4.4.129-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.4.129-stable review
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.129-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.4.129-rc1
Greg Thelen <[email protected]>
writeback: safer lock nesting
Amir Goldstein <[email protected]>
fanotify: fix logic of events on child
wangguang <[email protected]>
ext4: bugfix for mmaped pages in mpage_release_unused_pages()
Matthew Wilcox <[email protected]>
mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
Michal Hocko <[email protected]>
mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
Ian Kent <[email protected]>
autofs: mount point create should honour passed in mode
Al Viro <[email protected]>
Don't leak MNT_INTERNAL away from internal mounts
Al Viro <[email protected]>
rpc_pipefs: fix double-dput()
Al Viro <[email protected]>
hypfs_kill_super(): deal with failed allocations
Al Viro <[email protected]>
jffs2_kill_sb(): deal with failed allocations
Michael Ellerman <[email protected]>
powerpc/lib: Fix off-by-one in alternate feature patching
Michael Neuling <[email protected]>
powerpc/eeh: Fix enabling bridge MMIO windows
Matt Redfearn <[email protected]>
MIPS: memset.S: Fix clobber of v1 in last_fixup
Matt Redfearn <[email protected]>
MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
Matt Redfearn <[email protected]>
MIPS: memset.S: EVA & fault support for small_memset
Matt Redfearn <[email protected]>
MIPS: uaccess: Add micromips clobbers to bzero invocation
Rodrigo Rivas Costa <[email protected]>
HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
David Wang <[email protected]>
ALSA: hda - New VIA controller suppor no-snoop path
Takashi Iwai <[email protected]>
ALSA: rawmidi: Fix missing input substream checks in compat ioctls
Fabián Inostroza <[email protected]>
ALSA: line6: Use correct endpoint type for midi output
Theodore Ts'o <[email protected]>
ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
Jan Kara <[email protected]>
ext4: fix crashes in dioread_nolock mode
Paul Parsons <[email protected]>
drm/radeon: Fix PCIe lane width calculation
Theodore Ts'o <[email protected]>
ext4: don't allow r/w mounts if metadata blocks overlap the superblock
Alex Williamson <[email protected]>
vfio/pci: Virtualize Maximum Read Request Size
Alex Williamson <[email protected]>
vfio/pci: Virtualize Maximum Payload Size
Alex Williamson <[email protected]>
vfio-pci: Virtualize PCIe & AF FLR
Takashi Iwai <[email protected]>
ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
Takashi Iwai <[email protected]>
ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
Takashi Iwai <[email protected]>
ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
Takashi Iwai <[email protected]>
ALSA: pcm: Avoid potential races between OSS ioctls and read/write
Takashi Iwai <[email protected]>
ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
Nicholas Mc Guire <[email protected]>
ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
Igor Pylypiv <[email protected]>
watchdog: f71808e_wdt: Fix WD_EN register read
Mikhail Lappo <[email protected]>
thermal: imx: Fix race condition in imx_thermal_probe()
Boris Brezillon <[email protected]>
clk: bcm2835: De-assert/assert PLL reset signal when appropriate
Richard Genoud <[email protected]>
clk: mvebu: armada-38x: add support for missing clocks
Ralph Sennhauser <[email protected]>
clk: mvebu: armada-38x: add support for 1866MHz variants
Alex Smith <[email protected]>
mmc: jz4740: Fix race condition in IRQ mask update
Lu Baolu <[email protected]>
iommu/vt-d: Fix a potential memory leak
Krzysztof Mazur <[email protected]>
um: Use POSIX ucontext_t instead of struct ucontext
Maxime Jayat <[email protected]>
dmaengine: at_xdmac: fix rare residue corruption
Bart Van Assche <[email protected]>
IB/srp: Fix completion vector assignment algorithm
Bart Van Assche <[email protected]>
IB/srp: Fix srp_abort()
Takashi Iwai <[email protected]>
ALSA: pcm: Fix UAF at PCM release via PCM timer access
Roland Dreier <[email protected]>
RDMA/ucma: Don't allow setting RDMA_OPTION_IB_PATH without an RDMA device
Theodore Ts'o <[email protected]>
ext4: fail ext4_iget for root directory if unallocated
Theodore Ts'o <[email protected]>
ext4: add validity checks for bitmap block numbers
Theodore Ts'o <[email protected]>
ext4: don't update checksum of new initialized bitmaps
Theodore Ts'o <[email protected]>
jbd2: if the journal is aborted then don't allow update of the log tail
Theodore Ts'o <[email protected]>
random: use a tighter cap in credit_entropy_bits_safe()
Mika Westerberg <[email protected]>
thunderbolt: Resume control channel after hibernation image is created
James Kelly <[email protected]>
ASoC: ssm2602: Replace reg_default_raw with reg_default
Aaron Ma <[email protected]>
HID: core: Fix size as type u32
Aaron Ma <[email protected]>
HID: Fix hid_report_len usage
Nicholas Piggin <[email protected]>
powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
Nicholas Piggin <[email protected]>
powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
Nicholas Piggin <[email protected]>
powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
Aaron Ma <[email protected]>
HID: i2c-hid: fix size check and type usage
Thinh Nguyen <[email protected]>
usb: dwc3: pci: Properly cleanup resource
Zhengjun Xing <[email protected]>
USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
Mika Westerberg <[email protected]>
ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
Hans de Goede <[email protected]>
ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
Dan Carpenter <[email protected]>
regmap: Fix reversed bounds check in regmap_raw_write()
Jason Andryuk <[email protected]>
xen-netfront: Fix hang on device removal
Santiago Esteban <[email protected]>
ARM: dts: at91: sama5d4: fix pinctrl compatible string
Nicolas Ferre <[email protected]>
ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
Heinrich Schuchardt <[email protected]>
usb: musb: gadget: misplaced out of bounds check
Vlastimil Babka <[email protected]>
mm, slab: reschedule cache_reap() on the same CPU
Eric Biggers <[email protected]>
ipc/shm: fix use-after-free of shm file via remap_file_pages()
Takashi Iwai <[email protected]>
resource: fix integer overflow at reallocation
Andrew Morton <[email protected]>
fs/reiserfs/journal.c: add missing resierfs_warning() arg
Richard Weinberger <[email protected]>
ubi: Reject MLC NAND
Romain Izard <[email protected]>
ubi: Fix error for write access
Richard Weinberger <[email protected]>
ubi: fastmap: Don't flush fastmap work on detach
Richard Weinberger <[email protected]>
ubifs: Check ubifs_wbuf_sync() return code
Tejun Heo <[email protected]>
tty: make n_tty_read() always abort if hangup is in progress
Ville Syrjälä <[email protected]>
x86/hweight: Don't clobber %rdi
Borislav Petkov <[email protected]>
x86/hweight: Get rid of the special calling convention
Phil Elwell <[email protected]>
lan78xx: Correctly indicate invalid OTP
Tejaswi Tanikella <[email protected]>
slip: Check if rstate is initialized before uncompressing
Bassem Boubaker <[email protected]>
cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
Marek Szyprowski <[email protected]>
hwmon: (ina2xx) Fix access to uninitialized mutex
Sudhir Sreedharan <[email protected]>
rtl8187: Fix NULL pointer dereference in priv->conf_mutex
Al Viro <[email protected]>
getname_kernel() needs to make sure that ->name != ->iname in long case
Vasily Gorbik <[email protected]>
s390/ipl: ensure loadparm valid flag is set
Julian Wiedmann <[email protected]>
s390/qdio: don't merge ERROR output buffers
Julian Wiedmann <[email protected]>
s390/qdio: don't retry EQBS after CCQ 96
Tetsuo Handa <[email protected]>
block/loop: fix deadlock after loop_set_status
Greg Kroah-Hartman <[email protected]>
Revert "perf tests: Decompress kernel module before objdump"
Arnd Bergmann <[email protected]>
radeon: hide pointless #warning when compile testing
Adrian Hunter <[email protected]>
perf intel-pt: Fix timestamp following overflow
Adrian Hunter <[email protected]>
perf intel-pt: Fix error recovery from missing TIP packet
Adrian Hunter <[email protected]>
perf intel-pt: Fix sync_switch
Adrian Hunter <[email protected]>
perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
Helge Deller <[email protected]>
parisc: Fix out of array access in match_pci_device()
Mauro Carvalho Chehab <[email protected]>
media: v4l2-compat-ioctl32: don't oops on overlay
-------------
Diffstat:
Makefile | 4 +- arch/arm/boot/dts/at91sam9g25.dtsi | 2 +- arch/arm/boot/dts/sama5d4.dtsi | 2 +- arch/mips/include/asm/uaccess.h | 11 +- arch/mips/lib/memset.S | 11 +- arch/parisc/kernel/drivers.c | 4 + arch/powerpc/include/asm/barrier.h | 3 +- arch/powerpc/include/asm/synch.h | 4 - arch/powerpc/kernel/eeh_pe.c | 3 +- arch/powerpc/lib/feature-fixups.c | 2 +- arch/powerpc/platforms/powernv/opal-nvram.c | 11 +- arch/s390/hypfs/inode.c | 2 +- arch/s390/kernel/ipl.c | 1 + arch/um/os-Linux/signal.c | 2 +- arch/x86/Kconfig | 5 - arch/x86/include/asm/arch_hweight.h | 24 ++- arch/x86/kernel/i386_ksyms_32.c | 2 + arch/x86/kernel/x8664_ksyms_64.c | 3 + arch/x86/lib/Makefile | 2 +- arch/x86/lib/hweight.S | 79 +++++++++ arch/x86/um/stub_segv.c | 2 +- drivers/acpi/video_detect.c | 9 + drivers/base/regmap/regmap.c | 2 +- drivers/block/loop.c | 12 +- drivers/char/random.c | 2 +- drivers/clk/bcm/clk-bcm2835.c | 8 +- drivers/clk/mvebu/armada-38x.c | 15 +- drivers/dma/at_xdmac.c | 4 +- drivers/gpu/drm/radeon/radeon_object.c | 3 +- drivers/gpu/drm/radeon/si_dpm.c | 4 +- drivers/hid/hid-core.c | 10 +- drivers/hid/hid-input.c | 3 +- drivers/hid/hid-multitouch.c | 5 +- drivers/hid/hid-rmi.c | 4 +- drivers/hid/hidraw.c | 5 + drivers/hid/i2c-hid/i2c-hid.c | 13 +- drivers/hwmon/ina2xx.c | 3 +- drivers/infiniband/core/ucma.c | 3 + drivers/infiniband/ulp/srp/ib_srp.c | 18 +- drivers/iommu/intel-svm.c | 1 + drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 4 +- drivers/mmc/host/jz4740_mmc.c | 2 +- drivers/mtd/ubi/block.c | 2 +- drivers/mtd/ubi/build.c | 11 ++ drivers/mtd/ubi/fastmap-wl.c | 1 - drivers/net/slip/slhc.c | 5 + drivers/net/usb/cdc_ether.c | 6 + drivers/net/usb/lan78xx.c | 3 +- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- drivers/net/xen-netfront.c | 7 +- drivers/pci/hotplug/acpiphp_glue.c | 23 ++- drivers/s390/cio/qdio_main.c | 42 ++--- drivers/thermal/imx_thermal.c | 6 +- drivers/thunderbolt/nhi.c | 1 + drivers/tty/n_tty.c | 6 + drivers/tty/tty_io.c | 9 + drivers/usb/core/generic.c | 9 +- drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/musb/musb_gadget_ep0.c | 14 +- drivers/vfio/pci/vfio_pci_config.c | 107 +++++++++++- drivers/watchdog/f71808e_wdt.c | 2 +- fs/autofs4/root.c | 2 +- fs/ext4/balloc.c | 19 ++- fs/ext4/ialloc.c | 54 ++---- fs/ext4/inline.c | 66 ++++--- fs/ext4/inode.c | 48 +++--- fs/ext4/super.c | 6 + fs/ext4/xattr.c | 30 ++-- fs/ext4/xattr.h | 32 ++++ fs/fs-writeback.c | 7 +- fs/jbd2/journal.c | 5 +- fs/jffs2/super.c | 2 +- fs/namei.c | 3 +- fs/namespace.c | 3 +- fs/notify/fanotify/fanotify.c | 34 ++-- fs/reiserfs/journal.c | 2 +- fs/ubifs/super.c | 14 +- include/linux/backing-dev-defs.h | 5 + include/linux/backing-dev.h | 31 ++-- include/linux/hid.h | 6 +- include/linux/mm.h | 4 + include/linux/tty.h | 1 + include/net/slhc_vj.h | 1 + include/sound/pcm_oss.h | 1 + ipc/shm.c | 23 ++- kernel/resource.c | 3 +- lib/Makefile | 2 - lib/hweight.c | 4 + mm/filemap.c | 16 +- mm/memory.c | 17 ++ mm/page-writeback.c | 18 +- mm/slab.c | 3 +- net/sunrpc/rpc_pipe.c | 1 + sound/core/oss/pcm_oss.c | 189 ++++++++++++++++----- sound/core/pcm.c | 8 +- sound/core/rawmidi_compat.c | 18 +- sound/pci/hda/hda_intel.c | 3 +- sound/soc/codecs/ssm2602.c | 19 ++- sound/usb/line6/midi.c | 2 +- tools/perf/tests/code-reading.c | 20 +-- .../perf/util/intel-pt-decoder/intel-pt-decoder.c | 64 ++++--- .../perf/util/intel-pt-decoder/intel-pt-decoder.h | 2 +- tools/perf/util/intel-pt.c | 37 +++- 103 files changed, 943 insertions(+), 449 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/97 media: v4l2-compat-ioctl32: dont oops on overlay
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <[email protected]>
commit 85ea29f19eab56ec16ec6b92bc67305998706afa upstream.
At put_v4l2_window32(), it tries to access kp->clips. However, kp points to an userspace pointer. So, it should be obtained via get_user(), otherwise it can OOPS:
vivid-000: ================== END STATUS ==================
BUG: unable to handle kernel paging request at 00000000fffb18e0 IP: [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev] PGD 3f5776067 PUD 3f576f067 PMD 3f5769067 PTE 800000042548f067 Oops: 0001 [#1] SMP Modules linked in: vivid videobuf2_vmalloc videobuf2_memops v4l2_dv_timings videobuf2_core v4l2_common videodev media xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill binfmt_misc snd_hda_codec_hdmi i915 snd_hda_intel snd_hda_controller snd_hda_codec intel_rapl x86_pkg_temp_thermal snd_hwdep intel_powerclamp snd_pcm coretemp snd_seq_midi kvm_intel kvm snd_seq_midi_event snd_rawmidi i2c_algo_bit drm_kms_helper snd_seq drm crct10dif_pclmul e1000e snd_seq_device crc32_pclmul snd_timer ghash_clmulni_intel snd mei_me mei ptp pps_core soundcore lpc_ich video crc32c_intel [last unloaded: media] CPU: 2 PID: 28332 Comm: v4l2-compliance Not tainted 3.18.102+ #107 Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 task: ffff8804293f8000 ti: ffff8803f5640000 task.ti: ffff8803f5640000 RIP: 0010:[<ffffffffc05468d9>] [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev] RSP: 0018:ffff8803f5643e28 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00000000fffb1ab4 RDX: 00000000fffb1a68 RSI: 00000000fffb18d8 RDI: 00000000fffb1aa8 RBP: ffff8803f5643e48 R08: 0000000000000001 R09: ffff8803f54b0378 R10: 0000000000000000 R11: 0000000000000168 R12: 00000000fffb18c0 R13: 00000000fffb1a94 R14: 00000000fffb18c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff880456d00000(0063) knlGS:00000000f7100980 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000fffb18e0 CR3: 00000003f552b000 CR4: 00000000003407e0 Stack: 00000000fffb1a94 00000000c0cc5640 0000000000000056 ffff8804274f3600 ffff8803f5643ed0 ffffffffc0547e16 0000000000000003 ffff8803f5643eb0 ffffffff81301460 ffff88009db44b01 ffff880441942520 ffff8800c0d05640 Call Trace: [<ffffffffc0547e16>] v4l2_compat_ioctl32+0x12d6/0x1b1d [videodev] [<ffffffff81301460>] ? file_has_perm+0x70/0xc0 [<ffffffff81252a2c>] compat_SyS_ioctl+0xec/0x1200 [<ffffffff8173241a>] sysenter_dispatch+0x7/0x21 Code: 00 00 48 8b 80 48 c0 ff ff 48 83 e8 38 49 39 c6 0f 87 2b ff ff ff 49 8d 45 1c e8 a3 ce e3 c0 85 c0 0f 85 1a ff ff ff 41 8d 40 ff <4d> 8b 64 24 20 41 89 d5 48 8d 44 40 03 4d 8d 34 c4 eb 15 0f 1f RIP [<ffffffffc05468d9>] __put_v4l2_format32+0x169/0x220 [videodev] RSP <ffff8803f5643e28> CR2: 00000000fffb18e0
Tested with vivid driver on Kernel v3.18.102.
Same bug happens upstream too:
BUG: KASAN: user-memory-access in __put_v4l2_format32+0x98/0x4d0 [videodev] Read of size 8 at addr 00000000ffe48400 by task v4l2-compliance/8713 CPU: 0 PID: 8713 Comm: v4l2-compliance Not tainted 4.16.0-rc4+ #108 Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 Call Trace: dump_stack+0x5c/0x7c kasan_report+0x164/0x380 ? __put_v4l2_format32+0x98/0x4d0 [videodev] __put_v4l2_format32+0x98/0x4d0 [videodev] v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev] ? __fsnotify_inode_delete+0x20/0x20 ? __put_v4l2_format32+0x4d0/0x4d0 [videodev] compat_SyS_ioctl+0x646/0x14d0 ? do_ioctl+0x30/0x30 do_fast_syscall_32+0x191/0x3f4 entry_SYSENTER_compat+0x6b/0x7a ================================================================== Disabling lock debugging due to kernel taint BUG: unable to handle kernel paging request at 00000000ffe48400 IP: __put_v4l2_format32+0x98/0x4d0 [videodev] PGD 3a22fb067 P4D 3a22fb067 PUD 39b6f0067 PMD 39b6f1067 PTE 80000003256af067 Oops: 0001 [#1] SMP KASAN Modules linked in: vivid videobuf2_vmalloc videobuf2_dma_contig videobuf2_memops v4l2_tpg v4l2_dv_timings videobuf2_v4l2 videobuf2_common v4l2_common videodev xt_CHECKSUM iptable_mangle ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack libcrc32c tun bridge stp llc ebtable_filter ebtables ip6table_filter ip6_tables bluetooth rfkill ecdh_generic binfmt_misc snd_hda_codec_hdmi intel_rapl x86_pkg_temp_thermal intel_powerclamp i915 coretemp snd_hda_intel snd_hda_codec kvm_intel snd_hwdep snd_hda_core kvm snd_pcm irqbypass crct10dif_pclmul crc32_pclmul snd_seq_midi ghash_clmulni_intel snd_seq_midi_event i2c_algo_bit intel_cstate snd_rawmidi intel_uncore snd_seq drm_kms_helper e1000e snd_seq_device snd_timer intel_rapl_perf drm ptp snd mei_me mei lpc_ich pps_core soundcore video crc32c_intel CPU: 0 PID: 8713 Comm: v4l2-compliance Tainted: G B 4.16.0-rc4+ #108 Hardware name: /NUC5i7RYB, BIOS RYBDWi35.86A.0364.2017.0511.0949 05/11/2017 RIP: 0010:__put_v4l2_format32+0x98/0x4d0 [videodev] RSP: 0018:ffff8803b9be7d30 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8803ac983e80 RCX: ffffffff8cd929f2 RDX: 1ffffffff1d0a149 RSI: 0000000000000297 RDI: 0000000000000297 RBP: 00000000ffe485c0 R08: fffffbfff1cf5123 R09: ffffffff8e7a8948 R10: 0000000000000001 R11: fffffbfff1cf5122 R12: 00000000ffe483e0 R13: 00000000ffe485c4 R14: ffff8803ac985918 R15: 00000000ffe483e8 FS: 0000000000000000(0000) GS:ffff880407400000(0063) knlGS:00000000f7a46980 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000ffe48400 CR3: 00000003a83f2003 CR4: 00000000003606f0 Call Trace: v4l2_compat_ioctl32+0x1aec/0x27a0 [videodev] ? __fsnotify_inode_delete+0x20/0x20 ? __put_v4l2_format32+0x4d0/0x4d0 [videodev] compat_SyS_ioctl+0x646/0x14d0 ? do_ioctl+0x30/0x30 do_fast_syscall_32+0x191/0x3f4 entry_SYSENTER_compat+0x6b/0x7a Code: 4c 89 f7 4d 8d 7c 24 08 e8 e6 a4 69 cb 48 8b 83 98 1a 00 00 48 83 e8 10 49 39 c7 0f 87 9d 01 00 00 49 8d 7c 24 20 e8 c8 a4 69 cb <4d> 8b 74 24 20 4c 89 ef 4c 89 fe ba 10 00 00 00 e8 23 d9 08 cc RIP: __put_v4l2_format32+0x98/0x4d0 [videodev] RSP: ffff8803b9be7d30 CR2: 00000000ffe48400
--- drivers/media/v4l2-core/v4l2-compat-ioctl32.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/media/v4l2-core/v4l2-compat-ioctl32.c +3 -1
@@ -101,7 +101,7 @@ static int get_v4l2_window32(struct v4l2static int put_v4l2_window32 (struct v4l2_window __user *kp,struct v4l2_window32 __user *up) { -struct v4l2_clip __user *kclips = kp->clips; +struct v4l2_clip __user *kclips;struct v4l2_clip32 __user *uclips;compat_caddr_t p;u32 clipcount;
@@ -116,6 +116,8 @@ static int put_v4l2_window32(struct v4l2if (!clipcount)return 0 ; +if (get_user (kclips, &kp->clips)) +return -EFAULT ;if (get_user (p, &up->clips))return -EFAULT ; uclips =compat_ptr (p);
Greg Kroah-Hartman
maintainerPATCH 3/97 perf intel-pt: Fix overlap detection to identify consecutive buffers correctly
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 117db4b27bf08dba412faf3924ba55fe970c57b8 upstream.
Overlap detection was not not updating the buffer's 'consecutive' flag. Marking buffers consecutive has the advantage that decoding begins from the start of the buffer instead of the first PSB. Fix overlap detection to identify consecutive buffers correctly.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 62 +++++++++----------- tools/perf/util/intel-pt-decoder/intel-pt-decoder.h | 2 tools/perf/util/intel-pt.c | 5 + 3 files changed, 34 insertions(+), 35 deletions(-)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +29 -33
@@ -2152,14 +2152,6 @@ const struct intel_pt_state *intel_pt_dereturn &decoder->state; } -static bool intel_pt_at_psb (unsigned char *buf,size_t len) -{ -if (len <INTEL_PT_PSB_LEN ) -return false; -return memmem (buf,INTEL_PT_PSB_LEN ,INTEL_PT_PSB_STR , -INTEL_PT_PSB_LEN ); -} -/** * intel_pt_next_psb - move buffer pointer to the start of the next PSB packet. * @buf: pointer to buffer pointer
@@ -2248,6 +2240,7 @@ static unsigned char *intel_pt_last_psb(* @buf: buffer * @len: size of buffer * @tsc: TSC value returned +* @rem: returns remaining size when TSC is found * * Find a TSC packet in @buf and return the TSC value. This function assumes * that @buf starts at a PSB and that PSB+ will contain TSC and so stops if a
@@ -2255,7 +2248,8 @@ static unsigned char *intel_pt_last_psb(* * Return: %true if TSC is found, false otherwise. */ -static bool intel_pt_next_tsc (unsigned char *buf,size_t len,uint64_t *tsc) +static bool intel_pt_next_tsc (unsigned char *buf,size_t len,uint64_t *tsc, +size_t *rem) {struct intel_pt_pkt packet;int ret;
@@ -2266,6 +2260,7 @@ static bool intel_pt_next_tsc(unsigned creturn false;if (packet.type ==INTEL_PT_TSC ) { *tsc = packet.payload; + *rem = len;return true; }if (packet.type ==INTEL_PT_PSBEND )
@@ -2316,6 +2311,8 @@ static int intel_pt_tsc_cmp(uint64_t tsc* @len_a: size of first buffer * @buf_b: second buffer * @len_b: size of second buffer +* @consecutive: returns true if there is data in buf_b that is consecutive +* to buf_a * * If the trace contains TSC we can look at the last TSC of @buf_a and the * first TSC of @buf_b in order to determine if the buffers overlap, and then
@@ -2328,33 +2325,41 @@ static int intel_pt_tsc_cmp(uint64_t tscstatic unsigned char *intel_pt_find_overlap_tsc (unsigned char *buf_a,size_t len_a,unsigned char *buf_b, -size_t len_b) +size_t len_b,bool *consecutive) {uint64_t tsc_a, tsc_b;unsigned char *p; -size_t len; +size_t len, rem_a, rem_b; p =intel_pt_last_psb (buf_a, len_a);if (!p)return buf_b;/* No PSB in buf_a => no overlap */ len = len_a - (p - buf_a); -if (!intel_pt_next_tsc (p, len, &tsc_a)) { +if (!intel_pt_next_tsc (p, len, &tsc_a, &rem_a)) {/* The last PSB+ in buf_a is incomplete, so go back one more */ len_a -= len; p =intel_pt_last_psb (buf_a, len_a);if (!p)return buf_b;/* No full PSB+ => assume no overlap */ len = len_a - (p - buf_a); -if (!intel_pt_next_tsc (p, len, &tsc_a)) +if (!intel_pt_next_tsc (p, len, &tsc_a, &rem_a))return buf_b;/* No TSC in buf_a => assume no overlap */ }while (1 ) {/* Ignore PSB+ with no TSC */ -if (intel_pt_next_tsc (buf_b, len_b, &tsc_b) && -intel_pt_tsc_cmp (tsc_a, tsc_b) <0 ) -return buf_b;/* tsc_a < tsc_b => no overlap */ +if (intel_pt_next_tsc (buf_b, len_b, &tsc_b, &rem_b)) { +int cmp =intel_pt_tsc_cmp (tsc_a, tsc_b); + +/* Same TSC, so buffers are consecutive */ +if (!cmp && rem_b >= rem_a) { + *consecutive = true; +return buf_b + len_b - (rem_b - rem_a); + } +if (cmp <0 ) +return buf_b;/* tsc_a < tsc_b => no overlap */ + }if (!intel_pt_step_psb (&buf_b, &len_b))return buf_b + len_b;/* No PSB in buf_b => no data */
@@ -2368,6 +2373,8 @@ static unsigned char *intel_pt_find_over* @buf_b: second buffer * @len_b: size of second buffer * @have_tsc: can use TSC packets to detect overlap +* @consecutive: returns true if there is data in buf_b that is consecutive +* to buf_a * * When trace samples or snapshots are recorded there is the possibility that * the data overlaps. Note that, for the purposes of decoding, data is only
@@ -2378,7 +2385,7 @@ static unsigned char *intel_pt_find_over*/ unsigned char *intel_pt_find_overlap (unsigned char *buf_a,size_t len_a,unsigned char *buf_b,size_t len_b, -bool have_tsc) +bool have_tsc,bool *consecutive) {unsigned char *found;
@@ -2390,7 +2397,8 @@ unsigned char *intel_pt_find_overlap(unsreturn buf_b;/* No overlap */ if (have_tsc) { - found =intel_pt_find_overlap_tsc (buf_a, len_a, buf_b, len_b); + found =intel_pt_find_overlap_tsc (buf_a, len_a, buf_b, len_b, + consecutive);if (found)return found; }
@@ -2405,28 +2413,16 @@ unsigned char *intel_pt_find_overlap(uns }/* Now len_b >= len_a */ -if (len_b > len_a) { -/* The leftover buffer 'b' must start at a PSB */ -while (!intel_pt_at_psb (buf_b + len_a, len_b - len_a)) { -if (!intel_pt_step_psb (&buf_a, &len_a)) -return buf_b;/* No overlap */ - } - } -while (1 ) {/* Potential overlap so check the bytes */ found =memmem (buf_a, len_a, buf_b, len_a); -if (found) +if (found) { + *consecutive = true;return buf_b + len_a; + }/* Try again at next PSB in buffer 'a' */ if (!intel_pt_step_psb (&buf_a, &len_a))return buf_b;/* No overlap */ - -/* The leftover buffer 'b' must start at a PSB */ -while (!intel_pt_at_psb (buf_b + len_a, len_b - len_a)) { -if (!intel_pt_step_psb (&buf_a, &len_a)) -return buf_b;/* No overlap */ - } } }
tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +1 -1
@@ -102,7 +102,7 @@ const struct intel_pt_state *intel_pt_deunsigned char *intel_pt_find_overlap (unsigned char *buf_a,size_t len_a,unsigned char *buf_b,size_t len_b, -bool have_tsc); +bool have_tsc,bool *consecutive);int intel_pt__strerror (int code,char *buf,size_t buflen);
tools/perf/util/intel-pt.c +4 -1
@@ -188,14 +188,17 @@ static void intel_pt_dump_event(struct istatic int intel_pt_do_fix_overlap (struct intel_pt *pt,struct auxtrace_buffer *a,struct auxtrace_buffer *b) { +bool consecutive = false;void *start; start =intel_pt_find_overlap (a->data, a->size, b->data, b->size, - pt->have_tsc); + pt->have_tsc, &consecutive);if (!start)return -EINVAL ; b->use_size = b->data + b->size - start; b->use_data = start; +if (b->use_size && consecutive) + b->consecutive = true;return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/97 perf intel-pt: Fix sync_switch
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 63d8e38f6ae6c36dd5b5ba0e8c112e8861532ea2 upstream.
sync_switch is a facility to synchronize decoding more closely with the point in the kernel when the context actually switched.
The flag when sync_switch is enabled was global to the decoding, whereas it is really specific to the CPU.
The trace data for different CPUs is put on different queues, so add sync_switch to the intel_pt_queue structure and use that in preference to the global setting in the intel_pt structure.
That fixes problems decoding one CPU's trace because sync_switch was disabled on a different CPU's queue.
--- tools/perf/util/intel-pt.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-)
tools/perf/util/intel-pt.c +25 -7
@@ -125,6 +125,7 @@ struct intel_pt_queue {bool stop;bool step_through_buffers;bool use_buffer_pid_tid; +bool sync_switch;pid_t pid, tid;int cpu;int switch_state;
@@ -852,10 +853,12 @@ static int intel_pt_setup_queue(struct iif (pt->timeless_decoding || !pt->have_sched_switch) ptq->use_buffer_pid_tid = true; } + + ptq->sync_switch = pt->sync_switch; }if (!ptq->on_heap && - (!pt->sync_switch || + (!ptq->sync_switch || ptq->switch_state !=INTEL_PT_SS_EXPECTING_SWITCH_EVENT )) {const struct intel_pt_state *state;int ret;
@@ -1238,7 +1241,7 @@ static int intel_pt_sample(struct intel_if (pt->synth_opts.last_branch)intel_pt_update_last_branch_rb (ptq); -if (!pt->sync_switch) +if (!ptq->sync_switch)return 0 ;if (intel_pt_is_switch_ip (ptq, state->to_ip)) {
@@ -1319,6 +1322,21 @@ static u64 intel_pt_switch_ip(struct intreturn switch_ip; } +static void intel_pt_enable_sync_switch (struct intel_pt *pt) +{ +unsigned int i; + + pt->sync_switch = true; + +for (i =0 ; i < pt->queues.nr_queues; i++) { +struct auxtrace_queue *queue = &pt->queues.queue_array[i]; +struct intel_pt_queue *ptq = queue->priv; + +if (ptq) + ptq->sync_switch = true; + } +} +static int intel_pt_run_decoder (struct intel_pt_queue *ptq,u64 *timestamp) {const struct intel_pt_state *state = ptq->state;
@@ -1335,7 +1353,7 @@ static int intel_pt_run_decoder(struct iif (pt->switch_ip) {intel_pt_log ("switch_ip: %" PRIx64" ptss_ip: %" PRIx64"\n" , pt->switch_ip, pt->ptss_ip); - pt->sync_switch = true; +intel_pt_enable_sync_switch (pt); } } }
@@ -1351,9 +1369,9 @@ static int intel_pt_run_decoder(struct iif (state->err) {if (state->err ==INTEL_PT_ERR_NODATA )return 1 ; -if (pt->sync_switch && +if (ptq->sync_switch && state->from_ip >= pt->kernel_start) { - pt->sync_switch = false; + ptq->sync_switch = false;intel_pt_next_tid (pt, ptq); }if (pt->synth_opts.errors) {
@@ -1379,7 +1397,7 @@ static int intel_pt_run_decoder(struct i state->timestamp, state->est_timestamp); ptq->timestamp = state->est_timestamp;/* Use estimated TSC in unknown switch state */ - }else if (pt->sync_switch && + }else if (ptq->sync_switch && ptq->switch_state ==INTEL_PT_SS_UNKNOWN &&intel_pt_is_switch_ip (ptq, state->to_ip) && ptq->next_tid ==-1 ) {
@@ -1526,7 +1544,7 @@ static int intel_pt_sync_switch(struct ireturn 1 ; ptq =intel_pt_cpu_to_ptq (pt, cpu); -if (!ptq) +if (!ptq || !ptq->sync_switch)return 1 ;switch (ptq->switch_state) {
Greg Kroah-Hartman
maintainerPATCH 5/97 perf intel-pt: Fix error recovery from missing TIP packet
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 1c196a6c771c47a2faa63d38d913e03284f73a16 upstream.
