Linux 5.4.139
Greg Kroah-Hartman
maintainerI'm announcing the release of the 5.4.139 kernel.
All users of the 5.4 kernel series must upgrade.
The updated 5.4.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.4.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
thanks,
greg k-h
------------
Makefile | 2 drivers/firmware/arm_scmi/bus.c | 3 drivers/firmware/arm_scmi/driver.c | 8 - drivers/net/ethernet/qlogic/qed/qed_mcp.c | 23 ++- drivers/net/usb/r8152.c | 3 drivers/nvme/host/trace.h | 6 drivers/spi/spi-mt65xx.c | 19 -- drivers/spi/spi-stm32.c | 15 +- drivers/watchdog/iTCO_wdt.c | 12 - fs/btrfs/block-group.c | 2 fs/btrfs/ctree.c | 2 fs/btrfs/disk-io.c | 2 fs/btrfs/extent_io.c | 2 fs/btrfs/free-space-cache.c | 2 fs/btrfs/inode.c | 115 +---------------- fs/btrfs/qgroup.c | 2 fs/btrfs/tree-log.c | 107 ++++++--------- fs/btrfs/tree-log.h | 14 -- include/acpi/acpi_bus.h | 3 include/linux/mfd/rt5033-private.h | 4 kernel/bpf/verifier.c | 65 ++++++++- net/bluetooth/hci_core.c | 16 +- net/core/skbuff.c | 5 sound/soc/codecs/tlv320aic31xx.h | 4 tools/testing/selftests/bpf/test_verifier.c | 2 tools/testing/selftests/bpf/verifier/bounds.c | 65 +++++++++ tools/testing/selftests/bpf/verifier/dead_code.c | 2 tools/testing/selftests/bpf/verifier/jmp32.c | 22 +++ tools/testing/selftests/bpf/verifier/jset.c | 10 - tools/testing/selftests/bpf/verifier/unpriv.c | 2 tools/testing/selftests/bpf/verifier/value_ptr_arith.c | 7 - 31 files changed, 296 insertions(+), 250 deletions(-)
Alain Volmat (1):
spi: stm32h7: fix full duplex irq handler handling
Axel Lin (1):
regulator: rt5033: Fix n_voltages settings for BUCK and LDO
Cristian Marussi (1):
firmware: arm_scmi: Add delayed response status check
Daniel Borkmann (4):
bpf: Inherit expanded/patched seen count from old aux data
bpf: Do not mark insn as seen under speculative path verification
bpf: Fix leakage under speculation on mispredicted branches bpf, selftests: Adjust few selftest outcomes wrt unreachable code
Filipe Manana (3):
btrfs: do not commit logs and transactions during link and rename operations
btrfs: fix race causing unnecessary inode logging during link and rename
btrfs: fix lost inode on log replay after mix of fsync, rename and inode eviction
Greg Kroah-Hartman (3):
Revert "Bluetooth: Shutdown controller after workqueues are flushed or cancelled" Revert "watchdog: iTCO_wdt: Account for rebooting on second timeout" Linux 5.4.139
Guenter Roeck (1):
spi: mediatek: Fix fifo transfer
Jia He (1):
qed: fix possible unpaired spin_{un}lock_bh in _qed_mcp_cmd_and_union()
John Fastabend (2):
bpf: Test_verifier, add alu32 bounds tracking tests
bpf, selftests: Add a verifier test for assigning 32bit reg states to 64bit ones
Keith Busch (1):
nvme: fix nvme_setup_command metadata trace event
Kyle Russell (1):
ASoC: tlv320aic31xx: fix reversed bclk/wclk master bits
Linus Torvalds (1):
ACPI: fix NULL pointer dereference
Pravin B Shelar (1):
net: Fix zero-copy head len calculation.
