4.9.264-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainerPATCH 1/53 net: fec: ptp: avoid register access when ipg clock is disabled
In reply to Greg Kroah-HartmanFrom: Heiko Thiery <[email protected]>
[ Upstream commit 6a4d7234ae9a3bb31181f348ade9bbdb55aeb5c5 ]
When accessing the timecounter register on an i.MX8MQ the kernel hangs. This is only the case when the interface is down. This can be reproduced by reading with 'phc_ctrl eth0 get'.
Like described in the change in 91c0d987a9788dcc5fe26baafd73bf9242b68900 the igp clock is disabled when the interface is down and leads to a system hang.
So we check if the ptp clock status before reading the timecounter register.
--- drivers/net/ethernet/freescale/fec_ptp.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/net/ethernet/freescale/fec_ptp.c +7 -0
@@ -396,9 +396,16 @@ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts)u64 ns;unsigned long flags; +mutex_lock (&adapter->ptp_clk_mutex); +/* Check the ptp clock */ +if (!adapter->ptp_clk_on) { +mutex_unlock (&adapter->ptp_clk_mutex); +return -EINVAL ; + }spin_lock_irqsave (&adapter->tmreg_lock, flags); ns =timecounter_read (&adapter->tc);spin_unlock_irqrestore (&adapter->tmreg_lock, flags); +mutex_unlock (&adapter->ptp_clk_mutex); *ts =ns_to_timespec64 (ns);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 10/53 net: wan: fix error return code of uhdlc_init()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 62765d39553cfd1ad340124fe1e280450e8c89e2 ]
When priv->rx_skbuff or priv->tx_skbuff is NULL, no error return code of uhdlc_init() is assigned.
To fix this bug, ret is assigned with -ENOMEM in these cases.
--- drivers/net/wan/fsl_ucc_hdlc.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/net/wan/fsl_ucc_hdlc.c +6 -2
@@ -169,13 +169,17 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) priv->rx_skbuff =kzalloc (priv->rx_ring_size *sizeof (*priv->rx_skbuff),GFP_KERNEL ); -if (!priv->rx_skbuff) +if (!priv->rx_skbuff) { + ret = -ENOMEM ; goto free_ucc_pram; + } priv->tx_skbuff =kzalloc (priv->tx_ring_size *sizeof (*priv->tx_skbuff),GFP_KERNEL ); -if (!priv->tx_skbuff) +if (!priv->tx_skbuff) { + ret = -ENOMEM ; goto free_rx_skbuff; + } priv->skb_curtx =0 ; priv->skb_dirtytx =0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 11/53 atm: uPD98402: fix incorrect allocation
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 3153724fc084d8ef640c611f269ddfb576d1dcb1 ]
dev->dev_data is set in zatm.c, calling zatm_start() will overwrite this dev->dev_data in uPD98402_start() and a subsequent PRIV(dev)->lock (i.e dev->phy_data->lock) will result in a null-ptr-dereference.
I believe this is a typo and what it actually want to do is to allocate phy_data instead of dev_data.
--- drivers/atm/uPD98402.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/atm/uPD98402.c +1 -1
@@ -210,7 +210,7 @@ static void uPD98402_int(struct atm_dev *dev)static int uPD98402_start (struct atm_dev *dev) {DPRINTK ("phy_start\n" ); -if (!(dev->dev_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct uPD98402_priv ),GFP_KERNEL )))return -ENOMEM ;spin_lock_init (&PRIV (dev)->lock);memset (&PRIV (dev)->sonet_stats,0 ,sizeof (struct k_sonet_stats ));
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 12/53 atm: idt77252: fix null-ptr-dereference
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]
this one is similar to the phy_data allocation fix in uPD98402, the driver allocate the idt77105_priv and store to dev_data but later dereference using dev->dev_data, which will cause null-ptr-dereference.
fix this issue by changing dev_data to phy_data so that PRIV(dev) can work correctly.
--- drivers/atm/idt77105.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/atm/idt77105.c +2 -2
@@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev) {unsigned long flags; -if (!(dev->dev_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL ))) +if (!(dev->phy_data =kmalloc (sizeof (struct idt77105_priv ),GFP_KERNEL )))return -ENOMEM ;PRIV (dev)->dev = dev;spin_lock_irqsave (&idt77105_priv_lock, flags);
@@ -338,7 +338,7 @@ static int idt77105_stop(struct atm_dev *dev)else idt77105_all = walk->next; dev->phy =NULL ; - dev->dev_data =NULL ; + dev->phy_data =NULL ;kfree (walk);break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 14/53 nfs: we dont support removing system.nfs4_acl
In reply to Greg Kroah-HartmanFrom: J. Bruce Fields <[email protected]>
[ Upstream commit 4f8be1f53bf615102d103c0509ffa9596f65b718 ]
The NFSv4 protocol doesn't have any notion of reomoving an attribute, so removexattr(path,"system.nfs4_acl") doesn't make sense.
There's no documented return value. Arguably it could be EOPNOTSUPP but I'm a little worried an application might take that to mean that we don't support ACLs or xattrs. How about EINVAL?
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -5144,6 +5144,9 @@ static int __nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflunsigned int npages =DIV_ROUND_UP (buflen,PAGE_SIZE );int ret, i; +/* You can't remove system.nfs4_acl: */ +if (buflen ==0 ) +return -EINVAL ;if (!nfs4_server_supports_acls (server))return -EOPNOTSUPP ;if (npages >ARRAY_SIZE (pages))
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 16/53 ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 61bf318eac2c13356f7bd1c6a05421ef504ccc8a ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not return error sign properly.
The bug is in mismatch between get/set errors:
static inline long syscall_get_error(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r10 == -1 ? regs->r8:0;
}static inline long syscall_get_return_value(struct task_struct *task,
struct pt_regs *regs)
{
return regs->r8;
}static inline void syscall_set_return_value(struct task_struct *task,
struct pt_regs *regs, int error, long val)
{
if (error) {
/* error < 0, but ia64 uses > 0 return value */
regs->r8 = -error;
regs->r10 = -1;
} else {
regs->r8 = val;
regs->r10 = 0;
}
}Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/include/asm/syscall.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/include/asm/syscall.h +1 -1
@@ -35,7 +35,7 @@ static inline void syscall_rollback(struct task_struct *task,static inline long syscall_get_error (struct task_struct *task,struct pt_regs *regs) { -return regs->r10 ==-1 ? regs->r8:0 ; +return regs->r10 ==-1 ? -regs->r8:0 ; } static inline long syscall_get_return_value(struct task_struct *task,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 2/53 powerpc/4xx: Fix build errors from mfdcr()
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit eead089311f4d935ab5d1d8fbb0c42ad44699ada ]
lkp reported a build error in fsp2.o:
CC arch/powerpc/platforms/44x/fsp2.o
{standard input}:577: Error: unsupported relocation against base
Which comes from:
pr_err("GESR0: 0x%08x\n", mfdcr(base + PLB4OPB_GESR0));Where our mfdcr() macro is stringifying "base + PLB4OPB_GESR0", and passing that to the assembler, which obviously doesn't work.
The mfdcr() macro already checks that the argument is constant using __builtin_constant_p(), and if not calls the out-of-line version of mfdcr(). But in this case GCC is smart enough to notice that "base + PLB4OPB_GESR0" will be constant, even though it's not something we can immediately stringify into a register number.
Segher pointed out that passing the register number to the inline asm as a constant would be better, and in fact it fixes the build error, presumably because it gives GCC a chance to resolve the value.
While we're at it, change mtdcr() similarly.
--- arch/powerpc/include/asm/dcr-native.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
arch/powerpc/include/asm/dcr-native.h +4 -4
@@ -65,8 +65,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mfdcr (rn) \ ({unsigned int rval; \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mfdcr %0," __stringify(rn) \ - : "=r" (rval)); \ + asm volatile("mfdcr %0, %1" : "=r" (rval) \ + : "n" (rn)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ rval = mfdcrx(rn); \ else \
@@ -76,8 +76,8 @@ static inline void mtdcrx(unsigned int reg, unsigned int val)#define mtdcr (rn, v) \ do { \ if (__builtin_constant_p(rn) && rn < 1024) \ - asm volatile("mtdcr " __stringify(rn) ",%0" \ - : : "r" (v)); \ + asm volatile("mtdcr %0, %1" \ + : : "n" (rn), "r" (v)); \ else if (likely(cpu_has_feature(CPU_FTR_INDEXED_DCR))) \ mtdcrx(rn, v); \ else \
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 13/53 u64_stats,lockdep: Fix u64_stats_init() vs lockdep
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
[ Upstream commit d5b0e0677bfd5efd17c5bbb00156931f0d41cb85 ]
Jakub reported that:
static struct net_device *rtl8139_init_board(struct pci_dev *pdev)
{
...
u64_stats_init(&tp->rx_stats.syncp);
u64_stats_init(&tp->tx_stats.syncp);
...
}results in lockdep getting confused between the RX and TX stats lock. This is because u64_stats_init() is an inline calling seqcount_init(), which is a macro using a static variable to generate a lockdep class.
By wrapping that in an inline, we negate the effect of the macro and fold the static key variable, hence the confusion.
Fix by also making u64_stats_init() a macro for the case where it matters, leaving the other case an inline for argument validation etc.
--- include/linux/u64_stats_sync.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
include/linux/u64_stats_sync.h +4 -3
@@ -68,12 +68,13 @@ struct u64_stats_sync { }; +#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) +#define u64_stats_init (syncp) seqcount_init(&(syncp)->seq) +#else static inline void u64_stats_init (struct u64_stats_sync *syncp) { -#if BITS_PER_LONG ==32 && defined(CONFIG_SMP ) -seqcount_init (&syncp->seq); -#endif } +#endif static inline void u64_stats_update_begin (struct u64_stats_sync *syncp) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 15/53 ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
In reply to Greg Kroah-HartmanFrom: Sergei Trofimovich <[email protected]>
[ Upstream commit 0ceb1ace4a2778e34a5414e5349712ae4dc41d85 ]
In https://bugs.gentoo.org/769614 Dmitry noticed that ptrace(PTRACE_GET_SYSCALL_INFO) does not work for syscalls called via glibc's syscall() wrapper.
ia64 has two ways to call syscalls from userspace: via break and via eps instructions.
The difference is in stack layout:
1. eps creates simple stack frame: no locals, in{0..7} == out{0..8}
2. break uses userspace stack frame: may be locals (glibc provides one), in{0..7} == out{0..8}.
Both work fine in syscall handling cde itself.
But ptrace(PTRACE_GET_SYSCALL_INFO) uses unwind mechanism to re-extract syscall arguments but it does not account for locals.
The change always skips locals registers. It should not change eps path as kernel's handler already enforces locals=0 and fixes break.
Tested on v5.10 on rx3600 machine (ia64 9040 CPU).
--- arch/ia64/kernel/ptrace.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
arch/ia64/kernel/ptrace.c +18 -6
@@ -2144,27 +2144,39 @@ static void syscall_get_set_args_cb(struct unw_frame_info *info, void *data) {struct syscall_get_set_args *args = data;struct pt_regs *pt = args->regs; -unsigned long *krbs, cfm, ndirty; +unsigned long *krbs, cfm, ndirty, nlocals, nouts;int i, count;if (unw_unwind_to_user (info) <0 )return ; +/* +* We get here via a few paths: +* - break instruction: cfm is shared with caller. +* syscall args are in out= regs, locals are non-empty. +* - epsinstruction: cfm is set by br.call +* locals don't exist. +* +* For both cases argguments are reachable in cfm.sof - cfm.sol. +* CFM: [ ... | sor: 17..14 | sol : 13..7 | sof : 6..0 ] +*/ cfm = pt->cr_ifs; + nlocals = (cfm >>7 ) &0x7f ;/* aka sol */ + nouts = (cfm &0x7f ) - nlocals;/* aka sof - sol */ krbs = (unsigned long *)info->task +IA64_RBS_OFFSET /8 ; ndirty =ia64_rse_num_regs (krbs, krbs + (pt->loadrs >>19 )); count =0 ;if (in_syscall (pt)) - count =min_t (int, args->n, cfm &0x7f ); + count =min_t (int, args->n, nouts); +/* Iterate over outs. */ for (i =0 ; i < count; i++) { +int j = ndirty + nlocals + i + args->i;if (args->rw) - *ia64_rse_skip_regs (krbs, ndirty + i + args->i) = - args->args[i]; + *ia64_rse_skip_regs (krbs, j) = args->args[i];else - args->args[i] = *ia64_rse_skip_regs (krbs, - ndirty + i + args->i); + args->args[i] = *ia64_rse_skip_regs (krbs, j); }if (!args->rw) {
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 17/53 x86/tlb: Flush global mappings when KAISER is disabled
In reply to Greg Kroah-HartmanFrom: Borislav Petkov <[email protected]>
Jim Mattson reported that Debian 9 guests using a 4.9-stable kernel are exploding during alternatives patching:
kernel BUG at /build/linux-dqnRSc/linux-4.9.228/arch/x86/kernel/alternative.c:709! invalid opcode: 0000 [#1] SMP
Modules linked in: CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.9.0-13-amd64 #1 Debian 4.9.228-1 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: swap_entry_free swap_entry_free text_poke_bp swap_entry_free arch_jump_label_transform set_debug_rodata __jump_label_update static_key_slow_inc frontswap_register_ops init_zswap init_frontswap do_one_initcall set_debug_rodata kernel_init_freeable rest_init kernel_init ret_from_fork
triggering the BUG_ON in text_poke() which verifies whether patched instruction bytes have actually landed at the destination.
Further debugging showed that the TLB flush before that check is insufficient because there could be global mappings left in the TLB, leading to a stale mapping getting used.
I say "global mappings" because the hardware configuration is a new one:
machine is an AMD, which means, KAISER/PTI doesn't need to be enabled there, which also means there's no user/kernel pagetables split and therefore the TLB can have global mappings.
And the configuration is new one for a second reason: because that AMD machine supports PCID and INVPCID, which leads the CPU detection code to set the synthetic X86_FEATURE_INVPCID_SINGLE flag.
Now, __native_flush_tlb_single() does invalidate global mappings when X86_FEATURE_INVPCID_SINGLE is *not* set and returns.
When X86_FEATURE_INVPCID_SINGLE is set, however, it invalidates the requested address from both PCIDs in the KAISER-enabled case. But if KAISER is not enabled and the machine has global mappings in the TLB, then those global mappings do not get invalidated, which would lead to the above mismatch from using a stale TLB entry.
So make sure to flush those global mappings in the KAISER disabled case.
Co-debugged by Babu Moger <[email protected]>.
--- arch/x86/include/asm/tlbflush.h | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-)
arch/x86/include/asm/tlbflush.h +7 -4
@@ -245,12 +245,15 @@ static inline void __native_flush_tlb_single(unsigned long addr)* ASID. But, userspace flushes are probably much more * important performance-wise. * -* Make sure to do only a single invpcid when KAISER is -* disabled and we have only a single ASID. +* In the KAISER disabled case, do an INVLPG to make sure +* the mapping is flushed in case it is a global one. */ -if (kaiser_enabled) +if (kaiser_enabled) {invpcid_flush_one (X86_CR3_PCID_ASID_USER , addr); -invpcid_flush_one (X86_CR3_PCID_ASID_KERN , addr); +invpcid_flush_one (X86_CR3_PCID_ASID_KERN , addr); + }else { + asmvolatile ("invlpg (%0)" ::"r" (addr) :"memory" ); + } }static inline void __flush_tlb_all (void )
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 18/53 squashfs: fix inode lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Sean Nyekjaer <[email protected]>
commit c1b2028315c6b15e8d6725e0d5884b15887d3daa upstream.
When mouting a squashfs image created without inode compression it fails
with: "unable to read inode lookup table"
It turns out that the BLOCK_OFFSET is missing when checking the SQUASHFS_METADATA_SIZE agaist the actual size.
--- fs/squashfs/export.c | 8 ++++++-- fs/squashfs/squashfs_fs.h | 1 + 2 files changed, 7 insertions(+), 2 deletions(-)
fs/squashfs/export.c +6 -2
@@ -165,14 +165,18 @@ __le64 *squashfs_read_inode_lookup_table start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end + || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= lookup_table_start || (lookup_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= lookup_table_start || + (lookup_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/squashfs_fs.h +1 -0
@@ -30,6 +30,7 @@/* size of metadata (inode and directory) blocks */ #define SQUASHFS_METADATA_SIZE 8192 +#define SQUASHFS_BLOCK_OFFSET 2/* default size of block device I/O */ #ifdef CONFIG_SQUASHFS_4K_DEVBLK_SIZE
Greg Kroah-Hartman
maintainerPATCH 19/53 squashfs: fix xattr id and id lookup sanity checks
In reply to Greg Kroah-HartmanFrom: Phillip Lougher <[email protected]>
commit 8b44ca2b634527151af07447a8090a5f3a043321 upstream.
The checks for maximum metadata block size is missing SQUASHFS_BLOCK_OFFSET (the two byte length count).
--- fs/squashfs/id.c | 6 ++++-- fs/squashfs/xattr_id.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-)
fs/squashfs/id.c +4 -2
@@ -110,14 +110,16 @@ __le64 *squashfs_read_id_index_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= id_table_start || (id_table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= id_table_start || (id_table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
fs/squashfs/xattr_id.c +4 -2
@@ -122,14 +122,16 @@ __le64 *squashfs_read_xattr_id_table(str start =le64_to_cpu (table[n]); end =le64_to_cpu (table[n +1 ]); -if (start >= end || (end - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= end || (end - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); } } start =le64_to_cpu (table[indexes -1 ]); -if (start >= table_start || (table_start - start) >SQUASHFS_METADATA_SIZE ) { +if (start >= table_start || (table_start - start) > + (SQUASHFS_METADATA_SIZE +SQUASHFS_BLOCK_OFFSET )) {kfree (table);return ERR_PTR (-EINVAL ); }
Greg Kroah-Hartman
maintainerPATCH 4/53 atm: lanai: dont run lanai_dev_close if not open
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit a2bd45834e83d6c5a04d397bde13d744a4812dfc ]
lanai_dev_open() can fail. When it fail, lanai->base is unmapped and the pci device is disabled. The caller, lanai_init_one(), then tries to run atm_dev_deregister(). This will subsequently call lanai_dev_close() and use the already released MMIO area.
To fix this issue, set the lanai->base to NULL if open fail, and test the flag in lanai_dev_close().
