4.9.200-stable review
Subsystems (2)
Greg Kroah-Hartman
maintainercover 4.9.200-stable review
This is the start of the stable review cycle for the 4.9.200 release. There are 34 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun 10 Nov 2019 05:42:11 PM UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.200-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.200-rc1
Petr Vorel <[email protected]>
alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP
Jeffrey Hugo <[email protected]>
dmaengine: qcom: bam_dma: Fix resource leak
Eric Dumazet <[email protected]>
net/flow_dissector: switch to siphash
Seth Forshee <[email protected]>
kbuild: add -fcf-protection=none when using retpoline flags
Masahiro Yamada <[email protected]>
kbuild: use -fmacro-prefix-map to make __FILE__ a relative path
Kees Cook <[email protected]>
Kbuild: make designated_init attribute fatal
Eric Dumazet <[email protected]>
inet: stop leaking jiffies on the wire
Eran Ben Elisha <[email protected]>
net/mlx4_core: Dynamically set guaranteed amount of counters per VF
Xin Long <[email protected]>
vxlan: check tun_info options_len properly
Doug Berger <[email protected]>
net: bcmgenet: reset 40nm EPHY on energy detect
Vivien Didelot <[email protected]>
net: dsa: fix switch tree list
Eric Dumazet <[email protected]>
net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
Wei Wang <[email protected]>
selftests: net: reuseport_dualstack: fix uninitalized parameter
zhanglin <[email protected]>
net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
Jiangfeng Xiao <[email protected]>
net: hisilicon: Fix ping latency when deal with high throughput
Tejun Heo <[email protected]>
net: fix sk_page_frag() recursion from memory reclaim
Eric Dumazet <[email protected]>
dccp: do not leak jiffies on the wire
Dave Wysochanski <[email protected]>
cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
Jonas Gorski <[email protected]>
MIPS: bmips: mark exception vectors as char arrays
Navid Emamdoost <[email protected]>
of: unittest: fix memory leak in unittest_data_add
Bodo Stroesser <[email protected]>
scsi: target: core: Do not overwrite CDB byte 1
Peter Ujfalusi <[email protected]>
ARM: davinci: dm365: Fix McBSP dma_slave_map entry
Yunfeng Ye <[email protected]>
perf kmem: Fix memory leak in compact_gfp_flags()
Anson Huang <[email protected]>
ARM: dts: imx7s: Correct GPT's ipg clock source
Thomas Bogendoerfer <[email protected]>
scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
Thomas Bogendoerfer <[email protected]>
scsi: sni_53c710: fix compilation error
Hannes Reinecke <[email protected]>
scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions
Russell King <[email protected]>
ARM: mm: fix alignment handler faults under memory pressure
Dan Carpenter <[email protected]>
pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable()
Adam Ford <[email protected]>
ARM: dts: logicpd-torpedo-som: Remove twl_keypad
Robin Murphy <[email protected]>
ASoc: rockchip: i2s: Fix RPM imbalance
Stuart Henderson <[email protected]>
ASoC: wm_adsp: Don't generate kcontrols without READ flags
Yizhuo <[email protected]>
regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized
Axel Lin <[email protected]>
regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone
-------------
Diffstat:
Makefile | 16 +++++++- arch/arm/boot/dts/imx7s.dtsi | 8 ++-- arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 4 ++ arch/arm/mach-davinci/dm365.c | 4 +- arch/arm/mm/alignment.c | 44 ++++++++++++++++---- arch/mips/bcm63xx/prom.c | 2 +- arch/mips/include/asm/bmips.h | 10 ++--- arch/mips/kernel/smp-bmips.c | 8 ++-- drivers/dma/qcom/bam_dma.c | 14 +++++++ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 +++- drivers/net/ethernet/hisilicon/hip04_eth.c | 15 ++++--- .../net/ethernet/mellanox/mlx4/resource_tracker.c | 42 +++++++++++-------- drivers/net/vxlan.c | 5 ++- drivers/of/unittest.c | 1 + drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 +- drivers/regulator/pfuze100-regulator.c | 8 +++- drivers/regulator/ti-abb-regulator.c | 26 ++++-------- drivers/scsi/Kconfig | 2 +- drivers/scsi/device_handler/scsi_dh_alua.c | 21 +++++++--- drivers/scsi/sni_53c710.c | 4 +- drivers/target/target_core_device.c | 21 ---------- fs/cifs/cifsglob.h | 5 +++ fs/cifs/cifsproto.h | 1 + fs/cifs/file.c | 23 +++++++---- fs/cifs/smb2file.c | 2 +- include/linux/gfp.h | 23 +++++++++++ include/linux/skbuff.h | 3 +- include/net/flow_dissector.h | 3 +- include/net/fq.h | 2 +- include/net/fq_impl.h | 4 +- include/net/sock.h | 11 +++-- kernel/time/alarmtimer.c | 4 +- net/core/datagram.c | 2 +- net/core/ethtool.c | 4 +- net/core/flow_dissector.c | 48 +++++++++------------- net/dccp/ipv4.c | 4 +- net/dsa/dsa2.c | 2 +- net/ipv4/datagram.c | 2 +- net/ipv4/tcp_ipv4.c | 4 +- net/sched/sch_fq_codel.c | 6 +-- net/sched/sch_hhf.c | 8 ++-- net/sched/sch_sfb.c | 13 +++--- net/sched/sch_sfq.c | 14 ++++--- net/sctp/socket.c | 2 +- sound/soc/codecs/wm_adsp.c | 3 +- sound/soc/rockchip/rockchip_i2s.c | 2 +- tools/perf/builtin-kmem.c | 1 + tools/testing/selftests/net/reuseport_dualstack.c | 3 +- 48 files changed, 286 insertions(+), 181 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/34 regulator: ti-abb: Fix timeout in ti_abb_wait_txdone/ti_abb_clear_all_txdone
From: Axel Lin <[email protected]>
[ Upstream commit f64db548799e0330897c3203680c2ee795ade518 ]
ti_abb_wait_txdone() may return -ETIMEDOUT when ti_abb_check_txdone() returns true in the latest iteration of the while loop because the timeout value is abb->settling_time + 1. Similarly, ti_abb_clear_all_txdone() may return -ETIMEDOUT when ti_abb_check_txdone() returns false in the latest iteration of the while loop. Fix it.
--- drivers/regulator/ti-abb-regulator.c | 26 ++++++++------------------ 1 file changed, 8 insertions(+), 18 deletions(-)
drivers/regulator/ti-abb-regulator.c +8 -18
@@ -173,19 +173,14 @@ static int ti_abb_wait_txdone(struct device *dev, struct ti_abb *abb)while (timeout++ <= abb->settling_time) { status =ti_abb_check_txdone (abb);if (status) -break ; +return 0 ;udelay (1 ); } -if (timeout > abb->settling_time) { -dev_warn_ratelimited (dev, -"%s:TRANXDONE timeout(%duS) int=0x%08x\n" , - __func__, timeout,readl (abb->int_base)); -return -ETIMEDOUT ; - } - -return 0 ; +dev_warn_ratelimited (dev,"%s:TRANXDONE timeout(%duS) int=0x%08x\n" , + __func__, timeout,readl (abb->int_base)); +return -ETIMEDOUT ; }/**
@@ -205,19 +200,14 @@ static int ti_abb_clear_all_txdone(struct device *dev, const struct ti_abb *abb) status =ti_abb_check_txdone (abb);if (!status) -break ; +return 0 ;udelay (1 ); } -if (timeout > abb->settling_time) { -dev_warn_ratelimited (dev, -"%s:TRANXDONE timeout(%duS) int=0x%08x\n" , - __func__, timeout,readl (abb->int_base)); -return -ETIMEDOUT ; - } - -return 0 ; +dev_warn_ratelimited (dev,"%s:TRANXDONE timeout(%duS) int=0x%08x\n" , + __func__, timeout,readl (abb->int_base)); +return -ETIMEDOUT ; }/**
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 2/34 regulator: pfuze100-regulator: Variable "val" in pfuze100_regulator_probe() could be uninitialized
In reply to Greg Kroah-HartmanFrom: Yizhuo <[email protected]>
[ Upstream commit 1252b283141f03c3dffd139292c862cae10e174d ]
In function pfuze100_regulator_probe(), variable "val" could be initialized if regmap_read() fails. However, "val" is used to decide the control flow later in the if statement, which is potentially unsafe.
--- drivers/regulator/pfuze100-regulator.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
drivers/regulator/pfuze100-regulator.c +7 -1
@@ -608,7 +608,13 @@ static int pfuze100_regulator_probe(struct i2c_client *client,/* SW2~SW4 high bit check and modify the voltage value table */ if (i >= sw_check_start && i <= sw_check_end) { -regmap_read (pfuze_chip->regmap, desc->vsel_reg, &val); + ret =regmap_read (pfuze_chip->regmap, + desc->vsel_reg, &val); +if (ret) { +dev_err (&client->dev,"Fails to read from the register.\n" ); +return ret; + } +if (val & sw_hi) {if (pfuze_chip->chip_id ==PFUZE3000 ) { desc->volt_table = pfuze3000_sw2hi;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 3/34 ASoC: wm_adsp: Dont generate kcontrols without READ flags
In reply to Greg Kroah-HartmanFrom: Stuart Henderson <[email protected]>
[ Upstream commit 3ae7359c0e39f42a96284d6798fc669acff38140 ]
User space always expects to be able to read ALSA controls, so ensure no kcontrols are generated without an appropriate READ flag. In the case of a read of such a control zeros will be returned.
--- sound/soc/codecs/wm_adsp.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
sound/soc/codecs/wm_adsp.c +1 -2
@@ -948,8 +948,7 @@ static unsigned int wmfw_convert_flags(unsigned int in, unsigned int len) }if (in) { -if (in &WMFW_CTL_FLAG_READABLE ) - out |= rd; + out |= rd;if (in &WMFW_CTL_FLAG_WRITEABLE ) out |= wr;if (in &WMFW_CTL_FLAG_VOLATILE )
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 4/34 ASoc: rockchip: i2s: Fix RPM imbalance
In reply to Greg Kroah-HartmanFrom: Robin Murphy <[email protected]>
[ Upstream commit b1e620e7d32f5aad5353cc3cfc13ed99fea65d3a ]
If rockchip_pcm_platform_register() fails, e.g. upon deferring to wait for an absent DMA channel, we return without disabling RPM, which makes subsequent re-probe attempts scream with errors about the unbalanced enable. Don't do that.