Randy Dunlap (1):
btrfs: delete duplicated words + other fixes in comments
Sudeep Holla (1):
firmware: arm_scmi: Ensure drivers provide a probe function
Takashi Iwai (1):
r8152: Fix potential PM refcount imbalance
Greg Kroah-Hartman
maintainerMakefile +1 -1
@@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 4 -SUBLEVEL = 138 +SUBLEVEL = 139 EXTRAVERSION = NAME = Kleptomaniac Octopus
drivers/firmware/arm_scmi/bus.c +3 -0
@@ -100,6 +100,9 @@ int scmi_driver_register(struct scmi_driver *driver, struct module *owner, {int retval; +if (!driver->probe) +return -EINVAL ; + driver->driver.bus = &scmi_bus_type; driver->driver.name = driver->name; driver->driver.owner = owner;
drivers/firmware/arm_scmi/driver.c +6 -2
@@ -515,8 +515,12 @@ int scmi_do_xfer_with_response(const struct scmi_handle *handle, xfer->async_done = &async_response; ret =scmi_do_xfer (handle, xfer); -if (!ret && !wait_for_completion_timeout (xfer->async_done, timeout)) - ret = -ETIMEDOUT ; +if (!ret) { +if (!wait_for_completion_timeout (xfer->async_done, timeout)) + ret = -ETIMEDOUT ; +else if (xfer->hdr.status) + ret =scmi_to_linux_errno (xfer->hdr.status); + } xfer->async_done =NULL ;return ret;
drivers/net/ethernet/qlogic/qed/qed_mcp.c +17 -6
@@ -498,14 +498,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,spin_lock_bh (&p_hwfn->mcp_info->cmd_lock); -if (!qed_mcp_has_pending_cmd (p_hwfn)) +if (!qed_mcp_has_pending_cmd (p_hwfn)) { +spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);break ; + } rc =qed_mcp_update_pending_cmd (p_hwfn, p_ptt); -if (!rc) +if (!rc) { +spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);break ; -else if (rc != -EAGAIN ) + }else if (rc != -EAGAIN ) { goto err; + }spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);
@@ -522,6 +526,8 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,return -EAGAIN ; } +spin_lock_bh (&p_hwfn->mcp_info->cmd_lock); +/* Send the mailbox command */ qed_mcp_reread_offsets (p_hwfn, p_ptt); seq_num = ++p_hwfn->mcp_info->drv_mb_seq;
@@ -548,14 +554,18 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,spin_lock_bh (&p_hwfn->mcp_info->cmd_lock); -if (p_cmd_elem->b_is_completed) +if (p_cmd_elem->b_is_completed) { +spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);break ; + } rc =qed_mcp_update_pending_cmd (p_hwfn, p_ptt); -if (!rc) +if (!rc) { +spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);break ; -else if (rc != -EAGAIN ) + }else if (rc != -EAGAIN ) { goto err; + }spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock); }while (++cnt < max_retries);
@@ -576,6 +586,7 @@ _qed_mcp_cmd_and_union(struct qed_hwfn *p_hwfn,return -EAGAIN ; } +spin_lock_bh (&p_hwfn->mcp_info->cmd_lock);qed_mcp_cmd_del_elem (p_hwfn, p_cmd_elem);spin_unlock_bh (&p_hwfn->mcp_info->cmd_lock);
drivers/net/usb/r8152.c +2 -1
@@ -4317,9 +4317,10 @@ static int rtl8152_close(struct net_device *netdev) tp->rtl_ops.down (tp);mutex_unlock (&tp->control); + } +if (!res)usb_autopm_put_interface (tp->intf); - }free_all_mem (tp);
drivers/nvme/host/trace.h +3 -3
@@ -56,7 +56,7 @@ TRACE_EVENT(nvme_setup_cmd, __field(u8, fctype) __field(u16, cid) __field(u32, nsid) - __field(u64, metadata) + __field(bool, metadata)__array (u8, cdw10,24 ) ), TP_fast_assign(