[ 8.324153] lanai: lanai_start() failed, err=19 [ 8.324819] lanai(itf 0): shutting down interface [ 8.325211] BUG: unable to handle page fault for address: ffffc90000180024 [ 8.325781] #PF: supervisor write access in kernel mode [ 8.326215] #PF: error_code(0x0002) - not-present page [ 8.326641] PGD 100000067 P4D 100000067 PUD 100139067 PMD 10013a067 PTE 0 [ 8.327206] Oops: 0002 [#1] SMP KASAN NOPTI [ 8.327557] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #12 [ 8.328229] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd9c812dda519-4 [ 8.329145] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.329587] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.330917] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.331196] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.331572] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.331948] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.332326] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.332701] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.333077] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.333502] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.333806] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.334182] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.334557] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.334932] Call Trace: [ 8.335066] atm_dev_deregister+0x161/0x1a0 [atm] [ 8.335324] lanai_init_one.cold+0x20c/0x96d [lanai] [ 8.335594] ? lanai_send+0x2a0/0x2a0 [lanai] [ 8.335831] local_pci_probe+0x6f/0xb0 [ 8.336039] pci_device_probe+0x171/0x240 [ 8.336255] ? pci_device_remove+0xe0/0xe0 [ 8.336475] ? kernfs_create_link+0xb6/0x110 [ 8.336704] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 8.336983] really_probe+0x161/0x420 [ 8.337181] driver_probe_device+0x6d/0xd0 [ 8.337401] device_driver_attach+0x82/0x90 [ 8.337626] ? device_driver_attach+0x90/0x90 [ 8.337859] __driver_attach+0x60/0x100 [ 8.338065] ? device_driver_attach+0x90/0x90 [ 8.338298] bus_for_each_dev+0xe1/0x140 [ 8.338511] ? subsys_dev_iter_exit+0x10/0x10 [ 8.338745] ? klist_node_init+0x61/0x80 [ 8.338956] bus_add_driver+0x254/0x2a0 [ 8.339164] driver_register+0xd3/0x150 [ 8.339370] ? 0xffffffffc0028000 [ 8.339550] do_one_initcall+0x84/0x250 [ 8.339755] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 8.340076] ? free_vmap_area_noflush+0x1a5/0x5c0 [ 8.340329] ? unpoison_range+0xf/0x30 [ 8.340532] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.340806] ? unpoison_range+0xf/0x30 [ 8.341014] ? unpoison_range+0xf/0x30 [ 8.341217] do_init_module+0xf8/0x350 [ 8.341419] load_module+0x3fe6/0x4340 [ 8.341621] ? vm_unmap_ram+0x1d0/0x1d0 [ 8.341826] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 8.342101] ? module_frob_arch_sections+0x20/0x20 [ 8.342358] ? __do_sys_finit_module+0x108/0x170 [ 8.342604] __do_sys_finit_module+0x108/0x170 [ 8.342841] ? __ia32_sys_init_module+0x40/0x40 [ 8.343083] ? file_open_root+0x200/0x200 [ 8.343298] ? do_sys_open+0x85/0xe0 [ 8.343491] ? filp_open+0x50/0x50 [ 8.343675] ? exit_to_user_mode_prepare+0xfc/0x130 [ 8.343935] do_syscall_64+0x33/0x40 [ 8.344132] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 8.344401] RIP: 0033:0x7f08eb887cf7 [ 8.344594] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f7 48 89 d6 41 [ 8.345565] RSP: 002b:00007ffcd5c98ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 8.345962] RAX: ffffffffffffffda RBX: 00000000008fea70 RCX: 00007f08eb887cf7 [ 8.346336] RDX: 0000000000000000 RSI: 00000000008fd9e0 RDI: 0000000000000003 [ 8.346711] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 8.347085] R10: 00007f08eb8eb300 R11: 0000000000000246 R12: 00000000008fd9e0 [ 8.347460] R13: 0000000000000000 R14: 00000000008fddd0 R15: 0000000000000001 [ 8.347836] Modules linked in: lanai(+) atm [ 8.348065] CR2: ffffc90000180024 [ 8.348244] ---[ end trace 7fdc1c668f2003e5 ]--- [ 8.348490] RIP: 0010:lanai_dev_close+0x4f/0xe5 [lanai] [ 8.348772] Code: 00 48 c7 c7 00 d3 01 c0 e8 49 4e 0a c2 48 8d bd 08 02 00 00 e8 6e 52 14 c1 48 80 [ 8.349745] RSP: 0018:ffff8881029ef680 EFLAGS: 00010246 [ 8.350022] RAX: 000000000003fffe RBX: ffff888102fb4800 RCX: ffffffffc001a98a [ 8.350397] RDX: ffffc90000180000 RSI: 0000000000000246 RDI: ffff888102fb4000 [ 8.350772] RBP: ffff888102fb4000 R08: ffffffff8115da8a R09: ffffed102053deaa [ 8.351151] R10: 0000000000000003 R11: ffffed102053dea9 R12: ffff888102fb48a4 [ 8.351525] R13: ffffffffc00123c0 R14: ffff888102fb4b90 R15: ffff888102fb4b88 [ 8.351918] FS: 00007f08eb9056a0(0000) GS:ffff88815b400000(0000) knlGS:0000000000000000 [ 8.352343] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8.352647] CR2: ffffc90000180024 CR3: 0000000102a28000 CR4: 00000000000006f0 [ 8.353022] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 8.353397] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 8.353958] modprobe (95) used greatest stack depth: 26216 bytes left
--- drivers/atm/lanai.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/atm/lanai.c +4 -1
@@ -2240,6 +2240,7 @@ static int lanai_dev_open(struct atm_dev *atmdev)conf1_write (lanai);#endif iounmap (lanai->base); + lanai->base =NULL ; error_pci:pci_disable_device (lanai->pci); error:
@@ -2252,6 +2253,8 @@ static int lanai_dev_open(struct atm_dev *atmdev)static void lanai_dev_close (struct atm_dev *atmdev) {struct lanai_dev *lanai = (struct lanai_dev *) atmdev->dev_data; +if (lanai->base==NULL ) +return ; printk(KERN_INFO DEV_LABEL "(itf %d): shutting down interface\n", lanai->number);lanai_timed_poll_stop (lanai);
@@ -2561,7 +2564,7 @@ static int lanai_init_one(struct pci_dev *pci,struct atm_dev *atmdev;int result; - lanai =kmalloc (sizeof (*lanai),GFP_KERNEL ); + lanai =kzalloc (sizeof (*lanai),GFP_KERNEL );if (lanai ==NULL ) { printk(KERN_ERR DEV_LABEL ": couldn't allocate dev_data structure!\n");
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 3/53 atm: eni: dont release is never initialized
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 4deb550bc3b698a1f03d0332cde3df154d1b6c1e ]
label err_eni_release is reachable when eni_start() fail.
In eni_start() it calls dev->phy->start() in the last step, if start() fail we don't need to call phy->stop(), if start() is never called, we neither need to call phy->stop(), otherwise null-ptr-deref will happen.
In order to fix this issue, don't call phy->stop() in label err_eni_release
[ 4.875714] ================================================================== [ 4.876091] BUG: KASAN: null-ptr-deref in suni_stop+0x47/0x100 [suni] [ 4.876433] Read of size 8 at addr 0000000000000030 by task modprobe/95 [ 4.876778] [ 4.876862] CPU: 0 PID: 95 Comm: modprobe Not tainted 5.11.0-rc7-00090-gdcc0b49040c7 #2 [ 4.877290] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-48-gd94 [ 4.877876] Call Trace: [ 4.878009] dump_stack+0x7d/0xa3 [ 4.878191] kasan_report.cold+0x10c/0x10e [ 4.878410] ? __slab_free+0x2f0/0x340 [ 4.878612] ? suni_stop+0x47/0x100 [suni] [ 4.878832] suni_stop+0x47/0x100 [suni] [ 4.879043] eni_do_release+0x3b/0x70 [eni] [ 4.879269] eni_init_one.cold+0x1152/0x1747 [eni] [ 4.879528] ? _raw_spin_lock_irqsave+0x7b/0xd0 [ 4.879768] ? eni_ioctl+0x270/0x270 [eni] [ 4.879990] ? __mutex_lock_slowpath+0x10/0x10 [ 4.880226] ? eni_ioctl+0x270/0x270 [eni] [ 4.880448] local_pci_probe+0x6f/0xb0 [ 4.880650] pci_device_probe+0x171/0x240 [ 4.880864] ? pci_device_remove+0xe0/0xe0 [ 4.881086] ? kernfs_create_link+0xb6/0x110 [ 4.881315] ? sysfs_do_create_link_sd.isra.0+0x76/0xe0 [ 4.881594] really_probe+0x161/0x420 [ 4.881791] driver_probe_device+0x6d/0xd0 [ 4.882010] device_driver_attach+0x82/0x90 [ 4.882233] ? device_driver_attach+0x90/0x90 [ 4.882465] __driver_attach+0x60/0x100 [ 4.882671] ? device_driver_attach+0x90/0x90 [ 4.882903] bus_for_each_dev+0xe1/0x140 [ 4.883114] ? subsys_dev_iter_exit+0x10/0x10 [ 4.883346] ? klist_node_init+0x61/0x80 [ 4.883557] bus_add_driver+0x254/0x2a0 [ 4.883764] driver_register+0xd3/0x150 [ 4.883971] ? 0xffffffffc0038000 [ 4.884149] do_one_initcall+0x84/0x250 [ 4.884355] ? trace_event_raw_event_initcall_finish+0x150/0x150 [ 4.884674] ? unpoison_range+0xf/0x30 [ 4.884875] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.885150] ? unpoison_range+0xf/0x30 [ 4.885352] ? unpoison_range+0xf/0x30 [ 4.885557] do_init_module+0xf8/0x350 [ 4.885760] load_module+0x3fe6/0x4340 [ 4.885960] ? vm_unmap_ram+0x1d0/0x1d0 [ 4.886166] ? ____kasan_kmalloc.constprop.0+0x84/0xa0 [ 4.886441] ? module_frob_arch_sections+0x20/0x20 [ 4.886697] ? __do_sys_finit_module+0x108/0x170 [ 4.886941] __do_sys_finit_module+0x108/0x170 [ 4.887178] ? __ia32_sys_init_module+0x40/0x40 [ 4.887419] ? file_open_root+0x200/0x200 [ 4.887634] ? do_sys_open+0x85/0xe0 [ 4.887826] ? filp_open+0x50/0x50 [ 4.888009] ? fpregs_assert_state_consistent+0x4d/0x60 [ 4.888287] ? exit_to_user_mode_prepare+0x2f/0x130 [ 4.888547] do_syscall_64+0x33/0x40 [ 4.888739] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 4.889010] RIP: 0033:0x7ff62fcf1cf7 [ 4.889202] Code: 48 89 57 30 48 8b 04 24 48 89 47 38 e9 1d a0 02 00 48 89 f8 48 89 f71 [ 4.890172] RSP: 002b:00007ffe6644ade8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 4.890570] RAX: ffffffffffffffda RBX: 0000000000f2ca70 RCX: 00007ff62fcf1cf7 [ 4.890944] RDX: 0000000000000000 RSI: 0000000000f2b9e0 RDI: 0000000000000003 [ 4.891318] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000001 [ 4.891691] R10: 00007ff62fd55300 R11: 0000000000000246 R12: 0000000000f2b9e0 [ 4.892064] R13: 0000000000000000 R14: 0000000000f2bdd0 R15: 0000000000000001 [ 4.892439] ==================================================================
--- drivers/atm/eni.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/atm/eni.c +2 -1
@@ -2279,7 +2279,8 @@ static int eni_init_one(struct pci_dev *pci_dev,return rc; err_eni_release: -eni_do_release (dev); + dev->phy =NULL ; +iounmap (ENI_DEV (dev)->ioaddr); err_unregister:atm_dev_deregister (dev); err_free_consistent:
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 5/53 ixgbe: Fix memleak in ixgbe_configure_clsu32
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit 7a766381634da19fc837619b0a34590498d9d29a ]
When ixgbe_fdir_write_perfect_filter_82599() fails, input allocated by kzalloc() has not been freed, which leads to memleak.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +4 -2
@@ -8677,8 +8677,10 @@ static int ixgbe_configure_clsu32(struct ixgbe_adapter *adapter,ixgbe_atr_compute_perfect_hash_82599 (&input->filter, mask); err =ixgbe_fdir_write_perfect_filter_82599 (hw, &input->filter, input->sw_idx, queue); -if (!err) -ixgbe_update_ethtool_fdir_entry (adapter, input, input->sw_idx); +if (err) + goto err_out_w_lock; + +ixgbe_update_ethtool_fdir_entry (adapter, input, input->sw_idx);spin_unlock (&adapter->fdir_perfect_lock);if ((uhtid !=0x800 ) && (adapter->jump_tables[uhtid]))
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 6/53 net: tehuti: fix error return code in bdx_probe()
In reply to Greg Kroah-HartmanFrom: Jia-Ju Bai <[email protected]>
[ Upstream commit 38c26ff3048af50eee3fcd591921357ee5bfd9ee ]
When bdx_read_mac() fails, no error return code of bdx_probe() is assigned.
To fix this bug, err is assigned with -EFAULT as error return code.
--- drivers/net/ethernet/tehuti/tehuti.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/ethernet/tehuti/tehuti.c +1 -0
@@ -2062,6 +2062,7 @@ bdx_probe(struct pci_dev *pdev, const struct pci_device_id *ent)/*bdx_hw_reset(priv); */ if (bdx_read_mac (priv)) {pr_err ("load MAC address failed\n" ); + err = -EFAULT ; goto err_out_iomap; }SET_NETDEV_DEV (ndev, &pdev->dev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 8/53 nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
In reply to Greg Kroah-HartmanFrom: Timo Rothenpieler <[email protected]>
[ Upstream commit a0590473c5e6c4ef17c3132ad08fbad170f72d55 ]
This follows what was done in 8c2fabc6542d9d0f8b16bd1045c2eda59bdcde13. With the default being m, it's impossible to build the module into the kernel.
--- fs/nfs/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/nfs/Kconfig +1 -1
@@ -132,7 +132,7 @@ config PNFS_OBJLAYOUT config PNFS_FLEXFILE_LAYOUT tristate depends on NFS_V4_1 && NFS_V3 - default m + default NFS_V4 config NFS_V4_1_IMPLEMENTATION_ID_DOMAIN string "NFSv4.1 Implementation ID Domain"
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 7/53 sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
In reply to Greg Kroah-HartmanFrom: Denis Efremov <[email protected]>
[ Upstream commit 155b23e6e53475ca3b8c2a946299b4d4dd6a5a1e ]
RXMAC_BC_FRM_CNT_COUNT added to mp->rx_bcasts twice in a row in niu_xmac_interrupt(). Remove the second addition.
--- drivers/net/ethernet/sun/niu.c | 2 -- 1 file changed, 2 deletions(-)
drivers/net/ethernet/sun/niu.c +0 -2
@@ -3948,8 +3948,6 @@ static void niu_xmac_interrupt(struct niu *np) mp->rx_mcasts +=RXMAC_MC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ; -if (val &XRXMAC_STATUS_RXBCAST_CNT_EXP ) - mp->rx_bcasts +=RXMAC_BC_FRM_CNT_COUNT ;if (val &XRXMAC_STATUS_RXHIST1_CNT_EXP ) mp->rx_hist_cnt1 +=RXMAC_HIST_CNT1_COUNT ;if (val &XRXMAC_STATUS_RXHIST2_CNT_EXP )
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 9/53 NFS: Correct size calculation for create reply length
In reply to Greg Kroah-HartmanFrom: Frank Sorenson <[email protected]>
[ Upstream commit ad3dbe35c833c2d4d0bbf3f04c785d32f931e7c9 ]
CREATE requests return a post_op_fh3, rather than nfs_fh3. The post_op_fh3 includes an extra word to indicate 'handle_follows'.
Without that additional word, create fails when full 64-byte filehandles are in use.
Add NFS3_post_op_fh_sz, and correct the size calculation for NFS3_createres_sz.
