock.c | 53 +++----
fs/dlm/plock.c | 89 +++++++----
fs/dlm/recover.c | 39 +++--
fs/gfs2/super.c | 26 ++--
fs/jfs/jfs_dmap.c | 3 +
fs/jfs/jfs_txnmgr.c | 5 +
fs/jfs/namei.c | 5 +
fs/nfsd/nfs4state.c | 11 +-
fs/quota/dquot.c | 5 +-
fs/udf/unicode.c | 2 +-
include/linux/clk.h | 80 +++++-----
include/linux/raid_class.h | 4 -
include/linux/virtio_net.h | 4 +
include/media/v4l2-mem2mem.h | 18 ++-
include/net/bonding.h | 25 +--
include/net/sock.h | 11 +-
kernel/sched/rt.c | 5 +-
kernel/trace/trace.c | 9 +-
kernel/trace/trace_irqsoff.c | 3 +-
kernel/trace/trace_sched_wakeup.c | 2 +
lib/clz_ctz.c | 32 +---
lib/mpi/longlong.h | 36 +----
lib/test_firmware.c | 39 +++--
net/batman-adv/bat_v_elp.c | 3 +-
net/batman-adv/bat_v_ogm.c | 7 +-
net/batman-adv/hard-interface.c | 14 +-
net/batman-adv/soft-interface.c | 3 +
net/batman-adv/translation-table.c | 1 -
net/batman-adv/types.h | 6 +
net/bluetooth/l2cap_core.c | 5 +
net/core/rtnetlink.c | 5 +-
net/core/sock.c | 2 +-
net/dccp/proto.c | 20 ++-
net/ipv4/ip_vti.c | 4 +-
net/ipv4/tcp_timer.c | 4 +-
net/ipv6/ip6_vti.c | 4 +-
net/key/af_key.c | 4 +-
net/netfilter/ipvs/ip_vs_ctl.c | 74 +++++----
net/netfilter/nf_conntrack_proto_sctp.c | 6 +-
net/netfilter/nf_queue.c | 2 -
net/netfilter/nft_dynset.c | 3 +
net/sched/sch_api.c | 53 +++++--
net/sctp/socket.c | 2 +-
net/unix/af_unix.c | 9 +-
net/xfrm/Makefile | 2 +
.../{xfrm_interface.c => xfrm_interface_core.c} | 4 +-
net/xfrm/xfrm_user.c | 13 +-
security/integrity/ima/Kconfig | 2 +-
sound/pci/emu10k1/emufx.c | 112 ++-----------
sound/soc/codecs/rt5665.c | 2 +
sound/soc/meson/axg-tdm-formatter.c | 42 +++--
sound/usb/quirks-table.h | 29 ++++
.../selftests/net/forwarding/mirror_gre_changes.sh | 3 +-
.../testing/selftests/net/forwarding/tc_flower.sh | 8 +-
144 files changed, 1361 insertions(+), 870 deletions(-)Greg Kroah-Hartman
maintainerPATCH 1/129 lib/mpi: Eliminate unused umul_ppmm definitions for MIPS
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <[email protected]>
commit b0c091ae04f6746f541b9be91809e1f4f43e9a65 upstream.
Clang errors out when building this macro:
lib/mpi/generic_mpih-mul1.c:37:24: error: invalid use of a cast in a inline asm context requiring an l-value: remove the cast or build with -fheinous-gnu-extensions
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
lib/mpi/longlong.h:652:20: note: expanded from macro 'umul_ppmm'
: "=l" ((USItype)(w0)), \
~~~~~~~~~~^~~
lib/mpi/generic_mpih-mul1.c:37:3: error: invalid output constraint '=h'
in asm
umul_ppmm(prod_high, prod_low, s1_ptr[j], s2_limb);
^
lib/mpi/longlong.h:653:7: note: expanded from macro 'umul_ppmm'
"=h" ((USItype)(w1)) \
^2 errors generated.
The C version that is used for GCC 4.4 and up works well with clang; however, it is not currently being used because Clang masks itself as GCC 4.2.1 for compatibility reasons. As Nick points out, we require GCC 4.6 and newer in the kernel so we can eliminate all of the versioning checks and just use the C version of umul_ppmm for all supported compilers.
--- lib/mpi/longlong.h | 36 +----------------------------------- 1 file changed, 1 insertion(+), 35 deletions(-)
lib/mpi/longlong.h +1 -35
@@ -639,30 +639,12 @@ do { \************** MIPS ***************** ***************************************/ #if defined(__mips__) &&W_TYPE_SIZE ==32 -#if (__GNUC__ >=5 ) || (__GNUC__ >=4 && __GNUC_MINOR__ >=4 )#define umul_ppmm (w1, w0, u, v) \ do { \ UDItype __ll = (UDItype)(u) * (v); \ w1 = __ll >> 32; \ w0 = __ll; \ } while (0) -#elif __GNUC__ >2 || __GNUC_MINOR__ >=7 -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("multu %2,%3" \ - : "=l" ((USItype)(w0)), \ - "=h" ((USItype)(w1)) \ - : "d" ((USItype)(u)), \ - "d" ((USItype)(v))) -#else -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("multu %2,%3\n" \ - "mflo %0\n" \ - "mfhi %1" \ - : "=d" ((USItype)(w0)), \ - "=d" ((USItype)(w1)) \ - : "d" ((USItype)(u)), \ - "d" ((USItype)(v))) -#endif #define UMUL_TIME 10#define UDIV_TIME 100#endif /* __mips__ */
@@ -687,7 +669,7 @@ do { \ : "d" ((UDItype)(u)), \ "d" ((UDItype)(v))); \ } while (0) -#elif (__GNUC__ >=5 ) || (__GNUC__ >=4 && __GNUC_MINOR__ >=4 ) +#else#define umul_ppmm (w1, w0, u, v) \ do { \ typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \
@@ -695,22 +677,6 @@ do { \ w1 = __ll >>64 ; \ w0 = __ll; \ } while (0) -#elif __GNUC__ >2 || __GNUC_MINOR__ >=7 -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("dmultu %2,%3" \ - : "=l" ((UDItype)(w0)), \ - "=h" ((UDItype)(w1)) \ - : "d" ((UDItype)(u)), \ - "d" ((UDItype)(v))) -#else -#define umul_ppmm (w1, w0, u, v) \ - __asm__ ("dmultu %2,%3\n" \ - "mflo %0\n" \ - "mfhi %1" \ - : "=d" ((UDItype)(w0)), \ - "=d" ((UDItype)(w1)) \ - : "d" ((UDItype)(u)), \ - "d" ((UDItype)(v))) #endif#define UMUL_TIME 20#define UDIV_TIME 140
Greg Kroah-Hartman
maintainerPATCH 2/129 selftests: forwarding: tc_flower: Relax success criterion
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 9ee37e53e7687654b487fc94e82569377272a7a8 ]
The test checks that filters that match on source or destination MAC were only hit once. A host can send more than one packet with a given source or destination MAC, resulting in failures.
Fix by relaxing the success criterion and instead check that the filters were not hit zero times. Using tc_check_at_least_x_packets() is also an option, but it is not available in older kernels.
--- tools/testing/selftests/net/forwarding/tc_flower.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
tools/testing/selftests/net/forwarding/tc_flower.sh +4 -4
@@ -48,8 +48,8 @@ match_dst_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
@@ -74,8 +74,8 @@ match_src_mac_test() tc_check_packets "dev $h2 ingress" 101 1 check_fail $? "Matched on a wrong filter" - tc_check_packets "dev $h2 ingress" 102 1 - check_err $? "Did not match on correct filter" + tc_check_packets "dev $h2 ingress" 102 0 + check_fail $? "Did not match on correct filter" tc filter del dev $h2 ingress protocol ip pref 1 handle 101 flower tc filter del dev $h2 ingress protocol ip pref 2 handle 102 flower
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 3/129 drm/radeon: Fix integer overflow in radeon_cs_parser_init
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: hackyzh002 <[email protected]>
[ Upstream commit f828b681d0cd566f86351c0b913e6cb6ed8c7b9c ]
The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later
--- drivers/gpu/drm/radeon/radeon_cs.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_cs.c +2 -1
@@ -265,7 +265,8 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data) {struct drm_radeon_cs *cs = data;uint64_t *chunk_array_ptr; -unsigned size, i; +u64 size; +unsigned i;u32 ring =RADEON_CS_RING_GFX ;s32 priority =0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 4/129 ALSA: emu10k1: roll up loops in DSP setup code for Audigy
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oswald Buddenhagen <[email protected]>
[ Upstream commit 8cabf83c7aa54530e699be56249fb44f9505c4f3 ]
There is no apparent reason for the massive code duplication.
--- sound/pci/emu10k1/emufx.c | 112 +++----------------------------------- 1 file changed, 9 insertions(+), 103 deletions(-)
sound/pci/emu10k1/emufx.c +9 -103
@@ -1550,14 +1550,8 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input)) gpr +=2 ;/* Master volume (will be renamed later) */ -A_OP (icode, &ptr, iMAC0,A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+0 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+1 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+2 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+3 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+4 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+5 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+6 +SND_EMU10K1_PLAYBACK_CHANNELS )); -A_OP (icode, &ptr, iMAC0,A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+7 +SND_EMU10K1_PLAYBACK_CHANNELS )); +for (z =0 ; z <8 ; z++) +A_OP (icode, &ptr, iMAC0,A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ),A_C_00000000 ,A_GPR (gpr),A_GPR (playback+z+SND_EMU10K1_PLAYBACK_CHANNELS ));snd_emu10k1_init_mono_control (&controls[nctl++],"Wave Master Playback Volume" , gpr,0 ); gpr +=2 ;
@@ -1641,102 +1635,14 @@ A_OP(icode, &ptr, iMAC0, A_GPR(var), A_GPR(var), A_GPR(vol), A_EXTIN(input))dev_dbg(emu->card->dev, "emufx.c: gpr=0x%x, tmp=0x%x\n", gpr, tmp); */ -/* For the EMU1010: How to get 32bit values from the DSP. High 16bits into L, low 16bits into R. */ -/* A_P16VIN(0) is delayed by one sample, -* so all other A_P16VIN channels will need to also be delayed -*/ -/* Left ADC in. 1 of 2 */ snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_P16VIN (0x0 ),A_FXBUS2 (0 ) ); -/* Right ADC in 1 of 2 */ - gpr_map[gpr++] =0x00000000 ; -/* Delaying by one sample: instead of copying the input -* value A_P16VIN to output A_FXBUS2 as in the first channel, -* we use an auxiliary register, delaying the value by one -* sample -*/ -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (2 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x1 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (4 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x2 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (6 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x3 ),A_C_00000000 ,A_C_00000000 ); -/* For 96kHz mode */ -/* Left ADC in. 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0x8 ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x4 ),A_C_00000000 ,A_C_00000000 ); -/* Right ADC in 2 of 2 */ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xa ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x5 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xc ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x6 ),A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr -1 ),A_FXBUS2 (0xe ) ); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x7 ),A_C_00000000 ,A_C_00000000 ); -/* Pavel Hofman - we still have voices, A_FXBUS2s, and -* A_P16VINs available - -* let's add 8 more capture channels - total of 16 -*/ - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x10 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x8 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x12 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0x9 ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x14 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xa ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x16 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xb ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x18 )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xc ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1a )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xd ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1c )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xe ), -A_C_00000000 ,A_C_00000000 ); - gpr_map[gpr++] =0x00000000 ; -snd_emu10k1_audigy_dsp_convert_32_to_2x16 (icode, &ptr, tmp, - bit_shifter16, -A_GPR (gpr -1 ), -A_FXBUS2 (0x1e )); -A_OP (icode, &ptr, iACC3,A_GPR (gpr -1 ),A_P16VIN (0xf ), -A_C_00000000 ,A_C_00000000 ); +/* A_P16VIN(0) is delayed by one sample, so all other A_P16VIN channels +* will need to also be delayed; we use an auxiliary register for that. */ +for (z =1 ; z <0x10 ; z++) { +snd_emu10k1_audigy_dsp_convert_32_to_2x16 ( icode, &ptr, tmp, bit_shifter16,A_GPR (gpr),A_FXBUS2 (z *2 ) ); +A_OP (icode, &ptr, iACC3,A_GPR (gpr),A_P16VIN (z),A_C_00000000 ,A_C_00000000 ); + gpr_map[gpr++] =0x00000000 ; + } }#if 0
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 5/129 quota: Properly disable quotas when add_dquot_ref() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 6a4e3363792e30177cc3965697e34ddcea8b900b ]
When add_dquot_ref() fails (usually due to IO error or ENOMEM), we want to disable quotas we are trying to enable. However dquot_disable() call was passed just the flags we are enabling so in case flags == DQUOT_USAGE_ENABLED dquot_disable() call will just fail with EINVAL instead of properly disabling quotas. Fix the problem by always passing DQUOT_LIMITS_ENABLED | DQUOT_USAGE_ENABLED to dquot_disable() in this case.
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/quota/dquot.c +2 -1
@@ -2407,7 +2407,8 @@ int dquot_load_quota_sb(struct super_block *sb, int type, int format_id, error =add_dquot_ref (sb, type);if (error) -dquot_disable (sb, type, flags); +dquot_disable (sb, type, +DQUOT_USAGE_ENABLED |DQUOT_LIMITS_ENABLED );return error; out_fmt:
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 6/129 quota: fix warning in dqgrab()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <[email protected]>
[ Upstream commit d6a95db3c7ad160bc16b89e36449705309b52bcb ]
There's issue as follows when do fault injection:
WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Above issue may happens as follows:
ProcessA ProcessB ProcessCsys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_suspend -> suspend all type quota
sys_fsconfig
vfs_fsconfig_locked
reconfigure_super
ext4_remount
dquot_resume
ret = dquot_load_quota_sb
add_dquot_ref
do_open -> open file O_RDWR
vfs_open
do_dentry_open
get_write_access
atomic_inc_unless_negative(&inode->i_writecount)
ext4_file_open
dquot_file_open
dquot_initialize
__dquot_initialize
dqget
atomic_inc(&dquot->dq_count);
__dquot_initialize
__dquot_initialize
dqget
if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
ext4_acquire_dquot
-> Return error DQ_ACTIVE_B flag isn't set
dquot_disable
invalidate_dquots
if (atomic_read(&dquot->dq_count))
dqgrab
WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
-> Trigger warningIn the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab().
To solve above issue just replace the dqgrab() use in invalidate_dquots() with atomic_inc(&dquot->dq_count).
Message-Id: <[email protected]>
--- fs/quota/dquot.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/quota/dquot.c +1 -1
@@ -540,7 +540,7 @@ static void invalidate_dquots(struct super_block *sb, int type)continue ;/* Wait for dquot users */ if (atomic_read (&dquot->dq_count)) { -dqgrab (dquot); +atomic_inc (&dquot->dq_count);spin_unlock (&dq_list_lock);/* * Once dqput() wakes us up, we know it's time to free
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 7/129 HID: add quirk for 03f0:464a HP Elite Presenter Mouse
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Morandini <[email protected]>
[ Upstream commit 0db117359e47750d8bd310d19f13e1c4ef7fc26a ]
HP Elite Presenter Mouse HID Record Descriptor shows two mouses (Repord ID 0x1 and 0x2), one keypad (Report ID 0x5), two Consumer Controls (Report IDs 0x6 and 0x3). Previous to this commit it registers one mouse, one keypad and one Consumer Control, and it was usable only as a digitl laser pointer (one of the two mouses). This patch defines the 464a USB device ID and enables the HID_QUIRK_MULTI_INPUT quirk for it, allowing to use the device both as a mouse and a digital laser pointer.
--- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+)
drivers/hid/hid-ids.h +1 -0
@@ -571,6 +571,7 @@#define USB_DEVICE_ID_UGCI_FIGHTING 0x0030#define USB_VENDOR_ID_HP 0x03f0 +#define USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A 0x464a#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A 0x0a4a#define USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A 0x0b4a#define USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE 0x134a
drivers/hid/hid-quirks.c +1 -0
@@ -98,6 +98,7 @@ static const struct hid_device_id hid_quirks[] = { { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A096), HID_QUIRK_NO_INIT_REPORTS }, { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_KEYBOARD_A293), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0A4A), HID_QUIRK_ALWAYS_POLL }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_ELITE_PRESENTER_MOUSE_464A), HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_LOGITECH_OEM_USB_OPTICAL_MOUSE_0B4A), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_HP, USB_PRODUCT_ID_HP_PIXART_OEM_USB_OPTICAL_MOUSE_094A), HID_QUIRK_ALWAYS_POLL },
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 8/129 udf: Fix uninitialized array access for some pathnames
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
[ Upstream commit 028f6055c912588e6f72722d89c30b401bbcf013 ]
For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this.
--- fs/udf/unicode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/udf/unicode.c +1 -1
@@ -247,7 +247,7 @@ static int udf_name_from_CS0(struct super_block *sb, }if (translate) { -if (str_o_len <=2 && str_o[0 ] =='.' && +if (str_o_len >0 && str_o_len <=2 && str_o[0 ] =='.' && (str_o_len ==1 || str_o[1 ] =='.' )) needsCRC =1 ;if (needsCRC) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 9/129 fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yogesh <[email protected]>
[ Upstream commit 4e302336d5ca1767a06beee7596a72d3bdc8d983 ]
Syzkaller reported the following issue:
UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 index -84 is out of range for type 's8[341]' (aka 'signed char[341]') CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 lookup_open fs/namei.c:3492 [inline] open_last_lookups fs/namei.c:3560 [inline] path_openat+0x13df/0x3170 fs/namei.c:3788 do_filp_open+0x234/0x490 fs/namei.c:3818 do_sys_openat2+0x13f/0x500 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1f4e33f7e9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK>
The bug occurs when the dbAllocDmapLev()function attempts to access dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative.
To rectify this, the patch introduces a safeguard within the dbAllocDmapLev() function. A check has been added to verify if leafidx is negative. If it is, the function immediately returns an I/O error, preventing any further execution that could potentially cause harm.
Tested via syzbot.
--- fs/jfs/jfs_dmap.c | 3 +++ 1 file changed, 3 insertions(+)
fs/jfs/jfs_dmap.c +3 -0
@@ -2040,6 +2040,9 @@ dbAllocDmapLev(struct bmap * bmp,if (dbFindLeaf ((dmtree_t *) & dp->tree, l2nb, &leafidx))return -ENOSPC ; +if (leafidx <0 ) +return -EIO ; +/* determine the block number within the file system corresponding * to the leaf at which free space was found. */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 10/129 MIPS: dec: prom: Address -Warray-bounds warning
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <[email protected]>
[ Upstream commit 7b191b9b55df2a844bd32d1d380f47a7df1c2896 ]
Zero-length arrays are deprecated, and we are replacing them with flexible array members instead. So, replace zero-length array with flexible-array member in struct memmap.
Address the following warning found after building (with GCC-13) mips64
with decstation_64_defconfig:
In function 'rex_setup_memory_region',
inlined from 'prom_meminit' at arch/mips/dec/prom/memory.c:91:3:arch/mips/dec/prom/memory.c:72:31: error: array subscript i is outside array bounds of 'unsigned char[0]' [-Werror=array-bounds=]
72 | if (bm->bitmap[i] == 0xff)
| ~~~~~~~~~~^~~
In file included from arch/mips/dec/prom/memory.c:16:./arch/mips/include/asm/dec/prom.h: In function 'prom_meminit':./arch/mips/include/asm/dec/prom.h:73:23: note: while referencing 'bitmap'
73 | unsigned char bitmap[0];
This helps with the ongoing efforts to globally enable -Warray-bounds.
This results in no differences in binary output.
--- arch/mips/include/asm/dec/prom.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/include/asm/dec/prom.h +1 -1
@@ -74,7 +74,7 @@ static inline bool prom_is_rex(u32 magic)*/ typedef struct {int pagesize; -unsigned char bitmap[0 ]; +unsigned char bitmap[]; }memmap ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 11/129 FS: JFS: Fix null-ptr-deref Read in txBegin
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Immad Mir <[email protected]>
[ Upstream commit 47cfdc338d674d38f4b2f22b7612cc6a2763ba27 ]
Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code.
--- fs/jfs/namei.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/namei.c +5 -0
@@ -811,6 +811,11 @@ static int jfs_link(struct dentry *old_dentry,if (rc) goto out; +if (isReadOnly (ip)) { +jfs_error (ip->i_sb,"read-only filesystem\n" ); +return -EROFS ; + } + tid =txBegin (ip->i_sb,0 );mutex_lock_nested (&JFS_IP (dir)->commit_mutex,COMMIT_MUTEX_PARENT );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 12/129 FS: JFS: Check for read-only mounted filesystem in txBegin
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Immad Mir <[email protected]>
[ Upstream commit 95e2b352c03b0a86c5717ba1d24ea20969abcacc ]
This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref.
--- fs/jfs/jfs_txnmgr.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/jfs/jfs_txnmgr.c +5 -0
@@ -367,6 +367,11 @@ tid_t txBegin(struct super_block *sb, int flag)jfs_info ("txBegin: flag = 0x%x" , flag); log =JFS_SBI (sb)->log; +if (!log) { +jfs_error (sb,"read-only filesystem\n" ); +return 0 ; + } +TXN_LOCK ();INCREMENT (TxStat.txBegin);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 13/129 media: v4l2-mem2mem: add lock to protect parameter num_rdy
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yunfei Dong <[email protected]>
[ Upstream commit 56b5c3e67b0f9af3f45cf393be048ee8d8a92694 ]
Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.
kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&]
kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c
--- include/media/v4l2-mem2mem.h | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-)
include/media/v4l2-mem2mem.h +16 -2
@@ -405,7 +405,14 @@ void v4l2_m2m_buf_queue(struct v4l2_m2m_ctx *m2m_ctx,static inline unsigned int v4l2_m2m_num_src_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->out_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->out_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->out_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
@@ -417,7 +424,14 @@ unsigned int v4l2_m2m_num_src_bufs_ready(struct v4l2_m2m_ctx *m2m_ctx)static inline unsigned int v4l2_m2m_num_dst_bufs_ready (struct v4l2_m2m_ctx *m2m_ctx) { -return m2m_ctx->cap_q_ctx.num_rdy; +unsigned int num_buf_rdy; +unsigned long flags; + +spin_lock_irqsave (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + num_buf_rdy = m2m_ctx->cap_q_ctx.num_rdy; +spin_unlock_irqrestore (&m2m_ctx->cap_q_ctx.rdy_spinlock, flags); + +return num_buf_rdy; }/**
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 14/129 media: platform: mediatek: vpu: fix NULL ptr dereference
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans Verkuil <[email protected]>
[ Upstream commit 3df55cd773e8603b623425cc97b05e542854ad27 ]
If pdev is NULL, then it is still dereferenced.
This fixes this smatch warning:
drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_load_firmware() warn: address of NULL pointer 'pdev'
--- drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/media/platform/mtk-vpu/mtk_vpu.c +4 -2
@@ -537,16 +537,18 @@ static int load_requested_vpu(struct mtk_vpu *vpu,int vpu_load_firmware (struct platform_device *pdev) {struct mtk_vpu *vpu; -struct device *dev = &pdev->dev; +struct device *dev;struct vpu_run *run;const struct firmware *vpu_fw =NULL ;int ret;if (!pdev) { -dev_err (dev,"VPU platform device is invalid\n" ); +pr_err ("VPU platform device is invalid\n" );return -EINVAL ; } + dev = &pdev->dev; + vpu =platform_get_drvdata (pdev); run = &vpu->run;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 15/129 gfs2: Fix possible data races in gfs2_show_options()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tuo Li <[email protected]>
[ Upstream commit 6fa0a72cbbe45db4ed967a51f9e6f4e3afe61d20 ]
Some fields such as gt_logd_secs of the struct gfs2_tune are accessed without holding the lock gt_spin in gfs2_show_options():
val = sdp->sd_tune.gt_logd_secs;
if (val != 30)
seq_printf(s, ",commit=%d", val);And thus can cause data races when gfs2_show_options() and other functions such as gfs2_reconfigure() are concurrently executed:
spin_lock(>->gt_spin); gt->gt_logd_secs = newargs->ar_commit;
To fix these possible data races, the lock sdp->sd_tune.gt_spin is acquired before accessing the fields of gfs2_tune and released after these accesses.
Further changes by Andreas:
- Don't hold the spin lock over the seq_printf operations.
--- fs/gfs2/super.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-)
fs/gfs2/super.c +15 -11
@@ -1374,7 +1374,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) {struct gfs2_sbd *sdp = root->d_sb->s_fs_info;struct gfs2_args *args = &sdp->sd_args; -int val; +unsigned int logd_secs, statfs_slow, statfs_quantum, quota_quantum; + +spin_lock (&sdp->sd_tune.gt_spin); + logd_secs = sdp->sd_tune.gt_logd_secs; + quota_quantum = sdp->sd_tune.gt_quota_quantum; + statfs_quantum = sdp->sd_tune.gt_statfs_quantum; + statfs_slow = sdp->sd_tune.gt_statfs_slow; +spin_unlock (&sdp->sd_tune.gt_spin);if (is_ancestor (root, sdp->sd_master_dir))seq_puts (s,",meta" );
@@ -1429,17 +1436,14 @@ static int gfs2_show_options(struct seq_file *s, struct dentry *root) }if (args->ar_discard)seq_puts (s,",discard" ); - val = sdp->sd_tune.gt_logd_secs; -if (val !=30 ) -seq_printf (s,",commit=%d" , val); - val = sdp->sd_tune.gt_statfs_quantum; -if (val !=30 ) -seq_printf (s,",statfs_quantum=%d" , val); -else if (sdp->sd_tune.gt_statfs_slow) +if (logd_secs !=30 ) +seq_printf (s,",commit=%d" , logd_secs); +if (statfs_quantum !=30 ) +seq_printf (s,",statfs_quantum=%d" , statfs_quantum); +else if (statfs_slow)seq_puts (s,",statfs_quantum=0" ); - val = sdp->sd_tune.gt_quota_quantum; -if (val !=60 ) -seq_printf (s,",quota_quantum=%d" , val); +if (quota_quantum !=60 ) +seq_printf (s,",quota_quantum=%d" , quota_quantum);if (args->ar_statfs_percent)seq_printf (s,",statfs_percent=%d" , args->ar_statfs_percent);if (args->ar_errors !=GFS2_ERRORS_DEFAULT ) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 16/129 pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit c85fd9422fe0f5d667305efb27f56d09eab120b0 ]
When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket_data too, causing a memory leak observable with kmemleak:
unreferenced object 0xc28d1000 (size 64):
comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................
00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0
[<7e51f0c8>] kmalloc_trace+0x31/0xa4
[<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc]
[<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core]
[<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket]
[<c48fac39>] pci_device_probe+0x99/0x194
[<84b7c690>] really_probe+0x181/0x45c
[<8060fe6e>] __driver_probe_device+0x75/0x1f4
[<b9b76f43>] driver_probe_device+0x28/0xac
[<648b766f>] __driver_attach+0xeb/0x1e4
[<6e9659eb>] bus_for_each_dev+0x61/0xb4
[<25a669f3>] driver_attach+0x1e/0x28
[<d8671d6b>] bus_add_driver+0x102/0x20c
[<df0d323c>] driver_register+0x5b/0x120
[<942cd8a4>] __pci_register_driver+0x44/0x4c
[<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support]Fix this by freeing socket_data too.
Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding the yenta_cardbus driver (yenta_socket).
Message-ID: <[email protected]>
--- drivers/pcmcia/rsrc_nonstatic.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/pcmcia/rsrc_nonstatic.c +2 -0
@@ -1056,6 +1056,8 @@ static void nonstatic_release_resource_db(struct pcmcia_socket *s) q = p->next;kfree (p); } + +kfree (data); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 17/129 Bluetooth: L2CAP: Fix use-after-free
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengping Jiang <[email protected]>
[ Upstream commit f752a0b334bb95fe9b42ecb511e0864e2768046f ]
Fix potential use-after-free in l2cap_le_command_rej.
--- net/bluetooth/l2cap_core.c | 5 +++++ 1 file changed, 5 insertions(+)
net/bluetooth/l2cap_core.c +5 -0
@@ -5705,9 +5705,14 @@ static inline int l2cap_le_command_rej(struct l2cap_conn *conn,if (!chan) goto done; + chan =l2cap_chan_hold_unless_zero (chan); +if (!chan) + goto done; +l2cap_chan_lock (chan);l2cap_chan_del (chan,ECONNREFUSED );l2cap_chan_unlock (chan); +l2cap_chan_put (chan); done:mutex_unlock (&conn->chan_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 18/129 drm/amdgpu: Fix potential fence use-after-free v2
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: shanzhulig <[email protected]>
[ Upstream commit 2e54154b9f27262efd0cb4f903cc7d5ad1fe9628 ]
fence Decrements the reference count before exiting. Avoid Race Vulnerabilities for fence use-after-free.
v2 (chk): actually fix the use after free and not just move it.
--- drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +3 -3
@@ -1502,15 +1502,15 @@ static int amdgpu_cs_wait_all_fences(struct amdgpu_device *adev,continue ; r =dma_fence_wait_timeout (fence, true, timeout); +if (r >0 && fence->error) + r = fence->error; +dma_fence_put (fence);if (r <0 )return r;if (r ==0 )break ; - -if (fence->error) -return fence->error; }memset (wait,0 ,sizeof (*wait));
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 19/129 IMA: allow/fix UML builds
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <[email protected]>
[ Upstream commit 644f17412f5acf01a19af9d04a921937a2bc86c6 ]
UML supports HAS_IOMEM since 0bbadafdc49d (um: allow disabling NO_IOMEM).
Current IMA build on UML fails on allmodconfig (with TCG_TPM=m):
ld: security/integrity/ima/ima_queue.o: in function `ima_add_template_entry':
ima_queue.c:(.text+0x2d9): undefined reference to `tpm_pcr_extend'
ld: security/integrity/ima/ima_init.o: in function `ima_init':
ima_init.c:(.init.text+0x43f): undefined reference to `tpm_default_chip'
ld: security/integrity/ima/ima_crypto.o: in function `ima_calc_boot_aggregate_tfm':
ima_crypto.c:(.text+0x1044): undefined reference to `tpm_pcr_read'
ld: ima_crypto.c:(.text+0x10d8): undefined reference to `tpm_pcr_read'
Modify the IMA Kconfig entry so that it selects TCG_TPM if HAS_IOMEM is set, regardless of the UML Kconfig setting.
This updates TCG_TPM from =m to =y and fixes the linker errors.
--- security/integrity/ima/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/integrity/ima/Kconfig +1 -1
@@ -7,7 +7,7 @@ config IMA select CRYPTO_HMAC select CRYPTO_SHA1 select CRYPTO_HASH_INFO - select TCG_TPM if HAS_IOMEM && !UML + select TCG_TPM if HAS_IOMEM select TCG_TIS if TCG_TPM && X86 select TCG_CRB if TCG_TPM && ACPI select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 20/129 iio: add addac subdirectory
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cosmin Tanislav <[email protected]>
[ Upstream commit b62e2e1763cda3a6c494ed754317f19be1249297 ]
For IIO devices that expose both ADC and DAC functionality.
Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital")
--- drivers/iio/Kconfig | 1 + drivers/iio/Makefile | 1 + drivers/iio/addac/Kconfig | 8 ++++++++ drivers/iio/addac/Makefile | 6 ++++++ 4 files changed, 16 insertions(+) create mode 100644 drivers/iio/addac/Kconfig create mode 100644 drivers/iio/addac/Makefile
drivers/iio/Kconfig +1 -0
@@ -70,6 +70,7 @@ config IIO_TRIGGERED_EVENT source "drivers/iio/accel/Kconfig" source "drivers/iio/adc/Kconfig" +source "drivers/iio/addac/Kconfig" source "drivers/iio/afe/Kconfig" source "drivers/iio/amplifiers/Kconfig" source "drivers/iio/chemical/Kconfig"
drivers/iio/Makefile +1 -0
@@ -15,6 +15,7 @@ obj-$(CONFIG_IIO_TRIGGERED_EVENT) += industrialio-triggered-event.o obj-y += accel/ obj-y += adc/ +obj-y += addac/ obj-y += afe/ obj-y += amplifiers/ obj-y += buffer/
drivers/iio/addac/Kconfig new file +8 -0
@@ -0,0 +1,8 @@ +# +# ADC DAC drivers +# +# When adding new entries keep the list in alphabetical order + +menu "Analog to digital and digital to analog converters" + +endmenu
drivers/iio/addac/Makefile new file +6 -0
@@ -0,0 +1,6 @@ +# SPDX-License-Identifier: GPL-2.0 +# +# Makefile for industrial I/O ADDAC drivers +# + +# When adding new entries keep the list in alphabetical order
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 21/129 iio: adc: stx104: Utilize iomap interface
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
[ Upstream commit 73b8390cc27e096ab157be261ccc4eaaa6db87af ]
This driver doesn't need to access I/O ports directly via inb()/outb() and friends. This patch abstracts such access by calling ioport_map() to enable the use of more typical ioread8()/iowrite8() I/O memory accessor calls.
Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital")
--- drivers/iio/adc/stx104.c | 56 +++++++++++++++++++++------------------- 1 file changed, 29 insertions(+), 27 deletions(-)
drivers/iio/adc/stx104.c +29 -27
@@ -59,7 +59,7 @@ MODULE_PARM_DESC(base, "Apex Embedded Systems STX104 base addresses");*/ struct stx104_iio {unsigned int chan_out_states[STX104_NUM_OUT_CHAN ]; -unsigned int base; +void __iomem *base; };/**
@@ -72,7 +72,7 @@ struct stx104_iio {struct stx104_gpio {struct gpio_chip chip;spinlock_t lock; -unsigned int base; +void __iomem *base;unsigned int out_state; };
@@ -87,7 +87,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev,switch (mask) {case IIO_CHAN_INFO_HARDWAREGAIN :/* get gain configuration */ - adc_config =inb (priv->base +11 ); + adc_config =ioread8 (priv->base +11 ); gain = adc_config &0x3 ; *val =1 << gain;
@@ -99,24 +99,24 @@ static int stx104_read_raw(struct iio_dev *indio_dev, }/* select ADC channel */ -outb (chan->channel | (chan->channel <<4 ), priv->base +2 ); +iowrite8 (chan->channel | (chan->channel <<4 ), priv->base +2 );/* trigger ADC sample capture and wait for completion */ -outb (0 , priv->base); -while (inb (priv->base +8 ) &BIT (7 )); +iowrite8 (0 , priv->base); +while (ioread8 (priv->base +8 ) &BIT (7 )); - *val =inw (priv->base); + *val =ioread16 (priv->base);return IIO_VAL_INT ;case IIO_CHAN_INFO_OFFSET :/* get ADC bipolar/unipolar configuration */ - adc_config =inb (priv->base +11 ); + adc_config =ioread8 (priv->base +11 ); adbu = !(adc_config &BIT (2 )); *val =-32768 * adbu;return IIO_VAL_INT ;case IIO_CHAN_INFO_SCALE :/* get ADC bipolar/unipolar and gain configuration */ - adc_config =inb (priv->base +11 ); + adc_config =ioread8 (priv->base +11 ); adbu = !(adc_config &BIT (2 )); gain = adc_config &0x3 ;
@@ -138,16 +138,16 @@ static int stx104_write_raw(struct iio_dev *indio_dev,/* Only four gain states (x1, x2, x4, x8) */ switch (val) {case 1 : -outb (0 , priv->base +11 ); +iowrite8 (0 , priv->base +11 );break ;case 2 : -outb (1 , priv->base +11 ); +iowrite8 (1 , priv->base +11 );break ;case 4 : -outb (2 , priv->base +11 ); +iowrite8 (2 , priv->base +11 );break ;case 8 : -outb (3 , priv->base +11 ); +iowrite8 (3 , priv->base +11 );break ;default :return -EINVAL ;
@@ -161,7 +161,7 @@ static int stx104_write_raw(struct iio_dev *indio_dev,return -EINVAL ; priv->chan_out_states[chan->channel] = val; -outw (val, priv->base +4 +2 * chan->channel); +iowrite16 (val, priv->base +4 +2 * chan->channel);return 0 ; }
@@ -230,7 +230,7 @@ static int stx104_gpio_get(struct gpio_chip *chip, unsigned int offset)if (offset >=4 )return -EINVAL ; -return !!(inb (stx104gpio->base) &BIT (offset)); +return !!(ioread8 (stx104gpio->base) &BIT (offset)); } static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask,
@@ -238,7 +238,7 @@ static int stx104_gpio_get_multiple(struct gpio_chip *chip, unsigned long *mask, {struct stx104_gpio *const stx104gpio =gpiochip_get_data (chip); - *bits =inb (stx104gpio->base); + *bits =ioread8 (stx104gpio->base);return 0 ; }
@@ -260,7 +260,7 @@ static void stx104_gpio_set(struct gpio_chip *chip, unsigned int offset,else stx104gpio->out_state &= ~mask; -outb (stx104gpio->out_state, stx104gpio->base); +iowrite8 (stx104gpio->out_state, stx104gpio->base);spin_unlock_irqrestore (&stx104gpio->lock, flags); }
@@ -287,7 +287,7 @@ static void stx104_gpio_set_multiple(struct gpio_chip *chip, stx104gpio->out_state &= ~*mask; stx104gpio->out_state |= *mask & *bits; -outb (stx104gpio->out_state, stx104gpio->base); +iowrite8 (stx104gpio->out_state, stx104gpio->base);spin_unlock_irqrestore (&stx104gpio->lock, flags); }
@@ -314,11 +314,16 @@ static int stx104_probe(struct device *dev, unsigned int id)return -EBUSY ; } + priv =iio_priv (indio_dev); + priv->base =devm_ioport_map (dev, base[id],STX104_EXTENT ); +if (!priv->base) +return -ENOMEM ; + indio_dev->info = &stx104_info; indio_dev->modes =INDIO_DIRECT_MODE ;/* determine if differential inputs */ -if (inb (base[id] +8 ) &BIT (5 )) { +if (ioread8 (priv->base +8 ) &BIT (5 )) { indio_dev->num_channels =ARRAY_SIZE (stx104_channels_diff); indio_dev->channels = stx104_channels_diff; }else {
@@ -329,18 +334,15 @@ static int stx104_probe(struct device *dev, unsigned int id) indio_dev->name =dev_name (dev); indio_dev->dev.parent = dev; - priv =iio_priv (indio_dev); - priv->base = base[id]; -/* configure device for software trigger operation */ -outb (0 , base[id] +9 ); +iowrite8 (0 , priv->base +9 );/* initialize gain setting to x1 */ -outb (0 , base[id] +11 ); +iowrite8 (0 , priv->base +11 );/* initialize DAC output to 0V */ -outw (0 , base[id] +4 ); -outw (0 , base[id] +6 ); +iowrite16 (0 , priv->base +4 ); +iowrite16 (0 , priv->base +6 ); stx104gpio->chip.label =dev_name (dev); stx104gpio->chip.parent = dev;
@@ -355,7 +357,7 @@ static int stx104_probe(struct device *dev, unsigned int id) stx104gpio->chip.get_multiple = stx104_gpio_get_multiple; stx104gpio->chip.set = stx104_gpio_set; stx104gpio->chip.set_multiple = stx104_gpio_set_multiple; - stx104gpio->base = base[id] +3 ; + stx104gpio->base = priv->base +3 ; stx104gpio->out_state =0x0 ;spin_lock_init (&stx104gpio->lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 22/129 iio: adc: stx104: Implement and utilize register structures
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
[ Upstream commit 6cfd14c54b1f42f29097244c1b6208f8268d7d5b ]
Reduce magic numbers and improve code readability by implementing and utilizing named register data structures.
Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital")
--- drivers/iio/adc/stx104.c | 74 +++++++++++++++++++++++++++------------- 1 file changed, 50 insertions(+), 24 deletions(-)
drivers/iio/adc/stx104.c +50 -24
@@ -24,6 +24,7 @@#include <linux/module.h> #include <linux/moduleparam.h> #include <linux/spinlock.h> +#include <linux/types.h> #define STX104_OUT_CHAN (chan) { \ .type = IIO_VOLTAGE, \
@@ -52,14 +53,36 @@ static unsigned int num_stx104;module_param_hw_array (base, uint, ioport, &num_stx104,0 );MODULE_PARM_DESC (base,"Apex Embedded Systems STX104 base addresses" ); +/** +* struct stx104_reg - device register structure +* @ssr_ad: Software Strobe Register and ADC Data +* @achan: ADC Channel +* @dio: Digital I/O +* @dac: DAC Channels +* @cir_asr: Clear Interrupts and ADC Status +* @acr: ADC Control +* @pccr_fsh: Pacer Clock Control and FIFO Status MSB +* @acfg: ADC Configuration +*/ +struct stx104_reg { +u16 ssr_ad; +u8 achan; +u8 dio; +u16 dac[2 ]; +u8 cir_asr; +u8 acr; +u8 pccr_fsh; +u8 acfg; +}; +/** * struct stx104_iio - IIO device private data structure * @chan_out_states: channels' output states -* @base: base port address of the IIO device +* @reg: I/O address offset for the device registers */ struct stx104_iio {unsigned int chan_out_states[STX104_NUM_OUT_CHAN ]; -void __iomem *base; +struct stx104_reg __iomem *reg; };/**
@@ -72,7 +95,7 @@ struct stx104_iio {struct stx104_gpio {struct gpio_chip chip;spinlock_t lock; -void __iomem *base; +u8 __iomem *base;unsigned int out_state; };
@@ -80,6 +103,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev, struct iio_chan_spec const *chan, int *val, int *val2, long mask) { struct stx104_iio *const priv = iio_priv(indio_dev); +struct stx104_reg __iomem *const reg = priv->reg;unsigned int adc_config;int adbu;int gain;
@@ -87,7 +111,7 @@ static int stx104_read_raw(struct iio_dev *indio_dev,switch (mask) {case IIO_CHAN_INFO_HARDWAREGAIN :/* get gain configuration */ - adc_config =ioread8 (priv->base +11 ); + adc_config =ioread8 (®->acfg); gain = adc_config &0x3 ; *val =1 << gain;
@@ -99,24 +123,26 @@ static int stx104_read_raw(struct iio_dev *indio_dev, }/* select ADC channel */ -iowrite8 (chan->channel | (chan->channel <<4 ), priv->base +2 ); +iowrite8 (chan->channel | (chan->channel <<4 ), ®->achan); -/* trigger ADC sample capture and wait for completion */ -iowrite8 (0 , priv->base); -while (ioread8 (priv->base +8 ) &BIT (7 )); +/* trigger ADC sample capture by writing to the 8-bit +* Software Strobe Register and wait for completion +*/ +iowrite8 (0 , ®->ssr_ad); +while (ioread8 (®->cir_asr) &BIT (7 )); - *val =ioread16 (priv->base); + *val =ioread16 (®->ssr_ad);return IIO_VAL_INT ;case IIO_CHAN_INFO_OFFSET :/* get ADC bipolar/unipolar configuration */ - adc_config =ioread8 (priv->base +11 ); + adc_config =ioread8 (®->acfg); adbu = !(adc_config &BIT (2 )); *val =-32768 * adbu;return IIO_VAL_INT ;case IIO_CHAN_INFO_SCALE :/* get ADC bipolar/unipolar and gain configuration */ - adc_config =ioread8 (priv->base +11 ); + adc_config =ioread8 (®->acfg); adbu = !(adc_config &BIT (2 )); gain = adc_config &0x3 ;
@@ -138,16 +164,16 @@ static int stx104_write_raw(struct iio_dev *indio_dev,/* Only four gain states (x1, x2, x4, x8) */ switch (val) {case 1 : -iowrite8 (0 , priv->base +11 ); +iowrite8 (0 , &priv->reg->acfg);break ;case 2 : -iowrite8 (1 , priv->base +11 ); +iowrite8 (1 , &priv->reg->acfg);break ;case 4 : -iowrite8 (2 , priv->base +11 ); +iowrite8 (2 , &priv->reg->acfg);break ;case 8 : -iowrite8 (3 , priv->base +11 ); +iowrite8 (3 , &priv->reg->acfg);break ;default :return -EINVAL ;
@@ -161,7 +187,7 @@ static int stx104_write_raw(struct iio_dev *indio_dev,return -EINVAL ; priv->chan_out_states[chan->channel] = val; -iowrite16 (val, priv->base +4 +2 * chan->channel); +iowrite16 (val, &priv->reg->dac[chan->channel]);return 0 ; }
@@ -315,15 +341,15 @@ static int stx104_probe(struct device *dev, unsigned int id) } priv =iio_priv (indio_dev); - priv->base =devm_ioport_map (dev, base[id],STX104_EXTENT ); -if (!priv->base) + priv->reg =devm_ioport_map (dev, base[id],STX104_EXTENT ); +if (!priv->reg)return -ENOMEM ; indio_dev->info = &stx104_info; indio_dev->modes =INDIO_DIRECT_MODE ;/* determine if differential inputs */ -if (ioread8 (priv->base +8 ) &BIT (5 )) { +if (ioread8 (&priv->reg->cir_asr) &BIT (5 )) { indio_dev->num_channels =ARRAY_SIZE (stx104_channels_diff); indio_dev->channels = stx104_channels_diff; }else {
@@ -335,14 +361,14 @@ static int stx104_probe(struct device *dev, unsigned int id) indio_dev->dev.parent = dev;/* configure device for software trigger operation */ -iowrite8 (0 , priv->base +9 ); +iowrite8 (0 , &priv->reg->acr);/* initialize gain setting to x1 */ -iowrite8 (0 , priv->base +11 ); +iowrite8 (0 , &priv->reg->acfg);/* initialize DAC output to 0V */ -iowrite16 (0 , priv->base +4 ); -iowrite16 (0 , priv->base +6 ); +iowrite16 (0 , &priv->reg->dac[0 ]); +iowrite16 (0 , &priv->reg->dac[1 ]); stx104gpio->chip.label =dev_name (dev); stx104gpio->chip.parent = dev;
@@ -357,7 +383,7 @@ static int stx104_probe(struct device *dev, unsigned int id) stx104gpio->chip.get_multiple = stx104_gpio_get_multiple; stx104gpio->chip.set = stx104_gpio_set; stx104gpio->chip.set_multiple = stx104_gpio_set_multiple; - stx104gpio->base = priv->base +3 ; + stx104gpio->base = &priv->reg->dio; stx104gpio->out_state =0x0 ;spin_lock_init (&stx104gpio->lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 23/129 iio: addac: stx104: Fix race condition for stx104_write_raw()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
[ Upstream commit 9740827468cea80c42db29e7171a50e99acf7328 ]
The priv->chan_out_states array and actual DAC value can become mismatched if stx104_write_raw() is called concurrently. Prevent such a race condition by utilizing a mutex.
Stable-dep-of: 4f9b80aefb9e ("iio: addac: stx104: Fix race condition when converting analog-to-digital")
--- drivers/iio/adc/stx104.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/iio/adc/stx104.c +8 -0
@@ -23,6 +23,7 @@#include <linux/kernel.h> #include <linux/module.h> #include <linux/moduleparam.h> +#include <linux/mutex.h> #include <linux/spinlock.h> #include <linux/types.h>
@@ -77,10 +78,12 @@ struct stx104_reg {/** * struct stx104_iio - IIO device private data structure +* @lock: synchronization lock to prevent I/O race conditions * @chan_out_states: channels' output states * @reg: I/O address offset for the device registers */ struct stx104_iio { +struct mutex lock;unsigned int chan_out_states[STX104_NUM_OUT_CHAN ];struct stx104_reg __iomem *reg; };
@@ -186,9 +189,12 @@ static int stx104_write_raw(struct iio_dev *indio_dev,if ((unsigned int )val >65535 )return -EINVAL ; +mutex_lock (&priv->lock); + priv->chan_out_states[chan->channel] = val;iowrite16 (val, &priv->reg->dac[chan->channel]); +mutex_unlock (&priv->lock);return 0 ; }return -EINVAL ;
@@ -360,6 +366,8 @@ static int stx104_probe(struct device *dev, unsigned int id) indio_dev->name =dev_name (dev); indio_dev->dev.parent = dev; +mutex_init (&priv->lock); +/* configure device for software trigger operation */ iowrite8 (0 , &priv->reg->acr);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 24/129 iio: addac: stx104: Fix race condition when converting analog-to-digital
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <[email protected]>
[ Upstream commit 4f9b80aefb9e2f542a49d9ec087cf5919730e1dd ]
The ADC conversion procedure requires several device I/O operations performed in a particular sequence. If stx104_read_raw() is called concurrently, the ADC conversion procedure could be clobbered. Prevent such a race condition by utilizing a mutex.
--- drivers/iio/adc/stx104.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/iio/adc/stx104.c +4 -0
@@ -125,6 +125,8 @@ static int stx104_read_raw(struct iio_dev *indio_dev,return IIO_VAL_INT ; } +mutex_lock (&priv->lock); +/* select ADC channel */ iowrite8 (chan->channel | (chan->channel <<4 ), ®->achan);
@@ -135,6 +137,8 @@ static int stx104_read_raw(struct iio_dev *indio_dev,while (ioread8 (®->cir_asr) &BIT (7 )); *val =ioread16 (®->ssr_ad); + +mutex_unlock (&priv->lock);return IIO_VAL_INT ;case IIO_CHAN_INFO_OFFSET :/* get ADC bipolar/unipolar configuration */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 25/129 powerpc/mm: move platform specific mmu-xxx.h in platform directories
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 994da93d196866f914c9d64aafb86e95e3decbb2 ]
The purpose of this patch is to move platform specific mmu-xxx.h files in platform directories like pte-xxx.h files.
In the meantime this patch creates common nohash and nohash/32 + nohash/64 mmu.h files for future common parts.
Stable-dep-of: 66b2ca086210 ("powerpc/64s/radix: Fix soft dirty tracking")
---
arch/powerpc/include/asm/mmu.h | 14 ++------------
.../include/asm/{ => nohash/32}/mmu-40x.h | 0
.../include/asm/{ => nohash/32}/mmu-44x.h | 0
.../include/asm/{ => nohash/32}/mmu-8xx.h | 0
arch/powerpc/include/asm/nohash/32/mmu.h | 19 +++++++++++++++++++
arch/powerpc/include/asm/nohash/64/mmu.h | 8 ++++++++
.../include/asm/{ => nohash}/mmu-book3e.h | 0
arch/powerpc/include/asm/nohash/mmu.h | 11 +++++++++++
arch/powerpc/kernel/cpu_setup_fsl_booke.S | 2 +-
arch/powerpc/kvm/e500.h | 2 +-
10 files changed, 42 insertions(+), 14 deletions(-)
rename arch/powerpc/include/asm/{ => nohash/32}/mmu-40x.h (100%)
rename arch/powerpc/include/asm/{ => nohash/32}/mmu-44x.h (100%)
rename arch/powerpc/include/asm/{ => nohash/32}/mmu-8xx.h (100%)
create mode 100644 arch/powerpc/include/asm/nohash/32/mmu.h
create mode 100644 arch/powerpc/include/asm/nohash/64/mmu.h
rename arch/powerpc/include/asm/{ => nohash}/mmu-book3e.h (100%)
create mode 100644 arch/powerpc/include/asm/nohash/mmu.harch/powerpc/include/asm/mmu.h +2 -12
@@ -326,18 +326,8 @@ static inline void mmu_early_init_devtree(void) { }#if defined(CONFIG_PPC_STD_MMU_32 )/* 32-bit classic hash table MMU */ #include <asm/book3s/32/mmu-hash.h> -#elif defined(CONFIG_40x) -/* 40x-style software loaded TLB */ -# include <asm/mmu-40x.h> -#elif defined(CONFIG_44x) -/* 44x-style software loaded TLB */ -# include <asm/mmu-44x.h> -#elif defined(CONFIG_PPC_BOOK3E_MMU ) -/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */ -# include <asm/mmu-book3e.h> -#elif defined (CONFIG_PPC_8xx) -/* Motorola/Freescale 8xx software loaded TLB */ -# include <asm/mmu-8xx.h> +#elif defined(CONFIG_PPC_MMU_NOHASH ) +#include <asm/nohash/mmu.h> #endif #endif /* __KERNEL__ */
arch/powerpc/include/asm/nohash/32/mmu-40x.h renamed from arch/powerpc/include/asm/mmu-40x.h +0 -0
arch/powerpc/include/asm/nohash/32/mmu-44x.h renamed from arch/powerpc/include/asm/mmu-44x.h +0 -0
arch/powerpc/include/asm/nohash/32/mmu-8xx.h renamed from arch/powerpc/include/asm/mmu-8xx.h +0 -0
arch/powerpc/include/asm/nohash/32/mmu.h new file +19 -0
@@ -0,0 +1,19 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_POWERPC_NOHASH_32_MMU_H_ +#define _ASM_POWERPC_NOHASH_32_MMU_H_ + +#if defined(CONFIG_40x) +/* 40x-style software loaded TLB */ +#include <asm/nohash/32/mmu-40x.h> +#elif defined(CONFIG_44x) +/* 44x-style software loaded TLB */ +#include <asm/nohash/32/mmu-44x.h> +#elif defined(CONFIG_PPC_BOOK3E_MMU ) +/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */ +#include <asm/nohash/mmu-book3e.h> +#elif defined (CONFIG_PPC_8xx) +/* Motorola/Freescale 8xx software loaded TLB */ +#include <asm/nohash/32/mmu-8xx.h> +#endif + +#endif /* _ASM_POWERPC_NOHASH_32_MMU_H_ */
arch/powerpc/include/asm/nohash/64/mmu.h new file +8 -0
@@ -0,0 +1,8 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_POWERPC_NOHASH_64_MMU_H_ +#define _ASM_POWERPC_NOHASH_64_MMU_H_ + +/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */ +#include <asm/nohash/mmu-book3e.h> + +#endif /* _ASM_POWERPC_NOHASH_64_MMU_H_ */
arch/powerpc/include/asm/nohash/mmu-book3e.h renamed from arch/powerpc/include/asm/mmu-book3e.h +0 -0
arch/powerpc/include/asm/nohash/mmu.h new file +11 -0
@@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef _ASM_POWERPC_NOHASH_MMU_H_ +#define _ASM_POWERPC_NOHASH_MMU_H_ + +#ifdef CONFIG_PPC64 +#include <asm/nohash/64/mmu.h> +#else +#include <asm/nohash/32/mmu.h> +#endif + +#endif /* _ASM_POWERPC_NOHASH_MMU_H_ */
arch/powerpc/kernel/cpu_setup_fsl_booke.S +1 -1
@@ -17,7 +17,7 @@ #include <asm/processor.h> #include <asm/cputable.h> #include <asm/ppc_asm.h> -#include <asm/mmu-book3e.h> +#include <asm/nohash/mmu-book3e.h> #include <asm/asm-offsets.h> #include <asm/mpc85xx.h>
arch/powerpc/kvm/e500.h +1 -1
@@ -20,7 +20,7 @@#define KVM_E500_H #include <linux/kvm_host.h> -#include <asm/mmu-book3e.h> +#include <asm/nohash/mmu-book3e.h> #include <asm/tlb.h> #include <asm/cputhreads.h>
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 26/129 powerpc/mm: Move pgtable_t into platform headers
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit d09780f3a8d48fd49136d7bae8f0ae30de7f261a ]
This patch move pgtable_t into platform headers.
It gets rid of the CONFIG_PPC_64K_PAGES case for PPC64 as nohash/64 doesn't support CONFIG_PPC_64K_PAGES.
Stable-dep-of: 66b2ca086210 ("powerpc/64s/radix: Fix soft dirty tracking")
--- arch/powerpc/include/asm/book3s/32/mmu-hash.h | 2 ++ arch/powerpc/include/asm/book3s/64/mmu.h | 9 +++++++++ arch/powerpc/include/asm/nohash/32/mmu.h | 4 ++++ arch/powerpc/include/asm/nohash/64/mmu.h | 4 ++++ arch/powerpc/include/asm/page.h | 14 -------------- 5 files changed, 19 insertions(+), 14 deletions(-)
arch/powerpc/include/asm/book3s/32/mmu-hash.h +2 -0
@@ -42,6 +42,8 @@ struct ppc_bat {u32 batu; u32 batl; }; + +typedef struct page *pgtable_t ;#endif /* !__ASSEMBLY__ */ /*
arch/powerpc/include/asm/book3s/64/mmu.h +9 -0
@@ -2,6 +2,8 @@#ifndef _ASM_POWERPC_BOOK3S_64_MMU_H_#define _ASM_POWERPC_BOOK3S_64_MMU_H_ +#include <asm/page.h> +#ifndef __ASSEMBLY__/* * Page size definition
@@ -24,6 +26,13 @@ struct mmu_psize_def { };extern struct mmu_psize_def mmu_psize_defs[MMU_PAGE_COUNT ]; +/* +* For BOOK3s 64 with 4k and 64K linux page size +* we want to use pointers, because the page table +* actually store pfn +*/ +typedef pte_t *pgtable_t ; +#endif /* __ASSEMBLY__ */ /* 64-bit classic hash table MMU */
arch/powerpc/include/asm/nohash/32/mmu.h +4 -0
@@ -16,4 +16,8 @@#include <asm/nohash/32/mmu-8xx.h> #endif +#ifndef __ASSEMBLY__ +typedef struct page *pgtable_t ; +#endif +#endif /* _ASM_POWERPC_NOHASH_32_MMU_H_ */
arch/powerpc/include/asm/nohash/64/mmu.h +4 -0
@@ -5,4 +5,8 @@/* Freescale Book-E software loaded TLB or Book-3e (ISA 2.06+) MMU */ #include <asm/nohash/mmu-book3e.h> +#ifndef __ASSEMBLY__ +typedef struct page *pgtable_t ; +#endif +#endif /* _ASM_POWERPC_NOHASH_64_MMU_H_ */
arch/powerpc/include/asm/page.h +0 -14
@@ -335,20 +335,6 @@ void arch_free_page(struct page *page, int order);#endif struct vm_area_struct ; -#ifdef CONFIG_PPC_BOOK3S_64 -/* -* For BOOK3s 64 with 4k and 64K linux page size -* we want to use pointers, because the page table -* actually store pfn -*/ -typedef pte_t *pgtable_t ; -#else -#if defined(CONFIG_PPC_64K_PAGES ) && defined(CONFIG_PPC64 ) -typedef pte_t *pgtable_t ; -#else -typedef struct page *pgtable_t ; -#endif -#endif #include <asm-generic/memory_model.h> #endif /* __ASSEMBLY__ */
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 27/129 powerpc/mm: dump segment registers on book3s/32
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 0261a508c9fcb33e60f09cac42032f85c31e2039 ]
This patch creates a debugfs file to see content of segment registers
# cat /sys/kernel/debug/segment_registers ---[ User Segments ]--- 0x00000000-0x0fffffff Kern key 1 User key 1 VSID 0xade2b0 0x10000000-0x1fffffff Kern key 1 User key 1 VSID 0xade3c1 0x20000000-0x2fffffff Kern key 1 User key 1 VSID 0xade4d2 0x30000000-0x3fffffff Kern key 1 User key 1 VSID 0xade5e3 0x40000000-0x4fffffff Kern key 1 User key 1 VSID 0xade6f4 0x50000000-0x5fffffff Kern key 1 User key 1 VSID 0xade805 0x60000000-0x6fffffff Kern key 1 User key 1 VSID 0xade916 0x70000000-0x7fffffff Kern key 1 User key 1 VSID 0xadea27 0x80000000-0x8fffffff Kern key 1 User key 1 VSID 0xadeb38 0x90000000-0x9fffffff Kern key 1 User key 1 VSID 0xadec49 0xa0000000-0xafffffff Kern key 1 User key 1 VSID 0xaded5a 0xb0000000-0xbfffffff Kern key 1 User key 1 VSID 0xadee6b
---[ Kernel Segments ]---
0xc0000000-0xcfffffff Kern key 0 User key 1 VSID 0x000ccc 0xd0000000-0xdfffffff Kern key 0 User key 1 VSID 0x000ddd 0xe0000000-0xefffffff Kern key 0 User key 1 VSID 0x000eee 0xf0000000-0xffffffff Kern key 0 User key 1 VSID 0x000fff
Stable-dep-of: 66b2ca086210 ("powerpc/64s/radix: Fix soft dirty tracking")
--- arch/powerpc/mm/Makefile | 2 +- arch/powerpc/mm/dump_sr.c | 64 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 arch/powerpc/mm/dump_sr.c
arch/powerpc/mm/Makefile +1 -1
@@ -47,7 +47,7 @@ ifdef CONFIG_PPC_PTDUMP obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o -obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o +obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o dump_sr.o obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o endif obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o
arch/powerpc/mm/dump_sr.c new file +64 -0
64 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 28/129 powerpc/mm: dump block address translation on book3s/32
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit 7c91efce1608325634494b25ff6491320208e457 ]
This patch adds a debugfs file to dump block address translation:
~# cat /sys/kernel/debug/powerpc/block_address_translation ---[ Instruction Block Address Translations ]---
0: -
1: -
2: 0xc0000000-0xcfffffff 0x00000000 Kernel EXEC coherent 3: 0xd0000000-0xdfffffff 0x10000000 Kernel EXEC coherent
4: - 5: - 6: - 7: -
---[ Data Block Address Translations ]---
0: -
1: -
2: 0xc0000000-0xcfffffff 0x00000000 Kernel RW coherent 3: 0xd0000000-0xdfffffff 0x10000000 Kernel RW coherent
4: - 5: - 6: - 7: -
Stable-dep-of: 66b2ca086210 ("powerpc/64s/radix: Fix soft dirty tracking")
--- arch/powerpc/include/asm/book3s/32/mmu-hash.h | 4 + arch/powerpc/mm/Makefile | 2 +- arch/powerpc/mm/dump_bats.c | 173 ++++++++++++++++++ 3 files changed, 178 insertions(+), 1 deletion(-) create mode 100644 arch/powerpc/mm/dump_bats.c
arch/powerpc/include/asm/book3s/32/mmu-hash.h +4 -0
@@ -34,8 +34,12 @@#define BAT_PHYS_ADDR (x) ((u32)((x & 0x00000000fffe0000ULL) | \ ((x & 0x0000000e00000000ULL) >> 24) | \ ((x & 0x0000000100000000ULL) >> 30))) +#define PHYS_BAT_ADDR (x) (((u64)(x) & 0x00000000fffe0000ULL) | \ + (((u64)(x) << 24) & 0x0000000e00000000ULL) | \ + (((u64)(x) << 30) & 0x0000000100000000ULL))#else #define BAT_PHYS_ADDR (x) (x) +#define PHYS_BAT_ADDR (x) ((x) & 0xfffe0000)#endif struct ppc_bat {
arch/powerpc/mm/Makefile +1 -1
@@ -47,7 +47,7 @@ ifdef CONFIG_PPC_PTDUMP obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o -obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o dump_sr.o +obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o dump_bats.o dump_sr.o obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o endif obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o
arch/powerpc/mm/dump_bats.c new file +173 -0
173 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 29/129 powerpc: Move page table dump files in a dedicated subdirectory
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit e66c3209c7fd17209ccc4cbbee8b1b1bd5c438dd ]
This patch moves the files related to page table dump in a dedicated subdirectory.
The purpose is to clean a bit arch/powerpc/mm by regrouping multiple files handling a dedicated function.
Stable-dep-of: 66b2ca086210 ("powerpc/64s/radix: Fix soft dirty tracking")
---
arch/powerpc/Kconfig.debug | 4 ----
arch/powerpc/mm/Makefile | 10 +---------
.../mm/{dump_linuxpagetables-8xx.c => ptdump/8xx.c} | 2 +-
arch/powerpc/mm/ptdump/Makefile | 9 +++++++++
arch/powerpc/mm/{dump_bats.c => ptdump/bats.c} | 0
.../book3s64.c} | 2 +-
.../{dump_hashpagetable.c => ptdump/hashpagetable.c} | 0
.../mm/{dump_linuxpagetables.c => ptdump/ptdump.c} | 2 +-
.../mm/{dump_linuxpagetables.h => ptdump/ptdump.h} | 0
arch/powerpc/mm/{dump_sr.c => ptdump/segment_regs.c} | 0
.../shared.c} | 2 +-
11 files changed, 14 insertions(+), 17 deletions(-)
rename arch/powerpc/mm/{dump_linuxpagetables-8xx.c => ptdump/8xx.c} (97%)
create mode 100644 arch/powerpc/mm/ptdump/Makefile
rename arch/powerpc/mm/{dump_bats.c => ptdump/bats.c} (100%)
rename arch/powerpc/mm/{dump_linuxpagetables-book3s64.c => ptdump/book3s64.c} (98%)
rename arch/powerpc/mm/{dump_hashpagetable.c => ptdump/hashpagetable.c} (100%)
rename arch/powerpc/mm/{dump_linuxpagetables.c => ptdump/ptdump.c} (99%)
rename arch/powerpc/mm/{dump_linuxpagetables.h => ptdump/ptdump.h} (100%)
rename arch/powerpc/mm/{dump_sr.c => ptdump/segment_regs.c} (100%)
rename arch/powerpc/mm/{dump_linuxpagetables-generic.c => ptdump/shared.c} (97%)arch/powerpc/Kconfig.debug +0 -4
@@ -368,10 +368,6 @@ config PPC_PTDUMP If you are unsure, say N. -config PPC_HTDUMP - def_bool y - depends on PPC_PTDUMP && PPC_BOOK3S_64 - config PPC_FAST_ENDIAN_SWITCH bool "Deprecated fast endian-switch syscall" depends on DEBUG_KERNEL && PPC_BOOK3S_64
arch/powerpc/mm/Makefile +1 -9
@@ -42,13 +42,5 @@ obj-$(CONFIG_NOT_COHERENT_CACHE) += dma-noncoherent.o obj-$(CONFIG_HIGHMEM) += highmem.o obj-$(CONFIG_PPC_COPRO_BASE) += copro_fault.o obj-$(CONFIG_SPAPR_TCE_IOMMU) += mmu_context_iommu.o -obj-$(CONFIG_PPC_PTDUMP) += dump_linuxpagetables.o -ifdef CONFIG_PPC_PTDUMP -obj-$(CONFIG_4xx) += dump_linuxpagetables-generic.o -obj-$(CONFIG_PPC_8xx) += dump_linuxpagetables-8xx.o -obj-$(CONFIG_PPC_BOOK3E_MMU) += dump_linuxpagetables-generic.o -obj-$(CONFIG_PPC_BOOK3S_32) += dump_linuxpagetables-generic.o dump_bats.o dump_sr.o -obj-$(CONFIG_PPC_BOOK3S_64) += dump_linuxpagetables-book3s64.o -endif -obj-$(CONFIG_PPC_HTDUMP) += dump_hashpagetable.o +obj-$(CONFIG_PPC_PTDUMP) += ptdump/ obj-$(CONFIG_PPC_MEM_KEYS) += pkeys.o
arch/powerpc/mm/ptdump/8xx.c renamed from arch/powerpc/mm/dump_linuxpagetables-8xx.c +1 -1
@@ -7,7 +7,7 @@#include <linux/kernel.h> #include <asm/pgtable.h> -#include "dump_linuxpagetables.h" +#include "ptdump.h" static const struct flag_info flag_array[] = { {
arch/powerpc/mm/ptdump/Makefile new file +9 -0
@@ -0,0 +1,9 @@ +# SPDX-License-Identifier: GPL-2.0 + +obj-y += ptdump.o + +obj-$(CONFIG_4xx) += shared.o +obj-$(CONFIG_PPC_8xx) += 8xx.o +obj-$(CONFIG_PPC_BOOK3E_MMU) += shared.o +obj-$(CONFIG_PPC_BOOK3S_32) += shared.o bats.o segment_regs.o +obj-$(CONFIG_PPC_BOOK3S_64) += book3s64.o hashpagetable.o
arch/powerpc/mm/ptdump/bats.c renamed from arch/powerpc/mm/dump_bats.c +0 -0
arch/powerpc/mm/ptdump/book3s64.c renamed from arch/powerpc/mm/dump_linuxpagetables-book3s64.c +1 -1
@@ -7,7 +7,7 @@#include <linux/kernel.h> #include <asm/pgtable.h> -#include "dump_linuxpagetables.h" +#include "ptdump.h" static const struct flag_info flag_array[] = { {
arch/powerpc/mm/ptdump/hashpagetable.c renamed from arch/powerpc/mm/dump_hashpagetable.c +0 -0
arch/powerpc/mm/ptdump/ptdump.c renamed from arch/powerpc/mm/dump_linuxpagetables.c +1 -1
@@ -28,7 +28,7 @@#include <asm/page.h> #include <asm/pgalloc.h> -#include "dump_linuxpagetables.h" +#include "ptdump.h" #ifdef CONFIG_PPC32 #define KERN_VIRT_START 0
arch/powerpc/mm/ptdump/ptdump.h renamed from arch/powerpc/mm/dump_linuxpagetables.h +0 -0
arch/powerpc/mm/ptdump/segment_regs.c renamed from arch/powerpc/mm/dump_sr.c +0 -0
arch/powerpc/mm/ptdump/shared.c renamed from arch/powerpc/mm/dump_linuxpagetables-generic.c +1 -1
@@ -7,7 +7,7 @@#include <linux/kernel.h> #include <asm/pgtable.h> -#include "dump_linuxpagetables.h" +#include "ptdump.h" static const struct flag_info flag_array[] = { {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 30/129 powerpc/64s/radix: Fix soft dirty tracking
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
[ Upstream commit 66b2ca086210732954a7790d63d35542936fc664 ]
It was reported that soft dirty tracking doesn't work when using the Radix MMU.
The tracking is supposed to work by clearing the soft dirty bit for a mapping and then write protecting the PTE. If/when the page is written to, a page fault occurs and the soft dirty bit is added back via pte_mkdirty(). For example in wp_page_reuse():
entry = maybe_mkwrite(pte_mkdirty(entry), vma); if (ptep_set_access_flags(vma, vmf->address, vmf->pte, entry, 1)) update_mmu_cache(vma, vmf->address, vmf->pte);
Unfortunately on radix _PAGE_SOFTDIRTY is being dropped by radix__ptep_set_access_flags(), called from ptep_set_access_flags(), meaning the soft dirty bit is not set even though the page has been written to.
Fix it by adding _PAGE_SOFTDIRTY to the set of bits that are able to be changed in radix__ptep_set_access_flags().
--- arch/powerpc/mm/pgtable-radix.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/powerpc/mm/pgtable-radix.c +2 -2
@@ -1041,8 +1041,8 @@ void radix__ptep_set_access_flags(struct vm_area_struct *vma, pte_t *ptep, pte_t entry, unsigned long address, int psize) { struct mm_struct *mm = vma->vm_mm; -unsigned long set =pte_val (entry) & (_PAGE_DIRTY | _PAGE_ACCESSED | - _PAGE_RW | _PAGE_EXEC); +unsigned long set =pte_val (entry) & (_PAGE_DIRTY | _PAGE_SOFT_DIRTY | + _PAGE_ACCESSED | _PAGE_RW | _PAGE_EXEC);unsigned long change =pte_val (entry) ^pte_val (*ptep);/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 31/129 x86/topology: Fix erroneous smp_num_siblings on Intel Hybrid platforms
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Rui <[email protected]>
[ Upstream commit edc0a2b5957652f4685ef3516f519f84807087db ]
Traditionally, all CPUs in a system have identical numbers of SMT siblings. That changes with hybrid processors where some logical CPUs have a sibling and others have none.
Today, the CPU boot code sets the global variable smp_num_siblings when every CPU thread is brought up. The last thread to boot will overwrite it with the number of siblings of *that* thread. That last thread to boot will "win". If the thread is a Pcore, smp_num_siblings == 2. If it is an Ecore, smp_num_siblings == 1.
smp_num_siblings describes if the *system* supports SMT. It should specify the maximum number of SMT threads among all cores.
Ensure that smp_num_siblings represents the system-wide maximum number of siblings by always increasing its value. Never allow it to decrease.
On MeteorLake-P platform, this fixes a problem that the Ecore CPUs are not updated in any cpu sibling map because the system is treated as an UP system when probing Ecore CPUs.
Below shows part of the CPU topology information before and after the fix, for both Pcore and Ecore CPU (cpu0 is Pcore, cpu 12 is Ecore).
...
-/sys/devices/system/cpu/cpu0/topology/package_cpus:000fff -/sys/devices/system/cpu/cpu0/topology/package_cpus_list:0-11 +/sys/devices/system/cpu/cpu0/topology/package_cpus:3fffff +/sys/devices/system/cpu/cpu0/topology/package_cpus_list:0-21
...
-/sys/devices/system/cpu/cpu12/topology/package_cpus:001000 -/sys/devices/system/cpu/cpu12/topology/package_cpus_list:12 +/sys/devices/system/cpu/cpu12/topology/package_cpus:3fffff +/sys/devices/system/cpu/cpu12/topology/package_cpus_list:0-21
Notice that the "before" 'package_cpus_list' has only one CPU. This means that userspace tools like lscpu will see a little laptop like an 11-socket system:
-Core(s) per socket: 1 -Socket(s): 11 +Core(s) per socket: 16 +Socket(s): 1
This is also expected to make the scheduler do rather wonky things too.
[ dhansen: remove CPUID detail from changelog, add end user effects ]
--- arch/x86/kernel/cpu/topology.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
arch/x86/kernel/cpu/topology.c +3 -2
@@ -44,7 +44,7 @@ int detect_extended_topology_early(struct cpuinfo_x86 *c)* initial apic id, which also represents 32-bit extended x2apic id. */ c->initial_apicid = edx; - smp_num_siblings =LEVEL_MAX_SIBLINGS (ebx); + smp_num_siblings =max_t (int, smp_num_siblings,LEVEL_MAX_SIBLINGS (ebx));#endif return 0 ; }
@@ -68,7 +68,8 @@ int detect_extended_topology(struct cpuinfo_x86 *c)* Populate HT related information from sub-leaf level 0. */ cpuid_count (0xb ,SMT_LEVEL , &eax, &ebx, &ecx, &edx); - core_level_siblings = smp_num_siblings =LEVEL_MAX_SIBLINGS (ebx); + core_level_siblings =LEVEL_MAX_SIBLINGS (ebx); + smp_num_siblings =max_t (int, smp_num_siblings,LEVEL_MAX_SIBLINGS (ebx)); core_plus_mask_width = ht_mask_width =BITS_SHIFT_NEXT_LEVEL (eax); sub_index =1 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 32/129 irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <[email protected]>
[ Upstream commit dd098a0e031928cf88c89f7577d31821e1f0e6de ]
The MIPS GIC driver uses irq_cpu_online() to go and program the per-CPU interrupts. However, this method iterates over all IRQs in the system, despite only 3 per-CPU interrupts being of interest.