@@ -66,13 +66,13 @@ TRACE_EVENT(nvme_setup_cmd, __entry->flags = cmd->common.flags; __entry->cid = cmd->common.command_id; __entry->nsid =le32_to_cpu (cmd->common.nsid); - __entry->metadata =le64_to_cpu (cmd->common.metadata); + __entry->metadata = !!blk_integrity_rq (req); __entry->fctype = cmd->fabrics.fctype;__assign_disk_name (__entry->disk, req->rq_disk);memcpy (__entry->cdw10, &cmd->common.cdw10,sizeof (__entry->cdw10)); ), - TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%llx, cmd=(%s %s)", + TP_printk("nvme%d: %sqid=%d, cmdid=%u, nsid=%u, flags=0x%x, meta=0x%x, cmd=(%s %s)", __entry->ctrl_id, __print_disk_name(__entry->disk), __entry->qid, __entry->cid, __entry->nsid, __entry->flags, __entry->metadata,
drivers/spi/spi-mt65xx.c +5 -14
@@ -426,24 +426,15 @@ static int mtk_spi_fifo_transfer(struct spi_master *master,mtk_spi_prepare_transfer (master, xfer);mtk_spi_setup_packet (master); - cnt = xfer->len /4 ; -if (xfer->tx_buf) +if (xfer->tx_buf) { + cnt = xfer->len /4 ;iowrite32_rep (mdata->base +SPI_TX_DATA_REG , xfer->tx_buf, cnt); - -if (xfer->rx_buf) -ioread32_rep (mdata->base +SPI_RX_DATA_REG , xfer->rx_buf, cnt); - - remainder = xfer->len %4 ; -if (remainder >0 ) { - reg_val =0 ; -if (xfer->tx_buf) { + remainder = xfer->len %4 ; +if (remainder >0 ) { + reg_val =0 ;memcpy (®_val, xfer->tx_buf + (cnt *4 ), remainder);writel (reg_val, mdata->base +SPI_TX_DATA_REG ); } -if (xfer->rx_buf) { - reg_val =readl (mdata->base +SPI_RX_DATA_REG ); -memcpy (xfer->rx_buf + (cnt *4 ), ®_val, remainder); - } }mtk_spi_enable_transfer (master);
drivers/spi/spi-stm32.c +9 -6
@@ -913,15 +913,18 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) ier =readl_relaxed (spi->base +STM32H7_SPI_IER ); mask = ier; -/* EOTIE is triggered on EOT, SUSP and TXC events. */ +/* +* EOTIE enables irq from EOT, SUSP and TXC events. We need to set +* SUSP to acknowledge it later. TXC is automatically cleared +*/ + mask |=STM32H7_SPI_SR_SUSP ;/* -* When TXTF is set, DXPIE and TXPIE are cleared. So in case of -* Full-Duplex, need to poll RXP event to know if there are remaining -* data, before disabling SPI. +* DXPIE is set in Full-Duplex, one IT will be raised if TXP and RXP +* are set. So in case of Full-Duplex, need to poll TXP and RXP event. */ -if (spi->rx_buf && !spi->cur_usedma) - mask |=STM32H7_SPI_SR_RXP ; +if ((spi->cur_comm ==SPI_FULL_DUPLEX ) && !spi->cur_usedma) + mask |=STM32H7_SPI_SR_TXP |STM32H7_SPI_SR_RXP ;if (!(sr & mask)) { dev_warn(spi->dev, "spurious IT (sr=0x%08x, ier=0x%08x)\n",
drivers/watchdog/iTCO_wdt.c +3 -9
@@ -72,8 +72,6 @@#define TCOBASE (p) ((p)->tco_res->start)/* SMI Control and Enable Register */ #define SMI_EN (p) ((p)->smi_res->start) -#define TCO_EN (1 << 13) -#define GBL_SMI_EN (1 << 0)#define TCO_RLD (p) (TCOBASE(p) + 0x00)/* TCO Timer Reload/Curr. Value */ #define TCOv1_TMR (p) (TCOBASE(p) + 0x01)/* TCOv1 Timer Initial Value*/
@@ -346,12 +344,8 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t) tmrval =seconds_to_ticks (p, t); -/* -* If TCO SMIs are off, the timer counts down twice before rebooting. -* Otherwise, the BIOS generally reboots when the SMI triggers. -*/ -if (p->smi_res && - (SMI_EN (p) & (TCO_EN |GBL_SMI_EN )) != (TCO_EN |GBL_SMI_EN )) +/* For TCO v1 the timer counts down twice before rebooting */ +if (p->iTCO_version ==1 ) tmrval /=2 ;/* from the specs: */