When a TIP packet is expected but there is a different packet, it is an error. However the unexpected packet might be something important like a TSC packet, so after the error, it is necessary to continue from there, rather than the next packet. That is achieved by setting pkt_step to zero.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +1 -0
@@ -1492,6 +1492,7 @@ static int intel_pt_walk_fup_tip(structcase INTEL_PT_PSBEND :intel_pt_log ("ERROR: Missing TIP after FUP\n" ); decoder->pkt_state =INTEL_PT_STATE_ERR3 ; + decoder->pkt_step =0 ;return -ENOENT ;case INTEL_PT_OVF :
Greg Kroah-Hartman
maintainerPATCH 6/97 perf intel-pt: Fix timestamp following overflow
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Hunter <[email protected]>
commit 91d29b288aed3406caf7c454bf2b898c96cfd177 upstream.
timestamp_insn_cnt is used to estimate the timestamp based on the number of instructions since the last known timestamp.
If the estimate is not accurate enough decoding might not be correctly synchronized with side-band events causing more trace errors.
However there are always timestamps following an overflow, so the estimate is not needed and can indeed result in more errors.
Suppress the estimate by setting timestamp_insn_cnt to zero.
--- tools/perf/util/intel-pt-decoder/intel-pt-decoder.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +1 -0
@@ -1270,6 +1270,7 @@ static int intel_pt_overflow(struct inteintel_pt_clear_tx_flags (decoder); decoder->have_tma = false; decoder->cbr =0 ; + decoder->timestamp_insn_cnt =0 ; decoder->pkt_state =INTEL_PT_STATE_ERR_RESYNC ; decoder->overflow = true;return -EOVERFLOW ;
Greg Kroah-Hartman
maintainerPATCH 7/97 radeon: hide pointless #warning when compile testing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <[email protected]>
commit c02216acf4177c4411d33735c81cad687790fa59 upstream.
In randconfig testing, we sometimes get this warning:
drivers/gpu/drm/radeon/radeon_object.c: In function 'radeon_bo_create':drivers/gpu/drm/radeon/radeon_object.c:242:2: error: #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance thanks to write-combining [-Werror=cpp]
#warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \
This is rather annoying since almost all other code produces no build-time output unless we have found a real bug. We already fixed this in the amdgpu driver in commit 31bb90f1cd08 ("drm/amdgpu: shut up #warning for compile testing") by adding a CONFIG_COMPILE_TEST check last year and agreed to do the same here, but both Michel and I then forgot about it until I came across the issue again now.
For stable kernels, as this is one of very few remaining randconfig warnings in 4.14.
--- drivers/gpu/drm/radeon/radeon_object.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/gpu/drm/radeon/radeon_object.c +2 -1
@@ -238,9 +238,10 @@ int radeon_bo_create(struct radeon_devic* may be slow * See https://bugs.freedesktop.org/show_bug.cgi?id=88758 */ - +#ifndef CONFIG_COMPILE_TEST #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \ thanks to write-combining +#endif if (bo->flags &RADEON_GEM_GTT_WC ) DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for "
Greg Kroah-Hartman
maintainerPATCH 8/97 Revert "perf tests: Decompress kernel module before objdump"
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <[email protected]>
This reverts commit b0761b57e0bf11ada4c45e68f4cba1370363d90d which is commit 94df1040b1e6aacd8dec0ba3c61d7e77cd695f26 upstream.
It breaks the build of perf on 4.4.y, so I'm dropping it.
--- tools/perf/tests/code-reading.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-)
tools/perf/tests/code-reading.c +1 -19
@@ -182,8 +182,6 @@ static int read_object_code(u64 addr, siunsigned char buf2[BUFSZ ];size_t ret_len;u64 objdump_addr; -const char *objdump_name; -char decomp_name[KMOD_DECOMP_LEN ];int ret;pr_debug ("Reading object code for memory address: %#" PRIx64"\n" , addr);
@@ -244,25 +242,9 @@ static int read_object_code(u64 addr, si state->done[state->done_cnt++] = al.map->start; } - objdump_name = al.map->dso->long_name; -if (dso__needs_decompress (al.map->dso)) { -if (dso__decompress_kmodule_path (al.map->dso, objdump_name, - decomp_name, -sizeof (decomp_name)) <0 ) { -pr_debug ("decompression failed\n" ); -return -1 ; - } - - objdump_name = decomp_name; - } -/* Read the object code using objdump */ objdump_addr =map__rip_2objdump (al.map, al.addr); - ret =read_via_objdump (objdump_name, objdump_addr, buf2, len); - -if (dso__needs_decompress (al.map->dso)) -unlink (objdump_name); - + ret =read_via_objdump (al.map->dso->long_name, objdump_addr, buf2, len);if (ret >0 ) {/* * The kernel maps are inaccurate - assume objdump is right in
Greg Kroah-Hartman
maintainerPATCH 9/97 block/loop: fix deadlock after loop_set_status
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <[email protected]>
commit 1e047eaab3bb5564f25b41e9cd3a053009f4e789 upstream.
syzbot is reporting deadlocks at __blkdev_get() [1].
----------------------------------------
[ 92.493919] systemd-udevd D12696 525 1 0x00000000 [ 92.495891] Call Trace: [ 92.501560] schedule+0x23/0x80 [ 92.502923] schedule_preempt_disabled+0x5/0x10 [ 92.504645] __mutex_lock+0x416/0x9e0 [ 92.510760] __blkdev_get+0x73/0x4f0 [ 92.512220] blkdev_get+0x12e/0x390 [ 92.518151] do_dentry_open+0x1c3/0x2f0 [ 92.519815] path_openat+0x5d9/0xdc0 [ 92.521437] do_filp_open+0x7d/0xf0 [ 92.527365] do_sys_open+0x1b8/0x250 [ 92.528831] do_syscall_64+0x6e/0x270 [ 92.530341] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 92.931922] 1 lock held by systemd-udevd/525:
[ 92.933642] #0: 00000000a2849e25 (&bdev->bd_mutex){+.+.}, at: __blkdev_get+0x73/0x4f0----------------------------------------
The reason of deadlock turned out that wait_event_interruptible() in blk_queue_enter() got stuck with bdev->bd_mutex held at __blkdev_put() due to q->mq_freeze_depth == 1.
----------------------------------------
[ 92.787172] a.out S12584 634 633 0x80000002 [ 92.789120] Call Trace: [ 92.796693] schedule+0x23/0x80 [ 92.797994] blk_queue_enter+0x3cb/0x540 [ 92.803272] generic_make_request+0xf0/0x3d0 [ 92.807970] submit_bio+0x67/0x130 [ 92.810928] submit_bh_wbc+0x15e/0x190 [ 92.812461] __block_write_full_page+0x218/0x460 [ 92.815792] __writepage+0x11/0x50 [ 92.817209] write_cache_pages+0x1ae/0x3d0 [ 92.825585] generic_writepages+0x5a/0x90 [ 92.831865] do_writepages+0x43/0xd0 [ 92.836972] __filemap_fdatawrite_range+0xc1/0x100 [ 92.838788] filemap_write_and_wait+0x24/0x70 [ 92.840491] __blkdev_put+0x69/0x1e0 [ 92.841949] blkdev_close+0x16/0x20 [ 92.843418] __fput+0xda/0x1f0 [ 92.844740] task_work_run+0x87/0xb0 [ 92.846215] do_exit+0x2f5/0xba0 [ 92.850528] do_group_exit+0x34/0xb0 [ 92.852018] SyS_exit_group+0xb/0x10 [ 92.853449] do_syscall_64+0x6e/0x270 [ 92.854944] entry_SYSCALL_64_after_hwframe+0x42/0xb7
[ 92.943530] 1 lock held by a.out/634:
[ 92.945105] #0: 00000000a2849e25 (&bdev->bd_mutex){+.+.}, at: __blkdev_put+0x3c/0x1e0----------------------------------------
The reason of q->mq_freeze_depth == 1 turned out that loop_set_status() forgot to call blk_mq_unfreeze_queue() at error paths for info->lo_encrypt_type != NULL case.
----------------------------------------
[ 37.509497] CPU: 2 PID: 634 Comm: a.out Tainted: G W 4.16.0+ #457 [ 37.513608] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 05/19/2017 [ 37.518832] RIP: 0010:blk_freeze_queue_start+0x17/0x40 [ 37.521778] RSP: 0018:ffffb0c2013e7c60 EFLAGS: 00010246 [ 37.524078] RAX: 0000000000000000 RBX: ffff8b07b1519798 RCX: 0000000000000000 [ 37.527015] RDX: 0000000000000002 RSI: ffffb0c2013e7cc0 RDI: ffff8b07b1519798 [ 37.529934] RBP: ffffb0c2013e7cc0 R08: 0000000000000008 R09: 47a189966239b898 [ 37.532684] R10: dad78b99b278552f R11: 9332dca72259d5ef R12: ffff8b07acd73678 [ 37.535452] R13: 0000000000004c04 R14: 0000000000000000 R15: ffff8b07b841e940 [ 37.538186] FS: 00007fede33b9740(0000) GS:ffff8b07b8e80000(0000) knlGS:0000000000000000 [ 37.541168] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 37.543590] CR2: 00000000206fdf18 CR3: 0000000130b30006 CR4: 00000000000606e0 [ 37.546410] Call Trace: [ 37.547902] blk_freeze_queue+0x9/0x30 [ 37.549968] loop_set_status+0x67/0x3c0 [loop] [ 37.549975] loop_set_status64+0x3b/0x70 [loop] [ 37.549986] lo_ioctl+0x223/0x810 [loop] [ 37.549995] blkdev_ioctl+0x572/0x980 [ 37.550003] block_ioctl+0x34/0x40 [ 37.550006] do_vfs_ioctl+0xa7/0x6d0 [ 37.550017] ksys_ioctl+0x6b/0x80 [ 37.573076] SyS_ioctl+0x5/0x10 [ 37.574831] do_syscall_64+0x6e/0x270 [ 37.576769] entry_SYSCALL_64_after_hwframe+0x42/0xb7
----------------------------------------
[1] https://syzkaller.appspot.com/bug?id=cd662bc3f6022c0979d01a262c318fab2ee9b56f
--- drivers/block/loop.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/block/loop.c +8 -4
@@ -1121,11 +1121,15 @@ loop_set_status(struct loop_device *lo,if (info->lo_encrypt_type) {unsigned int type = info->lo_encrypt_type; -if (type >=MAX_LO_CRYPT ) -return -EINVAL ; +if (type >=MAX_LO_CRYPT ) { + err = -EINVAL ; + goto exit; + } xfer = xfer_funcs[type]; -if (xfer ==NULL ) -return -EINVAL ; +if (xfer ==NULL ) { + err = -EINVAL ; + goto exit; + } }else xfer =NULL ;
Greg Kroah-Hartman
maintainerPATCH 11/97 s390/qdio: dont merge ERROR output buffers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
commit 0cf1e05157b9e5530dcc3ca9fec9bf617fc93375 upstream.
On an Output queue, both EMPTY and PENDING buffer states imply that the buffer is ready for completion-processing by the upper-layer drivers.
So for a non-QEBSM Output queue, get_buf_states() merges mixed batches of PENDING and EMPTY buffers into one large batch of EMPTY buffers. The upper-layer driver (ie. qeth) later distuingishes PENDING from EMPTY by inspecting the slsb_state for QDIO_OUTBUF_STATE_FLAG_PENDING.
But the merge logic in get_buf_states() contains a bug that causes us to erronously also merge ERROR buffers into such a batch of EMPTY buffers (ERROR is 0xaf, EMPTY is 0xa1; so ERROR & EMPTY == EMPTY). Effectively, most outbound ERROR buffers are currently discarded silently and processed as if they had succeeded.
Note that this affects _all_ non-QEBSM device types, not just IQD with CQ.
Fix it by explicitly spelling out the exact conditions for merging.
For extracting the "get initial state" part out of the loop, this relies on the fact that get_buf_states() is never called with a count of 0. The QEBSM path already strictly requires this, and the two callers with variable 'count' make sure of it.
--- drivers/s390/cio/qdio_main.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-)
drivers/s390/cio/qdio_main.c +20 -11
@@ -205,7 +205,10 @@ again:return 0 ; } -/* returns number of examined buffers and their common state in *state */ +/* +* Returns number of examined buffers and their common state in *state. +* Requested number of buffers-to-examine must be > 0. +*/ static inline int get_buf_states (struct qdio_q *q,unsigned int bufnr,unsigned char *state,unsigned int count,int auto_ack,int merge_pending)
@@ -216,17 +219,23 @@ static inline int get_buf_states(structif (is_qebsm (q))return qdio_do_eqbs (q, state, bufnr, count, auto_ack); -for (i =0 ; i < count; i++) { -if (!__state) { - __state = q->slsb.val[bufnr]; -if (merge_pending && __state ==SLSB_P_OUTPUT_PENDING ) - __state =SLSB_P_OUTPUT_EMPTY ; - }else if (merge_pending) { -if ((q->slsb.val[bufnr] & __state) != __state) -break ; - }else if (q->slsb.val[bufnr] != __state) -break ; +/* get initial state: */ + __state = q->slsb.val[bufnr]; +if (merge_pending && __state ==SLSB_P_OUTPUT_PENDING ) + __state =SLSB_P_OUTPUT_EMPTY ; + +for (i =1 ; i < count; i++) { bufnr =next_buf (bufnr); + +/* merge PENDING into EMPTY: */ +if (merge_pending && + q->slsb.val[bufnr] ==SLSB_P_OUTPUT_PENDING && + __state ==SLSB_P_OUTPUT_EMPTY ) +continue ; + +/* stop if next state differs from initial state: */ +if (q->slsb.val[bufnr] != __state) +break ; } *state = __state;return i;
Greg Kroah-Hartman
maintainerPATCH 12/97 s390/ipl: ensure loadparm valid flag is set
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <[email protected]>
commit 15deb080a6087b73089139569558965750e69d67 upstream.
When loadparm is set in reipl parm block, the kernel should also set DIAG308_FLAGS_LP_VALID flag.
This fixes loadparm ignoring during z/VM fcp -> ccw reipl and kvm direct boot -> ccw reipl.
--- arch/s390/kernel/ipl.c | 1 + 1 file changed, 1 insertion(+)
arch/s390/kernel/ipl.c +1 -0
@@ -798,6 +798,7 @@ static ssize_t reipl_generic_loadparm_st/* copy and convert to ebcdic */ memcpy (ipb->hdr.loadparm, buf, lp_len);ASCEBC (ipb->hdr.loadparm,LOADPARM_LEN ); + ipb->hdr.flags |=DIAG308_FLAGS_LP_VALID ;return len; }
Greg Kroah-Hartman
maintainerPATCH 13/97 getname_kernel() needs to make sure that ->name != ->iname in long case
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 30ce4d1903e1d8a7ccd110860a5eef3c638ed8be upstream.
missed it in "kill struct filename.separate" several years ago.
--- fs/namei.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namei.c +2 -1
@@ -219,9 +219,10 @@ getname_kernel(const char * filename)if (len <=EMBEDDED_NAME_MAX ) { result->name = (char *)result->iname; }else if (len <=PATH_MAX ) { + const size_t size = offsetof(struct filename, iname[1]);struct filename *tmp; - tmp =kmalloc (sizeof (*tmp),GFP_KERNEL ); + tmp =kmalloc (size,GFP_KERNEL );if (unlikely (!tmp)) {__putname (result);return ERR_PTR (-ENOMEM );
Greg Kroah-Hartman
maintainerPATCH 16/97 cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bassem Boubaker <[email protected]>
[ Upstream commit 53765341ee821c0a0f1dec41adc89c9096ad694c ]
The Cinterion AHS8 is a 3G device with one embedded WWAN interface using cdc_ether as a driver.
The modem is controlled via AT commands through the exposed TTYs.
AT+CGDCONT write command can be used to activate or deactivate a WWAN connection for a PDP context defined with the same command. UE supports one WWAN adapter.
--- drivers/net/usb/cdc_ether.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/net/usb/cdc_ether.c +6 -0
@@ -705,6 +705,12 @@ static const struct usb_device_id produc USB_CDC_PROTO_NONE), .driver_info = (unsigned long )&wwan_info, }, { +/* Cinterion AHS3 modem by GEMALTO */ +USB_DEVICE_AND_INTERFACE_INFO (0x1e2d ,0x0055 ,USB_CLASS_COMM , +USB_CDC_SUBCLASS_ETHERNET , +USB_CDC_PROTO_NONE ), + .driver_info = (unsigned long)&wwan_info, +}, {/* Telit modules */ USB_VENDOR_AND_INTERFACE_INFO (0x1bc7 ,USB_CLASS_COMM , USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE),
Greg Kroah-Hartman
maintainerPATCH 20/97 x86/hweight: Dont clobber %rdi
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <[email protected]>
commit 65ea11ec6a82b1d44aba62b59e9eb20247e57c6e upstream.
The caller expects %rdi to remain intact, push+pop it make that happen.
Fixes the following kind of explosions on my core2duo machine when trying to reboot or shut down:
general protection fault: 0000 [#1] PREEMPT SMP Modules linked in: i915 i2c_algo_bit drm_kms_helper cfbfillrect syscopyarea cfbimgblt sysfillrect sysimgblt fb_sys_fops cfbcopyarea drm netconsole configfs binfmt_misc iTCO_wdt psmouse pcspkr snd_hda_codec_idt e100 coretemp hwmon snd_hda_codec_generic i2c_i801 mii i2c_smbus lpc_ich mfd_core snd_hda_intel uhci_hcd snd_hda_codec snd_hwdep snd_hda_core ehci_pci 8250 ehci_hcd snd_pcm 8250_base usbcore evdev serial_core usb_common parport_pc parport snd_timer snd soundcore CPU: 0 PID: 3070 Comm: reboot Not tainted 4.8.0-rc1-perf-dirty #69 Hardware name: /D946GZIS, BIOS TS94610J.86A.0087.2007.1107.1049 11/07/2007 task: ffff88012a0b4080 task.stack: ffff880123850000 RIP: 0010:[<ffffffff81003c92>] [<ffffffff81003c92>] x86_perf_event_update+0x52/0xc0 RSP: 0018:ffff880123853b60 EFLAGS: 00010087 RAX: 0000000000000001 RBX: ffff88012fc0a3c0 RCX: 000000000000001e RDX: 0000000000000000 RSI: 0000000040000000 RDI: ffff88012b014800 RBP: ffff880123853b88 R08: ffffffffffffffff R09: 0000000000000000 R10: ffffea0004a012c0 R11: ffffea0004acedc0 R12: ffffffff80000001 R13: ffff88012b0149c0 R14: ffff88012b014800 R15: 0000000000000018 FS: 00007f8b155cd700(0000) GS:ffff88012fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8b155f5000 CR3: 000000012a2d7000 CR4: 00000000000006f0 Stack: ffff88012fc0a3c0 ffff88012b014800 0000000000000004 0000000000000001 ffff88012fc1b750 ffff880123853bb0 ffffffff81003d59 ffff88012b014800 ffff88012fc0a3c0 ffff88012b014800 ffff880123853bd8 ffffffff81003e13 Call Trace: [<ffffffff81003d59>] x86_pmu_stop+0x59/0xd0 [<ffffffff81003e13>] x86_pmu_del+0x43/0x140 [<ffffffff8111705d>] event_sched_out.isra.105+0xbd/0x260 [<ffffffff8111738d>] __perf_remove_from_context+0x2d/0xb0 [<ffffffff8111745d>] __perf_event_exit_context+0x4d/0x70 [<ffffffff810c8826>] generic_exec_single+0xb6/0x140 [<ffffffff81117410>] ? __perf_remove_from_context+0xb0/0xb0 [<ffffffff81117410>] ? __perf_remove_from_context+0xb0/0xb0 [<ffffffff810c898f>] smp_call_function_single+0xdf/0x140 [<ffffffff81113d27>] perf_event_exit_cpu_context+0x87/0xc0 [<ffffffff81113d73>] perf_reboot+0x13/0x40 [<ffffffff8107578a>] notifier_call_chain+0x4a/0x70 [<ffffffff81075ad7>] __blocking_notifier_call_chain+0x47/0x60 [<ffffffff81075b06>] blocking_notifier_call_chain+0x16/0x20 [<ffffffff81076a1d>] kernel_restart_prepare+0x1d/0x40 [<ffffffff81076ae2>] kernel_restart+0x12/0x60 [<ffffffff81076d56>] SYSC_reboot+0xf6/0x1b0 [<ffffffff811a823c>] ? mntput_no_expire+0x2c/0x1b0 [<ffffffff811a83e4>] ? mntput+0x24/0x40 [<ffffffff811894fc>] ? __fput+0x16c/0x1e0 [<ffffffff811895ae>] ? ____fput+0xe/0x10 [<ffffffff81072fc3>] ? task_work_run+0x83/0xa0 [<ffffffff81001623>] ? exit_to_usermode_loop+0x53/0xc0 [<ffffffff8100105a>] ? trace_hardirqs_on_thunk+0x1a/0x1c [<ffffffff81076e6e>] SyS_reboot+0xe/0x10 [<ffffffff814c4ba5>] entry_SYSCALL_64_fastpath+0x18/0xa3 Code: 7c 4c 8d af c0 01 00 00 49 89 fe eb 10 48 09 c2 4c 89 e0 49 0f b1 55 00 4c 39 e0 74 35 4d 8b a6 c0 01 00 00 41 8b 8e 60 01 00 00 <0f> 33 8b 35 6e 02 8c 00 48 c1 e2 20 85 f6 7e d2 48 89 d3 89 cf RIP [<ffffffff81003c92>] x86_perf_event_update+0x52/0xc0 RSP <ffff880123853b60> ---[ end trace 7ec95181faf211be ]--- note: reboot[3070] exited with preempt_count 2
--- arch/x86/lib/hweight.S | 2 ++ 1 file changed, 2 insertions(+)
arch/x86/lib/hweight.S +2 -0
@@ -35,6 +35,7 @@ ENDPROC(__sw_hweight32) ENTRY(__sw_hweight64) #ifdef CONFIG_X86_64 + pushq %rdi pushq %rdx movq %rdi, %rdx # w -> t
@@ -60,6 +61,7 @@ ENTRY(__sw_hweight64) shrq $56, %rax # w = w_tmp >> 56 popq %rdx + popq %rdi ret #else /* CONFIG_X86_32 */ /* We're getting an u64 arg in (%eax,%edx): unsigned long hweight64(__u64 w) */
Greg Kroah-Hartman
maintainerPATCH 23/97 ubi: fastmap: Dont flush fastmap work on detach
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit 29b7a6fa1ec07e8480b0d9caf635a4498a438bf4 upstream.
At this point UBI volumes have already been free()'ed and fastmap can no longer access these data structures.
--- drivers/mtd/ubi/fastmap-wl.c | 1 - 1 file changed, 1 deletion(-)
drivers/mtd/ubi/fastmap-wl.c +0 -1
@@ -360,7 +360,6 @@ static void ubi_fastmap_close(struct ubi {int i; -flush_work (&ubi->fm_work);return_unused_pool_pebs (ubi, &ubi->fm_pool);return_unused_pool_pebs (ubi, &ubi->fm_wl_pool);
Greg Kroah-Hartman
maintainerPATCH 24/97 ubi: Fix error for write access
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Izard <[email protected]>
commit 78a8dfbabbece22bee58ac4cb26cab10e7a19c5d upstream.
When opening a device with write access, ubiblock_open returns an error code. Currently, this error code is -EPERM, but this is not the right value.
The open function for other block devices returns -EROFS when opening read-only devices with FMODE_WRITE set. When used with dm-verity, the veritysetup userspace tool is expecting EROFS, and refuses to use the ubiblock device.
Use -EROFS for ubiblock as well. As a result, veritysetup accepts the ubiblock device as valid.
--- drivers/mtd/ubi/block.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/ubi/block.c +1 -1
@@ -244,7 +244,7 @@ static int ubiblock_open(struct block_de* in any case. */ if (mode &FMODE_WRITE ) { - ret = -EPERM ; + ret = -EROFS ; goto out_unlock; }
Greg Kroah-Hartman
maintainerPATCH 26/97 fs/reiserfs/journal.c: add missing resierfs_warning() arg
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Morton <[email protected]>
commit 9ad553abe66f8be3f4755e9fa0a6ba137ce76341 upstream.
One use of the reiserfs_warning() macro in journal_init_dev() is missing a parameter, causing the following warning:
REISERFS warning (device loop0): journal_init_dev: Cannot open '%s': %i journal_init_dev:
This also causes a WARN_ONCE() warning in the vsprintf code, and then a panic if panic_on_warn is set.
Please remove unsupported %/ in format string
WARNING: CPU: 1 PID: 4480 at lib/vsprintf.c:2138 format_decode+0x77f/0x830 lib/vsprintf.c:2138 Kernel panic - not syncing: panic_on_warn set ...
Just add another string argument to the macro invocation.
Addresses https://syzkaller.appspot.com/bug?id=0627d4551fdc39bf1ef5d82cd9eef587047f7718
--- fs/reiserfs/journal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/reiserfs/journal.c +1 -1
@@ -2643,7 +2643,7 @@ static int journal_init_dev(struct superif (IS_ERR (journal->j_dev_bd)) { result =PTR_ERR (journal->j_dev_bd); journal->j_dev_bd =NULL ; -reiserfs_warning (super, +reiserfs_warning (super,"sh-457" ,"journal_init_dev: Cannot open '%s': %i" , jdev_name, result);return result;
Greg Kroah-Hartman
maintainerPATCH 27/97 resource: fix integer overflow at reallocation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 60bb83b81169820c691fbfa33a6a4aef32aa4b0b upstream.
We've got a bug report indicating a kernel panic at booting on an x86-32 system, and it turned out to be the invalid PCI resource assigned after reallocation. __find_resource() first aligns the resource start address and resets the end address with start+size-1 accordingly, then checks whether it's contained. Here the end address may overflow the integer, although resource_contains() still returns true because the function validates only start and end address. So this ends up with returning an invalid resource (start > end).
There was already an attempt to cover such a problem in the commit 47ea91b4052d ("Resource: fix wrong resource window calculation"), but this case is an overseen one.
This patch adds the validity check of the newly calculated resource for avoiding the integer overflow problem.
Bugzilla: http://bugzilla.opensuse.org/show_bug.cgi?id=1086739
--- kernel/resource.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/resource.c +2 -1
@@ -611,7 +611,8 @@ static int __find_resource(struct resour alloc.start = constraint->alignf (constraint->alignf_data, &avail, size, constraint->align); alloc.end = alloc.start + size -1 ; -if (resource_contains (&avail, &alloc)) { +if (alloc.start <= alloc.end && +resource_contains (&avail, &alloc)) { new->start = alloc.start; new->end = alloc.end;return 0 ;
Greg Kroah-Hartman
maintainerPATCH 29/97 mm, slab: reschedule cache_reap() on the same CPU
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <[email protected]>
commit a9f2a846f0503e7d729f552e3ccfe2279010fe94 upstream.
cache_reap() is initially scheduled in start_cpu_timer() via schedule_delayed_work_on(). But then the next iterations are scheduled via schedule_delayed_work(), i.e. using WORK_CPU_UNBOUND.
Thus since commit ef557180447f ("workqueue: schedule WORK_CPU_UNBOUND work on wq_unbound_cpumask CPUs") there is no guarantee the future iterations will run on the originally intended cpu, although it's still preferred. I was able to demonstrate this with /sys/module/workqueue/parameters/debug_force_rr_cpu. IIUC, it may also happen due to migrating timers in nohz context. As a result, some cpu's would be calling cache_reap() more frequently and others never.
This patch uses schedule_delayed_work_on() with the current cpu when scheduling the next iteration.
--- mm/slab.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
mm/slab.c +2 -1
@@ -3915,7 +3915,8 @@ next:next_reap_node (); out:/* Set up the next iteration */ -schedule_delayed_work (work,round_jiffies_relative (REAPTIMEOUT_AC )); +schedule_delayed_work_on (smp_processor_id (), work, +round_jiffies_relative (REAPTIMEOUT_AC )); }#ifdef CONFIG_SLABINFO
Greg Kroah-Hartman
maintainerPATCH 30/97 usb: musb: gadget: misplaced out of bounds check
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heinrich Schuchardt <[email protected]>
commit af6f8529098aeb0e56a68671b450cf74e7a64fcd upstream.
musb->endpoints[] has array size MUSB_C_NUM_EPS.
We must check array bounds before accessing the array and not afterwards.
--- drivers/usb/musb/musb_gadget_ep0.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-)
drivers/usb/musb/musb_gadget_ep0.c +9 -5
@@ -114,15 +114,19 @@ static int service_tx_status_request( } is_in = epnum &USB_DIR_IN ; -if (is_in) { - epnum &=0x0f ; + epnum &=0x0f ; +if (epnum >=MUSB_C_NUM_EPS ) { + handled = -EINVAL ; +break ; + } + +if (is_in) ep = &musb->endpoints[epnum].ep_in; - }else { +else ep = &musb->endpoints[epnum].ep_out; - } regs = musb->endpoints[epnum].regs; -if (epnum >=MUSB_C_NUM_EPS || !ep->desc) { +if (!ep->desc) { handled = -EINVAL ;break ; }
Greg Kroah-Hartman
maintainerPATCH 31/97 ARM: dts: at91: at91sam9g25: fix mux-mask pinctrl property
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <[email protected]>
commit e8fd0adf105e132fd84545997bbef3d5edc2c9c1 upstream.
There are only 19 PIOB pins having primary names PB0-PB18. Not all of them have a 'C' function. So the pinctrl property mask ends up being the same as the other SoC of the at91sam9x5 series.
--- arch/arm/boot/dts/at91sam9g25.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/at91sam9g25.dtsi +1 -1
@@ -21,7 +21,7 @@ atmel,mux-mask = < /* A B C */ 0xffffffff 0xffe0399f 0xc000001c /* pioA */ - 0x0007ffff 0x8000fe3f 0x00000000 /* pioB */ + 0x0007ffff 0x00047e3f 0x00000000 /* pioB */ 0x80000000 0x07c0ffff 0xb83fffff /* pioC */ 0x003fffff 0x003f8000 0x00000000 /* pioD */ >;
Greg Kroah-Hartman
maintainerPATCH 32/97 ARM: dts: at91: sama5d4: fix pinctrl compatible string
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Santiago Esteban <[email protected]>
commit 9a06757dcc8509c162ac00488c8c82fc98e04227 upstream.
The compatible string is incorrect. Add atmel,sama5d3-pinctrl since it's the appropriate compatible string. Remove the atmel,at91rm9200-pinctrl compatible string, this fallback is useless, there are too many changes.
--- arch/arm/boot/dts/sama5d4.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/sama5d4.dtsi +1 -1
@@ -1354,7 +1354,7 @@ pinctrl@fc06a000 { #address-cells = <1>; #size-cells = <1>; - compatible = "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; + compatible = "atmel,sama5d3-pinctrl", "atmel,at91sam9x5-pinctrl", "simple-bus"; ranges = <0xfc068000 0xfc068000 0x100 0xfc06a000 0xfc06a000 0x4000>; /* WARNING: revisit as pin spec has changed */
Greg Kroah-Hartman
maintainerPATCH 33/97 xen-netfront: Fix hang on device removal
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Andryuk <[email protected]>
commit c2d2e6738a209f0f9dffa2dc8e7292fc45360d61 upstream.
A toolstack may delete the vif frontend and backend xenstore entries while xen-netfront is in the removal code path. In that case, the checks for xenbus_read_driver_state would return XenbusStateUnknown, and xennet_remove would hang indefinitely. This hang prevents system shutdown.
xennet_remove must be able to handle XenbusStateUnknown, and netback_changed must also wake up the wake_queue for that state as well.
--- drivers/net/xen-netfront.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/net/xen-netfront.c +6 -1
@@ -2024,7 +2024,10 @@ static void netback_changed(struct xenbucase XenbusStateInitialised:case XenbusStateReconfiguring:case XenbusStateReconfigured: +break ; +case XenbusStateUnknown: +wake_up_all (&module_unload_q);break ;case XenbusStateInitWait:
@@ -2155,7 +2158,9 @@ static int xennet_remove(struct xenbus_dxenbus_switch_state (dev, XenbusStateClosing);wait_event (module_unload_q,xenbus_read_driver_state (dev->otherend) == - XenbusStateClosing); + XenbusStateClosing || +xenbus_read_driver_state (dev->otherend) == + XenbusStateUnknown);xenbus_switch_state (dev, XenbusStateClosed); wait_event(module_unload_q,
Greg Kroah-Hartman
maintainerPATCH 34/97 regmap: Fix reversed bounds check in regmap_raw_write()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit f00e71091ab92eba52122332586c6ecaa9cd1a56 upstream.
We're supposed to be checking that "val_len" is not too large but instead we check if it is smaller than the max.
The only function affected would be regmap_i2c_smbus_i2c_write() in drivers/base/regmap/regmap-i2c.c. Strangely that function has its own limit check which returns an error if (count >= I2C_SMBUS_BLOCK_MAX) so it doesn't look like it has ever been able to do anything except return an error.
--- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/base/regmap/regmap.c +1 -1
@@ -1582,7 +1582,7 @@ int regmap_raw_write(struct regmap *map,return -EINVAL ;if (val_len % map->format.val_bytes)return -EINVAL ; -if (map->max_raw_write && map->max_raw_write > val_len) +if (map->max_raw_write && map->max_raw_write < val_len)return -E2BIG ; map->lock (map->lock_arg);
Greg Kroah-Hartman
maintainerPATCH 35/97 ACPI / video: Add quirk to force acpi-video backlight on Samsung 670Z5E
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <[email protected]>
commit bbf038618a24d72e2efc19146ef421bb1e1eda1a upstream.
