4.19.323-rc1 review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.19.323-rc1 review
This is the start of the stable review cycle for the 4.19.323 release. There are 350 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri, 08 Nov 2024 12:02:47 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.323-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.19.323-rc1
Jeongjun Park <[email protected]>
vt: prevent kernel-infoleak in con_font_get()
Jeongjun Park <[email protected]>
mm: shmem: fix data-race in shmem_getattr()
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel bug due to missing clearing of checked flag
Edward Adam Davis <[email protected]>
ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow
Ryusuke Konishi <[email protected]>
nilfs2: fix potential deadlock with newly created symlinks
Ville Syrjälä <[email protected]>
wifi: iwlegacy: Clear stale interrupts before resuming device
Manikanta Pubbisetty <[email protected]>
wifi: ath10k: Fix memory leak in management tx
Felix Fietkau <[email protected]>
wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower
Greg Kroah-Hartman <[email protected]>
Revert "driver core: Fix uevent_show() vs driver detach race"
Faisal Hassan <[email protected]>
xhci: Fix Link TRB DMA in command ring stopped completion event
Zijun Hu <[email protected]>
usb: phy: Fix API devm_usb_put_phy() can not release the phy
Zongmin Zhou <[email protected]>
usbip: tools: Fix detach_port() invalid port error path
Dimitri Sivanich <[email protected]>
misc: sgi-gru: Don't disable preemption in GRU driver
Daniel Palmer <[email protected]>
net: amd: mvme147: Fix probe banner message
Xiongfeng Wang <[email protected]>
firmware: arm_sdei: Fix the input parameter of cpuhp_remove_state()
Pablo Neira Ayuso <[email protected]>
netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
Benoît Monin <[email protected]>
net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension
Xin Long <[email protected]>
net: support ip generic csum processing in skb_csum_hwoffload_help
Byeonguk Jeong <[email protected]>
bpf: Fix out-of-bounds write in trie_get_next_key()
Pedro Tammela <[email protected]>
net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT
Pablo Neira Ayuso <[email protected]>
gtp: allow -1 to be specified as file description from userspace
Christophe JAILLET <[email protected]>
gtp: simplify error handling code in 'gtp_encap_enable()'
Wander Lairson Costa <[email protected]>
igb: Disable threaded IRQ for igb_msix_other
Felix Fietkau <[email protected]>
wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys
Xiu Jianfeng <[email protected]>
cgroup: Fix potential overflow issue when checking max_depth
Selvarasu Ganesan <[email protected]>
usb: dwc3: core: Stop processing of pending events if controller is halted
Yu Chen <[email protected]>
usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc
Marek Szyprowski <[email protected]>
usb: dwc3: remove generic PHY calibrate() calls
Sabrina Dubroca <[email protected]>
xfrm: validate new SA's prefixlen using SA family when sel.family is unset
junhua huang <[email protected]>
arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning
Paul Moore <[email protected]>
selinux: improve error checking in sel_write_load()
Haiyang Zhang <[email protected]>
hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event
Ryusuke Konishi <[email protected]>
nilfs2: fix kernel bug due to missing clearing of buffer delay flag
Shubham Panwar <[email protected]>
ACPI: button: Add DMI quirk for Samsung Galaxy Book2 to fix initial lid detection issue
Mario Limonciello <[email protected]>
drm/amd: Guard against bad data for ATIF ACPI method
Kailang Yang <[email protected]>
ALSA: hda/realtek: Update default depop procedure
Jinjie Ruan <[email protected]>
posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()
Oliver Neukum <[email protected]>
net: usb: usbnet: fix name regression
Biju Das <[email protected]>
dt-bindings: power: Add r8a774b1 SYSC power domain definitions
Wang Hai <[email protected]>
be2net: fix potential memory leak in be_xmit()
Wang Hai <[email protected]>
net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()
Dave Kleikamp <[email protected]>
jfs: Fix sanity check in dbMount
Gianfranco Trad <[email protected]>
udf: fix uninit-value use in udf_get_fileshortad
Nico Boehr <[email protected]>
KVM: s390: gaccess: Check if guest address is in memslot
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Cleanup access to guest pages
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Refactor access address range check
Janis Schoetterl-Glausch <[email protected]>
KVM: s390: gaccess: Refactor gpa and length calculation
Mark Rutland <[email protected]>
arm64: probes: Fix uprobes for big-endian kernels
junhua huang <[email protected]>
arm64:uprobe fix the uprobe SWBP_INSN in big-endian
Ye Bin <[email protected]>
Bluetooth: bnep: fix wild-memory-access in proto_unregister
Thadeu Lima de Souza Cascardo <[email protected]>
usb: typec: altmode should keep reference to parent
Wang Hai <[email protected]>
net: systemport: fix potential memory leak in bcm_sysport_xmit()
Wang Hai <[email protected]>
net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()
Sabrina Dubroca <[email protected]>
macsec: don't increment counters for an unrelated SA
Jonathan Marek <[email protected]>
drm/msm/dsi: fix 32-bit signed integer extension in pclk_rate calculation
Kalesh AP <[email protected]>
RDMA/bnxt_re: Return more meaningful error
Anumula Murali Mohan Reddy <[email protected]>
RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP
Saravanan Vajravel <[email protected]>
RDMA/bnxt_re: Fix incorrect AVID type in WQE structure
Andrey Skvortsov <[email protected]>
clk: Fix slab-out-of-bounds error in devm_clk_release()
Uwe Kleine-König <[email protected]>
clk: Fix pointer casting to prevent oops in devm_clk_release()
Ryusuke Konishi <[email protected]>
nilfs2: propagate directory read errors from nilfs_find_entry()
Zhang Rui <[email protected]>
x86/apic: Always explicitly disarm TSC-deadline timer
Takashi Iwai <[email protected]>
parport: Proper fix for array out-of-bounds access
Daniele Palmas <[email protected]>
USB: serial: option: add Telit FN920C04 MBIM compositions
Benjamin B. Frost <[email protected]>
USB: serial: option: add support for Quectel EG916Q-GL
Mathias Nyman <[email protected]>
xhci: Fix incorrect stream context type macro
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001
Aaron Thompson <[email protected]>
Bluetooth: Remove debugfs directory on module init failure
Emil Gedenryd <[email protected]>
iio: light: opt3001: add missing full-scale range value
Christophe JAILLET <[email protected]>
iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()
Javier Carrasco <[email protected]>
iio: adc: ti-ads8688: add missing select IIO_(TRIGGERED_)BUFFER in Kconfig
Javier Carrasco <[email protected]>
iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig
Nikolay Kuratov <[email protected]>
drm/vmwgfx: Handle surface check failure correctly
Jim Mattson <[email protected]>
x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET
Michael Mueller <[email protected]>
KVM: s390: Change virtual to physical address access in diag 0x258 handler
Thomas Weißschuh <[email protected]>
s390/sclp_vt220: Convert newlines to CRLF instead of LFCR
Joseph Huang <[email protected]>
net: dsa: mv88e6xxx: Fix out-of-bound access
Breno Leitao <[email protected]>
KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
OGAWA Hirofumi <[email protected]>
fat: fix uninitialized variable
WangYuli <[email protected]>
PCI: Add function 0 DMA alias quirk for Glenfly Arise chip
Mark Rutland <[email protected]>
arm64: probes: Fix simulate_ldr*_literal()
Mark Rutland <[email protected]>
arm64: probes: Remove broken LDR (literal) uprobe support
Jinjie Ruan <[email protected]>
posix-clock: Fix missing timespec64 check in pc_clock_settime()
Anastasia Kovaleva <[email protected]>
net: Fix an unsafe loop on the list
Icenowy Zheng <[email protected]>
usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip
Jose Alberto Reguero <[email protected]>
usb: xhci: Fix problem with xhci resume from suspend
Oliver Neukum <[email protected]>
Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"
Wade Wang <[email protected]>
HID: plantronics: Workaround for an unexcepted opposite volume key
Oliver Neukum <[email protected]>
CDC-NCM: avoid overflow in sanity checking
[email protected] <[email protected]>
net: ipv6: ensure we call ipv6_mc_down() at most once
Eric Dumazet <[email protected]>
ppp: fix ppp_async_encode() illegal access
Rosen Penev <[email protected]>
net: ibm: emac: mal: fix wrong goto
Mohamed Khalfella <[email protected]>
igb: Do not bring the device up after non-fatal error
Billy Tsai <[email protected]>
gpio: aspeed: Use devm_clk api to manage clock source
Uwe Kleine-König <[email protected]>
clk: Provide new devm_clk helpers for prepared and enabled clocks
Uwe Kleine-König <[email protected]>
clk: generalize devm_clk_get() a bit
Phil Edworthy <[email protected]>
clk: Add (devm_)clk_get_optional() functions
Billy Tsai <[email protected]>
gpio: aspeed: Add the flush write to ensure the write complete.
Luiz Augusto von Dentz <[email protected]>
Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change
Andy Roulin <[email protected]>
netfilter: br_netfilter: fix panic with metadata_dst skb
Neal Cardwell <[email protected]>
tcp: fix tcp_enter_recovery() to zero retrans_stamp when it's safe
Dan Carpenter <[email protected]>
SUNRPC: Fix integer overflow in decode_rc_list()
Chuck Lever <[email protected]>
NFS: Remove print_overflow_msg()
Andrey Shumilin <[email protected]>
fbdev: sisfb: Fix strbuf array overflow
Zijun Hu <[email protected]>
driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute
Zhu Jun <[email protected]>
tools/iio: Add memory allocation failure check for trigger_name
Xu Yang <[email protected]>
usb: chipidea: udc: enable suspend interrupt after usb reset
Yunke Cao <[email protected]>
media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()
Alex Williamson <[email protected]>
PCI: Mark Creative Labs EMU20k2 INTx masking as broken
Hans de Goede <[email protected]>
i2c: i801: Use a different adapter-name for IDF adapters
Krzysztof Kozlowski <[email protected]>
clk: bcm: bcm53573: fix OF node leak in init
Daniel Jordan <[email protected]>
ktest.pl: Avoid false positives with grub2 skip regex
Thomas Richter <[email protected]>
s390/cpum_sf: Remove WARN_ON_ONCE statements
Wojciech Gładysz <[email protected]>
ext4: nested locking for xattr inode
Gerald Schaefer <[email protected]>
s390/mm: Add cond_resched() to cmm_alloc/free_pages()
Heiko Carstens <[email protected]>
s390/facility: Disable compile time optimization for decompressor code
Tao Chen <[email protected]>
bpf: Check percpu map value size first
Mathias Krause <[email protected]>
Input: synaptics-rmi4 - fix UAF of IRQ domain on driver removal
Michael S. Tsirkin <[email protected]>
virtio_console: fix misc probe bugs
Rob Clark <[email protected]>
drm/crtc: fix uninitialized variable use even harder
Sean Paul <[email protected]>
drm: Move drm_mode_setcrtc() local re-init to failure path
Steven Rostedt (Google) <[email protected]>
tracing: Remove precision vsnprintf() check from print event
Linus Walleij <[email protected]>
net: ethernet: cortina: Drop TSO support
zhanchengbin <[email protected]>
ext4: fix inode tree inconsistency caused by ENOMEM
Armin Wolf <[email protected]>
ACPI: battery: Fix possible crash when unregistering a battery hook
Armin Wolf <[email protected]>
ACPI: battery: Simplify battery hook locking
Krzysztof Kozlowski <[email protected]>
rtc: at91sam9: fix OF node leak in probe() error path
Alexandre Belloni <[email protected]>
rtc: at91sam9: drop platform_data support
NeilBrown <[email protected]>
nfsd: fix delegation_blocked() to block correctly for at least 30 seconds
Arnd Bergmann <[email protected]>
nfsd: use ktime_get_seconds() for timestamps
Oleg Nesterov <[email protected]>
uprobes: fix kernel info leak via "[uprobes]" vma
Mark Rutland <[email protected]>
arm64: errata: Expand speculative SSBS workaround once more
Mark Rutland <[email protected]>
arm64: cputype: Add Neoverse-N3 definitions
Anshuman Khandual <[email protected]>
arm64: Add Cortex-715 CPU part definition
Baokun Li <[email protected]>
ext4: update orig_path in ext4_find_extent()
Baokun Li <[email protected]>
ext4: fix slab-use-after-free in ext4_split_extent_at()
Theodore Ts'o <[email protected]>
ext4: avoid ext4_error()'s caused by ENOMEM in the truncate path
Emanuele Ghidoli <[email protected]>
gpio: davinci: fix lazy disable
Filipe Manana <[email protected]>
btrfs: wait for fixup workers before stopping cleaner kthread during umount
Nuno Sa <[email protected]>
Input: adp5589-keys - fix adp5589_gpio_get_value()
Tetsuo Handa <[email protected]>
tomoyo: fallback to realpath if symlink's pathname does not exist
Barnabás Czémán <[email protected]>
iio: magnetometer: ak8975: Fix reading for ak099xx sensors
Zheng Wang <[email protected]>
media: venus: fix use after free bug in venus_remove due to race condition
Hans Verkuil <[email protected]>
media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags
Sebastian Reichel <[email protected]>
clk: rockchip: fix error for unknown clocks
Chun-Yi Lee <[email protected]>
aoe: fix the potential use-after-free problem in more places
Jisheng Zhang <[email protected]>
riscv: define ILLEGAL_POINTER_VALUE for 64bit
Lizhi Xu <[email protected]>
ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate
Julian Sun <[email protected]>
ocfs2: fix null-ptr-deref when journal load failed.
Lizhi Xu <[email protected]>
ocfs2: remove unreasonable unlock in ocfs2_read_blocks
Joseph Qi <[email protected]>
ocfs2: cancel dqi_sync_work before freeing oinfo
Gautham Ananthakrishna <[email protected]>
ocfs2: reserve space for inline xattr before attaching reflink tree
Joseph Qi <[email protected]>
ocfs2: fix uninit-value in ocfs2_get_block()
Heming Zhao <[email protected]>
ocfs2: fix the la space leak when unmounting an ocfs2 volume
Baokun Li <[email protected]>
jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error
Andrew Jones <[email protected]>
of/irq: Support #msi-cells=<0> in of_msi_get_domain
Helge Deller <[email protected]>
parisc: Fix 64-bit userspace syscall path
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()
Baokun Li <[email protected]>
ext4: fix double brelse() the buffer of the extents path
Baokun Li <[email protected]>
ext4: aovid use-after-free in ext4_ext_insert_extent()
Luis Henriques (SUSE) <[email protected]>
ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()
Baokun Li <[email protected]>
ext4: propagate errors from ext4_find_extent() in ext4_insert_range()
Edward Adam Davis <[email protected]>
ext4: no need to continue when the number of entries is 1
Jaroslav Kysela <[email protected]>
ALSA: core: add isascii() check to card ID generator
Helge Deller <[email protected]>
parisc: Fix itlb miss handler for 64-bit programs
Luo Gengkun <[email protected]>
perf/core: Fix small negative period being ignored
Jinjie Ruan <[email protected]>
spi: bcm63xx: Fix module autoloading
Robert Hancock <[email protected]>
i2c: xiic: Wait for TX empty to avoid missed TX NAKs
Christophe Leroy <[email protected]>
selftests: vDSO: fix vDSO symbols lookup for powerpc64
Yifei Liu <[email protected]>
selftests: breakpoints: use remaining time to check if suspend succeed
Ben Dooks <[email protected]>
spi: s3c64xx: fix timeout counters in flush_fifo
Artem Sadovnikov <[email protected]>
ext4: fix i_data_sem unlock order in ext4_ind_migrate()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: ext4_search_dir should return a proper error
Geert Uytterhoeven <[email protected]>
of/irq: Refer to actual buffer size in of_irq_parse_one()
Geert Uytterhoeven <[email protected]>
drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()
Kees Cook <[email protected]>
scsi: aacraid: Rearrange order of struct aac_srb_unit
Matthew Brost <[email protected]>
drm/printer: Allow NULL data in devcoredump printer
Srinivasan Shanmugam <[email protected]>
drm/amd/display: Fix index out of bounds in degamma hardware format translation
Alex Hung <[email protected]>
drm/amd/display: Check stream before comparing them
Zhao Mengmeng <[email protected]>
jfs: Fix uninit-value access of new_ea in ea_buffer
Edward Adam Davis <[email protected]>
jfs: check if leafidx greater than num leaves per dmap tree
Edward Adam Davis <[email protected]>
jfs: Fix uaf in dbFreeBits
Remington Brasga <[email protected]>
jfs: UBSAN: shift-out-of-bounds in dbFindBits
Damien Le Moal <[email protected]>
ata: sata_sil: Rename sil_blacklist to sil_quirks
Andrew Davis <[email protected]>
power: reset: brcmstb: Do not go into infinite loop if reset fails
Kaixin Wang <[email protected]>
fbdev: pxafb: Fix possible use after free in pxafb_task()
Takashi Iwai <[email protected]>
ALSA: hdsp: Break infinite MIDI input flush loop
Takashi Iwai <[email protected]>
ALSA: asihpi: Fix potential OOB array access
Thomas Gleixner <[email protected]>
signal: Replace BUG_ON()s
Gustavo A. R. Silva <[email protected]>
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()
Aleksandrs Vinarskis <[email protected]>
ACPICA: iasl: handle empty connection_node
Jason Xing <[email protected]>
tcp: avoid reusing FIN_WAIT2 when trying to find port in connect() process
Ido Schimmel <[email protected]>
ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family
Kuniyuki Iwashima <[email protected]>
ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).
Simon Horman <[email protected]>
net: mvpp2: Increase size of queue_name buffer
Simon Horman <[email protected]>
tipc: guard against string buffer overrun
Pei Xiao <[email protected]>
ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()
Rafael J. Wysocki <[email protected]>
ACPI: EC: Do not release locks during operation region accesses
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
Armin Wolf <[email protected]>
ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_mdio: fix OF node leak in probe()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
Krzysztof Kozlowski <[email protected]>
net: hisilicon: hip04: fix OF node leak in probe()
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
Dmitry Kandybka <[email protected]>
wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
Jann Horn <[email protected]>
f2fs: Require FMODE_WRITE for atomic write ioctls
Takashi Iwai <[email protected]>
ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
Takashi Iwai <[email protected]>
ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
Xin Long <[email protected]>
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
Anton Danilov <[email protected]>
ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
Eric Dumazet <[email protected]>
net: add more sanity checks to qdisc_pkt_len_init()
Eric Dumazet <[email protected]>
net: avoid potential underflow in qdisc_pkt_len_init() with UFO
Aleksander Jan Bajkowski <[email protected]>
net: ethernet: lantiq_etop: fix memory disclosure
Prashant Malani <[email protected]>
r8152: Factor out OOB link list waits
Eric Dumazet <[email protected]>
netfilter: nf_tables: prevent nf_skb_duplicated corruption
Phil Sutter <[email protected]>
netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
Xiubo Li <[email protected]>
ceph: remove the incorrect Fw reference check when dirtying pages
Stefan Wahren <[email protected]>
mailbox: bcm2835: Fix timeout during suspend mode
Liao Chen <[email protected]>
mailbox: rockchip: fix a typo in module autoloading
Harshit Mogalapalli <[email protected]>
usb: yurex: Fix inconsistent locking bug in yurex_read()
Andy Shevchenko <[email protected]>
i2c: isch: Add missed 'else'
Tommy Huang <[email protected]>
i2c: aspeed: Update the stop sw state when the bus recovery occurs
Ma Ke <[email protected]>
pps: add an error check in parport_attach
Christophe JAILLET <[email protected]>
pps: remove usage of the deprecated ida_simple_xx() API
Oliver Neukum <[email protected]>
USB: misc: yurex: fix race between read and write
Lee Jones <[email protected]>
usb: yurex: Replace snprintf() with the safer scnprintf() variant
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix soc_dev leak during device remove
Krzysztof Kozlowski <[email protected]>
soc: versatile: realview: fix memory leak during device remove
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
Thomas Gleixner <[email protected]>
PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
Li Lingfeng <[email protected]>
nfs: fix memory leak in error path of nfs4_do_reclaim
Mickaël Salaün <[email protected]>
fs: Fix file_set_fowner LSM hook inconsistencies
Julian Sun <[email protected]>
vfs: fix race between evice_inodes() and find_inode()&iput()
Nikita Zhandarovich <[email protected]>
f2fs: avoid potential int overflow in sanity_check_area_boundary()
Nikita Zhandarovich <[email protected]>
f2fs: prevent possible int overflow in dir_block_index()
Thomas Weißschuh <[email protected]>
ACPI: sysfs: validate return type of _STR method
Mikhail Lobanov <[email protected]>
drbd: Add NULL check for net_conf to prevent dereference in state validation
Qiu-ji Chen <[email protected]>
drbd: Fix atomicity violation in drbd_uuid_set_bm()
Florian Fainelli <[email protected]>
tty: rp2: Fix reset with non forgiving PCIe host bridges
Jann Horn <[email protected]>
firmware_loader: Block path traversal
Oliver Neukum <[email protected]>
USB: misc: cypress_cy7c63: check for short transfer
Oliver Neukum <[email protected]>
USB: appledisplay: close race between probe and completion handler
Krzysztof Kozlowski <[email protected]>
soc: versatile: integrator: fix OF node leak in probe() error path
Laurent Pinchart <[email protected]>
Remove *.orig pattern from .gitignore
Hailey Mothershead <[email protected]>
crypto: aead,cipher - zeroize key buffer after use
Simon Horman <[email protected]>
netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
Youssef Samir <[email protected]>
net: qrtr: Update packets cloning when broadcasting
Josh Hunt <[email protected]>
tcp: check skb is non-NULL in tcp_rto_delta_us()
Eric Dumazet <[email protected]>
tcp: introduce tcp_skb_timestamp_us() helper
Kaixin Wang <[email protected]>
net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
Eric Dumazet <[email protected]>
netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
Suzuki K Poulose <[email protected]>
coresight: tmc: sg: Do not leak sg_table
Chao Yu <[email protected]>
f2fs: reduce expensive checkpoint trigger frequency
Chao Yu <[email protected]>
f2fs: remove unneeded check condition in __f2fs_setxattr()
Chao Yu <[email protected]>
f2fs: fix to update i_ctime in __f2fs_setxattr()
Yonggil Song <[email protected]>
f2fs: fix typo
Chao Yu <[email protected]>
f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
Guoqing Jiang <[email protected]>
nfsd: call cache_put if xdr_reserve_space returns NULL
Jinjie Ruan <[email protected]>
ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
Mikhail Lobanov <[email protected]>
RDMA/cxgb4: Added NULL check for lookup_atid
Wang Jianzheng <[email protected]>
pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
Yangtao Li <[email protected]>
pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
David Lechner <[email protected]>
clk: ti: dra7-atl: Fix leak of of_nodes
Yang Yingliang <[email protected]>
pinctrl: single: fix missing error code in pcs_probe()
Zhu Yanjun <[email protected]>
RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
Sean Anderson <[email protected]>
PCI: xilinx-nwl: Fix register misspelling
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
Junlin Li <[email protected]>
drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
Jonas Karlman <[email protected]>
clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
Ian Rogers <[email protected]>
perf time-utils: Fix 32-bit nsec parsing
Yang Jihong <[email protected]>
perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
Yang Jihong <[email protected]>
perf sched timehist: Fix missing free of session in perf_sched__timehist()
Ryusuke Konishi <[email protected]>
nilfs2: fix potential oob read in nilfs_btree_check_delete()
Ryusuke Konishi <[email protected]>
nilfs2: determine empty node blocks as corrupted
Ryusuke Konishi <[email protected]>
nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: avoid OOB when system.data xattr changes underneath the filesystem
Thadeu Lima de Souza Cascardo <[email protected]>
ext4: return error on ext4_find_inline_entry
Kemeng Shi <[email protected]>
ext4: avoid negative min_clusters in find_group_orlov()
Jiawei Ye <[email protected]>
smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
yangerkun <[email protected]>
ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
Mauricio Faria de Oliveira <[email protected]>
jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
Chen Yu <[email protected]>
kthread: fix task state in kthread worker if being frozen
Rob Clark <[email protected]>
kthread: add kthread_work tracepoints
Lasse Collin <[email protected]>
xz: cleanup CRC32 edits from 2018
Tony Ambardar <[email protected]>
selftests/bpf: Fix error compiling test_lru_map.c
Juergen Gross <[email protected]>
xen/swiotlb: add alignment check for dma buffers
Juergen Gross <[email protected]>
xen/swiotlb: simplify range_straddles_page_boundary()
Juergen Gross <[email protected]>
xen: use correct end address of kernel for conflict checking
Sherry Yang <[email protected]>
drm/msm: fix %s null argument error
Wolfram Sang <[email protected]>
ipmi: docs: don't advertise deprecated sysfs entries
Vladimir Lypak <[email protected]>
drm/msm/a5xx: fix races in preemption evaluation stage
Vladimir Lypak <[email protected]>
drm/msm/a5xx: properly clear preemption records on resume
Jeongjun Park <[email protected]>
jfs: fix out-of-bounds in dbNextAG() and diAlloc()
Nikita Zhandarovich <[email protected]>
drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
Alex Bee <[email protected]>
drm/rockchip: vop: Allow 4096px width scaling
Alex Deucher <[email protected]>
drm/radeon: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/radeon: Replace one-element array with flexible-array member
Alex Deucher <[email protected]>
drm/amdgpu: properly handle vbios fake edid sizing
Paulo Miguel Almeida <[email protected]>
drm/amdgpu: Replace one-element array with flexible-array member
Matteo Croce <[email protected]>
drm/amd: fix typo
Christophe JAILLET <[email protected]>
drm/stm: Fix an error handling path in stm_drm_platform_probe()
Christophe JAILLET <[email protected]>
fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
Artur Weber <[email protected]>
power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
Yuntao Liu <[email protected]>
hwmon: (ntc_thermistor) fix module autoloading
Mirsad Todorovac <[email protected]>
mtd: slram: insert break after errors in parsing the map
Guenter Roeck <[email protected]>
hwmon: (max16065) Fix overflows seen when writing limits
Ankit Agrawal <[email protected]>
clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
Krzysztof Kozlowski <[email protected]>
reset: berlin: fix OF node leak in probe() error path
Krzysztof Kozlowski <[email protected]>
ARM: versatile: fix OF node leak in CPUs prepare
Andy Shevchenko <[email protected]>
spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
Ma Ke <[email protected]>
spi: ppc4xx: handle irq_of_parse_and_map() errors
Yu Kuai <[email protected]>
block, bfq: don't break merge chain in bfq_split_bfqq()
Yu Kuai <[email protected]>
block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
Yu Kuai <[email protected]>
block, bfq: fix possible UAF for bfqq->bic with merge chain
Luiz Augusto von Dentz <[email protected]>
Bluetooth: btusb: Fix not handling ZPL/short-transfer
Kuniyuki Iwashima <[email protected]>
can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
Dmitry Antipov <[email protected]>
wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
Dmitry Antipov <[email protected]>
wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
Toke Høiland-Jørgensen <[email protected]>
wifi: ath9k: Remove error checks when creating debugfs entries
Minjie Du <[email protected]>
wifi: ath9k: fix parameter check in ath9k_init_debug()
Aleksandr Mishin <[email protected]>
ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
Junhao Xie <[email protected]>
USB: serial: pl2303: add device id for Macrosilicon MS3020
Hagar Hemdan <[email protected]>
gpio: prevent potential speculation leaks in gpio_device_get_desc()
Ferry Meng <[email protected]>
ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
Ferry Meng <[email protected]>
ocfs2: add bounds checking to ocfs2_xattr_find_entry()
Michael Kelley <[email protected]>
x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
Liao Chen <[email protected]>
spi: bcm63xx: Enable module autoloading
Liao Chen <[email protected]>
ASoC: tda7419: fix module autoloading
Emmanuel Grumbach <[email protected]>
wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead
Daniel Gabay <[email protected]>
wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
Jacky Chou <[email protected]>
net: ftgmac100: Ensure tx descriptor updates are visible
Mike Rapoport <[email protected]>
microblaze: don't treat zero reserved memory regions as error
Thomas Blocher <[email protected]>
pinctrl: at91: make it work with current gpiolib
Hongbo Li <[email protected]>
ASoC: allow module autoloading for table db1200_pids
Samasth Norway Ananda <[email protected]>
selftests/kcmp: remove call to ksft_set_plan()
Samasth Norway Ananda <[email protected]>
selftests/vm: remove call to ksft_set_plan()
Krzysztof Kozlowski <[email protected]>
soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
Sean Anderson <[email protected]>
net: dpaa: Pad packets to ETH_ZLEN
Jacky Chou <[email protected]>
net: ftgmac100: Enable TX interrupt to avoid TX timeout
Eran Ben Elisha <[email protected]>
net/mlx5: Update the list of the PCI supported devices
Quentin Schulz <[email protected]>
arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
Anders Roxell <[email protected]>
scripts: kconfig: merge_config: config files: add a trailing newline
Pawel Dembicki <[email protected]>
net: phy: vitesse: repair vsc73xx autonegotiation
Moon Yeounsu <[email protected]>
net: ethernet: use ip_hdrlen() instead of bit shift
Foster Snowhill <[email protected]>
usbnet: ipheth: fix carrier detection in modes 1 and 4
Aleksandr Mishin <[email protected]>
staging: iio: frequency: ad9834: Validate frequency parameter value
Beniamin Bia <[email protected]>
staging: iio: frequency: ad9833: Load clock using clock framework
Beniamin Bia <[email protected]>
staging: iio: frequency: ad9833: Get frequency value statically
-------------
Diffstat:
.gitignore | 1 - Documentation/IPMI.txt | 2 +- Documentation/arm64/silicon-errata.txt | 2 + Documentation/driver-model/devres.txt | 1 + Makefile | 4 +- arch/arm/mach-realview/platsmp-dt.c | 1 + arch/arm64/Kconfig | 2 + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 +- arch/arm64/include/asm/cputype.h | 4 + arch/arm64/include/asm/uprobes.h | 12 +- arch/arm64/kernel/cpu_errata.c | 2 + arch/arm64/kernel/probes/decode-insn.c | 16 +- arch/arm64/kernel/probes/simulate-insn.c | 18 +- arch/arm64/kernel/probes/uprobes.c | 4 +- arch/microblaze/mm/init.c | 5 - arch/parisc/kernel/entry.S | 6 +- arch/parisc/kernel/syscall.S | 14 +- arch/riscv/Kconfig | 5 + arch/s390/include/asm/facility.h | 6 +- arch/s390/kernel/perf_cpum_sf.c | 12 +- arch/s390/kvm/diag.c | 2 +- arch/s390/kvm/gaccess.c | 162 +++++--- arch/s390/kvm/gaccess.h | 14 +- arch/s390/mm/cmm.c | 18 +- arch/x86/include/asm/cpufeatures.h | 3 +- arch/x86/kernel/apic/apic.c | 14 +- arch/x86/kernel/cpu/mshyperv.c | 1 + arch/x86/xen/setup.c | 2 +- block/bfq-iosched.c | 13 +- crypto/aead.c | 3 +- crypto/cipher.c | 3 +- drivers/acpi/acpica/dbconvert.c | 2 + drivers/acpi/acpica/exprep.c | 3 + drivers/acpi/acpica/psargs.c | 47 +++ drivers/acpi/battery.c | 28 +- drivers/acpi/button.c | 11 + drivers/acpi/device_sysfs.c | 5 +- drivers/acpi/ec.c | 55 ++- drivers/acpi/pmic/tps68470_pmic.c | 6 +- drivers/ata/sata_sil.c | 12 +- drivers/base/bus.c | 6 +- drivers/base/core.c | 13 +- drivers/base/firmware_loader/main.c | 30 ++ drivers/base/module.c | 4 - drivers/block/aoe/aoecmd.c | 13 +- drivers/block/drbd/drbd_main.c | 8 +- drivers/block/drbd/drbd_state.c | 2 +- drivers/bluetooth/btusb.c | 10 +- drivers/char/virtio_console.c | 18 +- drivers/clk/bcm/clk-bcm53573-ilp.c | 2 +- drivers/clk/clk-devres.c | 115 +++++- drivers/clk/rockchip/clk-rk3228.c | 2 +- drivers/clk/rockchip/clk.c | 3 +- drivers/clk/ti/clk-dra7-atl.c | 1 + drivers/clocksource/timer-qcom.c | 7 +- drivers/firmware/arm_sdei.c | 2 +- drivers/gpio/gpio-aspeed.c | 4 +- drivers/gpio/gpio-davinci.c | 8 +- drivers/gpio/gpiolib.c | 3 +- drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c | 15 +- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 26 +- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 2 + .../gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 + drivers/gpu/drm/amd/include/atombios.h | 4 +- drivers/gpu/drm/drm_crtc.c | 17 +- drivers/gpu/drm/drm_print.c | 13 +- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 26 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 +- drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +-- drivers/gpu/drm/radeon/r100.c | 70 ++-- drivers/gpu/drm/radeon/radeon_atombios.c | 26 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 +- drivers/gpu/drm/stm/drv.c | 4 +- drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 1 + drivers/hid/hid-ids.h | 2 + drivers/hid/hid-plantronics.c | 23 ++ drivers/hwmon/max16065.c | 5 +- drivers/hwmon/ntc_thermistor.c | 1 + drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- drivers/i2c/busses/i2c-aspeed.c | 16 +- drivers/i2c/busses/i2c-i801.c | 9 +- drivers/i2c/busses/i2c-isch.c | 3 +- drivers/i2c/busses/i2c-xiic.c | 19 +- drivers/iio/adc/Kconfig | 2 + .../iio/common/hid-sensors/hid-sensor-trigger.c | 2 +- drivers/iio/dac/Kconfig | 1 + drivers/iio/light/opt3001.c | 4 + drivers/iio/magnetometer/ak8975.c | 32 +- drivers/infiniband/core/iwcm.c | 2 +- drivers/infiniband/hw/bnxt_re/qplib_fp.h | 2 +- drivers/infiniband/hw/bnxt_re/qplib_rcfw.c | 2 +- drivers/infiniband/hw/cxgb4/cm.c | 14 +- drivers/input/keyboard/adp5589-keys.c | 13 +- drivers/input/rmi4/rmi_driver.c | 6 +- drivers/mailbox/bcm2835-mailbox.c | 3 +- drivers/mailbox/rockchip-mailbox.c | 2 +- drivers/media/common/videobuf2/videobuf2-core.c | 8 +- drivers/media/dvb-frontends/rtl2830.c | 2 +- drivers/media/dvb-frontends/rtl2832.c | 2 +- drivers/media/platform/qcom/venus/core.c | 1 + drivers/misc/sgi-gru/grukservices.c | 2 - drivers/misc/sgi-gru/grumain.c | 4 - drivers/misc/sgi-gru/grutlbpurge.c | 2 - drivers/mtd/devices/slram.c | 2 + drivers/net/dsa/mv88e6xxx/global1_atu.c | 3 +- drivers/net/ethernet/aeroflex/greth.c | 3 +- drivers/net/ethernet/amd/mvme147.c | 7 +- drivers/net/ethernet/broadcom/bcmsysport.c | 1 + drivers/net/ethernet/cortina/gemini.c | 15 +- drivers/net/ethernet/emulex/benet/be_main.c | 10 +- drivers/net/ethernet/faraday/ftgmac100.c | 26 +- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 +- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + drivers/net/ethernet/i825xx/sun3_82586.c | 1 + drivers/net/ethernet/ibm/emac/mal.c | 2 +- drivers/net/ethernet/intel/igb/igb_main.c | 6 +- drivers/net/ethernet/jme.c | 10 +- drivers/net/ethernet/lantiq_etop.c | 4 +- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 2 +- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 + drivers/net/ethernet/seeq/ether3.c | 2 + drivers/net/gtp.c | 27 +- drivers/net/hyperv/netvsc_drv.c | 30 ++ drivers/net/macsec.c | 18 - drivers/net/phy/vitesse.c | 14 - drivers/net/ppp/ppp_async.c | 2 +- drivers/net/usb/cdc_ncm.c | 8 +- drivers/net/usb/ipheth.c | 5 +- drivers/net/usb/r8152.c | 73 +--- drivers/net/usb/usbnet.c | 3 +- drivers/net/wireless/ath/ath10k/wmi-tlv.c | 7 +- drivers/net/wireless/ath/ath10k/wmi.c | 2 + drivers/net/wireless/ath/ath9k/debug.c | 6 +- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 +- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 - drivers/net/wireless/intel/iwlegacy/common.c | 2 + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 8 +- drivers/net/wireless/marvell/mwifiex/fw.h | 2 +- drivers/net/wireless/marvell/mwifiex/scan.c | 3 +- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- drivers/of/irq.c | 38 +- drivers/parport/procfs.c | 22 +- drivers/pci/controller/pcie-xilinx-nwl.c | 24 +- drivers/pci/quirks.c | 6 + drivers/pinctrl/mvebu/pinctrl-dove.c | 45 +- drivers/pinctrl/pinctrl-at91.c | 5 +- drivers/pinctrl/pinctrl-single.c | 3 +- drivers/power/reset/brcmstb-reboot.c | 3 - drivers/power/supply/max17042_battery.c | 5 +- drivers/pps/clients/pps_parport.c | 14 +- drivers/reset/reset-berlin.c | 3 +- drivers/rtc/Kconfig | 2 +- drivers/rtc/rtc-at91sam9.c | 45 +- drivers/s390/char/sclp_vt220.c | 4 +- drivers/scsi/aacraid/aacraid.h | 2 +- drivers/soc/versatile/soc-integrator.c | 1 + drivers/soc/versatile/soc-realview.c | 20 +- drivers/soundwire/stream.c | 8 +- drivers/spi/spi-bcm63xx.c | 2 + drivers/spi/spi-ppc4xx.c | 7 +- drivers/spi/spi-s3c64xx.c | 4 +- drivers/staging/iio/frequency/ad9834.c | 54 +-- drivers/staging/iio/frequency/ad9834.h | 28 -- drivers/tty/serial/rp2.c | 2 +- drivers/tty/vt/vt.c | 2 +- drivers/usb/chipidea/udc.c | 8 +- drivers/usb/dwc3/core.c | 49 ++- drivers/usb/dwc3/core.h | 11 +- drivers/usb/dwc3/gadget.c | 11 - drivers/usb/host/xhci-pci.c | 5 + drivers/usb/host/xhci-ring.c | 16 +- drivers/usb/host/xhci.h | 2 +- drivers/usb/misc/appledisplay.c | 15 +- drivers/usb/misc/cypress_cy7c63.c | 4 + drivers/usb/misc/yurex.c | 5 +- drivers/usb/phy/phy.c | 2 +- drivers/usb/serial/option.c | 8 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 + drivers/usb/storage/unusual_devs.h | 11 + drivers/usb/typec/class.c | 3 + drivers/video/fbdev/hpfb.c | 1 + drivers/video/fbdev/pxafb.c | 1 + drivers/video/fbdev/sis/sis_main.c | 2 +- drivers/xen/swiotlb-xen.c | 40 +- fs/btrfs/disk-io.c | 11 + fs/ceph/addr.c | 1 - fs/ext4/ext4.h | 1 + fs/ext4/extents.c | 70 +++- fs/ext4/ialloc.c | 2 + fs/ext4/inline.c | 35 +- fs/ext4/inode.c | 11 +- fs/ext4/mballoc.c | 10 +- fs/ext4/migrate.c | 2 +- fs/ext4/move_extent.c | 1 - fs/ext4/namei.c | 14 +- fs/ext4/xattr.c | 4 +- fs/f2fs/acl.c | 23 +- fs/f2fs/dir.c | 3 +- fs/f2fs/f2fs.h | 4 +- fs/f2fs/file.c | 24 +- fs/f2fs/super.c | 4 +- fs/f2fs/xattr.c | 29 +- fs/fat/namei_vfat.c | 2 +- fs/fcntl.c | 14 +- fs/inode.c | 4 + fs/jbd2/checkpoint.c | 14 +- fs/jbd2/commit.c | 36 +- fs/jbd2/journal.c | 2 + fs/jfs/jfs_discard.c | 11 +- fs/jfs/jfs_dmap.c | 11 +- fs/jfs/jfs_imap.c | 2 +- fs/jfs/xattr.c | 2 + fs/lockd/clnt4xdr.c | 14 - fs/lockd/clntxdr.c | 14 - fs/nfs/callback_xdr.c | 61 ++- fs/nfs/nfs2xdr.c | 84 ++-- fs/nfs/nfs3xdr.c | 163 +++----- fs/nfs/nfs42xdr.c | 21 +- fs/nfs/nfs4state.c | 1 + fs/nfs/nfs4xdr.c | 451 ++++++--------------- fs/nfsd/nfs4callback.c | 13 - fs/nfsd/nfs4idmap.c | 13 +- fs/nfsd/nfs4state.c | 15 +- fs/nilfs2/btree.c | 12 +- fs/nilfs2/dir.c | 50 +-- fs/nilfs2/namei.c | 42 +- fs/nilfs2/nilfs.h | 2 +- fs/nilfs2/page.c | 7 +- fs/ocfs2/aops.c | 5 +- fs/ocfs2/buffer_head_io.c | 4 +- fs/ocfs2/file.c | 8 + fs/ocfs2/journal.c | 7 +- fs/ocfs2/localalloc.c | 19 + fs/ocfs2/quota_local.c | 8 +- fs/ocfs2/refcounttree.c | 26 +- fs/ocfs2/xattr.c | 38 +- fs/udf/inode.c | 9 +- include/drm/drm_print.h | 54 ++- include/dt-bindings/power/r8a774b1-sysc.h | 26 ++ include/linux/clk.h | 145 +++++++ include/linux/jbd2.h | 4 + include/linux/pci_ids.h | 2 + include/net/sock.h | 2 + include/net/tcp.h | 27 +- include/trace/events/f2fs.h | 3 +- include/trace/events/sched.h | 84 ++++ include/uapi/linux/cec.h | 6 +- include/uapi/linux/netfilter/nf_tables.h | 2 +- kernel/bpf/arraymap.c | 3 + kernel/bpf/hashtab.c | 3 + kernel/bpf/lpm_trie.c | 2 +- kernel/cgroup/cgroup.c | 4 +- kernel/events/core.c | 6 +- kernel/events/uprobes.c | 2 +- kernel/kthread.c | 19 +- kernel/signal.c | 11 +- kernel/time/posix-clock.c | 3 + kernel/trace/trace_output.c | 6 +- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 - mm/shmem.c | 2 + net/bluetooth/af_bluetooth.c | 1 + net/bluetooth/bnep/core.c | 3 +- net/bluetooth/rfcomm/sock.c | 2 - net/bridge/br_netfilter_hooks.c | 5 + net/can/bcm.c | 4 +- net/core/dev.c | 29 +- net/ipv4/devinet.c | 6 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/ip_gre.c | 6 +- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +- net/ipv4/tcp_input.c | 24 +- net/ipv4/tcp_ipv4.c | 5 +- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_rate.c | 17 +- net/ipv4/tcp_recovery.c | 5 +- net/ipv6/addrconf.c | 8 +- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +- net/ipv6/netfilter/nf_reject_ipv6.c | 14 +- net/mac80211/cfg.c | 3 +- net/mac80211/iface.c | 17 +- net/mac80211/key.c | 42 +- net/netfilter/nf_conntrack_netlink.c | 7 +- net/netfilter/nf_tables_api.c | 2 +- net/netfilter/nft_payload.c | 3 + net/netlink/af_netlink.c | 3 +- net/qrtr/qrtr.c | 2 +- net/sched/sch_api.c | 2 +- net/sctp/socket.c | 4 +- net/tipc/bearer.c | 8 +- net/wireless/nl80211.c | 3 +- net/wireless/scan.c | 6 +- net/wireless/sme.c | 3 +- net/xfrm/xfrm_user.c | 6 +- scripts/kconfig/merge_config.sh | 2 + security/selinux/selinuxfs.c | 31 +- security/smack/smackfs.c | 2 +- security/tomoyo/domain.c | 9 +- sound/core/init.c | 14 +- sound/pci/asihpi/hpimsgx.c | 2 +- sound/pci/hda/hda_generic.c | 4 +- sound/pci/hda/patch_conexant.c | 24 +- sound/pci/hda/patch_realtek.c | 38 +- sound/pci/rme9652/hdsp.c | 6 +- sound/pci/rme9652/hdspm.c | 6 +- sound/soc/au1x/db1200.c | 1 + sound/soc/codecs/tda7419.c | 1 + tools/iio/iio_generic_buffer.c | 4 + tools/perf/builtin-sched.c | 8 +- tools/perf/util/time-utils.c | 4 +- tools/testing/ktest/ktest.pl | 2 +- tools/testing/selftests/bpf/test_lru_map.c | 3 +- .../breakpoints/step_after_suspend_test.c | 5 +- tools/testing/selftests/kcmp/kcmp_test.c | 1 - tools/testing/selftests/vDSO/parse_vdso.c | 3 +- tools/testing/selftests/vm/compaction_test.c | 2 - tools/usb/usbip/src/usbip_detach.c | 1 + virt/kvm/kvm_main.c | 5 +- 326 files changed, 2648 insertions(+), 1791 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/350 staging: iio: frequency: ad9833: Get frequency value statically
4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beniamin Bia <[email protected]>
[ Upstream commit 80109c32348d7b2e85def9efc3f9524fb166569d ]
The values from platform data were replaced by statically values. This was just a intermediate step of taking this driver out of staging and load data from device tree.