--- sound/soc/rockchip/rockchip_i2s.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/soc/rockchip/rockchip_i2s.c +1 -1
@@ -649,7 +649,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev) ret =devm_snd_dmaengine_pcm_register (&pdev->dev,NULL ,0 );if (ret) {dev_err (&pdev->dev,"Could not register PCM\n" ); -return ret; + goto err_suspend; }return 0 ;
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 5/34 ARM: dts: logicpd-torpedo-som: Remove twl_keypad
In reply to Greg Kroah-HartmanFrom: Adam Ford <[email protected]>
[ Upstream commit 6b512b0ee091edcb8e46218894e4c917d919d3dc ]
The TWL4030 used on the Logit PD Torpedo SOM does not have the keypad pins routed. This patch disables the twl_keypad driver to remove some splat during boot:
twl4030_keypad 48070000.i2c:twl@48:keypad: missing or malformed property linux,keymap: -22 twl4030_keypad 48070000.i2c:twl@48:keypad: Failed to build keymaptwl4030_keypad: probe of 48070000.i2c:twl@48:keypad failed with error -22
--- arch/arm/boot/dts/logicpd-torpedo-som.dtsi | 4 ++++ 1 file changed, 4 insertions(+)
arch/arm/boot/dts/logicpd-torpedo-som.dtsi +4 -0
@@ -266,3 +266,7 @@ &twl_gpio { ti,use-leds; }; + +&twl_keypad { + status = "disabled"; +};
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 6/34 pinctrl: ns2: Fix off by one bugs in ns2_pinmux_enable()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 39b65fbb813089e366b376bd8acc300b6fd646dc ]
The pinctrl->functions[] array has pinctrl->num_functions elements and the pinctrl->groups[] array is the same way. These are set in ns2_pinmux_probe(). So the > comparisons should be >= so that we don't read one element beyond the end of the array.
--- drivers/pinctrl/bcm/pinctrl-ns2-mux.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/pinctrl/bcm/pinctrl-ns2-mux.c +2 -2
@@ -640,8 +640,8 @@ static int ns2_pinmux_enable(struct pinctrl_dev *pctrl_dev,const struct ns2_pin_function *func;const struct ns2_pin_group *grp; -if (grp_select > pinctrl->num_groups || - func_select > pinctrl->num_functions) +if (grp_select >= pinctrl->num_groups || + func_select >= pinctrl->num_functions)return -EINVAL ; func = &pinctrl->functions[func_select];
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 7/34 ARM: mm: fix alignment handler faults under memory pressure
In reply to Greg Kroah-HartmanFrom: Russell King <[email protected]>
[ Upstream commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee ]
When the system has high memory pressure, the page containing the instruction may be paged out. Using probe_kernel_address() means that if the page is swapped out, the resulting page fault will not be handled because page faults are disabled by this function.
Use get_user() to read the instruction instead.
--- arch/arm/mm/alignment.c | 44 +++++++++++++++++++++++++++++++++-------- 1 file changed, 36 insertions(+), 8 deletions(-)
arch/arm/mm/alignment.c +36 -8
@@ -767,6 +767,36 @@ do_alignment_t32_to_handler(unsigned long *pinstr, struct pt_regs *regs,return NULL ; } +static int alignment_get_arm (struct pt_regs *regs,u32 *ip,unsigned long *inst) +{ +u32 instr =0 ; +int fault; + +if (user_mode (regs)) + fault =get_user (instr, ip); +else + fault =probe_kernel_address (ip, instr); + + *inst =__mem_to_opcode_arm (instr); + +return fault; +} + +static int alignment_get_thumb (struct pt_regs *regs,u16 *ip,u16 *inst) +{ +u16 instr =0 ; +int fault; + +if (user_mode (regs)) + fault =get_user (instr, ip); +else + fault =probe_kernel_address (ip, instr); + + *inst =__mem_to_opcode_thumb16 (instr); + +return fault; +} +static int do_alignment (unsigned long addr,unsigned int fsr,struct pt_regs *regs) {
@@ -774,10 +804,10 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)unsigned long instr =0 , instrptr;int (*handler)(unsigned long addr,unsigned long instr,struct pt_regs *regs);unsigned int type; -unsigned int fault;u16 tinstr =0 ;int isize =4 ;int thumb2_32b =0 ; +int fault;if (interrupts_enabled (regs))local_irq_enable ();
@@ -786,15 +816,14 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)if (thumb_mode (regs)) {u16 *ptr = (u16 *)(instrptr & ~1 ); - fault =probe_kernel_address (ptr, tinstr); - tinstr =__mem_to_opcode_thumb16 (tinstr); + + fault =alignment_get_thumb (regs, ptr, &tinstr);if (!fault) {if (cpu_architecture () >= CPU_ARCH_ARMv7 &&IS_T32 (tinstr)) {/* Thumb-2 32-bit */ -u16 tinst2 =0 ; - fault =probe_kernel_address (ptr +1 , tinst2); - tinst2 =__mem_to_opcode_thumb16 (tinst2); +u16 tinst2; + fault =alignment_get_thumb (regs, ptr +1 , &tinst2); instr =__opcode_thumb32_compose (tinstr, tinst2); thumb2_32b =1 ; }else {
@@ -803,8 +832,7 @@ do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs) } } }else { - fault =probe_kernel_address ((void *)instrptr, instr); - instr =__mem_to_opcode_arm (instr); + fault =alignment_get_arm (regs, (void *)instrptr, &instr); }if (fault) {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 8/34 scsi: scsi_dh_alua: handle RTPG sense code correctly during state transitions
In reply to Greg Kroah-HartmanFrom: Hannes Reinecke <[email protected]>
[ Upstream commit b6ce6fb121a655aefe41dccc077141c102145a37 ]
Some arrays are not capable of returning RTPG data during state transitioning, but rather return an 'LUN not accessible, asymmetric access state transition' sense code. In these cases we can set the state to 'transitioning' directly and don't need to evaluate the RTPG data (which we won't have anyway).
--- drivers/scsi/device_handler/scsi_dh_alua.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-)
drivers/scsi/device_handler/scsi_dh_alua.c +16 -5
@@ -527,6 +527,7 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg)unsigned int tpg_desc_tbl_off;unsigned char orig_transition_tmo;unsigned long flags; +bool transitioning_sense = false;if (!pg->expiry) {unsigned long transition_tmo =ALUA_FAILOVER_TIMEOUT *HZ ;
@@ -571,13 +572,19 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) goto retry; }/* -* Retry on ALUA state transition or if any -* UNIT ATTENTION occurred. +* If the array returns with 'ALUA state transition' +* sense code here it cannot return RTPG data during +* transition. So set the state to 'transitioning' directly. */ if (sense_hdr.sense_key ==NOT_READY && - sense_hdr.asc ==0x04 && sense_hdr.ascq ==0x0a ) - err =SCSI_DH_RETRY ; -else if (sense_hdr.sense_key ==UNIT_ATTENTION ) + sense_hdr.asc ==0x04 && sense_hdr.ascq ==0x0a ) { + transitioning_sense = true; + goto skip_rtpg; + } +/* +* Retry on any other UNIT ATTENTION occurred. +*/ +if (sense_hdr.sense_key ==UNIT_ATTENTION ) err =SCSI_DH_RETRY ;if (err ==SCSI_DH_RETRY && pg->expiry !=0 &&time_before (jiffies, pg->expiry)) {
@@ -665,7 +672,11 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) off =8 + (desc[7 ] *4 ); } + skip_rtpg:spin_lock_irqsave (&pg->lock, flags); +if (transitioning_sense) + pg->state =SCSI_ACCESS_STATE_TRANSITIONING ; + sdev_printk(KERN_INFO, sdev, "%s: port group %02x state %c %s supports %c%c%c%c%c%c%c\n", ALUA_DH_NAME, pg->group_id, print_alua_state(pg->state),
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 9/34 scsi: sni_53c710: fix compilation error
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit 0ee6211408a8e939428f662833c7301394125b80 ]
Drop out memory dev_printk() with wrong device pointer argument.
[mkp: typo]
--- drivers/scsi/sni_53c710.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
drivers/scsi/sni_53c710.c +1 -3
@@ -78,10 +78,8 @@ static int snirm710_probe(struct platform_device *dev) base = res->start; hostdata =kzalloc (sizeof (*hostdata),GFP_KERNEL ); -if (!hostdata) { -dev_printk (KERN_ERR , dev,"Failed to allocate host data\n" ); +if (!hostdata)return -ENOMEM ; - } hostdata->dev = &dev->dev;dma_set_mask (&dev->dev,DMA_BIT_MASK (32 ));
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 10/34 scsi: fix kconfig dependency warning related to 53C700_LE_ON_BE
In reply to Greg Kroah-HartmanFrom: Thomas Bogendoerfer <[email protected]>
[ Upstream commit 8cbf0c173aa096dda526d1ccd66fc751c31da346 ]
When building a kernel with SCSI_SNI_53C710 enabled, Kconfig warns:
WARNING: unmet direct dependencies detected for 53C700_LE_ON_BE
Depends on [n]: SCSI_LOWLEVEL [=y] && SCSI [=y] && SCSI_LASI700 [=n] Selected by [y]:
- SCSI_SNI_53C710 [=y] && SCSI_LOWLEVEL [=y] && SNI_RM [=y] && SCSI [=y]
Add the missing depends SCSI_SNI_53C710 to 53C700_LE_ON_BE to fix it.
--- drivers/scsi/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/scsi/Kconfig +1 -1
@@ -986,7 +986,7 @@ config SCSI_SNI_53C710 config 53C700_LE_ON_BE bool - depends on SCSI_LASI700 + depends on SCSI_LASI700 || SCSI_SNI_53C710 default y config SCSI_STEX
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 11/34 ARM: dts: imx7s: Correct GPTs ipg clock source
In reply to Greg Kroah-HartmanFrom: Anson Huang <[email protected]>
[ Upstream commit 252b9e21bcf46b0d16f733f2e42b21fdc60addee ]
i.MX7S/D's GPT ipg clock should be from GPT clock root and controlled by CCM's GPT CCGR, using correct clock source for GPT ipg clock instead of IMX7D_CLK_DUMMY.