--- fs/nfs/nfs3xdr.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
fs/nfs/nfs3xdr.c +2 -1
@@ -33,6 +33,7 @@*/ #define NFS3_fhandle_sz (1+16)#define NFS3_fh_sz (NFS3_fhandle_sz)/* shorthand */ +#define NFS3_post_op_fh_sz (1+NFS3_fh_sz)#define NFS3_sattr_sz (15)#define NFS3_filename_sz (1+(NFS3_MAXNAMLEN>>2))#define NFS3_path_sz (1+(NFS3_MAXPATHLEN>>2))
@@ -70,7 +71,7 @@#define NFS3_readlinkres_sz (1+NFS3_post_op_attr_sz+1)#define NFS3_readres_sz (1+NFS3_post_op_attr_sz+3)#define NFS3_writeres_sz (1+NFS3_wcc_data_sz+4) -#define NFS3_createres_sz (1+NFS3_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz) +#define NFS3_createres_sz (1+NFS3_post_op_fh_sz+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_renameres_sz (1+(2 * NFS3_wcc_data_sz))#define NFS3_linkres_sz (1+NFS3_post_op_attr_sz+NFS3_wcc_data_sz)#define NFS3_readdirres_sz (1+NFS3_post_op_attr_sz+2)
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainercover 4.9.264-rc1 review
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.9.264-rc1
Markus Theil <[email protected]>
mac80211: fix double free in ibss_leave
Eric Dumazet <[email protected]>
net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
Eric Dumazet <[email protected]>
net: sched: validate stab values
Martin Willi <[email protected]>
can: dev: Move device back to init netns on owning netns delete
Mike Galbraith <[email protected]>
futex: Handle transient "ownerless" rtmutex state correctly
Mateusz Nosek <[email protected]>
futex: Fix incorrect should_fail_futex() handling
Yang Tao <[email protected]>
futex: Prevent robust futex exit race
Will Deacon <[email protected]>
arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
Will Deacon <[email protected]>
locking/futex: Allow low-level atomic operations to return -EAGAIN
Peter Zijlstra <[email protected]>
futex: Fix (possible) missed wakeup
Thomas Gleixner <[email protected]>
futex: Handle early deadlock return correctly
Peter Zijlstra <[email protected]>
futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
Thomas Gleixner <[email protected]>
futex: Avoid freeing an active timer
Peter Zijlstra <[email protected]>
futex: Drop hb->lock before enqueueing on the rtmutex
Peter Zijlstra <[email protected]>
futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()
Peter Zijlstra <[email protected]>
futex,rt_mutex: Introduce rt_mutex_init_waiter()
Peter Zijlstra <[email protected]>
futex: Use smp_store_release() in mark_wake_futex()
Matthew Wilcox <[email protected]>
idr: add ida_is_empty
Adrian Hunter <[email protected]>
perf auxtrace: Fix auxtrace queue conflict
Andy Shevchenko <[email protected]>
ACPI: scan: Use unique number for instance_no
Rafael J. Wysocki <[email protected]>
ACPI: scan: Rearrange memory allocation in acpi_device_add()
Potnuri Bharat Teja <[email protected]>
RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
Johan Hovold <[email protected]>
net: cdc-phonet: fix data-interface release on probe failure
Johannes Berg <[email protected]>
mac80211: fix rate mask reset
Torin Cooper-Bennun <[email protected]>
can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
Tong Zhang <[email protected]>
can: c_can: move runtime PM enable/disable to c_can_platform
Tong Zhang <[email protected]>
can: c_can_pci: c_can_pci_remove(): fix use-after-free
Lv Yunlong <[email protected]>
net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
Dinghao Liu <[email protected]>
e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
Vitaly Lifshits <[email protected]>
e1000e: add rtnl_lock() to e1000_reset_task
Florian Fainelli <[email protected]>
net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
Eric Dumazet <[email protected]>
macvlan: macvlan_count_rx() needs to be aware of preemption
Grygorii Strashko <[email protected]>
bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
Horia Geantă <[email protected]>
arm64: dts: ls1043a: mark crypto engine dma coherent
Phillip Lougher <[email protected]>
squashfs: fix xattr id and id lookup sanity checks
Sean Nyekjaer <[email protected]>
squashfs: fix inode lookup sanity checks
Borislav Petkov <[email protected]>
x86/tlb: Flush global mappings when KAISER is disabled
Sergei Trofimovich <[email protected]>
ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
Sergei Trofimovich <[email protected]>
ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
J. Bruce Fields <[email protected]>
nfs: we don't support removing system.nfs4_acl
Peter Zijlstra <[email protected]>
u64_stats,lockdep: Fix u64_stats_init() vs lockdep
Tong Zhang <[email protected]>
atm: idt77252: fix null-ptr-dereference
Tong Zhang <[email protected]>
atm: uPD98402: fix incorrect allocation
Jia-Ju Bai <[email protected]>
net: wan: fix error return code of uhdlc_init()
Frank Sorenson <[email protected]>
NFS: Correct size calculation for create reply length
Timo Rothenpieler <[email protected]>
nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
Denis Efremov <[email protected]>
sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
Jia-Ju Bai <[email protected]>
net: tehuti: fix error return code in bdx_probe()
Dinghao Liu <[email protected]>
ixgbe: Fix memleak in ixgbe_configure_clsu32
Tong Zhang <[email protected]>
atm: lanai: dont run lanai_dev_close if not open
Tong Zhang <[email protected]>
atm: eni: dont release is never initialized
Michael Ellerman <[email protected]>
powerpc/4xx: Fix build errors from mfdcr()
Heiko Thiery <[email protected]>
net: fec: ptp: avoid register access when ipg clock is disabled
-------------
Diffstat:
Makefile | 4 +- arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + arch/arm64/include/asm/futex.h | 59 ++-- arch/ia64/include/asm/syscall.h | 2 +- arch/ia64/kernel/ptrace.c | 24 +- arch/powerpc/include/asm/dcr-native.h | 8 +- arch/x86/include/asm/tlbflush.h | 11 +- drivers/acpi/internal.h | 6 +- drivers/acpi/scan.c | 88 +++-- drivers/atm/eni.c | 3 +- drivers/atm/idt77105.c | 4 +- drivers/atm/lanai.c | 5 +- drivers/atm/uPD98402.c | 2 +- drivers/bus/omap_l3_noc.c | 4 +- drivers/infiniband/hw/cxgb4/cm.c | 4 +- drivers/net/can/c_can/c_can.c | 24 +- drivers/net/can/c_can/c_can_pci.c | 3 +- drivers/net/can/c_can/c_can_platform.c | 6 +- drivers/net/can/dev.c | 1 + drivers/net/can/m_can/m_can.c | 3 - drivers/net/dsa/bcm_sf2.c | 6 +- drivers/net/ethernet/freescale/fec_ptp.c | 7 + drivers/net/ethernet/intel/e1000e/82571.c | 2 + drivers/net/ethernet/intel/e1000e/netdev.c | 6 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 6 +- .../net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 + drivers/net/ethernet/sun/niu.c | 2 - drivers/net/ethernet/tehuti/tehuti.c | 1 + drivers/net/usb/cdc-phonet.c | 2 + drivers/net/wan/fsl_ucc_hdlc.c | 8 +- drivers/usb/gadget/function/f_hid.c | 6 +- drivers/usb/gadget/function/f_printer.c | 6 +- fs/nfs/Kconfig | 2 +- fs/nfs/nfs3xdr.c | 3 +- fs/nfs/nfs4proc.c | 3 + fs/squashfs/export.c | 8 +- fs/squashfs/id.c | 6 +- fs/squashfs/squashfs_fs.h | 1 + fs/squashfs/xattr_id.c | 6 +- include/acpi/acpi_bus.h | 1 + include/linux/idr.h | 5 + include/linux/if_macvlan.h | 3 +- include/linux/u64_stats_sync.h | 7 +- include/net/red.h | 10 +- include/net/rtnetlink.h | 2 + kernel/futex.c | 393 ++++++++++++++------- kernel/locking/rtmutex.c | 106 ++++-- kernel/locking/rtmutex_common.h | 5 +- net/core/dev.c | 2 +- net/mac80211/cfg.c | 4 +- net/mac80211/ibss.c | 2 + net/qrtr/qrtr.c | 5 + net/sched/sch_choke.c | 7 +- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +- net/sched/sch_sfq.c | 2 +- tools/perf/util/auxtrace.c | 4 - 57 files changed, 607 insertions(+), 306 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 21/53 bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
From: Grygorii Strashko <[email protected]>
[ Upstream commit 7d7275b3e866cf8092bd12553ec53ba26864f7bb ]
The main purpose of l3 IRQs is to catch OCP bus access errors and identify corresponding code places by showing call stack, so it's important to handle L3 interconnect errors as fast as possible. On RT these IRQs will became threaded and will be scheduled much more late from the moment actual error occurred so showing completely useless information.
Hence, mark l3 IRQs as IRQF_NO_THREAD so they will not be forced threaded on RT or if force_irqthreads = true.
--- drivers/bus/omap_l3_noc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/bus/omap_l3_noc.c +2 -2
@@ -285,7 +285,7 @@ static int omap_l3_probe(struct platform_device *pdev)*/ l3->debug_irq =platform_get_irq (pdev,0 ); ret =devm_request_irq (l3->dev, l3->debug_irq, l3_interrupt_handler, -0x0 ,"l3-dbg-irq" , l3); +IRQF_NO_THREAD ,"l3-dbg-irq" , l3);if (ret) {dev_err (l3->dev,"request_irq failed for %d\n" , l3->debug_irq);
@@ -294,7 +294,7 @@ static int omap_l3_probe(struct platform_device *pdev) l3->app_irq =platform_get_irq (pdev,1 ); ret =devm_request_irq (l3->dev, l3->app_irq, l3_interrupt_handler, -0x0 ,"l3-app-irq" , l3); +IRQF_NO_THREAD ,"l3-app-irq" , l3);if (ret)dev_err (l3->dev,"request_irq failed for %d\n" , l3->app_irq);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 30/53 mac80211: fix rate mask reset
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 1944015fe9c1d9fa5e9eb7ffbbb5ef8954d6753b ]
Coverity reported the strange "if (~...)" condition that's always true. It suggested that ! was intended instead of ~, but upon further analysis I'm convinced that what really was intended was a comparison to 0xff/0xffff (in HT/VHT cases respectively), since this indicates that all of the rates are enabled.
Change the comparison accordingly.
I'm guessing this never really mattered because a reset to not having a rate mask is basically equivalent to having a mask that enables all rates.
--- net/mac80211/cfg.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/mac80211/cfg.c +2 -2
@@ -2681,14 +2681,14 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,continue ;for (j =0 ; j <IEEE80211_HT_MCS_MASK_LEN ; j++) { -if (~sdata->rc_rateidx_mcs_mask[i][j]) { +if (sdata->rc_rateidx_mcs_mask[i][j] !=0xff ) { sdata->rc_has_mcs_mask[i] = true;break ; } }for (j =0 ; j <NL80211_VHT_NSS_MAX ; j++) { -if (~sdata->rc_rateidx_vht_mcs_mask[i][j]) { +if (sdata->rc_rateidx_vht_mcs_mask[i][j] !=0xffff ) { sdata->rc_has_vht_mcs_mask[i] = true;break ; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 31/53 net: cdc-phonet: fix data-interface release on probe failure
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit c79a707072fe3fea0e3c92edee6ca85c1e53c29f ]
Set the disconnected flag before releasing the data interface in case netdev registration fails to avoid having the disconnect callback try to deregister the never registered netdev (and trigger a WARN_ON()).
--- drivers/net/usb/cdc-phonet.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/usb/cdc-phonet.c +2 -0
@@ -406,6 +406,8 @@ static int usbpn_probe(struct usb_interface *intf, const struct usb_device_id *i err =register_netdev (dev);if (err) { +/* Set disconnected flag so that disconnect() returns early. */ + pnd->disconnected =1 ;usb_driver_release_interface (&usbpn_driver, data_intf); goto out; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 32/53 RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
In reply to Greg Kroah-HartmanFrom: Potnuri Bharat Teja <[email protected]>
[ Upstream commit 3408be145a5d6418ff955fe5badde652be90e700 ]
Not setting the ipv6 bit while destroying ipv6 listening servers may result in potential fatal adapter errors due to lookup engine memory hash errors. Therefore always set ipv6 field while destroying ipv6 listening servers.
--- drivers/infiniband/hw/cxgb4/cm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/infiniband/hw/cxgb4/cm.c +2 -2
@@ -3472,13 +3472,13 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) ep->com.local_addr.ss_family == AF_INET) { err = cxgb4_remove_server_filter( ep->com.dev->rdev.lldi.ports[0], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0], 0); + ep->com.dev->rdev.lldi.rxq_ids[0], false); } else {struct sockaddr_in6 *sin6;c4iw_init_wr_wait (&ep->com.wr_wait); err =cxgb4_remove_server ( ep->com.dev->rdev.lldi.ports[0 ], ep->stid, - ep->com.dev->rdev.lldi.rxq_ids[0 ],0 ); + ep->com.dev->rdev.lldi.rxq_ids[0 ], true);if (err) goto done; err = c4iw_wait_for_reply(&ep->com.dev->rdev, &ep->com.wr_wait,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 33/53 ACPI: scan: Rearrange memory allocation in acpi_device_add()
In reply to Greg Kroah-HartmanFrom: Rafael J. Wysocki <[email protected]>
[ Upstream commit c1013ff7a5472db637c56bb6237f8343398c03a7 ]
The upfront allocation of new_bus_id is done to avoid allocating memory under acpi_device_lock, but it doesn't really help, because (1) it leads to many unnecessary memory allocations for _ADR devices, (2) kstrdup_const() is run under that lock anyway and
(3) it complicates the code.
Rearrange acpi_device_add() to allocate memory for a new struct acpi_device_bus_id instance only when necessary, eliminate a redundant local variable from it and reduce the number of labels in there.
No intentional functional impact.
--- drivers/acpi/scan.c | 57 +++++++++++++++++++++------------------------ 1 file changed, 26 insertions(+), 31 deletions(-)
drivers/acpi/scan.c +26 -31
@@ -622,12 +622,23 @@ void acpi_bus_put_acpi_device(struct acpi_device *adev)put_device (&adev->dev); } +static struct acpi_device_bus_id *acpi_device_bus_id_match (const char *dev_id) +{ +struct acpi_device_bus_id *acpi_device_bus_id; + +/* Find suitable bus_id and instance number in acpi_bus_id_list. */ +list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node) { +if (!strcmp (acpi_device_bus_id->bus_id, dev_id)) +return acpi_device_bus_id; + } +return NULL ; +} +int acpi_device_add (struct acpi_device *device,void (*release)(struct device *)) { +struct acpi_device_bus_id *acpi_device_bus_id;int result; -struct acpi_device_bus_id *acpi_device_bus_id, *new_bus_id; -int found =0 ;if (device->handle) {acpi_status status;
@@ -653,38 +664,26 @@ int acpi_device_add(struct acpi_device *device,INIT_LIST_HEAD (&device->del_list);mutex_init (&device->physical_node_lock); - new_bus_id =kzalloc (sizeof (struct acpi_device_bus_id ),GFP_KERNEL ); -if (!new_bus_id) { -pr_err (PREFIX "Memory allocation error\n" ); - result = -ENOMEM ; - goto err_detach; - } -mutex_lock (&acpi_device_lock); -/* -* Find suitable bus_id and instance number in acpi_bus_id_list -* If failed, create one and link it into acpi_bus_id_list -*/ -list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node) { -if (!strcmp (acpi_device_bus_id->bus_id, -acpi_device_hid (device))) { - acpi_device_bus_id->instance_no++; - found =1 ; -kfree (new_bus_id); -break ; + + acpi_device_bus_id =acpi_device_bus_id_match (acpi_device_hid (device)); +if (acpi_device_bus_id) { + acpi_device_bus_id->instance_no++; + }else { + acpi_device_bus_id =kzalloc (sizeof (*acpi_device_bus_id), +GFP_KERNEL ); +if (!acpi_device_bus_id) { + result = -ENOMEM ; + goto err_unlock; } - } -if (!found) { - acpi_device_bus_id = new_bus_id; acpi_device_bus_id->bus_id =kstrdup_const (acpi_device_hid (device),GFP_KERNEL );if (!acpi_device_bus_id->bus_id) { -pr_err (PREFIX "Memory allocation error for bus id\n" ); +kfree (acpi_device_bus_id); result = -ENOMEM ; - goto err_free_new_bus_id; + goto err_unlock; } - acpi_device_bus_id->instance_no =0 ;list_add_tail (&acpi_device_bus_id->node, &acpi_bus_id_list); }dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);
@@ -719,13 +718,9 @@ int acpi_device_add(struct acpi_device *device,list_del (&device->node);list_del (&device->wakeup_list); - err_free_new_bus_id: -if (!found) -kfree (new_bus_id); - + err_unlock:mutex_unlock (&acpi_device_lock); - err_detach:acpi_detach_data (device->handle, acpi_scan_drop_device);return result; }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 34/53 ACPI: scan: Use unique number for instance_no
In reply to Greg Kroah-HartmanFrom: Andy Shevchenko <[email protected]>
[ Upstream commit eb50aaf960e3bedfef79063411ffd670da94b84b ]
The decrementation of acpi_device_bus_id->instance_no in acpi_device_del() is incorrect, because it may cause a duplicate instance number to be allocated next time a device with the same acpi_device_bus_id is added.
Replace above mentioned approach by using IDA framework.
While at it, define the instance range to be [0, 4096).
--- drivers/acpi/internal.h | 6 +++++- drivers/acpi/scan.c | 33 ++++++++++++++++++++++++++++----- include/acpi/acpi_bus.h | 1 + 3 files changed, 34 insertions(+), 6 deletions(-)
drivers/acpi/internal.h +5 -1
@@ -18,6 +18,8 @@#ifndef _ACPI_INTERNAL_H_#define _ACPI_INTERNAL_H_ +#include <linux/idr.h> +#define PREFIX "ACPI: "int early_acpi_osi_init (void );
@@ -97,9 +99,11 @@ void acpi_scan_table_handler(u32 event, void *table, void *context);extern struct list_head acpi_bus_id_list; +#define ACPI_MAX_DEVICE_INSTANCES 4096 +struct acpi_device_bus_id {const char *bus_id; -unsigned int instance_no; +struct ida instance_ida;struct list_head node; };
drivers/acpi/scan.c +28 -5
@@ -481,9 +481,8 @@ static void acpi_device_del(struct acpi_device *device)list_for_each_entry (acpi_device_bus_id, &acpi_bus_id_list, node)if (!strcmp (acpi_device_bus_id->bus_id,acpi_device_hid (device))) { -if (acpi_device_bus_id->instance_no >0 ) - acpi_device_bus_id->instance_no--; -else { +ida_simple_remove (&acpi_device_bus_id->instance_ida, device->pnp.instance_no); +if (ida_is_empty (&acpi_device_bus_id->instance_ida)) {list_del (&acpi_device_bus_id->node);kfree_const (acpi_device_bus_id->bus_id);kfree (acpi_device_bus_id);
@@ -634,6 +633,21 @@ static struct acpi_device_bus_id *acpi_device_bus_id_match(const char *dev_id)return NULL ; } +static int acpi_device_set_name (struct acpi_device *device, +struct acpi_device_bus_id *acpi_device_bus_id) +{ +struct ida *instance_ida = &acpi_device_bus_id->instance_ida; +int result; + + result =ida_simple_get (instance_ida,0 ,ACPI_MAX_DEVICE_INSTANCES ,GFP_KERNEL ); +if (result <0 ) +return result; + + device->pnp.instance_no = result; +dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, result); +return 0 ; +} +int acpi_device_add (struct acpi_device *device,void (*release)(struct device *)) {
@@ -668,7 +682,9 @@ int acpi_device_add(struct acpi_device *device, acpi_device_bus_id =acpi_device_bus_id_match (acpi_device_hid (device));if (acpi_device_bus_id) { - acpi_device_bus_id->instance_no++; + result =acpi_device_set_name (device, acpi_device_bus_id); +if (result) + goto err_unlock; }else { acpi_device_bus_id =kzalloc (sizeof (*acpi_device_bus_id),GFP_KERNEL );
@@ -684,9 +700,16 @@ int acpi_device_add(struct acpi_device *device, goto err_unlock; } +ida_init (&acpi_device_bus_id->instance_ida); + + result =acpi_device_set_name (device, acpi_device_bus_id); +if (result) { +kfree (acpi_device_bus_id); + goto err_unlock; + } +list_add_tail (&acpi_device_bus_id->node, &acpi_bus_id_list); } -dev_set_name (&device->dev,"%s:%02x" , acpi_device_bus_id->bus_id, acpi_device_bus_id->instance_no);if (device->parent)list_add_tail (&device->node, &device->parent->children);
include/acpi/acpi_bus.h +1 -0
@@ -241,6 +241,7 @@ struct acpi_pnp_type {struct acpi_device_pnp {acpi_bus_id bus_id;/* Object name */ +int instance_no;/* Instance number of this object */ struct acpi_pnp_type type;/* ID type */ acpi_bus_address bus_address;/* _ADR */ char *unique_id;/* _UID */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 37/53 futex: Use smp_store_release() in mark_wake_futex()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 1b367ece0d7e696cab1c8501bab282cc6a538b3f upstream.
Since the futex_q can dissapear the instruction after assigning NULL, this really should be a RELEASE barrier. That stops loads from hitting dead memory too.