Just like many other Samsung models, the 670Z5E needs to use the acpi-video backlight interface rather then the native one for backlight control to work, add a quirk for this.
--- drivers/acpi/video_detect.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/acpi/video_detect.c +9 -0
@@ -206,6 +206,15 @@ static const struct dmi_system_id video_ }, }, { +/* https://bugzilla.redhat.com/show_bug.cgi?id=1557060 */ + .callback = video_detect_force_video, + .ident = "SAMSUNG 670Z5E", + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"SAMSUNG ELECTRONICS CO., LTD." ), + DMI_MATCH(DMI_PRODUCT_NAME, "670Z5E"), + }, + }, + {/* https://bugzilla.redhat.com/show_bug.cgi?id=1094948 */ .callback = video_detect_force_video, .ident = "SAMSUNG 730U3E/740U3E",
Greg Kroah-Hartman
maintainerPATCH 36/97 ACPI / hotplug / PCI: Check presence of slot itself in get_slot_status()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
commit 13d3047c81505cc0fb9bdae7810676e70523c8bf upstream.
Mike Lothian reported that plugging in a USB-C device does not work properly in his Dell Alienware system. This system has an Intel Alpine Ridge Thunderbolt controller providing USB-C functionality. In these systems the USB controller (xHCI) is hotplugged whenever a device is connected to the port using ACPI-based hotplug.
The ACPI description of the root port in question is as follows:
Device (RP01)
{
Name (_ADR, 0x001C0000) Device (PXSX)
{
Name (_ADR, 0x02)
Method (_RMV, 0, NotSerialized)
{
// ...
}
}Here _ADR 0x02 means device 0, function 2 on the bus under root port (RP01) but that seems to be incorrect because device 0 is the upstream port of the Alpine Ridge PCIe switch and it has no functions other than 0 (the bridge itself). When we get ACPI Notify() to the root port resulting from connecting a USB-C device, Linux tries to read PCI_VENDOR_ID from device 0, function 2 which of course always returns 0xffffffff because there is no such function and we never find the device.
In Windows this works fine.
Now, since we get ACPI Notify() to the root port and not to the PXSX device we should actually start our scan from there as well and not from the non-existent PXSX device. Fix this by checking presence of the slot itself (function 0) if we fail to do that otherwise.
While there use pci_bus_read_dev_vendor_id() in get_slot_status(), which is the recommended way to read Device and Vendor IDs of devices on PCI buses.
--- drivers/pci/hotplug/acpiphp_glue.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
drivers/pci/hotplug/acpiphp_glue.c +16 -7
@@ -587,6 +587,7 @@ static unsigned int get_slot_status(stru {unsigned long long sta =0 ;struct acpiphp_func *func; +u32 dvid;list_for_each_entry (func, &slot->funcs, sibling) {if (func->flags &FUNC_HAS_STA ) {
@@ -597,19 +598,27 @@ static unsigned int get_slot_status(struif (ACPI_SUCCESS (status) && sta)break ; }else { -u32 dvid; - -pci_bus_read_config_dword (slot->bus, -PCI_DEVFN (slot->device, - func->function), -PCI_VENDOR_ID , &dvid); -if (dvid !=0xffffffff ) { +if (pci_bus_read_dev_vendor_id (slot->bus, +PCI_DEVFN (slot->device, func->function), + &dvid,0 )) { sta =ACPI_STA_ALL ;break ; } } } +if (!sta) { +/* +* Check for the slot itself since it may be that the +* ACPI slot is a device below PCIe upstream port so in +* that case it may not even be reachable yet. +*/ +if (pci_bus_read_dev_vendor_id (slot->bus, +PCI_DEVFN (slot->device,0 ), &dvid,0 )) { + sta =ACPI_STA_ALL ; + } + } +return (unsigned int )sta; }
Greg Kroah-Hartman
maintainerPATCH 37/97 USB:fix USB3 devices behind USB3 hubs not resuming at hibernate thaw
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhengjun Xing <[email protected]>
commit 64627388b50158fd24d6ad88132525b95a5ef573 upstream.
USB3 hubs don't support global suspend.
USB3 specification 10.10, Enhanced SuperSpeed hubs only support selective suspend and resume, they do not support global suspend/resume where the hub downstream facing ports states are not affected.
When system enters hibernation it first enters freeze process where only the root hub enters suspend, usb_port_suspend() is not called for other devices, and suspend status flags are not set for them. Other devices are expected to suspend globally. Some external USB3 hubs will suspend the downstream facing port at global suspend. These devices won't be resumed at thaw as the suspend status flag is not set.
A USB3 removable hard disk connected through a USB3 hub that won't resume at thaw will fail to synchronize SCSI cache, return “cmd cmplt err -71” error, and needs a 60 seconds timeout which causing system hang for 60s before the USB host reset the port for the USB3 removable hard disk to recover.
Fix this by always calling usb_port_suspend() during freeze for USB3 devices.
--- drivers/usb/core/generic.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/usb/core/generic.c +7 -2
@@ -208,8 +208,13 @@ static int generic_suspend(struct usb_deif (!udev->parent) rc =hcd_bus_suspend (udev, msg); -/* Non-root devices don't need to do anything for FREEZE or PRETHAW */ -else if (msg.event ==PM_EVENT_FREEZE || msg.event ==PM_EVENT_PRETHAW ) +/* +* Non-root USB2 devices don't need to do anything for FREEZE +* or PRETHAW. USB3 devices don't support global suspend and +* needs to be selectively suspended. +*/ +else if ((msg.event ==PM_EVENT_FREEZE || msg.event ==PM_EVENT_PRETHAW ) + && (udev->speed <USB_SPEED_SUPER )) rc =0 ;else rc =usb_port_suspend (udev, msg);
Greg Kroah-Hartman
maintainerPATCH 38/97 usb: dwc3: pci: Properly cleanup resource
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <[email protected]>
commit cabdf83dadfb3d83eec31e0f0638a92dbd716435 upstream.
Platform device is allocated before adding resources. Make sure to properly cleanup on error case.
--- drivers/usb/dwc3/dwc3-pci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/dwc3/dwc3-pci.c +1 -1
@@ -167,7 +167,7 @@ static int dwc3_pci_probe(struct pci_dev ret =platform_device_add_resources (dwc3, res,ARRAY_SIZE (res));if (ret) {dev_err (dev,"couldn't add resources to dwc3 device\n" ); -return ret; + goto err; }pci_set_drvdata (pci, dwc3);
Greg Kroah-Hartman
maintainerPATCH 39/97 HID: i2c-hid: fix size check and type usage
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
commit ac75a041048b8c1f7418e27621ca5efda8571043 upstream.
When convert char array with signed int, if the inbuf[x] is negative then upper bits will be set to 1. Fix this by using u8 instead of char.
ret_size has to be at least 3, hid_input_report use it after minus 2 bytes.
--- drivers/hid/i2c-hid/i2c-hid.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-)
drivers/hid/i2c-hid/i2c-hid.c +7 -6
@@ -137,10 +137,10 @@ struct i2c_hid {* register of the HID * descriptor. */ unsigned int bufsize;/* i2c buffer size */ -char *inbuf;/* Input buffer */ -char *rawbuf;/* Raw Input buffer */ -char *cmdbuf;/* Command buffer */ -char *argsbuf;/* Command arguments buffer */ +u8 *inbuf;/* Input buffer */ +u8 *rawbuf;/* Raw Input buffer */ +u8 *cmdbuf;/* Command buffer */ +u8 *argsbuf;/* Command arguments buffer */ unsigned long flags;/* device flags */
@@ -387,7 +387,8 @@ static int i2c_hid_hwreset(struct i2c_clstatic void i2c_hid_get_input (struct i2c_hid *ihid) { -int ret, ret_size; +int ret; +u32 ret_size;int size =le16_to_cpu (ihid->hdesc.wMaxInputLength);if (size > ihid->bufsize)
@@ -412,7 +413,7 @@ static void i2c_hid_get_input(struct i2creturn ; } -if (ret_size > size) { +if ((ret_size > size) || (ret_size <=2 )) {dev_err (&ihid->client->dev,"%s: incomplete report (%d/%d)\n" , __func__, size, ret_size);return ;
Greg Kroah-Hartman
maintainerPATCH 40/97 powerpc/powernv: Handle unknown OPAL errors in opal_nvram_write()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit 741de617661794246f84a21a02fc5e327bffc9ad upstream.
opal_nvram_write currently just assumes success if it encounters an error other than OPAL_BUSY or OPAL_BUSY_EVENT. Have it return -EIO on other errors instead.
--- arch/powerpc/platforms/powernv/opal-nvram.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/powerpc/platforms/powernv/opal-nvram.c +4 -0
@@ -59,6 +59,10 @@ static ssize_t opal_nvram_write(char *buif (rc ==OPAL_BUSY_EVENT )opal_poll_events (NULL ); } + +if (rc) +return -EIO ; + *index += count;return count; }
Greg Kroah-Hartman
maintainerPATCH 41/97 powerpc/64: Fix smp_wmb barrier definition use use lwsync consistently
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit 0bfdf598900fd62869659f360d3387ed80eb71cf upstream.
asm/barrier.h is not always included after asm/synch.h, which meant it was missing __SUBARCH_HAS_LWSYNC, so in some files smp_wmb() would be eieio when it should be lwsync. kernel/time/hrtimer.c is one case.
__SUBARCH_HAS_LWSYNC is only used in one place, so just fold it in to where it's used. Previously with my small simulator config, 377 instances of eieio in the tree. After this patch there are 55.
--- arch/powerpc/include/asm/barrier.h | 3 ++- arch/powerpc/include/asm/synch.h | 4 ---- 2 files changed, 2 insertions(+), 5 deletions(-)
arch/powerpc/include/asm/barrier.h +2 -1
@@ -36,7 +36,8 @@#define smp_store_mb (var, value) do { WRITE_ONCE(var, value); mb(); } while (0) -#ifdef __SUBARCH_HAS_LWSYNC +/* The sub-arch has lwsync */ +#if defined(__powerpc64__) || defined(CONFIG_PPC_E500MC )# define SMPWMB LWSYNC#else # define SMPWMB eieio
arch/powerpc/include/asm/synch.h +0 -4
@@ -5,10 +5,6 @@#include <linux/stringify.h> #include <asm/feature-fixups.h> -#if defined(__powerpc64__) || defined(CONFIG_PPC_E500MC ) -#define __SUBARCH_HAS_LWSYNC -#endif -#ifndef __ASSEMBLY__extern unsigned int __start___lwsync_fixup, __stop___lwsync_fixup; extern void do_lwsync_fixups(unsigned long value, void *fixup_start,
Greg Kroah-Hartman
maintainerPATCH 43/97 HID: Fix hid_report_len usage
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
commit 3064a03b94e60388f0955fcc29f3e8a978d28f75 upstream.
Follow the change of return type u32 of hid_report_len, fix all the types of variables those get the return value of hid_report_len to u32, and all other code already uses u32.
--- drivers/hid/hid-input.c | 3 ++- drivers/hid/hid-multitouch.c | 5 +++-- drivers/hid/hid-rmi.c | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-)
drivers/hid/hid-input.c +2 -1
@@ -1258,7 +1258,8 @@ static void hidinput_led_worker(struct w led_work);struct hid_field *field;struct hid_report *report; -int len, ret; +int ret; +u32 len;__u8 *buf; field =hidinput_get_led_field (hid);
drivers/hid/hid-multitouch.c +3 -2
@@ -314,7 +314,8 @@ static struct attribute_group mt_attribustatic void mt_get_feature (struct hid_device *hdev,struct hid_report *report) {struct mt_device *td =hid_get_drvdata (hdev); -int ret, size =hid_report_len (report); +int ret; +u32 size =hid_report_len (report);u8 *buf;/*
@@ -919,7 +920,7 @@ static void mt_set_input_mode(struct hidstruct hid_report_enum *re;struct mt_class *cls = &td->mtclass;char *buf; -int report_len; +u32 report_len;if (td->inputmode <0 )return ;
drivers/hid/hid-rmi.c +2 -2
@@ -110,8 +110,8 @@ struct rmi_data {u8 *writeReport;u8 *readReport; -int input_report_size; -int output_report_size; +u32 input_report_size; +u32 output_report_size;unsigned long flags;
Greg Kroah-Hartman
maintainerPATCH 44/97 HID: core: Fix size as type u32
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <[email protected]>
commit 6de0b13cc0b4ba10e98a9263d7a83b940720b77a upstream.
When size is negative, calling memset will make segment fault. Declare the size as type u32 to keep memset safe.
size in struct hid_report is unsigned, fix return type of hid_report_len to u32.
--- drivers/hid/hid-core.c | 10 +++++----- include/linux/hid.h | 6 +++--- 2 files changed, 8 insertions(+), 8 deletions(-)
drivers/hid/hid-core.c +5 -5
@@ -1331,7 +1331,7 @@ u8 *hid_alloc_report_buf(struct hid_repo* of implement() working on 8 byte chunks */ -int len =hid_report_len (report) +7 ; +u32 len =hid_report_len (report) +7 ;return kmalloc (len, flags); }
@@ -1396,7 +1396,7 @@ void __hid_request(struct hid_device *hi {char *buf;int ret; -int len; +u32 len; buf =hid_alloc_report_buf (report,GFP_KERNEL );if (!buf)
@@ -1422,14 +1422,14 @@ out: }EXPORT_SYMBOL_GPL (__hid_request); -int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,u32 size,int interrupt) {struct hid_report_enum *report_enum = hid->report_enum + type;struct hid_report *report;struct hid_driver *hdrv;unsigned int a; -int rsize, csize = size; +u32 rsize, csize = size;u8 *cdata = data;int ret =0 ;
@@ -1487,7 +1487,7 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event);* * This is data entry for lower layers. */ -int hid_input_report (struct hid_device *hid,int type,u8 *data,int size,int interrupt) +int hid_input_report (struct hid_device *hid,int type,u8 *data,u32 size,int interrupt) {struct hid_report_enum *report_enum;struct hid_driver *hdrv;
include/linux/hid.h +3 -3
@@ -793,7 +793,7 @@ extern int hidinput_connect(struct hid_dextern void hidinput_disconnect (struct hid_device *);int hid_set_field (struct hid_field *,unsigned ,__s32 ); -int hid_input_report (struct hid_device *,int type,u8 *,int ,int ); +int hid_input_report (struct hid_device *,int type,u8 *,u32 ,int );int hidinput_find_field (struct hid_device *hid,unsigned int type,unsigned int code,struct hid_field **field);struct hid_field *hidinput_get_led_field (struct hid_device *hid);unsigned int hidinput_count_leds (struct hid_device *hid);
@@ -1098,13 +1098,13 @@ static inline void hid_hw_wait(struct hi* * @report: the report we want to know the length */ -static inline int hid_report_len (struct hid_report *report) +static inline u32 hid_report_len (struct hid_report *report) {/* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ return ((report->size -1 ) >>3 ) +1 + (report->id >0 ); } -int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,int size, +int hid_report_raw_event (struct hid_device *hid,int type,u8 *data,u32 size,int interrupt);/* HID quirks API */
Greg Kroah-Hartman
maintainerPATCH 45/97 ASoC: ssm2602: Replace reg_default_raw with reg_default
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Kelly <[email protected]>
commit a01df75ce737951ad13a08d101306e88c3f57cb2 upstream.
SSM2602 driver is broken on recent kernels (at least since 4.9). User space applications such as amixer or alsamixer get EIO when attempting to access codec controls via the relevant IOCTLs.
Root cause of these failures is the regcache_hw_init function in drivers/base/regmap/regcache.c, which prevents regmap cache initalization from the reg_defaults_raw element of the regmap_config structure when registers are write only. It also disables the regmap cache entirely when all registers are write only or volatile as is the case for the SSM2602 driver.
Using the reg_defaults element of the regmap_config structure rather than the reg_defaults_raw element to initalize the regmap cache avoids the logic in the regcache_hw_init function entirely. It also makes this driver consistent with other ASoC codec drivers, as this driver was the ONLY codec driver that used the reg_defaults_raw element to initalize the cache.
Tested on Digilent Zybo Z7 development board which has a SSM2603 codec chip connected to a Xilinx Zynq SoC.
--- sound/soc/codecs/ssm2602.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
sound/soc/codecs/ssm2602.c +13 -6
@@ -54,10 +54,17 @@ struct ssm2602_priv {* using 2 wire for device control, so we cache them instead. * There is no point in caching the reset register */ -static const u16 ssm2602_reg[SSM2602_CACHEREGNUM ] = { -0x0097 ,0x0097 ,0x0079 ,0x0079 , -0x000a ,0x0008 ,0x009f ,0x000a , -0x0000 ,0x0000 +static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM ] = { + { .reg =0x00 , .def =0x0097 }, + { .reg =0x01 , .def =0x0097 }, + { .reg =0x02 , .def =0x0079 }, + { .reg =0x03 , .def =0x0079 }, + { .reg =0x04 , .def =0x000a }, + { .reg =0x05 , .def =0x0008 }, + { .reg =0x06 , .def =0x009f }, + { .reg =0x07 , .def =0x000a }, + { .reg =0x08 , .def =0x0000 }, + { .reg =0x09 , .def =0x0000 } };
@@ -618,8 +625,8 @@ const struct regmap_config ssm2602_regma .volatile_reg = ssm2602_register_volatile, .cache_type = REGCACHE_RBTREE, - .reg_defaults_raw = ssm2602_reg, - .num_reg_defaults_raw = ARRAY_SIZE(ssm2602_reg), + .reg_defaults = ssm2602_reg, + .num_reg_defaults = ARRAY_SIZE(ssm2602_reg), };EXPORT_SYMBOL_GPL (ssm2602_regmap_config);
Greg Kroah-Hartman
maintainerPATCH 49/97 ext4: dont update checksum of new initialized bitmaps
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 044e6e3d74a3d7103a0c8a9305dfd94d64000660 upstream.
When reading the inode or block allocation bitmap, if the bitmap needs to be initialized, do not update the checksum in the block group descriptor. That's because we're not set up to journal those changes. Instead, just set the verified bit on the bitmap block, so that it's not necessary to validate the checksum.
When a block or inode allocation actually happens, at that point the checksum will be calculated, and update of the bg descriptor block will be properly journalled.
--- fs/ext4/balloc.c | 3 +-- fs/ext4/ialloc.c | 47 +++-------------------------------------------- 2 files changed, 4 insertions(+), 46 deletions(-)
fs/ext4/balloc.c +1 -2
@@ -242,8 +242,6 @@ static int ext4_init_block_bitmap(struct*/ ext4_mark_bitmap_end (num_clusters_in_group (sb, block_group), sb->s_blocksize *8 , bh->b_data); -ext4_block_bitmap_csum_set (sb, block_group, gdp, bh); -ext4_group_desc_csum_set (sb, block_group, gdp);return 0 ; }
@@ -447,6 +445,7 @@ ext4_read_block_bitmap_nowait(struct sup err =ext4_init_block_bitmap (sb, bh, block_group, desc);set_bitmap_uptodate (bh);set_buffer_uptodate (bh); +set_buffer_verified (bh);ext4_unlock_group (sb, block_group);unlock_buffer (bh);if (err) {
fs/ext4/ialloc.c +3 -44
64 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 50/97 ext4: add validity checks for bitmap block numbers
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 7dac4a1726a9c64a517d595c40e95e2d0d135f6f upstream.
An privileged attacker can cause a crash by mounting a crafted ext4 image which triggers a out-of-bounds read in the function ext4_valid_block_bitmap() in fs/ext4/balloc.c.
This issue has been assigned CVE-2018-1093.
--- fs/ext4/balloc.c | 16 ++++++++++++++-- fs/ext4/ialloc.c | 7 +++++++ 2 files changed, 21 insertions(+), 2 deletions(-)
fs/ext4/balloc.c +14 -2
@@ -337,20 +337,25 @@ static ext4_fsblk_t ext4_valid_block_bit/* check whether block bitmap block number is set */ blk =ext4_block_bitmap (sb, desc); offset = blk - group_first_block; -if (!ext4_test_bit (EXT4_B2C (sbi, offset), bh->b_data)) +if (offset <0 ||EXT4_B2C (sbi, offset) >= sb->s_blocksize || + !ext4_test_bit (EXT4_B2C (sbi, offset), bh->b_data))/* bad block bitmap */ return blk;/* check whether the inode bitmap block number is set */ blk =ext4_inode_bitmap (sb, desc); offset = blk - group_first_block; -if (!ext4_test_bit (EXT4_B2C (sbi, offset), bh->b_data)) +if (offset <0 ||EXT4_B2C (sbi, offset) >= sb->s_blocksize || + !ext4_test_bit (EXT4_B2C (sbi, offset), bh->b_data))/* bad block bitmap */ return blk;/* check whether the inode table block number is set */ blk =ext4_inode_table (sb, desc); offset = blk - group_first_block; +if (offset <0 ||EXT4_B2C (sbi, offset) >= sb->s_blocksize || +EXT4_B2C (sbi, offset + sbi->s_itb_per_group) >= sb->s_blocksize) +return blk; next_zero_bit =ext4_find_next_zero_bit (bh->b_data,EXT4_B2C (sbi, offset +EXT4_SB (sb)->s_itb_per_group),EXT4_B2C (sbi, offset));
@@ -416,6 +421,7 @@ struct buffer_head * ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) {struct ext4_group_desc *desc; +struct ext4_sb_info *sbi =EXT4_SB (sb);struct buffer_head *bh;ext4_fsblk_t bitmap_blk;int err;
@@ -424,6 +430,12 @@ ext4_read_block_bitmap_nowait(struct supif (!desc)return ERR_PTR (-EFSCORRUPTED ); bitmap_blk =ext4_block_bitmap (sb, desc); +if ((bitmap_blk <=le32_to_cpu (sbi->s_es->s_first_data_block)) || + (bitmap_blk >=ext4_blocks_count (sbi->s_es))) { +ext4_error (sb,"Invalid block bitmap block %llu in " +"block_group %u" , bitmap_blk, block_group); +return ERR_PTR (-EFSCORRUPTED ); + } bh =sb_getblk (sb, bitmap_blk);if (unlikely (!bh)) { ext4_error(sb, "Cannot get buffer for block bitmap - "
fs/ext4/ialloc.c +7 -0
@@ -119,6 +119,7 @@ static struct buffer_head * ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) {struct ext4_group_desc *desc; +struct ext4_sb_info *sbi =EXT4_SB (sb);struct buffer_head *bh =NULL ;ext4_fsblk_t bitmap_blk;int err;
@@ -128,6 +129,12 @@ ext4_read_inode_bitmap(struct super_blocreturn ERR_PTR (-EFSCORRUPTED ); bitmap_blk =ext4_inode_bitmap (sb, desc); +if ((bitmap_blk <=le32_to_cpu (sbi->s_es->s_first_data_block)) || + (bitmap_blk >=ext4_blocks_count (sbi->s_es))) { +ext4_error (sb,"Invalid inode bitmap blk %llu in " +"block_group %u" , bitmap_blk, block_group); +return ERR_PTR (-EFSCORRUPTED ); + } bh =sb_getblk (sb, bitmap_blk);if (unlikely (!bh)) { ext4_error(sb, "Cannot read inode bitmap - "
Greg Kroah-Hartman
maintainerPATCH 52/97 RDMA/ucma: Dont allow setting RDMA_OPTION_IB_PATH without an RDMA device
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roland Dreier <[email protected]>
commit 8435168d50e66fa5eae01852769d20a36f9e5e83 upstream.
Check to make sure that ctx->cm_id->device is set before we use it. Otherwise userspace can trigger a NULL dereference by doing RDMA_USER_CM_CMD_SET_OPTION on an ID that is not bound to a device.
--- drivers/infiniband/core/ucma.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/infiniband/core/ucma.c +3 -0
@@ -1230,6 +1230,9 @@ static int ucma_set_ib_path(struct ucma_if (!optlen)return -EINVAL ; +if (!ctx->cm_id->device) +return -EINVAL ; +memset (&sa_path,0 ,sizeof (sa_path));ib_sa_unpack_path (path_data->path_rec, &sa_path);
Greg Kroah-Hartman
maintainerPATCH 53/97 ALSA: pcm: Fix UAF at PCM release via PCM timer access
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit a820ccbe21e8ce8e86c39cd1d3bc8c7d1cbb949b upstream.
The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via substream->runtime, and it's cleared at snd_pcm_detach_substream().
The runtime object assignment is protected by PCM open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, as snd_pcm_timer_resolution() tries to access the runtime while clearing it in other side.
Fortunately, it's the only concurrent access from the PCM timer, and it merely reads runtime->timer_resolution field. So, we can avoid the race by reordering kfree() and wrapping the substream->runtime clearance with the corresponding timer lock.
--- sound/core/pcm.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
sound/core/pcm.c +7 -1
@@ -28,6 +28,7 @@#include <sound/core.h> #include <sound/minors.h> #include <sound/pcm.h> +#include <sound/timer.h> #include <sound/control.h> #include <sound/info.h>
@@ -1025,8 +1026,13 @@ void snd_pcm_detach_substream(struct sndsnd_free_pages ((void *)runtime->control,PAGE_ALIGN (sizeof (struct snd_pcm_mmap_control )));kfree (runtime->hw_constraints.rules); -kfree (runtime); +/* Avoid concurrent access to runtime via PCM timer interface */ +if (substream->timer) +spin_lock_irq (&substream->timer->lock); substream->runtime =NULL ; +if (substream->timer) +spin_unlock_irq (&substream->timer->lock); +kfree (runtime);put_pid (substream->pid); substream->pid =NULL ; substream->pstr->substream_opened--;
Greg Kroah-Hartman
maintainerPATCH 55/97 IB/srp: Fix completion vector assignment algorithm
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 3a148896b24adf8688dc0c59af54531931677a40 upstream.
Ensure that cv_end is equal to ibdev->num_comp_vectors for the NUMA node with the highest index. This patch improves spreading of RDMA channels over completion vectors and thereby improves performance, especially on systems with only a single NUMA node. This patch drops support for the comp_vector login parameter by ignoring the value of that parameter since I have not found a good way to combine support for that parameter and automatic spreading of RDMA channels over completion vectors.
--- drivers/infiniband/ulp/srp/ib_srp.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.c +4 -6
@@ -3311,12 +3311,10 @@ static ssize_t srp_create_target(struct num_online_nodes());const int ch_end = ((node_idx +1 ) * target->ch_count /num_online_nodes ()); -const int cv_start = (node_idx * ibdev->num_comp_vectors / -num_online_nodes () + target->comp_vector) - % ibdev->num_comp_vectors; -const int cv_end = ((node_idx +1 ) * ibdev->num_comp_vectors / -num_online_nodes () + target->comp_vector) - % ibdev->num_comp_vectors; +const int cv_start = node_idx * ibdev->num_comp_vectors / +num_online_nodes (); +const int cv_end = (node_idx +1 ) * ibdev->num_comp_vectors / +num_online_nodes ();int cpu_idx =0 ;for_each_online_cpu (cpu) {
Greg Kroah-Hartman
maintainerPATCH 56/97 dmaengine: at_xdmac: fix rare residue corruption
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxime Jayat <[email protected]>
commit c5637476bbf9bb86c7f0413b8f4822a73d8d2d07 upstream.
Despite the efforts made to correctly read the NDA and CUBC registers, the order in which the registers are read could sometimes lead to an inconsistent state.
Re-using the timeline from the comments, this following timing of registers reads could lead to reading NDA with value "@desc2" and CUBC with value "MAX desc1":
INITD -------- ------------
|____________________|
_______________________ _______________
NDA @desc2 \/ @desc3
_______________________/\_______________
__________ ___________ _______________ CUBC 0 \/ MAX desc1 \/ MAX desc2
__________/\___________/\_______________
| | | |
Events:(1)(2) (3)(4)
(1) check_nda = @desc2
(2) initd = 1
(3) cur_ubc = MAX desc1
(4) cur_nda = @desc2
This is allowed by the condition ((check_nda == cur_nda) && initd), despite cur_ubc and cur_nda being in the precise state we don't want.
This error leads to incorrect residue computation.
Fix it by inversing the order in which CUBC and INITD are read. This makes sure that NDA and CUBC are always read together either _before_ INITD goes to 0 or _after_ it is back at 1.
The case where NDA is read before INITD is at 0 and CUBC is read after INITD is back at 1 will be rejected by check_nda and cur_nda being different.
--- drivers/dma/at_xdmac.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/dma/at_xdmac.c +2 -2
@@ -1473,10 +1473,10 @@ at_xdmac_tx_status(struct dma_chan *chanfor (retry =0 ; retry <AT_XDMAC_RESIDUE_MAX_RETRIES ; retry++) { check_nda =at_xdmac_chan_read (atchan,AT_XDMAC_CNDA ) &0xfffffffc ;rmb (); - initd = !!(at_xdmac_chan_read (atchan,AT_XDMAC_CC ) &AT_XDMAC_CC_INITD ); -rmb (); cur_ubc =at_xdmac_chan_read (atchan,AT_XDMAC_CUBC );rmb (); + initd = !!(at_xdmac_chan_read (atchan,AT_XDMAC_CC ) &AT_XDMAC_CC_INITD ); +rmb (); cur_nda =at_xdmac_chan_read (atchan,AT_XDMAC_CNDA ) &0xfffffffc ;rmb ();
Greg Kroah-Hartman
maintainerPATCH 57/97 um: Use POSIX ucontext_t instead of struct ucontext
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Mazur <[email protected]>
commit 4d1a535b8ec5e74b42dfd9dc809142653b2597f6 upstream.
glibc 2.26 removed the 'struct ucontext' to "improve" POSIX compliance and break programs, including User Mode Linux. Fix User Mode Linux by using POSIX ucontext_t.
This fixes:
arch/um/os-Linux/signal.c: In function 'hard_handler':arch/um/os-Linux/signal.c:163:22: error: dereferencing pointer to incomplete type 'struct ucontext'
mcontext_t *mc = &uc->uc_mcontext;arch/x86/um/stub_segv.c: In function 'stub_segv_handler':arch/x86/um/stub_segv.c:16:13: error: dereferencing pointer to incomplete type 'struct ucontext'
&uc->uc_mcontext);
--- arch/um/os-Linux/signal.c | 2 +- arch/x86/um/stub_segv.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
arch/um/os-Linux/signal.c +1 -1
@@ -140,7 +140,7 @@ static void (*handlers[_NSIG])(int sig,static void hard_handler (int sig,siginfo_t *si,void *p) { -struct ucontext *uc = p; +ucontext_t *uc = p;mcontext_t *mc = &uc->uc_mcontext;unsigned long pending =1UL << sig;
arch/x86/um/stub_segv.c +1 -1
@@ -10,7 +10,7 @@void __attribute__ ((__section__ (".__syscall_stub" )))stub_segv_handler (int sig,siginfo_t *info,void *p) { -struct ucontext *uc = p; +ucontext_t *uc = p;GET_FAULTINFO_FROM_MC (*((struct faultinfo *)STUB_DATA ), &uc->uc_mcontext);
Greg Kroah-Hartman
maintainerPATCH 58/97 iommu/vt-d: Fix a potential memory leak
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Baolu <[email protected]>
commit bbe4b3af9d9e3172fb9aa1f8dcdfaedcb381fc64 upstream.
A memory block was allocated in intel_svm_bind_mm() but never freed in a failure path. This patch fixes this by free it to avoid memory leakage.
--- drivers/iommu/intel-svm.c | 1 + 1 file changed, 1 insertion(+)
drivers/iommu/intel-svm.c +1 -0
@@ -389,6 +389,7 @@ int intel_svm_bind_mm(struct device *dev pasid_max - 1, GFP_KERNEL);if (ret <0 ) {kfree (svm); +kfree (sdev); goto out; } svm->pasid = ret;
Greg Kroah-Hartman
maintainerPATCH 60/97 clk: mvebu: armada-38x: add support for 1866MHz variants
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Sennhauser <[email protected]>
commit 9593f4f56cf5d1c443f66660a0c7f01de38f979d upstream.
The Linksys WRT3200ACM CPU is clocked at 1866MHz. Add 1866MHz to the list of supported CPU frequencies. Also update multiplier and divisor for the l2clk and ddrclk.
Noticed by the following warning:
[ 0.000000] Selected CPU frequency (16) unsupported
--- drivers/clk/mvebu/armada-38x.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/clk/mvebu/armada-38x.c +4 -3
@@ -49,7 +49,8 @@ static const u32 armada_38x_cpu_frequenc0 ,0 ,0 ,0 ,1066 *1000 *1000 ,0 ,0 ,0 ,1332 *1000 *1000 ,0 ,0 ,0 , - 1600 * 1000 * 1000, +1600 *1000 *1000 ,0 ,0 ,0 , + 1866 * 1000 * 1000, };static u32 __init armada_38x_get_cpu_freq (void __iomem *sar)
@@ -79,7 +80,7 @@ static const int armada_38x_cpu_l2_ratio {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, - {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1},
@@ -90,7 +91,7 @@ static const int armada_38x_cpu_ddr_rati {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, - {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1},
Greg Kroah-Hartman
maintainerPATCH 62/97 clk: bcm2835: De-assert/assert PLL reset signal when appropriate
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <[email protected]>
commit 753872373b599384ac7df809aa61ea12d1c4d5d1 upstream.
