5.10.71-rc1 review
Greg Kroah-Hartman
maintainercover 5.10.71-rc1 review
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.71-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 5.10.71-rc1
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: Fix oversized kvmalloc() calls
Eric Dumazet <[email protected]>
netfilter: conntrack: serialize hash resizes and cleanups
Haimin Zhang <[email protected]>
KVM: x86: Handle SRCU initialization failure during page track init
Yanfei Xu <[email protected]>
net: mdiobus: Fix memory leak in __mdiobus_register
Anirudh Rayabharam <[email protected]>
HID: usbhid: free raw_report buffers in usbhid_stop
Linus Torvalds <[email protected]>
mm: don't allow oversized kvmalloc() calls
Jozsef Kadlecsik <[email protected]>
netfilter: ipset: Fix oversized kvmalloc() calls
F.A.Sulaiman <[email protected]>
HID: betop: fix slab-out-of-bounds Write in betop_probe
Dan Carpenter <[email protected]>
crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
Dongliang Mu <[email protected]>
usb: hso: remove the bailout parameter
Shuming Fan <[email protected]>
ASoC: dapm: use component prefix when checking widget names
Eric Dumazet <[email protected]>
net: udp: annotate data race around udp_sk(sk)->corkflag
Andrej Shadura <[email protected]>
HID: u2fzero: ignore incomplete packets without data
yangerkun <[email protected]>
ext4: fix potential infinite loop in ext4_dx_readdir()
Theodore Ts'o <[email protected]>
ext4: add error checking to ext4_ext_replay_set_iblocks()
Jeffle Xu <[email protected]>
ext4: fix reserved space counter leakage
Hou Tao <[email protected]>
ext4: limit the number of blocks in one ADD_RANGE TLV
Ritesh Harjani <[email protected]>
ext4: fix loff_t overflow in ext4_max_bitmap_size()
Johan Hovold <[email protected]>
ipack: ipoctal: fix module reference leak
Johan Hovold <[email protected]>
ipack: ipoctal: fix missing allocation-failure check
Johan Hovold <[email protected]>
ipack: ipoctal: fix tty-registration error handling
Johan Hovold <[email protected]>
ipack: ipoctal: fix tty registration race
Johan Hovold <[email protected]>
ipack: ipoctal: fix stack information leak
Nirmoy Das <[email protected]>
debugfs: debugfs_create_file_size(): use IS_ERR to check for error
Chen Jingwen <[email protected]>
elf: don't use MAP_FIXED_NOREPLACE for elf interpreter mappings
Keith Busch <[email protected]>
nvme: add command id quirk for apple controllers
Vadim Pasternak <[email protected]>
hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller
Kan Liang <[email protected]>
perf/x86/intel: Update event constraints for ICX
Eric Dumazet <[email protected]>
af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
Vlad Buslov <[email protected]>
net: sched: flower: protect fl_walk() with rcu
Florian Fainelli <[email protected]>
net: phy: bcm7xxx: Fixed indirect MMD operations
Guangbin Huang <[email protected]>
net: hns3: fix always enable rx vlan filter problem after selftest
Peng Li <[email protected]>
net: hns3: reconstruct function hns3_self_test
Huazhong Tan <[email protected]>
net: hns3: fix prototype warning
Jian Shen <[email protected]>
net: hns3: fix show wrong state when add existing uc mac address
Jian Shen <[email protected]>
net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE
Yonglong Liu <[email protected]>
net: hns3: keep MAC pause mode when multiple TCs are enabled
Jian Shen <[email protected]>
net: hns3: do not allow call hns3_nic_net_open repeatedly
Feng Zhou <[email protected]>
ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
Rahul Lakkireddy <[email protected]>
scsi: csiostor: Add module softdep on cxgb4
Jens Axboe <[email protected]>
Revert "block, bfq: honor already-setup queue merges"
Arnd Bergmann <[email protected]>
net: ks8851: fix link error
Jiri Benc <[email protected]>
selftests, bpf: test_lwt_ip_encap: Really disable rp_filter
Jiri Benc <[email protected]>
selftests, bpf: Fix makefile dependencies on libbpf
Lorenz Bauer <[email protected]>
bpf: Exempt CAP_BPF from checks against bpf_jit_limit
Yixing Liu <[email protected]>
RDMA/hns: Fix inaccurate prints
Jacob Keller <[email protected]>
e100: fix buffer overrun in e100_get_regs
Jacob Keller <[email protected]>
e100: fix length calculation in e100_get_regs_len
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: Fix MTU definition
Andrew Lunn <[email protected]>
dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
Matthew Auld <[email protected]>
drm/i915/request: fix early tracepoints
Aaro Koskinen <[email protected]>
smsc95xx: fix stalled rx after link change
Xiao Liang <[email protected]>
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
Vladimir Oltean <[email protected]>
net: enetc: fix the incorrect clearing of IF_MODE bits
Paul Fertser <[email protected]>
hwmon: (tmp421) fix rounding for negative values
Paul Fertser <[email protected]>
hwmon: (tmp421) report /PVLD condition as fault
Florian Westphal <[email protected]>
mptcp: don't return sockets in foreign netns
Xin Long <[email protected]>
sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
Johannes Berg <[email protected]>
mac80211-hwsim: fix late beacon hrtimer handling
Johannes Berg <[email protected]>
mac80211: mesh: fix potentially unaligned access
Lorenzo Bianconi <[email protected]>
mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
Chih-Kang Chang <[email protected]>
mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
Vadim Pasternak <[email protected]>
hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
Piotr Krysiuk <[email protected]>
bpf, mips: Validate conditional branch offsets
Tao Liu <[email protected]>
RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
Christoph Lameter <[email protected]>
IB/cma: Do not send IGMP leaves for sendonly Multicast groups
Hou Tao <[email protected]>
bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
Andrea Claudi <[email protected]>
ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
Hawking Zhang <[email protected]>
drm/amdgpu: correct initial cp_hqd_quantum for gfx9
Charlene Liu <[email protected]>
drm/amd/display: Pass PCI deviceid into DC
Jason Gunthorpe <[email protected]>
RDMA/cma: Do not change route.addr.src_addr.ss_family
Sean Young <[email protected]>
media: ir_toy: prevent device from hanging during transmit
Sean Christopherson <[email protected]>
KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest
Vitaly Kuznetsov <[email protected]>
KVM: nVMX: Filter out all unsupported controls when eVMCS was activated
Maxim Levitsky <[email protected]>
KVM: x86: nSVM: don't copy virt_ext from vmcb12
Vitaly Kuznetsov <[email protected]>
KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
Zelin Deng <[email protected]>
x86/kvmclock: Move this_cpu_pvti into kvmclock.h
Johannes Berg <[email protected]>
mac80211: fix use-after-free in CCMP/GCMP RX
Jonathan Hsu <[email protected]>
scsi: ufs: Fix illegal offset in UPIU event trace
Andrey Gusakov <[email protected]>
gpio: pca953x: do not ignore i2c errors
Nadezda Lutovinova <[email protected]>
hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
Nadezda Lutovinova <[email protected]>
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
Nadezda Lutovinova <[email protected]>
hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
Paul Fertser <[email protected]>
hwmon: (tmp421) handle I2C errors
Eric Biggers <[email protected]>
fs-verity: fix signed integer overflow with i_size near S64_MAX
Jia He <[email protected]>
ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect
Cameron Berkenpas <[email protected]>
ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
Pawel Laszczak <[email protected]>
usb: cdns3: fix race condition before setting doorbell
James Morse <[email protected]>
cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
Saurav Kashyap <[email protected]>
scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
Kevin Hao <[email protected]>
cpufreq: schedutil: Use kobject release() method to free sugov_tunables
Igor Matheus Andrade Torrente <[email protected]>
tty: Fix out-of-bound vmalloc access in imageblit
-------------
Diffstat:
Makefile | 4 +- arch/mips/net/bpf_jit.c | 57 ++++++--- arch/x86/events/intel/core.c | 1 + arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/include/asm/kvmclock.h | 14 +++ arch/x86/kernel/kvmclock.c | 13 +-- arch/x86/kvm/ioapic.c | 10 +- arch/x86/kvm/mmu/page_track.c | 4 +- arch/x86/kvm/svm/nested.c | 1 - arch/x86/kvm/vmx/evmcs.c | 12 +- arch/x86/kvm/vmx/vmx.c | 9 +- arch/x86/kvm/x86.c | 7 +- arch/x86/net/bpf_jit_comp.c | 53 ++++++--- block/bfq-iosched.c | 16 +-- drivers/acpi/nfit/core.c | 12 ++ drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- drivers/crypto/ccp/ccp-ops.c | 14 ++- drivers/gpio/gpio-pca953x.c | 11 +- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + drivers/gpu/drm/i915/i915_request.c | 11 +- drivers/hid/hid-betopff.c | 13 ++- drivers/hid/hid-u2fzero.c | 4 +- drivers/hid/usbhid/hid-core.c | 13 ++- drivers/hwmon/mlxreg-fan.c | 12 +- drivers/hwmon/pmbus/mp2975.c | 2 +- drivers/hwmon/tmp421.c | 71 +++++++----- drivers/hwmon/w83791d.c | 29 ++--- drivers/hwmon/w83792d.c | 28 ++--- drivers/hwmon/w83793.c | 26 ++--- drivers/infiniband/core/cma.c | 28 ++++- drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 35 +++--- drivers/infiniband/hw/hns/hns_roce_hem.c | 18 +-- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 30 ++--- drivers/infiniband/hw/hns/hns_roce_mr.c | 10 +- drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 61 +++++----- drivers/infiniband/hw/hns/hns_roce_srq.c | 37 +++--- drivers/ipack/devices/ipoctal.c | 63 +++++++--- drivers/media/rc/ir_toy.c | 21 +++- drivers/net/dsa/mv88e6xxx/chip.c | 17 +-- drivers/net/dsa/mv88e6xxx/chip.h | 1 + drivers/net/dsa/mv88e6xxx/global1.c | 2 + drivers/net/dsa/mv88e6xxx/port.c | 2 + drivers/net/ethernet/freescale/enetc/enetc_pf.c | 3 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 + drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 105 +++++++++++------ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 7 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 19 ++- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 52 ++++----- drivers/net/ethernet/intel/e100.c | 22 ++-- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 +- drivers/net/ethernet/micrel/Makefile | 6 +- drivers/net/ethernet/micrel/ks8851_common.c | 8 ++ drivers/net/phy/bcm7xxx.c | 114 +++++++++++++++++- drivers/net/phy/mdio_bus.c | 1 + drivers/net/usb/hso.c | 6 +- drivers/net/usb/smsc95xx.c | 3 + drivers/net/wireless/mac80211_hwsim.c | 4 +- drivers/nvme/host/core.c | 4 +- drivers/nvme/host/nvme.h | 6 + drivers/nvme/host/pci.c | 3 +- drivers/scsi/csiostor/csio_init.c | 1 + drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_isr.c | 2 + drivers/scsi/qla2xxx/qla_nvme.c | 40 +++---- drivers/scsi/ufs/ufshcd.c | 3 +- drivers/tty/vt/vt.c | 21 +++- drivers/usb/cdns3/gadget.c | 14 +++ fs/binfmt_elf.c | 2 +- fs/debugfs/inode.c | 2 +- fs/ext4/dir.c | 6 +- fs/ext4/extents.c | 19 ++- fs/ext4/fast_commit.c | 6 + fs/ext4/inode.c | 5 + fs/ext4/super.c | 16 ++- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- include/linux/bpf.h | 2 + include/net/ip_fib.h | 2 +- include/net/nexthop.h | 2 +- include/net/sock.h | 2 + kernel/bpf/bpf_struct_ops.c | 7 +- kernel/bpf/core.c | 2 +- kernel/entry/kvm.c | 4 +- kernel/rseq.c | 13 ++- kernel/sched/cpufreq_schedutil.c | 16 ++- mm/util.c | 4 + net/core/sock.c | 32 ++++- net/ipv4/fib_semantics.c | 16 +-- net/ipv4/udp.c | 10 +- net/ipv6/route.c | 5 +- net/ipv6/udp.c | 2 +- net/mac80211/mesh_ps.c | 3 +- net/mac80211/tx.c | 12 ++ net/mac80211/wpa.c | 6 + net/mptcp/mptcp_diag.c | 2 +- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 2 +- net/mptcp/syncookies.c | 13 +-- net/mptcp/token.c | 11 +- net/mptcp/token_test.c | 14 ++- net/netfilter/ipset/ip_set_hash_gen.h | 4 +- net/netfilter/ipvs/ip_vs_conn.c | 4 + net/netfilter/nf_conntrack_core.c | 70 +++++------ net/netfilter/nf_tables_api.c | 2 +- net/sched/cls_flower.c | 6 + net/sctp/input.c | 2 +- net/unix/af_unix.c | 34 +++++- sound/pci/hda/patch_realtek.c | 129 +++++++++++++++++++++ sound/soc/soc-dapm.c | 13 ++- tools/testing/selftests/bpf/Makefile | 3 +- tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 13 ++- 115 files changed, 1205 insertions(+), 564 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/93 tty: Fix out-of-bound vmalloc access in imageblit
From: Igor Matheus Andrade Torrente <[email protected]>
[ Upstream commit 3b0c406124719b625b1aba431659f5cdc24a982c ]
This issue happens when a userspace program does an ioctl FBIOPUT_VSCREENINFO passing the fb_var_screeninfo struct containing only the fields xres, yres, and bits_per_pixel with values.
If this struct is the same as the previous ioctl, the vc_resize() detects it and doesn't call the resize_screen(), leaving the fb_var_screeninfo incomplete. And this leads to the updatescrollmode() calculates a wrong value to fbcon_display->vrows, which makes the real_y() return a wrong value of y, and that value, eventually, causes the imageblit to access an out-of-bound address value.
To solve this issue I made the resize_screen() be called even if the screen does not need any resizing, so it will "fix and fill" the fb_var_screeninfo independently.
--- drivers/tty/vt/vt.c | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-)
drivers/tty/vt/vt.c +19 -2
@@ -1220,8 +1220,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, new_row_size = new_cols <<1 ; new_screen_size = new_row_size * new_rows; -if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) -return 0 ; +if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { +/* +* This function is being called here to cover the case +* where the userspace calls the FBIOPUT_VSCREENINFO twice, +* passing the same fb_var_screeninfo containing the fields +* yres/xres equal to a number non-multiple of vc_font.height +* and yres_virtual/xres_virtual equal to number lesser than the +* vc_font.height and yres/xres. +* In the second call, the struct fb_var_screeninfo isn't +* being modified by the underlying driver because of the +* if above, and this causes the fbcon_display->vrows to become +* negative and it eventually leads to out-of-bound +* access by the imageblit function. +* To give the correct values to the struct and to not have +* to deal with possible errors from the code below, we call +* the resize_screen here as well. +*/ +return resize_screen (vc, new_cols, new_rows, user); + }if (new_screen_size >KMALLOC_MAX_SIZE || !new_screen_size)return -EINVAL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 2/93 cpufreq: schedutil: Use kobject release() method to free sugov_tunables
In reply to Greg Kroah-HartmanFrom: Kevin Hao <[email protected]>
[ Upstream commit e5c6b312ce3cc97e90ea159446e6bfa06645364d ]
The struct sugov_tunables is protected by the kobject, so we can't free
it directly. Otherwise we would get a call trace like this:
ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x30
WARNING: CPU: 3 PID: 720 at lib/debugobjects.c:505 debug_print_object+0xb8/0x100 Modules linked in: CPU: 3 PID: 720 Comm: a.sh Tainted: G W 5.14.0-rc1-next-20210715-yocto-standard+ #507 Hardware name: Marvell OcteonTX CN96XX board (DT) pstate: 40400009 (nZcv daif +PAN -UAO -TCO BTYPE=--) pc : debug_print_object+0xb8/0x100 lr : debug_print_object+0xb8/0x100 sp : ffff80001ecaf910 x29: ffff80001ecaf910 x28: ffff00011b10b8d0 x27: ffff800011043d80 x26: ffff00011a8f0000 x25: ffff800013cb3ff0 x24: 0000000000000000 x23: ffff80001142aa68 x22: ffff800011043d80 x21: ffff00010de46f20 x20: ffff800013c0c520 x19: ffff800011d8f5b0 x18: 0000000000000010 x17: 6e6968207473696c x16: 5f72656d6974203a x15: 6570797420746365 x14: 6a626f2029302065 x13: 303378302f307830 x12: 2b6e665f72656d69 x11: ffff8000124b1560 x10: ffff800012331520 x9 : ffff8000100ca6b0 x8 : 000000000017ffe8 x7 : c0000000fffeffff x6 : 0000000000000001 x5 : ffff800011d8c000 x4 : ffff800011d8c740 x3 : 0000000000000000 x2 : ffff0001108301c0 x1 : ab3c90eedf9c0f00 x0 : 0000000000000000 Call trace: debug_print_object+0xb8/0x100 __debug_check_no_obj_freed+0x1c0/0x230 debug_check_no_obj_freed+0x20/0x88 slab_free_freelist_hook+0x154/0x1c8 kfree+0x114/0x5d0 sugov_exit+0xbc/0xc0 cpufreq_exit_governor+0x44/0x90 cpufreq_set_policy+0x268/0x4a8 store_scaling_governor+0xe0/0x128 store+0xc0/0xf0 sysfs_kf_write+0x54/0x80 kernfs_fop_write_iter+0x128/0x1c0 new_sync_write+0xf0/0x190 vfs_write+0x2d4/0x478 ksys_write+0x74/0x100 __arm64_sys_write+0x24/0x30 invoke_syscall.constprop.0+0x54/0xe0 do_el0_svc+0x64/0x158 el0_svc+0x2c/0xb0 el0t_64_sync_handler+0xb0/0xb8 el0t_64_sync+0x198/0x19c irq event stamp: 5518 hardirqs last enabled at (5517): [<ffff8000100cbd7c>] console_unlock+0x554/0x6c8 hardirqs last disabled at (5518): [<ffff800010fc0638>] el1_dbg+0x28/0xa0 softirqs last enabled at (5504): [<ffff8000100106e0>] __do_softirq+0x4d0/0x6c0 softirqs last disabled at (5483): [<ffff800010049548>] irq_exit+0x1b0/0x1b8
So split the original sugov_tunables_free() into two functions, sugov_clear_global_tunables() is just used to clear the global_tunables and the new sugov_tunables_free() is used as kobj_type::release to release the sugov_tunables safely.
--- kernel/sched/cpufreq_schedutil.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-)
kernel/sched/cpufreq_schedutil.c +11 -5
@@ -610,9 +610,17 @@ static struct attribute *sugov_attrs[] = { };ATTRIBUTE_GROUPS (sugov); +static void sugov_tunables_free (struct kobject *kobj) +{ + struct gov_attr_set *attr_set = container_of(kobj, struct gov_attr_set, kobj); + +kfree (to_sugov_tunables (attr_set)); +} +static struct kobj_type sugov_tunables_ktype = { .default_groups = sugov_groups, .sysfs_ops = &governor_sysfs_ops, + .release = &sugov_tunables_free, };/********************** cpufreq governor interface *********************/
@@ -712,12 +720,10 @@ static struct sugov_tunables *sugov_tunables_alloc(struct sugov_policy *sg_policreturn tunables; } -static void sugov_tunables_free (struct sugov_tunables *tunables) +static void sugov_clear_global_tunables (void ) {if (!have_governor_per_policy ()) global_tunables =NULL ; - -kfree (tunables); }static int sugov_init (struct cpufreq_policy *policy)
@@ -780,7 +786,7 @@ out: fail:kobject_put (&tunables->attr_set.kobj); policy->governor_data =NULL ; -sugov_tunables_free (tunables); +sugov_clear_global_tunables (); stop_kthread:sugov_kthread_stop (sg_policy);
@@ -807,7 +813,7 @@ static void sugov_exit(struct cpufreq_policy *policy) count =gov_attr_set_put (&tunables->attr_set, &sg_policy->tunables_hook); policy->governor_data =NULL ;if (!count) -sugov_tunables_free (tunables); +sugov_clear_global_tunables ();mutex_unlock (&global_tunables_lock);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 3/93 scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS
In reply to Greg Kroah-HartmanFrom: Saurav Kashyap <[email protected]>
[ Upstream commit 4a0a542fe5e4273baf9228459ef3f75c29490cba ]
The MSI-X and MSI calls fails in kdump kernel. Because of this qla2xxx_create_qpair() fails leading to .create_queue callback failure. The fix is to return existing qpair instead of allocating new one and allocate a single hw queue.
[ 19.975838] qla2xxx [0000:d8:00.1]-00c7:11: MSI-X: Failed to enable support, giving up -- 16/-28. [ 19.984885] qla2xxx [0000:d8:00.1]-0037:11: Falling back-to MSI mode -- ret=-28. [ 19.992278] qla2xxx [0000:d8:00.1]-0039:11: Falling back-to INTa mode --
ret=-28.
..
..
..
[ 21.141518] qla2xxx [0000:d8:00.0]-2104:2: qla_nvme_alloc_queue: handle
00000000e7ee499d, idx =1, qsize 32
[ 21.151166] qla2xxx [0000:d8:00.0]-0181:2: FW/Driver is not multi-queue capable.
[ 21.158558] qla2xxx [0000:d8:00.0]-2122:2: Failed to allocate qpair
[ 21.164824] nvme nvme0: NVME-FC{0}: reset: Reconnect attempt failed (-22)
[ 21.171612] nvme nvme0: NVME-FC{0}: Reconnect attempt in 2 seconds--- drivers/scsi/qla2xxx/qla_def.h | 1 - drivers/scsi/qla2xxx/qla_isr.c | 2 ++ drivers/scsi/qla2xxx/qla_nvme.c | 40 +++++++++++++++------------------ 3 files changed, 20 insertions(+), 23 deletions(-)
drivers/scsi/qla2xxx/qla_def.h +0 -1
@@ -3913,7 +3913,6 @@ struct qla_hw_data { uint32_t scm_supported_f:1;/* Enabled in Driver */ uint32_t scm_enabled:1; - uint32_t max_req_queue_warned:1; uint32_t plogi_template_valid:1; } flags;
drivers/scsi/qla2xxx/qla_isr.c +2 -0
@@ -4158,6 +4158,8 @@ skip_msi:ql_dbg (ql_dbg_init, vha,0x0125 ,"INTa mode: Enabled.\n" ); ha->flags.mr_intr_valid =1 ; +/* Set max_qpair to 0, as MSI-X and MSI in not enabled */ + ha->max_qpairs =0 ; } clear_risc_ints:
drivers/scsi/qla2xxx/qla_nvme.c +18 -22
@@ -109,19 +109,24 @@ static int qla_nvme_alloc_queue(struct nvme_fc_local_port *lport,return -EINVAL ; } -if (ha->queue_pair_map[qidx]) { - *handle = ha->queue_pair_map[qidx]; -ql_log (ql_log_info, vha,0x2121 , -"Returning existing qpair of %p for idx=%x\n" , - *handle, qidx); -return 0 ; - } +/* Use base qpair if max_qpairs is 0 */ +if (!ha->max_qpairs) { + qpair = ha->base_qpair; + }else { +if (ha->queue_pair_map[qidx]) { + *handle = ha->queue_pair_map[qidx]; +ql_log (ql_log_info, vha,0x2121 , +"Returning existing qpair of %p for idx=%x\n" , + *handle, qidx); +return 0 ; + } - qpair =qla2xxx_create_qpair (vha,5 , vha->vp_idx, true); -if (qpair ==NULL ) { -ql_log (ql_log_warn, vha,0x2122 , -"Failed to allocate qpair\n" ); -return -EINVAL ; + qpair =qla2xxx_create_qpair (vha,5 , vha->vp_idx, true); +if (!qpair) { +ql_log (ql_log_warn, vha,0x2122 , +"Failed to allocate qpair\n" ); +return -EINVAL ; + } } *handle = qpair;
@@ -715,18 +720,9 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha)WARN_ON (vha->nvme_local_port); -if (ha->max_req_queues <3 ) { -if (!ha->flags.max_req_queue_warned) -ql_log (ql_log_info, vha,0x2120 , -"%s: Disabling FC-NVME due to lack of free queue pairs (%d).\n" , - __func__, ha->max_req_queues); - ha->flags.max_req_queue_warned =1 ; -return ret; - } - qla_nvme_fc_transport.max_hw_queues =min ((uint8_t )(qla_nvme_fc_transport.max_hw_queues), - (uint8_t )(ha->max_req_queues -2 )); + (uint8_t )(ha->max_qpairs ? ha->max_qpairs :1 )); pinfo.node_name =wwn_to_u64 (vha->node_name); pinfo.port_name =wwn_to_u64 (vha->port_name);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 4/93 cpufreq: schedutil: Destroy mutex before kobject_put() frees the memory
In reply to Greg Kroah-HartmanFrom: James Morse <[email protected]>
[ Upstream commit cdef1196608892b9a46caa5f2b64095a7f0be60c ]
Since commit e5c6b312ce3c ("cpufreq: schedutil: Use kobject release() method to free sugov_tunables") kobject_put() has kfree()d the attr_set before gov_attr_set_put() returns.
kobject_put() isn't the last user of attr_set in gov_attr_set_put(), the subsequent mutex_destroy() triggers a use-after-free:
| BUG: KASAN: use-after-free in mutex_is_locked+0x20/0x60 | Read of size 8 at addr ffff000800ca4250 by task cpuhp/2/20 | | CPU: 2 PID: 20 Comm: cpuhp/2 Not tainted 5.15.0-rc1 #12369 | Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development | Platform, BIOS EDK II Jul 30 2018 | Call trace: | dump_backtrace+0x0/0x380 | show_stack+0x1c/0x30 | dump_stack_lvl+0x8c/0xb8 | print_address_description.constprop.0+0x74/0x2b8 | kasan_report+0x1f4/0x210 | kasan_check_range+0xfc/0x1a4 | __kasan_check_read+0x38/0x60 | mutex_is_locked+0x20/0x60 | mutex_destroy+0x80/0x100 | gov_attr_set_put+0xfc/0x150 | sugov_exit+0x78/0x190 | cpufreq_offline.isra.0+0x2c0/0x660 | cpuhp_cpufreq_offline+0x14/0x24 | cpuhp_invoke_callback+0x430/0x6d0 | cpuhp_thread_fun+0x1b0/0x624 | smpboot_thread_fn+0x5e0/0xa6c | kthread+0x3a0/0x450 | ret_from_fork+0x10/0x20
Swap the order of the calls.
--- drivers/cpufreq/cpufreq_governor_attr_set.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/cpufreq/cpufreq_governor_attr_set.c +1 -1
@@ -74,8 +74,8 @@ unsigned int gov_attr_set_put(struct gov_attr_set *attr_set, struct list_head *lif (count)return count; -kobject_put (&attr_set->kobj);mutex_destroy (&attr_set->update_lock); +kobject_put (&attr_set->kobj);return 0 ; }EXPORT_SYMBOL_GPL (gov_attr_set_put);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 5/93 usb: cdns3: fix race condition before setting doorbell
In reply to Greg Kroah-HartmanFrom: Pawel Laszczak <[email protected]>
[ Upstream commit b69ec50b3e55c4b2a85c8bc46763eaf330605847 ]
For DEV_VER_V3 version there exist race condition between clearing ep_sts.EP_STS_TRBERR and setting ep_cmd.EP_CMD_DRDY bit. Setting EP_CMD_DRDY will be ignored by controller when EP_STS_TRBERR is set. So, between these two instructions we have a small time gap in which the EP_STSS_TRBERR can be set. In such case the transfer will not start after setting doorbell.
--- drivers/usb/cdns3/gadget.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
drivers/usb/cdns3/gadget.c +14 -0
@@ -1101,6 +1101,19 @@ static int cdns3_ep_run_stream_transfer(struct cdns3_endpoint *priv_ep,return 0 ; } +static void cdns3_rearm_drdy_if_needed (struct cdns3_endpoint *priv_ep) +{ +struct cdns3_device *priv_dev = priv_ep->cdns3_dev; + +if (priv_dev->dev_ver <DEV_VER_V3 ) +return ; + +if (readl (&priv_dev->regs->ep_sts) &EP_STS_TRBERR ) { +writel (EP_STS_TRBERR , &priv_dev->regs->ep_sts); +writel (EP_CMD_DRDY , &priv_dev->regs->ep_cmd); + } +} +/** * cdns3_ep_run_transfer - start transfer on no-default endpoint hardware * @priv_ep: endpoint object
@@ -1352,6 +1365,7 @@ static int cdns3_ep_run_transfer(struct cdns3_endpoint *priv_ep,/*clearing TRBERR and EP_STS_DESCMIS before seting DRDY*/ writel (EP_STS_TRBERR |EP_STS_DESCMIS , &priv_dev->regs->ep_sts);writel (EP_CMD_DRDY , &priv_dev->regs->ep_cmd); +cdns3_rearm_drdy_if_needed (priv_ep);trace_cdns3_doorbell_epx (priv_ep->name,readl (&priv_dev->regs->ep_traddr)); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 6/93 ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops.
In reply to Greg Kroah-HartmanFrom: Cameron Berkenpas <[email protected]>
commit ad7cc2d41b7a8d0c5c5ecff37c3de7a4e137b3a6 upstream.
This patch initializes and enables speaker output on the Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 series of laptops using the HDA verb sequence specific to each model.
Speaker automute is suppressed for the Lenovo Legion 7i 15IMHG05 to avoid breaking speaker output on resume and when devices are unplugged from its headphone jack.
Thanks to: Andreas Holzer, Vincent Morel, sycxyc, Max Christian Pohle and all others that helped.