Let's be terribly bold and do the iteration ourselves. To ensure mutual exclusion, hold the gic_lock spinlock that is otherwise taken while dealing with these interrupts.
Stable-dep-of: 3d6a0e4197c0 ("irqchip/mips-gic: Use raw spinlock for gic_lock")
--- drivers/irqchip/irq-mips-gic.c | 37 ++++++++++++++++++++++++---------- 1 file changed, 26 insertions(+), 11 deletions(-)
drivers/irqchip/irq-mips-gic.c +26 -11
@@ -380,24 +380,35 @@ static void gic_unmask_local_irq_all_vpes(struct irq_data *d)spin_unlock_irqrestore (&gic_lock, flags); } -static void gic_all_vpes_irq_cpu_online (struct irq_data *d) +static void gic_all_vpes_irq_cpu_online (void ) { -struct gic_all_vpes_chip_data *cd; -unsigned int intr; +static const unsigned int local_intrs[] = { +GIC_LOCAL_INT_TIMER , +GIC_LOCAL_INT_PERFCTR , +GIC_LOCAL_INT_FDC , + }; +unsigned long flags; +int i; - intr =GIC_HWIRQ_TO_LOCAL (d->hwirq); - cd =irq_data_get_irq_chip_data (d); +spin_lock_irqsave (&gic_lock, flags); -write_gic_vl_map (mips_gic_vx_map_reg (intr), cd->map); -if (cd->mask) -write_gic_vl_smask (BIT (intr)); +for (i =0 ; i <ARRAY_SIZE (local_intrs); i++) { +unsigned int intr = local_intrs[i]; +struct gic_all_vpes_chip_data *cd; + + cd = &gic_all_vpes_chip_data[intr]; +write_gic_vl_map (mips_gic_vx_map_reg (intr), cd->map); +if (cd->mask) +write_gic_vl_smask (BIT (intr)); + } + +spin_unlock_irqrestore (&gic_lock, flags); }static struct irq_chip gic_all_vpes_local_irq_controller = { .name ="MIPS GIC Local" , .irq_mask = gic_mask_local_irq_all_vpes, .irq_unmask = gic_unmask_local_irq_all_vpes, - .irq_cpu_online = gic_all_vpes_irq_cpu_online, };static void __gic_irq_dispatch (void )
@@ -476,6 +487,10 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq, intr =GIC_HWIRQ_TO_LOCAL (hwirq); map =GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin; +/* +* If adding support for more per-cpu interrupts, keep the the +* array in gic_all_vpes_irq_cpu_online() in sync. +*/ switch (intr) {case GIC_LOCAL_INT_TIMER :/* CONFIG_MIPS_CMP workaround (see __gic_init) */
@@ -662,8 +677,8 @@ static int gic_cpu_startup(unsigned int cpu)/* Clear all local IRQ masks (ie. disable all local interrupts) */ write_gic_vl_rmask (~0 ); -/* Invoke irq_cpu_online callbacks to enable desired interrupts */ -irq_cpu_online (); +/* Enable desired interrupts */ +gic_all_vpes_irq_cpu_online ();return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 33/129 irqchip/mips-gic: Use raw spinlock for gic_lock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
[ Upstream commit 3d6a0e4197c04599d75d85a608c8bb16a630a38c ]
Since we may hold gic_lock in hardirq context, use raw spinlock makes more sense given that it is for low-level interrupt handling routine and the critical section is small.
Fixes BUG:
[ 0.426106] =============================
[ 0.426257] [ BUG: Invalid wait context ]
[ 0.426422] 6.3.0-rc7-next-20230421-dirty #54 Not tainted
[ 0.426638] -----------------------------
[ 0.426766] swapper/0/1 is trying to lock:
[ 0.426954] ffffffff8104e7b8 (gic_lock){....}-{3:3}, at: gic_set_type+0x30/08--- drivers/irqchip/irq-mips-gic.c | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-)
drivers/irqchip/irq-mips-gic.c +15 -15
@@ -48,7 +48,7 @@ void __iomem *mips_gic_base; DEFINE_PER_CPU_READ_MOSTLY(unsigned long[GIC_MAX_LONGS], pcpu_masks); -static DEFINE_SPINLOCK (gic_lock); +static DEFINE_RAW_SPINLOCK (gic_lock);static struct irq_domain *gic_irq_domain;static struct irq_domain *gic_ipi_domain;static int gic_shared_intrs;
@@ -207,7 +207,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type) irq =GIC_HWIRQ_TO_SHARED (d->hwirq); -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);switch (type &IRQ_TYPE_SENSE_MASK ) {case IRQ_TYPE_EDGE_FALLING : pol =GIC_POL_FALLING_EDGE ;
@@ -247,7 +247,7 @@ static int gic_set_type(struct irq_data *d, unsigned int type)else irq_set_chip_handler_name_locked (d, &gic_level_irq_controller, handle_level_irq,NULL ); -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags);return 0 ; }
@@ -265,7 +265,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,return -EINVAL ;/* Assumption : cpumask refers to a single CPU */ -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);/* Re-route this IRQ */ write_gic_map_vp (irq,BIT (mips_cm_vp_id (cpu)));
@@ -276,7 +276,7 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *cpumask,set_bit (irq,per_cpu_ptr (pcpu_masks, cpu));irq_data_update_effective_affinity (d,cpumask_of (cpu)); -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags);return IRQ_SET_MASK_OK ; }
@@ -354,12 +354,12 @@ static void gic_mask_local_irq_all_vpes(struct irq_data *d) cd =irq_data_get_irq_chip_data (d); cd->mask = false; -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);for_each_online_cpu (cpu) {write_gic_vl_other (mips_cm_vp_id (cpu));write_gic_vo_rmask (BIT (intr)); } -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags); }static void gic_unmask_local_irq_all_vpes (struct irq_data *d)
@@ -372,12 +372,12 @@ static void gic_unmask_local_irq_all_vpes(struct irq_data *d) cd =irq_data_get_irq_chip_data (d); cd->mask = true; -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);for_each_online_cpu (cpu) {write_gic_vl_other (mips_cm_vp_id (cpu));write_gic_vo_smask (BIT (intr)); } -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags); }static void gic_all_vpes_irq_cpu_online (void )
@@ -390,7 +390,7 @@ static void gic_all_vpes_irq_cpu_online(void)unsigned long flags;int i; -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);for (i =0 ; i <ARRAY_SIZE (local_intrs); i++) {unsigned int intr = local_intrs[i];
@@ -402,7 +402,7 @@ static void gic_all_vpes_irq_cpu_online(void)write_gic_vl_smask (BIT (intr)); } -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags); }static struct irq_chip gic_all_vpes_local_irq_controller = {
@@ -432,11 +432,11 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq, data =irq_get_irq_data (virq); -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);write_gic_map_pin (intr,GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin);write_gic_map_vp (intr,BIT (mips_cm_vp_id (cpu)));irq_data_update_effective_affinity (data,cpumask_of (cpu)); -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags);return 0 ; }
@@ -529,12 +529,12 @@ static int gic_irq_domain_map(struct irq_domain *d, unsigned int virq,if (!gic_local_irq_is_routable (intr))return -EPERM ; -spin_lock_irqsave (&gic_lock, flags); +raw_spin_lock_irqsave (&gic_lock, flags);for_each_online_cpu (cpu) {write_gic_vl_other (mips_cm_vp_id (cpu));write_gic_vo_map (mips_gic_vx_map_reg (intr), map); } -spin_unlock_irqrestore (&gic_lock, flags); +raw_spin_unlock_irqrestore (&gic_lock, flags);return 0 ; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 34/129 usb: dwc3: qcom: Add helper functions to enable,disable wake irqs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sandeep Maheswaram <[email protected]>
[ Upstream commit 360e8230516de94d74d30c64f0cdcf228b8e8b67 ]
Adding helper functions to enable,disable wake irqs to make the code simple and readable.
Stable-dep-of: d2d69354226d ("USB: dwc3: qcom: fix NULL-deref on suspend")
--- drivers/usb/dwc3/dwc3-qcom.c | 58 ++++++++++++++++-------------------- 1 file changed, 26 insertions(+), 32 deletions(-)
drivers/usb/dwc3/dwc3-qcom.c +26 -32
@@ -181,50 +181,44 @@ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom)return dwc->xhci; } +static void dwc3_qcom_enable_wakeup_irq (int irq) +{ +if (!irq) +return ; + +enable_irq (irq); +enable_irq_wake (irq); +} + +static void dwc3_qcom_disable_wakeup_irq (int irq) +{ +if (!irq) +return ; + +disable_irq_wake (irq); +disable_irq_nosync (irq); +} +static void dwc3_qcom_disable_interrupts (struct dwc3_qcom *qcom) { -if (qcom->hs_phy_irq) { -disable_irq_wake (qcom->hs_phy_irq); -disable_irq_nosync (qcom->hs_phy_irq); - } +dwc3_qcom_disable_wakeup_irq (qcom->hs_phy_irq); -if (qcom->dp_hs_phy_irq) { -disable_irq_wake (qcom->dp_hs_phy_irq); -disable_irq_nosync (qcom->dp_hs_phy_irq); - } +dwc3_qcom_disable_wakeup_irq (qcom->dp_hs_phy_irq); -if (qcom->dm_hs_phy_irq) { -disable_irq_wake (qcom->dm_hs_phy_irq); -disable_irq_nosync (qcom->dm_hs_phy_irq); - } +dwc3_qcom_disable_wakeup_irq (qcom->dm_hs_phy_irq); -if (qcom->ss_phy_irq) { -disable_irq_wake (qcom->ss_phy_irq); -disable_irq_nosync (qcom->ss_phy_irq); - } +dwc3_qcom_disable_wakeup_irq (qcom->ss_phy_irq); }static void dwc3_qcom_enable_interrupts (struct dwc3_qcom *qcom) { -if (qcom->hs_phy_irq) { -enable_irq (qcom->hs_phy_irq); -enable_irq_wake (qcom->hs_phy_irq); - } +dwc3_qcom_enable_wakeup_irq (qcom->hs_phy_irq); -if (qcom->dp_hs_phy_irq) { -enable_irq (qcom->dp_hs_phy_irq); -enable_irq_wake (qcom->dp_hs_phy_irq); - } +dwc3_qcom_enable_wakeup_irq (qcom->dp_hs_phy_irq); -if (qcom->dm_hs_phy_irq) { -enable_irq (qcom->dm_hs_phy_irq); -enable_irq_wake (qcom->dm_hs_phy_irq); - } +dwc3_qcom_enable_wakeup_irq (qcom->dm_hs_phy_irq); -if (qcom->ss_phy_irq) { -enable_irq (qcom->ss_phy_irq); -enable_irq_wake (qcom->ss_phy_irq); - } +dwc3_qcom_enable_wakeup_irq (qcom->ss_phy_irq); }static int dwc3_qcom_suspend (struct dwc3_qcom *qcom)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 35/129 USB: dwc3: qcom: fix NULL-deref on suspend
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
[ Upstream commit d2d69354226de0b333d4405981f3d9c41ba8430a ]
The Qualcomm dwc3 glue driver is currently accessing the driver data of the child core device during suspend and on wakeup interrupts. This is clearly a bad idea as the child may not have probed yet or could have been unbound from its driver.
The first such layering violation was part of the initial version of the driver, but this was later made worse when the hack that accesses the driver data of the grand child xhci device to configure the wakeup interrupts was added.
Fixing this properly is not that easily done, so add a sanity check to make sure that the child driver data is non-NULL before dereferencing it for now.
Note that this relies on subtleties like the fact that driver core is making sure that the parent is not suspended while the child is probing.
Message-ID: <[email protected]>
--- drivers/usb/dwc3/dwc3-qcom.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-qcom.c +10 -1
@@ -176,7 +176,16 @@ static int dwc3_qcom_register_extcon(struct dwc3_qcom *qcom)/* Only usable in contexts where the role can not change. */ static bool dwc3_qcom_is_host (struct dwc3_qcom *qcom) { -struct dwc3 *dwc =platform_get_drvdata (qcom->dwc3); +struct dwc3 *dwc; + +/* +* FIXME: Fix this layering violation. +*/ + dwc =platform_get_drvdata (qcom->dwc3); + +/* Core driver may not have probed yet. */ +if (!dwc) +return false;return dwc->xhci; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 36/129 mmc: meson-gx: remove useless lock
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit 83076d2268c72d123f3d1eaf186a9f56ec1b943a ]
The spinlock is only used within the irq handler so it does not seem very useful.
Stable-dep-of: 3c40eb814532 ("mmc: meson-gx: remove redundant mmc_request_done() call from irq context")
--- drivers/mmc/host/meson-gx-mmc.c | 7 ------- 1 file changed, 7 deletions(-)
drivers/mmc/host/meson-gx-mmc.c +0 -7
@@ -26,7 +26,6 @@#include <linux/of_device.h> #include <linux/platform_device.h> #include <linux/ioport.h> -#include <linux/spinlock.h> #include <linux/dma-mapping.h> #include <linux/mmc/host.h> #include <linux/mmc/mmc.h>
@@ -159,7 +158,6 @@ struct meson_host {struct mmc_host *mmc;struct mmc_command *cmd; -spinlock_t lock;void __iomem *regs;struct clk *core_clk;struct clk *mmc_clk;
@@ -1042,8 +1040,6 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)if (WARN_ON (!host) ||WARN_ON (!host->cmd))return IRQ_NONE ; -spin_lock (&host->lock); - cmd = host->cmd; data = cmd->data; cmd->error =0 ;
@@ -1093,7 +1089,6 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)if (ret ==IRQ_HANDLED )meson_mmc_request_done (host->mmc, cmd->mrq); -spin_unlock (&host->lock);return ret; }
@@ -1246,8 +1241,6 @@ static int meson_mmc_probe(struct platform_device *pdev) host->dev = &pdev->dev;dev_set_drvdata (&pdev->dev, host); -spin_lock_init (&host->lock); -/* Get regulators and the supported OCR mask */ host->vqmmc_enabled = false; ret =mmc_regulator_get_supply (mmc);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 37/129 mmc: meson-gx: remove redundant mmc_request_done() call from irq context
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Hundebøll <[email protected]>
[ Upstream commit 3c40eb8145325b0f5b93b8a169146078cb2c49d6 ]
The call to mmc_request_done() can schedule, so it must not be called from irq context. Wake the irq thread if it needs to be called, and let its existing logic do its work.
Fixes the following kernel bug, which appears when running an RT patched kernel on the AmLogic Meson AXG A113X SoC:
[ 11.111407] BUG: scheduling while atomic: kworker/0:1H/75/0x00010001 [ 11.111438] Modules linked in: [ 11.111451] CPU: 0 PID: 75 Comm: kworker/0:1H Not tainted 6.4.0-rc3-rt2-rtx-00081-gfd07f41ed6b4-dirty #1 [ 11.111461] Hardware name: RTX AXG A113X Linux Platform Board (DT) [ 11.111469] Workqueue: kblockd blk_mq_run_work_fn [ 11.111492] Call trace: [ 11.111497] dump_backtrace+0xac/0xe8 [ 11.111510] show_stack+0x18/0x28 [ 11.111518] dump_stack_lvl+0x48/0x60 [ 11.111530] dump_stack+0x18/0x24 [ 11.111537] __schedule_bug+0x4c/0x68 [ 11.111548] __schedule+0x80/0x574 [ 11.111558] schedule_loop+0x2c/0x50 [ 11.111567] schedule_rtlock+0x14/0x20 [ 11.111576] rtlock_slowlock_locked+0x468/0x730 [ 11.111587] rt_spin_lock+0x40/0x64 [ 11.111596] __wake_up_common_lock+0x5c/0xc4 [ 11.111610] __wake_up+0x18/0x24 [ 11.111620] mmc_blk_mq_req_done+0x68/0x138 [ 11.111633] mmc_request_done+0x104/0x118 [ 11.111644] meson_mmc_request_done+0x38/0x48 [ 11.111654] meson_mmc_irq+0x128/0x1f0 [ 11.111663] __handle_irq_event_percpu+0x70/0x114 [ 11.111674] handle_irq_event_percpu+0x18/0x4c [ 11.111683] handle_irq_event+0x80/0xb8 [ 11.111691] handle_fasteoi_irq+0xa4/0x120 [ 11.111704] handle_irq_desc+0x20/0x38 [ 11.111712] generic_handle_domain_irq+0x1c/0x28 [ 11.111721] gic_handle_irq+0x8c/0xa8 [ 11.111735] call_on_irq_stack+0x24/0x4c [ 11.111746] do_interrupt_handler+0x88/0x94 [ 11.111757] el1_interrupt+0x34/0x64 [ 11.111769] el1h_64_irq_handler+0x18/0x24 [ 11.111779] el1h_64_irq+0x64/0x68 [ 11.111786] __add_wait_queue+0x0/0x4c [ 11.111795] mmc_blk_rw_wait+0x84/0x118 [ 11.111804] mmc_blk_mq_issue_rq+0x5c4/0x654 [ 11.111814] mmc_mq_queue_rq+0x194/0x214 [ 11.111822] blk_mq_dispatch_rq_list+0x3ac/0x528 [ 11.111834] __blk_mq_sched_dispatch_requests+0x340/0x4d0 [ 11.111847] blk_mq_sched_dispatch_requests+0x38/0x70 [ 11.111858] blk_mq_run_work_fn+0x3c/0x70 [ 11.111865] process_one_work+0x17c/0x1f0 [ 11.111876] worker_thread+0x1d4/0x26c [ 11.111885] kthread+0xe4/0xf4 [ 11.111894] ret_from_fork+0x10/0x20
--- drivers/mmc/host/meson-gx-mmc.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-)
drivers/mmc/host/meson-gx-mmc.c +2 -8
@@ -1067,11 +1067,8 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)if (status & (IRQ_END_OF_CHAIN |IRQ_RESP_STATUS )) {if (data && !cmd->error) data->bytes_xfered = data->blksz * data->blocks; -if (meson_mmc_bounce_buf_read (data) || -meson_mmc_get_next_command (cmd)) - ret =IRQ_WAKE_THREAD ; -else - ret =IRQ_HANDLED ; + +return IRQ_WAKE_THREAD ; } out:
@@ -1086,9 +1083,6 @@ static irqreturn_t meson_mmc_irq(int irq, void *dev_id)writel (start, host->regs +SD_EMMC_START ); } -if (ret ==IRQ_HANDLED ) -meson_mmc_request_done (host->mmc, cmd->mrq); -return ret; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 38/129 mmc: tmio: replace tmio_mmc_clk_stop() calls with tmio_mmc_set_clock()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 74005a01f1ff66f98bf24163297932144d4da1ae ]
tmio_mmc_clk_stop(host) is equivalent to tmio_mmc_set_clock(host, 0). This replacement is needed for the next commit.
Stable-dep-of: 71150ac12558 ("mmc: bcm2835: fix deferred probing")
--- drivers/mmc/host/tmio_mmc_core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/mmc/host/tmio_mmc_core.c +3 -3
@@ -1051,7 +1051,7 @@ static void tmio_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)switch (ios->power_mode) {case MMC_POWER_OFF :tmio_mmc_power_off (host); -tmio_mmc_clk_stop (host); +tmio_mmc_set_clock (host,0 );break ;case MMC_POWER_UP :tmio_mmc_power_on (host, ios->vdd);
@@ -1318,7 +1318,7 @@ int tmio_mmc_host_probe(struct tmio_mmc_host *_host)if (pdata->flags &TMIO_MMC_SDIO_IRQ ) _host->sdio_irq_mask =TMIO_SDIO_MASK_ALL ; -tmio_mmc_clk_stop (_host); +tmio_mmc_set_clock (_host,0 );tmio_mmc_reset (_host); _host->sdcard_irq_mask =sd_ctrl_read16_and_16_as_32 (_host,CTL_IRQ_MASK );
@@ -1402,7 +1402,7 @@ int tmio_mmc_host_runtime_suspend(struct device *dev)tmio_mmc_disable_mmc_irqs (host,TMIO_MASK_ALL );if (host->clk_cache) -tmio_mmc_clk_stop (host); +tmio_mmc_set_clock (host,0 );tmio_mmc_clk_disable (host);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 39/129 mmc: tmio: move tmio_mmc_set_clock() to platform hook
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit 0196c8db8363f7627df6f78615271ae0ba430500 ]
tmio_mmc_set_clock() is full of quirks because different SoC vendors extended this in different ways.
The original IP defines the divisor range 1/2 ... 1/512.
bit 7 is set: 1/512
bit 6 is set: 1/256
...
bit 0 is set: 1/4
all bits clear: 1/2
It is platform-dependent how to achieve the 1/1 clock.
I guess the TMIO-MFD variant uses the clock selector outside of this IP, as far as I see tmio_core_mmc_clk_div() in drivers/mfd/tmio_core.c
I guess bit[7:0]=0xff is Renesas-specific extension.
Socionext (and Panasonic) uses bit 10 (CLKSEL) for 1/1. Also, newer versions of UniPhier SoC variants use bit 16 for 1/1024.
host->clk_update() is only used by the Renesas variants, whereas host->set_clk_div() is only used by the TMIO-MFD variants.
To cope with this mess, promote tmio_mmc_set_clock() to a new platform hook ->set_clock(), and melt the old two hooks into it.
Stable-dep-of: 71150ac12558 ("mmc: bcm2835: fix deferred probing")
--- drivers/mmc/host/renesas_sdhi_core.c | 62 ++++++++++++++++++- drivers/mmc/host/tmio_mmc.c | 48 +++++++++++++++ drivers/mmc/host/tmio_mmc.h | 4 +- drivers/mmc/host/tmio_mmc_core.c | 92 +++------------------------- 4 files changed, 117 insertions(+), 89 deletions(-)
drivers/mmc/host/renesas_sdhi_core.c +61 -1
@@ -155,6 +155,66 @@ static unsigned int renesas_sdhi_clk_update(struct tmio_mmc_host *host,return ret ==0 ? best_freq :clk_get_rate (priv->clk); } +static void renesas_sdhi_clk_start (struct tmio_mmc_host *host) +{ +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL ,CLK_CTL_SCLKEN | +sd_ctrl_read16 (host,CTL_SD_CARD_CLK_CTL )); + +/* HW engineers overrode docs: no sleep needed on R-Car2+ */ +if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 )) +usleep_range (10000 ,11000 ); +} + +static void renesas_sdhi_clk_stop (struct tmio_mmc_host *host) +{ +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , ~CLK_CTL_SCLKEN & +sd_ctrl_read16 (host,CTL_SD_CARD_CLK_CTL )); + +/* HW engineers overrode docs: no sleep needed on R-Car2+ */ +if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 )) +usleep_range (10000 ,11000 ); +} + +static void renesas_sdhi_set_clock (struct tmio_mmc_host *host, +unsigned int new_clock) +{ +u32 clk =0 , clock; + +if (new_clock ==0 ) { +renesas_sdhi_clk_stop (host); +return ; + } +/* +* Both HS400 and HS200/SD104 set 200MHz, but some devices need to +* set 400MHz to distinguish the CPG settings in HS400. +*/ +if (host->mmc->ios.timing ==MMC_TIMING_MMC_HS400 && + host->pdata->flags &TMIO_MMC_HAVE_4TAP_HS400 && + new_clock ==200000000 ) + new_clock =400000000 ; + + clock =renesas_sdhi_clk_update (host, new_clock) /512 ; + +for (clk =0x80000080 ; new_clock >= (clock <<1 ); clk >>=1 ) + clock <<=1 ; + +/* 1/1 clock is option */ +if ((host->pdata->flags &TMIO_MMC_CLK_ACTUAL ) && ((clk >>22 ) &0x1 )) { +if (!(host->mmc->ios.timing ==MMC_TIMING_MMC_HS400 )) + clk |=0xff ; +else + clk &= ~0xff ; + } + +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , ~CLK_CTL_SCLKEN & +sd_ctrl_read16 (host,CTL_SD_CARD_CLK_CTL )); +sd_ctrl_write16 (host,CTL_SD_CARD_CLK_CTL , clk &CLK_CTL_DIV_MASK ); +if (!(host->pdata->flags &TMIO_MMC_MIN_RCAR2 )) +usleep_range (10000 ,11000 ); + +renesas_sdhi_clk_start (host); +} +static void renesas_sdhi_clk_disable (struct tmio_mmc_host *host) {struct renesas_sdhi *priv =host_to_priv (host);
@@ -621,8 +681,8 @@ int renesas_sdhi_probe(struct platform_device *pdev, host->write16_hook = renesas_sdhi_write16_hook; host->clk_enable = renesas_sdhi_clk_enable; - host->clk_update = renesas_sdhi_clk_update; host->clk_disable = renesas_sdhi_clk_disable; + host->set_clock = renesas_sdhi_set_clock; host->multi_io_quirk = renesas_sdhi_multi_io_quirk; host->dma_ops = dma_ops;
drivers/mmc/host/tmio_mmc.c +48 -0
66 lines not on this page · raw message
drivers/mmc/host/tmio_mmc.h +1 -3
@@ -133,7 +133,6 @@ struct tmio_mmc_host {/* Callbacks for clock / power control */ void (*set_pwr)(struct platform_device *host,int state); -void (*set_clk_div)(struct platform_device *host,int state);/* pio related stuff */ struct scatterlist *sg_ptr;
@@ -170,10 +169,9 @@ struct tmio_mmc_host {/* Mandatory callback */ int (*clk_enable)(struct tmio_mmc_host *host); +void (*set_clock)(struct tmio_mmc_host *host,unsigned int clock);/* Optional callbacks */ -unsigned int (*clk_update)(struct tmio_mmc_host *host, -unsigned int new_clock);void (*clk_disable)(struct tmio_mmc_host *host);int (*multi_io_quirk)(struct mmc_card *card,unsigned int direction,int blk_size);
drivers/mmc/host/tmio_mmc_core.c +7 -85
140 lines not on this page · raw message
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 40/129 mmc: Remove dev_err() usage after platform_get_irq()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
[ Upstream commit 9a7957d0c9557f7780cdda970a2530d6351bd861 ]
We don't need dev_err() messages when platform_get_irq() fails now that platform_get_irq() prints an error message itself when something goes wrong. Let's remove these prints with a simple semantic patch.
// <smpl>
@@
expression ret;
struct platform_device *E;
@@
ret =
(platform_get_irq(E, ...)
|platform_get_irq_byname(E, ...)
);
if ( \( ret < 0 \| ret <= 0 \) )
{
(
-if (ret != -EPROBE_DEFER)
-{ ...
-dev_err(...);
-... }
|
...
-dev_err(...);
)
...
}
// </smpl>
While we're here, remove braces on if statements that only have one statement (manually).
Stable-dep-of: 71150ac12558 ("mmc: bcm2835: fix deferred probing")
--- drivers/mmc/host/bcm2835.c | 1 - drivers/mmc/host/jz4740_mmc.c | 1 - drivers/mmc/host/meson-gx-mmc.c | 1 - drivers/mmc/host/mxcmmc.c | 4 +--- drivers/mmc/host/s3cmci.c | 1 - drivers/mmc/host/sdhci-msm.c | 2 -- drivers/mmc/host/sdhci-pltfm.c | 1 - drivers/mmc/host/sdhci-s3c.c | 4 +--- drivers/mmc/host/sdhci_f_sdh30.c | 4 +--- 9 files changed, 3 insertions(+), 16 deletions(-)
drivers/mmc/host/bcm2835.c +0 -1
@@ -1418,7 +1418,6 @@ static int bcm2835_probe(struct platform host->irq =platform_get_irq (pdev,0 );if (host->irq <=0 ) { -dev_err (dev,"get IRQ failed\n" ); ret = -EINVAL ; goto err; }
drivers/mmc/host/jz4740_mmc.c +0 -1
@@ -1060,7 +1060,6 @@ static int jz4740_mmc_probe(struct platf host->irq =platform_get_irq (pdev,0 );if (host->irq <0 ) { ret = host->irq; -dev_err (&pdev->dev,"Failed to get platform irq: %d\n" , ret); goto err_free_host; }
drivers/mmc/host/meson-gx-mmc.c +0 -1
@@ -1272,7 +1272,6 @@ static int meson_mmc_probe(struct platfo host->irq =platform_get_irq (pdev,0 );if (host->irq <=0 ) { -dev_err (&pdev->dev,"failed to get interrupt resource.\n" ); ret = -EINVAL ; goto free_host; }
drivers/mmc/host/mxcmmc.c +1 -3
@@ -1017,10 +1017,8 @@ static int mxcmci_probe(struct platform_ res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); irq =platform_get_irq (pdev,0 ); -if (irq <0 ) { -dev_err (&pdev->dev,"failed to get IRQ: %d\n" , irq); +if (irq <0 )return irq; - } mmc =mmc_alloc_host (sizeof (*host), &pdev->dev);if (!mmc)
drivers/mmc/host/s3cmci.c +0 -1
@@ -1661,7 +1661,6 @@ static int s3cmci_probe(struct platform_ host->irq =platform_get_irq (pdev,0 );if (host->irq <=0 ) { -dev_err (&pdev->dev,"failed to get interrupt resource.\n" ); ret = -EINVAL ; goto probe_iounmap; }
drivers/mmc/host/sdhci-msm.c +0 -2
@@ -1914,8 +1914,6 @@ static int sdhci_msm_probe(struct platfo/* Setup IRQ for handling power/voltage tasks with PMIC */ msm_host->pwr_irq =platform_get_irq_byname (pdev,"pwr_irq" );if (msm_host->pwr_irq <0 ) { -dev_err (&pdev->dev,"Get pwr_irq failed (%d)\n" , - msm_host->pwr_irq); ret = msm_host->pwr_irq; goto clk_disable; }
drivers/mmc/host/sdhci-pltfm.c +0 -1
@@ -131,7 +131,6 @@ struct sdhci_host *sdhci_pltfm_init(stru irq =platform_get_irq (pdev,0 );if (irq <0 ) { -dev_err (&pdev->dev,"failed to get IRQ number\n" ); ret = irq; goto err; }
drivers/mmc/host/sdhci-s3c.c +1 -3
@@ -493,10 +493,8 @@ static int sdhci_s3c_probe(struct platfo } irq =platform_get_irq (pdev,0 ); -if (irq <0 ) { -dev_err (dev,"no irq specified\n" ); +if (irq <0 )return irq; - } host =sdhci_alloc_host (dev,sizeof (struct sdhci_s3c ));if (IS_ERR (host)) {
drivers/mmc/host/sdhci_f_sdh30.c +1 -3
@@ -122,10 +122,8 @@ static int sdhci_f_sdh30_probe(struct plu32 reg =0 ; irq =platform_get_irq (pdev,0 ); -if (irq <0 ) { -dev_err (dev,"%s: no irq specified\n" , __func__); +if (irq <0 )return irq; - } host =sdhci_alloc_host (dev,sizeof (struct f_sdhost_priv ));if (IS_ERR (host))
Greg Kroah-Hartman
maintainerPATCH 41/129 mmc: bcm2835: fix deferred probing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit 71150ac12558bcd9d75e6e24cf7c872c2efd80f3 ]
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/bcm2835.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/bcm2835.c +2 -2
@@ -1417,8 +1417,8 @@ static int bcm2835_probe(struct platform_device *pdev) host->max_clk =clk_get_rate (clk); host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto err; }
Signature · 1 line
2.40.1
Re: [PATCH 4.19 041/129] mmc: bcm2835: fix deferred probing
Quoted 15 lines · Greg Kroah-Hartman
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit
71150ac12558bcd9d75e6e24cf7c872c2efd80f3]The driver overrides the error codes and IRQ0 returned by
platform_get_irq()to-EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commitce753ad1549c("platform: finally disallow IRQ0 inplatform_get_irq()and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
Quoted 2 lines
Fixes 660fc733bd74 ("mmc: bcm2835: Add new driver for the sdhost controller.")Cc [email protected] # v5.19+
After a glance at the driver, the patch seems safe to be applied to 4.19.y,
despite I tried to limit it to 5.19.y and newer...
Quoted 4 lines
Signed-off-by Sergey Shtylyov <[email protected]>Signed-off-by Ulf Hansson <[email protected]>Signed-off-by Sasha Levin <[email protected]>
[...]
MBR, Sergey
Greg Kroah-Hartman
maintainerPATCH 42/129 mmc: sunxi: fix deferred probing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit c2df53c5806cfd746dae08e07bc8c4ad247c3b70 ]
The driver overrides the error codes and IRQ0 returned by platform_get_irq() to -EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commit ce753ad1549c ("platform: finally disallow IRQ0 in platform_get_irq() and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
--- drivers/mmc/host/sunxi-mmc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/mmc/host/sunxi-mmc.c +2 -2
@@ -1308,8 +1308,8 @@ static int sunxi_mmc_resource_request(struct sunxi_mmc_host *host,return ret; host->irq =platform_get_irq (pdev,0 ); -if (host->irq <=0 ) { - ret = -EINVAL ; +if (host->irq <0 ) { + ret = host->irq; goto error_disable_mmc; }
Signature · 1 line
2.40.1
Re: [PATCH 4.19 042/129] mmc: sunxi: fix deferred probing
Quoted 15 lines · Greg Kroah-Hartman
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <[email protected]>
[ Upstream commit
c2df53c5806cfd746dae08e07bc8c4ad247c3b70]The driver overrides the error codes and IRQ0 returned by
platform_get_irq()to-EINVAL, so if it returns -EPROBE_DEFER, the driver will fail the probe permanently instead of the deferred probing. Switch to propagating the error codes upstream. Since commitce753ad1549c("platform: finally disallow IRQ0 inplatform_get_irq()and its ilk") IRQ0 is no longer returned by those APIs, so we now can safely ignore it...
Quoted 2 lines
Fixes 2408a08583d2 ("mmc: sunxi-mmc: Handle return value of platform_get_irq")Cc [email protected] # v5.19+
After a glance at the driver, the patch too seems safe to be applied to 4.19.y,
despite I tried to limit it to 5.19.y and newer...
Quoted 5 lines
Signed-off-by Sergey Shtylyov <[email protected]>Reviewed-by Jernej Skrabec <[email protected]>Signed-off-by Ulf Hansson <[email protected]>Signed-off-by Sasha Levin <[email protected]>
[...]
MBR, Sergey
Greg Kroah-Hartman
maintainerPATCH 43/129 block: fix signed int overflow in Amiga partition support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Schmitz <[email protected]>
[ Upstream commit fc3d092c6bb48d5865fec15ed5b333c12f36288c ]
The Amiga partition parser module uses signed int for partition sector address and count, which will overflow for disks larger than 1 TB.
Use sector_t as type for sector address and size to allow using disks up to 2 TB without LBD support, and disks larger than 2 TB with LBD.
This bug was reported originally in 2012, and the fix was created by the RDB author, Joanne Dow <[email protected]>. A patch had been discussed and reviewed on linux-m68k at that time but never officially submitted. This patch differs from Joanne's patch only in its use of sector_t instead of unsigned int. No checking for overflows is done (see patch 3 of this series for that).
Message-ID: <[email protected]>
--- block/partitions/amiga.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
block/partitions/amiga.c +5 -4
@@ -32,7 +32,8 @@ int amiga_partition(struct parsed_partitions *state)unsigned char *data;struct RigidDiskBlock *rdb;struct PartitionBlock *pb; -int start_sect, nr_sects, blk, part, res =0 ; +sector_t start_sect, nr_sects; +int blk, part, res =0 ;int blksize =1 ;/* Multiplier for disk block size */ int slot =1 ;char b[BDEVNAME_SIZE ];
@@ -100,14 +101,14 @@ int amiga_partition(struct parsed_partitions *state)/* Tell Kernel about it */ - nr_sects = (be32_to_cpu (pb->pb_Environment[10 ]) +1 - -be32_to_cpu (pb->pb_Environment[9 ])) * + nr_sects = ((sector_t )be32_to_cpu (pb->pb_Environment[10 ]) +1 - +be32_to_cpu (pb->pb_Environment[9 ])) *be32_to_cpu (pb->pb_Environment[3 ]) *be32_to_cpu (pb->pb_Environment[5 ]) * blksize;if (!nr_sects)continue ; - start_sect =be32_to_cpu (pb->pb_Environment[9 ]) * + start_sect = (sector_t )be32_to_cpu (pb->pb_Environment[9 ]) *be32_to_cpu (pb->pb_Environment[3 ]) *be32_to_cpu (pb->pb_Environment[5 ]) * blksize;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 44/129 nfsd4: kill warnings on testing stateids with mismatched clientids
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: J. Bruce Fields <[email protected]>
[ Upstream commit 663e36f07666ff924012defa521f88875f6e5402 ]
It's normal for a client to test a stateid from a previous instance, e.g. after a network partition.