In order to enable a PLL, not only the PLL has to be powered up and locked, but you also have to de-assert the reset signal. The last part was missing. Add it so PLLs that were not enabled by the FW/bootloader can be enabled from Linux.
--- drivers/clk/bcm/clk-bcm2835.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/clk/bcm/clk-bcm2835.c +5 -3
@@ -891,9 +891,7 @@ static void bcm2835_pll_off(struct clk_hconst struct bcm2835_pll_data *data = pll->data;spin_lock (&cprman->regs_lock); -cprman_write (cprman, data->cm_ctrl_reg, -cprman_read (cprman, data->cm_ctrl_reg) | -CM_PLL_ANARST ); +cprman_write (cprman, data->cm_ctrl_reg,CM_PLL_ANARST );cprman_write (cprman, data->a2w_ctrl_reg,cprman_read (cprman, data->a2w_ctrl_reg) |A2W_PLL_CTRL_PWRDN );
@@ -929,6 +927,10 @@ static int bcm2835_pll_on(struct clk_hwcpu_relax (); } +cprman_write (cprman, data->a2w_ctrl_reg, +cprman_read (cprman, data->a2w_ctrl_reg) | +A2W_PLL_CTRL_PRST_DISABLE ); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 63/97 thermal: imx: Fix race condition in imx_thermal_probe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikhail Lappo <[email protected]>
commit cf1ba1d73a33944d8c1a75370a35434bf146b8a7 upstream.
When device boots with T > T_trip_1 and requests interrupt, the race condition takes place. The interrupt comes before THERMAL_DEVICE_ENABLED is set. This leads to an attempt to reading sensor value from irq and disabling the sensor, based on the data->mode field, which expected to be THERMAL_DEVICE_ENABLED, but still stays as THERMAL_DEVICE_DISABLED. Afher this issue sensor is never re-enabled, as the driver state is wrong.
Fix this problem by setting the 'data' members prior to requesting the interrupts.
--- drivers/thermal/imx_thermal.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/thermal/imx_thermal.c +3 -3
@@ -589,6 +589,9 @@ static int imx_thermal_probe(struct platregmap_write (map,TEMPSENSE0 +REG_CLR ,TEMPSENSE0_POWER_DOWN );regmap_write (map,TEMPSENSE0 +REG_SET ,TEMPSENSE0_MEASURE_TEMP ); + data->irq_enabled = true; + data->mode =THERMAL_DEVICE_ENABLED ; + ret =devm_request_threaded_irq (&pdev->dev, data->irq, imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread,0 ,"imx_thermal" , data);
@@ -600,9 +603,6 @@ static int imx_thermal_probe(struct platreturn ret; } - data->irq_enabled = true; - data->mode =THERMAL_DEVICE_ENABLED ; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 64/97 watchdog: f71808e_wdt: Fix WD_EN register read
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <[email protected]>
commit 977f6f68331f94bb72ad84ee96b7b87ce737d89d upstream.
F71808FG_FLAG_WD_EN defines bit position, not a bitmask
--- drivers/watchdog/f71808e_wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/f71808e_wdt.c +1 -1
@@ -450,7 +450,7 @@ static bool watchdog_is_running(void) is_running = (superio_inb (watchdog.sioaddr,SIO_REG_ENABLE ) &BIT (0 )) && (superio_inb (watchdog.sioaddr,F71808FG_REG_WDT_CONF ) - &F71808FG_FLAG_WD_EN ); + &BIT (F71808FG_FLAG_WD_EN ));superio_exit (watchdog.sioaddr);
Greg Kroah-Hartman
maintainerPATCH 65/97 ALSA: oss: consolidate kmalloc/memset 0 call to kzalloc
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Mc Guire <[email protected]>
commit 46325371b230cc66c743925c930a17e7d0b8211e upstream.
This is an API consolidation only. The use of kmalloc + memset to 0 is equivalent to kzalloc.
--- sound/core/oss/pcm_oss.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/core/oss/pcm_oss.c +1 -2
@@ -853,7 +853,7 @@ static int snd_pcm_oss_change_params(strreturn -EAGAIN ; }else if (mutex_lock_interruptible (&runtime->oss.params_lock))return -EINTR ; - sw_params =kmalloc (sizeof (*sw_params),GFP_KERNEL ); + sw_params =kzalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL ); sparams =kmalloc (sizeof (*sparams),GFP_KERNEL );if (!sw_params || !params || !sparams) {
@@ -991,7 +991,6 @@ static int snd_pcm_oss_change_params(str goto failure; } -memset (sw_params,0 ,sizeof (*sw_params));if (runtime->oss.trigger) { sw_params->start_threshold =1 ; }else {
Greg Kroah-Hartman
maintainerPATCH 66/97 ALSA: pcm: Use ERESTARTSYS instead of EINTR in OSS emulation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit c64ed5dd9feba193c76eb460b451225ac2a0d87b upstream.
Fix the last standing EINTR in the whole subsystem. Use more correct ERESTARTSYS for pending signals.
--- sound/core/oss/pcm_oss.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/core/oss/pcm_oss.c +1 -1
@@ -852,7 +852,7 @@ static int snd_pcm_oss_change_params(strif (!(mutex_trylock (&runtime->oss.params_lock)))return -EAGAIN ; }else if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -EINTR ; +return -ERESTARTSYS ; sw_params =kzalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL ); sparams =kmalloc (sizeof (*sparams),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 67/97 ALSA: pcm: Avoid potential races between OSS ioctls and read/write
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 02a5d6925cd34c3b774bdb8eefb057c40a30e870 upstream.
Although we apply the params_lock mutex to the whole read and write operations as well as snd_pcm_oss_change_params(), we may still face some races.
First off, the params_lock is taken inside the read and write loop. This is intentional for avoiding the too long locking, but it allows the in-between parameter change, which might lead to invalid pointers. We check the readiness of the stream and set up via snd_pcm_oss_make_ready() at the beginning of read and write, but it's called only once, by assuming that it remains ready in the rest.
Second, many ioctls that may change the actual parameters (i.e. setting runtime->oss.params=1) aren't protected, hence they can be processed in a half-baked state.
This patch is an attempt to plug these holes. The stream readiness check is moved inside the read/write inner loop, so that the stream is always set up in a proper state before further processing. Also, each ioctl that may change the parameter is wrapped with the params_lock for avoiding the races.
The issues were triggered by syzkaller in a few different scenarios, particularly the one below appearing as GPF in loopback_pos_update.
--- sound/core/oss/pcm_oss.c | 134 +++++++++++++++++++++++++++++++++++++---------- 1 file changed, 106 insertions(+), 28 deletions(-)
sound/core/oss/pcm_oss.c +106 -28
@@ -833,8 +833,8 @@ static int choose_rate(struct snd_pcm_sureturn snd_pcm_hw_param_near (substream, params,SNDRV_PCM_HW_PARAM_RATE , best_rate,NULL ); } -static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream, -bool trylock) +/* call with params_lock held */ +static int snd_pcm_oss_change_params_locked (struct snd_pcm_substream *substream) {struct snd_pcm_runtime *runtime = substream->runtime;struct snd_pcm_hw_params *params, *sparams;
@@ -848,11 +848,8 @@ static int snd_pcm_oss_change_params(strstruct snd_mask sformat_mask;struct snd_mask mask; -if (trylock) { -if (!(mutex_trylock (&runtime->oss.params_lock))) -return -EAGAIN ; - }else if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; +if (!runtime->oss.params) +return 0 ; sw_params =kzalloc (sizeof (*sw_params),GFP_KERNEL ); params =kmalloc (sizeof (*params),GFP_KERNEL ); sparams =kmalloc (sizeof (*sparams),GFP_KERNEL );
@@ -1078,6 +1075,23 @@ failure:kfree (sw_params);kfree (params);kfree (sparams); +return err; +} + +/* this one takes the lock by itself */ +static int snd_pcm_oss_change_params (struct snd_pcm_substream *substream, +bool trylock) +{ +struct snd_pcm_runtime *runtime = substream->runtime; +int err; + +if (trylock) { +if (!(mutex_trylock (&runtime->oss.params_lock))) +return -EAGAIN ; + }else if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; + + err =snd_pcm_oss_change_params_locked (substream);mutex_unlock (&runtime->oss.params_lock);return err; }
@@ -1106,11 +1120,14 @@ static int snd_pcm_oss_get_active_substrreturn 0 ; } +/* call with params_lock held */ static int snd_pcm_oss_prepare (struct snd_pcm_substream *substream) {int err;struct snd_pcm_runtime *runtime = substream->runtime; +if (!runtime->oss.prepare) +return 0 ; err =snd_pcm_kernel_ioctl (substream,SNDRV_PCM_IOCTL_PREPARE ,NULL );if (err <0 ) { pcm_dbg(substream->pcm,
@@ -1130,8 +1147,6 @@ static int snd_pcm_oss_make_ready(structstruct snd_pcm_runtime *runtime;int err; -if (substream ==NULL ) -return 0 ; runtime = substream->runtime;if (runtime->oss.params) { err =snd_pcm_oss_change_params (substream, false);
@@ -1139,6 +1154,29 @@ static int snd_pcm_oss_make_ready(structreturn err; }if (runtime->oss.prepare) { +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; + err =snd_pcm_oss_prepare (substream); +mutex_unlock (&runtime->oss.params_lock); +if (err <0 ) +return err; + } +return 0 ; +} + +/* call with params_lock held */ +static int snd_pcm_oss_make_ready_locked (struct snd_pcm_substream *substream) +{ +struct snd_pcm_runtime *runtime; +int err; + + runtime = substream->runtime; +if (runtime->oss.params) { + err =snd_pcm_oss_change_params_locked (substream); +if (err <0 ) +return err; + } +if (runtime->oss.prepare) { err =snd_pcm_oss_prepare (substream);if (err <0 )return err;
@@ -1366,13 +1404,14 @@ static ssize_t snd_pcm_oss_write1(structif (atomic_read (&substream->mmap_count))return -ENXIO ; -if ((tmp =snd_pcm_oss_make_ready (substream)) <0 ) -return tmp;while (bytes >0 ) {if (mutex_lock_interruptible (&runtime->oss.params_lock)) { tmp = -ERESTARTSYS ;break ; } + tmp =snd_pcm_oss_make_ready_locked (substream); +if (tmp <0 ) + goto err;if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used >0 ) { tmp = bytes;if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes)
@@ -1473,13 +1512,14 @@ static ssize_t snd_pcm_oss_read1(structif (atomic_read (&substream->mmap_count))return -ENXIO ; -if ((tmp =snd_pcm_oss_make_ready (substream)) <0 ) -return tmp;while (bytes >0 ) {if (mutex_lock_interruptible (&runtime->oss.params_lock)) { tmp = -ERESTARTSYS ;break ; } + tmp =snd_pcm_oss_make_ready_locked (substream); +if (tmp <0 ) + goto err;if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used >0 ) {if (runtime->oss.buffer_used ==0 ) { tmp =snd_pcm_oss_read2 (substream, runtime->oss.buffer, runtime->oss.period_bytes,1 );
@@ -1535,10 +1575,12 @@ static int snd_pcm_oss_reset(struct snd_continue ; runtime = substream->runtime;snd_pcm_kernel_ioctl (substream,SNDRV_PCM_IOCTL_DROP ,NULL ); +mutex_lock (&runtime->oss.params_lock); runtime->oss.prepare =1 ; runtime->oss.buffer_used =0 ; runtime->oss.prev_hw_ptr_period =0 ; runtime->oss.period_ptr =0 ; +mutex_unlock (&runtime->oss.params_lock); }return 0 ; }
@@ -1624,9 +1666,10 @@ static int snd_pcm_oss_sync(struct snd_p goto __direct;if ((err =snd_pcm_oss_make_ready (substream)) <0 )return err; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; format =snd_pcm_oss_format_from (runtime->oss.format); width =snd_pcm_format_physical_width (format); -mutex_lock (&runtime->oss.params_lock);if (runtime->oss.buffer_used >0 ) {#ifdef OSS_DEBUG pcm_dbg (substream->pcm,"sync: buffer_used\n" );
@@ -1694,7 +1737,9 @@ static int snd_pcm_oss_sync(struct snd_p substream->f_flags = saved_f_flags;if (err <0 )return err; +mutex_lock (&runtime->oss.params_lock); runtime->oss.prepare =1 ; +mutex_unlock (&runtime->oss.params_lock); } substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE ];
@@ -1705,8 +1750,10 @@ static int snd_pcm_oss_sync(struct snd_p err =snd_pcm_kernel_ioctl (substream,SNDRV_PCM_IOCTL_DROP ,NULL );if (err <0 )return err; +mutex_lock (&runtime->oss.params_lock); runtime->oss.buffer_used =0 ; runtime->oss.prepare =1 ; +mutex_unlock (&runtime->oss.params_lock); }return 0 ; }
@@ -1725,10 +1772,13 @@ static int snd_pcm_oss_set_rate(struct s rate =1000 ; else if (rate > 192000) rate =192000 ; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ;if (runtime->oss.rate != rate) { runtime->oss.params =1 ; runtime->oss.rate = rate; } +mutex_unlock (&runtime->oss.params_lock); }return snd_pcm_oss_get_rate (pcm_oss_file); }
@@ -1756,10 +1806,13 @@ static int snd_pcm_oss_set_channels(struif (substream ==NULL )continue ; runtime = substream->runtime; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ;if (runtime->oss.channels != channels) { runtime->oss.params =1 ; runtime->oss.channels = channels; } +mutex_unlock (&runtime->oss.params_lock); }return snd_pcm_oss_get_channels (pcm_oss_file); }
@@ -1845,10 +1898,13 @@ static int snd_pcm_oss_set_format(structif (substream ==NULL )continue ; runtime = substream->runtime; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ;if (runtime->oss.format != format) { runtime->oss.params =1 ; runtime->oss.format = format; } +mutex_unlock (&runtime->oss.params_lock); } }return snd_pcm_oss_get_format (pcm_oss_file);
@@ -1868,8 +1924,6 @@ static int snd_pcm_oss_set_subdivide1(st {struct snd_pcm_runtime *runtime; -if (substream ==NULL ) -return 0 ; runtime = substream->runtime;if (subdivide ==0 ) { subdivide = runtime->oss.subdivision;
@@ -1893,9 +1947,16 @@ static int snd_pcm_oss_set_subdivide(strfor (idx =1 ; idx >=0 ; --idx) {struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; +struct snd_pcm_runtime *runtime; +if (substream ==NULL )continue ; -if ((err =snd_pcm_oss_set_subdivide1 (substream, subdivide)) <0 ) + runtime = substream->runtime; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; + err =snd_pcm_oss_set_subdivide1 (substream, subdivide); +mutex_unlock (&runtime->oss.params_lock); +if (err <0 )return err; }return err;
@@ -1905,8 +1966,6 @@ static int snd_pcm_oss_set_fragment1(str {struct snd_pcm_runtime *runtime; -if (substream ==NULL ) -return 0 ; runtime = substream->runtime;if (runtime->oss.subdivision || runtime->oss.fragshift)return -EINVAL ;
@@ -1926,9 +1985,16 @@ static int snd_pcm_oss_set_fragment(strufor (idx =1 ; idx >=0 ; --idx) {struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; +struct snd_pcm_runtime *runtime; +if (substream ==NULL )continue ; -if ((err =snd_pcm_oss_set_fragment1 (substream, val)) <0 ) + runtime = substream->runtime; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; + err =snd_pcm_oss_set_fragment1 (substream, val); +mutex_unlock (&runtime->oss.params_lock); +if (err <0 )return err; }return err;
@@ -2012,6 +2078,9 @@ static int snd_pcm_oss_set_trigger(struc }if (psubstream) { runtime = psubstream->runtime; + cmd =0 ; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ;if (trigger &PCM_ENABLE_OUTPUT ) {if (runtime->oss.trigger) goto _skip1;
@@ -2029,13 +2098,19 @@ static int snd_pcm_oss_set_trigger(struc cmd =SNDRV_PCM_IOCTL_DROP ; runtime->oss.prepare =1 ; } - err =snd_pcm_kernel_ioctl (psubstream, cmd,NULL ); -if (err <0 ) -return err; - } _skip1: +mutex_unlock (&runtime->oss.params_lock); +if (cmd) { + err =snd_pcm_kernel_ioctl (psubstream, cmd,NULL ); +if (err <0 ) +return err; + } + }if (csubstream) { runtime = csubstream->runtime; + cmd =0 ; +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ;if (trigger &PCM_ENABLE_INPUT ) {if (runtime->oss.trigger) goto _skip2;
@@ -2050,11 +2125,14 @@ static int snd_pcm_oss_set_trigger(struc cmd =SNDRV_PCM_IOCTL_DROP ; runtime->oss.prepare =1 ; } - err =snd_pcm_kernel_ioctl (csubstream, cmd,NULL ); -if (err <0 ) -return err; - } _skip2: +mutex_unlock (&runtime->oss.params_lock); +if (cmd) { + err =snd_pcm_kernel_ioctl (csubstream, cmd,NULL ); +if (err <0 ) +return err; + } + }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 68/97 ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 40cab6e88cb0b6c56d3f30b7491a20e803f948f6 upstream.
OSS PCM stream management isn't modal but it allows ioctls issued at any time for changing the parameters. In the previous hardening patch ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write"), we covered these races and prevent the corruption by protecting the concurrent accesses via params_lock mutex. However, this means that some ioctls that try to change the stream parameter (e.g. channels or format) would be blocked until the read/write finishes, and it may take really long.
Basically changing the parameter while reading/writing is an invalid operation, hence it's even more user-friendly from the API POV if it returns -EBUSY in such a situation.
This patch adds such checks in the relevant ioctls with the addition of read/write access refcount.
--- include/sound/pcm_oss.h | 1 + sound/core/oss/pcm_oss.c | 36 +++++++++++++++++++++++++++--------- 2 files changed, 28 insertions(+), 9 deletions(-)
include/sound/pcm_oss.h +1 -0
@@ -57,6 +57,7 @@ struct snd_pcm_oss_runtime {char *buffer;/* vmallocated period */ size_t buffer_used;/* used length from period buffer */ struct mutex params_lock; +atomic_t rw_ref;/* concurrent read/write accesses */ #ifdef CONFIG_SND_PCM_OSS_PLUGINS struct snd_pcm_plugin *plugin_first;struct snd_pcm_plugin *plugin_last;
sound/core/oss/pcm_oss.c +27 -9
@@ -1404,6 +1404,7 @@ static ssize_t snd_pcm_oss_write1(structif (atomic_read (&substream->mmap_count))return -ENXIO ; +atomic_inc (&runtime->oss.rw_ref);while (bytes >0 ) {if (mutex_lock_interruptible (&runtime->oss.params_lock)) { tmp = -ERESTARTSYS ;
@@ -1467,6 +1468,7 @@ static ssize_t snd_pcm_oss_write1(struct } tmp =0 ; } +atomic_dec (&runtime->oss.rw_ref);return xfer >0 ? (snd_pcm_sframes_t )xfer : tmp; }
@@ -1512,6 +1514,7 @@ static ssize_t snd_pcm_oss_read1(structif (atomic_read (&substream->mmap_count))return -ENXIO ; +atomic_inc (&runtime->oss.rw_ref);while (bytes >0 ) {if (mutex_lock_interruptible (&runtime->oss.params_lock)) { tmp = -ERESTARTSYS ;
@@ -1560,6 +1563,7 @@ static ssize_t snd_pcm_oss_read1(struct } tmp =0 ; } +atomic_dec (&runtime->oss.rw_ref);return xfer >0 ? (snd_pcm_sframes_t )xfer : tmp; }
@@ -1666,8 +1670,11 @@ static int snd_pcm_oss_sync(struct snd_p goto __direct;if ((err =snd_pcm_oss_make_ready (substream)) <0 )return err; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) +atomic_inc (&runtime->oss.rw_ref); +if (mutex_lock_interruptible (&runtime->oss.params_lock)) { +atomic_dec (&runtime->oss.rw_ref);return -ERESTARTSYS ; + } format =snd_pcm_oss_format_from (runtime->oss.format); width =snd_pcm_format_physical_width (format);if (runtime->oss.buffer_used >0 ) {
@@ -1679,10 +1686,8 @@ static int snd_pcm_oss_sync(struct snd_p runtime->oss.buffer + runtime->oss.buffer_used, size); err =snd_pcm_oss_sync1 (substream, runtime->oss.period_bytes); -if (err <0 ) { -mutex_unlock (&runtime->oss.params_lock); -return err; - } +if (err <0 ) + goto unlock; }else if (runtime->oss.period_ptr >0 ) {#ifdef OSS_DEBUG pcm_dbg (substream->pcm,"sync: period_ptr\n" );
@@ -1692,10 +1697,8 @@ static int snd_pcm_oss_sync(struct snd_p runtime->oss.buffer, size * 8 / width); err =snd_pcm_oss_sync1 (substream, size); -if (err <0 ) { -mutex_unlock (&runtime->oss.params_lock); -return err; - } +if (err <0 ) + goto unlock; }/* * The ALSA's period might be a bit large than OSS one.
@@ -1726,7 +1729,11 @@ static int snd_pcm_oss_sync(struct snd_psnd_pcm_lib_writev (substream, buffers, size); } } +unlock:mutex_unlock (&runtime->oss.params_lock); +atomic_dec (&runtime->oss.rw_ref); +if (err <0 ) +return err;/* * finish sync: drain the buffer */
@@ -1774,6 +1781,8 @@ static int snd_pcm_oss_set_rate(struct s rate =192000 ;if (mutex_lock_interruptible (&runtime->oss.params_lock))return -ERESTARTSYS ; +if (atomic_read (&runtime->oss.rw_ref)) +return -EBUSY ;if (runtime->oss.rate != rate) { runtime->oss.params =1 ; runtime->oss.rate = rate;
@@ -1808,6 +1817,8 @@ static int snd_pcm_oss_set_channels(stru runtime = substream->runtime;if (mutex_lock_interruptible (&runtime->oss.params_lock))return -ERESTARTSYS ; +if (atomic_read (&runtime->oss.rw_ref)) +return -EBUSY ;if (runtime->oss.channels != channels) { runtime->oss.params =1 ; runtime->oss.channels = channels;
@@ -1898,6 +1909,8 @@ static int snd_pcm_oss_set_format(structif (substream ==NULL )continue ; runtime = substream->runtime; +if (atomic_read (&runtime->oss.rw_ref)) +return -EBUSY ;if (mutex_lock_interruptible (&runtime->oss.params_lock))return -ERESTARTSYS ;if (runtime->oss.format != format) {
@@ -1952,6 +1965,8 @@ static int snd_pcm_oss_set_subdivide(strif (substream ==NULL )continue ; runtime = substream->runtime; +if (atomic_read (&runtime->oss.rw_ref)) +return -EBUSY ;if (mutex_lock_interruptible (&runtime->oss.params_lock))return -ERESTARTSYS ; err =snd_pcm_oss_set_subdivide1 (substream, subdivide);
@@ -1990,6 +2005,8 @@ static int snd_pcm_oss_set_fragment(struif (substream ==NULL )continue ; runtime = substream->runtime; +if (atomic_read (&runtime->oss.rw_ref)) +return -EBUSY ;if (mutex_lock_interruptible (&runtime->oss.params_lock))return -ERESTARTSYS ; err =snd_pcm_oss_set_fragment1 (substream, val);
@@ -2384,6 +2401,7 @@ static void snd_pcm_oss_init_substream(s runtime->oss.maxfrags =0 ; runtime->oss.subdivision =0 ; substream->pcm_release = snd_pcm_oss_release_substream; +atomic_set (&runtime->oss.rw_ref,0 ); }static int snd_pcm_oss_release_file (struct snd_pcm_oss_file *pcm_oss_file)
Greg Kroah-Hartman
maintainerPATCH 69/97 ALSA: pcm: Fix mutex unbalance in OSS emulation ioctls
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f6d297df4dd47ef949540e4a201230d0c5308325 upstream.
The previous fix 40cab6e88cb0 ("ALSA: pcm: Return -EBUSY for OSS ioctls changing busy streams") introduced some mutex unbalance; the check of runtime->oss.rw_ref was inserted in a wrong place after the mutex lock.
This patch fixes the inconsistency by rewriting with the helper functions to lock/unlock parameters with the stream check.
--- sound/core/oss/pcm_oss.c | 67 +++++++++++++++++++++++++++++------------------ 1 file changed, 42 insertions(+), 25 deletions(-)
sound/core/oss/pcm_oss.c +42 -25
@@ -833,6 +833,23 @@ static int choose_rate(struct snd_pcm_sureturn snd_pcm_hw_param_near (substream, params,SNDRV_PCM_HW_PARAM_RATE , best_rate,NULL ); } +/* parameter locking: returns immediately if tried during streaming */ +static int lock_params (struct snd_pcm_runtime *runtime) +{ +if (mutex_lock_interruptible (&runtime->oss.params_lock)) +return -ERESTARTSYS ; +if (atomic_read (&runtime->oss.rw_ref)) { +mutex_unlock (&runtime->oss.params_lock); +return -EBUSY ; + } +return 0 ; +} + +static void unlock_params (struct snd_pcm_runtime *runtime) +{ +mutex_unlock (&runtime->oss.params_lock); +} +/* call with params_lock held */ static int snd_pcm_oss_change_params_locked (struct snd_pcm_substream *substream) {
@@ -1772,6 +1789,8 @@ static int snd_pcm_oss_set_rate(struct sfor (idx =1 ; idx >=0 ; --idx) {struct snd_pcm_substream *substream = pcm_oss_file->streams[idx];struct snd_pcm_runtime *runtime; +int err; +if (substream ==NULL )continue ; runtime = substream->runtime;
@@ -1779,15 +1798,14 @@ static int snd_pcm_oss_set_rate(struct s rate =1000 ; else if (rate > 192000) rate =192000 ; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; -if (atomic_read (&runtime->oss.rw_ref)) -return -EBUSY ; + err =lock_params (runtime); +if (err <0 ) +return err;if (runtime->oss.rate != rate) { runtime->oss.params =1 ; runtime->oss.rate = rate; } -mutex_unlock (&runtime->oss.params_lock); +unlock_params (runtime); }return snd_pcm_oss_get_rate (pcm_oss_file); }
@@ -1812,18 +1830,19 @@ static int snd_pcm_oss_set_channels(strufor (idx =1 ; idx >=0 ; --idx) {struct snd_pcm_substream *substream = pcm_oss_file->streams[idx];struct snd_pcm_runtime *runtime; +int err; +if (substream ==NULL )continue ; runtime = substream->runtime; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; -if (atomic_read (&runtime->oss.rw_ref)) -return -EBUSY ; + err =lock_params (runtime); +if (err <0 ) +return err;if (runtime->oss.channels != channels) { runtime->oss.params =1 ; runtime->oss.channels = channels; } -mutex_unlock (&runtime->oss.params_lock); +unlock_params (runtime); }return snd_pcm_oss_get_channels (pcm_oss_file); }
@@ -1896,6 +1915,7 @@ static int snd_pcm_oss_get_formats(strucstatic int snd_pcm_oss_set_format (struct snd_pcm_oss_file *pcm_oss_file,int format) {int formats, idx; +int err;if (format !=AFMT_QUERY ) { formats =snd_pcm_oss_get_formats (pcm_oss_file);
@@ -1909,15 +1929,14 @@ static int snd_pcm_oss_set_format(structif (substream ==NULL )continue ; runtime = substream->runtime; -if (atomic_read (&runtime->oss.rw_ref)) -return -EBUSY ; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; + err =lock_params (runtime); +if (err <0 ) +return err;if (runtime->oss.format != format) { runtime->oss.params =1 ; runtime->oss.format = format; } -mutex_unlock (&runtime->oss.params_lock); +unlock_params (runtime); } }return snd_pcm_oss_get_format (pcm_oss_file);
@@ -1965,12 +1984,11 @@ static int snd_pcm_oss_set_subdivide(strif (substream ==NULL )continue ; runtime = substream->runtime; -if (atomic_read (&runtime->oss.rw_ref)) -return -EBUSY ; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; + err =lock_params (runtime); +if (err <0 ) +return err; err =snd_pcm_oss_set_subdivide1 (substream, subdivide); -mutex_unlock (&runtime->oss.params_lock); +unlock_params (runtime);if (err <0 )return err; }
@@ -2005,12 +2023,11 @@ static int snd_pcm_oss_set_fragment(struif (substream ==NULL )continue ; runtime = substream->runtime; -if (atomic_read (&runtime->oss.rw_ref)) -return -EBUSY ; -if (mutex_lock_interruptible (&runtime->oss.params_lock)) -return -ERESTARTSYS ; + err =lock_params (runtime); +if (err <0 ) +return err; err =snd_pcm_oss_set_fragment1 (substream, val); -mutex_unlock (&runtime->oss.params_lock); +unlock_params (runtime);if (err <0 )return err; }
Greg Kroah-Hartman
maintainerPATCH 70/97 ALSA: pcm: Fix endless loop for XRUN recovery in OSS emulation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit e15dc99dbb9cf99f6432e8e3c0b3a8f7a3403a86 upstream.
The commit 02a5d6925cd3 ("ALSA: pcm: Avoid potential races between OSS ioctls and read/write") split the PCM preparation code to a locked version, and it added a sanity check of runtime->oss.prepare flag along with the change. This leaded to an endless loop when the stream gets XRUN: namely, snd_pcm_oss_write3() and co call snd_pcm_oss_prepare() without setting runtime->oss.prepare flag and the loop continues until the PCM state reaches to another one.
As the function is supposed to execute the preparation unconditionally, drop the invalid state check there.
The bug was triggered by syzkaller.
--- sound/core/oss/pcm_oss.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
sound/core/oss/pcm_oss.c +3 -2
@@ -1138,13 +1138,14 @@ static int snd_pcm_oss_get_active_substr }/* call with params_lock held */ +/* NOTE: this always call PREPARE unconditionally no matter whether +* runtime->oss.prepare is set or not +*/ static int snd_pcm_oss_prepare (struct snd_pcm_substream *substream) {int err;struct snd_pcm_runtime *runtime = substream->runtime; -if (!runtime->oss.prepare) -return 0 ; err =snd_pcm_kernel_ioctl (substream,SNDRV_PCM_IOCTL_PREPARE ,NULL );if (err <0 ) { pcm_dbg(substream->pcm,
Greg Kroah-Hartman
maintainerPATCH 71/97 vfio-pci: Virtualize PCIe & AF FLR
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit ddf9dc0eb5314d6dac8b19b1cc37c739c6896e7e upstream.
We use a BAR restore trick to try to detect when a user has performed a device reset, possibly through FLR or other backdoors, to put things back into a working state. This is important for backdoor resets, but we can actually just virtualize the "front door" resets provided via PCIe and AF FLR. Set these bits as virtualized + writable, allowing the default write to set them in vconfig, then we can simply check the bit, perform an FLR of our own, and clear the bit. We don't actually have the granularity in PCI to specify the type of reset we want to do, but generally devices don't implement both PCIe and AF FLR and we'll favor these over other types of reset, so we should generally lineup. We do test whether the device provides the requested FLR type to stay consistent with hardware capabilities though.
This seems to fix several instance of devices getting into bad states with userspace drivers, like dpdk, running inside a VM.
--- drivers/vfio/pci/vfio_pci_config.c | 82 ++++++++++++++++++++++++++++++++++--- 1 file changed, 77 insertions(+), 5 deletions(-)
drivers/vfio/pci/vfio_pci_config.c +77 -5
@@ -752,6 +752,40 @@ static int __init init_pci_cap_pcix_permreturn 0 ; } +static int vfio_exp_config_write (struct vfio_pci_device *vdev,int pos, +int count,struct perm_bits *perm, +int offset,__le32 val) +{ +__le16 *ctrl = (__le16 *)(vdev->vconfig + pos - + offset +PCI_EXP_DEVCTL ); + + count =vfio_default_config_write (vdev, pos, count, perm, offset, val); +if (count <0 ) +return count; + +/* +* The FLR bit is virtualized, if set and the device supports PCIe +* FLR, issue a reset_function. Regardless, clear the bit, the spec +* requires it to be always read as zero. NB, reset_function might +* not use a PCIe FLR, we don't have that level of granularity. +*/ +if (*ctrl &cpu_to_le16 (PCI_EXP_DEVCTL_BCR_FLR )) { +u32 cap; +int ret; + + *ctrl &= ~cpu_to_le16 (PCI_EXP_DEVCTL_BCR_FLR ); + + ret =pci_user_read_config_dword (vdev->pdev, + pos - offset +PCI_EXP_DEVCAP , + &cap); + +if (!ret && (cap &PCI_EXP_DEVCAP_FLR )) +pci_try_reset_function (vdev->pdev); + } + +return count; +} +/* Permissions for PCI Express capability */ static int __init init_pci_cap_exp_perm (struct perm_bits *perm) {
@@ -759,26 +793,64 @@ static int __init init_pci_cap_exp_perm(if (alloc_perm_bits (perm,PCI_CAP_EXP_ENDPOINT_SIZEOF_V2 ))return -ENOMEM ; + perm->writefn = vfio_exp_config_write; +p_setb (perm,PCI_CAP_LIST_NEXT , (u8 )ALL_VIRT ,NO_WRITE );/* -* Allow writes to device control fields (includes FLR!) -* but not to devctl_phantom which could confuse IOMMU -* or to the ARI bit in devctl2 which is set at probe time +* Allow writes to device control fields, except devctl_phantom, +* which could confuse IOMMU, and the ARI bit in devctl2, which +* is set at probe time. FLR gets virtualized via our writefn. */ -p_setw (perm,PCI_EXP_DEVCTL ,NO_VIRT , ~PCI_EXP_DEVCTL_PHANTOM ); +p_setw (perm,PCI_EXP_DEVCTL , +PCI_EXP_DEVCTL_BCR_FLR , ~PCI_EXP_DEVCTL_PHANTOM );p_setw (perm,PCI_EXP_DEVCTL2 ,NO_VIRT , ~PCI_EXP_DEVCTL2_ARI );return 0 ; } +static int vfio_af_config_write (struct vfio_pci_device *vdev,int pos, +int count,struct perm_bits *perm, +int offset,__le32 val) +{ +u8 *ctrl = vdev->vconfig + pos - offset +PCI_AF_CTRL ; + + count =vfio_default_config_write (vdev, pos, count, perm, offset, val); +if (count <0 ) +return count; + +/* +* The FLR bit is virtualized, if set and the device supports AF +* FLR, issue a reset_function. Regardless, clear the bit, the spec +* requires it to be always read as zero. NB, reset_function might +* not use an AF FLR, we don't have that level of granularity. +*/ +if (*ctrl &PCI_AF_CTRL_FLR ) { +u8 cap; +int ret; + + *ctrl &= ~PCI_AF_CTRL_FLR ; + + ret =pci_user_read_config_byte (vdev->pdev, + pos - offset +PCI_AF_CAP , + &cap); + +if (!ret && (cap &PCI_AF_CAP_FLR ) && (cap &PCI_AF_CAP_TP )) +pci_try_reset_function (vdev->pdev); + } + +return count; +} +/* Permissions for Advanced Function capability */ static int __init init_pci_cap_af_perm (struct perm_bits *perm) {if (alloc_perm_bits (perm, pci_cap_length[PCI_CAP_ID_AF ]))return -ENOMEM ; + perm->writefn = vfio_af_config_write; +p_setb (perm,PCI_CAP_LIST_NEXT , (u8 )ALL_VIRT ,NO_WRITE ); -p_setb (perm,PCI_AF_CTRL ,NO_VIRT ,PCI_AF_CTRL_FLR ); +p_setb (perm,PCI_AF_CTRL ,PCI_AF_CTRL_FLR ,PCI_AF_CTRL_FLR );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 73/97 vfio/pci: Virtualize Maximum Read Request Size
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit cf0d53ba4947aad6e471491d5b20a567cbe92e56 upstream.