--- kernel/futex.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
kernel/futex.c +1 -2
@@ -1565,8 +1565,7 @@ static void mark_wake_futex(struct wake_* memory barrier is required here to prevent the following * store to lock_ptr from getting ahead of the plist_del. */ -smp_wmb (); - q->lock_ptr =NULL ; +smp_store_release (&q->lock_ptr,NULL ); }/*
Greg Kroah-Hartman
maintainerPATCH 22/53 macvlan: macvlan_count_rx() needs to be aware of preemption
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit dd4fa1dae9f4847cc1fd78ca468ad69e16e5db3e ]
macvlan_count_rx() can be called from process context, it is thus necessary to disable preemption before calling u64_stats_update_begin()
syzbot was able to spot this on 32bit arch:
WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert include/linux/seqlock.h:271 [inline] WARNING: CPU: 1 PID: 4632 at include/linux/seqlock.h:271 __seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269 Modules linked in: Kernel panic - not syncing: panic_on_warn set ... CPU: 1 PID: 4632 Comm: kworker/1:3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: ARM-Versatile Express Workqueue: events macvlan_process_broadcast Backtrace: [<82740468>] (dump_backtrace) from [<827406dc>] (show_stack+0x18/0x1c arch/arm/kernel/traps.c:252) r7:00000080 r6:60000093 r5:00000000 r4:8422a3c4
[<827406c4>] (show_stack) from [<82751b58>] (__dump_stack lib/dump_stack.c:79 [inline])
[<827406c4>] (show_stack) from [<82751b58>] (dump_stack+0xb8/0xe8 lib/dump_stack.c:120)
[<82751aa0>] (dump_stack) from [<82741270>] (panic+0x130/0x378 kernel/panic.c:231)
r7:830209b4 r6:84069ea4 r5:00000000 r4:844350d0
[<82741140>] (panic) from [<80244924>] (__warn+0xb0/0x164 kernel/panic.c:605)
r3:8404ec8c r2:00000000 r1:00000000 r0:830209b4
r7:0000010f
[<80244874>] (__warn) from [<82741520>] (warn_slowpath_fmt+0x68/0xd4 kernel/panic.c:628)
r7:81363f70 r6:0000010f r5:83018e50 r4:00000000
[<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert include/linux/seqlock.h:271 [inline]) [<827414bc>] (warn_slowpath_fmt) from [<81363f70>] (__seqprop_assert.constprop.0+0xf0/0x11c include/linux/seqlock.h:269)
r8:5a109000 r7:0000000f r6:a568dac0 r5:89802300 r4:00000001
[<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (u64_stats_update_begin include/linux/u64_stats_sync.h:128 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_count_rx include/linux/if_macvlan.h:47 [inline]) [<81363e80>] (__seqprop_assert.constprop.0) from [<81364af0>] (macvlan_broadcast+0x154/0x26c drivers/net/macvlan.c:291)
r5:89802300 r4:8a927740
[<8136499c>] (macvlan_broadcast) from [<81365020>] (macvlan_process_broadcast+0x258/0x2d0 drivers/net/macvlan.c:317)
r10:81364f78 r9:8a86d000 r8:8a9c7e7c r7:8413aa5c r6:00000000 r5:00000000
r4:89802840
[<81364dc8>] (macvlan_process_broadcast) from [<802696a4>] (process_one_work+0x2d4/0x998 kernel/workqueue.c:2275)
r10:00000008 r9:8404ec98 r8:84367a02 r7:ddfe6400 r6:ddfe2d40 r5:898dac80
r4:8a86d43c
[<802693d0>] (process_one_work) from [<80269dcc>] (worker_thread+0x64/0x54c kernel/workqueue.c:2421)
r10:00000008 r9:8a9c6000 r8:84006d00 r7:ddfe2d78 r6:898dac94 r5:ddfe2d40
r4:898dac80
[<80269d68>] (worker_thread) from [<80271f40>] (kthread+0x184/0x1a4 kernel/kthread.c:292)
r10:85247e64 r9:898dac80 r8:80269d68 r7:00000000 r6:8a9c6000 r5:89a2ee40
r4:8a97bd00
[<80271dbc>] (kthread) from [<80200114>] (ret_from_fork+0x14/0x20 arch/arm/kernel/entry-common.S:158)
Exception stack(0x8a9c7fb0 to 0x8a9c7ff8)
--- include/linux/if_macvlan.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
include/linux/if_macvlan.h +2 -1
@@ -70,13 +70,14 @@ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,if (likely (success)) {struct vlan_pcpu_stats *pcpu_stats; - pcpu_stats =this_cpu_ptr (vlan->pcpu_stats); + pcpu_stats =get_cpu_ptr (vlan->pcpu_stats);u64_stats_update_begin (&pcpu_stats->syncp); pcpu_stats->rx_packets++; pcpu_stats->rx_bytes += len;if (multicast) pcpu_stats->rx_multicast++;u64_stats_update_end (&pcpu_stats->syncp); +put_cpu_ptr (vlan->pcpu_stats); }else {this_cpu_inc (vlan->pcpu_stats->rx_errors); }
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 35/53 perf auxtrace: Fix auxtrace queue conflict
In reply to Greg Kroah-HartmanFrom: Adrian Hunter <[email protected]>
[ Upstream commit b410ed2a8572d41c68bd9208555610e4b07d0703 ]
The only requirement of an auxtrace queue is that the buffers are in time order. That is achieved by making separate queues for separate perf buffer or AUX area buffer mmaps.
That generally means a separate queue per cpu for per-cpu contexts, and a separate queue per thread for per-task contexts.
When buffers are added to a queue, perf checks that the buffer cpu and thread id (tid) match the queue cpu and thread id.
However, generally, that need not be true, and perf will queue buffers correctly anyway, so the check is not needed.
In addition, the check gets erroneously hit when using sample mode to trace multiple threads.
Consequently, fix that case by removing the check.
--- tools/perf/util/auxtrace.c | 4 ---- 1 file changed, 4 deletions(-)
tools/perf/util/auxtrace.c +0 -4
@@ -248,10 +248,6 @@ static int auxtrace_queues__add_buffer(struct auxtrace_queues *queues, queue->set = true; queue->tid = buffer->tid; queue->cpu = buffer->cpu; - }else if (buffer->cpu != queue->cpu || buffer->tid != queue->tid) { -pr_err ("auxtrace queue conflict: cpu %d, tid %d vs cpu %d, tid %d\n" , - queue->cpu, queue->tid, buffer->cpu, buffer->tid); -return -EINVAL ; } buffer->buffer_nr = queues->next_buffer_nr++;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 36/53 idr: add ida_is_empty
In reply to Greg Kroah-HartmanFrom: Matthew Wilcox <[email protected]>
[ Upstream commit 99c494077e2d4282a17120a772eecc00ec3004cc ]
Two of the USB Gadgets were poking around in the internals of struct ida in order to determine if it is empty. Add the appropriate abstraction.
--- drivers/usb/gadget/function/f_hid.c | 6 +++--- drivers/usb/gadget/function/f_printer.c | 6 +++--- include/linux/idr.h | 5 +++++ 3 files changed, 11 insertions(+), 6 deletions(-)
drivers/usb/gadget/function/f_hid.c +3 -3
@@ -932,7 +932,7 @@ static void hidg_free_inst(struct usb_function_instance *f)mutex_lock (&hidg_ida_lock);hidg_put_minor (opts->minor); -if (idr_is_empty (&hidg_ida.idr)) +if (ida_is_empty (&hidg_ida))ghid_cleanup ();mutex_unlock (&hidg_ida_lock);
@@ -958,7 +958,7 @@ static struct usb_function_instance *hidg_alloc_inst(void)mutex_lock (&hidg_ida_lock); -if (idr_is_empty (&hidg_ida.idr)) { +if (ida_is_empty (&hidg_ida)) { status =ghid_setup (NULL ,HIDG_MINORS );if (status) { ret =ERR_PTR (status);
@@ -971,7 +971,7 @@ static struct usb_function_instance *hidg_alloc_inst(void)if (opts->minor <0 ) { ret =ERR_PTR (opts->minor);kfree (opts); -if (idr_is_empty (&hidg_ida.idr)) +if (ida_is_empty (&hidg_ida))ghid_cleanup (); goto unlock; }
drivers/usb/gadget/function/f_printer.c +3 -3
@@ -1276,7 +1276,7 @@ static void gprinter_free_inst(struct usb_function_instance *f)mutex_lock (&printer_ida_lock);gprinter_put_minor (opts->minor); -if (idr_is_empty (&printer_ida.idr)) +if (ida_is_empty (&printer_ida))gprinter_cleanup ();mutex_unlock (&printer_ida_lock);
@@ -1300,7 +1300,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void)mutex_lock (&printer_ida_lock); -if (idr_is_empty (&printer_ida.idr)) { +if (ida_is_empty (&printer_ida)) { status =gprinter_setup (PRINTER_MINORS );if (status) { ret =ERR_PTR (status);
@@ -1313,7 +1313,7 @@ static struct usb_function_instance *gprinter_alloc_inst(void)if (opts->minor <0 ) { ret =ERR_PTR (opts->minor);kfree (opts); -if (idr_is_empty (&printer_ida.idr)) +if (ida_is_empty (&printer_ida))gprinter_cleanup (); goto unlock; }
include/linux/idr.h +5 -0
@@ -195,6 +195,11 @@ static inline int ida_get_new(struct ida *ida, int *p_id) return ida_get_new_above(ida, 0, p_id); } +static inline bool ida_is_empty (struct ida *ida) +{ +return idr_is_empty (&ida->idr); +} +void __init idr_init_cache (void );#endif /* __IDR_H__ */
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 38/53 futex,rt_mutex: Introduce rt_mutex_init_waiter()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 50809358dd7199aa7ce232f6877dd09ec30ef374 upstream.
Since there's already two copies of this code, introduce a helper now before adding a third one.
--- kernel/futex.c | 5 +---- kernel/locking/rtmutex.c | 12 +++++++++--- kernel/locking/rtmutex_common.h | 1 + 3 files changed, 11 insertions(+), 7 deletions(-)
kernel/futex.c +1 -4
@@ -3234,10 +3234,7 @@ static int futex_wait_requeue_pi(u32 __u* The waiter is allocated on our stack, manipulated by the requeue * code while we sleep on uaddr. */ -debug_rt_mutex_init_waiter (&rt_waiter); -RB_CLEAR_NODE (&rt_waiter.pi_tree_entry); -RB_CLEAR_NODE (&rt_waiter.tree_entry); - rt_waiter.task =NULL ; +rt_mutex_init_waiter (&rt_waiter); ret =get_futex_key (uaddr2, flags &FLAGS_SHARED , &key2,VERIFY_WRITE );if (unlikely (ret !=0 ))
kernel/locking/rtmutex.c +9 -3
@@ -1176,6 +1176,14 @@ void rt_mutex_adjust_pi(struct task_stru next_lock, NULL, task); } +void rt_mutex_init_waiter (struct rt_mutex_waiter *waiter) +{ +debug_rt_mutex_init_waiter (waiter); +RB_CLEAR_NODE (&waiter->pi_tree_entry); +RB_CLEAR_NODE (&waiter->tree_entry); + waiter->task =NULL ; +} +/** * __rt_mutex_slowlock() - Perform the wait-wake-try-to-take loop * @lock: the rt_mutex to take
@@ -1258,9 +1266,7 @@ rt_mutex_slowlock(struct rt_mutex *lock,unsigned long flags;int ret =0 ; -debug_rt_mutex_init_waiter (&waiter); -RB_CLEAR_NODE (&waiter.pi_tree_entry); -RB_CLEAR_NODE (&waiter.tree_entry); +rt_mutex_init_waiter (&waiter);/* * Technically we could use raw_spin_[un]lock_irq() here, but this can
kernel/locking/rtmutex_common.h +1 -0
@@ -103,6 +103,7 @@ extern struct task_struct *rt_mutex_nextextern void rt_mutex_init_proxy_locked (struct rt_mutex *lock,struct task_struct *proxy_owner);extern void rt_mutex_proxy_unlock (struct rt_mutex *lock); +extern void rt_mutex_init_waiter (struct rt_mutex_waiter *waiter);extern int rt_mutex_start_proxy_lock (struct rt_mutex *lock,struct rt_mutex_waiter *waiter,struct task_struct *task);
Greg Kroah-Hartman
maintainerPATCH 39/53 futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit cfafcd117da0216520568c195cb2f6cd1980c4bb upstream.
By changing futex_lock_pi() to use rt_mutex_*_proxy_lock() all wait_list modifications are done under both hb->lock and wait_lock.
This closes the obvious interleave pattern between futex_lock_pi() and futex_unlock_pi(), but not entirely so. See below:
Before:
futex_lock_pi() futex_unlock_pi()
unlock hb->lock
lock hb->lock unlock hb->lock lock rt_mutex->wait_lock unlock rt_mutex_wait_lock -EAGAIN
lock rt_mutex->wait_lock
list_add
unlock rt_mutex->wait_lock
schedule()
lock rt_mutex->wait_lock
list_del
unlock rt_mutex->wait_lock
<idem> -EAGAIN
lock hb->lock
After:
futex_lock_pi() futex_unlock_pi()
lock hb->lock
lock rt_mutex->wait_lock
list_add
unlock rt_mutex->wait_lock
unlock hb->lock
schedule()
lock hb->lock unlock hb->lock
lock hb->lock
lock rt_mutex->wait_lock
list_del
unlock rt_mutex->wait_lock
lock rt_mutex->wait_lock unlock rt_mutex_wait_lock -EAGAIN
unlock hb->lock
It does however solve the earlier starvation/live-lock scenario which got introduced with the -EAGAIN since unlike the before scenario; where the -EAGAIN happens while futex_unlock_pi() doesn't hold any locks; in the after scenario it happens while futex_unlock_pi() actually holds a lock, and then it is serialized on that lock.
--- kernel/futex.c | 77 ++++++++++++++++++++++++++++------------ kernel/locking/rtmutex.c | 26 +++---------- kernel/locking/rtmutex_common.h | 1 3 files changed, 62 insertions(+), 42 deletions(-)
kernel/futex.c +55 -22
@@ -2333,20 +2333,7 @@ queue_unlock(struct futex_hash_bucket *hhb_waiters_dec (hb); } -/** -* queue_me() - Enqueue the futex_q on the futex_hash_bucket -* @q: The futex_q to enqueue -* @hb: The destination hash bucket -* -* The hb->lock must be held by the caller, and is released here. A call to -* queue_me() is typically paired with exactly one call to unqueue_me(). The -* exceptions involve the PI related operations, which may use unqueue_me_pi() -* or nothing if the unqueue is done as part of the wake process and the unqueue -* state is implicit in the state of woken task (see futex_wait_requeue_pi() for -* an example). -*/ -static inline void queue_me (struct futex_q *q,struct futex_hash_bucket *hb) - __releases(&hb->lock) +static inline void __queue_me (struct futex_q *q,struct futex_hash_bucket *hb) {int prio;
@@ -2363,6 +2350,24 @@ static inline void queue_me(struct futexplist_node_init (&q->list, prio);plist_add (&q->list, &hb->chain); q->task = current; +} + +/** +* queue_me() - Enqueue the futex_q on the futex_hash_bucket +* @q: The futex_q to enqueue +* @hb: The destination hash bucket +* +* The hb->lock must be held by the caller, and is released here. A call to +* queue_me() is typically paired with exactly one call to unqueue_me(). The +* exceptions involve the PI related operations, which may use unqueue_me_pi() +* or nothing if the unqueue is done as part of the wake process and the unqueue +* state is implicit in the state of woken task (see futex_wait_requeue_pi() for +* an example). +*/ +static inline void queue_me (struct futex_q *q,struct futex_hash_bucket *hb) + __releases(&hb->lock) +{ +__queue_me (q, hb);spin_unlock (&hb->lock); }
@@ -2868,6 +2873,7 @@ static int futex_lock_pi(u32 __user *uad {struct hrtimer_sleeper timeout, *to =NULL ;struct task_struct *exiting =NULL ; +struct rt_mutex_waiter rt_waiter;struct futex_hash_bucket *hb;struct futex_q q = futex_q_init;int res, ret;
@@ -2928,25 +2934,52 @@ retry_private: } } +WARN_ON (!q.pi_state); +/* * Only actually queue now that the atomic ops are done: */ -queue_me (&q, hb); +__queue_me (&q, hb); -WARN_ON (!q.pi_state); -/* -* Block on the PI mutex: -*/ -if (!trylock) { - ret =rt_mutex_timed_futex_lock (&q.pi_state->pi_mutex, to); - }else { +if (trylock) { ret =rt_mutex_futex_trylock (&q.pi_state->pi_mutex);/* Fixup the trylock return value: */ ret = ret ?0 : -EWOULDBLOCK ; + goto no_block; } +/* +* We must add ourselves to the rt_mutex waitlist while holding hb->lock +* such that the hb and rt_mutex wait lists match. +*/ +rt_mutex_init_waiter (&rt_waiter); + ret =rt_mutex_start_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter, current); +if (ret) { +if (ret ==1 ) + ret =0 ; + + goto no_block; + } + +spin_unlock (q.lock_ptr); + +if (unlikely (to)) +hrtimer_start_expires (&to->timer,HRTIMER_MODE_ABS ); + + ret =rt_mutex_wait_proxy_lock (&q.pi_state->pi_mutex, to, &rt_waiter); +spin_lock (q.lock_ptr);/* +* If we failed to acquire the lock (signal/timeout), we must +* first acquire the hb->lock before removing the lock from the +* rt_mutex waitqueue, such that we can keep the hb and rt_mutex +* wait lists consistent. +*/ +if (ret && !rt_mutex_cleanup_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter)) + ret =0 ; + +no_block: +/* * Fixup the pi_state owner and possibly acquire the lock if we * haven't already. */
kernel/locking/rtmutex.c +7 -19
@@ -1523,19 +1523,6 @@ int __sched rt_mutex_lock_interruptible(EXPORT_SYMBOL_GPL (rt_mutex_lock_interruptible);/* -* Futex variant with full deadlock detection. -* Futex variants must not use the fast-path, see __rt_mutex_futex_unlock(). -*/ -int __sched rt_mutex_timed_futex_lock(struct rt_mutex *lock, -struct hrtimer_sleeper *timeout) -{ -might_sleep (); - -return rt_mutex_slowlock (lock,TASK_INTERRUPTIBLE , - timeout,RT_MUTEX_FULL_CHAINWALK ); -} - -/* * Futex variant, must not use fastpath. */ int __sched rt_mutex_futex_trylock(struct rt_mutex *lock)
@@ -1808,12 +1795,6 @@ int rt_mutex_wait_proxy_lock(struct rt_m/* sleep on the mutex */ ret =__rt_mutex_slowlock (lock,TASK_INTERRUPTIBLE , to, waiter); -/* -* try_to_take_rt_mutex() sets the waiter bit unconditionally. We might -* have to fix that up. -*/ -fixup_rt_mutex_waiters (lock); -raw_spin_unlock_irq (&lock->wait_lock);return ret;
@@ -1853,6 +1834,13 @@ bool rt_mutex_cleanup_proxy_lock(structfixup_rt_mutex_waiters (lock); cleanup = true; } + +/* +* try_to_take_rt_mutex() sets the waiter bit unconditionally. We might +* have to fix that up. +*/ +fixup_rt_mutex_waiters (lock); +raw_spin_unlock_irq (&lock->wait_lock);return cleanup;
kernel/locking/rtmutex_common.h +0 -1
@@ -112,7 +112,6 @@ extern int rt_mutex_wait_proxy_lock(stru struct rt_mutex_waiter *waiter);extern bool rt_mutex_cleanup_proxy_lock (struct rt_mutex *lock,struct rt_mutex_waiter *waiter); -extern int rt_mutex_timed_futex_lock (struct rt_mutex *l,struct hrtimer_sleeper *to);extern int rt_mutex_futex_trylock (struct rt_mutex *l);extern int __rt_mutex_futex_trylock (struct rt_mutex *l);
Greg Kroah-Hartman
maintainerPATCH 40/53 futex: Drop hb->lock before enqueueing on the rtmutex
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 56222b212e8edb1cf51f5dd73ff645809b082b40 upstream.