Stable-dep-of: b48aa9917589 ("staging: iio: frequency: ad9834: Validate frequency parameter value")
--- drivers/staging/iio/frequency/ad9834.c | 21 +++++++------------ drivers/staging/iio/frequency/ad9834.h | 28 -------------------------- 2 files changed, 7 insertions(+), 42 deletions(-)
drivers/staging/iio/frequency/ad9834.c +7 -14
@@ -389,16 +389,11 @@ static const struct iio_info ad9833_info = {static int ad9834_probe (struct spi_device *spi) { -struct ad9834_platform_data *pdata =dev_get_platdata (&spi->dev);struct ad9834_state *st;struct iio_dev *indio_dev;struct regulator *reg;int ret; -if (!pdata) { -dev_dbg (&spi->dev,"no platform data?\n" ); -return -ENODEV ; - } reg =devm_regulator_get (&spi->dev,"avdd" );if (IS_ERR (reg))
@@ -418,7 +413,7 @@ static int ad9834_probe(struct spi_device *spi)spi_set_drvdata (spi, indio_dev); st =iio_priv (indio_dev);mutex_init (&st->lock); - st->mclk = pdata->mclk; + st->mclk =25000000 ; st->spi = spi; st->devid =spi_get_device_id (spi)->driver_data; st->reg = reg;
@@ -454,11 +449,9 @@ static int ad9834_probe(struct spi_device *spi)spi_message_add_tail (&st->freq_xfer[1 ], &st->freq_msg); st->control =AD9834_B28 |AD9834_RESET ; + st->control |=AD9834_DIV2 ; -if (!pdata->en_div2) - st->control |=AD9834_DIV2 ; - -if (!pdata->en_signbit_msb_out && (st->devid ==ID_AD9834 )) +if (st->devid ==ID_AD9834 ) st->control |=AD9834_SIGN_PIB ; st->data =cpu_to_be16 (AD9834_REG_CMD | st->control);
@@ -468,19 +461,19 @@ static int ad9834_probe(struct spi_device *spi) goto error_disable_reg; } - ret =ad9834_write_frequency (st,AD9834_REG_FREQ0 , pdata->freq0); + ret =ad9834_write_frequency (st,AD9834_REG_FREQ0 ,1000000 );if (ret) goto error_disable_reg; - ret =ad9834_write_frequency (st,AD9834_REG_FREQ1 , pdata->freq1); + ret =ad9834_write_frequency (st,AD9834_REG_FREQ1 ,5000000 );if (ret) goto error_disable_reg; - ret =ad9834_write_phase (st,AD9834_REG_PHASE0 , pdata->phase0); + ret =ad9834_write_phase (st,AD9834_REG_PHASE0 ,512 );if (ret) goto error_disable_reg; - ret =ad9834_write_phase (st,AD9834_REG_PHASE1 , pdata->phase1); + ret =ad9834_write_phase (st,AD9834_REG_PHASE1 ,1024 );if (ret) goto error_disable_reg;
drivers/staging/iio/frequency/ad9834.h +0 -28
@@ -8,32 +8,4 @@#ifndef IIO_DDS_AD9834_H_ #define IIO_DDS_AD9834_H_ -/* -* TODO: struct ad7887_platform_data needs to go into include/linux/iio -*/ - -/** -* struct ad9834_platform_data - platform specific information -* @mclk: master clock in Hz -* @freq0: power up freq0 tuning word in Hz -* @freq1: power up freq1 tuning word in Hz -* @phase0: power up phase0 value [0..4095] correlates with 0..2PI -* @phase1: power up phase1 value [0..4095] correlates with 0..2PI -* @en_div2: digital output/2 is passed to the SIGN BIT OUT pin -* @en_signbit_msb_out: the MSB (or MSB/2) of the DAC data is connected to the -* SIGN BIT OUT pin. en_div2 controls whether it is the MSB -* or MSB/2 that is output. if en_signbit_msb_out=false, -* the on-board comparator is connected to SIGN BIT OUT -*/ - -struct ad9834_platform_data { -unsigned int mclk; -unsigned int freq0; -unsigned int freq1; -unsigned short phase0; -unsigned short phase1; -bool en_div2; -bool en_signbit_msb_out; -}; -#endif /* IIO_DDS_AD9834_H_ */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 2/350 staging: iio: frequency: ad9833: Load clock using clock framework
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Beniamin Bia <[email protected]>
[ Upstream commit 8e8040c52e63546d1171c188a24aacf145a9a7e0 ]
The clock frequency is loaded from device-tree using clock framework instead of statically value. The change allow configuration of the device via device-trees and better initialization sequence. This is part of broader effort to add device-tree support to this driver and take it out from staging.
Stable-dep-of: b48aa9917589 ("staging: iio: frequency: ad9834: Validate frequency parameter value")
--- drivers/staging/iio/frequency/ad9834.c | 35 ++++++++++++++++++-------- 1 file changed, 24 insertions(+), 11 deletions(-)
drivers/staging/iio/frequency/ad9834.c +24 -11
@@ -6,6 +6,7 @@* Licensed under the GPL-2. */ +#include <linux/clk.h> #include <linux/interrupt.h> #include <linux/workqueue.h> #include <linux/device.h>
@@ -71,7 +72,7 @@struct ad9834_state {struct spi_device *spi;struct regulator *reg; -unsigned int mclk; +struct clk *mclk;unsigned short control;unsigned short devid;struct spi_transfer xfer;
@@ -110,12 +111,15 @@ static unsigned int ad9834_calc_freqreg(unsigned long mclk, unsigned long fout)static int ad9834_write_frequency (struct ad9834_state *st,unsigned long addr,unsigned long fout) { +unsigned long clk_freq;unsigned long regval; -if (fout > (st->mclk /2 )) + clk_freq =clk_get_rate (st->mclk); + +if (fout > (clk_freq /2 ))return -EINVAL ; - regval =ad9834_calc_freqreg (st->mclk, fout); + regval =ad9834_calc_freqreg (clk_freq, fout); st->freq_data[0 ] =cpu_to_be16 (addr | (regval &RES_MASK (AD9834_FREQ_BITS /2 )));
@@ -413,7 +417,14 @@ static int ad9834_probe(struct spi_device *spi)spi_set_drvdata (spi, indio_dev); st =iio_priv (indio_dev);mutex_init (&st->lock); - st->mclk =25000000 ; + st->mclk =devm_clk_get (&spi->dev,NULL ); + + ret =clk_prepare_enable (st->mclk); +if (ret) { +dev_err (&spi->dev,"Failed to enable master clock\n" ); + goto error_disable_reg; + } + st->spi = spi; st->devid =spi_get_device_id (spi)->driver_data; st->reg = reg;
@@ -458,31 +469,32 @@ static int ad9834_probe(struct spi_device *spi) ret =spi_sync (st->spi, &st->msg);if (ret) {dev_err (&spi->dev,"device init failed\n" ); - goto error_disable_reg; + goto error_clock_unprepare; } ret =ad9834_write_frequency (st,AD9834_REG_FREQ0 ,1000000 );if (ret) - goto error_disable_reg; + goto error_clock_unprepare; ret =ad9834_write_frequency (st,AD9834_REG_FREQ1 ,5000000 );if (ret) - goto error_disable_reg; + goto error_clock_unprepare; ret =ad9834_write_phase (st,AD9834_REG_PHASE0 ,512 );if (ret) - goto error_disable_reg; + goto error_clock_unprepare; ret =ad9834_write_phase (st,AD9834_REG_PHASE1 ,1024 );if (ret) - goto error_disable_reg; + goto error_clock_unprepare; ret =iio_device_register (indio_dev);if (ret) - goto error_disable_reg; + goto error_clock_unprepare;return 0 ; - +error_clock_unprepare: +clk_disable_unprepare (st->mclk); error_disable_reg:regulator_disable (reg);
@@ -495,6 +507,7 @@ static int ad9834_remove(struct spi_device *spi)struct ad9834_state *st =iio_priv (indio_dev);iio_device_unregister (indio_dev); +clk_disable_unprepare (st->mclk);regulator_disable (st->reg);return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 3/350 staging: iio: frequency: ad9834: Validate frequency parameter value
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit b48aa991758999d4e8f9296c5bbe388f293ef465 ]
In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by zero. Checking 'if (fout > (clk_freq / 2))' doesn't protect in case of 'fout' is 0. ad9834_write_frequency() is called from ad9834_write(), where fout is taken from text buffer, which can contain any value.
Modify parameters checking.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/staging/iio/frequency/ad9834.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/staging/iio/frequency/ad9834.c +1 -1
@@ -116,7 +116,7 @@ static int ad9834_write_frequency(struct ad9834_state *st, clk_freq =clk_get_rate (st->mclk); -if (fout > (clk_freq /2 )) +if (!clk_freq || fout > (clk_freq /2 ))return -EINVAL ; regval =ad9834_calc_freqreg (clk_freq, fout);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 4/350 usbnet: ipheth: fix carrier detection in modes 1 and 4
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Foster Snowhill <[email protected]>
[ Upstream commit 67927a1b255d883881be9467508e0af9a5e0be9d ]
Apart from the standard "configurations", "interfaces" and "alternate interface settings" in USB, iOS devices also have a notion of "modes". In different modes, the device exposes a different set of available configurations.
Depending on the iOS version, and depending on the current mode, the length and contents of the carrier state control message differs:
* 1 byte (seen on iOS 4.2.1, 8.4):
* 03: carrier off (mode 0)
* 04: carrier on (mode 0)
* 3 bytes (seen on iOS 10.3.4, 15.7.6):
* 03 03 03: carrier off (mode 0)
* 04 04 03: carrier on (mode 0)
* 4 bytes (seen on iOS 16.5, 17.6):
* 03 03 03 00: carrier off (mode 0)
* 04 03 03 00: carrier off (mode 1)
* 06 03 03 00: carrier off (mode 4)
* 04 04 03 04: carrier on (mode 0 and 1)
* 06 04 03 04: carrier on (mode 4)
Before this change, the driver always used the first byte of the response to determine carrier state.
Quoted 1 line
From this larger sample, the first byte seems to indicate the number of
available USB configurations in the current mode (with the exception of the default mode 0), and in some cases (namely mode 1 and 4) does not correlate with the carrier state.
Previous logic erroneously counted 04 03 03 00 as "carrier on" and 06 04 03 04 as "carrier off" on iOS versions that support mode 1 and mode 4 respectively.
Only modes 0, 1 and 4 expose the USB Ethernet interfaces necessary for the ipheth driver.
Check the second byte of the control message where possible, and fall back to checking the first byte on older iOS versions.
--- drivers/net/usb/ipheth.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/usb/ipheth.c +3 -2
@@ -307,13 +307,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)0x02 ,/* index */ dev->ctrl_buf,IPHETH_CTRL_BUF_SIZE , IPHETH_CTRL_TIMEOUT); -if (retval <0 ) { +if (retval <=0 ) {dev_err (&dev->intf->dev,"%s: usb_control_msg: %d\n" , __func__, retval);return retval; } -if (dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) { +if ((retval ==1 && dev->ctrl_buf[0 ] ==IPHETH_CARRIER_ON ) || + (retval >=2 && dev->ctrl_buf[1 ] ==IPHETH_CARRIER_ON )) {netif_carrier_on (dev->net);if (dev->tx_urb->status != -EINPROGRESS )netif_wake_queue (dev->net);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 5/350 net: ethernet: use ip_hdrlen() instead of bit shift
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moon Yeounsu <[email protected]>
[ Upstream commit 9a039eeb71a42c8b13408a1976e300f3898e1be0 ]
ip_hdr(skb)->ihl << 2 is the same as ip_hdrlen(skb) Therefore, we should use a well-defined function not a bit shift to find the header length.
It also compresses two lines to a single line.
--- drivers/net/ethernet/jme.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/net/ethernet/jme.c +4 -6
@@ -966,15 +966,13 @@ jme_udpsum(struct sk_buff *skb)if (skb->protocol !=htons (ETH_P_IP ))return csum;skb_set_network_header (skb,ETH_HLEN ); -if ((ip_hdr (skb)->protocol !=IPPROTO_UDP ) || - (skb->len < (ETH_HLEN + - (ip_hdr (skb)->ihl <<2 ) + -sizeof (struct udphdr )))) { + +if (ip_hdr (skb)->protocol !=IPPROTO_UDP || + skb->len < (ETH_HLEN +ip_hdrlen (skb) +sizeof (struct udphdr ))) {skb_reset_network_header (skb);return csum; } -skb_set_transport_header (skb, -ETH_HLEN + (ip_hdr (skb)->ihl <<2 )); +skb_set_transport_header (skb,ETH_HLEN +ip_hdrlen (skb)); csum =udp_hdr (skb)->check;skb_reset_transport_header (skb);skb_reset_network_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 6/350 net: phy: vitesse: repair vsc73xx autonegotiation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pawel Dembicki <[email protected]>
[ Upstream commit de7a670f8defe4ed2115552ad23dea0f432f7be4 ]
When the vsc73xx mdio bus work properly, the generic autonegotiation configuration works well.
--- drivers/net/phy/vitesse.c | 14 -------------- 1 file changed, 14 deletions(-)
drivers/net/phy/vitesse.c +0 -14
@@ -241,16 +241,6 @@ static int vsc739x_config_init(struct phy_device *phydev)return genphy_config_init (phydev); } -static int vsc73xx_config_aneg (struct phy_device *phydev) -{ -/* The VSC73xx switches does not like to be instructed to -* do autonegotiation in any way, it prefers that you just go -* with the power-on/reset defaults. Writing some registers will -* just make autonegotiation permanently fail. -*/ -return 0 ; -} -/* This adds a skew for both TX and RX clocks, so the skew should only be * applied to "rgmii-id" interfaces. It may not work as expected * on "rgmii-txid", "rgmii-rxid" or "rgmii" interfaces. */
@@ -459,7 +449,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, .features = PHY_GBIT_FEATURES, .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -468,7 +457,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, .features = PHY_GBIT_FEATURES, .config_init = vsc738x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -477,7 +465,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, .features = PHY_GBIT_FEATURES, .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
@@ -486,7 +473,6 @@ static struct phy_driver vsc82xx_driver[] = { .phy_id_mask = 0x000ffff0, .features = PHY_GBIT_FEATURES, .config_init = vsc739x_config_init, - .config_aneg = vsc73xx_config_aneg, .read_page = vsc73xx_read_page, .write_page = vsc73xx_write_page, }, {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 7/350 scripts: kconfig: merge_config: config files: add a trailing newline
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anders Roxell <[email protected]>
[ Upstream commit 33330bcf031818e60a816db0cfd3add9eecc3b28 ]
When merging files without trailing newlines at the end of the file, two config fragments end up at the same row if file1.config doens't have a trailing newline at the end of the file.
file1.config "CONFIG_1=y"
file2.config "CONFIG_2=y"./scripts/kconfig/merge_config.sh -m .config file1.config file2.config
This will generate a .config looking like this.
cat .config
...CONFIG_1=yCONFIG_2=y"
Making sure so we add a newline at the end of every config file that is passed into the script.
--- scripts/kconfig/merge_config.sh | 2 ++ 1 file changed, 2 insertions(+)
scripts/kconfig/merge_config.sh +2 -0
@@ -128,6 +128,8 @@ for MERGE_FILE in $MERGE_LIST ; do fi sed -i "/$CFG[ =]/d" $TMP_FILE done + # In case the previous file lacks a new line at the end + echo >> $TMP_FILE cat $MERGE_FILE >> $TMP_FILE done
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 8/350 arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quentin Schulz <[email protected]>
commit 741f5ba7ccba5d7ae796dd11c320e28045524771 upstream.
The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module eMMC and SPI flash powered-down initially (in fact it keeps the reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override that signal so that eMMC and SPI can be used regardless of the state of the signal.
Let's make this GPIO a hog so that it's reserved and locked in the proper state.
At the same time, make sure the pin is reserved for the hog and cannot be requested by another node.
--- arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +22 -1
@@ -147,6 +147,22 @@ status = "okay"; }; +&gpio3 { + /* + * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module + * eMMC and SPI flash powered-down initially (in fact it keeps the + * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override + * that signal so that eMMC and SPI can be used regardless of the state + * of the signal. + */ + bios-disable-override-hog { + gpios = <RK_PD5 GPIO_ACTIVE_LOW>; + gpio-hog; + line-name = "bios_disable_override"; + output-high; + }; +}; + &gmac { assigned-clocks = <&cru SCLK_RMII_SRC>; assigned-clock-parents = <&clkin_gmac>;
@@ -433,9 +449,14 @@ &pinctrl { pinctrl-names = "default"; - pinctrl-0 = <&q7_thermal_pin>; + pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>; gpios { + bios_disable_override_hog_pin: bios-disable-override-hog-pin { + rockchip,pins = + <3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>; + }; + q7_thermal_pin: q7-thermal-pin { rockchip,pins = <0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
Greg Kroah-Hartman
maintainerPATCH 9/350 net/mlx5: Update the list of the PCI supported devices
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eran Ben Elisha <[email protected]>
[ Upstream commit 85327a9c415057259b337805d356705d0d0f4200 ]
Add the upcoming ConnectX-6 Dx.
In addition, add "ConnectX Family mlx5Gen Virtual Function" device ID. Every new HCA VF will be identified with this device ID. Different VF models will be distinguished by their revision id.
--- drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/mellanox/mlx5/core/main.c +2 -0
@@ -1642,6 +1642,8 @@ static const struct pci_device_id mlx5_core_pci_table[] = { { PCI_VDEVICE(MELLANOX, 0x101a), MLX5_PCI_DEV_IS_VF}, /* ConnectX-5 Ex VF */ { PCI_VDEVICE(MELLANOX, 0x101b) }, /* ConnectX-6 */ { PCI_VDEVICE(MELLANOX, 0x101c), MLX5_PCI_DEV_IS_VF}, /* ConnectX-6 VF */ + { PCI_VDEVICE(MELLANOX, 0x101d) }, /* ConnectX-6 Dx */ + { PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF}, /* ConnectX Family mlx5Gen Virtual Function */ { PCI_VDEVICE(MELLANOX, 0xa2d2) }, /* BlueField integrated ConnectX-5 network controller */ { PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF}, /* BlueField integrated ConnectX-5 network controller VF */ { PCI_VDEVICE(MELLANOX, 0xa2d6) }, /* BlueField-2 integrated ConnectX-6 Dx network controller */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 10/350 net: ftgmac100: Enable TX interrupt to avoid TX timeout
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit fef2843bb49f414d1523ca007d088071dee0e055 ]
Currently, the driver only enables RX interrupt to handle RX packets and TX resources. Sometimes there is not RX traffic, so the TX resource needs to wait for RX interrupt to free. This situation will toggle the TX timeout watchdog when the MAC TX ring has no more resources to transmit packets. Therefore, enable TX interrupt to release TX resources at any time.
When I am verifying iperf3 over UDP, the network hangs. Like the log below.
root# iperf3 -c 192.168.100.100 -i1 -t10 -u -b0
Connecting to host 192.168.100.100, port 5201
[ 4] local 192.168.100.101 port 35773 connected to 192.168.100.100 port 5201
[ ID] Interval Transfer Bandwidth Total Datagrams [ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 20 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0 [ 4] 20.42-20.42 sec 0.00 Bytes 0.00 bits/sec 0
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval Transfer Bandwidth Jitter Lost/Total Datagrams
[ 4] 0.00-20.42 sec 160 KBytes 64.2 Kbits/sec 0.000 ms 0/20 (0%)
[ 4] Sent 20 datagrams
iperf3: error - the server has terminated
The network topology is FTGMAC connects directly to a PC.
UDP does not need to wait for ACK, unlike TCP.
Therefore, FTGMAC needs to enable TX interrupt to release TX resources instead of waiting for the RX interrupt.
--- drivers/net/ethernet/faraday/ftgmac100.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/faraday/ftgmac100.h +1 -1
@@ -97,7 +97,7 @@ FTGMAC100_INT_RPKT_BUF)/* All the interrupts we care about */ -#define FTGMAC100_INT_ALL (FTGMAC100_INT_RPKT_BUF | \ +#define FTGMAC100_INT_ALL (FTGMAC100_INT_RXTX | \ FTGMAC100_INT_BAD)/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 11/350 net: dpaa: Pad packets to ETH_ZLEN
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0 ]
When sending packets under 60 bytes, up to three bytes of the buffer following the data may be leaked. Avoid this by extending all packets to ETH_ZLEN, ensuring nothing is leaked in the padding. This bug can be reproduced by running
$ ping -s 11 destination
--- drivers/net/ethernet/freescale/dpaa/dpaa_eth.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +8 -1
@@ -2055,12 +2055,12 @@ static netdev_tx_t dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev) { const int queue_mapping = skb_get_queue_mapping(skb); -bool nonlinear =skb_is_nonlinear (skb);struct rtnl_link_stats64 *percpu_stats;struct dpaa_percpu_priv *percpu_priv;struct netdev_queue *txq;struct dpaa_priv *priv;struct qm_fd fd; +bool nonlinear;int offset =0 ;int err =0 ;
@@ -2070,6 +2070,13 @@ dpaa_start_xmit(struct sk_buff *skb, strqm_fd_clear_fd (&fd); +/* Packet data is always read as 32-bit words, so zero out any part of +* the skb which might be sent if we have to pad the packet +*/ +if (__skb_put_padto (skb,ETH_ZLEN , false)) + goto enomem; + + nonlinear =skb_is_nonlinear (skb);if (!nonlinear) {/* We're going to store the skb backpointer at the beginning * of the data buffer, so we need a privately owned skb
Greg Kroah-Hartman
maintainerPATCH 12/350 soundwire: stream: Revert "soundwire: stream: fix programming slave ports for non-continous port maps"
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 233a95fd574fde1c375c486540a90304a2d2d49f upstream.
This reverts commit ab8d66d132bc8f1992d3eb6cab8d32dda6733c84 because it breaks codecs using non-continuous masks in source and sink ports. The commit missed the point that port numbers are not used as indices for iterating over prop.sink_ports or prop.source_ports.
Soundwire core and existing codecs expect that the array passed as prop.sink_ports and prop.source_ports is continuous. The port mask still might be non-continuous, but that's unrelated.
--- drivers/soundwire/stream.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/soundwire/stream.c +4 -4
@@ -1232,18 +1232,18 @@ struct sdw_dpn_prop *sdw_get_slave_dpn_p unsigned int port_num) {struct sdw_dpn_prop *dpn_prop; -unsigned long mask; +u8 num_ports;int i;if (direction ==SDW_DATA_DIR_TX ) { - mask = slave->prop.source_ports; + num_ports =hweight32 (slave->prop.source_ports); dpn_prop = slave->prop.src_dpn_prop; }else { - mask = slave->prop.sink_ports; + num_ports =hweight32 (slave->prop.sink_ports); dpn_prop = slave->prop.sink_dpn_prop; } -for_each_set_bit (i, &mask,32 ) { +for (i =0 ; i < num_ports; i++) {if (dpn_prop[i].num == port_num)return &dpn_prop[i]; }
Greg Kroah-Hartman
maintainerPATCH 13/350 selftests/vm: remove call to ksft_set_plan()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
The function definition for ksft_set_plan() is not present in linux-4.19.y. compaction_test selftest fails to compile because of this.
--- tools/testing/selftests/vm/compaction_test.c | 2 -- 1 file changed, 2 deletions(-)
tools/testing/selftests/vm/compaction_test.c +0 -2
@@ -183,8 +183,6 @@ int main(int argc, char **argv)if (prereq () !=0 )return ksft_exit_pass (); -ksft_set_plan (1 ); - lim.rlim_cur =RLIM_INFINITY ; lim.rlim_max =RLIM_INFINITY ;if (setrlimit (RLIMIT_MEMLOCK , &lim))
Greg Kroah-Hartman
maintainerPATCH 14/350 selftests/kcmp: remove call to ksft_set_plan()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Samasth Norway Ananda <[email protected]>
The function definition for ksft_set_plan() is not present in linux-4.19.y. kcmp_test selftest fails to compile because of this.
--- tools/testing/selftests/kcmp/kcmp_test.c | 1 - 1 file changed, 1 deletion(-)
tools/testing/selftests/kcmp/kcmp_test.c +0 -1
@@ -89,7 +89,6 @@ int main(int argc, char **argv)int ret;ksft_print_header (); -ksft_set_plan (3 ); fd2 =open (kpath,O_RDWR );if (fd2 <0 ) {
Greg Kroah-Hartman
maintainerPATCH 15/350 ASoC: allow module autoloading for table db1200_pids
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hongbo Li <[email protected]>
[ Upstream commit 0e9fdab1e8df490354562187cdbb8dec643eae2c ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from platform_device_id table.
--- sound/soc/au1x/db1200.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/au1x/db1200.c +1 -0
@@ -43,6 +43,7 @@ static const struct platform_device_id db1200_pids[] = { }, {}, }; +MODULE_DEVICE_TABLE (platform, db1200_pids);/*------------------------- AC97 PART ---------------------------*/
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 16/350 pinctrl: at91: make it work with current gpiolib
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Blocher <[email protected]>
[ Upstream commit 752f387faaae0ae2e84d3f496922524785e77d60 ]
pinctrl-at91 currently does not support the gpio-groups devicetree property and has no pin-range.
Because of this at91 gpios stopped working since patch
commit 2ab73c6d8323fa1e ("gpio: Support GPIO controllers without pin-ranges") This was discussed in the patches
commit fc328a7d1fcce263 ("gpio: Revert regression in sysfs-gpio (gpiolib.c)") commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"")
As a workaround manually set pin-range via gpiochip_add_pin_range() until
a) pinctrl-at91 is reworked to support devicetree gpio-groups
b) another solution as mentioned in
commit 56e337f2cf132632 ("Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)"") is found
--- drivers/pinctrl/pinctrl-at91.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-at91.c +4 -1
@@ -1290,8 +1290,11 @@ static int at91_pinctrl_probe(struct platform_device *pdev)/* We will handle a range of GPIO pins */ for (i =0 ; i < gpio_banks; i++) -if (gpio_chips[i]) +if (gpio_chips[i]) {pinctrl_add_gpio_range (info->pctl, &gpio_chips[i]->range); +gpiochip_add_pin_range (&gpio_chips[i]->chip,dev_name (info->pctl->dev),0 , + gpio_chips[i]->range.pin_base, gpio_chips[i]->range.npins); + }dev_info (&pdev->dev,"initialized AT91 pinctrl driver\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 17/350 microblaze: dont treat zero reserved memory regions as error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Rapoport <[email protected]>
[ Upstream commit 0075df288dd8a7abfe03b3766176c393063591dd ]
Before commit 721f4a6526da ("mm/memblock: remove empty dummy entry") the check for non-zero of memblock.reserved.cnt in mmu_init() would always be true either because memblock.reserved.cnt is initialized to 1 or because there were memory reservations earlier.
The removal of dummy empty entry in memblock caused this check to fail because now memblock.reserved.cnt is initialized to 0.
Remove the check for non-zero of memblock.reserved.cnt because it's perfectly fine to have an empty memblock.reserved array that early in boot.
--- arch/microblaze/mm/init.c | 5 ----- 1 file changed, 5 deletions(-)
arch/microblaze/mm/init.c +0 -5
@@ -289,11 +289,6 @@ asmlinkage void __init mmu_init(void) {unsigned int kstart, ksize; -if (!memblock.reserved.cnt) { -pr_emerg ("Error memory count\n" ); -machine_restart (NULL ); - } -if ((u32 ) memblock.memory.regions[0 ].size <0x400000 ) {pr_emerg ("Memory must be greater than 4MB\n" );machine_restart (NULL );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 18/350 net: ftgmac100: Ensure tx descriptor updates are visible
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacky Chou <[email protected]>
[ Upstream commit 4186c8d9e6af57bab0687b299df10ebd47534a0a ]
The driver must ensure TX descriptor updates are visible before updating TX pointer and TX clear pointer.
This resolves TX hangs observed on AST2600 when running iperf3.
--- drivers/net/ethernet/faraday/ftgmac100.c | 26 ++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-)
drivers/net/ethernet/faraday/ftgmac100.c +18 -8
@@ -579,7 +579,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed) (*processed)++;return true; - drop: +drop:/* Clean rxdes0 (which resets own bit) */ rxdes->rxdes0 =cpu_to_le32 (status & priv->rxdes0_edorr_mask); priv->rx_pointer =ftgmac100_next_rx_pointer (priv, pointer);
@@ -663,6 +663,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv)ftgmac100_free_tx_packet (priv, pointer, skb, txdes, ctl_stat); txdes->txdes0 =cpu_to_le32 (ctl_stat & priv->txdes0_edotr_mask); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); + priv->tx_clean_pointer =ftgmac100_next_tx_pointer (priv, pointer);return true;
@@ -816,6 +821,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,dma_wmb (); first->txdes0 =cpu_to_le32 (f_ctl_stat); +/* Ensure the descriptor config is visible before setting the tx +* pointer. +*/ +smp_wmb (); +/* Update next TX pointer */ priv->tx_pointer = pointer;
@@ -836,7 +846,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,return NETDEV_TX_OK ; - dma_err: +dma_err:if (net_ratelimit ())netdev_err (netdev,"map tx fragment failed\n" );
@@ -858,7 +868,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,* last fragment, so we know ftgmac100_free_tx_packet() * hasn't freed the skb yet. */ - drop: +drop:/* Drop the packet */ dev_kfree_skb_any (skb); netdev->stats.tx_dropped++;
@@ -1444,7 +1454,7 @@ static void ftgmac100_reset_task(struct work_struct *work)ftgmac100_init_all (priv, true);netdev_dbg (netdev,"Reset done !\n" ); - bail: +bail:if (priv->mii_bus)mutex_unlock (&priv->mii_bus->mdio_lock);if (netdev->phydev)
@@ -1515,15 +1525,15 @@ static int ftgmac100_open(struct net_device *netdev)return 0 ; - err_ncsi: +err_ncsi:napi_disable (&priv->napi);netif_stop_queue (netdev); - err_alloc: +err_alloc:ftgmac100_free_buffers (priv);free_irq (netdev->irq, netdev); - err_irq: +err_irq:netif_napi_del (&priv->napi); - err_hw: +err_hw:iowrite32 (0 , priv->base +FTGMAC100_OFFSET_IER );ftgmac100_free_rings (priv);return err;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 19/350 wifi: iwlwifi: mvm: fix iwl_mvm_max_scan_ie_fw_cmd_room()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Gabay <[email protected]>
[ Upstream commit 916a5d9c5354c426220a0a6533a5e8ea1287d6ea ]
Driver creates also the WFA TPC element, consider that in the calculation.
--- drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/wireless/intel/iwlwifi/mvm/scan.c +4 -4
@@ -91,6 +91,8 @@/* adaptive dwell default APs number in social channels (1, 6, 11) */ #define IWL_SCAN_ADWELL_DEFAULT_N_APS_SOCIAL 10 +#define WFA_TPC_IE_LEN 9 +struct iwl_mvm_scan_timing_params {u32 suspend_time;u32 max_out_time;
@@ -328,8 +330,8 @@ static int iwl_mvm_max_scan_ie_fw_cmd_room(struct iwl_mvm *mvm) max_probe_len =SCAN_OFFLOAD_PROBE_REQ_SIZE ; -/* we create the 802.11 header and SSID element */ - max_probe_len -=24 +2 ; +/* we create the 802.11 header SSID element and WFA TPC element */ + max_probe_len -=24 +2 +WFA_TPC_IE_LEN ;/* DS parameter set element is added on 2.4GHZ band if required */ if (iwl_mvm_rrm_scan_needed (mvm))
@@ -727,8 +729,6 @@ static u8 *iwl_mvm_copy_and_insert_ds_elem(struct iwl_mvm *mvm, const u8 *ies,return newpos; } -#define WFA_TPC_IE_LEN 9 -static void iwl_mvm_add_tpc_report_ie (u8 *pos) { pos[0 ] =WLAN_EID_VENDOR_SPECIFIC ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 20/350 wifi: iwlwifi: mvm: dont wait for tx queues if firmware is dead
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emmanuel Grumbach <[email protected]>
[ Upstream commit 3a84454f5204718ca5b4ad2c1f0bf2031e2403d1 ]
There is a WARNING in iwl_trans_wait_tx_queues_empty() (that was recently converted from just a message), that can be hit if we wait for TX queues to become empty after firmware died. Clearly, we can't expect anything from the firmware after it's declared dead.
Don't call iwl_trans_wait_tx_queues_empty() in this case. While it could be a good idea to stop the flow earlier, the flush functions do some maintenance work that is not related to the firmware, so keep that part of the code running even when the firmware is not running.
--- drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +8 -1
@@ -4326,6 +4326,10 @@ static void iwl_mvm_flush_no_vif(struct iwl_mvm *mvm, u32 queues, bool drop)int i;if (!iwl_mvm_has_new_tx_api (mvm)) { +/* we can't ask the firmware anything if it is dead */ +if (test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status)) +return ;if (drop) {mutex_lock (&mvm->mutex); iwl_mvm_flush_tx_path(mvm,
@@ -4407,8 +4411,11 @@ static void iwl_mvm_mac_flush(struct ieee80211_hw *hw,/* this can take a while, and we may need/want other operations * to succeed while doing this, so do it without the mutex held +* If the firmware is dead, this can't work... */ -if (!drop && !iwl_mvm_has_new_tx_api (mvm)) +if (!drop && !iwl_mvm_has_new_tx_api (mvm) && + !test_bit (IWL_MVM_STATUS_HW_RESTART_REQUESTED , + &mvm->status))iwl_trans_wait_tx_queues_empty (mvm->trans, msk); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 21/350 ASoC: tda7419: fix module autoloading
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 934b44589da9aa300201a00fe139c5c54f421563 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- sound/soc/codecs/tda7419.c | 1 + 1 file changed, 1 insertion(+)
sound/soc/codecs/tda7419.c +1 -0
@@ -637,6 +637,7 @@ static const struct of_device_id tda7419_of_match[] = { { .compatible = "st,tda7419" }, { }, }; +MODULE_DEVICE_TABLE (of, tda7419_of_match);static struct i2c_driver tda7419_driver = { .driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 22/350 spi: bcm63xx: Enable module autoloading
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit 709df70a20e990d262c473ad9899314039e8ec82 ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
--- drivers/spi/spi-bcm63xx.c | 1 + 1 file changed, 1 insertion(+)
drivers/spi/spi-bcm63xx.c +1 -0
@@ -490,6 +490,7 @@ static const struct of_device_id bcm63xx_spi_of_match[] = { { .compatible = "brcm,bcm6358-spi", .data = &bcm6358_spi_reg_offsets }, { }, }; +MODULE_DEVICE_TABLE (of, bcm63xx_spi_of_match);static int bcm63xx_spi_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 23/350 x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <[email protected]>
[ Upstream commit 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e ]
A Linux guest on Hyper-V gets the TSC frequency from a synthetic MSR, if available. In this case, set X86_FEATURE_TSC_KNOWN_FREQ so that Linux doesn't unnecessarily do refined TSC calibration when setting up the TSC clocksource.
With this change, a message such as this is no longer output during boot when the TSC is used as the clocksource:
[ 1.115141] tsc: Refined TSC clocksource calibration: 2918.408 MHz
Furthermore, the guest and host will have exactly the same view of the TSC frequency, which is important for features such as the TSC deadline timer that are emulated by the Hyper-V host.
Message-ID: <[email protected]>
--- arch/x86/kernel/cpu/mshyperv.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/kernel/cpu/mshyperv.c +1 -0
@@ -243,6 +243,7 @@ static void __init ms_hyperv_init_platform(void) ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) { x86_platform.calibrate_tsc = hv_get_tsc_khz; x86_platform.calibrate_cpu = hv_get_tsc_khz; +setup_force_cpu_cap (X86_FEATURE_TSC_KNOWN_FREQ ); }if (ms_hyperv.hints &HV_X64_ENLIGHTENED_VMCS_RECOMMENDED ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 24/350 ocfs2: add bounds checking to ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit 9e3041fecdc8f78a5900c3aa51d3d756e73264d6 ]
Add a paranoia check to make sure it doesn't stray beyond valid memory region containing ocfs2 xattr entries when scanning for a match. It will prevent out-of-bound access in case of crafted images.