MRRS defines the maximum read request size a device is allowed to make. Drivers will often increase this to allow more data transfer with a single request. Completions to this request are bound by the MPS setting for the bus. Aside from device quirks (none known), it doesn't seem to make sense to set an MRRS value less than MPS, yet this is a likely scenario given that user drivers do not have a system-wide view of the PCI topology. Virtualize MRRS such that the user can set MRRS >= MPS, but use MPS as the floor value that we'll write to hardware.
--- drivers/vfio/pci/vfio_pci_config.c | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-)
drivers/vfio/pci/vfio_pci_config.c +26 -3
@@ -758,6 +758,7 @@ static int vfio_exp_config_write(struct {__le16 *ctrl = (__le16 *)(vdev->vconfig + pos - offset +PCI_EXP_DEVCTL ); +int readrq =le16_to_cpu (*ctrl) &PCI_EXP_DEVCTL_READRQ ; count =vfio_default_config_write (vdev, pos, count, perm, offset, val);if (count <0 )
@@ -783,6 +784,27 @@ static int vfio_exp_config_write(structpci_try_reset_function (vdev->pdev); } +/* +* MPS is virtualized to the user, writes do not change the physical +* register since determining a proper MPS value requires a system wide +* device view. The MRRS is largely independent of MPS, but since the +* user does not have that system-wide view, they might set a safe, but +* inefficiently low value. Here we allow writes through to hardware, +* but we set the floor to the physical device MPS setting, so that +* we can at least use full TLPs, as defined by the MPS value. +* +* NB, if any devices actually depend on an artificially low MRRS +* setting, this will need to be revisited, perhaps with a quirk +* though pcie_set_readrq(). +*/ +if (readrq != (le16_to_cpu (*ctrl) &PCI_EXP_DEVCTL_READRQ )) { + readrq =128 << + ((le16_to_cpu (*ctrl) &PCI_EXP_DEVCTL_READRQ ) >>12 ); + readrq =max (readrq,pcie_get_mps (vdev->pdev)); + +pcie_set_readrq (vdev->pdev, readrq); + } +return count; }
@@ -801,11 +823,12 @@ static int __init init_pci_cap_exp_perm(* Allow writes to device control fields, except devctl_phantom, * which could confuse IOMMU, MPS, which can break communication * with other physical devices, and the ARI bit in devctl2, which -* is set at probe time. FLR gets virtualized via our writefn. +* is set at probe time. FLR and MRRS get virtualized via our +* writefn. */ p_setw (perm,PCI_EXP_DEVCTL , -PCI_EXP_DEVCTL_BCR_FLR |PCI_EXP_DEVCTL_PAYLOAD , - ~PCI_EXP_DEVCTL_PHANTOM ); +PCI_EXP_DEVCTL_BCR_FLR |PCI_EXP_DEVCTL_PAYLOAD | +PCI_EXP_DEVCTL_READRQ , ~PCI_EXP_DEVCTL_PHANTOM );p_setw (perm,PCI_EXP_DEVCTL2 ,NO_VIRT , ~PCI_EXP_DEVCTL2_ARI );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 74/97 ext4: dont allow r/w mounts if metadata blocks overlap the superblock
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 18db4b4e6fc31eda838dd1c1296d67dbcb3dc957 upstream.
If some metadata block, such as an allocation bitmap, overlaps the superblock, it's very likely that if the file system is mounted read/write, the results will not be pretty. So disallow r/w mounts for file systems corrupted in this particular way.
Backport notes:
3.18.y is missing bc98a42c1f7d ("VFS: Convert sb->s_flags & MS_RDONLY to sb_rdonly(sb)") and e462ec50cb5f ("VFS: Differentiate mount flags (MS_*) from internal superblock flags") so we simply use the sb MS_RDONLY check from pre bc98a42c1f7d in place of the sb_rdonly function used in the upstream variant of the patch.
--- fs/ext4/super.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/super.c +6 -0
@@ -2131,6 +2131,8 @@ static int ext4_check_descriptors(structext4_msg (sb,KERN_ERR ,"ext4_check_descriptors: " "Block bitmap for group %u overlaps " "superblock" , i); +if (!(sb->s_flags &MS_RDONLY )) +return 0 ; }if (block_bitmap < first_block || block_bitmap > last_block) { ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -2143,6 +2145,8 @@ static int ext4_check_descriptors(structext4_msg (sb,KERN_ERR ,"ext4_check_descriptors: " "Inode bitmap for group %u overlaps " "superblock" , i); +if (!(sb->s_flags &MS_RDONLY )) +return 0 ; }if (inode_bitmap < first_block || inode_bitmap > last_block) { ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: "
@@ -2155,6 +2159,8 @@ static int ext4_check_descriptors(structext4_msg (sb,KERN_ERR ,"ext4_check_descriptors: " "Inode table for group %u overlaps " "superblock" , i); +if (!(sb->s_flags &MS_RDONLY )) +return 0 ; }if (inode_table < first_block || inode_table + sbi->s_itb_per_group -1 > last_block) {
Greg Kroah-Hartman
maintainerPATCH 75/97 drm/radeon: Fix PCIe lane width calculation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Parsons <[email protected]>
commit 85e290d92b4b794d0c758c53007eb4248d385386 upstream.
Two years ago I tried an AMD Radeon E8860 embedded GPU with the drm driver. The dmesg output included driver warnings about an invalid PCIe lane width. Tracking the problem back led to si_set_pcie_lane_width_in_smc(). The calculation of the lane widths via ATOM_PPLIB_PCIE_LINK_WIDTH_MASK and ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT macros did not increment the resulting value, per the comment in pptable.h ("lanes - 1"), and per usage elsewhere. Applying the increment silenced the warnings.
The code has not changed since, so either my analysis was incorrect or the bug has gone unnoticed. Hence submitting this as an RFC.
--- drivers/gpu/drm/radeon/si_dpm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/radeon/si_dpm.c +2 -2
@@ -5964,9 +5964,9 @@ static void si_set_pcie_lane_width_in_sm {u32 lane_width;u32 new_lane_width = - (radeon_new_state->caps &ATOM_PPLIB_PCIE_LINK_WIDTH_MASK ) >>ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT ; + ((radeon_new_state->caps &ATOM_PPLIB_PCIE_LINK_WIDTH_MASK ) >>ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT ) +1 ;u32 current_lane_width = - (radeon_current_state->caps &ATOM_PPLIB_PCIE_LINK_WIDTH_MASK ) >>ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT ; + ((radeon_current_state->caps &ATOM_PPLIB_PCIE_LINK_WIDTH_MASK ) >>ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT ) +1 ;if (new_lane_width != current_lane_width) {radeon_set_pcie_lanes (rdev, new_lane_width);
Greg Kroah-Hartman
maintainerPATCH 76/97 ext4: fix crashes in dioread_nolock mode
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <[email protected]>
commit 74dae4278546b897eb81784fdfcce872ddd8b2b8 upstream.
Competing overwrite DIO in dioread_nolock mode will just overwrite pointer to io_end in the inode. This may result in data corruption or extent conversion happening from IO completion interrupt because we don't properly set buffer_defer_completion() when unlocked DIO races with locked DIO to unwritten extent.
Since unlocked DIO doesn't need io_end for anything, just avoid allocating it and corrupting pointer from inode for locked DIO. A cleaner fix would be to avoid these games with io_end pointer from the inode but that requires more intrusive changes so we leave that for later.
--- fs/ext4/inode.c | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-)
fs/ext4/inode.c +20 -20
@@ -3256,29 +3256,29 @@ static ssize_t ext4_ext_direct_IO(struct* case, we allocate an io_end structure to hook to the iocb. */ iocb->private =NULL ; -ext4_inode_aio_set (inode,NULL ); -if (!is_sync_kiocb (iocb)) { - io_end =ext4_init_io_end (inode,GFP_NOFS ); -if (!io_end) { - ret = -ENOMEM ; - goto retake_lock; - } -/* -* Grab reference for DIO. Will be dropped in ext4_end_io_dio() -*/ - iocb->private =ext4_get_io_end (io_end); -/* -* we save the io structure for current async direct -* IO, so that later ext4_map_blocks() could flag the -* io structure whether there is a unwritten extents -* needs to be converted when IO is completed. -*/ -ext4_inode_aio_set (inode, io_end); - } -if (overwrite) { get_block_func = ext4_get_block_write_nolock; }else { +ext4_inode_aio_set (inode,NULL ); +if (!is_sync_kiocb (iocb)) { + io_end =ext4_init_io_end (inode,GFP_NOFS ); +if (!io_end) { + ret = -ENOMEM ; + goto retake_lock; + } +/* +* Grab reference for DIO. Will be dropped in +* ext4_end_io_dio() +*/ + iocb->private =ext4_get_io_end (io_end); +/* +* we save the io structure for current async direct +* IO, so that later ext4_map_blocks() could flag the +* io structure whether there is a unwritten extents +* needs to be converted when IO is completed. +*/ +ext4_inode_aio_set (inode, io_end); + } get_block_func = ext4_get_block_write; dio_flags =DIO_LOCKING ; }
Greg Kroah-Hartman
maintainerPATCH 77/97 ext4: fix deadlock between inline_data and ext4_expand_extra_isize_ea()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit c755e251357a0cee0679081f08c3f4ba797a8009 upstream.
The xattr_sem deadlock problems fixed in commit 2e81a4eeedca: "ext4:
avoid deadlock when expanding inode size" didn't include the use of xattr_sem in fs/ext4/inline.c. With the addition of project quota which added a new extra inode field, this exposed deadlocks in the inline_data code similar to the ones fixed by 2e81a4eeedca.
The deadlock can be reproduced via:
dmesg -n 7
mke2fs -t ext4 -O inline_data -Fq -I 256 /dev/vdc 32768 mount -t ext4 -o debug_want_extra_isize=24 /dev/vdc /vdc mkdir /vdc/a
umount /vdc
mount -t ext4 /dev/vdc /vdc
echo foo > /vdc/a/foo
and looks like this:
[ 11.158815]
[ 11.160276] =============================================
[ 11.161960] [ INFO: possible recursive locking detected ]
[ 11.161960] 4.10.0-rc3-00015-g011b30a8a3cf #160 Tainted: G W
[ 11.161960] ---------------------------------------------
[ 11.161960] bash/2519 is trying to acquire lock:
[ 11.161960] (&ei->xattr_sem){++++..}, at: [<c1225a4b>] ext4_expand_extra_isize_ea+0x3d/0x4cd
[ 11.161960]
[ 11.161960] but task is already holding lock:
[ 11.161960] (&ei->xattr_sem){++++..}, at: [<c1227941>] ext4_try_add_inline_entry+0x3a/0x152
[ 11.161960]
[ 11.161960] other info that might help us debug this:
[ 11.161960] Possible unsafe locking scenario:
[ 11.161960]
[ 11.161960] CPU0
[ 11.161960] ----
[ 11.161960] lock(&ei->xattr_sem);
[ 11.161960] lock(&ei->xattr_sem);
[ 11.161960]
[ 11.161960] *** DEADLOCK ***
[ 11.161960]
[ 11.161960] May be due to missing lock nesting notation
[ 11.161960]
[ 11.161960] 4 locks held by bash/2519:
[ 11.161960] #0: (sb_writers#3){.+.+.+}, at: [<c11a2414>] mnt_want_write+0x1e/0x3e
[ 11.161960] #1: (&type->i_mutex_dir_key){++++++}, at: [<c119508b>] path_openat+0x338/0x67a
[ 11.161960] #2: (jbd2_handle){++++..}, at: [<c123314a>] start_this_handle+0x582/0x622
[ 11.161960] #3: (&ei->xattr_sem){++++..}, at: [<c1227941>] ext4_try_add_inline_entry+0x3a/0x152
[ 11.161960]
[ 11.161960] stack backtrace:
[ 11.161960] CPU: 0 PID: 2519 Comm: bash Tainted: G W 4.10.0-rc3-00015-g011b30a8a3cf #160
[ 11.161960] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.1-1 04/01/2014
[ 11.161960] Call Trace:
[ 11.161960] dump_stack+0x72/0xa3
[ 11.161960] __lock_acquire+0xb7c/0xcb9
[ 11.161960] ? kvm_clock_read+0x1f/0x29
[ 11.161960] ? __lock_is_held+0x36/0x66
[ 11.161960] ? __lock_is_held+0x36/0x66
[ 11.161960] lock_acquire+0x106/0x18a
[ 11.161960] ? ext4_expand_extra_isize_ea+0x3d/0x4cd
[ 11.161960] down_write+0x39/0x72
[ 11.161960] ? ext4_expand_extra_isize_ea+0x3d/0x4cd
[ 11.161960] ext4_expand_extra_isize_ea+0x3d/0x4cd
[ 11.161960] ? _raw_read_unlock+0x22/0x2c
[ 11.161960] ? jbd2_journal_extend+0x1e2/0x262
[ 11.161960] ? __ext4_journal_get_write_access+0x3d/0x60
[ 11.161960] ext4_mark_inode_dirty+0x17d/0x26d
[ 11.161960] ? ext4_add_dirent_to_inline.isra.12+0xa5/0xb2
[ 11.161960] ext4_add_dirent_to_inline.isra.12+0xa5/0xb2
[ 11.161960] ext4_try_add_inline_entry+0x69/0x152
[ 11.161960] ext4_add_entry+0xa3/0x848
[ 11.161960] ? __brelse+0x14/0x2f
[ 11.161960] ? _raw_spin_unlock_irqrestore+0x44/0x4f
[ 11.161960] ext4_add_nondir+0x17/0x5b
[ 11.161960] ext4_create+0xcf/0x133
[ 11.161960] ? ext4_mknod+0x12f/0x12f
[ 11.161960] lookup_open+0x39e/0x3fb
[ 11.161960] ? __wake_up+0x1a/0x40
[ 11.161960] ? lock_acquire+0x11e/0x18a
[ 11.161960] path_openat+0x35c/0x67a
[ 11.161960] ? sched_clock_cpu+0xd7/0xf2
[ 11.161960] do_filp_open+0x36/0x7c
[ 11.161960] ? _raw_spin_unlock+0x22/0x2c
[ 11.161960] ? __alloc_fd+0x169/0x173
[ 11.161960] do_sys_open+0x59/0xcc
[ 11.161960] SyS_open+0x1d/0x1f
[ 11.161960] do_int80_syscall_32+0x4f/0x61
[ 11.161960] entry_INT80_32+0x2f/0x2f
[ 11.161960] EIP: 0xb76ad469
[ 11.161960] EFLAGS: 00000286 CPU: 0
[ 11.161960] EAX: ffffffda EBX: 08168ac8 ECX: 00008241 EDX: 000001b6
[ 11.161960] ESI: b75e46bc EDI: b7755000 EBP: bfbdb108 ESP: bfbdafc0
[ 11.161960] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b--- fs/ext4/inline.c | 66 +++++++++++++++++++++++++------------------------------ fs/ext4/xattr.c | 30 ++++++++++--------------- fs/ext4/xattr.h | 32 ++++++++++++++++++++++++++ 3 files changed, 74 insertions(+), 54 deletions(-)
fs/ext4/inline.c +30 -36
@@ -376,7 +376,7 @@ out:static int ext4_prepare_inline_data (handle_t *handle,struct inode *inode,unsigned int len) { -int ret, size; +int ret, size, no_expand;struct ext4_inode_info *ei =EXT4_I (inode);if (!ext4_test_inode_state (inode,EXT4_STATE_MAY_INLINE_DATA ))
@@ -386,15 +386,14 @@ static int ext4_prepare_inline_data(handif (size < len)return -ENOSPC ; -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand);if (ei->i_inline_off) ret =ext4_update_inline_data (handle, inode, len);else ret =ext4_create_inline_data (handle, inode, len); -up_write (&EXT4_I (inode)->xattr_sem); - +ext4_write_unlock_xattr (inode, &no_expand);return ret; }
@@ -523,7 +522,7 @@ static int ext4_convert_inline_data_to_estruct inode *inode, unsigned flags) { - int ret, needed_blocks; + int ret, needed_blocks, no_expand;handle_t *handle =NULL ;int retries =0 , sem_held =0 ;struct page *page =NULL ;
@@ -563,7 +562,7 @@ retry: goto out; } -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand); sem_held =1 ;/* If some one has already done this for us, just exit. */ if (!ext4_has_inline_data (inode)) {
@@ -599,7 +598,7 @@ retry:page_cache_release (page); page =NULL ;ext4_orphan_add (handle, inode); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand); sem_held =0 ;ext4_journal_stop (handle); handle =NULL ;
@@ -625,7 +624,7 @@ out:page_cache_release (page); }if (sem_held) -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);if (handle)ext4_journal_stop (handle);brelse (iloc.bh);
@@ -718,7 +717,7 @@ convert:int ext4_write_inline_data_end (struct inode *inode,loff_t pos,unsigned len,unsigned copied,struct page *page) { -int ret; +int ret, no_expand;void *kaddr;struct ext4_iloc iloc;
@@ -736,7 +735,7 @@ int ext4_write_inline_data_end(struct in goto out; } -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand);BUG_ON (!ext4_has_inline_data (inode)); kaddr =kmap_atomic (page);
@@ -746,7 +745,7 @@ int ext4_write_inline_data_end(struct in/* clear page dirty so that writepages wouldn't work for us. */ ClearPageDirty (page); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);brelse (iloc.bh); out:return copied;
@@ -757,7 +756,7 @@ ext4_journalled_write_inline_data(structunsigned len, struct page *page) { - int ret; + int ret, no_expand;void *kaddr;struct ext4_iloc iloc;
@@ -767,11 +766,11 @@ ext4_journalled_write_inline_data(structreturn NULL ; } -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand); kaddr =kmap_atomic (page);ext4_write_inline_data (inode, &iloc, kaddr,0 , len);kunmap_atomic (kaddr); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);return iloc.bh; }
@@ -1255,7 +1254,7 @@ out:int ext4_try_add_inline_entry (handle_t *handle,struct ext4_filename *fname,struct dentry *dentry,struct inode *inode) { -int ret, inline_size; +int ret, inline_size, no_expand;void *inline_start;struct ext4_iloc iloc;struct inode *dir =d_inode (dentry->d_parent);
@@ -1264,7 +1263,7 @@ int ext4_try_add_inline_entry(handle_t *if (ret)return ret; -down_write (&EXT4_I (dir)->xattr_sem); +ext4_write_lock_xattr (dir, &no_expand);if (!ext4_has_inline_data (dir)) goto out;
@@ -1310,7 +1309,7 @@ int ext4_try_add_inline_entry(handle_t * out:ext4_mark_inode_dirty (handle, dir); -up_write (&EXT4_I (dir)->xattr_sem); +ext4_write_unlock_xattr (dir, &no_expand);brelse (iloc.bh);return ret; }
@@ -1670,7 +1669,7 @@ int ext4_delete_inline_entry(handle_t *hstruct buffer_head *bh, int *has_inline_data) { - int err, inline_size; + int err, inline_size, no_expand;struct ext4_iloc iloc;void *inline_start;
@@ -1678,7 +1677,7 @@ int ext4_delete_inline_entry(handle_t *hif (err)return err; -down_write (&EXT4_I (dir)->xattr_sem); +ext4_write_lock_xattr (dir, &no_expand);if (!ext4_has_inline_data (dir)) { *has_inline_data =0 ; goto out;
@@ -1713,7 +1712,7 @@ int ext4_delete_inline_entry(handle_t *hext4_show_inline_dir (dir, iloc.bh, inline_start, inline_size); out: -up_write (&EXT4_I (dir)->xattr_sem); +ext4_write_unlock_xattr (dir, &no_expand);brelse (iloc.bh);if (err != -ENOENT )ext4_std_error (dir->i_sb, err);
@@ -1812,11 +1811,11 @@ out:int ext4_destroy_inline_data (handle_t *handle,struct inode *inode) { -int ret; +int ret, no_expand; -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand); ret =ext4_destroy_inline_data_nolock (handle, inode); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);return ret; }
@@ -1901,7 +1900,7 @@ out:void ext4_inline_data_truncate (struct inode *inode,int *has_inline) {handle_t *handle; -int inline_size, value_len, needed_blocks; +int inline_size, value_len, needed_blocks, no_expand;size_t i_size;void *value =NULL ;struct ext4_xattr_ibody_find is = {
@@ -1918,7 +1917,7 @@ void ext4_inline_data_truncate(struct inif (IS_ERR (handle))return ; -down_write (&EXT4_I (inode)->xattr_sem); +ext4_write_lock_xattr (inode, &no_expand);if (!ext4_has_inline_data (inode)) { *has_inline =0 ;ext4_journal_stop (handle);
@@ -1976,7 +1975,7 @@ out_error:up_write (&EXT4_I (inode)->i_data_sem); out:brelse (is.iloc.bh); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);kfree (value);if (inode->i_nlink)ext4_orphan_del (handle, inode);
@@ -1992,7 +1991,7 @@ out:int ext4_convert_inline_data (struct inode *inode) { -int error, needed_blocks; +int error, needed_blocks, no_expand;handle_t *handle;struct ext4_iloc iloc;
@@ -2014,15 +2013,10 @@ int ext4_convert_inline_data(struct inod goto out_free; } -down_write (&EXT4_I (inode)->xattr_sem); -if (!ext4_has_inline_data (inode)) { -up_write (&EXT4_I (inode)->xattr_sem); - goto out; - } - - error =ext4_convert_inline_data_nolock (handle, inode, &iloc); -up_write (&EXT4_I (inode)->xattr_sem); -out: +ext4_write_lock_xattr (inode, &no_expand); +if (ext4_has_inline_data (inode)) + error =ext4_convert_inline_data_nolock (handle, inode, &iloc); +ext4_write_unlock_xattr (inode, &no_expand);ext4_journal_stop (handle); out_free:brelse (iloc.bh);
fs/ext4/xattr.c +12 -18
@@ -1117,16 +1117,14 @@ ext4_xattr_set_handle(handle_t *handle,struct ext4_xattr_block_find bs = { .s = { .not_found = -ENODATA , }, }; -unsigned long no_expand; +int no_expand;int error;if (!name)return -EINVAL ;if (strlen (name) >255 )return -ERANGE ; -down_write (&EXT4_I (inode)->xattr_sem); - no_expand =ext4_test_inode_state (inode,EXT4_STATE_NO_EXPAND ); -ext4_set_inode_state (inode,EXT4_STATE_NO_EXPAND ); +ext4_write_lock_xattr (inode, &no_expand); error =ext4_reserve_inode_write (handle, inode, &is.iloc);if (error)
@@ -1187,7 +1185,7 @@ ext4_xattr_set_handle(handle_t *handle,ext4_xattr_update_super_block (handle, inode->i_sb); inode->i_ctime =ext4_current_time (inode);if (!value) -ext4_clear_inode_state (inode,EXT4_STATE_NO_EXPAND ); + no_expand =0 ; error =ext4_mark_iloc_dirty (handle, inode, &is.iloc);/* * The bh is consumed by ext4_mark_iloc_dirty, even with
@@ -1201,9 +1199,7 @@ ext4_xattr_set_handle(handle_t *handle, cleanup:brelse (is.iloc.bh);brelse (bs.bh); -if (no_expand ==0 ) -ext4_clear_inode_state (inode,EXT4_STATE_NO_EXPAND ); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);return error; }
@@ -1287,12 +1283,11 @@ int ext4_expand_extra_isize_ea(struct inint error =0 , tried_min_extra_isize =0 ;int s_min_extra_isize =le16_to_cpu (EXT4_SB (inode->i_sb)->s_es->s_min_extra_isize);int isize_diff;/* How much do we need to grow i_extra_isize */ +int no_expand; + +if (ext4_write_trylock_xattr (inode, &no_expand) ==0 ) +return 0 ; -down_write (&EXT4_I (inode)->xattr_sem); -/* -* Set EXT4_STATE_NO_EXPAND to avoid recursion when marking inode dirty -*/ -ext4_set_inode_state (inode,EXT4_STATE_NO_EXPAND ); retry: isize_diff = new_extra_isize -EXT4_I (inode)->i_extra_isize;if (EXT4_I (inode)->i_extra_isize >= new_extra_isize)
@@ -1486,8 +1481,7 @@ retry: }brelse (bh); out: -ext4_clear_inode_state (inode,EXT4_STATE_NO_EXPAND ); -up_write (&EXT4_I (inode)->xattr_sem); +ext4_write_unlock_xattr (inode, &no_expand);return 0 ; cleanup:
@@ -1499,10 +1493,10 @@ cleanup:kfree (bs);brelse (bh);/* -* We deliberately leave EXT4_STATE_NO_EXPAND set here since inode -* size expansion failed. +* Inode size expansion failed; don't try again */ -up_write (&EXT4_I (inode)->xattr_sem); + no_expand =1 ; +ext4_write_unlock_xattr (inode, &no_expand);return error; }
fs/ext4/xattr.h +32 -0
@@ -101,6 +101,38 @@ extern const struct xattr_handler ext4_x#define EXT4_XATTR_NAME_ENCRYPTION_CONTEXT "c" +/* +* The EXT4_STATE_NO_EXPAND is overloaded and used for two purposes. +* The first is to signal that there the inline xattrs and data are +* taking up so much space that we might as well not keep trying to +* expand it. The second is that xattr_sem is taken for writing, so +* we shouldn't try to recurse into the inode expansion. For this +* second case, we need to make sure that we take save and restore the +* NO_EXPAND state flag appropriately. +*/ +static inline void ext4_write_lock_xattr (struct inode *inode,int *save) +{ +down_write (&EXT4_I (inode)->xattr_sem); + *save =ext4_test_inode_state (inode,EXT4_STATE_NO_EXPAND ); +ext4_set_inode_state (inode,EXT4_STATE_NO_EXPAND ); +} + +static inline int ext4_write_trylock_xattr (struct inode *inode,int *save) +{ +if (down_write_trylock (&EXT4_I (inode)->xattr_sem) ==0 ) +return 0 ; + *save =ext4_test_inode_state (inode,EXT4_STATE_NO_EXPAND ); +ext4_set_inode_state (inode,EXT4_STATE_NO_EXPAND ); +return 1 ; +} + +static inline void ext4_write_unlock_xattr (struct inode *inode,int *save) +{ +if (*save ==0 ) +ext4_clear_inode_state (inode,EXT4_STATE_NO_EXPAND ); +up_write (&EXT4_I (inode)->xattr_sem); +} +extern ssize_t ext4_listxattr (struct dentry *,char *,size_t );extern int ext4_xattr_get (struct inode *,int ,const char *,void *,size_t );
Greg Kroah-Hartman
maintainerPATCH 78/97 ALSA: line6: Use correct endpoint type for midi output
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabián Inostroza <[email protected]>
commit 7ecb46e9ee9af18e304eb9e7d6804c59a408e846 upstream.
Sending MIDI messages to a PODxt through the USB connection shows "usb_submit_urb failed" in dmesg and the message is not received by the POD.
The error is caused because in the funcion send_midi_async() in midi.c there is a call to usb_sndbulkpipe() for endpoint 3 OUT, but the PODxt USB descriptor shows that this endpoint it's an interrupt endpoint.
Patch tested with PODxt only.
[ The bug has been present from the very beginning in the staging
driver time, but Fixes below points to the commit moving to sound/ directory so that the fix can be cleanly applied -- tiwai ]
--- sound/usb/line6/midi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/usb/line6/midi.c +1 -1
@@ -125,7 +125,7 @@ static int send_midi_async(struct usb_li }usb_fill_int_urb (urb, line6->usbdev, -usb_sndbulkpipe (line6->usbdev, +usb_sndintpipe (line6->usbdev, line6->properties->ep_ctrl_w), transfer_buffer, length, midi_sent, line6, line6->interval);
Greg Kroah-Hartman
maintainerPATCH 80/97 ALSA: hda - New VIA controller suppor no-snoop path
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wang <[email protected]>
commit af52f9982e410edac21ca4b49563053ffc9da1eb upstream.
This patch is used to tell kernel that new VIA HDAC controller also support no-snoop path.
[ minor coding style fix by tiwai ]
--- sound/pci/hda/hda_intel.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/pci/hda/hda_intel.c +2 -1
@@ -1549,7 +1549,8 @@ static void azx_check_snoop_available(st*/ u8 val;pci_read_config_byte (chip->pci,0x42 , &val); -if (!(val &0x80 ) && chip->pci->revision ==0x30 ) +if (!(val &0x80 ) && (chip->pci->revision ==0x30 || + chip->pci->revision ==0x20 )) snoop = false; }
Greg Kroah-Hartman
maintainerPATCH 81/97 HID: hidraw: Fix crash on HIDIOCGFEATURE with a destroyed device
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Rivas Costa <[email protected]>
commit a955358d54695e4ad9f7d6489a7ac4d69a8fc711 upstream.
Doing ioctl(HIDIOCGFEATURE) in a tight loop on a hidraw device and then disconnecting the device, or unloading the driver, can cause a NULL pointer dereference.
When a hidraw device is destroyed it sets 0 to dev->exist. Most functions check 'dev->exist' before doing its work, but hidraw_get_report() was missing that check.
--- drivers/hid/hidraw.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hid/hidraw.c +5 -0
@@ -197,6 +197,11 @@ static ssize_t hidraw_get_report(structint ret =0 , len;unsigned char report_number; +if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { + ret = -ENODEV ; + goto out; + } + dev = hidraw_table[minor]->hid;if (!dev->ll_driver->raw_request) {
Greg Kroah-Hartman
maintainerPATCH 82/97 MIPS: uaccess: Add micromips clobbers to bzero invocation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Redfearn <[email protected]>
commit b3d7e55c3f886493235bfee08e1e5a4a27cbcce8 upstream.
The micromips implementation of bzero additionally clobbers registers t7 & t8. Specify this in the clobbers list when invoking bzero.
Patchwork: https://patchwork.linux-mips.org/patch/19110/
--- arch/mips/include/asm/uaccess.h | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
arch/mips/include/asm/uaccess.h +9 -2
@@ -1238,6 +1238,13 @@ __clear_user(void __user *addr, __kernel {__kernel_size_t res; +#ifdef CONFIG_CPU_MICROMIPS +/* micromips memset / bzero also clobbers t7 & t8 */ +#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$15", "$24", "$31" +#else +#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$31" +#endif /* CONFIG_CPU_MICROMIPS */ +if (eva_kernel_access ()) { __asm__ __volatile__( "move\t$4, %1\n\t"
@@ -1247,7 +1254,7 @@ __clear_user(void __user *addr, __kernel "move\t%0, $6" : "=r" (res) : "r" (addr), "r" (size) - : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31"); + : bzero_clobbers); }else {might_fault (); __asm__ __volatile__(
@@ -1258,7 +1265,7 @@ __clear_user(void __user *addr, __kernel "move\t%0, $6" : "=r" (res) : "r" (addr), "r" (size) - : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31"); + : bzero_clobbers); }return res;
Greg Kroah-Hartman
maintainerPATCH 83/97 MIPS: memset.S: EVA & fault support for small_memset
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Redfearn <[email protected]>
commit 8a8158c85e1e774a44fbe81106fa41138580dfd1 upstream.