@@ -516,7 +510,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev)* Disables TCO logic generating an SMI# */ val32 =inl (SMI_EN (p)); - val32 &= ~TCO_EN ;/* Turn off SMI clearing watchdog */ + val32 &=0xffffdfff ;/* Turn off SMI clearing watchdog */ outl (val32,SMI_EN (p)); }
fs/btrfs/block-group.c +1 -1
@@ -2637,7 +2637,7 @@ int btrfs_write_dirty_block_groups(struct btrfs_trans_handle *trans)* finished yet (no block group item in the extent tree * yet, etc). If this is the case, wait for all free * space endio workers to finish and retry. This is a -* a very rare case so no need for a more efficient and +* very rare case so no need for a more efficient and * complex approach. */ if (ret == -ENOENT ) {
fs/btrfs/ctree.c +1 -1
@@ -5232,7 +5232,7 @@ int btrfs_search_forward(struct btrfs_root *root, struct btrfs_key *min_key, slot--;/* * check this node pointer against the min_trans parameters. -* If it is too old, old, skip to the next one. +* If it is too old, skip to the next one. */ while (slot < nritems) {u64 gen;
fs/btrfs/disk-io.c +1 -1
@@ -2816,7 +2816,7 @@ int open_ctree(struct super_block *sb, }/* -* Verify the type first, if that or the the checksum value are +* Verify the type first, if that or the checksum value are * corrupted, we'll find out */ csum_type =btrfs_super_csum_type ((struct btrfs_super_block *)bh->b_data);
fs/btrfs/extent_io.c +1 -1
@@ -3152,7 +3152,7 @@ static int __do_readpage(struct extent_io_tree *tree,/* * If we have a file range that points to a compressed extent -* and it's followed by a consecutive file range that points to +* and it's followed by a consecutive file range that points * to the same compressed extent (possibly with a different * offset and/or length, so it either points to the whole extent * or only part of it), we must make sure we do not submit a
fs/btrfs/free-space-cache.c +1 -1
@@ -1339,7 +1339,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode,/* * at this point the pages are under IO and we're happy, -* The caller is responsible for waiting on them and updating the +* The caller is responsible for waiting on them and updating * the cache and the inode */ io_ctl->entries = entries;
fs/btrfs/inode.c +13 -102
186 lines not on this page · raw message
fs/btrfs/qgroup.c +1 -1
@@ -2262,7 +2262,7 @@ static int qgroup_update_refcnt(struct btrfs_fs_info *fs_info,* Update qgroup rfer/excl counters. * Rfer update is easy, codes can explain themselves. * -* Excl update is tricky, the update is split into 2 part. +* Excl update is tricky, the update is split into 2 parts. * Part 1: Possible exclusive <-> sharing detect: * | A | !A | * -------------------------------------
fs/btrfs/tree-log.c +46 -61
141 lines not on this page · raw message
fs/btrfs/tree-log.h +4 -10
@@ -16,6 +16,7 @@ struct btrfs_log_ctx {int log_ret;int log_transid;bool log_new_dentries; +bool logging_new_name;struct inode *inode;struct list_head list; };
@@ -26,6 +27,7 @@ static inline void btrfs_init_log_ctx(struct btrfs_log_ctx *ctx, ctx->log_ret =0 ; ctx->log_transid =0 ; ctx->log_new_dentries = false; + ctx->logging_new_name = false; ctx->inode = inode;INIT_LIST_HEAD (&ctx->list); }