Stable-dep-of: af77c4fc1871 ("ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()")
--- fs/ocfs2/xattr.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
fs/ocfs2/xattr.c +8 -4
@@ -1076,7 +1076,7 @@ ssize_t ocfs2_listxattr(struct dentry *dentry,return i_ret + b_ret; } -static int ocfs2_xattr_find_entry (int name_index, +static int ocfs2_xattr_find_entry (struct inode *inode,int name_index,const char *name,struct ocfs2_xattr_search *xs) {
@@ -1090,6 +1090,10 @@ static int ocfs2_xattr_find_entry(int name_index, name_len =strlen (name); entry = xs->here;for (i =0 ; i <le16_to_cpu (xs->header->xh_count); i++) { +if ((void *)entry >= xs->end) { +ocfs2_error (inode->i_sb,"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len;
@@ -1180,7 +1184,7 @@ static int ocfs2_xattr_ibody_get(struct inode *inode, xs->base = (void *)xs->header; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret)return ret; size =le64_to_cpu (xs->here->xe_value_size);
@@ -2712,7 +2716,7 @@ static int ocfs2_xattr_ibody_find(struct inode *inode,/* Find the named attribute. */ if (oi->ip_dyn_features &OCFS2_INLINE_XATTR_FL ) { - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs);if (ret && ret != -ENODATA )return ret; xs->not_found = ret;
@@ -2847,7 +2851,7 @@ static int ocfs2_xattr_block_find(struct inode *inode, xs->end = (void *)(blk_bh->b_data) + blk_bh->b_size; xs->here = xs->header->xh_entries; - ret =ocfs2_xattr_find_entry (name_index, name, xs); + ret =ocfs2_xattr_find_entry (inode, name_index, name, xs); }else ret = ocfs2_xattr_index_block_find(inode, blk_bh, name_index,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 25/350 ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ferry Meng <[email protected]>
[ Upstream commit af77c4fc1871847b528d58b7fdafb4aa1f6a9262 ]
xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
--- fs/ocfs2/xattr.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-)
fs/ocfs2/xattr.c +10 -5
@@ -1082,7 +1082,7 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, {struct ocfs2_xattr_entry *entry;size_t name_len; -int i, cmp =1 ; +int i, name_offset, cmp =1 ;if (name ==NULL )return -EINVAL ;
@@ -1097,10 +1097,15 @@ static int ocfs2_xattr_find_entry(struct inode *inode, int name_index, cmp = name_index -ocfs2_xattr_get_type (entry);if (!cmp) cmp = name_len - entry->xe_name_len; -if (!cmp) - cmp =memcmp (name, (xs->base + -le16_to_cpu (entry->xe_name_offset)), - name_len); +if (!cmp) { + name_offset =le16_to_cpu (entry->xe_name_offset); +if ((xs->base + name_offset + name_len) > xs->end) { +ocfs2_error (inode->i_sb, +"corrupted xattr entries" ); +return -EFSCORRUPTED ; + } + cmp =memcmp (name, (xs->base + name_offset), name_len); + }if (cmp ==0 )break ; entry +=1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 26/350 gpio: prevent potential speculation leaks in gpio_device_get_desc()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hagar Hemdan <[email protected]>
commit d795848ecce24a75dfd46481aee066ae6fe39775 upstream.
Userspace may trigger a speculative read of an address outside the gpio descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range. Offset is copied from user and then used as an array index to get the gpio descriptor without sanitization in gpio_device_get_desc().
This change ensures that the offset is sanitized by using array_index_nospec() to mitigate any possibility of speculative information leaks.
This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc.
--- drivers/gpio/gpiolib.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib.c +2 -1
@@ -3,6 +3,7 @@#include <linux/module.h> #include <linux/interrupt.h> #include <linux/irq.h> +#include <linux/nospec.h> #include <linux/spinlock.h> #include <linux/list.h> #include <linux/device.h>
@@ -144,7 +145,7 @@ struct gpio_desc *gpiochip_get_desc(struif (hwnum >= gdev->ngpio)return ERR_PTR (-EINVAL ); -return &gdev->descs[hwnum]; +return &gdev->descs[array_index_nospec (hwnum, gdev->ngpio)]; }/**
Greg Kroah-Hartman
maintainerPATCH 27/350 USB: serial: pl2303: add device id for Macrosilicon MS3020
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junhao Xie <[email protected]>
commit 7d47d22444bb7dc1b6d768904a22070ef35e1fc0 upstream.
Add the device id for the Macrosilicon MS3020 which is a PL2303HXN based device.
--- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 4 ++++ 2 files changed, 5 insertions(+)
drivers/usb/serial/pl2303.c +1 -0
@@ -112,6 +112,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { USB_DEVICE(MACROSILICON_VENDOR_ID, MACROSILICON_MS3020_PRODUCT_ID) }, { } /* Terminating entry */ };
drivers/usb/serial/pl2303.h +4 -0
@@ -165,3 +165,7 @@/* Allied Telesis VT-Kit3 */ #define AT_VENDOR_ID 0x0caa#define AT_VTKIT3_PRODUCT_ID 0x3001 + +/* Macrosilicon MS3020 */ +#define MACROSILICON_VENDOR_ID 0x345f +#define MACROSILICON_MS3020_PRODUCT_ID 0x3020
Greg Kroah-Hartman
maintainerPATCH 28/350 ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksandr Mishin <[email protected]>
[ Upstream commit 07442c46abad1d50ac82af5e0f9c5de2732c4592 ]
In tps68470_pmic_opregion_probe() pointer 'dev' is compared to NULL which is useless.
Fix this issue by removing unneeded check.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/acpi/pmic/tps68470_pmic.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/acpi/pmic/tps68470_pmic.c +2 -4
@@ -376,10 +376,8 @@ static int tps68470_pmic_opregion_probe(struct platform_device *pdev)struct tps68470_pmic_opregion *opregion;acpi_status status; -if (!dev || !tps68470_regmap) { -dev_warn (dev,"dev or regmap is NULL\n" ); -return -EINVAL ; - } +if (!tps68470_regmap) +return dev_err_probe (dev, -EINVAL ,"regmap is missing\n" );if (!handle) {dev_warn (dev,"acpi handle is NULL\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 29/350 wifi: ath9k: fix parameter check in ath9k_init_debug()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <[email protected]>
[ Upstream commit 6edb4ba6fb5b946d112259f54f4657f82eb71e89 ]
Make IS_ERR() judge the debugfs_create_dir() function return in ath9k_init_debug()
Stable-dep-of: f6ffe7f01847 ("wifi: ath9k: Remove error checks when creating debugfs entries")
--- drivers/net/wireless/ath/ath9k/debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/ath/ath9k/debug.c +1 -1
@@ -1384,7 +1384,7 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (!sc->debug.debugfs_phy) +if (IS_ERR (sc->debug.debugfs_phy))return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 30/350 wifi: ath9k: Remove error checks when creating debugfs entries
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit f6ffe7f0184792c2f99aca6ae5b916683973d7d3 ]
We should not be checking the return values from debugfs creation at all: the debugfs functions are designed to handle errors of previously called functions and just transparently abort the creation of debugfs entries when debugfs is disabled. If we check the return value and abort driver initialisation, we break the driver if debugfs is disabled (such as when booting with debugfs=off).
Earlier versions of ath9k accidentally did the right thing by checking the return value, but only for NULL, not for IS_ERR(). This was "fixed" by the two commits referenced below, breaking ath9k with debugfs=off starting from the 6.6 kernel (as reported in the Bugzilla linked below).
Restore functionality by just getting rid of the return value check entirely.
--- drivers/net/wireless/ath/ath9k/debug.c | 2 -- drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 -- 2 files changed, 4 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +0 -2
@@ -1384,8 +1384,6 @@ int ath9k_init_debug(struct ath_hw *ah) sc->debug.debugfs_phy =debugfs_create_dir ("ath9k" , sc->hw->wiphy->debugfsdir); -if (IS_ERR (sc->debug.debugfs_phy)) -return -ENOMEM ;#ifdef CONFIG_ATH_DEBUG debugfs_create_file("debug", 0600, sc->debug.debugfs_phy,
drivers/net/wireless/ath/ath9k/htc_drv_debug.c +0 -2
@@ -491,8 +491,6 @@ int ath9k_htc_init_debug(struct ath_hw *ah) priv->debug.debugfs_phy =debugfs_create_dir (KBUILD_MODNAME , priv->hw->wiphy->debugfsdir); -if (IS_ERR (priv->debug.debugfs_phy)) -return -ENOMEM ;ath9k_cmn_spectral_init_debug (&priv->spec_priv, priv->debug.debugfs_phy);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 31/350 netfilter: nf_tables: elements with timeout below CONFIG_HZ never expire
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <[email protected]>
[ Upstream commit e0c47281723f301894c14e6f5cd5884fdfb813f9 ]
Element timeout that is below CONFIG_HZ never expires because the timeout extension is not allocated given that nf_msecs_to_jiffies64() returns 0. Set timeout to the minimum value to honor timeout.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -3339,7 +3339,7 @@ int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result)return -ERANGE ; ms *=NSEC_PER_MSEC ; - *result =nsecs_to_jiffies64 (ms); + *result =nsecs_to_jiffies64 (ms) ? : !!ms;return 0 ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 32/350 wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit a26a5107bc52922cf5f67361e307ad66547b51c7 ]
Looking at https://syzkaller.appspot.com/bug?extid=1a3986bbd3169c307819
and running reproducer with CONFIG_UBSAN_BOUNDS, I've noticed the following:
[ T4985] UBSAN: array-index-out-of-bounds in net/wireless/scan.c:3479:25 [ T4985] index 164 is out of range for type 'struct ieee80211_channel *[]' <...skipped...>
[ T4985] Call Trace:
[ T4985] <TASK> [ T4985] dump_stack_lvl+0x1c2/0x2a0 [ T4985] ? __pfx_dump_stack_lvl+0x10/0x10 [ T4985] ? __pfx__printk+0x10/0x10 [ T4985] __ubsan_handle_out_of_bounds+0x127/0x150 [ T4985] cfg80211_wext_siwscan+0x11a4/0x1260
<...the rest is not too useful...>
Even if we do 'creq->n_channels = n_channels' before 'creq->ssids = (void *)&creq->channels[n_channels]', UBSAN treats the latter as off-by-one error. Fix this by using pointer arithmetic rather than an expression with explicit array indexing and use convenient 'struct_size()' to simplify the math here and in 'kzalloc()' above.
--- net/wireless/scan.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/wireless/scan.c +3 -3
@@ -1414,8 +1414,8 @@ int cfg80211_wext_siwscan(struct net_device *dev, n_channels =ieee80211_get_num_supported_channels (wiphy); } - creq =kzalloc (sizeof (*creq) +sizeof (struct cfg80211_ssid ) + - n_channels *sizeof (void *), + creq =kzalloc (struct_size (creq, channels, n_channels) + +sizeof (struct cfg80211_ssid ),GFP_ATOMIC );if (!creq) { err = -ENOMEM ;
@@ -1425,7 +1425,7 @@ int cfg80211_wext_siwscan(struct net_device *dev, creq->wiphy = wiphy; creq->wdev = dev->ieee80211_ptr;/* SSIDs come after channels */ - creq->ssids = (void *)&creq->channels[n_channels]; + creq->ssids = (void *)creq +struct_size (creq, channels, n_channels); creq->n_channels = n_channels; creq->n_ssids =1 ; creq->scan_start = jiffies;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 33/350 wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 15ea13b1b1fbf6364d4cd568e65e4c8479632999 ]
Although not reproduced in practice, these two cases may be considered by UBSAN as off-by-one errors. So fix them in the same way as in commit a26a5107bc52 ("wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan()").
--- net/wireless/nl80211.c | 3 ++- net/wireless/sme.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-)
net/wireless/nl80211.c +2 -1
@@ -7578,7 +7578,8 @@ nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,return ERR_PTR (-ENOMEM );if (n_ssids) - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids = n_ssids;if (ie_len) {if (n_ssids)
net/wireless/sme.c +2 -1
@@ -116,7 +116,8 @@ static int cfg80211_conn_scan(struct wireless_dev *wdev) n_channels = i; } request->n_channels = n_channels; - request->ssids = (void *)&request->channels[n_channels]; + request->ssids = (void *)request + +struct_size (request, channels, n_channels); request->n_ssids =1 ; memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 34/350 wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <[email protected]>
[ Upstream commit 9d301de12da6e1bb069a9835c38359b8e8135121 ]
Since '__dev_queue_xmit()' should be called with interrupts enabled, the following backtrace:
ieee80211_do_stop()
...
spin_lock_irqsave(&local->queue_stop_reason_lock, flags)
...
ieee80211_free_txskb()
ieee80211_report_used_skb()
ieee80211_report_ack_skb()
cfg80211_mgmt_tx_status_ext()
nl80211_frame_tx_status()
genlmsg_multicast_netns()
genlmsg_multicast_netns_filtered()
nlmsg_multicast_filtered()
netlink_broadcast_filtered()
do_one_broadcast()
netlink_broadcast_deliver()
__netlink_sendskb()
netlink_deliver_tap()
__netlink_deliver_tap_skb()
dev_queue_xmit()
__dev_queue_xmit() ; with IRQS disabled ...
spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags)
issues the warning (as reported by syzbot reproducer):
WARNING: CPU: 2 PID: 5128 at kernel/softirq.c:362 __local_bh_enable_ip+0xc3/0x120
Fix this by implementing a two-phase skb reclamation in 'ieee80211_do_stop()', where actual work is performed outside of a section with interrupts disabled.
--- net/mac80211/iface.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-)
net/mac80211/iface.c +16 -1
@@ -798,6 +798,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, {struct ieee80211_local *local = sdata->local;unsigned long flags; +struct sk_buff_head freeq;struct sk_buff *skb, *tmp;u32 hw_reconf_flags =0 ;int i, flushed;
@@ -996,18 +997,32 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,skb_queue_purge (&sdata->skb_queue); } +/* +* Since ieee80211_free_txskb() may issue __dev_queue_xmit() +* which should be called with interrupts enabled, reclamation +* is done in two phases: +*/ +__skb_queue_head_init (&freeq); + +/* unlink from local queues... */ spin_lock_irqsave (&local->queue_stop_reason_lock, flags);for (i =0 ; i <IEEE80211_MAX_QUEUES ; i++) { skb_queue_walk_safe(&local->pending[i], skb, tmp) {struct ieee80211_tx_info *info =IEEE80211_SKB_CB (skb);if (info->control.vif == &sdata->vif) {__skb_unlink (skb, &local->pending[i]); -ieee80211_free_txskb (&local->hw, skb); +__skb_queue_tail (&freeq, skb); } } }spin_unlock_irqrestore (&local->queue_stop_reason_lock, flags); +/* ... and perform actual reclamation with interrupts enabled. */ + skb_queue_walk_safe(&freeq, skb, tmp) { +__skb_unlink (skb, &freeq); +ieee80211_free_txskb (&local->hw, skb); + } +if (sdata->vif.type ==NL80211_IFTYPE_AP_VLAN )ieee80211_txq_remove_vlan (local, sdata);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 35/350 can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <[email protected]>
[ Upstream commit 94b0818fa63555a65f6ba107080659ea6bcca63e ]
syzbot reported a warning in bcm_release(). [0]
The blamed change fixed another warning that is triggered when connect() is issued again for a socket whose connect()ed device has been unregistered.
However, if the socket is just close()d without the 2nd connect(), the remaining bo->bcm_proc_read triggers unnecessary remove_proc_entry() in bcm_release().
Let's clear bo->bcm_proc_read after remove_proc_entry() in bcm_notify().
[0]
name '4986'
WARNING: CPU: 0 PID: 5234 at fs/proc/generic.c:711 remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Modules linked in: CPU: 0 UID: 0 PID: 5234 Comm: syz-executor606 Not tainted 6.11.0-rc5-syzkaller-00178-g5517ae241919 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 RIP: 0010:remove_proc_entry+0x2e7/0x5d0 fs/proc/generic.c:711 Code: ff eb 05 e8 cb 1e 5e ff 48 8b 5c 24 10 48 c7 c7 e0 f7 aa 8e e8 2a 38 8e 09 90 48 c7 c7 60 3a 1b 8c 48 89 de e8 da 42 20 ff 90 <0f> 0b 90 90 48 8b 44 24 18 48 c7 44 24 40 0e 36 e0 45 49 c7 04 07 RSP: 0018:ffffc9000345fa20 EFLAGS: 00010246 RAX: 2a2d0aee2eb64600 RBX: ffff888032f1f548 RCX: ffff888029431e00 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000345fb08 R08: ffffffff8155b2f2 R09: 1ffff1101710519a R10: dffffc0000000000 R11: ffffed101710519b R12: ffff888011d38640 R13: 0000000000000004 R14: 0000000000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8880b8800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fcfb52722f0 CR3: 000000000e734000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> bcm_release+0x250/0x880 net/can/bcm.c:1578 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x24a/0x8a0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xa2f/0x27f0 kernel/exit.c:882 do_group_exit+0x207/0x2c0 kernel/exit.c:1031 __do_sys_exit_group kernel/exit.c:1042 [inline] __se_sys_exit_group kernel/exit.c:1040 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1040 x64_sys_call+0x2634/0x2640 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fcfb51ee969 Code: Unable to access opcode bytes at 0x7fcfb51ee93f. RSP: 002b:00007ffce0109ca8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fcfb51ee969 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000001 RBP: 00007fcfb526f3b0 R08: ffffffffffffffb8 R09: 0000555500000000 R10: 0000555500000000 R11: 0000000000000246 R12: 00007fcfb526f3b0 R13: 0000000000000000 R14: 00007fcfb5271ee0 R15: 00007fcfb51bf160 </TASK>
--- net/can/bcm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/can/bcm.c +3 -1
@@ -1423,8 +1423,10 @@ static void bcm_notify(struct bcm_sock *bo, unsigned long msg,/* remove device reference, if this is our bound device */ if (bo->bound && bo->ifindex == dev->ifindex) {#if IS_ENABLED (CONFIG_PROC_FS ) -if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) +if (sock_net (sk)->can.bcmproc_dir && bo->bcm_proc_read) {remove_proc_entry (bo->procname,sock_net (sk)->can.bcmproc_dir); + bo->bcm_proc_read =NULL ; + }#endif bo->bound =0 ; bo->ifindex =0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 36/350 Bluetooth: btusb: Fix not handling ZPL/short-transfer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <[email protected]>
[ Upstream commit 7b05933340f4490ef5b09e84d644d12484b05fdf ]
Requesting transfers of the exact same size of wMaxPacketSize may result in ZPL/short-transfer since the USB stack cannot handle it as we are limiting the buffer size to be the same as wMaxPacketSize.
Also, in terms of throughput this change has the same effect to interrupt endpoint as 290ba200815f "Bluetooth: Improve USB driver throughput by increasing the frame size" had for the bulk endpoint, so users of the advertisement bearer (e.g. BT Mesh) may benefit from this change.
--- drivers/bluetooth/btusb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/bluetooth/btusb.c +4 -1
@@ -743,7 +743,10 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)if (!urb)return -ENOMEM ; - size =le16_to_cpu (data->intr_ep->wMaxPacketSize); +/* Use maximum HCI Event size so the USB stack handles +* ZPL/short-transfer automatically. +*/ + size =HCI_MAX_EVENT_SIZE ; buf =kmalloc (size, mem_flags);if (!buf) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 37/350 block, bfq: fix possible UAF for bfqq->bic with merge chain
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]
1) initial state, three tasks:
Process 1 Process 2 Process 3
(BIC1) (BIC2) (BIC3)
| Λ | Λ | Λ
| | | | | |
V | V | V |
bfqq1 bfqq2 bfqq3
process ref: 1 1 1
2) bfqq1 merged to bfqq2:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) | | | Λ \--------------\| | | V V | bfqq1--------->bfqq2 bfqq3
process ref: 0 2 1
3) bfqq2 merged to bfqq3:
Process 1 Process 2 Process 3 (BIC1) (BIC2) (BIC3) here -> Λ | | \--------------\ \-------------\| V V bfqq1--------->bfqq2---------->bfqq3
process ref: 0 1 3
In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then get bfqq3 through merge chain, and finially handle IO by bfqq3. Howerver, current code will think bfqq2 is owned by BIC1, like initial state, and set bfqq2->bic to BIC1.
bfq_insert_request
-> by Process 1
bfqq = bfq_init_rq(rq)
bfqq = bfq_get_bfqq_handle_split
bfqq = bic_to_bfqq
-> get bfqq2 from BIC1
bfqq->ref++
rq->elv.priv[0] = bic
rq->elv.priv[1] = bfqq
if (bfqq_process_refs(bfqq) == 1)
bfqq->bic = bic
-> record BIC1 to bfqq2
__bfq_insert_request
new_bfqq = bfq_setup_cooperator
-> get bfqq3 from bfqq2->new_bfqq
bfqq_request_freed(bfqq)
new_bfqq->ref++
rq->elv.priv[1] = new_bfqq
-> handle IO by bfqq3
Fix the problem by checking bfqq is from merge chain fist. And this might fix a following problem reported by our syzkaller(unreproducible):
==================================================================
BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Workqueue: kblockd blk_mq_requeue_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0x10d/0x610 mm/kasan/report.c:475 kasan_report+0x8e/0xc0 mm/kasan/report.c:588 bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 bfq_init_rq block/bfq-iosched.c:6876 [inline] bfq_insert_request block/bfq-iosched.c:6254 [inline] bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 </TASK> Allocated by task 20776: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook mm/slab.h:763 [inline] slab_alloc_node mm/slub.c:3458 [inline] kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 ioc_create_icq block/blk-ioc.c:370 [inline] ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436 bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812 blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403 __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517 blk_mq_get_new_requests block/blk-mq.c:2940 [inline] blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042 __submit_bio+0x331/0x6f0 block/blk-core.c:624 __submit_bio_noacct_mq block/blk-core.c:703 [inline] submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732 submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826 xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958 xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619 xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Freed by task 946: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 ____kasan_slab_free mm/kasan/common.c:236 [inline] __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1815 [inline] slab_free_freelist_hook mm/slub.c:1841 [inline] slab_free mm/slub.c:3786 [inline] kmem_cache_free+0x118/0x6f0 mm/slub.c:3808 rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189 rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462 __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553 Last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 Second to last potentially related work creation: kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 __call_rcu_common kernel/rcu/tree.c:2712 [inline] call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 process_one_work kernel/workqueue.c:2627 [inline] process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 kthread+0x33c/0x440 kernel/kthread.c:388 ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 The buggy address belongs to the object at ffff888123839d68 which belongs to the cache bfq_io_cq of size 1360
The buggy address is located 336 bytes inside of
freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)
The buggy address belongs to the physical page:
page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838 head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)page_type: 0xffffffff()
raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488
raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================--- block/bfq-iosched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
block/bfq-iosched.c +2 -1
@@ -5218,7 +5218,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)* addition, if the queue has also just been split, we have to * resume its state. */ -if (likely (bfqq != &bfqd->oom_bfqq) &&bfqq_process_refs (bfqq) ==1 ) { +if (likely (bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq && +bfqq_process_refs (bfqq) ==1 ) { bfqq->bic = bic;if (split) {/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 38/350 block, bfq: choose the last bfqq from merge chain in bfq_setup_cooperator()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 0e456dba86c7f9a19792204a044835f1ca2c8dbb ]
Consider the following merge chain:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\--------------\ \-------------\ \-------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
IO from Process 1 will get bfqf2 from BIC1 first, then bfq_setup_cooperator() will found bfqq2 already merged to bfqq3 and then handle this IO from bfqq3. However, the merge chain can be much deeper and bfqq3 can be merged to other bfqq as well.
Fix this problem by iterating to the last bfqq inbfq_setup_cooperator().
--- block/bfq-iosched.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
block/bfq-iosched.c +6 -2
@@ -2226,8 +2226,12 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,struct bfq_queue *in_service_bfqq, *new_bfqq;/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; + new_bfqq = bfqq->new_bfqq; +if (new_bfqq) { +while (new_bfqq->new_bfqq) + new_bfqq = new_bfqq->new_bfqq; +return new_bfqq; + }/* * Prevent bfqq from being merged if it has been created too
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 39/350 block, bfq: dont break merge chain in bfq_split_bfqq()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <[email protected]>
[ Upstream commit 42c306ed723321af4003b2a41bb73728cab54f85 ]
Consider the following scenario:
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
Λ | | |
\-------------\ \-------------\ \--------------\|
V V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 1 2 4
If Process 1 issue a new IO and bfqq2 is found, and then bfq_init_rq() decide to spilt bfqq2 by bfq_split_bfqq(). Howerver, procress reference of bfqq2 is 1 and bfq_split_bfqq() just clear the coop flag, which will break the merge chain.
Expected result: caller will allocate a new bfqq for BIC1
Process 1 Process 2 Process 3 Process 4
(BIC1) (BIC2) (BIC3) (BIC4)
| | |
\-------------\ \--------------\|
V V
bfqq1--------->bfqq2---------->bfqq3----------->bfqq4
ref 0 0 1 3
Since the condition is only used for the last bfqq4 when the previous bfqq2 and bfqq3 are already splited. Fix the problem by checking if bfqq is the last one in the merge chain as well.
--- block/bfq-iosched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
block/bfq-iosched.c +1 -1
@@ -5037,7 +5037,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq) {bfq_log_bfqq (bfqq->bfqd, bfqq,"splitting queue" ); -if (bfqq_process_refs (bfqq) ==1 ) { +if (bfqq_process_refs (bfqq) ==1 && !bfqq->new_bfqq) { bfqq->pid = current->pid;bfq_clear_bfqq_coop (bfqq);bfq_clear_bfqq_split_coop (bfqq);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 40/350 spi: ppc4xx: handle irq_of_parse_and_map() errors
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 0f245463b01ea254ae90e1d0389e90b0e7d8dc75 ]
Zero and negative number is not a valid IRQ for in-kernel code and the irq_of_parse_and_map() function returns zero on error. So this check for valid IRQs should only accept values > 0.
--- drivers/spi/spi-ppc4xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/spi/spi-ppc4xx.c +3 -0
@@ -495,6 +495,9 @@ static int spi_ppc4xx_of_probe(struct platform_device *op)/* Request IRQ */ hw->irqnum =irq_of_parse_and_map (np,0 ); +if (hw->irqnum <=0 ) + goto free_host; + ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);if (ret) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 41/350 spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
[ Upstream commit 7781f1d120fec8624fc654eda900fc8748262082 ]
0 is incorrect error code when failed to parse and map IRQ. Replace OF specific old API for IRQ retrieval with a generic one to fix this issue.
--- drivers/spi/spi-ppc4xx.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/spi/spi-ppc4xx.c +3 -3
@@ -29,7 +29,6 @@#include <linux/errno.h> #include <linux/wait.h> #include <linux/of_address.h> -#include <linux/of_irq.h> #include <linux/of_platform.h> #include <linux/of_gpio.h> #include <linux/interrupt.h>
@@ -494,9 +493,10 @@ static int spi_ppc4xx_of_probe(struct platform_device *op) }/* Request IRQ */ - hw->irqnum =irq_of_parse_and_map (np,0 ); -if (hw->irqnum <=0 ) + ret =platform_get_irq (op,0 ); +if (ret <0 ) goto free_host; + hw->irqnum = ret; ret =request_irq (hw->irqnum, spi_ppc4xx_int,0 ,"spi_ppc4xx_of" , (void *)hw);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 42/350 ARM: versatile: fix OF node leak in CPUs prepare
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit f2642d97f2105ed17b2ece0c597450f2ff95d704 ]
Machine code is leaking OF node reference from of_find_matching_node() in realview_smp_prepare_cpus().
--- arch/arm/mach-realview/platsmp-dt.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-realview/platsmp-dt.c +1 -0
@@ -70,6 +70,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)return ; } map =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (map)) {pr_err ("PLATSMP: No syscon regmap\n" );return ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 43/350 reset: berlin: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b ]
Driver is leaking OF node reference on memory allocation failure. Acquire the OF node reference after memory allocation to fix this and keep it simple.
--- drivers/reset/reset-berlin.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/reset/reset-berlin.c +2 -1
@@ -68,13 +68,14 @@ static int berlin_reset_xlate(struct reset_controller_dev *rcdev,static int berlin2_reset_probe (struct platform_device *pdev) { -struct device_node *parent_np =of_get_parent (pdev->dev.of_node); +struct device_node *parent_np;struct berlin_reset_priv *priv; priv =devm_kzalloc (&pdev->dev,sizeof (*priv),GFP_KERNEL );if (!priv)return -ENOMEM ; + parent_np =of_get_parent (pdev->dev.of_node); priv->regmap =syscon_node_to_regmap (parent_np);of_node_put (parent_np);if (IS_ERR (priv->regmap))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 44/350 clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ankit Agrawal <[email protected]>
[ Upstream commit ca140a0dc0a18acd4653b56db211fec9b2339986 ]
Add the missing iounmap() when clock frequency fails to get read by the of_property_read_u32() call, or if the call to msm_timer_init() fails.
--- drivers/clocksource/timer-qcom.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/clocksource/timer-qcom.c +6 -1
@@ -242,6 +242,7 @@ static int __init msm_dt_timer_init(struct device_node *np) }if (of_property_read_u32 (np,"clock-frequency" , &freq)) { +iounmap (cpu0_base);pr_err ("Unknown frequency\n" );return -EINVAL ; }
@@ -252,7 +253,11 @@ static int __init msm_dt_timer_init(struct device_node *np) freq /=4 ;writel_relaxed (DGT_CLK_CTL_DIV_4 , source_base +DGT_CLK_CTL ); -return msm_timer_init (freq,32 , irq, !!percpu_offset); + ret =msm_timer_init (freq,32 , irq, !!percpu_offset); +if (ret) +iounmap (cpu0_base); + +return ret; }TIMER_OF_DECLARE (kpss_timer,"qcom,kpss-timer" , msm_dt_timer_init);TIMER_OF_DECLARE (scss_timer,"qcom,scss-timer" , msm_dt_timer_init);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 45/350 hwmon: (max16065) Fix overflows seen when writing limits
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <[email protected]>
[ Upstream commit 744ec4477b11c42e2c8de9eb8364675ae7a0bd81 ]
Writing large limits resulted in overflows as reported by module tests.
in0_lcrit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_crit: Suspected overflow: [max=5538, read 0, written 2147483647]in0_min: Suspected overflow: [max=5538, read 0, written 2147483647]
Fix the problem by clamping prior to multiplications and the use of DIV_ROUND_CLOSEST, and by using consistent variable types.
--- drivers/hwmon/max16065.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/hwmon/max16065.c +3 -2
@@ -117,9 +117,10 @@ static inline int LIMIT_TO_MV(int limit, int range)return limit * range /256 ; } -static inline int MV_TO_LIMIT (int mv,int range) +static inline int MV_TO_LIMIT (unsigned long mv,int range) { -return clamp_val (DIV_ROUND_CLOSEST (mv *256 , range),0 ,255 ); + mv =clamp_val (mv,0 ,ULONG_MAX /256 ); +return DIV_ROUND_CLOSEST (clamp_val (mv *256 ,0 , range *255 ), range); }static inline int ADC_TO_CURR (int adc,int gain)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 46/350 mtd: slram: insert break after errors in parsing the map
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mirsad Todorovac <[email protected]>
[ Upstream commit 336c218dd7f0588ed8a7345f367975a00a4f003f ]
GCC 12.3.0 compiler on linux-next next-20240709 tree found the execution path in which, due to lazy evaluation, devlength isn't initialised with the parsed string:
289 while (map) {
290 devname = devstart = devlength = NULL;
291
292 if (!(devname = strsep(&map, ","))) {
293 E("slram: No devicename specified.\n");
294 break;
295 }
296 T("slram: devname = %s\n", devname);
297 if ((!map) || (!(devstart = strsep(&map, ",")))) {
298 E("slram: No devicestart specified.\n");
299 }
300 T("slram: devstart = %s\n", devstart);
→ 301 if ((!map) || (!(devlength = strsep(&map, ",")))) {
302 E("slram: No devicelength / -end specified.\n");
303 }
→ 304 T("slram: devlength = %s\n", devlength);
305 if (parse_cmdline(devname, devstart, devlength) != 0) {
306 return(-EINVAL);
307 }
Parsing should be finished after map == NULL, so a break is best inserted after each E("slram: ... \n") error message.
--- drivers/mtd/devices/slram.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/mtd/devices/slram.c +2 -0
@@ -295,10 +295,12 @@ static int __init init_slram(void)T ("slram: devname = %s\n" , devname);if ((!map) || (!(devstart =strsep (&map,"," )))) {E ("slram: No devicestart specified.\n" ); +break ; }T ("slram: devstart = %s\n" , devstart);if ((!map) || (!(devlength =strsep (&map,"," )))) {E ("slram: No devicelength / -end specified.\n" ); +break ; }T ("slram: devlength = %s\n" , devlength);if (parse_cmdline (devname, devstart, devlength) !=0 ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 47/350 hwmon: (ntc_thermistor) fix module autoloading
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuntao Liu <[email protected]>
[ Upstream commit b6964d66a07a9003868e428a956949e17ab44d7e ]
Add MODULE_DEVICE_TABLE(), so modules could be properly autoloaded based on the alias from of_device_id table.
Message-ID: <[email protected]>
--- drivers/hwmon/ntc_thermistor.c | 1 + 1 file changed, 1 insertion(+)
drivers/hwmon/ntc_thermistor.c +1 -0
@@ -57,6 +57,7 @@ static const struct platform_device_id ntc_thermistor_id[] = { { "ncp15xh103", TYPE_NCPXXXH103 }, { }, }; +MODULE_DEVICE_TABLE (platform, ntc_thermistor_id);/* * A compensation table should be sorted by the values of .ohm
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 48/350 power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artur Weber <[email protected]>
[ Upstream commit 3a3acf839b2cedf092bdd1ff65b0e9895df1656b ]
Commit 223a3b82834f ("power: supply: max17042_battery: use VFSOC for capacity when no rsns") made it so that capacity on systems without current sensing would be read from VFSOC instead of RepSOC. However, the SOC threshold calculation still read RepSOC to get the SOC regardless of the current sensing option state.
Fix this by applying the same conditional to determine which register should be read.
This also seems to be the intended behavior as per the datasheet - SOC alert config value in MiscCFG on setups without current sensing is set to a value of 0b11, indicating SOC alerts being generated based on VFSOC, instead of 0b00 which indicates SOC alerts being generated based on RepSOC.
This fixes an issue on the Galaxy S3/Midas boards, where the alert interrupt would be constantly retriggered, causing high CPU usage on idle (around ~12%-15%).
--- drivers/power/supply/max17042_battery.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/power/supply/max17042_battery.c +4 -1
@@ -848,7 +848,10 @@ static void max17042_set_soc_threshold(struct max17042_chip *chip, u16 off)/* program interrupt thesholds such that we should * get interrupt for every 'off' perc change in the soc */ -regmap_read (map, MAX17042_RepSOC, &soc); +if (chip->pdata->enable_current_sense) +regmap_read (map, MAX17042_RepSOC, &soc); +else +regmap_read (map,MAX17042_VFSOC , &soc); soc >>=8 ; soc_tr = (soc + off) <<8 ;if (off < soc)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 49/350 fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit aa578e897520f32ae12bec487f2474357d01ca9c ]
If an error occurs after request_mem_region(), a corresponding release_mem_region() should be called, as already done in the remove function.
--- drivers/video/fbdev/hpfb.c | 1 + 1 file changed, 1 insertion(+)
drivers/video/fbdev/hpfb.c +1 -0
@@ -343,6 +343,7 @@ static int hpfb_dio_probe(struct dio_dev *d, const struct dio_device_id *ent)if (hpfb_init_one (paddr, vaddr)) {if (d->scode >=DIOII_SCBASE )iounmap ((void *)vaddr); +release_mem_region (d->resource.start,resource_size (&d->resource));return -ENOMEM ; }return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 50/350 drm/stm: Fix an error handling path in stm_drm_platform_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit ce7c90bfda2656418c69ba0dd8f8a7536b8928d4 ]
If drm_dev_register() fails, a call to drv_load() must be undone, as already done in the remove function.
--- drivers/gpu/drm/stm/drv.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpu/drm/stm/drv.c +3 -1
@@ -152,10 +152,12 @@ static int stm_drm_platform_probe(struct platform_device *pdev) ret =drm_dev_register (ddev,0 );if (ret) - goto err_put; + goto err_unload;return 0 ; +err_unload: +drv_unload (ddev); err_put:drm_dev_put (ddev);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 51/350 drm/amd: fix typo
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matteo Croce <[email protected]>
[ Upstream commit 229f7b1d6344ea35fff0b113e4d91128921f8937 ]
Fix spelling mistake: "lenght" -> "length"
Stable-dep-of: 8155566a26b8 ("drm/amdgpu: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/amd/include/atombios.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/include/atombios.h +1 -1
@@ -4106,7 +4106,7 @@ typedef struct _ATOM_LCD_MODE_CONTROL_CAPtypedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType; -UCHAR ucFakeEDIDLength;// = 128 means EDID lenght is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128 +UCHAR ucFakeEDIDLength;// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128 UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 52/350 drm/amdgpu: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit 320e2590e281d0a7865e861f50155b5b435e9813 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
Important to mention is that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 8155566a26b8 ("drm/amdgpu: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/amd/amdgpu/atombios_encoders.c | 7 +++++-- drivers/gpu/drm/amd/include/atombios.h | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +5 -2
@@ -2110,8 +2110,11 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
drivers/gpu/drm/amd/include/atombios.h +1 -1
@@ -4107,7 +4107,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength;// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128 -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 53/350 drm/amdgpu: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 8155566a26b8d6c1dd914f06a0c652e4e2f2adf1 ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- .../gpu/drm/amd/amdgpu/atombios_encoders.c | 29 ++++++++++--------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/amd/amdgpu/atombios_encoders.c +16 -13
@@ -2095,26 +2095,29 @@ amdgpu_atombios_encoder_get_lcd_info(struct amdgpu_encoder *encoder) fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { adev->mode_info.bios_hardcoded_edid = edid; adev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 54/350 drm/radeon: Replace one-element array with flexible-array member
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Miguel Almeida <[email protected]>
[ Upstream commit c81c5bd5cf2f428867e0bcfcccd4e4d2f8c68f51 ]
One-element arrays are deprecated, and we are replacing them with flexible array members instead. So, replace one-element array with flexible-array member in struct _ATOM_FAKE_EDID_PATCH_RECORD and refactor the rest of the code accordingly.
It's worth mentioning that doing a build before/after this patch results in no binary output differences.
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE routines on memcpy() and help us make progress towards globally enabling -fstrict-flex-arrays=3 [1].
Stable-dep-of: 17c6baff3d5f ("drm/radeon: properly handle vbios fake edid sizing")
--- drivers/gpu/drm/radeon/atombios.h | 2 +- drivers/gpu/drm/radeon/radeon_atombios.c | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-)
drivers/gpu/drm/radeon/atombios.h +1 -1
@@ -3615,7 +3615,7 @@ typedef struct _ATOM_FAKE_EDID_PATCH_RECORD {UCHAR ucRecordType;UCHAR ucFakeEDIDLength; -UCHAR ucFakeEDIDString[1 ];// This actually has ucFakeEdidLength elements. +UCHAR ucFakeEDIDString[];// This actually has ucFakeEdidLength elements. }ATOM_FAKE_EDID_PATCH_RECORD ; typedef struct _ATOM_PANEL_RESOLUTION_PATCH_RECORD
drivers/gpu/drm/radeon/radeon_atombios.c +5 -2
@@ -1742,8 +1742,11 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct } } record += fake_edid_record->ucFakeEDIDLength ? - fake_edid_record->ucFakeEDIDLength +2 : -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ); +struct_size (fake_edid_record, + ucFakeEDIDString, + fake_edid_record->ucFakeEDIDLength) : +/* empty fake edid record must be 3 bytes long */ +sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 55/350 drm/radeon: properly handle vbios fake edid sizing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <[email protected]>
[ Upstream commit 17c6baff3d5f65c8da164137a58742541a060b2f ]
The comment in the vbios structure says:
// = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
This fake edid struct has not been used in a long time, so I'm not sure if there were actually any boards out there with a non-128 byte EDID, but align the code with the comment.
--- drivers/gpu/drm/radeon/radeon_atombios.c | 29 +++++++++++++----------- 1 file changed, 16 insertions(+), 13 deletions(-)
drivers/gpu/drm/radeon/radeon_atombios.c +16 -13
@@ -1727,26 +1727,29 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct fake_edid_record = (ATOM_FAKE_EDID_PATCH_RECORD *)record;if (fake_edid_record->ucFakeEDIDLength) {struct edid *edid; -int edid_size = -max ((int )EDID_LENGTH , (int )fake_edid_record->ucFakeEDIDLength); - edid =kmalloc (edid_size,GFP_KERNEL ); +int edid_size; + +if (fake_edid_record->ucFakeEDIDLength ==128 ) + edid_size = fake_edid_record->ucFakeEDIDLength; +else + edid_size = fake_edid_record->ucFakeEDIDLength *128 ; + edid =kmemdup (&fake_edid_record->ucFakeEDIDString[0 ], + edid_size,GFP_KERNEL );if (edid) { -memcpy ((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0 ], - fake_edid_record->ucFakeEDIDLength); -if (drm_edid_is_valid (edid)) { rdev->mode_info.bios_hardcoded_edid = edid; rdev->mode_info.bios_hardcoded_edid_size = edid_size; - }else + }else {kfree (edid); + } } + record +=struct_size (fake_edid_record, + ucFakeEDIDString, + edid_size); + }else { +/* empty fake edid record must be 3 bytes long */ + record +=sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ; } - record += fake_edid_record->ucFakeEDIDLength ? -struct_size (fake_edid_record, - ucFakeEDIDString, - fake_edid_record->ucFakeEDIDLength) : -/* empty fake edid record must be 3 bytes long */ -sizeof (ATOM_FAKE_EDID_PATCH_RECORD ) +1 ;break ;case LCD_PANEL_RESOLUTION_RECORD_TYPE : panel_res_record = (ATOM_PANEL_RESOLUTION_PATCH_RECORD *)record;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 56/350 drm/rockchip: vop: Allow 4096px width scaling
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Bee <[email protected]>
[ Upstream commit 0ef968d91a20b5da581839f093f98f7a03a804f7 ]
There is no reason to limit VOP scaling to 3840px width, the limit of RK3288, when there are newer VOP versions that support 4096px width.
