4.9.159-stable review
Subsystems (5)
Greg Kroah-Hartman
maintainercover 4.9.159-stable review
This is the start of the stable review cycle for the 4.9.159 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Feb 20 13:34:40 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.159-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.159-rc1
Hugh Dickins <[email protected]>
mm: stop leaking PageTables
Christian Lamparter <[email protected]>
pinctrl: msm: fix gpio-hog related boot issues
Liping Zhang <[email protected]>
netfilter: nf_tables: fix mismatch in big-endian system
John Youn <[email protected]>
usb: dwc2: Remove unnecessary kfree
Eric Dumazet <[email protected]>
kaweth: use skb_cow_head() to deal with cloned skbs
Eric Dumazet <[email protected]>
ch9200: use skb_cow_head() to deal with cloned skbs
James Hughes <[email protected]>
smsc95xx: Use skb_cow_head to deal with cloned skbs
Joonas Lahtinen <[email protected]>
drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
Nikos Tsironis <[email protected]>
dm thin: fix bug where bio that overwrites thin block ignores FUA
Borislav Petkov <[email protected]>
x86/a.out: Clear the dump structure initially
Eric W. Biederman <[email protected]>
signal: Restore the stop PTRACE_EVENT_EXIT
Hedi Berriche <[email protected]>
x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
Andreas Ziegler <[email protected]>
tracing/uprobes: Fix output for multiple string arguments
Meelis Roos <[email protected]>
alpha: Fix Eiger NR_IRQS to 128
Sergei Trofimovich <[email protected]>
alpha: fix page fault handling for r16-r18 targets
Matti Kurkela <[email protected]>
Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
Jonathan Bakker <[email protected]>
Input: bma150 - register input device after setting private data
Xiaoyao Li <[email protected]>
kvm: vmx: Fix entry number check for add_atomic_switch_msr()
Manuel Reinhardt <[email protected]>
ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
Jurica Vukadin <[email protected]>
ALSA: hda - Add quirk for HP EliteBook 840 G5
Jiri Olsa <[email protected]>
perf/x86: Add check_period PMU callback
Ingo Molnar <[email protected]>
perf/core: Fix impossible ring-buffer sizes warning
Mauro Ciancio <[email protected]>
Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
Dmitry Torokhov <[email protected]>
Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
Milian Wolff <[email protected]>
perf report: Include partial stacks unwound with libdw
Ross Lagerwall <[email protected]>
cifs: Limit memory used by lock request calls to a page
Nicholas Mc Guire <[email protected]>
gpio: pl061: handle failed allocations
Linus Walleij <[email protected]>
ARM: dts: kirkwood: Fix polarity of GPIO fan lines
Peter Ujfalusi <[email protected]>
ARM: dts: da850-lcdk: Correct the sound card name
Peter Ujfalusi <[email protected]>
ARM: dts: da850-evm: Correct the sound card name
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: fix output H/V syncs
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: reject modes which require too much BW
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: fix single lane configuration
Tomi Valkeinen <[email protected]>
drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
Sudeep Holla <[email protected]>
cpufreq: check if policy is inactive early in __cpufreq_get()
Chao Fan <[email protected]>
ACPI: NUMA: Use correct type for printing addresses on i386-PAE
Daniel Axtens <[email protected]>
bnx2x: disable GSO where gso_size is too big for hardware
Daniel Axtens <[email protected]>
net: create skb_gso_validate_mac_len()
Russell King <[email protected]>
ARM: fix the cockup in the previous patch
Russell King <[email protected]>
ARM: ensure that processor vtables is not lost after boot
Russell King <[email protected]>
ARM: spectre-v2: per-CPU vtables to work around big.Little systems
Russell King <[email protected]>
ARM: add PROC_VTABLE and PROC_TABLE macros
Russell King <[email protected]>
ARM: clean up per-processor check_bugs method call
Russell King <[email protected]>
ARM: split out processor lookup
Russell King <[email protected]>
ARM: make lookup_processor_type() non-__init
Julien Thierry <[email protected]>
ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
Julien Thierry <[email protected]>
ARM: 8797/1: spectre-v1.1: harden __copy_to_user
Julien Thierry <[email protected]>
ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
Julien Thierry <[email protected]>
ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
Julien Thierry <[email protected]>
ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
Julien Thierry <[email protected]>
ARM: 8793/1: signal: replace __put_user_error with __put_user
Julien Thierry <[email protected]>
ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
Julien Thierry <[email protected]>
ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
Julien Thierry <[email protected]>
ARM: 8789/1: signal: copy registers using __copy_to_user()
Hauke Mehrtens <[email protected]>
uapi/if_ether.h: prevent redefinition of struct ethhdr
Adrian Bunk <[email protected]>
eeprom: at24: add support for 24c2048
Adrian Bunk <[email protected]>
dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
-------------
Diffstat:
.../devicetree/bindings/eeprom/eeprom.txt | 5 +- Makefile | 4 +- arch/alpha/include/asm/irq.h | 6 +- arch/alpha/mm/fault.c | 2 +- arch/arm/boot/dts/da850-evm.dts | 2 +- arch/arm/boot/dts/da850-lcdk.dts | 2 +- arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 +- arch/arm/include/asm/assembler.h | 11 ++++ arch/arm/include/asm/cputype.h | 1 + arch/arm/include/asm/proc-fns.h | 61 +++++++++++++++---- arch/arm/include/asm/thread_info.h | 4 +- arch/arm/include/asm/uaccess.h | 49 +++++++++++++-- arch/arm/kernel/bugs.c | 4 +- arch/arm/kernel/head-common.S | 6 +- arch/arm/kernel/setup.c | 40 ++++++++----- arch/arm/kernel/signal.c | 70 ++++++++++++---------- arch/arm/kernel/smp.c | 32 ++++++++++ arch/arm/kernel/sys_oabi-compat.c | 8 ++- arch/arm/lib/copy_from_user.S | 6 +- arch/arm/lib/copy_to_user.S | 6 +- arch/arm/lib/uaccess_with_memcpy.c | 3 +- arch/arm/mach-integrator/impd1.c | 6 +- arch/arm/mm/proc-macros.S | 10 ++++ arch/arm/mm/proc-v7-bugs.c | 17 +----- arch/arm/vfp/vfpmodule.c | 20 +++---- arch/x86/events/core.c | 14 +++++ arch/x86/events/intel/core.c | 9 +++ arch/x86/events/perf_event.h | 16 ++++- arch/x86/ia32/ia32_aout.c | 6 +- arch/x86/include/asm/uv/bios.h | 8 ++- arch/x86/kvm/vmx.c | 3 +- arch/x86/platform/uv/bios_uv.c | 23 ++++++- drivers/acpi/numa.c | 6 +- drivers/cpufreq/cpufreq.c | 7 +-- drivers/firmware/efi/runtime-wrappers.c | 7 +++ drivers/gpu/drm/bridge/tc358767.c | 41 ++++++++++--- drivers/gpu/drm/i915/i915_gem.c | 12 +++- drivers/input/misc/bma150.c | 9 +-- drivers/input/mouse/elan_i2c_core.c | 2 +- drivers/input/mouse/elantech.c | 9 +++ drivers/md/dm-thin.c | 55 +++++++++++++++-- drivers/misc/eeprom/Kconfig | 2 +- drivers/misc/eeprom/at24.c | 1 + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 18 ++++++ drivers/net/usb/ch9200.c | 9 +-- drivers/net/usb/kaweth.c | 18 ++---- drivers/net/usb/smsc95xx.c | 12 ++-- drivers/pinctrl/qcom/pinctrl-msm.c | 23 +++++-- drivers/usb/dwc2/hcd.c | 1 - fs/cifs/file.c | 8 +++ fs/cifs/smb2file.c | 4 ++ include/linux/perf_event.h | 5 ++ include/linux/skbuff.h | 16 +++++ include/net/netfilter/nf_tables.h | 29 +++++++++ include/uapi/linux/if_ether.h | 3 + include/uapi/linux/libc-compat.h | 6 ++ kernel/events/core.c | 16 +++++ kernel/events/ring_buffer.c | 2 +- kernel/signal.c | 7 ++- kernel/trace/trace_uprobe.c | 9 ++- mm/memory.c | 21 +++++-- net/core/skbuff.c | 63 +++++++++++++++---- net/ipv4/netfilter/nft_masq_ipv4.c | 8 +-- net/ipv4/netfilter/nft_redir_ipv4.c | 8 +-- net/ipv6/netfilter/nft_masq_ipv6.c | 8 +-- net/ipv6/netfilter/nft_redir_ipv6.c | 8 +-- net/netfilter/nft_ct.c | 10 ++-- net/netfilter/nft_meta.c | 42 ++++++------- net/netfilter/nft_nat.c | 8 +-- net/sched/sch_tbf.c | 10 ---- sound/pci/hda/patch_conexant.c | 1 + sound/usb/pcm.c | 9 ++- tools/perf/util/unwind-libdw.c | 2 +- 73 files changed, 725 insertions(+), 268 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/58 dt-bindings: eeprom: at24: add "atmel,24c2048" compatible string
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 6c0c5dc33ff42af49243e94842d0ebdb153189ea upstream.
Add new compatible to the device tree bindings.
--- Documentation/devicetree/bindings/eeprom/eeprom.txt | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
Documentation/devicetree/bindings/eeprom/eeprom.txt +3 -2
@@ -6,7 +6,8 @@ Required properties: "atmel,24c00", "atmel,24c01", "atmel,24c02", "atmel,24c04", "atmel,24c08", "atmel,24c16", "atmel,24c32", "atmel,24c64", - "atmel,24c128", "atmel,24c256", "atmel,24c512", "atmel,24c1024" + "atmel,24c128", "atmel,24c256", "atmel,24c512", "atmel,24c1024", + "atmel,24c2048" "catalyst,24c32"
@@ -17,7 +18,7 @@ Required properties: If there is no specific driver for <manufacturer>, a generic driver based on <type> is selected. Possible types are: "24c00", "24c01", "24c02", "24c04", "24c08", "24c16", "24c32", "24c64", - "24c128", "24c256", "24c512", "24c1024", "spd" + "24c128", "24c256", "24c512", "24c1024", "24c2048", "spd" - reg : the I2C address of the EEPROM
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 2/58 eeprom: at24: add support for 24c2048
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 37cf28d3b5bca1b532a0b6aac722e7f2788a9294 upstream.
Works with ST M24M02.
--- drivers/misc/eeprom/Kconfig | 2 +- drivers/misc/eeprom/at24.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-)
drivers/misc/eeprom/Kconfig +1 -1
@@ -12,7 +12,7 @@ config EEPROM_AT24 ones like at24c64, 24lc02 or fm24c04: 24c00, 24c01, 24c02, spd (readonly 24c02), 24c04, 24c08, - 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024 + 24c16, 24c32, 24c64, 24c128, 24c256, 24c512, 24c1024, 24c2048 Unless you like data loss puzzles, always be sure that any chip you configure as a 24c32 (32 kbit) or larger is NOT really a
drivers/misc/eeprom/at24.c +1 -0
@@ -170,6 +170,7 @@ static const struct i2c_device_id at24_ids[] = { { "24c256", AT24_DEVICE_MAGIC(262144 / 8, AT24_FLAG_ADDR16) }, { "24c512", AT24_DEVICE_MAGIC(524288 / 8, AT24_FLAG_ADDR16) }, { "24c1024", AT24_DEVICE_MAGIC(1048576 / 8, AT24_FLAG_ADDR16) }, + { "24c2048", AT24_DEVICE_MAGIC(2097152 / 8, AT24_FLAG_ADDR16) }, { "at24", 0 }, { /* END OF LIST */ } };
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 3/58 uapi/if_ether.h: prevent redefinition of struct ethhdr
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 6926e041a8920c8ec27e4e155efa760aa01551fd upstream.
Musl provides its own ethhdr struct definition. Add a guard to prevent its definition of the appropriate musl header has already been included.
glibc does not implement this header, but when glibc will implement this they can just define __UAPI_DEF_ETHHDR 0 to make it work with the kernel.
--- include/uapi/linux/if_ether.h | 3 +++ include/uapi/linux/libc-compat.h | 6 ++++++ 2 files changed, 9 insertions(+)
include/uapi/linux/if_ether.h +3 -0
@@ -22,6 +22,7 @@#define _UAPI_LINUX_IF_ETHER_H#include <linux/types.h> +#include <linux/libc-compat.h> /* * IEEE 802.3 Ethernet magic constants. The frame sizes omit the preamble
@@ -139,11 +140,13 @@* This is an Ethernet frame header. */ +#if __UAPI_DEF_ETHHDRstruct ethhdr {unsigned char h_dest[ETH_ALEN ];/* destination eth addr */ unsigned char h_source[ETH_ALEN ];/* source ether addr */ __be16 h_proto;/* packet type ID field */ } __attribute__((packed)); +#endif #endif /* _UAPI_LINUX_IF_ETHER_H */
include/uapi/linux/libc-compat.h +6 -0
@@ -263,4 +263,10 @@#endif /* __GLIBC__ */ +/* Definitions for if_ether.h */ +/* allow libcs like musl to deactivate this, glibc does not implement this. */ +#ifndef __UAPI_DEF_ETHHDR +#define __UAPI_DEF_ETHHDR 1 +#endif +#endif /* _UAPI_LIBC_COMPAT_H */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 4/58 ARM: 8789/1: signal: copy registers using __copy_to_user()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 5ca451cf6ed04443774bbb7ee45332dafa42e99f upstream.
When saving the ARM integer registers, use __copy_to_user() to copy them into user signal frame, rather than __put_user_error(). This has the benefit of disabling/enabling PAN once for the whole copy intead of once per write.
--- arch/arm/kernel/signal.c | 49 ++++++++++++++++++++++------------------ 1 file changed, 27 insertions(+), 22 deletions(-)
arch/arm/kernel/signal.c +27 -22
@@ -256,30 +256,35 @@ static int setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set) { struct aux_sigframe __user *aux; +struct sigcontext context;int err =0 ; -__put_user_error (regs->ARM_r0, &sf->uc.uc_mcontext.arm_r0, err); -__put_user_error (regs->ARM_r1, &sf->uc.uc_mcontext.arm_r1, err); -__put_user_error (regs->ARM_r2, &sf->uc.uc_mcontext.arm_r2, err); -__put_user_error (regs->ARM_r3, &sf->uc.uc_mcontext.arm_r3, err); -__put_user_error (regs->ARM_r4, &sf->uc.uc_mcontext.arm_r4, err); -__put_user_error (regs->ARM_r5, &sf->uc.uc_mcontext.arm_r5, err); -__put_user_error (regs->ARM_r6, &sf->uc.uc_mcontext.arm_r6, err); -__put_user_error (regs->ARM_r7, &sf->uc.uc_mcontext.arm_r7, err); -__put_user_error (regs->ARM_r8, &sf->uc.uc_mcontext.arm_r8, err); -__put_user_error (regs->ARM_r9, &sf->uc.uc_mcontext.arm_r9, err); -__put_user_error (regs->ARM_r10, &sf->uc.uc_mcontext.arm_r10, err); -__put_user_error (regs->ARM_fp, &sf->uc.uc_mcontext.arm_fp, err); -__put_user_error (regs->ARM_ip, &sf->uc.uc_mcontext.arm_ip, err); -__put_user_error (regs->ARM_sp, &sf->uc.uc_mcontext.arm_sp, err); -__put_user_error (regs->ARM_lr, &sf->uc.uc_mcontext.arm_lr, err); -__put_user_error (regs->ARM_pc, &sf->uc.uc_mcontext.arm_pc, err); -__put_user_error (regs->ARM_cpsr, &sf->uc.uc_mcontext.arm_cpsr, err); - -__put_user_error (current->thread.trap_no, &sf->uc.uc_mcontext.trap_no, err); -__put_user_error (current->thread.error_code, &sf->uc.uc_mcontext.error_code, err); -__put_user_error (current->thread.address, &sf->uc.uc_mcontext.fault_address, err); -__put_user_error (set->sig[0 ], &sf->uc.uc_mcontext.oldmask, err); + context = (struct sigcontext ) { + .arm_r0 = regs->ARM_r0, + .arm_r1 = regs->ARM_r1, + .arm_r2 = regs->ARM_r2, + .arm_r3 = regs->ARM_r3, + .arm_r4 = regs->ARM_r4, + .arm_r5 = regs->ARM_r5, + .arm_r6 = regs->ARM_r6, + .arm_r7 = regs->ARM_r7, + .arm_r8 = regs->ARM_r8, + .arm_r9 = regs->ARM_r9, + .arm_r10 = regs->ARM_r10, + .arm_fp = regs->ARM_fp, + .arm_ip = regs->ARM_ip, + .arm_sp = regs->ARM_sp, + .arm_lr = regs->ARM_lr, + .arm_pc = regs->ARM_pc, + .arm_cpsr = regs->ARM_cpsr, + + .trap_no = current->thread.trap_no, + .error_code = current->thread.error_code, + .fault_address = current->thread.address, + .oldmask = set->sig[0 ], + }; + + err |=__copy_to_user (&sf->uc.uc_mcontext, &context,sizeof (context)); err |=__copy_to_user (&sf->uc.uc_sigmask, set,sizeof (*set));
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 5/58 ARM: 8791/1: vfp: use __copy_to_user() when saving VFP state
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 upstream.
Use __copy_to_user() rather than __put_user_error() for individual members when saving VFP state.
This has the benefit of disabling/enabling PAN once per copied struct intead of once per write.