[ minor coding style fixes by tiwai ]
--- sound/pci/hda/patch_realtek.c | 129 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 129 insertions(+)
sound/pci/hda/patch_realtek.c +129 -0
@@ -6375,6 +6375,20 @@ static void alc_fixup_thinkpad_acpi(struhda_fixup_thinkpad_acpi (codec, fix, action); } +/* Fixup for Lenovo Legion 15IMHg05 speaker output on headset removal. */ +static void alc287_fixup_legion_15imhg05_speakers (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +struct alc_spec *spec = codec->spec; + +switch (action) { +case HDA_FIXUP_ACT_PRE_PROBE : + spec->gen.suppress_auto_mute =1 ; +break ; + } +} +/* for alc295_fixup_hp_top_speakers */ #include "hp_x360_helper.c"
@@ -6591,6 +6605,10 @@ enum {ALC623_FIXUP_LENOVO_THINKSTATION_P340 ,ALC255_FIXUP_ACER_HEADPHONE_AND_MIC ,ALC236_FIXUP_HP_LIMIT_INT_MIC_BOOST , +ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS , +ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE , +ALC287_FIXUP_YOGA7_14ITL_SPEAKERS , +ALC287_FIXUP_13S_GEN2_SPEAKERS }; static const struct hda_fixup alc269_fixups[] = {
@@ -8175,6 +8193,113 @@ static const struct hda_fixup alc269_fix .chained = true, .chain_id = ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF, }, + [ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, +//.v.verbs = legion_15imhg05_coefs, + .v.verbs = (const struct hda_verb []) { +// set left speaker Legion 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x1a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + +// set right speaker Legion 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x42 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE, + }, + [ALC287_FIXUP_LEGION_15IMHG05_AUTOMUTE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc287_fixup_legion_15imhg05_speakers, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, + [ALC287_FIXUP_YOGA7_14ITL_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { +// set left speaker Yoga 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x1a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + +// set right speaker Yoga 7i. + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x46 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xc }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2a }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, + [ALC287_FIXUP_13S_GEN2_SPEAKERS] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb []) { + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x41 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x24 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x42 }, + {0x20 ,AC_VERB_SET_COEF_INDEX ,0x26 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x2 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0x0 }, + {0x20 ,AC_VERB_SET_PROC_COEF ,0xb020 }, + {} + }, + .chained = true, + .chain_id = ALC269_FIXUP_HEADSET_MODE, + }, };static const struct snd_pci_quirk alc269_fixup_tbl[] = {
@@ -8567,6 +8692,10 @@ static const struct snd_pci_quirk alc269SND_PCI_QUIRK (0x17aa ,0x3818 ,"Lenovo C940" ,ALC298_FIXUP_LENOVO_SPK_VOLUME ),SND_PCI_QUIRK (0x17aa ,0x3827 ,"Ideapad S740" ,ALC285_FIXUP_IDEAPAD_S740_COEF ),SND_PCI_QUIRK (0x17aa ,0x3843 ,"Yoga 9i" ,ALC287_FIXUP_IDEAPAD_BASS_SPK_AMP ), +SND_PCI_QUIRK (0x17aa ,0x3813 ,"Legion 7i 15IMHG05" ,ALC287_FIXUP_LEGION_15IMHG05_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3852 ,"Lenovo Yoga 7 14ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3853 ,"Lenovo Yoga 7 15ITL5" ,ALC287_FIXUP_YOGA7_14ITL_SPEAKERS ), +SND_PCI_QUIRK (0x17aa ,0x3819 ,"Lenovo 13s Gen2 ITL" ,ALC287_FIXUP_13S_GEN2_SPEAKERS ),SND_PCI_QUIRK (0x17aa ,0x3902 ,"Lenovo E50-80" ,ALC269_FIXUP_DMIC_THINKPAD_ACPI ),SND_PCI_QUIRK (0x17aa ,0x3977 ,"IdeaPad S210" ,ALC283_FIXUP_INT_MIC ), SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo B50-70", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
Greg Kroah-Hartman
maintainerPATCH 7/93 ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect
In reply to Greg Kroah-HartmanFrom: Jia He <[email protected]>
commit f060db99374e80e853ac4916b49f0a903f65e9dc upstream.
When ACPI NFIT table is failing to populate correct numa information on arm64, dax_kmem will get NUMA_NO_NODE from the NFIT driver.
Without this patch, pmem can't be probed as RAM devices on arm64 guest:
$ndctl create-namespace -fe namespace0.0 --mode=devdax --map=dev -s 1g -a 128M kmem dax0.0: rejecting DAX region [mem 0x240400000-0x2bfffffff] with invalid node: -1
kmem: probe of dax0.0 failed with error -22
--- drivers/acpi/nfit/core.c | 12 ++++++++++++ 1 file changed, 12 insertions(+)
drivers/acpi/nfit/core.c +12 -0
@@ -3018,6 +3018,18 @@ static int acpi_nfit_register_region(str ndr_desc->target_node =NUMA_NO_NODE ; } +/* Fallback to address based numa information if node lookup failed */ +if (ndr_desc->numa_node ==NUMA_NO_NODE ) { + ndr_desc->numa_node =memory_add_physaddr_to_nid (spa->address); +dev_info (acpi_desc->dev,"changing numa node from %d to %d for nfit region [%pa-%pa]" , +NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); + } +if (ndr_desc->target_node ==NUMA_NO_NODE ) { + ndr_desc->target_node =phys_to_target_node (spa->address); +dev_info (acpi_desc->dev,"changing target node from %d to %d for nfit region [%pa-%pa]" , +NUMA_NO_NODE , ndr_desc->numa_node, &res.start, &res.end); + } +/* * Persistence domain bits are hierarchical, if * ACPI_NFIT_CAPABILITY_CACHE_FLUSH is set then
Greg Kroah-Hartman
maintainerPATCH 8/93 fs-verity: fix signed integer overflow with i_size near S64_MAX
In reply to Greg Kroah-HartmanFrom: Eric Biggers <[email protected]>
commit 80f6e3080bfcf865062a926817b3ca6c4a137a57 upstream.
If the file size is almost S64_MAX, the calculated number of Merkle tree levels exceeds FS_VERITY_MAX_LEVELS, causing FS_IOC_ENABLE_VERITY to fail. This is unintentional, since as the comment above the definition of FS_VERITY_MAX_LEVELS states, it is enough for over U64_MAX bytes of data using SHA-256 and 4K blocks. (Specifically, 4096*128**8 >= 2**64.)
The bug is actually that when the number of blocks in the first level is calculated from i_size, there is a signed integer overflow due to i_size being signed. Fix this by treating i_size as unsigned.
This was found by the new test "generic: test fs-verity EFBIG scenarios"
(https://lkml.kernel.org/r/b1d116cd4d0ea74b9cd86f349c672021e005a75c.1631558495.git.boris@bur.io).
This didn't affect ext4 or f2fs since those have a smaller maximum file size, but it did affect btrfs which allows files up to S64_MAX bytes.
--- fs/verity/enable.c | 2 +- fs/verity/open.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
fs/verity/enable.c +1 -1
@@ -177,7 +177,7 @@ static int build_merkle_tree(struct file* (level 0) and ascending to the root node (level 'num_levels - 1'). * Then at the end (level 'num_levels'), calculate the root hash. */ - blocks = (inode->i_size + params->block_size -1 ) >> + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> params->log_blocksize;for (level =0 ; level <= params->num_levels; level++) { err = build_merkle_tree_level(filp, level, blocks, params,
fs/verity/open.c +1 -1
@@ -89,7 +89,7 @@ int fsverity_init_merkle_tree_params(str*/ /* Compute number of levels and the number of blocks in each level */ - blocks = (inode->i_size + params->block_size -1 ) >> log_blocksize; + blocks = ((u64 )inode->i_size + params->block_size -1 ) >> log_blocksize;pr_debug ("Data is %lld bytes (%llu blocks)\n" , inode->i_size, blocks);while (blocks >1 ) {if (params->num_levels >=FS_VERITY_MAX_LEVELS ) {
Greg Kroah-Hartman
maintainerPATCH 9/93 hwmon: (tmp421) handle I2C errors
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
commit 2938b2978a70d4cc10777ee71c9e512ffe4e0f4b upstream.
Function i2c_smbus_read_byte_data() can return a negative error number instead of the data read if I2C transaction failed for whatever reason.
Lack of error checking can lead to serious issues on production hardware, e.g. errors treated as temperatures produce spurious critical temperature-crossed-threshold errors in BMC logs for OCP server hardware. The patch was tested with Mellanox OCP Mezzanine card emulating TMP421 protocol for temperature sensing which sometimes leads to I2C protocol error during early boot up stage.
--- drivers/hwmon/tmp421.c | 38 ++++++++++++++++++++++++++++---------- 1 file changed, 28 insertions(+), 10 deletions(-)
drivers/hwmon/tmp421.c +28 -10
@@ -119,38 +119,56 @@ static int temp_from_u16(u16 reg)return (temp *1000 +128 ) /256 ; } -static struct tmp421_data *tmp421_update_device (struct device *dev) +static int tmp421_update_device (struct tmp421_data *data) { -struct tmp421_data *data =dev_get_drvdata (dev);struct i2c_client *client = data->client; +int ret =0 ;int i;mutex_lock (&data->update_lock);if (time_after (jiffies, data->last_updated + (HZ /2 )) || !data->valid) { - data->config =i2c_smbus_read_byte_data (client, -TMP421_CONFIG_REG_1 ); + ret =i2c_smbus_read_byte_data (client,TMP421_CONFIG_REG_1 ); +if (ret <0 ) + goto exit; + data->config = ret;for (i =0 ; i < data->channels; i++) { - data->temp[i] =i2c_smbus_read_byte_data (client, -TMP421_TEMP_MSB [i]) <<8 ; - data->temp[i] |=i2c_smbus_read_byte_data (client, -TMP421_TEMP_LSB [i]); + ret =i2c_smbus_read_byte_data (client,TMP421_TEMP_MSB [i]); +if (ret <0 ) + goto exit; + data->temp[i] = ret <<8 ; + + ret =i2c_smbus_read_byte_data (client,TMP421_TEMP_LSB [i]); +if (ret <0 ) + goto exit; + data->temp[i] |= ret; } data->last_updated = jiffies; data->valid =1 ; } +exit:mutex_unlock (&data->update_lock); -return data; +if (ret <0 ) { + data->valid =0 ; +return ret; + } + +return 0 ; }static int tmp421_read (struct device *dev,enum hwmon_sensor_types type,u32 attr,int channel,long *val) { -struct tmp421_data *tmp421 =tmp421_update_device (dev); +struct tmp421_data *tmp421 =dev_get_drvdata (dev); +int ret =0 ; + + ret =tmp421_update_device (tmp421); +if (ret) +return ret;switch (attr) {case hwmon_temp_input:
Greg Kroah-Hartman
maintainerPATCH 10/93 hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit dd4d747ef05addab887dc8ff0d6ab9860bbcd783 upstream.
If driver read tmp value sufficient for
(tmp & 0x08) && (!(tmp & 0x80)) && ((tmp & 0x7) == ((tmp >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83793.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-)
drivers/hwmon/w83793.c +11 -15
@@ -202,7 +202,6 @@ static inline s8 TEMP_TO_REG(long val, s }struct w83793_data { -struct i2c_client *lm75[2 ];struct device *hwmon_dev;struct mutex update_lock;char valid;/* !=0 if following fields are valid */
@@ -1566,7 +1565,6 @@ w83793_detect_subclients(struct i2c_clieint address = client->addr;u8 tmp;struct i2c_adapter *adapter = client->adapter; -struct w83793_data *data =i2c_get_clientdata (client); id =i2c_adapter_id (adapter);if (force_subclients[0 ] == id && force_subclients[1 ] == address) {
@@ -1586,21 +1584,19 @@ w83793_detect_subclients(struct i2c_clie } tmp =w83793_read_value (client,W83793_REG_I2C_SUBADDR ); -if (!(tmp &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + (tmp &0x7 )); -if (!(tmp &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) - && ((tmp &0x7 ) == ((tmp >>4 ) &0x7 ))) { -dev_err (&client->dev, -"duplicate addresses 0x%x, " -"use force_subclients\n" , data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + ((tmp >>4 ) &0x7 )); + +if (!(tmp &0x88 ) && (tmp &0x7 ) == ((tmp >>4 ) &0x7 )) { +dev_err (&client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (tmp &0x7 )); +return -ENODEV ; } +if (!(tmp &0x08 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + (tmp &0x7 )); + +if (!(tmp &0x80 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + ((tmp >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 11/93 hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit 0f36b88173f028e372668ae040ab1a496834d278 upstream.
If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83792d.c | 28 +++++++++++----------------- 1 file changed, 11 insertions(+), 17 deletions(-)
drivers/hwmon/w83792d.c +11 -17
@@ -264,9 +264,6 @@ struct w83792d_data {char valid;/* !=0 if following fields are valid */ unsigned long last_updated;/* In jiffies */ -/* array of 2 pointers to subclients */ -struct i2c_client *lm75[2 ]; -u8 in[9 ];/* Register value */ u8 in_max[9 ];/* Register value */ u8 in_min[9 ];/* Register value */
@@ -927,7 +924,6 @@ w83792d_detect_subclients(struct i2c_cliint address = new_client->addr;u8 val;struct i2c_adapter *adapter = new_client->adapter; -struct w83792d_data *data =i2c_get_clientdata (new_client); id =i2c_adapter_id (adapter);if (force_subclients[0 ] == id && force_subclients[1 ] == address) {
@@ -946,21 +942,19 @@ w83792d_detect_subclients(struct i2c_cli } val =w83792d_read_value (new_client,W83792D_REG_I2C_SUBADDR ); -if (!(val &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&new_client->dev, adapter, -0x48 + (val &0x7 )); -if (!(val &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) && - ((val &0x7 ) == ((val >>4 ) &0x7 ))) { -dev_err (&new_client->dev, -"duplicate addresses 0x%x, use force_subclient\n" , - data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&new_client->dev, adapter, -0x48 + ((val >>4 ) &0x7 )); + +if (!(val &0x88 ) && (val &0x7 ) == ((val >>4 ) &0x7 )) { +dev_err (&new_client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (val &0x7 )); +return -ENODEV ; } +if (!(val &0x08 )) +devm_i2c_new_dummy_device (&new_client->dev, adapter,0x48 + (val &0x7 )); + +if (!(val &0x80 )) +devm_i2c_new_dummy_device (&new_client->dev, adapter,0x48 + ((val >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 12/93 hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field
In reply to Greg Kroah-HartmanFrom: Nadezda Lutovinova <[email protected]>
commit 943c15ac1b84d378da26bba41c83c67e16499ac4 upstream.
If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7)) from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers) Also lm75[] does not serve a purpose anymore after switching to devm_i2c_new_dummy_device() in w83791d_detect_subclients().
The patch fixes possible NULL pointer dereference by removing lm75[].
Found by Linux Driver Verification project (linuxtesting.org).
--- drivers/hwmon/w83791d.c | 29 +++++++++++------------------ 1 file changed, 11 insertions(+), 18 deletions(-)
drivers/hwmon/w83791d.c +11 -18
@@ -273,9 +273,6 @@ struct w83791d_data {char valid;/* !=0 if following fields are valid */ unsigned long last_updated;/* In jiffies */ -/* array of 2 pointers to subclients */ -struct i2c_client *lm75[2 ]; -/* volts */ u8 in[NUMBER_OF_VIN ];/* Register value */ u8 in_max[NUMBER_OF_VIN ];/* Register value */
@@ -1257,7 +1254,6 @@ static const struct attribute_group w837static int w83791d_detect_subclients (struct i2c_client *client) {struct i2c_adapter *adapter = client->adapter; -struct w83791d_data *data =i2c_get_clientdata (client);int address = client->addr;int i, id;u8 val;
@@ -1280,22 +1276,19 @@ static int w83791d_detect_subclients(str } val =w83791d_read (client,W83791D_REG_I2C_SUBADDR ); -if (!(val &0x08 )) - data->lm75[0 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + (val &0x7 )); -if (!(val &0x80 )) { -if (!IS_ERR (data->lm75[0 ]) && - ((val &0x7 ) == ((val >>4 ) &0x7 ))) { -dev_err (&client->dev, -"duplicate addresses 0x%x, " -"use force_subclient\n" , - data->lm75[0 ]->addr); -return -ENODEV ; - } - data->lm75[1 ] =devm_i2c_new_dummy_device (&client->dev, adapter, -0x48 + ((val >>4 ) &0x7 )); + +if (!(val &0x88 ) && (val &0x7 ) == ((val >>4 ) &0x7 )) { +dev_err (&client->dev, +"duplicate addresses 0x%x, use force_subclient\n" ,0x48 + (val &0x7 )); +return -ENODEV ; } +if (!(val &0x08 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + (val &0x7 )); + +if (!(val &0x80 )) +devm_i2c_new_dummy_device (&client->dev, adapter,0x48 + ((val >>4 ) &0x7 )); +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 13/93 gpio: pca953x: do not ignore i2c errors
In reply to Greg Kroah-HartmanFrom: Andrey Gusakov <[email protected]>
commit 540cffbab8b8e6c52a4121666ca18d6e94586ed2 upstream.
Per gpio_chip interface, error shall be proparated to the caller.
Attempt to silent diagnostics by returning zero (as written in the comment) is plain wrong, because the zero return can be interpreted by the caller as the gpio value.
--- drivers/gpio/gpio-pca953x.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpio/gpio-pca953x.c +2 -9
@@ -467,15 +467,8 @@ static int pca953x_gpio_get_value(structmutex_lock (&chip->i2c_lock); ret =regmap_read (chip->regmap, inreg, ®_val);mutex_unlock (&chip->i2c_lock); -if (ret <0 ) { -/* -* NOTE: -* diagnostic already emitted; that's all we should -* do unless gpio_*_value_cansleep() calls become different -* from their nonsleeping siblings (and report faults). -*/ -return 0 ; - } +if (ret <0 ) +return ret;return !!(reg_val & bit); }
Greg Kroah-Hartman
maintainerPATCH 14/93 scsi: ufs: Fix illegal offset in UPIU event trace
In reply to Greg Kroah-HartmanFrom: Jonathan Hsu <[email protected]>
commit e8c2da7e329ce004fee748b921e4c765dc2fa338 upstream.
Fix incorrect index for UTMRD reference in ufshcd_add_tm_upiu_trace().
--- drivers/scsi/ufs/ufshcd.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd.c +1 -2
@@ -318,8 +318,7 @@ static void ufshcd_add_query_upiu_trace(static void ufshcd_add_tm_upiu_trace (struct ufs_hba *hba,unsigned int tag,const char *str) { -int off = (int )tag - hba->nutrs; -struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[off]; +struct utp_task_req_desc *descp = &hba->utmrdl_base_addr[tag];trace_ufshcd_upiu (dev_name (hba->dev), str, &descp->req_header, &descp->input_param1);
Greg Kroah-Hartman
maintainerPATCH 15/93 mac80211: fix use-after-free in CCMP/GCMP RX
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
commit 94513069eb549737bcfc3d988d6ed4da948a2de8 upstream.
When PN checking is done in mac80211, for fragmentation we need to copy the PN to the RX struct so we can later use it to do a comparison, since commit bf30ca922a0c ("mac80211: check defrag PN against current frame").
Unfortunately, in that commit I used the 'hdr' variable without it being necessarily valid, so use-after-free could occur if it was necessary to reallocate (parts of) the frame.
Fix this by reloading the variable after the code that results in the reallocations, if any.
This fixes https://bugzilla.kernel.org/show_bug.cgi?id=214401.
--- net/mac80211/wpa.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/mac80211/wpa.c +6 -0
@@ -520,6 +520,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieereturn RX_DROP_UNUSABLE ; } +/* reload hdr - skb might have been reallocated */ + hdr = (void *)rx->skb->data; + data_len = skb->len - hdrlen -IEEE80211_CCMP_HDR_LEN - mic_len;if (!rx->sta || data_len <0 )return RX_DROP_UNUSABLE ;
@@ -749,6 +752,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieereturn RX_DROP_UNUSABLE ; } +/* reload hdr - skb might have been reallocated */ + hdr = (void *)rx->skb->data; + data_len = skb->len - hdrlen -IEEE80211_GCMP_HDR_LEN - mic_len;if (!rx->sta || data_len <0 )return RX_DROP_UNUSABLE ;
Greg Kroah-Hartman
maintainerPATCH 16/93 x86/kvmclock: Move this_cpu_pvti into kvmclock.h
In reply to Greg Kroah-HartmanFrom: Zelin Deng <[email protected]>
commit ad9af930680bb396c87582edc172b3a7cf2a3fbf upstream.
There're other modules might use hv_clock_per_cpu variable like ptp_kvm, so move it into kvmclock.h and export the symbol to make it visiable to other modules.
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvmclock.h | 14 ++++++++++++++ arch/x86/kernel/kvmclock.c | 13 ++----------- 2 files changed, 16 insertions(+), 11 deletions(-)
arch/x86/include/asm/kvmclock.h +14 -0
@@ -2,6 +2,20 @@#ifndef _ASM_X86_KVM_CLOCK_H#define _ASM_X86_KVM_CLOCK_H +#include <linux/percpu.h> +extern struct clocksource kvm_clock; +DECLARE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); + +static inline struct pvclock_vcpu_time_info *this_cpu_pvti (void ) +{ +return &this_cpu_read (hv_clock_per_cpu)->pvti; +} + +static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock (void ) +{ +return this_cpu_read (hv_clock_per_cpu); +} +#endif /* _ASM_X86_KVM_CLOCK_H */
arch/x86/kernel/kvmclock.c +2 -11
@@ -50,18 +50,9 @@ early_param("no-kvmclock-vsyscall", parsstatic struct pvclock_vsyscall_time_info hv_clock_boot[HVC_BOOT_ARRAY_SIZE] __bss_decrypted __aligned(PAGE_SIZE); static struct pvclock_wall_clock wall_clock __bss_decrypted; -static DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu);static struct pvclock_vsyscall_time_info *hvclock_mem; - -static inline struct pvclock_vcpu_time_info *this_cpu_pvti (void ) -{ -return &this_cpu_read (hv_clock_per_cpu)->pvti; -} - -static inline struct pvclock_vsyscall_time_info *this_cpu_hvclock (void ) -{ -return this_cpu_read (hv_clock_per_cpu); -} +DEFINE_PER_CPU(struct pvclock_vsyscall_time_info *, hv_clock_per_cpu); +EXPORT_PER_CPU_SYMBOL_GPL (hv_clock_per_cpu);/* * The wallclock is the time of day when we booted. Since then, some time may
Greg Kroah-Hartman
maintainerPATCH 17/93 KVM: x86: Fix stack-out-of-bounds memory access from ioapic_write_indirect()
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 2f9b68f57c6278c322793a06063181deded0ad69 upstream.
KASAN reports the following issue:
BUG: KASAN: stack-out-of-bounds in kvm_make_vcpus_request_mask+0x174/0x440 [kvm] Read of size 8 at addr ffffc9001364f638 by task qemu-kvm/4798 CPU: 0 PID: 4798 Comm: qemu-kvm Tainted: G X --------- --- Hardware name: AMD Corporation DAYTONA_X/DAYTONA_X, BIOS RYM0081C 07/13/2020 Call Trace: dump_stack+0xa5/0xe6 print_address_description.constprop.0+0x18/0x130 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] __kasan_report.cold+0x7f/0x114 ? kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kasan_report+0x38/0x50 kasan_check_range+0xf5/0x1d0 kvm_make_vcpus_request_mask+0x174/0x440 [kvm] kvm_make_scan_ioapic_request_mask+0x84/0xc0 [kvm] ? kvm_arch_exit+0x110/0x110 [kvm] ? sched_clock+0x5/0x10 ioapic_write_indirect+0x59f/0x9e0 [kvm] ? static_obj+0xc0/0xc0 ? __lock_acquired+0x1d2/0x8c0 ? kvm_ioapic_eoi_inject_work+0x120/0x120 [kvm]
The problem appears to be that 'vcpu_bitmap' is allocated as a single long on stack and it should really be KVM_MAX_VCPUS long. We also seem to clear the lower 16 bits of it with bitmap_zero() for no particular reason (my guess would be that 'bitmap' and 'vcpu_bitmap' variables in kvm_bitmap_or_dest_vcpus() caused the confusion: while the later is indeed 16-bit long, the later should accommodate all possible vCPUs).
Message-Id: <[email protected]>
--- arch/x86/kvm/ioapic.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
arch/x86/kvm/ioapic.c +5 -5
@@ -319,8 +319,8 @@ static void ioapic_write_indirect(structunsigned index;bool mask_before, mask_after;union kvm_ioapic_redirect_entry *e; -unsigned long vcpu_bitmap;int old_remote_irr, old_delivery_status, old_dest_id, old_dest_mode; +DECLARE_BITMAP (vcpu_bitmap,KVM_MAX_VCPUS );switch (ioapic->ioregsel) {case IOAPIC_REG_VERSION :
@@ -384,9 +384,9 @@ static void ioapic_write_indirect(struct irq.shorthand =APIC_DEST_NOSHORT ; irq.dest_id = e->fields.dest_id; irq.msi_redir_hint = false; -bitmap_zero (&vcpu_bitmap,16 ); +bitmap_zero (vcpu_bitmap,KVM_MAX_VCPUS );kvm_bitmap_or_dest_vcpus (ioapic->kvm, &irq, - &vcpu_bitmap); + vcpu_bitmap);if (old_dest_mode != e->fields.dest_mode || old_dest_id != e->fields.dest_id) {/*
@@ -399,10 +399,10 @@ static void ioapic_write_indirect(structkvm_lapic_irq_dest_mode ( !!e->fields.dest_mode);kvm_bitmap_or_dest_vcpus (ioapic->kvm, &irq, - &vcpu_bitmap); + vcpu_bitmap); }kvm_make_scan_ioapic_request_mask (ioapic->kvm, - &vcpu_bitmap); + vcpu_bitmap); }else {kvm_make_scan_ioapic_request (ioapic->kvm); }
Greg Kroah-Hartman
maintainerPATCH 18/93 KVM: x86: nSVM: dont copy virt_ext from vmcb12
In reply to Greg Kroah-HartmanFrom: Maxim Levitsky <[email protected]>
commit faf6b755629627f19feafa75b32e81cd7738f12d upstream.
These field correspond to features that we don't expose yet to L2
While currently there are no CVE worthy features in this field, if AMD adds more features to this field, that could allow guest escapes similar to CVE-2021-3653 and CVE-2021-3656.
Message-Id: <[email protected]>
--- arch/x86/kvm/svm/nested.c | 1 - 1 file changed, 1 deletion(-)
arch/x86/kvm/svm/nested.c +0 -1
@@ -447,7 +447,6 @@ static void nested_prepare_vmcb_control( (svm->nested.ctl.int_ctl & int_ctl_vmcb12_bits) | (svm->nested.hsave->control.int_ctl & int_ctl_vmcb01_bits); - svm->vmcb->control.virt_ext = svm->nested.ctl.virt_ext; svm->vmcb->control.int_vector = svm->nested.ctl.int_vector; svm->vmcb->control.int_state = svm->nested.ctl.int_state; svm->vmcb->control.event_inj = svm->nested.ctl.event_inj;
Greg Kroah-Hartman
maintainerPATCH 19/93 KVM: nVMX: Filter out all unsupported controls when eVMCS was activated
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 8d68bad6d869fae8f4d50ab6423538dec7da72d1 upstream.
Windows Server 2022 with Hyper-V role enabled failed to boot on KVM when enlightened VMCS is advertised. Debugging revealed there are two exposed secondary controls it is not happy with: SECONDARY_EXEC_ENABLE_VMFUNC and SECONDARY_EXEC_SHADOW_VMCS. These controls are known to be unsupported, as there are no corresponding fields in eVMCSv1 (see the comment above EVMCS1_UNSUPPORTED_2NDEXEC definition).
Previously, commit 31de3d2500e4 ("x86/kvm/hyper-v: move VMX controls sanitization out of nested_enable_evmcs()") introduced the required filtering mechanism for VMX MSRs but for some reason put only known to be problematic (and not full EVMCS1_UNSUPPORTED_* lists) controls there.
Note, Windows Server 2022 seems to have gained some sanity check for VMX
MSRs: it doesn't even try to launch a guest when there's something it doesn't like, nested_evmcs_check_controls() mechanism can't catch the problem.
Let's be bold this time and instead of playing whack-a-mole just filter out all unsupported controls from VMX MSRs.
Message-Id: <[email protected]>
--- arch/x86/kvm/vmx/evmcs.c | 12 +++++++++--- arch/x86/kvm/vmx/vmx.c | 9 +++++---- 2 files changed, 14 insertions(+), 7 deletions(-)
arch/x86/kvm/vmx/evmcs.c +9 -3
@@ -352,14 +352,20 @@ void nested_evmcs_filter_control_msr(u32switch (msr_index) {case MSR_IA32_VMX_EXIT_CTLS :case MSR_IA32_VMX_TRUE_EXIT_CTLS : - ctl_high &= ~VM_EXIT_LOAD_IA32_PERF_GLOBAL_CTRL ; + ctl_high &= ~EVMCS1_UNSUPPORTED_VMEXIT_CTRL ;break ;case MSR_IA32_VMX_ENTRY_CTLS :case MSR_IA32_VMX_TRUE_ENTRY_CTLS : - ctl_high &= ~VM_ENTRY_LOAD_IA32_PERF_GLOBAL_CTRL ; + ctl_high &= ~EVMCS1_UNSUPPORTED_VMENTRY_CTRL ;break ;case MSR_IA32_VMX_PROCBASED_CTLS2 : - ctl_high &= ~SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES ; + ctl_high &= ~EVMCS1_UNSUPPORTED_2NDEXEC ; +break ; +case MSR_IA32_VMX_PINBASED_CTLS : + ctl_high &= ~EVMCS1_UNSUPPORTED_PINCTRL ; +break ; +case MSR_IA32_VMX_VMFUNC : + ctl_low &= ~EVMCS1_UNSUPPORTED_VMFUNC ;break ; }
arch/x86/kvm/vmx/vmx.c +5 -4
@@ -1867,10 +1867,11 @@ static int vmx_get_msr(struct kvm_vcpu * &msr_info->data))return 1 ;/* -* Enlightened VMCS v1 doesn't have certain fields, but buggy -* Hyper-V versions are still trying to use corresponding -* features when they are exposed. Filter out the essential -* minimum. +* Enlightened VMCS v1 doesn't have certain VMCS fields but +* instead of just ignoring the features, different Hyper-V +* versions are either trying to use them and fail or do some +* sanity checking and refuse to boot. Filter all unsupported +* features out. */ if (!msr_info->host_initiated && vmx->nested.enlightened_vmcs_enabled)
Greg Kroah-Hartman
maintainerPATCH 20/93 KVM: rseq: Update rseq when processing NOTIFY_RESUME on xfer to KVM guest
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 8646e53633f314e4d746a988240d3b951a92f94a upstream.
Invoke rseq's NOTIFY_RESUME handler when processing the flag prior to transferring to a KVM guest, which is roughly equivalent to an exit to userspace and processes many of the same pending actions. While the task cannot be in an rseq critical section as the KVM path is reachable only by via ioctl(KVM_RUN), the side effects that apply to rseq outside of a critical section still apply, e.g. the current CPU needs to be updated if the task is migrated.
Clearing TIF_NOTIFY_RESUME without informing rseq can lead to segfaults and other badness in userspace VMMs that use rseq in combination with KVM, e.g. due to the CPU ID being stale after task migration.
Message-Id: <[email protected]>
--- kernel/entry/kvm.c | 4 +++- kernel/rseq.c | 13 ++++++++++--- 2 files changed, 13 insertions(+), 4 deletions(-)
kernel/entry/kvm.c +3 -1
@@ -16,8 +16,10 @@ static int xfer_to_guest_mode_work(strucif (ti_work & _TIF_NEED_RESCHED)schedule (); -if (ti_work & _TIF_NOTIFY_RESUME) +if (ti_work & _TIF_NOTIFY_RESUME) {tracehook_notify_resume (NULL ); +rseq_handle_notify_resume (NULL ,NULL ); + } ret =arch_xfer_to_guest_mode_handle_work (vcpu, ti_work);if (ret)
kernel/rseq.c +10 -3
@@ -268,9 +268,16 @@ void __rseq_handle_notify_resume(structreturn ;if (unlikely (!access_ok (t->rseq,sizeof (*t->rseq)))) goto error; - ret =rseq_ip_fixup (regs); -if (unlikely (ret <0 )) - goto error; +/* +* regs is NULL if and only if the caller is in a syscall path. Skip +* fixup and leave rseq_cs as is so that rseq_sycall() will detect and +* kill a misbehaving userspace on debug kernels. +*/ +if (regs) { + ret =rseq_ip_fixup (regs); +if (unlikely (ret <0 )) + goto error; + }if (unlikely (rseq_update_cpu_id (t))) goto error;return ;
Greg Kroah-Hartman
maintainerPATCH 21/93 media: ir_toy: prevent device from hanging during transmit
In reply to Greg Kroah-HartmanFrom: Sean Young <[email protected]>
commit f0c15b360fb65ee39849afe987c16eb3d0175d0d upstream.