Change to enforce a maximum of 4096px width plane scaling, the maximum supported output width of the VOP versions supported by this driver.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +2 -2
@@ -308,8 +308,8 @@ static void scl_vop_cal_scl_fac(struct vop *vop, const struct vop_win_data *win,if (info->is_yuv) is_yuv = true; -if (dst_w >3840 ) { -DRM_DEV_ERROR (vop->dev,"Maximum dst width (3840) exceeded\n" ); +if (dst_w >4096 ) { +DRM_DEV_ERROR (vop->dev,"Maximum dst width (4096) exceeded\n" );return ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 57/350 drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
[ Upstream commit 3fbaf475a5b8361ebee7da18964db809e37518b7 ]
Several cs track offsets (such as 'track->db_s_read_offset') either are initialized with or plainly take big enough values that, once shifted 8 bits left, may be hit with integer overflow if the resulting values end up going over u32 limit.
Same goes for a few instances of 'surf.layer_size * mslice' multiplications that are added to 'offset' variable - they may potentially overflow as well and need to be validated properly.
While some debug prints in this code section take possible overflow issues into account, simply casting to (unsigned long) may be erroneous in its own way, as depending on CPU architecture one is liable to get different results.
Fix said problems by:
- casting 'offset' to fixed u64 data type instead of ambiguous unsigned long.
- casting one of the operands in vulnerable to integer overflow cases to u64.
- adjust format specifiers in debug prints to properly represent 'offset' values.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- drivers/gpu/drm/radeon/evergreen_cs.c | 62 +++++++++++++-------------- 1 file changed, 31 insertions(+), 31 deletions(-)
drivers/gpu/drm/radeon/evergreen_cs.c +31 -31
@@ -396,7 +396,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned istruct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028C6C_SLICE_MAX (track->cb_color_view[id]) +1 ;
@@ -434,14 +434,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned ireturn r; } - offset = track->cb_color_bo_offset[id] <<8 ; + offset = (u64 )track->cb_color_bo_offset[id] <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d cb[%d] bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d cb[%d] bo base %llu not aligned with %ld\n" , __func__, __LINE__, id, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->cb_color_bo[id])) {/* old ddx are broken they allocate bo with w*h*bpp but * program slice with ALIGN(h, 8), catch this and patch
@@ -449,14 +449,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i*/ if (!surf.mode) {uint32_t *ib = p->ib.ptr; -unsigned long tmp, nby, bsize, size, min =0 ; +u64 tmp, nby, bsize, size, min =0 ;/* find the height the ddx wants */ if (surf.nby >8 ) { min = surf.nby -8 ; } bsize =radeon_bo_size (track->cb_color_bo[id]); - tmp = track->cb_color_bo_offset[id] <<8 ; + tmp = (u64 )track->cb_color_bo_offset[id] <<8 ;for (nby = surf.nby; nby > min; nby--) { size = nby * surf.nbx * surf.bpe * surf.nsamples;if ((tmp + size * mslice) <= bsize) {
@@ -468,7 +468,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i slice = ((nby * surf.nbx) /64 ) -1 ;if (!evergreen_surface_check (p, &surf,"cb" )) {/* check if this one works */ - tmp += surf.layer_size * mslice; + tmp += (u64 )surf.layer_size * mslice;if (tmp <= bsize) { ib[track->cb_color_slice_idx[id]] = slice; goto old_ddx_ok;
@@ -477,9 +477,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i } }dev_warn (p->dev,"%s:%d cb[%d] bo too small (layer size %d, " -"offset %d, max layer %d, bo size %ld, slice %d)\n" , +"offset %llu, max layer %d, bo size %ld, slice %d)\n" , __func__, __LINE__, id, surf.layer_size, - track->cb_color_bo_offset[id] <<8 , mslice, + (u64 )track->cb_color_bo_offset[id] <<8 , mslice,radeon_bo_size (track->cb_color_bo[id]), slice); dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n", __func__, __LINE__, surf.nbx, surf.nby,
@@ -563,7 +563,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -609,18 +609,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return r; } - offset = track->db_s_read_offset <<8 ; + offset = (u64 )track->db_s_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_read_bo)) {dev_warn (p->dev,"%s:%d stencil read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_read_offset <<8 , mslice, + (u64 )track->db_s_read_offset <<8 , mslice,radeon_bo_size (track->db_s_read_bo)); dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n", __func__, __LINE__, track->db_depth_size,
@@ -628,18 +628,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)return -EINVAL ; } - offset = track->db_s_write_offset <<8 ; + offset = (u64 )track->db_s_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_s_write_bo)) {dev_warn (p->dev,"%s:%d stencil write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_s_write_offset <<8 , mslice, + (u64 )track->db_s_write_offset <<8 , mslice,radeon_bo_size (track->db_s_write_bo));return -EINVAL ; }
@@ -660,7 +660,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)struct evergreen_cs_track *track = p->track;struct eg_surface surf;unsigned pitch, slice, mslice; -unsigned long offset; +u64 offset;int r; mslice =G_028008_SLICE_MAX (track->db_depth_view) +1 ;
@@ -707,34 +707,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)return r; } - offset = track->db_z_read_offset <<8 ; + offset = (u64 )track->db_z_read_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil read bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil read bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_read_bo)) {dev_warn (p->dev,"%s:%d depth read bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_read_offset <<8 , mslice, + (u64 )track->db_z_read_offset <<8 , mslice,radeon_bo_size (track->db_z_read_bo));return -EINVAL ; } - offset = track->db_z_write_offset <<8 ; + offset = (u64 )track->db_z_write_offset <<8 ;if (offset & (surf.base_align -1 )) { -dev_warn (p->dev,"%s:%d stencil write bo base %ld not aligned with %ld\n" , +dev_warn (p->dev,"%s:%d stencil write bo base %llu not aligned with %ld\n" , __func__, __LINE__, offset, surf.base_align);return -EINVAL ; } - offset += surf.layer_size * mslice; + offset += (u64 )surf.layer_size * mslice;if (offset >radeon_bo_size (track->db_z_write_bo)) {dev_warn (p->dev,"%s:%d depth write bo too small (layer size %d, " -"offset %ld, max layer %d, bo size %ld)\n" , +"offset %llu, max layer %d, bo size %ld)\n" , __func__, __LINE__, surf.layer_size, - (unsigned long )track->db_z_write_offset <<8 , mslice, + (u64 )track->db_z_write_offset <<8 , mslice,radeon_bo_size (track->db_z_write_bo));return -EINVAL ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 58/350 jfs: fix out-of-bounds in dbNextAG() and diAlloc()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeongjun Park <[email protected]>
[ Upstream commit e63866a475562810500ea7f784099bfe341e761a ]
In dbNextAG() , there is no check for the case where bmp->db_numag is greater or same than MAXAG due to a polluted image, which causes an out-of-bounds. Therefore, a bounds check should be added in dbMount().
And in dbNextAG(), a check for the case where agpref is greater than bmp->db_numag should be added, so an out-of-bounds exception should be prevented.
Additionally, a check for the case where agno is greater or same than MAXAG should be added in diAlloc() to prevent out-of-bounds.
--- fs/jfs/jfs_dmap.c | 4 ++-- fs/jfs/jfs_imap.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-)
fs/jfs/jfs_dmap.c +2 -2
@@ -200,7 +200,7 @@ int dbMount(struct inode *ipbmap) } bmp->db_numag =le32_to_cpu (dbmp_le->dn_numag); -if (!bmp->db_numag) { +if (!bmp->db_numag || bmp->db_numag >=MAXAG ) { err = -EINVAL ; goto err_release_metapage; }
@@ -665,7 +665,7 @@ int dbNextAG(struct inode *ipbmap)* average free space. */ for (i =0 ; i < bmp->db_numag; i++, agpref++) { -if (agpref == bmp->db_numag) +if (agpref >= bmp->db_numag) agpref =0 ;if (atomic_read (&bmp->db_active[agpref]))
fs/jfs/jfs_imap.c +1 -1
@@ -1375,7 +1375,7 @@ int diAlloc(struct inode *pip, bool dir, struct inode *ip)/* get the ag number of this iag */ agno =BLKTOAG (JFS_IP (pip)->agstart,JFS_SBI (pip->i_sb)); dn_numag =JFS_SBI (pip->i_sb)->bmap->db_numag; -if (agno <0 || agno > dn_numag) +if (agno <0 || agno > dn_numag || agno >=MAXAG )return -EIO ;if (atomic_read (&JFS_SBI (pip->i_sb)->bmap->db_active[agno])) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 59/350 drm/msm/a5xx: properly clear preemption records on resume
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit 64fd6d01a52904bdbda0ce810a45a428c995a4ca ]
Two fields of preempt_record which are used by CP aren't reset on
resume: "data" and "info". This is the reason behind faults which happen when we try to switch to the ring that was active last before suspend. In addition those faults can't be recovered from because we use suspend and resume to do so (keeping values of those fields again).
Patchwork: https://patchwork.freedesktop.org/patch/612043/
--- drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/msm/adreno/a5xx_preempt.c +2 -0
@@ -209,6 +209,8 @@ void a5xx_preempt_hw_init(struct msm_gpu *gpu)int i;for (i =0 ; i < gpu->nr_rings; i++) { + a5xx_gpu->preempt[i]->data =0 ; + a5xx_gpu->preempt[i]->info =0 ; a5xx_gpu->preempt[i]->wptr =0 ; a5xx_gpu->preempt[i]->rptr =0 ; a5xx_gpu->preempt[i]->rbase = gpu->rb[i]->iova;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 60/350 drm/msm/a5xx: fix races in preemption evaluation stage
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Lypak <[email protected]>
[ Upstream commit ce050f307ad93bcc5958d0dd35fc276fd394d274 ]
On A5XX GPUs when preemption is used it's invietable to enter a soft lock-up state in which GPU is stuck at empty ring-buffer doing nothing. This appears as full UI lockup and not detected as GPU hang (because it's not). This happens due to not triggering preemption when it was needed. Sometimes this state can be recovered by some new submit but generally it won't happen because applications are waiting for old submits to retire.
One of the reasons why this happens is a race between a5xx_submit and a5xx_preempt_trigger called from IRQ during submit retire. Former thread updates ring->cur of previously empty and not current ring right after latter checks it for emptiness. Then both threads can just exit because for first one preempt_state wasn't NONE yet and for second one all rings appeared to be empty.
To prevent such situations from happening we need to establish guarantee for preempt_trigger to make decision after each submit or retire. To implement this we serialize preemption initiation using spinlock. If switch is already in progress we need to re-trigger preemption when it finishes.
Patchwork: https://patchwork.freedesktop.org/patch/612045/
--- drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 24 +++++++++++++++++++++-- 2 files changed, 23 insertions(+), 2 deletions(-)
drivers/gpu/drm/msm/adreno/a5xx_gpu.h +1 -0
@@ -44,6 +44,7 @@ struct a5xx_gpu {uint64_t preempt_iova[MSM_GPU_MAX_RINGS ];atomic_t preempt_state; +spinlock_t preempt_start_lock;struct timer_list preempt_timer; };
drivers/gpu/drm/msm/adreno/a5xx_preempt.c +22 -2
@@ -107,12 +107,19 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)if (gpu->nr_rings ==1 )return ; +/* +* Serialize preemption start to ensure that we always make +* decision on latest state. Otherwise we can get stuck in +* lower priority or empty ring. +*/ +spin_lock_irqsave (&a5xx_gpu->preempt_start_lock, flags); +/* * Try to start preemption by moving from NONE to START. If * unsuccessful, a preemption is already in flight */ if (!try_preempt_state (a5xx_gpu,PREEMPT_NONE ,PREEMPT_START )) -return ; + goto out;/* Get the next ring to preempt to */ ring =get_next_ring (gpu);
@@ -137,9 +144,11 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)set_preempt_state (a5xx_gpu,PREEMPT_ABORT );update_wptr (gpu, a5xx_gpu->cur_ring);set_preempt_state (a5xx_gpu,PREEMPT_NONE ); -return ; + goto out; } +spin_unlock_irqrestore (&a5xx_gpu->preempt_start_lock, flags); +/* Make sure the wptr doesn't update while we're in motion */ spin_lock_irqsave (&ring->lock, flags); a5xx_gpu->preempt[ring->id]->wptr =get_wptr (ring);
@@ -163,6 +172,10 @@ void a5xx_preempt_trigger(struct msm_gpu *gpu)/* And actually start the preemption */ gpu_write (gpu,REG_A5XX_CP_CONTEXT_SWITCH_CNTL ,1 ); +return ; + +out: +spin_unlock_irqrestore (&a5xx_gpu->preempt_start_lock, flags); }void a5xx_preempt_irq (struct msm_gpu *gpu)
@@ -200,6 +213,12 @@ void a5xx_preempt_irq(struct msm_gpu *gpu)update_wptr (gpu, a5xx_gpu->cur_ring);set_preempt_state (a5xx_gpu,PREEMPT_NONE ); + +/* +* Try to trigger preemption again in case there was a submit or +* retire during ring switch +*/ +a5xx_preempt_trigger (gpu); }void a5xx_preempt_hw_init (struct msm_gpu *gpu)
@@ -302,5 +321,6 @@ void a5xx_preempt_init(struct msm_gpu *gpu) } } +spin_lock_init (&a5xx_gpu->preempt_start_lock);timer_setup (&a5xx_gpu->preempt_timer, a5xx_preempt_timer,0 ); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 61/350 ipmi: docs: dont advertise deprecated sysfs entries
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <[email protected]>
[ Upstream commit 64dce81f8c373c681e62d5ffe0397c45a35d48a2 ]
"i2c-adapter" class entries are deprecated since 2009. Switch to the proper location.
Message-Id: <[email protected]>
--- Documentation/IPMI.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Documentation/IPMI.txt +1 -1
@@ -518,7 +518,7 @@ at module load time (for a module) with:: [dbg_probe=1] The addresses are normal I2C addresses. The adapter is the string -name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name. +name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name. It is *NOT* i2c-<n> itself. Also, the comparison is done ignoring spaces, so if the name is "This is an I2C chip" you can say adapter_name=ThisisanI2cchip. This is because it's hard to pass in
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 62/350 drm/msm: fix %s null argument error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sherry Yang <[email protected]>
[ Upstream commit 25b85075150fe8adddb096db8a4b950353045ee1 ]
The following build error was triggered because of NULL string argument:
BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c: In function 'mdp5_smp_dump': BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=] BUILDSTDERR: 352 | drm_printf(p, "%s:%d\t%d\t%s\n", BUILDSTDERR: | ^~ BUILDSTDERR: drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c:352:51: error: '%s' directive argument is null [-Werror=format-overflow=]
This happens from the commit a61ddb4393ad ("drm: enable (most) W=1 warnings by default across the subsystem"). Using "(null)" instead to fix it.
Patchwork: https://patchwork.freedesktop.org/patch/611071/
--- drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/msm/disp/mdp5/mdp5_smp.c +1 -1
@@ -366,7 +366,7 @@ void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p)drm_printf (p,"%s:%d\t%d\t%s\n" ,pipe2name (pipe), j, inuse, - plane ? plane->name :NULL ); + plane ? plane->name :"(null)" ); total += inuse; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 63/350 xen: use correct end address of kernel for conflict checking
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit fac1bceeeb04886fc2ee952672e6e6c85ce41dca ]
When running as a Xen PV dom0 the kernel is loaded by the hypervisor using a different memory map than that of the host. In order to minimize the required changes in the kernel, the kernel adapts its memory map to that of the host. In order to do that it is checking for conflicts of its load address with the host memory map.
Unfortunately the tested memory range does not include the .brk area, which might result in crashes or memory corruption when this area does conflict with the memory map of the host.
Fix the test by using the _end label instead of __bss_stop.
--- arch/x86/xen/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/xen/setup.c +1 -1
@@ -862,7 +862,7 @@ char * __init xen_memory_setup(void)* to relocating (and even reusing) pages with kernel text or data. */ if (xen_is_e820_reserved (__pa_symbol (_text), -__pa_symbol (__bss_stop) -__pa_symbol (_text))) { +__pa_symbol (_end) -__pa_symbol (_text))) {xen_raw_console_write ("Xen hypervisor allocated kernel memory conflicts with E820 map\n" );BUG (); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 64/350 xen/swiotlb: simplify range_straddles_page_boundary()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit bf70726668c6116aa4976e0cc87f470be6268a2f ]
range_straddles_page_boundary() is open coding several macros from include/xen/page.h. Use those instead. Additionally there is no need to have check_pages_physically_contiguous() as a separate function as it is used only once, so merge it into range_straddles_page_boundary().
Stable-dep-of: 9f40ec84a797 ("xen/swiotlb: add alignment check for dma buffers")
--- drivers/xen/swiotlb-xen.c | 28 ++++++---------------------- 1 file changed, 6 insertions(+), 22 deletions(-)
drivers/xen/swiotlb-xen.c +6 -22
@@ -94,34 +94,18 @@ static inline dma_addr_t xen_virt_to_bus(void *address)return xen_phys_to_bus (virt_to_phys (address)); } -static int check_pages_physically_contiguous (unsigned long xen_pfn, -unsigned int offset, -size_t length) +static inline int range_straddles_page_boundary (phys_addr_t p,size_t size) { -unsigned long next_bfn; -int i; -int nr_pages; +unsigned long next_bfn, xen_pfn =XEN_PFN_DOWN (p); +unsigned int i, nr_pages =XEN_PFN_UP (xen_offset_in_page (p) + size); next_bfn =pfn_to_bfn (xen_pfn); - nr_pages = (offset + length +XEN_PAGE_SIZE -1 ) >>XEN_PAGE_SHIFT ; -for (i =1 ; i < nr_pages; i++) { +for (i =1 ; i < nr_pages; i++)if (pfn_to_bfn (++xen_pfn) != ++next_bfn) -return 0 ; - } -return 1 ; -} +return 1 ; -static inline int range_straddles_page_boundary (phys_addr_t p,size_t size) -{ -unsigned long xen_pfn =XEN_PFN_DOWN (p); -unsigned int offset = p & ~XEN_PAGE_MASK ; - -if (offset + size <=XEN_PAGE_SIZE ) -return 0 ; -if (check_pages_physically_contiguous (xen_pfn, offset, size)) -return 0 ; -return 1 ; +return 0 ; }static int is_xen_swiotlb_buffer (dma_addr_t dma_addr)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 65/350 xen/swiotlb: add alignment check for dma buffers
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <[email protected]>
[ Upstream commit 9f40ec84a7976d95c34e7cc070939deb103652b0 ]
When checking a memory buffer to be consecutive in machine memory, the alignment needs to be checked, too. Failing to do so might result in DMA memory not being aligned according to its requested size, leading to error messages like:
4xxx 0000:2b:00.0: enabling device (0140 -> 0142) 4xxx 0000:2b:00.0: Ring address not aligned
4xxx 0000:2b:00.0: Failed to initialise service qat_crypto 4xxx 0000:2b:00.0: Resetting device qat_dev0 4xxx: probe of 0000:2b:00.0 failed with error -14
--- drivers/xen/swiotlb-xen.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/xen/swiotlb-xen.c +6 -0
@@ -98,9 +98,15 @@ static inline int range_straddles_page_boundary(phys_addr_t p, size_t size) {unsigned long next_bfn, xen_pfn =XEN_PFN_DOWN (p);unsigned int i, nr_pages =XEN_PFN_UP (xen_offset_in_page (p) + size); +phys_addr_t algn =1ULL << (get_order (size) +PAGE_SHIFT ); next_bfn =pfn_to_bfn (xen_pfn); +/* If buffer is physically aligned, ensure DMA alignment. */ +if (IS_ALIGNED (p, algn) && + !IS_ALIGNED ((phys_addr_t )next_bfn <<XEN_PAGE_SHIFT , algn)) +return 1 ; +for (i =1 ; i < nr_pages; i++)if (pfn_to_bfn (++xen_pfn) != ++next_bfn)return 1 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 66/350 selftests/bpf: Fix error compiling test_lru_map.c
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Ambardar <[email protected]>
[ Upstream commit cacf2a5a78cd1f5f616eae043ebc6f024104b721 ]
Although the post-increment in macro 'CPU_SET(next++, &cpuset)' seems safe, the sequencing can raise compile errors, so move the increment outside the macro. This avoids an error seen using gcc 12.3.0 for mips64el/musl-libc:
In file included from test_lru_map.c:11:
test_lru_map.c: In function 'sched_next_online':
test_lru_map.c:129:29: error: operation on 'next' may be undefined [-Werror=sequence-point]
129 | CPU_SET(next++, &cpuset);
| ^cc1: all warnings being treated as errors
--- tools/testing/selftests/bpf/test_lru_map.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/test_lru_map.c +2 -1
@@ -76,7 +76,8 @@ static int sched_next_online(int pid, int *next_to_try)while (next < nr_cpus) {CPU_ZERO (&cpuset); -CPU_SET (next++, &cpuset); +CPU_SET (next, &cpuset); + next++;if (!sched_setaffinity (pid,sizeof (cpuset), &cpuset)) { ret =0 ;break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 67/350 xz: cleanup CRC32 edits from 2018
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lasse Collin <[email protected]>
[ Upstream commit 2ee96abef214550d9e92f5143ee3ac1fd1323e67 ]
In 2018, a dependency on <linux/crc32poly.h> was added to avoid duplicating the same constant in multiple files. Two months later it was found to be a bad idea and the definition of CRC32_POLY_LE macro was moved into xz_private.h to avoid including <linux/crc32poly.h>.
xz_private.h is a wrong place for it too. Revert back to the upstream version which has the poly in xz_crc32_init() in xz_crc32.c.
--- lib/xz/xz_crc32.c | 2 +- lib/xz/xz_private.h | 4 ---- 2 files changed, 1 insertion(+), 5 deletions(-)
lib/xz/xz_crc32.c +1 -1
@@ -29,7 +29,7 @@ STATIC_RW_DATA uint32_t xz_crc32_table[256]; XZ_EXTERN void xz_crc32_init(void) { -const uint32_t poly =CRC32_POLY_LE ; +const uint32_t poly =0xEDB88320 ;uint32_t i;uint32_t j;
lib/xz/xz_private.h +0 -4
@@ -102,10 +102,6 @@# endif #endif -#ifndef CRC32_POLY_LE -#define CRC32_POLY_LE 0xedb88320 -#endif -/* * Allocate memory for LZMA2 decoder. xz_dec_lzma2_reset() must be used * before calling xz_dec_lzma2_run().
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 68/350 kthread: add kthread_work tracepoints
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <[email protected]>
[ Upstream commit f630c7c6f10546ebff15c3a856e7949feb7a2372 ]
While migrating some code from wq to kthread_worker, I found that I missed the execute_start/end tracepoints. So add similar tracepoints for kthread_work. And for completeness, queue_work tracepoint (although this one differs slightly from the matching workqueue tracepoint).
Stable-dep-of: e16c7b07784f ("kthread: fix task state in kthread worker if being frozen")
--- include/trace/events/sched.h | 84 ++++++++++++++++++++++++++++++++++++ kernel/kthread.c | 9 ++++ 2 files changed, 93 insertions(+)
include/trace/events/sched.h +84 -0
@@ -5,6 +5,7 @@#if !defined(_TRACE_SCHED_H) || defined(TRACE_HEADER_MULTI_READ )#define _TRACE_SCHED_H +#include <linux/kthread.h> #include <linux/sched/numa_balancing.h> #include <linux/tracepoint.h> #include <linux/binfmts.h>
@@ -51,6 +52,89 @@ TRACE_EVENT(sched_kthread_stop_ret,TP_printk ("ret=%d" , __entry->ret) ); +/** +* sched_kthread_work_queue_work - called when a work gets queued +* @worker: pointer to the kthread_worker +* @work: pointer to struct kthread_work +* +* This event occurs when a work is queued immediately or once a +* delayed work is actually queued (ie: once the delay has been +* reached). +*/ +TRACE_EVENT (sched_kthread_work_queue_work, + + TP_PROTO(struct kthread_worker *worker, + struct kthread_work *work), + +TP_ARGS (worker, work), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + __field( void *, worker) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = work->func; + __entry->worker = worker; + ), + +TP_printk ("work struct=%p function=%ps worker=%p" , + __entry->work, __entry->function, __entry->worker) +); + +/** +* sched_kthread_work_execute_start - called immediately before the work callback +* @work: pointer to struct kthread_work +* +* Allows to track kthread work execution. +*/ +TRACE_EVENT (sched_kthread_work_execute_start, + + TP_PROTO(struct kthread_work *work), + +TP_ARGS (work), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = work->func; + ), + +TP_printk ("work struct %p: function %ps" , __entry->work, __entry->function) +); + +/** +* sched_kthread_work_execute_end - called immediately after the work callback +* @work: pointer to struct work_struct +* @function: pointer to worker function +* +* Allows to track workqueue execution. +*/ +TRACE_EVENT (sched_kthread_work_execute_end, + + TP_PROTO(struct kthread_work *work, kthread_work_func_t function), + +TP_ARGS (work, function), + +TP_STRUCT__entry ( + __field( void *, work ) + __field( void *, function) + ), + +TP_fast_assign ( + __entry->work = work; + __entry->function = function; + ), + +TP_printk ("work struct %p: function %ps" , __entry->work, __entry->function) +); +/* * Tracepoint for waking up a task: */
kernel/kthread.c +9 -0
@@ -696,8 +696,15 @@ int kthread_worker_fn(void *worker_ptr)spin_unlock_irq (&worker->lock);if (work) { +kthread_work_func_t func = work->func;__set_current_state (TASK_RUNNING ); +trace_sched_kthread_work_execute_start (work); work->func (work); +/* +* Avoid dereferencing work after this point. The trace +* event only cares about the address. +*/ +trace_sched_kthread_work_execute_end (work, func); }else if (!freezing (current))schedule ();
@@ -826,6 +833,8 @@ static void kthread_insert_work(struct kthread_worker *worker, {kthread_insert_work_sanity_check (worker, work); +trace_sched_kthread_work_queue_work (worker, work); +list_add_tail (&work->node, pos); work->worker = worker;if (!worker->current_work &&likely (worker->task))
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 69/350 kthread: fix task state in kthread worker if being frozen
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <[email protected]>
[ Upstream commit e16c7b07784f3fb03025939c4590b9a7c64970a7 ]
When analyzing a kernel waring message, Peter pointed out that there is a race condition when the kworker is being frozen and falls into try_to_freeze() with TASK_INTERRUPTIBLE, which could trigger a might_sleep() warning in try_to_freeze(). Although the root cause is not related to freeze()[1], it is still worthy to fix this issue ahead.
One possible race scenario:
CPU 0 CPU 1
----- -----
// kthread_worker_fn
set_current_state(TASK_INTERRUPTIBLE);
suspend_freeze_processes()
freeze_processes
static_branch_inc(&freezer_active);
freeze_kernel_threads
pm_nosig_freezing = true;
if (work) { //false
__set_current_state(TASK_RUNNING);
} else if (!freezing(current)) //false, been frozen
freezing():
if (static_branch_unlikely(&freezer_active))
if (pm_nosig_freezing)
return true;
schedule()
}
// state is still TASK_INTERRUPTIBLE
try_to_freeze()
might_sleep() <--- warningFix this by explicitly set the TASK_RUNNING before entering try_to_freeze().
--- kernel/kthread.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
kernel/kthread.c +9 -1
@@ -705,8 +705,16 @@ int kthread_worker_fn(void *worker_ptr)* event only cares about the address. */ trace_sched_kthread_work_execute_end (work, func); - }else if (!freezing (current)) + }else if (!freezing (current)) {schedule (); + }else { +/* +* Handle the case where the current remains +* TASK_INTERRUPTIBLE. try_to_freeze() expects +* the current to be TASK_RUNNING. +*/ +__set_current_state (TASK_RUNNING ); + }try_to_freeze ();cond_resched ();
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 70/350 jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauricio Faria de Oliveira <[email protected]>
[ Upstream commit aa3c0c61f62d682259e3e66cdc01846290f9cd6c ]
Export functions that implement the current behavior done for an inode in journal_submit|finish_inode_data_buffers().
No functional change.
Stable-dep-of: 20cee68f5b44 ("ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard")
--- fs/jbd2/commit.c | 36 ++++++++++++++++-------------------- fs/jbd2/journal.c | 2 ++ include/linux/jbd2.h | 4 ++++ 3 files changed, 22 insertions(+), 20 deletions(-)
fs/jbd2/commit.c +16 -20
@@ -187,19 +187,17 @@ static int journal_wait_on_commit_record(journal_t *journal,* use writepages() because with dealyed allocation we may be doing * block allocation in writepages(). */ -static int journal_submit_inode_data_buffers (struct address_space *mapping, -loff_t dirty_start,loff_t dirty_end) +int jbd2_journal_submit_inode_data_buffers (struct jbd2_inode *jinode) { -int ret; +struct address_space *mapping = jinode->i_vfs_inode->i_mapping;struct writeback_control wbc = { .sync_mode =WB_SYNC_ALL , .nr_to_write = mapping->nrpages *2 , - .range_start = dirty_start, - .range_end = dirty_end, + .range_start = jinode->i_dirty_start, + .range_end = jinode->i_dirty_end, }; - ret =generic_writepages (mapping, &wbc); -return ret; +return generic_writepages (mapping, &wbc); }/*
@@ -215,16 +213,11 @@ static int journal_submit_data_buffers(journal_t *journal, {struct jbd2_inode *jinode;int err, ret =0 ; -struct address_space *mapping;spin_lock (&journal->j_list_lock);list_for_each_entry (jinode, &commit_transaction->t_inode_list, i_list) { -loff_t dirty_start = jinode->i_dirty_start; -loff_t dirty_end = jinode->i_dirty_end; -if (!(jinode->i_flags &JI_WRITE_DATA ))continue ; - mapping = jinode->i_vfs_inode->i_mapping; jinode->i_flags |=JI_COMMIT_RUNNING ;spin_unlock (&journal->j_list_lock);/*
@@ -234,8 +227,7 @@ static int journal_submit_data_buffers(journal_t *journal,* only allocated blocks here. */ trace_jbd2_submit_inode_data (jinode->i_vfs_inode); - err =journal_submit_inode_data_buffers (mapping, dirty_start, - dirty_end); + err =jbd2_journal_submit_inode_data_buffers (jinode);if (!ret) ret = err;spin_lock (&journal->j_list_lock);
@@ -248,6 +240,15 @@ static int journal_submit_data_buffers(journal_t *journal,return ret; } +int jbd2_journal_finish_inode_data_buffers (struct jbd2_inode *jinode) +{ +struct address_space *mapping = jinode->i_vfs_inode->i_mapping; + +return filemap_fdatawait_range_keep_errors (mapping, + jinode->i_dirty_start, + jinode->i_dirty_end); +} +/* * Wait for data submitted for writeout, refile inodes to proper * transaction if needed.
@@ -262,16 +263,11 @@ static int journal_finish_inode_data_buffers(journal_t *journal,/* For locking, see the comment in journal_submit_data_buffers() */ spin_lock (&journal->j_list_lock);list_for_each_entry (jinode, &commit_transaction->t_inode_list, i_list) { -loff_t dirty_start = jinode->i_dirty_start; -loff_t dirty_end = jinode->i_dirty_end; -if (!(jinode->i_flags &JI_WAIT_DATA ))continue ; jinode->i_flags |=JI_COMMIT_RUNNING ;spin_unlock (&journal->j_list_lock); - err =filemap_fdatawait_range_keep_errors ( - jinode->i_vfs_inode->i_mapping, dirty_start, - dirty_end); + err =jbd2_journal_finish_inode_data_buffers (jinode);if (!ret) ret = err;spin_lock (&journal->j_list_lock);
fs/jbd2/journal.c +2 -0
@@ -96,6 +96,8 @@ EXPORT_SYMBOL(jbd2_journal_inode_add_write);EXPORT_SYMBOL (jbd2_journal_inode_add_wait);EXPORT_SYMBOL (jbd2_journal_inode_ranged_write);EXPORT_SYMBOL (jbd2_journal_inode_ranged_wait); +EXPORT_SYMBOL (jbd2_journal_submit_inode_data_buffers); +EXPORT_SYMBOL (jbd2_journal_finish_inode_data_buffers);EXPORT_SYMBOL (jbd2_journal_init_jbd_inode);EXPORT_SYMBOL (jbd2_journal_release_jbd_inode);EXPORT_SYMBOL (jbd2_journal_begin_ordered_truncate);
include/linux/jbd2.h +4 -0
@@ -1421,6 +1421,10 @@ extern int jbd2_journal_inode_ranged_write(handle_t *handle,extern int jbd2_journal_inode_ranged_wait (handle_t *handle,struct jbd2_inode *inode,loff_t start_byte,loff_t length); +extern int jbd2_journal_submit_inode_data_buffers ( +struct jbd2_inode *jinode); +extern int jbd2_journal_finish_inode_data_buffers ( +struct jbd2_inode *jinode);extern int jbd2_journal_begin_ordered_truncate (journal_t *journal,struct jbd2_inode *inode,loff_t new_size);extern void jbd2_journal_init_jbd_inode (struct jbd2_inode *jinode,struct inode *inode);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 71/350 ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangerkun <[email protected]>
[ Upstream commit 20cee68f5b44fdc2942d20f3172a262ec247b117 ]
Commit 3d56b8d2c74c ("ext4: Speed up FITRIM by recording flags in ext4_group_info") speed up fstrim by skipping trim trimmed group. We also has the chance to clear trimmed once there exists some block free for this group(mount without discard), and the next trim for this group will work well too.
For mount with discard, we will issue dicard when we free blocks, so leave trimmed flag keep alive to skip useless trim trigger from userspace seems reasonable. But for some case like ext4 build on dm-thinpool(ext4 blocksize 4K, pool blocksize 128K), discard from ext4 maybe unaligned for dm thinpool, and thinpool will just finish this discard(see process_discard_bio when begein equals to end) without actually process discard. For this case, trim from userspace can really help us to free some thinpool block.
So convert to clear trimmed flag for all case no matter mounted with discard or not.
--- fs/ext4/mballoc.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
fs/ext4/mballoc.c +4 -6
@@ -2834,11 +2834,8 @@ static void ext4_free_data_in_buddy(struct super_block *sb,/* * Clear the trimmed flag for the group so that the next * ext4_trim_fs can trim it. -* If the volume is mounted with -o discard, online discard -* is supported and the free blocks will be trimmed online. */ -if (!test_opt (sb,DISCARD )) -EXT4_MB_GRP_CLEAR_TRIMMED (db); +EXT4_MB_GRP_CLEAR_TRIMMED (db);if (!db->bb_free_root.rb_node) {/* No more items in the per group rb tree
@@ -4962,8 +4959,9 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode," group:%d block:%d count:%lu failed" " with %d" , block_group, bit, count, err); - }else -EXT4_MB_GRP_CLEAR_TRIMMED (e4b.bd_info); + } + +EXT4_MB_GRP_CLEAR_TRIMMED (e4b.bd_info);ext4_lock_group (sb, block_group);mb_clear_bits (bitmap_bh->b_data, bit, count_clusters);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 72/350 smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiawei Ye <[email protected]>
[ Upstream commit 2749749afa071f8a0e405605de9da615e771a7ce ]
In the smk_set_cipso function, the skp->smk_netlabel.attr.mls.cat field is directly assigned to a new value without using the appropriate RCU pointer assignment functions. According to RCU usage rules, this is illegal and can lead to unpredictable behavior, including data inconsistencies and impossible-to-diagnose memory corruption issues.
This possible bug was identified using a static analysis tool developed by myself, specifically designed to detect RCU-related issues.
To address this, the assignment is now done using rcu_assign_pointer(), which ensures that the pointer assignment is done safely, with the necessary memory barriers and synchronization. This change prevents potential RCU dereference issues by ensuring that the cat field is safely updated while still adhering to RCU's requirements.
--- security/smack/smackfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/smack/smackfs.c +1 -1
@@ -948,7 +948,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf, rc =smk_netlbl_mls (maplevel, mapcatset, &ncats,SMK_CIPSOLEN );if (rc >=0 ) { old_cat = skp->smk_netlabel.attr.mls.cat; - skp->smk_netlabel.attr.mls.cat = ncats.attr.mls.cat; +rcu_assign_pointer (skp->smk_netlabel.attr.mls.cat, ncats.attr.mls.cat); skp->smk_netlabel.attr.mls.lvl = ncats.attr.mls.lvl;synchronize_rcu ();netlbl_catmap_free (old_cat);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 73/350 ext4: avoid negative min_clusters in find_group_orlov()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <[email protected]>
[ Upstream commit bb0a12c3439b10d88412fd3102df5b9a6e3cd6dc ]
min_clusters is signed integer and will be converted to unsigned integer when compared with unsigned number stats.free_clusters. If min_clusters is negative, it will be converted to a huge unsigned value in which case all groups may not meet the actual desired free clusters.
Set negative min_clusters to 0 to avoid unexpected behavior.
--- fs/ext4/ialloc.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/ialloc.c +2 -0
@@ -510,6 +510,8 @@ static int find_group_orlov(struct super_block *sb, struct inode *parent,if (min_inodes <1 ) min_inodes =1 ; min_clusters = avefreec -EXT4_CLUSTERS_PER_GROUP (sb)*flex_size /4 ; +if (min_clusters <0 ) + min_clusters =0 ;/* * Start looking in the flex group where we last allocated an
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 74/350 ext4: return error on ext4_find_inline_entry
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit 4d231b91a944f3cab355fce65af5871fb5d7735b ]
In case of errors when reading an inode from disk or traversing inline directory entries, return an error-encoded ERR_PTR instead of returning NULL. ext4_find_inline_entry only caller, __ext4_find_entry already returns such encoded errors.
Stable-dep-of: c6b72f5d82b1 ("ext4: avoid OOB when system.data xattr changes underneath the filesystem")
--- fs/ext4/inline.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/ext4/inline.c +7 -3
@@ -1658,8 +1658,9 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,void *inline_start;int inline_size; -if (ext4_get_inode_loc (dir, &iloc)) -return NULL ; + ret =ext4_get_inode_loc (dir, &iloc); +if (ret) +return ERR_PTR (ret);down_read (&EXT4_I (dir)->xattr_sem);if (!ext4_has_inline_data (dir)) {
@@ -1690,7 +1691,10 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir, out:brelse (iloc.bh); - iloc.bh =NULL ; +if (ret <0 ) + iloc.bh =ERR_PTR (ret); +else + iloc.bh =NULL ; out_find:up_read (&EXT4_I (dir)->xattr_sem);return iloc.bh;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 75/350 ext4: avoid OOB when system.data xattr changes underneath the filesystem
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <[email protected]>
[ Upstream commit c6b72f5d82b1017bad80f9ebf502832fc321d796 ]
When looking up for an entry in an inlined directory, if e_value_offs is changed underneath the filesystem by some change in the block device, it will lead to an out-of-bounds access that KASAN detects as an UAF.
EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none.
loop0: detected capacity change from 2048 to 2047
==================================================================
BUG: KASAN: use-after-free in ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 Read of size 1 at addr ffff88803e91130f by task syz-executor269/5103 CPU: 0 UID: 0 PID: 5103 Comm: syz-executor269 Not tainted 6.11.0-rc4-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ext4_search_dir+0xf2/0x1c0 fs/ext4/namei.c:1500 ext4_find_inline_entry+0x4be/0x5e0 fs/ext4/inline.c:1697 __ext4_find_entry+0x2b4/0x1b30 fs/ext4/namei.c:1573 ext4_lookup_entry fs/ext4/namei.c:1727 [inline] ext4_lookup+0x15f/0x750 fs/ext4/namei.c:1795 lookup_one_qstr_excl+0x11f/0x260 fs/namei.c:1633 filename_create+0x297/0x540 fs/namei.c:3980 do_symlinkat+0xf9/0x3a0 fs/namei.c:4587 __do_sys_symlinkat fs/namei.c:4610 [inline] __se_sys_symlinkat fs/namei.c:4607 [inline] __x64_sys_symlinkat+0x95/0xb0 fs/namei.c:4607 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f3e73ced469 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 21 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff4d40c258 EFLAGS: 00000246 ORIG_RAX: 000000000000010a RAX: ffffffffffffffda RBX: 0032656c69662f2e RCX: 00007f3e73ced469 RDX: 0000000020000200 RSI: 00000000ffffff9c RDI: 00000000200001c0 RBP: 0000000000000000 R08: 00007fff4d40c290 R09: 00007fff4d40c290 R10: 0023706f6f6c2f76 R11: 0000000000000246 R12: 00007fff4d40c27c R13: 0000000000000003 R14: 431bde82d7b634db R15: 00007fff4d40c2b0 </TASK>
Calling ext4_xattr_ibody_find right after reading the inode with ext4_get_inode_loc will lead to a check of the validity of the xattrs, avoiding this problem.