--- arch/arm/boot/dts/imx7s.dtsi | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/arm/boot/dts/imx7s.dtsi +4 -4
@@ -437,7 +437,7 @@ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; reg = <0x302d0000 0x10000>; interrupts = <GIC_SPI 55 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clks IMX7D_CLK_DUMMY>, + clocks = <&clks IMX7D_GPT1_ROOT_CLK>, <&clks IMX7D_GPT1_ROOT_CLK>; clock-names = "ipg", "per"; };
@@ -446,7 +446,7 @@ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; reg = <0x302e0000 0x10000>; interrupts = <GIC_SPI 54 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clks IMX7D_CLK_DUMMY>, + clocks = <&clks IMX7D_GPT2_ROOT_CLK>, <&clks IMX7D_GPT2_ROOT_CLK>; clock-names = "ipg", "per"; status = "disabled";
@@ -456,7 +456,7 @@ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; reg = <0x302f0000 0x10000>; interrupts = <GIC_SPI 53 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clks IMX7D_CLK_DUMMY>, + clocks = <&clks IMX7D_GPT3_ROOT_CLK>, <&clks IMX7D_GPT3_ROOT_CLK>; clock-names = "ipg", "per"; status = "disabled";
@@ -466,7 +466,7 @@ compatible = "fsl,imx7d-gpt", "fsl,imx6sx-gpt"; reg = <0x30300000 0x10000>; interrupts = <GIC_SPI 52 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&clks IMX7D_CLK_DUMMY>, + clocks = <&clks IMX7D_GPT4_ROOT_CLK>, <&clks IMX7D_GPT4_ROOT_CLK>; clock-names = "ipg", "per"; status = "disabled";
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 12/34 perf kmem: Fix memory leak in compact_gfp_flags()
In reply to Greg Kroah-HartmanFrom: Yunfeng Ye <[email protected]>
[ Upstream commit 1abecfcaa7bba21c9985e0136fa49836164dd8fd ]
The memory @orig_flags is allocated by strdup(), it is freed on the normal path, but leak to free on the error path.
Fix this by adding free(orig_flags) on the error path.
--- tools/perf/builtin-kmem.c | 1 + 1 file changed, 1 insertion(+)
tools/perf/builtin-kmem.c +1 -0
@@ -674,6 +674,7 @@ static char *compact_gfp_flags(char *gfp_flags) new =realloc (new_flags, len +strlen (cpt) +2 );if (new ==NULL ) {free (new_flags); +free (orig_flags);return NULL ; }
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 13/34 ARM: davinci: dm365: Fix McBSP dma_slave_map entry
In reply to Greg Kroah-HartmanFrom: Peter Ujfalusi <[email protected]>
[ Upstream commit 564b6bb9d42d31fc80c006658cf38940a9b99616 ]
dm365 have only single McBSP, so the device name is without .0
--- arch/arm/mach-davinci/dm365.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mach-davinci/dm365.c +2 -2
@@ -864,8 +864,8 @@ static s8 dm365_queue_priority_mapping[][2] = { };static const struct dma_slave_map dm365_edma_map[] = { - {"davinci-mcbsp.0" ,"tx" ,EDMA_FILTER_PARAM (0 ,2 ) }, - {"davinci-mcbsp.0" ,"rx" ,EDMA_FILTER_PARAM (0 ,3 ) }, + {"davinci-mcbsp" ,"tx" ,EDMA_FILTER_PARAM (0 ,2 ) }, + {"davinci-mcbsp" ,"rx" ,EDMA_FILTER_PARAM (0 ,3 ) }, {"davinci_voicecodec" ,"tx" ,EDMA_FILTER_PARAM (0 ,2 ) }, {"davinci_voicecodec" ,"rx" ,EDMA_FILTER_PARAM (0 ,3 ) }, {"spi_davinci.2" ,"tx" ,EDMA_FILTER_PARAM (0 ,10 ) },
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 14/34 scsi: target: core: Do not overwrite CDB byte 1
In reply to Greg Kroah-HartmanFrom: Bodo Stroesser <[email protected]>
[ Upstream commit 27e84243cb63601a10e366afe3e2d05bb03c1cb5 ]
passthrough_parse_cdb() - used by TCMU and PSCSI - attepts to reset the LUN field of SCSI-2 CDBs (bits 5,6,7 of byte 1). The current code is wrong as for newer commands not having the LUN field it overwrites relevant command bits (e.g. for SECURITY PROTOCOL IN / OUT). We think this code was unnecessary from the beginning or at least it is no longer useful. So we remove it entirely.
--- drivers/target/target_core_device.c | 21 --------------------- 1 file changed, 21 deletions(-)
drivers/target/target_core_device.c +0 -21
@@ -1046,27 +1046,6 @@ passthrough_parse_cdb(struct se_cmd *cmd, {unsigned char *cdb = cmd->t_task_cdb; -/* -* Clear a lun set in the cdb if the initiator talking to use spoke -* and old standards version, as we can't assume the underlying device -* won't choke up on it. -*/ -switch (cdb[0 ]) { -case READ_10 :/* SBC - RDProtect */ -case READ_12 :/* SBC - RDProtect */ -case READ_16 :/* SBC - RDProtect */ -case SEND_DIAGNOSTIC :/* SPC - SELF-TEST Code */ -case VERIFY :/* SBC - VRProtect */ -case VERIFY_16 :/* SBC - VRProtect */ -case WRITE_VERIFY :/* SBC - VRProtect */ -case WRITE_VERIFY_12 :/* SBC - VRProtect */ -case MAINTENANCE_IN :/* SPC - Parameter Data Format for SA RTPG */ -break ; -default : - cdb[1 ] &=0x1f ;/* clear logical unit number */ -break ; - } -/* * For REPORT LUNS we always need to emulate the response, for everything * else, pass it up.
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 15/34 of: unittest: fix memory leak in unittest_data_add
In reply to Greg Kroah-HartmanFrom: Navid Emamdoost <[email protected]>
[ Upstream commit e13de8fe0d6a51341671bbe384826d527afe8d44 ]
In unittest_data_add, a copy buffer is created via kmemdup. This buffer is leaked if of_fdt_unflatten_tree fails. The release for the unittest_data buffer is added.
--- drivers/of/unittest.c | 1 + 1 file changed, 1 insertion(+)
drivers/of/unittest.c +1 -0
@@ -933,6 +933,7 @@ static int __init unittest_data_add(void)of_fdt_unflatten_tree (unittest_data,NULL , &unittest_data_node);if (!unittest_data_node) {pr_warn ("%s: No tree to attach; not running tests\n" , __func__); +kfree (unittest_data);return -ENODATA ; }of_node_set_flag (unittest_data_node,OF_DETACHED );
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 16/34 MIPS: bmips: mark exception vectors as char arrays
In reply to Greg Kroah-HartmanFrom: Jonas Gorski <[email protected]>
[ Upstream commit e4f5cb1a9b27c0f94ef4f5a0178a3fde2d3d0e9e ]
The vectors span more than one byte, so mark them as arrays.
Fixes the following build error when building when using GCC 8.3:
In file included from ./include/linux/string.h:19,
from ./include/linux/bitmap.h:9,
from ./include/linux/cpumask.h:12,
from ./arch/mips/include/asm/processor.h:15,
from ./arch/mips/include/asm/thread_info.h:16,
from ./include/linux/thread_info.h:38,
from ./include/asm-generic/preempt.h:5,
from ./arch/mips/include/generated/asm/preempt.h:1,
from ./include/linux/preempt.h:81,
from ./include/linux/spinlock.h:51,
from ./include/linux/mmzone.h:8,
from ./include/linux/bootmem.h:8,
from arch/mips/bcm63xx/prom.c:10:
arch/mips/bcm63xx/prom.c: In function 'prom_init':
./arch/mips/include/asm/string.h:162:11: error: '__builtin_memcpy' forming offset [2, 32] is out of the bounds [0, 1] of object 'bmips_smp_movevec' with type 'char' [-Werror=array-bounds]
__ret = __builtin_memcpy((dst), (src), __len); \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~arch/mips/bcm63xx/prom.c:97:3: note: in expansion of macro 'memcpy'
memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
^~~~~~
In file included from arch/mips/bcm63xx/prom.c:14:./arch/mips/include/asm/bmips.h:80:13: note: 'bmips_smp_movevec' declared here
extern char bmips_smp_movevec;
--- arch/mips/bcm63xx/prom.c | 2 +- arch/mips/include/asm/bmips.h | 10 +++++----- arch/mips/kernel/smp-bmips.c | 8 ++++---- 3 files changed, 10 insertions(+), 10 deletions(-)
arch/mips/bcm63xx/prom.c +1 -1
@@ -84,7 +84,7 @@ void __init prom_init(void)* Here we will start up CPU1 in the background and ask it to * reconfigure itself then go back to sleep. */ -memcpy ((void *)0xa0000200 , &bmips_smp_movevec,0x20 ); +memcpy ((void *)0xa0000200 , bmips_smp_movevec,0x20 );__sync ();set_c0_cause (C_SW0 );cpumask_set_cpu (1 , &bmips_booted_mask);
arch/mips/include/asm/bmips.h +5 -5
@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops(void)#endif } -extern char bmips_reset_nmi_vec; -extern char bmips_reset_nmi_vec_end; -extern char bmips_smp_movevec; -extern char bmips_smp_int_vec; -extern char bmips_smp_int_vec_end; +extern char bmips_reset_nmi_vec[]; +extern char bmips_reset_nmi_vec_end[]; +extern char bmips_smp_movevec[]; +extern char bmips_smp_int_vec[]; +extern char bmips_smp_int_vec_end[];extern int bmips_smp_enabled;extern int bmips_cpu_offset;
arch/mips/kernel/smp-bmips.c +4 -4
@@ -453,10 +453,10 @@ static void bmips_wr_vec(unsigned long dst, char *start, char *end)static inline void bmips_nmi_handler_setup (void ) { -bmips_wr_vec (BMIPS_NMI_RESET_VEC , &bmips_reset_nmi_vec, - &bmips_reset_nmi_vec_end); -bmips_wr_vec (BMIPS_WARM_RESTART_VEC , &bmips_smp_int_vec, - &bmips_smp_int_vec_end); +bmips_wr_vec (BMIPS_NMI_RESET_VEC , bmips_reset_nmi_vec, + bmips_reset_nmi_vec_end); +bmips_wr_vec (BMIPS_WARM_RESTART_VEC , bmips_smp_int_vec, + bmips_smp_int_vec_end); }struct reset_vec_info {
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 17/34 cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs
In reply to Greg Kroah-HartmanFrom: Dave Wysochanski <[email protected]>
[ Upstream commit d46b0da7a33dd8c99d969834f682267a45444ab3 ]
There's a deadlock that is possible and can easily be seen with a test where multiple readers open/read/close of the same file and a disruption occurs causing reconnect. The deadlock is due a reader thread inside cifs_strict_readv calling down_read and obtaining lock_sem, and then after reconnect inside cifs_reopen_file calling down_read a second time. If in between the two down_read calls, a down_write comes from another process, deadlock occurs.