The MIPS kernel memset / bzero implementation includes a small_memset branch which is used when the region to be set is smaller than a long (4 bytes on 32bit, 8 bytes on 64bit). The current small_memset implementation uses a simple store byte loop to write the destination. There are 2 issues with this implementation:
1. When EVA mode is active, user and kernel address spaces may overlap. Currently the use of the sb instruction means kernel mode addressing is always used and an intended write to userspace may actually overwrite some critical kernel data.
2. If the write triggers a page fault, for example by calling __clear_user(NULL, 2), instead of gracefully handling the fault, an OOPS is triggered.
Fix these issues by replacing the sb instruction with the EX() macro, which will emit EVA compatible instuctions as required. Additionally implement a fault fixup for small_memset which sets a2 to the number of bytes that could not be cleared (as defined by __clear_user).
Patchwork: https://patchwork.linux-mips.org/patch/18975/
--- arch/mips/lib/memset.S | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/mips/lib/memset.S +6 -1
@@ -218,7 +218,7 @@ 1: PTR_ADDIU a0, 1 /* fill bytewise */ R10KCBARRIER(0(ra)) bne t1, a0, 1b - sb a1, -1(a0) + EX(sb, a1, -1(a0), .Lsmall_fixup\@) 2: jr ra /* done */ move a2, zero
@@ -257,6 +257,11 @@ jr ra andi v1, a2, STORMASK +.Lsmall_fixup\@: + PTR_SUBU a2, t1, a0 + jr ra + PTR_ADDIU a2, 1 + .endm /*
Greg Kroah-Hartman
maintainerPATCH 84/97 MIPS: memset.S: Fix return of __clear_user from Lpartial_fixup
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Redfearn <[email protected]>
commit daf70d89f80c6e1772233da9e020114b1254e7e0 upstream.
The __clear_user function is defined to return the number of bytes that could not be cleared. From the underlying memset / bzero implementation this means setting register a2 to that number on return. Currently if a page fault is triggered within the memset_partial block, the value loaded into a2 on return is meaningless.
The label .Lpartial_fixup\@ is jumped to on page fault. In order to work out how many bytes failed to copy, the exception handler should find how many bytes left in the partial block (andi a2, STORMASK), add that to the partial block end address (a2), and subtract the faulting address to get the remainder. Currently it incorrectly subtracts the partial block start address (t1), which has additionally been clobbered to generate a jump target in memset_partial. Fix this by adding the block end address instead.
This issue was found with the following test code:
int j, k;
for (j = 0; j < 512; j++) {
if ((k = clear_user(NULL, j)) != j) {
pr_err("clear_user (NULL %d) returned %d\n", j, k);
}
}Which now passes on Creator Ci40 (MIPS32) and Cavium Octeon II (MIPS64).
Patchwork: https://patchwork.linux-mips.org/patch/19108/
--- arch/mips/lib/memset.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/lib/memset.S +1 -1
@@ -249,7 +249,7 @@ PTR_L t0, TI_TASK($28) andi a2, STORMASK LONG_L t0, THREAD_BUADDR(t0) - LONG_ADDU a2, t1 + LONG_ADDU a2, a0 jr ra LONG_SUBU a2, t0
Greg Kroah-Hartman
maintainerPATCH 86/97 powerpc/eeh: Fix enabling bridge MMIO windows
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Neuling <[email protected]>
commit 13a83eac373c49c0a081cbcd137e79210fe78acd upstream.
On boot we save the configuration space of PCIe bridges. We do this so when we get an EEH event and everything gets reset that we can restore them.
Unfortunately we save this state before we've enabled the MMIO space on the bridges. Hence if we have to reset the bridge when we come back MMIO is not enabled and we end up taking an PE freeze when the driver starts accessing again.
This patch forces the memory/MMIO and bus mastering on when restoring bridges on EEH. Ideally we'd do this correctly by saving the configuration space writes later, but that will have to come later in a larger EEH rewrite. For now we have this simple fix.
The original bug can be triggered on a boston machine by doing:
echo 0x8000000000000000 > /sys/kernel/debug/powerpc/PCI0001/err_injct_outbound
On boston, this PHB has a PCIe switch on it. Without this patch, you'll see two EEH events, 1 expected and 1 the failure we are fixing here. The second EEH event causes the anything under the PHB to disappear (i.e. the i40e eth).
With this patch, only 1 EEH event occurs and devices properly recover.
--- arch/powerpc/kernel/eeh_pe.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/powerpc/kernel/eeh_pe.c +2 -1
@@ -788,7 +788,8 @@ static void eeh_restore_bridge_bars(stru eeh_ops->write_config (pdn,15 *4 ,4 , edev->config_space[15 ]);/* PCI Command: 0x4 */ - eeh_ops->write_config (pdn,PCI_COMMAND ,4 , edev->config_space[1 ]); + eeh_ops->write_config (pdn,PCI_COMMAND ,4 , edev->config_space[1 ] | +PCI_COMMAND_MEMORY |PCI_COMMAND_MASTER );/* Check the PCIe link is ready */ eeh_bridge_check_link (edev);
Greg Kroah-Hartman
maintainerPATCH 88/97 jffs2_kill_sb(): deal with failed allocations
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit c66b23c2840446a82c389e4cb1a12eb2a71fa2e4 upstream.
jffs2_fill_super() might fail to allocate jffs2_sb_info; jffs2_kill_sb() must survive that.
--- fs/jffs2/super.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/jffs2/super.c +1 -1
@@ -345,7 +345,7 @@ static void jffs2_put_super (struct supestatic void jffs2_kill_sb (struct super_block *sb) {struct jffs2_sb_info *c =JFFS2_SB_INFO (sb); -if (!(sb->s_flags &MS_RDONLY )) +if (c && !(sb->s_flags &MS_RDONLY ))jffs2_stop_garbage_collect_thread (c);kill_mtd_super (sb);kfree (c);
Greg Kroah-Hartman
maintainerPATCH 89/97 hypfs_kill_super(): deal with failed allocations
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit a24cd490739586a7d2da3549a1844e1d7c4f4fc4 upstream.
hypfs_fill_super() might fail to allocate sbi; hypfs_kill_super() should not oops on that.
--- arch/s390/hypfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/s390/hypfs/inode.c +1 -1
@@ -318,7 +318,7 @@ static void hypfs_kill_super(struct supeif (sb->s_root)hypfs_delete_tree (sb->s_root); -if (sb_info->update_file) +if (sb_info && sb_info->update_file)hypfs_remove (sb_info->update_file);kfree (sb->s_fs_info); sb->s_fs_info =NULL ;
Greg Kroah-Hartman
maintainerPATCH 90/97 rpc_pipefs: fix double-dput()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 4a3877c4cedd95543f8726b0a98743ed8db0c0fb upstream.
if we ever hit rpc_gssd_dummy_depopulate() dentry passed to it has refcount equal to 1. __rpc_rmpipe() drops it and dput() done after that hits an already freed dentry.
--- net/sunrpc/rpc_pipe.c | 1 + 1 file changed, 1 insertion(+)
net/sunrpc/rpc_pipe.c +1 -0
@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentrystruct dentry *clnt_dir = pipe_dentry->d_parent;struct dentry *gssd_dir = clnt_dir->d_parent; +dget (pipe_dentry);__rpc_rmpipe (d_inode (clnt_dir), pipe_dentry);__rpc_depopulate (clnt_dir, gssd_dummy_info_file,0 ,1 );__rpc_depopulate (gssd_dir, gssd_dummy_clnt_dir,0 ,1 );
Greg Kroah-Hartman
maintainerPATCH 92/97 autofs: mount point create should honour passed in mode
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Kent <[email protected]>
commit 1e6306652ba18723015d1b4967fe9de55f042499 upstream.
The autofs file system mkdir inode operation blindly sets the created directory mode to S_IFDIR | 0555, ingoring the passed in mode, which can cause selinux dac_override denials.
But the function also checks if the caller is the daemon (as no-one else should be able to do anything here) so there's no point in not honouring the passed in mode, allowing the daemon to set appropriate mode when required.
--- fs/autofs4/root.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/autofs4/root.c +1 -1
@@ -746,7 +746,7 @@ static int autofs4_dir_mkdir(struct inodautofs4_del_active (dentry); - inode =autofs4_get_inode (dir->i_sb,S_IFDIR |0555 ); + inode =autofs4_get_inode (dir->i_sb,S_IFDIR | mode);if (!inode)return -ENOMEM ;d_add (dentry, inode);
Greg Kroah-Hartman
maintainerPATCH 93/97 mm: allow GFP_{FS,IO} for page_cache_read page cache allocation
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <[email protected]>
commit c20cd45eb01748f0fba77a504f956b000df4ea73 upstream.
page_cache_read has been historically using page_cache_alloc_cold to allocate a new page. This means that mapping_gfp_mask is used as the base for the gfp_mask. Many filesystems are setting this mask to GFP_NOFS to prevent from fs recursion issues. page_cache_read is called from the vm_operations_struct::fault() context during the page fault. This context doesn't need the reclaim protection normally.
ceph and ocfs2 which call filemap_fault from their fault handlers seem to be OK because they are not taking any fs lock before invoking generic implementation. xfs which takes XFS_MMAPLOCK_SHARED is safe from the reclaim recursion POV because this lock serializes truncate and punch hole with the page faults and it doesn't get involved in the reclaim.
There is simply no reason to deliberately use a weaker allocation context when a __GFP_FS | __GFP_IO can be used. The GFP_NOFS protection might be even harmful. There is a push to fail GFP_NOFS allocations rather than loop within allocator indefinitely with a very limited reclaim ability. Once we start failing those requests the OOM killer might be triggered prematurely because the page cache allocation failure is propagated up the page fault path and end up in pagefault_out_of_memory.
We cannot play with mapping_gfp_mask directly because that would be racy wrt. parallel page faults and it might interfere with other users who really rely on NOFS semantic from the stored gfp_mask. The mask is also inode proper so it would even be a layering violation. What we can do instead is to push the gfp_mask into struct vm_fault and allow fs layer to overwrite it should the callback need to be called with a different allocation context.
Initialize the default to (mapping_gfp_mask | __GFP_FS | __GFP_IO) because this should be safe from the page fault path normally. Why do we care about mapping_gfp_mask at all then? Because this doesn't hold only reclaim protection flags but it also might contain zone and movability restrictions (GFP_DMA32, __GFP_MOVABLE and others) so we have to respect those.
--- include/linux/mm.h | 4 ++++ mm/filemap.c | 9 ++++----- mm/memory.c | 17 +++++++++++++++++ 3 files changed, 25 insertions(+), 5 deletions(-)
include/linux/mm.h +4 -0
@@ -225,10 +225,14 @@ extern pgprot_t protection_map[16];* ->fault function. The vma's ->fault is responsible for returning a bitmask * of VM_FAULT_xxx flags that give details about how the fault was handled. * +* MM layer fills up gfp_mask for page allocations but fault handler might +* alter it if its implementation requires a different allocation context. +* * pgoff should be used in favour of virtual_address, if possible. */ struct vm_fault {unsigned int flags;/* FAULT_FLAG_xxx flags */ +gfp_t gfp_mask;/* gfp mask to be used for allocations */ pgoff_t pgoff;/* Logical page offset based on vma */ void __user *virtual_address;/* Faulting virtual address */
mm/filemap.c +4 -5
@@ -1827,19 +1827,18 @@ EXPORT_SYMBOL(generic_file_read_iter);* This adds the requested page to the page cache if it isn't already there, * and schedules an I/O to read in its contents from disk. */ -static int page_cache_read (struct file *file,pgoff_t offset) +static int page_cache_read (struct file *file,pgoff_t offset,gfp_t gfp_mask) {struct address_space *mapping = file->f_mapping;struct page *page;int ret; do { - page = page_cache_alloc_cold(mapping); + page = __page_cache_alloc(gfp_mask|__GFP_COLD); if (!page) return -ENOMEM; - ret = add_to_page_cache_lru(page, mapping, offset, - mapping_gfp_constraint(mapping, GFP_KERNEL)); + ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL); if (ret == 0) ret = mapping->a_ops->readpage(file, page); else if (ret == -EEXIST)
@@ -2020,7 +2019,7 @@ no_cached_page:* We're only likely to ever get here if MADV_RANDOM is in * effect. */ - error =page_cache_read (file, offset); + error =page_cache_read (file, offset, vmf->gfp_mask);/* * The page we want has now been added to the page cache.
mm/memory.c +17 -0
@@ -1990,6 +1990,20 @@ static inline void cow_user_page(structcopy_user_highpage (dst, src, va, vma); } +static gfp_t __get_fault_gfp_mask (struct vm_area_struct *vma) +{ +struct file *vm_file = vma->vm_file; + +if (vm_file) +return mapping_gfp_mask (vm_file->f_mapping) | __GFP_FS | __GFP_IO; + +/* +* Special mappings (e.g. VDSO) do not have any file so fake +* a default GFP_KERNEL for them. +*/ +return GFP_KERNEL ; +} +/* * Notify the address space that the page is about to become writable so that * it can prohibit this or wait for the page to get into an appropriate state.
@@ -2005,6 +2019,7 @@ static int do_page_mkwrite(struct vm_are vmf.virtual_address = (void __user *)(address &PAGE_MASK ); vmf.pgoff = page->index; vmf.flags =FAULT_FLAG_WRITE |FAULT_FLAG_MKWRITE ; + vmf.gfp_mask =__get_fault_gfp_mask (vma); vmf.page = page; vmf.cow_page =NULL ;
@@ -2770,6 +2785,7 @@ static int __do_fault(struct vm_area_str vmf.pgoff = pgoff; vmf.flags = flags; vmf.page =NULL ; + vmf.gfp_mask =__get_fault_gfp_mask (vma); vmf.cow_page = cow_page; ret = vma->vm_ops->fault (vma, &vmf);
@@ -2936,6 +2952,7 @@ static void do_fault_around(struct vm_ar vmf.pgoff = pgoff; vmf.max_pgoff = max_pgoff; vmf.flags = flags; + vmf.gfp_mask =__get_fault_gfp_mask (vma); vma->vm_ops->map_pages (vma, &vmf); }
Greg Kroah-Hartman
maintainerPATCH 94/97 mm/filemap.c: fix NULL pointer in page_cache_tree_insert()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <[email protected]>
commit abc1be13fd113ddef5e2d807a466286b864caed3 upstream.
f2fs specifies the __GFP_ZERO flag for allocating some of its pages. Unfortunately, the page cache also uses the mapping's GFP flags for allocating radix tree nodes. It always masked off the __GFP_HIGHMEM flag, and masks off __GFP_ZERO in some paths, but not all. That causes radix tree nodes to be allocated with a NULL list_head, which causes backtraces like:
__list_del_entry+0x30/0xd0 list_lru_del+0xac/0x1ac page_cache_tree_insert+0xd8/0x110
The __GFP_DMA and __GFP_DMA32 flags would also be able to sneak through if they are ever used. Fix them all by using GFP_RECLAIM_MASK at the innermost location, and remove it from earlier in the callchain.
--- mm/filemap.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
mm/filemap.c +4 -5
@@ -571,7 +571,7 @@ int replace_page_cache_page(struct pageVM_BUG_ON_PAGE (!PageLocked (new), new);VM_BUG_ON_PAGE (new->mapping, new); - error =radix_tree_preload (gfp_mask & ~__GFP_HIGHMEM); + error =radix_tree_preload (gfp_mask &GFP_RECLAIM_MASK );if (!error) {struct address_space *mapping = old->mapping;void (*freepage)(struct page *);
@@ -630,7 +630,7 @@ static int __add_to_page_cache_locked(streturn error; } - error =radix_tree_maybe_preload (gfp_mask & ~__GFP_HIGHMEM); + error =radix_tree_maybe_preload (gfp_mask &GFP_RECLAIM_MASK );if (error) {if (!huge)mem_cgroup_cancel_charge (page, memcg);
@@ -1192,8 +1192,7 @@ no_page:if (fgp_flags &FGP_ACCESSED )__SetPageReferenced (page); - err =add_to_page_cache_lru (page, mapping, offset, - gfp_mask &GFP_RECLAIM_MASK ); + err =add_to_page_cache_lru (page, mapping, offset, gfp_mask);if (unlikely (err)) {page_cache_release (page); page =NULL ;
@@ -1838,7 +1837,7 @@ static int page_cache_read(struct file *if (!page)return -ENOMEM ; - ret =add_to_page_cache_lru (page, mapping, offset, gfp_mask &GFP_KERNEL ); + ret =add_to_page_cache_lru (page, mapping, offset, gfp_mask);if (ret ==0 ) ret = mapping->a_ops->readpage (file, page);else if (ret == -EEXIST )
Greg Kroah-Hartman
maintainerPATCH 95/97 ext4: bugfix for mmaped pages in mpage_release_unused_pages()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangguang <[email protected]>
commit 4e800c0359d9a53e6bf0ab216954971b2515247f upstream.
Pages clear buffers after ext4 delayed block allocation failed, However, it does not clean its pte_dirty flag.
if the pages unmap ,in cording to the pte_dirty , unmap_page_range may try to call __set_page_dirty,
which may lead to the bugon at mpage_prepare_extent_to_map:head = page_buffers(page);.
This patch just call clear_page_dirty_for_io to clean pte_dirty at mpage_release_unused_pages for pages mmaped.
Steps to reproduce the bug:
（1） mmap a file in ext4
addr = (char *)mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0); memset(addr, 'i', 4096);
（2） return EIO at
ext4_writepages->mpage_map_and_submit_extent->mpage_map_one_extent
which causes this log message to be print:
ext4_msg(sb, KERN_CRIT,
"Delayed block allocation failed for "
"inode %lu at logical offset %llu with"
" max blocks %u with error %d",
inode->i_ino,
(unsigned long long)map->m_lblk,
(unsigned)map->m_len, -err);(3）Unmap the addr cause warning at
__set_page_dirty:WARN_ON_ONCE(warn && !PageUptodate(page));
(4) wait for a minute,then bugon happen.
--- fs/ext4/inode.c | 2 ++ 1 file changed, 2 insertions(+)
fs/ext4/inode.c +2 -0
@@ -1515,6 +1515,8 @@ static void mpage_release_unused_pages(sBUG_ON (!PageLocked (page));BUG_ON (PageWriteback (page));if (invalidate) { +if (page_mapped (page)) +clear_page_dirty_for_io (page);block_invalidatepage (page,0 ,PAGE_CACHE_SIZE );ClearPageUptodate (page); }
Greg Kroah-Hartman
maintainerPATCH 96/97 fanotify: fix logic of events on child
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amir Goldstein <[email protected]>
commit 54a307ba8d3cd00a3902337ffaae28f436eeb1a4 upstream.
When event on child inodes are sent to the parent inode mark and parent inode mark was not marked with FAN_EVENT_ON_CHILD, the event will not be delivered to the listener process. However, if the same process also has a mount mark, the event to the parent inode will be delivered regadless of the mount mark mask.
This behavior is incorrect in the case where the mount mark mask does not contain the specific event type. For example, the process adds a mark on a directory with mask FAN_MODIFY (without FAN_EVENT_ON_CHILD) and a mount mark with mask FAN_CLOSE_NOWRITE (without FAN_ONDIR).
A modify event on a file inside that directory (and inside that mount) should not create a FAN_MODIFY event, because neither of the marks requested to get that event on the file.
--- fs/notify/fanotify/fanotify.c | 34 +++++++++++++++------------------- 1 file changed, 15 insertions(+), 19 deletions(-)
fs/notify/fanotify/fanotify.c +15 -19
@@ -92,7 +92,7 @@ static bool fanotify_should_send_event(su32 event_mask, void *data, int data_type) { - __u32 marks_mask, marks_ignored_mask; + __u32 marks_mask = 0, marks_ignored_mask = 0;struct path *path = data; pr_debug("%s: inode_mark=%p vfsmnt_mark=%p mask=%x data=%p"
@@ -108,24 +108,20 @@ static bool fanotify_should_send_event(s !d_can_lookup(path->dentry))return false; -if (inode_mark && vfsmnt_mark) { - marks_mask = (vfsmnt_mark->mask | inode_mark->mask); - marks_ignored_mask = (vfsmnt_mark->ignored_mask | inode_mark->ignored_mask); - }else if (inode_mark) { -/* -* if the event is for a child and this inode doesn't care about -* events on the child, don't send it! -*/ -if ((event_mask &FS_EVENT_ON_CHILD ) && - !(inode_mark->mask &FS_EVENT_ON_CHILD )) -return false; - marks_mask = inode_mark->mask; - marks_ignored_mask = inode_mark->ignored_mask; - }else if (vfsmnt_mark) { - marks_mask = vfsmnt_mark->mask; - marks_ignored_mask = vfsmnt_mark->ignored_mask; - }else { -BUG (); +/* +* if the event is for a child and this inode doesn't care about +* events on the child, don't send it! +*/ +if (inode_mark && + (!(event_mask &FS_EVENT_ON_CHILD ) || + (inode_mark->mask &FS_EVENT_ON_CHILD ))) { + marks_mask |= inode_mark->mask; + marks_ignored_mask |= inode_mark->ignored_mask; + } + +if (vfsmnt_mark) { + marks_mask |= vfsmnt_mark->mask; + marks_ignored_mask |= vfsmnt_mark->ignored_mask; } if (d_is_dir(path->dentry) &&
Greg Kroah-Hartman
maintainerPATCH 97/97 writeback: safer lock nesting
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Thelen <[email protected]>
commit 2e898e4c0a3897ccd434adac5abb8330194f527b upstream.
lock_page_memcg()/unlock_page_memcg() use spin_lock_irqsave/restore() if the page's memcg is undergoing move accounting, which occurs when a process leaves its memcg for a new one that has memory.move_charge_at_immigrate set.
unlocked_inode_to_wb_begin,end() use spin_lock_irq/spin_unlock_irq() if the given inode is switching writeback domains. Switches occur when enough writes are issued from a new domain.
This existing pattern is thus suspicious:
lock_page_memcg(page);
unlocked_inode_to_wb_begin(inode, &locked);
...
unlocked_inode_to_wb_end(inode, locked);
unlock_page_memcg(page);If both inode switch and process memcg migration are both in-flight then unlocked_inode_to_wb_end() will unconditionally enable interrupts while still holding the lock_page_memcg() irq spinlock. This suggests the possibility of deadlock if an interrupt occurs before unlock_page_memcg().
truncate
__cancel_dirty_page
lock_page_memcg
unlocked_inode_to_wb_begin unlocked_inode_to_wb_end
<interrupts mistakenly enabled>
<interrupt> end_page_writeback test_clear_page_writeback lock_page_memcg <deadlock>
unlock_page_memcg
Due to configuration limitations this deadlock is not currently possible because we don't mix cgroup writeback (a cgroupv2 feature) and memory.move_charge_at_immigrate (a cgroupv1 feature).
If the kernel is hacked to always claim inode switching and memcg moving_account, then this script triggers lockup in less than a minute:
cd /mnt/cgroup/memory
mkdir a b
echo 1 > a/memory.move_charge_at_immigrate
echo 1 > b/memory.move_charge_at_immigrate
(
echo $BASHPID > a/cgroup.procs
while true; do
dd if=/dev/zero of=/mnt/big bs=1M count=256
done
) &
while true; do
sync
done &
sleep 1h &
SLEEP=$!
while true; do
echo $SLEEP > a/cgroup.procs
echo $SLEEP > b/cgroup.procs
done
The deadlock does not seem possible, so it's debatable if there's any reason to modify the kernel. I suggest we should to prevent future surprises. And Wang Long said "this deadlock occurs three times in our environment", so there's more reason to apply this, even to stable. Stable 4.4 has minor conflicts applying this patch. For a clean 4.4 patch see "[PATCH for-4.4] writeback: safer lock nesting"
https://lkml.org/lkml/2018/4/11/146
Wang Long said "this deadlock occurs three times in our environment"
--- fs/fs-writeback.c | 7 ++++--- include/linux/backing-dev-defs.h | 5 +++++ include/linux/backing-dev.h | 31 +++++++++++++++++-------------- mm/page-writeback.c | 18 +++++++++--------- 4 files changed, 35 insertions(+), 26 deletions(-)
fs/fs-writeback.c +4 -3
@@ -747,11 +747,12 @@ int inode_congested(struct inode *inode,*/ if (inode &&inode_to_wb_is_valid (inode)) {struct bdi_writeback *wb; -bool locked, congested; +struct wb_lock_cookie lock_cookie = {}; +bool congested; - wb =unlocked_inode_to_wb_begin (inode, &locked); + wb =unlocked_inode_to_wb_begin (inode, &lock_cookie); congested =wb_congested (wb, cong_bits); -unlocked_inode_to_wb_end (inode, locked); +unlocked_inode_to_wb_end (inode, &lock_cookie);return congested; }
include/linux/backing-dev-defs.h +5 -0
@@ -191,6 +191,11 @@ static inline void set_bdi_congested(strset_wb_congested (bdi->wb.congested, sync); } +struct wb_lock_cookie { +bool locked; +unsigned long flags; +}; +#ifdef CONFIG_CGROUP_WRITEBACK /**
include/linux/backing-dev.h +17 -14
@@ -366,7 +366,7 @@ static inline struct bdi_writeback *inod/** * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction * @inode: target inode -* @lockedp: temp bool output param, to be passed to the end function +* @cookie: output param, to be passed to the end function * * The caller wants to access the wb associated with @inode but isn't * holding inode->i_lock, mapping->tree_lock or wb->list_lock. This
@@ -374,12 +374,12 @@ static inline struct bdi_writeback *inod* association doesn't change until the transaction is finished with * unlocked_inode_to_wb_end(). * -* The caller must call unlocked_inode_to_wb_end() with *@lockdep -* afterwards and can't sleep during transaction. IRQ may or may not be -* disabled on return. +* The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and +* can't sleep during the transaction. IRQs may or may not be disabled on +* return. */ static inline struct bdi_writeback * -unlocked_inode_to_wb_begin (struct inode *inode,bool *lockedp) +unlocked_inode_to_wb_begin (struct inode *inode,struct wb_lock_cookie *cookie) {rcu_read_lock ();
@@ -387,10 +387,10 @@ unlocked_inode_to_wb_begin(struct inode* Paired with store_release in inode_switch_wb_work_fn() and * ensures that we see the new wb if we see cleared I_WB_SWITCH. */ - *lockedp =smp_load_acquire (&inode->i_state) &I_WB_SWITCH ; + cookie->locked =smp_load_acquire (&inode->i_state) &I_WB_SWITCH ; -if (unlikely (*lockedp)) -spin_lock_irq (&inode->i_mapping->tree_lock); +if (unlikely (cookie->locked)) +spin_lock_irqsave (&inode->i_mapping->tree_lock, cookie->flags);/* * Protected by either !I_WB_SWITCH + rcu_read_lock() or tree_lock.
@@ -402,12 +402,14 @@ unlocked_inode_to_wb_begin(struct inode/** * unlocked_inode_to_wb_end - end inode wb access transaction * @inode: target inode -* @locked: *@lockedp from unlocked_inode_to_wb_begin() +* @cookie: @cookie from unlocked_inode_to_wb_begin() */ -static inline void unlocked_inode_to_wb_end (struct inode *inode,bool locked) +static inline void unlocked_inode_to_wb_end (struct inode *inode, +struct wb_lock_cookie *cookie) { -if (unlikely (locked)) -spin_unlock_irq (&inode->i_mapping->tree_lock); +if (unlikely (cookie->locked)) +spin_unlock_irqrestore (&inode->i_mapping->tree_lock, + cookie->flags);rcu_read_unlock (); }
@@ -454,12 +456,13 @@ static inline struct bdi_writeback *inod }static inline struct bdi_writeback * -unlocked_inode_to_wb_begin (struct inode *inode,bool *lockedp) +unlocked_inode_to_wb_begin (struct inode *inode,struct wb_lock_cookie *cookie) {return inode_to_wb (inode); } -static inline void unlocked_inode_to_wb_end (struct inode *inode,bool locked) +static inline void unlocked_inode_to_wb_end (struct inode *inode, +struct wb_lock_cookie *cookie) { }
mm/page-writeback.c +9 -9
@@ -2510,13 +2510,13 @@ void account_page_redirty(struct page *pif (mapping &&mapping_cap_account_dirty (mapping)) {struct inode *inode = mapping->host;struct bdi_writeback *wb; -bool locked; +struct wb_lock_cookie cookie = {}; - wb =unlocked_inode_to_wb_begin (inode, &locked); + wb =unlocked_inode_to_wb_begin (inode, &cookie); current->nr_dirtied--;dec_zone_page_state (page,NR_DIRTIED );dec_wb_stat (wb,WB_DIRTIED ); -unlocked_inode_to_wb_end (inode, locked); +unlocked_inode_to_wb_end (inode, &cookie); } }EXPORT_SYMBOL (account_page_redirty);
@@ -2622,15 +2622,15 @@ void cancel_dirty_page(struct page *pagestruct inode *inode = mapping->host;struct bdi_writeback *wb;struct mem_cgroup *memcg; -bool locked; +struct wb_lock_cookie cookie = {}; memcg =mem_cgroup_begin_page_stat (page); - wb =unlocked_inode_to_wb_begin (inode, &locked); + wb =unlocked_inode_to_wb_begin (inode, &cookie);if (TestClearPageDirty (page))account_page_cleaned (page, mapping, memcg, wb); -unlocked_inode_to_wb_end (inode, locked); +unlocked_inode_to_wb_end (inode, &cookie);mem_cgroup_end_page_stat (memcg); }else {ClearPageDirty (page);
@@ -2663,7 +2663,7 @@ int clear_page_dirty_for_io(struct pagestruct inode *inode = mapping->host;struct bdi_writeback *wb;struct mem_cgroup *memcg; -bool locked; +struct wb_lock_cookie cookie = {};/* * Yes, Virginia, this is indeed insane.
@@ -2701,14 +2701,14 @@ int clear_page_dirty_for_io(struct page* exclusion. */ memcg =mem_cgroup_begin_page_stat (page); - wb =unlocked_inode_to_wb_begin (inode, &locked); + wb =unlocked_inode_to_wb_begin (inode, &cookie);if (TestClearPageDirty (page)) {mem_cgroup_dec_page_stat (memcg,MEM_CGROUP_STAT_DIRTY );dec_zone_page_state (page,NR_FILE_DIRTY );dec_wb_stat (wb,WB_RECLAIMABLE ); ret =1 ; } -unlocked_inode_to_wb_end (inode, locked); +unlocked_inode_to_wb_end (inode, &cookie);mem_cgroup_end_page_stat (memcg);return ret; }
Greg Kroah-Hartman
maintainerPATCH 10/97 s390/qdio: dont retry EQBS after CCQ 96
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julian Wiedmann <[email protected]>
commit dae55b6fef58530c13df074bcc182c096609339e upstream.
Immediate retry of EQBS after CCQ 96 means that we potentially misreport the state of buffers inspected during the first EQBS call.
This occurs when
1. the first EQBS finds all inspected buffers still in the initial state set by the driver (ie INPUT EMPTY or OUTPUT PRIMED),
2. the EQBS terminates early with CCQ 96, and
3. by the time that the second EQBS comes around, the state of those previously inspected buffers has changed.
If the state reported by the second EQBS is 'driver-owned', all we know is that the previous buffers are driver-owned now as well. But we can't tell if they all have the same state. So for instance
- the second EQBS reports OUTPUT EMPTY, but any number of the previous buffers could be OUTPUT ERROR by now,
- the second EQBS reports OUTPUT ERROR, but any number of the previous buffers could be OUTPUT EMPTY by now.
Effectively, this can result in both over- and underreporting of errors.
If the state reported by the second EQBS is 'HW-owned', that doesn't guarantee that the previous buffers have not been switched to driver-owned in the mean time. So for instance
- the second EQBS reports INPUT EMPTY, but any number of the previous buffers could be INPUT PRIMED (or INPUT ERROR) by now.
This would result in failure to process pending work on the queue. If it's the final check before yielding initiative, this can cause a (temporary) queue stall due to IRQ avoidance.
--- drivers/s390/cio/qdio_main.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/s390/cio/qdio_main.c +2 -9
@@ -126,7 +126,7 @@ static inline int qdio_check_ccq(structstatic int qdio_do_eqbs (struct qdio_q *q,unsigned char *state,int start,int count,int auto_ack) { -int rc, tmp_count = count, tmp_start = start, nr = q->nr, retried =0 ; +int rc, tmp_count = count, tmp_start = start, nr = q->nr;unsigned int ccq =0 ;qperf_inc (q, eqbs);
@@ -149,14 +149,7 @@ again:qperf_inc (q, eqbs_partial);DBF_DEV_EVENT (DBF_WARN , q->irq_ptr,"EQBS part:%02x" , tmp_count); -/* -* Retry once, if that fails bail out and process the -* extracted buffers before trying again. -*/ -if (!retried++) - goto again; -else -return count - tmp_count; +return count - tmp_count; }DBF_ERROR ("%4x EQBS ERROR" ,SCH_NO (q));
Greg Kroah-Hartman
maintainerPATCH 14/97 rtl8187: Fix NULL pointer dereference in priv->conf_mutex
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudhir Sreedharan <[email protected]>
commit 7972326a26b5bf8dc2adac575c4e03ee7e9d193a upstream.
This can be reproduced by bind/unbind the driver multiple times in AM3517 board.
Analysis revealed that rtl8187_start() was invoked before probe finishes(ie. before the mutex is initialized).