--- arch/arm/include/asm/thread_info.h | 4 ++-- arch/arm/kernel/signal.c | 13 +++++++------ arch/arm/vfp/vfpmodule.c | 20 ++++++++------------ 3 files changed, 17 insertions(+), 20 deletions(-)
arch/arm/include/asm/thread_info.h +2 -2
@@ -124,8 +124,8 @@ extern void vfp_flush_hwstate(struct thread_info *);struct user_vfp ;struct user_vfp_exc ; -extern int vfp_preserve_user_clear_hwstate (struct user_vfp __user *, -struct user_vfp_exc __user *); +extern int vfp_preserve_user_clear_hwstate (struct user_vfp *, +struct user_vfp_exc *);extern int vfp_restore_user_hwstate (struct user_vfp *,struct user_vfp_exc *);#endif
arch/arm/kernel/signal.c +7 -6
@@ -94,17 +94,18 @@ static int restore_iwmmxt_context(struct iwmmxt_sigframe *frame)static int preserve_vfp_context (struct vfp_sigframe __user *frame) { -const unsigned long magic =VFP_MAGIC ; -const unsigned long size =VFP_STORAGE_SIZE ; +struct vfp_sigframe kframe;int err =0 ; -__put_user_error (magic, &frame->magic, err); -__put_user_error (size, &frame->size, err); +memset (&kframe,0 ,sizeof (kframe)); + kframe.magic =VFP_MAGIC ; + kframe.size =VFP_STORAGE_SIZE ; + err =vfp_preserve_user_clear_hwstate (&kframe.ufp, &kframe.ufp_exc);if (err) -return -EFAULT ; +return err; -return vfp_preserve_user_clear_hwstate (&frame->ufp, &frame->ufp_exc); +return __copy_to_user (frame, &kframe,sizeof (kframe)); }static int restore_vfp_context (struct vfp_sigframe __user *auxp)
arch/arm/vfp/vfpmodule.c +8 -12
@@ -554,12 +554,11 @@ void vfp_flush_hwstate(struct thread_info *thread)* Save the current VFP state into the provided structures and prepare * for entry into a new function (signal handler). */ -int vfp_preserve_user_clear_hwstate (struct user_vfp __user *ufp, -struct user_vfp_exc __user *ufp_exc) +int vfp_preserve_user_clear_hwstate (struct user_vfp *ufp, +struct user_vfp_exc *ufp_exc) {struct thread_info *thread =current_thread_info ();struct vfp_hard_struct *hwstate = &thread->vfpstate.hard; -int err =0 ;/* Ensure that the saved hwstate is up-to-date. */ vfp_sync_hwstate (thread);
@@ -568,22 +567,19 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp __user *ufp,* Copy the floating point registers. There can be unused * registers see asm/hwcap.h for details. */ - err |=__copy_to_user (&ufp->fpregs, &hwstate->fpregs, -sizeof (hwstate->fpregs)); +memcpy (&ufp->fpregs, &hwstate->fpregs,sizeof (hwstate->fpregs)); +/* * Copy the status and control register. */ -__put_user_error (hwstate->fpscr, &ufp->fpscr, err); + ufp->fpscr = hwstate->fpscr;/* * Copy the exception registers. */ -__put_user_error (hwstate->fpexc, &ufp_exc->fpexc, err); -__put_user_error (hwstate->fpinst, &ufp_exc->fpinst, err); -__put_user_error (hwstate->fpinst2, &ufp_exc->fpinst2, err); - -if (err) -return -EFAULT ; + ufp_exc->fpexc = hwstate->fpexc; + ufp_exc->fpinst = hwstate->fpinst; + ufp_exc->fpinst2 = ufp_exc->fpinst2;/* Ensure that VFP is disabled. */ vfp_flush_hwstate (thread);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 6/58 ARM: 8792/1: oabi-compat: copy oabi events using __copy_to_user()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 319508902600c2688e057750148487996396e9ca upstream.
Copy events to user using __copy_to_user() rather than copy members of individually with __put_user_error().
This has the benefit of disabling/enabling PAN once per event intead of once per event member.
--- arch/arm/kernel/sys_oabi-compat.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
arch/arm/kernel/sys_oabi-compat.c +6 -2
@@ -276,6 +276,7 @@ asmlinkage long sys_oabi_epoll_wait(int epfd, int maxevents, int timeout) {struct epoll_event *kbuf; +struct oabi_epoll_event e;mm_segment_t fs;long ret, err, i;
@@ -294,8 +295,11 @@ asmlinkage long sys_oabi_epoll_wait(int epfd,set_fs (fs); err =0 ;for (i =0 ; i < ret; i++) { -__put_user_error (kbuf[i].events, &events->events, err); -__put_user_error (kbuf[i].data, &events->data, err); + e.events = kbuf[i].events; + e.data = kbuf[i].data; + err =__copy_to_user (events, &e,sizeof (e)); +if (err) +break ; events++; }kfree (kbuf);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 7/58 ARM: 8793/1: signal: replace __put_user_error with __put_user
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 18ea66bd6e7a95bdc598223d72757190916af28b upstream.
With Spectre-v1.1 mitigations, __put_user_error is pointless. In an attempt to remove it, replace its references in frame setups with __put_user.
--- arch/arm/kernel/signal.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/kernel/signal.c +4 -4
@@ -302,7 +302,7 @@ setup_sigframe(struct sigframe __user *sf, struct pt_regs *regs, sigset_t *set)if (err ==0 ) err |=preserve_vfp_context (&aux->vfp);#endif -__put_user_error (0 , &aux->end_magic, err); + err |=__put_user (0 , &aux->end_magic);return err; }
@@ -434,7 +434,7 @@ setup_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs)/* * Set uc.uc_flags to a value which sc.trap_no would never have. */ -__put_user_error (0x5ac3c35a , &frame->uc.uc_flags, err); + err =__put_user (0x5ac3c35a , &frame->uc.uc_flags); err |=setup_sigframe (frame, regs, set);if (err ==0 )
@@ -454,8 +454,8 @@ setup_rt_frame(struct ksignal *ksig, sigset_t *set, struct pt_regs *regs) err |=copy_siginfo_to_user (&frame->info, &ksig->info); -__put_user_error (0 , &frame->sig.uc.uc_flags, err); -__put_user_error (NULL , &frame->sig.uc.uc_link, err); + err |=__put_user (0 , &frame->sig.uc.uc_flags); + err |=__put_user (NULL , &frame->sig.uc.uc_link); err |=__save_altstack (&frame->sig.uc.uc_stack, regs->ARM_sp); err |=setup_sigframe (&frame->sig, regs, set);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 8/58 ARM: 8794/1: uaccess: Prevent speculative use of the current addr_limit
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 621afc677465db231662ed126ae1f355bf8eac47 upstream.
A mispredicted conditional call to set_fs could result in the wrong addr_limit being forwarded under speculation to a subsequent access_ok check, potentially forming part of a spectre-v1 attack using uaccess routines.
This patch prevents this forwarding from taking place, but putting heavy barriers in set_fs after writing the addr_limit.
Porting commit c2f0ad4fc089cff8 ("arm64: uaccess: Prevent speculative use of the current addr_limit").
--- arch/arm/include/asm/uaccess.h | 8 ++++++++ 1 file changed, 8 insertions(+)
arch/arm/include/asm/uaccess.h +8 -0
@@ -99,6 +99,14 @@ extern int __put_user_bad(void);static inline void set_fs (mm_segment_t fs) {current_thread_info ()->addr_limit = fs; + +/* +* Prevent a mispredicted conditional call to set_fs from forwarding +* the wrong address limit to access_ok under speculation. +*/ +dsb (nsh); +isb (); +modify_domain (DOMAIN_KERNEL , fs ?DOMAIN_CLIENT :DOMAIN_MANAGER ); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 9/58 ARM: 8795/1: spectre-v1.1: use put_user() for __put_user()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit e3aa6243434fd9a82e84bb79ab1abd14f2d9a5a7 upstream.
When Spectre mitigation is required, __put_user() needs to include check_uaccess. This is already the case for put_user(), so just make __put_user() an alias of put_user().
--- arch/arm/include/asm/uaccess.h | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
arch/arm/include/asm/uaccess.h +9 -6
@@ -400,6 +400,14 @@ do { \ __pu_err; \ }) +#ifdef CONFIG_CPU_SPECTRE +/* +* When mitigating Spectre variant 1.1, all accessors need to include +* verification of the address space. +*/ +#define __put_user (x, ptr) put_user(x, ptr) + +#else #define __put_user (x, ptr) \ ({ \ long __pu_err = 0; \
@@ -407,12 +415,6 @@ do { \ __pu_err; \ }) -#define __put_user_error (x, ptr, err) \ -({ \ - __put_user_switch((x), (ptr), (err), __put_user_nocheck); \ - (void) 0; \ -}) -#define __put_user_nocheck (x, __pu_ptr, __err, __size) \ do { \ unsigned long __pu_addr = (unsigned long)__pu_ptr; \
@@ -492,6 +494,7 @@ do { \ : "r" (x), "i" (-EFAULT) \ : "cc") +#endif /* !CONFIG_CPU_SPECTRE */ #ifdef CONFIG_MMU extern unsigned long __must_check
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 10/58 ARM: 8796/1: spectre-v1,v1.1: provide helpers for address sanitization
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit afaf6838f4bc896a711180b702b388b8cfa638fc upstream.
Introduce C and asm helpers to sanitize user address, taking the address range they target into account.
Use asm helper for existing sanitization in __copy_from_user().
--- arch/arm/include/asm/assembler.h | 11 +++++++++++ arch/arm/include/asm/uaccess.h | 26 ++++++++++++++++++++++++++ arch/arm/lib/copy_from_user.S | 6 +----- 3 files changed, 38 insertions(+), 5 deletions(-)
arch/arm/include/asm/assembler.h +11 -0
@@ -465,6 +465,17 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )#endif .endm + .macro uaccess_mask_range_ptr, addr:req, size:req, limit:req, tmp:req +#ifdef CONFIG_CPU_SPECTRE + sub \tmp, \limit, #1 + subs \tmp, \tmp, \addr @ tmp = limit - 1 - addr + addhs \tmp, \tmp, #1 @ if (tmp >= 0) { + subhss \tmp, \tmp, \size @ tmp = limit - (addr + size) } + movlo \addr, #0 @ if (tmp < 0) addr = NULL + csdb +#endif + .endm + .macro uaccess_disable, tmp, isb=1 #ifdef CONFIG_CPU_SW_DOMAIN_PAN/*
arch/arm/include/asm/uaccess.h +26 -0
@@ -129,6 +129,32 @@ static inline void set_fs(mm_segment_t fs)#define __inttype (x) \ __typeof__(__builtin_choose_expr(sizeof(x) > sizeof(0UL), 0ULL, 0UL)) +/* +* Sanitise a uaccess pointer such that it becomes NULL if addr+size +* is above the current addr_limit. +*/ +#define uaccess_mask_range_ptr (ptr, size) \ + ((__typeof__(ptr))__uaccess_mask_range_ptr(ptr, size)) +static inline void __user *__uaccess_mask_range_ptr (const void __user *ptr, +size_t size) +{ +void __user *safe_ptr = (void __user *)ptr; +unsigned long tmp; + + asmvolatile ( +" sub %1, %3, #1\n" +" subs %1, %1, %0\n" +" addhs %1, %1, #1\n" +" subhss %1, %1, %2\n" +" movlo %0, #0\n" + :"+r" (safe_ptr),"=&r" (tmp) + :"r" (size),"r" (current_thread_info ()->addr_limit) + :"cc" ); + +csdb (); +return safe_ptr; +} +/* * Single-value transfer routines. They automatically use the right * size if we just have the right pointer type. Note that the functions
arch/arm/lib/copy_from_user.S +1 -5
@@ -93,11 +93,7 @@ ENTRY(arm_copy_from_user) #ifdef CONFIG_CPU_SPECTRE get_thread_info r3 ldr r3, [r3, #TI_ADDR_LIMIT] - adds ip, r1, r2 @ ip=addr+size - sub r3, r3, #1 @ addr_limit - 1 - cmpcc ip, r3 @ if (addr+size > addr_limit - 1) - movcs r1, #0 @ addr = NULL - csdb + uaccess_mask_range_ptr r1, r2, r3, ip #endif #include "copy_template.S"
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 11/58 ARM: 8797/1: spectre-v1.1: harden __copy_to_user
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit a1d09e074250fad24f1b993f327b18cc6812eb7a upstream.
Sanitize user pointer given to __copy_to_user, both for standard version and memcopy version of the user accessor.
--- arch/arm/lib/copy_to_user.S | 6 +++++- arch/arm/lib/uaccess_with_memcpy.c | 3 ++- 2 files changed, 7 insertions(+), 2 deletions(-)
arch/arm/lib/copy_to_user.S +5 -1
@@ -94,6 +94,11 @@ ENTRY(__copy_to_user_std) WEAK(arm_copy_to_user) +#ifdef CONFIG_CPU_SPECTRE + get_thread_info r3 + ldr r3, [r3, #TI_ADDR_LIMIT] + uaccess_mask_range_ptr r0, r2, r3, ip +#endif #include "copy_template.S"
@@ -108,4 +113,3 @@ ENDPROC(__copy_to_user_std) rsb r0, r0, r2 copy_abort_end .popsection -
arch/arm/lib/uaccess_with_memcpy.c +2 -1
@@ -152,7 +152,8 @@ arm_copy_to_user(void __user *to, const void *from, unsigned long n) n =__copy_to_user_std (to, from, n);uaccess_restore (ua_flags); }else { - n =__copy_to_user_memcpy (to, from, n); + n =__copy_to_user_memcpy (uaccess_mask_range_ptr (to, n), + from, n); }return n; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 12/58 ARM: 8810/1: vfp: Fix wrong assignement to ufp_exc
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 5df7a99bdd0de4a0480320264c44c04543c29d5a upstream.
In vfp_preserve_user_clear_hwstate, ufp_exc->fpinst2 gets assigned to itself. It should actually be hwstate->fpinst2 that gets assigned to the ufp_exc field.
Fixes commit 3aa2df6ec2ca6bc143a65351cca4266d03a8bc41 ("ARM: 8791/1:
vfp: use __copy_to_user() when saving VFP state").
--- arch/arm/vfp/vfpmodule.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/vfp/vfpmodule.c +1 -1
@@ -579,7 +579,7 @@ int vfp_preserve_user_clear_hwstate(struct user_vfp *ufp,*/ ufp_exc->fpexc = hwstate->fpexc; ufp_exc->fpinst = hwstate->fpinst; - ufp_exc->fpinst2 = ufp_exc->fpinst2; + ufp_exc->fpinst2 = hwstate->fpinst2;/* Ensure that VFP is disabled. */ vfp_flush_hwstate (thread);
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 13/58 ARM: make lookup_processor_type() non-__init
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 899a42f836678a595f7d2bc36a5a0c2b03d08cbc upstream.
Move lookup_processor_type() out of the __init section so it is callable from (eg) the secondary startup code during hotplug.
--- arch/arm/kernel/head-common.S | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/arm/kernel/head-common.S +3 -3
@@ -122,6 +122,9 @@ __mmap_switched_data: .long init_thread_union + THREAD_START_SP @ sp .size __mmap_switched_data, . - __mmap_switched_data + __FINIT + .text + /* * This provides a C-API version of __lookup_processor_type */
@@ -133,9 +136,6 @@ ENTRY(lookup_processor_type) ldmfd sp!, {r4 - r6, r9, pc} ENDPROC(lookup_processor_type) - __FINIT - .text - /* * Read processor ID register (CP#15, CR0), and look up in the linker-built * supported processor list. Note that we can't use the absolute addresses
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 14/58 ARM: split out processor lookup
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 65987a8553061515b5851b472081aedb9837a391 upstream.
Split out the lookup of the processor type and associated error handling from the rest of setup_processor() - we will need to use this in the secondary CPU bringup path for big.Little Spectre variant 2 mitigation.
--- arch/arm/include/asm/cputype.h | 1 + arch/arm/kernel/setup.c | 31 +++++++++++++++++++------------ 2 files changed, 20 insertions(+), 12 deletions(-)
arch/arm/include/asm/cputype.h +1 -0
@@ -106,6 +106,7 @@#define ARM_CPU_PART_SCORPION 0x510002d0extern unsigned int processor_id; +struct proc_info_list *lookup_processor (u32 midr);#ifdef CONFIG_CPU_CP15 #define read_cpuid (reg) \
arch/arm/kernel/setup.c +19 -12
@@ -667,22 +667,29 @@ static void __init smp_build_mpidr_hash(void) }#endif -static void __init setup_processor (void ) +/* +* locate processor in the list of supported processor types. The linker +* builds this table for us from the entries in arch/arm/mm/proc-*.S +*/ +struct proc_info_list *lookup_processor (u32 midr) { -struct proc_info_list *list; +struct proc_info_list *list =lookup_processor_type (midr); -/* -* locate processor in the list of supported processor -* types. The linker builds this table for us from the -* entries in arch/arm/mm/proc-*.S -*/ - list =lookup_processor_type (read_cpuid_id ());if (!list) { -pr_err ("CPU configuration botched (ID %08x), unable to continue.\n" , -read_cpuid_id ()); -while (1 ); +pr_err ("CPU%u: configuration botched (ID %08x), CPU halted\n" , +smp_processor_id (), midr); +while (1 ) +/* can't use cpu_relax() here as it may require MMU setup */ ; } +return list; +} + +static void __init setup_processor (void ) +{ +unsigned int midr =read_cpuid_id (); +struct proc_info_list *list =lookup_processor (midr); + cpu_name = list->cpu_name; __cpu_architecture =__get_cpu_architecture ();
@@ -700,7 +707,7 @@ static void __init setup_processor(void)#endif pr_info ("CPU: %s [%08x] revision %d (ARMv%s), cr=%08lx\n" , - cpu_name,read_cpuid_id (),read_cpuid_id () &15 , + list->cpu_name, midr, midr &15 , proc_arch[cpu_architecture ()],get_cr ()); snprintf(init_utsname()->machine, __NEW_UTS_LEN + 1, "%s%c",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 15/58 ARM: clean up per-processor check_bugs method call
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 945aceb1db8885d3a35790cf2e810f681db52756 upstream.