--- fs/ext4/inline.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-)
fs/ext4/inline.c +21 -10
@@ -1653,25 +1653,36 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,struct ext4_dir_entry_2 **res_dir, int *has_inline_data) { + struct ext4_xattr_ibody_find is = { + .s = { .not_found = -ENODATA , }, + }; +struct ext4_xattr_info i = { + .name_index =EXT4_XATTR_INDEX_SYSTEM , + .name =EXT4_XATTR_SYSTEM_DATA , + };int ret; -struct ext4_iloc iloc;void *inline_start;int inline_size; - ret =ext4_get_inode_loc (dir, &iloc); + ret =ext4_get_inode_loc (dir, &is.iloc);if (ret)return ERR_PTR (ret);down_read (&EXT4_I (dir)->xattr_sem); + + ret =ext4_xattr_ibody_find (dir, &i, &is); +if (ret) + goto out; +if (!ext4_has_inline_data (dir)) { *has_inline_data =0 ; goto out; } - inline_start = (void *)ext4_raw_inode (&iloc)->i_block + + inline_start = (void *)ext4_raw_inode (&is.iloc)->i_block +EXT4_INLINE_DOTDOT_SIZE ; inline_size =EXT4_MIN_INLINE_DATA_SIZE -EXT4_INLINE_DOTDOT_SIZE ; - ret =ext4_search_dir (iloc.bh, inline_start, inline_size, + ret =ext4_search_dir (is.iloc.bh, inline_start, inline_size, dir, fname,0 , res_dir);if (ret ==1 ) goto out_find;
@@ -1681,23 +1692,23 @@ struct buffer_head *ext4_find_inline_entry(struct inode *dir,if (ext4_get_inline_size (dir) ==EXT4_MIN_INLINE_DATA_SIZE ) goto out; - inline_start =ext4_get_inline_xattr_pos (dir, &iloc); + inline_start =ext4_get_inline_xattr_pos (dir, &is.iloc); inline_size =ext4_get_inline_size (dir) -EXT4_MIN_INLINE_DATA_SIZE ; - ret =ext4_search_dir (iloc.bh, inline_start, inline_size, + ret =ext4_search_dir (is.iloc.bh, inline_start, inline_size, dir, fname,0 , res_dir);if (ret ==1 ) goto out_find; out: -brelse (iloc.bh); +brelse (is.iloc.bh);if (ret <0 ) - iloc.bh =ERR_PTR (ret); + is.iloc.bh =ERR_PTR (ret);else - iloc.bh =NULL ; + is.iloc.bh =NULL ; out_find:up_read (&EXT4_I (dir)->xattr_sem); -return iloc.bh; +return is.iloc.bh; } int ext4_delete_inline_entry(handle_t *handle,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 76/350 nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 9403001ad65ae4f4c5de368bdda3a0636b51d51a ]
Patch series "nilfs2: fix potential issues with empty b-tree nodes".
This series addresses three potential issues with empty b-tree nodes that can occur with corrupted filesystem images, including one recently discovered by syzbot.
This patch (of 3):
If a b-tree is broken on the device, and the b-tree height is greater than 2 (the level of the root node is greater than 1) even if the number of child nodes of the b-tree root is 0, a NULL pointer dereference occurs in nilfs_btree_prepare_insert(), which is called from nilfs_btree_insert().
This is because, when the number of child nodes of the b-tree root is 0, nilfs_btree_do_lookup() does not set the block buffer head in any of path[x].bp_bh, leaving it as the initial value of NULL, but if the level of the b-tree root node is greater than 1, nilfs_btree_get_nonroot_node(), which accesses the buffer memory of path[x].bp_bh, is called.
Fix this issue by adding a check to nilfs_btree_root_broken(), which performs sanity checks when reading the root node from the device, to detect this inconsistency.
Thanks to Lizhi Xu for trying to solve the bug and clarifying the cause early on.
--- fs/nilfs2/btree.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nilfs2/btree.c +2 -1
@@ -381,7 +381,8 @@ static int nilfs_btree_root_broken(const struct nilfs_btree_node *node,if (unlikely (level <NILFS_BTREE_LEVEL_NODE_MIN || level >=NILFS_BTREE_LEVEL_MAX || nchildren <0 || - nchildren >NILFS_BTREE_ROOT_NCHILDREN_MAX )) { + nchildren >NILFS_BTREE_ROOT_NCHILDREN_MAX || + (nchildren ==0 && level >NILFS_BTREE_LEVEL_NODE_MIN ))) {nilfs_crit (inode->i_sb,"bad btree root (ino=%lu): level = %d, flags = 0x%x, nchildren = %d" , inode->i_ino, level, flags, nchildren);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 77/350 nilfs2: determine empty node blocks as corrupted
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit 111b812d3662f3a1b831d19208f83aa711583fe6 ]
Due to the nature of b-trees, nilfs2 itself and admin tools such as mkfs.nilfs2 will never create an intermediate b-tree node block with 0 child nodes, nor will they delete (key, pointer)-entries that would result in such a state. However, it is possible that a b-tree node block is corrupted on the backing device and is read with 0 child nodes.
Because operation is not guaranteed if the number of child nodes is 0 for intermediate node blocks other than the root node, modify nilfs_btree_node_broken(), which performs sanity checks when reading a b-tree node block, so that such cases will be judged as metadata corruption.
--- fs/nilfs2/btree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nilfs2/btree.c +1 -1
@@ -350,7 +350,7 @@ static int nilfs_btree_node_broken(const struct nilfs_btree_node *node,if (unlikely (level <NILFS_BTREE_LEVEL_NODE_MIN || level >=NILFS_BTREE_LEVEL_MAX || (flags &NILFS_BTREE_NODE_ROOT ) || - nchildren <0 || + nchildren <=0 || nchildren >NILFS_BTREE_NODE_NCHILDREN_MAX (size))) { nilfs_crit(inode->i_sb, "bad btree node (ino=%lu, blocknr=%llu): level = %d, flags = 0x%x, nchildren = %d",
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 78/350 nilfs2: fix potential oob read in nilfs_btree_check_delete()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <[email protected]>
[ Upstream commit f9c96351aa6718b42a9f42eaf7adce0356bdb5e8 ]
The function nilfs_btree_check_delete(), which checks whether degeneration to direct mapping occurs before deleting a b-tree entry, causes memory access outside the block buffer when retrieving the maximum key if the root node has no entries.
This does not usually happen because b-tree mappings with 0 child nodes are never created by mkfs.nilfs2 or nilfs2 itself. However, it can happen if the b-tree root node read from a device is configured that way, so fix this potential issue by adding a check for that case.
--- fs/nilfs2/btree.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
fs/nilfs2/btree.c +5 -2
@@ -1660,13 +1660,16 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)int nchildren, ret; root =nilfs_btree_get_root (btree); + nchildren =nilfs_btree_node_get_nchildren (root); +if (unlikely (nchildren ==0 )) +return 0 ; +switch (nilfs_btree_height (btree)) {case 2 : bh =NULL ; node = root;break ;case 3 : - nchildren =nilfs_btree_node_get_nchildren (root);if (nchildren >1 )return 0 ; ptr = nilfs_btree_node_get_ptr(root, nchildren - 1,
@@ -1675,12 +1678,12 @@ static int nilfs_btree_check_delete(struct nilfs_bmap *btree, __u64 key)if (ret <0 )return ret; node = (struct nilfs_btree_node *)bh->b_data; + nchildren =nilfs_btree_node_get_nchildren (node);break ;default :return 0 ; } - nchildren =nilfs_btree_node_get_nchildren (node); maxkey =nilfs_btree_node_get_key (node, nchildren -1 ); nextmaxkey = (nchildren >1 ) ?nilfs_btree_node_get_key (node, nchildren -2 ) :0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 79/350 perf sched timehist: Fix missing free of session in perf_sched__timehist()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 6bdf5168b6fb19541b0c1862bdaa596d116c7bfb ]
When perf_time__parse_str() fails in perf_sched__timehist(), need to free session that was previously created, fix it.
--- tools/perf/builtin-sched.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/perf/builtin-sched.c +2 -1
@@ -2994,7 +2994,8 @@ static int perf_sched__timehist(struct perf_sched *sched)if (perf_time__parse_str (&sched->ptime, sched->time_str) !=0 ) {pr_err ("Invalid time string\n" ); -return -EINVAL ; + err = -EINVAL ; + goto out; }if (timehist_check_attr (sched, evlist) !=0 )
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 80/350 perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Jihong <[email protected]>
[ Upstream commit 39c243411bdb8fb35777adf49ee32549633c4e12 ]
If sched_in event for current task is not recorded, sched_in timestamp will be set to end_time of time window interest, causing an error in timestamp show. In this case, we choose to ignore this event.
Test scenario:
perf[1229608] does not record the first sched_in event, run time and sch delay are both 0
# perf sched timehist
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ---------
2090450.763231 [0000] perf[1229608] 0.000 0.000 0.000
2090450.763235 [0000] migration/0[15] 0.000 0.001 0.003
2090450.763263 [0001] perf[1229608] 0.000 0.000 0.000
2090450.763268 [0001] migration/1[21] 0.000 0.001 0.004
2090450.763302 [0002] perf[1229608] 0.000 0.000 0.000
2090450.763309 [0002] migration/2[27] 0.000 0.001 0.007
2090450.763338 [0003] perf[1229608] 0.000 0.000 0.000
2090450.763343 [0003] migration/3[33] 0.000 0.001 0.004Before:
arbitrarily specify a time window of interest, timestamp will be set to an incorrect value
# perf sched timehist --time 100,200
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ---------
200.000000 [0000] perf[1229608] 0.000 0.000 0.000
200.000000 [0001] perf[1229608] 0.000 0.000 0.000
200.000000 [0002] perf[1229608] 0.000 0.000 0.000
200.000000 [0003] perf[1229608] 0.000 0.000 0.000
200.000000 [0004] perf[1229608] 0.000 0.000 0.000
200.000000 [0005] perf[1229608] 0.000 0.000 0.000
200.000000 [0006] perf[1229608] 0.000 0.000 0.000
200.000000 [0007] perf[1229608] 0.000 0.000 0.000After:
# perf sched timehist --time 100,200
Samples of sched_switch event do not have callchains.
time cpu task name wait time sch delay run time
[tid/pid] (msec) (msec) (msec)
--------------- ------ ------------------------------ --------- --------- ------------ tools/perf/builtin-sched.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
tools/perf/builtin-sched.c +4 -1
@@ -2553,9 +2553,12 @@ static int timehist_sched_change_event(struct perf_tool *tool,* - previous sched event is out of window - we are done * - sample time is beyond window user cares about - reset it * to close out stats for time window interest +* - If tprev is 0, that is, sched_in event for current task is +* not recorded, cannot determine whether sched_in event is +* within time window interest - ignore it */ if (ptime->end) { -if (tprev > ptime->end) +if (!tprev || tprev > ptime->end) goto out;if (t > ptime->end)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 81/350 perf time-utils: Fix 32-bit nsec parsing
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <[email protected]>
[ Upstream commit 38e2648a81204c9fc5b4c87a8ffce93a6ed91b65 ]
The "time utils" test fails in 32-bit builds:
...
parse_nsec_time("18446744073.709551615")
Failed. ptime 4294967295709551615 expected 18446744073709551615
...
Switch strtoul to strtoull as an unsigned long in 32-bit build isn't 64-bits.
--- tools/perf/util/time-utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
tools/perf/util/time-utils.c +2 -2
@@ -17,7 +17,7 @@ int parse_nsec_time(const char *str, u64 *ptime)u64 time_sec, time_nsec;char *end; - time_sec =strtoul (str, &end,10 ); + time_sec =strtoull (str, &end,10 );if (*end !='.' && *end !='\0' )return -1 ;
@@ -35,7 +35,7 @@ int parse_nsec_time(const char *str, u64 *ptime)for (i =strlen (nsec_buf); i <9 ; i++) nsec_buf[i] ='0' ; - time_nsec =strtoul (nsec_buf, &end,10 ); + time_nsec =strtoull (nsec_buf, &end,10 );if (*end !='\0' )return -1 ; }else
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 82/350 clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <[email protected]>
[ Upstream commit 1d34b9757523c1ad547bd6d040381f62d74a3189 ]
Similar to DCLK_LCDC on RK3328, the DCLK_VOP on RK3228 is typically parented by the hdmiphy clk and it is expected that the DCLK_VOP and hdmiphy clk rate are kept in sync.
Use CLK_SET_RATE_PARENT and CLK_SET_RATE_NO_REPARENT flags, same as used on RK3328, to make full use of all possible supported display modes.
--- drivers/clk/rockchip/clk-rk3228.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/clk/rockchip/clk-rk3228.c +1 -1
@@ -415,7 +415,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),DIV (0 ,"sclk_vop_pre" ,"sclk_vop_src" ,0 ,RK2928_CLKSEL_CON (27 ),8 ,8 ,DFLAGS ), -MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,0 , +MUX (DCLK_VOP ,"dclk_vop" , mux_dclk_vop_p,CLK_SET_RATE_PARENT |CLK_SET_RATE_NO_REPARENT ,RK2928_CLKSEL_CON (27 ),1 ,1 ,MFLAGS ), FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 83/350 drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 8ae06f360cfaca2b88b98ca89144548b3186aab1 ]
Ensure index in rtl2832_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2832.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2832.c +1 -1
@@ -995,7 +995,7 @@ static int rtl2832_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, index, pid, onoff, dev->slave_ts);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 84/350 drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junlin Li <[email protected]>
[ Upstream commit 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14 ]
Ensure index in rtl2830_pid_filter does not exceed 31 to prevent out-of-bounds access.
dev->filters is a 32-bit value, so set_bit and clear_bit functions should only operate on indices from 0 to 31. If index is 32, it will attempt to access a non-existent 33rd bit, leading to out-of-bounds access. Change the boundary check from index > 32 to index >= 32 to resolve this issue.
--- drivers/media/dvb-frontends/rtl2830.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/dvb-frontends/rtl2830.c +1 -1
@@ -619,7 +619,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on index, pid, onoff);/* skip invalid PIDs (0x2000) */ -if (pid >0x1fff || index >32 ) +if (pid >0x1fff || index >=32 )return 0 ;if (onoff)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 85/350 PCI: xilinx-nwl: Fix register misspelling
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit a437027ae1730b8dc379c75fa0dd7d3036917400 ]
MSIC -> MISC
--- drivers/pci/controller/pcie-xilinx-nwl.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +6 -6
@@ -79,8 +79,8 @@#define MSGF_MISC_SR_NON_FATAL_DEV BIT(22)#define MSGF_MISC_SR_FATAL_DEV BIT(23)#define MSGF_MISC_SR_LINK_DOWN BIT(24) -#define MSGF_MSIC_SR_LINK_AUTO_BWIDTH BIT(25) -#define MSGF_MSIC_SR_LINK_BWIDTH BIT(26) +#define MSGF_MISC_SR_LINK_AUTO_BWIDTH BIT(25) +#define MSGF_MISC_SR_LINK_BWIDTH BIT(26)#define MSGF_MISC_SR_MASKALL (MSGF_MISC_SR_RXMSG_AVAIL | \ MSGF_MISC_SR_RXMSG_OVER | \
@@ -95,8 +95,8 @@ MSGF_MISC_SR_NON_FATAL_DEV | \ MSGF_MISC_SR_FATAL_DEV | \ MSGF_MISC_SR_LINK_DOWN | \ - MSGF_MSIC_SR_LINK_AUTO_BWIDTH | \ - MSGF_MSIC_SR_LINK_BWIDTH) + MSGF_MISC_SR_LINK_AUTO_BWIDTH | \ + MSGF_MISC_SR_LINK_BWIDTH)/* Legacy interrupt status mask bits */ #define MSGF_LEG_SR_INTA BIT(0)
@@ -308,10 +308,10 @@ static irqreturn_t nwl_pcie_misc_handler(int irq, void *data)if (misc_stat &MSGF_MISC_SR_FATAL_DEV )dev_err (dev,"Fatal Error Detected\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_AUTO_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_AUTO_BWIDTH )dev_info (dev,"Link Autonomous Bandwidth Management Status bit set\n" ); -if (misc_stat &MSGF_MSIC_SR_LINK_BWIDTH ) +if (misc_stat &MSGF_MISC_SR_LINK_BWIDTH )dev_info (dev,"Link Bandwidth Management Status bit set\n" );/* Clear misc interrupt status */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 86/350 RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhu Yanjun <[email protected]>
[ Upstream commit 86dfdd8288907f03c18b7fb462e0e232c4f98d89 ]
In the commit aee2424246f9 ("RDMA/iwcm: Fix a use-after-free related to destroying CM IDs"), the function flush_workqueue is invoked to flush the work queue iwcm_wq.
But at that time, the work queue iwcm_wq was created via the function alloc_ordered_workqueue without the flag WQ_MEM_RECLAIM.
Because the current process is trying to flush the whole iwcm_wq, if iwcm_wq doesn't have the flag WQ_MEM_RECLAIM, verify that the current process is not reclaiming memory or running on a workqueue which doesn't have the flag WQ_MEM_RECLAIM as that can break forward-progress guarantee leading to a deadlock.
The call trace is as below:
[ 125.350876][ T1430] Call Trace: [ 125.356281][ T1430] <TASK> [ 125.361285][ T1430] ? __warn (kernel/panic.c:693) [ 125.367640][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.375689][ T1430] ? report_bug (lib/bug.c:180 lib/bug.c:219) [ 125.382505][ T1430] ? handle_bug (arch/x86/kernel/traps.c:239) [ 125.388987][ T1430] ? exc_invalid_op (arch/x86/kernel/traps.c:260 (discriminator 1)) [ 125.395831][ T1430] ? asm_exc_invalid_op (arch/x86/include/asm/idtentry.h:621) [ 125.403125][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.410984][ T1430] ? check_flush_dependency (kernel/workqueue.c:3706 (discriminator 9)) [ 125.418764][ T1430] __flush_workqueue (kernel/workqueue.c:3970) [ 125.426021][ T1430] ? __pfx___might_resched (kernel/sched/core.c:10151) [ 125.433431][ T1430] ? destroy_cm_id (drivers/infiniband/core/iwcm.c:375) iw_cm [ 125.441209][ T1430] ? __pfx___flush_workqueue (kernel/workqueue.c:3910) [ 125.473900][ T1430] ? _raw_spin_lock_irqsave (arch/x86/include/asm/atomic.h:107 include/linux/atomic/atomic-arch-fallback.h:2170 include/linux/atomic/atomic-instrumented.h:1302 include/asm-generic/qspinlock.h:111 include/linux/spinlock.h:187 include/linux/spinlock_api_smp.h:111 kernel/locking/spinlock.c:162) [ 125.473909][ T1430] ? __pfx__raw_spin_lock_irqsave (kernel/locking/spinlock.c:161) [ 125.482537][ T1430] _destroy_id (drivers/infiniband/core/cma.c:2044) rdma_cm [ 125.495072][ T1430] nvme_rdma_free_queue (drivers/nvme/host/rdma.c:656 drivers/nvme/host/rdma.c:650) nvme_rdma [ 125.505827][ T1430] nvme_rdma_reset_ctrl_work (drivers/nvme/host/rdma.c:2180) nvme_rdma [ 125.505831][ T1430] process_one_work (kernel/workqueue.c:3231) [ 125.515122][ T1430] worker_thread (kernel/workqueue.c:3306 kernel/workqueue.c:3393) [ 125.515127][ T1430] ? __pfx_worker_thread (kernel/workqueue.c:3339) [ 125.531837][ T1430] kthread (kernel/kthread.c:389) [ 125.539864][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.550628][ T1430] ret_from_fork (arch/x86/kernel/process.c:147) [ 125.558840][ T1430] ? __pfx_kthread (kernel/kthread.c:342) [ 125.558844][ T1430] ret_from_fork_asm (arch/x86/entry/entry_64.S:257) [ 125.566487][ T1430] </TASK> [ 125.566488][ T1430] ---[ end trace 0000000000000000 ]---
--- drivers/infiniband/core/iwcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/infiniband/core/iwcm.c +1 -1
@@ -1178,7 +1178,7 @@ static int __init iw_cm_init(void)if (ret)return ret; - iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,0 ); + iwcm_wq =alloc_ordered_workqueue ("iw_cm_wq" ,WQ_MEM_RECLAIM );if (!iwcm_wq) goto err_alloc;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 87/350 pinctrl: single: fix missing error code in pcs_probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <[email protected]>
[ Upstream commit cacd8cf79d7823b07619865e994a7916fcc8ae91 ]
If pinctrl_enable() fails in pcs_probe(), it should return the error code.
--- drivers/pinctrl/pinctrl-single.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/pinctrl/pinctrl-single.c +2 -1
@@ -1898,7 +1898,8 @@ static int pcs_probe(struct platform_device *pdev)dev_info (pcs->dev,"%i pins, size %u\n" , pcs->desc.npins, pcs->size); -if (pinctrl_enable (pcs->pctl)) + ret =pinctrl_enable (pcs->pctl); +if (ret) goto free;return 0 ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 88/350 clk: ti: dra7-atl: Fix leak of of_nodes
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <[email protected]>
[ Upstream commit 9d6e9f10e2e031fb7bfb3030a7d1afc561a28fea ]
This fix leaking the of_node references in of_dra7_atl_clk_probe().
The docs for of_parse_phandle_with_args() say that the caller must call of_node_put() on the returned node. This adds the missing of_node_put() to fix the leak.
--- drivers/clk/ti/clk-dra7-atl.c | 1 + 1 file changed, 1 insertion(+)
drivers/clk/ti/clk-dra7-atl.c +1 -0
@@ -257,6 +257,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) } clk =of_clk_get_from_provider (&clkspec); +of_node_put (clkspec.np);if (IS_ERR (clk)) {pr_err ("%s: failed to get atl clock %d from provider\n" , __func__, i);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 89/350 pinctrl: mvebu: Use devm_platform_get_and_ioremap_resource()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <[email protected]>
[ Upstream commit 2d357f25663ddfef47ffe26da21155302153d168 ]
Convert platform_get_resource(), devm_ioremap_resource() to a single call to devm_platform_get_and_ioremap_resource(), as this is exactly what this function does.
Stable-dep-of: c25478419f6f ("pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function")
--- drivers/pinctrl/mvebu/pinctrl-dove.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/pinctrl/mvebu/pinctrl-dove.c +1 -2
@@ -788,8 +788,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev) }clk_prepare_enable (clk); - mpp_res =platform_get_resource (pdev,IORESOURCE_MEM ,0 ); - base =devm_ioremap_resource (&pdev->dev, mpp_res); + base =devm_platform_get_and_ioremap_resource (pdev,0 , &mpp_res);if (IS_ERR (base))return PTR_ERR (base);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 90/350 pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jianzheng <[email protected]>
[ Upstream commit c25478419f6fd3f74c324a21ec007cf14f2688d7 ]
When an error occurs during the execution of the function __devinit_dove_pinctrl_probe, the clk is not properly disabled.
Fix this by calling clk_disable_unprepare before return.
--- drivers/pinctrl/mvebu/pinctrl-dove.c | 42 +++++++++++++++++++--------- 1 file changed, 29 insertions(+), 13 deletions(-)
drivers/pinctrl/mvebu/pinctrl-dove.c +29 -13
@@ -773,7 +773,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)of_match_device (dove_pinctrl_of_match, &pdev->dev);struct mvebu_mpp_ctrl_data *mpp_data;void __iomem *base; -int i; +int i, ret; pdev->dev.platform_data = (void *)match->data;
@@ -789,13 +789,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)clk_prepare_enable (clk); base =devm_platform_get_and_ioremap_resource (pdev,0 , &mpp_res); -if (IS_ERR (base)) -return PTR_ERR (base); +if (IS_ERR (base)) { + ret =PTR_ERR (base); + goto err_probe; + } mpp_data =devm_kcalloc (&pdev->dev, dove_pinctrl_info.ncontrols,sizeof (*mpp_data),GFP_KERNEL ); -if (!mpp_data) -return -ENOMEM ; +if (!mpp_data) { + ret = -ENOMEM ; + goto err_probe; + } dove_pinctrl_info.control_data = mpp_data;for (i =0 ; i <ARRAY_SIZE (dove_mpp_controls); i++)
@@ -814,8 +818,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } mpp4_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (mpp4_base)) -return PTR_ERR (mpp4_base); +if (IS_ERR (mpp4_base)) { + ret =PTR_ERR (mpp4_base); + goto err_probe; + } res =platform_get_resource (pdev,IORESOURCE_MEM ,2 );if (!res) {
@@ -826,8 +832,10 @@ static int dove_pinctrl_probe(struct platform_device *pdev) } pmu_base =devm_ioremap_resource (&pdev->dev, res); -if (IS_ERR (pmu_base)) -return PTR_ERR (pmu_base); +if (IS_ERR (pmu_base)) { + ret =PTR_ERR (pmu_base); + goto err_probe; + } gconfmap =syscon_regmap_lookup_by_compatible ("marvell,dove-global-config" );if (IS_ERR (gconfmap)) {
@@ -837,12 +845,17 @@ static int dove_pinctrl_probe(struct platform_device *pdev)adjust_resource (&fb_res, (mpp_res->start &INT_REGS_MASK ) +GC_REGS_OFFS ,0x14 ); gc_base =devm_ioremap_resource (&pdev->dev, &fb_res); -if (IS_ERR (gc_base)) -return PTR_ERR (gc_base); +if (IS_ERR (gc_base)) { + ret =PTR_ERR (gc_base); + goto err_probe; + } + gconfmap =devm_regmap_init_mmio (&pdev->dev, gc_base, &gc_regmap_config); -if (IS_ERR (gconfmap)) -return PTR_ERR (gconfmap); +if (IS_ERR (gconfmap)) { + ret =PTR_ERR (gconfmap); + goto err_probe; + } }/* Warn on any missing DT resource */
@@ -850,6 +863,9 @@ static int dove_pinctrl_probe(struct platform_device *pdev)dev_warn (&pdev->dev,FW_BUG "Missing pinctrl regs in DTB. Please update your firmware.\n" );return mvebu_pinctrl_probe (pdev); +err_probe: +clk_disable_unprepare (clk); +return ret; }static struct platform_driver dove_pinctrl_driver = {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 91/350 RDMA/cxgb4: Added NULL check for lookup_atid
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
[ Upstream commit e766e6a92410ca269161de059fff0843b8ddd65f ]
The lookup_atid() function can return NULL if the ATID is invalid or does not exist in the identifier table, which could lead to dereferencing a null pointer without a check in the act_establish() and act_open_rpl() functions. Add a NULL check to prevent null pointer dereferencing.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/infiniband/hw/cxgb4/cm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/infiniband/hw/cxgb4/cm.c +5 -0
@@ -1180,6 +1180,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)int ret; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ;pr_debug ("ep %p tid %u snd_isn %u rcv_isn %u\n" , ep, tid,be32_to_cpu (req->snd_isn),be32_to_cpu (req->rcv_isn));
@@ -2235,6 +2237,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)int ret =0 ; ep =lookup_atid (t, atid); +if (!ep) +return -EINVAL ; + la = (struct sockaddr_in *)&ep->com.local_addr; ra = (struct sockaddr_in *)&ep->com.remote_addr; la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 92/350 ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <[email protected]>
[ Upstream commit e229897d373a87ee09ec5cc4ecd4bb2f895fc16b ]
The debugfs_create_dir() function returns error pointers. It never returns NULL. So use IS_ERR() to check it.
--- drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/ntb/hw/intel/ntb_hw_gen1.c +1 -1
@@ -777,7 +777,7 @@ static void ndev_init_debugfs(struct intel_ntb_dev *ndev) ndev->debugfs_dir =debugfs_create_dir (pci_name (ndev->ntb.pdev), debugfs_dir); -if (!ndev->debugfs_dir) +if (IS_ERR (ndev->debugfs_dir)) ndev->debugfs_info =NULL ;else ndev->debugfs_info =
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 93/350 nfsd: call cache_put if xdr_reserve_space returns NULL
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <[email protected]>
[ Upstream commit d078cbf5c38de83bc31f83c47dcd2184c04a50c7 ]
If not enough buffer space available, but idmap_lookup has triggered lookup_fn which calls cache_get and returns successfully. Then we missed to call cache_put here which pairs with cache_get.
--- fs/nfsd/nfs4idmap.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
fs/nfsd/nfs4idmap.c +9 -4
@@ -565,6 +565,7 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr, .id = id, .type = type, }; +__be32 status = nfs_ok;__be32 *p;int ret;struct nfsd_net *nn =net_generic (SVC_NET (rqstp), nfsd_net_id);
@@ -577,12 +578,16 @@ static __be32 idmap_id_to_name(struct xdr_stream *xdr,return nfserrno (ret); ret =strlen (item->name);WARN_ON_ONCE (ret >IDMAP_NAMESZ ); + p =xdr_reserve_space (xdr, ret +4 ); -if (!p) -return nfserr_resource; - p =xdr_encode_opaque (p, item->name, ret); +if (unlikely (!p)) { + status = nfserr_resource; + goto out_put; + } +xdr_encode_opaque (p, item->name, ret); +out_put:cache_put (&item->h, nn->idtoname_cache); -return 0 ; +return status; } static bool
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 94/350 f2fs: enhance to update i_mode and acl atomically in f2fs_setattr()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 17232e830afb800acdcc22ae8980bf9d330393ef ]
Previously, in f2fs_setattr(), we don't update S_ISUID|S_ISGID|S_ISVTX bits with S_IRWXUGO bits and acl entries atomically, so in error path, chmod() may partially success, this patch enhances to make chmod() flow being atomical.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/acl.c | 23 ++++++++++++++++++++++- fs/f2fs/file.c | 6 ++++-- fs/f2fs/xattr.c | 15 +++++++++------ 3 files changed, 35 insertions(+), 9 deletions(-)
fs/f2fs/acl.c +22 -1
@@ -200,6 +200,27 @@ struct posix_acl *f2fs_get_acl(struct inode *inode, int type)return __f2fs_get_acl (inode, type,NULL ); } +static int f2fs_acl_update_mode (struct inode *inode,umode_t *mode_p, +struct posix_acl **acl) +{ +umode_t mode = inode->i_mode; +int error; + +if (is_inode_flag_set (inode,FI_ACL_MODE )) + mode =F2FS_I (inode)->i_acl_mode; + + error =posix_acl_equiv_mode (*acl, &mode); +if (error <0 ) +return error; +if (error ==0 ) + *acl =NULL ; +if (!in_group_p (inode->i_gid) && + !capable_wrt_inode_uidgid (inode,CAP_FSETID )) + mode &= ~S_ISGID ; + *mode_p = mode; +return 0 ; +} +static int __f2fs_set_acl (struct inode *inode,int type,struct posix_acl *acl,struct page *ipage) {
@@ -213,7 +234,7 @@ static int __f2fs_set_acl(struct inode *inode, int type,case ACL_TYPE_ACCESS : name_index =F2FS_XATTR_INDEX_POSIX_ACL_ACCESS ;if (acl && !ipage) { - error =posix_acl_update_mode (inode, &mode, &acl); + error =f2fs_acl_update_mode (inode, &mode, &acl);if (error)return error;set_acl_inode (inode, mode);
fs/f2fs/file.c +4 -2
@@ -839,8 +839,10 @@ int f2fs_setattr(struct dentry *dentry, struct iattr *attr)if (attr->ia_valid &ATTR_MODE ) { err =posix_acl_chmod (inode,f2fs_get_inode_mode (inode)); -if (err ||is_inode_flag_set (inode,FI_ACL_MODE )) { - inode->i_mode =F2FS_I (inode)->i_acl_mode; + +if (is_inode_flag_set (inode,FI_ACL_MODE )) { +if (!err) + inode->i_mode =F2FS_I (inode)->i_acl_mode;clear_inode_flag (inode,FI_ACL_MODE ); } }
fs/f2fs/xattr.c +9 -6
@@ -651,7 +651,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, }if (value &&f2fs_xattr_value_same (here, value, size)) - goto exit; + goto same; }else if ((flags &XATTR_REPLACE )) { error = -ENODATA ; goto exit;
@@ -729,17 +729,20 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (error) goto exit; -if (is_inode_flag_set (inode,FI_ACL_MODE )) { - inode->i_mode =F2FS_I (inode)->i_acl_mode; - inode->i_ctime =current_time (inode); -clear_inode_flag (inode,FI_ACL_MODE ); - }if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode);f2fs_mark_inode_dirty_sync (inode, true);if (!error &&S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); + +same: +if (is_inode_flag_set (inode,FI_ACL_MODE )) { + inode->i_mode =F2FS_I (inode)->i_acl_mode; + inode->i_ctime =current_time (inode); +clear_inode_flag (inode,FI_ACL_MODE ); + } + exit:kzfree (base_addr);return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 95/350 f2fs: fix typo
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yonggil Song <[email protected]>
[ Upstream commit d382e36970ecf8242921400db2afde15fb6ed49e ]
Fix typo in f2fs.h
Detected by Jaeyoon Choi
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/f2fs.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/f2fs.h +1 -1
@@ -213,7 +213,7 @@ enum {ORPHAN_INO ,/* for orphan ino list */ APPEND_INO ,/* for append ino list */ UPDATE_INO ,/* for update ino list */ -TRANS_DIR_INO ,/* for trasactions dir ino list */ +TRANS_DIR_INO ,/* for transactions dir ino list */ FLUSH_INO ,/* for multiple device flushing */ MAX_INO_ENTRY, /* max. list */ };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 96/350 f2fs: fix to update i_ctime in __f2fs_setxattr()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit 8874ad7dae8d91d24cc87c545c0073b3b2da5688 ]
generic/728 - output mismatch (see /media/fstests/results//generic/728.out.bad)
--- tests/generic/728.out 2023-07-19 07:10:48.362711407 +0000
+++ /media/fstests/results//generic/728.out.bad 2023-07-19 08:39:57.000000000 +0000
QA output created by 728
+Expected ctime to change after setxattr.
+Expected ctime to change after removexattr.
Silence is golden
...
(Run 'diff -u /media/fstests/tests/generic/728.out /media/fstests/results//generic/728.out.bad' to see the entire diff)
generic/729 1s
It needs to update i_ctime after {set,remove}xattr, fix it.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/xattr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/xattr.c +2 -2
@@ -732,17 +732,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -f2fs_mark_inode_dirty_sync (inode, true);if (!error &&S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); same:if (is_inode_flag_set (inode,FI_ACL_MODE )) { inode->i_mode =F2FS_I (inode)->i_acl_mode; - inode->i_ctime =current_time (inode);clear_inode_flag (inode,FI_ACL_MODE ); } + inode->i_ctime =current_time (inode); +f2fs_mark_inode_dirty_sync (inode, true); exit:kzfree (base_addr);return error;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 97/350 f2fs: remove unneeded check condition in __f2fs_setxattr()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit bc3994ffa4cf23f55171943c713366132c3ff45d ]
It has checked return value of write_all_xattrs(), remove unneeded following check condition.
Stable-dep-of: aaf8c0b9ae04 ("f2fs: reduce expensive checkpoint trigger frequency")
--- fs/f2fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/xattr.c +1 -1
@@ -732,7 +732,7 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -if (!error &&S_ISDIR (inode->i_mode)) +if (S_ISDIR (inode->i_mode))set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); same:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 98/350 f2fs: reduce expensive checkpoint trigger frequency
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <[email protected]>
[ Upstream commit aaf8c0b9ae042494cb4585883b15c1332de77840 ]
We may trigger high frequent checkpoint for below case:
1. mkdir /mnt/dir1; set dir1 encrypted
2. touch /mnt/file1; fsync /mnt/file1
3. mkdir /mnt/dir2; set dir2 encrypted
4. touch /mnt/file2; fsync /mnt/file2
...
Although, newly created dir and file are not related, due to commit bbf156f7afa7 ("f2fs: fix lost xattrs of directories"), we will trigger checkpoint whenever fsync() comes after a new encrypted dir created.
In order to avoid such performance regression issue, let's record an entry including directory's ino in global cache whenever we update directory's xattr data, and then triggerring checkpoint() only if xattr metadata of target file's parent was updated.
This patch updates to cover below no encryption case as well:
1) parent is checkpointed
2) set_xattr(dir) w/ new xnid
3) create(file)
4) fsync(file)
--- fs/f2fs/f2fs.h | 2 ++ fs/f2fs/file.c | 3 +++ fs/f2fs/xattr.c | 14 ++++++++++++-- include/trace/events/f2fs.h | 3 ++- 4 files changed, 19 insertions(+), 3 deletions(-)
fs/f2fs/f2fs.h +2 -0
@@ -214,6 +214,7 @@ enum {APPEND_INO ,/* for append ino list */ UPDATE_INO ,/* for update ino list */ TRANS_DIR_INO ,/* for transactions dir ino list */ +XATTR_DIR_INO ,/* for xattr updated dir ino list */ FLUSH_INO ,/* for multiple device flushing */ MAX_INO_ENTRY, /* max. list */ };
@@ -998,6 +999,7 @@ enum cp_reason_type {CP_FASTBOOT_MODE ,CP_SPEC_LOG_NUM ,CP_RECOVER_DIR , + CP_XATTR_DIR, }; enum iostat_type {
fs/f2fs/file.c +3 -0
@@ -170,6 +170,9 @@ static inline enum cp_reason_type need_do_checkpoint(struct inode *inode) f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, TRANS_DIR_INO)) cp_reason =CP_RECOVER_DIR ; + else if (f2fs_exist_written_data(sbi, F2FS_I(inode)->i_pino, +XATTR_DIR_INO )) + cp_reason =CP_XATTR_DIR ;return cp_reason; }
fs/f2fs/xattr.c +12 -2
@@ -607,6 +607,7 @@ static int __f2fs_setxattr(struct inode *inode, int index, const char *name, const void *value, size_t size, struct page *ipage, int flags) { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode);struct f2fs_xattr_entry *here, *last;void *base_addr, *last_base_addr;nid_t xnid =F2FS_I (inode)->i_xattr_nid;
@@ -732,9 +733,18 @@ static int __f2fs_setxattr(struct inode *inode, int index,if (index ==F2FS_XATTR_INDEX_ENCRYPTION && !strcmp (name,F2FS_XATTR_NAME_ENCRYPTION_CONTEXT ))f2fs_set_encrypted_inode (inode); -if (S_ISDIR (inode->i_mode)) -set_sbi_flag (F2FS_I_SB (inode),SBI_NEED_CP ); +if (!S_ISDIR (inode->i_mode)) + goto same; +/* +* In restrict mode, fsync() always try to trigger checkpoint for all +* metadata consistency, in other mode, it triggers checkpoint when +* parent's xattr metadata was updated. +*/ +if (F2FS_OPTION (sbi).fsync_mode ==FSYNC_MODE_STRICT ) +set_sbi_flag (sbi,SBI_NEED_CP ); +else +f2fs_add_ino_entry (sbi, inode->i_ino,XATTR_DIR_INO ); same:if (is_inode_flag_set (inode,FI_ACL_MODE )) { inode->i_mode =F2FS_I (inode)->i_acl_mode;
include/trace/events/f2fs.h +2 -1
@@ -148,7 +148,8 @@ TRACE_DEFINE_ENUM(CP_TRIMMED); { CP_NODE_NEED_CP, "node needs cp" }, \ { CP_FASTBOOT_MODE, "fastboot mode" }, \ { CP_SPEC_LOG_NUM, "log type is 2" }, \ - { CP_RECOVER_DIR, "dir needs recovery" }) + { CP_RECOVER_DIR, "dir needs recovery" }, \ + { CP_XATTR_DIR, "dir's xattr updated" }) struct victim_sel_policy;struct f2fs_map_blocks ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 99/350 coresight: tmc: sg: Do not leak sg_table
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suzuki K Poulose <[email protected]>
[ Upstream commit c58dc5a1f886f2fcc1133746d0cbaa1fe7fd44ff ]
Running perf with cs_etm on Juno triggers the following kmemleak warning !
:~# cat /sys/kernel/debug/kmemleak unreferenced object 0xffffff8806b6d720 (size 96): comm "perf", pid 562, jiffies 4297810960 hex dump (first 32 bytes): 38 d8 13 07 88 ff ff ff 00 d0 9e 85 c0 ff ff ff 8............... 00 10 00 88 c0 ff ff ff 00 f0 ff f7 ff 00 00 00 ................ backtrace (crc 1dbf6e00): [<ffffffc08107381c>] kmemleak_alloc+0xbc/0xd8 [<ffffffc0802f9798>] kmalloc_trace_noprof+0x220/0x2e8 [<ffffffc07bb71948>] tmc_alloc_sg_table+0x48/0x208 [coresight_tmc] [<ffffffc07bb71cbc>] tmc_etr_alloc_sg_buf+0xac/0x240 [coresight_tmc] [<ffffffc07bb72538>] tmc_alloc_etr_buf.constprop.0+0x1f0/0x260 [coresight_tmc] [<ffffffc07bb7280c>] alloc_etr_buf.constprop.0.isra.0+0x74/0xa8 [coresight_tmc] [<ffffffc07bb72950>] tmc_alloc_etr_buffer+0x110/0x260 [coresight_tmc] [<ffffffc07bb38afc>] etm_setup_aux+0x204/0x3b0 [coresight] [<ffffffc08025837c>] rb_alloc_aux+0x20c/0x318 [<ffffffc08024dd84>] perf_mmap+0x2e4/0x7a0 [<ffffffc0802cceb0>] mmap_region+0x3b0/0xa08 [<ffffffc0802cd8a8>] do_mmap+0x3a0/0x500 [<ffffffc080295328>] vm_mmap_pgoff+0x100/0x1d0 [<ffffffc0802cadf8>] ksys_mmap_pgoff+0xb8/0x110 [<ffffffc080020688>] __arm64_sys_mmap+0x38/0x58 [<ffffffc080028fc0>] invoke_syscall.constprop.0+0x58/0x100
This due to the fact that we do not free the "sg_table" itself while freeing up the SG table and data pages. Fix this by freeing the sg_table in tmc_free_sg_table().