Stable-dep-of: f75546f58a70 ("nfsd: Remove incorrect check in nfsd4_validate_stateid")
--- fs/nfsd/nfs4state.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-)
fs/nfsd/nfs4state.c +1 -8
@@ -4998,15 +4998,8 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)if (ZERO_STATEID (stateid) ||ONE_STATEID (stateid) ||CLOSE_STATEID (stateid))return status; -/* Client debugging aid. */ -if (!same_clid (&stateid->si_opaque.so_clid, &cl->cl_clientid)) { -char addr_str[INET6_ADDRSTRLEN ]; -rpc_ntop ((struct sockaddr *)&cl->cl_addr, addr_str, -sizeof (addr_str)); -pr_warn_ratelimited ("NFSD: client %s testing state ID " -"with incorrect client ID\n" , addr_str); +if (!same_clid (&stateid->si_opaque.so_clid, &cl->cl_clientid))return status; - }spin_lock (&cl->cl_lock); s =find_stateid_locked (cl, stateid);if (!s)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 45/129 nfsd: Remove incorrect check in nfsd4_validate_stateid
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <[email protected]>
[ Upstream commit f75546f58a70da5cfdcec5a45ffc377885ccbee8 ]
If the client is calling TEST_STATEID, then it is because some event occurred that requires it to check all the stateids for validity and call FREE_STATEID on the ones that have been revoked. In this case, either the stateid exists in the list of stateids associated with that nfs4_client, in which case it should be tested, or it does not. There are no additional conditions to be considered.
--- fs/nfsd/nfs4state.c | 2 -- 1 file changed, 2 deletions(-)
fs/nfsd/nfs4state.c +0 -2
@@ -4998,8 +4998,6 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid)if (ZERO_STATEID (stateid) ||ONE_STATEID (stateid) ||CLOSE_STATEID (stateid))return status; -if (!same_clid (&stateid->si_opaque.so_clid, &cl->cl_clientid)) -return status;spin_lock (&cl->cl_lock); s =find_stateid_locked (cl, stateid);if (!s)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 46/129 virtio-mmio: convert to devm_platform_ioremap_resource
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit c64eb62cfce242a57a7276ca8280ae0baab29d05 ]
Use devm_platform_ioremap_resource() to simplify code, which contains platform_get_resource, devm_request_mem_region and devm_ioremap.
Stable-dep-of: 55c91fedd03d ("virtio-mmio: don't break lifecycle of vm_dev")
--- drivers/virtio/virtio_mmio.c | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-)
drivers/virtio/virtio_mmio.c +3 -12
@@ -548,18 +548,9 @@ static void virtio_mmio_release_dev(struct device *_d)static int virtio_mmio_probe (struct platform_device *pdev) {struct virtio_mmio_device *vm_dev; -struct resource *mem;unsigned long magic;int rc; - mem =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); -if (!mem) -return -EINVAL ; - -if (!devm_request_mem_region (&pdev->dev, mem->start, -resource_size (mem), pdev->name)) -return -EBUSY ; - vm_dev =devm_kzalloc (&pdev->dev,sizeof (*vm_dev),GFP_KERNEL );if (!vm_dev)return -ENOMEM ;
@@ -571,9 +562,9 @@ static int virtio_mmio_probe(struct platform_device *pdev)INIT_LIST_HEAD (&vm_dev->virtqueues);spin_lock_init (&vm_dev->lock); - vm_dev->base =devm_ioremap (&pdev->dev, mem->start,resource_size (mem)); -if (vm_dev->base ==NULL ) -return -EFAULT ; + vm_dev->base =devm_platform_ioremap_resource (pdev,0 ); +if (IS_ERR (vm_dev->base)) +return PTR_ERR (vm_dev->base);/* Check magic value */ magic =readl (vm_dev->base +VIRTIO_MMIO_MAGIC_VALUE );
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 47/129 virtio-mmio: Use to_virtio_mmio_device() to simply code
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tang Bin <[email protected]>
[ Upstream commit da98b54d02981de5b07d8044b2a632bf6ba3ac45 ]
The file virtio_mmio.c has defined the function to_virtio_mmio_device, so use it instead of container_of() to simply code.
Stable-dep-of: 55c91fedd03d ("virtio-mmio: don't break lifecycle of vm_dev")
--- drivers/virtio/virtio_mmio.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/virtio/virtio_mmio.c +1 -2
@@ -536,8 +536,7 @@ static void virtio_mmio_release_dev(struct device *_d) {struct virtio_device *vdev = container_of(_d, struct virtio_device, dev); -struct virtio_mmio_device *vm_dev = - container_of(vdev, struct virtio_mmio_device, vdev); +struct virtio_mmio_device *vm_dev =to_virtio_mmio_device (vdev);struct platform_device *pdev = vm_dev->pdev;devm_kfree (&pdev->dev, vm_dev);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 48/129 virtio-mmio: dont break lifecycle of vm_dev
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 55c91fedd03d7b9cf0c5199b2eb12b9b8e95281a ]
vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct.
Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called.
To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs.
The fix is easy, don't use devres in this case.
Found during my research about object lifetime problems.
Message-Id: <[email protected]>
--- drivers/virtio/virtio_mmio.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)
drivers/virtio/virtio_mmio.c +2 -3
@@ -537,9 +537,8 @@ static void virtio_mmio_release_dev(struct device *_d)struct virtio_device *vdev = container_of(_d, struct virtio_device, dev);struct virtio_mmio_device *vm_dev =to_virtio_mmio_device (vdev); -struct platform_device *pdev = vm_dev->pdev; -devm_kfree (&pdev->dev, vm_dev); +kfree (vm_dev); }/* Platform device */
@@ -550,7 +549,7 @@ static int virtio_mmio_probe(struct platform_device *pdev)unsigned long magic;int rc; - vm_dev =devm_kzalloc (&pdev->dev,sizeof (*vm_dev),GFP_KERNEL ); + vm_dev =kzalloc (sizeof (*vm_dev),GFP_KERNEL );if (!vm_dev)return -ENOMEM ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 49/129 fbdev: mmp: fix value check in mmphw_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <[email protected]>
commit 0872b2c0abc0e84ac82472959c8e14e35277549c upstream.
in mmphw_probe(), check the return value of clk_prepare_enable() and return the error code if clk_prepare_enable() returns an unexpected value.
--- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/video/fbdev/mmp/hw/mmp_ctrl.c +3 -1
@@ -523,7 +523,9 @@ static int mmphw_probe(struct platform_d ret = -ENOENT ; goto failed; } -clk_prepare_enable (ctrl->clk); + ret =clk_prepare_enable (ctrl->clk); +if (ret) + goto failed;/* init global regs */ ctrl_set_default (ctrl);
Greg Kroah-Hartman
maintainerPATCH 50/129 powerpc/rtas_flash: allow user copy to flash block cache objects
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <[email protected]>
commit 4f3175979e62de3b929bfa54a0db4b87d36257a7 upstream.
With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG():
kernel BUG at mm/usercopy.c:102!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
Modules linked in:
CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2
Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries
NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000
REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+)
MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c
CFAR: c0000000001fbd34 IRQMASK: 0
[ ... GPRs omitted ... ]
NIP usercopy_abort+0xa0/0xb0
LR usercopy_abort+0x9c/0xb0
Call Trace:
usercopy_abort+0x9c/0xb0 (unreliable)
__check_heap_object+0x1b4/0x1d0
__check_object_size+0x2d0/0x380
rtas_flash_write+0xe4/0x250
proc_reg_write+0xfc/0x160
vfs_write+0xfc/0x4e0
ksys_write+0x90/0x160
system_call_exception+0x178/0x320
system_call_common+0x160/0x2c4The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access.
--- arch/powerpc/kernel/rtas_flash.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/powerpc/kernel/rtas_flash.c +3 -3
@@ -714,9 +714,9 @@ static int __init rtas_flash_init(void)if (!rtas_validate_flash_data.buf)return -ENOMEM ; - flash_block_cache =kmem_cache_create ("rtas_flash_cache" , -RTAS_BLK_SIZE ,RTAS_BLK_SIZE ,0 , -NULL ); + flash_block_cache =kmem_cache_create_usercopy ("rtas_flash_cache" , +RTAS_BLK_SIZE ,RTAS_BLK_SIZE , +0 ,0 ,RTAS_BLK_SIZE ,NULL );if (!flash_block_cache) {printk (KERN_ERR "%s: failed to create block cache\n" , __func__);
Greg Kroah-Hartman
maintainerPATCH 51/129 btrfs: fix BUG_ON condition in btrfs_cancel_balance
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: xiaoshoukui <[email protected]>
commit 29eefa6d0d07e185f7bfe9576f91e6dba98189c2 upstream.
Pausing and canceling balance can race to interrupt balance lead to BUG_ON panic in btrfs_cancel_balance. The BUG_ON condition in btrfs_cancel_balance does not take this race scenario into account.
However, the race condition has no other side effects. We can fix that.
Reproducing it with panic trace like this:
kernel BUG at fs/btrfs/volumes.c:4618!
RIP: 0010:btrfs_cancel_balance+0x5cf/0x6a0 Call Trace: <TASK> ? do_nanosleep+0x60/0x120 ? hrtimer_nanosleep+0xb7/0x1a0 ? sched_core_clone_cookie+0x70/0x70 btrfs_ioctl_balance_ctl+0x55/0x70 btrfs_ioctl+0xa46/0xd20 __x64_sys_ioctl+0x7d/0xa0 do_syscall_64+0x38/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Race scenario as follows:
> mutex_unlock(&fs_info->balance_mutex);
> --------------------
> .......issue pause and cancel req in another thread
> --------------------
> ret = __btrfs_balance(fs_info);
>
> mutex_lock(&fs_info->balance_mutex);
> if (ret == -ECANCELED && atomic_read(&fs_info->balance_pause_req)) {
> btrfs_info(fs_info, "balance: paused");
> btrfs_exclop_balance(fs_info, BTRFS_EXCLOP_BALANCE_PAUSED);
> }--- fs/btrfs/volumes.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/volumes.c +1 -2
@@ -4106,8 +4106,7 @@ int btrfs_cancel_balance(struct btrfs_fs } } -BUG_ON (fs_info->balance_ctl || -test_bit (BTRFS_FS_BALANCE_RUNNING , &fs_info->flags)); +ASSERT (!test_bit (BTRFS_FS_BALANCE_RUNNING , &fs_info->flags));atomic_dec (&fs_info->balance_cancel_req);mutex_unlock (&fs_info->balance_mutex);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 52/129 net: xfrm: Fix xfrm_address_filter OOB read
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
We found below OOB crash:
[ 44.211730] ================================================================== [ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0 [ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97 [ 44.212045] [ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4 [ 44.212045] Call Trace: [ 44.212045] <TASK> [ 44.212045] dump_stack_lvl+0x37/0x50 [ 44.212045] print_report+0xcc/0x620 [ 44.212045] ? __virt_addr_valid+0xf3/0x170 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_report+0xb2/0xe0 [ 44.212045] ? memcmp+0x8b/0xb0 [ 44.212045] kasan_check_range+0x39/0x1c0 [ 44.212045] memcmp+0x8b/0xb0 [ 44.212045] xfrm_state_walk+0x21c/0x420 [ 44.212045] ? __pfx_dump_one_state+0x10/0x10 [ 44.212045] xfrm_dump_sa+0x1e2/0x290 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __kernel_text_address+0xd/0x40 [ 44.212045] ? kasan_unpoison+0x27/0x60 [ 44.212045] ? mutex_lock+0x60/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] ? __pfx_netlink_dump+0x10/0x10 [ 44.212045] ? mutex_unlock+0x7f/0xd0 [ 44.212045] ? __pfx_mutex_unlock+0x10/0x10 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10 [ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10 [ 44.212045] ? __stack_depot_save+0x382/0x4e0 [ 44.212045] ? filter_irq_stacks+0x1c/0x70 [ 44.212045] ? kasan_save_stack+0x32/0x50 [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? __kasan_slab_alloc+0x59/0x70 [ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260 [ 44.212045] ? kmalloc_reserve+0xab/0x120 [ 44.212045] ? __alloc_skb+0xcf/0x210 [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? netlink_sendmsg+0x509/0x700 [ 44.212045] ? sock_sendmsg+0xde/0xe0 [ 44.212045] ? __sys_sendto+0x18d/0x230 [ 44.212045] ? __x64_sys_sendto+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? kasan_save_stack+0x22/0x50 [ 44.212045] ? kasan_set_track+0x25/0x30 [ 44.212045] ? kasan_save_free_info+0x2e/0x50 [ 44.212045] ? __kasan_slab_free+0x10a/0x190 [ 44.212045] ? kmem_cache_free+0x9c/0x340 [ 44.212045] ? netlink_recvmsg+0x23c/0x660 [ 44.212045] ? sock_recvmsg+0xeb/0xf0 [ 44.212045] ? __sys_recvfrom+0x13c/0x1f0 [ 44.212045] ? __x64_sys_recvfrom+0x71/0x90 [ 44.212045] ? do_syscall_64+0x3f/0x90 [ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] ? copyout+0x3e/0x50 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 44.212045] ? __pfx_sock_has_perm+0x10/0x10 [ 44.212045] ? mutex_lock+0x8d/0xe0 [ 44.212045] ? __pfx_mutex_lock+0x10/0x10 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] ? __pfx_netlink_unicast+0x10/0x10 [ 44.212045] ? netlink_recvmsg+0x500/0x660 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] ? __pfx___sys_sendto+0x10/0x10 [ 44.212045] ? rcu_core+0x44a/0xe10 [ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740 [ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0 [ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10 [ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10 [ 44.212045] ? __pfx_task_work_run+0x10/0x10 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] RIP: 0033:0x44b7da [ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da [ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003 [ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c [ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001 [ 44.212045] </TASK> [ 44.212045] [ 44.212045] Allocated by task 97: [ 44.212045] kasan_save_stack+0x22/0x50 [ 44.212045] kasan_set_track+0x25/0x30 [ 44.212045] __kasan_kmalloc+0x7f/0x90 [ 44.212045] __kmalloc_node_track_caller+0x5b/0x140 [ 44.212045] kmemdup+0x21/0x50 [ 44.212045] xfrm_dump_sa+0x17d/0x290 [ 44.212045] netlink_dump+0x322/0x6c0 [ 44.212045] __netlink_dump_start+0x353/0x430 [ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410 [ 44.212045] netlink_rcv_skb+0xd6/0x210 [ 44.212045] xfrm_netlink_rcv+0x44/0x50 [ 44.212045] netlink_unicast+0x36f/0x4c0 [ 44.212045] netlink_sendmsg+0x3b7/0x700 [ 44.212045] sock_sendmsg+0xde/0xe0 [ 44.212045] __sys_sendto+0x18d/0x230 [ 44.212045] __x64_sys_sendto+0x71/0x90 [ 44.212045] do_syscall_64+0x3f/0x90 [ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc [ 44.212045] [ 44.212045] The buggy address belongs to the object at ffff88800870f300 [ 44.212045] which belongs to the cache kmalloc-64 of size 64 [ 44.212045] The buggy address is located 32 bytes inside of [ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324) [ 44.212045] [ 44.212045] The buggy address belongs to the physical page: [ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ... [ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1) [ 44.212045] page_type: 0xffffffff() [ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000 [ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 44.212045] page dumped because: kasan: bad access detected [ 44.212045] [ 44.212045] Memory state around the buggy address: [ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ^ [ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 44.212045] ==================================================================
By investigating the code, we find the root cause of this OOB is the lack of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states, the attacker can achieve 8 bytes heap OOB read, which causes info leak.
if (attrs[XFRMA_ADDRESS_FILTER]) {
filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
// NO MORE CHECKS HERE !!!
}This patch fixes the OOB by adding necessary boundary checks, just like the code in pfkey_dump() function.
--- net/xfrm/xfrm_user.c | 9 +++++++++ 1 file changed, 9 insertions(+)
net/xfrm/xfrm_user.c +9 -0
@@ -1036,6 +1036,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb) sizeof(*filter), GFP_KERNEL);if (filter ==NULL )return -ENOMEM ; + +/* see addr_match(), (prefix length >> 5) << 2 +* will be used to compare xfrm_address_t +*/ +if (filter->splen > (sizeof (xfrm_address_t) <<3 ) || + filter->dplen > (sizeof (xfrm_address_t) <<3 )) { +kfree (filter); +return -EINVAL ; + } }if (attrs[XFRMA_PROTO ])
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 53/129 net: af_key: fix sadb_x_filter validation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 75065a8929069bc93181848818e23f147a73f83a ]
When running xfrm_state_walk_init(), the xfrm_address_filter being used is okay to have a splen/dplen that equals to sizeof(xfrm_address_t)<<3. This commit replaces >= to > to make sure the boundary checking is correct.
--- net/key/af_key.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/key/af_key.c +2 -2
@@ -1858,9 +1858,9 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_msif (ext_hdrs[SADB_X_EXT_FILTER -1 ]) {struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER -1 ]; -if ((xfilter->sadb_x_filter_splen >= +if ((xfilter->sadb_x_filter_splen > (sizeof (xfrm_address_t) <<3 )) || - (xfilter->sadb_x_filter_dplen >= + (xfilter->sadb_x_filter_dplen > (sizeof (xfrm_address_t) <<3 ))) {mutex_unlock (&pfk->dump_lock);return -EINVAL ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 54/129 xfrm: interface: rename xfrm_interface.c to xfrm_interface_core.c
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eyal Birger <[email protected]>
[ Upstream commit ee9a113ab63468137802898bcd2c598998c96938 ]
This change allows adding additional files to the xfrm_interface module.
Stable-dep-of: 53223f2ed1ef ("xfrm: fix slab-use-after-free in decode_session6")
---
net/xfrm/Makefile | 2 ++
net/xfrm/{xfrm_interface.c => xfrm_interface_core.c} | 0
2 files changed, 2 insertions(+)
rename net/xfrm/{xfrm_interface.c => xfrm_interface_core.c} (100%)net/xfrm/Makefile +2 -0
@@ -3,6 +3,8 @@ # Makefile for the XFRM subsystem. # +xfrm_interface-$(CONFIG_XFRM_INTERFACE) += xfrm_interface_core.o + obj-$(CONFIG_XFRM) := xfrm_policy.o xfrm_state.o xfrm_hash.o \ xfrm_input.o xfrm_output.o \ xfrm_sysctl.o xfrm_replay.o xfrm_device.o
net/xfrm/xfrm_interface_core.c renamed from net/xfrm/xfrm_interface.c +0 -0
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 55/129 xfrm: fix slab-use-after-free in decode_session6
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 53223f2ed1ef5c90dad814daaaefea4e68a933c8 ]
When the xfrm device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when the xfrm device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff8881111458ef by task swapper/3/0 CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.4.0-next-20230707 #409 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 xfrmi_xmit+0x173/0x1ca0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1a/0x20 RIP: 0010:intel_idle_hlt+0x23/0x30 Code: 1f 84 00 00 00 00 00 f3 0f 1e fa 41 54 41 89 d4 0f 1f 44 00 00 66 90 0f 1f 44 00 00 0f 00 2d c4 9f ab 00 0f 1f 44 00 00 fb f4 <fa> 44 89 e0 41 5c c3 66 0f 1f 44 00 00 f3 0f 1e fa 41 54 41 89 d4 RSP: 0018:ffffc90000197d78 EFLAGS: 00000246 RAX: 00000000000a83c3 RBX: ffffe8ffffd09c50 RCX: ffffffff8a22d8e5 RDX: 0000000000000001 RSI: ffffffff8d3f8080 RDI: ffffe8ffffd09c50 RBP: ffffffff8d3f8080 R08: 0000000000000001 R09: ffffed1026ba6d9d R10: ffff888135d36ceb R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff8d3f8100 R14: 0000000000000001 R15: 0000000000000000 cpuidle_enter_state+0xd3/0x6f0 cpuidle_enter+0x4e/0xa0 do_idle+0x2fe/0x3c0 cpu_startup_entry+0x18/0x20 start_secondary+0x200/0x290 secondary_startup_64_no_verify+0x167/0x16b </TASK> Allocated by task 939: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 inet6_ifa_notify+0x118/0x230 __ipv6_ifa_notify+0x177/0xbe0 addrconf_dad_completed+0x133/0xe00 addrconf_dad_work+0x764/0x1390 process_one_work+0xa32/0x16f0 worker_thread+0x67d/0x10c0 kthread+0x344/0x440 ret_from_fork+0x1f/0x30 The buggy address belongs to the object at ffff888111145800
which belongs to the cache skbuff_small_head of size 640 The buggy address is located 239 bytes inside of freed 640-byte region [ffff888111145800, ffff888111145a80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/xfrm/xfrm_interface_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/xfrm/xfrm_interface_core.c +2 -2
@@ -354,8 +354,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)switch (skb->protocol) {case htons (ETH_P_IPV6 ): -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );if (!dst) { fl.u.ip6.flowi6_oif = dev->ifindex; fl.u.ip6.flowi6_flags |=FLOWI_FLAG_ANYSRC ;
@@ -369,8 +369,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev) }break ;case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );if (!dst) {struct rtable *rt;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 56/129 ip6_vti: fix slab-use-after-free in decode_session6
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 9fd41f1ba638938c9a1195d09bc6fa3be2712f25 ]
When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ipv6_vti device sends IPv6 packets.
The stack information is as follows:
BUG: KASAN: slab-use-after-free in decode_session6+0x103f/0x1890 Read of size 1 at addr ffff88802e08edc2 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-next-20230707-00001-g84e2cad7f979 #410 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc33 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0xd9/0x150 print_address_description.constprop.0+0x2c/0x3c0 kasan_report+0x11d/0x130 decode_session6+0x103f/0x1890 __xfrm_decode_session+0x54/0xb0 vti6_tnl_xmit+0x3e6/0x1ee0 dev_hard_start_xmit+0x187/0x700 sch_direct_xmit+0x1a3/0xc30 __qdisc_run+0x510/0x17a0 __dev_queue_xmit+0x2215/0x3b10 neigh_connected_output+0x3c2/0x550 ip6_finish_output2+0x55a/0x1550 ip6_finish_output+0x6b9/0x1270 ip6_output+0x1f1/0x540 ndisc_send_skb+0xa63/0x1890 ndisc_send_rs+0x132/0x6f0 addrconf_rs_timer+0x3f1/0x870 call_timer_fn+0x1a0/0x580 expire_timers+0x29b/0x4b0 run_timer_softirq+0x326/0x910 __do_softirq+0x1d4/0x905 irq_exit_rcu+0xb7/0x120 sysvec_apic_timer_interrupt+0x97/0xc0 </IRQ> Allocated by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 __kasan_slab_alloc+0x7f/0x90 kmem_cache_alloc_node+0x1cd/0x410 kmalloc_reserve+0x165/0x270 __alloc_skb+0x129/0x330 netlink_sendmsg+0x9b1/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 9176: kasan_save_stack+0x22/0x40 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x40 ____kasan_slab_free+0x160/0x1c0 slab_free_freelist_hook+0x11b/0x220 kmem_cache_free+0xf0/0x490 skb_free_head+0x17f/0x1b0 skb_release_data+0x59c/0x850 consume_skb+0xd2/0x170 netlink_unicast+0x54f/0x7f0 netlink_sendmsg+0x926/0xe30 sock_sendmsg+0xde/0x190 ____sys_sendmsg+0x739/0x920 ___sys_sendmsg+0x110/0x1b0 __sys_sendmsg+0xf7/0x1c0 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The buggy address belongs to the object at ffff88802e08ed00
which belongs to the cache skbuff_small_head of size 640 The buggy address is located 194 bytes inside of freed 640-byte region [ffff88802e08ed00, ffff88802e08ef80)
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv6/ip6_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv6/ip6_vti.c +2 -2
@@ -562,12 +562,12 @@ vti6_tnl_xmit(struct sk_buff *skb, struct net_device *dev) vti6_addr_conflict(t, ipv6_hdr(skb))) goto tx_err; -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;default : goto tx_err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 57/129 ip_vti: fix potential slab-use-after-free in decode_session6
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengchao Shao <[email protected]>
[ Upstream commit 6018a266279b1a75143c7c0804dd08a5fc4c3e0b ]
When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-after-free may occur when ip_vti device sends IPv6 packets. As commit f855691975bb ("xfrm6: Fix the nexthdr offset in _decode_session6.") showed, xfrm_decode_session was originally intended only for the receive path. IP6CB(skb)->nhoff is not set during transmission. Therefore, set the cb field in the skb to 0 before sending packets.
--- net/ipv4/ip_vti.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/ipv4/ip_vti.c +2 -2
@@ -319,12 +319,12 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)switch (skb->protocol) {case htons (ETH_P_IP ): -xfrm_decode_session (skb, &fl,AF_INET );memset (IPCB (skb),0 ,sizeof (*IPCB (skb))); +xfrm_decode_session (skb, &fl,AF_INET );break ;case htons (ETH_P_IPV6 ): -xfrm_decode_session (skb, &fl,AF_INET6 );memset (IP6CB (skb),0 ,sizeof (*IP6CB (skb))); +xfrm_decode_session (skb, &fl,AF_INET6 );break ;default : goto tx_err;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 58/129 xfrm: add NULL check in xfrm_update_ae_params
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
[ Upstream commit 00374d9b6d9f932802b55181be9831aa948e5b7c ]
Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below.
BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700
This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -521,7 +521,7 @@ static void xfrm_update_ae_params(struct xfrm_state *x, struct nlattr **attrs,struct nlattr *et = attrs[XFRMA_ETIMER_THRESH ];struct nlattr *rt = attrs[XFRMA_REPLAY_THRESH ]; -if (re) { +if (re && x->replay_esn && x->preplay_esn) {struct xfrm_replay_state_esn *replay_esn; replay_esn =nla_data (re); memcpy(x->replay_esn, replay_esn,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 59/129 selftests: mirror_gre_changes: Tighten up the TTL test match
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Machata <[email protected]>
[ Upstream commit 855067defa36b1f9effad8c219d9a85b655cf500 ]
This test verifies whether the encapsulated packets have the correct configured TTL. It does so by sending ICMP packets through the test topology and mirroring them to a gretap netdevice. On a busy host however, more than just the test ICMP packets may end up flowing through the topology, get mirrored, and counted. This leads to potential spurious failures as the test observes much more mirrored packets than the sent test packets, and assumes a bug.
Fix this by tightening up the mirror action match. Change it from matchall to a flower classifier matching on ICMP packets specifically.
--- tools/testing/selftests/net/forwarding/mirror_gre_changes.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/net/forwarding/mirror_gre_changes.sh +2 -1
@@ -72,7 +72,8 @@ test_span_gre_ttl() RET=0 - mirror_install $swp1 ingress $tundev "matchall $tcflags" + mirror_install $swp1 ingress $tundev \ + "prot ip flower $tcflags ip_prot icmp" tc filter add dev $h3 ingress pref 77 prot $prot \ flower ip_ttl 50 action pass
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 60/129 netfilter: nft_dynset: disallow object maps
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit 23185c6aed1ffb8fc44087880ba2767aba493779 ]
Do not allow to insert elements from datapath to objects maps.
--- net/netfilter/nft_dynset.c | 3 +++ 1 file changed, 3 insertions(+)
net/netfilter/nft_dynset.c +3 -0
@@ -144,6 +144,9 @@ static int nft_dynset_init(const struct nft_ctx *ctx,if (IS_ERR (set))return PTR_ERR (set); +if (set->flags &NFT_SET_OBJECT ) +return -EOPNOTSUPP ; +if (set->ops->update ==NULL )return -EOPNOTSUPP ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 61/129 team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <[email protected]>
[ Upstream commit dafcbce07136d799edc4c67f04f9fd69ff1eac1f ]
Similar to commit 01f4fd270870 ("bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves"), we can trigger BUG_ON(!vlan_info) in unregister_vlan_dev() with the following testcase:
# ip netns add ns1 # ip netns exec ns1 ip link add team1 type team # ip netns exec ns1 ip link add team_slave type veth peer veth2 # ip netns exec ns1 ip link set team_slave master team1 # ip netns exec ns1 ip link add link team_slave name team_slave.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link add link team1 name team1.10 type vlan id 10 protocol 802.1ad # ip netns exec ns1 ip link set team_slave nomaster # ip netns del ns1
Add S-VLAN tag related features support to team driver. So the team driver will always propagate the VLAN info to its slaves.
--- drivers/net/team/team.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/team/team.c +3 -1
@@ -2168,7 +2168,9 @@ static void team_setup(struct net_device *dev) dev->hw_features =TEAM_VLAN_FEATURES |NETIF_F_HW_VLAN_CTAG_RX | -NETIF_F_HW_VLAN_CTAG_FILTER ; +NETIF_F_HW_VLAN_CTAG_FILTER | +NETIF_F_HW_VLAN_STAG_RX | +NETIF_F_HW_VLAN_STAG_FILTER ; dev->hw_features |=NETIF_F_GSO_ENCAP_ALL |NETIF_F_GSO_UDP_L4 ; dev->features |= dev->hw_features;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 62/129 i40e: fix misleading debug logs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Staikov <[email protected]>
[ Upstream commit 2f2beb8874cb0844e84ad26e990f05f4f13ff63f ]
Change "write" into the actual "read" word.
Change parameters description.
--- drivers/net/ethernet/intel/i40e/i40e_nvm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/ethernet/intel/i40e/i40e_nvm.c +8 -8
@@ -210,11 +210,11 @@ static i40e_status i40e_read_nvm_word_srctl(struct i40e_hw *hw, u16 offset,* @hw: pointer to the HW structure. * @module_pointer: module pointer location in words from the NVM beginning * @offset: offset in words from module start -* @words: number of words to write -* @data: buffer with words to write to the Shadow RAM +* @words: number of words to read +* @data: buffer with words to read to the Shadow RAM * @last_command: tells the AdminQ that this is the last command * -* Writes a 16 bit words buffer to the Shadow RAM using the admin command. +* Reads a 16 bit words buffer to the Shadow RAM using the admin command. **/ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw, u8 module_pointer, u32 offset,
@@ -234,18 +234,18 @@ static i40e_status i40e_read_nvm_aq(struct i40e_hw *hw,*/ if ((offset + words) > hw->nvm.sr_size)i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: offset %d beyond Shadow RAM limit %d\n" , +"NVM read error: offset %d beyond Shadow RAM limit %d\n" , (offset + words), hw->nvm.sr_size);else if (words >I40E_SR_SECTOR_SIZE_IN_WORDS ) -/* We can write only up to 4KB (one sector), in one AQ write */ +/* We can read only up to 4KB (one sector), in one AQ write */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write fail error: tried to write %d words, limit is %d.\n" , +"NVM read fail error: tried to read %d words, limit is %d.\n" , words,I40E_SR_SECTOR_SIZE_IN_WORDS );else if (((offset + (words -1 )) /I40E_SR_SECTOR_SIZE_IN_WORDS ) != (offset /I40E_SR_SECTOR_SIZE_IN_WORDS )) -/* A single write cannot spread over two sectors */ +/* A single read cannot spread over two sectors */ i40e_debug (hw,I40E_DEBUG_NVM , -"NVM write error: cannot spread over two sectors in a single write offset=%d words=%d\n" , +"NVM read error: cannot spread over two sectors in a single read offset=%d words=%d\n" , offset, words);else ret_code = i40e_aq_read_nvm(hw, module_pointer,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 63/129 sock: Fix misuse of sk_under_memory_pressure()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abel Wu <[email protected]>
[ Upstream commit 2d0c88e84e483982067a82073f6125490ddf3614 ]
The status of global socket memory pressure is updated when:
a) __sk_mem_raise_allocated():
enter: sk_memory_allocated(sk) > sysctl_mem[1]
leave: sk_memory_allocated(sk) <= sysctl_mem[0]
b) __sk_mem_reduce_allocated():
leave: sk_under_memory_pressure(sk) && sk_memory_allocated(sk) < sysctl_mem[0]
So the conditions of leaving global pressure are inconstant, which may lead to the situation that one pressured net-memcg prevents the global pressure from being cleared when there is indeed no global pressure, thus the global constrains are still in effect unexpectedly on the other sockets.
This patch fixes this by ignoring the net-memcg's pressure when deciding whether should leave global memory pressure.
--- include/net/sock.h | 6 ++++++ net/core/sock.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-)
include/net/sock.h +6 -0
@@ -1265,6 +1265,12 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)return sk->sk_prot->memory_pressure !=NULL ; } +static inline bool sk_under_global_memory_pressure (const struct sock *sk) +{ +return sk->sk_prot->memory_pressure && + !!*sk->sk_prot->memory_pressure; +} +static inline bool sk_under_memory_pressure (const struct sock *sk) {if (!sk->sk_prot->memory_pressure)
net/core/sock.c +1 -1
@@ -2538,7 +2538,7 @@ void __sk_mem_reduce_allocated(struct sock *sk, int amount)if (mem_cgroup_sockets_enabled && sk->sk_memcg)mem_cgroup_uncharge_skmem (sk->sk_memcg, amount); -if (sk_under_memory_pressure (sk) && +if (sk_under_global_memory_pressure (sk) && (sk_memory_allocated (sk) <sk_prot_mem_limits (sk,0 )))sk_leave_memory_pressure (sk); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 64/129 net: do not allow gso_size to be set to GSO_BY_FRAGS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit b616be6b97688f2f2bd7c4a47ab32f27f94fb2a9 ]
One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1]
Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel.
[1]
general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550 __sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff27cdb34d9
--- include/linux/virtio_net.h | 4 ++++ 1 file changed, 4 insertions(+)
include/linux/virtio_net.h +4 -0
@@ -148,6 +148,10 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,if (gso_type &SKB_GSO_UDP ) nh_off -= thlen; +/* Kernel has a special handling for GSO_BY_FRAGS. */ +if (gso_size ==GSO_BY_FRAGS ) +return -EINVAL ; +/* Too small packets are not really GSO ones. */ if (skb->len - nh_off > gso_size) { shinfo->gso_size = gso_size;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 65/129 ASoC: rt5665: add missed regulator_bulk_disable
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit c163108e706909570f8aa9aa5bcf6806e2b4c98c ]
The driver forgets to call regulator_bulk_disable()
Add the missed call to fix it.
--- sound/soc/codecs/rt5665.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/rt5665.c +2 -0
@@ -4475,6 +4475,8 @@ static void rt5665_remove(struct snd_soc_component *component)struct rt5665_priv *rt5665 =snd_soc_component_get_drvdata (component);regmap_write (rt5665->regmap,RT5665_RESET ,0 ); + +regulator_bulk_disable (ARRAY_SIZE (rt5665->supplies), rt5665->supplies); }#ifdef CONFIG_PM
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 66/129 ASoC: meson: axg-tdm-formatter: fix channel slot allocation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <[email protected]>
[ Upstream commit c1f848f12103920ca165758aedb1c10904e193e1 ]
When the tdm lane mask is computed, the driver currently fills the 1st lane before moving on to the next. If the stream has less channels than the lanes can accommodate, slots will be disabled on the last lanes.
Unfortunately, the HW distribute channels in a different way. It distribute channels in pair on each lanes before moving on the next slots.
This difference leads to problems if a device has an interface with more than 1 lane and with more than 2 slots per lane.
For example: a playback interface with 2 lanes and 4 slots each (total 8 slots - zero based numbering)
- Playing a 8ch stream:
- All slots activated by the driver
- channel #2 will be played on lane #1 - slot #0 following HW placement
- Playing a 4ch stream:
- Lane #1 disabled by the driver
- channel #2 will be played on lane #0 - slot #2
This behaviour is obviously not desirable.
Change the way slots are activated on the TDM lanes to follow what the HW does and make sure each channel always get mapped to the same slot/lane.
--- sound/soc/meson/axg-tdm-formatter.c | 42 ++++++++++++++++++----------- 1 file changed, 26 insertions(+), 16 deletions(-)
sound/soc/meson/axg-tdm-formatter.c +26 -16
@@ -28,27 +28,32 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map, struct axg_tdm_stream *ts, unsigned int offset) { -unsigned int val, ch = ts->channels; -unsigned long mask; -int i, j; +unsigned int ch = ts->channels; +u32 val[AXG_TDM_NUM_LANES ]; +int i, j, k; + +/* +* We need to mimick the slot distribution used by the HW to keep the +* channel placement consistent regardless of the number of channel +* in the stream. This is why the odd algorithm below is used. +*/ +memset (val,0 ,sizeof (*val) *AXG_TDM_NUM_LANES );/* * Distribute the channels of the stream over the available slots -* of each TDM lane +* of each TDM lane. We need to go over the 32 slots ... */ -for (i =0 ; i <AXG_TDM_NUM_LANES ; i++) { - val =0 ; - mask = ts->mask[i]; - -for (j =find_first_bit (&mask,32 ); - (j <32 ) && ch; - j =find_next_bit (&mask,32 , j +1 )) { - val |=1 << j; - ch -=1 ; +for (i =0 ; (i <32 ) && ch; i +=2 ) { +/* ... of all the lanes ... */ +for (j =0 ; j <AXG_TDM_NUM_LANES ; j++) { +/* ... then distribute the channels in pairs */ +for (k =0 ; k <2 ; k++) { +if ((BIT (i + k) & ts->mask[j]) && ch) { + val[j] |=BIT (i + k); + ch -=1 ; + } + } } - -regmap_write (map, offset, val); - offset +=regmap_get_reg_stride (map); }/*
@@ -61,6 +66,11 @@ int axg_tdm_formatter_set_channel_masks(struct regmap *map,return -EINVAL ; } +for (i =0 ; i <AXG_TDM_NUM_LANES ; i++) { +regmap_write (map, offset, val[i]); + offset +=regmap_get_reg_stride (map); + } +return 0 ; }EXPORT_SYMBOL_GPL (axg_tdm_formatter_set_channel_masks);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 67/129 serial: 8250: Fix oops for port->pm on uart_change_pm()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
[ Upstream commit dfe2aeb226fd5e19b0ee795f4f6ed8bc494c1534 ]
Unloading a hardware specific 8250 driver can produce error "Unable to handle kernel paging request at virtual address" about ten seconds after unloading the driver. This happens on uart_hangup() calling uart_change_pm().