If the IR Toy is receiving IR while a transmit is done, it may end up hanging. We can prevent this from happening by re-entering sample mode just before issuing the transmit command.
--- drivers/media/rc/ir_toy.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-)
drivers/media/rc/ir_toy.c +20 -1
@@ -24,6 +24,7 @@ static const u8 COMMAND_VERSION[] = { 'v// End transmit and repeat reset command so we exit sump mode static const u8 COMMAND_RESET [] = {0xff ,0xff ,0 ,0 ,0 ,0 ,0 };static const u8 COMMAND_SMODE_ENTER [] = {'s' }; +static const u8 COMMAND_SMODE_EXIT [] = {0 };static const u8 COMMAND_TXSTART [] = {0x26 ,0x24 ,0x25 ,0x03 };#define REPLY_XMITCOUNT 't'
@@ -309,12 +310,30 @@ static int irtoy_tx(struct rc_dev *rc, u buf[i] =cpu_to_be16 (v); } - buf[count] =cpu_to_be16 (0xffff ); + buf[count] =0xffff ; irtoy->tx_buf = buf; irtoy->tx_len = size; irtoy->emitted =0 ; +// There is an issue where if the unit is receiving IR while the +// first TXSTART command is sent, the device might end up hanging +// with its led on. It does not respond to any command when this +// happens. To work around this, re-enter sample mode. + err =irtoy_command (irtoy,COMMAND_SMODE_EXIT , +sizeof (COMMAND_SMODE_EXIT ),STATE_RESET ); +if (err) { +dev_err (irtoy->dev,"exit sample mode: %d\n" , err); +return err; + } + + err =irtoy_command (irtoy,COMMAND_SMODE_ENTER , +sizeof (COMMAND_SMODE_ENTER ),STATE_COMMAND ); +if (err) { +dev_err (irtoy->dev,"enter sample mode: %d\n" , err); +return err; + } + err =irtoy_command (irtoy,COMMAND_TXSTART ,sizeof (COMMAND_TXSTART ),STATE_TX );kfree (buf);
Greg Kroah-Hartman
maintainerPATCH 22/93 RDMA/cma: Do not change route.addr.src_addr.ss_family
In reply to Greg Kroah-HartmanFrom: Jason Gunthorpe <[email protected]>
commit bc0bdc5afaa740d782fbf936aaeebd65e5c2921d upstream.
If the state is not idle then rdma_bind_addr() will immediately fail and no change to global state should happen.
For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation():
if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev)
To view a mangled src_addr, eg with a IPv6 loopback address but an IPv4 family, failing the test.
This would manifest as this trace from syzkaller:
BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c:26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae
Which is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens().
Instead of trying to re-use the src_addr memory to indirectly create an any address build one explicitly on the stack and bind to that as any other normal flow would do.
--- drivers/infiniband/core/cma.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/infiniband/core/cma.c +6 -2
@@ -3732,9 +3732,13 @@ int rdma_listen(struct rdma_cm_id *id, iint ret; if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_LISTEN)) { + struct sockaddr_in any_in = { + .sin_family = AF_INET, + .sin_addr.s_addr = htonl(INADDR_ANY), + }; + /* For a well behaved ULP state will be RDMA_CM_IDLE */ - id->route.addr.src_addr.ss_family = AF_INET; - ret = rdma_bind_addr(id, cma_src_addr(id_priv)); + ret = rdma_bind_addr(id, (struct sockaddr *)&any_in); if (ret) return ret; if (WARN_ON(!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND,
Greg Kroah-Hartman
maintainerPATCH 23/93 drm/amd/display: Pass PCI deviceid into DC
In reply to Greg Kroah-HartmanFrom: Charlene Liu <[email protected]>
commit d942856865c733ff60450de9691af796ad71d7bc upstream.
[why]
pci deviceid not passed to dal dc, without proper break, dcn2.x falls into dcn3.x code path
[how]
pass in pci deviceid, and break once dal_version initialized.
--- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 1 + 1 file changed, 1 insertion(+)
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +1 -0
@@ -951,6 +951,7 @@ static int amdgpu_dm_init(struct amdgpu_ init_data.asic_id.pci_revision_id = adev->pdev->revision; init_data.asic_id.hw_internal_rev = adev->external_rev_id; + init_data.asic_id.chip_id = adev->pdev->device; init_data.asic_id.vram_width = adev->gmc.vram_width;/* TODO: initialize init_data.asic_id.vram_type here!!!! */
Greg Kroah-Hartman
maintainerPATCH 24/93 drm/amdgpu: correct initial cp_hqd_quantum for gfx9
In reply to Greg Kroah-HartmanFrom: Hawking Zhang <[email protected]>
commit 9f52c25f59b504a29dda42d83ac1e24d2af535d4 upstream.
didn't read the value of mmCP_HQD_QUANTUM from correct register offset
--- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +1 -1
@@ -3542,7 +3542,7 @@ static int gfx_v9_0_mqd_init(struct amdg/* set static priority for a queue/ring */ gfx_v9_0_mqd_set_priority (ring, mqd); - mqd->cp_hqd_quantum =RREG32 (mmCP_HQD_QUANTUM); + mqd->cp_hqd_quantum =RREG32_SOC15 (GC ,0 , mmCP_HQD_QUANTUM);/* map_queues packet doesn't need activate the queue, * so only kiq need set this field.
Greg Kroah-Hartman
maintainerPATCH 25/93 ipvs: check that ip_vs_conn_tab_bits is between 8 and 20
In reply to Greg Kroah-HartmanFrom: Andrea Claudi <[email protected]>
[ Upstream commit 69e73dbfda14fbfe748d3812da1244cce2928dcb ]
ip_vs_conn_tab_bits may be provided by the user through the conn_tab_bits module parameter. If this value is greater than 31, or less than 0, the shift operator used to derive tab_size causes undefined behaviour.
Fix this checking ip_vs_conn_tab_bits value to be in the range specified in ipvs Kconfig. If not, simply use default value.
--- net/netfilter/ipvs/ip_vs_conn.c | 4 ++++ 1 file changed, 4 insertions(+)
net/netfilter/ipvs/ip_vs_conn.c +4 -0
@@ -1468,6 +1468,10 @@ int __init ip_vs_conn_init(void)int idx;/* Compute size and mask */ +if (ip_vs_conn_tab_bits <8 || ip_vs_conn_tab_bits >20 ) { +pr_info ("conn_tab_bits not in [8, 20]. Using default value\n" ); + ip_vs_conn_tab_bits =CONFIG_IP_VS_TAB_BITS ; + } ip_vs_conn_tab_size =1 << ip_vs_conn_tab_bits; ip_vs_conn_tab_mask = ip_vs_conn_tab_size -1 ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 26/93 bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
[ Upstream commit 356ed64991c6847a0c4f2e8fa3b1133f7a14f1fc ]
Currently if a function ptr in struct_ops has a return value, its caller will get a random return value from it, because the return value of related BPF_PROG_TYPE_STRUCT_OPS prog is just dropped.
So adding a new flag BPF_TRAMP_F_RET_FENTRY_RET to tell bpf trampoline to save and return the return value of struct_ops prog if ret_size of the function ptr is greater than 0. Also restricting the flag to be used alone.
--- arch/x86/net/bpf_jit_comp.c | 53 ++++++++++++++++++++++++++++--------- include/linux/bpf.h | 2 ++ kernel/bpf/bpf_struct_ops.c | 7 +++-- 3 files changed, 47 insertions(+), 15 deletions(-)
arch/x86/net/bpf_jit_comp.c +40 -13
@@ -1547,7 +1547,7 @@ static void restore_regs(const struct btf_func_model *m, u8 **prog, int nr_args, }static int invoke_bpf_prog (const struct btf_func_model *m,u8 **pprog, -struct bpf_prog *p,int stack_size,bool mod_ret) +struct bpf_prog *p,int stack_size,bool save_ret) {u8 *prog = *pprog;int cnt =0 ;
@@ -1573,11 +1573,15 @@ static int invoke_bpf_prog(const struct btf_func_model *m, u8 **pprog,if (emit_call (&prog, p->bpf_func, prog))return -EINVAL ; -/* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return +/* +* BPF_TRAMP_MODIFY_RETURN trampolines can modify the return * of the previous call which is then passed on the stack to * the next BPF program. +* +* BPF_TRAMP_FENTRY trampoline may need to return the return +* value of BPF_PROG_TYPE_STRUCT_OPS prog. */ -if (mod_ret) +if (save_ret)emit_stx (&prog,BPF_DW ,BPF_REG_FP ,BPF_REG_0 ,-8 );if (p->aux->sleepable) {
@@ -1645,13 +1649,15 @@ static int emit_cond_near_jump(u8 **pprog, void *func, void *ip, u8 jmp_cond) }static int invoke_bpf (const struct btf_func_model *m,u8 **pprog, -struct bpf_tramp_progs *tp,int stack_size) +struct bpf_tramp_progs *tp,int stack_size, +bool save_ret) {int i;u8 *prog = *pprog;for (i =0 ; i < tp->nr_progs; i++) { -if (invoke_bpf_prog (m, &prog, tp->progs[i], stack_size, false)) +if (invoke_bpf_prog (m, &prog, tp->progs[i], stack_size, + save_ret))return -EINVAL ; } *pprog = prog;
@@ -1694,6 +1700,23 @@ static int invoke_bpf_mod_ret(const struct btf_func_model *m, u8 **pprog,return 0 ; } +static bool is_valid_bpf_tramp_flags (unsigned int flags) +{ +if ((flags &BPF_TRAMP_F_RESTORE_REGS ) && + (flags &BPF_TRAMP_F_SKIP_FRAME )) +return false; + +/* +* BPF_TRAMP_F_RET_FENTRY_RET is only used by bpf_struct_ops, +* and it must be used alone. +*/ +if ((flags &BPF_TRAMP_F_RET_FENTRY_RET ) && + (flags & ~BPF_TRAMP_F_RET_FENTRY_RET )) +return false; + +return true; +} +/* Example: * __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev); * its 'struct btf_func_model' will be nr_args=2
@@ -1766,17 +1789,19 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *istruct bpf_tramp_progs *fmod_ret = &tprogs[BPF_TRAMP_MODIFY_RETURN ];u8 **branches =NULL ;u8 *prog; +bool save_ret;/* x86-64 supports up to 6 arguments. 7+ can be added in the future */ if (nr_args >6 )return -ENOTSUPP ; -if ((flags &BPF_TRAMP_F_RESTORE_REGS ) && - (flags &BPF_TRAMP_F_SKIP_FRAME )) +if (!is_valid_bpf_tramp_flags (flags))return -EINVAL ; -if (flags &BPF_TRAMP_F_CALL_ORIG ) - stack_size +=8 ;/* room for return value of orig_call */ +/* room for return value of orig_call or fentry prog */ + save_ret = flags & (BPF_TRAMP_F_CALL_ORIG |BPF_TRAMP_F_RET_FENTRY_RET ); +if (save_ret) + stack_size +=8 ;if (flags &BPF_TRAMP_F_SKIP_FRAME )/* skip patched call instruction and point orig_call to actual
@@ -1803,7 +1828,8 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i }if (fentry->nr_progs) -if (invoke_bpf (m, &prog, fentry, stack_size)) +if (invoke_bpf (m, &prog, fentry, stack_size, + flags &BPF_TRAMP_F_RET_FENTRY_RET ))return -EINVAL ;if (fmod_ret->nr_progs) {
@@ -1850,7 +1876,7 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i }if (fexit->nr_progs) -if (invoke_bpf (m, &prog, fexit, stack_size)) { +if (invoke_bpf (m, &prog, fexit, stack_size, false)) { ret = -EINVAL ; goto cleanup; }
@@ -1870,9 +1896,10 @@ int arch_prepare_bpf_trampoline(struct bpf_tramp_image *im, void *image, void *i ret = -EINVAL ; goto cleanup; } -/* restore original return value back into RAX */ -emit_ldx (&prog,BPF_DW ,BPF_REG_0 ,BPF_REG_FP ,-8 ); } +/* restore return value of orig_call or fentry prog back into RAX */ +if (save_ret) +emit_ldx (&prog,BPF_DW ,BPF_REG_0 ,BPF_REG_FP ,-8 );EMIT1 (0x5B );/* pop rbx */ EMIT1 (0xC9 );/* leave */
include/linux/bpf.h +2 -0
@@ -526,6 +526,8 @@ struct btf_func_model {* programs only. Should not be used with normal calls and indirect calls. */ #define BPF_TRAMP_F_SKIP_FRAME BIT(2) +/* Return the return value of fentry prog. Only used by bpf_struct_ops. */ +#define BPF_TRAMP_F_RET_FENTRY_RET BIT(4)/* Each call __bpf_prog_enter + call bpf_func + call __bpf_prog_exit is ~50 * bytes on x86. Pick a number to fit into BPF_IMAGE_SIZE / 2
kernel/bpf/bpf_struct_ops.c +5 -2
@@ -367,6 +367,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key,const struct btf_type *mtype, *ptype;struct bpf_prog *prog;u32 moff; +u32 flags; moff =btf_member_bit_offset (t, member) /8 ; ptype =btf_type_resolve_ptr (btf_vmlinux, member->type,NULL );
@@ -430,10 +431,12 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, tprogs[BPF_TRAMP_FENTRY ].progs[0 ] = prog; tprogs[BPF_TRAMP_FENTRY ].nr_progs =1 ; + flags = st_ops->func_models[i].ret_size >0 ? +BPF_TRAMP_F_RET_FENTRY_RET :0 ; err =arch_prepare_bpf_trampoline (NULL , image, st_map->image +PAGE_SIZE , - &st_ops->func_models[i],0 , - tprogs,NULL ); + &st_ops->func_models[i], + flags, tprogs,NULL );if (err <0 ) goto reset_unlock;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 27/93 IB/cma: Do not send IGMP leaves for sendonly Multicast groups
In reply to Greg Kroah-HartmanFrom: Christoph Lameter <[email protected]>
[ Upstream commit 2cc74e1ee31d00393b6698ec80b322fd26523da4 ]
ROCE uses IGMP for Multicast instead of the native Infiniband system where joins are required in order to post messages on the Multicast group. On Ethernet one can send Multicast messages to arbitrary addresses without the need to subscribe to a group.
So ROCE correctly does not send IGMP joins during rdma_join_multicast().
F.e. in cma_iboe_join_multicast() we see:
if (addr->sa_family == AF_INET) {
if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) {
ib.rec.hop_limit = IPV6_DEFAULT_HOPLIMIT;
if (!send_only) {
err = cma_igmp_send(ndev, &ib.rec.mgid,
true);
}
}
} else {So the IGMP join is suppressed as it is unnecessary.
However no such check is done in destroy_mc(). And therefore leaving a sendonly multicast group will send an IGMP leave.
This means that the following scenario can lead to a multicast receiver unexpectedly being unsubscribed from a MC group:
1. Sender thread does a sendonly join on MC group X. No IGMP join is sent.
2. Receiver thread does a regular join on the same MC Group x. IGMP join is sent and the receiver begins to get messages.
3. Sender thread terminates and destroys MC group X. IGMP leave is sent and the receiver no longer receives data.
This patch adds the same logic for sendonly joins to destroy_mc() that is also used in cma_iboe_join_multicast().
--- drivers/infiniband/core/cma.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/infiniband/core/cma.c +6 -1
@@ -1814,6 +1814,8 @@ static void cma_release_port(struct rdma_id_private *id_priv)static void destroy_mc (struct rdma_id_private *id_priv,struct cma_multicast *mc) { +bool send_only = mc->join_state ==BIT (SENDONLY_FULLMEMBER_JOIN ); +if (rdma_cap_ib_mcast (id_priv->id.device, id_priv->id.port_num))ib_sa_free_multicast (mc->sa_mc);
@@ -1830,7 +1832,10 @@ static void destroy_mc(struct rdma_id_private *id_priv,cma_set_mgid (id_priv, (struct sockaddr *)&mc->addr, &mgid); -cma_igmp_send (ndev, &mgid, false); + +if (!send_only) +cma_igmp_send (ndev, &mgid, false); +dev_put (ndev); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 28/93 RDMA/cma: Fix listener leak in rdma_cma_listen_on_all() failure
In reply to Greg Kroah-HartmanFrom: Tao Liu <[email protected]>
[ Upstream commit ca465e1f1f9b38fe916a36f7d80c5d25f2337c81 ]
If cma_listen_on_all() fails it leaves the per-device ID still on the listen_list but the state is not set to RDMA_CM_ADDR_BOUND.
When the cmid is eventually destroyed cma_cancel_listens() is not called due to the wrong state, however the per-device IDs are still holding the refcount preventing the ID from being destroyed, thus deadlocking:
task:rping state:D stack: 0 pid:19605 ppid: 47036 flags:0x00000084
Call Trace: __schedule+0x29a/0x780 ? free_unref_page_commit+0x9b/0x110 schedule+0x3c/0xa0 schedule_timeout+0x215/0x2b0 ? __flush_work+0x19e/0x1e0 wait_for_completion+0x8d/0xf0 _destroy_id+0x144/0x210 [rdma_cm] ucma_close_id+0x2b/0x40 [rdma_ucm] __destroy_id+0x93/0x2c0 [rdma_ucm] ? __xa_erase+0x4a/0xa0 ucma_destroy_id+0x9a/0x120 [rdma_ucm] ucma_write+0xb8/0x130 [rdma_ucm] vfs_write+0xb4/0x250 ksys_write+0xb5/0xd0 ? syscall_trace_enter.isra.19+0x123/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9
Ensure that cma_listen_on_all() atomically unwinds its action under the lock during error.
--- drivers/infiniband/core/cma.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/infiniband/core/cma.c +10 -3
@@ -1750,15 +1750,16 @@ static void cma_cancel_route(struct rdma_id_private *id_priv) } } -static void cma_cancel_listens (struct rdma_id_private *id_priv) +static void _cma_cancel_listens (struct rdma_id_private *id_priv) {struct rdma_id_private *dev_id_priv; +lockdep_assert_held (&lock); +/* * Remove from listen_any_list to prevent added devices from spawning * additional listen requests. */ -mutex_lock (&lock);list_del (&id_priv->list);while (!list_empty (&id_priv->listen_list)) {
@@ -1772,6 +1773,12 @@ static void cma_cancel_listens(struct rdma_id_private *id_priv)rdma_destroy_id (&dev_id_priv->id);mutex_lock (&lock); } +} + +static void cma_cancel_listens (struct rdma_id_private *id_priv) +{ +mutex_lock (&lock); +_cma_cancel_listens (id_priv);mutex_unlock (&lock); }
@@ -2582,7 +2589,7 @@ static int cma_listen_on_all(struct rdma_id_private *id_priv)return 0 ; err_listen: -list_del (&id_priv->list); +_cma_cancel_listens (id_priv);mutex_unlock (&lock);if (to_destroy)rdma_destroy_id (&to_destroy->id);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 29/93 bpf, mips: Validate conditional branch offsets
In reply to Greg Kroah-HartmanFrom: Piotr Krysiuk <[email protected]>
[ Upstream commit 37cb28ec7d3a36a5bace7063a3dba633ab110f8b ]
The conditional branch instructions on MIPS use 18-bit signed offsets allowing for a branch range of 128 KBytes (backward and forward). However, this limit is not observed by the cBPF JIT compiler, and so the JIT compiler emits out-of-range branches when translating certain cBPF programs. A specific example of such a cBPF program is included in the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes anomalous machine code containing incorrect branch offsets under JIT.
Furthermore, this issue can be abused to craft undesirable machine code, where the control flow is hijacked to execute arbitrary Kernel code.
The following steps can be used to reproduce the issue:
# echo 1 > /proc/sys/net/core/bpf_jit_enable # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH"
This should produce multiple warnings from build_bimm() similar to:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590
Micro-assembler field overflow
Modules linked in: test_bpf(+)
CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1
Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee
82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180
00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e
6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000
00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001
[...]
Call Trace:
[<80108f44>] show_stack+0x38/0x118
[<807a7aac>] dump_stack_lvl+0x5c/0x7c
[<807a4b3c>] __warn+0xcc/0x140
[<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8
[<8011e198>] build_insn+0x558/0x590
[<8011e358>] uasm_i_bne+0x20/0x2c
[<80127b48>] build_body+0xa58/0x2a94
[<80129c98>] bpf_jit_compile+0x114/0x1e4
[<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4
[<8061423c>] bpf_prog_create+0x80/0xc4
[<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf]
[<8010051c>] do_one_initcall+0x50/0x1d4
[<801c5e54>] do_init_module+0x60/0x220
[<801c8b20>] sys_finit_module+0xc4/0xfc
[<801144d0>] syscall_common+0x34/0x58
[...]
---[ end trace a287d9742503c645 ]---Then the anomalous machine code executes:
=> 0xc0a18000: addiu sp,sp,-16 0xc0a18004: sw s3,0(sp) 0xc0a18008: sw s4,4(sp) 0xc0a1800c: sw s5,8(sp) 0xc0a18010: sw ra,12(sp) 0xc0a18014: move s5,a0 0xc0a18018: move s4,zero 0xc0a1801c: move s3,zero
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a18020: lui t6,0x8012 0xc0a18024: ori t4,t6,0x9e14 0xc0a18028: li a1,0 0xc0a1802c: jalr t4 0xc0a18030: move a0,s5 0xc0a18034: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a18038: move v0,zero 0xc0a1803c: andi s4,s3,0xf 0xc0a18040: b 0xc0a18048 0xc0a18044: sll s4,s4,0x2
[...]
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffa0: lui t6,0x8012 0xc0a1ffa4: ori t4,t6,0x9e14 0xc0a1ffa8: li a1,0 0xc0a1ffac: jalr t4 0xc0a1ffb0: move a0,s5 0xc0a1ffb4: bnez v0,0xc0a1ffb8 # incorrect branch offset 0xc0a1ffb8: move v0,zero 0xc0a1ffbc: andi s4,s3,0xf 0xc0a1ffc0: b 0xc0a1ffc8 0xc0a1ffc4: sll s4,s4,0x2
# __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0) 0xc0a1ffc8: lui t6,0x8012 0xc0a1ffcc: ori t4,t6,0x9e14 0xc0a1ffd0: li a1,0 0xc0a1ffd4: jalr t4 0xc0a1ffd8: move a0,s5 0xc0a1ffdc: bnez v0,0xc0a3ffb8 # correct branch offset 0xc0a1ffe0: move v0,zero 0xc0a1ffe4: andi s4,s3,0xf 0xc0a1ffe8: b 0xc0a1fff0 0xc0a1ffec: sll s4,s4,0x2
[...]
# epilogue 0xc0a3ffb8: lw s3,0(sp) 0xc0a3ffbc: lw s4,4(sp) 0xc0a3ffc0: lw s5,8(sp) 0xc0a3ffc4: lw ra,12(sp) 0xc0a3ffc8: addiu sp,sp,16 0xc0a3ffcc: jr ra 0xc0a3ffd0: nop
To mitigate this issue, we assert the branch ranges for each emit call that could generate an out-of-range branch.
--- arch/mips/net/bpf_jit.c | 57 +++++++++++++++++++++++++++++++---------- 1 file changed, 43 insertions(+), 14 deletions(-)
arch/mips/net/bpf_jit.c +43 -14
@@ -662,6 +662,11 @@ static void build_epilogue(struct jit_ctx *ctx) ((int)K < 0 ? ((int)K >= SKF_LL_OFF ? func##_negative : func) : \ func##_positive) +static bool is_bad_offset (int b_off) +{ +return b_off >0x1ffff || b_off <-0x20000 ; +} +static int build_body (struct jit_ctx *ctx) {const struct bpf_prog *prog = ctx->skf;
@@ -728,7 +733,10 @@ static int build_body(struct jit_ctx *ctx)/* Load return register on DS for failures */ emit_reg_move (r_ret, r_zero, ctx);/* Return with error */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx);break ;case BPF_LD |BPF_W |BPF_IND :
@@ -775,8 +783,10 @@ static int build_body(struct jit_ctx *ctx)emit_jalr (MIPS_R_RA , r_s0, ctx);emit_reg_move (MIPS_R_A0 , r_skb, ctx);/* delay slot */ /* Check the error value */ -emit_bcond (MIPS_COND_NE , r_ret,0 , -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_NE , r_ret,0 , b_off, ctx);emit_reg_move (r_ret, r_zero, ctx);/* We are good */ /* X <- P[1:K] & 0xf */
@@ -855,8 +865,10 @@ static int build_body(struct jit_ctx *ctx)/* A /= X */ ctx->flags |=SEEN_X |SEEN_A ;/* Check if r_X is zero */ -emit_bcond (MIPS_COND_EQ , r_X, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_X, r_zero, b_off, ctx);emit_load_imm (r_ret,0 , ctx);/* delay slot */ emit_div (r_A, r_X, ctx);break ;
@@ -864,8 +876,10 @@ static int build_body(struct jit_ctx *ctx)/* A %= X */ ctx->flags |=SEEN_X |SEEN_A ;/* Check if r_X is zero */ -emit_bcond (MIPS_COND_EQ , r_X, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_X, r_zero, b_off, ctx);emit_load_imm (r_ret,0 , ctx);/* delay slot */ emit_mod (r_A, r_X, ctx);break ;
@@ -926,7 +940,10 @@ static int build_body(struct jit_ctx *ctx)break ;case BPF_JMP |BPF_JA :/* pc += K */ -emit_b (b_imm (i + k +1 , ctx), ctx); + b_off =b_imm (i + k +1 , ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx);break ;case BPF_JMP |BPF_JEQ |BPF_K :
@@ -1056,12 +1073,16 @@ static int build_body(struct jit_ctx *ctx)break ;case BPF_RET |BPF_A : ctx->flags |=SEEN_A ; -if (i != prog->len -1 ) +if (i != prog->len -1 ) {/* * If this is not the last instruction * then jump to the epilogue */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx); + }emit_reg_move (r_ret, r_A, ctx);/* delay slot */ break ;case BPF_RET |BPF_K :
@@ -1075,7 +1096,10 @@ static int build_body(struct jit_ctx *ctx)* If this is not the last instruction * then jump to the epilogue */ -emit_b (b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_b (b_off, ctx);emit_nop (ctx); }break ;
@@ -1133,8 +1157,10 @@ static int build_body(struct jit_ctx *ctx)/* Load *dev pointer */ emit_load_ptr (r_s0, r_skb, off, ctx);/* error (0) in the delay slot */ -emit_bcond (MIPS_COND_EQ , r_s0, r_zero, -b_imm (prog->len, ctx), ctx); + b_off =b_imm (prog->len, ctx); +if (is_bad_offset (b_off)) +return -E2BIG ; +emit_bcond (MIPS_COND_EQ , r_s0, r_zero, b_off, ctx);emit_reg_move (r_ret, r_zero, ctx);if (code == (BPF_ANC |SKF_AD_IFINDEX )) { BUILD_BUG_ON(sizeof_field(struct net_device, ifindex) != 4);
@@ -1244,7 +1270,10 @@ void bpf_jit_compile(struct bpf_prog *fp)/* Generate the actual JIT code */ build_prologue (&ctx); -build_body (&ctx); +if (build_body (&ctx)) { +module_memfree (ctx.target); + goto out; + }build_epilogue (&ctx);/* Update the icache */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 30/93 hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit e6fab7af6ba1bc77c78713a83876f60ca7a4a064 ]
Fan speed minimum can be enforced from sysfs. For example, setting current fan speed to 20 is used to enforce fan speed to be at 100% speed, 19 - to be not below 90% speed, etcetera. This feature provides ability to limit fan speed according to some system wise considerations, like absence of some replaceable units or high system ambient temperature.
Request for changing fan minimum speed is configuration request and can be set only through 'sysfs' write procedure. In this situation value of argument 'state' is above nominal fan speed maximum.
Return non-zero code in this case to avoid thermal_cooling_device_stats_update() call, because in this case statistics update violates thermal statistics table range. The issues is observed in case kernel is configured with option CONFIG_THERMAL_STATISTICS.
Here is the trace from KASAN:
[ 159.506659] BUG: KASAN: slab-out-of-bounds in thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.516016] Read of size 4 at addr ffff888116163840 by task hw-management.s/7444 [ 159.545625] Call Trace: [ 159.548366] dump_stack+0x92/0xc1 [ 159.552084] ? thermal_cooling_device_stats_update+0x7d/0xb0 [ 159.635869] thermal_zone_device_update+0x345/0x780 [ 159.688711] thermal_zone_device_set_mode+0x7d/0xc0 [ 159.694174] mlxsw_thermal_modules_init+0x48f/0x590 [mlxsw_core] [ 159.700972] ? mlxsw_thermal_set_cur_state+0x5a0/0x5a0 [mlxsw_core] [ 159.731827] mlxsw_thermal_init+0x763/0x880 [mlxsw_core] [ 160.070233] RIP: 0033:0x7fd995909970 [ 160.074239] Code: 73 01 c3 48 8b 0d 28 d5 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 99 2d 2c 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff .. [ 160.095242] RSP: 002b:00007fff54f5d938 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 160.103722] RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 00007fd995909970 [ 160.111710] RDX: 0000000000000013 RSI: 0000000001906008 RDI: 0000000000000001 [ 160.119699] RBP: 0000000001906008 R08: 00007fd995bc9760 R09: 00007fd996210700 [ 160.127687] R10: 0000000000000073 R11: 0000000000000246 R12: 0000000000000013 [ 160.135673] R13: 0000000000000001 R14: 00007fd995bc8600 R15: 0000000000000013 [ 160.143671] [ 160.145338] Allocated by task 2924: [ 160.149242] kasan_save_stack+0x19/0x40 [ 160.153541] __kasan_kmalloc+0x7f/0xa0 [ 160.157743] __kmalloc+0x1a2/0x2b0 [ 160.161552] thermal_cooling_device_setup_sysfs+0xf9/0x1a0 [ 160.167687] __thermal_cooling_device_register+0x1b5/0x500 [ 160.173833] devm_thermal_of_cooling_device_register+0x60/0xa0 [ 160.180356] mlxreg_fan_probe+0x474/0x5e0 [mlxreg_fan] [ 160.248140] [ 160.249807] The buggy address belongs to the object at ffff888116163400 [ 160.249807] which belongs to the cache kmalloc-1k of size 1024 [ 160.263814] The buggy address is located 64 bytes to the right of [ 160.263814] 1024-byte region [ffff888116163400, ffff888116163800) [ 160.277536] The buggy address belongs to the page: [ 160.282898] page:0000000012275840 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888116167000 pfn:0x116160 [ 160.294872] head:0000000012275840 order:3 compound_mapcount:0 compound_pincount:0 [ 160.303251] flags: 0x200000000010200(slab|head|node=0|zone=2) [ 160.309694] raw: 0200000000010200 ffffea00046f7208 ffffea0004928208 ffff88810004dbc0 [ 160.318367] raw: ffff888116167000 00000000000a0006 00000001ffffffff 0000000000000000 [ 160.327033] page dumped because: kasan: bad access detected [ 160.333270] [ 160.334937] Memory state around the buggy address: [ 160.356469] >ffff888116163800: fc ..