--- drivers/hwtracing/coresight/coresight-tmc-etr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwtracing/coresight/coresight-tmc-etr.c +1 -1
@@ -222,6 +222,7 @@ void tmc_free_sg_table(struct tmc_sg_table *sg_table) {tmc_free_table_pages (sg_table);tmc_free_data_pages (sg_table); +kfree (sg_table); }/*
@@ -302,7 +303,6 @@ struct tmc_sg_table *tmc_alloc_sg_table(struct device *dev, rc =tmc_alloc_table_pages (sg_table);if (rc) {tmc_free_sg_table (sg_table); -kfree (sg_table);return ERR_PTR (rc); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 100/350 netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 9c778fe48d20ef362047e3376dee56d77f8500d4 ]
syzbot reported that nf_reject_ip6_tcphdr_put() was possibly sending garbage on the four reserved tcp bits (th->res1)
Use skb_put_zero() to clear the whole TCP header,
as done in nf_reject_ip_tcphdr_put()
BUG: KMSAN: uninit-value in nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_reject_ip6_tcphdr_put+0x688/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:255 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588 do_softirq+0x9a/0x100 kernel/softirq.c:455 __local_bh_enable_ip+0x9f/0xb0 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:908 [inline] __dev_queue_xmit+0x2692/0x5610 net/core/dev.c:4450 dev_queue_xmit include/linux/netdevice.h:3105 [inline] neigh_resolve_output+0x9ca/0xae0 net/core/neighbour.c:1565 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x2347/0x2ba0 net/ipv6/ip6_output.c:141 __ip6_finish_output net/ipv6/ip6_output.c:215 [inline] ip6_finish_output+0xbb8/0x14b0 net/ipv6/ip6_output.c:226 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x356/0x620 net/ipv6/ip6_output.c:247 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] ip6_xmit+0x1ba6/0x25d0 net/ipv6/ip6_output.c:366 inet6_csk_xmit+0x442/0x530 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x3b07/0x4880 net/ipv4/tcp_output.c:1466 tcp_transmit_skb net/ipv4/tcp_output.c:1484 [inline] tcp_connect+0x35b6/0x7130 net/ipv4/tcp_output.c:4143 tcp_v6_connect+0x1bcc/0x1e40 net/ipv6/tcp_ipv6.c:333 __inet_stream_connect+0x2ef/0x1730 net/ipv4/af_inet.c:679 inet_stream_connect+0x6a/0xd0 net/ipv4/af_inet.c:750 __sys_connect_file net/socket.c:2061 [inline] __sys_connect+0x606/0x690 net/socket.c:2078 __do_sys_connect net/socket.c:2088 [inline] __se_sys_connect net/socket.c:2085 [inline] __x64_sys_connect+0x91/0xe0 net/socket.c:2085 x64_sys_call+0x27a5/0x3ba0 arch/x86/include/generated/asm/syscalls_64.h:43 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x60c/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:249 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was stored to memory at:
nf_reject_ip6_tcphdr_put+0x2ca/0x6c0 net/ipv6/netfilter/nf_reject_ipv6.c:231 nf_send_reset6+0xd84/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:344 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
Uninit was created at:
slab_post_alloc_hook mm/slub.c:3998 [inline] slab_alloc_node mm/slub.c:4041 [inline] kmem_cache_alloc_node_noprof+0x6bf/0xb80 mm/slub.c:4084 kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:583 __alloc_skb+0x363/0x7b0 net/core/skbuff.c:674 alloc_skb include/linux/skbuff.h:1320 [inline] nf_send_reset6+0x98d/0x15b0 net/ipv6/netfilter/nf_reject_ipv6.c:327 nft_reject_inet_eval+0x3c1/0x880 net/netfilter/nft_reject_inet.c:48 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x438/0x22a0 net/netfilter/nf_tables_core.c:288 nft_do_chain_inet+0x41a/0x4f0 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xf4/0x400 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:269 [inline] NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0x29b/0x390 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core net/core/dev.c:5661 [inline] __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5775 process_backlog+0x4ad/0xa50 net/core/dev.c:6108 __napi_poll+0xe7/0x980 net/core/dev.c:6772 napi_poll net/core/dev.c:6841 [inline] net_rx_action+0xa5a/0x19b0 net/core/dev.c:6963 handle_softirqs+0x1ce/0x800 kernel/softirq.c:554 __do_softirq+0x14/0x1a kernel/softirq.c:588
--- net/ipv6/netfilter/nf_reject_ipv6.c | 14 ++------------ 1 file changed, 2 insertions(+), 12 deletions(-)
net/ipv6/netfilter/nf_reject_ipv6.c +2 -12
@@ -92,33 +92,23 @@ void nf_reject_ip6_tcphdr_put(struct sk_buff *nskb, const struct tcphdr *oth, unsigned int otcplen) { struct tcphdr *tcph; -int needs_ack;skb_reset_transport_header (nskb); - tcph =skb_put (nskb,sizeof (struct tcphdr )); + tcph =skb_put_zero (nskb,sizeof (struct tcphdr ));/* Truncate to length (no data) */ tcph->doff =sizeof (struct tcphdr )/4 ; tcph->source = oth->dest; tcph->dest = oth->source;if (oth->ack) { - needs_ack =0 ; tcph->seq = oth->ack_seq; - tcph->ack_seq =0 ; }else { - needs_ack =1 ; tcph->ack_seq =htonl (ntohl (oth->seq) + oth->syn + oth->fin + otcplen - (oth->doff<<2 )); - tcph->seq =0 ; + tcph->ack =1 ; } -/* Reset flags */ - ((u_int8_t *)tcph)[13 ] =0 ; tcph->rst =1 ; - tcph->ack = needs_ack; - tcph->window =0 ; - tcph->urg_ptr =0 ; - tcph->check =0 ;/* Adjust TCP checksum */ tcph->check = csum_ipv6_magic(&ipv6_hdr(nskb)->saddr,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 101/350 net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Condition
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaixin Wang <[email protected]>
[ Upstream commit b5109b60ee4fcb2f2bb24f589575e10cc5283ad4 ]
In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:
CPU0 CPU1
| ether3_ledoff
ether3_remove |
free_netdev(dev); |
put_devic |
kfree(dev); |
| ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
| // use devFix it by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove.
--- drivers/net/ethernet/seeq/ether3.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/seeq/ether3.c +2 -0
@@ -851,9 +851,11 @@ static void ether3_remove(struct expansion_card *ec) {struct net_device *dev =ecard_get_drvdata (ec); +ether3_outw (priv (dev)->regs.config2 |=CFG2_CTRLO ,REG_CONFIG2 );ecard_set_drvdata (ec,NULL );unregister_netdev (dev); +del_timer_sync (&priv (dev)->timer);free_netdev (dev);ecard_release_resources (ec); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 102/350 tcp: introduce tcp_skb_timestamp_us() helper
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 2fd66ffba50716fc5ab481c48db643af3bda2276 ]
There are few places where TCP reads skb->skb_mstamp expecting a value in usec unit.
skb->tstamp (aka skb->skb_mstamp) will soon store CLOCK_TAI nsec value.
Add tcp_skb_timestamp_us() to provide proper conversion when needed.
Stable-dep-of: c8770db2d544 ("tcp: check skb is non-NULL in tcp_rto_delta_us()")
--- include/net/tcp.h | 8 +++++++- net/ipv4/tcp_input.c | 11 ++++++----- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_rate.c | 15 ++++++++------- net/ipv4/tcp_recovery.c | 5 +++-- 6 files changed, 26 insertions(+), 17 deletions(-)
include/net/tcp.h +7 -1
@@ -794,6 +794,12 @@ static inline u32 tcp_skb_timestamp(const struct sk_buff *skb)return div_u64 (skb->skb_mstamp,USEC_PER_SEC /TCP_TS_HZ ); } +/* provide the departure time in us unit */ +static inline u64 tcp_skb_timestamp_us (const struct sk_buff *skb) +{ +return skb->skb_mstamp; +} +#define tcp_flag_byte (th) (((u_int8_t *)th)[13])
@@ -2003,7 +2009,7 @@ static inline s64 tcp_rto_delta_us(const struct sock *sk) {const struct sk_buff *skb =tcp_rtx_queue_head (sk);u32 rto =inet_csk (sk)->icsk_rto; -u64 rto_time_stamp_us = skb->skb_mstamp +jiffies_to_usecs (rto); +u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto);return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; }
net/ipv4/tcp_input.c +6 -5
@@ -1301,7 +1301,7 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *prev,*/ tcp_sacktag_one (sk, state,TCP_SKB_CB (skb)->sacked, start_seq, end_seq, dup_sack, pcount, - skb->skb_mstamp); +tcp_skb_timestamp_us (skb));tcp_rate_skb_delivered (sk, skb, state->rate);if (skb == tp->lost_skb_hint)
@@ -1590,7 +1590,7 @@ static struct sk_buff *tcp_sacktag_walk(struct sk_buff *skb, struct sock *sk,TCP_SKB_CB (skb)->end_seq, dup_sack,tcp_skb_pcount (skb), - skb->skb_mstamp); + tcp_skb_timestamp_us(skb));tcp_rate_skb_delivered (sk, skb, state->rate);if (TCP_SKB_CB (skb)->sacked &TCPCB_SACKED_ACKED )list_del_init (&skb->tcp_tsorted_anchor);
@@ -3140,7 +3140,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack, tp->retrans_out -= acked_pcount; flag |=FLAG_RETRANS_DATA_ACKED ; }else if (!(sacked &TCPCB_SACKED_ACKED )) { - last_ackt = skb->skb_mstamp; + last_ackt =tcp_skb_timestamp_us (skb);WARN_ON_ONCE (last_ackt ==0 );if (!first_ackt) first_ackt = last_ackt;
@@ -3158,7 +3158,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack, tp->delivered += acked_pcount;if (!tcp_skb_spurious_retrans (tp, skb))tcp_rack_advance (tp, sacked, scb->end_seq, - skb->skb_mstamp); +tcp_skb_timestamp_us (skb)); }if (sacked &TCPCB_LOST ) tp->lost_out -= acked_pcount;
@@ -3253,7 +3253,8 @@ static int tcp_clean_rtx_queue(struct sock *sk, u32 prior_fack, tp->lost_cnt_hint -=min (tp->lost_cnt_hint, delta); } }else if (skb && rtt_update && sack_rtt_us >=0 && - sack_rtt_us >tcp_stamp_us_delta (tp->tcp_mstamp, skb->skb_mstamp)) { + sack_rtt_us >tcp_stamp_us_delta (tp->tcp_mstamp, +tcp_skb_timestamp_us (skb))) {/* Do not re-arm RTO if the sack RTT is measured from data sent * after when the head was last (re)transmitted. Otherwise the * timeout may continue to extend in loss recovery.
net/ipv4/tcp_ipv4.c +1 -1
@@ -556,7 +556,7 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) icsk->icsk_rto =inet_csk_rto_backoff (icsk,TCP_RTO_MAX );tcp_mstamp_refresh (tp); - delta_us = (u32)(tp->tcp_mstamp - skb->skb_mstamp); + delta_us = (u32)(tp->tcp_mstamp -tcp_skb_timestamp_us (skb)); remaining = icsk->icsk_rto -usecs_to_jiffies (delta_us);
net/ipv4/tcp_output.c +1 -1
@@ -1993,7 +1993,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb, head =tcp_rtx_queue_head (sk);if (!head) goto send_now; - age =tcp_stamp_us_delta (tp->tcp_mstamp, head->skb_mstamp); + age =tcp_stamp_us_delta (tp->tcp_mstamp,tcp_skb_timestamp_us (head));/* If next ACK is likely to come too late (half srtt), do not defer */ if (age < (tp->srtt_us >>4 )) goto send_now;
net/ipv4/tcp_rate.c +8 -7
@@ -55,8 +55,10 @@ void tcp_rate_skb_sent(struct sock *sk, struct sk_buff *skb)* bandwidth estimate. */ if (!tp->packets_out) { - tp->first_tx_mstamp = skb->skb_mstamp; - tp->delivered_mstamp = skb->skb_mstamp; +u64 tstamp_us =tcp_skb_timestamp_us (skb); + + tp->first_tx_mstamp = tstamp_us; + tp->delivered_mstamp = tstamp_us; }TCP_SKB_CB (skb)->tx.first_tx_mstamp = tp->first_tx_mstamp;
@@ -88,13 +90,12 @@ void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb, rs->is_app_limited = scb->tx.is_app_limited; rs->is_retrans = scb->sacked &TCPCB_RETRANS ; +/* Record send time of most recently ACKed packet: */ + tp->first_tx_mstamp =tcp_skb_timestamp_us (skb);/* Find the duration of the "send phase" of this window: */ - rs->interval_us =tcp_stamp_us_delta ( - skb->skb_mstamp, - scb->tx.first_tx_mstamp); + rs->interval_us =tcp_stamp_us_delta (tp->first_tx_mstamp, + scb->tx.first_tx_mstamp); -/* Record send time of most recently ACKed packet: */ - tp->first_tx_mstamp = skb->skb_mstamp; }/* Mark off the skb delivered once it's sacked to avoid being * used again when it's cumulatively acked. For acked packets
net/ipv4/tcp_recovery.c +3 -2
@@ -51,7 +51,7 @@ static u32 tcp_rack_reo_wnd(const struct sock *sk)s32 tcp_rack_skb_timeout (struct tcp_sock *tp,struct sk_buff *skb,u32 reo_wnd) {return tp->rack.rtt_us + reo_wnd - -tcp_stamp_us_delta (tp->tcp_mstamp, skb->skb_mstamp); +tcp_stamp_us_delta (tp->tcp_mstamp,tcp_skb_timestamp_us (skb)); }/* RACK loss detection (IETF draft draft-ietf-tcpm-rack-01):
@@ -92,7 +92,8 @@ static void tcp_rack_detect_loss(struct sock *sk, u32 *reo_timeout) !(scb->sacked & TCPCB_SACKED_RETRANS))continue ; -if (!tcp_rack_sent_after (tp->rack.mstamp, skb->skb_mstamp, +if (!tcp_rack_sent_after (tp->rack.mstamp, +tcp_skb_timestamp_us (skb), tp->rack.end_seq, scb->end_seq))break ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 103/350 tcp: check skb is non-NULL in tcp_rto_delta_us()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Hunt <[email protected]>
[ Upstream commit c8770db2d54437a5f49417ae7b46f7de23d14db6 ]
We have some machines running stock Ubuntu 20.04.6 which is their 5.4.0-174-generic kernel that are running ceph and recently hit a null ptr dereference in tcp_rearm_rto(). Initially hitting it from the TLP path, but then later we also saw it getting hit from the RACK case as well. Here are examples of the oops messages we saw in each of those cases:
Jul 26 15:05:02 rx [11061395.780353] BUG: kernel NULL pointer dereference, address: 0000000000000020 Jul 26 15:05:02 rx [11061395.787572] #PF: supervisor read access in kernel mode Jul 26 15:05:02 rx [11061395.792971] #PF: error_code(0x0000) - not-present page Jul 26 15:05:02 rx [11061395.798362] PGD 0 P4D 0 Jul 26 15:05:02 rx [11061395.801164] Oops: 0000 [#1] SMP NOPTI Jul 26 15:05:02 rx [11061395.805091] CPU: 0 PID: 9180 Comm: msgr-worker-1 Tainted: G W 5.4.0-174-generic #193-Ubuntu Jul 26 15:05:02 rx [11061395.814996] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 15:05:02 rx [11061395.825952] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.830656] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061395.849665] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061395.855149] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061395.862542] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061395.869933] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061395.877318] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061395.884710] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061395.892095] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061395.900438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061395.906435] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061395.913822] PKRU: 55555554 Jul 26 15:05:02 rx [11061395.916786] Call Trace: Jul 26 15:05:02 rx [11061395.919488] Jul 26 15:05:02 rx [11061395.921765] ? show_regs.cold+0x1a/0x1f Jul 26 15:05:02 rx [11061395.925859] ? __die+0x90/0xd9 Jul 26 15:05:02 rx [11061395.929169] ? no_context+0x196/0x380 Jul 26 15:05:02 rx [11061395.933088] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0 Jul 26 15:05:02 rx [11061395.938216] ? ip6_sublist_rcv_finish+0x3d/0x50 Jul 26 15:05:02 rx [11061395.943000] ? __bad_area_nosemaphore+0x50/0x1a0 Jul 26 15:05:02 rx [11061395.947873] ? bad_area_nosemaphore+0x16/0x20 Jul 26 15:05:02 rx [11061395.952486] ? do_user_addr_fault+0x267/0x450 Jul 26 15:05:02 rx [11061395.957104] ? ipv6_list_rcv+0x112/0x140 Jul 26 15:05:02 rx [11061395.961279] ? __do_page_fault+0x58/0x90 Jul 26 15:05:02 rx [11061395.965458] ? do_page_fault+0x2c/0xe0 Jul 26 15:05:02 rx [11061395.969465] ? page_fault+0x34/0x40 Jul 26 15:05:02 rx [11061395.973217] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.977313] ? tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061395.981408] tcp_send_loss_probe+0x10b/0x220 Jul 26 15:05:02 rx [11061395.985937] tcp_write_timer_handler+0x1b4/0x240 Jul 26 15:05:02 rx [11061395.990809] tcp_write_timer+0x9e/0xe0 Jul 26 15:05:02 rx [11061395.994814] ? tcp_write_timer_handler+0x240/0x240 Jul 26 15:05:02 rx [11061395.999866] call_timer_fn+0x32/0x130 Jul 26 15:05:02 rx [11061396.003782] __run_timers.part.0+0x180/0x280 Jul 26 15:05:02 rx [11061396.008309] ? recalibrate_cpu_khz+0x10/0x10 Jul 26 15:05:02 rx [11061396.012841] ? native_x2apic_icr_write+0x30/0x30 Jul 26 15:05:02 rx [11061396.017718] ? lapic_next_event+0x21/0x30 Jul 26 15:05:02 rx [11061396.021984] ? clockevents_program_event+0x8f/0xe0 Jul 26 15:05:02 rx [11061396.027035] run_timer_softirq+0x2a/0x50 Jul 26 15:05:02 rx [11061396.031212] __do_softirq+0xd1/0x2c1 Jul 26 15:05:02 rx [11061396.035044] do_softirq_own_stack+0x2a/0x40 Jul 26 15:05:02 rx [11061396.039480] Jul 26 15:05:02 rx [11061396.041840] do_softirq.part.0+0x46/0x50 Jul 26 15:05:02 rx [11061396.046022] __local_bh_enable_ip+0x50/0x60 Jul 26 15:05:02 rx [11061396.050460] _raw_spin_unlock_bh+0x1e/0x20 Jul 26 15:05:02 rx [11061396.054817] nf_conntrack_tcp_packet+0x29e/0xbe0 [nf_conntrack] Jul 26 15:05:02 rx [11061396.060994] ? get_l4proto+0xe7/0x190 [nf_conntrack] Jul 26 15:05:02 rx [11061396.066220] nf_conntrack_in+0xe9/0x670 [nf_conntrack] Jul 26 15:05:02 rx [11061396.071618] ipv6_conntrack_local+0x14/0x20 [nf_conntrack] Jul 26 15:05:02 rx [11061396.077356] nf_hook_slow+0x45/0xb0 Jul 26 15:05:02 rx [11061396.081098] ip6_xmit+0x3f0/0x5d0 Jul 26 15:05:02 rx [11061396.084670] ? ipv6_anycast_cleanup+0x50/0x50 Jul 26 15:05:02 rx [11061396.089282] ? __sk_dst_check+0x38/0x70 Jul 26 15:05:02 rx [11061396.093381] ? inet6_csk_route_socket+0x13b/0x200 Jul 26 15:05:02 rx [11061396.098346] inet6_csk_xmit+0xa7/0xf0 Jul 26 15:05:02 rx [11061396.102263] __tcp_transmit_skb+0x550/0xb30 Jul 26 15:05:02 rx [11061396.106701] tcp_write_xmit+0x3c6/0xc20 Jul 26 15:05:02 rx [11061396.110792] ? __alloc_skb+0x98/0x1d0 Jul 26 15:05:02 rx [11061396.114708] __tcp_push_pending_frames+0x37/0x100 Jul 26 15:05:02 rx [11061396.119667] tcp_push+0xfd/0x100 Jul 26 15:05:02 rx [11061396.123150] tcp_sendmsg_locked+0xc70/0xdd0 Jul 26 15:05:02 rx [11061396.127588] tcp_sendmsg+0x2d/0x50 Jul 26 15:05:02 rx [11061396.131245] inet6_sendmsg+0x43/0x70 Jul 26 15:05:02 rx [11061396.135075] __sock_sendmsg+0x48/0x70 Jul 26 15:05:02 rx [11061396.138994] ____sys_sendmsg+0x212/0x280 Jul 26 15:05:02 rx [11061396.143172] ___sys_sendmsg+0x88/0xd0 Jul 26 15:05:02 rx [11061396.147098] ? __seccomp_filter+0x7e/0x6b0 Jul 26 15:05:02 rx [11061396.151446] ? __switch_to+0x39c/0x460 Jul 26 15:05:02 rx [11061396.155453] ? __switch_to_asm+0x42/0x80 Jul 26 15:05:02 rx [11061396.159636] ? __switch_to_asm+0x5a/0x80 Jul 26 15:05:02 rx [11061396.163816] __sys_sendmsg+0x5c/0xa0 Jul 26 15:05:02 rx [11061396.167647] __x64_sys_sendmsg+0x1f/0x30 Jul 26 15:05:02 rx [11061396.171832] do_syscall_64+0x57/0x190 Jul 26 15:05:02 rx [11061396.175748] entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Jul 26 15:05:02 rx [11061396.181055] RIP: 0033:0x7f1ef692618d Jul 26 15:05:02 rx [11061396.184893] Code: 28 89 54 24 1c 48 89 74 24 10 89 7c 24 08 e8 ca ee ff ff 8b 54 24 1c 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 2f 44 89 c7 48 89 44 24 08 e8 fe ee ff ff 48 Jul 26 15:05:02 rx [11061396.203889] RSP: 002b:00007f1ef4a26aa0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e Jul 26 15:05:02 rx [11061396.211708] RAX: ffffffffffffffda RBX: 000000000000084b RCX: 00007f1ef692618d Jul 26 15:05:02 rx [11061396.219091] RDX: 0000000000004000 RSI: 00007f1ef4a26b10 RDI: 0000000000000275 Jul 26 15:05:02 rx [11061396.226475] RBP: 0000000000004000 R08: 0000000000000000 R09: 0000000000000020 Jul 26 15:05:02 rx [11061396.233859] R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000084b Jul 26 15:05:02 rx [11061396.241243] R13: 00007f1ef4a26b10 R14: 0000000000000275 R15: 000055592030f1e8 Jul 26 15:05:02 rx [11061396.248628] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler nft_ct sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 mlx5_core hid_generic pci_hyperv_intf crc32_pclmul tls usbhid ahci mlxfw bnxt_en libahci hid nvme i2c_piix4 nvme_core wmi Jul 26 15:05:02 rx [11061396.324334] CR2: 0000000000000020 Jul 26 15:05:02 rx [11061396.327944] ---[ end trace 68a2b679d1cfb4f1 ]--- Jul 26 15:05:02 rx [11061396.433435] RIP: 0010:tcp_rearm_rto+0xe4/0x160 Jul 26 15:05:02 rx [11061396.438137] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3 Jul 26 15:05:02 rx [11061396.457144] RSP: 0018:ffffb75d40003e08 EFLAGS: 00010246 Jul 26 15:05:02 rx [11061396.462629] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000 Jul 26 15:05:02 rx [11061396.470012] RDX: 0000000062177c30 RSI: 000000000000231c RDI: ffff9874ad283a60 Jul 26 15:05:02 rx [11061396.477396] RBP: ffffb75d40003e20 R08: 0000000000000000 R09: ffff987605e20aa8 Jul 26 15:05:02 rx [11061396.484779] R10: ffffb75d40003f00 R11: ffffb75d4460f740 R12: ffff9874ad283900 Jul 26 15:05:02 rx [11061396.492164] R13: ffff9874ad283a60 R14: ffff9874ad283980 R15: ffff9874ad283d30 Jul 26 15:05:02 rx [11061396.499547] FS: 00007f1ef4a2e700(0000) GS:ffff987605e00000(0000) knlGS:0000000000000000 Jul 26 15:05:02 rx [11061396.507886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 15:05:02 rx [11061396.513884] CR2: 0000000000000020 CR3: 0000003e450ba003 CR4: 0000000000760ef0 Jul 26 15:05:02 rx [11061396.521267] PKRU: 55555554 Jul 26 15:05:02 rx [11061396.524230] Kernel panic - not syncing: Fatal exception in interrupt Jul 26 15:05:02 rx [11061396.530885] Kernel Offset: 0x1b200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) Jul 26 15:05:03 rx [11061396.660181] ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]---
After we hit this we disabled TLP by setting tcp_early_retrans to 0 and then hit the crash in the RACK case:
Aug 7 07:26:16 rx [1006006.265582] BUG: kernel NULL pointer dereference, address: 0000000000000020
Aug 7 07:26:16 rx [1006006.272719] #PF: supervisor read access in kernel mode
Aug 7 07:26:16 rx [1006006.278030] #PF: error_code(0x0000) - not-present page
Aug 7 07:26:16 rx [1006006.283343] PGD 0 P4D 0
Aug 7 07:26:16 rx [1006006.286057] Oops: 0000 [#1] SMP NOPTI
Aug 7 07:26:16 rx [1006006.289896] CPU: 5 PID: 0 Comm: swapper/5 Tainted: G W 5.4.0-174-generic #193-Ubuntu
Aug 7 07:26:16 rx [1006006.299107] Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023
Aug 7 07:26:16 rx [1006006.309970] RIP: 0010:tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.314584] Code: 87 ca 04 00 00 00 5b 41 5c 41 5d 5d c3 c3 49 8b bc 24 40 06 00 00 eb 8d 48 bb cf f7 53 e3 a5 9b c4 20 4c 89 ef e8 0c fe 0e 00 <48> 8b 78 20 48 c1 ef 03 48 89 f8 41 8b bc 24 80 04 00 00 48 f7 e3
Aug 7 07:26:16 rx [1006006.333499] RSP: 0018:ffffb42600a50960 EFLAGS: 00010246
Aug 7 07:26:16 rx [1006006.338895] RAX: 0000000000000000 RBX: 20c49ba5e353f7cf RCX: 0000000000000000
Aug 7 07:26:16 rx [1006006.346193] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff92d687ed8160
Aug 7 07:26:16 rx [1006006.353489] RBP: ffffb42600a50978 R08: 0000000000000000 R09: 00000000cd896dcc
Aug 7 07:26:16 rx [1006006.360786] R10: ffff92dc3404f400 R11: 0000000000000001 R12: ffff92d687ed8000
Aug 7 07:26:16 rx [1006006.368084] R13: ffff92d687ed8160 R14: 00000000cd896dcc R15: 00000000cd8fca81
Aug 7 07:26:16 rx [1006006.375381] FS: 0000000000000000(0000) GS:ffff93158ad40000(0000) knlGS:0000000000000000
Aug 7 07:26:16 rx [1006006.383632] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
Aug 7 07:26:16 rx [1006006.389544] CR2: 0000000000000020 CR3: 0000003e775ce006 CR4: 0000000000760ee0
Aug 7 07:26:16 rx [1006006.396839] PKRU: 55555554
Aug 7 07:26:16 rx [1006006.399717] Call Trace:
Aug 7 07:26:16 rx [1006006.402335]
Aug 7 07:26:16 rx [1006006.404525] ? show_regs.cold+0x1a/0x1f
Aug 7 07:26:16 rx [1006006.408532] ? __die+0x90/0xd9
Aug 7 07:26:16 rx [1006006.411760] ? no_context+0x196/0x380
Aug 7 07:26:16 rx [1006006.415599] ? __bad_area_nosemaphore+0x50/0x1a0
Aug 7 07:26:16 rx [1006006.420392] ? _raw_spin_lock+0x1e/0x30
Aug 7 07:26:16 rx [1006006.424401] ? bad_area_nosemaphore+0x16/0x20
Aug 7 07:26:16 rx [1006006.428927] ? do_user_addr_fault+0x267/0x450
Aug 7 07:26:16 rx [1006006.433450] ? __do_page_fault+0x58/0x90
Aug 7 07:26:16 rx [1006006.437542] ? do_page_fault+0x2c/0xe0
Aug 7 07:26:16 rx [1006006.441470] ? page_fault+0x34/0x40
Aug 7 07:26:16 rx [1006006.445134] ? tcp_rearm_rto+0xe4/0x160
Aug 7 07:26:16 rx [1006006.449145] tcp_ack+0xa32/0xb30
Aug 7 07:26:16 rx [1006006.452542] tcp_rcv_established+0x13c/0x670
Aug 7 07:26:16 rx [1006006.456981] ? sk_filter_trim_cap+0x48/0x220
Aug 7 07:26:16 rx [1006006.461419] tcp_v6_do_rcv+0xdb/0x450
Aug 7 07:26:16 rx [1006006.465257] tcp_v6_rcv+0xc2b/0xd10
Aug 7 07:26:16 rx [1006006.468918] ip6_protocol_deliver_rcu+0xd3/0x4e0
Aug 7 07:26:16 rx [1006006.473706] ip6_input_finish+0x15/0x20
Aug 7 07:26:16 rx [1006006.477710] ip6_input+0xa2/0xb0
Aug 7 07:26:16 rx [1006006.481109] ? ip6_protocol_deliver_rcu+0x4e0/0x4e0
Aug 7 07:26:16 rx [1006006.486151] ip6_sublist_rcv_finish+0x3d/0x50
Aug 7 07:26:16 rx [1006006.490679] ip6_sublist_rcv+0x1aa/0x250
Aug 7 07:26:16 rx [1006006.494779] ? ip6_rcv_finish_core.isra.0+0xa0/0xa0
Aug 7 07:26:16 rx [1006006.499828] ipv6_list_rcv+0x112/0x140
Aug 7 07:26:16 rx [1006006.503748] __netif_receive_skb_list_core+0x1a4/0x250
Aug 7 07:26:16 rx [1006006.509057] netif_receive_skb_list_internal+0x1a1/0x2b0
Aug 7 07:26:16 rx [1006006.514538] gro_normal_list.part.0+0x1e/0x40
Aug 7 07:26:16 rx [1006006.519068] napi_complete_done+0x91/0x130
Aug 7 07:26:16 rx [1006006.523352] mlx5e_napi_poll+0x18e/0x610 [mlx5_core]
Aug 7 07:26:16 rx [1006006.528481] net_rx_action+0x142/0x390
Aug 7 07:26:16 rx [1006006.532398] __do_softirq+0xd1/0x2c1
Aug 7 07:26:16 rx [1006006.536142] irq_exit+0xae/0xb0
Aug 7 07:26:16 rx [1006006.539452] do_IRQ+0x5a/0xf0
Aug 7 07:26:16 rx [1006006.542590] common_interrupt+0xf/0xf
Aug 7 07:26:16 rx [1006006.546421]
Aug 7 07:26:16 rx [1006006.548695] RIP: 0010:native_safe_halt+0xe/0x10
Aug 7 07:26:16 rx [1006006.553399] Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65
Aug 7 07:26:16 rx [1006006.572309] RSP: 0018:ffffb42600177e70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffc2
Aug 7 07:26:16 rx [1006006.580040] RAX: ffffffff8ed08b20 RBX: 0000000000000005 RCX: 0000000000000001
Aug 7 07:26:16 rx [1006006.587337] RDX: 00000000f48eeca2 RSI: 0000000000000082 RDI: 0000000000000082
Aug 7 07:26:16 rx [1006006.594635] RBP: ffffb42600177e90 R08: 0000000000000000 R09: 000000000000020f
Aug 7 07:26:16 rx [1006006.601931] R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000005
Aug 7 07:26:16 rx [1006006.609229] R13: ffff93157deb5f00 R14: 0000000000000000 R15: 0000000000000000
Aug 7 07:26:16 rx [1006006.616530] ? __cpuidle_text_start+0x8/0x8
Aug 7 07:26:16 rx [1006006.620886] ? default_idle+0x20/0x140
Aug 7 07:26:16 rx [1006006.624804] arch_cpu_idle+0x15/0x20
Aug 7 07:26:16 rx [1006006.628545] default_idle_call+0x23/0x30
Aug 7 07:26:16 rx [1006006.632640] do_idle+0x1fb/0x270
Aug 7 07:26:16 rx [1006006.636035] cpu_startup_entry+0x20/0x30
Aug 7 07:26:16 rx [1006006.640126] start_secondary+0x178/0x1d0
Aug 7 07:26:16 rx [1006006.644218] secondary_startup_64+0xa4/0xb0
Aug 7 07:26:17 rx [1006006.648568] Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif input_leds joydev rndis_host cdc_ether usbnet ast mii drm_vram_helper ttm drm_kms_helper i2c_algo_bit fb_sys_fops syscopyarea sysfillrect sysimgblt ccp mac_hid ipmi_si ipmi_devintf ipmi_msghandler sch_fq_codel nf_tables_set nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables nfnetlink ramoops reed_solomon efi_pstore drm ip_tables x_tables autofs4 raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid0 multipath linear mlx5_ib ib_uverbs ib_core raid1 hid_generic mlx5_core pci_hyperv_intf crc32_pclmul usbhid ahci tls mlxfw bnxt_en hid libahci nvme i2c_piix4 nvme_core wmi [last unloaded: cpuid] Aug 7 07:26:17 rx [1006006.726180] CR2: 0000000000000020
Aug 7 07:26:17 rx [1006006.729718] ---[ end trace e0e2e37e4e612984 ]---
Prior to seeing the first crash and on other machines we also see the warning in tcp_send_loss_probe() where packets_out is non-zero, but both transmit and retrans queues are empty so we know the box is seeing some accounting issue in this area:
Jul 26 09:15:27 kernel: ------------[ cut here ]------------ Jul 26 09:15:27 kernel: invalid inflight: 2 state 1 cwnd 68 mss 8988 Jul 26 09:15:27 kernel: WARNING: CPU: 16 PID: 0 at net/ipv4/tcp_output.c:2605 tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Modules linked in: vrf bridge stp llc vxlan ip6_udp_tunnel udp_tunnel nls_iso8859_1 nft_ct amd64_edac_mod edac_mce_amd kvm_amd kvm crct10dif_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper wmi_bmof ipmi_ssif joydev input_leds rndis_host cdc_ether usbnet mii ast drm_vram_helper ttm drm_kms_he> Jul 26 09:15:27 kernel: CPU: 16 PID: 0 Comm: swapper/16 Not tainted 5.4.0-174-generic #193-Ubuntu Jul 26 09:15:27 kernel: Hardware name: Supermicro SMC 2x26 os-gen8 64C NVME-Y 256G/H12SSW-NTR, BIOS 2.5.V1.2U.NVMe.UEFI 05/09/2023 Jul 26 09:15:27 kernel: RIP: 0010:tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: Code: 08 26 01 00 75 e2 41 0f b6 54 24 12 41 8b 8c 24 c0 06 00 00 45 89 f0 48 c7 c7 e0 b4 20 a7 c6 05 8d 08 26 01 01 e8 4a c0 0f 00 <0f> 0b eb ba 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 89 e5 41 Jul 26 09:15:27 kernel: RSP: 0018:ffffb7838088ce00 EFLAGS: 00010286 Jul 26 09:15:27 kernel: RAX: 0000000000000000 RBX: ffff9b84b5630430 RCX: 0000000000000006 Jul 26 09:15:27 kernel: RDX: 0000000000000007 RSI: 0000000000000096 RDI: ffff9b8e4621c8c0 Jul 26 09:15:27 kernel: RBP: ffffb7838088ce18 R08: 0000000000000927 R09: 0000000000000004 Jul 26 09:15:27 kernel: R10: 0000000000000000 R11: 0000000000000001 R12: ffff9b84b5630000 Jul 26 09:15:27 kernel: R13: 0000000000000000 R14: 000000000000231c R15: ffff9b84b5630430 Jul 26 09:15:27 kernel: FS: 0000000000000000(0000) GS:ffff9b8e46200000(0000) knlGS:0000000000000000 Jul 26 09:15:27 kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 Jul 26 09:15:27 kernel: CR2: 000056238cec2380 CR3: 0000003e49ede005 CR4: 0000000000760ee0 Jul 26 09:15:27 kernel: PKRU: 55555554 Jul 26 09:15:27 kernel: Call Trace: Jul 26 09:15:27 kernel: <IRQ> Jul 26 09:15:27 kernel: ? show_regs.cold+0x1a/0x1f Jul 26 09:15:27 kernel: ? __warn+0x98/0xe0 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? report_bug+0xd1/0x100 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? do_error_trap+0x9b/0xc0 Jul 26 09:15:27 kernel: ? do_invalid_op+0x3c/0x50 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: ? invalid_op+0x1e/0x30 Jul 26 09:15:27 kernel: ? tcp_send_loss_probe+0x214/0x220 Jul 26 09:15:27 kernel: tcp_write_timer_handler+0x1b4/0x240 Jul 26 09:15:27 kernel: tcp_write_timer+0x9e/0xe0 Jul 26 09:15:27 kernel: ? tcp_write_timer_handler+0x240/0x240 Jul 26 09:15:27 kernel: call_timer_fn+0x32/0x130 Jul 26 09:15:27 kernel: __run_timers.part.0+0x180/0x280 Jul 26 09:15:27 kernel: ? timerqueue_add+0x9b/0xb0 Jul 26 09:15:27 kernel: ? enqueue_hrtimer+0x3d/0x90 Jul 26 09:15:27 kernel: ? recalibrate_cpu_khz+0x10/0x10 Jul 26 09:15:27 kernel: ? ktime_get+0x3e/0xa0 Jul 26 09:15:27 kernel: ? native_x2apic_icr_write+0x30/0x30 Jul 26 09:15:27 kernel: run_timer_softirq+0x2a/0x50 Jul 26 09:15:27 kernel: __do_softirq+0xd1/0x2c1 Jul 26 09:15:27 kernel: irq_exit+0xae/0xb0 Jul 26 09:15:27 kernel: smp_apic_timer_interrupt+0x7b/0x140 Jul 26 09:15:27 kernel: apic_timer_interrupt+0xf/0x20 Jul 26 09:15:27 kernel: </IRQ> Jul 26 09:15:27 kernel: RIP: 0010:native_safe_halt+0xe/0x10 Jul 26 09:15:27 kernel: Code: 7b ff ff ff eb bd 90 90 90 90 90 90 e9 07 00 00 00 0f 00 2d 36 2c 50 00 f4 c3 66 90 e9 07 00 00 00 0f 00 2d 26 2c 50 00 fb f4 <c3> 90 0f 1f 44 00 00 55 48 89 e5 41 55 41 54 53 e8 dd 5e 61 ff 65 Jul 26 09:15:27 kernel: RSP: 0018:ffffb783801cfe70 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 Jul 26 09:15:27 kernel: RAX: ffffffffa6908b20 RBX: 0000000000000010 RCX: 0000000000000001 Jul 26 09:15:27 kernel: RDX: 000000006fc0c97e RSI: 0000000000000082 RDI: 0000000000000082 Jul 26 09:15:27 kernel: RBP: ffffb783801cfe90 R08: 0000000000000000 R09: 0000000000000225 Jul 26 09:15:27 kernel: R10: 0000000000100000 R11: 0000000000000000 R12: 0000000000000010 Jul 26 09:15:27 kernel: R13: ffff9b8e390b0000 R14: 0000000000000000 R15: 0000000000000000 Jul 26 09:15:27 kernel: ? __cpuidle_text_start+0x8/0x8 Jul 26 09:15:27 kernel: ? default_idle+0x20/0x140 Jul 26 09:15:27 kernel: arch_cpu_idle+0x15/0x20 Jul 26 09:15:27 kernel: default_idle_call+0x23/0x30 Jul 26 09:15:27 kernel: do_idle+0x1fb/0x270 Jul 26 09:15:27 kernel: cpu_startup_entry+0x20/0x30 Jul 26 09:15:27 kernel: start_secondary+0x178/0x1d0 Jul 26 09:15:27 kernel: secondary_startup_64+0xa4/0xb0 Jul 26 09:15:27 kernel: ---[ end trace e7ac822987e33be1 ]---
The NULL ptr deref is coming from tcp_rto_delta_us() attempting to pull an skb off the head of the retransmit queue and then dereferencing that skb to get the skb_mstamp_ns value via tcp_skb_timestamp_us(skb).
The crash is the same one that was reported a # of years ago here:
https://lore.kernel.org/netdev/[email protected]/T/#t
and the kernel we're running has the fix which was added to resolve this issue.