Turns out commit 04e82793f068 ("serial: 8250: Reinit port->pm on port specific driver unbind") was only a partial fix. If the hardware specific driver has initialized port->pm function, we need to clear port->pm too. Just reinitializing port->ops does not do this. Otherwise serial8250_pm() will call port->pm() instead of serial8250_do_pm().
--- drivers/tty/serial/8250/8250_port.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/8250/8250_port.c +1 -0
@@ -3224,6 +3224,7 @@ void serial8250_init_port(struct uart_8250_port *up)struct uart_port *port = &up->port;spin_lock_init (&port->lock); + port->pm =NULL ; port->ops = &serial8250_pops; up->cur_iotype =0xFF ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 68/129 ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: dengxiang <[email protected]>
commit 788449ae57f4273111b779bbcaad552b67f517d5 upstream.
This patch adds a USB quirk for Mythware XA001AU USB interface.
--- sound/usb/quirks-table.h | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
sound/usb/quirks-table.h +29 -0
@@ -3677,5 +3677,34 @@ ALC1220_VB_DESKTOP(0x26ce, 0x0a01), /* A } } }, +{ +/* Advanced modes of the Mythware XA001AU. +* For the standard mode, Mythware XA001AU has ID ffad:a001 +*/ + USB_DEVICE_VENDOR_SPEC(0xffad, 0xa001), + .driver_info = (unsigned long ) &(const struct snd_usb_audio_quirk ) { + .vendor_name ="Mythware" , + .product_name ="XA001AU" , + .ifnum =QUIRK_ANY_INTERFACE , + .type =QUIRK_COMPOSITE , + .data = (const struct snd_usb_audio_quirk []) { + { + .ifnum =0 , + .type =QUIRK_IGNORE_INTERFACE , + }, + { + .ifnum =1 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =2 , + .type =QUIRK_AUDIO_STANDARD_INTERFACE , + }, + { + .ifnum =-1 + } + } + } +}, #undef USB_DEVICE_VENDOR_SPEC
Greg Kroah-Hartman
maintainerPATCH 69/129 cifs: Release folio lock on fscache read hit.
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Harmon via samba-technical <[email protected]>
commit 69513dd669e243928f7450893190915a88f84a2b upstream.
Under the current code, when cifs_readpage_worker is called, the call contract is that the callee should unlock the page. This is documented in the read_folio section of Documentation/filesystems/vfs.rst as:
Quoted 2 lines
The filesystem should unlock the folio once the read has completed, whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during a read, the page lock is leaked, producing the following stack on subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack [<0>] folio_wait_bit_common+0x124/0x350 [<0>] filemap_read_folio+0xad/0xf0 [<0>] filemap_fault+0x8b1/0xab0 [<0>] __do_fault+0x39/0x150 [<0>] do_fault+0x25c/0x3e0 [<0>] __handle_mm_fault+0x6ca/0xc70 [<0>] handle_mm_fault+0xe9/0x350 [<0>] do_user_addr_fault+0x225/0x6c0 [<0>] exc_page_fault+0x84/0x1b0 [<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the page clean, but does not free the folio lock. This happens in __cifs_readpage_from_fscache on success. Releasing the lock at that point however is not appropriate as cifs_readahead also calls cifs_readpage_from_fscache and *does* unconditionally release the lock after its return. This change therefore effectively makes cifs_readpage_worker work like cifs_readahead.
--- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/file.c +1 -1
@@ -3991,9 +3991,9 @@ static int cifs_readpage_worker(struct f io_error:kunmap (page); -unlock_page (page); read_complete: +unlock_page (page);return rc; }
Greg Kroah-Hartman
maintainerPATCH 70/129 mmc: wbsd: fix double mmc_free_host() in wbsd_init()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
commit d83035433701919ac6db15f7737cbf554c36c1a6 upstream.
mmc_free_host() has already be called in wbsd_free_mmc(), remove the mmc_free_host() in error path in wbsd_init().
--- drivers/mmc/host/wbsd.c | 2 -- 1 file changed, 2 deletions(-)
drivers/mmc/host/wbsd.c +0 -2
@@ -1713,8 +1713,6 @@ static int wbsd_init(struct device *dev,wbsd_release_resources (host);wbsd_free_mmc (dev); - -mmc_free_host (mmc);return ret; }
Greg Kroah-Hartman
maintainerPATCH 71/129 test_firmware: prevent race conditions by a correct implementation of locking
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Goran Todorovac <[email protected]>
commit 4acfe3dfde685a5a9eaec5555351918e2d7266a1 upstream.
Dan Carpenter spotted a race condition in a couple of situations like these in the test_firmware driver:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
u8 val;
int ret;
ret = kstrtou8(buf, 10, &val);
if (ret)
return ret;
mutex_lock(&test_fw_mutex);
*(u8 *)cfg = val;
mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
}static ssize_t config_num_requests_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
int rc;
mutex_lock(&test_fw_mutex);
if (test_fw_config->reqs) {
pr_err("Must call release_all_firmware prior to changing config\n");
rc = -EINVAL;
mutex_unlock(&test_fw_mutex);
goto out;
}
mutex_unlock(&test_fw_mutex);
rc = test_dev_config_update_u8(buf, count,
&test_fw_config->num_requests);out:
return rc; }
static ssize_t config_read_fw_idx_store(struct device *dev,
struct device_attribute *attr, const char *buf, size_t count)
{
return test_dev_config_update_u8(buf, count,
&test_fw_config->read_fw_idx);
}
The function test_dev_config_update_u8() is called from both the locked and the unlocked context, function config_num_requests_store() and config_read_fw_idx_store() which can both be called asynchronously as they are driver's methods, while test_dev_config_update_u8() and siblings change their argument pointed to by u8 *cfg or similar pointer.
To avoid deadlock on test_fw_mutex, the lock is dropped before calling test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8() itself, but alas this creates a race condition.
Having two locks wouldn't assure a race-proof mutual exclusion.
This situation is best avoided by the introduction of a new, unlocked function __test_dev_config_update_u8() which can be called from the locked context and reducing test_dev_config_update_u8() to:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
int ret;
mutex_lock(&test_fw_mutex);
ret = __test_dev_config_update_u8(buf, size, cfg);
mutex_unlock(&test_fw_mutex);
return ret;
}doing the locking and calling the unlocked primitive, which enables both locked and unlocked versions without duplication of code.
The similar approach was applied to all functions called from the locked and the unlocked context, which safely mitigates both deadlocks and race conditions in the driver.
__test_dev_config_update_bool(), __test_dev_config_update_u8() and __test_dev_config_update_size_t() unlocked versions of the functions were introduced to be called from the locked contexts as a workaround without releasing the main driver's lock and thereof causing a race condition.
The test_dev_config_update_bool(), test_dev_config_update_u8() and test_dev_config_update_size_t() locked versions of the functions are being called from driver methods without the unnecessary multiplying of the locking and unlocking code for each method, and complicating the code with saving of the return value across lock.
--- lib/test_firmware.c | 37 ++++++++++++++++++++++++++++--------- 1 file changed, 28 insertions(+), 9 deletions(-)
lib/test_firmware.c +28 -9
@@ -284,16 +284,26 @@ static ssize_t config_test_show_str(charreturn len; } -static int test_dev_config_update_bool (const char *buf,size_t size, -bool *cfg) +static inline int __test_dev_config_update_bool (const char *buf,size_t size, +bool *cfg) {int ret; -mutex_lock (&test_fw_mutex);if (strtobool (buf, cfg) <0 ) ret = -EINVAL ;else ret = size; + +return ret; +} + +static int test_dev_config_update_bool (const char *buf,size_t size, +bool *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_bool (buf, size, cfg);mutex_unlock (&test_fw_mutex);return ret;
@@ -323,7 +333,7 @@ static ssize_t test_dev_config_show_int(return snprintf (buf,PAGE_SIZE ,"%d\n" , val); } -static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +static inline int __test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) {int ret;long new;
@@ -335,14 +345,23 @@ static int test_dev_config_update_u8(conif (new >U8_MAX )return -EINVAL ; -mutex_lock (&test_fw_mutex); *(u8 *)cfg = new; -mutex_unlock (&test_fw_mutex);/* Always return full write size even if we didn't consume all */ return size; } +static int test_dev_config_update_u8 (const char *buf,size_t size,u8 *cfg) +{ +int ret; + +mutex_lock (&test_fw_mutex); + ret =__test_dev_config_update_u8 (buf, size, cfg); +mutex_unlock (&test_fw_mutex); + +return ret; +} +static ssize_t test_dev_config_show_u8 (char *buf,u8 cfg) {u8 val;
@@ -375,10 +394,10 @@ static ssize_t config_num_requests_storemutex_unlock (&test_fw_mutex); goto out; } -mutex_unlock (&test_fw_mutex); - rc =test_dev_config_update_u8 (buf, count, - &test_fw_config->num_requests); + rc =__test_dev_config_update_u8 (buf, count, + &test_fw_config->num_requests); +mutex_unlock (&test_fw_mutex); out:return rc;
Greg Kroah-Hartman
maintainerPATCH 72/129 netfilter: set default timeout to 3 secs for sctp shutdown send and recv state
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
commit 9bfab6d23a2865966a4f89a96536fbf23f83bc8c upstream.
In SCTP protocol, it is using the same timer (T2 timer) for SHUTDOWN and SHUTDOWN_ACK retransmission. However in sctp conntrack the default timeout value for SCTP_CONNTRACK_SHUTDOWN_ACK_SENT state is 3 secs while it's 300 msecs for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV state.
As Paolo Valerio noticed, this might cause unwanted expiration of the ct entry. In my test, with 1s tc netem delay set on the NAT path, after the SHUTDOWN is sent, the sctp ct entry enters SCTP_CONNTRACK_SHUTDOWN_SEND state. However, due to 300ms (too short) delay, when the SHUTDOWN_ACK is sent back from the peer, the sctp ct entry has expired and been deleted, and then the SHUTDOWN_ACK has to be dropped.
Also, it is confusing these two sysctl options always show 0 due to all timeout values using sec as unit:
net.netfilter.nf_conntrack_sctp_timeout_shutdown_recd = 0 net.netfilter.nf_conntrack_sctp_timeout_shutdown_sent = 0
This patch fixes it by also using 3 secs for sctp shutdown send and recv state in sctp conntrack, which is also RTO.initial value in SCTP protocol.
Note that the very short time value for SCTP_CONNTRACK_SHUTDOWN_SEND/RECV was probably used for a rare scenario where SHUTDOWN is sent on 1st path but SHUTDOWN_ACK is replied on 2nd path, then a new connection started immediately on 1st path. So this patch also moves from SHUTDOWN_SEND/RECV to CLOSE when receiving INIT in the ORIGINAL direction.
--- net/netfilter/nf_conntrack_proto_sctp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/netfilter/nf_conntrack_proto_sctp.c +3 -3
@@ -58,8 +58,8 @@ static const unsigned int sctp_timeouts[ [SCTP_CONNTRACK_COOKIE_WAIT] = 3 SECS, [SCTP_CONNTRACK_COOKIE_ECHOED] = 3 SECS, [SCTP_CONNTRACK_ESTABLISHED] = 5 DAYS, - [SCTP_CONNTRACK_SHUTDOWN_SENT] = 300 SECS / 1000, - [SCTP_CONNTRACK_SHUTDOWN_RECD] = 300 SECS / 1000, + [SCTP_CONNTRACK_SHUTDOWN_SENT] = 3 SECS, + [SCTP_CONNTRACK_SHUTDOWN_RECD] = 3 SECS, [SCTP_CONNTRACK_SHUTDOWN_ACK_SENT] = 3 SECS, [SCTP_CONNTRACK_HEARTBEAT_SENT] = 30 SECS, [SCTP_CONNTRACK_HEARTBEAT_ACKED] = 210 SECS,
@@ -119,7 +119,7 @@ static const u8 sctp_conntracks[2][11][S {/* ORIGINAL */ /* sNO, sCL, sCW, sCE, sES, sSS, sSR, sSA, sHS, sHA */ -/* init */ {sCW, sCW, sCW, sCE, sES, sSS, sSR, sSA, sCW, sHA}, +/* init */ {sCW, sCW, sCW, sCE, sES, sCL, sCL, sSA, sCW, sHA}, /* init_ack */ {sCL, sCL, sCW, sCE, sES, sSS, sSR, sSA, sCL, sHA}, /* abort */ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL}, /* shutdown */ {sCL, sCL, sCW, sCE, sSS, sSS, sSR, sSA, sCL, sSS},
Greg Kroah-Hartman
maintainerPATCH 73/129 af_unix: Fix null-ptr-deref in unix_stream_sendpage().
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
Bing-Jhong Billy Jheng reported null-ptr-deref in unix_stream_sendpage() with detailed analysis and a nice repro.
unix_stream_sendpage() tries to add data to the last skb in the peer's recv queue without locking the queue.
If the peer's FD is passed to another socket and the socket's FD is passed to the peer, there is a loop between them. If we close both sockets without receiving FD, the sockets will be cleaned up by garbage collection.
The garbage collection iterates such sockets and unlinks skb with FD from the socket's receive queue under the queue's lock.
So, there is a race where unix_stream_sendpage() could access an skb locklessly that is being released by garbage collection, resulting in use-after-free.
To avoid the issue, unix_stream_sendpage() must lock the peer's recv queue.
Note the issue does not exist in 6.5+ thanks to the recent sendpage() refactoring.
This patch is originally written by Linus Torvalds.
BUG: unable to handle page fault for address: ffff988004dd6870
PF: supervisor read access in kernel mode
PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
PREEMPT SMP PTI
CPU: 4 PID: 297 Comm: garbage_uaf Not tainted 6.1.46 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:kmem_cache_alloc_node+0xa2/0x1e0 Code: c0 0f 84 32 01 00 00 41 83 fd ff 74 10 48 8b 00 48 c1 e8 3a 41 39 c5 0f 85 1c 01 00 00 41 8b 44 24 28 49 8b 3c 24 48 8d 4a 40 <49> 8b 1c 06 4c 89 f0 65 48 0f c7 0f 0f 94 c0 84 c0 74 a1 41 8b 44 RSP: 0018:ffffc9000079fac0 EFLAGS: 00000246 RAX: 0000000000000070 RBX: 0000000000000005 RCX: 000000000001a284 RDX: 000000000001a244 RSI: 0000000000400cc0 RDI: 000000000002eee0 RBP: 0000000000400cc0 R08: 0000000000400cc0 R09: 0000000000000003 R10: 0000000000000001 R11: 0000000000000000 R12: ffff888003970f00 R13: 00000000ffffffff R14: ffff988004dd6800 R15: 00000000000000e8 FS: 00007f174d6f3600(0000) GS:ffff88807db00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff988004dd6870 CR3: 00000000092be000 CR4: 00000000007506e0 PKRU: 55555554 Call Trace: <TASK> ? __die_body.cold+0x1a/0x1f ? page_fault_oops+0xa9/0x1e0 ? fixup_exception+0x1d/0x310 ? exc_page_fault+0xa8/0x150 ? asm_exc_page_fault+0x22/0x30 ? kmem_cache_alloc_node+0xa2/0x1e0 ? __alloc_skb+0x16c/0x1e0 __alloc_skb+0x16c/0x1e0 alloc_skb_with_frags+0x48/0x1e0 sock_alloc_send_pskb+0x234/0x270 unix_stream_sendmsg+0x1f5/0x690 sock_sendmsg+0x5d/0x60 ____sys_sendmsg+0x210/0x260 ___sys_sendmsg+0x83/0xd0 ? kmem_cache_alloc+0xc6/0x1c0 ? avc_disable+0x20/0x20 ? percpu_counter_add_batch+0x53/0xc0 ? alloc_empty_file+0x5d/0xb0 ? alloc_file+0x91/0x170 ? alloc_file_pseudo+0x94/0x100 ? __fget_light+0x9f/0x120 __sys_sendmsg+0x54/0xa0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x69/0xd3 RIP: 0033:0x7f174d639a7d Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 8a c1 f4 ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 33 44 89 c7 48 89 44 24 08 e8 de c1 f4 ff 48 RSP: 002b:00007ffcb563ea50 EFLAGS: 00000293 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f174d639a7d RDX: 0000000000000000 RSI: 00007ffcb563eab0 RDI: 0000000000000007 RBP: 00007ffcb563eb10 R08: 0000000000000000 R09: 00000000ffffffff R10: 00000000004040a0 R11: 0000000000000293 R12: 00007ffcb563ec28 R13: 0000000000401398 R14: 0000000000403e00 R15: 00007f174d72c000 </TASK>
--- net/unix/af_unix.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
net/unix/af_unix.c +4 -5
@@ -1984,6 +1984,7 @@ static ssize_t unix_stream_sendpage(struif (false) { alloc_skb: +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock); newskb = sock_alloc_send_pskb(sk, 0, 0, flags & MSG_DONTWAIT,
@@ -2023,6 +2024,7 @@ alloc_skb: init_scm = false; } +spin_lock (&other->sk_receive_queue.lock); skb =skb_peek_tail (&other->sk_receive_queue);if (tail && tail == skb) { skb = newskb;
@@ -2053,14 +2055,11 @@ alloc_skb:refcount_add (size, &sk->sk_wmem_alloc);if (newskb) { - err =unix_scm_to_skb (&scm, skb, false); -if (err) - goto err_state_unlock; -spin_lock (&other->sk_receive_queue.lock); +unix_scm_to_skb (&scm, skb, false);__skb_queue_tail (&other->sk_receive_queue, newskb); -spin_unlock (&other->sk_receive_queue.lock); } +spin_unlock (&other->sk_receive_queue.lock);unix_state_unlock (other);mutex_unlock (&unix_sk (other)->iolock);
Greg Kroah-Hartman
maintainerPATCH 74/129 virtio-net: set queues after driver_ok
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Wang <[email protected]>
commit 51b813176f098ff61bd2833f627f5319ead098a5 upstream.
Commit 25266128fe16 ("virtio-net: fix race between set queues and probe") tries to fix the race between set queues and probe by calling _virtnet_set_queues() before DRIVER_OK is set. This violates virtio spec. Fixing this by setting queues after virtio_device_ready().
Note that rtnl needs to be held for userspace requests to change the number of queues. So we are serialized in this way.
--- drivers/net/virtio_net.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/virtio_net.c +2 -2
@@ -3120,8 +3120,6 @@ static int virtnet_probe(struct virtio_d } } -_virtnet_set_queues (vi, vi->curr_queue_pairs); -/* serialize netdev register + virtio_device_ready() with ndo_open() */ rtnl_lock ();
@@ -3134,6 +3132,8 @@ static int virtnet_probe(struct virtio_dvirtio_device_ready (vdev); +_virtnet_set_queues (vi, vi->curr_queue_pairs); +rtnl_unlock (); err =virtnet_cpu_notif_add (vi);
Greg Kroah-Hartman
maintainerPATCH 75/129 bus: ti-sysc: Flush posted write on enable before reset
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <[email protected]>
commit 34539b442b3bc7d5bf10164750302b60b91f18a7 upstream.
The am335x devices started producing boot errors for resetting musb module in because of subtle timing changes:
Unhandled fault: external abort on non-linefetch (0x1008)
...sysc_poll_reset_sysconfig from sysc_reset+0x109/0x12 sysc_reset from sysc_probe+0xa99/0xeb0
...
The fix is to flush posted write after enable before reset during probe. Note that some devices also need to specify the delay after enable with ti,sysc-delay-us, but this is not needed for musb on am335x based on my tests.
--- drivers/bus/ti-sysc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/bus/ti-sysc.c +2 -0
@@ -978,6 +978,8 @@ static int sysc_reset(struct sysc *ddata val =sysc_read (ddata, offset); val |= (0x1 << ddata->cap->regbits->srst_shift);sysc_write (ddata, offset, val); +/* Flush posted write */ + val =sysc_read_sysconfig (ddata);/* Poll on reset status */ offset = ddata->offsets[SYSC_SYSSTATUS ];
Greg Kroah-Hartman
maintainerPATCH 76/129 net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Xing <[email protected]>
commit e4dd0d3a2f64b8bd8029ec70f52bdbebd0644408 upstream.
In the real workload, I encountered an issue which could cause the RTO timer to retransmit the skb per 1ms with linear option enabled. The amount of lost-retransmitted skbs can go up to 1000+ instantly.
The root cause is that if the icsk_rto happens to be zero in the 6th round (which is the TCP_THIN_LINEAR_RETRIES value), then it will always be zero due to the changed calculation method in tcp_retransmit_timer() as follows:
icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
Above line could be converted toicsk->icsk_rto = min(0 << 1, TCP_RTO_MAX) = 0
Therefore, the timer expires so quickly without any doubt.
I read through the RFC 6298 and found that the RTO value can be rounded up to a certain value, in Linux, say TCP_RTO_MIN as default, which is regarded as the lower bound in this patch as suggested by Eric.
--- net/ipv4/tcp_timer.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/ipv4/tcp_timer.c +3 -1
@@ -549,7 +549,9 @@ out_reset_timer: tcp_stream_is_thin(tp) && icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) { icsk->icsk_backoff = 0; - icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX); + icsk->icsk_rto = clamp(__tcp_set_rto(tp), + tcp_rto_min(sk), + TCP_RTO_MAX); } else {/* Use normal (exponential) backoff */ icsk->icsk_rto =min (icsk->icsk_rto <<1 ,TCP_RTO_MAX );
Greg Kroah-Hartman
maintainerPATCH 77/129 net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <[email protected]>
commit d1e0e61d617ba17aa516db707aa871387566bbf7 upstream.
According to all consumers code of attrs[XFRMA_SEC_CTX], like
* verify_sec_ctx_len(), convert to xfrm_user_sec_ctx*
* xfrm_state_construct(), call security_xfrm_state_alloc whose prototype is int security_xfrm_state_alloc(.., struct xfrm_user_sec_ctx *sec_ctx);
* copy_from_user_sec_ctx(), convert to xfrm_user_sec_ctx *
...
It seems that the expected parsing result for XFRMA_SEC_CTX should be structure xfrm_user_sec_ctx, and the current xfrm_sec_ctx is confusing and misleading (Luckily, they happen to have same size 8 bytes).
This commit amend the policy structure to xfrm_user_sec_ctx to avoid ambiguity.
--- net/xfrm/xfrm_user.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/xfrm/xfrm_user.c +1 -1
@@ -2582,7 +2582,7 @@ static const struct nla_policy xfrma_pol [XFRMA_ALG_COMP] = { .len = sizeof(struct xfrm_algo) }, [XFRMA_ENCAP] = { .len = sizeof(struct xfrm_encap_tmpl) }, [XFRMA_TMPL] = { .len = sizeof(struct xfrm_user_tmpl) }, - [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_sec_ctx) }, + [XFRMA_SEC_CTX] = { .len = sizeof(struct xfrm_user_sec_ctx) }, [XFRMA_LTIME_VAL] = { .len = sizeof(struct xfrm_lifetime_cur) }, [XFRMA_REPLAY_VAL] = { .len = sizeof(struct xfrm_replay_state) }, [XFRMA_REPLAY_THRESH] = { .type = NLA_U32 },
Greg Kroah-Hartman
maintainerPATCH 78/129 net: phy: broadcom: stub c45 read/write for 54810
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Chen <[email protected]>
commit 096516d092d54604d590827d05b1022c8f326639 upstream.
The 54810 does not support c45. The mmd_phy_indirect accesses return arbirtary values leading to odd behavior like saying it supports EEE when it doesn't. We also see that reading/writing these non-existent MMD registers leads to phy instability in some cases.
--- drivers/net/phy/broadcom.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/net/phy/broadcom.c +13 -0
@@ -421,6 +421,17 @@ static int bcm5482_read_status(struct phreturn err; } +static int bcm54810_read_mmd (struct phy_device *phydev,int devnum,u16 regnum) +{ +return -EOPNOTSUPP ; +} + +static int bcm54810_write_mmd (struct phy_device *phydev,int devnum,u16 regnum, +u16 val) +{ +return -EOPNOTSUPP ; +} +static int bcm5481_config_aneg (struct phy_device *phydev) {struct device_node *np = phydev->mdio.dev.of_node;
@@ -684,6 +695,8 @@ static struct phy_driver broadcom_driver .name = "Broadcom BCM54810", .features = PHY_GBIT_FEATURES, .flags = PHY_HAS_INTERRUPT, + .read_mmd = bcm54810_read_mmd, + .write_mmd = bcm54810_write_mmd, .config_init = bcm54xx_config_init, .config_aneg = bcm5481_config_aneg, .ack_interrupt = bcm_phy_ack_intr,
Greg Kroah-Hartman
maintainerPATCH 79/129 PCI: acpiphp: Reassign resources on bridge if necessary
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Mammedov <[email protected]>
[ Upstream commit 40613da52b13fb21c5566f10b287e0ca8c12c4e9 ]
When using ACPI PCI hotplug, hotplugging a device with large BARs may fail if bridge windows programmed by firmware are not large enough.
Reproducer:
$ qemu-kvm -monitor stdio -M q35 -m 4G \
-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=on \
-device id=rp1,pcie-root-port,bus=pcie.0,chassis=4 \
disk_image wait till linux guest boots, then hotplug device:
(qemu) device_add qxl,bus=rp1
hotplug on guest side fails with:
pci 0000:01:00.0: [1b36:0100] type 00 class 0x038000 pci 0000:01:00.0: reg 0x10: [mem 0x00000000-0x03ffffff] pci 0000:01:00.0: reg 0x14: [mem 0x00000000-0x03ffffff] pci 0000:01:00.0: reg 0x18: [mem 0x00000000-0x00001fff] pci 0000:01:00.0: reg 0x1c: [io 0x0000-0x001f]
pci 0000:01:00.0: BAR 0: no space for [mem size 0x04000000] pci 0000:01:00.0: BAR 0: failed to assign [mem size 0x04000000] pci 0000:01:00.0: BAR 1: no space for [mem size 0x04000000] pci 0000:01:00.0: BAR 1: failed to assign [mem size 0x04000000] pci 0000:01:00.0: BAR 2: assigned [mem 0xfe800000-0xfe801fff] pci 0000:01:00.0: BAR 3: assigned [io 0x1000-0x101f] qxl 0000:01:00.0: enabling device (0000 -> 0003) Unable to create vram_mapping
qxl: probe of 0000:01:00.0 failed with error -12
However when using native PCIe hotplug
'-global ICH9-LPC.acpi-pci-hotplug-with-bridge-support=off'
it works fine, since kernel attempts to reassign unused resources.
Use the same machinery as native PCIe hotplug to (re)assign resources.
--- drivers/pci/hotplug/acpiphp_glue.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
drivers/pci/hotplug/acpiphp_glue.c +1 -4
@@ -496,7 +496,6 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)acpiphp_native_scan_bridge (dev); } }else { -LIST_HEAD (add_list);int max, pass;acpiphp_rescan_slot (slot);
@@ -510,12 +509,10 @@ static void enable_slot(struct acpiphp_slot *slot, bool bridge)if (pass && dev->subordinate) {check_hotplug_bridge (slot, dev);pcibios_resource_survey_bus (dev->subordinate); -__pci_bus_size_bridges (dev->subordinate, - &add_list); } } } -__pci_bus_assign_resources (bus, &add_list,NULL ); +pci_assign_unassigned_bridge_resources (bus->self); }acpiphp_sanitize_bus (bus);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 80/129 dlm: improve plock logging if interrupted
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit bcfad4265cedf3adcac355e994ef9771b78407bd ]
This patch changes the log level if a plock is removed when interrupted from debug to info. Additional it signals now that the plock entity was removed to let the user know what's happening.
If on a dev_write() a pending plock cannot be find it will signal that it might have been removed because wait interruption.
Before this patch there might be a "dev_write no op ..." info message and the users can only guess that the plock was removed before because the wait interruption. To be sure that is the case we log both messages on the same log level.
Let both message be logged on info layer because it should not happened a lot and if it happens it should be clear why the op was not found.
Stable-dep-of: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
--- fs/dlm/plock.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
fs/dlm/plock.c +5 -4
@@ -164,11 +164,12 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, rv =wait_event_killable (recv_wq, (op->done !=0 ));if (rv == -ERESTARTSYS ) { -log_debug (ls,"%s: wait killed %llx" , __func__, - (unsigned long long )number);spin_lock (&ops_lock);list_del (&op->list);spin_unlock (&ops_lock); +log_print ("%s: wait interrupted %x %llx, op removed" , + __func__, ls->ls_global_id, + (unsigned long long )number);dlm_release_plock_op (op);do_unlock_close (ls, number, file, fl); goto out;
@@ -472,8 +473,8 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,else wake_up (&recv_wq); }else -log_print ("dev_write no op %x %llx" , info.fsid, - (unsigned long long )info.number); +log_print ("%s: no op %x %llx - may got interrupted?" , __func__, + info.fsid, (unsigned long long )info.number);return count; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 81/129 dlm: replace usage of found with dedicated list iterator variable
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakob Koschel <[email protected]>
[ Upstream commit dc1acd5c94699389a9ed023e94dd860c846ea1f6 ]
To move the list iterator variable into the list_for_each_entry_*() macro in the future it should be avoided to use the list iterator variable after the loop body.
To *never* use the list iterator variable after the loop it was concluded to use a separate iterator variable instead of a found boolean [1].
This removes the need to use a found variable and simply checking if the variable was set, can determine if the break/goto was hit.
Stable-dep-of: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
--- fs/dlm/lock.c | 53 +++++++++++++++++++++++------------------------- fs/dlm/plock.c | 24 +++++++++++----------- fs/dlm/recover.c | 39 +++++++++++++++++------------------ 3 files changed, 56 insertions(+), 60 deletions(-)
fs/dlm/lock.c +25 -28
@@ -1858,7 +1858,7 @@ static void del_timeout(struct dlm_lkb *lkb)void dlm_scan_timeout (struct dlm_ls *ls) {struct dlm_rsb *r; -struct dlm_lkb *lkb; +struct dlm_lkb *lkb =NULL , *iter;int do_cancel, do_warn;s64 wait_us;
@@ -1869,27 +1869,28 @@ void dlm_scan_timeout(struct dlm_ls *ls) do_cancel =0 ; do_warn =0 ;mutex_lock (&ls->ls_timeout_mutex); -list_for_each_entry (lkb, &ls->ls_timeout, lkb_time_list) { +list_for_each_entry (iter, &ls->ls_timeout, lkb_time_list) { wait_us =ktime_to_us (ktime_sub (ktime_get (), - lkb->lkb_timestamp)); + iter->lkb_timestamp)); -if ((lkb->lkb_exflags &DLM_LKF_TIMEOUT ) && - wait_us >= (lkb->lkb_timeout_cs *10000 )) +if ((iter->lkb_exflags &DLM_LKF_TIMEOUT ) && + wait_us >= (iter->lkb_timeout_cs *10000 )) do_cancel =1 ; -if ((lkb->lkb_flags &DLM_IFL_WATCH_TIMEWARN ) && +if ((iter->lkb_flags &DLM_IFL_WATCH_TIMEWARN ) && wait_us >= dlm_config.ci_timewarn_cs *10000 ) do_warn =1 ;if (!do_cancel && !do_warn)continue ; -hold_lkb (lkb); +hold_lkb (iter); + lkb = iter;break ; }mutex_unlock (&ls->ls_timeout_mutex); -if (!do_cancel && !do_warn) +if (!lkb)break ; r = lkb->lkb_resource;
@@ -5243,21 +5244,18 @@ void dlm_recover_waiters_pre(struct dlm_ls *ls)static struct dlm_lkb *find_resend_waiter (struct dlm_ls *ls) { -struct dlm_lkb *lkb; -int found =0 ; +struct dlm_lkb *lkb =NULL , *iter;mutex_lock (&ls->ls_waiters_mutex); -list_for_each_entry (lkb, &ls->ls_waiters, lkb_wait_reply) { -if (lkb->lkb_flags &DLM_IFL_RESEND ) { -hold_lkb (lkb); - found =1 ; +list_for_each_entry (iter, &ls->ls_waiters, lkb_wait_reply) { +if (iter->lkb_flags &DLM_IFL_RESEND ) { +hold_lkb (iter); + lkb = iter;break ; } }mutex_unlock (&ls->ls_waiters_mutex); -if (!found) - lkb =NULL ;return lkb; }
@@ -5916,37 +5914,36 @@ int dlm_user_adopt_orphan(struct dlm_ls *ls, struct dlm_user_args *ua_tmp, int mode, uint32_t flags, void *name, unsigned int namelen, unsigned long timeout_cs, uint32_t *lkid) { - struct dlm_lkb *lkb; + struct dlm_lkb *lkb = NULL, *iter;struct dlm_user_args *ua;int found_other_mode =0 ; -int found =0 ;int rv =0 ;mutex_lock (&ls->ls_orphans_mutex); -list_for_each_entry (lkb, &ls->ls_orphans, lkb_ownqueue) { -if (lkb->lkb_resource->res_length != namelen) +list_for_each_entry (iter, &ls->ls_orphans, lkb_ownqueue) { +if (iter->lkb_resource->res_length != namelen)continue ; -if (memcmp (lkb->lkb_resource->res_name, name, namelen)) +if (memcmp (iter->lkb_resource->res_name, name, namelen))continue ; -if (lkb->lkb_grmode != mode) { +if (iter->lkb_grmode != mode) { found_other_mode =1 ;continue ; } - found =1 ; -list_del_init (&lkb->lkb_ownqueue); - lkb->lkb_flags &= ~DLM_IFL_ORPHAN ; - *lkid = lkb->lkb_id; + lkb = iter; +list_del_init (&iter->lkb_ownqueue); + iter->lkb_flags &= ~DLM_IFL_ORPHAN ; + *lkid = iter->lkb_id;break ; }mutex_unlock (&ls->ls_orphans_mutex); -if (!found && found_other_mode) { +if (!lkb && found_other_mode) { rv = -EAGAIN ; goto out; } -if (!found) { +if (!lkb) { rv = -ENOENT ; goto out; }
fs/dlm/plock.c +12 -12
@@ -437,9 +437,9 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,static ssize_t dev_write (struct file *file,const char __user *u,size_t count,loff_t *ppos) { +struct plock_op *op =NULL , *iter;struct dlm_plock_info info; -struct plock_op *op; -int found =0 , do_callback =0 ; +int do_callback =0 ;if (count !=sizeof (info))return -EINVAL ;
@@ -451,23 +451,23 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,return -EINVAL ;spin_lock (&ops_lock); -list_for_each_entry (op, &recv_list, list) { -if (op->info.fsid == info.fsid && - op->info.number == info.number && - op->info.owner == info.owner) { -list_del_init (&op->list); -memcpy (&op->info, &info,sizeof (info)); -if (op->data) +list_for_each_entry (iter, &recv_list, list) { +if (iter->info.fsid == info.fsid && + iter->info.number == info.number && + iter->info.owner == info.owner) { +list_del_init (&iter->list); +memcpy (&iter->info, &info,sizeof (info)); +if (iter->data) do_callback =1 ;else - op->done =1 ; - found =1 ; + iter->done =1 ; + op = iter;break ; } }spin_unlock (&ops_lock); -if (found) { +if (op) {if (do_callback)dlm_plock_callback (op);else
fs/dlm/recover.c +19 -20
@@ -734,10 +734,9 @@ void dlm_recovered_lock(struct dlm_rsb *r)static void recover_lvb (struct dlm_rsb *r) { -struct dlm_lkb *lkb, *high_lkb =NULL ; +struct dlm_lkb *big_lkb =NULL , *iter, *high_lkb =NULL ;uint32_t high_seq =0 ;int lock_lvb_exists =0 ; -int big_lock_exists =0 ;int lvblen = r->res_ls->ls_lvblen; if (!rsb_flag(r, RSB_NEW_MASTER2) &&
@@ -753,37 +752,37 @@ static void recover_lvb(struct dlm_rsb *r)/* we are the new master, so figure out if VALNOTVALID should be set, and set the rsb lvb from the best lkb available. */ -list_for_each_entry (lkb, &r->res_grantqueue, lkb_statequeue) { -if (!(lkb->lkb_exflags &DLM_LKF_VALBLK )) +list_for_each_entry (iter, &r->res_grantqueue, lkb_statequeue) { +if (!(iter->lkb_exflags &DLM_LKF_VALBLK ))continue ; lock_lvb_exists =1 ; -if (lkb->lkb_grmode >DLM_LOCK_CR ) { - big_lock_exists =1 ; +if (iter->lkb_grmode >DLM_LOCK_CR ) { + big_lkb = iter; goto setflag; } -if (((int )lkb->lkb_lvbseq - (int )high_seq) >=0 ) { - high_lkb = lkb; - high_seq = lkb->lkb_lvbseq; +if (((int )iter->lkb_lvbseq - (int )high_seq) >=0 ) { + high_lkb = iter; + high_seq = iter->lkb_lvbseq; } } -list_for_each_entry (lkb, &r->res_convertqueue, lkb_statequeue) { -if (!(lkb->lkb_exflags &DLM_LKF_VALBLK )) +list_for_each_entry (iter, &r->res_convertqueue, lkb_statequeue) { +if (!(iter->lkb_exflags &DLM_LKF_VALBLK ))continue ; lock_lvb_exists =1 ; -if (lkb->lkb_grmode >DLM_LOCK_CR ) { - big_lock_exists =1 ; +if (iter->lkb_grmode >DLM_LOCK_CR ) { + big_lkb = iter; goto setflag; } -if (((int )lkb->lkb_lvbseq - (int )high_seq) >=0 ) { - high_lkb = lkb; - high_seq = lkb->lkb_lvbseq; +if (((int )iter->lkb_lvbseq - (int )high_seq) >=0 ) { + high_lkb = iter; + high_seq = iter->lkb_lvbseq; } }
@@ -792,7 +791,7 @@ static void recover_lvb(struct dlm_rsb *r) goto out;/* lvb is invalidated if only NL/CR locks remain */ -if (!big_lock_exists) +if (!big_lkb)rsb_set_flag (r,RSB_VALNOTVALID );if (!r->res_lvbptr) {
@@ -801,9 +800,9 @@ static void recover_lvb(struct dlm_rsb *r) goto out; } -if (big_lock_exists) { - r->res_lvbseq = lkb->lkb_lvbseq; -memcpy (r->res_lvbptr, lkb->lkb_lvbptr, lvblen); +if (big_lkb) { + r->res_lvbseq = big_lkb->lkb_lvbseq; +memcpy (r->res_lvbptr, big_lkb->lkb_lvbptr, lvblen); }else if (high_lkb) { r->res_lvbseq = high_lkb->lkb_lvbseq;memcpy (r->res_lvbptr, high_lkb->lkb_lvbptr, lvblen);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 82/129 fs: dlm: add pid to debug log
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 19d7ca051d303622c423b4cb39e6bde5d177328b ]
This patch adds the pid information which requested the lock operation to the debug log output.