CPU0 CPU1
---- ----
cifs_strict_readv()
down_read(&cifsi->lock_sem);
_cifsFileInfo_put
OR
cifs_new_fileinfo
down_write(&cifsi->lock_sem);cifs_reopen_file()
down_read(&cifsi->lock_sem);
Fix the above by changing all down_write(lock_sem) calls to down_write_trylock(lock_sem)/msleep() loop, which in turn makes the second down_read call benign since it will never block behind the writer while holding lock_sem.
--- fs/cifs/cifsglob.h | 5 +++++ fs/cifs/cifsproto.h | 1 + fs/cifs/file.c | 23 +++++++++++++++-------- fs/cifs/smb2file.c | 2 +- 4 files changed, 22 insertions(+), 9 deletions(-)
fs/cifs/cifsglob.h +5 -0
@@ -1178,6 +1178,11 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);struct cifsInodeInfo {bool can_cache_brlcks;struct list_head llist;/* locks helb by this inode */ +/* +* NOTE: Some code paths call down_read(lock_sem) twice, so +* we must always use use cifs_down_write() instead of down_write() +* for this semaphore to avoid deadlocks. +*/ struct rw_semaphore lock_sem;/* protect the fields above */ /* BB add in lists for dirty pages i.e. write caching info for oplock */ struct list_head openFileList;
fs/cifs/cifsproto.h +1 -0
@@ -138,6 +138,7 @@ extern int cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, const unsigned int xid);extern int cifs_push_mandatory_locks (struct cifsFileInfo *cfile); +extern void cifs_down_write (struct rw_semaphore *sem); extern struct cifsFileInfo *cifs_new_fileinfo(struct cifs_fid *fid, struct file *file, struct tcon_link *tlink,
fs/cifs/file.c +15 -8
@@ -280,6 +280,13 @@ cifs_has_mand_locks(struct cifsInodeInfo *cinode)return has_locks; } +void +cifs_down_write (struct rw_semaphore *sem) +{ +while (!down_write_trylock (sem)) +msleep (10 ); +} +struct cifsFileInfo *cifs_new_fileinfo (struct cifs_fid *fid,struct file *file,struct tcon_link *tlink,__u32 oplock)
@@ -305,7 +312,7 @@ cifs_new_fileinfo(struct cifs_fid *fid, struct file *file,INIT_LIST_HEAD (&fdlocks->locks); fdlocks->cfile = cfile; cfile->llist = fdlocks; -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);list_add (&fdlocks->llist, &cinode->llist);up_write (&cinode->lock_sem);
@@ -457,7 +464,7 @@ void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)* Delete any outstanding lock records. We'll lose them when the file * is closed anyway. */ -down_write (&cifsi->lock_sem); +cifs_down_write (&cifsi->lock_sem);list_for_each_entry_safe (li, tmp, &cifs_file->llist->locks, llist) {list_del (&li->llist);cifs_del_lock_waiters (li);
@@ -1011,7 +1018,7 @@ static void cifs_lock_add(struct cifsFileInfo *cfile, struct cifsLockInfo *lock) { struct cifsInodeInfo *cinode = CIFS_I(d_inode(cfile->dentry)); -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);list_add_tail (&lock->llist, &cfile->llist->locks);up_write (&cinode->lock_sem); }
@@ -1033,7 +1040,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock, try_again: exist = false; -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem); exist =cifs_find_lock_conflict (cfile, lock->offset, lock->length, lock->type, &conf_lock,CIFS_LOCK_OP );
@@ -1055,7 +1062,7 @@ cifs_lock_add_if(struct cifsFileInfo *cfile, struct cifsLockInfo *lock, (lock->blist.next == &lock->blist));if (!rc) goto try_again; -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);list_del_init (&lock->blist); }
@@ -1108,7 +1115,7 @@ cifs_posix_lock_set(struct file *file, struct file_lock *flock)return rc; try_again: -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);if (!cinode->can_cache_brlcks) {up_write (&cinode->lock_sem);return rc;
@@ -1312,7 +1319,7 @@ cifs_push_locks(struct cifsFileInfo *cfile)int rc =0 ;/* we are going to update can_cache_brlcks here - need a write access */ -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);if (!cinode->can_cache_brlcks) {up_write (&cinode->lock_sem);return rc;
@@ -1501,7 +1508,7 @@ cifs_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock,if (!buf)return -ENOMEM ; -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem);for (i =0 ; i <2 ; i++) { cur = buf; num =0 ;
fs/cifs/smb2file.c +1 -1
@@ -138,7 +138,7 @@ smb2_unlock_range(struct cifsFileInfo *cfile, struct file_lock *flock, cur = buf; -down_write (&cinode->lock_sem); +cifs_down_write (&cinode->lock_sem); list_for_each_entry_safe(li, tmp, &cfile->llist->locks, llist) { if (flock->fl_start > li->offset || (flock->fl_start + length) <
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 18/34 dccp: do not leak jiffies on the wire
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 3d1e5039f5f87a8731202ceca08764ee7cb010d3 ]
For some reason I missed the case of DCCP passive
flows in my previous patch.
--- net/dccp/ipv4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dccp/ipv4.c +1 -1
@@ -417,7 +417,7 @@ struct sock *dccp_v4_request_recv_sock(cRCU_INIT_POINTER (newinet->inet_opt,rcu_dereference (ireq->ireq_opt)); newinet->mc_index =inet_iif (skb); newinet->mc_ttl =ip_hdr (skb)->ttl; - newinet->inet_id = jiffies; + newinet->inet_id =prandom_u32 ();if (dst ==NULL && (dst =inet_csk_route_child_sock (sk, newsk, req)) ==NULL ) goto put_and_exit;
Greg Kroah-Hartman
maintainerPATCH 19/34 net: fix sk_page_frag() recursion from memory reclaim
In reply to Greg Kroah-HartmanFrom: Tejun Heo <[email protected]>
[ Upstream commit 20eb4f29b60286e0d6dc01d9c260b4bd383c58fb ]
sk_page_frag() optimizes skb_frag allocations by using per-task skb_frag cache when it knows it's the only user. The condition is determined by seeing whether the socket allocation mask allows blocking - if the allocation may block, it obviously owns the task's context and ergo exclusively owns current->task_frag.
Unfortunately, this misses recursion through memory reclaim path. Please take a look at the following backtrace.
[2] RIP: 0010:tcp_sendmsg_locked+0xccf/0xe10
...
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
sock_xmit.isra.24+0xa1/0x170 [nbd]
nbd_send_cmd+0x1d2/0x690 [nbd]
nbd_queue_rq+0x1b5/0x3b0 [nbd]
__blk_mq_try_issue_directly+0x108/0x1b0
blk_mq_request_issue_directly+0xbd/0xe0
blk_mq_try_issue_list_directly+0x41/0xb0
blk_mq_sched_insert_requests+0xa2/0xe0
blk_mq_flush_plug_list+0x205/0x2a0
blk_flush_plug_list+0xc3/0xf0
[1] blk_finish_plug+0x21/0x2e
_xfs_buf_ioapply+0x313/0x460
__xfs_buf_submit+0x67/0x220
xfs_buf_read_map+0x113/0x1a0
xfs_trans_read_buf_map+0xbf/0x330
xfs_btree_read_buf_block.constprop.42+0x95/0xd0
xfs_btree_lookup_get_block+0x95/0x170
xfs_btree_lookup+0xcc/0x470
xfs_bmap_del_extent_real+0x254/0x9a0
__xfs_bunmapi+0x45c/0xab0
xfs_bunmapi+0x15/0x30
xfs_itruncate_extents_flags+0xca/0x250
xfs_free_eofblocks+0x181/0x1e0
xfs_fs_destroy_inode+0xa8/0x1b0
destroy_inode+0x38/0x70
dispose_list+0x35/0x50
prune_icache_sb+0x52/0x70
super_cache_scan+0x120/0x1a0
do_shrink_slab+0x120/0x290
shrink_slab+0x216/0x2b0
shrink_node+0x1b6/0x4a0
do_try_to_free_pages+0xc6/0x370
try_to_free_mem_cgroup_pages+0xe3/0x1e0
try_charge+0x29e/0x790
mem_cgroup_charge_skmem+0x6a/0x100
__sk_mem_raise_allocated+0x18e/0x390
__sk_mem_schedule+0x2a/0x40
[0] tcp_sendmsg_locked+0x8eb/0xe10
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
___sys_sendmsg+0x26d/0x2b0
__sys_sendmsg+0x57/0xa0
do_syscall_64+0x42/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9In [0], tcp_send_msg_locked() was using current->page_frag when it called sk_wmem_schedule(). It already calculated how many bytes can be fit into current->page_frag. Due to memory pressure, sk_wmem_schedule() called into memory reclaim path which called into xfs and then IO issue path. Because the filesystem in question is backed by nbd, the control goes back into the tcp layer - back into tcp_sendmsg_locked().
nbd sets sk_allocation to (GFP_NOIO | __GFP_MEMALLOC) which makes sense - it's in the process of freeing memory and wants to be able to, e.g., drop clean pages to make forward progress. However, this confused sk_page_frag() called from [2]. Because it only tests whether the allocation allows blocking which it does, it now thinks current->page_frag can be used again although it already was being used in [0].
After [2] used current->page_frag, the offset would be increased by the used amount. When the control returns to [0], current->page_frag's offset is increased and the previously calculated number of bytes now may overrun the end of allocated memory leading to silent memory corruptions.
Fix it by adding gfpflags_normal_context() which tests sleepable && !reclaim and use it to determine whether to use current->task_frag.
v2: Eric didn't like gfp flags being tested twice. Introduce a new
helper gfpflags_normal_context() and combine the two tests.