--- drivers/hwmon/mlxreg-fan.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-)
drivers/hwmon/mlxreg-fan.c +9 -3
@@ -291,8 +291,8 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, {struct mlxreg_fan *fan = cdev->devdata;unsigned long cur_state; +int i, config =0 ;u32 regval; -int i;int err;/*
@@ -305,6 +305,12 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,* overwritten. */ if (state >=MLXREG_FAN_SPEED_MIN && state <=MLXREG_FAN_SPEED_MAX ) { +/* +* This is configuration change, which is only supported through sysfs. +* For configuration non-zero value is to be returned to avoid thermal +* statistics update. +*/ + config =1 ; state -=MLXREG_FAN_MAX_STATE ;for (i =0 ; i < state; i++) fan->cooling_levels[i] = state;
@@ -319,7 +325,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev, cur_state =MLXREG_FAN_PWM_DUTY2STATE (regval);if (state < cur_state) -return 0 ; +return config; state = cur_state; }
@@ -335,7 +341,7 @@ static int mlxreg_fan_set_cur_state(struct thermal_cooling_device *cdev,dev_err (fan->dev,"Failed to write PWM duty\n" );return err; } -return 0 ; +return config; }static const struct thermal_cooling_device_ops mlxreg_fan_cooling_ops = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 31/93 mac80211: Fix ieee80211_amsdu_aggregate frag_tail bug
In reply to Greg Kroah-HartmanFrom: Chih-Kang Chang <[email protected]>
[ Upstream commit fe94bac626d9c1c5bc98ab32707be8a9d7f8adba ]
In ieee80211_amsdu_aggregate() set a pointer frag_tail point to the end of skb_shinfo(head)->frag_list, and use it to bind other skb in the end of this function. But when execute ieee80211_amsdu_aggregate() ->ieee80211_amsdu_realloc_pad()->pskb_expand_head(), the address of skb_shinfo(head)->frag_list will be changed. However, the ieee80211_amsdu_aggregate() not update frag_tail after call pskb_expand_head(). That will cause the second skb can't bind to the head skb appropriately.So we update the address of frag_tail to fix it.
--- net/mac80211/tx.c | 8 ++++++++ 1 file changed, 8 insertions(+)
net/mac80211/tx.c +8 -0
@@ -3365,6 +3365,14 @@ static bool ieee80211_amsdu_aggregate(struct ieee80211_sub_if_data *sdata,if (!ieee80211_amsdu_prepare_head (sdata, fast_tx, head)) goto out; +/* If n == 2, the "while (*frag_tail)" loop above didn't execute +* and frag_tail should be &skb_shinfo(head)->frag_list. +* However, ieee80211_amsdu_prepare_head() can reallocate it. +* Reload frag_tail to have it pointing to the correct place. +*/ +if (n ==2 ) + frag_tail = &skb_shinfo (head)->frag_list; +/* * Pad out the previous subframe to a multiple of 4 by adding the * padding to the next one, that's being added. Note that head->len
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 32/93 mac80211: limit injected vht mcs/nss in ieee80211_parse_tx_radiotap
In reply to Greg Kroah-HartmanFrom: Lorenzo Bianconi <[email protected]>
[ Upstream commit 13cb6d826e0ac0d144b0d48191ff1a111d32f0c6 ]
Limit max values for vht mcs and nss in ieee80211_parse_tx_radiotap routine in order to fix the following warning reported by syzbot:
WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] WARNING: CPU: 0 PID: 10717 at include/net/mac80211.h:989 ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 Modules linked in: CPU: 0 PID: 10717 Comm: syz-executor.5 Not tainted 5.14.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ieee80211_rate_set_vht include/net/mac80211.h:989 [inline] RIP: 0010:ieee80211_parse_tx_radiotap+0x101e/0x12d0 net/mac80211/tx.c:2244 RSP: 0018:ffffc9000186f3e8 EFLAGS: 00010216 RAX: 0000000000000618 RBX: ffff88804ef76500 RCX: ffffc900143a5000 RDX: 0000000000040000 RSI: ffffffff888f478e RDI: 0000000000000003 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000100 R10: ffffffff888f46f9 R11: 0000000000000000 R12: 00000000fffffff8 R13: ffff88804ef7653c R14: 0000000000000001 R15: 0000000000000004 FS: 00007fbf5718f700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2de23000 CR3: 000000006a671000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: ieee80211_monitor_select_queue+0xa6/0x250 net/mac80211/iface.c:740 netdev_core_pick_tx+0x169/0x2e0 net/core/dev.c:4089 __dev_queue_xmit+0x6f9/0x3710 net/core/dev.c:4165 __bpf_tx_skb net/core/filter.c:2114 [inline] __bpf_redirect_no_mac net/core/filter.c:2139 [inline] __bpf_redirect+0x5ba/0xd20 net/core/filter.c:2162 ____bpf_clone_redirect net/core/filter.c:2429 [inline] bpf_clone_redirect+0x2ae/0x420 net/core/filter.c:2401 bpf_prog_eeb6f53a69e5c6a2+0x59/0x234 bpf_dispatcher_nop_func include/linux/bpf.h:717 [inline] __bpf_prog_run include/linux/filter.h:624 [inline] bpf_prog_run include/linux/filter.h:631 [inline] bpf_test_run+0x381/0xa30 net/bpf/test_run.c:119 bpf_prog_test_run_skb+0xb84/0x1ee0 net/bpf/test_run.c:663 bpf_prog_test_run kernel/bpf/syscall.c:3307 [inline] __sys_bpf+0x2137/0x5df0 kernel/bpf/syscall.c:4605 __do_sys_bpf kernel/bpf/syscall.c:4691 [inline] __se_sys_bpf kernel/bpf/syscall.c:4689 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:4689 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x4665f9
--- net/mac80211/tx.c | 4 ++++ 1 file changed, 4 insertions(+)
net/mac80211/tx.c +4 -0
@@ -2177,7 +2177,11 @@ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb, } vht_mcs = iterator.this_arg[4 ] >>4 ; +if (vht_mcs >11 ) + vht_mcs =0 ; vht_nss = iterator.this_arg[4 ] &0xF ; +if (!vht_nss || vht_nss >8 ) + vht_nss =1 ;break ;/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 33/93 mac80211: mesh: fix potentially unaligned access
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit b9731062ce8afd35cf723bf3a8ad55d208f915a5 ]
The pointer here points directly into the frame, so the access is potentially unaligned. Use get_unaligned_le16 to avoid that.
--- net/mac80211/mesh_ps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
net/mac80211/mesh_ps.c +2 -1
@@ -2,6 +2,7 @@/* * Copyright 2012-2013, Marco Porsch <[email protected]> * Copyright 2012-2013, cozybit Inc. +* Copyright (C) 2021 Intel Corporation */ #include "mesh.h"
@@ -588,7 +589,7 @@ void ieee80211_mps_frame_release(struct sta_info *sta,/* only transmit to PS STA with announced, non-zero awake window */ if (test_sta_flag (sta,WLAN_STA_PS_STA ) && - (!elems->awake_window || !le16_to_cpu (*elems->awake_window))) + (!elems->awake_window || !get_unaligned_le16 (elems->awake_window)))return ;if (!test_sta_flag (sta,WLAN_STA_MPSP_OWNER ))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 34/93 mac80211-hwsim: fix late beacon hrtimer handling
In reply to Greg Kroah-HartmanFrom: Johannes Berg <[email protected]>
[ Upstream commit 313bbd1990b6ddfdaa7da098d0c56b098a833572 ]
Thomas explained in https://lore.kernel.org/r/87mtoeb4hb.ffs@tglx
that our handling of the hrtimer here is wrong: If the timer fires late (e.g. due to vCPU scheduling, as reported by Dmitry/syzbot) then it tries to actually rearm the timer at the next deadline, which might be in the past already:
1 2 3 N N+1 | | | ... | |
^ intended to fire here (1)
^ next deadline here (2)
^ actually fired here
The next time it fires, it's later, but will still try to schedule for the next deadline (now 3), etc. until it catches up with N, but that might take a long time, causing stalls etc.
Now, all of this is simulation, so we just have to fix it, but note that the behaviour is wrong even per spec, since there's no value then in sending all those beacons unaligned - they should be aligned to the TBTT (1, 2, 3, ... in the picture), and if we're a bit (or a lot) late, then just resume at that point.
Therefore, change the code to use hrtimer_forward_now() which will ensure that the next firing of the timer would be at N+1 (in the picture), i.e. the next interval point after the current time.
--- drivers/net/wireless/mac80211_hwsim.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/mac80211_hwsim.c +2 -2
@@ -1795,8 +1795,8 @@ mac80211_hwsim_beacon(struct hrtimer *timer) bcn_int -= data->bcn_delta; data->bcn_delta =0 ; } -hrtimer_forward (&data->beacon_timer,hrtimer_get_expires (timer), -ns_to_ktime (bcn_int *NSEC_PER_USEC )); +hrtimer_forward_now (&data->beacon_timer, +ns_to_ktime (bcn_int *NSEC_PER_USEC ));return HRTIMER_RESTART ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 35/93 sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
In reply to Greg Kroah-HartmanFrom: Xin Long <[email protected]>
[ Upstream commit f7e745f8e94492a8ac0b0a26e25f2b19d342918f ]
We should always check if skb_header_pointer's return is NULL before using it, otherwise it may cause null-ptr-deref, as syzbot reported:
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:sctp_rcv_ootb net/sctp/input.c:705 [inline] RIP: 0010:sctp_rcv+0x1d84/0x3220 net/sctp/input.c:196 Call Trace: <IRQ> sctp6_rcv+0x38/0x60 net/sctp/ipv6.c:1109 ip6_protocol_deliver_rcu+0x2e9/0x1ca0 net/ipv6/ip6_input.c:422 ip6_input_finish+0x62/0x170 net/ipv6/ip6_input.c:463 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_input+0x9c/0xd0 net/ipv6/ip6_input.c:472 dst_input include/net/dst.h:460 [inline] ip6_rcv_finish net/ipv6/ip6_input.c:76 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ipv6_rcv+0x28c/0x3c0 net/ipv6/ip6_input.c:297
--- net/sctp/input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sctp/input.c +1 -1
@@ -677,7 +677,7 @@ static int sctp_rcv_ootb(struct sk_buff *skb) ch =skb_header_pointer (skb, offset,sizeof (*ch), &_ch);/* Break out if chunk length is less then minimal. */ -if (ntohs (ch->length) <sizeof (_ch)) +if (!ch ||ntohs (ch->length) <sizeof (_ch))break ; ch_end = offset +SCTP_PAD4 (ntohs (ch->length));
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 36/93 mptcp: dont return sockets in foreign netns
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit ea1300b9df7c8e8b65695a08b8f6aaf4b25fec9c ]
mptcp_token_get_sock() may return a mptcp socket that is in a different net namespace than the socket that received the token value.
The mptcp syncookie code path had an explicit check for this, this moves the test into mptcp_token_get_sock() function.
Eventually token.c should be converted to pernet storage, but such change is not suitable for net tree.
--- net/mptcp/mptcp_diag.c | 2 +- net/mptcp/protocol.h | 2 +- net/mptcp/subflow.c | 2 +- net/mptcp/syncookies.c | 13 +------------ net/mptcp/token.c | 11 ++++++++--- net/mptcp/token_test.c | 14 ++++++++------ 6 files changed, 20 insertions(+), 24 deletions(-)
net/mptcp/mptcp_diag.c +1 -1
@@ -36,7 +36,7 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb,struct sock *sk; net =sock_net (in_skb->sk); - msk =mptcp_token_get_sock (req->id.idiag_cookie[0 ]); + msk =mptcp_token_get_sock (net, req->id.idiag_cookie[0 ]);if (!msk) goto out_nosk;
net/mptcp/protocol.h +1 -1
@@ -424,7 +424,7 @@ int mptcp_token_new_connect(struct sock *sk);void mptcp_token_accept (struct mptcp_subflow_request_sock *r,struct mptcp_sock *msk);bool mptcp_token_exists (u32 token); -struct mptcp_sock *mptcp_token_get_sock (u32 token); +struct mptcp_sock *mptcp_token_get_sock (struct net *net,u32 token);struct mptcp_sock *mptcp_token_iter_next (const struct net *net,long *s_slot,long *s_num);void mptcp_token_destroy (struct mptcp_sock *msk);
net/mptcp/subflow.c +1 -1
@@ -69,7 +69,7 @@ static struct mptcp_sock *subflow_token_join_request(struct request_sock *req,struct mptcp_sock *msk;int local_id; - msk =mptcp_token_get_sock (subflow_req->token); + msk =mptcp_token_get_sock (sock_net (req_to_sk (req)), subflow_req->token);if (!msk) {SUBFLOW_REQ_INC_STATS (req,MPTCP_MIB_JOINNOTOKEN );return NULL ;
net/mptcp/syncookies.c +1 -12
@@ -108,18 +108,12 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl e->valid =0 ; - msk =mptcp_token_get_sock (e->token); + msk =mptcp_token_get_sock (net, e->token);if (!msk) {spin_unlock_bh (&join_entry_locks[i]);return false; } -/* If this fails, the token got re-used in the mean time by another -* mptcp socket in a different netns, i.e. entry is outdated. -*/ -if (!net_eq (sock_net ((struct sock *)msk), net)) - goto err_put; - subflow_req->remote_nonce = e->remote_nonce; subflow_req->local_nonce = e->local_nonce; subflow_req->backup = e->backup;
@@ -128,11 +122,6 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl subflow_req->msk = msk;spin_unlock_bh (&join_entry_locks[i]);return true; - -err_put: -spin_unlock_bh (&join_entry_locks[i]); -sock_put ((struct sock *)msk); -return false; }void __init mptcp_join_cookie_init (void )
net/mptcp/token.c +8 -3
@@ -232,6 +232,7 @@ bool mptcp_token_exists(u32 token)/** * mptcp_token_get_sock - retrieve mptcp connection sock using its token +* @net: restrict to this namespace * @token: token of the mptcp connection to retrieve * * This function returns the mptcp connection structure with the given token.
@@ -239,7 +240,7 @@ bool mptcp_token_exists(u32 token)* * returns NULL if no connection with the given token value exists. */ -struct mptcp_sock *mptcp_token_get_sock (u32 token) +struct mptcp_sock *mptcp_token_get_sock (struct net *net,u32 token) {struct hlist_nulls_node *pos;struct token_bucket *bucket;
@@ -252,11 +253,15 @@ struct mptcp_sock *mptcp_token_get_sock(u32 token) again:sk_nulls_for_each_rcu (sk, pos, &bucket->msk_chain) { msk =mptcp_sk (sk); -if (READ_ONCE (msk->token) != token) +if (READ_ONCE (msk->token) != token || + !net_eq (sock_net (sk), net))continue ; +if (!refcount_inc_not_zero (&sk->sk_refcnt)) goto not_found; -if (READ_ONCE (msk->token) != token) { + +if (READ_ONCE (msk->token) != token || + !net_eq (sock_net (sk), net)) {sock_put (sk); goto again; }
net/mptcp/token_test.c +8 -6
@@ -11,6 +11,7 @@ static struct mptcp_subflow_request_sock *build_req_sock(struct kunit *test) GFP_USER);KUNIT_EXPECT_NOT_ERR_OR_NULL (test, req);mptcp_token_init_request ((struct request_sock *)req); +sock_net_set ((struct sock *)req, &init_net);return req; }
@@ -22,7 +23,7 @@ static void mptcp_token_test_req_basic(struct kunit *test)KUNIT_ASSERT_EQ (test,0 ,mptcp_token_new_request ((struct request_sock *)req));KUNIT_EXPECT_NE (test,0 , (int )req->token); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (req->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, req->token));/* cleanup */ mptcp_token_destroy_request ((struct request_sock *)req);
@@ -55,6 +56,7 @@ static struct mptcp_sock *build_msk(struct kunit *test) msk =kunit_kzalloc (test,sizeof (struct mptcp_sock ),GFP_USER );KUNIT_EXPECT_NOT_ERR_OR_NULL (test, msk);refcount_set (&((struct sock *)msk)->sk_refcnt,1 ); +sock_net_set ((struct sock *)msk, &init_net);return msk; }
@@ -74,11 +76,11 @@ static void mptcp_token_test_msk_basic(struct kunit *test) mptcp_token_new_connect((struct sock *)icsk));KUNIT_EXPECT_NE (test,0 , (int )ctx->token);KUNIT_EXPECT_EQ (test, ctx->token, msk->token); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (ctx->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, ctx->token));KUNIT_EXPECT_EQ (test,2 , (int )refcount_read (&sk->sk_refcnt));mptcp_token_destroy (msk); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (ctx->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, ctx->token)); }static void mptcp_token_test_accept (struct kunit *test)
@@ -90,11 +92,11 @@ static void mptcp_token_test_accept(struct kunit *test) mptcp_token_new_request((struct request_sock *)req)); msk->token = req->token;mptcp_token_accept (req, msk); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, msk->token));/* this is now a no-op */ mptcp_token_destroy_request ((struct request_sock *)req); -KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, msk,mptcp_token_get_sock (&init_net, msk->token));/* cleanup */ mptcp_token_destroy (msk);
@@ -116,7 +118,7 @@ static void mptcp_token_test_destroyed(struct kunit *test)/* simulate race on removal */ refcount_set (&sk->sk_refcnt,0 ); -KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (msk->token)); +KUNIT_EXPECT_PTR_EQ (test, null_msk,mptcp_token_get_sock (&init_net, msk->token));/* cleanup */ mptcp_token_destroy (msk);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 37/93 hwmon: (tmp421) report /PVLD condition as fault
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
[ Upstream commit 540effa7f283d25bcc13c0940d808002fee340b8 ]
For both local and remote sensors all the supported ICs can report an "undervoltage lockout" condition which means the conversion wasn't properly performed due to insufficient power supply voltage and so the measurement results can't be trusted.
--- drivers/hwmon/tmp421.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/hwmon/tmp421.c +3 -6
@@ -179,10 +179,10 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,return 0 ;case hwmon_temp_fault:/* -* The OPEN bit signals a fault. This is bit 0 of the temperature -* register (low byte). +* Any of OPEN or /PVLD bits indicate a hardware mulfunction +* and the conversion result may be incorrect */ - *val = tmp421->temp[channel] &0x01 ; + *val = !!(tmp421->temp[channel] &0x03 );return 0 ;default :return -EOPNOTSUPP ;
@@ -195,9 +195,6 @@ static umode_t tmp421_is_visible(const void *data, enum hwmon_sensor_types type, {switch (attr) {case hwmon_temp_fault: -if (channel ==0 ) -return 0 ; -return 0444 ;case hwmon_temp_input:return 0444 ;default :
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 38/93 hwmon: (tmp421) fix rounding for negative values
In reply to Greg Kroah-HartmanFrom: Paul Fertser <[email protected]>
[ Upstream commit 724e8af85854c4d3401313b6dd7d79cf792d8990 ]
Old code produces -24999 for 0b1110011100000000 input in standard format due to always rounding up rather than "away from zero".
Use the common macro for division, unify and simplify the conversion code along the way.
--- drivers/hwmon/tmp421.c | 24 ++++++++---------------- 1 file changed, 8 insertions(+), 16 deletions(-)
drivers/hwmon/tmp421.c +8 -16
@@ -100,23 +100,17 @@ struct tmp421_data {s16 temp[4 ]; }; -static int temp_from_s16 (s16 reg) +static int temp_from_raw (u16 reg,bool extended) {/* Mask out status bits */ int temp = reg & ~0xf ; -return (temp *1000 +128 ) /256 ; -} - -static int temp_from_u16 (u16 reg) -{ -/* Mask out status bits */ -int temp = reg & ~0xf ; - -/* Add offset for extended temperature range. */ - temp -=64 *256 ; +if (extended) + temp = temp -64 *256 ; +else + temp = (s16 )temp; -return (temp *1000 +128 ) /256 ; +return DIV_ROUND_CLOSEST (temp *1000 ,256 ); }static int tmp421_update_device (struct tmp421_data *data)
@@ -172,10 +166,8 @@ static int tmp421_read(struct device *dev, enum hwmon_sensor_types type,switch (attr) {case hwmon_temp_input: -if (tmp421->config &TMP421_CONFIG_RANGE ) - *val =temp_from_u16 (tmp421->temp[channel]); -else - *val =temp_from_s16 (tmp421->temp[channel]); + *val =temp_from_raw (tmp421->temp[channel], + tmp421->config &TMP421_CONFIG_RANGE );return 0 ;case hwmon_temp_fault:/*
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 39/93 net: enetc: fix the incorrect clearing of IF_MODE bits
In reply to Greg Kroah-HartmanFrom: Vladimir Oltean <[email protected]>
[ Upstream commit 325fd36ae76a6d089983b2d2eccb41237d35b221 ]
The enetc phylink .mac_config handler intends to clear the IFMODE field (bits 1:0) of the PM0_IF_MODE register, but incorrectly clears all the other fields instead.
For normal operation, the bug was inconsequential, due to the fact that we write the PM0_IF_MODE register in two stages, first in phylink .mac_config (which incorrectly cleared out a bunch of stuff), then we update the speed and duplex to the correct values in phylink .mac_link_up.
Judging by the code (not tested), it looks like maybe loopback mode was broken, since this is one of the settings in PM0_IF_MODE which is incorrectly cleared.
--- drivers/net/ethernet/freescale/enetc/enetc_pf.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
drivers/net/ethernet/freescale/enetc/enetc_pf.c +1 -2
@@ -504,8 +504,7 @@ static void enetc_mac_config(struct enetc_hw *hw, phy_interface_t phy_mode)if (phy_interface_mode_is_rgmii (phy_mode)) { val =enetc_port_rd (hw,ENETC_PM0_IF_MODE ); - val &= ~ENETC_PM0_IFM_EN_AUTO ; - val &=ENETC_PM0_IFM_IFMODE_MASK ; + val &= ~(ENETC_PM0_IFM_EN_AUTO |ENETC_PM0_IFM_IFMODE_MASK ); val |=ENETC_PM0_IFM_IFMODE_GMII |ENETC_PM0_IFM_RG ;enetc_port_wr (hw,ENETC_PM0_IF_MODE , val); }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 40/93 net: ipv4: Fix rtnexthop len when RTA_FLOW is present
In reply to Greg Kroah-HartmanFrom: Xiao Liang <[email protected]>
[ Upstream commit 597aa16c782496bf74c5dc3b45ff472ade6cee64 ]
Multipath RTA_FLOW is embedded in nexthop. Dump it in fib_add_nexthop() to get the length of rtnexthop correct.
--- include/net/ip_fib.h | 2 +- include/net/nexthop.h | 2 +- net/ipv4/fib_semantics.c | 16 +++++++++------- net/ipv6/route.c | 5 +++-- 4 files changed, 14 insertions(+), 11 deletions(-)
include/net/ip_fib.h +1 -1
@@ -553,5 +553,5 @@ int ip_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,int fib_nexthop_info (struct sk_buff *skb,const struct fib_nh_common *nh,u8 rt_family,unsigned char *flags,bool skip_oif);int fib_add_nexthop (struct sk_buff *skb,const struct fib_nh_common *nh, -int nh_weight,u8 rt_family); +int nh_weight,u8 rt_family,u32 nh_tclassid);#endif /* _NET_FIB_H */
include/net/nexthop.h +1 -1
@@ -211,7 +211,7 @@ int nexthop_mpath_fill_node(struct sk_buff *skb, struct nexthop *nh,struct fib_nh_common *nhc = &nhi->fib_nhc;int weight = nhg->nh_entries[i].weight; -if (fib_add_nexthop (skb, nhc, weight, rt_family) <0 ) +if (fib_add_nexthop (skb, nhc, weight, rt_family,0 ) <0 )return -EMSGSIZE ; }
net/ipv4/fib_semantics.c +9 -7
@@ -1663,7 +1663,7 @@ EXPORT_SYMBOL_GPL(fib_nexthop_info);#if IS_ENABLED (CONFIG_IP_ROUTE_MULTIPATH ) ||IS_ENABLED (CONFIG_IPV6 )int fib_add_nexthop (struct sk_buff *skb,const struct fib_nh_common *nhc, -int nh_weight,u8 rt_family) +int nh_weight,u8 rt_family,u32 nh_tclassid) {const struct net_device *dev = nhc->nhc_dev;struct rtnexthop *rtnh;
@@ -1681,6 +1681,9 @@ int fib_add_nexthop(struct sk_buff *skb, const struct fib_nh_common *nhc, rtnh->rtnh_flags = flags; +if (nh_tclassid &&nla_put_u32 (skb,RTA_FLOW , nh_tclassid)) + goto nla_put_failure; +/* length of rtnetlink header + attributes */ rtnh->rtnh_len =nlmsg_get_pos (skb) - (void *)rtnh;
@@ -1708,14 +1711,13 @@ static int fib_add_multipath(struct sk_buff *skb, struct fib_info *fi) }for_nexthops (fi) { -if (fib_add_nexthop (skb, &nh->nh_common, nh->fib_nh_weight, -AF_INET ) <0 ) - goto nla_put_failure; +u32 nh_tclassid =0 ;#ifdef CONFIG_IP_ROUTE_CLASSID -if (nh->nh_tclassid && -nla_put_u32 (skb,RTA_FLOW , nh->nh_tclassid)) - goto nla_put_failure; + nh_tclassid = nh->nh_tclassid;#endif +if (fib_add_nexthop (skb, &nh->nh_common, nh->fib_nh_weight, +AF_INET , nh_tclassid) <0 ) + goto nla_put_failure; }endfor_nexthops (fi); mp_end:
net/ipv6/route.c +3 -2
@@ -5566,14 +5566,15 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb, goto nla_put_failure;if (fib_add_nexthop (skb, &rt->fib6_nh->nh_common, - rt->fib6_nh->fib_nh_weight,AF_INET6 ) <0 ) + rt->fib6_nh->fib_nh_weight,AF_INET6 , +0 ) <0 ) goto nla_put_failure;list_for_each_entry_safe (sibling, next_sibling, &rt->fib6_siblings, fib6_siblings) {if (fib_add_nexthop (skb, &sibling->fib6_nh->nh_common, sibling->fib6_nh->fib_nh_weight, -AF_INET6 ) <0 ) +AF_INET6 ,0 ) <0 ) goto nla_put_failure; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 41/93 smsc95xx: fix stalled rx after link change
In reply to Greg Kroah-HartmanFrom: Aaro Koskinen <[email protected]>
[ Upstream commit 5ab8a447bcfee1ded709e7ff5dc7608ca9f66ae2 ]
After commit 05b35e7eb9a1 ("smsc95xx: add phylib support"), link changes are no longer propagated to usbnet. As a result, rx URB allocation won't happen until there is a packet sent out first (this might never happen, e.g. running just ssh server with a static IP). Fix by triggering usbnet EVENT_LINK_CHANGE.
--- drivers/net/usb/smsc95xx.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/net/usb/smsc95xx.c +3 -0
@@ -1178,7 +1178,10 @@ static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)static void smsc95xx_handle_link_change (struct net_device *net) { +struct usbnet *dev =netdev_priv (net); +phy_print_status (net->phydev); +usbnet_defer_kevent (dev,EVENT_LINK_CHANGE ); }static int smsc95xx_start_phy (struct usbnet *dev)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 42/93 drm/i915/request: fix early tracepoints
In reply to Greg Kroah-HartmanFrom: Matthew Auld <[email protected]>
[ Upstream commit c83ff0186401169eb27ce5057d820b7a863455c3 ]
Currently we blow up in trace_dma_fence_init, when calling into get_driver_name or get_timeline_name, since both the engine and context might be NULL(or contain some garbage address) in the case of newly allocated slab objects via the request ctor. Note that we also use SLAB_TYPESAFE_BY_RCU here, which allows requests to be immediately freed, but delay freeing the underlying page by an RCU grace period. With this scheme requests can be re-allocated, at the same time as they are also being read by some lockless RCU lookup mechanism.
In the ctor case, which is only called for new slab objects(i.e allocate new page and call the ctor for each object) it's safe to reset the context/engine prior to calling into dma_fence_init, since we can be certain that no one is doing an RCU lookup which might depend on peeking at the engine/context, like in active_engine(), since the object can't yet be externally visible.
In the recycled case(which might also be externally visible) the request refcount always transitions from 0->1 after we set the context/engine etc, which should ensure it's valid to dereference the engine for example, when doing an RCU list-walk, so long as we can also increment the refcount first. If the refcount is already zero, then the request is considered complete/released. If it's non-zero, then the request might be in the process of being re-allocated, or potentially still in flight, however after successfully incrementing the refcount, it's possible to carefully inspect the request state, to determine if the request is still what we were looking for. Note that all externally visible requests returned to the cache must have zero refcount.
One possible fix then is to move dma_fence_init out from the request ctor. Originally this was how it was done, but it was moved in:
commit 855e39e65cfc33a73724f1cc644ffc5754864a20
Author: Chris Wilson <[email protected]> Date: Mon Feb 3 09:41:48 2020 +0000
drm/i915: Initialise basic fence before acquiring seqno
where it looks like intel_timeline_get_seqno() relied on some of the rq->fence state, but that is no longer the case since:
commit 12ca695d2c1ed26b2dcbb528b42813bd0f216cfc
Author: Maarten Lankhorst <[email protected]> Date: Tue Mar 23 16:49:50 2021 +0100
drm/i915: Do not share hwsp across contexts any more, v8.
intel_timeline_get_seqno() could also be cleaned up slightly by dropping the request argument.
Moving dma_fence_init back out of the ctor, should ensure we have enough of the request initialised in case of trace_dma_fence_init. Functionally this should be the same, and is effectively what we were already open coding before, except now we also assign the fence->lock and fence->ops, but since these are invariant for recycled requests(which might be externally visible), and will therefore already hold the same value, it shouldn't matter.