@@ -67,16 +69,8 @@ void btrfs_record_unlink_dir(struct btrfs_trans_handle *trans, int for_rename);void btrfs_record_snapshot_destroy (struct btrfs_trans_handle *trans,struct btrfs_inode *dir); -/* Return values for btrfs_log_new_name() */ -enum { -BTRFS_DONT_NEED_TRANS_COMMIT , -BTRFS_NEED_TRANS_COMMIT , -BTRFS_DONT_NEED_LOG_SYNC , -BTRFS_NEED_LOG_SYNC , -}; -int btrfs_log_new_name (struct btrfs_trans_handle *trans, +void btrfs_log_new_name (struct btrfs_trans_handle *trans,struct btrfs_inode *inode,struct btrfs_inode *old_dir, -struct dentry *parent, -bool sync_log,struct btrfs_log_ctx *ctx); +struct dentry *parent);#endif
include/acpi/acpi_bus.h +2 -1
@@ -681,7 +681,8 @@ acpi_dev_get_first_match_dev(const char *hid, const char *uid, s64 hrv);static inline void acpi_dev_put (struct acpi_device *adev) { -put_device (&adev->dev); +if (adev) +put_device (&adev->dev); }#else /* CONFIG_ACPI */
include/linux/mfd/rt5033-private.h +2 -2
@@ -200,13 +200,13 @@ enum rt5033_reg {#define RT5033_REGULATOR_BUCK_VOLTAGE_MIN 1000000U#define RT5033_REGULATOR_BUCK_VOLTAGE_MAX 3000000U#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP 100000U -#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 32 +#define RT5033_REGULATOR_BUCK_VOLTAGE_STEP_NUM 21/* RT5033 regulator LDO output voltage uV */ #define RT5033_REGULATOR_LDO_VOLTAGE_MIN 1200000U#define RT5033_REGULATOR_LDO_VOLTAGE_MAX 3000000U#define RT5033_REGULATOR_LDO_VOLTAGE_STEP 100000U -#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 32 +#define RT5033_REGULATOR_LDO_VOLTAGE_STEP_NUM 19/* RT5033 regulator SAFE LDO output voltage uV */ #define RT5033_REGULATOR_SAFE_LDO_VOLTAGE 4900000U
kernel/bpf/verifier.c +58 -7
117 lines not on this page · raw message
net/bluetooth/hci_core.c +8 -8
@@ -1672,6 +1672,14 @@ int hci_dev_do_close(struct hci_dev *hdev)BT_DBG ("%s %p" , hdev->name, hdev); +if (!hci_dev_test_flag (hdev,HCI_UNREGISTER ) && + !hci_dev_test_flag (hdev,HCI_USER_CHANNEL ) && +test_bit (HCI_UP , &hdev->flags)) { +/* Execute vendor specific shutdown routine */ +if (hdev->shutdown) + hdev->shutdown (hdev); + } +cancel_delayed_work (&hdev->power_off);hci_request_cancel_all (hdev);
@@ -1745,14 +1753,6 @@ int hci_dev_do_close(struct hci_dev *hdev)clear_bit (HCI_INIT , &hdev->flags); } -if (!hci_dev_test_flag (hdev,HCI_UNREGISTER ) && - !hci_dev_test_flag (hdev,HCI_USER_CHANNEL ) && -test_bit (HCI_UP , &hdev->flags)) { -/* Execute vendor specific shutdown routine */ -if (hdev->shutdown) - hdev->shutdown (hdev); - } -/* flush cmd work */ flush_work (&hdev->cmd_work);
net/core/skbuff.c +4 -1
@@ -2921,8 +2921,11 @@ skb_zerocopy_headlen(const struct sk_buff *from)if (!from->head_frag ||skb_headlen (from) <L1_CACHE_BYTES || -skb_shinfo (from)->nr_frags >=MAX_SKB_FRAGS ) +skb_shinfo (from)->nr_frags >=MAX_SKB_FRAGS ) { hlen =skb_headlen (from); +if (!hlen) + hlen = from->len; + }if (skb_has_frag_list (from)) hlen = from->len;
sound/soc/codecs/tlv320aic31xx.h +2 -2
@@ -151,8 +151,8 @@ struct aic31xx_pdata {#define AIC31XX_WORD_LEN_24BITS 0x02#define AIC31XX_WORD_LEN_32BITS 0x03#define AIC31XX_IFACE1_MASTER_MASK GENMASK(3, 2) -#define AIC31XX_BCLK_MASTER BIT(2) -#define AIC31XX_WCLK_MASTER BIT(3) +#define AIC31XX_BCLK_MASTER BIT(3) +#define AIC31XX_WCLK_MASTER BIT(2)/* AIC31XX_DATA_OFFSET */ #define AIC31XX_DATA_OFFSET_MASK GENMASK(7, 0)
tools/testing/selftests/bpf/test_verifier.c +1 -1
@@ -980,7 +980,7 @@ static void do_test_single(struct bpf_test *test, bool unpriv, } } -if (test->insn_processed) { +if (!unpriv && test->insn_processed) {uint32_t insn_processed;char *proc;