Call the per-processor type check_bugs() method in the same way as we do other per-processor functions - move the "processor." detail into proc-fns.h.
--- arch/arm/include/asm/proc-fns.h | 1 + arch/arm/kernel/bugs.c | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-)
arch/arm/include/asm/proc-fns.h +1 -0
@@ -99,6 +99,7 @@ extern void cpu_do_suspend(void *);extern void cpu_do_resume (void *);#else #define cpu_proc_init processor._proc_init +#define cpu_check_bugs processor.check_bugs#define cpu_proc_fin processor._proc_fin#define cpu_reset processor.reset#define cpu_do_idle processor._do_idle
arch/arm/kernel/bugs.c +2 -2
@@ -6,8 +6,8 @@void check_other_bugs (void ) {#ifdef MULTI_CPU -if (processor.check_bugs) - processor.check_bugs (); +if (cpu_check_bugs) +cpu_check_bugs ();#endif }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 16/58 ARM: add PROC_VTABLE and PROC_TABLE macros
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit e209950fdd065d2cc46e6338e47e52841b830cba upstream.
Allow the way we access members of the processor vtable to be changed at compile time. We will need to move to per-CPU vtables to fix the Spectre variant 2 issues on big.Little systems.
However, we have a couple of calls that do not need the vtable treatment, and indeed cause a kernel warning due to the (later) use of smp_processor_id(), so also introduce the PROC_TABLE macro for these which always use CPU 0's function pointers.
--- arch/arm/include/asm/proc-fns.h | 39 ++++++++++++++++++++++----------- arch/arm/kernel/setup.c | 4 +--- 2 files changed, 27 insertions(+), 16 deletions(-)
arch/arm/include/asm/proc-fns.h +26 -13
@@ -23,7 +23,7 @@ struct mm_struct;/* * Don't change this structure - ASM code relies on it. */ -extern struct processor { +struct processor {/* MISC * get data abort address/flags */
@@ -79,9 +79,13 @@ extern struct processor {unsigned int suspend_size;void (*do_suspend)(void *);void (*do_resume)(void *); -} processor; +};#ifndef MULTI_CPU +static inline void init_proc_vtable (const struct processor *p) +{ +} +extern void cpu_proc_init (void );extern void cpu_proc_fin (void );extern int cpu_do_idle (void );
@@ -98,18 +102,27 @@ extern void cpu_reset(unsigned long addr) __attribute__((noreturn));extern void cpu_do_suspend (void *);extern void cpu_do_resume (void *);#else -#define cpu_proc_init processor._proc_init -#define cpu_check_bugs processor.check_bugs -#define cpu_proc_fin processor._proc_fin -#define cpu_reset processor.reset -#define cpu_do_idle processor._do_idle -#define cpu_dcache_clean_area processor.dcache_clean_area -#define cpu_set_pte_ext processor.set_pte_ext -#define cpu_do_switch_mm processor.switch_mm -/* These three are private to arch/arm/kernel/suspend.c */ -#define cpu_do_suspend processor.do_suspend -#define cpu_do_resume processor.do_resume +extern struct processor processor; +#define PROC_VTABLE (f) processor.f +#define PROC_TABLE (f) processor.f +static inline void init_proc_vtable (const struct processor *p) +{ + processor = *p; +} + +#define cpu_proc_init PROC_VTABLE(_proc_init) +#define cpu_check_bugs PROC_VTABLE(check_bugs) +#define cpu_proc_fin PROC_VTABLE(_proc_fin) +#define cpu_reset PROC_VTABLE(reset) +#define cpu_do_idle PROC_VTABLE(_do_idle) +#define cpu_dcache_clean_area PROC_TABLE(dcache_clean_area) +#define cpu_set_pte_ext PROC_TABLE(set_pte_ext) +#define cpu_do_switch_mm PROC_VTABLE(switch_mm) + +/* These two are private to arch/arm/kernel/suspend.c */ +#define cpu_do_suspend PROC_VTABLE(do_suspend) +#define cpu_do_resume PROC_VTABLE(do_resume)#endif extern void cpu_resume (void );
arch/arm/kernel/setup.c +1 -3
@@ -693,9 +693,7 @@ static void __init setup_processor(void) cpu_name = list->cpu_name; __cpu_architecture =__get_cpu_architecture (); -#ifdef MULTI_CPU - processor = *list->proc; -#endif +init_proc_vtable (list->proc);#ifdef MULTI_TLB cpu_tlb = *list->tlb;#endif
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 17/58 ARM: spectre-v2: per-CPU vtables to work around big.Little systems
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 383fb3ee8024d596f488d2dbaf45e572897acbdb upstream.
In big.Little systems, some CPUs require the Spectre workarounds in paths such as the context switch, but other CPUs do not. In order to handle these differences, we need per-CPU vtables.
We are unable to use the kernel's per-CPU variables to support this as per-CPU is not initialised at times when we need access to the vtables, so we have to use an array indexed by logical CPU number.
We use an array-of-pointers to avoid having function pointers in the kernel's read/write .data section.
Note: Added include of linux/slab.h in arch/arm/smp.c.
--- arch/arm/include/asm/proc-fns.h | 23 +++++++++++++++++++++++ arch/arm/kernel/setup.c | 5 +++++ arch/arm/kernel/smp.c | 32 ++++++++++++++++++++++++++++++++ arch/arm/mm/proc-v7-bugs.c | 17 ++--------------- 4 files changed, 62 insertions(+), 15 deletions(-)
arch/arm/include/asm/proc-fns.h +23 -0
@@ -104,12 +104,35 @@ extern void cpu_do_resume(void *);#else extern struct processor processor; +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +#include <linux/smp.h> +/* +* This can't be a per-cpu variable because we need to access it before +* per-cpu has been initialised. We have a couple of functions that are +* called in a pre-emptible context, and so can't use smp_processor_id() +* there, hence PROC_TABLE(). We insist in init_proc_vtable() that the +* function pointers for these are identical across all CPUs. +*/ +extern struct processor *cpu_vtable[]; +#define PROC_VTABLE (f) cpu_vtable[smp_processor_id()]->f +#define PROC_TABLE (f) cpu_vtable[0]->f +static inline void init_proc_vtable (const struct processor *p) +{ +unsigned int cpu =smp_processor_id (); + *cpu_vtable[cpu] = *p; +WARN_ON_ONCE (cpu_vtable[cpu]->dcache_clean_area != + cpu_vtable[0 ]->dcache_clean_area); +WARN_ON_ONCE (cpu_vtable[cpu]->set_pte_ext != + cpu_vtable[0 ]->set_pte_ext); +} +#else #define PROC_VTABLE (f) processor.f#define PROC_TABLE (f) processor.fstatic inline void init_proc_vtable (const struct processor *p) { processor = *p; } +#endif #define cpu_proc_init PROC_VTABLE(_proc_init)#define cpu_check_bugs PROC_VTABLE(check_bugs)
arch/arm/kernel/setup.c +5 -0
@@ -115,6 +115,11 @@ EXPORT_SYMBOL(elf_hwcap2);#ifdef MULTI_CPU struct processor processor__ro_after_init ; +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +struct processor *cpu_vtable[NR_CPUS ] = { + [0 ] = &processor, +}; +#endif #endif #ifdef MULTI_TLB struct cpu_tlb_fns cpu_tlb__ro_after_init ;
arch/arm/kernel/smp.c +32 -0
@@ -27,6 +27,7 @@#include <linux/completion.h> #include <linux/cpufreq.h> #include <linux/irq_work.h> +#include <linux/slab.h> #include <linux/atomic.h> #include <asm/bugs.h>
@@ -40,6 +41,7 @@#include <asm/mmu_context.h> #include <asm/pgtable.h> #include <asm/pgalloc.h> +#include <asm/procinfo.h> #include <asm/processor.h> #include <asm/sections.h> #include <asm/tlbflush.h>
@@ -100,6 +102,30 @@ static unsigned long get_arch_pgd(pgd_t *pgd)#endif } +#if defined(CONFIG_BIG_LITTLE ) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR ) +static int secondary_biglittle_prepare (unsigned int cpu) +{ +if (!cpu_vtable[cpu]) + cpu_vtable[cpu] =kzalloc (sizeof (*cpu_vtable[cpu]),GFP_KERNEL ); + +return cpu_vtable[cpu] ?0 : -ENOMEM ; +} + +static void secondary_biglittle_init (void ) +{ +init_proc_vtable (lookup_processor (read_cpuid_id ())->proc); +} +#else +static int secondary_biglittle_prepare (unsigned int cpu) +{ +return 0 ; +} + +static void secondary_biglittle_init (void ) +{ +} +#endif +int __cpu_up (unsigned int cpu,struct task_struct *idle) {int ret;
@@ -107,6 +133,10 @@ int __cpu_up(unsigned int cpu, struct task_struct *idle)if (!smp_ops.smp_boot_secondary)return -ENOSYS ; + ret =secondary_biglittle_prepare (cpu); +if (ret) +return ret; +/* * We need to tell the secondary core where to find * its stack and the page tables.
@@ -358,6 +388,8 @@ asmlinkage void secondary_start_kernel(void)struct mm_struct *mm = &init_mm;unsigned int cpu; +secondary_biglittle_init (); +/* * The identity mapping is uncached (strongly ordered), so * switch away from it before attempting any exclusive accesses.
arch/arm/mm/proc-v7-bugs.c +2 -15
@@ -52,8 +52,6 @@ static void cpu_v7_spectre_init(void)case ARM_CPU_PART_CORTEX_A17 :case ARM_CPU_PART_CORTEX_A73 :case ARM_CPU_PART_CORTEX_A75 : -if (processor.switch_mm != cpu_v7_bpiall_switch_mm) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = harden_branch_predictor_bpiall; spectre_v2_method ="BPIALL" ;
@@ -61,8 +59,6 @@ static void cpu_v7_spectre_init(void)case ARM_CPU_PART_CORTEX_A15 :case ARM_CPU_PART_BRAHMA_B15 : -if (processor.switch_mm != cpu_v7_iciallu_switch_mm) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = harden_branch_predictor_iciallu; spectre_v2_method ="ICIALLU" ;
@@ -88,11 +84,9 @@ static void cpu_v7_spectre_init(void) ARM_SMCCC_ARCH_WORKAROUND_1, &res);if ((int )res.a0 !=0 )break ; -if (processor.switch_mm != cpu_v7_hvc_switch_mm && cpu) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = call_hvc_arch_workaround_1; - processor.switch_mm = cpu_v7_hvc_switch_mm; + cpu_do_switch_mm = cpu_v7_hvc_switch_mm; spectre_v2_method ="hypervisor" ;break ;
@@ -101,11 +95,9 @@ static void cpu_v7_spectre_init(void) ARM_SMCCC_ARCH_WORKAROUND_1, &res);if ((int )res.a0 !=0 )break ; -if (processor.switch_mm != cpu_v7_smc_switch_mm && cpu) - goto bl_error;per_cpu (harden_branch_predictor_fn, cpu) = call_smc_arch_workaround_1; - processor.switch_mm = cpu_v7_smc_switch_mm; + cpu_do_switch_mm = cpu_v7_smc_switch_mm; spectre_v2_method ="firmware" ;break ;
@@ -119,11 +111,6 @@ static void cpu_v7_spectre_init(void)if (spectre_v2_method)pr_info ("CPU%u: Spectre v2: using %s workaround\n" , smp_processor_id(), spectre_v2_method); -return ; - -bl_error: -pr_err ("CPU%u: Spectre v2: incorrect context switching function, system vulnerable\n" , - cpu); }#else static void cpu_v7_spectre_init (void )
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 18/58 ARM: ensure that processor vtables is not lost after boot
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit 3a4d0c2172bcf15b7a3d9d498b2b355f9864286b upstream.
Marek Szyprowski reported problems with CPU hotplug in current kernels. This was tracked down to the processor vtables being located in an init section, and therefore discarded after kernel boot, despite being required after boot to properly initialise the non-boot CPUs.
Arrange for these tables to end up in .rodata when required.
--- arch/arm/mm/proc-macros.S | 10 ++++++++++ 1 file changed, 10 insertions(+)
arch/arm/mm/proc-macros.S +10 -0
@@ -275,6 +275,13 @@ .endm .macro define_processor_functions name:req, dabort:req, pabort:req, nommu=0, suspend=0, bugs=0 +/* + * If we are building for big.Little with branch predictor hardening, + * we need the processor function tables to remain available after boot. + */ +#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) + .section ".rodata" +#endif .type \name\()_processor_functions, #object .align 2 ENTRY(\name\()_processor_functions)
@@ -310,6 +317,9 @@ ENTRY(\name\()_processor_functions) .endif .size \name\()_processor_functions, . - \name\()_processor_functions +#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) + .previous +#endif .endm .macro define_cache_functions name:req
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 19/58 ARM: fix the cockup in the previous patch
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
Commit d6951f582cc50ba0ad22ef46b599740966599b14 upstream.
The intention in the previous patch was to only place the processor tables in the .rodata section if big.Little was being built and we wanted the branch target hardening, but instead (due to the way it was tested) it ended up always placing the tables into the .rodata section.
Although harmless, let's correct this anyway.
--- arch/arm/mm/proc-macros.S | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/proc-macros.S +2 -2
@@ -279,7 +279,7 @@ * If we are building for big.Little with branch predictor hardening, * we need the processor function tables to remain available after boot. */ -#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) +#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) .section ".rodata" #endif .type \name\()_processor_functions, #object
@@ -317,7 +317,7 @@ ENTRY(\name\()_processor_functions) .endif .size \name\()_processor_functions, . - \name\()_processor_functions -#if 1 // defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) +#if defined(CONFIG_BIG_LITTLE) && defined(CONFIG_HARDEN_BRANCH_PREDICTOR) .previous #endif .endm
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 20/58 net: create skb_gso_validate_mac_len()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 2b16f048729bf35e6c28a40cbfad07239f9dcd90 upstream
If you take a GSO skb, and split it into packets, will the MAC length (L2 + L3 + L4 headers + payload) of those packets be small enough to fit within a given length?
Move skb_gso_mac_seglen() to skbuff.h with other related functions like skb_gso_network_seglen() so we can use it, and then create skb_gso_validate_mac_len to do the full calculation.
--- include/linux/skbuff.h | 16 +++++++++++ net/core/skbuff.c | 63 +++++++++++++++++++++++++++++++++--------- net/sched/sch_tbf.c | 10 ------- 3 files changed, 66 insertions(+), 23 deletions(-)
include/linux/skbuff.h +16 -0
@@ -3102,6 +3102,7 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen);void skb_scrub_packet (struct sk_buff *skb,bool xnet);unsigned int skb_gso_transport_seglen (const struct sk_buff *skb);bool skb_gso_validate_mtu (const struct sk_buff *skb,unsigned int mtu); +bool skb_gso_validate_mac_len (const struct sk_buff *skb,unsigned int len);struct sk_buff *skb_segment (struct sk_buff *skb,netdev_features_t features);struct sk_buff *skb_vlan_untag (struct sk_buff *skb);int skb_ensure_writable (struct sk_buff *skb,int write_len);
@@ -3880,6 +3881,21 @@ static inline unsigned int skb_gso_network_seglen(const struct sk_buff *skb)return hdr_len +skb_gso_transport_seglen (skb); } +/** +* skb_gso_mac_seglen - Return length of individual segments of a gso packet +* +* @skb: GSO skb +* +* skb_gso_mac_seglen is used to determine the real size of the +* individual segments, including MAC/L2, Layer3 (IP, IPv6) and L4 +* headers (TCP/UDP). +*/ +static inline unsigned int skb_gso_mac_seglen (const struct sk_buff *skb) +{ +unsigned int hdr_len =skb_transport_header (skb) -skb_mac_header (skb); +return hdr_len +skb_gso_transport_seglen (skb); +} +/* Local Checksum Offload. * Compute outer checksum based on the assumption that the * inner checksum will be offloaded later.
net/core/skbuff.c +50 -13
87 lines not on this page · raw message
net/sched/sch_tbf.c +0 -10
@@ -142,16 +142,6 @@ static u64 psched_ns_t2l(const struct psched_ratecfg *r,return len; } -/* -* Return length of individual segments of a gso packet, -* including all headers (MAC, IP, TCP/UDP) -*/ -static unsigned int skb_gso_mac_seglen (const struct sk_buff *skb) -{ -unsigned int hdr_len =skb_transport_header (skb) -skb_mac_header (skb); -return hdr_len +skb_gso_transport_seglen (skb); -} -/* GSO packet is too big, segment it so that tbf can transmit * each segment in time */
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 21/58 bnx2x: disable GSO where gso_size is too big for hardware
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 8914a595110a6eca69a5e275b323f5d09e18f4f9 upstream
If a bnx2x card is passed a GSO packet with a gso_size larger than ~9700 bytes, it will cause a firmware error that will bring the card down:
bnx2x: [bnx2x_attn_int_deasserted3:4323(enP24p1s0f0)]MC assert!
bnx2x: [bnx2x_mc_assert:720(enP24p1s0f0)]XSTORM_ASSERT_LIST_INDEX 0x2
bnx2x: [bnx2x_mc_assert:736(enP24p1s0f0)]XSTORM_ASSERT_INDEX 0x0 = 0x00000000 0x25e43e47 0x00463e01 0x00010052
bnx2x: [bnx2x_mc_assert:750(enP24p1s0f0)]Chip Revision: everest3, FW Version: 7_13_1
... (dump of values continues) ...