Stable-dep-of: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
--- fs/dlm/plock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/dlm/plock.c +2 -2
@@ -167,9 +167,9 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,spin_lock (&ops_lock);list_del (&op->list);spin_unlock (&ops_lock); -log_print ("%s: wait interrupted %x %llx, op removed" , +log_print ("%s: wait interrupted %x %llx pid %d, op removed" , __func__, ls->ls_global_id, - (unsigned long long )number); + (unsigned long long )number, op->info.pid);dlm_release_plock_op (op);do_unlock_close (ls, number, file, fl); goto out;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 83/129 fs: dlm: change plock interrupted message to debug again
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit ea06d4cabf529eefbe7e89e3a8325f1f89355ccd ]
This patch reverses the commit bcfad4265ced ("dlm: improve plock logging if interrupted") by moving it to debug level and notifying the user an op was removed.
Stable-dep-of: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
--- fs/dlm/plock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/dlm/plock.c +2 -2
@@ -167,7 +167,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file,spin_lock (&ops_lock);list_del (&op->list);spin_unlock (&ops_lock); -log_print ("%s: wait interrupted %x %llx pid %d, op removed" , +log_debug (ls,"%s: wait interrupted %x %llx pid %d" , __func__, ls->ls_global_id, (unsigned long long )number, op->info.pid);dlm_release_plock_op (op);
@@ -473,7 +473,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,else wake_up (&recv_wq); }else -log_print ("%s: no op %x %llx - may got interrupted?" , __func__, +log_print ("%s: no op %x %llx" , __func__, info.fsid, (unsigned long long )info.number);return count; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 84/129 fs: dlm: use dlm_plock_info for do_unlock_close
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 4d413ae9ced4180c0e2114553c3a7560b509b0f8 ]
This patch refactors do_unlock_close() by using only struct dlm_plock_info as a parameter.
Stable-dep-of: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
--- fs/dlm/plock.c | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-)
fs/dlm/plock.c +6 -10
@@ -83,8 +83,7 @@ static void send_op(struct plock_op *op)abandoned waiter. So, we have to insert the unlock-close when the lock call is interrupted. */ -static void do_unlock_close (struct dlm_ls *ls,u64 number, -struct file *file,struct file_lock *fl) +static void do_unlock_close (const struct dlm_plock_info *info) {struct plock_op *op;
@@ -93,15 +92,12 @@ static void do_unlock_close(struct dlm_ls *ls, u64 number,return ; op->info.optype =DLM_PLOCK_OP_UNLOCK ; - op->info.pid = fl->fl_pid; - op->info.fsid = ls->ls_global_id; - op->info.number = number; + op->info.pid = info->pid; + op->info.fsid = info->fsid; + op->info.number = info->number; op->info.start =0 ; op->info.end =OFFSET_MAX ; -if (fl->fl_lmops && fl->fl_lmops->lm_grant) - op->info.owner = (__u64 ) fl->fl_pid; -else - op->info.owner = (__u64 )(long ) fl->fl_owner; + op->info.owner = info->owner; op->info.flags |=DLM_PLOCK_FL_CLOSE ;send_op (op);
@@ -171,7 +167,7 @@ int dlm_posix_lock(dlm_lockspace_t *lockspace, u64 number, struct file *file, __func__, ls->ls_global_id, (unsigned long long)number, op->info.pid);dlm_release_plock_op (op); -do_unlock_close (ls, number, file, fl); +do_unlock_close (&op->info); goto out; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 85/129 fs: dlm: fix mismatch of plock results from userspace
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <[email protected]>
[ Upstream commit 57e2c2f2d94cfd551af91cedfa1af6d972487197 ]
When a waiting plock request (F_SETLKW) is sent to userspace for processing (dlm_controld), the result is returned at a later time. That result could be incorrectly matched to a different waiting request in cases where the owner field is the same (e.g. different threads in a process.) This is fixed by comparing all the properties in the request and reply.
The results for non-waiting plock requests are now matched based on list order because the results are returned in the same order they were sent.
--- fs/dlm/plock.c | 58 +++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 45 insertions(+), 13 deletions(-)
fs/dlm/plock.c +45 -13
@@ -408,7 +408,7 @@ static ssize_t dev_read(struct file *file, char __user *u, size_t count,if (op->info.flags &DLM_PLOCK_FL_CLOSE )list_del (&op->list);else -list_move (&op->list, &recv_list); +list_move_tail (&op->list, &recv_list);memcpy (&info, &op->info,sizeof (info)); }spin_unlock (&ops_lock);
@@ -446,20 +446,52 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count,if (check_version (&info))return -EINVAL ; +/* +* The results for waiting ops (SETLKW) can be returned in any +* order, so match all fields to find the op. The results for +* non-waiting ops are returned in the order that they were sent +* to userspace, so match the result with the first non-waiting op. +*/ spin_lock (&ops_lock); -list_for_each_entry (iter, &recv_list, list) { -if (iter->info.fsid == info.fsid && - iter->info.number == info.number && - iter->info.owner == info.owner) { -list_del_init (&iter->list); -memcpy (&iter->info, &info,sizeof (info)); -if (iter->data) - do_callback =1 ; -else - iter->done =1 ; - op = iter; -break ; +if (info.wait) { +list_for_each_entry (iter, &recv_list, list) { +if (iter->info.fsid == info.fsid && + iter->info.number == info.number && + iter->info.owner == info.owner && + iter->info.pid == info.pid && + iter->info.start == info.start && + iter->info.end == info.end && + iter->info.ex == info.ex && + iter->info.wait) { + op = iter; +break ; + } } + }else { +list_for_each_entry (iter, &recv_list, list) { +if (!iter->info.wait) { + op = iter; +break ; + } + } + } + +if (op) { +/* Sanity check that op and info match. */ +if (info.wait) +WARN_ON (op->info.optype !=DLM_PLOCK_OP_LOCK ); +else +WARN_ON (op->info.fsid != info.fsid || + op->info.number != info.number || + op->info.owner != info.owner || + op->info.optype != info.optype); + +list_del_init (&op->list); +memcpy (&op->info, &info,sizeof (info)); +if (op->data) + do_callback =1 ; +else + op->done =1 ; }spin_unlock (&ops_lock);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 86/129 MIPS: cpu-features: Enable octeon_cache by cpu_type
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
[ Upstream commit f641519409a73403ee6612b8648b95a688ab85c2 ]
cpu_has_octeon_cache was tied to 0 for generic cpu-features, whith this generic kernel built for octeon CPU won't boot.
Just enable this flag by cpu_type. It won't hurt orther platforms because compiler will eliminate the code path on other processors.
Stable-dep-of: 5487a7b60695 ("MIPS: cpu-features: Use boot_cpu_type for CPU type based features")
--- arch/mips/include/asm/cpu-features.h | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-)
arch/mips/include/asm/cpu-features.h +18 -1
@@ -111,7 +111,24 @@#define cpu_has_tx39_cache __opt(MIPS_CPU_TX39_CACHE)#endif #ifndef cpu_has_octeon_cache -#define cpu_has_octeon_cache 0 +#define cpu_has_octeon_cache \ +({ \ + int __res; \ + \ + switch (current_cpu_type()) { \ + case CPU_CAVIUM_OCTEON: \ + case CPU_CAVIUM_OCTEON_PLUS: \ + case CPU_CAVIUM_OCTEON2: \ + case CPU_CAVIUM_OCTEON3: \ + __res = 1; \ + break; \ + \ + default: \ + __res = 0; \ + } \ + \ + __res; \ +})#endif /* Don't override `cpu_has_fpu' to 1 or the "nofpu" option won't work. */ #ifndef cpu_has_fpu
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 87/129 MIPS: cpu-features: Use boot_cpu_type for CPU type based features
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
[ Upstream commit 5487a7b60695a92cf998350e4beac17144c91fcd ]
Some CPU feature macros were using current_cpu_type to mark feature availability.
However current_cpu_type will use smp_processor_id, which is prohibited under preemptable context.
Since those features are all uniform on all CPUs in a SMP system, use boot_cpu_type instead of current_cpu_type to fix preemptable kernel.
--- arch/mips/include/asm/cpu-features.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/mips/include/asm/cpu-features.h +2 -2
@@ -115,7 +115,7 @@ ({ \ int __res; \ \ - switch (current_cpu_type()) { \ + switch (boot_cpu_type()) { \ case CPU_CAVIUM_OCTEON: \ case CPU_CAVIUM_OCTEON_PLUS: \ case CPU_CAVIUM_OCTEON2: \
@@ -349,7 +349,7 @@ ({ \ int __res; \ \ - switch (current_cpu_type()) { \ + switch (boot_cpu_type()) { \ case CPU_M14KC: \ case CPU_74K: \ case CPU_1074K: \
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 88/129 Revert "tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <[email protected]>
[ Upstream commit 4e9679738a918d8a482ac6a2cb2bb871f094bb84 ]
Revert commit b4b844930f27 ("tty: serial: fsl_lpuart: drop earlycon entry for i.MX8QXP"), because this breaks earlycon support on imx8qm/imx8qxp. While it is true that for earlycon there is no difference between i.MX8QXP and i.MX7ULP (for now at least), there are differences regarding clocks and fixups for wakeup support. For that reason it was deemed unacceptable to add the imx7ulp compatible to device tree in order to get earlycon working again.
Stable-dep-of: e0edfdc15863 ("tty: serial: fsl_lpuart: add earlycon for imx8ulp platform")
--- drivers/tty/serial/fsl_lpuart.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/fsl_lpuart.c +1 -0
@@ -2136,6 +2136,7 @@ static int __init lpuart32_imx_early_console_setup(struct earlycon_device *devicOF_EARLYCON_DECLARE (lpuart,"fsl,vf610-lpuart" , lpuart_early_console_setup);OF_EARLYCON_DECLARE (lpuart32,"fsl,ls1021a-lpuart" , lpuart32_early_console_setup);OF_EARLYCON_DECLARE (lpuart32,"fsl,imx7ulp-lpuart" , lpuart32_imx_early_console_setup); +OF_EARLYCON_DECLARE (lpuart32,"fsl,imx8qxp-lpuart" , lpuart32_imx_early_console_setup);EARLYCON_DECLARE (lpuart, lpuart_early_console_setup);EARLYCON_DECLARE (lpuart32, lpuart32_early_console_setup);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 89/129 tty: serial: fsl_lpuart: add earlycon for imx8ulp platform
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Sun <[email protected]>
[ Upstream commit e0edfdc15863ec80a1d9ac6e174dbccc00206dd0 ]
Add earlycon support for imx8ulp platform.
--- drivers/tty/serial/fsl_lpuart.c | 1 + 1 file changed, 1 insertion(+)
drivers/tty/serial/fsl_lpuart.c +1 -0
@@ -2136,6 +2136,7 @@ static int __init lpuart32_imx_early_console_setup(struct earlycon_device *devicOF_EARLYCON_DECLARE (lpuart,"fsl,vf610-lpuart" , lpuart_early_console_setup);OF_EARLYCON_DECLARE (lpuart32,"fsl,ls1021a-lpuart" , lpuart32_early_console_setup);OF_EARLYCON_DECLARE (lpuart32,"fsl,imx7ulp-lpuart" , lpuart32_imx_early_console_setup); +OF_EARLYCON_DECLARE (lpuart32,"fsl,imx8ulp-lpuart" , lpuart32_imx_early_console_setup);OF_EARLYCON_DECLARE (lpuart32,"fsl,imx8qxp-lpuart" , lpuart32_imx_early_console_setup);EARLYCON_DECLARE (lpuart, lpuart_early_console_setup);EARLYCON_DECLARE (lpuart32, lpuart32_early_console_setup);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 90/129 fbdev: Improve performance of sys_imageblit()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 6f29e04938bf509fccfad490a74284cf158891ce ]
Improve the performance of sys_imageblit() by manually unrolling the inner blitting loop and moving some invariants out. The compiler failed to do this automatically. The resulting binary code was even slower than the cfb_imageblit() helper, which uses the same algorithm, but operates on I/O memory.
A microbenchmark measures the average number of CPU cycles for sys_imageblit() after a stabilizing period of a few minutes (i7-4790, FullHD, simpledrm, kernel with debugging). The value for CFB is given as a reference.
sys_imageblit(), new: 25934 cycles
sys_imageblit(), old: 35944 cycles
cfb_imageblit(): 30566 cycles
In the optimized case, sys_imageblit() is now ~30% faster than before and ~20% faster than cfb_imageblit().
v2:
* move switch out of inner loop (Gerd)
* remove test for alignment of dst1 (Sam)
Stable-dep-of: c2d22806aecb ("fbdev: fix potential OOB read in fast_imageblit()")
--- drivers/video/fbdev/core/sysimgblt.c | 49 +++++++++++++++++++++------- 1 file changed, 38 insertions(+), 11 deletions(-)
drivers/video/fbdev/core/sysimgblt.c +38 -11
@@ -188,23 +188,29 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, {u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;u32 ppw =32 /bpp, spitch = (image->width +7 )/8 ; -u32 bit_mask, end_mask, eorx, shift; +u32 bit_mask, eorx;const char *s = image->data, *src;u32 *dst; -const u32 *tab =NULL ; +const u32 *tab; +size_t tablen; +u32 colortab[16 ];int i, j, k;switch (bpp) {case 8 : tab =fb_be_math (p) ? cfb_tab8_be : cfb_tab8_le; + tablen =16 ;break ;case 16 : tab =fb_be_math (p) ? cfb_tab16_be : cfb_tab16_le; + tablen =4 ;break ;case 32 : -default : tab = cfb_tab32; + tablen =2 ;break ; +default : +return ; }for (i = ppw-1 ; i--; ) {
@@ -218,19 +224,40 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, eorx = fgx ^ bgx; k = image->width/ppw; +for (i =0 ; i < tablen; ++i) + colortab[i] = (tab[i] & eorx) ^ bgx; +for (i = image->height; i--; ) { dst = dst1; - shift =8 ; src = s; -for (j = k; j--; ) { - shift -= ppw; - end_mask = tab[(*src >> shift) & bit_mask]; - *dst++ = (end_mask & eorx) ^ bgx; -if (!shift) { - shift =8 ; - src++; +switch (ppw) { +case 4 :/* 8 bpp */ +for (j = k; j; j -=2 , ++src) { + *dst++ = colortab[(*src >>4 ) & bit_mask]; + *dst++ = colortab[(*src >>0 ) & bit_mask]; + } +break ; +case 2 :/* 16 bpp */ +for (j = k; j; j -=4 , ++src) { + *dst++ = colortab[(*src >>6 ) & bit_mask]; + *dst++ = colortab[(*src >>4 ) & bit_mask]; + *dst++ = colortab[(*src >>2 ) & bit_mask]; + *dst++ = colortab[(*src >>0 ) & bit_mask]; + } +break ; +case 1 :/* 32 bpp */ +for (j = k; j; j -=8 , ++src) { + *dst++ = colortab[(*src >>7 ) & bit_mask]; + *dst++ = colortab[(*src >>6 ) & bit_mask]; + *dst++ = colortab[(*src >>5 ) & bit_mask]; + *dst++ = colortab[(*src >>4 ) & bit_mask]; + *dst++ = colortab[(*src >>3 ) & bit_mask]; + *dst++ = colortab[(*src >>2 ) & bit_mask]; + *dst++ = colortab[(*src >>1 ) & bit_mask]; + *dst++ = colortab[(*src >>0 ) & bit_mask]; } +break ; } dst1 += p->fix.line_length; s += spitch;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 91/129 fbdev: Fix sys_imageblit() for arbitrary image widths
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <[email protected]>
[ Upstream commit 61bfcb6a3b981e8f19e044ac8c3de6edbe6caf70 ]
Commit 6f29e04938bf ("fbdev: Improve performance of sys_imageblit()") broke sys_imageblit() for image width that are not aligned to 8-bit boundaries. Fix this by handling the trailing pixels on each line separately. The performance improvements in the original commit do not regress by this change.
Stable-dep-of: c2d22806aecb ("fbdev: fix potential OOB read in fast_imageblit()")
--- drivers/video/fbdev/core/sysimgblt.c | 29 ++++++++++++++++++++++++---- 1 file changed, 25 insertions(+), 4 deletions(-)
drivers/video/fbdev/core/sysimgblt.c +25 -4
@@ -188,7 +188,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, {u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;u32 ppw =32 /bpp, spitch = (image->width +7 )/8 ; -u32 bit_mask, eorx; +u32 bit_mask, eorx, shift;const char *s = image->data, *src;u32 *dst;const u32 *tab;
@@ -229,17 +229,23 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,for (i = image->height; i--; ) { dst = dst1; + shift =8 ; src = s; +/* +* Manually unroll the per-line copying loop for better +* performance. This works until we processed the last +* completely filled source byte (inclusive). +*/ switch (ppw) {case 4 :/* 8 bpp */ -for (j = k; j; j -=2 , ++src) { +for (j = k; j >=2 ; j -=2 , ++src) { *dst++ = colortab[(*src >>4 ) & bit_mask]; *dst++ = colortab[(*src >>0 ) & bit_mask]; }break ;case 2 :/* 16 bpp */ -for (j = k; j; j -=4 , ++src) { +for (j = k; j >=4 ; j -=4 , ++src) { *dst++ = colortab[(*src >>6 ) & bit_mask]; *dst++ = colortab[(*src >>4 ) & bit_mask]; *dst++ = colortab[(*src >>2 ) & bit_mask];
@@ -247,7 +253,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, }break ;case 1 :/* 32 bpp */ -for (j = k; j; j -=8 , ++src) { +for (j = k; j >=8 ; j -=8 , ++src) { *dst++ = colortab[(*src >>7 ) & bit_mask]; *dst++ = colortab[(*src >>6 ) & bit_mask]; *dst++ = colortab[(*src >>5 ) & bit_mask];
@@ -259,6 +265,21 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p, }break ; } + +/* +* For image widths that are not a multiple of 8, there +* are trailing pixels left on the current line. Print +* them as well. +*/ +for (; j--; ) { + shift -= ppw; + *dst++ = colortab[(*src >> shift) & bit_mask]; +if (!shift) { + shift =8 ; + ++src; + } + } + dst1 += p->fix.line_length; s += spitch; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 92/129 fbdev: fix potential OOB read in fast_imageblit()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <[email protected]>
[ Upstream commit c2d22806aecb24e2de55c30a06e5d6eb297d161d ]
There is a potential OOB read at fast_imageblit, for "colortab[(*src >> 4)]" can become a negative value due to "const char *s = image->data, *src".
This change makes sure the index for colortab always positive or zero.
Similar commit:
https://patchwork.kernel.org/patch/11746067
Potential bug report:
https://groups.google.com/g/syzkaller-bugs/c/9ubBXKeKXf4/m/k-QXy4UgAAAJ
--- drivers/video/fbdev/core/sysimgblt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/video/fbdev/core/sysimgblt.c +1 -1
@@ -189,7 +189,7 @@ static void fast_imageblit(const struct fb_image *image, struct fb_info *p,u32 fgx = fgcolor, bgx = bgcolor, bpp = p->var.bits_per_pixel;u32 ppw =32 /bpp, spitch = (image->width +7 )/8 ;u32 bit_mask, eorx, shift; -const char *s = image->data, *src; +const u8 *s = image->data, *src;u32 *dst;const u32 *tab;size_t tablen;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 93/129 powerpc/32: add stack protector support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <[email protected]>
[ Upstream commit c3ff2a5193fa61b1b284cfb1d79628814ed0e95a ]
This functionality was tentatively added in the past (commit 6533b7c16ee5 ("powerpc: Initial stack protector (-fstack-protector) support")) but had to be reverted (commit f2574030b0e3 ("powerpc: Revert the initial stack protector support") because of GCC implementing it differently whether it had been built with libc support or not.
Now, GCC offers the possibility to manually set the stack-protector mode (global or tls) regardless of libc support.
This time, the patch selects HAVE_STACKPROTECTOR only if -mstack-protector-guard=tls is supported by GCC.
On PPC32, as register r2 points to current task_struct at
all time, the stack_canary located inside task_struct can be used directly by using the following GCC options:
-mstack-protector-guard=tls
-mstack-protector-guard-reg=r2 -mstack-protector-guard-offset=offsetof(struct task_struct, stack_canary))
The protector is disabled for prom_init and bootx_init as it is too early to handle it properly.
$ echo CORRUPT_STACK > /sys/kernel/debug/provoke-crash/DIRECT [ 134.943666] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: lkdtm_CORRUPT_STACK+0x64/0x64 [ 134.943666] [ 134.955414] CPU: 0 PID: 283 Comm: sh Not tainted 4.18.0-s3k-dev-12143-ga3272be41209 #835 [ 134.963380] Call Trace: [ 134.965860] [c6615d60] [c001f76c] panic+0x118/0x260 (unreliable) [ 134.971775] [c6615dc0] [c001f654] panic+0x0/0x260 [ 134.976435] [c6615dd0] [c032c368] lkdtm_CORRUPT_STACK_STRONG+0x0/0x64 [ 134.982769] [c6615e00] [ffffffff] 0xffffffff
Stable-dep-of: 25ea739ea1d4 ("powerpc: Fail build if using recordmcount with binutils v2.37")
--- arch/powerpc/Kconfig | 1 + arch/powerpc/Makefile | 10 +++++++ arch/powerpc/include/asm/stackprotector.h | 34 +++++++++++++++++++++++ arch/powerpc/kernel/Makefile | 2 ++ arch/powerpc/kernel/asm-offsets.c | 3 ++ arch/powerpc/platforms/powermac/Makefile | 1 + 6 files changed, 51 insertions(+) create mode 100644 arch/powerpc/include/asm/stackprotector.h
arch/powerpc/Kconfig +1 -0
@@ -181,6 +181,7 @@ config PPC select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_TRACEHOOK select HAVE_CBPF_JIT if !PPC64 + select HAVE_STACKPROTECTOR if $(cc-option,-mstack-protector-guard=tls) && PPC32 select HAVE_CONTEXT_TRACKING if PPC64 select HAVE_DEBUG_KMEMLEAK select HAVE_DEBUG_STACKOVERFLOW
arch/powerpc/Makefile +10 -0
@@ -113,6 +113,9 @@ KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION) KBUILD_ARFLAGS += --target=elf$(BITS)-$(GNUTARGET) endif +cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard=tls +cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r2 + LDFLAGS_vmlinux-y := -Bstatic LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie LDFLAGS_vmlinux := $(LDFLAGS_vmlinux-y)
@@ -419,6 +422,13 @@ archclean: archprepare: checkbin +ifdef CONFIG_STACKPROTECTOR +prepare: stack_protector_prepare + +stack_protector_prepare: prepare0 + $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h)) +endif + # Use the file '.tmp_gas_check' for binutils tests, as gas won't output # to stdout and these checks are run even on install targets. TOUT := .tmp_gas_check
arch/powerpc/include/asm/stackprotector.h new file +34 -0
@@ -0,0 +1,34 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* +* GCC stack protector support. +* +*/ + +#ifndef _ASM_STACKPROTECTOR_H +#define _ASM_STACKPROTECTOR_H + +#include <linux/random.h> +#include <linux/version.h> +#include <asm/reg.h> +#include <asm/current.h> + +/* +* Initialize the stackprotector canary value. +* +* NOTE: this must only be called from functions that never return, +* and it must always be inlined. +*/ +static __always_inline void boot_init_stack_canary(void) +{ +unsigned long canary; + +/* Try to get a semi random initial value. */ + canary =get_random_canary (); + canary ^=mftb (); + canary ^=LINUX_VERSION_CODE ; + canary &=CANARY_MASK ; + + current->stack_canary = canary; +} + +#endif /* _ASM_STACKPROTECTOR_H */
arch/powerpc/kernel/Makefile +2 -0
@@ -21,6 +21,8 @@ CFLAGS_prom_init.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_btext.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) CFLAGS_prom.o += $(DISABLE_LATENT_ENTROPY_PLUGIN) +CFLAGS_prom_init.o += $(call cc-option, -fno-stack-protector) + ifdef CONFIG_FUNCTION_TRACER # Do not trace early boot code CFLAGS_REMOVE_cputable.o = $(CC_FLAGS_FTRACE)
arch/powerpc/kernel/asm-offsets.c +3 -0
@@ -79,6 +79,9 @@ int main(void) {OFFSET (THREAD , task_struct, thread);OFFSET (MM , task_struct, mm); +#ifdef CONFIG_STACKPROTECTOR +OFFSET (TASK_CANARY , task_struct, stack_canary); +#endif OFFSET (MMCONTEXTID , mm_struct, context.id);#ifdef CONFIG_PPC64 DEFINE (SIGSEGV ,SIGSEGV );
arch/powerpc/platforms/powermac/Makefile +1 -0
@@ -1,5 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 CFLAGS_bootx_init.o += -fPIC +CFLAGS_bootx_init.o += $(call cc-option, -fno-stack-protector) ifdef CONFIG_FUNCTION_TRACER # Do not trace early boot code
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 94/129 powerpc: remove leftover code of old GCC version checks
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <[email protected]>
[ Upstream commit bad96de8d31ba65dc26645af5550135315ea0b19 ]
Clean up the leftover of commit f2910f0e6835 ("powerpc: remove old GCC version checks").
Stable-dep-of: 25ea739ea1d4 ("powerpc: Fail build if using recordmcount with binutils v2.37")
--- arch/powerpc/Makefile | 8 -------- 1 file changed, 8 deletions(-)
arch/powerpc/Makefile +0 -8
@@ -429,10 +429,6 @@ stack_protector_prepare: prepare0 $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h)) endif -# Use the file '.tmp_gas_check' for binutils tests, as gas won't output -# to stdout and these checks are run even on install targets. -TOUT := .tmp_gas_check - # Check toolchain versions: # - gcc-4.6 is the minimum kernel-wide version so nothing required. checkbin:
@@ -443,7 +439,3 @@ checkbin: echo -n '*** Please use a different binutils version.' ; \ false ; \ fi - - -CLEAN_FILES += $(TOUT) -
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 95/129 powerpc: Fail build if using recordmcount with binutils v2.37
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Naveen N Rao <[email protected]>
[ Upstream commit 25ea739ea1d4d3de41acc4f4eb2d1a97eee0eb75 ]
binutils v2.37 drops unused section symbols, which prevents recordmcount from capturing mcount locations in sections that have no non-weak symbols. This results in a build failure with a message such as:
Cannot find symbol for section 12: .text.perf_callchain_kernel. kernel/events/callchain.o: failed
The change to binutils was reverted for v2.38, so this behavior is specific to binutils v2.37:
https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=c09c8b42021180eee9495bd50d8b35e683d3901b
Objtool is able to cope with such sections, so this issue is specific to recordmcount.
Fail the build and print a warning if binutils v2.37 is detected and if we are using recordmcount.
--- arch/powerpc/Makefile | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/powerpc/Makefile +8 -0
@@ -439,3 +439,11 @@ checkbin: echo -n '*** Please use a different binutils version.' ; \ false ; \ fi + @if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \ + "x${CONFIG_LD_IS_BFD}" = "xy" -a \ + "${CONFIG_LD_VERSION}" = "23700" ; then \ + echo -n '*** binutils 2.37 drops unused section symbols, which recordmcount ' ; \ + echo 'is unable to handle.' ; \ + echo '*** Please use a different binutils version.' ; \ + false ; \ + fi
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 96/129 dm integrity: increase RECALC_SECTORS to improve recalculate speed
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit b1a2b9332050c7ae32a22c2c74bc443e39f37b23 ]
Increase RECALC_SECTORS because it improves recalculate speed slightly (from 390kiB/s to 410kiB/s).
Stable-dep-of: 6d50eb472593 ("dm integrity: reduce vmalloc space footprint on 32-bit architectures")
--- drivers/md/dm-integrity.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-integrity.c +1 -1
@@ -33,7 +33,7 @@#define MIN_LOG2_INTERLEAVE_SECTORS 3#define MAX_LOG2_INTERLEAVE_SECTORS 31#define METADATA_WORKQUEUE_MAX_ACTIVE 16 -#define RECALC_SECTORS 8192 +#define RECALC_SECTORS 32768#define RECALC_WRITE_SUPER 16/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 97/129 dm integrity: reduce vmalloc space footprint on 32-bit architectures
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <[email protected]>
[ Upstream commit 6d50eb4725934fd22f5eeccb401000687c790fd0 ]
It was reported that dm-integrity runs out of vmalloc space on 32-bit architectures. On x86, there is only 128MiB vmalloc space and dm-integrity consumes it quickly because it has a 64MiB journal and 8MiB recalculate buffer.
Fix this by reducing the size of the journal to 4MiB and the size of the recalculate buffer to 1MiB, so that multiple dm-integrity devices can be created and activated on 32-bit architectures.
--- drivers/md/dm-integrity.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/md/dm-integrity.c +2 -2
@@ -29,11 +29,11 @@#define DEFAULT_BUFFER_SECTORS 128#define DEFAULT_JOURNAL_WATERMARK 50#define DEFAULT_SYNC_MSEC 10000 -#define DEFAULT_MAX_JOURNAL_SECTORS 131072 +#define DEFAULT_MAX_JOURNAL_SECTORS (IS_ENABLED(CONFIG_64BIT) ? 131072 : 8192)#define MIN_LOG2_INTERLEAVE_SECTORS 3#define MAX_LOG2_INTERLEAVE_SECTORS 31#define METADATA_WORKQUEUE_MAX_ACTIVE 16 -#define RECALC_SECTORS 32768 +#define RECALC_SECTORS (IS_ENABLED(CONFIG_64BIT) ? 32768 : 2048)#define RECALC_WRITE_SUPER 16/*
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 98/129 regmap: Account for register length in SMBus I/O limits
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Brown <[email protected]>
[ Upstream commit 0c9d2eb5e94792fe64019008a04d4df5e57625af ]
The SMBus I2C buses have limits on the size of transfers they can do but do not factor in the register length meaning we may try to do a transfer longer than our length limit, the core will not take care of this. Future changes will factor this out into the core but there are a number of users that assume current behaviour so let's just do something conservative here.
This does not take account padding bits but practically speaking these are very rarely if ever used on I2C buses given that they generally run slowly enough to mean there's no issue.
--- drivers/base/regmap/regmap-i2c.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/base/regmap/regmap-i2c.c +2 -2
@@ -246,8 +246,8 @@ static int regmap_i2c_smbus_i2c_read(voistatic struct regmap_bus regmap_i2c_smbus_i2c_block = { .write = regmap_i2c_smbus_i2c_write, .read = regmap_i2c_smbus_i2c_read, - .max_raw_read =I2C_SMBUS_BLOCK_MAX , - .max_raw_write =I2C_SMBUS_BLOCK_MAX , + .max_raw_read =I2C_SMBUS_BLOCK_MAX -1 , + .max_raw_write =I2C_SMBUS_BLOCK_MAX -1 , }; static const struct regmap_bus *regmap_get_i2c_bus(struct i2c_client *i2c,
Greg Kroah-Hartman
maintainerPATCH 99/129 drm/amd/display: do not wait for mpc idle if tg is disabled
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josip Pavic <[email protected]>
[ Upstream commit 2513ed4f937999c0446fd824f7564f76b697d722 ]
[Why]
When booting, the driver waits for the MPC idle bit to be set as part of pipe initialization. However, on some systems this occurs before OTG is enabled, and since the MPC idle bit won't be set until the vupdate signal occurs (which requires OTG to be enabled), this never happens and the wait times out. This can add hundreds of milliseconds to the boot time.
[How]
Do not wait for mpc idle if tg is disabled
Stable-dep-of: 5a25cefc0920 ("drm/amd/display: check TG is non-null before checking if enabled")
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +2 -1
@@ -2529,7 +2529,8 @@ static void dcn10_wait_for_mpcc_disconnect(if (pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst]) {struct hubp *hubp =get_hubp_by_inst (res_pool, mpcc_inst); - res_pool->mpc->funcs->wait_for_idle (res_pool->mpc, mpcc_inst); +if (pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) + res_pool->mpc->funcs->wait_for_idle (res_pool->mpc, mpcc_inst); pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst] = false; hubp->funcs->set_blank (hubp, true);/*DC_LOG_ERROR(dc->ctx->logger,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 100/129 drm/amd/display: check TG is non-null before checking if enabled
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taimur Hassan <[email protected]>
[ Upstream commit 5a25cefc0920088bb9afafeb80ad3dcd84fe278b ]
[Why & How]
If there is no TG allocation we can dereference a NULL pointer when checking if the TG is enabled.
--- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +2 -1
@@ -2529,7 +2529,8 @@ static void dcn10_wait_for_mpcc_disconnect(if (pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst]) {struct hubp *hubp =get_hubp_by_inst (res_pool, mpcc_inst); -if (pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) +if (pipe_ctx->stream_res.tg && + pipe_ctx->stream_res.tg->funcs->is_tg_enabled (pipe_ctx->stream_res.tg)) res_pool->mpc->funcs->wait_for_idle (res_pool->mpc, mpcc_inst); pipe_ctx->stream_res.opp->mpcc_disconnect_pending[mpcc_inst] = false; hubp->funcs->set_blank (hubp, true);
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 101/129 tracing: Fix memleak due to race between current_tracer and trace
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <[email protected]>
[ Upstream commit eecb91b9f98d6427d4af5fdb8f108f52572a39e7 ]
Kmemleak report a leak in graph_trace_open():
unreferenced object 0xffff0040b95f4a00 (size 128):
comm "cat", pid 204981, jiffies 4301155872 (age 99771.964s)
hex dump (first 32 bytes):
e0 05 e7 b4 ab 7d 00 00 0b 00 01 00 00 00 00 00 .....}..........
f4 00 01 10 00 a0 ff ff 00 00 00 00 65 00 10 00 ............e...
backtrace:
[<000000005db27c8b>] kmem_cache_alloc_trace+0x348/0x5f0
[<000000007df90faa>] graph_trace_open+0xb0/0x344
[<00000000737524cd>] __tracing_open+0x450/0xb10
[<0000000098043327>] tracing_open+0x1a0/0x2a0
[<00000000291c3876>] do_dentry_open+0x3c0/0xdc0
[<000000004015bcd6>] vfs_open+0x98/0xd0
[<000000002b5f60c9>] do_open+0x520/0x8d0
[<00000000376c7820>] path_openat+0x1c0/0x3e0
[<00000000336a54b5>] do_filp_open+0x14c/0x324
[<000000002802df13>] do_sys_openat2+0x2c4/0x530
[<0000000094eea458>] __arm64_sys_openat+0x130/0x1c4
[<00000000a71d7881>] el0_svc_common.constprop.0+0xfc/0x394
[<00000000313647bf>] do_el0_svc+0xac/0xec
[<000000002ef1c651>] el0_svc+0x20/0x30
[<000000002fd4692a>] el0_sync_handler+0xb0/0xb4
[<000000000c309c35>] el0_sync+0x160/0x180The root cause is descripted as follows:
__tracing_open() { // 1. File 'trace' is being opened;
...
*iter->trace = *tr->current_trace; // 2. Tracer 'function_graph' is
// currently set;
...
iter->trace->open(iter); // 3. Call graph_trace_open() here,
// and memory are allocated in it;
...}
s_start() { // 4. The opened file is being read;
...
*iter->trace = *tr->current_trace; // 5. If tracer is switched to
// 'nop' or others, then memory
// in step 3 are leaked!!!
...}
To fix it, in s_start(), close tracer before switching then reopen the new tracer after switching. And some tracers like 'wakeup' may not update 'iter->private' in some cases when reopen, then it should be cleared to avoid being mistakenly closed again.