tools/testing/selftests/bpf/verifier/bounds.c +65 -0
68 lines not on this page · raw message
tools/testing/selftests/bpf/verifier/dead_code.c +2 -0
@@ -8,6 +8,8 @@ BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 10, -4), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R9 !read_ok", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 7, },
tools/testing/selftests/bpf/verifier/jmp32.c +22 -0
@@ -72,6 +72,8 @@BPF_LDX_MEM (BPF_B ,BPF_REG_8 ,BPF_REG_9 ,0 ), BPF_EXIT_INSN(), }, + .errstr_unpriv ="R9 !read_ok" , + .result_unpriv = REJECT, .result = ACCEPT, }, {
@@ -135,6 +137,8 @@BPF_LDX_MEM (BPF_B ,BPF_REG_8 ,BPF_REG_9 ,0 ), BPF_EXIT_INSN(), }, + .errstr_unpriv ="R9 !read_ok" , + .result_unpriv = REJECT, .result = ACCEPT, }, {
@@ -198,6 +202,8 @@BPF_LDX_MEM (BPF_B ,BPF_REG_8 ,BPF_REG_9 ,0 ), BPF_EXIT_INSN(), }, + .errstr_unpriv ="R9 !read_ok" , + .result_unpriv = REJECT, .result = ACCEPT, }, {
@@ -265,6 +271,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -333,6 +341,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -401,6 +411,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -469,6 +481,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -537,6 +551,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -605,6 +621,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -673,6 +691,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
@@ -741,6 +761,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R0 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 2, },
tools/testing/selftests/bpf/verifier/jset.c +6 -4
@@ -82,8 +82,8 @@ BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, - .retval_unpriv = 1, - .result_unpriv = ACCEPT, + .errstr_unpriv = "R9 !read_ok", + .result_unpriv = REJECT, .retval = 1, .result = ACCEPT, },
@@ -141,7 +141,8 @@ BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, - .result_unpriv = ACCEPT, + .errstr_unpriv = "R9 !read_ok", + .result_unpriv = REJECT, .result = ACCEPT, }, {
@@ -162,6 +163,7 @@ BPF_EXIT_INSN(), }, .prog_type = BPF_PROG_TYPE_SOCKET_FILTER, - .result_unpriv = ACCEPT, + .errstr_unpriv = "R9 !read_ok", + .result_unpriv = REJECT, .result = ACCEPT, },
tools/testing/selftests/bpf/verifier/unpriv.c +2 -0
@@ -418,6 +418,8 @@ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_7, 0), BPF_EXIT_INSN(), }, + .errstr_unpriv = "R7 invalid mem access 'inv'", + .result_unpriv = REJECT, .result = ACCEPT, .retval = 0, },
tools/testing/selftests/bpf/verifier/value_ptr_arith.c +4 -3
@@ -120,7 +120,7 @@ .fixup_map_array_48b = { 1 }, .result = ACCEPT, .result_unpriv = REJECT, - .errstr_unpriv = "R2 tried to add from different maps, paths or scalars", + .errstr_unpriv = "R2 pointer comparison prohibited", .retval = 0, }, {
@@ -159,7 +159,8 @@BPF_MOV64_IMM (BPF_REG_0 ,0 ),BPF_EXIT_INSN (),// fake-dead code; targeted from branch A to -// prevent dead code sanitization +// prevent dead code sanitization, rejected +// via branch B however BPF_LDX_MEM (BPF_B ,BPF_REG_0 ,BPF_REG_0 ,0 ),BPF_MOV64_IMM (BPF_REG_0 ,0 ), BPF_EXIT_INSN(),
@@ -167,7 +168,7 @@ .fixup_map_array_48b = { 1 }, .result = ACCEPT, .result_unpriv = REJECT, - .errstr_unpriv = "R2 tried to add from different maps, paths or scalars", + .errstr_unpriv = "R0 invalid mem access 'inv'", .retval = 0, }, {