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 0 PID: 821 Comm: wpa_supplicant Not tainted 4.9.80-dirty #250 Hardware name: Generic AM3517 (Flattened Device Tree) [<c010e0d8>] (unwind_backtrace) from [<c010beac>] (show_stack+0x10/0x14) [<c010beac>] (show_stack) from [<c017401c>] (register_lock_class+0x4f4/0x55c) [<c017401c>] (register_lock_class) from [<c0176fe0>] (__lock_acquire+0x74/0x1938) [<c0176fe0>] (__lock_acquire) from [<c0178cfc>] (lock_acquire+0xfc/0x23c) [<c0178cfc>] (lock_acquire) from [<c08aa2f8>] (mutex_lock_nested+0x50/0x3b0) [<c08aa2f8>] (mutex_lock_nested) from [<c05f5bf8>] (rtl8187_start+0x2c/0xd54) [<c05f5bf8>] (rtl8187_start) from [<c082dea0>] (drv_start+0xa8/0x320) [<c082dea0>] (drv_start) from [<c084d1d4>] (ieee80211_do_open+0x2bc/0x8e4) [<c084d1d4>] (ieee80211_do_open) from [<c069be94>] (__dev_open+0xb8/0x120) [<c069be94>] (__dev_open) from [<c069c11c>] (__dev_change_flags+0x88/0x14c) [<c069c11c>] (__dev_change_flags) from [<c069c1f8>] (dev_change_flags+0x18/0x48) [<c069c1f8>] (dev_change_flags) from [<c0710b08>] (devinet_ioctl+0x738/0x840) [<c0710b08>] (devinet_ioctl) from [<c067925c>] (sock_ioctl+0x164/0x2f4) [<c067925c>] (sock_ioctl) from [<c02883f8>] (do_vfs_ioctl+0x8c/0x9d0) [<c02883f8>] (do_vfs_ioctl) from [<c0288da8>] (SyS_ioctl+0x6c/0x7c) [<c0288da8>] (SyS_ioctl) from [<c0107760>] (ret_fast_syscall+0x0/0x1c) Unable to handle kernel NULL pointer dereference at virtual address 00000000 pgd = cd1ec000 [00000000] *pgd=8d1de831, *pte=00000000, *ppte=00000000 Internal error: Oops: 817 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 821 Comm: wpa_supplicant Not tainted 4.9.80-dirty #250 Hardware name: Generic AM3517 (Flattened Device Tree) task: ce73eec0 task.stack: cd1ea000 PC is at mutex_lock_nested+0xe8/0x3b0 LR is at mutex_lock_nested+0xd0/0x3b0
--- drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +1 -1
@@ -1454,6 +1454,7 @@ static int rtl8187_probe(struct usb_inte goto err_free_dev; }mutex_init (&priv->io_mutex); +mutex_init (&priv->conf_mutex);SET_IEEE80211_DEV (dev, &intf->dev);usb_set_intfdata (intf, dev);
@@ -1627,7 +1628,6 @@ static int rtl8187_probe(struct usb_inteprintk (KERN_ERR "rtl8187: Cannot register device\n" ); goto err_free_dmabuf; } -mutex_init (&priv->conf_mutex);skb_queue_head_init (&priv->b_tx_status.queue); wiphy_info(dev->wiphy, "hwaddr %pM, %s V%d + %s, rfkill mask %d\n",
Greg Kroah-Hartman
maintainerPATCH 15/97 hwmon: (ina2xx) Fix access to uninitialized mutex
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <[email protected]>
commit 0c4c5860e9983eb3da7a3d73ca987643c3ed034b upstream.
Initialize data->config_lock mutex before it is used by the driver code.
This fixes following warning on Odroid XU3 boards:
INFO: trying to register non-static key.
the code is fine but needs lockdep annotation.
turning off the locking correctness validator.
CPU: 5 PID: 1 Comm: swapper/0 Not tainted 4.15.0-rc7-next-20180115-00001-gb75575dee3f2 #107 Hardware name: SAMSUNG EXYNOS (Flattened Device Tree) [<c0111504>] (unwind_backtrace) from [<c010dbec>] (show_stack+0x10/0x14) [<c010dbec>] (show_stack) from [<c09b3f74>] (dump_stack+0x90/0xc8) [<c09b3f74>] (dump_stack) from [<c0179528>] (register_lock_class+0x1c0/0x59c) [<c0179528>] (register_lock_class) from [<c017bd1c>] (__lock_acquire+0x78/0x1850) [<c017bd1c>] (__lock_acquire) from [<c017de30>] (lock_acquire+0xc8/0x2b8) [<c017de30>] (lock_acquire) from [<c09ca59c>] (__mutex_lock+0x60/0xa0c) [<c09ca59c>] (__mutex_lock) from [<c09cafd0>] (mutex_lock_nested+0x1c/0x24) [<c09cafd0>] (mutex_lock_nested) from [<c068b0d0>] (ina2xx_set_shunt+0x70/0xb0) [<c068b0d0>] (ina2xx_set_shunt) from [<c068b218>] (ina2xx_probe+0x88/0x1b0) [<c068b218>] (ina2xx_probe) from [<c0673d90>] (i2c_device_probe+0x1e0/0x2d0) [<c0673d90>] (i2c_device_probe) from [<c053a268>] (driver_probe_device+0x2b8/0x4a0) [<c053a268>] (driver_probe_device) from [<c053a54c>] (__driver_attach+0xfc/0x120) [<c053a54c>] (__driver_attach) from [<c05384cc>] (bus_for_each_dev+0x58/0x7c) [<c05384cc>] (bus_for_each_dev) from [<c0539590>] (bus_add_driver+0x174/0x250) [<c0539590>] (bus_add_driver) from [<c053b5e0>] (driver_register+0x78/0xf4) [<c053b5e0>] (driver_register) from [<c0675ef0>] (i2c_register_driver+0x38/0xa8) [<c0675ef0>] (i2c_register_driver) from [<c0102b40>] (do_one_initcall+0x48/0x18c) [<c0102b40>] (do_one_initcall) from [<c0e00df0>] (kernel_init_freeable+0x110/0x1d4) [<c0e00df0>] (kernel_init_freeable) from [<c09c8120>] (kernel_init+0x8/0x114) [<c09c8120>] (kernel_init) from [<c01010b4>] (ret_from_fork+0x14/0x20)
--- drivers/hwmon/ina2xx.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/hwmon/ina2xx.c +1 -2
@@ -447,6 +447,7 @@ static int ina2xx_probe(struct i2c_clien/* set the device type */ data->config = &ina2xx_config[id->driver_data]; +mutex_init (&data->config_lock);if (of_property_read_u32 (dev->of_node,"shunt-resistor" , &val) <0 ) {struct ina2xx_platform_data *pdata =dev_get_platdata (dev);
@@ -473,8 +474,6 @@ static int ina2xx_probe(struct i2c_clienreturn -ENODEV ; } -mutex_init (&data->config_lock); - data->groups[group++] = &ina2xx_group;if (id->driver_data == ina226) data->groups[group++] = &ina226_group;
Greg Kroah-Hartman
maintainerPATCH 17/97 slip: Check if rstate is initialized before uncompressing
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejaswi Tanikella <[email protected]>
[ Upstream commit 3f01ddb962dc506916c243f9524e8bef97119b77 ]
On receiving a packet the state index points to the rstate which must be used to fill up IP and TCP headers. But if the state index points to a rstate which is unitialized, i.e. filled with zeros, it gets stuck in an infinite loop inside ip_fast_csum trying to compute the ip checsum of a header with zero length.
89.666953: <2> [<ffffff9dd3e94d38>] slhc_uncompress+0x464/0x468 89.666965: <2> [<ffffff9dd3e87d88>] ppp_receive_nonmp_frame+0x3b4/0x65c 89.666978: <2> [<ffffff9dd3e89dd4>] ppp_receive_frame+0x64/0x7e0 89.666991: <2> [<ffffff9dd3e8a708>] ppp_input+0x104/0x198 89.667005: <2> [<ffffff9dd3e93868>] pppopns_recv_core+0x238/0x370 89.667027: <2> [<ffffff9dd4428fc8>] __sk_receive_skb+0xdc/0x250 89.667040: <2> [<ffffff9dd3e939e4>] pppopns_recv+0x44/0x60 89.667053: <2> [<ffffff9dd4426848>] __sock_queue_rcv_skb+0x16c/0x24c 89.667065: <2> [<ffffff9dd4426954>] sock_queue_rcv_skb+0x2c/0x38 89.667085: <2> [<ffffff9dd44f7358>] raw_rcv+0x124/0x154 89.667098: <2> [<ffffff9dd44f7568>] raw_local_deliver+0x1e0/0x22c 89.667117: <2> [<ffffff9dd44c8ba0>] ip_local_deliver_finish+0x70/0x24c 89.667131: <2> [<ffffff9dd44c92f4>] ip_local_deliver+0x100/0x10c
./scripts/faddr2line vmlinux slhc_uncompress+0x464/0x468 output:
ip_fast_csum at arch/arm64/include/asm/checksum.h:40 (inlined by) slhc_uncompress at drivers/net/slip/slhc.c:615
Adding a variable to indicate if the current rstate is initialized. If such a packet arrives, move to toss state.
--- drivers/net/slip/slhc.c | 5 +++++ include/net/slhc_vj.h | 1 + 2 files changed, 6 insertions(+)
drivers/net/slip/slhc.c +5 -0
@@ -509,6 +509,10 @@ slhc_uncompress(struct slcompress *comp,if (x <0 || x > comp->rslot_limit) goto bad; +/* Check if the cstate is initialized */ +if (!comp->rstate[x].initialized) + goto bad; + comp->flags &=~SLF_TOSS ; comp->recv_current = x; }else {
@@ -673,6 +677,7 @@ slhc_remember(struct slcompress *comp, uif (cs->cs_tcp.doff >5 )memcpy (cs->cs_tcpopt, icp + ihl*4 +sizeof (struct tcphdr ), (cs->cs_tcp.doff -5 ) *4 ); cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2 ; + cs->initialized = true;/* Put headers back on packet * Neither header checksum is recalculated */
include/net/slhc_vj.h +1 -0
@@ -127,6 +127,7 @@ typedef __u32 int32;*/ struct cstate {byte_t cs_this;/* connection id number (xmit) */ +bool initialized;/* true if initialized */ struct cstate *next;/* next in ring (xmit) */ struct iphdr cs_ip;/* ip/tcp hdr from most recent packet */ struct tcphdr cs_tcp;
Greg Kroah-Hartman
maintainerPATCH 18/97 lan78xx: Correctly indicate invalid OTP
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <[email protected]>
[ Upstream commit 4bfc33807a9a02764bdd1e42e794b3b401240f27 ]
lan78xx_read_otp tries to return -EINVAL in the event of invalid OTP content, but the value gets overwritten before it is returned and the read goes ahead anyway. Make the read conditional as it should be and preserve the error code.
--- drivers/net/usb/lan78xx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/usb/lan78xx.c +2 -1
@@ -618,7 +618,8 @@ static int lan78xx_read_otp(struct lan78 offset +=0x100 ; else ret = -EINVAL ; - ret =lan78xx_read_raw_otp (dev, offset, length, data); +if (!ret) + ret =lan78xx_read_raw_otp (dev, offset, length, data); }return ret;
Greg Kroah-Hartman
maintainerPATCH 19/97 x86/hweight: Get rid of the special calling convention
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit f5967101e9de12addcda4510dfbac66d7c5779c3 upstream.
People complained about ARCH_HWEIGHT_CFLAGS and how it throws a wrench into kcov, lto, etc, experimentations.
Add asm versions for __sw_hweight{32,64}() and do explicit saving and restoring of clobbered registers. This gets rid of the special calling convention. We get to call those functions on !X86_FEATURE_POPCNT CPUs.
We still need to hardcode POPCNT and register operands as some old gas versions which we support, do not know about POPCNT.
Btw, remove redundant REX prefix from 32-bit POPCNT because alternatives can do padding now.
--- arch/x86/Kconfig | 5 -- arch/x86/include/asm/arch_hweight.h | 24 ++++------- arch/x86/kernel/i386_ksyms_32.c | 2 arch/x86/kernel/x8664_ksyms_64.c | 3 + arch/x86/lib/Makefile | 2 arch/x86/lib/hweight.S | 77 ++++++++++++++++++++++++++++++++++++ lib/Makefile | 2 lib/hweight.c | 4 + 8 files changed, 97 insertions(+), 22 deletions(-)
arch/x86/Kconfig +0 -5
@@ -280,11 +280,6 @@ config X86_32_LAZY_GS def_bool y depends on X86_32 && !CC_STACKPROTECTOR -config ARCH_HWEIGHT_CFLAGS - string - default "-fcall-saved-ecx -fcall-saved-edx" if X86_32 - default "-fcall-saved-rdi -fcall-saved-rsi -fcall-saved-rdx -fcall-saved-rcx -fcall-saved-r8 -fcall-saved-r9 -fcall-saved-r10 -fcall-saved-r11" if X86_64 - config ARCH_SUPPORTS_UPROBES def_bool y
arch/x86/include/asm/arch_hweight.h +10 -14
@@ -2,8 +2,8 @@#define _ASM_X86_HWEIGHT_H#ifdef CONFIG_64BIT -/* popcnt %edi, %eax -- redundant REX prefix for alignment */ -#define POPCNT32 ".byte 0xf3,0x40,0x0f,0xb8,0xc7" +/* popcnt %edi, %eax */ +#define POPCNT32 ".byte 0xf3,0x0f,0xb8,0xc7"/* popcnt %rdi, %rax */ #define POPCNT64 ".byte 0xf3,0x48,0x0f,0xb8,0xc7"#define REG_IN "D"
@@ -15,19 +15,15 @@#define REG_OUT "a"#endif -/* -* __sw_hweightXX are called from within the alternatives below -* and callee-clobbered registers need to be taken care of. See -* ARCH_HWEIGHT_CFLAGS in <arch/x86/Kconfig> for the respective -* compiler switches. -*/ +#define __HAVE_ARCH_SW_HWEIGHT + static __always_inline unsigned int __arch_hweight32(unsigned int w) { -unsigned int res =0 ; +unsigned int res; asm (ALTERNATIVE("call __sw_hweight32", POPCNT32, X86_FEATURE_POPCNT) - : "="REG_OUT (res) - : REG_IN (w)); + : "="REG_OUT (res) + : REG_IN (w));return res; }
@@ -51,11 +47,11 @@ static inline unsigned long __arch_hweig#else static __always_inline unsigned long __arch_hweight64 (__u64 w) { -unsigned long res =0 ; +unsigned long res; asm (ALTERNATIVE("call __sw_hweight64", POPCNT64, X86_FEATURE_POPCNT) - : "="REG_OUT (res) - : REG_IN (w)); + : "="REG_OUT (res) + : REG_IN (w));return res; }
arch/x86/kernel/i386_ksyms_32.c +2 -0
@@ -42,3 +42,5 @@ EXPORT_SYMBOL(empty_zero_page);EXPORT_SYMBOL (___preempt_schedule);EXPORT_SYMBOL (___preempt_schedule_notrace);#endif + +EXPORT_SYMBOL (__sw_hweight32);
arch/x86/kernel/x8664_ksyms_64.c +3 -0
@@ -42,6 +42,9 @@ EXPORT_SYMBOL(clear_page);EXPORT_SYMBOL (csum_partial); +EXPORT_SYMBOL (__sw_hweight32); +EXPORT_SYMBOL (__sw_hweight64); +/* * Export string functions. We normally rely on gcc builtin for most of these, * but gcc sometimes decides not to inline them.
arch/x86/lib/Makefile +1 -1
@@ -23,7 +23,7 @@ lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o lib-$(CONFIG_RETPOLINE) += retpoline.o -obj-y += msr.o msr-reg.o msr-reg-export.o +obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o ifeq ($(CONFIG_X86_32),y) obj-y += atomic64_32.o
arch/x86/lib/hweight.S new file +77 -0
77 lines not on this page · raw message
lib/Makefile +0 -2
@@ -58,8 +58,6 @@ obj-$(CONFIG_HAS_IOMEM) += iomap_copy.o obj-$(CONFIG_CHECK_SIGNATURE) += check_signature.o obj-$(CONFIG_DEBUG_LOCKING_API_SELFTESTS) += locking-selftest.o -GCOV_PROFILE_hweight.o := n -CFLAGS_hweight.o = $(subst $(quote),,$(CONFIG_ARCH_HWEIGHT_CFLAGS)) obj-$(CONFIG_GENERIC_HWEIGHT) += hweight.o obj-$(CONFIG_BTREE) += btree.o
lib/hweight.c +4 -0
@@ -9,6 +9,7 @@* The Hamming Weight of a number is the total number of bits set in it. */ +#ifndef __HAVE_ARCH_SW_HWEIGHTunsigned int __sw_hweight32 (unsigned int w) {#ifdef CONFIG_ARCH_HAS_FAST_MULTIPLIER
@@ -25,6 +26,7 @@ unsigned int __sw_hweight32(unsigned int #endif }EXPORT_SYMBOL (__sw_hweight32); +#endif unsigned int __sw_hweight16 (unsigned int w) {
@@ -43,6 +45,7 @@ unsigned int __sw_hweight8(unsigned int }EXPORT_SYMBOL (__sw_hweight8); +#ifndef __HAVE_ARCH_SW_HWEIGHTunsigned long __sw_hweight64 (__u64 w) {#if BITS_PER_LONG ==32
@@ -65,3 +68,4 @@ unsigned long __sw_hweight64(__u64 w) #endif }EXPORT_SYMBOL (__sw_hweight64); +#endif
Greg Kroah-Hartman
maintainerPATCH 2/97 parisc: Fix out of array access in match_pci_device()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <[email protected]>
commit 615b2665fd20c327b631ff1e79426775de748094 upstream.
As found by the ubsan checker, the value of the 'index' variable can be out of range for the bc[] array:
UBSAN: Undefined behaviour in arch/parisc/kernel/drivers.c:655:21 index 6 is out of range for type 'char [6]' Backtrace: [<104fa850>] __ubsan_handle_out_of_bounds+0x68/0x80 [<1019d83c>] check_parent+0xc0/0x170 [<1019d91c>] descend_children+0x30/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019cd54>] parse_tree_node+0x40/0x54 [<1019d86c>] check_parent+0xf0/0x170 [<1019d91c>] descend_children+0x30/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019d938>] descend_children+0x4c/0x6c [<1059e164>] device_for_each_child+0x60/0x98 [<1019cd54>] parse_tree_node+0x40/0x54 [<1019cffc>] hwpath_to_device+0xa4/0xc4
--- arch/parisc/kernel/drivers.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/parisc/kernel/drivers.c +4 -0
@@ -648,6 +648,10 @@ static int match_pci_device(struct devic (modpath->mod == PCI_FUNC(devfn))); } +/* index might be out of bounds for bc[] */ +if (index >=6 ) +return 0 ; + id =PCI_SLOT (pdev->devfn) | (PCI_FUNC (pdev->devfn) <<5 );return (modpath->bc[index] == id); }
Greg Kroah-Hartman
maintainerPATCH 21/97 tty: make n_tty_read() always abort if hangup is in progress
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <[email protected]>
commit 28b0f8a6962a24ed21737578f3b1b07424635c9e upstream.
A tty is hung up by __tty_hangup() setting file->f_op to hung_up_tty_fops, which is skipped on ttys whose write operation isn't tty_write(). This means that, for example, /dev/console whose write op is redirected_tty_write() is never actually marked hung up.
Because n_tty_read() uses the hung up status to decide whether to abort the waiting readers, the lack of hung-up marking can lead to the following scenario.
1. A session contains two processes. The leader and its child. The child ignores SIGHUP.
2. The leader exits and starts disassociating from the controlling terminal (/dev/console).
3. __tty_hangup() skips setting f_op to hung_up_tty_fops.
4. SIGHUP is delivered and ignored.
5. tty_ldisc_hangup() is invoked. It wakes up the waits which should
clear the read lockers of tty->ldisc_sem.
6. The reader wakes up but because tty_hung_up_p() is false, it doesn't abort and goes back to sleep while read-holding tty->ldisc_sem.
7. The leader progresses to tty_ldisc_lock() in tty_ldisc_hangup() and is now stuck in D sleep indefinitely waiting for tty->ldisc_sem.
The following is Alan's explanation on why some ttys aren't hung up.
http://lkml.kernel.org/r/20171101170908.6ad08580@alans-desktop
1. It broke the serial consoles because they would hang up and close down the hardware. With tty_port that *should* be fixable properly for any cases remaining.
2. The console layer was (and still is) completely broken and doens't refcount properly. So if you turn on console hangups it breaks (as indeed does freeing consoles and half a dozen other things).
As neither can be fixed quickly, this patch works around the problem by introducing a new flag, TTY_HUPPING, which is used solely to tell n_tty_read() that hang-up is in progress for the console and the readers should be aborted regardless of the hung-up status of the device.
The following is a sample hung task warning caused by this issue.
INFO: task agetty:2662 blocked for more than 120 seconds.
Not tainted 4.11.3-dbg-tty-lockup-02478-gfd6c7ee-dirty #28
"echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
0 2662 1 0x00000086
Call Trace:
__schedule+0x267/0x890
schedule+0x36/0x80
schedule_timeout+0x23c/0x2e0
ldsem_down_write+0xce/0x1f6
tty_ldisc_lock+0x16/0x30
tty_ldisc_hangup+0xb3/0x1b0
__tty_hangup+0x300/0x410
disassociate_ctty+0x6c/0x290
do_exit+0x7ef/0xb00
do_group_exit+0x3f/0xa0
get_signal+0x1b3/0x5d0
do_signal+0x28/0x660
exit_to_usermode_loop+0x46/0x86
do_syscall_64+0x9c/0xb0
entry_SYSCALL64_slow_path+0x25/0x25The following is the repro. Run "$PROG /dev/console". The parent process hangs in D state.
#include <sys/types.h> #include <sys/stat.h> #include <sys/wait.h> #include <sys/ioctl.h> #include <fcntl.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <errno.h> #include <signal.h> #include <time.h> #include <termios.h>
int main(int argc, char **argv)
{
struct sigaction sact = { .sa_handler = SIG_IGN };
struct timespec ts1s = { .tv_sec = 1 };
pid_t pid;
int fd;
if (argc < 2) {
fprintf(stderr, "test-hung-tty /dev/$TTY\n");
return 1;
}
/* fork a child to ensure that it isn't already the session leader */
pid = fork();
if (pid < 0) {
perror("fork");
return 1;
}
if (pid > 0) {
/* top parent, wait for everyone */
while (waitpid(-1, NULL, 0) >= 0)
;
if (errno != ECHILD)
perror("waitpid");
return 0;
}
/* new session, start a new session and set the controlling tty */
if (setsid() < 0) {
perror("setsid");
return 1;
}
fd = open(argv[1], O_RDWR);
if (fd < 0) {
perror("open");
return 1;
}
if (ioctl(fd, TIOCSCTTY, 1) < 0) {
perror("ioctl");
return 1;
}
/* fork a child, sleep a bit and exit */
pid = fork();
if (pid < 0) {
perror("fork");
return 1;
}
if (pid > 0) {
nanosleep(&ts1s, NULL);
printf("Session leader exiting\n");
exit(0);
}
/*
* The child ignores SIGHUP and keeps reading from the controlling
* tty. Because SIGHUP is ignored, the child doesn't get killed on
* parent exit and the bug in n_tty makes the read(2) block the
* parent's control terminal hangup attempt. The parent ends up in
* D sleep until the child is explicitly killed.
*/
sigaction(SIGHUP, &sact, NULL);
printf("Child reading tty\n");
while (1) {
char buf[1024];
if (read(fd, buf, sizeof(buf)) < 0) {
perror("read");
return 1;
}
}
return 0;}
--- drivers/tty/n_tty.c | 6 ++++++ drivers/tty/tty_io.c | 9 +++++++++ include/linux/tty.h | 1 + 3 files changed, 16 insertions(+)
drivers/tty/n_tty.c +6 -0
@@ -2238,6 +2238,12 @@ static ssize_t n_tty_read(struct tty_str }if (tty_hung_up_p (file))break ; +/* +* Abort readers for ttys which never actually +* get hung up. See __tty_hangup(). +*/ +if (test_bit (TTY_HUPPING , &tty->flags)) +break ;if (!timeout)break ;if (file->f_flags &O_NONBLOCK ) {
drivers/tty/tty_io.c +9 -0
@@ -702,6 +702,14 @@ static void __tty_hangup(struct tty_strureturn ; } +/* +* Some console devices aren't actually hung up for technical and +* historical reasons, which can lead to indefinite interruptible +* sleep in n_tty_read(). The following explicitly tells +* n_tty_read() to abort readers. +*/ +set_bit (TTY_HUPPING , &tty->flags); +/* inuse_filps is protected by the single tty lock, this really needs to change if we want to flush the workqueue with the lock held */
@@ -757,6 +765,7 @@ static void __tty_hangup(struct tty_stru* can't yet guarantee all that. */ set_bit (TTY_HUPPED , &tty->flags); +clear_bit (TTY_HUPPING , &tty->flags);tty_unlock (tty);if (f)
include/linux/tty.h +1 -0
@@ -342,6 +342,7 @@ struct tty_file_private {#define TTY_PTY_LOCK 16/* pty private */ #define TTY_NO_WRITE_SPLIT 17/* Preserve write boundaries to driver */ #define TTY_HUPPED 18/* Post driver->hangup() */ +#define TTY_HUPPING 19/* Hangup in progress */ #define TTY_LDISC_HALTED 22/* Line discipline is halted */ #define TTY_WRITE_FLUSH (tty) tty_write_flush((tty))
Greg Kroah-Hartman
maintainerPATCH 22/97 ubifs: Check ubifs_wbuf_sync() return code
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit aac17948a7ce01fb60b9ee6cf902967a47b3ce26 upstream.
If ubifs_wbuf_sync() fails we must not write a master node with the dirty marker cleared.
Otherwise it is possible that in case of an IO error while syncing we mark the filesystem as clean and UBIFS refuses to recover upon next mount.
--- fs/ubifs/super.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-)
fs/ubifs/super.c +10 -4
@@ -1728,8 +1728,11 @@ static void ubifs_remount_ro(struct ubifdbg_save_space_info (c); -for (i =0 ; i < c->jhead_cnt; i++) -ubifs_wbuf_sync (&c->jheads[i].wbuf); +for (i =0 ; i < c->jhead_cnt; i++) { + err =ubifs_wbuf_sync (&c->jheads[i].wbuf); +if (err) +ubifs_ro_mode (c, err); + } c->mst_node->flags &= ~cpu_to_le32 (UBIFS_MST_DIRTY ); c->mst_node->flags |=cpu_to_le32 (UBIFS_MST_NO_ORPHS );
@@ -1795,8 +1798,11 @@ static void ubifs_put_super(struct superint err;/* Synchronize write-buffers */ -for (i =0 ; i < c->jhead_cnt; i++) -ubifs_wbuf_sync (&c->jheads[i].wbuf); +for (i =0 ; i < c->jhead_cnt; i++) { + err =ubifs_wbuf_sync (&c->jheads[i].wbuf); +if (err) +ubifs_ro_mode (c, err); + }/* * We are being cleanly unmounted which means the
Greg Kroah-Hartman
maintainerPATCH 25/97 ubi: Reject MLC NAND
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit b5094b7f135be34630e3ea8a98fa215715d0f29d upstream.
While UBI and UBIFS seem to work at first sight with MLC NAND, you will most likely lose all your data upon a power-cut or due to read/write disturb.
In order to protect users from bad surprises, refuse to attach to MLC NAND.
--- drivers/mtd/ubi/build.c | 11 +++++++++++ 1 file changed, 11 insertions(+)
drivers/mtd/ubi/build.c +11 -0
@@ -889,6 +889,17 @@ int ubi_attach_mtd_dev(struct mtd_info *return -EINVAL ; } +/* +* Both UBI and UBIFS have been designed for SLC NAND and NOR flashes. +* MLC NAND is different and needs special care, otherwise UBI or UBIFS +* will die soon and you will lose all your data. +*/ +if (mtd->type ==MTD_MLCNANDFLASH ) { +pr_err ("ubi: refuse attaching mtd%d - MLC NAND is not supported\n" , + mtd->index); +return -EINVAL ; + } +if (ubi_num ==UBI_DEV_NUM_AUTO ) {/* Search for an empty slot in the @ubi_devices array */ for (ubi_num =0 ; ubi_num <UBI_MAX_DEVICES ; ubi_num++)
Greg Kroah-Hartman
maintainerPATCH 28/97 ipc/shm: fix use-after-free of shm file via remap_file_pages()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <[email protected]>
commit 3f05317d9889ab75c7190dcd39491d2a97921984 upstream.
syzbot reported a use-after-free of shm_file_data(file)->file->f_op in shm_get_unmapped_area(), called via sys_remap_file_pages().
Unfortunately it couldn't generate a reproducer, but I found a bug which I think caused it. When remap_file_pages() is passed a full System V shared memory segment, the memory is first unmapped, then a new map is created using the ->vm_file. Between these steps, the shm ID can be removed and reused for a new shm segment. But, shm_mmap() only checks whether the ID is currently valid before calling the underlying file's ->mmap(); it doesn't check whether it was reused. Thus it can use the wrong underlying file, one that was already freed.
Fix this by making the "outer" shm file (the one that gets put in ->vm_file) hold a reference to the real shm file, and by making __shm_open() require that the file associated with the shm ID matches the one associated with the "outer" file.
Taking the reference to the real shm file is needed to fully solve the problem, since otherwise sfd->file could point to a freed file, which then could be reallocated for the reused shm ID, causing the wrong shm segment to be mapped (and without the required permission checks).
Commit 1ac0b6dec656 ("ipc/shm: handle removed segments gracefully in shm_mmap()") almost fixed this bug, but it didn't go far enough because it didn't consider the case where the shm ID is reused.
The following program usually reproduces this bug:
#include <stdlib.h>
#include <sys/shm.h>
#include <sys/syscall.h>
#include <unistd.h>
int main()
{
int is_parent = (fork() != 0);
srand(getpid());
for (;;) {
int id = shmget(0xF00F, 4096, IPC_CREAT|0700);
if (is_parent) {
void *addr = shmat(id, NULL, 0);
usleep(rand() % 50);
while (!syscall(__NR_remap_file_pages, addr, 4096, 0, 0, 0));
} else {
usleep(rand() % 50);
shmctl(id, IPC_RMID, NULL);
}
}
}It causes the following NULL pointer dereference due to a 'struct file' being used while it's being freed. (I couldn't actually get a KASAN use-after-free splat like in the syzbot report. But I think it's possible with this bug; it would just take a more extraordinary race...)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000058 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 9 PID: 258 Comm: syz_ipc Not tainted 4.16.0-05140-gf8cf2f16a7c95 #189 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014 RIP: 0010:d_inode include/linux/dcache.h:519 [inline] RIP: 0010:touch_atime+0x25/0xd0 fs/inode.c:1724 [...] Call Trace: file_accessed include/linux/fs.h:2063 [inline] shmem_mmap+0x25/0x40 mm/shmem.c:2149 call_mmap include/linux/fs.h:1789 [inline] shm_mmap+0x34/0x80 ipc/shm.c:465 call_mmap include/linux/fs.h:1789 [inline] mmap_region+0x309/0x5b0 mm/mmap.c:1712 do_mmap+0x294/0x4a0 mm/mmap.c:1483 do_mmap_pgoff include/linux/mm.h:2235 [inline] SYSC_remap_file_pages mm/mmap.c:2853 [inline] SyS_remap_file_pages+0x232/0x310 mm/mmap.c:2769 do_syscall_64+0x64/0x1a0 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7
--- ipc/shm.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-)
ipc/shm.c +20 -3
@@ -198,6 +198,12 @@ static int __shm_open(struct vm_area_strif (IS_ERR (shp))return PTR_ERR (shp); +if (shp->shm_file != sfd->file) { +/* ID was reused */ +shm_unlock (shp); +return -EINVAL ; + } + shp->shm_atim =get_seconds (); shp->shm_lprid =task_tgid_vnr (current); shp->shm_nattch++;
@@ -414,8 +420,9 @@ static int shm_mmap(struct file *file, sint ret;/* -* In case of remap_file_pages() emulation, the file can represent -* removed IPC ID: propogate shm_lock() error to caller. +* In case of remap_file_pages() emulation, the file can represent an +* IPC ID that was removed, and possibly even reused by another shm +* segment already. Propagate this case as an error to caller. */ ret =__shm_open (vma);if (ret)
@@ -439,6 +446,7 @@ static int shm_release(struct inode *inostruct shm_file_data *sfd =shm_file_data (file);put_ipc_ns (sfd->ns); +fput (sfd->file);shm_file_data (file) =NULL ;kfree (sfd);return 0 ;
@@ -1198,7 +1206,16 @@ long do_shmat(int shmid, char __user *sh file->f_mapping = shp->shm_file->f_mapping; sfd->id = shp->shm_perm.id; sfd->ns =get_ipc_ns (ns); - sfd->file = shp->shm_file; +/* +* We need to take a reference to the real shm file to prevent the +* pointer from becoming stale in cases where the lifetime of the outer +* file extends beyond that of the shm segment. It's not usually +* possible, but it can happen during remap_file_pages() emulation as +* that unmaps the memory, then does ->mmap() via file reference only. +* We'll deny the ->mmap() if the shm segment was since removed, but to +* detect shm ID reuse we need to compare the file pointers. +*/ + sfd->file =get_file (shp->shm_file); sfd->vm_ops =NULL ; err =security_mmap_file (file, prot, flags);
Greg Kroah-Hartman
maintainerPATCH 42/97 powerpc/powernv: Fix OPAL NVRAM driver OPAL_BUSY loops
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <[email protected]>
commit 3b8070335f751aac9f1526ae2e012e6f5b8b0f21 upstream.