--- kernel/trace/trace.c | 9 ++++++++- kernel/trace/trace_irqsoff.c | 3 ++- kernel/trace/trace_sched_wakeup.c | 2 ++ 3 files changed, 12 insertions(+), 2 deletions(-)
kernel/trace/trace.c +8 -1
@@ -3277,8 +3277,15 @@ static void *s_start(struct seq_file *m, loff_t *pos)* will point to the same string as current_trace->name. */ mutex_lock (&trace_types_lock); -if (unlikely (tr->current_trace && iter->trace->name != tr->current_trace->name)) +if (unlikely (tr->current_trace && iter->trace->name != tr->current_trace->name)) { +/* Close iter->trace before switching to the new current tracer */ +if (iter->trace->close) + iter->trace->close (iter); *iter->trace = *tr->current_trace; +/* Reopen the new current tracer */ +if (iter->trace->open) + iter->trace->open (iter); + }mutex_unlock (&trace_types_lock);#ifdef CONFIG_TRACER_MAX_TRACE
kernel/trace/trace_irqsoff.c +2 -1
@@ -222,7 +222,8 @@ static void irqsoff_trace_open(struct trace_iterator *iter) {if (is_graph (iter->tr))graph_trace_open (iter); - +else + iter->private =NULL ; }static void irqsoff_trace_close (struct trace_iterator *iter)
kernel/trace/trace_sched_wakeup.c +2 -0
@@ -287,6 +287,8 @@ static void wakeup_trace_open(struct trace_iterator *iter) {if (is_graph (iter->tr))graph_trace_open (iter); +else + iter->private =NULL ; }static void wakeup_trace_close (struct trace_iterator *iter)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 102/129 sock: annotate data-races around prot->memory_pressure
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 76f33296d2e09f63118db78125c95ef56df438e9 ]
*prot->memory_pressure is read/writen locklessly, we need to add proper annotations.
A recent commit added a new race, it is time to audit all accesses.
--- include/net/sock.h | 7 ++++--- net/sctp/socket.c | 2 +- 2 files changed, 5 insertions(+), 4 deletions(-)
include/net/sock.h +4 -3
@@ -1152,6 +1152,7 @@ struct proto {/* * Pressure flag: try to collapse. * Technical note: it is used by multiple contexts non atomically. +* Make sure to use READ_ONCE()/WRITE_ONCE() for all reads/writes. * All the __sk_mem_schedule() is of this nature: accounting * is strict, actions are advisory and have some latency. */
@@ -1268,7 +1269,7 @@ static inline bool sk_has_memory_pressure(const struct sock *sk)static inline bool sk_under_global_memory_pressure (const struct sock *sk) {return sk->sk_prot->memory_pressure && - !!*sk->sk_prot->memory_pressure; + !!READ_ONCE (*sk->sk_prot->memory_pressure); }static inline bool sk_under_memory_pressure (const struct sock *sk)
@@ -1280,7 +1281,7 @@ static inline bool sk_under_memory_pressure(const struct sock *sk) mem_cgroup_under_socket_pressure(sk->sk_memcg))return true; -return !!*sk->sk_prot->memory_pressure; +return !!READ_ONCE (*sk->sk_prot->memory_pressure); } static inline long
@@ -1334,7 +1335,7 @@ proto_memory_pressure(struct proto *prot) {if (!prot->memory_pressure)return false; -return !!*prot->memory_pressure; +return !!READ_ONCE (*prot->memory_pressure); }
net/sctp/socket.c +1 -1
@@ -112,7 +112,7 @@ struct percpu_counter sctp_sockets_allocated;static void sctp_enter_memory_pressure (struct sock *sk) { - sctp_memory_pressure =1 ; +WRITE_ONCE (sctp_memory_pressure,1 ); }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 103/129 dccp: annotate data-races in dccp_poll()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit cba3f1786916063261e3e5ccbb803abc325b24ef ]
We changed tcp_poll() over time, bug never updated dccp.
Note that we also could remove dccp instead of maintaining it.
--- net/dccp/proto.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-)
net/dccp/proto.c +12 -8
@@ -328,11 +328,15 @@ EXPORT_SYMBOL_GPL(dccp_disconnect);__poll_t dccp_poll (struct file *file,struct socket *sock,poll_table *wait) { -__poll_t mask;struct sock *sk = sock->sk; +__poll_t mask; +u8 shutdown; +int state;sock_poll_wait (file, sock, wait); -if (sk->sk_state ==DCCP_LISTEN ) + + state =inet_sk_state_load (sk); +if (state ==DCCP_LISTEN )return inet_csk_listen_poll (sk);/* Socket is not locked. We are protected from async events
@@ -341,20 +345,21 @@ __poll_t dccp_poll(struct file *file, struct socket *sock,*/ mask =0 ; -if (sk->sk_err) +if (READ_ONCE (sk->sk_err)) mask =EPOLLERR ; + shutdown =READ_ONCE (sk->sk_shutdown); -if (sk->sk_shutdown ==SHUTDOWN_MASK || sk->sk_state ==DCCP_CLOSED ) +if (shutdown ==SHUTDOWN_MASK || state ==DCCP_CLOSED ) mask |=EPOLLHUP ; -if (sk->sk_shutdown &RCV_SHUTDOWN ) +if (shutdown &RCV_SHUTDOWN ) mask |=EPOLLIN |EPOLLRDNORM |EPOLLRDHUP ;/* Connected? */ -if ((1 << sk->sk_state) & ~(DCCPF_REQUESTING |DCCPF_RESPOND )) { +if ((1 << state) & ~(DCCPF_REQUESTING |DCCPF_RESPOND )) {if (atomic_read (&sk->sk_rmem_alloc) >0 ) mask |=EPOLLIN |EPOLLRDNORM ; -if (!(sk->sk_shutdown &SEND_SHUTDOWN )) { +if (!(shutdown &SEND_SHUTDOWN )) {if (sk_stream_is_writeable (sk)) { mask |=EPOLLOUT |EPOLLWRNORM ; }else {/* send SIGIO later */
@@ -372,7 +377,6 @@ __poll_t dccp_poll(struct file *file, struct socket *sock, }return mask; } -EXPORT_SYMBOL_GPL (dccp_poll);int dccp_ioctl (struct sock *sk,int cmd,unsigned long arg)
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 104/129 igb: Avoid starting unnecessary workqueues
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alessio Igor Bogani <[email protected]>
[ Upstream commit b888c510f7b3d64ca75fc0f43b4a4bd1a611312f ]
If ptp_clock_register() fails or CONFIG_PTP isn't enabled, avoid starting PTP related workqueues.
In this way we can fix this:
BUG: unable to handle page fault for address: ffffc9000440b6f8 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 100000067 P4D 100000067 PUD 1001e0067 PMD 107dc5067 PTE 0 Oops: 0000 [#1] PREEMPT SMP [...] Workqueue: events igb_ptp_overflow_check RIP: 0010:igb_rd32+0x1f/0x60 [...] Call Trace: igb_ptp_read_82580+0x20/0x50 timecounter_read+0x15/0x60 igb_ptp_overflow_check+0x1a/0x50 process_one_work+0x1cb/0x3c0 worker_thread+0x53/0x3f0 ? rescuer_thread+0x370/0x370 kthread+0x142/0x160 ? kthread_associate_blkcg+0xc0/0xc0 ret_from_fork+0x1f/0x30
--- drivers/net/ethernet/intel/igb/igb_ptp.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-)
drivers/net/ethernet/intel/igb/igb_ptp.c +12 -12
@@ -1181,18 +1181,6 @@ void igb_ptp_init(struct igb_adapter *adapter)return ; } -spin_lock_init (&adapter->tmreg_lock); -INIT_WORK (&adapter->ptp_tx_work, igb_ptp_tx_work); - -if (adapter->ptp_flags &IGB_PTP_OVERFLOW_CHECK ) -INIT_DELAYED_WORK (&adapter->ptp_overflow_work, - igb_ptp_overflow_check); - - adapter->tstamp_config.rx_filter =HWTSTAMP_FILTER_NONE ; - adapter->tstamp_config.tx_type =HWTSTAMP_TX_OFF ; - -igb_ptp_reset (adapter); - adapter->ptp_clock =ptp_clock_register (&adapter->ptp_caps, &adapter->pdev->dev);if (IS_ERR (adapter->ptp_clock)) {
@@ -1202,6 +1190,18 @@ void igb_ptp_init(struct igb_adapter *adapter)dev_info (&adapter->pdev->dev,"added PHC on %s\n" , adapter->netdev->name); adapter->ptp_flags |=IGB_PTP_ENABLED ; + +spin_lock_init (&adapter->tmreg_lock); +INIT_WORK (&adapter->ptp_tx_work, igb_ptp_tx_work); + +if (adapter->ptp_flags &IGB_PTP_OVERFLOW_CHECK ) +INIT_DELAYED_WORK (&adapter->ptp_overflow_work, + igb_ptp_overflow_check); + + adapter->tstamp_config.rx_filter =HWTSTAMP_FILTER_NONE ; + adapter->tstamp_config.tx_type =HWTSTAMP_TX_OFF ; + +igb_ptp_reset (adapter); } }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 105/129 net/sched: fix a qdisc modification with ambiguous command request
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jamal Hadi Salim <[email protected]>
[ Upstream commit da71714e359b64bd7aab3bd56ec53f307f058133 ]
When replacing an existing root qdisc, with one that is of the same kind, the request boils down to essentially a parameterization change i.e not one that requires allocation and grafting of a new qdisc. syzbot was able to create a scenario which resulted in a taprio qdisc replacing an existing taprio qdisc with a combination of NLM_F_CREATE, NLM_F_REPLACE and NLM_F_EXCL leading to create and graft scenario.
The fix ensures that only when the qdisc kinds are different that we should allow a create and graft, otherwise it goes into the "change" codepath.
While at it, fix the code and comments to improve readability.
While syzbot was able to create the issue, it did not zone on the root cause. Analysis from Vladimir Oltean <[email protected]> helped narrow it down.
v1->V2 changes:
- remove "inline" function definition (Vladmir)
- remove extrenous braces in branches (Vladmir)
- change inline function names (Pedro)
- Run tdc tests (Victor)v2->v3 changes:
- dont break else/if (Simon)
--- net/sched/sch_api.c | 53 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 40 insertions(+), 13 deletions(-)
net/sched/sch_api.c +40 -13
@@ -1438,10 +1438,28 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n,return 0 ; } +static bool req_create_or_replace (struct nlmsghdr *n) +{ +return (n->nlmsg_flags &NLM_F_CREATE && + n->nlmsg_flags &NLM_F_REPLACE ); +} + +static bool req_create_exclusive (struct nlmsghdr *n) +{ +return (n->nlmsg_flags &NLM_F_CREATE && + n->nlmsg_flags &NLM_F_EXCL ); +} + +static bool req_change (struct nlmsghdr *n) +{ +return (!(n->nlmsg_flags &NLM_F_CREATE ) && + !(n->nlmsg_flags &NLM_F_REPLACE ) && + !(n->nlmsg_flags &NLM_F_EXCL )); +} +/* * Create/change qdisc. */ -static int tc_modify_qdisc (struct sk_buff *skb,struct nlmsghdr *n,struct netlink_ext_ack *extack) {
@@ -1538,27 +1556,35 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,* * We know, that some child q is already * attached to this parent and have choice: -* either to change it or to create/graft new one. +* 1) change it or 2) create/graft new one. +* If the requested qdisc kind is different +* than the existing one, then we choose graft. +* If they are the same then this is "change" +* operation - just let it fallthrough.. * * 1. We are allowed to create/graft only -* if CREATE and REPLACE flags are set. +* if the request is explicitly stating +* "please create if it doesn't exist". * -* 2. If EXCL is set, requestor wanted to say, -* that qdisc tcm_handle is not expected +* 2. If the request is to exclusive create +* then the qdisc tcm_handle is not expected * to exist, so that we choose create/graft too. * * 3. The last case is when no flags are set. +* This will happen when for example tc +* utility issues a "change" command. * Alas, it is sort of hole in API, we * cannot decide what to do unambiguously. -* For now we select create/graft, if -* user gave KIND, which does not match existing. +* For now we select create/graft. */ -if ((n->nlmsg_flags &NLM_F_CREATE ) && - (n->nlmsg_flags &NLM_F_REPLACE ) && - ((n->nlmsg_flags &NLM_F_EXCL ) || - (tca[TCA_KIND ] && -nla_strcmp (tca[TCA_KIND ], q->ops->id)))) - goto create_n_graft; +if (tca[TCA_KIND ] && +nla_strcmp (tca[TCA_KIND ], q->ops->id)) { +if (req_create_or_replace (n) || +req_create_exclusive (n)) + goto create_n_graft; +else if (req_change (n)) + goto create_n_graft2; + } } } }else {
@@ -1592,6 +1618,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,NL_SET_ERR_MSG (extack,"Qdisc not found. To create specify NLM_F_CREATE flag" );return -ENOENT ; } +create_n_graft2:if (clid ==TC_H_INGRESS ) {if (dev_ingress_queue (dev)) { q = qdisc_create(dev, dev_ingress_queue(dev), p,
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 106/129 net: remove bond_slave_has_mac_rcu()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <[email protected]>
[ Upstream commit 8b0fdcdc3a7d44aff907f0103f5ffb86b12bfe71 ]
No caller since v3.16.
Stable-dep-of: e74216b8def3 ("bonding: fix macvlan over alb bond support")
--- include/net/bonding.h | 14 -------------- 1 file changed, 14 deletions(-)
include/net/bonding.h +0 -14
@@ -674,20 +674,6 @@ static inline struct slave *bond_slave_has_mac(struct bonding *bond,return NULL ; } -/* Caller must hold rcu_read_lock() for read */ -static inline struct slave *bond_slave_has_mac_rcu (struct bonding *bond, -const u8 *mac) -{ -struct list_head *iter; -struct slave *tmp; - -bond_for_each_slave_rcu (bond, tmp, iter) -if (ether_addr_equal_64bits (mac, tmp->dev->dev_addr)) -return tmp; - -return NULL ; -} -/* Caller must hold rcu_read_lock() for read */ static inline bool bond_slave_has_mac_rx (struct bonding *bond,const u8 *mac) {
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 107/129 bonding: fix macvlan over alb bond support
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <[email protected]>
[ Upstream commit e74216b8def3803e98ae536de78733e9d7f3b109 ]
The commit 14af9963ba1e ("bonding: Support macvlans on top of tlb/rlb mode bonds") aims to enable the use of macvlans on top of rlb bond mode. However, the current rlb bond mode only handles ARP packets to update remote neighbor entries. This causes an issue when a macvlan is on top of the bond, and remote devices send packets to the macvlan using the bond's MAC address as the destination. After delivering the packets to the macvlan, the macvlan will rejects them as the MAC address is incorrect. Consequently, this commit makes macvlan over bond non-functional.
To address this problem, one potential solution is to check for the presence of a macvlan port on the bond device using netif_is_macvlan_port(bond->dev) and return NULL in the rlb_arp_xmit() function. However, this approach doesn't fully resolve the situation when a VLAN exists between the bond and macvlan.
So let's just do a partial revert for commit 14af9963ba1e in rlb_arp_xmit(). As the comment said, Don't modify or load balance ARPs that do not originate locally.
--- drivers/net/bonding/bond_alb.c | 6 +++--- include/net/bonding.h | 11 +---------- 2 files changed, 4 insertions(+), 13 deletions(-)
drivers/net/bonding/bond_alb.c +3 -3
@@ -671,10 +671,10 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond)return NULL ; arp = (struct arp_pkt *)skb_network_header (skb); -/* Don't modify or load balance ARPs that do not originate locally -* (e.g.,arrive via a bridge). +/* Don't modify or load balance ARPs that do not originate +* from the bond itself or a VLAN directly above the bond. */ -if (!bond_slave_has_mac_rx (bond, arp->mac_src)) +if (!bond_slave_has_mac_rcu (bond, arp->mac_src))return NULL ;if (arp->op_code ==htons (ARPOP_REPLY )) {
include/net/bonding.h +1 -10
@@ -675,23 +675,14 @@ static inline struct slave *bond_slave_has_mac(struct bonding *bond, }/* Caller must hold rcu_read_lock() for read */ -static inline bool bond_slave_has_mac_rx (struct bonding *bond,const u8 *mac) +static inline bool bond_slave_has_mac_rcu (struct bonding *bond,const u8 *mac) {struct list_head *iter;struct slave *tmp; -struct netdev_hw_addr *ha;bond_for_each_slave_rcu (bond, tmp, iter)if (ether_addr_equal_64bits (mac, tmp->dev->dev_addr))return true; - -if (netdev_uc_empty (bond->dev)) -return false; - -netdev_for_each_uc_addr (ha, bond->dev) -if (ether_addr_equal_64bits (mac, ha->addr)) -return true; -return false; }
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 108/129 ipvs: Improve robustness to the ipvs sysctl
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junwei Hu <[email protected]>
commit 1b90af292e71b20d03b837d39406acfbdc5d4b2a upstream.
The ipvs module parse the user buffer and save it to sysctl, then check if the value is valid. invalid value occurs over a period of time.
Here, I add a variable, struct ctl_table tmp, used to read the value from the user buffer, and save only when it is valid. I delete proc_do_sync_mode and use extra1/2 in table for the proc_dointvec_minmax call.
--- net/netfilter/ipvs/ip_vs_ctl.c | 70 +++++++++++++++++++++-------------------- 1 file changed, 36 insertions(+), 34 deletions(-)
net/netfilter/ipvs/ip_vs_ctl.c +36 -34
@@ -1656,6 +1656,7 @@ static int ip_vs_zero_all(struct netns_i#ifdef CONFIG_SYSCTL static int zero; +static int one =1 ;static int three =3 ; static int
@@ -1667,12 +1668,18 @@ proc_do_defense_mode(struct ctl_table *tint val = *valp;int rc; - rc =proc_dointvec (table, write, buffer, lenp, ppos); +struct ctl_table tmp = { + .data = &val, + .maxlen =sizeof (int ), + .mode = table->mode, + }; + + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write && (*valp != val)) { -if ((*valp <0 ) || (*valp >3 )) { -/* Restore the correct value */ - *valp = val; +if (val <0 || val >3 ) { + rc = -EINVAL ; }else { + *valp = val;update_defense_level (ipvs); } }
@@ -1686,33 +1693,20 @@ proc_do_sync_threshold(struct ctl_tableint *valp = table->data;int val[2 ];int rc; +struct ctl_table tmp = { + .data = &val, + .maxlen = table->maxlen, + .mode = table->mode, + }; -/* backup the value first */ memcpy (val, valp,sizeof (val)); - - rc =proc_dointvec (table, write, buffer, lenp, ppos); -if (write && (valp[0 ] <0 || valp[1 ] <0 || - (valp[0 ] >= valp[1 ] && valp[1 ]))) { -/* Restore the correct value */ -memcpy (valp, val,sizeof (val)); - } -return rc; -} - -static int -proc_do_sync_mode (struct ctl_table *table,int write, -void __user *buffer,size_t *lenp,loff_t *ppos) -{ -int *valp = table->data; -int val = *valp; -int rc; - - rc =proc_dointvec (table, write, buffer, lenp, ppos); -if (write && (*valp != val)) { -if ((*valp <0 ) || (*valp >1 )) { -/* Restore the correct value */ - *valp = val; - } + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos); +if (write) { +if (val[0 ] <0 || val[1 ] <0 || + (val[0 ] >= val[1 ] && val[1 ])) + rc = -EINVAL ; +else +memcpy (valp, val,sizeof (val)); }return rc; }
@@ -1725,12 +1719,18 @@ proc_do_sync_ports(struct ctl_table *tabint val = *valp;int rc; - rc =proc_dointvec (table, write, buffer, lenp, ppos); +struct ctl_table tmp = { + .data = &val, + .maxlen =sizeof (int ), + .mode = table->mode, + }; + + rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write && (*valp != val)) { -if (*valp <1 || !is_power_of_2 (*valp)) { -/* Restore the correct value */ +if (val <1 || !is_power_of_2 (val)) + rc = -EINVAL ; +else *valp = val; - } }return rc; }
@@ -1790,7 +1790,9 @@ static struct ctl_table vs_vars[] = { .procname = "sync_version", .maxlen = sizeof(int), .mode = 0644, - .proc_handler = proc_do_sync_mode, + .proc_handler = proc_dointvec_minmax, + .extra1 = &zero, + .extra2 = &one, }, { .procname = "sync_ports",
Greg Kroah-Hartman
maintainerPATCH 109/129 ipvs: fix racy memcpy in proc_do_sync_threshold
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sishuai Gong <[email protected]>
commit 5310760af1d4fbea1452bfc77db5f9a680f7ae47 upstream.
When two threads run proc_do_sync_threshold() in parallel, data races could happen between the two memcpy():
Thread-1 Thread-2
memcpy(val, valp, sizeof(val)); memcpy(valp, val, sizeof(val));
This race might mess up the (struct ctl_table *) table->data, so we add a mutex lock to serialize them.
--- net/netfilter/ipvs/ip_vs_ctl.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_ctl.c +4 -0
@@ -1690,6 +1690,7 @@ static int proc_do_sync_threshold(struct ctl_table *table, int write, void __user *buffer, size_t *lenp, loff_t *ppos) { + struct netns_ipvs *ipvs = table->extra2;int *valp = table->data;int val[2 ];int rc;
@@ -1699,6 +1700,7 @@ proc_do_sync_threshold(struct ctl_table .mode = table->mode, }; +mutex_lock (&ipvs->sync_mutex);memcpy (val, valp,sizeof (val)); rc =proc_dointvec (&tmp, write, buffer, lenp, ppos);if (write) {
@@ -1708,6 +1710,7 @@ proc_do_sync_threshold(struct ctl_tableelse memcpy (valp, val,sizeof (val)); } +mutex_unlock (&ipvs->sync_mutex);return rc; }
@@ -3944,6 +3947,7 @@ static int __net_init ip_vs_control_net_ ipvs->sysctl_sync_threshold[0 ] =DEFAULT_SYNC_THRESHOLD ; ipvs->sysctl_sync_threshold[1 ] =DEFAULT_SYNC_PERIOD ; tbl[idx].data = &ipvs->sysctl_sync_threshold; + tbl[idx].extra2 = ipvs; tbl[idx++].maxlen =sizeof (ipvs->sysctl_sync_threshold); ipvs->sysctl_sync_refresh_period =DEFAULT_SYNC_REFRESH_PERIOD ; tbl[idx++].data = &ipvs->sysctl_sync_refresh_period;
Greg Kroah-Hartman
maintainerPATCH 110/129 ibmveth: Use dcbf rather than dcbfl
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit bfedba3b2c7793ce127680bc8f70711e05ec7a17 upstream.
When building for power4, newer binutils don't recognise the "dcbfl" extended mnemonic.
dcbfl RA, RB is equivalent to dcbf RA, RB, 1.
Switch to "dcbf" to avoid the build error.
--- drivers/net/ethernet/ibm/ibmveth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/ibm/ibmveth.c +1 -1
@@ -209,7 +209,7 @@ static inline void ibmveth_flush_buffer(unsigned long offset;for (offset =0 ; offset < length; offset +=SMP_CACHE_BYTES ) - asm("dcbfl %0,%1" ::"b" (addr),"r" (offset)); + asm("dcbf %0,%1,1" ::"b" (addr),"r" (offset)); }/* replenish the buffers for a pool. note that we don't need to
Greg Kroah-Hartman
maintainerPATCH 111/129 nfsd: Fix race to FREE_STATEID and cl_revoked
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <[email protected]>
commit 3b816601e279756e781e6c4d9b3f3bd21a72ac67 upstream.
We have some reports of linux NFS clients that cannot satisfy a linux knfsd server that always sets SEQ4_STATUS_RECALLABLE_STATE_REVOKED even though those clients repeatedly walk all their known state using TEST_STATEID and receive NFS4_OK for all.
Its possible for revoke_delegation() to set NFS4_REVOKED_DELEG_STID, then nfsd4_free_stateid() finds the delegation and returns NFS4_OK to FREE_STATEID. Afterward, revoke_delegation() moves the same delegation to cl_revoked. This would produce the observed client/server effect.
Fix this by ensuring that the setting of sc_type to NFS4_REVOKED_DELEG_STID and move to cl_revoked happens within the same cl_lock. This will allow nfsd4_free_stateid() to properly remove the delegation from cl_revoked.
--- fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfsd/nfs4state.c +1 -1
@@ -1019,9 +1019,9 @@ static void revoke_delegation(struct nfsWARN_ON (!list_empty (&dp->dl_recall_lru));if (clp->cl_minorversion) { +spin_lock (&clp->cl_lock); dp->dl_stid.sc_type =NFS4_REVOKED_DELEG_STID ;refcount_inc (&dp->dl_stid.sc_count); -spin_lock (&clp->cl_lock);list_add (&dp->dl_recall_lru, &clp->cl_revoked);spin_unlock (&clp->cl_lock); }
Greg Kroah-Hartman
maintainerPATCH 112/129 batman-adv: Trigger events for auto adjusted MTU
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit c6a953cce8d0438391e6da48c8d0793d3fbfcfa6 upstream.
If an interface changes the MTU, it is expected that an NETDEV_PRECHANGEMTU and NETDEV_CHANGEMTU notification events is triggered. This worked fine for .ndo_change_mtu based changes because core networking code took care of it. But for auto-adjustments after hard-interfaces changes, these events were simply missing.
Due to this problem, non-batman-adv components weren't aware of MTU changes and thus couldn't perform their own tasks correctly.
--- net/batman-adv/hard-interface.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/batman-adv/hard-interface.c +1 -1
@@ -643,7 +643,7 @@ out:*/ void batadv_update_min_mtu (struct net_device *soft_iface) { - soft_iface->mtu =batadv_hardif_min_mtu (soft_iface); +dev_set_mtu (soft_iface,batadv_hardif_min_mtu (soft_iface));/* Check if the local translate table should be cleaned up to match a * new (and smaller) MTU.
Greg Kroah-Hartman
maintainerPATCH 113/129 batman-adv: Dont increase MTU when set by user
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <[email protected]>
commit d8e42a2b0addf238be8b3b37dcd9795a5c1be459 upstream.
If the user set an MTU value, it usually means that there are special requirements for the MTU. But if an interface gots activated, the MTU was always recalculated and then the user set value was overwritten.
The only reason why this user set value has to be overwritten, is when the MTU has to be decreased because batman-adv is not able to transfer packets with the user specified size.
--- net/batman-adv/hard-interface.c | 14 +++++++++++++- net/batman-adv/soft-interface.c | 3 +++ net/batman-adv/types.h | 6 ++++++ 3 files changed, 22 insertions(+), 1 deletion(-)
net/batman-adv/hard-interface.c +13 -1
@@ -643,7 +643,19 @@ out:*/ void batadv_update_min_mtu (struct net_device *soft_iface) { -dev_set_mtu (soft_iface,batadv_hardif_min_mtu (soft_iface)); +struct batadv_priv *bat_priv =netdev_priv (soft_iface); +int limit_mtu; +int mtu; + + mtu =batadv_hardif_min_mtu (soft_iface); + +if (bat_priv->mtu_set_by_user) + limit_mtu = bat_priv->mtu_set_by_user; +else + limit_mtu =ETH_DATA_LEN ; + + mtu =min (mtu, limit_mtu); +dev_set_mtu (soft_iface, mtu);/* Check if the local translate table should be cleaned up to match a * new (and smaller) MTU.
net/batman-adv/soft-interface.c +3 -0
@@ -167,11 +167,14 @@ static int batadv_interface_set_mac_addrstatic int batadv_interface_change_mtu (struct net_device *dev,int new_mtu) { +struct batadv_priv *bat_priv =netdev_priv (dev); +/* check ranges */ if (new_mtu <68 || new_mtu >batadv_hardif_min_mtu (dev))return -EINVAL ; dev->mtu = new_mtu; + bat_priv->mtu_set_by_user = new_mtu;return 0 ; }
net/batman-adv/types.h +6 -0
@@ -1515,6 +1515,12 @@ struct batadv_priv {struct net_device *soft_iface;/** +* @mtu_set_by_user: MTU was set once by user +* protected by rtnl_lock +*/ +int mtu_set_by_user; + +/** * @bat_counters: mesh internal traffic statistic counters (see * batadv_counters) */
Greg Kroah-Hartman
maintainerPATCH 114/129 batman-adv: Do not get eth header before batadv_check_management_packet
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit eac27a41ab641de074655d2932fc7f8cdb446881 upstream.
If received skb in batadv_v_elp_packet_recv or batadv_v_ogm_packet_recv is either cloned or non linearized then its data buffer will be reallocated by batadv_check_management_packet when skb_cow or skb_linearize get called. Thus geting ethernet header address inside skb data buffer before batadv_check_management_packet had any chance to reallocate it could lead to the following kernel panic:
Unable to handle kernel paging request at virtual address ffffff8020ab069a
Mem abort info:
ESR = 0x96000007
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x07: level 3 translation fault
Data abort info:
ISV = 0, ISS = 0x00000007
CM = 0, WnR = 0
swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000040f45000
[ffffff8020ab069a] pgd=180000007fffa003, p4d=180000007fffa003, pud=180000007fffa003, pmd=180000007fefe003, pte=0068000020ab0706
Internal error: Oops: 96000007 [#1] SMP
Modules linked in: ahci_mvebu libahci_platform libahci dvb_usb_af9035 dvb_usb_dib0700 dib0070 dib7000m dibx000_common ath11k_pci ath10k_pci ath10k_core mwl8k_new nf_nat_sip nf_conntrack_sip xhci_plat_hcd xhci_hcd nf_nat_pptp nf_conntrack_pptp at24 sbsa_gwdt
CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.15.42-00066-g3242268d425c-dirty #550
Hardware name: A8k (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : batadv_is_my_mac+0x60/0xc0
lr : batadv_v_ogm_packet_recv+0x98/0x5d0
sp : ffffff8000183820
x29: ffffff8000183820 x28: 0000000000000001 x27: ffffff8014f9af00
x26: 0000000000000000 x25: 0000000000000543 x24: 0000000000000003
x23: ffffff8020ab0580 x22: 0000000000000110 x21: ffffff80168ae880
x20: 0000000000000000 x19: ffffff800b561000 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000 x15: 00dc098924ae0032
x14: 0f0405433e0054b0 x13: ffffffff00000080 x12: 0000004000000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : 0000000000000000 x7 : ffffffc076dae000 x6 : ffffff8000183700
x5 : ffffffc00955e698 x4 : ffffff80168ae000 x3 : ffffff80059cf000
x2 : ffffff800b561000 x1 : ffffff8020ab0696 x0 : ffffff80168ae880
Call trace:
batadv_is_my_mac+0x60/0xc0
batadv_v_ogm_packet_recv+0x98/0x5d0
batadv_batman_skb_recv+0x1b8/0x244
__netif_receive_skb_core.isra.0+0x440/0xc74
__netif_receive_skb_one_core+0x14/0x20
netif_receive_skb+0x68/0x140
br_pass_frame_up+0x70/0x80
br_handle_frame_finish+0x108/0x284
br_handle_frame+0x190/0x250
__netif_receive_skb_core.isra.0+0x240/0xc74
__netif_receive_skb_list_core+0x6c/0x90
netif_receive_skb_list_internal+0x1f4/0x310
napi_complete_done+0x64/0x1d0
gro_cell_poll+0x7c/0xa0
__napi_poll+0x34/0x174
net_rx_action+0xf8/0x2a0
_stext+0x12c/0x2ac
run_ksoftirqd+0x4c/0x7c
smpboot_thread_fn+0x120/0x210
kthread+0x140/0x150
ret_from_fork+0x10/0x20
Code: f9403844 eb03009f 54fffee1 f94Thus ethernet header address should only be fetched after batadv_check_management_packet has been called.
--- net/batman-adv/bat_v_elp.c | 3 ++- net/batman-adv/bat_v_ogm.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/batman-adv/bat_v_elp.c +2 -1
@@ -513,7 +513,7 @@ int batadv_v_elp_packet_recv(struct sk_bstruct batadv_priv *bat_priv =netdev_priv (if_incoming->soft_iface);struct batadv_elp_packet *elp_packet;struct batadv_hard_iface *primary_if; -struct ethhdr *ethhdr = (struct ethhdr *)skb_mac_header (skb); +struct ethhdr *ethhdr;bool res;int ret =NET_RX_DROP ;
@@ -521,6 +521,7 @@ int batadv_v_elp_packet_recv(struct sk_bif (!res) goto free_skb; + ethhdr =eth_hdr (skb);if (batadv_is_my_mac (bat_priv, ethhdr->h_source)) goto free_skb;
net/batman-adv/bat_v_ogm.c +2 -1
@@ -832,7 +832,7 @@ int batadv_v_ogm_packet_recv(struct sk_b {struct batadv_priv *bat_priv =netdev_priv (if_incoming->soft_iface);struct batadv_ogm2_packet *ogm_packet; -struct ethhdr *ethhdr =eth_hdr (skb); +struct ethhdr *ethhdr;int ogm_offset;u8 *packet_pos;int ret =NET_RX_DROP ;
@@ -846,6 +846,7 @@ int batadv_v_ogm_packet_recv(struct sk_bif (!batadv_check_management_packet (skb, if_incoming,BATADV_OGM2_HLEN )) goto free_skb; + ethhdr =eth_hdr (skb);if (batadv_is_my_mac (bat_priv, ethhdr->h_source)) goto free_skb;
Greg Kroah-Hartman
maintainerPATCH 115/129 batman-adv: Fix TT global entry leak when client roamed back
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit d25ddb7e788d34cf27ff1738d11a87cb4b67d446 upstream.
When a client roamed back to a node before it got time to destroy the pending local entry (i.e. within the same originator interval) the old global one is directly removed from hash table and left as such.
But because this entry had an extra reference taken at lookup (i.e using batadv_tt_global_hash_find) there is no way its memory will be reclaimed at any time causing the following memory leak:
unreferenced object 0xffff0000073c8000 (size 18560):
comm "softirq", pid 0, jiffies 4294907738 (age 228.644s)
hex dump (first 32 bytes):
06 31 ac 12 c7 7a 05 00 01 00 00 00 00 00 00 00 .1...z..........
2c ad be 08 00 80 ff ff 6c b6 be 08 00 80 ff ff ,.......l.......
backtrace:
[<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300
[<000000000ff2fdbc>] batadv_tt_global_add+0x700/0xe20
[<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790
[<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110
[<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10
[<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0
[<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4
[<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0
[<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90
[<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74
[<000000000f39a009>] __netif_receive_skb+0x48/0xe0
[<00000000f2cd8888>] process_backlog+0x174/0x344
[<00000000507d6564>] __napi_poll+0x58/0x1f4
[<00000000b64ef9eb>] net_rx_action+0x504/0x590
[<00000000056fa5e4>] _stext+0x1b8/0x418
[<00000000878879d6>] run_ksoftirqd+0x74/0xa4
unreferenced object 0xffff00000bae1a80 (size 56):
comm "softirq", pid 0, jiffies 4294910888 (age 216.092s)
hex dump (first 32 bytes):
00 78 b1 0b 00 00 ff ff 0d 50 00 00 00 00 00 00 .x.......P......
00 00 00 00 00 00 00 00 50 c8 3c 07 00 00 ff ff ........P.<.....
backtrace:
[<00000000ee6e0ffa>] kmem_cache_alloc+0x1b4/0x300
[<00000000d9aaa49e>] batadv_tt_global_add+0x53c/0xe20
[<00000000443897c7>] _batadv_tt_update_changes+0x21c/0x790
[<000000005dd90463>] batadv_tt_update_changes+0x3c/0x110
[<00000000a2d7fc57>] batadv_tt_tvlv_unicast_handler_v1+0xafc/0xe10
[<0000000011793f2a>] batadv_tvlv_containers_process+0x168/0x2b0
[<00000000b7cbe2ef>] batadv_recv_unicast_tvlv+0xec/0x1f4
[<0000000042aef1d8>] batadv_batman_skb_recv+0x25c/0x3a0
[<00000000bbd8b0a2>] __netif_receive_skb_core.isra.0+0x7a8/0xe90
[<000000004033d428>] __netif_receive_skb_one_core+0x64/0x74
[<000000000f39a009>] __netif_receive_skb+0x48/0xe0
[<00000000f2cd8888>] process_backlog+0x174/0x344
[<00000000507d6564>] __napi_poll+0x58/0x1f4
[<00000000b64ef9eb>] net_rx_action+0x504/0x590
[<00000000056fa5e4>] _stext+0x1b8/0x418
[<00000000878879d6>] run_ksoftirqd+0x74/0xa4Releasing the extra reference from batadv_tt_global_hash_find even at roam back when batadv_tt_global_free is called fixes this memory leak.
Signed-off-by; Sven Eckelmann <[email protected]>
--- net/batman-adv/translation-table.c | 1 - 1 file changed, 1 deletion(-)
net/batman-adv/translation-table.c +0 -1
@@ -793,7 +793,6 @@ check_roaming:if (roamed_back) {batadv_tt_global_free (bat_priv, tt_global,"Roaming canceled" ); - tt_global =NULL ; }else {/* The global entry has to be marked as ROAMING and * has to be kept for consistency purpose
Greg Kroah-Hartman
maintainerPATCH 116/129 batman-adv: Fix batadv_v_ogm_aggr_send memory leak
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Remi Pommarel <[email protected]>
commit 421d467dc2d483175bad4fb76a31b9e5a3d744cf upstream.
When batadv_v_ogm_aggr_send is called for an inactive interface, the skb is silently dropped by batadv_v_ogm_send_to_if() but never freed causing the following memory leak:
unreferenced object 0xffff00000c164800 (size 512):
comm "kworker/u8:1", pid 2648, jiffies 4295122303 (age 97.656s)
hex dump (first 32 bytes):
00 80 af 09 00 00 ff ff e1 09 00 00 75 01 60 83 ............u.`.