Detect when the mac length of a GSO packet is greater than the maximum packet size (9700 bytes) and disable GSO.
--- .../net/ethernet/broadcom/bnx2x/bnx2x_main.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+)
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +18 -0
@@ -12979,6 +12979,24 @@ static netdev_features_t bnx2x_features_check(struct sk_buff *skb, struct net_device *dev, netdev_features_t features) { +/* +* A skb with gso_size + header length > 9700 will cause a +* firmware panic. Drop GSO support. +* +* Eventually the upper layer should not pass these packets down. +* +* For speed, if the gso_size is <= 9000, assume there will +* not be 700 bytes of headers and pass it through. Only do a +* full (slow) validation if the gso_size is > 9000. +* +* (Due to the way SKB_BY_FRAGS works this will also do a full +* validation in that case.) +*/ +if (unlikely (skb_is_gso (skb) && + (skb_shinfo (skb)->gso_size >9000 ) && + !skb_gso_validate_mac_len (skb,9700 ))) + features &= ~NETIF_F_GSO_MASK ; + features =vlan_features_check (skb, features);return vxlan_features_check (skb, features); }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 22/58 ACPI: NUMA: Use correct type for printing addresses on i386-PAE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b9ced18acf68dffebe6888c7ec765a2b1db7a039 ]
The addresses of NUMA nodes are not printed correctly on i386-PAE which is misleading.
Here is a debian9-32bit with PAE in a QEMU guest having more than 4G of memory:
qemu-system-i386 \
-hda /var/lib/libvirt/images/debian32.qcow2 \
-m 5G \
-enable-kvm \
-smp 10 \
-numa node,mem=512M,nodeid=0,cpus=0 \
-numa node,mem=512M,nodeid=1,cpus=1 \
-numa node,mem=512M,nodeid=2,cpus=2 \
-numa node,mem=512M,nodeid=3,cpus=3 \
-numa node,mem=512M,nodeid=4,cpus=4 \
-numa node,mem=512M,nodeid=5,cpus=5 \
-numa node,mem=512M,nodeid=6,cpus=6 \
-numa node,mem=512M,nodeid=7,cpus=7 \
-numa node,mem=512M,nodeid=8,cpus=8 \
-numa node,mem=512M,nodeid=9,cpus=9 \
-serial stdio
Because of the wrong value type, it prints as below:
[ 0.021049] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled [ 0.021740] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled [ 0.022425] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled [ 0.023092] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled [ 0.023764] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled [ 0.024431] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled [ 0.025104] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled [ 0.025791] ACPI: SRAT Memory (0x0 length 0x20000000) in proximity domain 6 enabled [ 0.026412] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 7 enabled [ 0.027118] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 8 enabled [ 0.027802] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 9 enabled
The upper half of the start address of the NUMA domains between 6 and 9 inclusive was cut, so the printed values are incorrect.
Fix the value type, to get the correct values in the log as follows:
[ 0.023698] ACPI: SRAT Memory (0x0 length 0xa0000) in proximity domain 0 enabled [ 0.024325] ACPI: SRAT Memory (0x100000 length 0x1ff00000) in proximity domain 0 enabled [ 0.024981] ACPI: SRAT Memory (0x20000000 length 0x20000000) in proximity domain 1 enabled [ 0.025659] ACPI: SRAT Memory (0x40000000 length 0x20000000) in proximity domain 2 enabled [ 0.026317] ACPI: SRAT Memory (0x60000000 length 0x20000000) in proximity domain 3 enabled [ 0.026980] ACPI: SRAT Memory (0x80000000 length 0x20000000) in proximity domain 4 enabled [ 0.027635] ACPI: SRAT Memory (0xa0000000 length 0x20000000) in proximity domain 5 enabled [ 0.028311] ACPI: SRAT Memory (0x100000000 length 0x20000000) in proximity domain 6 enabled [ 0.028985] ACPI: SRAT Memory (0x120000000 length 0x20000000) in proximity domain 7 enabled [ 0.029667] ACPI: SRAT Memory (0x140000000 length 0x20000000) in proximity domain 8 enabled [ 0.030334] ACPI: SRAT Memory (0x160000000 length 0x20000000) in proximity domain 9 enabled
--- drivers/acpi/numa.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/acpi/numa.c +3 -3
@@ -147,9 +147,9 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header) {struct acpi_srat_mem_affinity *p = (struct acpi_srat_mem_affinity *)header; - pr_debug("SRAT Memory (0x%lx length 0x%lx) in proximity domain %d %s%s%s\n", - (unsigned long)p->base_address, - (unsigned long)p->length, + pr_debug("SRAT Memory (0x%llx length 0x%llx) in proximity domain %d %s%s%s\n", + (unsigned long long)p->base_address, + (unsigned long long)p->length, p->proximity_domain, (p->flags & ACPI_SRAT_MEM_ENABLED) ? "enabled" : "disabled",
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 23/58 cpufreq: check if policy is inactive early in __cpufreq_get()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 2f66196208c98b3d1b4294edffb2c5a8197be899 ]
cpuinfo_cur_freq gets current CPU frequency as detected by hardware while scaling_cur_freq last known CPU frequency. Some platforms may not allow checking the CPU frequency of an offline CPU or the associated resources may have been released via cpufreq_exit when the CPU gets offlined, in which case the policy would have been invalidated already. If we attempt to get current frequency from the hardware, it may result in hang or crash.
For example on Juno, I see:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000188 [0000000000000188] pgd=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP Modules linked in: CPU: 5 PID: 4202 Comm: cat Not tainted 4.20.0-08251-ga0f2c0318a15-dirty #87 Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform pstate: 40000005 (nZcv daif -PAN -UAO) pc : scmi_cpufreq_get_rate+0x34/0xb0 lr : scmi_cpufreq_get_rate+0x34/0xb0 Call trace: scmi_cpufreq_get_rate+0x34/0xb0 __cpufreq_get+0x34/0xc0 show_cpuinfo_cur_freq+0x24/0x78 show+0x40/0x60 sysfs_kf_seq_show+0xc0/0x148 kernfs_seq_show+0x44/0x50 seq_read+0xd4/0x480 kernfs_fop_read+0x15c/0x208 __vfs_read+0x60/0x188 vfs_read+0x94/0x150 ksys_read+0x6c/0xd8 __arm64_sys_read+0x24/0x30 el0_svc_common+0x78/0x100 el0_svc_handler+0x38/0x78 el0_svc+0x8/0xc ---[ end trace 3d1024e58f77f6b2 ]---
So fix the issue by checking if the policy is invalid early in __cpufreq_get before attempting to get the current frequency.
--- drivers/cpufreq/cpufreq.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-)
drivers/cpufreq/cpufreq.c +3 -4
@@ -1496,17 +1496,16 @@ static unsigned int __cpufreq_get(struct cpufreq_policy *policy) {unsigned int ret_freq =0 ; -if (!cpufreq_driver->get) +if (unlikely (policy_is_inactive (policy)) || !cpufreq_driver->get)return ret_freq; ret_freq = cpufreq_driver->get (policy->cpu);/* -* Updating inactive policies is invalid, so avoid doing that. Also -* if fast frequency switching is used with the given policy, the check +* If fast frequency switching is used with the given policy, the check * against policy->cur is pointless, so skip it in that case too. */ -if (unlikely (policy_is_inactive (policy)) || policy->fast_switch_enabled) +if (policy->fast_switch_enabled)return ret_freq; if (ret_freq && policy->cur &&
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 24/58 drm/bridge: tc358767: add defines for DP1_SRCCTRL & PHY_2LANE
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit adf4109896bbee27fd2ac3b48d22d6a0062fe517 ]
DP1_SRCCTRL register and PHY_2LANE field did not have matching defines. Add these.
--- drivers/gpu/drm/bridge/tc358767.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/tc358767.c +7 -3
@@ -140,6 +140,8 @@#define DP0_LTLOOPCTRL 0x06d8#define DP0_SNKLTCTRL 0x06e4 +#define DP1_SRCCTRL 0x07a0 +/* PHY */ #define DP_PHY_CTRL 0x0800#define DP_PHY_RST BIT(28)/* DP PHY Global Soft Reset */
@@ -148,6 +150,7 @@#define PHY_M1_RST BIT(12)/* Reset PHY1 Main Channel */ #define PHY_RDY BIT(16)/* PHY Main Channels Ready */ #define PHY_M0_RST BIT(8)/* Reset PHY0 Main Channel */ +#define PHY_2LANE BIT(2)/* PHY Enable 2 lanes */ #define PHY_A0_EN BIT(1)/* PHY Aux Channel0 Enable */ #define PHY_M0_EN BIT(0)/* PHY Main Channel0 Enable */
@@ -562,7 +565,7 @@ static int tc_aux_link_setup(struct tc_data *tc) value |=SYSCLK_SEL_LSCLK |LSCLK_DIV_2 ;tc_write (SYS_PLLPARAM , value); -tc_write (DP_PHY_CTRL ,BGREN |PWR_SW_EN |BIT (2 ) |PHY_A0_EN ); +tc_write (DP_PHY_CTRL ,BGREN |PWR_SW_EN |PHY_2LANE |PHY_A0_EN );/* * Initially PLLs are in bypass. Force PLL parameter update,
@@ -832,7 +835,7 @@ static int tc_main_link_setup(struct tc_data *tc)DP0_SRCCTRL_LANESKEW |DP0_SRCCTRL_LANES_2 | DP0_SRCCTRL_BW27 | DP0_SRCCTRL_AUTOCORRECT);/* from excel file - DP1_SrcCtrl */ -tc_write (0x07a0 ,0x00003083 ); +tc_write (DP1_SRCCTRL ,0x00003083 ); rate =clk_get_rate (tc->refclk);switch (rate) {
@@ -853,8 +856,9 @@ static int tc_main_link_setup(struct tc_data *tc) } value |=SYSCLK_SEL_LSCLK |LSCLK_DIV_2 ;tc_write (SYS_PLLPARAM , value); +/* Setup Main Link */ - dp_phy_ctrl =BGREN |PWR_SW_EN |BIT (2 ) |PHY_A0_EN |PHY_M0_EN ; + dp_phy_ctrl =BGREN |PWR_SW_EN |PHY_2LANE |PHY_A0_EN |PHY_M0_EN ;tc_write (DP_PHY_CTRL , dp_phy_ctrl);msleep (100 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 25/58 drm/bridge: tc358767: fix single lane configuration
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4d9d54a730434cc068dd3515ba6116697196f77b ]
PHY_2LANE bit is always set in DP_PHY_CTRL, breaking 1 lane use.
Set PHY_2LANE only when 2 lanes are used.
--- drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/tc358767.c +8 -2
@@ -541,6 +541,7 @@ static int tc_aux_link_setup(struct tc_data *tc)unsigned long rate;u32 value;int ret; +u32 dp_phy_ctrl; rate =clk_get_rate (tc->refclk);switch (rate) {
@@ -565,7 +566,10 @@ static int tc_aux_link_setup(struct tc_data *tc) value |=SYSCLK_SEL_LSCLK |LSCLK_DIV_2 ;tc_write (SYS_PLLPARAM , value); -tc_write (DP_PHY_CTRL ,BGREN |PWR_SW_EN |PHY_2LANE |PHY_A0_EN ); + dp_phy_ctrl =BGREN |PWR_SW_EN |PHY_A0_EN ; +if (tc->link.base.num_lanes ==2 ) + dp_phy_ctrl |=PHY_2LANE ; +tc_write (DP_PHY_CTRL , dp_phy_ctrl);/* * Initially PLLs are in bypass. Force PLL parameter update,
@@ -858,7 +862,9 @@ static int tc_main_link_setup(struct tc_data *tc)tc_write (SYS_PLLPARAM , value);/* Setup Main Link */ - dp_phy_ctrl =BGREN |PWR_SW_EN |PHY_2LANE |PHY_A0_EN |PHY_M0_EN ; + dp_phy_ctrl =BGREN |PWR_SW_EN |PHY_A0_EN |PHY_M0_EN ; +if (tc->link.base.num_lanes ==2 ) + dp_phy_ctrl |=PHY_2LANE ;tc_write (DP_PHY_CTRL , dp_phy_ctrl);msleep (100 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 26/58 drm/bridge: tc358767: fix initial DP0/1_SRCCTRL value
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 9a63bd6fe1b5590ffa42ae2ed22ee21363293e31 ]
Initially DP0_SRCCTRL is set to a static value which includes DP0_SRCCTRL_LANES_2 and DP0_SRCCTRL_BW27, even when only 1 lane of 1.62Gbps speed is used. DP1_SRCCTRL is configured to a magic number.
This patch changes the configuration as follows:
Configure DP0_SRCCTRL by using tc_srcctrl() which provides the correct value.
DP1_SRCCTRL needs two bits to be set to the same value as DP0_SRCCTRL:
SSCG and BW27. All other bits can be zero.
--- drivers/gpu/drm/bridge/tc358767.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
drivers/gpu/drm/bridge/tc358767.c +5 -6
@@ -834,12 +834,11 @@ static int tc_main_link_setup(struct tc_data *tc)if (!tc->mode)return -EINVAL ; -/* from excel file - DP0_SrcCtrl */ -tc_write (DP0_SRCCTRL ,DP0_SRCCTRL_SCRMBLDIS |DP0_SRCCTRL_EN810B | -DP0_SRCCTRL_LANESKEW |DP0_SRCCTRL_LANES_2 | -DP0_SRCCTRL_BW27 |DP0_SRCCTRL_AUTOCORRECT ); -/* from excel file - DP1_SrcCtrl */ -tc_write (DP1_SRCCTRL ,0x00003083 ); +tc_write (DP0_SRCCTRL ,tc_srcctrl (tc)); +/* SSCG and BW27 on DP1 must be set to the same as on DP0 */ +tc_write (DP1_SRCCTRL , + (tc->link.spread ?DP0_SRCCTRL_SSCG :0 ) | + ((tc->link.base.rate !=162000 ) ?DP0_SRCCTRL_BW27 :0 )); rate =clk_get_rate (tc->refclk);switch (rate) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 27/58 drm/bridge: tc358767: reject modes which require too much BW
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 51b9e62eb6950c762162ab7eb8390990179be067 ]
The current driver accepts any videomode with pclk < 154MHz. This is not correct, as with 1 lane and/or 1.62Mbps speed not all videomodes can be supported.
Add code to reject modes that require more bandwidth that is available.
--- drivers/gpu/drm/bridge/tc358767.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
drivers/gpu/drm/bridge/tc358767.c +10 -0
@@ -1118,10 +1118,20 @@ static bool tc_bridge_mode_fixup(struct drm_bridge *bridge,static int tc_connector_mode_valid (struct drm_connector *connector,struct drm_display_mode *mode) { +struct tc_data *tc =connector_to_tc (connector); +u32 req, avail; +u32 bits_per_pixel =24 ; +/* DPI interface clock limitation: upto 154 MHz */ if (mode->clock >154000 )return MODE_CLOCK_HIGH ; + req = mode->clock * bits_per_pixel /8 ; + avail = tc->link.base.num_lanes * tc->link.base.rate; + +if (req > avail) +return MODE_BAD ; +return MODE_OK ; }
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 28/58 drm/bridge: tc358767: fix output H/V syncs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7923e09c7a766e2d58de7fc395bb84c18e5bc625 ]
The H and V syncs of the DP output are always set to active high. This patch fixes the syncs by configuring them according to the videomode.
--- drivers/gpu/drm/bridge/tc358767.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/gpu/drm/bridge/tc358767.c +5 -1
@@ -96,6 +96,8 @@#define DP0_STARTVAL 0x064c#define DP0_ACTIVEVAL 0x0650#define DP0_SYNCVAL 0x0654 +#define SYNCVAL_HS_POL_ACTIVE_LOW (1 << 15) +#define SYNCVAL_VS_POL_ACTIVE_LOW (1 << 31)#define DP0_MISC 0x0658#define TU_SIZE_RECOMMENDED (63)/* LSCLK cycles per TU */ #define BPC_6 (0 << 5)
@@ -724,7 +726,9 @@ static int tc_set_video_mode(struct tc_data *tc, struct drm_display_mode *mode)tc_write (DP0_ACTIVEVAL , (mode->vdisplay <<16 ) | (mode->hdisplay)); -tc_write (DP0_SYNCVAL , (vsync_len <<16 ) | (hsync_len <<0 )); +tc_write (DP0_SYNCVAL , (vsync_len <<16 ) | (hsync_len <<0 ) | + ((mode->flags &DRM_MODE_FLAG_NHSYNC ) ?SYNCVAL_HS_POL_ACTIVE_LOW :0 ) | + ((mode->flags &DRM_MODE_FLAG_NVSYNC ) ?SYNCVAL_VS_POL_ACTIVE_LOW :0 ));tc_write (DPIPXLFMT ,VS_POL_ACTIVE_LOW |HS_POL_ACTIVE_LOW |DE_POL_ACTIVE_HIGH |SUB_CFG_TYPE_CONFIG1 |DPI_BPP_RGB888 );
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 29/58 ARM: dts: da850-evm: Correct the sound card name
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 7fca69d4e43fa1ae9cb4f652772c132dc5a659c6 ]
To avoid the following error:
asoc-simple-card sound: ASoC: Failed to create card debugfs directory
Which is because the card name contains '/' character, which can not be used in file or directory names.