The OPAL NVRAM driver does not sleep in case it gets OPAL_BUSY or OPAL_BUSY_EVENT from firmware, which causes large scheduling latencies, and various lockup errors to trigger (again, BMC reboot can cause it).
Fix this by converting it to the standard form OPAL_BUSY loop that sleeps.
Depends-on: 34dd25de9fe3 ("powerpc/powernv: define a standard delay for OPAL_BUSY type retry loops")
--- arch/powerpc/platforms/powernv/opal-nvram.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/powerpc/platforms/powernv/opal-nvram.c +6 -1
@@ -11,6 +11,7 @@#define DEBUG +#include <linux/delay.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/of.h>
@@ -56,8 +57,12 @@ static ssize_t opal_nvram_write(char *buwhile (rc ==OPAL_BUSY || rc ==OPAL_BUSY_EVENT ) { rc =opal_write_nvram (__pa (buf), count, off); -if (rc ==OPAL_BUSY_EVENT ) +if (rc ==OPAL_BUSY_EVENT ) { +msleep (OPAL_BUSY_DELAY_MS );opal_poll_events (NULL ); + }else if (rc ==OPAL_BUSY ) { +msleep (OPAL_BUSY_DELAY_MS ); + } }if (rc)
Greg Kroah-Hartman
maintainerPATCH 46/97 thunderbolt: Resume control channel after hibernation image is created
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <[email protected]>
commit f2a659f7d8d5da803836583aa16df06bdf324252 upstream.
The driver misses implementation of PM hook that undoes what ->freeze_noirq() does after the hibernation image is created. This means the control channel is not resumed properly and the Thunderbolt bus becomes useless in later stages of hibernation (when the image is stored or if the operation fails).
Fix this by pointing ->thaw_noirq to driver nhi_resume_noirq(). This makes sure the control channel is resumed properly.
--- drivers/thunderbolt/nhi.c | 1 + 1 file changed, 1 insertion(+)
drivers/thunderbolt/nhi.c +1 -0
@@ -627,6 +627,7 @@ static const struct dev_pm_ops nhi_pm_op* we just disable hotplug, the * pci-tunnels stay alive. */ + .thaw_noirq = nhi_resume_noirq, .restore_noirq = nhi_resume_noirq, };
Greg Kroah-Hartman
maintainerPATCH 47/97 random: use a tighter cap in credit_entropy_bits_safe()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 9f886f4d1d292442b2f22a0a33321eae821bde40 upstream.
This fixes a harmless UBSAN where root could potentially end up causing an overflow while bumping the entropy_total field (which is ignored once the entropy pool has been initialized, and this generally is completed during the boot sequence).
This is marginal for the stable kernel series, but it's a really trivial patch, and it fixes UBSAN warning that might cause security folks to get overly excited for no reason.
--- drivers/char/random.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/random.c +1 -1
@@ -724,7 +724,7 @@ retry:static int credit_entropy_bits_safe (struct entropy_store *r,int nbits) { -const int nbits_max = (int )(~0U >> (ENTROPY_SHIFT +1 )); +const int nbits_max = r->poolinfo->poolwords *32 ;if (nbits <0 )return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 48/97 jbd2: if the journal is aborted then dont allow update of the log tail
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 85e0c4e89c1b864e763c4e3bb15d0b6d501ad5d9 upstream.
This updates the jbd2 superblock unnecessarily, and on an abort we shouldn't truncate the log.
--- fs/jbd2/journal.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
fs/jbd2/journal.c +4 -1
@@ -914,7 +914,7 @@ out: }/* -* This is a variaon of __jbd2_update_log_tail which checks for validity of +* This is a variation of __jbd2_update_log_tail which checks for validity of * provided log tail and locks j_checkpoint_mutex. So it is safe against races * with other threads updating log tail. */
@@ -1384,6 +1384,9 @@ int jbd2_journal_update_sb_log_tail(jourjournal_superblock_t *sb = journal->j_superblock;int ret; +if (is_journal_aborted (journal)) +return -EIO ; +BUG_ON (!mutex_is_locked (&journal->j_checkpoint_mutex));jbd_debug (1 ,"JBD2: updating superblock (start %lu, seq %u)\n" , tail_block, tail_tid);
Greg Kroah-Hartman
maintainerPATCH 51/97 ext4: fail ext4_iget for root directory if unallocated
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 8e4b5eae5decd9dfe5a4ee369c22028f90ab4c44 upstream.
If the root directory has an i_links_count of zero, then when the file system is mounted, then when ext4_fill_super() notices the problem and tries to call iput() the root directory in the error return path, ext4_evict_inode() will try to free the inode on disk, before all of the file system structures are set up, and this will result in an OOPS caused by a NULL pointer dereference.
This issue has been assigned CVE-2018-1092.
https://bugzilla.kernel.org/show_bug.cgi?id=199179
https://bugzilla.redhat.com/show_bug.cgi?id=1560777
--- fs/ext4/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/inode.c +6 -0
@@ -4231,6 +4231,12 @@ struct inode *ext4_iget(struct super_blo goto bad_inode; raw_inode =ext4_raw_inode (&iloc); +if ((ino ==EXT4_ROOT_INO ) && (raw_inode->i_links_count ==0 )) { +EXT4_ERROR_INODE (inode,"root inode unallocated" ); + ret = -EFSCORRUPTED ; + goto bad_inode; + } +if (EXT4_INODE_SIZE (inode->i_sb) >EXT4_GOOD_OLD_INODE_SIZE ) { ei->i_extra_isize =le16_to_cpu (raw_inode->i_extra_isize); if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize >
Greg Kroah-Hartman
maintainerPATCH 54/97 IB/srp: Fix srp_abort()
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit e68088e78d82920632eba112b968e49d588d02a2 upstream.
Before commit e494f6a72839 ("[SCSI] improved eh timeout handler") it did not really matter whether or not abort handlers like srp_abort() called .scsi_done() when returning another value than SUCCESS. Since that commit however this matters. Hence only call .scsi_done() when returning SUCCESS.
--- drivers/infiniband/ulp/srp/ib_srp.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/infiniband/ulp/srp/ib_srp.c +5 -3
@@ -2581,9 +2581,11 @@ static int srp_abort(struct scsi_cmnd *s ret =FAST_IO_FAIL ; else ret =FAILED ; -srp_free_req (ch, req, scmnd,0 ); - scmnd->result =DID_ABORT <<16 ; - scmnd->scsi_done (scmnd); +if (ret ==SUCCESS ) { +srp_free_req (ch, req, scmnd,0 ); + scmnd->result =DID_ABORT <<16 ; + scmnd->scsi_done (scmnd); + }return ret; }
Greg Kroah-Hartman
maintainerPATCH 59/97 mmc: jz4740: Fix race condition in IRQ mask update
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Smith <[email protected]>
commit a04f0017c22453613d5f423326b190c61e3b4f98 upstream.
A spinlock is held while updating the internal copy of the IRQ mask, but not while writing it to the actual IMASK register. After the lock is released, an IRQ can occur before the IMASK register is written. If handling this IRQ causes the mask to be changed, when the handler returns back to the middle of the first mask update, a stale value will be written to the mask register.
If this causes an IRQ to become unmasked that cannot have its status cleared by writing a 1 to it in the IREG register, e.g. the SDIO IRQ, then we can end up stuck with the same IRQ repeatedly being fired but not handled. Normally the MMC IRQ handler attempts to clear any unexpected IRQs by writing IREG, but for those that cannot be cleared in this way then the IRQ will just repeatedly fire.
This was resulting in lockups after a while of using Wi-Fi on the CI20 (GitHub issue #19).
Resolve by holding the spinlock until after the IMASK register has been updated.
--- drivers/mmc/host/jz4740_mmc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mmc/host/jz4740_mmc.c +1 -1
@@ -368,9 +368,9 @@ static void jz4740_mmc_set_irq_enabled(s host->irq_mask &= ~irq; else host->irq_mask |= irq; -spin_unlock_irqrestore (&host->lock, flags);writew (host->irq_mask, host->base +JZ_REG_MMC_IMASK ); +spin_unlock_irqrestore (&host->lock, flags); } static void jz4740_mmc_clock_enable(struct jz4740_mmc_host *host,
Greg Kroah-Hartman
maintainerPATCH 61/97 clk: mvebu: armada-38x: add support for missing clocks
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Genoud <[email protected]>
commit 6a4a4595804548e173f0763a0e7274a3521c59a9 upstream.
Clearfog boards can come with a CPU clocked at 1600MHz (commercial) or 1333MHz (industrial).
They have also some dip-switches to select a different clock (666, 800, 1066, 1200).
The funny thing is that the recovery button is on the MPP34 fq selector. So, when booting an industrial board with this button down, the frequency 666MHz is selected (and the kernel didn't boot).
This patch add all the missing clocks.
The only mode I didn't test is 2GHz (uboot found 4294MHz instead :/ ).
--- drivers/clk/mvebu/armada-38x.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/clk/mvebu/armada-38x.c +7 -7
@@ -46,11 +46,11 @@ static u32 __init armada_38x_get_tclk_fr }static const u32 armada_38x_cpu_frequencies[]__initconst = { -0 ,0 ,0 ,0 , -1066 *1000 *1000 ,0 ,0 ,0 , +666 *1000 *1000 ,0 ,800 *1000 *1000 ,0 , +1066 *1000 *1000 ,0 ,1200 *1000 *1000 ,0 ,1332 *1000 *1000 ,0 ,0 ,0 ,1600 *1000 *1000 ,0 ,0 ,0 , -1866 *1000 *1000 , +1866 *1000 *1000 ,0 ,0 ,2000 *1000 *1000 , };static u32 __init armada_38x_get_cpu_freq (void __iomem *sar)
@@ -76,11 +76,11 @@ static const struct coreclk_ratio armada };static const int armada_38x_cpu_l2_ratios[32 ][2 ]__initconst = { - {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, - {1 ,2 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, - {1 ,2 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, + {1 ,2 }, {0 ,1 }, {1 ,2 }, {0 ,1 }, + {1 ,2 }, {0 ,1 }, {1 ,2 }, {0 ,1 }, {1 ,2 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {1 ,2 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, + {1 ,2 }, {0 ,1 }, {0 ,1 }, {1 ,2 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 }, {0 ,1 },
@@ -91,7 +91,7 @@ static const int armada_38x_cpu_ddr_rati {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, {1, 2}, {0, 1}, {0, 1}, {0, 1}, - {1, 2}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {7, 15}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1}, {0, 1},
Greg Kroah-Hartman
maintainerPATCH 85/97 MIPS: memset.S: Fix clobber of v1 in last_fixup
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matt Redfearn <[email protected]>
commit c96eebf07692e53bf4dd5987510d8b550e793598 upstream.
The label .Llast_fixup\@ is jumped to on page fault within the final byte set loop of memset (on < MIPSR6 architectures). For some reason, in this fault handler, the v1 register is randomly set to a2 & STORMASK. This clobbers v1 for the calling function. This can be observed with the following test code:
static int __init __attribute__((optimize("O0"))) test_clear_user(void) {
register int t asm("v1");
char *test;
int j, k;
pr_info("\n\n\nTesting clear_user\n");
test = vmalloc(PAGE_SIZE);
for (j = 256; j < 512; j++) {
t = 0xa5a5a5a5;
if ((k = clear_user(test + PAGE_SIZE - 256, j)) != j - 256) {
pr_err("clear_user (%px %d) returned %d\n", test + PAGE_SIZE - 256, j, k);
}
if (t != 0xa5a5a5a5) {
pr_err("v1 was clobbered to 0x%x!\n", t);
}
} return 0;
}late_initcall(test_clear_user);
Which demonstrates that v1 is indeed clobbered (MIPS64):
Testing clear_user
v1 was clobbered to 0x1!
v1 was clobbered to 0x2!
v1 was clobbered to 0x3!
v1 was clobbered to 0x4!
v1 was clobbered to 0x5!
v1 was clobbered to 0x6!
v1 was clobbered to 0x7!
Since the number of bytes that could not be set is already contained in a2, the andi placing a value in v1 is not necessary and actively harmful in clobbering v1.
Patchwork: https://patchwork.linux-mips.org/patch/19109/
--- arch/mips/lib/memset.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/lib/memset.S +1 -1
@@ -255,7 +255,7 @@ .Llast_fixup\@: jr ra - andi v1, a2, STORMASK + nop .Lsmall_fixup\@: PTR_SUBU a2, t1, a0
Greg Kroah-Hartman
maintainerPATCH 87/97 powerpc/lib: Fix off-by-one in alternate feature patching
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <[email protected]>
commit b8858581febb050688e276b956796bc4a78299ed upstream.
When we patch an alternate feature section, we have to adjust any relative branches that branch out of the alternate section.
But currently we have a bug if we have a branch that points to past the last instruction of the alternate section, eg:
FTR_SECTION_ELSE
1: b 2f
or 6,6,6
2:
ALT_FTR_SECTION_END(...)
nop
This will result in a relative branch at 1 with a target that equals the end of the alternate section.
That branch does not need adjusting when it's moved to the non-else location. Currently we do adjust it, resulting in a branch that goes off into the link-time location of the else section, which is junk.
The fix is to not patch branches that have a target == end of the alternate section.
--- arch/powerpc/lib/feature-fixups.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/powerpc/lib/feature-fixups.c +1 -1
@@ -53,7 +53,7 @@ static int patch_alt_instruction(unsigneunsigned int *target = (unsigned int *)branch_target (src);/* Branch within the section doesn't need translating */ -if (target < alt_start || target >= alt_end) { +if (target < alt_start || target > alt_end) { instr =translate_branch (dest, src);if (!instr)return 1 ;
Greg Kroah-Hartman
maintainerPATCH 72/97 vfio/pci: Virtualize Maximum Payload Size
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Williamson <[email protected]>
commit 523184972b282cd9ca17a76f6ca4742394856818 upstream.
With virtual PCI-Express chipsets, we now see userspace/guest drivers trying to match the physical MPS setting to a virtual downstream port. Of course a lone physical device surrounded by virtual interconnects cannot make a correct decision for a proper MPS setting. Instead, let's virtualize the MPS control register so that writes through to hardware are disallowed. Userspace drivers like QEMU assume they can write anything to the device and we'll filter out anything dangerous. Since mismatched MPS can lead to AER and other faults, let's add it to the kernel side rather than relying on userspace virtualization to handle it.
--- drivers/vfio/pci/vfio_pci_config.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/vfio/pci/vfio_pci_config.c +4 -2
@@ -799,11 +799,13 @@ static int __init init_pci_cap_exp_perm(/* * Allow writes to device control fields, except devctl_phantom, -* which could confuse IOMMU, and the ARI bit in devctl2, which +* which could confuse IOMMU, MPS, which can break communication +* with other physical devices, and the ARI bit in devctl2, which * is set at probe time. FLR gets virtualized via our writefn. */ p_setw (perm,PCI_EXP_DEVCTL , -PCI_EXP_DEVCTL_BCR_FLR , ~PCI_EXP_DEVCTL_PHANTOM ); +PCI_EXP_DEVCTL_BCR_FLR |PCI_EXP_DEVCTL_PAYLOAD , + ~PCI_EXP_DEVCTL_PHANTOM );p_setw (perm,PCI_EXP_DEVCTL2 ,NO_VIRT , ~PCI_EXP_DEVCTL2_ARI );return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 91/97 Dont leak MNT_INTERNAL away from internal mounts
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <[email protected]>
commit 16a34adb9392b2fe4195267475ab5b472e55292c upstream.
We want it only for the stuff created by SB_KERNMOUNT mounts, *not* for their copies. As it is, creating a deep stack of bindings of /proc/*/ns/* somewhere in a new namespace and exiting yields a stack overflow.
--- fs/namespace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/namespace.c +2 -1
@@ -1018,7 +1018,8 @@ static struct mount *clone_mnt(struct mo goto out_free; } - mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD |MNT_MARKED ); + mnt->mnt.mnt_flags = old->mnt.mnt_flags; + mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD |MNT_MARKED |MNT_INTERNAL );/* Don't allow unprivileged users to change mount flags */ if (flag &CL_UNPRIVILEGED ) { mnt->mnt.mnt_flags |=MNT_LOCK_ATIME ;
Greg Kroah-Hartman
maintainerPATCH 79/97 ALSA: rawmidi: Fix missing input substream checks in compat ioctls
In reply to Greg Kroah-Hartman4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 8a56ef4f3ffba9ebf4967b61ef600b0a7ba10f11 upstream.
Some rawmidi compat ioctls lack of the input substream checks (although they do check only for rfile->output). This many eventually lead to an Oops as NULL substream is passed to the rawmidi core functions.
Fix it by adding the proper checks before each function call.
The bug was spotted by syzkaller.
--- sound/core/rawmidi_compat.c | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-)
sound/core/rawmidi_compat.c +12 -6
@@ -36,8 +36,6 @@ static int snd_rawmidi_ioctl_params_compstruct snd_rawmidi_params params;unsigned int val; -if (rfile->output ==NULL ) -return -EINVAL ; if (get_user(params.stream, &src->stream) || get_user(params.buffer_size, &src->buffer_size) || get_user(params.avail_min, &src->avail_min) ||
@@ -46,8 +44,12 @@ static int snd_rawmidi_ioctl_params_comp params.no_active_sensing = val;switch (params.stream) {case SNDRV_RAWMIDI_STREAM_OUTPUT : +if (!rfile->output) +return -EINVAL ;return snd_rawmidi_output_params (rfile->output, ¶ms);case SNDRV_RAWMIDI_STREAM_INPUT : +if (!rfile->input) +return -EINVAL ;return snd_rawmidi_input_params (rfile->input, ¶ms); }return -EINVAL ;
@@ -67,16 +69,18 @@ static int snd_rawmidi_ioctl_status_compint err;struct snd_rawmidi_status status; -if (rfile->output ==NULL ) -return -EINVAL ;if (get_user (status.stream, &src->stream))return -EFAULT ;switch (status.stream) {case SNDRV_RAWMIDI_STREAM_OUTPUT : +if (!rfile->output) +return -EINVAL ; err =snd_rawmidi_output_status (rfile->output, &status);break ;case SNDRV_RAWMIDI_STREAM_INPUT : +if (!rfile->input) +return -EINVAL ; err =snd_rawmidi_input_status (rfile->input, &status);break ;default :
@@ -113,16 +117,18 @@ static int snd_rawmidi_ioctl_status_x32(int err;struct snd_rawmidi_status status; -if (rfile->output ==NULL ) -return -EINVAL ;if (get_user (status.stream, &src->stream))return -EFAULT ;switch (status.stream) {case SNDRV_RAWMIDI_STREAM_OUTPUT : +if (!rfile->output) +return -EINVAL ; err =snd_rawmidi_output_status (rfile->output, &status);break ;case SNDRV_RAWMIDI_STREAM_INPUT : +if (!rfile->input) +return -EINVAL ; err =snd_rawmidi_input_status (rfile->input, &status);break ;default :
stable-rc/linux-4.4.y boot: 121 boots: 1 failed, 106 passed with 9 offline, 3 untried/unknown, 2 conflicts (v4.4.128-98-g7f61d298acbc)
stable-rc/linux-4.4.y boot: 121 boots: 1 failed, 106 passed with 9 offline, 3 untried/unknown, 2 conflicts (v4.4.128-98-g7f61d298acbc)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.4.y/kernel/v4.4.128-98-g7f61d298acbc/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.4.y/kernel/v4.4.128-98-g7f61d298acbc/
Tree: stable-rc
Branch: linux-4.4.y
Git Describe: v4.4.128-98-g7f61d298acbc
Git Commit: 7f61d298acbc397846d74572c39fd4920cb317af
Git URL: http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 59 unique boards, 20 SoC families, 16 builds out of 176
Boot Regressions Detected:
arm:
multi_v7_defconfig:
at91-sama5d4_xplained:
lab-free-electrons: new failure (last pass: v4.4.128-19-ga168d28608b3)
sama5_defconfig:
at91-sama5d4_xplained:
lab-free-electrons: new failure (last pass: v4.4.128-19-ga168d28608b3)
sama5d36ek:
lab-free-electrons: new failure (last pass: v4.4.128-19-ga168d28608b3)Boot Failure Detected:
arm:
sama5_defconfig
sama5d36ek: 1 failed lab
Offline Platforms:
arm:
sunxi_defconfig:
sun5i-r8-chip: 1 offline lab
multi_v7_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline lab
sun5i-r8-chip: 1 offline lab
tegra20-iris-512: 1 offline lab
qcom_defconfig:
qcom-apq8064-cm-qs600: 1 offline lab
qcom-apq8064-ifc6410: 1 offline lab
tegra_defconfig:
tegra20-iris-512: 1 offline labarm64:
defconfig:
apq8016-sbc: 1 offline labConflicting Boot Failures Detected: (These likely are not failures as other labs are reporting PASS. Needs review.)
arm:
sama5_defconfig:
at91-sama5d4_xplained:
lab-free-electrons: FAIL
lab-baylibre-seattle: PASS
multi_v7_defconfig:
at91-sama5d4_xplained:
lab-free-electrons: FAIL
lab-baylibre-seattle: PASS---
For more info write to <[email protected]>
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.129-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Merged, compiled, and flashed onto my Pixel 2 XL and OnePlus 5.
No initial issues in general usage or dmesg; all images build clean with GCC 4.9.4, GCC 7.3.0, Clang 5.0, Clang 6.0, and Clang 7.0.
Thanks!
Nathan
Greg Kroah-Hartman
maintainerQuoted 17 lines · Nathan Chancellor
Quoted 16 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.129-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
Quoted 7 lines
Quoted 2 lines
greg k-h
Merged, compiled, and flashed onto my Pixel 2 XL and OnePlus 5.
No initial issues in general usage or dmesg; all images build clean with GCC 4.9.4, GCC 7.3.0, Clang 5.0, Clang 6.0, and Clang 7.0.
Thanks for testing and letting me know.
greg k-h
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.129-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
Summary
------------------------------------------------------------------------
kernel: 4.4.129-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 7f61d298acbc397846d74572c39fd4920cb317af
git describe: v4.4.128-98-g7f61d298acbc
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.128-98-g7f61d298acbc
No regressions (compared to build v4.4.128-19-ga168d28608b3)
------------------------------------------------------------------------
Boards, architectures and test suites:
-------------------------------------
juno-r2 - arm64
* boot - pass: 20,
* kselftest - fail: 6, pass: 30, skip: 30
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 28, skip: 53
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 57, skip: 6
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1010, skip: 140
* ltp-timers-tests - pass: 13,
qemu_x86_64
* boot - pass: 22,
* kselftest - fail: 6, pass: 42, skip: 32
* kselftest-vsyscall-mode-native - fail: 6, pass: 42, skip: 32
* kselftest-vsyscall-mode-none - fail: 6, pass: 42, skip: 32
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 57, skip: 6
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1000, skip: 150
* ltp-timers-tests - pass: 13,
x15 - arm
* boot - pass: 20,
* kselftest - fail: 6, pass: 30, skip: 29
* libhugetlbfs - pass: 87, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 63, skip: 18
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 58, skip: 5
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 20, skip: 2
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1072, skip: 78
* ltp-timers-tests - pass: 13,
x86_64
* boot - pass: 22,
* kselftest - fail: 6, pass: 42, skip: 28
* kselftest-vsyscall-mode-native - fail: 6, pass: 41, skip: 29
* kselftest-vsyscall-mode-none - fail: 5, pass: 42, skip: 30
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64, skip: 17
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 58, skip: 5
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 9, skip: 5
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1031, skip: 119
* ltp-timers-tests - pass: 13,
Hikey test results,
Summary
------------------------------------------------------------------------
kernel: 4.4.129-rc1
git repo: https://git.linaro.org/lkft/arm64-stable-rc.git
git tag: 4.4.129-rc1-hikey-20180422-175
git commit: 0a1a7ef3621b3edfdfac49700d09565a5c05eec0
git describe: 4.4.129-rc1-hikey-20180422-175
Test details: https://qa-reports.linaro.org/lkft/linaro-hikey-stable-rc-4.4-oe/build/4.4.129-rc1-hikey-20180422-175
No regressions (compared to build 4.4.129-rc1-hikey-20180417-173)
------------------------------------------------------------------------
Boards, architectures and test suites:
-------------------------------------
hi6220-hikey - arm64
* boot - pass: 20,
* kselftest - fail: 6, pass: 28, skip: 32
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 28, skip: 53
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 57, skip: 6
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 21, skip: 1
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 10, skip: 4
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1008, skip: 142
* ltp-timers-tests - pass: 13,
Signature · 2 lines
Linaro QA (beta) https://qa-reports.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
For v4.4.128-98-ge41c167:
Build results:
total: 146 pass: 146 fail: 0 Qemu test results: total: 127 pass: 127 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.4.129 release. There are 97 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Tue Apr 24 13:52:47 UTC 2018. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.129-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.4.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Re: [PATCH 4.4 23/97] ubi: fastmap: Dont flush fastmap work on detach
In reply to Greg Kroah-HartmanQuoted 10 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Weinberger <[email protected]>
commit
29b7a6fa1ec07e8480b0d9caf635a4498a438bf4upstream.At this point UBI volumes have already been free()'ed and fastmap can no longer access these data structures.
I don't see how this change can fix a use-after-free. If this function can be called with *ubi already freed, then the rest of the function body is also not safe to run. But I don't think that is the case.
ubi->fm_work doesn't depend on any other structure (except a global workqueue, which won't go away).
It seems to me that the bug is really a race condition, and removing the flush_work() makes it harder to hit that condition. The proper fix would be to call flush_work() (or cancel_work_sync()) before the UBI volumes are freed.
Ben.
Quoted 23 lines
Reported-by Martin Townsend <[email protected]>Fixes 74cdaf24004a ("UBI: Fastmap: Fix memory leaks while closing the WL sub-system")Signed-off-by Richard Weinberger <[email protected]>Signed-off-by Greg Kroah-Hartman <[email protected]>---
drivers/mtd/ubi/fastmap-wl.c | 1 -1 file changed, 1 deletion(-)drivers/mtd/ubi/fastmap-wl.c +0
-0@@ -360,7 +360,6 @@ static void ubi_fastmap_close(struct ubi { int i;drivers/mtd/ubi/fastmap-wl.c +0
-1-flush_work (&ubi->fm_work);
return_unused_pool_pebs(ubi, &ubi->fm_pool);return_unused_pool_pebs(ubi, &ubi->fm_wl_pool);
Signature · 2 lines
Ben Hutchings Software Developer, Codethink Ltd.
Re: [PATCH 4.4 23/97] ubi: fastmap: Dont flush fastmap work on detach
Ben,
Am Mittwoch, 16. Mai 2018, 18:53:49 CEST schrieb Ben Hutchings:
Quoted 3 lines
I don't see how this change can fix a use-after-free. If this function can be called with *ubi already freed, then the rest of the function body is also not safe to run. But I don't think that is the case.
thanks a lot for digging into this!
It is not about ubi (struct ubi_device) being free()'d, it is about ubi->volumes[].
Quoted 7 lines
ubi->fm_workdoesn't depend on any other structure (except a global workqueue, which won't go away).It seems to me that the bug is really a race condition, and removing the
flush_work()makes it harder to hit that condition. The proper fix would be to callflush_work()(orcancel_work_sync()) before the UBI volumes are freed.
That's a very valid point.
I think cancel_work_sync() is the right thing to do.
Thanks,
//richard
Re: [PATCH 4.4 53/97] ALSA: pcm: Fix UAF at PCM release via PCM timer access
In reply to Greg Kroah-HartmanQuoted 19 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit
a820ccbe21e8ce8e86c39cd1d3bc8c7d1cbb949bupstream.The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via
substream->runtime, and it's cleared atsnd_pcm_detach_substream().The runtime object assignment is protected by PCM
open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, assnd_pcm_timer_resolution()tries to access the runtime while clearing it in other side.
Quoted 4 lines
Fortunately, it's the only concurrent access from the PCM timer, and it merely reads
runtime->timer_resolutionfield. So, we can avoid the race by reorderingkfree()and wrapping thesubstream->runtimeclearance with the corresponding timer lock.
[...]
This seems to depend on:
commit f65e0d299807d8a11812845c972493c3f9a18e10
Author: Takashi Iwai <[email protected]>
Date: Wed Feb 10 12:47:03 2016 +0100
ALSA: timer: Call notifier in the same spinlock
(But I'm not totally convinced that snd_pcm_timer_resolution() is always called with the timer lock held, even after that.)
Ben.
Signature · 2 lines
Ben Hutchings Software Developer, Codethink Ltd.
Re: [PATCH 4.4 53/97] ALSA: pcm: Fix UAF at PCM release via PCM timer access
Quoted 29 lines · Ben Hutchings
Quoted 19 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit
a820ccbe21e8ce8e86c39cd1d3bc8c7d1cbb949bupstream.The PCM runtime object is created and freed dynamically at PCM stream open / close time. This is tracked via
substream->runtime, and it's cleared atsnd_pcm_detach_substream().The runtime object assignment is protected by PCM
open_mutex, so for all PCM operations, it's safely handled. However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream. This may eventually lead to a UAF, assnd_pcm_timer_resolution()tries to access the runtime while clearing it in other side.Quoted 4 lines
Fortunately, it's the only concurrent access from the PCM timer, and it merely reads
runtime->timer_resolutionfield. So, we can avoid the race by reorderingkfree()and wrapping thesubstream->runtimeclearance with the corresponding timer lock.[...]
This seems to depend on:
Quoted 8 lines
commit
f65e0d299807d8a11812845c972493c3f9a18e10
Author: Takashi Iwai <[email protected]>
Date: Wed Feb 10 12:47:03 2016 +0100ALSA: timer: Call notifier in the same spinlock
(But I'm not totally convinced that
snd_pcm_timer_resolution()is always called with the timer lock held, even after that.)
Indeed, there seem more codes calling the callback without the lock. I'll send the fix patches.
thanks,
Takashi
Re: [PATCH 4.4 60/97] clk: mvebu: armada-38x: add support for 1866MHz variants
In reply to Greg Kroah-HartmanQuoted 6 lines · Greg Kroah-Hartman
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Sennhauser <[email protected]>
Quoted 8 lines
commit
9593f4f56cf5d1c443f66660a0c7f01de38f979dupstream.The Linksys WRT3200ACM CPU is clocked at 1866MHz. Add 1866MHz to the list of supported CPU frequencies. Also update multiplier and divisor for the l2clk and ddrclk.
Noticed by the following warning:
[ 0.000000] Selected CPU frequency (16) unsupported
So the frequency selection field is read as 16...
[...]
drivers/clk/mvebu/armada-38x.c static const u32 armada_38x_cpu_frequenc · line 54
Quoted 10 lines
drivers/clk/mvebu/armada-38x.c +2
-1@@ -49,7 +49,8 @@ static const u32 armada_38x_cpu_frequenc 0, 0, 0, 0, 1066 * 1000 * 1000, 0, 0, 0, 1332 * 1000 * 1000, 0, 0, 0, - 1600 * 1000 * 1000, +1600 *1000 *1000 ,0 ,0 ,0 , + 1866 * 1000 * 1000, };
[...]
...but this only adds entries to the lookup table at indexes 9-12 inclusive.
It looks like this fixes the clock settings, but not the warning.
Ben.
Signature · 2 lines
Ben Hutchings Software Developer, Codethink Ltd.
Re: [PATCH 4.4 60/97] clk: mvebu: armada-38x: add support for 1866MHz variants
On Thu, 2018-05-17 at 00:32 +0100, Ben Hutchings wrote:
[...]
Quoted 4 lines
...but this only adds entries to the lookup table at indexes 9-12 inclusive.
It looks like this fixes the clock settings, but not the warning.
Sorry, I misread this, it's fine.
Ben.
Signature · 2 lines
Ben Hutchings Software Developer, Codethink Ltd.
Greg Kroah-Hartman
maintainerRe: [PATCH 4.4 53/97] ALSA: pcm: Fix UAF at PCM release via PCM timer access
In reply to Takashi IwaiQuoted 31 lines · Takashi Iwai
Quoted 29 lines · Ben Hutchings
Quoted 19 lines · Greg Kroah-Hartman
4.4-stable review patch.��If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit
a820ccbe21e8ce8e86c39cd1d3bc8c7d1cbb949bupstream.The PCM runtime object is created and freed dynamically at PCM stream open / close time.��This is tracked via
substream->runtime, and it's cleared atsnd_pcm_detach_substream().The runtime object assignment is protected by PCM
open_mutex, so for all PCM operations, it's safely handled.��However, each PCM substream provides also an ALSA timer interface, and user-space can access to this while closing a PCM substream.��This may eventually lead to a UAF, assnd_pcm_timer_resolution()tries to access the runtime while clearing it in other side.Quoted 4 lines
Fortunately, it's the only concurrent access from the PCM timer, and it merely reads
runtime->timer_resolutionfield.��So, we can avoid the race by reorderingkfree()and wrapping thesubstream->runtimeclearance with the corresponding timer lock.[...]
This seems to depend on:
Quoted 8 lines
Quoted 8 lines
commit
f65e0d299807d8a11812845c972493c3f9a18e10
Author: Takashi Iwai <[email protected]>
Date:���Wed Feb 10 12:47:03 2016 +0100����ALSA: timer: Call notifier in the same spinlock
(But I'm not totally convinced that
snd_pcm_timer_resolution()is always called with the timer lock held, even after that.)
Good catch, I'll queue this up now, thanks.
greg k-h