Unfortunately we've been unsuccessful so far in reproducing this problem in the lab and do not have the luxury of pushing out a new kernel to try and test if newer kernels resolve this issue at the moment. I realize this is a report against both an Ubuntu kernel and also an older 5.4 kernel. I have reported this issue to Ubuntu here: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2077657
however I feel like since this issue has possibly cropped up again it makes sense to build in some protection in this path (even on the latest kernel versions) since the code in question just blindly assumes there's a valid skb without testing if it's NULL b/f it looks at the timestamp.
Given we have seen crashes in this path before and now this case it seems like we should protect ourselves for when packets_out accounting is incorrect. While we should fix that root cause we should also just make sure the skb is not NULL before dereferencing it. Also add a warn once here to capture some information if/when the problem case is hit again.
--- include/net/tcp.h | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
include/net/tcp.h +19 -2
@@ -2009,9 +2009,26 @@ static inline s64 tcp_rto_delta_us(const struct sock *sk) {const struct sk_buff *skb =tcp_rtx_queue_head (sk);u32 rto =inet_csk (sk)->icsk_rto; -u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); -return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; +if (likely (skb)) { +u64 rto_time_stamp_us =tcp_skb_timestamp_us (skb) +jiffies_to_usecs (rto); + +return rto_time_stamp_us -tcp_sk (sk)->tcp_mstamp; + }else { +WARN_ONCE (1 , +"rtx queue emtpy: " +"out:%u sacked:%u lost:%u retrans:%u " +"tlp_high_seq:%u sk_state:%u ca_state:%u " +"advmss:%u mss_cache:%u pmtu:%u\n" , +tcp_sk (sk)->packets_out,tcp_sk (sk)->sacked_out, +tcp_sk (sk)->lost_out,tcp_sk (sk)->retrans_out, +tcp_sk (sk)->tlp_high_seq, sk->sk_state, +inet_csk (sk)->icsk_ca_state, +tcp_sk (sk)->advmss,tcp_sk (sk)->mss_cache, +inet_csk (sk)->icsk_pmtu_cookie); +return jiffies_to_usecs (rto); + } + }/*
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 104/350 net: qrtr: Update packets cloning when broadcasting
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Youssef Samir <[email protected]>
[ Upstream commit f011b313e8ebd5b7abd8521b5119aecef403de45 ]
When broadcasting data to multiple nodes via MHI, using skb_clone() causes all nodes to receive the same header data. This can result in packets being discarded by endpoints, leading to lost data.
This issue occurs when a socket is closed, and a QRTR_TYPE_DEL_CLIENT packet is broadcasted. All nodes receive the same destination node ID, causing the node connected to the client to discard the packet and remain unaware of the client's deletion.
Replace skb_clone() with pskb_copy(), to create a separate copy of the header for each sk_buff.
--- net/qrtr/qrtr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/qrtr/qrtr.c +1 -1
@@ -718,7 +718,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb,mutex_lock (&qrtr_node_lock);list_for_each_entry (node, &qrtr_all_nodes, item) { - skbn =skb_clone (skb,GFP_KERNEL ); + skbn =pskb_copy (skb,GFP_KERNEL );if (!skbn)break ;skb_set_owner_w (skbn, skb->sk);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 105/350 netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Simon Horman <[email protected]>
[ Upstream commit e1f1ee0e9ad8cbe660f5c104e791c5f1a7cf4c31 ]
Only provide ctnetlink_label_size when it is used, which is when CONFIG_NF_CONNTRACK_EVENTS is configured.
Flagged by clang-18 W=1 builds as:
.../nf_conntrack_netlink.c:385:19: warning: unused function 'ctnetlink_label_size' [-Wunused-function]
385 | static inline int ctnetlink_label_size(const struct nf_conn *ct)
| ^~~~~~~~~~~~~~~~~~~~
The condition on CONFIG_NF_CONNTRACK_LABELS being removed by this patch guards compilation of non-trivial implementations of ctnetlink_dump_labels() and ctnetlink_label_size().
However, this is not necessary as each of these functions will always return 0 if CONFIG_NF_CONNTRACK_LABELS is not defined as each function starts with the equivalent of:
struct nf_conn_labels *labels = nf_ct_labels_find(ct); if (!labels) return 0;
And nf_ct_labels_find always returns NULL if CONFIG_NF_CONNTRACK_LABELS is not enabled. So I believe that the compiler optimises the code away in such cases anyway.
Found by inspection.
Compile tested only.
Originally splitted in two patches, Pablo Neira Ayuso collapsed them and added Fixes: tag.
--- net/netfilter/nf_conntrack_netlink.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-)
net/netfilter/nf_conntrack_netlink.c +2 -5
@@ -359,7 +359,7 @@ nla_put_failure:#define ctnetlink_dump_secctx (a, b) (0)#endif -#ifdef CONFIG_NF_CONNTRACK_LABELS +#ifdef CONFIG_NF_CONNTRACK_EVENTS static inline int ctnetlink_label_size (const struct nf_conn *ct) {struct nf_conn_labels *labels =nf_ct_labels_find (ct);
@@ -368,6 +368,7 @@ static inline int ctnetlink_label_size(creturn 0 ; return nla_total_size(sizeof(labels->bits)); } +#endif static int ctnetlink_dump_labels (struct sk_buff *skb,const struct nf_conn *ct)
@@ -388,10 +389,6 @@ ctnetlink_dump_labels(struct sk_buff *skreturn 0 ; } -#else -#define ctnetlink_dump_labels (a, b) (0) -#define ctnetlink_label_size (a) (0) -#endif #define master_tuple (ct) &(ct->master->tuplehash[IP_CT_DIR_ORIGINAL].tuple)
Greg Kroah-Hartman
maintainerPATCH 106/350 crypto: aead,cipher - zeroize key buffer after use
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hailey Mothershead <[email protected]>
commit 23e4099bdc3c8381992f9eb975c79196d6755210 upstream.
I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer needed. Accomplish this by using kfree_sensitive for buffers that previously held the private key.
--- crypto/aead.c | 3 +-- crypto/cipher.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-)
crypto/aead.c +1 -2
@@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypt alignbuffer = (u8 *)ALIGN ((unsigned long )buffer, alignmask +1 );memcpy (alignbuffer, key, keylen); ret =crypto_aead_alg (tfm)->setkey (tfm, alignbuffer, keylen); -memset (alignbuffer,0 , keylen); -kfree (buffer); +kzfree (buffer);return ret; }
crypto/cipher.c +1 -2
@@ -38,8 +38,7 @@ static int setkey_unaligned(struct crypt alignbuffer = (u8 *)ALIGN ((unsigned long )buffer, alignmask +1 );memcpy (alignbuffer, key, keylen); ret = cia->cia_setkey (tfm, alignbuffer, keylen); -memset (alignbuffer,0 , keylen); -kfree (buffer); +kzfree (buffer);return ret; }
Greg Kroah-Hartman
maintainerPATCH 107/350 Remove *.orig pattern from .gitignore
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <[email protected]>
commit 76be4f5a784533c71afbbb1b8f2963ef9e2ee258 upstream.
Commit 3f1b0e1f2875 (".gitignore update") added *.orig and *.rej patterns to .gitignore in v2.6.23. The commit message didn't give a rationale. Later on, commit 1f5d3a6b6532 ("Remove *.rej pattern from .gitignore") removed the *.rej pattern in v2.6.26, on the rationale that *.rej files indicated something went really wrong and should not be ignored.
The *.rej files are now shown by git status, which helps located conflicts when applying patches and lowers the probability that they will go unnoticed. It is however still easy to overlook the *.orig files which slowly polute the source tree. That's not as big of a deal as not noticing a conflict, but it's still not nice.
Drop the *.orig pattern from .gitignore to avoid this and help keep the source tree clean.
[[email protected]:
I do not have a strong opinion about this. Perhaps some people may have a different opinion.
If you are someone who wants to ignore *.orig, it is likely you would want to do so across all projects. Then, $XDG_CONFIG_HOME/git/ignore would be more suitable for your needs. gitignore(5) suggests, "Patterns which a user wants Git to ignore in all situations generally go into a file specified by core.excludesFile in the user's ~/.gitconfig".
Please note that you cannot do the opposite; if *.orig is ignored by the project's .gitignore, you cannot override the decision because $XDG_CONFIG_HOME/git/ignore has a lower priority.
If *.orig is sitting on the fence, I'd leave it to the users. ]
--- .gitignore | 1 - 1 file changed, 1 deletion(-)
.gitignore +0 -1
@@ -114,7 +114,6 @@ GTAGS # id-utils files ID -*.orig *~ \#*#
Greg Kroah-Hartman
maintainerPATCH 108/350 soc: versatile: integrator: fix OF node leak in probe() error path
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
commit 874c5b601856adbfda10846b9770a6c66c41e229 upstream.
Driver is leaking OF node reference obtained fromof_find_matching_node().
--- drivers/soc/versatile/soc-integrator.c | 1 + 1 file changed, 1 insertion(+)
drivers/soc/versatile/soc-integrator.c +1 -0
@@ -115,6 +115,7 @@ static int __init integrator_soc_init(voreturn -ENODEV ; syscon_regmap =syscon_node_to_regmap (np); +of_node_put (np);if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap);
Greg Kroah-Hartman
maintainerPATCH 109/350 USB: appledisplay: close race between probe and completion handler
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 8265d06b7794493d82c5c21a12d7ba43eccc30cb upstream.
There is a small window during probing when IO is running but the backlight is not registered. Processing events during that time will crash. The completion handler needs to check for a backlight before scheduling work.
The bug is as old as the driver.
--- drivers/usb/misc/appledisplay.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-)
drivers/usb/misc/appledisplay.c +11 -4
@@ -111,7 +111,12 @@ static void appledisplay_complete(structcase ACD_BTN_BRIGHT_UP :case ACD_BTN_BRIGHT_DOWN : pdata->button_pressed =1 ; -schedule_delayed_work (&pdata->work,0 ); +/* +* there is a window during which no device +* is registered +*/ +if (pdata->bd ) +schedule_delayed_work (&pdata->work,0 );break ;case ACD_BTN_NONE :default :
@@ -208,6 +213,7 @@ static int appledisplay_probe(struct usb const struct usb_device_id *id) {struct backlight_properties props; +struct backlight_device *backlight;struct appledisplay *pdata;struct usb_device *udev =interface_to_usbdev (iface);struct usb_endpoint_descriptor *endpoint;
@@ -278,13 +284,14 @@ static int appledisplay_probe(struct usbmemset (&props,0 ,sizeof (struct backlight_properties )); props.type =BACKLIGHT_RAW ; props.max_brightness =0xff ; - pdata->bd =backlight_device_register (bl_name,NULL , pdata, + backlight =backlight_device_register (bl_name,NULL , pdata, &appledisplay_bl_data, &props); -if (IS_ERR (pdata->bd)) { +if (IS_ERR (backlight)) {dev_err (&iface->dev,"Backlight registration failed\n" ); - retval =PTR_ERR (pdata->bd); + retval =PTR_ERR (backlight); goto error; } + pdata->bd = backlight;/* Try to get brightness */ brightness =appledisplay_bl_get_brightness (pdata->bd);
Greg Kroah-Hartman
maintainerPATCH 110/350 USB: misc: cypress_cy7c63: check for short transfer
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
commit 49cd2f4d747eeb3050b76245a7f72aa99dbd3310 upstream.
As we process the second byte of a control transfer, transfers of less than 2 bytes must be discarded.
This bug is as old as the driver.
--- drivers/usb/misc/cypress_cy7c63.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/misc/cypress_cy7c63.c +4 -0
@@ -88,6 +88,9 @@ static int vendor_command(struct cypressUSB_DIR_IN |USB_TYPE_VENDOR |USB_RECIP_OTHER , address, data, iobuf,CYPRESS_MAX_REQSIZE , USB_CTRL_GET_TIMEOUT); +/* we must not process garbage */ +if (retval <2 ) + goto err_buf;/* store returned data (more READs to be added) */ switch (request) {
@@ -107,6 +110,7 @@ static int vendor_command(struct cypressbreak ; } +err_buf:kfree (iobuf); error:return retval;
Greg Kroah-Hartman
maintainerPATCH 111/350 firmware_loader: Block path traversal
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit f0e5311aa8022107d63c54e2f03684ec097d1394 upstream.
Most firmware names are hardcoded strings, or are constructed from fairly constrained format strings where the dynamic parts are just some hex numbers or such.
However, there are a couple codepaths in the kernel where firmware file names contain string components that are passed through from a device or semi-privileged userspace; the ones I could find (not counting interfaces that require root privileges) are:
- lpfc_sli4_request_firmware_update() seems to construct the firmware filename from "ModelName", a string that was previously parsed out of some descriptor ("Vital Product Data") in lpfc_fill_vpd()
- nfp_net_fw_find() seems to construct a firmware filename from a model name coming from nfp_hwinfo_lookup(pf->hwinfo, "nffw.partno"), which I think parses some descriptor that was read from the device. (But this case likely isn't exploitable because the format string looks like "netronome/nic_%s", and there shouldn't be any *folders* starting with "netronome/nic_". The previous case was different because there, the "%s" is *at the start* of the format string.)
- module_flash_fw_schedule() is reachable from the ETHTOOL_MSG_MODULE_FW_FLASH_ACT netlink command, which is marked as GENL_UNS_ADMIN_PERM (meaning CAP_NET_ADMIN inside a user namespace is enough to pass the privilege check), and takes a userspace-provided firmware name.
(But I think to reach this case, you need to have CAP_NET_ADMIN over a network namespace that a special kind of ethernet device is mapped into, so I think this is not a viable attack path in practice.)
Fix it by rejecting any firmware names containing ".." path components.
For what it's worth, I went looking and haven't found any USB device drivers that use the firmware loader dangerously.
--- drivers/base/firmware_loader/main.c | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+)
drivers/base/firmware_loader/main.c +30 -0
@@ -565,6 +565,26 @@ static void fw_abort_batch_reqs(struct fmutex_unlock (&fw_lock); } +/* +* Reject firmware file names with ".." path components. +* There are drivers that construct firmware file names from device-supplied +* strings, and we don't want some device to be able to tell us "I would like to +* be sent my firmware from ../../../etc/shadow, please". +* +* Search for ".." surrounded by either '/' or start/end of string. +* +* This intentionally only looks at the firmware name, not at the firmware base +* directory or at symlink contents. +*/ +static bool name_contains_dotdot (const char *name) +{ +size_t name_len =strlen (name); + +return strcmp (name,".." ) ==0 ||strncmp (name,"../" ,3 ) ==0 || +strstr (name,"/../" ) !=NULL || + (name_len >=3 &&strcmp (name+name_len-3 ,"/.." ) ==0 ); +} +/* called from request_firmware() and request_firmware_work_func() */ static int _request_firmware(const struct firmware **firmware_p, const char *name,
@@ -582,6 +602,14 @@ _request_firmware(const struct firmware goto out; } +if (name_contains_dotdot (name)) { +dev_warn (device, +"Firmware load for '%s' refused, path contains '..' component\n" , + name); + ret = -EINVAL ; + goto out; + } + ret =_request_firmware_prepare (&fw, name, device, buf, size, opt_flags);if (ret <=0 )/* error or already assigned */
@@ -622,6 +650,8 @@ _request_firmware(const struct firmware* @name will be used as $FIRMWARE in the uevent environment and * should be distinctive enough not to be confused with any other * firmware image for this or any other device. +* It must not contain any ".." path components - "foo/bar..bin" is +* allowed, but "foo/../bar.bin" is not. * * Caller must hold the reference count of @device. *
Greg Kroah-Hartman
maintainerPATCH 112/350 tty: rp2: Fix reset with non forgiving PCIe host bridges
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <[email protected]>
commit f16dd10ba342c429b1e36ada545fb36d4d1f0e63 upstream.
The write to RP2_GLOBAL_CMD followed by an immediate read of RP2_GLOBAL_CMD in rp2_reset_asic() is intented to flush out the write, however by then the device is already in reset and cannot respond to a memory cycle access.
On platforms such as the Raspberry Pi 4 and others using the pcie-brcmstb.c driver, any memory access to a device that cannot respond is met with a fatal system error, rather than being substituted with all 1s as is usually the case on PC platforms.
Swapping the delay and the read ensures that the device has finished resetting before we attempt to read from it.
--- drivers/tty/serial/rp2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/serial/rp2.c +1 -1
@@ -600,8 +600,8 @@ static void rp2_reset_asic(struct rp2_cau32 clk_cfg;writew (1 , base +RP2_GLOBAL_CMD ); -readw (base +RP2_GLOBAL_CMD );msleep (100 ); +readw (base +RP2_GLOBAL_CMD );writel (0 , base +RP2_CLK_PRESCALER );/* TDM clock configuration */
Greg Kroah-Hartman
maintainerPATCH 113/350 drbd: Fix atomicity violation in drbd_uuid_set_bm()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiu-ji Chen <[email protected]>
commit 2f02b5af3a4482b216e6a466edecf6ba8450fa45 upstream.
The violation of atomicity occurs when the drbd_uuid_set_bm function is executed simultaneously with modifying the value of device->ldev->md.uuid[UI_BITMAP]. Consider a scenario where, while device->ldev->md.uuid[UI_BITMAP] passes the validity check when its value is not zero, the value of device->ldev->md.uuid[UI_BITMAP] is written to zero. In this case, the check in drbd_uuid_set_bm might refer to the old value of device->ldev->md.uuid[UI_BITMAP] (before locking), which allows an invalid value to pass the validity check, resulting in inconsistency.
To address this issue, it is recommended to include the data validity check within the locked section of the function. This modification ensures that the value of device->ldev->md.uuid[UI_BITMAP] does not change during the validation process, thereby maintaining its integrity.
This possible bug is found by an experimental static analysis tool developed by our team. This tool analyzes the locking APIs to extract function pairs that can be concurrently executed, and then analyzes the instructions in the paired functions to identify possible concurrency bugs including data races and atomicity violations.
--- drivers/block/drbd/drbd_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/block/drbd/drbd_main.c +4 -2
@@ -3499,10 +3499,12 @@ void drbd_uuid_new_current(struct drbd_dvoid drbd_uuid_set_bm (struct drbd_device *device,u64 val)__must_hold (local) {unsigned long flags; -if (device->ldev->md.uuid[UI_BITMAP ] ==0 && val ==0 ) +spin_lock_irqsave (&device->ldev->md.uuid_lock, flags); +if (device->ldev->md.uuid[UI_BITMAP ] ==0 && val ==0 ) { +spin_unlock_irqrestore (&device->ldev->md.uuid_lock, flags);return ; + } -spin_lock_irqsave (&device->ldev->md.uuid_lock, flags);if (val ==0 ) {drbd_uuid_move_history (device); device->ldev->md.uuid[UI_HISTORY_START ] = device->ldev->md.uuid[UI_BITMAP ];
Greg Kroah-Hartman
maintainerPATCH 114/350 drbd: Add NULL check for net_conf to prevent dereference in state validation
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lobanov <[email protected]>
commit a5e61b50c9f44c5edb6e134ede6fee8806ffafa9 upstream.
If the net_conf pointer is NULL and the code attempts to access its fields without a check, it will lead to a null pointer dereference. Add a NULL check before dereferencing the pointer.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/block/drbd/drbd_state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/drbd/drbd_state.c +1 -1
@@ -888,7 +888,7 @@ is_valid_state(struct drbd_device *devic ns.disk == D_OUTDATED) rv =SS_CONNECTED_OUTDATES ; - else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && + else if (nc && (ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) && (nc->verify_alg[0] == 0)) rv =SS_NO_VERIFY_ALG ;
Greg Kroah-Hartman
maintainerPATCH 115/350 ACPI: sysfs: validate return type of _STR method
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <[email protected]>
commit 4bb1e7d027413835b086aed35bc3f0713bc0f72b upstream.
Only buffer objects are valid return values of _STR.
If something else is returned description_show() will access invalid memory.
--- drivers/acpi/device_sysfs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/acpi/device_sysfs.c +3 -2
@@ -539,8 +539,9 @@ int acpi_device_setup_files(struct acpi_* If device has _STR, 'description' file is created */ if (acpi_has_method (dev->handle,"_STR" )) { - status =acpi_evaluate_object (dev->handle,"_STR" , -NULL , &buffer); + status =acpi_evaluate_object_typed (dev->handle,"_STR" , +NULL , &buffer, +ACPI_TYPE_BUFFER );if (ACPI_FAILURE (status)) buffer.pointer =NULL ; dev->pnp.str_obj = buffer.pointer;
Greg Kroah-Hartman
maintainerPATCH 116/350 f2fs: prevent possible int overflow in dir_block_index()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 47f268f33dff4a5e31541a990dc09f116f80e61c upstream.
The result of multiplication between values derived from functions dir_buckets() and bucket_blocks() *could* technically reach 2^30 * 2^2 = 2^32.
While unlikely to happen, it is prudent to ensure that it will not lead to integer overflow. Thus, use mul_u32_u32() as it's more appropriate to mitigate the issue.
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- fs/f2fs/dir.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/f2fs/dir.c +2 -1
@@ -79,7 +79,8 @@ static unsigned long dir_block_index(unsunsigned long bidx =0 ;for (i =0 ; i < level; i++) - bidx +=dir_buckets (i, dir_level) *bucket_blocks (i); + bidx +=mul_u32_u32 (dir_buckets (i, dir_level), +bucket_blocks (i)); bidx += idx *bucket_blocks (level);return bidx; }
Greg Kroah-Hartman
maintainerPATCH 117/350 f2fs: avoid potential int overflow in sanity_check_area_boundary()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <[email protected]>
commit 50438dbc483ca6a133d2bce9d5d6747bcee38371 upstream.
While calculating the end addresses of main area and segment 0, u32 may be not enough to hold the result without the danger of int overflow.
Just in case, play it safe and cast one of the operands to a wider type (u64).
Found by Linux Verification Center (linuxtesting.org) with static analysis tool SVACE.
--- fs/f2fs/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/f2fs/super.c +2 -2
@@ -2116,9 +2116,9 @@ static inline bool sanity_check_area_bouu32 segment_count =le32_to_cpu (raw_super->segment_count);u32 log_blocks_per_seg =le32_to_cpu (raw_super->log_blocks_per_seg);u64 main_end_blkaddr = main_blkaddr + - (segment_count_main << log_blocks_per_seg); + ((u64 )segment_count_main << log_blocks_per_seg);u64 seg_end_blkaddr = segment0_blkaddr + - (segment_count << log_blocks_per_seg); + ((u64 )segment_count << log_blocks_per_seg);if (segment0_blkaddr != cp_blkaddr) { f2fs_msg(sb, KERN_INFO,
Greg Kroah-Hartman
maintainerPATCH 118/350 vfs: fix race between evice_inodes() and find_inode()&iput()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Sun <[email protected]>
commit 88b1afbf0f6b221f6c5bb66cc80cd3b38d696687 upstream.
Hi, all
Recently I noticed a bug[1] in btrfs, after digged it into and I believe it'a race in vfs.
Let's assume there's a inode (ie ino 261) with i_count 1 is called by iput(), and there's a concurrent thread calling generic_shutdown_super().
cpu0: cpu1:iput() // i_count is 1
->spin_lock(inode)
->dec i_count to 0
->iput_final() generic_shutdown_super()
->__inode_add_lru() ->evict_inodes()
// cause some reason[2] ->if (atomic_read(inode->i_count)) continue;
// return before // inode 261 passed the above check
// list_lru_add_obj() // and then schedule out ->spin_unlock()
// note here: the inode 261
// was still at sb list and hash list,
// and I_FREEING|I_WILL_FREE was not been set
btrfs_iget()
// after some function calls
->find_inode()
// found the above inode 261
->spin_lock(inode)
// check I_FREEING|I_WILL_FREE
// and passed
->__iget()
->spin_unlock(inode) // schedule back
->spin_lock(inode)
// check (I_NEW|I_FREEING|I_WILL_FREE) flags,
// passed and set I_FREEINGiput() ->spin_unlock(inode)
->spin_lock(inode) ->evict()
// dec i_count to 0
->iput_final()
->spin_unlock()
->evict()Now, we have two threads simultaneously evicting
the same inode, which may trigger the BUG(inode->i_state & I_CLEAR) statement both within clear_inode() and iput().
To fix the bug, recheck the inode->i_count after holding i_lock. Because in the most scenarios, the first check is valid, and the overhead of spin_lock() can be reduced.
If there is any misunderstanding, please let me know, thanks.
[1]: https://lore.kernel.org/linux-btrfs/[email protected]/
[2]: The reason might be 1. SB_ACTIVE was removed or 2. mapping_shrinkable() return false when I reproduced the bug.
--- fs/inode.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/inode.c +4 -0
@@ -616,6 +616,10 @@ again:continue ;spin_lock (&inode->i_lock); +if (atomic_read (&inode->i_count)) { +spin_unlock (&inode->i_lock); +continue ; + }if (inode->i_state & (I_NEW |I_FREEING |I_WILL_FREE )) {spin_unlock (&inode->i_lock);continue ;
Greg Kroah-Hartman
maintainerPATCH 119/350 fs: Fix file_set_fowner LSM hook inconsistencies
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <[email protected]>
commit 26f204380a3c182e5adf1a798db0724d6111b597 upstream.
The fcntl's F_SETOWN command sets the process that handle SIGIO/SIGURG for the related file descriptor. Before this change, the file_set_fowner LSM hook was always called, ignoring the VFS logic which may not actually change the process that handles SIGIO (e.g. TUN, TTY, dnotify), nor update the related UID/EUID.
Moreover, because security_file_set_fowner() was called without lock (e.g. f_owner.lock), concurrent F_SETOWN commands could result to a race condition and inconsistent LSM states (e.g. SELinux's fown_sid) compared to struct fown_struct's UID/EUID.
This change makes sure the LSM states are always in sync with the VFS state by moving the security_file_set_fowner() call close to the UID/EUID updates and using the same f_owner.lock .
Rename f_modown() to __f_setown() to simplify code.
--- fs/fcntl.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
fs/fcntl.c +4 -10
@@ -84,8 +84,8 @@ static int setfl(int fd, struct file * freturn error; } -static void f_modown (struct file *filp,struct pid *pid,enum pid_type type, -int force) +void __f_setown (struct file *filp,struct pid *pid,enum pid_type type, +int force) {write_lock_irq (&filp->f_owner.lock);if (force || !filp->f_owner.pid) {
@@ -95,19 +95,13 @@ static void f_modown(struct file *filp,if (pid) {const struct cred *cred =current_cred (); +security_file_set_fowner (filp); filp->f_owner.uid = cred->uid; filp->f_owner.euid = cred->euid; } }write_unlock_irq (&filp->f_owner.lock); } - -void __f_setown (struct file *filp,struct pid *pid,enum pid_type type, -int force) -{ -security_file_set_fowner (filp); -f_modown (filp, pid, type, force); -}EXPORT_SYMBOL (__f_setown);int f_setown (struct file *filp,unsigned long arg,int force)
@@ -143,7 +137,7 @@ EXPORT_SYMBOL(f_setown);void f_delown (struct file *filp) { -f_modown (filp,NULL ,PIDTYPE_TGID ,1 ); +__f_setown (filp,NULL ,PIDTYPE_TGID ,1 ); }pid_t f_getown (struct file *filp)
Greg Kroah-Hartman
maintainerPATCH 120/350 nfs: fix memory leak in error path of nfs4_do_reclaim
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Lingfeng <[email protected]>
commit 8f6a7c9467eaf39da4c14e5474e46190ab3fb529 upstream.
Commit c77e22834ae9 ("NFSv4: Fix a potential sleep while atomic in nfs4_do_reclaim()") separate out the freeing of the state owners from nfs4_purge_state_owners() and finish it outside the rcu lock. However, the error path is omitted. As a result, the state owners in "freeme" will not be released.
Fix it by adding freeing in the error path.
--- fs/nfs/nfs4state.c | 1 + 1 file changed, 1 insertion(+)
fs/nfs/nfs4state.c +1 -0
@@ -1892,6 +1892,7 @@ restart:set_bit (ops->owner_flag_bit, &sp->so_flags);nfs4_put_state_owner (sp); status =nfs4_recovery_handle_error (clp, status); +nfs4_free_state_owners (&freeme);return (status !=0 ) ? status : -EAGAIN ; }
Greg Kroah-Hartman
maintainerPATCH 121/350 PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <[email protected]>
[ Upstream commit e56427068a8d796bb7b8e297f2b6e947380e383f ]
Going through a full irq descriptor lookup instead of just using the proper helper function which provides direct access is suboptimal.
In fact it _is_ wrong because the chip callback needs to get the chip data which is relevant for the chip while using the irq descriptor variant returns the irq chip data of the top level chip of a hierarchy. It does not matter in this case because the chip is the top level chip, but that doesn't make it more correct.
Stable-dep-of: 0199d2f2bd8c ("PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler")
--- drivers/pci/controller/pcie-xilinx-nwl.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +2 -6
@@ -384,13 +384,11 @@ static void nwl_pcie_msi_handler_low(struct irq_desc *desc)static void nwl_mask_leg_irq (struct irq_data *data) { -struct irq_desc *desc =irq_to_desc (data->irq); -struct nwl_pcie *pcie; +struct nwl_pcie *pcie =irq_data_get_irq_chip_data (data);unsigned long flags;u32 mask;u32 val; - pcie =irq_desc_get_chip_data (desc); mask =1 << (data->hwirq -1 );raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );
@@ -400,13 +398,11 @@ static void nwl_mask_leg_irq(struct irq_data *data)static void nwl_unmask_leg_irq (struct irq_data *data) { -struct irq_desc *desc =irq_to_desc (data->irq); -struct nwl_pcie *pcie; +struct nwl_pcie *pcie =irq_data_get_irq_chip_data (data);unsigned long flags;u32 mask;u32 val; - pcie =irq_desc_get_chip_data (desc); mask =1 << (data->hwirq -1 );raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 122/350 PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Anderson <[email protected]>
[ Upstream commit 0199d2f2bd8cd97b310f7ed82a067247d7456029 ]
MSGF_LEG_MASK is laid out with INTA in bit 0, INTB in bit 1, INTC in bit 2, and INTD in bit 3. Hardware IRQ numbers start at 0, and we register PCI_NUM_INTX IRQs. So to enable INTA (aka hwirq 0) we should set bit 0. Remove the subtraction of one.
This bug would cause INTx interrupts not to be delivered, as enabling INTB would actually enable INTA, and enabling INTA wouldn't enable anything at all. It is likely that this got overlooked for so long since most PCIe hardware uses MSIs. This fixes the following UBSAN error:
UBSAN: shift-out-of-bounds in ../drivers/pci/controller/pcie-xilinx-nwl.c:389:11 shift exponent 18446744073709551615 is too large for 32-bit type 'int' CPU: 1 PID: 61 Comm: kworker/u10:1 Not tainted 6.6.20+ #268 Hardware name: xlnx,zynqmp (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:235) show_stack (arch/arm64/kernel/stacktrace.c:242) dump_stack_lvl (lib/dump_stack.c:107) dump_stack (lib/dump_stack.c:114) __ubsan_handle_shift_out_of_bounds (lib/ubsan.c:218 lib/ubsan.c:387) nwl_unmask_leg_irq (drivers/pci/controller/pcie-xilinx-nwl.c:389 (discriminator 1)) irq_enable (kernel/irq/internals.h:234 kernel/irq/chip.c:170 kernel/irq/chip.c:439 kernel/irq/chip.c:432 kernel/irq/chip.c:345) __irq_startup (kernel/irq/internals.h:239 kernel/irq/chip.c:180 kernel/irq/chip.c:250) irq_startup (kernel/irq/chip.c:270) __setup_irq (kernel/irq/manage.c:1800) request_threaded_irq (kernel/irq/manage.c:2206) pcie_pme_probe (include/linux/interrupt.h:168 drivers/pci/pcie/pme.c:348)
--- drivers/pci/controller/pcie-xilinx-nwl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pci/controller/pcie-xilinx-nwl.c +2 -2
@@ -389,7 +389,7 @@ static void nwl_mask_leg_irq(struct irq_data *data)u32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val & (~mask)),MSGF_LEG_MASK );
@@ -403,7 +403,7 @@ static void nwl_unmask_leg_irq(struct irq_data *data)u32 mask;u32 val; - mask =1 << (data->hwirq -1 ); + mask =1 << data->hwirq;raw_spin_lock_irqsave (&pcie->leg_mask_lock, flags); val =nwl_bridge_readl (pcie,MSGF_LEG_MASK );nwl_bridge_writel (pcie, (val | mask),MSGF_LEG_MASK );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 123/350 soc: versatile: realview: fix memory leak during device remove
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 1c4f26a41f9d052f334f6ae629e01f598ed93508 ]
If device is unbound, the memory allocated for soc_dev_attr should be freed to prevent leaks.
Stable-dep-of: c774f2564c00 ("soc: versatile: realview: fix soc_dev leak during device remove")
--- drivers/soc/versatile/soc-realview.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/soc/versatile/soc-realview.c +3 -4
@@ -95,7 +95,7 @@ static int realview_soc_probe(struct platform_device *pdev)if (IS_ERR (syscon_regmap))return PTR_ERR (syscon_regmap); - soc_dev_attr =kzalloc (sizeof (*soc_dev_attr),GFP_KERNEL ); + soc_dev_attr =devm_kzalloc (&pdev->dev,sizeof (*soc_dev_attr),GFP_KERNEL );if (!soc_dev_attr)return -ENOMEM ;
@@ -107,10 +107,9 @@ static int realview_soc_probe(struct platform_device *pdev) soc_dev_attr->machine ="RealView" ; soc_dev_attr->family ="Versatile" ; soc_dev =soc_device_register (soc_dev_attr); -if (IS_ERR (soc_dev)) { -kfree (soc_dev_attr); +if (IS_ERR (soc_dev))return -ENODEV ; - } + ret =regmap_read (syscon_regmap,REALVIEW_SYS_ID_OFFSET , &realview_coreid);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 124/350 soc: versatile: realview: fix soc_dev leak during device remove
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit c774f2564c0086c23f5269fd4691f233756bf075 ]
If device is unbound, the soc_dev should be unregistered to prevent memory leak.
--- drivers/soc/versatile/soc-realview.c | 13 +++++++++++++ 1 file changed, 13 insertions(+)
drivers/soc/versatile/soc-realview.c +13 -0
@@ -8,6 +8,7 @@* published by the Free Software Foundation. * */ +#include <linux/device.h> #include <linux/init.h> #include <linux/io.h> #include <linux/slab.h>
@@ -83,6 +84,13 @@ static ssize_t realview_get_build(struct device *dev,static struct device_attribute realview_build_attr =__ATTR (build,S_IRUGO , realview_get_build,NULL ); +static void realview_soc_socdev_release (void *data) +{ +struct soc_device *soc_dev = data; + +soc_device_unregister (soc_dev); +} +static int realview_soc_probe (struct platform_device *pdev) {struct regmap *syscon_regmap;
@@ -110,6 +118,11 @@ static int realview_soc_probe(struct platform_device *pdev)if (IS_ERR (soc_dev))return -ENODEV ; + ret =devm_add_action_or_reset (&pdev->dev, realview_soc_socdev_release, + soc_dev); +if (ret) +return ret; + ret =regmap_read (syscon_regmap,REALVIEW_SYS_ID_OFFSET , &realview_coreid);if (ret)
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 125/350 usb: yurex: Replace snprintf() with the safer scnprintf() variant
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee Jones <[email protected]>
[ Upstream commit 86b20af11e84c26ae3fde4dcc4f490948e3f8035 ]
There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that.
Whilst we're at it, let's define some magic numbers to increase readability and ease of maintenance.
Stable-dep-of: 93907620b308 ("USB: misc: yurex: fix race between read and write")
--- drivers/usb/misc/yurex.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-)
drivers/usb/misc/yurex.c +7 -5
@@ -34,6 +34,8 @@#define YUREX_BUF_SIZE 8#define YUREX_WRITE_TIMEOUT (HZ*2) +#define MAX_S64_STRLEN 20/* {-}922337203685477580{7,8} */ +/* table of devices that work with this driver */ static struct usb_device_id yurex_table[] = { {USB_DEVICE (YUREX_VENDOR_ID ,YUREX_PRODUCT_ID ) },
@@ -402,7 +404,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, {struct usb_yurex *dev;int len =0 ; -char in_buffer[20 ]; +char in_buffer[MAX_S64_STRLEN ];unsigned long flags; dev = file->private_data;
@@ -413,14 +415,14 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,return -ENODEV ; } +if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) +return -EIO ; +spin_lock_irqsave (&dev->lock, flags); - len =snprintf (in_buffer,20 ,"%lld\n" , dev->bbu); +scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu);spin_unlock_irqrestore (&dev->lock, flags);mutex_unlock (&dev->io_mutex); -if (WARN_ON_ONCE (len >=sizeof (in_buffer))) -return -EIO ; -return simple_read_from_buffer (buffer, count, ppos, in_buffer, len); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 126/350 USB: misc: yurex: fix race between read and write
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <[email protected]>
[ Upstream commit 93907620b308609c72ba4b95b09a6aa2658bb553 ]
The write code path touches the bbu member in a non atomic manner without taking the spinlock. Fix it.
The bug is as old as the driver.
--- drivers/usb/misc/yurex.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
drivers/usb/misc/yurex.c +6 -4
@@ -405,7 +405,6 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,struct usb_yurex *dev;int len =0 ;char in_buffer[MAX_S64_STRLEN ]; -unsigned long flags; dev = file->private_data;
@@ -418,9 +417,9 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count,if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN ))return -EIO ; -spin_lock_irqsave (&dev->lock, flags); +spin_lock_irq (&dev->lock);scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu); -spin_unlock_irqrestore (&dev->lock, flags); +spin_unlock_irq (&dev->lock);mutex_unlock (&dev->io_mutex);return simple_read_from_buffer (buffer, count, ppos, in_buffer, len);
@@ -510,8 +509,11 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, __func__, retval); goto error; } -if (set && timeout) +if (set && timeout) { +spin_lock_irq (&dev->lock); dev->bbu = c2; +spin_unlock_irq (&dev->lock); + }return timeout ? count : -EIO ; error:
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 127/350 pps: remove usage of the deprecated ida_simple_xx() API
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <[email protected]>
[ Upstream commit 55dbc5b5174d0e7d1fa397d05aa4cb145e8b887e ]
ida_alloc() and ida_free() should be preferred to the deprecated ida_simple_get() and ida_simple_remove().
This is less verbose.
Stable-dep-of: 62c5a01a5711 ("pps: add an error check in parport_attach")
--- drivers/pps/clients/pps_parport.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/pps/clients/pps_parport.c +3 -3
@@ -158,7 +158,7 @@ static void parport_attach(struct parport *port)return ; } - index =ida_simple_get (&pps_client_index,0 ,0 ,GFP_KERNEL ); + index =ida_alloc (&pps_client_index,GFP_KERNEL );memset (&pps_client_cb,0 ,sizeof (pps_client_cb)); pps_client_cb.private = device; pps_client_cb.irq_func = parport_irq;
@@ -198,7 +198,7 @@ static void parport_attach(struct parport *port) err_unregister_dev:parport_unregister_device (device->pardev); err_free: -ida_simple_remove (&pps_client_index, index); +ida_free (&pps_client_index, index);kfree (device); }
@@ -218,7 +218,7 @@ static void parport_detach(struct parport *port)pps_unregister_source (device->pps);parport_release (pardev);parport_unregister_device (pardev); -ida_simple_remove (&pps_client_index, device->index); +ida_free (&pps_client_index, device->index);kfree (device); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 128/350 pps: add an error check in parport_attach
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <[email protected]>
[ Upstream commit 62c5a01a5711c8e4be8ae7b6f0db663094615d48 ]
In parport_attach, the return value of ida_alloc is unchecked, witch leads to the use of an invalid index value.
To address this issue, index should be checked. When the index value is abnormal, the device should be freed.
Found by code review, compile tested only.
--- drivers/pps/clients/pps_parport.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/pps/clients/pps_parport.c +6 -2
@@ -159,6 +159,9 @@ static void parport_attach(struct parport *port) } index =ida_alloc (&pps_client_index,GFP_KERNEL ); +if (index <0 ) + goto err_free_device; +memset (&pps_client_cb,0 ,sizeof (pps_client_cb)); pps_client_cb.private = device; pps_client_cb.irq_func = parport_irq;
@@ -169,7 +172,7 @@ static void parport_attach(struct parport *port) index);if (!device->pardev) {pr_err ("couldn't register with %s\n" , port->name); - goto err_free; + goto err_free_ida; }if (parport_claim_or_block (device->pardev) <0 ) {
@@ -197,8 +200,9 @@ static void parport_attach(struct parport *port)parport_release (device->pardev); err_unregister_dev:parport_unregister_device (device->pardev); -err_free: +err_free_ida:ida_free (&pps_client_index, index); +err_free_device:kfree (device); }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 129/350 i2c: aspeed: Update the stop sw state when the bus recovery occurs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tommy Huang <[email protected]>
commit 93701d3b84ac5f3ea07259d4ced405c53d757985 upstream.
When the i2c bus recovery occurs, driver will send i2c stop command in the scl low condition. In this case the sw state will still keep original situation. Under multi-master usage, i2c bus recovery will be called when i2c transfer timeout occurs. Update the stop command calling with aspeed_i2c_do_stop function to update master_state.