When PREEMPT_RT_FULL does the spinlock -> rt_mutex substitution the PI chain code will (falsely) report a deadlock and BUG.
The problem is that it hold hb->lock (now an rt_mutex) while doing task_blocks_on_rt_mutex on the futex's pi_state::rtmutex. This, when interleaved just right with futex_unlock_pi() leads it to believe to see an AB-BA deadlock.
Task1 (holds rt_mutex, Task2 (does FUTEX_LOCK_PI)
does FUTEX_UNLOCK_PI)
lock hb->lock
lock rt_mutex (as per start_proxy)
lock hb->lock
Which is a trivial AB-BA.
It is not an actual deadlock, because it won't be holding hb->lock by the time it actually blocks on the rt_mutex, but the chainwalk code doesn't know that and it would be a nightmare to handle this gracefully.
To avoid this problem, do the same as in futex_unlock_pi() and drop hb->lock after acquiring wait_lock. This still fully serializes against futex_unlock_pi(), since adding to the wait_list does the very same lock dance, and removing it holds both locks.
Aside of solving the RT problem this makes the lock and unlock mechanism symetric and reduces the hb->lock held time.
--- kernel/futex.c | 30 +++++++++++++++++------- kernel/locking/rtmutex.c | 49 ++++++++++++++++++++++------------------ kernel/locking/rtmutex_common.h | 3 ++ 3 files changed, 52 insertions(+), 30 deletions(-)
kernel/futex.c +21 -9
@@ -2948,20 +2948,33 @@ retry_private: goto no_block; } +rt_mutex_init_waiter (&rt_waiter); +/* -* We must add ourselves to the rt_mutex waitlist while holding hb->lock -* such that the hb and rt_mutex wait lists match. +* On PREEMPT_RT_FULL, when hb->lock becomes an rt_mutex, we must not +* hold it while doing rt_mutex_start_proxy(), because then it will +* include hb->lock in the blocking chain, even through we'll not in +* fact hold it while blocking. This will lead it to report -EDEADLK +* and BUG when futex_unlock_pi() interleaves with this. +* +* Therefore acquire wait_lock while holding hb->lock, but drop the +* latter before calling rt_mutex_start_proxy_lock(). This still fully +* serializes against futex_unlock_pi() as that does the exact same +* lock handoff sequence. */ -rt_mutex_init_waiter (&rt_waiter); - ret =rt_mutex_start_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter, current); +raw_spin_lock_irq (&q.pi_state->pi_mutex.wait_lock); +spin_unlock (q.lock_ptr); + ret =__rt_mutex_start_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter, current); +raw_spin_unlock_irq (&q.pi_state->pi_mutex.wait_lock); +if (ret) {if (ret ==1 ) ret =0 ; +spin_lock (q.lock_ptr); goto no_block; } -spin_unlock (q.lock_ptr);if (unlikely (to))hrtimer_start_expires (&to->timer,HRTIMER_MODE_ABS );
@@ -2974,6 +2987,9 @@ retry_private:* first acquire the hb->lock before removing the lock from the * rt_mutex waitqueue, such that we can keep the hb and rt_mutex * wait lists consistent. +* +* In particular; it is important that futex_unlock_pi() can not +* observe this inconsistency. */ if (ret && !rt_mutex_cleanup_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter)) ret =0 ;
@@ -3071,10 +3087,6 @@ retry:get_pi_state (pi_state);/* -* Since modifying the wait_list is done while holding both -* hb->lock and wait_lock, holding either is sufficient to -* observe it. -* * By taking wait_lock while still holding hb->lock, we ensure * there is no point where we hold neither; and therefore * wake_futex_pi() must observe a state consistent with what we
kernel/locking/rtmutex.c +28 -21
71 lines not on this page · raw message
kernel/locking/rtmutex_common.h +3 -0
@@ -104,6 +104,9 @@ extern void rt_mutex_init_proxy_locked(s struct task_struct *proxy_owner);extern void rt_mutex_proxy_unlock (struct rt_mutex *lock);extern void rt_mutex_init_waiter (struct rt_mutex_waiter *waiter); +extern int __rt_mutex_start_proxy_lock (struct rt_mutex *lock, +struct rt_mutex_waiter *waiter, +struct task_struct *task);extern int rt_mutex_start_proxy_lock (struct rt_mutex *lock,struct rt_mutex_waiter *waiter,struct task_struct *task);
Greg Kroah-Hartman
maintainerPATCH 41/53 futex: Avoid freeing an active timer
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 97181f9bd57405b879403763284537e27d46963d upstream.
Alexander reported a hrtimer debug_object splat:
ODEBUG: free active (active state 0) object type: hrtimer hint: hrtimer_wakeup (kernel/time/hrtimer.c:1423)
debug_object_free (lib/debugobjects.c:603) destroy_hrtimer_on_stack (kernel/time/hrtimer.c:427) futex_lock_pi (kernel/futex.c:2740) do_futex (kernel/futex.c:3399)
SyS_futex (kernel/futex.c:3447 kernel/futex.c:3415) do_syscall_64 (arch/x86/entry/common.c:284) entry_SYSCALL64_slow_path (arch/x86/entry/entry_64.S:249)
Which was caused by commit:
cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")
... losing the hrtimer_cancel() in the shuffle. Where previously the hrtimer_cancel() was done by rt_mutex_slowlock() we now need to do it manually.
--- kernel/futex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/futex.c +3 -1
@@ -3018,8 +3018,10 @@ out_unlock_put_key: out_put_key:put_futex_key (&q.key); out: -if (to) +if (to) { +hrtimer_cancel (&to->timer);destroy_hrtimer_on_stack (&to->timer); + }return ret != -EINTR ? ret : -ERESTARTNOINTR ; uaddr_faulted:
Greg Kroah-Hartman
maintainerPATCH 42/53 futex,rt_mutex: Fix rt_mutex_cleanup_proxy_lock()
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit 04dc1b2fff4e96cb4142227fbdc63c8871ad4ed9 upstream.
Markus reported that the glibc/nptl/tst-robustpi8 test was failing after commit:
cfafcd117da0 ("futex: Rework futex_lock_pi() to use rt_mutex_*_proxy_lock()")
The following trace shows the problem:
ld-linux-x86-64-2161 [019] .... 410.760971: SyS_futex: 00007ffbeb76b028: 80000875 op=FUTEX_LOCK_PI ld-linux-x86-64-2161 [019] ...1 410.760972: lock_pi_update_atomic: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000875 ret=0 ld-linux-x86-64-2165 [011] .... 410.760978: SyS_futex: 00007ffbeb76b028: 80000875 op=FUTEX_UNLOCK_PI ld-linux-x86-64-2165 [011] d..1 410.760979: do_futex: 00007ffbeb76b028: curval=80000875 uval=80000875 newval=80000871 ret=0 ld-linux-x86-64-2165 [011] .... 410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=0000 ld-linux-x86-64-2161 [019] .... 410.760980: SyS_futex: 00007ffbeb76b028: 80000871 ret=ETIMEDOUT
Task 2165 does an UNLOCK_PI, assigning the lock to the waiter task 2161 which then returns with -ETIMEDOUT. That wrecks the lock state, because now the owner isn't aware it acquired the lock and removes the pending robust list entry.
If 2161 is killed, the robust list will not clear out this futex and the subsequent acquire on this futex will then (correctly) result in -ESRCH which is unexpected by glibc, triggers an internal assertion and dies.
Task 2161 Task 2165
rt_mutex_wait_proxy_lock()
timeout();
/* T2161 is still queued in the waiter list */ return -ETIMEDOUT;
futex_unlock_pi()
spin_lock(hb->lock);
rtmutex_unlock()
remove_rtmutex_waiter(T2161);
mark_lock_available();
/* Make the next waiter owner of the user space side */
futex_uval = 2161;
spin_unlock(hb->lock);
spin_lock(hb->lock);
rt_mutex_cleanup_proxy_lock()
if (rtmutex_owner() !== current)
...
return FAIL;....
return -ETIMEOUT;
This means that rt_mutex_cleanup_proxy_lock() needs to call try_to_take_rt_mutex() so it can take over the rtmutex correctly which was assigned by the waker. If the rtmutex is owned by some other task then this call is harmless and just confirmes that the waiter is not able to acquire it.
While there, fix what looks like a merge error which resulted in rt_mutex_cleanup_proxy_lock() having two calls to fixup_rt_mutex_waiters() and rt_mutex_wait_proxy_lock() not having any. Both should have one, since both potentially touch the waiter list.
--- kernel/locking/rtmutex.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
kernel/locking/rtmutex.c +18 -6
@@ -1796,12 +1796,14 @@ int rt_mutex_wait_proxy_lock(struct rt_mint ret;raw_spin_lock_irq (&lock->wait_lock); - -set_current_state (TASK_INTERRUPTIBLE ); -/* sleep on the mutex */ +set_current_state (TASK_INTERRUPTIBLE ); ret =__rt_mutex_slowlock (lock,TASK_INTERRUPTIBLE , to, waiter); - +/* +* try_to_take_rt_mutex() sets the waiter bit unconditionally. We might +* have to fix that up. +*/ +fixup_rt_mutex_waiters (lock);raw_spin_unlock_irq (&lock->wait_lock);return ret;
@@ -1833,15 +1835,25 @@ bool rt_mutex_cleanup_proxy_lock(structraw_spin_lock_irq (&lock->wait_lock);/* +* Do an unconditional try-lock, this deals with the lock stealing +* state where __rt_mutex_futex_unlock() -> mark_wakeup_next_waiter() +* sets a NULL owner. +* +* We're not interested in the return value, because the subsequent +* test on rt_mutex_owner() will infer that. If the trylock succeeded, +* we will own the lock and it will have removed the waiter. If we +* failed the trylock, we're still not owner and we need to remove +* ourselves. +*/ +try_to_take_rt_mutex (lock, current, waiter); +/* * Unless we're the owner; we're still enqueued on the wait_list. * So check if we became owner, if not, take us off the wait_list. */ if (rt_mutex_owner (lock) != current) {remove_waiter (lock, waiter); -fixup_rt_mutex_waiters (lock); cleanup = true; } -/* * try_to_take_rt_mutex() sets the waiter bit unconditionally. We might * have to fix that up.
Greg Kroah-Hartman
maintainerPATCH 44/53 futex: Fix (possible) missed wakeup
In reply to Greg Kroah-HartmanFrom: Peter Zijlstra <[email protected]>
commit b061c38bef43406df8e73c5be06cbfacad5ee6ad upstream.
We must not rely on wake_q_add() to delay the wakeup; in particular commit:
1d0dcb3ad9d3 ("futex: Implement lockless wakeups")
moved wake_q_add() before smp_store_release(&q->lock_ptr, NULL), which could result in futex_wait() waking before observing ->lock_ptr == NULL and going back to sleep again.
--- kernel/futex.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
kernel/futex.c +8 -5
@@ -1553,11 +1553,7 @@ static void mark_wake_futex(struct wake_if (WARN (q->pi_state || q->rt_waiter,"refusing to wake PI futex\n" ))return ; -/* -* Queue the task for later wakeup for after we've released -* the hb->lock. wake_q_add() grabs reference to p. -*/ -wake_q_add (wake_q, p); +get_task_struct (p);__unqueue_futex (q);/* * The waiting task can free the futex_q as soon as
@@ -1566,6 +1562,13 @@ static void mark_wake_futex(struct wake_* store to lock_ptr from getting ahead of the plist_del. */ smp_store_release (&q->lock_ptr,NULL ); + +/* +* Queue the task for later wakeup for after we've released +* the hb->lock. wake_q_add() grabs reference to p. +*/ +wake_q_add (wake_q, p); +put_task_struct (p); }/*
Greg Kroah-Hartman
maintainerPATCH 43/53 futex: Handle early deadlock return correctly
In reply to Greg Kroah-HartmanFrom: Thomas Gleixner <[email protected]>
commit 1a1fb985f2e2b85ec0d3dc2e519ee48389ec2434 upstream.
commit 56222b212e8e ("futex: Drop hb->lock before enqueueing on the rtmutex") changed the locking rules in the futex code so that the hash bucket lock is not longer held while the waiter is enqueued into the rtmutex wait list. This made the lock and the unlock path symmetric, but unfortunately the possible early exit from __rt_mutex_proxy_start() due to a detected deadlock was not updated accordingly. That allows a concurrent unlocker to observe inconsitent state which triggers the warning in the unlock path.
futex_lock_pi() futex_unlock_pi()
lock(hb->lock)
queue(hb_waiter) lock(hb->lock)
lock(rtmutex->wait_lock)
unlock(hb->lock)
// acquired hb->lock
hb_waiter = futex_top_waiter()
lock(rtmutex->wait_lock)
__rt_mutex_proxy_start()
---> fail
remove(rtmutex_waiter);
---> returns -EDEADLOCK
unlock(rtmutex->wait_lock)
// acquired wait_lock
wake_futex_pi()
rt_mutex_next_owner()
--> returns NULL
--> WARN lock(hb->lock)
unqueue(hb_waiter)
The problem is caused by the remove(rtmutex_waiter) in the failure case of __rt_mutex_proxy_start() as this lets the unlocker observe a waiter in the hash bucket but no waiter on the rtmutex, i.e. inconsistent state.
The original commit handles this correctly for the other early return cases (timeout, signal) by delaying the removal of the rtmutex waiter until the returning task reacquired the hash bucket lock.
Treat the failure case of __rt_mutex_proxy_start() in the same way and let the existing cleanup code handle the eventual handover of the rtmutex gracefully. The regular rt_mutex_proxy_start() gains the rtmutex waiter removal for the failure case, so that the other callsites are still operating correctly.
Add proper comments to the code so all these details are fully documented.
Thanks to Peter for helping with the analysis and writing the really valuable code comments.
--- kernel/futex.c | 28 ++++++++++++++++++---------- kernel/locking/rtmutex.c | 37 ++++++++++++++++++++++++++++++++----- 2 files changed, 50 insertions(+), 15 deletions(-)
kernel/futex.c +18 -10
@@ -2958,35 +2958,39 @@ retry_private:* and BUG when futex_unlock_pi() interleaves with this. * * Therefore acquire wait_lock while holding hb->lock, but drop the -* latter before calling rt_mutex_start_proxy_lock(). This still fully -* serializes against futex_unlock_pi() as that does the exact same -* lock handoff sequence. +* latter before calling __rt_mutex_start_proxy_lock(). This +* interleaves with futex_unlock_pi() -- which does a similar lock +* handoff -- such that the latter can observe the futex_q::pi_state +* before __rt_mutex_start_proxy_lock() is done. */ raw_spin_lock_irq (&q.pi_state->pi_mutex.wait_lock);spin_unlock (q.lock_ptr); +/* +* __rt_mutex_start_proxy_lock() unconditionally enqueues the @rt_waiter +* such that futex_unlock_pi() is guaranteed to observe the waiter when +* it sees the futex_q::pi_state. +*/ ret =__rt_mutex_start_proxy_lock (&q.pi_state->pi_mutex, &rt_waiter, current);raw_spin_unlock_irq (&q.pi_state->pi_mutex.wait_lock);if (ret) {if (ret ==1 ) ret =0 ; - -spin_lock (q.lock_ptr); - goto no_block; + goto cleanup; } -if (unlikely (to))hrtimer_start_expires (&to->timer,HRTIMER_MODE_ABS ); ret =rt_mutex_wait_proxy_lock (&q.pi_state->pi_mutex, to, &rt_waiter); +cleanup:spin_lock (q.lock_ptr);/* -* If we failed to acquire the lock (signal/timeout), we must +* If we failed to acquire the lock (deadlock/signal/timeout), we must * first acquire the hb->lock before removing the lock from the -* rt_mutex waitqueue, such that we can keep the hb and rt_mutex -* wait lists consistent. +* rt_mutex waitqueue, such that we can keep the hb and rt_mutex wait +* lists consistent. * * In particular; it is important that futex_unlock_pi() can not * observe this inconsistency.