--- include/linux/gfp.h | 23 +++++++++++++++++++++++ include/net/sock.h | 11 ++++++++--- 2 files changed, 31 insertions(+), 3 deletions(-)
include/linux/gfp.h +23 -0
@@ -284,6 +284,29 @@ static inline bool gfpflags_allow_blockireturn !!(gfp_flags & __GFP_DIRECT_RECLAIM); } +/** +* gfpflags_normal_context - is gfp_flags a normal sleepable context? +* @gfp_flags: gfp_flags to test +* +* Test whether @gfp_flags indicates that the allocation is from the +* %current context and allowed to sleep. +* +* An allocation being allowed to block doesn't mean it owns the %current +* context. When direct reclaim path tries to allocate memory, the +* allocation context is nested inside whatever %current was doing at the +* time of the original allocation. The nested allocation may be allowed +* to block but modifying anything %current owns can corrupt the outer +* context's expectations. +* +* %true result from this function indicates that the allocation context +* can sleep and use anything that's associated with %current. +*/ +static inline bool gfpflags_normal_context (const gfp_t gfp_flags) +{ +return (gfp_flags & (__GFP_DIRECT_RECLAIM | __GFP_MEMALLOC)) == + __GFP_DIRECT_RECLAIM; +} +#ifdef CONFIG_HIGHMEM #define OPT_ZONE_HIGHMEM ZONE_HIGHMEM#else
include/net/sock.h +8 -3
@@ -2045,12 +2045,17 @@ struct sk_buff *sk_stream_alloc_skb(stru* sk_page_frag - return an appropriate page_frag * @sk: socket * -* If socket allocation mode allows current thread to sleep, it means its -* safe to use the per task page_frag instead of the per socket one. +* Use the per task page_frag instead of the per socket one for +* optimization when we know that we're in the normal context and owns +* everything that's associated with %current. +* +* gfpflags_allow_blocking() isn't enough here as direct reclaim may nest +* inside other socket operations and end up recursing into sk_page_frag() +* while it's already in use. */ static inline struct page_frag *sk_page_frag (struct sock *sk) { -if (gfpflags_allow_blocking (sk->sk_allocation)) +if (gfpflags_normal_context (sk->sk_allocation))return ¤t->task_frag;return &sk->sk_frag;
Greg Kroah-Hartman
maintainerPATCH 20/34 net: hisilicon: Fix ping latency when deal with high throughput
In reply to Greg Kroah-HartmanFrom: Jiangfeng Xiao <[email protected]>
[ Upstream commit e56bd641ca61beb92b135298d5046905f920b734 ]
This is due to error in over budget processing.
When dealing with high throughput, the used buffers
that exceeds the budget is not cleaned up. In addition, it takes a lot of cycles to clean up the used buffer,
and then the buffer where the valid data is located can take effect.
--- drivers/net/ethernet/hisilicon/hip04_eth.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-)
drivers/net/ethernet/hisilicon/hip04_eth.c +9 -6
@@ -174,6 +174,7 @@ struct hip04_priv {dma_addr_t rx_phys[RX_DESC_NUM ];unsigned int rx_head;unsigned int rx_buf_size; +unsigned int rx_cnt_remaining;struct device_node *phy_node;struct phy_device *phy;
@@ -487,7 +488,6 @@ static int hip04_rx_poll(struct napi_str struct hip04_priv *priv = container_of(napi, struct hip04_priv, napi);struct net_device *ndev = priv->ndev;struct net_device_stats *stats = &ndev->stats; -unsigned int cnt =hip04_recv_cnt (priv);struct rx_desc *desc;struct sk_buff *skb;unsigned char *buf;
@@ -500,8 +500,8 @@ static int hip04_rx_poll(struct napi_str/* clean up tx descriptors */ tx_remaining =hip04_tx_reclaim (ndev, false); - -while (cnt && !last) { + priv->rx_cnt_remaining +=hip04_recv_cnt (priv); +while (priv->rx_cnt_remaining && !last) { buf = priv->rx_buf[priv->rx_head]; skb =build_skb (buf, priv->rx_buf_size);if (unlikely (!skb)) {
@@ -547,11 +547,13 @@ refill:hip04_set_recv_desc (priv, phys); priv->rx_head =RX_NEXT (priv->rx_head); -if (rx >= budget) +if (rx >= budget) { + --priv->rx_cnt_remaining; goto done; + } -if (--cnt ==0 ) - cnt =hip04_recv_cnt (priv); +if (--priv->rx_cnt_remaining ==0 ) + priv->rx_cnt_remaining +=hip04_recv_cnt (priv); }if (!(priv->reg_inten &RCV_INT )) {
@@ -636,6 +638,7 @@ static int hip04_mac_open(struct net_devint i; priv->rx_head =0 ; + priv->rx_cnt_remaining =0 ; priv->tx_head =0 ; priv->tx_tail =0 ;hip04_reset_ppe (priv);
Greg Kroah-Hartman
maintainerPATCH 21/34 net: Zeroing the structure ethtool_wolinfo in ethtool_get_wol()
In reply to Greg Kroah-HartmanFrom: zhanglin <[email protected]>
[ Upstream commit 5ff223e86f5addbfae26419cbb5d61d98f6fbf7d ]
memset() the structure ethtool_wolinfo that has padded bytes but the padded bytes have not been zeroed out.
--- net/core/ethtool.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
net/core/ethtool.c +3 -1
@@ -1438,11 +1438,13 @@ static int ethtool_reset(struct net_devistatic int ethtool_get_wol (struct net_device *dev,char __user *useraddr) { -struct ethtool_wolinfo wol = { .cmd =ETHTOOL_GWOL }; +struct ethtool_wolinfo wol;if (!dev->ethtool_ops->get_wol)return -EOPNOTSUPP ; +memset (&wol,0 ,sizeof (struct ethtool_wolinfo )); + wol.cmd =ETHTOOL_GWOL ; dev->ethtool_ops->get_wol (dev, &wol);if (copy_to_user (useraddr, &wol,sizeof (wol)))
Greg Kroah-Hartman
maintainerPATCH 22/34 selftests: net: reuseport_dualstack: fix uninitalized parameter
In reply to Greg Kroah-HartmanFrom: Wei Wang <[email protected]>
[ Upstream commit d64479a3e3f9924074ca7b50bd72fa5211dca9c1 ]
This test reports EINVAL for getsockopt(SOL_SOCKET, SO_DOMAIN) occasionally due to the uninitialized length parameter. Initialize it to fix this, and also use int for "test_family" to comply with the API standard.
--- tools/testing/selftests/net/reuseport_dualstack.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/net/reuseport_dualstack.c +2 -1
@@ -128,7 +128,7 @@ static void test(int *rcv_fds, int count {struct epoll_event ev;int epfd, i, test_fd; -uint16_t test_family; +int test_family;socklen_t len; epfd =epoll_create (1 );
@@ -145,6 +145,7 @@ static void test(int *rcv_fds, int countsend_from_v4 (proto); test_fd =receive_once (epfd, proto); + len =sizeof (test_family);if (getsockopt (test_fd,SOL_SOCKET ,SO_DOMAIN , &test_family, &len))error (1 , errno,"failed to read socket domain" );if (test_family !=AF_INET )
Greg Kroah-Hartman
maintainerPATCH 23/34 net: add READ_ONCE() annotation in __skb_wait_for_more_packets()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 7c422d0ce97552dde4a97e6290de70ec6efb0fc6 ]
__skb_wait_for_more_packets() can be called while other cpus can feed packets to the socket receive queue.
KCSAN reported :
BUG: KCSAN: data-race in __skb_wait_for_more_packets / __udp_enqueue_schedule_skb
write to 0xffff888102e40b58 of 8 bytes by interrupt on cpu 0:
__skb_insert include/linux/skbuff.h:1852 [inline] __skb_queue_before include/linux/skbuff.h:1958 [inline] __skb_queue_tail include/linux/skbuff.h:1991 [inline] __udp_enqueue_schedule_skb+0x2d7/0x410 net/ipv4/udp.c:1470 __udp_queue_rcv_skb net/ipv4/udp.c:1940 [inline] udp_queue_rcv_one_skb+0x7bd/0xc70 net/ipv4/udp.c:2057 udp_queue_rcv_skb+0xb5/0x400 net/ipv4/udp.c:2074 udp_unicast_rcv_skb.isra.0+0x7e/0x1c0 net/ipv4/udp.c:2233 __udp4_lib_rcv+0xa44/0x17c0 net/ipv4/udp.c:2300 udp_rcv+0x2b/0x40 net/ipv4/udp.c:2470 ip_protocol_deliver_rcu+0x4d/0x420 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x110/0x140 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_local_deliver+0x133/0x210 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:442 [inline] ip_rcv_finish+0x121/0x160 net/ipv4/ip_input.c:413 NF_HOOK include/linux/netfilter.h:305 [inline] NF_HOOK include/linux/netfilter.h:299 [inline] ip_rcv+0x18f/0x1a0 net/ipv4/ip_input.c:523 __netif_receive_skb_one_core+0xa7/0xe0 net/core/dev.c:5010 __netif_receive_skb+0x37/0xf0 net/core/dev.c:5124 process_backlog+0x1d3/0x420 net/core/dev.c:5955
read to 0xffff888102e40b58 of 8 bytes by task 13035 on cpu 1:
__skb_wait_for_more_packets+0xfa/0x320 net/core/datagram.c:100 __skb_recv_udp+0x374/0x500 net/ipv4/udp.c:1683 udp_recvmsg+0xe1/0xb10 net/ipv4/udp.c:1712 inet_recvmsg+0xbb/0x250 net/ipv4/af_inet.c:838 sock_recvmsg_nosec+0x5c/0x70 net/socket.c:871 ___sys_recvmsg+0x1a0/0x3e0 net/socket.c:2480 do_recvmmsg+0x19a/0x5c0 net/socket.c:2601 __sys_recvmmsg+0x1ef/0x200 net/socket.c:2680 __do_sys_recvmmsg net/socket.c:2703 [inline] __se_sys_recvmmsg net/socket.c:2696 [inline] __x64_sys_recvmmsg+0x89/0xb0 net/socket.c:2696 do_syscall_64+0xcc/0x370 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 13035 Comm: syz-executor.3 Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
--- net/core/datagram.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/core/datagram.c +1 -1
@@ -96,7 +96,7 @@ int __skb_wait_for_more_packets(struct sif (error) goto out_err; -if (sk->sk_receive_queue.prev != skb) +if (READ_ONCE (sk->sk_receive_queue.prev) != skb) goto out;/* Socket shut down? */
Greg Kroah-Hartman
maintainerPATCH 24/34 net: dsa: fix switch tree list
In reply to Greg Kroah-HartmanFrom: Vivien Didelot <[email protected]>
[ Upstream commit 50c7d2ba9de20f60a2d527ad6928209ef67e4cdd ]
If there are multiple switch trees on the device, only the last one will be listed, because the arguments of list_add_tail are swapped.