An alternative fix, since we don't yet have a fully initialised request when in the ctor, is just setting the context/engine as NULL, but this does require adding some extra handling in get_driver_name etc.
v2(Daniel):
- Try to make the commit message less confusing
--- drivers/gpu/drm/i915/i915_request.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-)
drivers/gpu/drm/i915/i915_request.c +2 -9
@@ -776,8 +776,6 @@ static void __i915_request_ctor(void *arg)i915_sw_fence_init (&rq->submit, submit_notify);i915_sw_fence_init (&rq->semaphore, semaphore_notify); -dma_fence_init (&rq->fence, &i915_fence_ops, &rq->lock,0 ,0 ); - rq->capture_list =NULL ;init_llist_head (&rq->execute_cb);
@@ -840,17 +838,12 @@ __i915_request_create(struct intel_context *ce, gfp_t gfp) rq->ring = ce->ring; rq->execution_mask = ce->engine->mask; -kref_init (&rq->fence.refcount); - rq->fence.flags =0 ; - rq->fence.error =0 ; -INIT_LIST_HEAD (&rq->fence.cb_list); - ret =intel_timeline_get_seqno (tl, rq, &seqno);if (ret) goto err_free; - rq->fence.context = tl->fence_context; - rq->fence.seqno = seqno; +dma_fence_init (&rq->fence, &i915_fence_ops, &rq->lock, + tl->fence_context, seqno);RCU_INIT_POINTER (rq->timeline, tl);RCU_INIT_POINTER (rq->hwsp_cacheline, tl->hwsp_cacheline);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 43/93 dsa: mv88e6xxx: 6161: Use chip wide MAX MTU
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit fe23036192c95b66e60d019d2ec1814d0d561ffd ]
The datasheets suggests the 6161 uses a per port setting for jumbo frames. Testing has however shown this is not correct, it uses the old style chip wide MTU control. Change the ops in the 6161 structure to reflect this.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/dsa/mv88e6xxx/chip.c +1 -1
@@ -3455,7 +3455,6 @@ static const struct mv88e6xxx_ops mv88e6161_ops = { .port_set_frame_mode = mv88e6351_port_set_frame_mode, .port_set_egress_floods = mv88e6352_port_set_egress_floods, .port_set_ether_type = mv88e6351_port_set_ether_type, - .port_set_jumbo_size = mv88e6165_port_set_jumbo_size, .port_egress_rate_limiting = mv88e6097_port_egress_rate_limiting, .port_pause_limit = mv88e6097_port_pause_limit, .port_disable_learn_limit = mv88e6xxx_port_disable_learn_limit,
@@ -3480,6 +3479,7 @@ static const struct mv88e6xxx_ops mv88e6161_ops = { .avb_ops = &mv88e6165_avb_ops, .ptp_ops = &mv88e6165_ptp_ops, .phylink_validate = mv88e6185_phylink_validate, + .set_max_frame_size = mv88e6185_g1_set_max_frame_size, };static const struct mv88e6xxx_ops mv88e6165_ops = {
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 44/93 dsa: mv88e6xxx: Fix MTU definition
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit b92ce2f54c0f0ff781e914ec189c25f7bf1b1ec2 ]
The MTU passed to the DSA driver is the payload size, typically 1500. However, the switch uses the frame size when applying restrictions. Adjust the MTU with the size of the Ethernet header and the frame checksum. The VLAN header also needs to be included when the frame size it per port, but not when it is global.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 12 ++++++------ drivers/net/dsa/mv88e6xxx/global1.c | 2 ++ drivers/net/dsa/mv88e6xxx/port.c | 2 ++ 3 files changed, 10 insertions(+), 6 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +6 -6
@@ -2613,8 +2613,8 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)if (err)return err; -/* Port Control 2: don't force a good FCS, set the maximum frame size to -* 10240 bytes, disable 802.1q tags checking, don't discard tagged or +/* Port Control 2: don't force a good FCS, set the MTU size to +* 10222 bytes, disable 802.1q tags checking, don't discard tagged or * untagged frames on this port, do a destination address lookup on all * received packets as usual, disable ARP mirroring and don't send a * copy of all transmitted/received frames on this port to the CPU.
@@ -2633,7 +2633,7 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port)return err;if (chip->info->ops->port_set_jumbo_size) { - err = chip->info->ops->port_set_jumbo_size (chip, port,10240 ); + err = chip->info->ops->port_set_jumbo_size (chip, port,10218 );if (err)return err; }
@@ -2718,10 +2718,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)struct mv88e6xxx_chip *chip = ds->priv;if (chip->info->ops->port_set_jumbo_size) -return 10240 ; +return 10240 -VLAN_ETH_HLEN -ETH_FCS_LEN ;else if (chip->info->ops->set_max_frame_size) -return 1632 ; -return 1522 ; +return 1632 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 1522 -VLAN_ETH_HLEN -ETH_FCS_LEN ; }static int mv88e6xxx_change_mtu (struct dsa_switch *ds,int port,int new_mtu)
drivers/net/dsa/mv88e6xxx/global1.c +2 -0
@@ -232,6 +232,8 @@ int mv88e6185_g1_set_max_frame_size(struct mv88e6xxx_chip *chip, int mtu)u16 val;int err; + mtu +=ETH_HLEN +ETH_FCS_LEN ; + err =mv88e6xxx_g1_read (chip,MV88E6XXX_G1_CTL1 , &val);if (err)return err;
drivers/net/dsa/mv88e6xxx/port.c +2 -0
@@ -1082,6 +1082,8 @@ int mv88e6165_port_set_jumbo_size(struct mv88e6xxx_chip *chip, int port,u16 reg;int err; + size +=VLAN_ETH_HLEN +ETH_FCS_LEN ; + err =mv88e6xxx_port_read (chip, port,MV88E6XXX_PORT_CTL2 , ®);if (err)return err;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 45/93 dsa: mv88e6xxx: Include tagger overhead when setting MTU for DSA and CPU ports
In reply to Greg Kroah-HartmanFrom: Andrew Lunn <[email protected]>
[ Upstream commit b9c587fed61cf88bd45822c3159644445f6d5aa6 ]
Same members of the Marvell Ethernet switches impose MTU restrictions on ports used for connecting to the CPU or another switch for DSA. If the MTU is set too low, tagged frames will be discarded. Ensure the worst case tagger overhead is included in setting the MTU for DSA and CPU ports.
Reported by: 曹煜 <[email protected]>
--- drivers/net/dsa/mv88e6xxx/chip.c | 9 ++++++--- drivers/net/dsa/mv88e6xxx/chip.h | 1 + 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/dsa/mv88e6xxx/chip.c +6 -3
@@ -2718,10 +2718,10 @@ static int mv88e6xxx_get_max_mtu(struct dsa_switch *ds, int port)struct mv88e6xxx_chip *chip = ds->priv;if (chip->info->ops->port_set_jumbo_size) -return 10240 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 10240 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ;else if (chip->info->ops->set_max_frame_size) -return 1632 -VLAN_ETH_HLEN -ETH_FCS_LEN ; -return 1522 -VLAN_ETH_HLEN -ETH_FCS_LEN ; +return 1632 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; +return 1522 -VLAN_ETH_HLEN -EDSA_HLEN -ETH_FCS_LEN ; }static int mv88e6xxx_change_mtu (struct dsa_switch *ds,int port,int new_mtu)
@@ -2729,6 +2729,9 @@ static int mv88e6xxx_change_mtu(struct dsa_switch *ds, int port, int new_mtu)struct mv88e6xxx_chip *chip = ds->priv;int ret =0 ; +if (dsa_is_dsa_port (ds, port) ||dsa_is_cpu_port (ds, port)) + new_mtu +=EDSA_HLEN ; +mv88e6xxx_reg_lock (chip);if (chip->info->ops->port_set_jumbo_size) ret = chip->info->ops->port_set_jumbo_size (chip, port, new_mtu);
drivers/net/dsa/mv88e6xxx/chip.h +1 -0
@@ -18,6 +18,7 @@#include <linux/timecounter.h> #include <net/dsa.h> +#define EDSA_HLEN 8#define MV88E6XXX_N_FID 4096/* PVT limits for 4-bit port and 5-bit switch */
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 46/93 e100: fix length calculation in e100_get_regs_len
In reply to Greg Kroah-HartmanFrom: Jacob Keller <[email protected]>
[ Upstream commit 4329c8dc110b25d5f04ed20c6821bb60deff279f ]
commit abf9b902059f ("e100: cleanup unneeded math") tried to simplify e100_get_regs_len and remove a double 'divide and then multiply' calculation that the e100_reg_regs_len function did.
This change broke the size calculation entirely as it failed to account for the fact that the numbered registers are actually 4 bytes wide and not 1 byte. This resulted in a significant under allocation of the register buffer used by e100_get_regs.
Fix this by properly multiplying the register count by u32 first before adding the size of the dump buffer.
--- drivers/net/ethernet/intel/e100.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/net/ethernet/intel/e100.c +5 -1
@@ -2435,7 +2435,11 @@ static void e100_get_drvinfo(struct net_device *netdev,static int e100_get_regs_len (struct net_device *netdev) {struct nic *nic =netdev_priv (netdev); -return 1 +E100_PHY_REGS +sizeof (nic->mem->dump_buf); + +/* We know the number of registers, and the size of the dump buffer. +* Calculate the total size in bytes. +*/ +return (1 +E100_PHY_REGS ) *sizeof (u32) +sizeof (nic->mem->dump_buf); } static void e100_get_regs(struct net_device *netdev,
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 47/93 e100: fix buffer overrun in e100_get_regs
In reply to Greg Kroah-HartmanFrom: Jacob Keller <[email protected]>
[ Upstream commit 51032e6f17ce990d06123ad7307f258c50d25aa7 ]
The e100_get_regs function is used to implement a simple register dump for the e100 device. The data is broken into a couple of MAC control registers, and then a series of PHY registers, followed by a memory dump buffer.
The total length of the register dump is defined as (1 + E100_PHY_REGS)
* sizeof(u32) + sizeof(nic->mem->dump_buf).
The logic for filling in the PHY registers uses a convoluted inverted count for loop which counts from E100_PHY_REGS (0x1C) down to 0, and assigns the slots 1 + E100_PHY_REGS - i. The first loop iteration will fill in [1] and the final loop iteration will fill in [1 + 0x1C]. This is actually one more than the supposed number of PHY registers.
The memory dump buffer is then filled into the space at
[2 + E100_PHY_REGS] which will cause that memcpy to assign 4 bytes past the total size.
The end result is that we overrun the total buffer size allocated by the kernel, which could lead to a panic or other issues due to memory corruption.
It is difficult to determine the actual total number of registers here. The only 8255x datasheet I could find indicates there are 28 total MDI registers. However, we're reading 29 here, and reading them in reverse!
In addition, the ethtool e100 register dump interface appears to read the first PHY register to determine if the device is in MDI or MDIx mode. This doesn't appear to be documented anywhere within the 8255x datasheet. I can only assume it must be in register 28 (the extra register we're reading here).
Lets not change any of the intended meaning of what we copy here. Just extend the space by 4 bytes to account for the extra register and continue copying the data out in the same order.
Change the E100_PHY_REGS value to be the correct total (29) so that the total register dump size is calculated properly. Fix the offset for where we copy the dump buffer so that it doesn't overrun the total size.
Re-write the for loop to use counting up instead of the convoluted down-counting. Correct the mdio_read offset to use the 0-based register offsets, but maintain the bizarre reverse ordering so that we have the ABI expected by applications like ethtool. This requires and additional subtraction of 1. It seems a bit odd but it makes the flow of assignment into the register buffer easier to follow.
--- drivers/net/ethernet/intel/e100.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-)
drivers/net/ethernet/intel/e100.c +10 -6
@@ -2431,7 +2431,7 @@ static void e100_get_drvinfo(struct net_device *netdev, sizeof(info->bus_info)); } -#define E100_PHY_REGS 0x1C +#define E100_PHY_REGS 0x1Dstatic int e100_get_regs_len (struct net_device *netdev) {struct nic *nic =netdev_priv (netdev);
@@ -2453,14 +2453,18 @@ static void e100_get_regs(struct net_device *netdev, buff[0 ] =ioread8 (&nic->csr->scb.cmd_hi) <<24 |ioread8 (&nic->csr->scb.cmd_lo) <<16 |ioread16 (&nic->csr->scb.status); -for (i =E100_PHY_REGS ; i >=0 ; i--) - buff[1 +E100_PHY_REGS - i] = -mdio_read (netdev, nic->mii.phy_id, i); +for (i =0 ; i <E100_PHY_REGS ; i++) +/* Note that we read the registers in reverse order. This +* ordering is the ABI apparently used by ethtool and other +* applications. +*/ + buff[1 + i] =mdio_read (netdev, nic->mii.phy_id, +E100_PHY_REGS -1 - i);memset (nic->mem->dump_buf,0 ,sizeof (nic->mem->dump_buf));e100_exec_cb (nic,NULL , e100_dump);msleep (10 ); -memcpy (&buff[2 +E100_PHY_REGS ], nic->mem->dump_buf, -sizeof (nic->mem->dump_buf)); +memcpy (&buff[1 +E100_PHY_REGS ], nic->mem->dump_buf, +sizeof (nic->mem->dump_buf)); }static void e100_get_wol (struct net_device *netdev,struct ethtool_wolinfo *wol)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 48/93 RDMA/hns: Fix inaccurate prints
In reply to Greg Kroah-HartmanFrom: Yixing Liu <[email protected]>
[ Upstream commit 61918e9b008492f48577692428aca3cebf56111a ]
Some %d in print format string should be %u, and some prints miss the useful errno or are in nonstandard format. Just fix above issues.
--- drivers/infiniband/hw/hns/hns_roce_alloc.c | 4 +- drivers/infiniband/hw/hns/hns_roce_cq.c | 35 +++++++------ drivers/infiniband/hw/hns/hns_roce_hem.c | 18 +++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 30 +++++------ drivers/infiniband/hw/hns/hns_roce_mr.c | 10 ++-- drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +- drivers/infiniband/hw/hns/hns_roce_qp.c | 61 +++++++++++++--------- drivers/infiniband/hw/hns/hns_roce_srq.c | 37 +++++++------ 8 files changed, 107 insertions(+), 90 deletions(-)
drivers/infiniband/hw/hns/hns_roce_alloc.c +2 -2
@@ -240,7 +240,7 @@ int hns_roce_get_kmem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs, end = start + buf_cnt;if (end > buf->npages) {dev_err (hr_dev->dev, -"Failed to check kmem bufs, end %d + %d total %d!\n" , +"failed to check kmem bufs, end %d + %d total %u!\n" , start, buf_cnt, buf->npages);return -EINVAL ; }
@@ -262,7 +262,7 @@ int hns_roce_get_umem_bufs(struct hns_roce_dev *hr_dev, dma_addr_t *bufs,u64 addr;if (page_shift <HNS_HW_PAGE_SHIFT ) { -dev_err (hr_dev->dev,"Failed to check umem page shift %d!\n" , +dev_err (hr_dev->dev,"failed to check umem page shift %u!\n" , page_shift);return -EINVAL ; }
drivers/infiniband/hw/hns/hns_roce_cq.c +18 -17
@@ -50,29 +50,29 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq) ret =hns_roce_mtr_find (hr_dev, &hr_cq->mtr,0 , mtts,ARRAY_SIZE (mtts), &dma_handle); -if (ret <1 ) { -ibdev_err (ibdev,"Failed to find CQ mtr\n" ); +if (!ret) { +ibdev_err (ibdev,"failed to find CQ mtr, ret = %d.\n" , ret);return -EINVAL ; } cq_table = &hr_dev->cq_table; ret =hns_roce_bitmap_alloc (&cq_table->bitmap, &hr_cq->cqn);if (ret) { -ibdev_err (ibdev,"Failed to alloc CQ bitmap, err %d\n" , ret); +ibdev_err (ibdev,"failed to alloc CQ bitmap, ret = %d.\n" , ret);return ret; }/* Get CQC memory HEM(Hardware Entry Memory) table */ ret =hns_roce_table_get (hr_dev, &cq_table->table, hr_cq->cqn);if (ret) { -ibdev_err (ibdev,"Failed to get CQ(0x%lx) context, err %d\n" , +ibdev_err (ibdev,"failed to get CQ(0x%lx) context, ret = %d.\n" , hr_cq->cqn, ret); goto err_out; } ret =xa_err (xa_store (&cq_table->array, hr_cq->cqn, hr_cq,GFP_KERNEL ));if (ret) { -ibdev_err (ibdev,"Failed to xa_store CQ\n" ); +ibdev_err (ibdev,"failed to xa_store CQ, ret = %d.\n" , ret); goto err_put; }
@@ -91,7 +91,7 @@ static int alloc_cqc(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq)hns_roce_free_cmd_mailbox (hr_dev, mailbox);if (ret) {ibdev_err (ibdev, -"Failed to send create cmd for CQ(0x%lx), err %d\n" , +"failed to send create cmd for CQ(0x%lx), ret = %d.\n" , hr_cq->cqn, ret); goto err_xa; }
@@ -147,7 +147,7 @@ static int alloc_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq, {struct ib_device *ibdev = &hr_dev->ib_dev;struct hns_roce_buf_attr buf_attr = {}; -int err; +int ret; buf_attr.page_shift = hr_dev->caps.cqe_buf_pg_sz +HNS_HW_PAGE_SHIFT ; buf_attr.region[0 ].size = hr_cq->cq_depth * hr_cq->cqe_size;
@@ -155,13 +155,13 @@ static int alloc_cq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_cq *hr_cq, buf_attr.region_count =1 ; buf_attr.fixed_page = true; - err =hns_roce_mtr_create (hr_dev, &hr_cq->mtr, &buf_attr, + ret =hns_roce_mtr_create (hr_dev, &hr_cq->mtr, &buf_attr, hr_dev->caps.cqe_ba_pg_sz +HNS_HW_PAGE_SHIFT , udata, addr); -if (err) -ibdev_err (ibdev,"Failed to alloc CQ mtr, err %d\n" , err); +if (ret) +ibdev_err (ibdev,"failed to alloc CQ mtr, ret = %d.\n" , ret); -return err; +return ret; }static void free_cq_buf (struct hns_roce_dev *hr_dev,struct hns_roce_cq *hr_cq)
@@ -252,13 +252,13 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr,int ret;if (cq_entries <1 || cq_entries > hr_dev->caps.max_cqes) { -ibdev_err (ibdev,"Failed to check CQ count %d max=%d\n" , +ibdev_err (ibdev,"failed to check CQ count %u, max = %u.\n" , cq_entries, hr_dev->caps.max_cqes);return -EINVAL ; }if (vector >= hr_dev->caps.num_comp_vectors) { -ibdev_err (ibdev,"Failed to check CQ vector=%d max=%d\n" , +ibdev_err (ibdev,"failed to check CQ vector = %d, max = %d.\n" , vector, hr_dev->caps.num_comp_vectors);return -EINVAL ; }
@@ -276,7 +276,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr, ret =ib_copy_from_udata (&ucmd, udata,min (udata->inlen,sizeof (ucmd)));if (ret) { -ibdev_err (ibdev,"Failed to copy CQ udata, err %d\n" , +ibdev_err (ibdev,"failed to copy CQ udata, ret = %d.\n" , ret);return ret; }
@@ -286,19 +286,20 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr, ret =alloc_cq_buf (hr_dev, hr_cq, udata, ucmd.buf_addr);if (ret) { -ibdev_err (ibdev,"Failed to alloc CQ buf, err %d\n" , ret); +ibdev_err (ibdev,"failed to alloc CQ buf, ret = %d.\n" , ret);return ret; } ret =alloc_cq_db (hr_dev, hr_cq, udata, ucmd.db_addr, &resp);if (ret) { -ibdev_err (ibdev,"Failed to alloc CQ db, err %d\n" , ret); +ibdev_err (ibdev,"failed to alloc CQ db, ret = %d.\n" , ret); goto err_cq_buf; } ret =alloc_cqc (hr_dev, hr_cq);if (ret) { -ibdev_err (ibdev,"Failed to alloc CQ context, err %d\n" , ret); +ibdev_err (ibdev, +"failed to alloc CQ context, ret = %d.\n" , ret); goto err_cq_db; }
drivers/infiniband/hw/hns/hns_roce_hem.c +9 -9
@@ -184,7 +184,7 @@ static int get_hem_table_config(struct hns_roce_dev *hr_dev, mhop->hop_num = hr_dev->caps.srqc_hop_num;break ;default : -dev_err (dev,"Table %d not support multi-hop addressing!\n" , +dev_err (dev,"table %u not support multi-hop addressing!\n" , type);return -EINVAL ; }
@@ -232,8 +232,8 @@ int hns_roce_calc_hem_mhop(struct hns_roce_dev *hr_dev, mhop->l0_idx = table_idx;break ;default : -dev_err (dev,"Table %d not support hop_num = %d!\n" , - table->type, mhop->hop_num); +dev_err (dev,"table %u not support hop_num = %u!\n" , + table->type, mhop->hop_num);return -EINVAL ; }if (mhop->l0_idx >= mhop->ba_l0_num)
@@ -438,13 +438,13 @@ static int calc_hem_config(struct hns_roce_dev *hr_dev, index->buf = l0_idx;break ;default : -ibdev_err (ibdev,"Table %d not support mhop.hop_num = %d!\n" , +ibdev_err (ibdev,"table %u not support mhop.hop_num = %u!\n" , table->type, mhop->hop_num);return -EINVAL ; }if (unlikely (index->buf >= table->num_hem)) { -ibdev_err (ibdev,"Table %d exceed hem limt idx %llu,max %lu!\n" , +ibdev_err (ibdev,"table %u exceed hem limt idx %llu, max %lu!\n" , table->type, index->buf, table->num_hem);return -EINVAL ; }
@@ -714,15 +714,15 @@ static void clear_mhop_hem(struct hns_roce_dev *hr_dev, step_idx = hop_num;if (hr_dev->hw->clear_hem (hr_dev, table, obj, step_idx)) -ibdev_warn (ibdev,"Clear hop%d HEM failed.\n" , hop_num); +ibdev_warn (ibdev,"failed to clear hop%u HEM.\n" , hop_num);if (index->inited &HEM_INDEX_L1 )if (hr_dev->hw->clear_hem (hr_dev, table, obj,1 )) -ibdev_warn (ibdev,"Clear HEM step 1 failed.\n" ); +ibdev_warn (ibdev,"failed to clear HEM step 1.\n" );if (index->inited &HEM_INDEX_L0 )if (hr_dev->hw->clear_hem (hr_dev, table, obj,0 )) -ibdev_warn (ibdev,"Clear HEM step 0 failed.\n" ); +ibdev_warn (ibdev,"failed to clear HEM step 0.\n" ); } }
@@ -1234,7 +1234,7 @@ static int hem_list_alloc_mid_bt(struct hns_roce_dev *hr_dev, }if (offset < r->offset) { -dev_err (hr_dev->dev,"invalid offset %d,min %d!\n" , +dev_err (hr_dev->dev,"invalid offset %d, min %u!\n" , offset, r->offset);return -EINVAL ; }
drivers/infiniband/hw/hns/hns_roce_hw_v2.c +15 -15
@@ -361,7 +361,7 @@ static int check_send_valid(struct hns_roce_dev *hr_dev, }else if (unlikely (hr_qp->state ==IB_QPS_RESET || hr_qp->state ==IB_QPS_INIT || hr_qp->state ==IB_QPS_RTR )) { -ibdev_err (ibdev,"failed to post WQE, QP state %d!\n" , +ibdev_err (ibdev,"failed to post WQE, QP state %hhu!\n" , hr_qp->state);return -EINVAL ; }else if (unlikely (hr_dev->state >=HNS_ROCE_DEVICE_STATE_RST_DOWN )) {
@@ -665,7 +665,7 @@ static int hns_roce_v2_post_send(struct ib_qp *ibqp, wqe_idx = (qp->sq.head + nreq) & (qp->sq.wqe_cnt -1 );if (unlikely (wr->num_sge > qp->sq.max_gs)) { -ibdev_err (ibdev,"num_sge=%d > qp->sq.max_gs=%d\n" , +ibdev_err (ibdev,"num_sge = %d > qp->sq.max_gs = %u.\n" , wr->num_sge, qp->sq.max_gs); ret = -EINVAL ; *bad_wr = wr;
@@ -750,7 +750,7 @@ static int hns_roce_v2_post_recv(struct ib_qp *ibqp, wqe_idx = (hr_qp->rq.head + nreq) & (hr_qp->rq.wqe_cnt -1 );if (unlikely (wr->num_sge > hr_qp->rq.max_gs)) { -ibdev_err (ibdev,"rq:num_sge=%d >= qp->sq.max_gs=%d\n" , +ibdev_err (ibdev,"num_sge = %d >= max_sge = %u.\n" , wr->num_sge, hr_qp->rq.max_gs); ret = -EINVAL ; *bad_wr = wr;
@@ -1920,8 +1920,8 @@ static void calc_pg_sz(int obj_num, int obj_size, int hop_num, int ctx_bt_num, obj_per_chunk = ctx_bt_num * obj_per_chunk_default;break ;default : -pr_err ("Table %d not support hop_num = %d!\n" , hem_type, - hop_num); +pr_err ("table %u not support hop_num = %u!\n" , hem_type, + hop_num);return ; }
@@ -3562,7 +3562,7 @@ static int get_op_for_set_hem(struct hns_roce_dev *hr_dev, u32 type,break ;default :dev_warn (hr_dev->dev, -"Table %d not to be written by mailbox!\n" , type); +"table %u not to be written by mailbox!\n" , type);return -EINVAL ; }
@@ -3681,7 +3681,7 @@ static int hns_roce_v2_clear_hem(struct hns_roce_dev *hr_dev, op =HNS_ROCE_CMD_DESTROY_SRQC_BT0 ;break ;default : -dev_warn (dev,"Table %d not to be destroyed by mailbox!\n" , +dev_warn (dev,"table %u not to be destroyed by mailbox!\n" , table->type);return 0 ; }
@@ -4318,7 +4318,7 @@ static int modify_qp_rtr_to_rts(struct ib_qp *ibqp, ret =config_qp_sq_buf (hr_dev, hr_qp, context, qpc_mask);if (ret) { -ibdev_err (ibdev,"failed to config sq buf, ret %d\n" , ret); +ibdev_err (ibdev,"failed to config sq buf, ret = %d.\n" , ret);return ret; }
@@ -4804,7 +4804,7 @@ static int hns_roce_v2_modify_qp(struct ib_qp *ibqp,/* SW pass context to HW */ ret =hns_roce_v2_qp_modify (hr_dev, context, qpc_mask, hr_qp);if (ret) { -ibdev_err (ibdev,"failed to modify QP, ret = %d\n" , ret); +ibdev_err (ibdev,"failed to modify QP, ret = %d.\n" , ret); goto out; }
@@ -4897,7 +4897,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, ret =hns_roce_v2_query_qpc (hr_dev, hr_qp, &context);if (ret) { -ibdev_err (ibdev,"failed to query QPC, ret = %d\n" , ret); +ibdev_err (ibdev,"failed to query QPC, ret = %d.\n" , ret); ret = -EINVAL ; goto out; }
@@ -5018,7 +5018,7 @@ static int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, hr_qp->state, IB_QPS_RESET);if (ret)ibdev_err (ibdev, -"failed to modify QP to RST, ret = %d\n" , +"failed to modify QP to RST, ret = %d.\n" , ret); }
@@ -5057,7 +5057,7 @@ static int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) ret =hns_roce_v2_destroy_qp_common (hr_dev, hr_qp, udata);if (ret)ibdev_err (&hr_dev->ib_dev, -"failed to destroy QP 0x%06lx, ret = %d\n" , +"failed to destroy QP, QPN = 0x%06lx, ret = %d.\n" , hr_qp->qpn, ret);hns_roce_qp_destroy (hr_dev, hr_qp, udata);
@@ -5080,7 +5080,7 @@ static int hns_roce_v2_qp_flow_control_init(struct hns_roce_dev *hr_dev,hns_roce_cmq_setup_basic_desc (&desc,HNS_ROCE_OPC_RESET_SCCC , false); ret =hns_roce_cmq_send (hr_dev, &desc,1 );if (ret) { -ibdev_err (ibdev,"failed to reset SCC ctx, ret = %d\n" , ret); +ibdev_err (ibdev,"failed to reset SCC ctx, ret = %d.\n" , ret); goto out; }
@@ -5090,7 +5090,7 @@ static int hns_roce_v2_qp_flow_control_init(struct hns_roce_dev *hr_dev, clr->qpn =cpu_to_le32 (hr_qp->qpn); ret =hns_roce_cmq_send (hr_dev, &desc,1 );if (ret) { -ibdev_err (ibdev,"failed to clear SCC ctx, ret = %d\n" , ret); +ibdev_err (ibdev,"failed to clear SCC ctx, ret = %d.\n" , ret); goto out; }
@@ -5339,7 +5339,7 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period)hns_roce_free_cmd_mailbox (hr_dev, mailbox);if (ret)ibdev_err (&hr_dev->ib_dev, -"failed to process cmd when modifying CQ, ret = %d\n" , +"failed to process cmd when modifying CQ, ret = %d.\n" , ret);return ret;
drivers/infiniband/hw/hns/hns_roce_mr.c +5 -5
@@ -185,14 +185,14 @@ static int hns_roce_mr_enable(struct hns_roce_dev *hr_dev,else ret = hr_dev->hw->frmr_write_mtpt (hr_dev, mailbox->buf, mr);if (ret) { -dev_err (dev,"Write mtpt fail!\n" ); +dev_err (dev,"failed to write mtpt, ret = %d.\n" , ret); goto err_page; } ret =hns_roce_hw_create_mpt (hr_dev, mailbox, mtpt_idx & (hr_dev->caps.num_mtpts -1 ));if (ret) { -dev_err (dev,"CREATE_MPT failed (%d)\n" , ret); +dev_err (dev,"failed to create mpt, ret = %d.\n" , ret); goto err_page; }
@@ -495,7 +495,7 @@ int hns_roce_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, int sg_nents, ret =ib_sg_to_pages (ibmr, sg, sg_nents, sg_offset, hns_roce_set_page);if (ret <1 ) { -ibdev_err (ibdev,"failed to store sg pages %d %d, cnt = %d.\n" , +ibdev_err (ibdev,"failed to store sg pages %u %u, cnt = %d.\n" , mr->npages, mr->pbl_mtr.hem_cfg.buf_pg_count, ret); goto err_page_list; }
@@ -862,7 +862,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,if (r->offset + r->count > page_cnt) { err = -EINVAL ;ibdev_err (ibdev, -"Failed to check mtr%d end %d + %d, max %d\n" , +"failed to check mtr%u end %u + %u, max %u.\n" , i, r->offset, r->count, page_cnt);return err; }
@@ -870,7 +870,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, err =mtr_map_region (hr_dev, mtr, &pages[r->offset], r);if (err) {ibdev_err (ibdev, -"Failed to map mtr%d offset %d, err %d\n" , +"failed to map mtr%u offset %u, ret = %d.\n" , i, r->offset, err);return err; }
drivers/infiniband/hw/hns/hns_roce_pd.c +1 -1
@@ -65,7 +65,7 @@ int hns_roce_alloc_pd(struct ib_pd *ibpd, struct ib_udata *udata) ret =hns_roce_pd_alloc (to_hr_dev (ib_dev), &pd->pdn);if (ret) { -ibdev_err (ib_dev,"failed to alloc pd, ret = %d\n" , ret); +ibdev_err (ib_dev,"failed to alloc pd, ret = %d.\n" , ret);return ret; }
drivers/infiniband/hw/hns/hns_roce_qp.c +35 -26
181 lines not on this page · raw message
drivers/infiniband/hw/hns/hns_roce_srq.c +22 -15
@@ -93,7 +93,8 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, ret =hns_roce_mtr_find (hr_dev, &srq->buf_mtr,0 , mtts_wqe,ARRAY_SIZE (mtts_wqe), &dma_handle_wqe);if (ret <1 ) { -ibdev_err (ibdev,"Failed to find mtr for SRQ WQE\n" ); +ibdev_err (ibdev,"failed to find mtr for SRQ WQE, ret = %d.\n" , + ret);return -ENOBUFS ; }
@@ -101,32 +102,34 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, ret =hns_roce_mtr_find (hr_dev, &srq->idx_que.mtr,0 , mtts_idx,ARRAY_SIZE (mtts_idx), &dma_handle_idx);if (ret <1 ) { -ibdev_err (ibdev,"Failed to find mtr for SRQ idx\n" ); +ibdev_err (ibdev,"failed to find mtr for SRQ idx, ret = %d.\n" , + ret);return -ENOBUFS ; } ret =hns_roce_bitmap_alloc (&srq_table->bitmap, &srq->srqn);if (ret) { -ibdev_err (ibdev,"Failed to alloc SRQ number, err %d\n" , ret); +ibdev_err (ibdev, +"failed to alloc SRQ number, ret = %d.\n" , ret);return -ENOMEM ; } ret =hns_roce_table_get (hr_dev, &srq_table->table, srq->srqn);if (ret) { -ibdev_err (ibdev,"Failed to get SRQC table, err %d\n" , ret); +ibdev_err (ibdev,"failed to get SRQC table, ret = %d.\n" , ret); goto err_out; } ret =xa_err (xa_store (&srq_table->xa, srq->srqn, srq,GFP_KERNEL ));if (ret) { -ibdev_err (ibdev,"Failed to store SRQC, err %d\n" , ret); +ibdev_err (ibdev,"failed to store SRQC, ret = %d.\n" , ret); goto err_put; } mailbox =hns_roce_alloc_cmd_mailbox (hr_dev);if (IS_ERR_OR_NULL (mailbox)) { ret = -ENOMEM ; -ibdev_err (ibdev,"Failed to alloc mailbox for SRQC\n" ); +ibdev_err (ibdev,"failed to alloc mailbox for SRQC.\n" ); goto err_xa; }
@@ -137,7 +140,7 @@ static int alloc_srqc(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, ret =hns_roce_hw_create_srq (hr_dev, mailbox, srq->srqn);hns_roce_free_cmd_mailbox (hr_dev, mailbox);if (ret) { -ibdev_err (ibdev,"Failed to config SRQC, err %d\n" , ret); +ibdev_err (ibdev,"failed to config SRQC, ret = %d.\n" , ret); goto err_xa; }
@@ -198,7 +201,8 @@ static int alloc_srq_buf(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, hr_dev->caps.srqwqe_ba_pg_sz + HNS_HW_PAGE_SHIFT, udata, addr);if (err) -ibdev_err (ibdev,"Failed to alloc SRQ buf mtr, err %d\n" , err); +ibdev_err (ibdev, +"failed to alloc SRQ buf mtr, ret = %d.\n" , err);return err; }
@@ -229,14 +233,15 @@ static int alloc_srq_idx(struct hns_roce_dev *hr_dev, struct hns_roce_srq *srq, hr_dev->caps.idx_ba_pg_sz +HNS_HW_PAGE_SHIFT , udata, addr);if (err) { -ibdev_err (ibdev,"Failed to alloc SRQ idx mtr, err %d\n" , err); +ibdev_err (ibdev, +"failed to alloc SRQ idx mtr, ret = %d.\n" , err);return err; }if (!udata) { idx_que->bitmap =bitmap_zalloc (srq->wqe_cnt,GFP_KERNEL );if (!idx_que->bitmap) { -ibdev_err (ibdev,"Failed to alloc SRQ idx bitmap\n" ); +ibdev_err (ibdev,"failed to alloc SRQ idx bitmap.\n" ); err = -ENOMEM ; goto err_idx_mtr; }
@@ -303,7 +308,7 @@ int hns_roce_create_srq(struct ib_srq *ib_srq, ret =ib_copy_from_udata (&ucmd, udata,min (udata->inlen,sizeof (ucmd)));if (ret) { -ibdev_err (ibdev,"Failed to copy SRQ udata, err %d\n" , +ibdev_err (ibdev,"failed to copy SRQ udata, ret = %d.\n" , ret);return ret; }
@@ -311,20 +316,21 @@ int hns_roce_create_srq(struct ib_srq *ib_srq, ret =alloc_srq_buf (hr_dev, srq, udata, ucmd.buf_addr);if (ret) { -ibdev_err (ibdev,"Failed to alloc SRQ buffer, err %d\n" , ret); +ibdev_err (ibdev, +"failed to alloc SRQ buffer, ret = %d.\n" , ret);return ret; } ret =alloc_srq_idx (hr_dev, srq, udata, ucmd.que_addr);if (ret) { -ibdev_err (ibdev,"Failed to alloc SRQ idx, err %d\n" , ret); +ibdev_err (ibdev,"failed to alloc SRQ idx, ret = %d.\n" , ret); goto err_buf_alloc; }if (!udata) { ret =alloc_srq_wrid (hr_dev, srq);if (ret) { -ibdev_err (ibdev,"Failed to alloc SRQ wrid, err %d\n" , +ibdev_err (ibdev,"failed to alloc SRQ wrid, ret = %d.\n" , ret); goto err_idx_alloc; }
@@ -336,7 +342,8 @@ int hns_roce_create_srq(struct ib_srq *ib_srq, ret =alloc_srqc (hr_dev, srq,to_hr_pd (ib_srq->pd)->pdn, cqn,0 ,0 );if (ret) { -ibdev_err (ibdev,"Failed to alloc SRQ context, err %d\n" , ret); +ibdev_err (ibdev, +"failed to alloc SRQ context, ret = %d.\n" , ret); goto err_wrid_alloc; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 49/93 bpf: Exempt CAP_BPF from checks against bpf_jit_limit
In reply to Greg Kroah-HartmanFrom: Lorenz Bauer <[email protected]>
[ Upstream commit 8a98ae12fbefdb583a7696de719a1d57e5e940a2 ]
When introducing CAP_BPF, bpf_jit_charge_modmem() was not changed to treat programs with CAP_BPF as privileged for the purpose of JIT memory allocation. This means that a program without CAP_BPF can block a program with CAP_BPF from loading a program.