--- arch/arm/boot/dts/da850-evm.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/da850-evm.dts +1 -1
@@ -156,7 +156,7 @@ sound { compatible = "simple-audio-card"; - simple-audio-card,name = "DA850/OMAP-L138 EVM"; + simple-audio-card,name = "DA850-OMAPL138 EVM"; simple-audio-card,widgets = "Line", "Line In", "Line", "Line Out";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 30/58 ARM: dts: da850-lcdk: Correct the sound card name
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit c25748acc5c20786ecb7518bfeae8fcef93472d6 ]
To avoid the following error:
asoc-simple-card sound: ASoC: Failed to create card debugfs directory
Which is because the card name contains '/' character, which can not be used in file or directory names.
--- arch/arm/boot/dts/da850-lcdk.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/da850-lcdk.dts +1 -1
@@ -26,7 +26,7 @@ sound { compatible = "simple-audio-card"; - simple-audio-card,name = "DA850/OMAP-L138 LCDK"; + simple-audio-card,name = "DA850-OMAPL138 LCDK"; simple-audio-card,widgets = "Line", "Line In", "Line", "Line Out";
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 31/58 ARM: dts: kirkwood: Fix polarity of GPIO fan lines
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit b5f034845e70916fd33e172fad5ad530a29c10ab ]
These two lines are active high, not active low. The bug was found when we changed the kernel to respect the polarity defined in the device tree.
--- arch/arm/boot/dts/kirkwood-dnskw.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/boot/dts/kirkwood-dnskw.dtsi +2 -2
@@ -35,8 +35,8 @@ compatible = "gpio-fan"; pinctrl-0 = <&pmx_fan_high_speed &pmx_fan_low_speed>; pinctrl-names = "default"; - gpios = <&gpio1 14 GPIO_ACTIVE_LOW - &gpio1 13 GPIO_ACTIVE_LOW>; + gpios = <&gpio1 14 GPIO_ACTIVE_HIGH + &gpio1 13 GPIO_ACTIVE_HIGH>; gpio-fan,speed-map = <0 0 3000 1 6000 2>;
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 32/58 gpio: pl061: handle failed allocations
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit df209c43a0e8258e096fb722dfbdae4f0dd13fde ]
devm_kzalloc(), devm_kstrdup() and devm_kasprintf() all can fail internal allocation and return NULL. Using any of the assigned objects without checking is not safe. As this is early in the boot phase and these allocations really should not fail, any failure here is probably an indication of a more serious issue so it makes little sense to try and rollback the previous allocated resources or try to continue; but rather the probe function is simply exited with -ENOMEM.
--- arch/arm/mach-integrator/impd1.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
arch/arm/mach-integrator/impd1.c +5 -1
@@ -394,7 +394,11 @@ static int __ref impd1_probe(struct lm_device *dev)sizeof (*lookup) +3 *sizeof (struct gpiod_lookup ), GFP_KERNEL); chipname =devm_kstrdup (&dev->dev, devname,GFP_KERNEL ); - mmciname =kasprintf (GFP_KERNEL ,"lm%x:00700" , dev->id); + mmciname =devm_kasprintf (&dev->dev,GFP_KERNEL , +"lm%x:00700" , dev->id); +if (!lookup || !chipname || !mmciname) +return -ENOMEM ; + lookup->dev_id = mmciname;/* * Offsets on GPIO block 1:
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 33/58 cifs: Limit memory used by lock request calls to a page
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 92a8109e4d3a34fb6b115c9098b51767dc933444 ]
The code tries to allocate a contiguous buffer with a size supplied by the server (maxBuf). This could fail if memory is fragmented since it results in high order allocations for commonly used server implementations. It is also wasteful since there are probably few locks in the usual case. Limit the buffer to be no larger than a page to avoid memory allocation failures due to fragmentation.
--- fs/cifs/file.c | 8 ++++++++ fs/cifs/smb2file.c | 4 ++++ 2 files changed, 12 insertions(+)
fs/cifs/file.c +8 -0
@@ -1126,6 +1126,10 @@ cifs_push_mandatory_locks(struct cifsFileInfo *cfile)return -EINVAL ; } +BUILD_BUG_ON (sizeof (struct smb_hdr ) +sizeof (LOCKING_ANDX_RANGE ) > +PAGE_SIZE ); + max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), +PAGE_SIZE ); max_num = (max_buf -sizeof (struct smb_hdr )) /sizeof (LOCKING_ANDX_RANGE ); buf =kcalloc (max_num,sizeof (LOCKING_ANDX_RANGE ),GFP_KERNEL );
@@ -1462,6 +1466,10 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,if (max_buf < (sizeof (struct smb_hdr ) +sizeof (LOCKING_ANDX_RANGE )))return -EINVAL ; +BUILD_BUG_ON (sizeof (struct smb_hdr ) +sizeof (LOCKING_ANDX_RANGE ) > +PAGE_SIZE ); + max_buf = min_t(unsigned int, max_buf - sizeof(struct smb_hdr), +PAGE_SIZE ); max_num = (max_buf -sizeof (struct smb_hdr )) /sizeof (LOCKING_ANDX_RANGE ); buf =kcalloc (max_num,sizeof (LOCKING_ANDX_RANGE ),GFP_KERNEL );
fs/cifs/smb2file.c +4 -0
@@ -129,6 +129,8 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,if (max_buf <sizeof (struct smb2_lock_element ))return -EINVAL ; +BUILD_BUG_ON (sizeof (struct smb2_lock_element ) >PAGE_SIZE ); + max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); max_num = max_buf /sizeof (struct smb2_lock_element ); buf =kcalloc (max_num,sizeof (struct smb2_lock_element ),GFP_KERNEL );if (!buf)
@@ -265,6 +267,8 @@ smb2_push_mandatory_locks(struct cifsFileInfo *cfile)return -EINVAL ; } +BUILD_BUG_ON (sizeof (struct smb2_lock_element ) >PAGE_SIZE ); + max_buf = min_t(unsigned int, max_buf, PAGE_SIZE); max_num = max_buf /sizeof (struct smb2_lock_element ); buf =kcalloc (max_num,sizeof (struct smb2_lock_element ),GFP_KERNEL );if (!buf) {
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 34/58 perf report: Include partial stacks unwound with libdw
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
commit 5ea0416f51cc93436bbe497c62ab49fd9cb245b6 upstream.
So far the whole stack was thrown away when any error occurred before the maximum stack depth was unwound. This is actually a very common scenario though. The stacks that got unwound so far are still interesting. This removes a large chunk of differences when comparing perf script output for libunwind and libdw perf unwinding.
E.g. with libunwind:
~~~~~heaptrack_gui 2228 135073.388524: 479408 cycles:
ffffffff811749ed perf_iterate_ctx ([kernel.kallsyms])
ffffffff81181662 perf_event_mmap ([kernel.kallsyms])
ffffffff811cf5ed mmap_region ([kernel.kallsyms])
ffffffff811cfe6b do_mmap ([kernel.kallsyms])
ffffffff811b0dca vm_mmap_pgoff ([kernel.kallsyms])
ffffffff811cdb0c sys_mmap_pgoff ([kernel.kallsyms])
ffffffff81033acb sys_mmap ([kernel.kallsyms])
ffffffff81631d37 entry_SYSCALL_64_fastpath ([kernel.kallsyms])
192ca mmap64 (/usr/lib/ld-2.25.so)
59a9 _dl_map_object_from_fd (/usr/lib/ld-2.25.so)
83d0 _dl_map_object (/usr/lib/ld-2.25.so)
cda1 openaux (/usr/lib/ld-2.25.so)
1834f _dl_catch_error (/usr/lib/ld-2.25.so)
cfe2 _dl_map_object_deps (/usr/lib/ld-2.25.so)
3481 dl_main (/usr/lib/ld-2.25.so)
17387 _dl_sysdep_start (/usr/lib/ld-2.25.so)
4d37 _dl_start (/usr/lib/ld-2.25.so)
d87 _start (/usr/lib/ld-2.25.so)heaptrack_gui 2228 135073.388677: 611329 cycles:
1a3e0 strcmp (/usr/lib/ld-2.25.so)
82b2 _dl_map_object (/usr/lib/ld-2.25.so)
cda1 openaux (/usr/lib/ld-2.25.so)
1834f _dl_catch_error (/usr/lib/ld-2.25.so)
cfe2 _dl_map_object_deps (/usr/lib/ld-2.25.so)
3481 dl_main (/usr/lib/ld-2.25.so)
17387 _dl_sysdep_start (/usr/lib/ld-2.25.so)
4d37 _dl_start (/usr/lib/ld-2.25.so)
d87 _start (/usr/lib/ld-2.25.so)~~~~~
With libdw without this patch:
~~~~~heaptrack_gui 2228 135073.388524: 479408 cycles:
ffffffff811749ed perf_iterate_ctx ([kernel.kallsyms]) ffffffff81181662 perf_event_mmap ([kernel.kallsyms]) ffffffff811cf5ed mmap_region ([kernel.kallsyms]) ffffffff811cfe6b do_mmap ([kernel.kallsyms]) ffffffff811b0dca vm_mmap_pgoff ([kernel.kallsyms]) ffffffff811cdb0c sys_mmap_pgoff ([kernel.kallsyms]) ffffffff81033acb sys_mmap ([kernel.kallsyms]) ffffffff81631d37 entry_SYSCALL_64_fastpath ([kernel.kallsyms])
heaptrack_gui 2228 135073.388677: 611329 cycles:
~~~~~
With this patch applied, the libdw unwinder will produce the same output as the libunwind unwinder.
--- tools/perf/util/unwind-libdw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/unwind-libdw.c +1 -1
@@ -231,7 +231,7 @@ int unwind__get_entries(unwind_entry_cb_t cb, void *arg, err =dwfl_getthread_frames (ui->dwfl, thread->tid, frame_callback, ui); -if (err && !ui->max_stack) +if (err && ui->max_stack != max_stack) err =0 ;/*
Signature · 1 line
2.19.1
Greg Kroah-Hartman
maintainerPATCH 35/58 Revert "Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G"
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <[email protected]>
commit f420c54e4b12c1361c6ed313002ee7bd7ac58362 upstream.
This reverts commit 7db54c89f0b30a101584e09d3729144e6170059d as it breaks Acer Aspire V-371 and other devices. According to Elan:
"Acer Aspire F5-573G is MS Precision touchpad which should use hid
multitouch driver. ELAN0501 should not be added in elan_i2c."
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=202503
--- drivers/input/mouse/elan_i2c_core.c | 1 - 1 file changed, 1 deletion(-)
drivers/input/mouse/elan_i2c_core.c +0 -1
@@ -1240,7 +1240,6 @@ MODULE_DEVICE_TABLE(i2c, elan_id);static const struct acpi_device_id elan_acpi_id[] = { {"ELAN0000" ,0 }, {"ELAN0100" ,0 }, - {"ELAN0501" ,0 }, {"ELAN0600" ,0 }, {"ELAN0602" ,0 }, {"ELAN0605" ,0 },
Greg Kroah-Hartman
maintainerPATCH 36/58 Input: elan_i2c - add ACPI ID for touchpad in Lenovo V330-15ISK
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Ciancio <[email protected]>
commit 7ad222b3aed350adfc27ee7eec4587ffe55dfdce upstream.
This adds ELAN0617 to the ACPI table to support Elan touchpad found in Lenovo V330-15ISK.
--- drivers/input/mouse/elan_i2c_core.c | 1 + 1 file changed, 1 insertion(+)
drivers/input/mouse/elan_i2c_core.c +1 -0
@@ -1250,6 +1250,7 @@ static const struct acpi_device_id elan_ { "ELAN060C", 0 }, { "ELAN0611", 0 }, { "ELAN0612", 0 }, + { "ELAN0617", 0 }, { "ELAN0618", 0 }, { "ELAN061C", 0 }, { "ELAN061D", 0 },
Greg Kroah-Hartman
maintainerPATCH 37/58 perf/core: Fix impossible ring-buffer sizes warning
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ingo Molnar <[email protected]>
commit 528871b456026e6127d95b1b2bd8e3a003dc1614 upstream.
The following commit:
9dff0aa95a32 ("perf/core: Don't WARN() for impossible ring-buffer sizes")
results in perf recording failures with larger mmap areas:
root@skl:/tmp# perf record -g -a failed to mmap with 12 (Cannot allocate memory)
The root cause is that the following condition is buggy:
if (order_base_2(size) >= MAX_ORDER) goto fail;
The problem is that @size is in bytes and MAX_ORDER is in pages, so the right test is:
if (order_base_2(size) >= PAGE_SHIFT+MAX_ORDER) goto fail;
Fix it.
--- kernel/events/ring_buffer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/events/ring_buffer.c +1 -1
@@ -700,7 +700,7 @@ struct ring_buffer *rb_alloc(int nr_page size =sizeof (struct ring_buffer ); size += nr_pages *sizeof (void *); -if (order_base_2 (size) >=MAX_ORDER ) +if (order_base_2 (size) >=PAGE_SHIFT +MAX_ORDER ) goto fail; rb =kzalloc (size,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 38/58 perf/x86: Add check_period PMU callback
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <[email protected]>
commit 81ec3f3c4c4d78f2d3b6689c9816bfbdf7417dbb upstream.
Vince (and later on Ravi) reported crashes in the BTS code during fuzzing with the following backtrace:
general protection fault: 0000 [#1] SMP PTI ... RIP: 0010:perf_prepare_sample+0x8f/0x510 ... Call Trace: <IRQ> ? intel_pmu_drain_bts_buffer+0x194/0x230 intel_pmu_drain_bts_buffer+0x160/0x230 ? tick_nohz_irq_exit+0x31/0x40 ? smp_call_function_single_interrupt+0x48/0xe0 ? call_function_single_interrupt+0xf/0x20 ? call_function_single_interrupt+0xa/0x20 ? x86_schedule_events+0x1a0/0x2f0 ? x86_pmu_commit_txn+0xb4/0x100 ? find_busiest_group+0x47/0x5d0 ? perf_event_set_state.part.42+0x12/0x50 ? perf_mux_hrtimer_restart+0x40/0xb0 intel_pmu_disable_event+0xae/0x100 ? intel_pmu_disable_event+0xae/0x100 x86_pmu_stop+0x7a/0xb0 x86_pmu_del+0x57/0x120 event_sched_out.isra.101+0x83/0x180 group_sched_out.part.103+0x57/0xe0 ctx_sched_out+0x188/0x240 ctx_resched+0xa8/0xd0 __perf_event_enable+0x193/0x1e0 event_function+0x8e/0xc0 remote_function+0x41/0x50 flush_smp_call_function_queue+0x68/0x100 generic_smp_call_function_single_interrupt+0x13/0x30 smp_call_function_single_interrupt+0x3e/0xe0 call_function_single_interrupt+0xf/0x20 </IRQ>
The reason is that while event init code does several checks for BTS events and prevents several unwanted config bits for BTS event (like precise_ip), the PERF_EVENT_IOC_PERIOD allows to create BTS event without those checks being done.
Following sequence will cause the crash:
If we create an 'almost' BTS event with precise_ip and callchains, and it into a BTS event it will crash the perf_prepare_sample() function because precise_ip events are expected to come in with callchain data initialized, but that's not the case for intel_pmu_drain_bts_buffer() caller.
Adding a check_period callback to be called before the period is changed via PERF_EVENT_IOC_PERIOD. It will deny the change if the event would become BTS. Plus adding also the limit_period check as well.