--- net/dsa/dsa2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/dsa/dsa2.c +1 -1
@@ -59,7 +59,7 @@ static struct dsa_switch_tree *dsa_add_d dst->tree = tree; dst->cpu_switch =-1 ;INIT_LIST_HEAD (&dst->list); -list_add_tail (&dsa_switch_trees, &dst->list); +list_add_tail (&dst->list, &dsa_switch_trees);kref_init (&dst->refcount);return dst;
Greg Kroah-Hartman
maintainerPATCH 25/34 net: bcmgenet: reset 40nm EPHY on energy detect
In reply to Greg Kroah-HartmanFrom: Doug Berger <[email protected]>
[ Upstream commit 25382b991d252aed961cd434176240f9de6bb15f ]
The EPHY integrated into the 40nm Set-Top Box devices can falsely detect energy when connected to a disabled peer interface. When the peer interface is enabled the EPHY will detect and report the link as active, but on occasion may get into a state where it is not able to exchange data with the connected GENET MAC. This issue has not been observed when the link parameters are auto-negotiated; however, it has been observed with a manually configured link.
It has been empirically determined that issuing a soft reset to the EPHY when energy is detected prevents it from getting into this bad state.
--- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/net/ethernet/broadcom/genet/bcmgenet.c +7 -2
@@ -1914,6 +1914,8 @@ static void bcmgenet_link_intr_enable(st*/ if (priv->internal_phy) { int0_enable |=UMAC_IRQ_LINK_EVENT ; +if (GENET_IS_V1 (priv) ||GENET_IS_V2 (priv) ||GENET_IS_V3 (priv)) + int0_enable |=UMAC_IRQ_PHY_DET_R ; }else if (priv->ext_phy) { int0_enable |=UMAC_IRQ_LINK_EVENT ; }else if (priv->phy_interface ==PHY_INTERFACE_MODE_MOCA ) {
@@ -2531,6 +2533,10 @@ static void bcmgenet_irq_task(struct worbcmgenet_power_up (priv,GENET_POWER_WOL_MAGIC ); } +if (status &UMAC_IRQ_PHY_DET_R && + priv->dev->phydev->autoneg !=AUTONEG_ENABLE ) +phy_init_hw (priv->dev->phydev); +/* Link UP/DOWN event */ if (status &UMAC_IRQ_LINK_EVENT ) phy_mac_interrupt(priv->phydev,
@@ -2627,8 +2633,7 @@ static irqreturn_t bcmgenet_isr0(int irq }/* all other interested interrupts handled in bottom half */ - status &= (UMAC_IRQ_LINK_EVENT | -UMAC_IRQ_MPD_R ); + status &= (UMAC_IRQ_LINK_EVENT |UMAC_IRQ_MPD_R |UMAC_IRQ_PHY_DET_R );if (status) {/* Save irq status for bottom-half processing. */ spin_lock_irqsave (&priv->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 26/34 vxlan: check tun_info options_len properly
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit eadf52cf1852196a1363044dcda22fa5d7f296f7 ]
This patch is to improve the tun_info options_len by dropping the skb when TUNNEL_VXLAN_OPT is set but options_len is less than vxlan_metadata. This can void a potential out-of-bounds access on ip_tun_info.
--- drivers/net/vxlan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/vxlan.c +4 -1
@@ -2049,8 +2049,11 @@ static void vxlan_xmit_one(struct sk_buf label = info->key.label; udp_sum = !!(info->key.tun_flags &TUNNEL_CSUM ); -if (info->options_len) +if (info->options_len) { +if (info->options_len <sizeof (*md)) + goto drop; md =ip_tunnel_info_opts (info); + } }else { md->gbp = skb->mark; }
Greg Kroah-Hartman
maintainerPATCH 27/34 net/mlx4_core: Dynamically set guaranteed amount of counters per VF
In reply to Greg Kroah-HartmanFrom: Eran Ben Elisha <[email protected]>
[ Upstream commit e19868efea0c103f23b4b7e986fd0a703822111f ]
Prior to this patch, the amount of counters guaranteed per VF in the resource tracker was MLX4_VF_COUNTERS_PER_PORT * MLX4_MAX_PORTS. It was set regardless if the VF was single or dual port.
This caused several VFs to have no guaranteed counters although the system could satisfy their request.
The fix is to dynamically guarantee counters, based on each VF specification.
--- drivers/net/ethernet/mellanox/mlx4/resource_tracker.c | 42 +++++++++++------- 1 file changed, 26 insertions(+), 16 deletions(-)
drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +26 -16
@@ -470,12 +470,31 @@ void mlx4_init_quotas(struct mlx4_dev *d priv->mfunc.master.res_tracker.res_alloc[RES_MPT ].quota[pf]; } -static int get_max_gauranteed_vfs_counter (struct mlx4_dev *dev) +static int +mlx4_calc_res_counter_guaranteed (struct mlx4_dev *dev, +struct resource_allocator *res_alloc, +int vf) { -/* reduce the sink counter */ -return (dev->caps.max_counters -1 - - (MLX4_PF_COUNTERS_PER_PORT *MLX4_MAX_PORTS )) - /MLX4_MAX_PORTS ; +struct mlx4_active_ports actv_ports; +int ports, counters_guaranteed; + +/* For master, only allocate according to the number of phys ports */ +if (vf ==mlx4_master_func_num (dev)) +return MLX4_PF_COUNTERS_PER_PORT * dev->caps.num_ports; + +/* calculate real number of ports for the VF */ + actv_ports =mlx4_get_active_ports (dev, vf); + ports =bitmap_weight (actv_ports.ports, dev->caps.num_ports); + counters_guaranteed = ports *MLX4_VF_COUNTERS_PER_PORT ; + +/* If we do not have enough counters for this VF, do not +* allocate any for it. '-1' to reduce the sink counter. +*/ +if ((res_alloc->res_reserved + counters_guaranteed) > + (dev->caps.max_counters -1 )) +return 0 ; + +return counters_guaranteed; }int mlx4_init_resource_tracker (struct mlx4_dev *dev)
@@ -483,7 +502,6 @@ int mlx4_init_resource_tracker(struct mlstruct mlx4_priv *priv =mlx4_priv (dev);int i, j;int t; -int max_vfs_guarantee_counter =get_max_gauranteed_vfs_counter (dev); priv->mfunc.master.res_tracker.slave_list = kzalloc(dev->num_slaves * sizeof(struct slave_list),
@@ -600,16 +618,8 @@ int mlx4_init_resource_tracker(struct mlbreak ;case RES_COUNTER : res_alloc->quota[t] = dev->caps.max_counters; -if (t ==mlx4_master_func_num (dev)) - res_alloc->guaranteed[t] = -MLX4_PF_COUNTERS_PER_PORT * -MLX4_MAX_PORTS ; -else if (t <= max_vfs_guarantee_counter) - res_alloc->guaranteed[t] = -MLX4_VF_COUNTERS_PER_PORT * -MLX4_MAX_PORTS ; -else - res_alloc->guaranteed[t] =0 ; + res_alloc->guaranteed[t] = +mlx4_calc_res_counter_guaranteed (dev, res_alloc, t); res_alloc->res_free -= res_alloc->guaranteed[t];break ;default :
Greg Kroah-Hartman
maintainerPATCH 28/34 inet: stop leaking jiffies on the wire
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit a904a0693c189691eeee64f6c6b188bd7dc244e9 ]
Historically linux tried to stick to RFC 791, 1122, 2003 for IPv4 ID field generation.
RFC 6864 made clear that no matter how hard we try, we can not ensure unicity of IP ID within maximum lifetime for all datagrams with a given source address/destination address/protocol tuple.
Linux uses a per socket inet generator (inet_id), initialized at connection startup with a XOR of 'jiffies' and other fields that appear clear on the wire.
Thiemo Nagel pointed that this strategy is a privacy concern as this provides 16 bits of entropy to fingerprint devices.
Let's switch to a random starting point, this is just as good as far as RFC 6864 is concerned and does not leak anything critical.