--- drivers/i2c/busses/i2c-aspeed.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/i2c/busses/i2c-aspeed.c +8 -8
@@ -159,6 +159,13 @@ struct aspeed_i2c_bus {static int aspeed_i2c_reset (struct aspeed_i2c_bus *bus); +/* precondition: bus.lock has been acquired. */ +static void aspeed_i2c_do_stop (struct aspeed_i2c_bus *bus) +{ + bus->master_state =ASPEED_I2C_MASTER_STOP ; +writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); +} +static int aspeed_i2c_recover_bus (struct aspeed_i2c_bus *bus) {unsigned long time_left, flags;
@@ -176,7 +183,7 @@ static int aspeed_i2c_recover_bus(struct command);reinit_completion (&bus->cmd_complete); -writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); +aspeed_i2c_do_stop (bus);spin_unlock_irqrestore (&bus->lock, flags); time_left = wait_for_completion_timeout(
@@ -351,13 +358,6 @@ static void aspeed_i2c_do_start(struct a }/* precondition: bus.lock has been acquired. */ -static void aspeed_i2c_do_stop (struct aspeed_i2c_bus *bus) -{ - bus->master_state =ASPEED_I2C_MASTER_STOP ; -writel (ASPEED_I2CD_M_STOP_CMD , bus->base +ASPEED_I2C_CMD_REG ); -} - -/* precondition: bus.lock has been acquired. */ static void aspeed_i2c_next_msg_or_stop (struct aspeed_i2c_bus *bus) {if (bus->msgs_index +1 < bus->msgs_count) {
Greg Kroah-Hartman
maintainerPATCH 130/350 i2c: isch: Add missed else
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <[email protected]>
commit 1db4da55070d6a2754efeb3743f5312fc32f5961 upstream.
In accordance with the existing comment and code analysis it is quite likely that there is a missed 'else' when adapter times out. Add it.
--- drivers/i2c/busses/i2c-isch.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/i2c/busses/i2c-isch.c +1 -2
@@ -107,8 +107,7 @@ static int sch_transaction(void)if (retries >MAX_RETRIES ) {dev_err (&sch_adapter.dev,"SMBus Timeout!\n" ); result = -ETIMEDOUT ; - } -if (temp &0x04 ) { + }else if (temp &0x04 ) { result = -EIO ;dev_dbg (&sch_adapter.dev,"Bus collision! SMBus may be " "locked until next hard reset. (sorry!)\n" );
Greg Kroah-Hartman
maintainerPATCH 131/350 usb: yurex: Fix inconsistent locking bug in yurex_read()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harshit Mogalapalli <[email protected]>
commit e7d3b9f28654dbfce7e09f8028210489adaf6a33 upstream.
Unlock before returning on the error path.
--- drivers/usb/misc/yurex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/usb/misc/yurex.c +3 -1
@@ -414,8 +414,10 @@ static ssize_t yurex_read(struct file *freturn -ENODEV ; } -if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) +if (WARN_ON_ONCE (dev->bbu >S64_MAX || dev->bbu <S64_MIN )) { +mutex_unlock (&dev->io_mutex);return -EIO ; + }spin_lock_irq (&dev->lock);scnprintf (in_buffer,MAX_S64_STRLEN ,"%lld\n" , dev->bbu);
Greg Kroah-Hartman
maintainerPATCH 132/350 mailbox: rockchip: fix a typo in module autoloading
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chen <[email protected]>
[ Upstream commit e92d87c9c5d769e4cb1dd7c90faa38dddd7e52e3 ]
MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match) could let the module properly autoloaded based on the alias from of_device_id table. It should be 'rockchip_mbox_of_match' instead of 'rockchp_mbox_of_match', just fix it.
--- drivers/mailbox/rockchip-mailbox.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mailbox/rockchip-mailbox.c +1 -1
@@ -167,7 +167,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = { { .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data}, { }, }; -MODULE_DEVICE_TABLE (of, rockchp_mbox_of_match); +MODULE_DEVICE_TABLE (of, rockchip_mbox_of_match);static int rockchip_mbox_probe (struct platform_device *pdev) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 133/350 mailbox: bcm2835: Fix timeout during suspend mode
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <[email protected]>
[ Upstream commit dc09f007caed3b2f6a3b6bd7e13777557ae22bfd ]
During noirq suspend phase the Raspberry Pi power driver suffer of firmware property timeouts. The reason is that the IRQ of the underlying BCM2835 mailbox is disabled and rpi_firmware_property_list() will always run into a timeout [1].
Since the VideoCore side isn't consider as a wakeup source, set the IRQF_NO_SUSPEND flag for the mailbox IRQ in order to keep it enabled during suspend-resume cycle.
[1]
PM: late suspend of devices complete after 1.754 msecs
WARNING: CPU: 0 PID: 438 at drivers/firmware/raspberrypi.c:128 rpi_firmware_property_list+0x204/0x22c Firmware transaction 0x00028001 timeout Modules linked in: CPU: 0 PID: 438 Comm: bash Tainted: G C 6.9.3-dirty #17 Hardware name: BCM2835 Call trace: unwind_backtrace from show_stack+0x18/0x1c show_stack from dump_stack_lvl+0x34/0x44 dump_stack_lvl from __warn+0x88/0xec __warn from warn_slowpath_fmt+0x7c/0xb0 warn_slowpath_fmt from rpi_firmware_property_list+0x204/0x22c rpi_firmware_property_list from rpi_firmware_property+0x68/0x8c rpi_firmware_property from rpi_firmware_set_power+0x54/0xc0 rpi_firmware_set_power from _genpd_power_off+0xe4/0x148 _genpd_power_off from genpd_sync_power_off+0x7c/0x11c genpd_sync_power_off from genpd_finish_suspend+0xcc/0xe0 genpd_finish_suspend from dpm_run_callback+0x78/0xd0 dpm_run_callback from device_suspend_noirq+0xc0/0x238 device_suspend_noirq from dpm_suspend_noirq+0xb0/0x168 dpm_suspend_noirq from suspend_devices_and_enter+0x1b8/0x5ac suspend_devices_and_enter from pm_suspend+0x254/0x2e4 pm_suspend from state_store+0xa8/0xd4 state_store from kernfs_fop_write_iter+0x154/0x1a0 kernfs_fop_write_iter from vfs_write+0x12c/0x184 vfs_write from ksys_write+0x78/0xc0 ksys_write from ret_fast_syscall+0x0/0x54 Exception stack(0xcc93dfa8 to 0xcc93dff0)
[...]
PM: noirq suspend of devices complete after 3095.584 msecs
--- drivers/mailbox/bcm2835-mailbox.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/mailbox/bcm2835-mailbox.c +2 -1
@@ -152,7 +152,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)spin_lock_init (&mbox->lock); ret =devm_request_irq (dev,irq_of_parse_and_map (dev->of_node,0 ), - bcm2835_mbox_irq,0 ,dev_name (dev), mbox); + bcm2835_mbox_irq,IRQF_NO_SUSPEND ,dev_name (dev), + mbox);if (ret) {dev_err (dev,"Failed to register a mailbox IRQ handler: %d\n" , ret);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 134/350 ceph: remove the incorrect Fw reference check when dirtying pages
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <[email protected]>
[ Upstream commit c08dfb1b49492c09cf13838c71897493ea3b424e ]
When doing the direct-io reads it will also try to mark pages dirty, but for the read path it won't hold the Fw caps and there is case will it get the Fw reference.
--- fs/ceph/addr.c | 1 - 1 file changed, 1 deletion(-)
fs/ceph/addr.c +0 -1
@@ -88,7 +88,6 @@ static int ceph_set_page_dirty(struct page *page)/* dirty the head */ spin_lock (&ci->i_ceph_lock); -BUG_ON (ci->i_wr_ref ==0 );// caller should hold Fw reference if (__ceph_have_pending_cap_snap (ci)) {struct ceph_cap_snap *capsnap = list_last_entry(&ci->i_cap_snaps,
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 135/350 netfilter: uapi: NFTA_FLOWTABLE_HOOK is NLA_NESTED
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <[email protected]>
[ Upstream commit 76f1ed087b562a469f2153076f179854b749c09a ]
Fix the comment which incorrectly defines it as NLA_U32.
--- include/uapi/linux/netfilter/nf_tables.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/uapi/linux/netfilter/nf_tables.h +1 -1
@@ -1464,7 +1464,7 @@ enum nft_object_attributes {* * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING) * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING) -* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32) +* @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED) * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32) * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64) */
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 136/350 netfilter: nf_tables: prevent nf_skb_duplicated corruption
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit 92ceba94de6fb4cee2bf40b485979c342f44a492 ]
syzbot found that nf_dup_ipv4() or nf_dup_ipv6() could write per-cpu variable nf_skb_duplicated in an unsafe way [1].
Disabling preemption as hinted by the splat is not enough, we have to disable soft interrupts as well.
[1]
BUG: using __this_cpu_write() in preemptible [00000000] code: syz.4.282/6316 caller is nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 CPU: 0 UID: 0 PID: 6316 Comm: syz.4.282 Not tainted 6.11.0-rc7-syzkaller-00104-g7052622fccb1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 check_preemption_disabled+0x10e/0x120 lib/smp_processor_id.c:49 nf_dup_ipv4+0x651/0x8f0 net/ipv4/netfilter/nf_dup_ipv4.c:87 nft_dup_ipv4_eval+0x1db/0x300 net/ipv4/netfilter/nft_dup_ipv4.c:30 expr_call_ops_eval net/netfilter/nf_tables_core.c:240 [inline] nft_do_chain+0x4ad/0x1da0 net/netfilter/nf_tables_core.c:288 nft_do_chain_ipv4+0x202/0x320 net/netfilter/nft_chain_filter.c:23 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626 nf_hook+0x2c4/0x450 include/linux/netfilter.h:269 NF_HOOK_COND include/linux/netfilter.h:302 [inline] ip_output+0x185/0x230 net/ipv4/ip_output.c:433 ip_local_out net/ipv4/ip_output.c:129 [inline] ip_send_skb+0x74/0x100 net/ipv4/ip_output.c:1495 udp_send_skb+0xacf/0x1650 net/ipv4/udp.c:981 udp_sendmsg+0x1c21/0x2a60 net/ipv4/udp.c:1269 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmmsg+0x3b2/0x740 net/socket.c:2737 __do_sys_sendmmsg net/socket.c:2766 [inline] __se_sys_sendmmsg net/socket.c:2763 [inline] __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2763 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f4ce4f7def9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f4ce5d4a038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00007f4ce5135f80 RCX: 00007f4ce4f7def9 RDX: 0000000000000001 RSI: 0000000020005d40 RDI: 0000000000000006 RBP: 00007f4ce4ff0b76 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f4ce5135f80 R15: 00007ffd4cbc6d68 </TASK>
--- net/ipv4/netfilter/nf_dup_ipv4.c | 7 +++++-- net/ipv6/netfilter/nf_dup_ipv6.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)
net/ipv4/netfilter/nf_dup_ipv4.c +5 -2
@@ -55,8 +55,9 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, {struct iphdr *iph; +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out;/* * Copy the skb, and route the copy. Will later return %XT_CONTINUE for * the original skb, which should continue on its way as if nothing has
@@ -64,7 +65,7 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum,*/ skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )/* Avoid counting cloned packets towards the original connection. */
@@ -93,6 +94,8 @@ void nf_dup_ipv4(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv4);
net/ipv6/netfilter/nf_dup_ipv6.c +5 -2
@@ -50,11 +50,12 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb,void nf_dup_ipv6 (struct net *net,struct sk_buff *skb,unsigned int hooknum,const struct in6_addr *gw,int oif) { +local_bh_disable ();if (this_cpu_read (nf_skb_duplicated)) -return ; + goto out; skb =pskb_copy (skb,GFP_ATOMIC );if (skb ==NULL ) -return ; + goto out;#if IS_ENABLED (CONFIG_NF_CONNTRACK )nf_reset (skb);
@@ -72,6 +73,8 @@ void nf_dup_ipv6(struct net *net, struct sk_buff *skb, unsigned int hooknum, }else {kfree_skb (skb); } +out: +local_bh_enable (); }EXPORT_SYMBOL_GPL (nf_dup_ipv6);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 137/350 r8152: Factor out OOB link list waits
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Prashant Malani <[email protected]>
[ Upstream commit 5f71c84038d39def573744a145c573758f52a949 ]
The same for-loop check for the LINK_LIST_READY bit of an OOB_CTRL register is used in several places. Factor these out into a single function to reduce the lines of code.
Stable-dep-of: 45c0de18ff2d ("net: ethernet: lantiq_etop: fix memory disclosure")
--- drivers/net/usb/r8152.c | 73 ++++++++++++----------------------------- 1 file changed, 21 insertions(+), 52 deletions(-)
drivers/net/usb/r8152.c +21 -52
@@ -3007,11 +3007,23 @@ static void r8152b_hw_phy_cfg(struct r8152 *tp)set_bit (PHY_RESET , &tp->flags); } -static void r8152b_exit_oob (struct r8152 *tp) +static void wait_oob_link_list_ready (struct r8152 *tp) {u32 ocp_data;int i; +for (i =0 ; i <1000 ; i++) { + ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); +if (ocp_data &LINK_LIST_READY ) +break ; +usleep_range (1000 ,2000 ); + } +} + +static void r8152b_exit_oob (struct r8152 *tp) +{ +u32 ocp_data; + ocp_data =ocp_read_dword (tp,MCU_TYPE_PLA ,PLA_RCR ); ocp_data &= ~RCR_ACPT_ALL ;ocp_write_dword (tp,MCU_TYPE_PLA ,PLA_RCR , ocp_data);
@@ -3029,23 +3041,13 @@ static void r8152b_exit_oob(struct r8152 *tp) ocp_data &= ~MCU_BORW_EN ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp); ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 ); ocp_data |=RE_INIT_LL ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp);rtl8152_nic_reset (tp);
@@ -3087,7 +3089,6 @@ static void r8152b_exit_oob(struct r8152 *tp)static void r8152b_enter_oob (struct r8152 *tp) {u32 ocp_data; -int i; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); ocp_data &= ~NOW_IS_OOB ;
@@ -3099,23 +3100,13 @@ static void r8152b_enter_oob(struct r8152 *tp)rtl_disable (tp); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp); ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 ); ocp_data |=RE_INIT_LL ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp);ocp_write_word (tp,MCU_TYPE_PLA ,PLA_RMS ,RTL8152_RMS );
@@ -3388,7 +3379,6 @@ static void r8153b_hw_phy_cfg(struct r8152 *tp)static void r8153_first_init (struct r8152 *tp) {u32 ocp_data; -int i;rxdy_gated_en (tp, true);r8153_teredo_off (tp);
@@ -3408,23 +3398,13 @@ static void r8153_first_init(struct r8152 *tp) ocp_data &= ~MCU_BORW_EN ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp); ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 ); ocp_data |=RE_INIT_LL ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp);rtl_rx_vlan_en (tp, tp->netdev->features &NETIF_F_HW_VLAN_CTAG_RX );
@@ -3449,7 +3429,6 @@ static void r8153_first_init(struct r8152 *tp)static void r8153_enter_oob (struct r8152 *tp) {u32 ocp_data; -int i; ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); ocp_data &= ~NOW_IS_OOB ;
@@ -3458,23 +3437,13 @@ static void r8153_enter_oob(struct r8152 *tp)rtl_disable (tp);rtl_reset_bmu (tp); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp); ocp_data =ocp_read_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 ); ocp_data |=RE_INIT_LL ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_SFF_STS_7 , ocp_data); -for (i =0 ; i <1000 ; i++) { - ocp_data =ocp_read_byte (tp,MCU_TYPE_PLA ,PLA_OOB_CTRL ); -if (ocp_data &LINK_LIST_READY ) -break ; -usleep_range (1000 ,2000 ); - } +wait_oob_link_list_ready (tp); ocp_data = tp->netdev->mtu +VLAN_ETH_HLEN +ETH_FCS_LEN ;ocp_write_word (tp,MCU_TYPE_PLA ,PLA_RMS , ocp_data);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 138/350 net: ethernet: lantiq_etop: fix memory disclosure
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <[email protected]>
[ Upstream commit 45c0de18ff2dc9af01236380404bbd6a46502c69 ]
When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expanded buffer.
In case the packet cannot be padded it is silently dropped. Statistics are also not incremented. This driver does not support statistics in the old 32-bit format or the new 64-bit format. These will be added in the future. In its current form, the patch should be easily backported to stable versions.
Ethernet MACs on Amazon-SE and Danube cannot do padding of the packets in hardware, so software padding must be applied.
--- drivers/net/ethernet/lantiq_etop.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/net/ethernet/lantiq_etop.c +3 -1
@@ -478,7 +478,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)unsigned long flags;u32 byte_offset; - len = skb->len <ETH_ZLEN ?ETH_ZLEN : skb->len; +if (skb_put_padto (skb,ETH_ZLEN )) +return NETDEV_TX_OK ; + len = skb->len;if ((desc->ctl & (LTQ_DMA_OWN |LTQ_DMA_C )) || ch->skb[ch->dma.desc]) {netdev_err (dev,"tx ring full\n" );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 139/350 net: avoid potential underflow in qdisc_pkt_len_init() with UFO
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit c20029db28399ecc50e556964eaba75c43b1e2f1 ]
After commit 7c6d2ecbda83 ("net: be more gentle about silly gso requests coming from user") virtio_net_hdr_to_skb() had sanity check to detect malicious attempts from user space to cook a bad GSO packet.
Then commit cf9acc90c80ec ("net: virtio_net_hdr_to_skb: count transport header in UFO") while fixing one issue, allowed user space to cook a GSO packet with the following characteristic :
IPv4 SKB_GSO_UDP, gso_size=3, skb->len = 28.
When this packet arrives in qdisc_pkt_len_init(), we end up with hdr_len = 28 (IPv4 header + UDP header), matching skb->len
Then the following sets gso_segs to 0 :
gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
shinfo->gso_size);
Then later we set qdisc_skb_cb(skb)->pkt_len to back to zero :/
qdisc_skb_cb(skb)->pkt_len += (gso_segs - 1) * hdr_len;
This leads to the following crash in fq_codel [1]
qdisc_pkt_len_init() is best effort, we only want an estimation of the bytes sent on the wire, not crashing the kernel.
This patch is fixing this particular issue, a following one adds more sanity checks for another potential bug.
[1]
[ 70.724101] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 70.724561] #PF: supervisor read access in kernel mode [ 70.724561] #PF: error_code(0x0000) - not-present page [ 70.724561] PGD 10ac61067 P4D 10ac61067 PUD 107ee2067 PMD 0 [ 70.724561] Oops: Oops: 0000 [#1] SMP NOPTI [ 70.724561] CPU: 11 UID: 0 PID: 2163 Comm: b358537762 Not tainted 6.11.0-virtme #991 [ 70.724561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 70.724561] RIP: 0010:fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] Code: 24 08 49 c1 e1 06 44 89 7c 24 18 45 31 ed 45 31 c0 31 ff 89 44 24 14 4c 03 8b 90 01 00 00 eb 04 39 ca 73 37 4d 8b 39 83 c7 01 <49> 8b 17 49 89 11 41 8b 57 28 45 8b 5f 34 49 c7 07 00 00 00 00 49 All code ======== 0: 24 08 and $0x8,%al 2: 49 c1 e1 06 shl $0x6,%r9 6: 44 89 7c 24 18 mov %r15d,0x18(%rsp) b: 45 31 ed xor %r13d,%r13d e: 45 31 c0 xor %r8d,%r8d 11: 31 ff xor %edi,%edi 13: 89 44 24 14 mov %eax,0x14(%rsp) 17: 4c 03 8b 90 01 00 00 add 0x190(%rbx),%r9 1e: eb 04 jmp 0x24 20: 39 ca cmp %ecx,%edx 22: 73 37 jae 0x5b 24: 4d 8b 39 mov (%r9),%r15 27: 83 c7 01 add $0x1,%edi 2a:* 49 8b 17 mov (%r15),%rdx <-- trapping instruction 2d: 49 89 11 mov %rdx,(%r9) 30: 41 8b 57 28 mov 0x28(%r15),%edx 34: 45 8b 5f 34 mov 0x34(%r15),%r11d 38: 49 c7 07 00 00 00 00 movq $0x0,(%r15)
3f: 49 rex.WB
Code starting with the faulting instruction
===========================================
0: 49 8b 17 mov (%r15),%rdx 3: 49 89 11 mov %rdx,(%r9) 6: 41 8b 57 28 mov 0x28(%r15),%edx a: 45 8b 5f 34 mov 0x34(%r15),%r11d e: 49 c7 07 00 00 00 00 movq $0x0,(%r15) 15: 49 rex.WB [ 70.724561] RSP: 0018:ffff95ae85e6fb90 EFLAGS: 00000202 [ 70.724561] RAX: 0000000002000000 RBX: ffff95ae841de000 RCX: 0000000000000000 [ 70.724561] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001 [ 70.724561] RBP: ffff95ae85e6fbf8 R08: 0000000000000000 R09: ffff95b710a30000 [ 70.724561] R10: 0000000000000000 R11: bdf289445ce31881 R12: ffff95ae85e6fc58 [ 70.724561] R13: 0000000000000000 R14: 0000000000000040 R15: 0000000000000000 [ 70.724561] FS: 000000002c5c1380(0000) GS:ffff95bd7fcc0000(0000) knlGS:0000000000000000 [ 70.724561] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.724561] CR2: 0000000000000000 CR3: 000000010c568000 CR4: 00000000000006f0 [ 70.724561] Call Trace: [ 70.724561] <TASK> [ 70.724561] ? __die (arch/x86/kernel/dumpstack.c:421 arch/x86/kernel/dumpstack.c:434) [ 70.724561] ? page_fault_oops (arch/x86/mm/fault.c:715) [ 70.724561] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:87 ./arch/x86/include/asm/irqflags.h:147 arch/x86/mm/fault.c:1489 arch/x86/mm/fault.c:1539) [ 70.724561] ? asm_exc_page_fault (./arch/x86/include/asm/idtentry.h:623) [ 70.724561] ? fq_codel_enqueue (net/sched/sch_fq_codel.c:120 net/sched/sch_fq_codel.c:168 net/sched/sch_fq_codel.c:230) sch_fq_codel [ 70.724561] dev_qdisc_enqueue (net/core/dev.c:3784) [ 70.724561] __dev_queue_xmit (net/core/dev.c:3880 (discriminator 2) net/core/dev.c:4390 (discriminator 2)) [ 70.724561] ? irqentry_enter (kernel/entry/common.c:237) [ 70.724561] ? sysvec_apic_timer_interrupt (./arch/x86/include/asm/hardirq.h:74 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2) arch/x86/kernel/apic/apic.c:1043 (discriminator 2)) [ 70.724561] ? trace_hardirqs_on (kernel/trace/trace_preemptirq.c:58 (discriminator 4)) [ 70.724561] ? asm_sysvec_apic_timer_interrupt (./arch/x86/include/asm/idtentry.h:702) [ 70.724561] ? virtio_net_hdr_to_skb.constprop.0 (./include/linux/virtio_net.h:129 (discriminator 1)) [ 70.724561] packet_sendmsg (net/packet/af_packet.c:3145 (discriminator 1) net/packet/af_packet.c:3177 (discriminator 1)) [ 70.724561] ? _raw_spin_lock_bh (./arch/x86/include/asm/atomic.h:107 (discriminator 4) ./include/linux/atomic/atomic-arch-fallback.h:2170 (discriminator 4) ./include/linux/atomic/atomic-instrumented.h:1302 (discriminator 4) ./include/asm-generic/qspinlock.h:111 (discriminator 4) ./include/linux/spinlock.h:187 (discriminator 4) ./include/linux/spinlock_api_smp.h:127 (discriminator 4) kernel/locking/spinlock.c:178 (discriminator 4)) [ 70.724561] ? netdev_name_node_lookup_rcu (net/core/dev.c:325 (discriminator 1)) [ 70.724561] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:745 (discriminator 1) net/socket.c:2210 (discriminator 1)) [ 70.724561] ? __sys_setsockopt (./include/linux/file.h:34 net/socket.c:2355) [ 70.724561] __x64_sys_sendto (net/socket.c:2222 (discriminator 1) net/socket.c:2218 (discriminator 1) net/socket.c:2218 (discriminator 1)) [ 70.724561] do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1)) [ 70.724561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 70.724561] RIP: 0033:0x41ae09
--- net/core/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/dev.c +1 -1
@@ -3435,7 +3435,7 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) sizeof(_tcphdr), &_tcphdr);if (likely (th)) hdr_len +=__tcp_hdrlen (th); - }else { + }else if (shinfo->gso_type &SKB_GSO_UDP_L4 ) {struct udphdr _udphdr; if (skb_header_pointer(skb, skb_transport_offset(skb),
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 140/350 net: add more sanity checks to qdisc_pkt_len_init()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
[ Upstream commit ab9a9a9e9647392a19e7a885b08000e89c86b535 ]
One path takes care of SKB_GSO_DODGY, assumingskb->len is bigger than hdr_len.
virtio_net_hdr_to_skb() does not fully dissect TCP headers, it only make sure it is at least 20 bytes.
It is possible for an user to provide a malicious 'GSO' packet, total length of 80 bytes.
- 20 bytes of IPv4 header
- 60 bytes TCP header
- a small gso_size like 8
virtio_net_hdr_to_skb() would declare this packet as a normal GSO packet, because it would see 40 bytes of payload, bigger than gso_size.
We need to make detect this case to not underflow
qdisc_skb_cb(skb)->pkt_len.
--- net/core/dev.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
net/core/dev.c +7 -3
@@ -3443,10 +3443,14 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) hdr_len +=sizeof (struct udphdr ); } -if (shinfo->gso_type &SKB_GSO_DODGY ) - gso_segs =DIV_ROUND_UP (skb->len - hdr_len, - shinfo->gso_size); +if (unlikely (shinfo->gso_type &SKB_GSO_DODGY )) { +int payload = skb->len - hdr_len; +/* Malicious packet. */ +if (payload <=0 ) +return ; + gso_segs =DIV_ROUND_UP (payload, shinfo->gso_size); + }qdisc_skb_cb (skb)->pkt_len += (gso_segs -1 ) * hdr_len; } }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 141/350 ipv4: ip_gre: Fix drops of small packets in ipgre_xmit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anton Danilov <[email protected]>
[ Upstream commit c4a14f6d9d17ad1e41a36182dd3b8a5fd91efbd7 ]
Regression Description:
Depending on the options specified for the GRE tunnel device, small packets may be dropped. This occurs because the pskb_network_may_pull function fails due to the packet's insufficient length.
For example, if only the okey option is specified for the tunnel device, original (before encapsulation) packets smaller than 28 bytes (including the IPv4 header) will be dropped. This happens because the required length is calculated relative to the network header, not the skb->head.
Here is how the required length is computed and checked:
* The pull_len variable is set to 28 bytes, consisting of:
* IPv4 header: 20 bytes
* GRE header with Key field: 8 bytes
* The pskb_network_may_pull function adds the network offset, shifting the checkable space further to the beginning of the network header and extending it to the beginning of the packet. As a result, the end of the checkable space occurs beyond the actual end of the packet.
Instead of ensuring that 28 bytes are present in skb->head, the function is requesting these 28 bytes starting from the network header. For small packets, this requested length exceeds the actual packet size, causing the check to fail and the packets to be dropped.
This issue affects both locally originated and forwarded packets in DMVPN-like setups.
How to reproduce (for local originated packets):
ip link add dev gre1 type gre ikey 1.9.8.4 okey 1.9.8.4 \
local <your-ip> remote 0.0.0.0 ip link set mtu 1400 dev gre1
ip link set up dev gre1
ip address add 192.168.13.1/24 dev gre1
ip neighbor add 192.168.13.2 lladdr <remote-ip> dev gre1 ping -s 1374 -c 10 192.168.13.2
tcpdump -vni gre1
tcpdump -vni <your-ext-iface> 'ip proto 47'
ip -s -s -d link show dev gre1
Solution:
Use the pskb_may_pull function instead the pskb_network_may_pull.
--- net/ipv4/ip_gre.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
net/ipv4/ip_gre.c +3 -3
@@ -711,11 +711,11 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb,if (skb_cow_head (skb,0 )) goto free_skb; - tnl_params = (const struct iphdr *)skb->data; - -if (!pskb_network_may_pull (skb, pull_len)) +if (!pskb_may_pull (skb, pull_len)) goto free_skb; + tnl_params = (const struct iphdr *)skb->data; +/* ip_tunnel_xmit() needs skb->data pointing to gre header. */ skb_pull (skb, pull_len);skb_reset_mac_header (skb);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 142/350 sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <[email protected]>
[ Upstream commit 8beee4d8dee76b67c75dc91fd8185d91e845c160 ]
In sctp_listen_start() invoked by sctp_inet_listen(), it should set the sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.
Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash is NULL.
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617 Call Trace: <TASK> __sys_listen_socket net/socket.c:1883 [inline] __sys_listen+0x1b7/0x230 net/socket.c:1894 __do_sys_listen net/socket.c:1902 [inline]
--- net/sctp/socket.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/sctp/socket.c +3 -1
@@ -7845,8 +7845,10 @@ static int sctp_listen_start(struct sock *sk, int backlog)*/ inet_sk_set_state (sk,SCTP_SS_LISTENING );if (!ep->base.bind_addr.port) { -if (sctp_autobind (sk)) +if (sctp_autobind (sk)) { +inet_sk_set_state (sk,SCTP_SS_CLOSED );return -EAGAIN ; + } }else {if (sctp_get_port (sk,inet_sk (sk)->inet_num)) {inet_sk_set_state (sk,SCTP_SS_CLOSED );
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 143/350 ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit 1c801e7f77445bc56e5e1fec6191fd4503534787 ]
Some time ago, we introduced the obey_preferred_dacs flag for choosing the DAC/pin pairs specified by the driver instead of parsing the paths. This works as expected, per se, but there have been a few cases where we forgot to set this flag while preferred_dacs table is already set up. It ended up with incorrect wiring and made us wondering why it doesn't work.
Basically, when the preferred_dacs table is provided, it means that the driver really wants to wire up to follow that. That is, the presence of the preferred_dacs table itself is already a "do-it" flag.
In this patch, we simply replace the evaluation of obey_preferred_dacs flag with the presence of preferred_dacs table for fixing the misbehavior. Another patch to drop of the obsoleted flag will follow.
--- sound/pci/hda/hda_generic.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
sound/pci/hda/hda_generic.c +2 -2
@@ -1383,7 +1383,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,struct nid_path *path;hda_nid_t pin = pins[i]; -if (!spec->obey_preferred_dacs) { +if (!spec->preferred_dacs) { path =snd_hda_get_path_from_idx (codec, path_idx[i]);if (path) { badness +=assign_out_path_ctls (codec, path);
@@ -1395,7 +1395,7 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,if (dacs[i]) {if (is_dac_already_used (codec, dacs[i])) badness += bad->shared_primary; - }else if (spec->obey_preferred_dacs) { + }else if (spec->preferred_dacs) { badness +=BAD_NO_PRIMARY_DAC ; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 144/350 ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
[ Upstream commit b3ebb007060f89d5a45c9b99f06a55e36a1945b5 ]
We received a regression report for System76 Pangolin (pang14) due to the recent fix for Tuxedo Sirius devices to support the top speaker. The reason was the conflicting PCI SSID, as often seen.
As a workaround, now the codec SSID is checked and the quirk is applied conditionally only to Sirius devices.
--- sound/pci/hda/patch_conexant.c | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-)
sound/pci/hda/patch_conexant.c +19 -5
@@ -730,6 +730,23 @@ static const struct hda_pintbl cxt_pincfg_sws_js201d[] = { {} }; +/* pincfg quirk for Tuxedo Sirius; +* unfortunately the (PCI) SSID conflicts with System76 Pangolin pang14, +* which has incompatible pin setup, so we check the codec SSID (luckily +* different one!) and conditionally apply the quirk here +*/ +static void cxt_fixup_sirius_top_speaker (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* ignore for incorrectly picked-up pang14 */ +if (codec->core.subsystem_id ==0x278212b3 ) +return ; +/* set up the top speaker pin */ +if (action ==HDA_FIXUP_ACT_PRE_PROBE ) +snd_hda_codec_set_pincfg (codec,0x1d ,0x82170111 ); +} +static const struct hda_fixup cxt_fixups[] = { [CXT_PINCFG_LENOVO_X200 ] = { .type =HDA_FIXUP_PINS ,
@@ -886,11 +903,8 @@ static const struct hda_fixup cxt_fixups[] = { .v.pins = cxt_pincfg_sws_js201d, }, [CXT_PINCFG_TOP_SPEAKER] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl []) { - {0x1d ,0x82170111 }, - { } - }, + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_sirius_top_speaker, }, };
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 145/350 f2fs: Require FMODE_WRITE for atomic write ioctls
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <[email protected]>
commit 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e upstream.
The F2FS ioctls for starting and committing atomic writes check for inode_owner_or_capable(), but this does not give LSMs like SELinux or Landlock an opportunity to deny the write access - if the caller's FSUID matches the inode's UID, inode_owner_or_capable() immediately returns true.
There are scenarios where LSMs want to deny a process the ability to write particular files, even files that the FSUID of the process owns; but this can currently partially be bypassed using atomic write ioctls in two ways:
- F2FS_IOC_START_ATOMIC_REPLACE + F2FS_IOC_COMMIT_ATOMIC_WRITE can truncate an inode to size 0
- F2FS_IOC_START_ATOMIC_WRITE + F2FS_IOC_ABORT_ATOMIC_WRITE can revert changes another process concurrently made to a file
Fix it by requiring FMODE_WRITE for these operations, just like for F2FS_IOC_MOVE_RANGE. Since any legitimate caller should only be using these ioctls when intending to write into the file, that seems unlikely to break anything.
--- fs/f2fs/file.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+)
fs/f2fs/file.c +15 -0
@@ -1716,6 +1716,9 @@ static int f2fs_ioc_start_atomic_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -1773,6 +1776,9 @@ static int f2fs_ioc_commit_atomic_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -1818,6 +1824,9 @@ static int f2fs_ioc_start_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -1853,6 +1862,9 @@ static int f2fs_ioc_release_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
@@ -1882,6 +1894,9 @@ static int f2fs_ioc_abort_volatile_write(struct file *filp)struct inode *inode =file_inode (filp);int ret; +if (!(filp->f_mode &FMODE_WRITE )) +return -EBADF ; +if (!inode_owner_or_capable (inode))return -EACCES ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 146/350 wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Kandybka <[email protected]>
[ Upstream commit 3f66f26703093886db81f0610b97a6794511917c ]
In 'ath9k_get_et_stats()', promote TX stats counters to 'u64' to avoid possible integer overflow. Compile tested only.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/ath/ath9k/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/ath9k/debug.c +2 -2
@@ -1329,11 +1329,11 @@ void ath9k_get_et_stats(struct ieee80211_hw *hw,struct ath_softc *sc = hw->priv;int i =0 ; - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_pkts_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_pkts_all); - data[i++] = (sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + + data[i++] = ((u64 )sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BE )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_BK )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VI )].tx_bytes_all + sc->debug.stats.txstats[PR_QNUM (IEEE80211_AC_VO )].tx_bytes_all);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 147/350 wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Toke Høiland-Jørgensen <[email protected]>
[ Upstream commit 94745807f3ebd379f23865e6dab196f220664179 ]
Syzbot points out that skb_trim() has a sanity check on the existing length of the skb, which can be uninitialised in some error paths. The intent here is clearly just to reset the length to zero before resubmitting, so switch to calling __skb_set_length(skb, 0) directly. In addition, __skb_set_length() already contains a call to skb_reset_tail_pointer(), so remove the redundant call.
The syzbot report came from ath9k_hif_usb_reg_in_cb(), but there's a similar usage of skb_trim() in ath9k_hif_usb_rx_cb(), change both while we're at it.
--- drivers/net/wireless/ath/ath9k/hif_usb.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/net/wireless/ath/ath9k/hif_usb.c +2 -4
@@ -718,8 +718,7 @@ static void ath9k_hif_usb_rx_cb(struct urb *urb) } resubmit: -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 );usb_anchor_urb (urb, &hif_dev->rx_submitted); ret =usb_submit_urb (urb,GFP_ATOMIC );
@@ -756,8 +755,7 @@ static void ath9k_hif_usb_reg_in_cb(struct urb *urb)case -ESHUTDOWN : goto free_skb;default : -skb_reset_tail_pointer (skb); -skb_trim (skb,0 ); +__skb_set_length (skb,0 ); goto resubmit; }
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 148/350 net: hisilicon: hip04: fix OF node leak in probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 17555297dbd5bccc93a01516117547e26a61caf1 ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hip04_eth.c +1 -0
@@ -861,6 +861,7 @@ static int hip04_mac_probe(struct platform_device *pdev) priv->tx_coalesce_timer.function = tx_done; priv->map =syscon_node_to_regmap (arg.np); +of_node_put (arg.np);if (IS_ERR (priv->map)) {dev_warn (d,"no syscon hisilicon,hip04-ppe\n" ); ret =PTR_ERR (priv->map);
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 149/350 net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11 ]
Driver is leaking OF node reference from of_parse_phandle_with_fixed_args() in hns_mac_get_info().
--- drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c +1 -0
@@ -937,6 +937,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb) mac_cb->cpld_ctrl =NULL ; }else { syscon =syscon_node_to_regmap (cpld_args.np); +of_node_put (cpld_args.np);if (IS_ERR_OR_NULL (syscon)) {dev_dbg (mac_cb->dev,"no cpld-syscon found!\n" ); mac_cb->cpld_ctrl =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 150/350 net: hisilicon: hns_mdio: fix OF node leak in probe()
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <[email protected]>
[ Upstream commit e62beddc45f487b9969821fad3a0913d9bc18a2f ]
Driver is leaking OF node reference fromof_parse_phandle_with_fixed_args() in probe().
--- drivers/net/ethernet/hisilicon/hns_mdio.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/hisilicon/hns_mdio.c +1 -0
@@ -508,6 +508,7 @@ static int hns_mdio_probe(struct platform_device *pdev)MDIO_SC_RESET_ST ; } } +of_node_put (reg_args.np); }else {dev_warn (&pdev->dev,"find syscon ret = %#x\n" , ret); mdio_dev->subctrl_vbase =NULL ;
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 151/350 ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit 5accb265f7a1b23e52b0ec42313d1e12895552f4 ]
ACPICA commit 2802af722bbde7bf1a7ac68df68e179e2555d361
If acpi_ps_get_next_namepath() fails, the previously allocated union acpi_parse_object needs to be freed before returning the status code.
The issue was first being reported on the Linux ACPI mailing list:
--- drivers/acpi/acpica/psargs.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/acpica/psargs.c +8 -0
@@ -820,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_NOT_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + } }else {/* Single complex argument, nothing returned */
@@ -854,6 +858,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,acpi_ps_get_next_namepath (walk_state, parser_state, arg,ACPI_POSSIBLE_METHOD_CALL ); +if (ACPI_FAILURE (status)) { +acpi_ps_free_op (arg); +return_ACPI_STATUS (status); + }if (arg->common.aml_opcode ==AML_INT_METHODCALL_OP ) {
Signature · 1 line
2.43.0
Greg Kroah-Hartman
maintainerPATCH 152/350 ACPICA: Fix memory leak if acpi_ps_get_next_field() fails
In reply to Greg Kroah-Hartman4.19-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <[email protected]>
[ Upstream commit e6169a8ffee8a012badd8c703716e761ce851b15 ]
ACPICA commit 1280045754264841b119a5ede96cd005bc09b5a7
If acpi_ps_get_next_field() fails, the previously created field list needs to be properly disposed before returning the status code.
--- drivers/acpi/acpica/psargs.c | 39 ++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+)
drivers/acpi/acpica/psargs.c +39 -0
@@ -25,6 +25,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);static union acpi_parse_object *acpi_ps_get_next_field (struct acpi_parse_state *parser_state); +static void acpi_ps_free_field_list (union acpi_parse_object *start); +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_package_length
@@ -683,6 +685,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_statereturn_PTR (field); } +/******************************************************************************* +* +* FUNCTION: acpi_ps_free_field_list +* +* PARAMETERS: start - First Op in field list +* +* RETURN: None. +* +* DESCRIPTION: Free all Op objects inside a field list. +* +******************************************************************************/ + +static void acpi_ps_free_field_list (union acpi_parse_object *start) +{ +union acpi_parse_object *cur = start; +union acpi_parse_object *next; +union acpi_parse_object *arg; + +while (cur) { + next = cur->common.next; + +/* AML_INT_CONNECTION_OP can have a single argument */ + + arg =acpi_ps_get_arg (cur,0 ); +if (arg) { +acpi_ps_free_op (arg); + } + +acpi_ps_free_op (cur); + cur = next; + } +} +/******************************************************************************* * * FUNCTION: acpi_ps_get_next_arg
@@ -751,6 +786,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,while (parser_state->aml < parser_state->pkg_end) { field =acpi_ps_get_next_field (parser_state);if (!field) { +if (arg) { +acpi_ps_free_field_list (arg); + } +return_ACPI_STATUS (AE_NO_MEMORY ); }
Signature · 1 line
2.43.0