Fix this by checking bpf_capable() in bpf_jit_charge_modmem().
--- kernel/bpf/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
kernel/bpf/core.c +1 -1
@@ -831,7 +831,7 @@ int bpf_jit_charge_modmem(u32 pages) {if (atomic_long_add_return (pages, &bpf_jit_current) > (bpf_jit_limit >>PAGE_SHIFT )) { -if (!capable (CAP_SYS_ADMIN )) { +if (!bpf_capable ()) {atomic_long_sub (pages, &bpf_jit_current);return -EPERM ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 50/93 selftests, bpf: Fix makefile dependencies on libbpf
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit d888eaac4fb1df30320bb1305a8f78efe86524c6 ]
When building bpf selftest with make -j, I'm randomly getting build failures such as this one:
In file included from progs/bpf_flow.c:19:
[...]/tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:11:10: fatal error: 'bpf_helper_defs.h' file not found
#include "bpf_helper_defs.h"
^~~~~~~~~~~~~~~~~~~The file that fails the build varies between runs but it's always in the progs/ subdir.
The reason is a missing make dependency on libbpf for the .o files in progs/. There was a dependency before commit 3ac2e20fba07e but that commit removed it to prevent unneeded rebuilds. However, that only works if libbpf has been built already; the 'wildcard' prerequisite does not trigger when there's no bpf_helper_defs.h generated yet.
Keep the libbpf as an order-only prerequisite to satisfy both goals. It is always built before the progs/ objects but it does not trigger unnecessary rebuilds by itself.
--- tools/testing/selftests/bpf/Makefile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
tools/testing/selftests/bpf/Makefile +2 -1
@@ -326,7 +326,8 @@ $(TRUNNER_BPF_OBJS): $(TRUNNER_OUTPUT)/%.o: \ $(TRUNNER_BPF_PROGS_DIR)/%.c \ $(TRUNNER_BPF_PROGS_DIR)/*.h \ $$(INCLUDE_DIR)/vmlinux.h \ - $(wildcard $(BPFDIR)/bpf_*.h) | $(TRUNNER_OUTPUT) + $(wildcard $(BPFDIR)/bpf_*.h) \ + | $(TRUNNER_OUTPUT) $$(BPFOBJ) $$(call $(TRUNNER_BPF_BUILD_RULE),$$<,$$@, \ $(TRUNNER_BPF_CFLAGS), \ $(TRUNNER_BPF_LDFLAGS))
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 51/93 selftests, bpf: test_lwt_ip_encap: Really disable rp_filter
In reply to Greg Kroah-HartmanFrom: Jiri Benc <[email protected]>
[ Upstream commit 79e2c306667542b8ee2d9a9d947eadc7039f0a3c ]
It's not enough to set net.ipv4.conf.all.rp_filter=0, that does not override a greater rp_filter value on the individual interfaces. We also need to set net.ipv4.conf.default.rp_filter=0 before creating the interfaces. That way, they'll also get their own rp_filter value of zero.
--- tools/testing/selftests/bpf/test_lwt_ip_encap.sh | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-)
tools/testing/selftests/bpf/test_lwt_ip_encap.sh +8 -5
@@ -112,6 +112,14 @@ setup() ip netns add "${NS2}" ip netns add "${NS3}" + # rp_filter gets confused by what these tests are doing, so disable it + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0 + ip netns exec ${NS1} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS2} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip netns exec ${NS3} sysctl -wq net.ipv4.conf.default.rp_filter=0 + ip link add veth1 type veth peer name veth2 ip link add veth3 type veth peer name veth4 ip link add veth5 type veth peer name veth6
@@ -236,11 +244,6 @@ setup() ip -netns ${NS1} -6 route add ${IPv6_GRE}/128 dev veth5 via ${IPv6_6} ${VRF} ip -netns ${NS2} -6 route add ${IPv6_GRE}/128 dev veth7 via ${IPv6_8} ${VRF} - # rp_filter gets confused by what these tests are doing, so disable it - ip netns exec ${NS1} sysctl -wq net.ipv4.conf.all.rp_filter=0 - ip netns exec ${NS2} sysctl -wq net.ipv4.conf.all.rp_filter=0 - ip netns exec ${NS3} sysctl -wq net.ipv4.conf.all.rp_filter=0 - TMPFILE=$(mktemp /tmp/test_lwt_ip_encap.XXXXXX) sleep 1 # reduce flakiness
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 52/93 net: ks8851: fix link error
In reply to Greg Kroah-HartmanFrom: Arnd Bergmann <[email protected]>
[ Upstream commit 51bb08dd04a05035a64504faa47651d36b0f3125 ]
An object file cannot be built for both loadable module and built-in use at the same time:
arm-linux-gnueabi-ld: drivers/net/ethernet/micrel/ks8851_common.o: in function `ks8851_probe_common':
ks8851_common.c:(.text+0xf80): undefined reference to `__this_module'
Change the ks8851_common code to be a standalone module instead, and use Makefile logic to ensure this is built-in if at least one of its two users is.
--- drivers/net/ethernet/micrel/Makefile | 6 ++---- drivers/net/ethernet/micrel/ks8851_common.c | 8 ++++++++ 2 files changed, 10 insertions(+), 4 deletions(-)
drivers/net/ethernet/micrel/Makefile +2 -4
@@ -4,8 +4,6 @@ # obj-$(CONFIG_KS8842) += ks8842.o -obj-$(CONFIG_KS8851) += ks8851.o -ks8851-objs = ks8851_common.o ks8851_spi.o -obj-$(CONFIG_KS8851_MLL) += ks8851_mll.o -ks8851_mll-objs = ks8851_common.o ks8851_par.o +obj-$(CONFIG_KS8851) += ks8851_common.o ks8851_spi.o +obj-$(CONFIG_KS8851_MLL) += ks8851_common.o ks8851_par.o obj-$(CONFIG_KSZ884X_PCI) += ksz884x.o
drivers/net/ethernet/micrel/ks8851_common.c +8 -0
@@ -1031,6 +1031,7 @@ int ks8851_suspend(struct device *dev)return 0 ; } +EXPORT_SYMBOL_GPL (ks8851_suspend);int ks8851_resume (struct device *dev) {
@@ -1044,6 +1045,7 @@ int ks8851_resume(struct device *dev)return 0 ; } +EXPORT_SYMBOL_GPL (ks8851_resume);#endif int ks8851_probe_common(struct net_device *netdev, struct device *dev,
@@ -1175,6 +1177,7 @@ int ks8851_probe_common(struct net_device *netdev, struct device *dev, err_reg_io:return ret; } +EXPORT_SYMBOL_GPL (ks8851_probe_common);int ks8851_remove_common (struct device *dev) {
@@ -1191,3 +1194,8 @@ int ks8851_remove_common(struct device *dev)return 0 ; } +EXPORT_SYMBOL_GPL (ks8851_remove_common); + +MODULE_DESCRIPTION ("KS8851 Network driver" ); +MODULE_AUTHOR ("Ben Dooks <[email protected]>" ); +MODULE_LICENSE ("GPL" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 53/93 Revert "block, bfq: honor already-setup queue merges"
In reply to Greg Kroah-HartmanFrom: Jens Axboe <[email protected]>
[ Upstream commit ebc69e897e17373fbe1daaff1debaa77583a5284 ]
This reverts commit 2d52c58b9c9bdae0ca3df6a1eab5745ab3f7d80b.
We have had several folks complain that this causes hangs for them, which is especially problematic as the commit has also hit stable already.
As no resolution seems to be forthcoming right now, revert the patch.
--- block/bfq-iosched.c | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-)
block/bfq-iosched.c +3 -13
@@ -2526,15 +2526,6 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq)* are likely to increase the throughput. */ bfqq->new_bfqq = new_bfqq; -/* -* The above assignment schedules the following redirections: -* each time some I/O for bfqq arrives, the process that -* generated that I/O is disassociated from bfqq and -* associated with new_bfqq. Here we increases new_bfqq->ref -* in advance, adding the number of processes that are -* expected to be associated with new_bfqq as they happen to -* issue I/O. -*/ new_bfqq->ref += process_refs;return new_bfqq; }
@@ -2594,10 +2585,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, {struct bfq_queue *in_service_bfqq, *new_bfqq; -/* if a merge has already been setup, then proceed with that first */ -if (bfqq->new_bfqq) -return bfqq->new_bfqq; -/* * Do not perform queue merging if the device is non * rotational and performs internal queueing. In fact, such a
@@ -2652,6 +2639,9 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq,if (bfq_too_late_for_merging (bfqq))return NULL ; +if (bfqq->new_bfqq) +return bfqq->new_bfqq; +if (!io_struct ||unlikely (bfqq == &bfqd->oom_bfqq))return NULL ;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 54/93 scsi: csiostor: Add module softdep on cxgb4
In reply to Greg Kroah-HartmanFrom: Rahul Lakkireddy <[email protected]>
[ Upstream commit 79a7482249a7353bc86aff8127954d5febf02472 ]
Both cxgb4 and csiostor drivers run on their own independent Physical Function. But when cxgb4 and csiostor are both being loaded in parallel via modprobe, there is a race when firmware upgrade is attempted by both the drivers.
When the cxgb4 driver initiates the firmware upgrade, it halts the firmware and the chip until upgrade is complete. When the csiostor driver is coming up in parallel, the firmware mailbox communication fails with timeouts and the csiostor driver probe fails.
Add a module soft dependency on cxgb4 driver to ensure loading csiostor triggers cxgb4 to load first when available to avoid the firmware upgrade race.
--- drivers/scsi/csiostor/csio_init.c | 1 + 1 file changed, 1 insertion(+)
drivers/scsi/csiostor/csio_init.c +1 -0
@@ -1254,3 +1254,4 @@ MODULE_DEVICE_TABLE(pci, csio_pci_tbl);MODULE_VERSION (CSIO_DRV_VERSION );MODULE_FIRMWARE (FW_FNAME_T5 );MODULE_FIRMWARE (FW_FNAME_T6 ); +MODULE_SOFTDEP ("pre: cxgb4" );
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 55/93 ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup
In reply to Greg Kroah-HartmanFrom: Feng Zhou <[email protected]>
[ Upstream commit 513e605d7a9ce136886cb42ebb2c40e9a6eb6333 ]
The ixgbe driver currently generates a NULL pointer dereference with some machine (online cpus < 63). This is due to the fact that the maximum value of num_xdp_queues is nr_cpu_ids. Code is in "ixgbe_set_rss_queues"".
Here's how the problem repeats itself:
Some machine (online cpus < 63), And user set num_queues to 63 through ethtool. Code is in the "ixgbe_set_channels",
adapter->ring_feature[RING_F_FDIR].limit = count;
It becomes 63.
When user use xdp, "ixgbe_set_rss_queues" will set queues num.
adapter->num_rx_queues = rss_i; adapter->num_tx_queues = rss_i; adapter->num_xdp_queues = ixgbe_xdp_queues(adapter);
And rss_i's value is from
f = &adapter->ring_feature[RING_F_FDIR]; rss_i = f->indices = f->limit;
So "num_rx_queues" > "num_xdp_queues", when run to "ixgbe_xdp_setup",
for (i = 0; i < adapter->num_rx_queues; i++) if (adapter->xdp_ring[i]->xsk_umem)
It leads to panic.
Call trace: [exception RIP: ixgbe_xdp+368] RIP: ffffffffc02a76a0 RSP: ffff9fe16202f8d0 RFLAGS: 00010297 RAX: 0000000000000000 RBX: 0000000000000020 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 000000000000001c RDI: ffffffffa94ead90 RBP: ffff92f8f24c0c18 R8: 0000000000000000 R9: 0000000000000000 R10: ffff9fe16202f830 R11: 0000000000000000 R12: ffff92f8f24c0000 R13: ffff9fe16202fc01 R14: 000000000000000a R15: ffffffffc02a7530 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 7 [ffff9fe16202f8f0] dev_xdp_install at ffffffffa89fbbcc 8 [ffff9fe16202f920] dev_change_xdp_fd at ffffffffa8a08808 9 [ffff9fe16202f960] do_setlink at ffffffffa8a20235
10 [ffff9fe16202fa88] rtnl_setlink at ffffffffa8a20384
11 [ffff9fe16202fc78] rtnetlink_rcv_msg at ffffffffa8a1a8dd 12 [ffff9fe16202fcf0] netlink_rcv_skb at ffffffffa8a717eb
13 [ffff9fe16202fd40] netlink_unicast at ffffffffa8a70f88
14 [ffff9fe16202fd80] netlink_sendmsg at ffffffffa8a71319
15 [ffff9fe16202fdf0] sock_sendmsg at ffffffffa89df290
16 [ffff9fe16202fe08] __sys_sendto at ffffffffa89e19c8
17 [ffff9fe16202ff30] __x64_sys_sendto at ffffffffa89e1a64 18 [ffff9fe16202ff38] do_syscall_64 at ffffffffa84042b9
19 [ffff9fe16202ff50] entry_SYSCALL_64_after_hwframe at ffffffffa8c0008c
So I fix ixgbe_max_channels so that it will not allow a setting of queues to be higher than the num_online_cpus(). And when run to ixgbe_xdp_setup, take the smaller value of num_rx_queues and num_xdp_queues.
--- drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 2 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-)
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +1 -1
@@ -3216,7 +3216,7 @@ static unsigned int ixgbe_max_channels(struct ixgbe_adapter *adapter) max_combined =ixgbe_max_rss_indices (adapter); } -return max_combined; +return min_t (int, max_combined,num_online_cpus ()); } static void ixgbe_get_channels(struct net_device *dev,
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +6 -2
@@ -10123,6 +10123,7 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)struct ixgbe_adapter *adapter =netdev_priv (dev);struct bpf_prog *old_prog;bool need_reset; +int num_queues;if (adapter->flags &IXGBE_FLAG_SRIOV_ENABLED )return -EINVAL ;
@@ -10172,11 +10173,14 @@ static int ixgbe_xdp_setup(struct net_device *dev, struct bpf_prog *prog)/* Kick start the NAPI context if there is an AF_XDP socket open * on that queue id. This so that receiving will start. */ -if (need_reset && prog) -for (i =0 ; i < adapter->num_rx_queues; i++) +if (need_reset && prog) { + num_queues =min_t (int, adapter->num_rx_queues, + adapter->num_xdp_queues); +for (i =0 ; i < num_queues; i++)if (adapter->xdp_ring[i]->xsk_pool) (void )ixgbe_xsk_wakeup (adapter->netdev, i,XDP_WAKEUP_RX ); + }return 0 ; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 56/93 net: hns3: do not allow call hns3_nic_net_open repeatedly
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 5b09e88e1bf7fe86540fab4b5f3eece8abead39e ]
hns3_nic_net_open() is not allowed to called repeatly, but there is no checking for this. When doing device reset and setup tc concurrently, there is a small oppotunity to call hns3_nic_net_open repeatedly, and cause kernel bug by calling napi_enable twice.
The calltrace information is like below:
[ 3078.222780] ------------[ cut here ]------------ [ 3078.230255] kernel BUG at net/core/dev.c:6991! [ 3078.236224] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 3078.243431] Modules linked in: hns3 hclgevf hclge hnae3 vfio_iommu_type1 vfio_pci vfio_virqfd vfio pv680_mii(O) [ 3078.258880] CPU: 0 PID: 295 Comm: kworker/u8:5 Tainted: G O 5.14.0-rc4+ #1 [ 3078.269102] Hardware name: , BIOS KpxxxFPGA 1P B600 V181 08/12/2021 [ 3078.276801] Workqueue: hclge hclge_service_task [hclge] [ 3078.288774] pstate: 60400009 (nZCv daif +PAN -UAO -TCO BTYPE=--) [ 3078.296168] pc : napi_enable+0x80/0x84
tc qdisc sho[w 3d0e7v8 .e3t0h218 79] lr : hns3_nic_net_open+0x138/0x510 [hns3]
[ 3078.314771] sp : ffff8000108abb20 [ 3078.319099] x29: ffff8000108abb20 x28: 0000000000000000 x27: ffff0820a8490300 [ 3078.329121] x26: 0000000000000001 x25: ffff08209cfc6200 x24: 0000000000000000 [ 3078.339044] x23: ffff0820a8490300 x22: ffff08209cd76000 x21: ffff0820abfe3880 [ 3078.349018] x20: 0000000000000000 x19: ffff08209cd76900 x18: 0000000000000000 [ 3078.358620] x17: 0000000000000000 x16: ffffc816e1727a50 x15: 0000ffff8f4ff930 [ 3078.368895] x14: 0000000000000000 x13: 0000000000000000 x12: 0000259e9dbeb6b4 [ 3078.377987] x11: 0096a8f7e764eb40 x10: 634615ad28d3eab5 x9 : ffffc816ad8885b8 [ 3078.387091] x8 : ffff08209cfc6fb8 x7 : ffff0820ac0da058 x6 : ffff0820a8490344 [ 3078.396356] x5 : 0000000000000140 x4 : 0000000000000003 x3 : ffff08209cd76938 [ 3078.405365] x2 : 0000000000000000 x1 : 0000000000000010 x0 : ffff0820abfe38a0 [ 3078.414657] Call trace: [ 3078.418517] napi_enable+0x80/0x84 [ 3078.424626] hns3_reset_notify_up_enet+0x78/0xd0 [hns3] [ 3078.433469] hns3_reset_notify+0x64/0x80 [hns3] [ 3078.441430] hclge_notify_client+0x68/0xb0 [hclge] [ 3078.450511] hclge_reset_rebuild+0x524/0x884 [hclge] [ 3078.458879] hclge_reset_service_task+0x3c4/0x680 [hclge] [ 3078.467470] hclge_service_task+0xb0/0xb54 [hclge] [ 3078.475675] process_one_work+0x1dc/0x48c [ 3078.481888] worker_thread+0x15c/0x464 [ 3078.487104] kthread+0x160/0x170 [ 3078.492479] ret_from_fork+0x10/0x18 [ 3078.498785] Code: c8027c81 35ffffa2 d50323bf d65f03c0 (d4210000) [ 3078.506889] ---[ end trace 8ebe0340a1b0fb44 ]---
Once hns3_nic_net_open() is excute success, the flag HNS3_NIC_STATE_DOWN will be cleared. So add checking for this flag, directly return when HNS3_NIC_STATE_DOWN is no set.
--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +5 -0
@@ -444,6 +444,11 @@ static int hns3_nic_net_open(struct net_device *netdev)if (hns3_nic_resetting (netdev))return -EBUSY ; +if (!test_bit (HNS3_NIC_STATE_DOWN , &priv->state)) { +netdev_warn (netdev,"net open repeatedly!\n" ); +return 0 ; + } +netif_carrier_off (netdev); ret =hns3_nic_set_real_num_queue (netdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 57/93 net: hns3: keep MAC pause mode when multiple TCs are enabled
In reply to Greg Kroah-HartmanFrom: Yonglong Liu <[email protected]>
[ Upstream commit d78e5b6a6764cb6e83668806b63d74566db36399 ]
Bellow HNAE3_DEVICE_VERSION_V3, MAC pause mode just support one TC, when enabled multiple TCs, force enable PFC mode.
HNAE3_DEVICE_VERSION_V3 can support MAC pause mode on multiple TCs, so when enable multiple TCs, just keep MAC pause mode, and enable PFC mode just according to the user settings.
--- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 23 ++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +22 -1
@@ -682,7 +682,7 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev) } } -static void hclge_pfc_info_init (struct hclge_dev *hdev) +static void hclge_update_fc_mode_by_dcb_flag (struct hclge_dev *hdev) {if (!(hdev->flag &HCLGE_FLAG_DCB_ENABLE )) {if (hdev->fc_mode_last_time ==HCLGE_FC_PFC )
@@ -700,6 +700,27 @@ static void hclge_pfc_info_init(struct hclge_dev *hdev) } } +static void hclge_update_fc_mode (struct hclge_dev *hdev) +{ +if (!hdev->tm_info.pfc_en) { + hdev->tm_info.fc_mode = hdev->fc_mode_last_time; +return ; + } + +if (hdev->tm_info.fc_mode !=HCLGE_FC_PFC ) { + hdev->fc_mode_last_time = hdev->tm_info.fc_mode; + hdev->tm_info.fc_mode =HCLGE_FC_PFC ; + } +} + +static void hclge_pfc_info_init (struct hclge_dev *hdev) +{ +if (hdev->ae_dev->dev_version >=HNAE3_DEVICE_VERSION_V3 ) +hclge_update_fc_mode (hdev); +else +hclge_update_fc_mode_by_dcb_flag (hdev); +} +static void hclge_tm_schd_info_init (struct hclge_dev *hdev) {hclge_tm_pg_info_init (hdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 58/93 net: hns3: fix mixed flag HCLGE_FLAG_MQPRIO_ENABLE and HCLGE_FLAG_DCB_ENABLE
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 0472e95ffeac8e61259eec17ab61608c6b35599d ]
HCLGE_FLAG_MQPRIO_ENABLE is supposed to set when enable multiple TCs with tc mqprio, and HCLGE_FLAG_DCB_ENABLE is supposed to set when enable multiple TCs with ets. But the driver mixed the flags when updating the tm configuration.
Furtherly, PFC should be available when HCLGE_FLAG_MQPRIO_ENABLE too, so remove the unnecessary limitation.
--- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 7 +++-- .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 31 +++---------------- 2 files changed, 10 insertions(+), 28 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +5 -2
@@ -248,6 +248,10 @@ static int hclge_ieee_setets(struct hnae3_handle *h, struct ieee_ets *ets) }hclge_tm_schd_info_update (hdev, num_tc); +if (num_tc >1 ) + hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; +else + hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; ret =hclge_ieee_ets_to_tm_info (hdev, ets);if (ret)
@@ -313,8 +317,7 @@ static int hclge_ieee_setpfc(struct hnae3_handle *h, struct ieee_pfc *pfc)u8 i, j, pfc_map, *prio_tc;int ret; -if (!(hdev->dcbx_cap &DCB_CAP_DCBX_VER_IEEE ) || - hdev->flag &HCLGE_FLAG_MQPRIO_ENABLE ) +if (!(hdev->dcbx_cap &DCB_CAP_DCBX_VER_IEEE ))return -EINVAL ;if (pfc->pfc_en == hdev->tm_info.pfc_en)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +5 -26
@@ -646,14 +646,6 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev)for (i =0 ; i <HNAE3_MAX_USER_PRIO ; i++) hdev->tm_info.prio_tc[i] = (i >= hdev->tm_info.num_tc) ?0 : i; - -/* DCB is enabled if we have more than 1 TC or pfc_en is -* non-zero. -*/ -if (hdev->tm_info.num_tc >1 || hdev->tm_info.pfc_en) - hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; -else - hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; }static void hclge_tm_pg_info_init (struct hclge_dev *hdev)
@@ -684,10 +676,10 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev)static void hclge_update_fc_mode_by_dcb_flag (struct hclge_dev *hdev) { -if (!(hdev->flag &HCLGE_FLAG_DCB_ENABLE )) { +if (hdev->tm_info.num_tc ==1 && !hdev->tm_info.pfc_en) {if (hdev->fc_mode_last_time ==HCLGE_FC_PFC )dev_warn (&hdev->pdev->dev, -"DCB is disable, but last mode is FC_PFC\n" ); +"Only 1 tc used, but last mode is FC_PFC\n" ); hdev->tm_info.fc_mode = hdev->fc_mode_last_time; }else if (hdev->tm_info.fc_mode !=HCLGE_FC_PFC ) {
@@ -713,7 +705,7 @@ static void hclge_update_fc_mode(struct hclge_dev *hdev) } } -static void hclge_pfc_info_init (struct hclge_dev *hdev) +void hclge_tm_pfc_info_update (struct hclge_dev *hdev) {if (hdev->ae_dev->dev_version >=HNAE3_DEVICE_VERSION_V3 )hclge_update_fc_mode (hdev);
@@ -729,7 +721,7 @@ static void hclge_tm_schd_info_init(struct hclge_dev *hdev)hclge_tm_vport_info_update (hdev); -hclge_pfc_info_init (hdev); +hclge_tm_pfc_info_update (hdev); }static int hclge_tm_pg_to_pri_map (struct hclge_dev *hdev)
@@ -1465,19 +1457,6 @@ void hclge_tm_schd_info_update(struct hclge_dev *hdev, u8 num_tc)hclge_tm_schd_info_init (hdev); } -void hclge_tm_pfc_info_update (struct hclge_dev *hdev) -{ -/* DCB is enabled if we have more than 1 TC or pfc_en is -* non-zero. -*/ -if (hdev->tm_info.num_tc >1 || hdev->tm_info.pfc_en) - hdev->flag |=HCLGE_FLAG_DCB_ENABLE ; -else - hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE ; - -hclge_pfc_info_init (hdev); -} -int hclge_tm_init_hw (struct hclge_dev *hdev,bool init) {int ret;
@@ -1523,7 +1502,7 @@ int hclge_tm_vport_map_update(struct hclge_dev *hdev)if (ret)return ret; -if (!(hdev->flag &HCLGE_FLAG_DCB_ENABLE )) +if (hdev->tm_info.num_tc ==1 && !hdev->tm_info.pfc_en)return 0 ;return hclge_tm_bp_setup (hdev);
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 59/93 net: hns3: fix show wrong state when add existing uc mac address
In reply to Greg Kroah-HartmanFrom: Jian Shen <[email protected]>
[ Upstream commit 108b3c7810e14892c4a1819b1d268a2c785c087c ]
Currently, if function adds an existing unicast mac address, eventhough driver will not add this address into hardware, but it will return 0 in function hclge_add_uc_addr_common(). It will cause the state of this unicast mac address is ACTIVE in driver, but it should be in TO-ADD state.