--- net/dccp/ipv4.c | 2 +- net/ipv4/datagram.c | 2 +- net/ipv4/tcp_ipv4.c | 4 ++-- net/sctp/socket.c | 2 +- 4 files changed, 5 insertions(+), 5 deletions(-)
net/dccp/ipv4.c +1 -1
@@ -121,7 +121,7 @@ int dccp_v4_connect(struct sock *sk, str inet->inet_daddr, inet->inet_sport, inet->inet_dport); - inet->inet_id = dp->dccps_iss ^ jiffies; + inet->inet_id =prandom_u32 (); err =dccp_connect (sk); rt =NULL ;
net/ipv4/datagram.c +1 -1
@@ -75,7 +75,7 @@ int __ip4_datagram_connect(struct sock * inet->inet_dport = usin->sin_port; sk->sk_state =TCP_ESTABLISHED ;sk_set_txhash (sk); - inet->inet_id = jiffies; + inet->inet_id =prandom_u32 ();sk_dst_set (sk, &rt->dst); err =0 ;
net/ipv4/tcp_ipv4.c +2 -2
@@ -239,7 +239,7 @@ int tcp_v4_connect(struct sock *sk, stru inet->inet_sport, usin->sin_port); - inet->inet_id = tp->write_seq ^ jiffies; + inet->inet_id =prandom_u32 (); err =tcp_connect (sk);
@@ -1307,7 +1307,7 @@ struct sock *tcp_v4_syn_recv_sock(constinet_csk (newsk)->icsk_ext_hdr_len =0 ;if (inet_opt)inet_csk (newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen; - newinet->inet_id = newtp->write_seq ^ jiffies; + newinet->inet_id =prandom_u32 ();if (!dst) { dst =inet_csk_route_child_sock (sk, newsk, req);
net/sctp/socket.c +1 -1
@@ -7734,7 +7734,7 @@ void sctp_copy_sock(struct sock *newsk, newinet->inet_rcv_saddr = inet->inet_rcv_saddr; newinet->inet_dport =htons (asoc->peer.port); newinet->pmtudisc = inet->pmtudisc; - newinet->inet_id = asoc->next_tsn ^ jiffies; + newinet->inet_id =prandom_u32 (); newinet->uc_ttl = inet->uc_ttl; newinet->mc_loop =1 ;
Greg Kroah-Hartman
maintainerPATCH 29/34 Kbuild: make designated_init attribute fatal
In reply to Greg Kroah-HartmanFrom: Kees Cook <[email protected]>
[ Upstream commit c834f0e8a8bb3025aac38e802fca2e686720f544 ]
If a structure is marked with __attribute__((designated_init)) from GCC or Sparse, it needs to have all static initializers using designated initialization. Fail the build for any missing cases. This attribute will be used by the randstruct plugin to make sure randomized structures are being correctly initialized.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -834,6 +834,9 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) # enforce correct pointer usage KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types) +# Require designated initializers for all marked structures +KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init) + # use the deterministic mode of AR if available KBUILD_ARFLAGS := $(call ar-option,D)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 30/34 kbuild: use -fmacro-prefix-map to make __FILE__ a relative path
In reply to Greg Kroah-HartmanFrom: Masahiro Yamada <[email protected]>
[ Upstream commit a73619a845d5625079cc1b3b820f44c899618388 ]
The __FILE__ macro is used everywhere in the kernel to locate the file printing the log message, such as WARN_ON(), etc. If the kernel is built out of tree, this can be a long absolute path, like this:
WARNING: CPU: 1 PID: 1 at /path/to/build/directory/arch/arm64/kernel/foo.c:...
This is because Kbuild runs in the objtree instead of the srctree, then __FILE__ is expanded to a file path prefixed with $(srctree)/.
Commit 9da0763bdd82 ("kbuild: Use relative path when building in a subdir of the source tree") improved this to some extent; $(srctree) becomes ".." if the objtree is a child of the srctree.
For other cases of out-of-tree build, __FILE__ is still the absolute path. It also means the kernel image depends on where it was built.
A brand-new option from GCC, -fmacro-prefix-map, solves this problem. If your compiler supports it, __FILE__ is the relative path from the srctree regardless of O= option. This provides more readable log and more reproducible builds.
Please note __FILE__ is always an absolute path for external modules.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -837,6 +837,9 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=incompatible-pointer-types) # Require designated initializers for all marked structures KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init) +# change __FILE__ to the relative path from the srctree +KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) + # use the deterministic mode of AR if available KBUILD_ARFLAGS := $(call ar-option,D)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 31/34 kbuild: add -fcf-protection=none when using retpoline flags
In reply to Greg Kroah-HartmanFrom: Seth Forshee <[email protected]>
[ Upstream commit 29be86d7f9cb18df4123f309ac7857570513e8bc ]
The gcc -fcf-protection=branch option is not compatible with -mindirect-branch=thunk-extern. The latter is used when CONFIG_RETPOLINE is selected, and this will fail to build with a gcc which has -fcf-protection=branch enabled by default. Adding -fcf-protection=none when building with retpoline enabled prevents such build failures.
--- Makefile | 6 ++++++ 1 file changed, 6 insertions(+)
Makefile +6 -0
@@ -840,6 +840,12 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=designated-init) # change __FILE__ to the relative path from the srctree KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=) +# ensure -fcf-protection is disabled when using retpoline as it is +# incompatible with -mindirect-branch=thunk-extern +ifdef CONFIG_RETPOLINE +KBUILD_CFLAGS += $(call cc-option,-fcf-protection=none) +endif + # use the deterministic mode of AR if available KBUILD_ARFLAGS := $(call ar-option,D)
Signature · 1 line
2.20.1
Greg Kroah-Hartman
maintainerPATCH 32/34 net/flow_dissector: switch to siphash
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 55667441c84fa5e0911a0aac44fb059c15ba6da2 upstream.
UDP IPv6 packets auto flowlabels are using a 32bit secret (static u32 hashrnd in net/core/flow_dissector.c) and apply jhash() over fields known by the receivers.
Attackers can easily infer the 32bit secret and use this information to identify a device and/or user, since this 32bit secret is only set at boot time.
Really, using jhash() to generate cookies sent on the wire is a serious security concern.
Trying to change the rol32(hash, 16) in ip6_make_flowlabel() would be a dead end. Trying to periodically change the secret (like in sch_sfq.c) could change paths taken in the network for long lived flows.
Let's switch to siphash, as we did in commit df453700e8d8 ("inet: switch IP ID generator to siphash")
Using a cryptographically strong pseudo random function will solve this privacy issue and more generally remove other weak points in the stack.
Packet schedulers using skb_get_hash_perturb() benefit from this change.
--- include/linux/skbuff.h | 3 +- include/net/flow_dissector.h | 3 +- include/net/fq.h | 2 - include/net/fq_impl.h | 4 +-- net/core/flow_dissector.c | 48 +++++++++++++++++-------------------------- net/sched/sch_fq_codel.c | 6 ++--- net/sched/sch_hhf.c | 8 +++---- net/sched/sch_sfb.c | 13 ++++++----- net/sched/sch_sfq.c | 14 +++++++----- 9 files changed, 49 insertions(+), 52 deletions(-)
include/linux/skbuff.h +2 -1
@@ -1178,7 +1178,8 @@ static inline __u32 skb_get_hash_flowi4(return skb->hash; } -__u32 skb_get_hash_perturb (const struct sk_buff *skb,u32 perturb); +__u32 skb_get_hash_perturb (const struct sk_buff *skb, +const siphash_key_t *perturb);static inline __u32 skb_get_hash_raw (const struct sk_buff *skb) {
include/net/flow_dissector.h +2 -1
@@ -3,6 +3,7 @@#include <linux/types.h> #include <linux/in6.h> +#include <linux/siphash.h> #include <uapi/linux/if_ether.h> /**
@@ -151,7 +152,7 @@ struct flow_dissector {struct flow_keys {struct flow_dissector_key_control control;#define FLOW_KEYS_HASH_START_FIELD basic -struct flow_dissector_key_basic basic; +struct flow_dissector_key_basic basic__aligned(SIPHASH_ALIGNMENT) ;struct flow_dissector_key_tags tags;struct flow_dissector_key_vlan vlan;struct flow_dissector_key_keyid keyid;
include/net/fq.h +1 -1
@@ -70,7 +70,7 @@ struct fq {struct list_head backlogs;spinlock_t lock;u32 flows_cnt; -u32 perturbation; +siphash_key_t perturbation;u32 limit;u32 memory_limit;u32 memory_usage;
include/net/fq_impl.h +2 -2
@@ -105,7 +105,7 @@ static struct fq_flow *fq_flow_classify(lockdep_assert_held (&fq->lock); - hash =skb_get_hash_perturb (skb, fq->perturbation); + hash =skb_get_hash_perturb (skb, &fq->perturbation); idx =reciprocal_scale (hash, fq->flows_cnt); flow = &fq->flows[idx];
@@ -252,7 +252,7 @@ static int fq_init(struct fq *fq, int flINIT_LIST_HEAD (&fq->backlogs);spin_lock_init (&fq->lock); fq->flows_cnt =max_t (u32, flows_cnt,1 ); - fq->perturbation =prandom_u32 (); +get_random_bytes (&fq->perturbation,sizeof (fq->perturbation)); fq->quantum =300 ; fq->limit =8192 ; fq->memory_limit =16 <<20 ;/* 16 MBytes */
net/core/flow_dissector.c +20 -28
111 lines not on this page · raw message
net/sched/sch_fq_codel.c +3 -3
@@ -57,7 +57,7 @@ struct fq_codel_sched_data {struct fq_codel_flow *flows;/* Flows table [flows_cnt] */ u32 *backlogs;/* backlog table [flows_cnt] */ u32 flows_cnt;/* number of flows */ -u32 perturbation;/* hash perturbation */ +siphash_key_t perturbation;/* hash perturbation */ u32 quantum;/* psched_mtu(qdisc_dev(sch)); */ u32 drop_batch_size;u32 memory_limit;
@@ -75,7 +75,7 @@ struct fq_codel_sched_data {static unsigned int fq_codel_hash (const struct fq_codel_sched_data *q,struct sk_buff *skb) { -u32 hash =skb_get_hash_perturb (skb, q->perturbation); +u32 hash =skb_get_hash_perturb (skb, &q->perturbation);return reciprocal_scale (hash, q->flows_cnt); }
@@ -482,7 +482,7 @@ static int fq_codel_init(struct Qdisc *s q->memory_limit =32 <<20 ;/* 32 MBytes */ q->drop_batch_size =64 ; q->quantum =psched_mtu (qdisc_dev (sch)); - q->perturbation =prandom_u32 (); +get_random_bytes (&q->perturbation,sizeof (q->perturbation));INIT_LIST_HEAD (&q->new_flows);INIT_LIST_HEAD (&q->old_flows);codel_params_init (&q->cparams);
net/sched/sch_hhf.c +4 -4