--- arch/x86/events/core.c | 14 ++++++++++++++ arch/x86/events/intel/core.c | 9 +++++++++ arch/x86/events/perf_event.h | 16 ++++++++++++++-- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 16 ++++++++++++++++ 5 files changed, 58 insertions(+), 2 deletions(-)
arch/x86/events/core.c +14 -0
@@ -2196,6 +2196,19 @@ void perf_check_microcode(void) }EXPORT_SYMBOL_GPL (perf_check_microcode); +static int x86_pmu_check_period (struct perf_event *event,u64 value) +{ +if (x86_pmu.check_period && x86_pmu.check_period (event, value)) +return -EINVAL ; + +if (value && x86_pmu.limit_period) { +if (x86_pmu.limit_period (event, value) > value) +return -EINVAL ; + } + +return 0 ; +} +static struct pmu pmu = { .pmu_enable = x86_pmu_enable, .pmu_disable = x86_pmu_disable,
@@ -2220,6 +2233,7 @@ static struct pmu pmu = { .event_idx = x86_pmu_event_idx, .sched_task = x86_pmu_sched_task, .task_ctx_size = sizeof(struct x86_perf_task_context), + .check_period = x86_pmu_check_period, }; void arch_perf_update_userpage(struct perf_event *event,
arch/x86/events/intel/core.c +9 -0
@@ -3262,6 +3262,11 @@ static void intel_pmu_sched_task(structintel_pmu_lbr_sched_task (ctx, sched_in); } +static int intel_pmu_check_period (struct perf_event *event,u64 value) +{ +return intel_pmu_has_bts_period (event, value) ? -EINVAL :0 ; +} +PMU_FORMAT_ATTR (offcore_rsp,"config1:0-63" );PMU_FORMAT_ATTR (ldlat,"config1:0-15" );
@@ -3328,6 +3333,8 @@ static __initconst const struct x86_pmu .cpu_starting = intel_pmu_cpu_starting, .cpu_dying = intel_pmu_cpu_dying, .cpu_dead = intel_pmu_cpu_dead, + + .check_period = intel_pmu_check_period, };static __initconst const struct x86_pmu intel_pmu = {
@@ -3367,6 +3374,8 @@ static __initconst const struct x86_pmu .guest_get_msrs = intel_guest_get_msrs, .sched_task = intel_pmu_sched_task, + + .check_period = intel_pmu_check_period, };static __init void intel_clovertown_quirk (void )
arch/x86/events/perf_event.h +14 -2
@@ -626,6 +626,11 @@ struct x86_pmu {* Intel host/guest support (KVM) */ struct perf_guest_switch_msr *(*guest_get_msrs)(int *nr); + +/* +* Check period value for PERF_EVENT_IOC_PERIOD ioctl. +*/ +int (*check_period) (struct perf_event *event,u64 period); };struct x86_perf_task_context {
@@ -833,7 +838,7 @@ static inline int amd_pmu_init(void)#ifdef CONFIG_CPU_SUP_INTEL -static inline bool intel_pmu_has_bts (struct perf_event *event) +static inline bool intel_pmu_has_bts_period (struct perf_event *event,u64 period) {struct hw_perf_event *hwc = &event->hw;unsigned int hw_event, bts_event;
@@ -844,7 +849,14 @@ static inline bool intel_pmu_has_bts(str hw_event = hwc->config &INTEL_ARCH_EVENT_MASK ; bts_event = x86_pmu.event_map (PERF_COUNT_HW_BRANCH_INSTRUCTIONS ); -return hw_event == bts_event && hwc->sample_period ==1 ; +return hw_event == bts_event && period ==1 ; +} + +static inline bool intel_pmu_has_bts (struct perf_event *event) +{ +struct hw_perf_event *hwc = &event->hw; + +return intel_pmu_has_bts_period (event, hwc->sample_period); }int intel_pmu_save_and_restart (struct perf_event *event);
include/linux/perf_event.h +5 -0
@@ -455,6 +455,11 @@ struct pmu {* Filter events for PMU-specific reasons. */ int (*filter_match) (struct perf_event *event);/* optional */ + +/* +* Check period value for PERF_EVENT_IOC_PERIOD ioctl. +*/ +int (*check_period) (struct perf_event *event,u64 value);/* optional */ };/**
kernel/events/core.c +16 -0
@@ -4600,6 +4600,11 @@ static void __perf_event_period(struct p } } +static int perf_event_check_period (struct perf_event *event,u64 value) +{ +return event->pmu->check_period (event, value); +} +static int perf_event_period (struct perf_event *event,u64 __user *arg) {u64 value;
@@ -4616,6 +4621,9 @@ static int perf_event_period(struct perfif (event->attr.freq && value > sysctl_perf_event_sample_rate)return -EINVAL ; +if (perf_event_check_period (event, value)) +return -EINVAL ; +event_function_call (event, __perf_event_period, &value);return 0 ;
@@ -8622,6 +8630,11 @@ static int perf_pmu_nop_int(struct pmu *return 0 ; } +static int perf_event_nop_int (struct perf_event *event,u64 value) +{ +return 0 ; +} + static DEFINE_PER_CPU(unsigned int, nop_txn_flags);static void perf_pmu_start_txn (struct pmu *pmu,unsigned int flags)
@@ -8944,6 +8957,9 @@ got_cpu_context: pmu->pmu_disable = perf_pmu_nop_void; } +if (!pmu->check_period) + pmu->check_period = perf_event_nop_int; +if (!pmu->event_idx) pmu->event_idx = perf_event_idx_default;
Greg Kroah-Hartman
maintainerPATCH 39/58 ALSA: hda - Add quirk for HP EliteBook 840 G5
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jurica Vukadin <[email protected]>
commit 4cd3016ce996494f78fdfd87ea35c8ca5d0b413e upstream.
This enables mute LED support and fixes switching jacks when the laptop is docked.
--- sound/pci/hda/patch_conexant.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_conexant.c +1 -0
@@ -854,6 +854,7 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x103c ,0x807C ,"HP EliteBook 820 G3" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x80FD ,"HP ProBook 640 G2" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x828c ,"HP EliteBook 840 G4" ,CXT_FIXUP_HP_DOCK ), +SND_PCI_QUIRK (0x103c ,0x83b2 ,"HP EliteBook 840 G5" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x83b3 ,"HP EliteBook 830 G5" ,CXT_FIXUP_HP_DOCK ),SND_PCI_QUIRK (0x103c ,0x83d3 ,"HP ProBook 640 G4" ,CXT_FIXUP_HP_DOCK ), SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
Greg Kroah-Hartman
maintainerPATCH 40/58 ALSA: usb-audio: Fix implicit fb endpoint setup by quirk
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manuel Reinhardt <[email protected]>
commit 2bc16b9f3223d049b57202ee702fcb5b9b507019 upstream.
The commit a60945fd08e4 ("ALSA: usb-audio: move implicit fb quirks to separate function") introduced an error in the handling of quirks for implicit feedback endpoints. This commit fixes this.
If a quirk successfully sets up an implicit feedback endpoint, usb-audio no longer tries to find the implicit fb endpoint itself.
--- sound/usb/pcm.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
sound/usb/pcm.c +8 -1
@@ -313,6 +313,9 @@ static int search_roland_implicit_fb(strreturn 0 ; } +/* Setup an implicit feedback endpoint from a quirk. Returns 0 if no quirk +* applies. Returns 1 if a quirk was found. +*/ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, struct usb_device *dev, struct usb_interface_descriptor *altsd,
@@ -391,7 +394,7 @@ add_sync_ep: subs->data_endpoint->sync_master = subs->sync_endpoint; -return 0 ; +return 1 ; } static int set_sync_endpoint(struct snd_usb_substream *subs,
@@ -430,6 +433,10 @@ static int set_sync_endpoint(struct snd_if (err <0 )return err; +/* endpoint set by quirk */ +if (err >0 ) +return 0 ; +if (altsd->bNumEndpoints <2 )return 0 ;
Greg Kroah-Hartman
maintainerPATCH 41/58 kvm: vmx: Fix entry number check for add_atomic_switch_msr()
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaoyao Li <[email protected]>
commit 98ae70cc476e833332a2c6bb72f941a25f0de226 upstream.
Commit ca83b4a7f2d068da79a0 ("x86/KVM/VMX: Add find_msr() helper function") introduces the helper function find_msr(), which returns -ENOENT when not find the msr in vmx->msr_autoload.guest/host. Correct checking contion of no more available entry in vmx->msr_autoload.
--- arch/x86/kvm/vmx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/x86/kvm/vmx.c +2 -1
@@ -2178,7 +2178,8 @@ static void add_atomic_switch_msr(structif (!entry_only) j =find_msr (&m->host, msr); -if (i ==NR_AUTOLOAD_MSRS || j ==NR_AUTOLOAD_MSRS ) { +if ((i <0 && m->guest.nr ==NR_AUTOLOAD_MSRS ) || + (j <0 && m->host.nr ==NR_AUTOLOAD_MSRS )) {printk_once (KERN_WARNING "Not enough msr switch entries. " "Can't add msr %x\n" , msr);return ;
Greg Kroah-Hartman
maintainerPATCH 42/58 Input: bma150 - register input device after setting private data
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Bakker <[email protected]>
commit 90cc55f067f6ca0e64e5e52883ece47d8af7b67b upstream.
Otherwise we introduce a race condition where userspace can request input before we're ready leading to null pointer dereference such as
input: bma150 as /devices/platform/i2c-gpio-2/i2c-5/5-0038/input/input3
Unable to handle kernel NULL pointer dereference at virtual address 00000018 pgd = (ptrval) [00000018] *pgd=55dac831, *pte=00000000, *ppte=00000000 Internal error: Oops: 17 [#1] PREEMPT ARM Modules linked in: bma150 input_polldev [last unloaded: bma150] CPU: 0 PID: 2870 Comm: accelerometer Not tainted 5.0.0-rc3-dirty #46 Hardware name: Samsung S5PC110/S5PV210-based board PC is at input_event+0x8/0x60 LR is at bma150_report_xyz+0x9c/0xe0 [bma150] pc : [<80450f70>] lr : [<7f0a614c>] psr: 800d0013
sp : a4c1fd78 ip : 00000081 fp : 00020000
r10: 00000000 r9 : a5e2944c r8 : a7455000
r7 : 00000016 r6 : 00000101 r5 : a7617940 r4 : 80909048
r3 : fffffff2 r2 : 00000000 r1 : 00000003 r0 : 00000000
Flags: Nzcv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none
Control: 10c5387d Table: 54e34019 DAC: 00000051
Process accelerometer (pid: 2870, stack limit = 0x(ptrval))
Stackck: (0xa4c1fd78 to 0xa4c20000)
fd60: fffffff3 fc813f6c
fd80: 40410581 d7530ce3 a5e2817c a7617f00 a5e29404 a5e2817c 00000000 7f008324
fda0: a5e28000 8044f59c a5fdd9d0 a5e2945c a46a4a00 a5e29668 a7455000 80454f10
fdc0: 80909048 a5e29668 a5fdd9d0 a46a4a00 806316d0 00000000 a46a4a00 801df5f0
fde0: 00000000 d7530ce3 a4c1fec0 a46a4a00 00000000 a5fdd9d0 a46a4a08 801df53c
fe00: 00000000 801d74bc a4c1fec0 00000000 a4c1ff70 00000000 a7038da8 00000000
fe20: a46a4a00 801e91fc a411bbe0 801f2e88 00000004 00000000 80909048 00000041
fe40: 00000000 00020000 00000000 dead4ead a6a88da0 00000000 ffffe000 806fcae8
fe60: a4c1fec8 00000000 80909048 00000002 a5fdd9d0 a7660110 a411bab0 00000001
fe80: dead4ead ffffffff ffffffff a4c1fe8c a4c1fe8c d7530ce3 20000013 80909048
fea0: 80909048 a4c1ff70 00000001 fffff000 a4c1e000 00000005 00026038 801eabd8
fec0: a7660110 a411bab0 b9394901 00000006 a696201b 76fb3000 00000000 a7039720
fee0: a5fdd9d0 00000101 00000002 00000096 00000000 00000000 00000000 a4c1ff00
ff00: a6b310f4 805cb174 a6b310f4 00000010 00000fe0 00000010 a4c1e000 d7530ce3
ff20: 00000003 a5f41400 a5f41424 00000000 a6962000 00000000 00000003 00000002
ff40: ffffff9c 000a0000 80909048 d7530ce3 a6962000 00000003 80909048 ffffff9c
ff60: a6962000 801d890c 00000000 00000000 00020000 a7590000 00000004 00000100
ff80: 00000001 d7530ce3 000288b8 00026320 000288b8 00000005 80101204 a4c1e000
ffa0: 00000005 80101000 000288b8 00026320 000288b8 000a0000 00000000 00000000
ffc0: 000288b8 00026320 000288b8 00000005 7eef3bac 000264e8 00028ad8 00026038
ffe0: 00000005 7eef3300 76f76e91 76f78546 800d0030 000288b8 00000000 00000000 [<80450f70>] (input_event) from [<a5e2817c>] (0xa5e2817c)
Code: e1a08148 eaffffa8 e351001f 812fff1e (e590c018) ---[ end trace 1c691ee85f2ff243 ]---
--- drivers/input/misc/bma150.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
drivers/input/misc/bma150.c +5 -4
@@ -482,13 +482,14 @@ static int bma150_register_input_device( idev->close = bma150_irq_close;input_set_drvdata (idev, bma150); + bma150->input = idev; + error =input_register_device (idev);if (error) {input_free_device (idev);return error; } - bma150->input = idev;return 0 ; }
@@ -511,15 +512,15 @@ static int bma150_register_polled_devicebma150_init_input_device (bma150, ipoll_dev->input); + bma150->input_polled = ipoll_dev; + bma150->input = ipoll_dev->input; + error =input_register_polled_device (ipoll_dev);if (error) {input_free_polled_device (ipoll_dev);return error; } - bma150->input_polled = ipoll_dev; - bma150->input = ipoll_dev->input; -return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 43/58 Input: elantech - enable 3rd button support on Fujitsu CELSIUS H780
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Kurkela <[email protected]>
commit e8b22d0a329f0fb5c7ef95406872d268f01ee3b1 upstream.
Like Fujitsu CELSIUS H760, the H780 also has a three-button Elantech touchpad, but the driver needs to be told so to enable the middle touchpad button.
The elantech_dmi_force_crc_enabled quirk was not necessary with the H780.
Also document the fw_version and caps values detected for both H760 and H780 models.
--- drivers/input/mouse/elantech.c | 9 +++++++++ 1 file changed, 9 insertions(+)
drivers/input/mouse/elantech.c +9 -0
@@ -1117,6 +1117,8 @@ static int elantech_get_resolution_v4(st* Asus UX31 0x361f00 20, 15, 0e clickpad * Asus UX32VD 0x361f02 00, 15, 0e clickpad * Avatar AVIU-145A2 0x361f00 ? clickpad +* Fujitsu CELSIUS H760 0x570f02 40, 14, 0c 3 hw buttons (**) +* Fujitsu CELSIUS H780 0x5d0f02 41, 16, 0d 3 hw buttons (**) * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons
@@ -1169,6 +1171,13 @@ static const struct dmi_system_id elante DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H760"), }, }, + { +/* Fujitsu H780 also has a middle button */ + .matches = { +DMI_MATCH (DMI_SYS_VENDOR ,"FUJITSU" ), + DMI_MATCH(DMI_PRODUCT_NAME, "CELSIUS H780"), + }, + }, #endif { } };
Greg Kroah-Hartman
maintainerPATCH 44/58 alpha: fix page fault handling for r16-r18 targets
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergei Trofimovich <[email protected]>
commit 491af60ffb848b59e82f7c9145833222e0bf27a5 upstream.
Fix page fault handling code to fixup r16-r18 registers. Before the patch code had off-by-two registers bug. This bug caused overwriting of ps,pc,gp registers instead of fixing intended r16,r17,r18 (see struct pt_regs).
More details:
Initially Dmitry noticed a kernel bug as a failure on strace test suite. Test passes unmapped userspace pointer to io_submit:
```c
#include <err.h>
#include <unistd.h>
#include <sys/mman.h>
#include <asm/unistd.h>
int main(void)
{
unsigned long ctx = 0;
if (syscall(__NR_io_setup, 1, &ctx))
err(1, "io_setup");
const size_t page_size = sysconf(_SC_PAGESIZE);
const size_t size = page_size * 2;
void *ptr = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
if (MAP_FAILED == ptr)
err(1, "mmap(%zu)", size);
if (munmap(ptr, size))
err(1, "munmap");
syscall(__NR_io_submit, ctx, 1, ptr + page_size);
syscall(__NR_io_destroy, ctx);
return 0;
}
```Running this test causes kernel to crash when handling page fault:
```
Unable to handle kernel paging request at virtual address ffffffffffff9468
CPU 3
aio(26027): Oops 0
pc = [<fffffc00004eddf8>] ra = [<fffffc00004edd5c>] ps = 0000 Not tainted
pc is at sys_io_submit+0x108/0x200
ra is at sys_io_submit+0x6c/0x200
v0 = fffffc00c58e6300 t0 = fffffffffffffff2 t1 = 000002000025e000
t2 = fffffc01f159fef8 t3 = fffffc0001009640 t4 = fffffc0000e0f6e0
t5 = 0000020001002e9e t6 = 4c41564e49452031 t7 = fffffc01f159c000
s0 = 0000000000000002 s1 = 000002000025e000 s2 = 0000000000000000
s3 = 0000000000000000 s4 = 0000000000000000 s5 = fffffffffffffff2
s6 = fffffc00c58e6300
a0 = fffffc00c58e6300 a1 = 0000000000000000 a2 = 000002000025e000
a3 = 00000200001ac260 a4 = 00000200001ac1e8 a5 = 0000000000000001
t8 = 0000000000000008 t9 = 000000011f8bce30 t10= 00000200001ac440
t11= 0000000000000000 pv = fffffc00006fd320 at = 0000000000000000
gp = 0000000000000000 sp = 00000000265fd174
Disabling lock debugging due to kernel taint
Trace:
[<fffffc0000311404>] entSys+0xa4/0xc0
```Here gp has invalid value. gp is s overwritten by a fixup for the following page fault handler in io_submit` syscall handler:
```
__se_sys_io_submit
...
ldq a1,0(t1)
bne t0,4280 <__se_sys_io_submit+0x180>
```After a page fault t0 should contain -EFALUT and a1 is 0. Instead gp was overwritten in place of a1.
This happens due to a off-by-two bug in dpf_reg() for r16-r18 (aka a0-a2).
I think the bug went unnoticed for a long time as gp is one of scratch registers. Any kernel function call would re-calculate gp.
Dmitry tracked down the bug origin back to 2.1.32 kernel version where trap_a{0,1,2} fields were inserted into struct pt_regs. And even before that dpf_reg() contained off-by-one error.
--- arch/alpha/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/alpha/mm/fault.c +1 -1
@@ -77,7 +77,7 @@ __load_new_mm_context(struct mm_struct */* Macro for exception fixup code to access integer registers. */ #define dpf_reg (r) \ (((unsigned long *)regs)[(r) <= 8 ? (r) : (r) <= 15 ? (r)-16 : \ - (r) <= 18 ? (r)+8 : (r)-10]) + (r) <= 18 ? (r)+10 : (r)-10]) asmlinkage void do_page_fault(unsigned long address, unsigned long mmcsr,
Greg Kroah-Hartman
maintainerPATCH 45/58 alpha: Fix Eiger NR_IRQS to 128
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Meelis Roos <[email protected]>
commit bfc913682464f45bc4d6044084e370f9048de9d5 upstream.