@@ -3093,6 +3097,10 @@ retry:* there is no point where we hold neither; and therefore * wake_futex_pi() must observe a state consistent with what we * observed. +* +* In particular; this forces __rt_mutex_start_proxy() to +* complete such that we're guaranteed to observe the +* rt_waiter. Also see the WARN in wake_futex_pi(). */ raw_spin_lock_irq (&pi_state->pi_mutex.wait_lock);spin_unlock (&hb->lock);
kernel/locking/rtmutex.c +32 -5
@@ -1695,12 +1695,33 @@ void rt_mutex_proxy_unlock(struct rt_mutrt_mutex_set_owner (lock,NULL ); } +/** +* __rt_mutex_start_proxy_lock() - Start lock acquisition for another task +* @lock: the rt_mutex to take +* @waiter: the pre-initialized rt_mutex_waiter +* @task: the task to prepare +* +* Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock +* detection. It does not wait, see rt_mutex_wait_proxy_lock() for that. +* +* NOTE: does _NOT_ remove the @waiter on failure; must either call +* rt_mutex_wait_proxy_lock() or rt_mutex_cleanup_proxy_lock() after this. +* +* Returns: +* 0 - task blocked on lock +* 1 - acquired the lock for task, caller should wake it up +* <0 - error +* +* Special API call for PI-futex support. +*/ int __rt_mutex_start_proxy_lock (struct rt_mutex *lock,struct rt_mutex_waiter *waiter,struct task_struct *task) {int ret; +lockdep_assert_held (&lock->wait_lock); +if (try_to_take_rt_mutex (lock, task,NULL ))return 1 ;
@@ -1718,9 +1739,6 @@ int __rt_mutex_start_proxy_lock(struct r ret =0 ; } -if (unlikely (ret)) -remove_waiter (lock, waiter); -debug_rt_mutex_print_deadlock (waiter);return ret;
@@ -1732,12 +1750,18 @@ int __rt_mutex_start_proxy_lock(struct r* @waiter: the pre-initialized rt_mutex_waiter * @task: the task to prepare * +* Starts the rt_mutex acquire; it enqueues the @waiter and does deadlock +* detection. It does not wait, see rt_mutex_wait_proxy_lock() for that. +* +* NOTE: unlike __rt_mutex_start_proxy_lock this _DOES_ remove the @waiter +* on failure. +* * Returns: * 0 - task blocked on lock * 1 - acquired the lock for task, caller should wake it up * <0 - error * -* Special API call for FUTEX_REQUEUE_PI support. +* Special API call for PI-futex support. */ int rt_mutex_start_proxy_lock(struct rt_mutex *lock, struct rt_mutex_waiter *waiter,
@@ -1747,6 +1771,8 @@ int rt_mutex_start_proxy_lock(struct rt_raw_spin_lock_irq (&lock->wait_lock); ret =__rt_mutex_start_proxy_lock (lock, waiter, task); +if (unlikely (ret)) +remove_waiter (lock, waiter);raw_spin_unlock_irq (&lock->wait_lock);return ret;
@@ -1814,7 +1840,8 @@ int rt_mutex_wait_proxy_lock(struct rt_m* @lock: the rt_mutex we were woken on * @waiter: the pre-initialized rt_mutex_waiter * -* Attempt to clean up after a failed rt_mutex_wait_proxy_lock(). +* Attempt to clean up after a failed __rt_mutex_start_proxy_lock() or +* rt_mutex_wait_proxy_lock(). * * Unless we acquired the lock; we're still enqueued on the wait-list and can * in fact still be granted ownership until we're removed. Therefore we can
Greg Kroah-Hartman
maintainerPATCH 45/53 locking/futex: Allow low-level atomic operations to return -EAGAIN
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 6b4f4bc9cb22875f97023984a625386f0c7cc1c0 upstream.
Some futex() operations, including FUTEX_WAKE_OP, require the kernel to perform an atomic read-modify-write of the futex word via the userspace mapping. These operations are implemented by each architecture in arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic(), which are called in atomic context with the relevant hash bucket locks held.
Although these routines may return -EFAULT in response to a page fault generated when accessing userspace, they are expected to succeed (i.e. return 0) in all other cases. This poses a problem for architectures that do not provide bounded forward progress guarantees or fairness of contended atomic operations and can lead to starvation in some cases.
In these problematic scenarios, we must return back to the core futex code so that we can drop the hash bucket locks and reschedule if necessary, much like we do in the case of a page fault.
Allow architectures to return -EAGAIN from their implementations of arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic(), which will cause the core futex code to reschedule if necessary and return back to the architecture code later on.
--- kernel/futex.c | 185 +++++++++++++++++++++++++++++++++++---------------------- 1 file changed, 115 insertions(+), 70 deletions(-)
kernel/futex.c +115 -70
@@ -1407,13 +1407,15 @@ static int lookup_pi_state(u32 __user *ustatic int lock_pi_update_atomic (u32 __user *uaddr,u32 uval,u32 newval) { +int err;u32 uninitialized_var (curval );if (unlikely (should_fail_futex (true)))return -EFAULT ; -if (unlikely (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval))) -return -EFAULT ; + err =cmpxchg_futex_value_locked (&curval, uaddr, uval, newval); +if (unlikely (err)) +return err;/* If user space value changed, let the caller retry */ return curval != uval ? -EAGAIN :0 ;
@@ -1606,10 +1608,8 @@ static int wake_futex_pi(u32 __user *uadif (unlikely (should_fail_futex (true))) ret = -EFAULT ; -if (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)) { - ret = -EFAULT ; - - }else if (curval != uval) { + ret =cmpxchg_futex_value_locked (&curval, uaddr, uval, newval); +if (!ret && (curval != uval)) {/* * If a unconditional UNLOCK_PI operation (user space did not * try the TID->0 transition) raced with a waiter setting the
@@ -1795,32 +1795,32 @@ retry_private:double_lock_hb (hb1, hb2); op_ret =futex_atomic_op_inuser (op, uaddr2);if (unlikely (op_ret <0 )) { -double_unlock_hb (hb1, hb2); -#ifndef CONFIG_MMU -/* -* we don't get EFAULT from MMU faults if we don't have an MMU, -* but we might get them from range checking -*/ - ret = op_ret; - goto out_put_keys; -#endif - -if (unlikely (op_ret != -EFAULT )) { +if (!IS_ENABLED (CONFIG_MMU ) || +unlikely (op_ret != -EFAULT && op_ret != -EAGAIN )) { +/* +* we don't get EFAULT from MMU faults if we don't have +* an MMU, but we might get them from range checking +*/ ret = op_ret; goto out_put_keys; } - ret =fault_in_user_writeable (uaddr2); -if (ret) - goto out_put_keys; +if (op_ret == -EFAULT ) { + ret =fault_in_user_writeable (uaddr2); +if (ret) + goto out_put_keys; + } -if (!(flags &FLAGS_SHARED )) +if (!(flags &FLAGS_SHARED )) { +cond_resched (); goto retry_private; + }put_futex_key (&key2);put_futex_key (&key1); +cond_resched (); goto retry; }
@@ -2516,14 +2516,17 @@ retry:if (!pi_state->owner) newtid |=FUTEX_OWNER_DIED ; -if (get_futex_value_locked (&uval, uaddr)) - goto handle_fault; + err =get_futex_value_locked (&uval, uaddr); +if (err) + goto handle_err;for (;;) { newval = (uval &FUTEX_OWNER_DIED ) | newtid; -if (cmpxchg_futex_value_locked (&curval, uaddr, uval, newval)) - goto handle_fault; + err =cmpxchg_futex_value_locked (&curval, uaddr, uval, newval); +if (err) + goto handle_err; +if (curval == uval)break ; uval = curval;
@@ -2538,23 +2541,36 @@ retry:return argowner == current;/* -* To handle the page fault we need to drop the locks here. That gives -* the other task (either the highest priority waiter itself or the -* task which stole the rtmutex) the chance to try the fixup of the -* pi_state. So once we are back from handling the fault we need to -* check the pi_state after reacquiring the locks and before trying to -* do another fixup. When the fixup has been done already we simply -* return. +* In order to reschedule or handle a page fault, we need to drop the +* locks here. In the case of a fault, this gives the other task +* (either the highest priority waiter itself or the task which stole +* the rtmutex) the chance to try the fixup of the pi_state. So once we +* are back from handling the fault we need to check the pi_state after +* reacquiring the locks and before trying to do another fixup. When +* the fixup has been done already we simply return. * * Note: we hold both hb->lock and pi_mutex->wait_lock. We can safely * drop hb->lock since the caller owns the hb -> futex_q relation. * Dropping the pi_mutex->wait_lock requires the state revalidate. */ -handle_fault: +handle_err:raw_spin_unlock_irq (&pi_state->pi_mutex.wait_lock);spin_unlock (q->lock_ptr); - err =fault_in_user_writeable (uaddr); +switch (err) { +case -EFAULT : + err =fault_in_user_writeable (uaddr); +break ; + +case -EAGAIN : +cond_resched (); + err =0 ; +break ; + +default : +WARN_ON_ONCE (1 ); +break ; + }spin_lock (q->lock_ptr);raw_spin_lock_irq (&pi_state->pi_mutex.wait_lock);
@@ -3128,10 +3144,8 @@ retry:* A unconditional UNLOCK_PI op raced against a waiter * setting the FUTEX_WAITERS bit. Try again. */ -if (ret == -EAGAIN ) { -put_futex_key (&key); - goto retry; - } +if (ret == -EAGAIN ) + goto pi_retry;/* * wake_futex_pi has detected invalid state. Tell user * space.
@@ -3146,9 +3160,19 @@ retry:* preserve the WAITERS bit not the OWNER_DIED one. We are the * owner. */ -if (cmpxchg_futex_value_locked (&curval, uaddr, uval,0 )) { +if ((ret =cmpxchg_futex_value_locked (&curval, uaddr, uval,0 ))) {spin_unlock (&hb->lock); - goto pi_faulted; +switch (ret) { +case -EFAULT : + goto pi_faulted; + +case -EAGAIN : + goto pi_retry; + +default : +WARN_ON_ONCE (1 ); + goto out_putkey; + } }/*
@@ -3162,6 +3186,11 @@ out_putkey:put_futex_key (&key);return ret; +pi_retry: +put_futex_key (&key); +cond_resched (); + goto retry; + pi_faulted:put_futex_key (&key);
@@ -3504,6 +3533,7 @@ err_unlock:static int handle_futex_death (u32 __user *uaddr,struct task_struct *curr,int pi) {u32 uval,uninitialized_var (nval ), mval; +int err;/* Futex address must be 32bit aligned */ if ((((unsigned long )uaddr) %sizeof (*uaddr)) !=0 )
@@ -3513,42 +3543,57 @@ retry:if (get_user (uval, uaddr))return -1 ; -if ((uval &FUTEX_TID_MASK ) ==task_pid_vnr (curr)) { -/* -* Ok, this dying thread is truly holding a futex -* of interest. Set the OWNER_DIED bit atomically -* via cmpxchg, and if the value had FUTEX_WAITERS -* set, wake up a waiter (if any). (We have to do a -* futex_wake() even if OWNER_DIED is already set - -* to handle the rare but possible case of recursive -* thread-death.) The rest of the cleanup is done in -* userspace. -*/ - mval = (uval &FUTEX_WAITERS ) |FUTEX_OWNER_DIED ; -/* -* We are not holding a lock here, but we want to have -* the pagefault_disable/enable() protection because -* we want to handle the fault gracefully. If the -* access fails we try to fault in the futex with R/W -* verification via get_user_pages. get_user() above -* does not guarantee R/W access. If that fails we -* give up and leave the futex locked. -*/ -if (cmpxchg_futex_value_locked (&nval, uaddr, uval, mval)) { +if ((uval &FUTEX_TID_MASK ) !=task_pid_vnr (curr)) +return 0 ; + +/* +* Ok, this dying thread is truly holding a futex +* of interest. Set the OWNER_DIED bit atomically +* via cmpxchg, and if the value had FUTEX_WAITERS +* set, wake up a waiter (if any). (We have to do a +* futex_wake() even if OWNER_DIED is already set - +* to handle the rare but possible case of recursive +* thread-death.) The rest of the cleanup is done in +* userspace. +*/ + mval = (uval &FUTEX_WAITERS ) |FUTEX_OWNER_DIED ; + +/* +* We are not holding a lock here, but we want to have +* the pagefault_disable/enable() protection because +* we want to handle the fault gracefully. If the +* access fails we try to fault in the futex with R/W +* verification via get_user_pages. get_user() above +* does not guarantee R/W access. If that fails we +* give up and leave the futex locked. +*/ +if ((err =cmpxchg_futex_value_locked (&nval, uaddr, uval, mval))) { +switch (err) { +case -EFAULT :if (fault_in_user_writeable (uaddr))return -1 ; goto retry; - } -if (nval != uval) + +case -EAGAIN : +cond_resched (); goto retry; -/* -* Wake robust non-PI futexes here. The wakeup of -* PI futexes happens in exit_pi_state(): -*/ -if (!pi && (uval &FUTEX_WAITERS )) -futex_wake (uaddr,1 ,1 ,FUTEX_BITSET_MATCH_ANY ); +default : +WARN_ON_ONCE (1 ); +return err; + } } + +if (nval != uval) + goto retry; + +/* +* Wake robust non-PI futexes here. The wakeup of +* PI futexes happens in exit_pi_state(): +*/ +if (!pi && (uval &FUTEX_WAITERS )) +futex_wake (uaddr,1 ,1 ,FUTEX_BITSET_MATCH_ANY ); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 46/53 arm64: futex: Bound number of LDXR/STXR loops in FUTEX_WAKE_OP
In reply to Greg Kroah-HartmanFrom: Will Deacon <[email protected]>
commit 03110a5cb2161690ae5ac04994d47ed0cd6cef75 upstream.
Our futex implementation makes use of LDXR/STXR loops to perform atomic updates to user memory from atomic context. This can lead to latency problems if we end up spinning around the LL/SC sequence at the expense of doing something useful.
Rework our futex atomic operations so that we return -EAGAIN if we fail to update the futex word after 128 attempts. The core futex code will reschedule if necessary and we'll try again later.
--- arch/arm64/include/asm/futex.h | 59 +++++++++++++++++++++++++---------------- 1 file changed, 37 insertions(+), 22 deletions(-)
arch/arm64/include/asm/futex.h +37 -22
@@ -26,7 +26,12 @@#include <asm/errno.h> #include <asm/sysreg.h> +#define FUTEX_MAX_LOOPS 128/* What's the largest number you can think of? */ +#define __futex_atomic_op (insn, ret, oldval, uaddr, tmp, oparg) \ +do { \ + unsigned int loops = FUTEX_MAX_LOOPS; \ + \ asm volatile( \ ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, \ CONFIG_ARM64_PAN) \
@@ -34,21 +39,26 @@"1: ldxr %w1, %2\n" \ insn"\n" \"2: stlxr %w0, %w3, %2\n" \ -" cbnz %w0, 1b\n" \ -" dmb ish\n" \ +" cbz %w0, 3f\n" \ +" sub %w4, %w4, %w0\n" \ +" cbnz %w4, 1b\n" \ +" mov %w0, %w7\n" \"3:\n" \ +" dmb ish\n" \" .pushsection .fixup,\"ax\"\n" \" .align 2\n" \ -"4: mov %w0, %w5\n" \ +"4: mov %w0, %w6\n" \" b 3b\n" \" .popsection\n" \ _ASM_EXTABLE(1b, 4b) \ _ASM_EXTABLE(2b, 4b) \ALTERNATIVE ("nop" ,SET_PSTATE_PAN (1 ),ARM64_HAS_PAN , \CONFIG_ARM64_PAN ) \ - : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp) \ -: " r" (oparg), " Ir" (-EFAULT) \ - : "memory") + : "=&r" (ret), "=&r" (oldval), "+Q" (*uaddr), "=&r" (tmp), \ +" +r" (loops) \ +: " r" (oparg), " Ir" (-EFAULT), " Ir" (-EAGAIN) \ +: " memory"); \ +} while (0) static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
@@ -59,23 +69,23 @@ arch_futex_atomic_op_inuser(int op, intswitch (op) {case FUTEX_OP_SET : -__futex_atomic_op ("mov %w3, %w4" , +__futex_atomic_op ("mov %w3, %w5" , ret, oldval, uaddr, tmp, oparg);break ;case FUTEX_OP_ADD : -__futex_atomic_op ("add %w3, %w1, %w4" , +__futex_atomic_op ("add %w3, %w1, %w5" , ret, oldval, uaddr, tmp, oparg);break ;case FUTEX_OP_OR : -__futex_atomic_op ("orr %w3, %w1, %w4" , +__futex_atomic_op ("orr %w3, %w1, %w5" , ret, oldval, uaddr, tmp, oparg);break ;case FUTEX_OP_ANDN : -__futex_atomic_op ("and %w3, %w1, %w4" , +__futex_atomic_op ("and %w3, %w1, %w5" , ret, oldval, uaddr, tmp, ~oparg);break ;case FUTEX_OP_XOR : -__futex_atomic_op ("eor %w3, %w1, %w4" , +__futex_atomic_op ("eor %w3, %w1, %w5" , ret, oldval, uaddr, tmp, oparg);break ;default :
@@ -95,6 +105,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 oldval, u32 newval) {int ret =0 ; +unsigned int loops =FUTEX_MAX_LOOPS ;u32 val, tmp;u32 __user *uaddr;
@@ -106,21 +117,25 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)" prfm pstl1strm, %2\n" "1: ldxr %w1, %2\n" -" sub %w3, %w1, %w4\n" -" cbnz %w3, 3f\n" -"2: stlxr %w3, %w5, %2\n" -" cbnz %w3, 1b\n" -" dmb ish\n" +" sub %w3, %w1, %w5\n" +" cbnz %w3, 4f\n" +"2: stlxr %w3, %w6, %2\n" +" cbz %w3, 3f\n" +" sub %w4, %w4, %w3\n" +" cbnz %w4, 1b\n" +" mov %w0, %w8\n" "3:\n" +" dmb ish\n" +"4:\n" " .pushsection .fixup,\"ax\"\n" -"4: mov %w0, %w6\n" -" b 3b\n" +"5: mov %w0, %w7\n" +" b 4b\n" " .popsection\n" - _ASM_EXTABLE(1b, 4b) - _ASM_EXTABLE(2b, 4b) + _ASM_EXTABLE(1b, 5b) + _ASM_EXTABLE(2b, 5b) ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN) - : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp) - : "r" (oldval), "r" (newval), "Ir" (-EFAULT) + : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp), "+r" (loops) + : "r" (oldval), "r" (newval), "Ir" (-EFAULT), "Ir" (-EAGAIN) : "memory"); *uval = val;
Greg Kroah-Hartman
maintainerPATCH 23/53 net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 47142ed6c34d544ae9f0463e58d482289cbe0d46 ]
Similar to commit 92696286f3bb37ba50e4bd8d1beb24afb759a799 ("net:
bcmgenet: Set phydev->dev_flags only for internal PHYs") we need to qualify the phydev->dev_flags based on whether the port is connected to an internal or external PHY otherwise we risk having a flags collision with a completely different interpretation depending on the driver.
--- drivers/net/dsa/bcm_sf2.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/dsa/bcm_sf2.c +4 -2
@@ -588,8 +588,10 @@ static u32 bcm_sf2_sw_get_phy_flags(struct dsa_switch *ds, int port)* in bits 15:8 and the patch level in bits 7:0 which is exactly what * the REG_PHY_REVISION register layout is. */ - -return priv->hw_params.gphy_rev; +if (priv->int_phy_mask &BIT (port)) +return priv->hw_params.gphy_rev; +else +return 0 ; } static void bcm_sf2_sw_adjust_link(struct dsa_switch *ds, int port,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 47/53 futex: Prevent robust futex exit race
In reply to Greg Kroah-HartmanFrom: Yang Tao <[email protected]>
commit ca16d5bee59807bf04deaab0a8eccecd5061528c upstream.
Robust futexes utilize the robust_list mechanism to allow the kernel to release futexes which are held when a task exits. The exit can be voluntary or caused by a signal or fault. This prevents that waiters block forever.
The futex operations in user space store a pointer to the futex they are either locking or unlocking in the op_pending member of the per task robust list.
After a lock operation has succeeded the futex is queued in the robust list linked list and the op_pending pointer is cleared.
After an unlock operation has succeeded the futex is removed from the robust list linked list and the op_pending pointer is cleared.