1f 00 00 00 b8 00 00 00 15 00 05 00 da e3 d3 64 ...............d
backtrace:
[<0000000007ad20f6>] __kmalloc_track_caller+0x1a8/0x310
[<00000000d1029e55>] kmalloc_reserve.constprop.0+0x70/0x13c
[<000000008b9d4183>] __alloc_skb+0xec/0x1fc
[<00000000c7af5051>] __netdev_alloc_skb+0x48/0x23c
[<00000000642ee5f5>] batadv_v_ogm_aggr_send+0x50/0x36c
[<0000000088660bd7>] batadv_v_ogm_aggr_work+0x24/0x40
[<0000000042fc2606>] process_one_work+0x3b0/0x610
[<000000002f2a0b1c>] worker_thread+0xa0/0x690
[<0000000059fae5d4>] kthread+0x1fc/0x210
[<000000000c587d3a>] ret_from_fork+0x10/0x20Free the skb in that case to fix this leak.
--- net/batman-adv/bat_v_ogm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/batman-adv/bat_v_ogm.c +3 -1
@@ -119,8 +119,10 @@ static void batadv_v_ogm_send_to_if(stru {struct batadv_priv *bat_priv =netdev_priv (hard_iface->soft_iface); -if (hard_iface->if_status !=BATADV_IF_ACTIVE ) +if (hard_iface->if_status !=BATADV_IF_ACTIVE ) { +kfree_skb (skb);return ; + }batadv_inc_counter (bat_priv,BATADV_CNT_MGMT_TX ); batadv_add_counter(bat_priv, BATADV_CNT_MGMT_TX_BYTES,
Greg Kroah-Hartman
maintainerPATCH 117/129 lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 382d4cd1847517ffcb1800fd462b625db7b2ebea upstream.
The gcc compiler translates on some architectures the 64-bit __builtin_clzll() function to a call to the libgcc function __clzdi2(), which should take a 64-bit parameter on 32- and 64-bit platforms.
But in the current kernel code, the built-in __clzdi2() function is defined to operate (wrongly) on 32-bit parameters if BITS_PER_LONG == 32, thus the return values on 32-bit kernels are in the range from [0..31] instead of the expected [0..63] range.
This patch fixes the in-kernel functions __clzdi2() and __ctzdi2() to take a 64-bit parameter on 32-bit kernels as well, thus it makes the functions identical for 32- and 64-bit kernels.
This bug went unnoticed since kernel 3.11 for over 10 years, and here are some possible reasons for that:
a) Some architectures have assembly instructions to count the bits and which are used instead of calling __clzdi2(), e.g. on x86 the bsr instruction and on ppc cntlz is used. On such architectures the wrong __clzdi2() implementation isn't used and as such the bug has no effect and won't be noticed.
b) Some architectures link to libgcc.a, and the in-kernel weak functions get replaced by the correct 64-bit variants from libgcc.a.
c) __builtin_clzll() and __clzdi2() doesn't seem to be used in many places in the kernel, and most likely only in uncritical functions, e.g. when printing hex values via seq_put_hex_ll(). The wrong return value will still print the correct number, but just in a wrong formatting (e.g. with too many leading zeroes).
d) 32-bit kernels aren't used that much any longer, so they are less tested.
A trivial testcase to verify if the currently running 32-bit kernel is affected by the bug is to look at the output of /proc/self/maps:
Here the kernel uses a correct implementation of __clzdi2():
root@debian:~# cat /proc/self/maps 00010000-00019000 r-xp 00000000 08:05 787324 /usr/bin/cat 00019000-0001a000 rwxp 00009000 08:05 787324 /usr/bin/cat 0001a000-0003b000 rwxp 00000000 00:00 0 [heap] f7551000-f770d000 r-xp 00000000 08:05 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ...
and this kernel uses the broken implementation of __clzdi2():
root@debian:~# cat /proc/self/maps 0000000010000-0000000019000 r-xp 00000000 000000008:000000005 787324 /usr/bin/cat 0000000019000-000000001a000 rwxp 000000009000 000000008:000000005 787324 /usr/bin/cat 000000001a000-000000003b000 rwxp 00000000 00:00 0 [heap] 00000000f73d1000-00000000f758d000 r-xp 00000000 000000008:000000005 794765 /usr/lib/hppa-linux-gnu/libc.so.6 ...
--- lib/clz_ctz.c | 32 ++++++-------------------------- 1 file changed, 6 insertions(+), 26 deletions(-)
lib/clz_ctz.c +6 -26
@@ -30,36 +30,16 @@ int __weak __clzsi2(int val) }EXPORT_SYMBOL (__clzsi2); -int __weak __clzdi2 (long val); -int __weak __ctzdi2 (long val); -#if BITS_PER_LONG ==32 - -int __weak __clzdi2 (long val) +int __weak __clzdi2 (u64 val); +int __weak __clzdi2 (u64 val) { -return 32 -fls ((int )val); +return 64 -fls64 (val); }EXPORT_SYMBOL (__clzdi2); -int __weak __ctzdi2 (long val) +int __weak __ctzdi2 (u64 val); +int __weak __ctzdi2 (u64 val) { -return __ffs ((u32 )val); +return __ffs64 (val); }EXPORT_SYMBOL (__ctzdi2); - -#elif BITS_PER_LONG ==64 - -int __weak __clzdi2 (long val) -{ -return 64 -fls64 ((u64 )val); -} -EXPORT_SYMBOL (__clzdi2); - -int __weak __ctzdi2 (long val) -{ -return __ffs64 ((u64 )val); -} -EXPORT_SYMBOL (__ctzdi2); - -#else -#error BITS_PER_LONG not 32 or 64 -#endif
Greg Kroah-Hartman
maintainerPATCH 118/129 media: vcodec: Fix potential array out-of-bounds in encoder queue_setup
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Chen <[email protected]>
commit e7f2e65699e2290fd547ec12a17008764e5d9620 upstream.
variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds.
Fix this bug by checking *nplanes against the array size.
--- drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mtk-vcodec/mtk_vcodec_enc.c +2 -0
@@ -766,6 +766,8 @@ static int vb2ops_venc_queue_setup(strucreturn -EINVAL ;if (*nplanes) { +if (*nplanes != q_data->fmt->num_planes) +return -EINVAL ;for (i =0 ; i < *nplanes; i++)if (sizes[i] < q_data->sizeimage[i])return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 119/129 PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Mammedov <[email protected]>
commit cc22522fd55e257c86d340ae9aedc122e705a435 upstream.
40613da52b13 ("PCI: acpiphp: Reassign resources on bridge if necessary") changed acpiphp hotplug to use pci_assign_unassigned_bridge_resources() which depends on bridge being available, however enable_slot() can be called without bridge associated:
1. Legitimate case of hotplug on root bus (widely used in virt world)
2. A (misbehaving) firmware, that sends ACPI Bus Check notifications to non existing root ports (Dell Inspiron 7352/0W6WV0), which end up at enable_slot(..., bridge = 0) where bus has no bridge assigned to it. acpihp doesn't know that it's a bridge, and bus specific 'PCI subsystem' can't augment ACPI context with bridge information since the PCI device to get this data from is/was not available.
Issue is easy to reproduce with QEMU's 'pc' machine, which supports PCI hotplug on hostbridge slots. To reproduce, boot kernel at commit 40613da52b13 in VM started with following CLI (assuming guest root fs is installed on sda1 partition):
# qemu-system-x86_64 -M pc -m 1G -enable-kvm -cpu host \
-monitor stdio -serial file:serial.log \
-kernel arch/x86/boot/bzImage \
-append "root=/dev/sda1 console=ttyS0" \
guest_disk.imgOnce guest OS is fully booted at qemu prompt:
(qemu) device_add e1000
(check serial.log) it will cause NULL pointer dereference at:
void pci_assign_unassigned_bridge_resources(struct pci_dev *bridge)
{
struct pci_bus *parent = bridge->subordinate;BUG: kernel NULL pointer dereference, address: 0000000000000018 ? pci_assign_unassigned_bridge_resources+0x1f/0x260 enable_slot+0x21f/0x3e0 acpiphp_hotplug_notify+0x13d/0x260 acpi_device_hotplug+0xbc/0x540 acpi_hotplug_work_fn+0x15/0x20 process_one_work+0x1f7/0x370 worker_thread+0x45/0x3b0
The issue was discovered on Dell Inspiron 7352/0W6WV0 laptop with following sequence:
1. Suspend to RAM
2. Wake up with the same backtrace being observed:
3. 2nd suspend to RAM attempt makes laptop freeze
Fix it by using __pci_bus_assign_resources() instead of pci_assign_unassigned_bridge_resources() as we used to do, but only in case when bus doesn't have a bridge associated (to cover for the case of ACPI event on hostbridge or non existing root port).
That lets us keep hotplug on root bus working like it used to and at the same time keeps resource reassignment usable on root ports (and other 1st level bridges) that was fixed by 40613da52b13.
--- drivers/pci/hotplug/acpiphp_glue.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/pci/hotplug/acpiphp_glue.c +7 -1
@@ -496,6 +496,7 @@ static void enable_slot(struct acpiphp_sacpiphp_native_scan_bridge (dev); } }else { +LIST_HEAD (add_list);int max, pass;acpiphp_rescan_slot (slot);
@@ -509,10 +510,15 @@ static void enable_slot(struct acpiphp_sif (pass && dev->subordinate) {check_hotplug_bridge (slot, dev);pcibios_resource_survey_bus (dev->subordinate); +if (pci_is_root_bus (bus)) +__pci_bus_size_bridges (dev->subordinate, &add_list); } } } -pci_assign_unassigned_bridge_resources (bus->self); +if (pci_is_root_bus (bus)) +__pci_bus_assign_resources (bus, &add_list,NULL ); +else +pci_assign_unassigned_bridge_resources (bus->self); }acpiphp_sanitize_bus (bus);
Greg Kroah-Hartman
maintainerPATCH 120/129 x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Feng Tang <[email protected]>
commit 2c66ca3949dc701da7f4c9407f2140ae425683a5 upstream.
0-Day found a 34.6% regression in stress-ng's 'af-alg' test case, and bisected it to commit b81fac906a8f ("x86/fpu: Move FPU initialization into arch_cpu_finalize_init()"), which optimizes the FPU init order, and moves the CR4_OSXSAVE enabling into a later place:
arch_cpu_finalize_init
identify_boot_cpu
identify_cpu
generic_identify
get_cpu_cap --> setup cpu capability
...
fpu__init_cpu
fpu__init_cpu_xstate
cr4_set_bits(X86_CR4_OSXSAVE);As the FPU is not yet initialized the CPU capability setup fails to set X86_FEATURE_OSXSAVE. Many security module like 'camellia_aesni_avx_x86_64' depend on this feature and therefore fail to load, causing the regression.
Cure this by setting X86_FEATURE_OSXSAVE feature right after OSXSAVE enabling.
[ tglx: Moved it into the actual BSP FPU initialization code and added a comment ]
--- arch/x86/kernel/fpu/xstate.c | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/x86/kernel/fpu/xstate.c +8 -0
@@ -811,6 +811,14 @@ void __init fpu__init_system_xstate(voidfpu__init_prepare_fx_sw_frame ();setup_init_fpu_buf ();setup_xstate_comp (); + +/* +* CPU capabilities initialization runs before FPU init. So +* X86_FEATURE_OSXSAVE is not set. Now that XSAVE is completely +* functional, set the feature bit so depending code works. +*/ +setup_force_cpu_cap (X86_FEATURE_OSXSAVE ); +print_xstate_offset_size (); pr_info("x86/fpu: Enabled xstate features 0x%llx, context size is %d bytes, using '%s' format.\n",
Greg Kroah-Hartman
maintainerPATCH 121/129 mmc: block: Fix in_flight[issue_type] value error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yibin Ding <[email protected]>
commit 4b430d4ac99750ee2ae2f893f1055c7af1ec3dc5 upstream.
For a completed request, after the mmc_blk_mq_complete_rq(mq, req) function is executed, the bitmap_tags corresponding to the request will be cleared, that is, the request will be regarded as idle. If the request is acquired by a different type of process at this time, the issue_type of the request may change. It further caused the value of mq->in_flight[issue_type] to be abnormal, and a large number of requests could not be sent.
p1: p2:mmc_blk_mq_complete_rq
blk_mq_free_request
blk_mq_get_request
blk_mq_rq_ctx_initmmc_blk_mq_dec_in_flight
mmc_issue_type(mq, req)
This strategy can ensure the consistency of issue_type before and after executing mmc_blk_mq_complete_rq.
--- drivers/mmc/core/block.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
drivers/mmc/core/block.c +7 -4
@@ -1976,15 +1976,16 @@ static void mmc_blk_mq_poll_completion(smmc_blk_urgent_bkops (mq, mqrq); } -static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq,struct request *req) +static void mmc_blk_mq_dec_in_flight (struct mmc_queue *mq, +struct request_queue *q, +enum mmc_issue_type issue_type) { -struct request_queue *q = req->q;unsigned long flags;bool put_card;spin_lock_irqsave (q->queue_lock, flags); - mq->in_flight[mmc_issue_type (mq, req)] -=1 ; + mq->in_flight[issue_type] -=1 ; put_card = (mmc_tot_in_flight (mq) ==0 );
@@ -1996,9 +1997,11 @@ static void mmc_blk_mq_dec_in_flight(strstatic void mmc_blk_mq_post_req (struct mmc_queue *mq,struct request *req) { +enum mmc_issue_type issue_type =mmc_issue_type (mq, req);struct mmc_queue_req *mqrq =req_to_mmc_queue_req (req);struct mmc_request *mrq = &mqrq->brq.mrq;struct mmc_host *host = mq->card->host; +struct request_queue *q = req->q;mmc_post_req (host, mrq,0 );
@@ -2011,7 +2014,7 @@ static void mmc_blk_mq_post_req(struct melse blk_mq_complete_request (req); -mmc_blk_mq_dec_in_flight (mq, req); +mmc_blk_mq_dec_in_flight (mq, q, issue_type); }void mmc_blk_mq_recovery (struct mmc_queue *mq)
Greg Kroah-Hartman
maintainerPATCH 122/129 sched/rt: pick_next_rt_entity(): check list_entry
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pietro Borrello <[email protected]>
commit 7c4a5b89a0b5a57a64b601775b296abf77a9fe97 upstream.
Commit 326587b84078 ("sched: fix goto retry in pick_next_task_rt()") removed any path which could make pick_next_rt_entity() return NULL. However, BUG_ON(!rt_se) in _pick_next_task_rt() (the only caller of pick_next_rt_entity()) still checks the error condition, which can never happen, since list_entry() never returns NULL. Remove the BUG_ON check, and instead emit a warning in the only possible error condition here: the queue being empty which should never happen.
[ Fixes CVE-2023-1077: sched/rt: pick_next_rt_entity(): check list_entry
An insufficient list empty checking in pick_next_rt_entity(). The _pick_next_task_rt() checks pick_next_rt_entity() returns NULL or not but pick_next_rt_entity() never returns NULL. So, even if the list is empty, _pick_next_task_rt() continues its process. ]
--- kernel/sched/rt.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/sched/rt.c +4 -1
@@ -1522,6 +1522,8 @@ static struct sched_rt_entity *pick_nextBUG_ON (idx >=MAX_RT_PRIO ); queue = array->queue + idx; +if (SCHED_WARN_ON (list_empty (queue))) +return NULL ; next = list_entry(queue->next, struct sched_rt_entity, run_list);return next;
@@ -1535,7 +1537,8 @@ static struct task_struct *_pick_next_tado { rt_se =pick_next_rt_entity (rq, rt_rq); -BUG_ON (!rt_se); +if (unlikely (!rt_se)) +return NULL ; rt_rq =group_rt_rq (rt_se); }while (rt_rq);
Greg Kroah-Hartman
maintainerPATCH 123/129 netfilter: nf_queue: fix socket leak
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vamsi Krishna Brahmajosyula <[email protected]>
Removal of the sock_hold got lost when backporting commit c3873070247d ("netfilter: nf_queue: fix possible use-after-free") to 4.19
Fixed in 4.14 with
https://lore.kernel.org/all/[email protected]/
--- net/netfilter/nf_queue.c | 2 -- 1 file changed, 2 deletions(-)
net/netfilter/nf_queue.c +0 -2
@@ -93,8 +93,6 @@ bool nf_queue_entry_get_refs(struct nf_qdev_hold (state->in);if (state->out)dev_hold (state->out); -if (state->sk) -sock_hold (state->sk);#if IS_ENABLED (CONFIG_BRIDGE_NETFILTER )if (entry->skb->nf_bridge) {struct net_device *physdev;
Greg Kroah-Hartman
maintainerPATCH 124/129 rtnetlink: Reject negative ifindexes in RTM_NEWLINK
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <[email protected]>
[ Upstream commit 30188bd7838c16a98a520db1fe9df01ffc6ed368 ]
Negative ifindexes are illegal, but the kernel does not validate the ifindex in the ancillary header of RTM_NEWLINK messages, resulting in the kernel generating a warning [1] when such an ifindex is specified.
Fix by rejecting negative ifindexes.
[1]
WARNING: CPU: 0 PID: 5031 at net/core/dev.c:9593 dev_index_reserve+0x1a2/0x1c0 net/core/dev.c:9593 [...] Call Trace: <TASK> register_netdevice+0x69a/0x1490 net/core/dev.c:10081 br_dev_newlink+0x27/0x110 net/bridge/br_netlink.c:1552 rtnl_newlink_create net/core/rtnetlink.c:3471 [inline] __rtnl_newlink+0x115e/0x18c0 net/core/rtnetlink.c:3688 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3701 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6427 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545 netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline] netlink_unicast+0x536/0x810 net/netlink/af_netlink.c:1368 netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910 sock_sendmsg_nosec net/socket.c:728 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:751 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2538 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2592 __sys_sendmsg+0x117/0x1e0 net/socket.c:2621 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
--- net/core/rtnetlink.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
net/core/rtnetlink.c +4 -1
@@ -2702,7 +2702,10 @@ static int rtnl_setlink(struct sk_buff * ifm =nlmsg_data (nlh);if (ifm->ifi_index >0 ) dev =__dev_get_by_index (net, ifm->ifi_index); -else if (tb[IFLA_IFNAME ]) +else if (ifm->ifi_index <0 ) { +NL_SET_ERR_MSG (extack,"ifindex can't be negative" ); +return -EINVAL ; + }else if (tb[IFLA_IFNAME ]) dev =__dev_get_by_name (net, ifname);else goto errout;
Greg Kroah-Hartman
maintainerPATCH 125/129 irqchip/mips-gic: Dont touch vl_map if a local interrupt is not routable
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiaxun Yang <[email protected]>
commit 2c6c9c049510163090b979ea5f92a68ae8d93c45 upstream.
When a GIC local interrupt is not routable, it's vl_map will be used to control some internal states for core (providing IPTI, IPPCI, IPFDC input signal for core). Overriding it will interfere core's intetrupt controller.
Do not touch vl_map if a local interrupt is not routable, we are not going to remap it.
Before dd098a0e0319 (" irqchip/mips-gic: Get rid of the reliance on irq_cpu_online()"), if a local interrupt is not routable, then it won't be requested from GIC Local domain, and thus gic_all_vpes_irq_cpu_online won't be called for that particular interrupt.
--- drivers/irqchip/irq-mips-gic.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/irqchip/irq-mips-gic.c +2 -0
@@ -396,6 +396,8 @@ static void gic_all_vpes_irq_cpu_online(unsigned int intr = local_intrs[i];struct gic_all_vpes_chip_data *cd; +if (!gic_local_irq_is_routable (intr)) +continue ; cd = &gic_all_vpes_chip_data[intr];write_gic_vl_map (mips_gic_vx_map_reg (intr), cd->map);if (cd->mask)
Greg Kroah-Hartman
maintainerPATCH 126/129 scsi: snic: Fix double free in snic_tgt_create()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Wang <[email protected]>
commit 1bd3a76880b2bce017987cf53780b372cf59528e upstream.
Commit 41320b18a0e0 ("scsi: snic: Fix possible memory leak if device_add() fails") fixed the memory leak caused by dev_set_name() when device_add() failed. However, it did not consider that 'tgt' has already been released when put_device(&tgt->dev) is called. Remove kfree(tgt) in the error path to avoid double free of 'tgt' and move put_device(&tgt->dev) after the removed kfree(tgt) to avoid a use-after-free.
--- drivers/scsi/snic/snic_disc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/snic/snic_disc.c +1 -2
@@ -316,12 +316,11 @@ snic_tgt_create(struct snic *snic, struc"Snic Tgt: device_add, with err = %d\n" , ret); -put_device (&tgt->dev);put_device (&snic->shost->shost_gendev);spin_lock_irqsave (snic->shost->host_lock, flags);list_del (&tgt->list);spin_unlock_irqrestore (snic->shost->host_lock, flags); -kfree (tgt); +put_device (&tgt->dev); tgt =NULL ;return tgt;
Greg Kroah-Hartman
maintainerPATCH 127/129 scsi: core: raid_class: Remove raid_component_add()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Wang <[email protected]>
commit 60c5fd2e8f3c42a5abc565ba9876ead1da5ad2b7 upstream.
The raid_component_add() function was added to the kernel tree via patch "[SCSI] embryonic RAID class" (2005). Remove this function since it never has had any callers in the Linux kernel. And also raid_component_release() is only used in raid_component_add(), so it is also removed.
--- drivers/scsi/raid_class.c | 48 --------------------------------------------- include/linux/raid_class.h | 4 --- 2 files changed, 52 deletions(-)
drivers/scsi/raid_class.c +0 -48
@@ -210,54 +210,6 @@ raid_attr_ro_state(level);raid_attr_ro_fn (resync);raid_attr_ro_state_fn (state); -static void raid_component_release (struct device *dev) -{ -struct raid_component *rc = - container_of(dev, struct raid_component, dev); -dev_printk (KERN_ERR , rc->dev.parent,"COMPONENT RELEASE\n" ); -put_device (rc->dev.parent); -kfree (rc); -} - -int raid_component_add (struct raid_template *r,struct device *raid_dev, -struct device *component_dev) -{ -struct device *cdev = -attribute_container_find_class_device (&r->raid_attrs.ac, - raid_dev); -struct raid_component *rc; -struct raid_data *rd =dev_get_drvdata (cdev); -int err; - - rc =kzalloc (sizeof (*rc),GFP_KERNEL ); -if (!rc) -return -ENOMEM ; - -INIT_LIST_HEAD (&rc->node); -device_initialize (&rc->dev); - rc->dev.release = raid_component_release; - rc->dev.parent =get_device (component_dev); - rc->num = rd->component_count++; - -dev_set_name (&rc->dev,"component-%d" , rc->num); -list_add_tail (&rc->node, &rd->component_list); - rc->dev.class = &raid_class.class; - err =device_add (&rc->dev); -if (err) - goto err_out; - -return 0 ; - -err_out: -put_device (&rc->dev); -list_del (&rc->node); - rd->component_count--; -put_device (component_dev); -kfree (rc); -return err; -} -EXPORT_SYMBOL (raid_component_add); -struct raid_template *raid_class_attach (struct raid_function_template *ft) {
include/linux/raid_class.h +0 -4
@@ -78,7 +78,3 @@ DEFINE_RAID_ATTRIBUTE(enum raid_state, sstruct raid_template *raid_class_attach (struct raid_function_template *);void raid_class_release (struct raid_template *); - -int __must_check raid_component_add (struct raid_template *,struct device *, -struct device *); -
Greg Kroah-Hartman
maintainerPATCH 128/129 clk: Fix undefined reference to `clk_rate_exclusive_{get,put}
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <[email protected]>
[ Upstream commit 2746f13f6f1df7999001d6595b16f789ecc28ad1 ]
The COMMON_CLK config is not enabled in some of the architectures. This causes below build issues:
pwm-rz-mtu3.c:(.text+0x114):
undefined reference to `clk_rate_exclusive_put'
pwm-rz-mtu3.c:(.text+0x32c):
undefined reference to `clk_rate_exclusive_get'
Fix these issues by moving clk_rate_exclusive_{get,put} inside COMMON_CLK code block, as clk.c is enabled by COMMON_CLK.
--- include/linux/clk.h | 80 ++++++++++++++++++++++----------------------- 1 file changed, 40 insertions(+), 40 deletions(-)
include/linux/clk.h +40 -40
@@ -175,6 +175,39 @@ int clk_get_scaled_duty_cycle(struct clk *clk, unsigned int scale);*/ bool clk_is_match (const struct clk *p,const struct clk *q); +/** +* clk_rate_exclusive_get - get exclusivity over the rate control of a +* producer +* @clk: clock source +* +* This function allows drivers to get exclusive control over the rate of a +* provider. It prevents any other consumer to execute, even indirectly, +* opereation which could alter the rate of the provider or cause glitches +* +* If exlusivity is claimed more than once on clock, even by the same driver, +* the rate effectively gets locked as exclusivity can't be preempted. +* +* Must not be called from within atomic context. +* +* Returns success (0) or negative errno. +*/ +int clk_rate_exclusive_get (struct clk *clk); + +/** +* clk_rate_exclusive_put - release exclusivity over the rate control of a +* producer +* @clk: clock source +* +* This function allows drivers to release the exclusivity it previously got +* from clk_rate_exclusive_get() +* +* The caller must balance the number of clk_rate_exclusive_get() and +* clk_rate_exclusive_put() calls. +* +* Must not be called from within atomic context. +*/ +void clk_rate_exclusive_put (struct clk *clk); +#else static inline int clk_notifier_register(struct clk *clk,
@@ -221,6 +254,13 @@ static inline bool clk_is_match(const struct clk *p, const struct clk *q) return p == q; } +static inline int clk_rate_exclusive_get (struct clk *clk) +{ +return 0 ; +} + +static inline void clk_rate_exclusive_put (struct clk *clk) {} +#endif /**
@@ -364,38 +404,6 @@ struct clk *devm_clk_get(struct device *dev, const char *id);*/ struct clk *devm_get_clk_from_child (struct device *dev,struct device_node *np,const char *con_id); -/** -* clk_rate_exclusive_get - get exclusivity over the rate control of a -* producer -* @clk: clock source -* -* This function allows drivers to get exclusive control over the rate of a -* provider. It prevents any other consumer to execute, even indirectly, -* opereation which could alter the rate of the provider or cause glitches -* -* If exlusivity is claimed more than once on clock, even by the same driver, -* the rate effectively gets locked as exclusivity can't be preempted. -* -* Must not be called from within atomic context. -* -* Returns success (0) or negative errno. -*/ -int clk_rate_exclusive_get (struct clk *clk); - -/** -* clk_rate_exclusive_put - release exclusivity over the rate control of a -* producer -* @clk: clock source -* -* This function allows drivers to release the exclusivity it previously got -* from clk_rate_exclusive_get() -* -* The caller must balance the number of clk_rate_exclusive_get() and -* clk_rate_exclusive_put() calls. -* -* Must not be called from within atomic context. -*/ -void clk_rate_exclusive_put (struct clk *clk);/** * clk_enable - inform the system when the clock source should be running.
@@ -665,14 +673,6 @@ static inline void clk_bulk_put(int num_clks, struct clk_bulk_data *clks) {}static inline void devm_clk_put (struct device *dev,struct clk *clk) {} - -static inline int clk_rate_exclusive_get (struct clk *clk) -{ -return 0 ; -} - -static inline void clk_rate_exclusive_put (struct clk *clk) {} -static inline int clk_enable (struct clk *clk) {return 0 ;
Signature · 1 line
2.40.1
Greg Kroah-Hartman
maintainerPATCH 129/129 dma-buf/sw_sync: Avoid recursive lock during fence signal
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit e531fdb5cd5ee2564b7fe10c8a9219e2b2fac61e ]
If a signal callback releases the sw_sync fence, that will trigger a deadlock as the timeline_fence_release recurses onto the fence->lock (used both for signaling and the the timeline tree).
To avoid that, temporarily hold an extra reference to the signalled fences until after we drop the lock.
(This is an alternative implementation of https://patchwork.kernel.org/patch/11664717/
which avoids some potential UAF issues with the original patch.)
v2: Remove now obsolete comment, use list_move_tail() and
list_del_init()
--- drivers/dma-buf/sw_sync.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-)
drivers/dma-buf/sw_sync.c +9 -9
@@ -200,6 +200,7 @@ static const struct dma_fence_ops timeline_fence_ops = {*/ static void sync_timeline_signal (struct sync_timeline *obj,unsigned int inc) { +LIST_HEAD (signalled);struct sync_pt *pt, *next;trace_sync_timeline (obj);
@@ -212,21 +213,20 @@ static void sync_timeline_signal(struct sync_timeline *obj, unsigned int inc)if (!timeline_fence_signaled (&pt->base))break ; -list_del_init (&pt->link); +dma_fence_get (&pt->base); + +list_move_tail (&pt->link, &signalled);rb_erase (&pt->node, &obj->pt_tree); -/* -* A signal callback may release the last reference to this -* fence, causing it to be freed. That operation has to be -* last to avoid a use after free inside this loop, and must -* be after we remove the fence from the timeline in order to -* prevent deadlocking on timeline->lock inside -* timeline_fence_release(). -*/ dma_fence_signal_locked (&pt->base); }spin_unlock_irq (&obj->lock); + +list_for_each_entry_safe (pt, next, &signalled, link) { +list_del_init (&pt->link); +dma_fence_put (&pt->base); + } }/**
Signature · 1 line
2.40.1
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regressions on arm.
stable-rc linux-4.19.y arm gcc-12 builds fails with following warnings / errors.
Build errors:
--------------drivers/bus/ti-sysc.c: In function 'sysc_reset':drivers/bus/ti-sysc.c:982:15: error: implicit declaration of function 'sysc_read_sysconfig' [-Werror=implicit-function-declaration]
982 | val = sysc_read_sysconfig(ddata);
| ^~~~~~~~~~~~~~~~~~~cc1: some warnings being treated as errors
Quoted 2 lines
Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before reset
bus: ti-sysc: Flush posted write on enable before reset commit 34539b442b3bc7d5bf10164750302b60b91f18a7 upstream.
The above commit is causing this build warnings / errors.
Links,
https://storage.tuxsuite.com/public/linaro/lkft/builds/2UbpNRPtHJcx6nk8e60amSmKgZ3/
steps to reproduce:
tuxmake --runtime podman --target-arch arm --toolchain gcc-12
--kconfig https://storage.tuxsuite.com/public/linaro/lkft/builds/2UbpNRPtHJcx6nk8e60amSmKgZ3/config
--
Linaro LKFT
https://lkft.linaro.org
Hi!
Quoted 29 lines
Quoted 9 lines
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regressions on arm.stable-rc linux-4.19.y arm gcc-12 builds fails with following warnings / errors.
Build errors:
--------------drivers/bus/ti-sysc.c: In function 'sysc_reset':drivers/bus/ti-sysc.c:982:15: error: implicit declaration of function 'sysc_read_sysconfig' [-Werror=implicit-function-declaration]
Quoted 5 lines
982 | val = sysc_read_sysconfig(ddata); | ^~~~~~~~~~~~~~~~~~~cc1: some warnings being treated as errors
We see this one, too:
CC kernel/kthread.o1126drivers/bus/ti-sysc.c: In function 'sysc_reset':1127drivers/bus/ti-sysc.c:982:8: error: implicit declaration of function 'sysc_read_sysconfig'; did you mean 'sysc_read_revision'? [-Werror=implicit-function-declaration] 1128 val = sysc_read_sysconfig(ddata);
1129 ^~~~~~~~~~~~~~~~~~~
1130 sysc_read_revision
1131 CC drivers/char/hw_random/omap3-rom-rng.o 1132 CC fs/readdir.o
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Erika Unter HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Greg Kroah-Hartman
maintainerQuoted 39 lines · Naresh Kamboju
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
Regressions on arm.stable-rc linux-4.19.y arm gcc-12 builds fails with following warnings / errors.
Build errors:
--------------drivers/bus/ti-sysc.c: In function 'sysc_reset':drivers/bus/ti-sysc.c:982:15: error: implicit declaration of function 'sysc_read_sysconfig' [-Werror=implicit-function-declaration]982 | val = sysc_read_sysconfig(ddata); | ^~~~~~~~~~~~~~~~~~~cc1: some warnings being treated as errors
Quoted 7 lines
Quoted 2 lines
Tony Lindgren <[email protected]>
bus: ti-sysc: Flush posted write on enable before resetbus: ti-sysc: Flush posted write on enable before reset commit
34539b442b3bc7d5bf10164750302b60b91f18a7upstream.The above commit is causing this build warnings / errors.
Now dropped, thanks.
greg k-h
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Just an initial report.
mips builds are failing with the error:arch/mips/alchemy/common/dbdma.c:33:10: fatal error:linux/dma-map-ops.h: No such file or directory
33 | #include <linux/dma-map-ops.h> /* for dma_default_coherent */ | ^~~~~~~~~~~~~~~~~~~~~
arm build has failed with:arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error: platform.h: No such file or directory
12 | #include "platform.h"
| ^~~~~~~~~~~~
Signature · 2 lines
Regards Sudip
Quoted 21 lines · Sudip Mukherjee
Hi Greg,
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Just an initial report.
mips builds are failing with the error:
arch/mips/alchemy/common/dbdma.c:33:10: fatal error:linux/dma-map-ops.h: No such file or directory
33 | #include <linux/dma-map-ops.h> /* fordma_default_coherent*/ | ^~~~~~~~~~~~~~~~~~~~~
Quoted 7 lines
arm build has failed with:
arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error:platform.h: No such file or directory
12 | #include "platform.h"
| ^~~~~~~~~~~~
I'd guess that the mips dma patch which fail to build in v5.10.y (and by extension in all older kernels) have been applied to those older kernels. AFAICs the problem now affects all releases form v4.14.y to v5.10.y.
Guenter
Hi Greg,
Quoted 7 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Build test (gcc version 11.4.1 20230829):
mips: 63 configs -> 4 failures
arm: 115 configs -> 4 failures
arm64: 2 configs -> no failurex86_64: 4 configs -> no failure
alpha allmodconfig -> no failure
powerpc allmodconfig -> no failure
riscv allmodconfig -> no failure
s390 allmodconfig -> no failure
xtensa allmodconfig -> no failure
Note:
1. mips builds are failing with the error:
arch/mips/alchemy/common/dbdma.c:33:10: fatal error: linux/dma-map-ops.h: No such file or directory
33 | #include <linux/dma-map-ops.h> /* for dma_default_coherent */
| ^~~~~~~~~~~~~~~~~~~~~
2. arm builds are failing with the error:
arm allmodconfig, multi_v7_defconfig and omap2plus_defconfig:
drivers/bus/ti-sysc.c: In function 'sysc_reset':drivers/bus/ti-sysc.c:982:15: error: implicit declaration of function 'sysc_read_sysconfig' [-Werror=implicit-function-declaration]
982 | val = sysc_read_sysconfig(ddata);
| ^~~~~~~~~~~~~~~~~~~arm ep93xx_defconfig:
arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error: platform.h: No such file or directory
12 | #include "platform.h"
| ^~~~~~~~~~~~
Boot test:x86_64: Booted on my test laptop. No regression.x86_64: Booted on qemu. No regression. [1]
[1]. https://openqa.qa.codethink.co.uk/tests/4857
Signature · 2 lines
Regards Sudip
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
Build results:
total: 149 pass: 144 fail: 5
Failed builds:
arm:allmodconfig
arm:omap2plus_defconfig
arm:ep93xx_defconfig
mips:mtx1_defconfig
mips:db1xxx_defconfig
Qemu test results:
total: 438 pass: 407 fail: 31
Failed tests:
<lots of arm>
arm:allmodconfig and others
drivers/bus/ti-sysc.c: In function 'sysc_reset':drivers/bus/ti-sysc.c:982:15: error: implicit declaration of function 'sysc_read_sysconfig'
arm boot tests fail with the same build error.
arm:ep93xx_defconfig
arch/arm/mach-ep93xx/timer-ep93xx.c:12:10: fatal error: platform.h
mips:mtx1_defconfig
arch/mips/alchemy/common/dbdma.c:33:10: fatal error: linux/dma-map-ops.h
Guenter
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Failures detected for Tegra ...
Test results for stable-v4.19:
11 builds: 6 pass, 5 fail
14 boots: 14 pass, 0 fail
24 tests: 24 pass, 0 failLinux version: 4.19.293-rc1-ga291d82603f3
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04Builds failed: aarch64+defconfig+jetson, arm+multi_v7
Jon
Jon Hunter
maintainerQuoted 26 lines · Jon Hunter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.19.293 release. There are 129 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 30 Aug 2023 10:11:30 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.293-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.19.y
and the diffstat can be found below.thanks,
greg k-h
Failures detected for Tegra ...
Test results for stable-v4.19:
11 builds: 6 pass, 5 fail 14 boots: 14 pass, 0 fail 24 tests: 24 pass, 0 fail
Quoted 6 lines
Linux version: 4.19.293-rc1-ga291d82603f3
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,tegra194-p2972-0000, tegra20-ventana, tegra210-p2371-2180, tegra30-cardhu-a04Builds failed: aarch64+defconfig+jetson, arm+multi_v7
It is the same build issue everyone is reporting ...
kernel/drivers/bus/ti-sysc.c: In function ‘sysc_reset’:
kernel/drivers/bus/ti-sysc.c:982:8: error: implicit declaration of function ‘sysc_read_sysconfig’; did you mean ‘sysc_read_revision’? [-Werror=implicit-function-declaration]
val = sysc_read_sysconfig(ddata);
^~~~~~~~~~~~~~~~~~~Jon
Signature · 1 line
nvpublic