Eiger machine vector definition has nr_irqs 128, and working 2.6.26 boot shows SCSI getting IRQ-s 64 and 65. Current kernel boot fails because Symbios SCSI fails to request IRQ-s and does not find the disks. It has been broken at least since 3.18 - the earliest I could test with my gcc-5.
The headers have moved around and possibly another order of defines has worked in the past - but since 128 seems to be correct and used, fix arch/alpha/include/asm/irq.h to have NR_IRQS=128 for Eiger.
This fixes 4.19-rc7 boot on my Force Flexor A264 (Eiger subarch).
--- arch/alpha/include/asm/irq.h | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
arch/alpha/include/asm/irq.h +3 -3
@@ -55,15 +55,15 @@#elif defined(CONFIG_ALPHA_DP264 ) || \ defined(CONFIG_ALPHA_LYNX ) || \ - defined(CONFIG_ALPHA_SHARK ) || \ - defined(CONFIG_ALPHA_EIGER ) + defined(CONFIG_ALPHA_SHARK )# define NR_IRQS 64#elif defined(CONFIG_ALPHA_TITAN )#define NR_IRQS 80#elif defined(CONFIG_ALPHA_RAWHIDE ) || \ - defined(CONFIG_ALPHA_TAKARA ) + defined(CONFIG_ALPHA_TAKARA ) || \ + defined(CONFIG_ALPHA_EIGER )# define NR_IRQS 128#elif defined(CONFIG_ALPHA_WILDFIRE )
Greg Kroah-Hartman
maintainerPATCH 46/58 tracing/uprobes: Fix output for multiple string arguments
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Ziegler <[email protected]>
commit 0722069a5374b904ec1a67f91249f90e1cfae259 upstream.
When printing multiple uprobe arguments as strings the output for the earlier arguments would also include all later string arguments.
This is best explained in an example:
Consider adding a uprobe to a function receiving two strings as parameters which is at offset 0xa0 in strlib.so and we want to print both parameters when the uprobe is hit (on x86_64):
$ echo 'p:func /lib/strlib.so:0xa0 +0(%di):string +0(%si):string' > \
/sys/kernel/debug/tracing/uprobe_eventsWhen the function is called as func("foo", "bar") and we hit the probe, the trace file shows a line like the following:
[...] func: (0x7f7e683706a0) arg1="foobar" arg2="bar"
Note the extra "bar" printed as part of arg1. This behaviour stacks up for additional string arguments.
The strings are stored in a dynamically growing part of the uprobe buffer by fetch_store_string() after copying them from userspace via strncpy_from_user(). The return value of strncpy_from_user() is then directly used as the required size for the string. However, this does not take the terminating null byte into account as the documentation for strncpy_from_user() cleary states that it "[...] returns the length of the string (not including the trailing NUL)" even though the null byte will be copied to the destination.
Therefore, subsequent calls to fetch_store_string() will overwrite the terminating null byte of the most recently fetched string with the first character of the current string, leading to the "accumulation" of strings in earlier arguments in the output.
Fix this by incrementing the return value of strncpy_from_user() by one if we did not hit the maximum buffer size.
--- kernel/trace/trace_uprobe.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)
kernel/trace/trace_uprobe.c +8 -1
@@ -150,7 +150,14 @@ static void FETCH_FUNC_NAME(memory, stri ret =strncpy_from_user (dst, src, maxlen);if (ret == maxlen) - dst[--ret] ='\0' ; + dst[ret -1 ] ='\0' ; +else if (ret >=0 ) +/* +* Include the terminating null byte. In this case it +* was copied by strncpy_from_user but not accounted +* for in ret. +*/ + ret++;if (ret <0 ) {/* Failed to fetch string */ ((u8 *)get_rloc_data (dest))[0 ] ='\0' ;
Greg Kroah-Hartman
maintainerPATCH 47/58 x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hedi Berriche <[email protected]>
commit f331e766c4be33f4338574f3c9f7f77e98ab4571 upstream.
Calls into UV firmware must be protected against concurrency, expose the efi_runtime_lock to the UV platform, and use it to serialise UV BIOS calls.
--- arch/x86/include/asm/uv/bios.h | 8 +++++++- arch/x86/platform/uv/bios_uv.c | 23 +++++++++++++++++++++-- drivers/firmware/efi/runtime-wrappers.c | 7 +++++++ 3 files changed, 35 insertions(+), 3 deletions(-)
arch/x86/include/asm/uv/bios.h +7 -1
@@ -48,7 +48,8 @@ enum {BIOS_STATUS_SUCCESS =0 ,BIOS_STATUS_UNIMPLEMENTED = -ENOSYS ,BIOS_STATUS_EINVAL = -EINVAL , - BIOS_STATUS_UNAVAIL = -EBUSY +BIOS_STATUS_UNAVAIL = -EBUSY , + BIOS_STATUS_ABORT = -EINTR, };/* Address map parameters */
@@ -167,4 +168,9 @@ extern long system_serial_number;extern struct kobject *sgi_uv_kobj;/* /sys/firmware/sgi_uv */ +/* +* EFI runtime lock; cf. firmware/efi/runtime-wrappers.c for details +*/ +extern struct semaphore __efi_uv_runtime_lock; +#endif /* _ASM_X86_UV_BIOS_H */
arch/x86/platform/uv/bios_uv.c +21 -2
@@ -29,7 +29,8 @@struct uv_systab *uv_systab; -s64 uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3,u64 a4,u64 a5) +static s64 __uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3, +u64 a4,u64 a5) {struct uv_systab *tab = uv_systab;s64 ret;
@@ -51,6 +52,19 @@ s64 uv_bios_call(enum uv_bios_cmd which,return ret; } + +s64 uv_bios_call (enum uv_bios_cmd which,u64 a1,u64 a2,u64 a3,u64 a4,u64 a5) +{ +s64 ret; + +if (down_interruptible (&__efi_uv_runtime_lock)) +return BIOS_STATUS_ABORT ; + + ret =__uv_bios_call (which, a1, a2, a3, a4, a5); +up (&__efi_uv_runtime_lock); + +return ret; +}EXPORT_SYMBOL_GPL (uv_bios_call); s64 uv_bios_call_irqsave(enum uv_bios_cmd which, u64 a1, u64 a2, u64 a3,
@@ -59,10 +73,15 @@ s64 uv_bios_call_irqsave(enum uv_bios_cmunsigned long bios_flags;s64 ret; +if (down_interruptible (&__efi_uv_runtime_lock)) +return BIOS_STATUS_ABORT ; +local_irq_save (bios_flags); - ret =uv_bios_call (which, a1, a2, a3, a4, a5); + ret =__uv_bios_call (which, a1, a2, a3, a4, a5);local_irq_restore (bios_flags); +up (&__efi_uv_runtime_lock); +return ret; }
drivers/firmware/efi/runtime-wrappers.c +7 -0
@@ -50,6 +50,13 @@ void efi_call_virt_check_flags(unsigned }/* +* Expose the EFI runtime lock to the UV platform +*/ +#ifdef CONFIG_X86_UV +extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); +#endif + +/* * According to section 7.1 of the UEFI spec, Runtime Services are not fully * reentrant, and there are particular combinations of calls that need to be * serialized. (source: UEFI Specification v2.4A)
Greg Kroah-Hartman
maintainerPATCH 48/58 signal: Restore the stop PTRACE_EVENT_EXIT
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit cf43a757fd49442bc38f76088b70c2299eed2c2f upstream.
In the middle of do_exit() there is there is a call "ptrace_event(PTRACE_EVENT_EXIT, code);" That call places the process in TACKED_TRACED aka "(TASK_WAKEKILL | __TASK_TRACED)" and waits for for the debugger to release the task or SIGKILL to be delivered.
Skipping past dequeue_signal when we know a fatal signal has already been delivered resulted in SIGKILL remaining pending and TIF_SIGPENDING remaining set. This in turn caused the scheduler to not sleep in PTACE_EVENT_EXIT as it figured a fatal signal was pending. This also caused ptrace_freeze_traced in ptrace_check_attach to fail because it left a per thread SIGKILL pending which is what fatal_signal_pending tests for.
This difference in signal state caused strace to report
strace: Exit of unknown pid NNNNN ignored
Therefore update the signal handling state like dequeue_signal would when removing a per thread SIGKILL, by removing SIGKILL from the per thread signal mask and clearing TIF_SIGPENDING.
--- kernel/signal.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
kernel/signal.c +5 -2
@@ -2241,9 +2241,12 @@ relock: }/* Has this task already been marked for death? */ - ksig->info.si_signo = signr =SIGKILL ; -if (signal_group_exit (signal)) +if (signal_group_exit (signal)) { + ksig->info.si_signo = signr =SIGKILL ; +sigdelset (¤t->pending.signal,SIGKILL ); +recalc_sigpending (); goto fatal; + }for (;;) {struct k_sigaction *ka;
Greg Kroah-Hartman
maintainerPATCH 49/58 x86/a.out: Clear the dump structure initially
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov <[email protected]>
commit 10970e1b4be9c74fce8ab6e3c34a7d718f063f2c upstream.
dump_thread32() in aout_core_dump() does not clear the user32 structure allocated on the stack as the first thing on function entry.
As a result, the dump.u_comm, dump.u_ar0 and dump.signal which get assigned before the clearing, get overwritten.
Rename that function to fill_dump() to make it clear what it does and call it first thing.
This was caught while staring at a patch by Derek Robson <[email protected]>.
--- arch/x86/ia32/ia32_aout.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
arch/x86/ia32/ia32_aout.c +4 -2
@@ -50,7 +50,7 @@ static unsigned long get_dr(int n)/* * fill in the user structure for a core dump.. */ -static void dump_thread32 (struct pt_regs *regs,struct user32 *dump) +static void fill_dump (struct pt_regs *regs,struct user32 *dump) {u32 fs, gs;memset (dump,0 ,sizeof (*dump));
@@ -156,10 +156,12 @@ static int aout_core_dump(struct coredum fs =get_fs ();set_fs (KERNEL_DS ); has_dumped =1 ; + +fill_dump (cprm->regs, &dump); +strncpy (dump.u_comm, current->comm,sizeof (current->comm)); dump.u_ar0 = offsetof(struct user32 , regs); dump.signal = cprm->siginfo->si_signo; -dump_thread32 (cprm->regs, &dump);/* * If the size of the dump file exceeds the rlimit, then see
Greg Kroah-Hartman
maintainerPATCH 50/58 dm thin: fix bug where bio that overwrites thin block ignores FUA
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikos Tsironis <[email protected]>
commit 4ae280b4ee3463fa57bbe6eede26b97daff8a0f1 upstream.
When provisioning a new data block for a virtual block, either because the block was previously unallocated or because we are breaking sharing, if the whole block of data is being overwritten the bio that triggered the provisioning is issued immediately, skipping copying or zeroing of the data block.
When this bio completes the new mapping is inserted in to the pool's metadata by process_prepared_mapping(), where the bio completion is signaled to the upper layers.
This completion is signaled without first committing the metadata. If the bio in question has the REQ_FUA flag set and the system crashes right after its completion and before the next metadata commit, then the write is lost despite the REQ_FUA flag requiring that I/O completion for this request must only be signaled after the data has been committed to non-volatile storage.
Fix this by deferring the completion of overwrite bios, with the REQ_FUA flag set, until after the metadata has been committed.
--- drivers/md/dm-thin.c | 55 ++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 50 insertions(+), 5 deletions(-)
drivers/md/dm-thin.c +50 -5
@@ -257,6 +257,7 @@ struct pool {spinlock_t lock;struct bio_list deferred_flush_bios; +struct bio_list deferred_flush_completions;struct list_head prepared_mappings;struct list_head prepared_discards;struct list_head prepared_discards_pt2;
@@ -925,6 +926,39 @@ static void process_prepared_mapping_faimempool_free (m, m->tc->pool->mapping_pool); } +static void complete_overwrite_bio (struct thin_c *tc,struct bio *bio) +{ +struct pool *pool = tc->pool; +unsigned long flags; + +/* +* If the bio has the REQ_FUA flag set we must commit the metadata +* before signaling its completion. +*/ +if (!bio_triggers_commit (tc, bio)) { +bio_endio (bio); +return ; + } + +/* +* Complete bio with an error if earlier I/O caused changes to the +* metadata that can't be committed, e.g, due to I/O errors on the +* metadata device. +*/ +if (dm_thin_aborted_changes (tc->td)) { +bio_io_error (bio); +return ; + } + +/* +* Batch together any bios that trigger commits and then issue a +* single commit for them in process_deferred_bios(). +*/ +spin_lock_irqsave (&pool->lock, flags); +bio_list_add (&pool->deferred_flush_completions, bio); +spin_unlock_irqrestore (&pool->lock, flags); +} +static void process_prepared_mapping (struct dm_thin_new_mapping *m) {struct thin_c *tc = m->tc;
@@ -957,7 +991,7 @@ static void process_prepared_mapping(str*/ if (bio) {inc_remap_and_issue_cell (tc, m->cell, m->data_block); -bio_endio (bio); +complete_overwrite_bio (tc, bio); }else {inc_all_io_entry (tc->pool, m->cell->holder);remap_and_issue (tc, m->cell->holder, m->data_block);
@@ -2303,7 +2337,7 @@ static void process_deferred_bios(struct {unsigned long flags;struct bio *bio; -struct bio_list bios; +struct bio_list bios, bio_completions;struct thin_c *tc; tc =get_first_thin (pool);
@@ -2314,26 +2348,36 @@ static void process_deferred_bios(struct }/* -* If there are any deferred flush bios, we must commit -* the metadata before issuing them. +* If there are any deferred flush bios, we must commit the metadata +* before issuing them or signaling their completion. */ bio_list_init (&bios); +bio_list_init (&bio_completions); +spin_lock_irqsave (&pool->lock, flags);bio_list_merge (&bios, &pool->deferred_flush_bios);bio_list_init (&pool->deferred_flush_bios); + +bio_list_merge (&bio_completions, &pool->deferred_flush_completions); +bio_list_init (&pool->deferred_flush_completions);spin_unlock_irqrestore (&pool->lock, flags); -if (bio_list_empty (&bios) && +if (bio_list_empty (&bios) &&bio_list_empty (&bio_completions) && !(dm_pool_changed_this_transaction (pool->pmd) &&need_commit_due_to_time (pool)))return ;if (commit (pool)) { +bio_list_merge (&bios, &bio_completions); +while ((bio =bio_list_pop (&bios)))bio_io_error (bio);return ; } pool->last_commit_jiffies = jiffies; +while ((bio =bio_list_pop (&bio_completions))) +bio_endio (bio); +while ((bio =bio_list_pop (&bios)))generic_make_request (bio); }
@@ -2968,6 +3012,7 @@ static struct pool *pool_create(struct mINIT_DELAYED_WORK (&pool->no_space_timeout, do_no_space_timeout);spin_lock_init (&pool->lock);bio_list_init (&pool->deferred_flush_bios); +bio_list_init (&pool->deferred_flush_completions);INIT_LIST_HEAD (&pool->prepared_mappings);INIT_LIST_HEAD (&pool->prepared_discards);INIT_LIST_HEAD (&pool->prepared_discards_pt2);
Greg Kroah-Hartman
maintainerPATCH 51/58 drm/i915: Prevent a race during I915_GEM_MMAP ioctl with WC set
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joonas Lahtinen <[email protected]>
commit 2e7bd10e05afb866b5fb13eda25095c35d7a27cc upstream.
Make sure the underlying VMA in the process address space is the same as it was during vm_mmap to avoid applying WC to wrong VMA.
A more long-term solution would be to have vm_mmap_locked variant in linux/mmap.h for when caller wants to hold mmap_sem for an extended duration.
v2:
- Refactor the compare function
--- drivers/gpu/drm/i915/i915_gem.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/gpu/drm/i915/i915_gem.c +11 -1
@@ -1593,6 +1593,16 @@ i915_gem_sw_finish_ioctl(struct drm_devireturn err; } +static inline bool +__vma_matches (struct vm_area_struct *vma,struct file *filp, +unsigned long addr,unsigned long size) +{ +if (vma->vm_file != filp) +return false; + +return vma->vm_start == addr && (vma->vm_end - vma->vm_start) == size; +} +/** * i915_gem_mmap_ioctl - Maps the contents of an object, returning the address * it is mapped to.
@@ -1651,7 +1661,7 @@ i915_gem_mmap_ioctl(struct drm_device *dreturn -EINTR ; } vma =find_vma (mm, addr); -if (vma) +if (vma &&__vma_matches (vma, obj->base.filp, addr, args->size)) vma->vm_page_prot =pgprot_writecombine (vm_get_page_prot (vma->vm_flags));else
Greg Kroah-Hartman
maintainerPATCH 52/58 smsc95xx: Use skb_cow_head to deal with cloned skbs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Hughes <[email protected]>
commit e9156cd26a495a18706e796f02a81fee41ec14f4 upstream.
The driver was failing to check that the SKB wasn't cloned before adding checksum data.
Replace existing handling to extend/copy the header buffer with skb_cow_head.