The robust list exit code checks for the pending operation and any futex which is queued in the linked list. It carefully checks whether the futex value is the TID of the exiting task. If so, it sets the OWNER_DIED bit and tries to wake up a potential waiter.
This is race free for the lock operation but unlock has two race scenarios where waiters might not be woken up. These issues can be observed with regular robust pthread mutexes. PI aware pthread mutexes are not affected.
(1) Unlocking task is killed after unlocking the futex value in user space
before being able to wake a waiter.
pthread_mutex_unlock()
|
V
atomic_exchange_rel (&mutex->__data.__lock, 0)
<------------------------killed
lll_futex_wake () |
|
|(__lock = 0)
|(enter kernel)
|
V
do_exit()
exit_mm()
mm_release()
exit_robust_list()
handle_futex_death()
|
|(__lock = 0)
|(uval = 0)
|
V
if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
return 0;
The sanity check which ensures that the user space futex is owned by
the exiting task prevents the wakeup of waiters which in consequence
block infinitely.(2) Waiting task is killed after a wakeup and before it can acquire the futex in user space.
OWNER WAITER
futex_wait()
pthread_mutex_unlock() |
| |
|(__lock = 0) |
| |
V |
futex_wake() ------------> wakeup()
|
|(return to userspace)
|(__lock = 0)
|
V
oldval = mutex->__data.__lock
<-----------------killed
atomic_compare_and_exchange_val_acq (&mutex->__data.__lock, |
id | assume_other_futex_waiters, 0) |
|
|
(enter kernel)|
|
V
do_exit()
|
|
V
handle_futex_death()
|
|(__lock = 0)
|(uval = 0)
|
V
if ((uval & FUTEX_TID_MASK) != task_pid_vnr(curr))
return 0;
The sanity check which ensures that the user space futex is owned
by the exiting task prevents the wakeup of waiters, which seems to
be correct as the exiting task does not own the futex value, but
the consequence is that other waiters wont be woken up and block
infinitely.In both scenarios the following conditions are true:
- task->robust_list->list_op_pending != NULL
- user space futex value == 0
- Regular futex (not PI)
If these conditions are met then it is reasonably safe to wake up a potential waiter in order to prevent the above problems.
As this might be a false positive it can cause spurious wakeups, but the waiter side has to handle other types of unrelated wakeups, e.g. signals gracefully anyway. So such a spurious wakeup will not affect the correctness of these operations.
This workaround must not touch the user space futex value and cannot set the OWNER_DIED bit because the lock value is 0, i.e. uncontended. Setting OWNER_DIED in this case would result in inconsistent state and subsequently in malfunction of the owner died handling in user space.
The rest of the user space state is still consistent as no other task can observe the list_op_pending entry in the exiting tasks robust list.
The eventually woken up waiter will observe the uncontended lock value and take it over.
[ tglx: Massaged changelog and comment. Made the return explicit and not
depend on the subsequent check and added constants to hand into handle_futex_death() instead of plain numbers. Fixed a few coding style issues. ]
--- kernel/futex.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 51 insertions(+), 7 deletions(-)
kernel/futex.c +51 -7
@@ -3526,11 +3526,16 @@ err_unlock:return ret; } +/* Constants for the pending_op argument of handle_futex_death */ +#define HANDLE_DEATH_PENDING true +#define HANDLE_DEATH_LIST false +/* * Process a futex-list entry, check whether it's owned by the * dying task, and do notification if so: */ -static int handle_futex_death (u32 __user *uaddr,struct task_struct *curr,int pi) +static int handle_futex_death (u32 __user *uaddr,struct task_struct *curr, +bool pi,bool pending_op) {u32 uval,uninitialized_var (nval ), mval;int err;
@@ -3543,6 +3548,42 @@ retry:if (get_user (uval, uaddr))return -1 ; +/* +* Special case for regular (non PI) futexes. The unlock path in +* user space has two race scenarios: +* +* 1. The unlock path releases the user space futex value and +* before it can execute the futex() syscall to wake up +* waiters it is killed. +* +* 2. A woken up waiter is killed before it can acquire the +* futex in user space. +* +* In both cases the TID validation below prevents a wakeup of +* potential waiters which can cause these waiters to block +* forever. +* +* In both cases the following conditions are met: +* +* 1) task->robust_list->list_op_pending != NULL +* @pending_op == true +* 2) User space futex value == 0 +* 3) Regular futex: @pi == false +* +* If these conditions are met, it is safe to attempt waking up a +* potential waiter without touching the user space futex value and +* trying to set the OWNER_DIED bit. The user space futex value is +* uncontended and the rest of the user space mutex state is +* consistent, so a woken waiter will just take over the +* uncontended futex. Setting the OWNER_DIED bit would create +* inconsistent state and malfunction of the user space owner died +* handling. +*/ +if (pending_op && !pi && !uval) { +futex_wake (uaddr,1 ,1 ,FUTEX_BITSET_MATCH_ANY ); +return 0 ; + } +if ((uval &FUTEX_TID_MASK ) !=task_pid_vnr (curr))return 0 ;
@@ -3662,10 +3703,11 @@ static void exit_robust_list(struct task* A pending lock might already be on the list, so * don't process it twice: */ -if (entry != pending) +if (entry != pending) {if (handle_futex_death ((void __user *)entry + futex_offset, - curr, pi)) + curr, pi,HANDLE_DEATH_LIST ))return ; + }if (rc)return ; entry = next_entry;
@@ -3679,9 +3721,10 @@ static void exit_robust_list(struct taskcond_resched (); } -if (pending) +if (pending) {handle_futex_death ((void __user *)pending + futex_offset, - curr, pip); + curr, pip,HANDLE_DEATH_PENDING ); + } }static void futex_cleanup (struct task_struct *tsk)
@@ -3964,7 +4007,8 @@ void compat_exit_robust_list(struct taskif (entry != pending) {void __user *uaddr =futex_uaddr (entry, futex_offset); -if (handle_futex_death (uaddr, curr, pi)) +if (handle_futex_death (uaddr, curr, pi, +HANDLE_DEATH_LIST ))return ; }if (rc)
@@ -3983,7 +4027,7 @@ void compat_exit_robust_list(struct taskif (pending) {void __user *uaddr =futex_uaddr (pending, futex_offset); -handle_futex_death (uaddr, curr, pip); +handle_futex_death (uaddr, curr, pip,HANDLE_DEATH_PENDING ); } }
Greg Kroah-Hartman
maintainerPATCH 48/53 futex: Fix incorrect should_fail_futex() handling
In reply to Greg Kroah-HartmanFrom: Mateusz Nosek <[email protected]>
commit 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 upstream.
If should_futex_fail() returns true in futex_wake_pi(), then the 'ret' variable is set to -EFAULT and then immediately overwritten. So the failure injection is non-functional.
Fix it by actually leaving the function and returning -EFAULT.
The Fixes tag is kinda blury because the initial commit which introduced failure injection was already sloppy, but the below mentioned commit broke it completely.
[ tglx: Massaged changelog ]
--- kernel/futex.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
kernel/futex.c +3 -1
@@ -1605,8 +1605,10 @@ static int wake_futex_pi(u32 __user *uad*/ newval =FUTEX_WAITERS |task_pid_vnr (new_owner); -if (unlikely (should_fail_futex (true))) +if (unlikely (should_fail_futex (true))) { ret = -EFAULT ; + goto out_unlock; + } ret =cmpxchg_futex_value_locked (&curval, uaddr, uval, newval);if (!ret && (curval != uval)) {
Greg Kroah-Hartman
maintainerPATCH 49/53 futex: Handle transient "ownerless" rtmutex state correctly
In reply to Greg Kroah-HartmanFrom: Mike Galbraith <[email protected]>
commit 9f5d1c336a10c0d24e83e40b4c1b9539f7dba627 upstream.
Gratian managed to trigger the BUG_ON(!newowner) in fixup_pi_state_owner(). This is one possible chain of events leading to this:
Task Prio Operation
T1 120 lock(F) T2 120 lock(F) -> blocks (top waiter) T3 50 (RT) lock(F) -> boosts T1 and blocks (new top waiter) XX timeout/ -> wakes T2
signal
T1 50 unlock(F) -> wakes T3 (rtmutex->owner == NULL, waiter bit is set)
T2 120 cleanup -> try_to_take_mutex() fails because T3 is the top waiter
and the lower priority T2 cannot steal the lock.
-> fixup_pi_state_owner() sees newowner == NULL -> BUG_ON()
The comment states that this is invalid and rt_mutex_real_owner() must return a non NULL owner when the trylock failed, but in case of a queued and woken up waiter rt_mutex_real_owner() == NULL is a valid transient state. The higher priority waiter has simply not yet managed to take over the rtmutex.
The BUG_ON() is therefore wrong and this is just another retry condition in fixup_pi_state_owner().
Drop the locks, so that T3 can make progress, and then try the fixup again.
Gratian provided a great analysis, traces and a reproducer. The analysis is to the point, but it confused the hell out of that tglx dude who had to page in all the futex horrors again. Condensed version is above.
[ tglx: Wrote comment and changelog ]
--- kernel/futex.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-)
kernel/futex.c +14 -2
@@ -2497,10 +2497,22 @@ retry: }/* -* Since we just failed the trylock; there must be an owner. +* The trylock just failed, so either there is an owner or +* there is a higher priority waiter than this one. */ newowner =rt_mutex_owner (&pi_state->pi_mutex); -BUG_ON (!newowner); +/* +* If the higher priority waiter has not yet taken over the +* rtmutex then newowner is NULL. We can't return here with +* that state because it's inconsistent vs. the user space +* state. So drop the locks and try again. It's a valid +* situation and not any different from the other retry +* conditions. +*/ +if (unlikely (!newowner)) { + err = -EAGAIN ; + goto handle_err; + } }else {WARN_ON_ONCE (argowner != current);if (oldowner == current) {
Greg Kroah-Hartman
maintainerPATCH 50/53 can: dev: Move device back to init netns on owning netns delete
In reply to Greg Kroah-HartmanFrom: Martin Willi <[email protected]>
commit 3a5ca857079ea022e0b1b17fc154f7ad7dbc150f upstream.
When a non-initial netns is destroyed, the usual policy is to delete all virtual network interfaces contained, but move physical interfaces back to the initial netns. This keeps the physical interface visible on the system.
CAN devices are somewhat special, as they define rtnl_link_ops even if they are physical devices. If a CAN interface is moved into a non-initial netns, destroying that netns lets the interface vanish instead of moving it back to the initial netns. default_device_exit() skips CAN interfaces due to having rtnl_link_ops set. Reproducer:
ip netns add foo
ip link set can0 netns foo
ip netns delete foo
WARNING: CPU: 1 PID: 84 at net/core/dev.c:11030 ops_exit_list+0x38/0x60 CPU: 1 PID: 84 Comm: kworker/u4:2 Not tainted 5.10.19 #1 Workqueue: netns cleanup_net [<c010e700>] (unwind_backtrace) from [<c010a1d8>] (show_stack+0x10/0x14) [<c010a1d8>] (show_stack) from [<c086dc10>] (dump_stack+0x94/0xa8) [<c086dc10>] (dump_stack) from [<c086b938>] (__warn+0xb8/0x114) [<c086b938>] (__warn) from [<c086ba10>] (warn_slowpath_fmt+0x7c/0xac) [<c086ba10>] (warn_slowpath_fmt) from [<c0629f20>] (ops_exit_list+0x38/0x60) [<c0629f20>] (ops_exit_list) from [<c062a5c4>] (cleanup_net+0x230/0x380) [<c062a5c4>] (cleanup_net) from [<c0142c20>] (process_one_work+0x1d8/0x438) [<c0142c20>] (process_one_work) from [<c0142ee4>] (worker_thread+0x64/0x5a8) [<c0142ee4>] (worker_thread) from [<c0148a98>] (kthread+0x148/0x14c) [<c0148a98>] (kthread) from [<c0100148>] (ret_from_fork+0x14/0x2c)
To properly restore physical CAN devices to the initial netns on owning netns exit, introduce a flag on rtnl_link_ops that can be set by drivers. For CAN devices setting this flag, default_device_exit() considers them non-virtual, applying the usual namespace move.
The issue was introduced in the commit mentioned below, as at that time CAN devices did not have a dellink() operation.
--- drivers/net/can/dev.c | 1 + include/net/rtnetlink.h | 2 ++ net/core/dev.c | 2 +- 3 files changed, 4 insertions(+), 1 deletion(-)
drivers/net/can/dev.c +1 -0
@@ -1084,6 +1084,7 @@ static void can_dellink(struct net_devicstatic struct rtnl_link_ops can_link_ops__read_mostly = { .kind ="can" , + .netns_refund = true, .maxtype =IFLA_CAN_MAX , .policy = can_policy, .setup = can_setup,
include/net/rtnetlink.h +2 -0
@@ -28,6 +28,7 @@ static inline int rtnl_msg_family(const* * @list: Used internally * @kind: Identifier +* @netns_refund: Physical device, move to init_net on netns exit * @maxtype: Highest device specific netlink attribute number * @policy: Netlink policy for device specific attribute validation * @validate: Optional validation function for netlink/changelink parameters
@@ -84,6 +85,7 @@ struct rtnl_link_ops {unsigned int (*get_num_tx_queues)(void );unsigned int (*get_num_rx_queues)(void ); +bool netns_refund;int slave_maxtype;const struct nla_policy *slave_policy; int (*slave_validate)(struct nlattr *tb[],
net/core/dev.c +1 -1
@@ -8300,7 +8300,7 @@ static void __net_exit default_device_excontinue ;/* Leave virtual devices for the generic cleanup */ -if (dev->rtnl_link_ops) +if (dev->rtnl_link_ops && !dev->rtnl_link_ops->netns_refund)continue ;/* Push remaining network devices to init_net */
Greg Kroah-Hartman
maintainerPATCH 51/53 net: sched: validate stab values
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit e323d865b36134e8c5c82c834df89109a5c60dab upstream.
iproute2 package is well behaved, but malicious user space can provide illegal shift values and trigger UBSAN reports.
Add stab parameter to red_check_params() to validate user input.
syzbot reported:
UBSAN: shift-out-of-bounds in ./include/net/red.h:312:18 shift exponent 111 is too large for 64-bit type 'long unsigned int' CPU: 1 PID: 14662 Comm: syz-executor.3 Not tainted 5.12.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 red_calc_qavg_from_idle_time include/net/red.h:312 [inline] red_calc_qavg include/net/red.h:353 [inline] choke_enqueue.cold+0x18/0x3dd net/sched/sch_choke.c:221 __dev_xmit_skb net/core/dev.c:3837 [inline] __dev_queue_xmit+0x1943/0x2e00 net/core/dev.c:4150 neigh_hh_output include/net/neighbour.h:499 [inline] neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0x911/0x1700 net/ipv6/ip6_output.c:117 __ip6_finish_output net/ipv6/ip6_output.c:182 [inline] __ip6_finish_output+0x4c1/0xe10 net/ipv6/ip6_output.c:161 ip6_finish_output+0x35/0x200 net/ipv6/ip6_output.c:192 NF_HOOK_COND include/linux/netfilter.h:290 [inline] ip6_output+0x1e4/0x530 net/ipv6/ip6_output.c:215 dst_output include/net/dst.h:448 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] NF_HOOK include/linux/netfilter.h:295 [inline] ip6_xmit+0x127e/0x1eb0 net/ipv6/ip6_output.c:320 inet6_csk_xmit+0x358/0x630 net/ipv6/inet6_connection_sock.c:135 dccp_transmit_skb+0x973/0x12c0 net/dccp/output.c:138 dccp_send_reset+0x21b/0x2b0 net/dccp/output.c:535 dccp_finish_passive_close net/dccp/proto.c:123 [inline] dccp_finish_passive_close+0xed/0x140 net/dccp/proto.c:118 dccp_terminate_connection net/dccp/proto.c:958 [inline] dccp_close+0xb3c/0xe60 net/dccp/proto.c:1028 inet_release+0x12e/0x280 net/ipv4/af_inet.c:431 inet6_release+0x4c/0x70 net/ipv6/af_inet6.c:478 __sock_release+0xcd/0x280 net/socket.c:599 sock_close+0x18/0x20 net/socket.c:1258 __fput+0x288/0x920 fs/file_table.c:280 task_work_run+0xdd/0x1a0 kernel/task_work.c:140 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
--- include/net/red.h | 10 +++++++++- net/sched/sch_choke.c | 7 ++++--- net/sched/sch_gred.c | 2 +- net/sched/sch_red.c | 7 +++++-- net/sched/sch_sfq.c | 2 +- 5 files changed, 20 insertions(+), 8 deletions(-)
include/net/red.h +9 -1
@@ -167,7 +167,8 @@ static inline void red_set_vars(struct r v->qcount =-1 ; } -static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog,u8 Scell_log) +static inline bool red_check_params (u32 qth_min,u32 qth_max,u8 Wlog, +u8 Scell_log,u8 *stab) {if (fls (qth_min) + Wlog >32 )return false;
@@ -177,6 +178,13 @@ static inline bool red_check_params(u32return false;if (qth_max < qth_min)return false; +if (stab) { +int i; + +for (i =0 ; i <RED_STAB_SIZE ; i++) +if (stab[i] >=32 ) +return false; + }return true; }
net/sched/sch_choke.c +4 -3
@@ -409,6 +409,7 @@ static int choke_change(struct Qdisc *scstruct sk_buff **old =NULL ;unsigned int mask;u32 max_P; +u8 *stab;if (opt ==NULL )return -EINVAL ;
@@ -424,8 +425,8 @@ static int choke_change(struct Qdisc *sc max_P = tb[TCA_CHOKE_MAX_P ] ?nla_get_u32 (tb[TCA_CHOKE_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_CHOKE_PARMS ]); - -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_CHOKE_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))return -EINVAL ;if (ctl->limit >CHOKE_MAX_QUEUE )
@@ -478,7 +479,7 @@ static int choke_change(struct Qdisc *scred_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_CHOKE_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_gred.c +1 -1
@@ -356,7 +356,7 @@ static inline int gred_change_vq(structstruct gred_sched *table =qdisc_priv (sch);struct gred_sched_data *q = table->tab[dp]; -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log, stab))return -EINVAL ;if (!q) {
net/sched/sch_red.c +5 -2
@@ -169,6 +169,7 @@ static int red_change(struct Qdisc *sch,struct Qdisc *child =NULL ;int err;u32 max_P; +u8 *stab;if (opt ==NULL )return -EINVAL ;
@@ -184,7 +185,9 @@ static int red_change(struct Qdisc *sch, max_P = tb[TCA_RED_MAX_P ] ?nla_get_u32 (tb[TCA_RED_MAX_P ]) :0 ; ctl =nla_data (tb[TCA_RED_PARMS ]); -if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Scell_log)) + stab =nla_data (tb[TCA_RED_STAB ]); +if (!red_check_params (ctl->qth_min, ctl->qth_max, ctl->Wlog, + ctl->Scell_log, stab))return -EINVAL ;if (ctl->limit >0 ) {
@@ -206,7 +209,7 @@ static int red_change(struct Qdisc *sch,red_set_parms (&q->parms, ctl->qth_min, ctl->qth_max, ctl->Wlog, ctl->Plog, ctl->Scell_log, -nla_data (tb[TCA_RED_STAB ]), + stab, max_P);red_set_vars (&q->vars);
net/sched/sch_sfq.c +1 -1
@@ -645,7 +645,7 @@ static int sfq_change(struct Qdisc *sch, }if (ctl_v1 && !red_check_params (ctl_v1->qth_min, ctl_v1->qth_max, - ctl_v1->Wlog, ctl_v1->Scell_log)) + ctl_v1->Wlog, ctl_v1->Scell_log,NULL ))return -EINVAL ;if (ctl_v1 && ctl_v1->qth_min) { p =kmalloc (sizeof (*p),GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 24/53 e1000e: add rtnl_lock() to e1000_reset_task
In reply to Greg Kroah-HartmanFrom: Vitaly Lifshits <[email protected]>
[ Upstream commit 21f857f0321d0d0ea9b1a758bd55dc63d1cb2437 ]
A possible race condition was found in e1000_reset_task, after discovering a similar issue in igb driver via commit 024a8168b749 ("igb: reinit_locked() should be called with rtnl_lock").