To fix this problem, function hclge_add_uc_addr_common() returns -EEXIST if mac address is existing, and delete two error log to avoid printing them all the time after this modification.
--- .../hisilicon/hns3/hns3pf/hclge_main.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +9 -10
@@ -7581,15 +7581,8 @@ int hclge_add_uc_addr_common(struct hclge_vport *vport, }/* check if we just hit the duplicate */ -if (!ret) { -dev_warn (&hdev->pdev->dev,"VF %u mac(%pM) exists\n" , - vport->vport_id, addr); -return 0 ; - } - -dev_err (&hdev->pdev->dev, -"PF failed to add unicast entry(%pM) in the MAC table\n" , - addr); +if (!ret) +return -EEXIST ;return ret; }
@@ -7743,7 +7736,13 @@ static void hclge_sync_vport_mac_list(struct hclge_vport *vport, }else {set_bit (HCLGE_VPORT_STATE_MAC_TBL_CHANGE , &vport->state); -break ; + +/* If one unicast mac address is existing in hardware, +* we need to try whether other unicast mac addresses +* are new addresses that can be added. +*/ +if (ret != -EEXIST ) +break ; } } }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 60/93 net: hns3: fix prototype warning
In reply to Greg Kroah-HartmanFrom: Huazhong Tan <[email protected]>
[ Upstream commit a1e144d7dc3c55aa4d451e3a23cd8f34cd65ee01 ]
Correct a report warning in hns3_ethtool.c
--- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +1 -1
@@ -301,7 +301,7 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode) }/** -* hns3_nic_self_test - self test +* hns3_self_test - self test * @ndev: net device * @eth_test: test cmd * @data: test result
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 61/93 net: hns3: reconstruct function hns3_self_test
In reply to Greg Kroah-HartmanFrom: Peng Li <[email protected]>
[ Upstream commit 4c8dab1c709c5a715bce14efdb8f4e889d86aa04 ]
This patch reconstructs function hns3_self_test to reduce the code cycle complexity and make code more concise.
--- .../ethernet/hisilicon/hns3/hns3_ethtool.c | 101 +++++++++++------- 1 file changed, 64 insertions(+), 37 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +64 -37
@@ -300,33 +300,8 @@ static int hns3_lp_run_test(struct net_device *ndev, enum hnae3_loop mode)return ret_val; } -/** -* hns3_self_test - self test -* @ndev: net device -* @eth_test: test cmd -* @data: test result -*/ -static void hns3_self_test (struct net_device *ndev, -struct ethtool_test *eth_test,u64 *data) +static void hns3_set_selftest_param (struct hnae3_handle *h,int (*st_param)[2 ]) { -struct hns3_nic_priv *priv =netdev_priv (ndev); -struct hnae3_handle *h = priv->ae_handle; -int st_param[HNS3_SELF_TEST_TYPE_NUM ][2 ]; -bool if_running =netif_running (ndev); -int test_index =0 ; -u32 i; - -if (hns3_nic_resetting (ndev)) { -netdev_err (ndev,"dev resetting!" ); -return ; - } - -/* Only do offline selftest, or pass by default */ -if (eth_test->flags !=ETH_TEST_FL_OFFLINE ) -return ; - -netif_dbg (h, drv, ndev,"self test start" ); - st_param[HNAE3_LOOP_APP ][0 ] =HNAE3_LOOP_APP ; st_param[HNAE3_LOOP_APP ][1 ] = h->flags &HNAE3_SUPPORT_APP_LOOPBACK ;
@@ -343,6 +318,18 @@ static void hns3_self_test(struct net_device *ndev, st_param[HNAE3_LOOP_PHY ][0 ] =HNAE3_LOOP_PHY ; st_param[HNAE3_LOOP_PHY ][1 ] = h->flags &HNAE3_SUPPORT_PHY_LOOPBACK ; +} + +static void hns3_selftest_prepare (struct net_device *ndev, +bool if_running,int (*st_param)[2 ]) +{ +struct hns3_nic_priv *priv =netdev_priv (ndev); +struct hnae3_handle *h = priv->ae_handle; + +if (netif_msg_ifdown (h)) +netdev_info (ndev,"self test start\n" ); + +hns3_set_selftest_param (h, st_param);if (if_running) ndev->netdev_ops->ndo_stop (ndev);
@@ -361,6 +348,35 @@ static void hns3_self_test(struct net_device *ndev, h->ae_algo->ops->halt_autoneg (h, true);set_bit (HNS3_NIC_STATE_TESTING , &priv->state); +} + +static void hns3_selftest_restore (struct net_device *ndev,bool if_running) +{ +struct hns3_nic_priv *priv =netdev_priv (ndev); +struct hnae3_handle *h = priv->ae_handle; + +clear_bit (HNS3_NIC_STATE_TESTING , &priv->state); + +if (h->ae_algo->ops->halt_autoneg) + h->ae_algo->ops->halt_autoneg (h, false); + +#if IS_ENABLED (CONFIG_VLAN_8021Q ) +if (h->ae_algo->ops->enable_vlan_filter) + h->ae_algo->ops->enable_vlan_filter (h, true); +#endif + +if (if_running) + ndev->netdev_ops->ndo_open (ndev); + +if (netif_msg_ifdown (h)) +netdev_info (ndev,"self test end\n" ); +} + +static void hns3_do_selftest (struct net_device *ndev,int (*st_param)[2 ], +struct ethtool_test *eth_test,u64 *data) +{ +int test_index =0 ; +u32 i;for (i =0 ; i <HNS3_SELF_TEST_TYPE_NUM ; i++) {enum hnae3_loop loop_type = (enum hnae3_loop )st_param[i][0 ];
@@ -379,21 +395,32 @@ static void hns3_self_test(struct net_device *ndev, test_index++; } +} -clear_bit (HNS3_NIC_STATE_TESTING , &priv->state); - -if (h->ae_algo->ops->halt_autoneg) - h->ae_algo->ops->halt_autoneg (h, false); +/** +* hns3_nic_self_test - self test +* @ndev: net device +* @eth_test: test cmd +* @data: test result +*/ +static void hns3_self_test (struct net_device *ndev, +struct ethtool_test *eth_test,u64 *data) +{ +int st_param[HNS3_SELF_TEST_TYPE_NUM ][2 ]; +bool if_running =netif_running (ndev); -#if IS_ENABLED (CONFIG_VLAN_8021Q ) -if (h->ae_algo->ops->enable_vlan_filter) - h->ae_algo->ops->enable_vlan_filter (h, true); -#endif +if (hns3_nic_resetting (ndev)) { +netdev_err (ndev,"dev resetting!" ); +return ; + } -if (if_running) - ndev->netdev_ops->ndo_open (ndev); +/* Only do offline selftest, or pass by default */ +if (eth_test->flags !=ETH_TEST_FL_OFFLINE ) +return ; -netif_dbg (h, drv, ndev,"self test end\n" ); +hns3_selftest_prepare (ndev, if_running, st_param); +hns3_do_selftest (ndev, st_param, eth_test, data); +hns3_selftest_restore (ndev, if_running); }static int hns3_get_sset_count (struct net_device *netdev,int stringset)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 62/93 net: hns3: fix always enable rx vlan filter problem after selftest
In reply to Greg Kroah-HartmanFrom: Guangbin Huang <[email protected]>
[ Upstream commit 27bf4af69fcb9845fb2f0076db5d562ec072e70f ]
Currently, the rx vlan filter will always be disabled before selftest and be enabled after selftest as the rx vlan filter feature is fixed on in old device earlier than V3.
However, this feature is not fixed in some new devices and it can be disabled by user. In this case, it is wrong if rx vlan filter is enabled after selftest. So fix it.
--- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +4 -2
@@ -336,7 +336,8 @@ static void hns3_selftest_prepare(struct net_device *ndev,#if IS_ENABLED (CONFIG_VLAN_8021Q )/* Disable the vlan filter for selftest does not support it */ -if (h->ae_algo->ops->enable_vlan_filter) +if (h->ae_algo->ops->enable_vlan_filter && + ndev->features &NETIF_F_HW_VLAN_CTAG_FILTER ) h->ae_algo->ops->enable_vlan_filter (h, false);#endif
@@ -361,7 +362,8 @@ static void hns3_selftest_restore(struct net_device *ndev, bool if_running) h->ae_algo->ops->halt_autoneg (h, false);#if IS_ENABLED (CONFIG_VLAN_8021Q ) -if (h->ae_algo->ops->enable_vlan_filter) +if (h->ae_algo->ops->enable_vlan_filter && + ndev->features &NETIF_F_HW_VLAN_CTAG_FILTER ) h->ae_algo->ops->enable_vlan_filter (h, true);#endif
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 63/93 net: phy: bcm7xxx: Fixed indirect MMD operations
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit d88fd1b546ff19c8040cfaea76bf16aed1c5a0bb ]
When EEE support was added to the 28nm EPHY it was assumed that it would be able to support the standard clause 45 over clause 22 register access method. It turns out that the PHY does not support that, which is the very reason for using the indirect shadow mode 2 bank 3 access method.
Implement {read,write}_mmd to allow the standard PHY library routines pertaining to EEE querying and configuration to work correctly on these PHYs. This forces us to implement a __phy_set_clr_bits() function that does not grab the MDIO bus lock since the PHY driver's {read,write}_mmd functions are always called with that lock held.
--- drivers/net/phy/bcm7xxx.c | 114 ++++++++++++++++++++++++++++++++++++-- 1 file changed, 110 insertions(+), 4 deletions(-)
drivers/net/phy/bcm7xxx.c +110 -4
@@ -27,7 +27,12 @@#define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe#define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf#define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a +#define MII_BCM7XXX_SHD_3_PCS_CTRL 0x0 +#define MII_BCM7XXX_SHD_3_PCS_STATUS 0x1 +#define MII_BCM7XXX_SHD_3_EEE_CAP 0x2#define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3 +#define MII_BCM7XXX_SHD_3_EEE_LP 0x4 +#define MII_BCM7XXX_SHD_3_EEE_WK_ERR 0x5#define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6#define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400#define MII_BCM7XXX_SHD_3_AN_STAT 0xb
@@ -216,25 +221,37 @@ static int bcm7xxx_28nm_resume(struct phy_device *phydev)return genphy_config_aneg (phydev); } -static int phy_set_clr_bits (struct phy_device *dev,int location, -int set_mask,int clr_mask) +static int __phy_set_clr_bits (struct phy_device *dev,int location, +int set_mask,int clr_mask) {int v, ret; - v =phy_read (dev, location); + v =__phy_read (dev, location);if (v <0 )return v; v &= ~clr_mask; v |= set_mask; - ret =phy_write (dev, location, v); + ret =__phy_write (dev, location, v);if (ret <0 )return ret;return v; } +static int phy_set_clr_bits (struct phy_device *dev,int location, +int set_mask,int clr_mask) +{ +int ret; + +mutex_lock (&dev->mdio.bus->mdio_lock); + ret =__phy_set_clr_bits (dev, location, set_mask, clr_mask); +mutex_unlock (&dev->mdio.bus->mdio_lock); + +return ret; +} +static int bcm7xxx_28nm_ephy_01_afe_config_init (struct phy_device *phydev) {int ret;
@@ -398,6 +415,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev)return bcm7xxx_28nm_ephy_apd_enable (phydev); } +#define MII_BCM7XXX_REG_INVALID 0xff + +static u8 bcm7xxx_28nm_ephy_regnum_to_shd (u16 regnum) +{ +switch (regnum) { +case MDIO_CTRL1 : +return MII_BCM7XXX_SHD_3_PCS_CTRL ; +case MDIO_STAT1 : +return MII_BCM7XXX_SHD_3_PCS_STATUS ; +case MDIO_PCS_EEE_ABLE : +return MII_BCM7XXX_SHD_3_EEE_CAP ; +case MDIO_AN_EEE_ADV : +return MII_BCM7XXX_SHD_3_AN_EEE_ADV ; +case MDIO_AN_EEE_LPABLE : +return MII_BCM7XXX_SHD_3_EEE_LP ; +case MDIO_PCS_EEE_WK_ERR : +return MII_BCM7XXX_SHD_3_EEE_WK_ERR ; +default : +return MII_BCM7XXX_REG_INVALID ; + } +} + +static bool bcm7xxx_28nm_ephy_dev_valid (int devnum) +{ +return devnum ==MDIO_MMD_AN || devnum ==MDIO_MMD_PCS ; +} + +static int bcm7xxx_28nm_ephy_read_mmd (struct phy_device *phydev, +int devnum,u16 regnum) +{ +u8 shd =bcm7xxx_28nm_ephy_regnum_to_shd (regnum); +int ret; + +if (!bcm7xxx_28nm_ephy_dev_valid (devnum) || + shd ==MII_BCM7XXX_REG_INVALID ) +return -EOPNOTSUPP ; + +/* set shadow mode 2 */ + ret =__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST , +MII_BCM7XXX_SHD_MODE_2 ,0 ); +if (ret <0 ) +return ret; + +/* Access the desired shadow register address */ + ret =__phy_write (phydev,MII_BCM7XXX_SHD_2_ADDR_CTRL , shd); +if (ret <0 ) + goto reset_shadow_mode; + + ret =__phy_read (phydev,MII_BCM7XXX_SHD_2_CTRL_STAT ); + +reset_shadow_mode: +/* reset shadow mode 2 */ +__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,0 , +MII_BCM7XXX_SHD_MODE_2 ); +return ret; +} + +static int bcm7xxx_28nm_ephy_write_mmd (struct phy_device *phydev, +int devnum,u16 regnum,u16 val) +{ +u8 shd =bcm7xxx_28nm_ephy_regnum_to_shd (regnum); +int ret; + +if (!bcm7xxx_28nm_ephy_dev_valid (devnum) || + shd ==MII_BCM7XXX_REG_INVALID ) +return -EOPNOTSUPP ; + +/* set shadow mode 2 */ + ret =__phy_set_clr_bits (phydev,MII_BCM7XXX_TEST , +MII_BCM7XXX_SHD_MODE_2 ,0 ); +if (ret <0 ) +return ret; + +/* Access the desired shadow register address */ + ret =__phy_write (phydev,MII_BCM7XXX_SHD_2_ADDR_CTRL , shd); +if (ret <0 ) + goto reset_shadow_mode; + +/* Write the desired value in the shadow register */ +__phy_write (phydev,MII_BCM7XXX_SHD_2_CTRL_STAT , val); + +reset_shadow_mode: +/* reset shadow mode 2 */ +return __phy_set_clr_bits (phydev,MII_BCM7XXX_TEST ,0 , +MII_BCM7XXX_SHD_MODE_2 ); +} +static int bcm7xxx_28nm_ephy_resume (struct phy_device *phydev) {int ret;
@@ -595,6 +699,8 @@ static void bcm7xxx_28nm_remove(struct phy_device *phydev) .get_stats = bcm7xxx_28nm_get_phy_stats, \ .probe = bcm7xxx_28nm_probe, \ .remove = bcm7xxx_28nm_remove, \ + .read_mmd = bcm7xxx_28nm_ephy_read_mmd, \ + .write_mmd = bcm7xxx_28nm_ephy_write_mmd, \ }#define BCM7XXX_40NM_EPHY (_oui, _name) \
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 64/93 net: sched: flower: protect fl_walk() with rcu
In reply to Greg Kroah-HartmanFrom: Vlad Buslov <[email protected]>
[ Upstream commit d5ef190693a7d76c5c192d108e8dec48307b46ee ]
Patch that refactored fl_walk() to use idr_for_each_entry_continue_ul() also removed rcu protection of individual filters which causes following use-after-free when filter is deleted concurrently. Fix fl_walk() to obtain rcu read lock while iterating and taking the filter reference and temporary release the lock while calling arg->fn() callback that can sleep.
KASAN trace:
[ 352.773640] ================================================================== [ 352.775041] BUG: KASAN: use-after-free in fl_walk+0x159/0x240 [cls_flower] [ 352.776304] Read of size 4 at addr ffff8881c8251480 by task tc/2987
[ 352.777862] CPU: 3 PID: 2987 Comm: tc Not tainted 5.15.0-rc2+ #2 [ 352.778980] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 352.781022] Call Trace: [ 352.781573] dump_stack_lvl+0x46/0x5a [ 352.782332] print_address_description.constprop.0+0x1f/0x140 [ 352.783400] ? fl_walk+0x159/0x240 [cls_flower] [ 352.784292] ? fl_walk+0x159/0x240 [cls_flower] [ 352.785138] kasan_report.cold+0x83/0xdf [ 352.785851] ? fl_walk+0x159/0x240 [cls_flower] [ 352.786587] kasan_check_range+0x145/0x1a0 [ 352.787337] fl_walk+0x159/0x240 [cls_flower] [ 352.788163] ? fl_put+0x10/0x10 [cls_flower] [ 352.789007] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.790102] tcf_chain_dump+0x231/0x450 [ 352.790878] ? tcf_chain_tp_delete_empty+0x170/0x170 [ 352.791833] ? __might_sleep+0x2e/0xc0 [ 352.792594] ? tfilter_notify+0x170/0x170 [ 352.793400] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.794477] tc_dump_tfilter+0x385/0x4b0 [ 352.795262] ? tc_new_tfilter+0x1180/0x1180 [ 352.796103] ? __mod_node_page_state+0x1f/0xc0 [ 352.796974] ? __build_skb_around+0x10e/0x130 [ 352.797826] netlink_dump+0x2c0/0x560 [ 352.798563] ? netlink_getsockopt+0x430/0x430 [ 352.799433] ? __mutex_unlock_slowpath.constprop.0+0x220/0x220 [ 352.800542] __netlink_dump_start+0x356/0x440 [ 352.801397] rtnetlink_rcv_msg+0x3ff/0x550 [ 352.802190] ? tc_new_tfilter+0x1180/0x1180 [ 352.802872] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.803668] ? tc_new_tfilter+0x1180/0x1180 [ 352.804344] ? _copy_from_iter_nocache+0x800/0x800 [ 352.805202] ? kasan_set_track+0x1c/0x30 [ 352.805900] netlink_rcv_skb+0xc6/0x1f0 [ 352.806587] ? rht_deferred_worker+0x6b0/0x6b0 [ 352.807455] ? rtnl_calcit.isra.0+0x1f0/0x1f0 [ 352.808324] ? netlink_ack+0x4d0/0x4d0 [ 352.809086] ? netlink_deliver_tap+0x62/0x3d0 [ 352.809951] netlink_unicast+0x353/0x480 [ 352.810744] ? netlink_attachskb+0x430/0x430 [ 352.811586] ? __alloc_skb+0xd7/0x200 [ 352.812349] netlink_sendmsg+0x396/0x680 [ 352.813132] ? netlink_unicast+0x480/0x480 [ 352.813952] ? __import_iovec+0x192/0x210 [ 352.814759] ? netlink_unicast+0x480/0x480 [ 352.815580] sock_sendmsg+0x6c/0x80 [ 352.816299] ____sys_sendmsg+0x3a5/0x3c0 [ 352.817096] ? kernel_sendmsg+0x30/0x30 [ 352.817873] ? __ia32_sys_recvmmsg+0x150/0x150 [ 352.818753] ___sys_sendmsg+0xd8/0x140 [ 352.819518] ? sendmsg_copy_msghdr+0x110/0x110 [ 352.820402] ? ___sys_recvmsg+0xf4/0x1a0 [ 352.821110] ? __copy_msghdr_from_user+0x260/0x260 [ 352.821934] ? _raw_spin_lock+0x81/0xd0 [ 352.822680] ? __handle_mm_fault+0xef3/0x1b20 [ 352.823549] ? rb_insert_color+0x2a/0x270 [ 352.824373] ? copy_page_range+0x16b0/0x16b0 [ 352.825209] ? perf_event_update_userpage+0x2d0/0x2d0 [ 352.826190] ? __fget_light+0xd9/0xf0 [ 352.826941] __sys_sendmsg+0xb3/0x130 [ 352.827613] ? __sys_sendmsg_sock+0x20/0x20 [ 352.828377] ? do_user_addr_fault+0x2c5/0x8a0 [ 352.829184] ? fpregs_assert_state_consistent+0x52/0x60 [ 352.830001] ? exit_to_user_mode_prepare+0x32/0x160 [ 352.830845] do_syscall_64+0x35/0x80 [ 352.831445] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 352.832331] RIP: 0033:0x7f7bee973c17 [ 352.833078] Code: 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 352.836202] RSP: 002b:00007ffcbb368e28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 352.837524] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7bee973c17 [ 352.838715] RDX: 0000000000000000 RSI: 00007ffcbb368e50 RDI: 0000000000000003 [ 352.839838] RBP: 00007ffcbb36d090 R08: 00000000cea96d79 R09: 00007f7beea34a40 [ 352.841021] R10: 00000000004059bb R11: 0000000000000246 R12: 000000000046563f [ 352.842208] R13: 0000000000000000 R14: 0000000000000000 R15: 00007ffcbb36d088
[ 352.843784] Allocated by task 2960: [ 352.844451] kasan_save_stack+0x1b/0x40 [ 352.845173] __kasan_kmalloc+0x7c/0x90 [ 352.845873] fl_change+0x282/0x22db [cls_flower] [ 352.846696] tc_new_tfilter+0x6cf/0x1180 [ 352.847493] rtnetlink_rcv_msg+0x471/0x550 [ 352.848323] netlink_rcv_skb+0xc6/0x1f0 [ 352.849097] netlink_unicast+0x353/0x480 [ 352.849886] netlink_sendmsg+0x396/0x680 [ 352.850678] sock_sendmsg+0x6c/0x80 [ 352.851398] ____sys_sendmsg+0x3a5/0x3c0 [ 352.852202] ___sys_sendmsg+0xd8/0x140 [ 352.852967] __sys_sendmsg+0xb3/0x130 [ 352.853718] do_syscall_64+0x35/0x80 [ 352.854457] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 352.855830] Freed by task 7: [ 352.856421] kasan_save_stack+0x1b/0x40 [ 352.857139] kasan_set_track+0x1c/0x30 [ 352.857854] kasan_set_free_info+0x20/0x30 [ 352.858609] __kasan_slab_free+0xed/0x130 [ 352.859348] kfree+0xa7/0x3c0 [ 352.859951] process_one_work+0x44d/0x780 [ 352.860685] worker_thread+0x2e2/0x7e0 [ 352.861390] kthread+0x1f4/0x220 [ 352.862022] ret_from_fork+0x1f/0x30
[ 352.862955] Last potentially related work creation: [ 352.863758] kasan_save_stack+0x1b/0x40 [ 352.864378] kasan_record_aux_stack+0xab/0xc0 [ 352.865028] insert_work+0x30/0x160 [ 352.865617] __queue_work+0x351/0x670 [ 352.866261] rcu_work_rcufn+0x30/0x40 [ 352.866917] rcu_core+0x3b2/0xdb0 [ 352.867561] __do_softirq+0xf6/0x386
[ 352.868708] Second to last potentially related work creation: [ 352.869779] kasan_save_stack+0x1b/0x40 [ 352.870560] kasan_record_aux_stack+0xab/0xc0 [ 352.871426] call_rcu+0x5f/0x5c0 [ 352.872108] queue_rcu_work+0x44/0x50 [ 352.872855] __fl_put+0x17c/0x240 [cls_flower] [ 352.873733] fl_delete+0xc7/0x100 [cls_flower] [ 352.874607] tc_del_tfilter+0x510/0xb30 [ 352.886085] rtnetlink_rcv_msg+0x471/0x550 [ 352.886875] netlink_rcv_skb+0xc6/0x1f0 [ 352.887636] netlink_unicast+0x353/0x480 [ 352.888285] netlink_sendmsg+0x396/0x680 [ 352.888942] sock_sendmsg+0x6c/0x80 [ 352.889583] ____sys_sendmsg+0x3a5/0x3c0 [ 352.890311] ___sys_sendmsg+0xd8/0x140 [ 352.891019] __sys_sendmsg+0xb3/0x130 [ 352.891716] do_syscall_64+0x35/0x80 [ 352.892395] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 352.893666] The buggy address belongs to the object at ffff8881c8251000
which belongs to the cache kmalloc-2k of size 2048
[ 352.895696] The buggy address is located 1152 bytes inside of
2048-byte region [ffff8881c8251000, ffff8881c8251800)
[ 352.897640] The buggy address belongs to the page:
[ 352.898492] page:00000000213bac35 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c8250
[ 352.900110] head:00000000213bac35 order:3 compound_mapcount:0 compound_pincount:0
[ 352.901541] flags: 0x2ffff800010200(slab|head|node=0|zone=2|lastcpupid=0x1ffff)
[ 352.902908] raw: 002ffff800010200 0000000000000000 dead000000000122 ffff888100042f00
[ 352.904391] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
[ 352.905861] page dumped because: kasan: bad access detected[ 352.907323] Memory state around the buggy address: [ 352.908218] ffff8881c8251380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.909471] ffff8881c8251400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.910735] >ffff8881c8251480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.912012] ^ [ 352.912642] ffff8881c8251500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.913919] ffff8881c8251580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 352.915185] ==================================================================
--- net/sched/cls_flower.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/cls_flower.c +6 -0
@@ -2169,18 +2169,24 @@ static void fl_walk(struct tcf_proto *tp, struct tcf_walker *arg, arg->count = arg->skip; +rcu_read_lock ();idr_for_each_entry_continue_ul (&head->handle_idr, f, tmp, id) {/* don't return filters that are being deleted */ if (!refcount_inc_not_zero (&f->refcnt))continue ; +rcu_read_unlock (); +if (arg->fn (tp, f, arg) <0 ) {__fl_put (f); arg->stop =1 ; +rcu_read_lock ();break ; }__fl_put (f); arg->count++; +rcu_read_lock (); } +rcu_read_unlock (); arg->cookie = id; }
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 65/93 af_unix: fix races in sk_peer_pid and sk_peer_cred accesses
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]
Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
In order to fix this issue, this patch adds a new spinlock that needs to be used whenever these fields are read or written.
Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently reading sk->sk_peer_pid which makes no sense, as this field
is only possibly set by AF_UNIX sockets.
We will have to clean this in a separate patch.
This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback" or implementing what was truly expected.
--- include/net/sock.h | 2 ++ net/core/sock.c | 32 ++++++++++++++++++++++++++------ net/unix/af_unix.c | 34 ++++++++++++++++++++++++++++------ 3 files changed, 56 insertions(+), 12 deletions(-)
include/net/sock.h +2 -0
@@ -479,8 +479,10 @@ struct sock {u32 sk_ack_backlog;u32 sk_max_ack_backlog;kuid_t sk_uid; +spinlock_t sk_peer_lock;struct pid *sk_peer_pid;const struct cred *sk_peer_cred; +long sk_rcvtimeo;ktime_t sk_stamp;#if BITS_PER_LONG ==32
net/core/sock.c +26 -6
@@ -1255,6 +1255,16 @@ int sock_setsockopt(struct socket *sock, int level, int optname, }EXPORT_SYMBOL (sock_setsockopt); +static const struct cred *sk_get_peer_cred (struct sock *sk) +{ +const struct cred *cred; + +spin_lock (&sk->sk_peer_lock); + cred =get_cred (sk->sk_peer_cred); +spin_unlock (&sk->sk_peer_lock); + +return cred; +}static void cred_to_ucred (struct pid *pid,const struct cred *cred,struct ucred *ucred)
@@ -1428,7 +1438,11 @@ int sock_getsockopt(struct socket *sock, int level, int optname,struct ucred peercred;if (len >sizeof (peercred)) len =sizeof (peercred); + +spin_lock (&sk->sk_peer_lock);cred_to_ucred (sk->sk_peer_pid, sk->sk_peer_cred, &peercred); +spin_unlock (&sk->sk_peer_lock); +if (copy_to_user (optval, &peercred, len))return -EFAULT ; goto lenout;
@@ -1436,20 +1450,23 @@ int sock_getsockopt(struct socket *sock, int level, int optname,case SO_PEERGROUPS : { +const struct cred *cred;int ret, n; -if (!sk->sk_peer_cred) + cred =sk_get_peer_cred (sk); +if (!cred)return -ENODATA ; - n = sk->sk_peer_cred->group_info->ngroups; + n = cred->group_info->ngroups;if (len < n *sizeof (gid_t)) { len = n *sizeof (gid_t); +put_cred (cred);return put_user (len, optlen) ? -EFAULT : -ERANGE ; } len = n *sizeof (gid_t); - ret =groups_to_user ((gid_t __user *)optval, - sk->sk_peer_cred->group_info); + ret =groups_to_user ((gid_t __user *)optval, cred->group_info); +put_cred (cred);if (ret)return ret; goto lenout;
@@ -1788,9 +1805,10 @@ static void __sk_destruct(struct rcu_head *head) sk->sk_frag.page =NULL ; } -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +/* We do not need to acquire sk->sk_peer_lock, we are the last user. */ +put_cred (sk->sk_peer_cred);put_pid (sk->sk_peer_pid); +if (likely (sk->sk_net_refcnt))put_net (sock_net (sk));sk_prot_free (sk->sk_prot_creator, sk);
@@ -3000,6 +3018,8 @@ void sock_init_data(struct socket *sock, struct sock *sk) sk->sk_peer_pid =NULL ; sk->sk_peer_cred =NULL ; +spin_lock_init (&sk->sk_peer_lock); + sk->sk_write_pending =0 ; sk->sk_rcvlowat =1 ; sk->sk_rcvtimeo =MAX_SCHEDULE_TIMEOUT ;
net/unix/af_unix.c +28 -6
@@ -593,20 +593,42 @@ static void unix_release_sock(struct sock *sk, int embrion)static void init_peercred (struct sock *sk) { -put_pid (sk->sk_peer_pid); -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +const struct cred *old_cred; +struct pid *old_pid; + +spin_lock (&sk->sk_peer_lock); + old_pid = sk->sk_peer_pid; + old_cred = sk->sk_peer_cred; sk->sk_peer_pid =get_pid (task_tgid (current)); sk->sk_peer_cred =get_current_cred (); +spin_unlock (&sk->sk_peer_lock); + +put_pid (old_pid); +put_cred (old_cred); }static void copy_peercred (struct sock *sk,struct sock *peersk) { -put_pid (sk->sk_peer_pid); -if (sk->sk_peer_cred) -put_cred (sk->sk_peer_cred); +const struct cred *old_cred; +struct pid *old_pid; + +if (sk < peersk) { +spin_lock (&sk->sk_peer_lock); +spin_lock_nested (&peersk->sk_peer_lock,SINGLE_DEPTH_NESTING ); + }else { +spin_lock (&peersk->sk_peer_lock); +spin_lock_nested (&sk->sk_peer_lock,SINGLE_DEPTH_NESTING ); + } + old_pid = sk->sk_peer_pid; + old_cred = sk->sk_peer_cred; sk->sk_peer_pid =get_pid (peersk->sk_peer_pid); sk->sk_peer_cred =get_cred (peersk->sk_peer_cred); + +spin_unlock (&sk->sk_peer_lock); +spin_unlock (&peersk->sk_peer_lock); + +put_pid (old_pid); +put_cred (old_cred); }static int unix_listen (struct socket *sock,int backlog)
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 66/93 perf/x86/intel: Update event constraints for ICX
In reply to Greg Kroah-HartmanFrom: Kan Liang <[email protected]>
[ Upstream commit ecc2123e09f9e71ddc6c53d71e283b8ada685fe2 ]
According to the latest event list, the event encoding 0xEF is only available on the first 4 counters. Add it into the event constraints table.