--- drivers/net/usb/smsc95xx.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
drivers/net/usb/smsc95xx.c +6 -6
@@ -2011,13 +2011,13 @@ static struct sk_buff *smsc95xx_tx_fixup/* We do not advertise SG, so skbs should be already linearized */ BUG_ON (skb_shinfo (skb)->nr_frags); -if (skb_headroom (skb) < overhead) { -struct sk_buff *skb2 =skb_copy_expand (skb, - overhead,0 , flags); +/* Make writable and expand header space by overhead if required */ +if (skb_cow_head (skb, overhead)) { +/* Must deallocate here as returning NULL to indicate error +* means the skb won't be deallocated in the caller. +*/ dev_kfree_skb_any (skb); - skb = skb2; -if (!skb) -return NULL ; +return NULL ; }if (csum) {
Greg Kroah-Hartman
maintainerPATCH 53/58 ch9200: use skb_cow_head() to deal with cloned skbs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 6bc6895bdd6744e0136eaa4a11fbdb20a7db4e40 upstream.
We need to ensure there is enough headroom to push extra header, but we also need to check if we are allowed to change headers.
skb_cow_head() is the proper helper to deal with this.
--- drivers/net/usb/ch9200.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-)
drivers/net/usb/ch9200.c +2 -7
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(s tx_overhead =0x40 ; len = skb->len; -if (skb_headroom (skb) < tx_overhead) { -struct sk_buff *skb2; - - skb2 =skb_copy_expand (skb, tx_overhead,0 , flags); +if (skb_cow_head (skb, tx_overhead)) {dev_kfree_skb_any (skb); - skb = skb2; -if (!skb) -return NULL ; +return NULL ; }__skb_push (skb, tx_overhead);
Greg Kroah-Hartman
maintainerPATCH 54/58 kaweth: use skb_cow_head() to deal with cloned skbs
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <[email protected]>
commit 39fba7835aacda65284a86e611774cbba71dac20 upstream.
We can use skb_cow_head() to properly deal with clones, especially the ones coming from TCP stack that allow their head being modified. This avoids a copy.
--- drivers/net/usb/kaweth.c | 18 ++++++------------ 1 file changed, 6 insertions(+), 12 deletions(-)
drivers/net/usb/kaweth.c +6 -12
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(str }/* We now decide whether we can put our special header into the sk_buff */ -if (skb_cloned (skb) ||skb_headroom (skb) <2 ) { -/* no such luck - we make our own */ -struct sk_buff *copied_skb; - copied_skb =skb_copy_expand (skb,2 ,0 ,GFP_ATOMIC ); -dev_kfree_skb_irq (skb); - skb = copied_skb; -if (!copied_skb) { - kaweth->stats.tx_errors++; -netif_start_queue (net); -spin_unlock_irq (&kaweth->device_lock); -return NETDEV_TX_OK ; - } +if (skb_cow_head (skb,2 )) { + kaweth->stats.tx_errors++; +netif_start_queue (net); +spin_unlock_irq (&kaweth->device_lock); +dev_kfree_skb_any (skb); +return NETDEV_TX_OK ; } private_header = (__le16 *)__skb_push (skb,2 );
Greg Kroah-Hartman
maintainerPATCH 55/58 usb: dwc2: Remove unnecessary kfree
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Youn <[email protected]>
commit cd4b1e34655d46950c065d9284b596cd8d7b28cd upstream.
This shouldn't be freed by the HCD as it is owned by the core and allocated with devm_kzalloc.
--- drivers/usb/dwc2/hcd.c | 1 - 1 file changed, 1 deletion(-)
drivers/usb/dwc2/hcd.c +0 -1
@@ -5202,7 +5202,6 @@ error3: error2:usb_put_hcd (hcd); error1: -kfree (hsotg->core_params);#ifdef CONFIG_USB_DWC2_TRACK_MISSED_SOFS kfree (hsotg->last_frame_num_array);
Greg Kroah-Hartman
maintainerPATCH 56/58 netfilter: nf_tables: fix mismatch in big-endian system
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liping Zhang <[email protected]>
commit 10596608c4d62cb8c1c2b806debcbd32fe657e71 upstream.
Currently, there are two different methods to store an u16 integer to the u32 data register. For example:
u32 *dest = ®s->data[priv->dreg];
1. *dest = 0; *(u16 *) dest = val_u16;
2. *dest = val_u16;
For method 1, the u16 value will be stored like this, either in big-endian or little-endian system:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+ | Value | 0 | +-+-+-+-+-+-+-+-+-+-+-+-+
For method 2, in little-endian system, the u16 value will be the same as listed above. But in big-endian system, the u16 value will be stored like this:
0 15 31
+-+-+-+-+-+-+-+-+-+-+-+-+ | 0 | Value | +-+-+-+-+-+-+-+-+-+-+-+-+
So later we use "memcmp(®s->data[priv->sreg], data, 2);" to do compare in nft_cmp, nft_lookup expr ..., method 2 will get the wrong result in big-endian system, as 0~15 bits will always be zero.
For the similar reason, when loading an u16 value from the u32 data register, we should use "*(u16 *) sreg;" instead of "(u16)*sreg;", the 2nd method will get the wrong value in the big-endian system.
So introduce some wrapper functions to store/load an u8 or u16 integer to/from the u32 data register, and use them in the right place.
--- include/net/netfilter/nf_tables.h | 29 ++++++++++++++++++++++++ net/ipv4/netfilter/nft_masq_ipv4.c | 8 +++--- net/ipv4/netfilter/nft_redir_ipv4.c | 8 +++--- net/ipv6/netfilter/nft_masq_ipv6.c | 8 +++--- net/ipv6/netfilter/nft_redir_ipv6.c | 8 +++--- net/netfilter/nft_ct.c | 10 ++++---- net/netfilter/nft_meta.c | 42 ++++++++++++++++++------------------ net/netfilter/nft_nat.c | 8 +++--- 8 files changed, 76 insertions(+), 45 deletions(-)
include/net/netfilter/nf_tables.h +29 -0
@@ -87,6 +87,35 @@ struct nft_regs { }; }; +/* Store/load an u16 or u8 integer to/from the u32 data register. +* +* Note, when using concatenations, register allocation happens at 32-bit +* level. So for store instruction, pad the rest part with zero to avoid +* garbage values. +*/ + +static inline void nft_reg_store16 (u32 *dreg,u16 val) +{ + *dreg =0 ; + *(u16 *)dreg = val; +} + +static inline void nft_reg_store8 (u32 *dreg,u8 val) +{ + *dreg =0 ; + *(u8 *)dreg = val; +} + +static inline u16 nft_reg_load16 (u32 *sreg) +{ +return *(u16 *)sreg; +} + +static inline u8 nft_reg_load8 (u32 *sreg) +{ +return *(u8 *)sreg; +} +static inline void nft_data_copy (u32 *dst,const struct nft_data *src,unsigned int len) {
net/ipv4/netfilter/nft_masq_ipv4.c +4 -4
@@ -26,10 +26,10 @@ static void nft_masq_ipv4_eval(const strmemset (&range,0 ,sizeof (range)); range.flags = priv->flags;if (priv->sreg_proto_min) { - range.min_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_min]; - range.max_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_max]; + range.min_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_min]); + range.max_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_max]); } regs->verdict.code =nf_nat_masquerade_ipv4 (pkt->skb, pkt->hook, &range, pkt->out);
net/ipv4/netfilter/nft_redir_ipv4.c +4 -4
@@ -26,10 +26,10 @@ static void nft_redir_ipv4_eval(const stmemset (&mr,0 ,sizeof (mr));if (priv->sreg_proto_min) { - mr.range[0 ].min.all = - *(__be16 *)®s->data[priv->sreg_proto_min]; - mr.range[0 ].max.all = - *(__be16 *)®s->data[priv->sreg_proto_max]; + mr.range[0 ].min.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_min]); + mr.range[0 ].max.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_max]); mr.range[0 ].flags |=NF_NAT_RANGE_PROTO_SPECIFIED ; }
net/ipv6/netfilter/nft_masq_ipv6.c +4 -4
@@ -27,10 +27,10 @@ static void nft_masq_ipv6_eval(const strmemset (&range,0 ,sizeof (range)); range.flags = priv->flags;if (priv->sreg_proto_min) { - range.min_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_min]; - range.max_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_max]; + range.min_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_min]); + range.max_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_max]); } regs->verdict.code =nf_nat_masquerade_ipv6 (pkt->skb, &range, pkt->out); }
net/ipv6/netfilter/nft_redir_ipv6.c +4 -4
@@ -26,10 +26,10 @@ static void nft_redir_ipv6_eval(const stmemset (&range,0 ,sizeof (range));if (priv->sreg_proto_min) { - range.min_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_min], - range.max_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_max], + range.min_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_min]); + range.max_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_max]); range.flags |=NF_NAT_RANGE_PROTO_SPECIFIED ; }
net/netfilter/nft_ct.c +5 -5
@@ -77,7 +77,7 @@ static void nft_ct_get_eval(const structswitch (priv->key) {case NFT_CT_DIRECTION : - *dest =CTINFO2DIR (ctinfo); +nft_reg_store8 (dest,CTINFO2DIR (ctinfo));return ;case NFT_CT_STATUS : *dest = ct->status;
@@ -129,10 +129,10 @@ static void nft_ct_get_eval(const structreturn ; }case NFT_CT_L3PROTOCOL : - *dest =nf_ct_l3num (ct); +nft_reg_store8 (dest,nf_ct_l3num (ct));return ;case NFT_CT_PROTOCOL : - *dest =nf_ct_protonum (ct); +nft_reg_store8 (dest,nf_ct_protonum (ct));return ;default :break ;
@@ -149,10 +149,10 @@ static void nft_ct_get_eval(const struct nf_ct_l3num(ct) == NFPROTO_IPV4 ? 4 : 16);return ;case NFT_CT_PROTO_SRC : - *dest = (__force __u16 )tuple->src.u.all; +nft_reg_store16 (dest, (__force u16 )tuple->src.u.all);return ;case NFT_CT_PROTO_DST : - *dest = (__force __u16 )tuple->dst.u.all; +nft_reg_store16 (dest, (__force u16 )tuple->dst.u.all);return ;default :break ;
net/netfilter/nft_meta.c +22 -20
104 lines not on this page · raw message
net/netfilter/nft_nat.c +4 -4
@@ -65,10 +65,10 @@ static void nft_nat_eval(const struct nf }if (priv->sreg_proto_min) { - range.min_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_min]; - range.max_proto.all = - *(__be16 *)®s->data[priv->sreg_proto_max]; + range.min_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_min]); + range.max_proto.all = (__force __be16 )nft_reg_load16 ( + ®s->data[priv->sreg_proto_max]); range.flags |=NF_NAT_RANGE_PROTO_SPECIFIED ; }
Greg Kroah-Hartman
maintainerPATCH 57/58 pinctrl: msm: fix gpio-hog related boot issues
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
commit a86caa9ba5d70696ceb35d1d39caa20d8b641387 upstream.
Sven Eckelmann reported an issue with the current IPQ4019 pinctrl. Setting up any gpio-hog in the device-tree for his device would "kill the bootup completely":
| [ 0.477838] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe | [ 0.499828] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferring probe | [ 1.298883] requesting hog GPIO enable USB2 power (chip 1000000.pinctrl, offset 58) failed, -517 | [ 1.299609] gpiochip_add_data: GPIOs 0..99 (1000000.pinctrl) failed to register | [ 1.308589] ipq4019-pinctrl 1000000.pinctrl: Failed register gpiochip | [ 1.316586] msm_serial 78af000.serial: could not find pctldev for node /soc/pinctrl@1000000/serial_pinmux, deferring probe | [ 1.322415] spi_qup 78b5000.spi: could not find pctldev for node /soc/pinctrl@1000000/spi_0_pinmux, deferri
This was also verified on a RT-AC58U (IPQ4018) which would no longer boot, if a gpio-hog was specified. (Tried forcing the USB LED PIN (GPIO0) to high.).
The problem is that Pinctrl+GPIO registration is currently peformed in the following order in pinctrl-msm.c:
1. pinctrl_register()
2. gpiochip_add()
3. gpiochip_add_pin_range()
The actual error code -517 == -EPROBE_DEFER is coming from pinctrl_get_device_gpio_range(), which is called through:
gpiochip_add
of_gpiochip_add
of_gpiochip_scan_gpios
gpiod_hog
gpiochip_request_own_desc
__gpiod_request
chip->request
gpiochip_generic_request
pinctrl_gpio_request
pinctrl_get_device_gpio_rangepinctrl_get_device_gpio_range() is unable to find any valid pin ranges, since nothing has been added to the pinctrldev_list yet. so the range can't be found, and the operation fails with -EPROBE_DEFER.
This patch fixes the issue by adding the "gpio-ranges" property to the pinctrl device node of all upstream Qcom SoC. The pin ranges are then added by the gpio core.
In order to remain compatible with older, existing DTs (and ACPI) a check for the "gpio-ranges" property has been added to msm_gpio_init(). This prevents the driver of adding the same entry to the pinctrldev_list twice.
--- drivers/pinctrl/qcom/pinctrl-msm.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-)
drivers/pinctrl/qcom/pinctrl-msm.c +18 -5
@@ -803,11 +803,24 @@ static int msm_gpio_init(struct msm_pincreturn ret; } - ret =gpiochip_add_pin_range (&pctrl->chip,dev_name (pctrl->dev),0 ,0 , chip->ngpio); -if (ret) { -dev_err (pctrl->dev,"Failed to add pin range\n" ); -gpiochip_remove (&pctrl->chip); -return ret; +/* +* For DeviceTree-supported systems, the gpio core checks the +* pinctrl's device node for the "gpio-ranges" property. +* If it is present, it takes care of adding the pin ranges +* for the driver. In this case the driver can skip ahead. +* +* In order to remain compatible with older, existing DeviceTree +* files which don't set the "gpio-ranges" property or systems that +* utilize ACPI the driver has to call gpiochip_add_pin_range(). +*/ +if (!of_property_read_bool (pctrl->dev->of_node,"gpio-ranges" )) { + ret =gpiochip_add_pin_range (&pctrl->chip, +dev_name (pctrl->dev),0 ,0 , chip->ngpio); +if (ret) { +dev_err (pctrl->dev,"Failed to add pin range\n" ); +gpiochip_remove (&pctrl->chip); +return ret; + } } ret = gpiochip_irqchip_add(chip,
Greg Kroah-Hartman
maintainerPATCH 58/58 mm: stop leaking PageTables
In reply to Greg Kroah-Hartman4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <[email protected]>
commit b0b9b3df27d100a975b4e8818f35382b64a5e35c upstream.
4.10-rc loadtest (even on x86, and even without THPCache) fails with "fork: Cannot allocate memory" or some such; and /proc/meminfo shows PageTables growing.
Commit 953c66c2b22a ("mm: THP page cache support for ppc64") that got merged in rc1 removed the freeing of an unused preallocated pagetable after do_fault_around() has called map_pages().
This is usually a good optimization, so that the followup doesn't have to reallocate one; but it's not sufficient to shift the freeing into alloc_set_pte(), since there are failure cases (most commonly VM_FAULT_RETRY) which never reach finish_fault().
Check and free it at the outer level in do_fault(), then we don't need to worry in alloc_set_pte(), and can restore that to how it was (I cannot find any reason to pte_free() under lock as it was doing).
And fix a separate pagetable leak, or crash, introduced by the same change, that could only show up on some ppc64: why does do_set_pmd()'s failure case attempt to withdraw a pagetable when it never deposited one, at the same time overwriting (so leaking) the vmf->prealloc_pte? Residue of an earlier implementation, perhaps? Delete it.
--- mm/memory.c | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-)
mm/memory.c +15 -6
@@ -3329,15 +3329,24 @@ static int do_fault(struct fault_env *fe {struct vm_area_struct *vma = fe->vma;pgoff_t pgoff =linear_page_index (vma, fe->address); +int ret;/* The VMA was not fully populated on mmap() or missing VM_DONTEXPAND */ if (!vma->vm_ops->fault) -return VM_FAULT_SIGBUS ; -if (!(fe->flags &FAULT_FLAG_WRITE )) -return do_read_fault (fe, pgoff); -if (!(vma->vm_flags &VM_SHARED )) -return do_cow_fault (fe, pgoff); -return do_shared_fault (fe, pgoff); + ret =VM_FAULT_SIGBUS ; +else if (!(fe->flags &FAULT_FLAG_WRITE )) + ret =do_read_fault (fe, pgoff); +else if (!(vma->vm_flags &VM_SHARED )) + ret =do_cow_fault (fe, pgoff); +else + ret =do_shared_fault (fe, pgoff); + +/* preallocated pagetable is unused: free it */ +if (fe->prealloc_pte) { +pte_free (vma->vm_mm, fe->prealloc_pte); + fe->prealloc_pte =0 ; + } +return ret; } static int numa_migrate_prep(struct page *page, struct vm_area_struct *vma,
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.159 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Feb 20 13:34:40 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.159-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.159-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: fe5f19afca3005a843e6b2c67f3592fa35fa612a
git describe: v4.9.158-59-gfe5f19afca30
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.158-59-gfe5f19afca30
No regressions (compared to build v4.9.158)
No fixes (compared to build v4.9.158)
Ran 22236 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* boot
* install-android-platform-tools-r2600
* kselftest
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* spectre-meltdown-checker-test
* ltp-open-posix-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Jon Hunter
maintainerQuoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.159 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Feb 20 13:34:40 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.159-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests are passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
14 tests: 14 pass, 0 failLinux version: 4.9.159-rc1-gfe5f19a
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Cheers
Jon
Signature · 1 line
nvpublic
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.159 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Feb 20 13:34:40 UTC 2019. Anything received after that time might be too late.
Build results:
total: 172 pass: 172 fail: 0 Qemu test results: total: 315 pass: 315 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.159 release. There are 58 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed Feb 20 13:34:40 UTC 2019. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.159-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No demesg regressions.
thanks,
-- Shuah