Added rtnl_lock() and rtnl_unlock() to avoid this.
--- drivers/net/ethernet/intel/e1000e/netdev.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e1000e/netdev.c +5 -1
@@ -5920,15 +5920,19 @@ static void e1000_reset_task(struct work_struct *work)struct e1000_adapter *adapter; adapter = container_of(work, struct e1000_adapter, reset_task); +rtnl_lock ();/* don't run the task if already down */ -if (test_bit (__E1000_DOWN, &adapter->state)) +if (test_bit (__E1000_DOWN, &adapter->state)) { +rtnl_unlock ();return ; + }if (!(adapter->flags &FLAG_RESTART_NOW )) {e1000e_dump (adapter);e_err ("Reset adapter unexpectedly\n" ); }e1000e_reinit_locked (adapter); +rtnl_unlock (); }/**
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 26/53 net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
In reply to Greg Kroah-HartmanFrom: Lv Yunlong <[email protected]>
[ Upstream commit db74623a3850db99cb9692fda9e836a56b74198d ]
In qlcnic_83xx_get_minidump_template, fw_dump->tmpl_hdr was freed by vfree(). But unfortunately, it is used when extended is true.
--- drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/ethernet/qlogic/qlcnic/qlcnic_minidump.c +3 -0
@@ -1426,6 +1426,7 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)if (fw_dump->tmpl_hdr ==NULL || current_version > prev_version) {vfree (fw_dump->tmpl_hdr); + fw_dump->tmpl_hdr =NULL ;if (qlcnic_83xx_md_check_extended_dump_capability (adapter)) extended = !qlcnic_83xx_extend_md_capab (adapter);
@@ -1444,6 +1445,8 @@ void qlcnic_83xx_get_minidump_template(struct qlcnic_adapter *adapter)struct qlcnic_83xx_dump_template_hdr *hdr; hdr = fw_dump->tmpl_hdr; +if (!hdr) +return ; hdr->drv_cap_mask =0x1f ; fw_dump->cap_mask =0x1f ; dev_info(&pdev->dev,
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 27/53 can: c_can_pci: c_can_pci_remove(): fix use-after-free
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 0429d6d89f97ebff4f17f13f5b5069c66bde8138 ]
There is a UAF in c_can_pci_remove(). dev is released by free_c_can_dev() and is used by pci_iounmap(pdev, priv->base) later. To fix this issue, save the mmio address before releasing dev.
--- drivers/net/can/c_can/c_can_pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/can/c_can/c_can_pci.c +2 -1
@@ -239,12 +239,13 @@ static void c_can_pci_remove(struct pci_dev *pdev) {struct net_device *dev =pci_get_drvdata (pdev);struct c_can_priv *priv =netdev_priv (dev); +void __iomem *addr = priv->base;unregister_c_can_dev (dev);free_c_can_dev (dev); -pci_iounmap (pdev, priv->base); +pci_iounmap (pdev, addr);pci_disable_msi (pdev);pci_clear_master (pdev);pci_release_regions (pdev);
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 28/53 can: c_can: move runtime PM enable/disable to c_can_platform
In reply to Greg Kroah-HartmanFrom: Tong Zhang <[email protected]>
[ Upstream commit 6e2fe01dd6f98da6cae8b07cd5cfa67abc70d97d ]
Currently doing modprobe c_can_pci will make the kernel complain:
Unbalanced pm_runtime_enable!
this is caused by pm_runtime_enable() called before pm is initialized.
This fix is similar to 227619c3ff7c, move those pm_enable/disable code to c_can_platform.
--- drivers/net/can/c_can/c_can.c | 24 +----------------------- drivers/net/can/c_can/c_can_platform.c | 6 +++++- 2 files changed, 6 insertions(+), 24 deletions(-)
drivers/net/can/c_can/c_can.c +1 -23
@@ -212,18 +212,6 @@ static const struct can_bittiming_const c_can_bittiming_const = { .brp_inc = 1, }; -static inline void c_can_pm_runtime_enable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_enable (priv->device); -} - -static inline void c_can_pm_runtime_disable (const struct c_can_priv *priv) -{ -if (priv->device) -pm_runtime_disable (priv->device); -} -static inline void c_can_pm_runtime_get_sync (const struct c_can_priv *priv) {if (priv->device)
@@ -1318,7 +1306,6 @@ static const struct net_device_ops c_can_netdev_ops = {int register_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev);int err;/* Deactivate pins to prevent DRA7 DCAN IP from being
@@ -1328,28 +1315,19 @@ int register_c_can_dev(struct net_device *dev)*/ pinctrl_pm_select_sleep_state (dev->dev.parent); -c_can_pm_runtime_enable (priv); - dev->flags |=IFF_ECHO ;/* we support local echo */ dev->netdev_ops = &c_can_netdev_ops; err =register_candev (dev); -if (err) -c_can_pm_runtime_disable (priv); -else +if (!err)devm_can_led_init (dev); -return err; }EXPORT_SYMBOL_GPL (register_c_can_dev);void unregister_c_can_dev (struct net_device *dev) { -struct c_can_priv *priv =netdev_priv (dev); -unregister_candev (dev); - -c_can_pm_runtime_disable (priv); }EXPORT_SYMBOL_GPL (unregister_c_can_dev);
drivers/net/can/c_can/c_can_platform.c +5 -1
@@ -29,6 +29,7 @@#include <linux/list.h> #include <linux/io.h> #include <linux/platform_device.h> +#include <linux/pm_runtime.h> #include <linux/clk.h> #include <linux/of.h> #include <linux/of_device.h>
@@ -385,6 +386,7 @@ static int c_can_plat_probe(struct platform_device *pdev)platform_set_drvdata (pdev, dev);SET_NETDEV_DEV (dev, &pdev->dev); +pm_runtime_enable (priv->device); ret =register_c_can_dev (dev);if (ret) { dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
@@ -397,6 +399,7 @@ static int c_can_plat_probe(struct platform_device *pdev)return 0 ; exit_free_device: +pm_runtime_disable (priv->device);free_c_can_dev (dev); exit:dev_err (&pdev->dev,"probe failed\n" );
@@ -407,9 +410,10 @@ exit:static int c_can_plat_remove (struct platform_device *pdev) {struct net_device *dev =platform_get_drvdata (pdev); +struct c_can_priv *priv =netdev_priv (dev);unregister_c_can_dev (dev); - +pm_runtime_disable (priv->device);free_c_can_dev (dev);return 0 ;
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 52/53 net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit 50535249f624d0072cd885bcdce4e4b6fb770160 upstream.
struct sockaddr_qrtr has a 2-byte hole, and qrtr_recvmsg() currently does not clear it before copying kernel data to user space.
It might be too late to name the hole since sockaddr_qrtr structure is uapi.
BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 CPU: 0 PID: 29705 Comm: syz-executor.3 Not tainted 5.11.0-rc7-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 kmsan_internal_check_memory+0x202/0x520 mm/kmsan/kmsan.c:402 kmsan_copy_to_user+0x9c/0xb0 mm/kmsan/kmsan_hooks.c:249 instrument_copy_to_user include/linux/instrumented.h:121 [inline] _copy_to_user+0x1ac/0x270 lib/usercopy.c:33 copy_to_user include/linux/uaccess.h:209 [inline] move_addr_to_user+0x3a2/0x640 net/socket.c:237 ____sys_recvmsg+0x696/0xd50 net/socket.c:2575 ___sys_recvmsg net/socket.c:2610 [inline] do_recvmmsg+0xa97/0x22d0 net/socket.c:2710 __sys_recvmmsg net/socket.c:2789 [inline] __do_sys_recvmmsg net/socket.c:2812 [inline] __se_sys_recvmmsg+0x24a/0x410 net/socket.c:2805 __x64_sys_recvmmsg+0x62/0x80 net/socket.c:2805 do_syscall_64+0x9f/0x140 arch/x86/entry/common.c:48 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x465f69 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f43659d6188 EFLAGS: 00000246 ORIG_RAX: 000000000000012b RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465f69 RDX: 0000000000000008 RSI: 0000000020003e40 RDI: 0000000000000003 RBP: 00000000004bfa8f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000010060 R11: 0000000000000246 R12: 000000000056bf60 R13: 0000000000a9fb1f R14: 00007f43659d6300 R15: 0000000000022000
Local variable ----addr@____sys_recvmsg created at:
____sys_recvmsg+0x168/0xd50 net/socket.c:2550 ____sys_recvmsg+0x168/0xd50 net/socket.c:2550
Bytes 2-3 of 12 are uninitialized
Memory access of size 12 starts at ffff88817c627b40 Data copied to user address 0000000020000140
--- net/qrtr/qrtr.c | 5 +++++ 1 file changed, 5 insertions(+)
net/qrtr/qrtr.c +5 -0
@@ -728,6 +728,11 @@ static int qrtr_recvmsg(struct socket *s rc = copied;if (addr) { +/* There is an anonymous 2-byte hole after sq_family, +* make sure to clear it. +*/ +memset (addr,0 ,sizeof (*addr)); + addr->sq_family =AF_QIPCRTR ; addr->sq_node =le32_to_cpu (phdr->src_node_id); addr->sq_port =le32_to_cpu (phdr->src_port_id);
Greg Kroah-Hartman
maintainerPATCH 53/53 mac80211: fix double free in ibss_leave
In reply to Greg Kroah-HartmanFrom: Markus Theil <[email protected]>
commit 3bd801b14e0c5d29eeddc7336558beb3344efaa3 upstream.
Clear beacon ie pointer and ie length after free
in order to prevent double free.
==================================================================
BUG: KASAN: double-free or invalid-free \ in ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 CPU: 0 PID: 8472 Comm: syz-executor100 Not tainted 5.11.0-rc6-syzkaller #0 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355 ____kasan_slab_free+0xcc/0xe0 mm/kasan/common.c:341 kasan_slab_free include/linux/kasan.h:192 [inline] __cache_free mm/slab.c:3424 [inline] kfree+0xed/0x270 mm/slab.c:3760 ieee80211_ibss_leave+0x83/0xe0 net/mac80211/ibss.c:1876 rdev_leave_ibss net/wireless/rdev-ops.h:545 [inline] __cfg80211_leave_ibss+0x19a/0x4c0 net/wireless/ibss.c:212 __cfg80211_leave+0x327/0x430 net/wireless/core.c:1172 cfg80211_leave net/wireless/core.c:1221 [inline] cfg80211_netdev_notifier_call+0x9e8/0x12c0 net/wireless/core.c:1335 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2040 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline] call_netdevice_notifiers net/core/dev.c:2066 [inline] __dev_close_many+0xee/0x2e0 net/core/dev.c:1586 __dev_close net/core/dev.c:1624 [inline] __dev_change_flags+0x2cb/0x730 net/core/dev.c:8476 dev_change_flags+0x8a/0x160 net/core/dev.c:8549 dev_ifsioc+0x210/0xa70 net/core/dev_ioctl.c:265 dev_ioctl+0x1b1/0xc40 net/core/dev_ioctl.c:511 sock_do_ioctl+0x148/0x2d0 net/socket.c:1060 sock_ioctl+0x477/0x6a0 net/socket.c:1177 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:739 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9
--- net/mac80211/ibss.c | 2 ++ 1 file changed, 2 insertions(+)
net/mac80211/ibss.c +2 -0
@@ -1862,6 +1862,8 @@ int ieee80211_ibss_leave(struct ieee8021/* remove beacon */ kfree (sdata->u.ibss.ie); + sdata->u.ibss.ie =NULL ; + sdata->u.ibss.ie_len =0 ;/* on the next join, re-program HT parameters */ memset (&ifibss->ht_capa,0 ,sizeof (ifibss->ht_capa));
Greg Kroah-Hartman
maintainerPATCH 20/53 arm64: dts: ls1043a: mark crypto engine dma coherent
In reply to Greg Kroah-HartmanFrom: Horia Geantă <[email protected]>
commit 4fb3a074755b7737c4081cffe0ccfa08c2f2d29d upstream.
Crypto engine (CAAM) on LS1043A platform is configured HW-coherent, mark accordingly the DT node.
Lack of "dma-coherent" property for an IP that is configured HW-coherent can lead to problems, similar to what has been reported for LS1046A.
--- arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm64/boot/dts/freescale/fsl-ls1043a.dtsi +1 -0
@@ -177,6 +177,7 @@ ranges = <0x0 0x00 0x1700000 0x100000>; reg = <0x00 0x1700000 0x0 0x100000>; interrupts = <0 75 0x4>; + dma-coherent; sec_jr0: jr@10000 { compatible = "fsl,sec-v5.4-job-ring",
Greg Kroah-Hartman
maintainerPATCH 25/53 e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
In reply to Greg Kroah-HartmanFrom: Dinghao Liu <[email protected]>
[ Upstream commit b52912b8293f2c496f42583e65599aee606a0c18 ]
There is one e1e_wphy() call in e1000_set_d0_lplu_state_82571 that we have caught its return value but lack further handling. Check and terminate the execution flow just like other e1e_wphy() in this function.
--- drivers/net/ethernet/intel/e1000e/82571.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/net/ethernet/intel/e1000e/82571.c +2 -0
@@ -917,6 +917,8 @@ static s32 e1000_set_d0_lplu_state_82571(struct e1000_hw *hw, bool active) }else { data &= ~IGP02E1000_PM_D0_LPLU ; ret_val =e1e_wphy (hw,IGP02E1000_PHY_POWER_MGMT , data); +if (ret_val) +return ret_val;/* LPLU and SmartSpeed are mutually exclusive. LPLU is used * during Dx states where the power conservation is most * important. During driver activity we should enable
Signature · 1 line
2.30.1
Greg Kroah-Hartman
maintainerPATCH 29/53 can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
In reply to Greg Kroah-HartmanFrom: Torin Cooper-Bennun <[email protected]>
[ Upstream commit c0e399f3baf42279f48991554240af8c457535d1 ]
Message loss from RX FIFO 0 is already handled in m_can_handle_lost_msg(), with netdev output included.
Removing this warning also improves driver performance under heavy load, where m_can_do_rx_poll() may be called many times before this interrupt is cleared, causing this message to be output many times (thanks Mariusz Madej for this report).
--- drivers/net/can/m_can/m_can.c | 3 --- 1 file changed, 3 deletions(-)
drivers/net/can/m_can/m_can.c +0 -3
@@ -428,9 +428,6 @@ static int m_can_do_rx_poll(struct net_device *dev, int quota) }while ((rxfs &RXFS_FFL_MASK ) && (quota >0 )) { -if (rxfs &RXFS_RFL ) -netdev_warn (dev,"Rx FIFO 0 Message Lost\n" ); -m_can_read_fifo (dev, rxfs); quota--;
Signature · 1 line
2.30.1
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 10 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
and thanks to Ben's latest back ports, no longer seeing the do_futex warning that I was seeing, thanks a lot Ben!
Signature · 1 line
Florian
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
Build results:
total: 163 pass: 163 fail: 0 Qemu test results: total: 381 pass: 381 fail: 0
Guenter
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 10 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Summary
------------------------------------------------------------------------
kernel: 4.9.264-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.9.y
git commit: 3c2295cc6be320f7598a3ae9da3abc98230bd931
git describe: v4.9.263-54-g3c2295cc6be3
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-4.9.y/build/v4.9.263-54-g3c2295cc6be3
No regressions (compared to build v4.9.263)
No fixes (compared to build v4.9.263)
Ran 49047 total tests in the following environments and test suites.
Environments
--------------
- arm
- arm64
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-64k_page_size
- juno-r2 - arm64
- juno-r2-compat
- juno-r2-kasan
- mips
- qemu-arm-debug
- qemu-arm64-debug
- qemu-arm64-kasan
- qemu-i386-debug
- qemu-x86_64-debug
- qemu-x86_64-kasan
- qemu_arm
- qemu_arm64
- qemu_arm64-compat
- qemu_i386
- qemu_x86_64
- qemu_x86_64-compat
- sparc
- x15 - arm
- x86_64
- x86-kasan
- x86_64
Test Suites
-----------
* build
* linux-log-parser
* igt-gpu-tools
* install-android-platform-tools-r2600
* kselftest-android
* kselftest-bpf
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-filesystems
* kselftest-firmware
* kselftest-fpu
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-lkdtm
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sysctl
* kvm-unit-tests
* libhugetlbfs
* ltp-commands-tests
* ltp-containers-tests
* ltp-controllers-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-tracing-tests
* v4l2-compliance
* fwts
* kselftest-lib
* kselftest-membarrier
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-zram
* ltp-cap_bounds-tests
* ltp-cpuhotplug-tests
* ltp-crypto-tests
* network-basic-tests
* perf
* kselftest-kexec
* kselftest-sync
* kselftest-vm
* kselftest-x86
* ltp-open-posix-tests
* ssuite
Signature · 2 lines
Linaro LKFT https://lkft.linaro.org
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.9.264 release. There are 53 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 31 Mar 2021 07:55:56 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.264-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.9.y
and the diffstat can be found below.thanks,
greg k-h
All tests passing for Tegra ...
Test results for stable-v4.9:
8 builds: 8 pass, 0 fail
16 boots: 16 pass, 0 fail
32 tests: 32 pass, 0 failLinux version: 4.9.264-rc1-g3c2295cc6be3
Boards tested: tegra124-jetson-tk1, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04
Jon