@@ -4,11 +4,11 @@* Copyright (C) 2013 Nandita Dukkipati <[email protected]> */ -#include <linux/jhash.h> #include <linux/jiffies.h> #include <linux/module.h> #include <linux/skbuff.h> #include <linux/vmalloc.h> +#include <linux/siphash.h> #include <net/pkt_sched.h> #include <net/sock.h>
@@ -125,7 +125,7 @@ struct wdrr_bucket {struct hhf_sched_data {struct wdrr_bucket buckets[WDRR_BUCKET_CNT ]; -u32 perturbation;/* hash perturbation */ +siphash_key_t perturbation;/* hash perturbation */ u32 quantum;/* psched_mtu(qdisc_dev(sch)); */ u32 drop_overlimit;/* number of times max qdisc packet * limit was hit
@@ -263,7 +263,7 @@ static enum wdrr_bucket_idx hhf_classify }/* Get hashed flow-id of the skb. */ - hash =skb_get_hash_perturb (skb, q->perturbation); + hash =skb_get_hash_perturb (skb, &q->perturbation);/* Check if this packet belongs to an already established HH flow. */ flow_pos = hash &HHF_BIT_MASK ;
@@ -593,7 +593,7 @@ static int hhf_init(struct Qdisc *sch, s sch->limit =1000 ; q->quantum =psched_mtu (qdisc_dev (sch)); - q->perturbation =prandom_u32 (); +get_random_bytes (&q->perturbation,sizeof (q->perturbation));INIT_LIST_HEAD (&q->new_buckets);INIT_LIST_HEAD (&q->old_buckets);
net/sched/sch_sfb.c +7 -6
@@ -22,7 +22,7 @@#include <linux/errno.h> #include <linux/skbuff.h> #include <linux/random.h> -#include <linux/jhash.h> +#include <linux/siphash.h> #include <net/ip.h> #include <net/pkt_sched.h> #include <net/inet_ecn.h>
@@ -48,7 +48,7 @@ struct sfb_bucket {* (Section 4.4 of SFB reference : moving hash functions) */ struct sfb_bins { -u32 perturbation;/* jhash perturbation */ +siphash_key_t perturbation;/* siphash key */ struct sfb_bucket bins[SFB_LEVELS ][SFB_NUMBUCKETS ]; };
@@ -219,7 +219,8 @@ static u32 sfb_compute_qlen(u32 *prob_r,static void sfb_init_perturbation (u32 slot,struct sfb_sched_data *q) { - q->bins[slot].perturbation =prandom_u32 (); +get_random_bytes (&q->bins[slot].perturbation, +sizeof (q->bins[slot].perturbation)); }static void sfb_swap_slot (struct sfb_sched_data *q)
@@ -314,9 +315,9 @@ static int sfb_enqueue(struct sk_buff *s/* If using external classifiers, get result and record it. */ if (!sfb_classify (skb, fl, &ret, &salt)) goto other_drop; - sfbhash =jhash_1word (salt, q->bins[slot].perturbation); + sfbhash =siphash_1u32 (salt, &q->bins[slot].perturbation); }else { - sfbhash =skb_get_hash_perturb (skb, q->bins[slot].perturbation); + sfbhash =skb_get_hash_perturb (skb, &q->bins[slot].perturbation); }
@@ -352,7 +353,7 @@ static int sfb_enqueue(struct sk_buff *s/* Inelastic flow */ if (q->double_buffering) { sfbhash =skb_get_hash_perturb (skb, - q->bins[slot].perturbation); + &q->bins[slot].perturbation);if (!sfbhash) sfbhash =1 ;sfb_skb_cb (skb)->hashes[slot] = sfbhash;
net/sched/sch_sfq.c +8 -6
@@ -18,7 +18,7 @@#include <linux/errno.h> #include <linux/init.h> #include <linux/skbuff.h> -#include <linux/jhash.h> +#include <linux/siphash.h> #include <linux/slab.h> #include <linux/vmalloc.h> #include <net/netlink.h>
@@ -120,7 +120,7 @@ struct sfq_sched_data {u8 headdrop;u8 maxdepth;/* limit of packets per flow */ -u32 perturbation; +siphash_key_t perturbation;u8 cur_depth;/* depth of longest slot */ u8 flags;unsigned short scaled_quantum;/* SFQ_ALLOT_SIZE(quantum) */
@@ -158,7 +158,7 @@ static inline struct sfq_head *sfq_dep_hstatic unsigned int sfq_hash (const struct sfq_sched_data *q,const struct sk_buff *skb) { -return skb_get_hash_perturb (skb, q->perturbation) & (q->divisor -1 ); +return skb_get_hash_perturb (skb, &q->perturbation) & (q->divisor -1 ); } static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
@@ -607,9 +607,11 @@ static void sfq_perturbation(unsigned lostruct Qdisc *sch = (struct Qdisc *)arg;struct sfq_sched_data *q =qdisc_priv (sch);spinlock_t *root_lock =qdisc_lock (qdisc_root_sleeping (sch)); +siphash_key_t nkey; +get_random_bytes (&nkey,sizeof (nkey));spin_lock (root_lock); - q->perturbation =prandom_u32 (); + q->perturbation = nkey;if (!q->filter_list && q->tail)sfq_rehash (sch);spin_unlock (root_lock);
@@ -681,7 +683,7 @@ static int sfq_change(struct Qdisc *sch,del_timer (&q->perturb_timer);if (q->perturb_period) {mod_timer (&q->perturb_timer, jiffies + q->perturb_period); - q->perturbation =prandom_u32 (); +get_random_bytes (&q->perturbation,sizeof (q->perturbation)); }sch_tree_unlock (sch);kfree (p);
@@ -737,7 +739,7 @@ static int sfq_init(struct Qdisc *sch, s q->quantum =psched_mtu (qdisc_dev (sch)); q->scaled_quantum =SFQ_ALLOT_SIZE (q->quantum); q->perturb_period =0 ; - q->perturbation =prandom_u32 (); +get_random_bytes (&q->perturbation,sizeof (q->perturbation));if (opt) {int err =sfq_change (sch, opt);
Greg Kroah-Hartman
maintainerPATCH 33/34 dmaengine: qcom: bam_dma: Fix resource leak
In reply to Greg Kroah-HartmanFrom: Jeffrey Hugo <[email protected]>
commit 7667819385457b4aeb5fac94f67f52ab52cc10d5 upstream.
bam_dma_terminate_all() will leak resources if any of the transactions are committed to the hardware (present in the desc fifo), and not complete. Since bam_dma_terminate_all() does not cause the hardware to be updated, the hardware will still operate on any previously committed transactions. This can cause memory corruption if the memory for the transaction has been reassigned, and will cause a sync issue between the BAM and its client(s).
Fix this by properly updating the hardware in bam_dma_terminate_all().
--- drivers/dma/qcom/bam_dma.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/dma/qcom/bam_dma.c +14 -0
@@ -686,7 +686,21 @@ static int bam_dma_terminate_all(struct/* remove all transactions, including active transaction */ spin_lock_irqsave (&bchan->vc.lock, flag); +/* +* If we have transactions queued, then some might be committed to the +* hardware in the desc fifo. The only way to reset the desc fifo is +* to do a hardware reset (either by pipe or the entire block). +* bam_chan_init_hw() will trigger a pipe reset, and also reinit the +* pipe. If the pipe is left disabled (default state after pipe reset) +* and is accessed by a connected hardware engine, a fatal error in +* the BAM will occur. There is a small window where this could happen +* with bam_chan_init_hw(), but it is assumed that the caller has +* stopped activity on any attached hardware engine. Make sure to do +* this first so that the BAM hardware doesn't cause memory corruption +* by accessing freed resources. +*/ if (bchan->curr_txd) { +bam_chan_init_hw (bchan, bchan->curr_txd->dir);list_add (&bchan->curr_txd->vd.node, &bchan->vc.desc_issued); bchan->curr_txd =NULL ; }
Greg Kroah-Hartman
maintainerPATCH 34/34 alarmtimer: Change remaining ENOTSUPP to EOPNOTSUPP
In reply to Greg Kroah-HartmanFrom: Petr Vorel <[email protected]>
Fix backport of commit f18ddc13af981ce3c7b7f26925f099e7c6929aba upstream.
Update backport to change ENOTSUPP to EOPNOTSUPP in alarm_timer_{del,set}(), which were removed in f2c45807d3992fe0f173f34af9c347d907c31686 in v4.13-rc1.
--- kernel/time/alarmtimer.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/time/alarmtimer.c +2 -2
@@ -586,7 +586,7 @@ static void alarm_timer_get(struct k_itistatic int alarm_timer_del (struct k_itimer *timr) {if (!rtcdev) -return -ENOTSUPP ; +return -EOPNOTSUPP ;if (alarm_try_to_cancel (&timr->it.alarm.alarmtimer) <0 )return TIMER_RETRY ;
@@ -610,7 +610,7 @@ static int alarm_timer_set(struct k_itimktime_t exp;if (!rtcdev) -return -ENOTSUPP ; +return -EOPNOTSUPP ;if (flags & ~TIMER_ABSTIME )return -EINVAL ;
stable-rc/linux-4.9.y boot: 93 boots: 0 failed, 86 passed with 7 offline (v4.9.199-35-ge0ad85ece397)
stable-rc/linux-4.9.y boot: 93 boots: 0 failed, 86 passed with 7 offline (v4.9.199-35-ge0ad85ece397)
Full Boot Summary: https://kernelci.org/boot/all/job/stable-rc/branch/linux-4.9.y/kernel/v4.9.199-35-ge0ad85ece397/
Full Build Summary: https://kernelci.org/build/stable-rc/branch/linux-4.9.y/kernel/v4.9.199-35-ge0ad85ece397/
Tree: stable-rc
Branch: linux-4.9.y
Git Describe: v4.9.199-35-ge0ad85ece397
Git Commit: e0ad85ece3979aa8efb65ef7e22c924cd63dc859
Git URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Tested: 49 unique boards, 20 SoC families, 14 builds out of 197
Offline Platforms:
arm:
sunxi_defconfig:
gcc-8
sun5i-r8-chip: 1 offline lab
sun7i-a20-bananapi: 1 offline lab
multi_v7_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab
sun5i-r8-chip: 1 offline lab
sun7i-a20-bananapi: 1 offline lab
davinci_all_defconfig:
gcc-8
dm365evm,legacy: 1 offline lab
qcom_defconfig:
gcc-8
qcom-apq8064-cm-qs600: 1 offline lab---
For more info write to <[email protected]>
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.200 release. There are 34 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun 10 Nov 2019 05:42:11 PM UTC. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.200-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.200-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: e0ad85ece3979aa8efb65ef7e22c924cd63dc859
git describe: v4.9.199-35-ge0ad85ece397
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.9-oe/build/v4.9.199-35-ge0ad85ece397
No regressions (compared to build v4.9.199)
No fixes (compared to build v4.9.199)
Ran 23538 total tests in the following environments and test suites.
Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64
Test Suites
-----------
* build
* install-android-platform-tools-r2600
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* kselftest
* network-basic-tests
* ltp-open-posix-tests
* prep-tmp-disk
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none
* ssuite
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.200 release. There are 34 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Sun 10 Nov 2019 05:42:11 PM UTC. Anything received after that time might be too late.
Build results:
total: 172 pass: 172 fail: 0 Qemu test results: total: 356 pass: 356 fail: 0
Guenter