--- arch/x86/events/intel/core.c | 1 + 1 file changed, 1 insertion(+)
arch/x86/events/intel/core.c +1 -0
@@ -263,6 +263,7 @@ static struct event_constraint intel_icl_event_constraints[] = {INTEL_EVENT_CONSTRAINT_RANGE (0xa8 ,0xb0 ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xb7 ,0xbd ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xd0 ,0xe6 ,0xf ), +INTEL_EVENT_CONSTRAINT (0xef ,0xf ),INTEL_EVENT_CONSTRAINT_RANGE (0xf0 ,0xf4 ,0xf ), EVENT_CONSTRAINT_END };
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 67/93 hwmon: (pmbus/mp2975) Add missed POUT attribute for page 1 mp2975 controller
In reply to Greg Kroah-HartmanFrom: Vadim Pasternak <[email protected]>
[ Upstream commit 2292e2f685cd5c65e3f47bbcf9f469513acc3195 ]
Add missed attribute for reading POUT from page 1.
It is supported by device, but has been missed in initial commit.
--- drivers/hwmon/pmbus/mp2975.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/hwmon/pmbus/mp2975.c +1 -1
@@ -54,7 +54,7 @@#define MP2975_RAIL2_FUNC (PMBUS_HAVE_VOUT | PMBUS_HAVE_STATUS_VOUT | \ PMBUS_HAVE_IOUT | PMBUS_HAVE_STATUS_IOUT | \ - PMBUS_PHASE_VIRTUAL) + PMBUS_HAVE_POUT | PMBUS_PHASE_VIRTUAL)struct mp2975_data {struct pmbus_driver_info info;
Signature · 1 line
2.33.0
Greg Kroah-Hartman
maintainerPATCH 68/93 nvme: add command id quirk for apple controllers
In reply to Greg Kroah-HartmanFrom: Keith Busch <[email protected]>
commit a2941f6aa71a72be2c82c0a168523a492d093530 upstream.
Some apple controllers use the command id as an index to implementation specific data structures and will fail if the value is out of bounds. The nvme driver's recently introduced command sequence number breaks this controller.
Provide a quirk so these spec incompliant controllers can function as before. The driver will not have the ability to detect bad completions when this quirk is used, but we weren't previously checking this anyway.
The quirk bit was selected so that it can readily apply to stable.
--- drivers/nvme/host/core.c | 4 +++- drivers/nvme/host/nvme.h | 6 ++++++ drivers/nvme/host/pci.c | 3 ++- 3 files changed, 11 insertions(+), 2 deletions(-)
drivers/nvme/host/core.c +3 -1
@@ -831,6 +831,7 @@ EXPORT_SYMBOL_GPL(nvme_cleanup_cmd);blk_status_t nvme_setup_cmd (struct nvme_ns *ns,struct request *req,struct nvme_command *cmd) { +struct nvme_ctrl *ctrl =nvme_req (req)->ctrl;blk_status_t ret =BLK_STS_OK ;nvme_clear_nvme_request (req);
@@ -877,7 +878,8 @@ blk_status_t nvme_setup_cmd(struct nvme_return BLK_STS_IOERR ; } -nvme_req (req)->genctr++; +if (!(ctrl->quirks &NVME_QUIRK_SKIP_CID_GEN )) +nvme_req (req)->genctr++; cmd->common.command_id =nvme_cid (req);trace_nvme_setup_cmd (req, cmd);return ret;
drivers/nvme/host/nvme.h +6 -0
@@ -144,6 +144,12 @@ enum nvme_quirks {* NVMe 1.3 compliance. */ NVME_QUIRK_NO_NS_DESC_LIST = (1 <<15 ), + +/* +* The controller requires the command_id value be be limited, so skip +* encoding the generation sequence number. +*/ + NVME_QUIRK_SKIP_CID_GEN = (1 << 17), };/*
drivers/nvme/host/pci.c +2 -1
@@ -3259,7 +3259,8 @@ static const struct pci_device_id nvme_i { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2005), .driver_data =NVME_QUIRK_SINGLE_VECTOR |NVME_QUIRK_128_BYTES_SQES | - NVME_QUIRK_SHARED_TAGS }, +NVME_QUIRK_SHARED_TAGS | + NVME_QUIRK_SKIP_CID_GEN }, { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, { 0, }
Greg Kroah-Hartman
maintainerPATCH 69/93 elf: dont use MAP_FIXED_NOREPLACE for elf interpreter mappings
In reply to Greg Kroah-HartmanFrom: Chen Jingwen <[email protected]>
commit 9b2f72cc0aa4bb444541bb87581c35b7508b37d3 upstream.
In commit b212921b13bd ("elf: don't use MAP_FIXED_NOREPLACE for elf executable mappings") we still leave MAP_FIXED_NOREPLACE in place for load_elf_interp.
Unfortunately, this will cause kernel to fail to start with:
1 (init): Uhuuh, elf segment at 00003ffff7ffd000 requested but the memory is mapped already Failed to execute /init (error -17)
The reason is that the elf interpreter (ld.so) has overlapping segments.
readelf -l ld-2.31.so
Program Headers:
Type Offset VirtAddr PhysAddr
FileSiz MemSiz Flags Align
LOAD 0x0000000000000000 0x0000000000000000 0x0000000000000000
0x000000000002c94c 0x000000000002c94c R E 0x10000
LOAD 0x000000000002dae0 0x000000000003dae0 0x000000000003dae0
0x00000000000021e8 0x0000000000002320 RW 0x10000
LOAD 0x000000000002fe00 0x000000000003fe00 0x000000000003fe00
0x00000000000011ac 0x0000000000001328 RW 0x10000The reason for this problem is the same as described in commit ad55eac74f20 ("elf: enforce MAP_FIXED on overlaying elf segments").
Not only executable binaries, elf interpreters (e.g. ld.so) can have overlapping elf segments, so we better drop MAP_FIXED_NOREPLACE and go back to MAP_FIXED in load_elf_interp.
--- fs/binfmt_elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/binfmt_elf.c +1 -1
@@ -627,7 +627,7 @@ static unsigned long load_elf_interp(str vaddr = eppnt->p_vaddr;if (interp_elf_ex->e_type ==ET_EXEC || load_addr_set) - elf_type |=MAP_FIXED_NOREPLACE ; + elf_type |=MAP_FIXED ;else if (no_base && interp_elf_ex->e_type ==ET_DYN ) load_addr = -vaddr;
Greg Kroah-Hartman
maintainerPATCH 70/93 debugfs: debugfs_create_file_size(): use IS_ERR to check for error
In reply to Greg Kroah-HartmanFrom: Nirmoy Das <[email protected]>
commit af505cad9567f7a500d34bf183696d570d7f6810 upstream.
debugfs_create_file() returns encoded error so use IS_ERR for checking return value.
--- fs/debugfs/inode.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/debugfs/inode.c +1 -1
@@ -524,7 +524,7 @@ void debugfs_create_file_size(const char {struct dentry *de =debugfs_create_file (name, mode, parent, data, fops); -if (de) +if (!IS_ERR (de))d_inode (de)->i_size = file_size; }EXPORT_SYMBOL_GPL (debugfs_create_file_size);
Greg Kroah-Hartman
maintainerPATCH 71/93 ipack: ipoctal: fix stack information leak
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit a89936cce87d60766a75732a9e7e25c51164f47c upstream.
The tty driver name is used also after registering the driver and must specifically not be allocated on the stack to avoid leaking information to user space (or triggering an oops).
Drivers should not try to encode topology information in the tty device name but this one snuck in through staging without anyone noticing and another driver has since copied this malpractice.
Fixing the ABI is a separate issue, but this at least plugs the security hole.
--- drivers/ipack/devices/ipoctal.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
drivers/ipack/devices/ipoctal.c +14 -5
@@ -266,7 +266,6 @@ static int ipoctal_inst_slot(struct ipocint res;int i;struct tty_driver *tty; -char name[20 ];struct ipoctal_channel *channel;struct ipack_region *region;void __iomem *addr;
@@ -357,8 +356,11 @@ static int ipoctal_inst_slot(struct ipoc/* Fill struct tty_driver with ipoctal data */ tty->owner =THIS_MODULE ; tty->driver_name =KBUILD_MODNAME ; -sprintf (name,KBUILD_MODNAME ".%d.%d." , bus_nr, slot); - tty->name = name; + tty->name =kasprintf (GFP_KERNEL ,KBUILD_MODNAME ".%d.%d." , bus_nr, slot); +if (!tty->name) { + res = -ENOMEM ; + goto err_put_driver; + } tty->major =0 ; tty->minor_start =0 ;
@@ -374,8 +376,7 @@ static int ipoctal_inst_slot(struct ipoc res =tty_register_driver (tty);if (res) {dev_err (&ipoctal->dev->dev,"Can't register tty driver.\n" ); -put_tty_driver (tty); -return res; + goto err_free_name; }/* Save struct tty_driver for use it when uninstalling the device */
@@ -412,6 +413,13 @@ static int ipoctal_inst_slot(struct ipoc ipoctal_irq_handler, ipoctal);return 0 ; + +err_free_name: +kfree (tty->name); +err_put_driver: +put_tty_driver (tty); + +return res; } static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel,
@@ -700,6 +708,7 @@ static void __ipoctal_remove(struct ipoc }tty_unregister_driver (ipoctal->tty_drv); +kfree (ipoctal->tty_drv->name);put_tty_driver (ipoctal->tty_drv);kfree (ipoctal); }
Greg Kroah-Hartman
maintainerPATCH 72/93 ipack: ipoctal: fix tty registration race
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 65c001df517a7bf9be8621b53d43c89f426ce8d6 upstream.
Make sure to set the tty class-device driver data before registering the tty to avoid having a racing open() dereference a NULL pointer.
--- drivers/ipack/devices/ipoctal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/ipack/devices/ipoctal.c +2 -2
@@ -395,13 +395,13 @@ static int ipoctal_inst_slot(struct ipocspin_lock_init (&channel->lock); channel->pointer_read =0 ; channel->pointer_write =0 ; - tty_dev =tty_port_register_device (&channel->tty_port, tty, i,NULL ); + tty_dev =tty_port_register_device_attr (&channel->tty_port, tty, + i,NULL , channel,NULL );if (IS_ERR (tty_dev)) {dev_err (&ipoctal->dev->dev,"Failed to register tty device.\n" );tty_port_destroy (&channel->tty_port);continue ; } -dev_set_drvdata (tty_dev, channel); }/*
Greg Kroah-Hartman
maintainerPATCH 73/93 ipack: ipoctal: fix tty-registration error handling
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit cd20d59291d1790dc74248476e928f57fc455189 upstream.
Registration of the ipoctal tty devices is unlikely to fail, but if it ever does, make sure not to deregister a never registered tty device (and dereference a NULL pointer) when the driver is later unbound.
--- drivers/ipack/devices/ipoctal.c | 7 +++++++ 1 file changed, 7 insertions(+)
drivers/ipack/devices/ipoctal.c +7 -0
@@ -35,6 +35,7 @@ struct ipoctal_channel {unsigned int pointer_read;unsigned int pointer_write;struct tty_port tty_port; +bool tty_registered;union scc2698_channel __iomem *regs;union scc2698_block __iomem *block_regs;unsigned int board_id;
@@ -399,9 +400,11 @@ static int ipoctal_inst_slot(struct ipoc i, NULL, channel, NULL);if (IS_ERR (tty_dev)) {dev_err (&ipoctal->dev->dev,"Failed to register tty device.\n" ); +tty_port_free_xmit_buf (&channel->tty_port);tty_port_destroy (&channel->tty_port);continue ; } + channel->tty_registered = true; }/*
@@ -702,6 +705,10 @@ static void __ipoctal_remove(struct ipocfor (i =0 ; i <NR_CHANNELS ; i++) {struct ipoctal_channel *channel = &ipoctal->channel[i]; + +if (!channel->tty_registered) +continue ; +tty_unregister_device (ipoctal->tty_drv, i);tty_port_free_xmit_buf (&channel->tty_port);tty_port_destroy (&channel->tty_port);
Greg Kroah-Hartman
maintainerPATCH 74/93 ipack: ipoctal: fix missing allocation-failure check
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit 445c8132727728dc297492a7d9fc074af3e94ba3 upstream.
Add the missing error handling when allocating the transmit buffer to avoid dereferencing a NULL pointer in write() should the allocation ever fail.
--- drivers/ipack/devices/ipoctal.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/ipack/devices/ipoctal.c +3 -1
@@ -388,7 +388,9 @@ static int ipoctal_inst_slot(struct ipoc channel = &ipoctal->channel[i];tty_port_init (&channel->tty_port); -tty_port_alloc_xmit_buf (&channel->tty_port); + res =tty_port_alloc_xmit_buf (&channel->tty_port); +if (res) +continue ; channel->tty_port.ops = &ipoctal_tty_port_ops;ipoctal_reset_stats (&channel->stats);
Greg Kroah-Hartman
maintainerPATCH 75/93 ipack: ipoctal: fix module reference leak
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
commit bb8a4fcb2136508224c596a7e665bdba1d7c3c27 upstream.
A reference to the carrier module was taken on every open but was only released once when the final reference to the tty struct was dropped.
Fix this by taking the module reference and initialising the tty driver data when installing the tty.
--- drivers/ipack/devices/ipoctal.c | 29 +++++++++++++++++++++-------- 1 file changed, 21 insertions(+), 8 deletions(-)
drivers/ipack/devices/ipoctal.c +21 -8
@@ -84,22 +84,34 @@ static int ipoctal_port_activate(structreturn 0 ; } -static int ipoctal_open (struct tty_struct *tty,struct file *file) +static int ipoctal_install (struct tty_driver *driver,struct tty_struct *tty) {struct ipoctal_channel *channel =dev_get_drvdata (tty->dev);struct ipoctal *ipoctal =chan_to_ipoctal (channel, tty->index); -int err; - - tty->driver_data = channel; +int res;if (!ipack_get_carrier (ipoctal->dev))return -EBUSY ; - err =tty_port_open (&channel->tty_port, tty, file); -if (err) -ipack_put_carrier (ipoctal->dev); + res =tty_standard_install (driver, tty); +if (res) + goto err_put_carrier; + + tty->driver_data = channel; + +return 0 ; + +err_put_carrier: +ipack_put_carrier (ipoctal->dev); + +return res; +} + +static int ipoctal_open (struct tty_struct *tty,struct file *file) +{ +struct ipoctal_channel *channel = tty->driver_data; -return err; +return tty_port_open (&channel->tty_port, tty, file); }static void ipoctal_reset_stats (struct ipoctal_stats *stats)
@@ -665,6 +677,7 @@ static void ipoctal_cleanup(struct tty_sstatic const struct tty_operations ipoctal_fops = { .ioctl =NULL , + .install = ipoctal_install, .open = ipoctal_open, .close = ipoctal_close, .write = ipoctal_write_tty,
Greg Kroah-Hartman
maintainerPATCH 76/93 ext4: fix loff_t overflow in ext4_max_bitmap_size()
In reply to Greg Kroah-HartmanFrom: Ritesh Harjani <[email protected]>
commit 75ca6ad408f459f00b09a64f04c774559848c097 upstream.
We should use unsigned long long rather than loff_t to avoid overflow in ext4_max_bitmap_size() for comparison before returning. w/o this patch sbi->s_bitmap_maxbytes was becoming a negative value due to overflow of upper_limit (with has_huge_files as true)
Below is a quick test to trigger it on a 64KB pagesize system.
sudo mkfs.ext4 -b 65536 -O ^has_extents,^64bit /dev/loop2 sudo mount /dev/loop2 /mnt
sudo echo "hello" > /mnt/hello -> This will error out with
"echo: write error: File too large"
--- fs/ext4/super.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
fs/ext4/super.c +5 -5
@@ -3194,17 +3194,17 @@ static loff_t ext4_max_size(int blkbits,*/ static loff_t ext4_max_bitmap_size (int bits,int has_huge_files) { -loff_t res =EXT4_NDIR_BLOCKS ; +unsigned long long upper_limit, res =EXT4_NDIR_BLOCKS ;int meta_blocks; -loff_t upper_limit; -/* This is calculated to be the largest file size for a dense, block + +/* +* This is calculated to be the largest file size for a dense, block * mapped file such that the file's total number of 512-byte sectors, * including data and all indirect blocks, does not exceed (2^48 - 1). * * __u32 i_blocks_lo and _u16 i_blocks_high represent the total * number of 512-byte sectors of the file. */ -if (!has_huge_files) {/* * !has_huge_files or implies that the inode i_block field
@@ -3247,7 +3247,7 @@ static loff_t ext4_max_bitmap_size(int bif (res >MAX_LFS_FILESIZE ) res =MAX_LFS_FILESIZE ; -return res; +return (loff_t )res; } static ext4_fsblk_t descriptor_loc(struct super_block *sb,
Greg Kroah-Hartman
maintainerPATCH 77/93 ext4: limit the number of blocks in one ADD_RANGE TLV
In reply to Greg Kroah-HartmanFrom: Hou Tao <[email protected]>
commit a2c2f0826e2b75560b31daf1cd9a755ab93cf4c6 upstream.
Now EXT4_FC_TAG_ADD_RANGE uses ext4_extent to track the newly-added blocks, but the limit on the max value of ee_len field is ignored, and it can lead to BUG_ON as shown below when running command "fallocate -l 128M file" on a fast_commit-enabled fs:
kernel BUG at fs/ext4/ext4_extents.h:199! invalid opcode: 0000 [#1] SMP PTI
CPU: 3 PID: 624 Comm: fallocate Not tainted 5.14.0-rc6+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:ext4_fc_write_inode_data+0x1f3/0x200 Call Trace: ? ext4_fc_write_inode+0xf2/0x150 ext4_fc_commit+0x93b/0xa00 ? ext4_fallocate+0x1ad/0x10d0 ext4_sync_file+0x157/0x340 ? ext4_sync_file+0x157/0x340 vfs_fsync_range+0x49/0x80 do_fsync+0x3d/0x70 __x64_sys_fsync+0x14/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae
Simply fixing it by limiting the number of blocks in one EXT4_FC_TAG_ADD_RANGE TLV.
--- fs/ext4/fast_commit.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/fast_commit.c +6 -0
@@ -832,6 +832,12 @@ static int ext4_fc_write_inode_data(stru sizeof(lrange), (u8 *)&lrange, crc))return -ENOSPC ; }else { +unsigned int max = (map.m_flags &EXT4_MAP_UNWRITTEN ) ? +EXT_UNWRITTEN_MAX_LEN :EXT_INIT_MAX_LEN ; + +/* Limit the number of blocks in one extent */ + map.m_len =min (max, map.m_len); + fc_ext.fc_ino =cpu_to_le32 (inode->i_ino); ex = (struct ext4_extent *)&fc_ext.fc_ex; ex->ee_block =cpu_to_le32 (map.m_lblk);
Greg Kroah-Hartman
maintainerPATCH 78/93 ext4: fix reserved space counter leakage
In reply to Greg Kroah-HartmanFrom: Jeffle Xu <[email protected]>
commit 6fed83957f21eff11c8496e9f24253b03d2bc1dc upstream.
When ext4_insert_delayed block receives and recovers from an error from ext4_es_insert_delayed_block(), e.g., ENOMEM, it does not release the space it has reserved for that block insertion as it should. One effect of this bug is that s_dirtyclusters_counter is not decremented and remains incorrectly elevated until the file system has been unmounted. This can result in premature ENOSPC returns and apparent loss of free space.
Another effect of this bug is that /sys/fs/ext4/<dev>/delayed_allocation_blocks can remain non-zero even after syncfs has been executed on the filesystem.
Besides, add check for s_dirtyclusters_counter when inode is going to be evicted and freed. s_dirtyclusters_counter can still keep non-zero until inode is written back in .evict_inode(), and thus the check is delayed to .destroy_inode().
--- fs/ext4/inode.c | 5 +++++ fs/ext4/super.c | 6 ++++++ 2 files changed, 11 insertions(+)
fs/ext4/inode.c +5 -0
@@ -1641,6 +1641,7 @@ static int ext4_insert_delayed_block(strstruct ext4_sb_info *sbi =EXT4_SB (inode->i_sb);int ret;bool allocated = false; +bool reserved = false;/* * If the cluster containing lblk is shared with a delayed,
@@ -1657,6 +1658,7 @@ static int ext4_insert_delayed_block(str ret =ext4_da_reserve_space (inode);if (ret !=0 )/* ENOSPC */ goto errout; + reserved = true; } else { /* bigalloc */ if (!ext4_es_scan_clu(inode, &ext4_es_is_delonly, lblk)) { if (!ext4_es_scan_clu(inode,
@@ -1669,6 +1671,7 @@ static int ext4_insert_delayed_block(str ret =ext4_da_reserve_space (inode);if (ret !=0 )/* ENOSPC */ goto errout; + reserved = true; }else { allocated = true; }
@@ -1679,6 +1682,8 @@ static int ext4_insert_delayed_block(str } ret =ext4_es_insert_delayed_block (inode, lblk, allocated); +if (ret && reserved) +ext4_da_release_space (inode,1 ); errout:return ret;
fs/ext4/super.c +6 -0
@@ -1356,6 +1356,12 @@ static void ext4_destroy_inode(struct in true);dump_stack (); } + +if (EXT4_I (inode)->i_reserved_data_blocks) +ext4_msg (inode->i_sb,KERN_ERR , +"Inode %lu (%p): i_reserved_data_blocks (%u) not cleared!" , + inode->i_ino,EXT4_I (inode), +EXT4_I (inode)->i_reserved_data_blocks); }static void init_once (void *foo)
Greg Kroah-Hartman
maintainerPATCH 79/93 ext4: add error checking to ext4_ext_replay_set_iblocks()
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit 1fd95c05d8f742abfe906620780aee4dbe1a2db0 upstream.
If the call to ext4_map_blocks() fails due to an corrupted file system, ext4_ext_replay_set_iblocks() can get stuck in an infinite loop. This could be reproduced by running generic/526 with a file system that has inline_data and fast_commit enabled. The system will repeatedly log to the console:
EXT4-fs warning (device dm-3): ext4_block_to_path:105: block 1074800922 > max in inode 131076
and the stack that it gets stuck in is:
ext4_block_to_path+0xe3/0x130 ext4_ind_map_blocks+0x93/0x690 ext4_map_blocks+0x100/0x660 skip_hole+0x47/0x70 ext4_ext_replay_set_iblocks+0x223/0x440 ext4_fc_replay_inode+0x29e/0x3b0 ext4_fc_replay+0x278/0x550 do_one_pass+0x646/0xc10 jbd2_journal_recover+0x14a/0x270 jbd2_journal_load+0xc4/0x150 ext4_load_journal+0x1f3/0x490 ext4_fill_super+0x22d4/0x2c00
With this patch, generic/526 still fails, but system is no longer locking up in a tight loop. It's likely the root casue is that fast_commit replay is corrupting file systems with inline_data, and we probably need to add better error handling in the fast commit replay code path beyond what is done here, which essentially just breaks the infinite loop without reporting the to the higher levels of the code.
--- fs/ext4/extents.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-)
fs/ext4/extents.c +14 -5
@@ -5907,7 +5907,7 @@ void ext4_ext_replay_shrink_inode(struct }/* Check if *cur is a hole and if it is, skip it */ -static void skip_hole (struct inode *inode,ext4_lblk_t *cur) +static int skip_hole (struct inode *inode,ext4_lblk_t *cur) {int ret;struct ext4_map_blocks map;
@@ -5916,9 +5916,12 @@ static void skip_hole(struct inode *inod map.m_len = ((inode->i_size) >> inode->i_sb->s_blocksize_bits) - *cur; ret =ext4_map_blocks (NULL , inode, &map,0 ); +if (ret <0 ) +return ret;if (ret !=0 ) -return ; +return 0 ; *cur = *cur + map.m_len; +return 0 ; }/* Count number of blocks used by this inode and update i_blocks */
@@ -5967,7 +5970,9 @@ int ext4_ext_replay_set_iblocks(struct i* iblocks by total number of differences found. */ cur =0 ; -skip_hole (inode, &cur); + ret =skip_hole (inode, &cur); +if (ret <0 ) + goto out; path =ext4_find_extent (inode, cur,NULL ,0 );if (IS_ERR (path)) goto out;
@@ -5986,8 +5991,12 @@ int ext4_ext_replay_set_iblocks(struct i } cur =max (cur +1 ,le32_to_cpu (ex->ee_block) +ext4_ext_get_actual_len (ex)); -skip_hole (inode, &cur); - + ret =skip_hole (inode, &cur); +if (ret <0 ) { +ext4_ext_drop_refs (path); +kfree (path); +break ; + } path2 =ext4_find_extent (inode, cur,NULL ,0 );if (IS_ERR (path2)) {ext4_ext_drop_refs (path);
Greg Kroah-Hartman
maintainerPATCH 80/93 ext4: fix potential infinite loop in ext4_dx_readdir()
In reply to Greg Kroah-HartmanFrom: yangerkun <[email protected]>
commit 42cb447410d024e9d54139ae9c21ea132a8c384c upstream.
When ext4_htree_fill_tree() fails, ext4_dx_readdir() can run into an infinite loop since if info->last_pos != ctx->pos this will reset the directory scan and reread the failing entry. For example:
1. a dx_dir which has 3 block, block 0 as dx_root block, block 1/2 as leaf block which own the ext4_dir_entry_2
2. block 1 read ok and call_filldir which will fill the dirent and update the ctx->pos
3. block 2 read fail, but we has already fill some dirent, so we will return back to userspace will a positive return val(see ksys_getdents64)
4. the second ext4_dx_readdir will reset the world since info->last_pos != ctx->pos, and will also init the curr_hash which pos to block 1
5. So we will read block1 too, and once block2 still read fail, we can only fill one dirent because the hash of the entry in block1(besides the last one) won't greater than curr_hash
6. this time, we forget update last_pos too since the read for block2 will fail, and since we has got the one entry, ksys_getdents64 can return success
7. Latter we will trapped in a loop with step 4~6
--- fs/ext4/dir.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
fs/ext4/dir.c +3 -3
@@ -534,7 +534,7 @@ static int ext4_dx_readdir(struct file *struct dir_private_info *info = file->private_data;struct inode *inode =file_inode (file);struct fname *fname; -int ret; +int ret =0 ;if (!info) { info =ext4_htree_create_dir_info (file, ctx->pos);
@@ -582,7 +582,7 @@ static int ext4_dx_readdir(struct file * info->curr_minor_hash, &info->next_hash);if (ret <0 ) -return ret; + goto finished;if (ret ==0 ) { ctx->pos =ext4_get_htree_eof (file);break ;
@@ -613,7 +613,7 @@ static int ext4_dx_readdir(struct file * } finished: info->last_pos = ctx->pos; -return 0 ; +return ret <0 ? ret :0 ; }static int ext4_dir_open (struct inode * inode,struct file * filp)
Greg Kroah-Hartman
maintainerPATCH 81/93 HID: u2fzero: ignore incomplete packets without data
In reply to Greg Kroah-HartmanFrom: Andrej Shadura <[email protected]>
commit 22d65765f211cc83186fd8b87521159f354c0da9 upstream.
Since the actual_length calculation is performed unsigned, packets shorter than 7 bytes (e.g. packets without data or otherwise truncated) or non-received packets ("zero" bytes) can cause buffer overflow.
--- drivers/hid/hid-u2fzero.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/hid/hid-u2fzero.c +3 -1
@@ -198,7 +198,9 @@ static int u2fzero_rng_read(struct hwrng } ret =u2fzero_recv (dev, &req, &resp); -if (ret <0 ) + +/* ignore errors or packets without data */ + if (ret < offsetof(struct u2f_hid_msg, init.data))return 0 ;/* only take the minimum amount of data it is safe to take */
Greg Kroah-Hartman
maintainerPATCH 82/93 net: udp: annotate data race around udp_sk(sk)->corkflag
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit a9f5970767d11eadc805d5283f202612c7ba1f59 upstream.
up->corkflag field can be read or written without any lock. Annotate accesses to avoid possible syzbot/KCSAN reports.
--- net/ipv4/udp.c | 10 +++++----- net/ipv6/udp.c | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-)
net/ipv4/udp.c +5 -5
@@ -1035,7 +1035,7 @@ int udp_sendmsg(struct sock *sk, struct__be16 dport;u8 tos;int err, is_udplite =IS_UDPLITE (sk); -int corkreq = up->corkflag || msg->msg_flags&MSG_MORE ; +int corkreq =READ_ONCE (up->corkflag) || msg->msg_flags&MSG_MORE ;int (*getfrag)(void *,char *,int ,int ,int ,struct sk_buff *);struct sk_buff *skb;struct ip_options_data opt_copy;
@@ -1343,7 +1343,7 @@ int udp_sendpage(struct sock *sk, struct } up->len += size; -if (!(up->corkflag || (flags&MSG_MORE ))) +if (!(READ_ONCE (up->corkflag) || (flags&MSG_MORE ))) ret =udp_push_pending_frames (sk);if (!ret) ret = size;
@@ -2609,9 +2609,9 @@ int udp_lib_setsockopt(struct sock *sk,switch (optname) {case UDP_CORK :if (val !=0 ) { - up->corkflag =1 ; +WRITE_ONCE (up->corkflag,1 ); }else { - up->corkflag =0 ; +WRITE_ONCE (up->corkflag,0 );lock_sock (sk);push_pending_frames (sk);release_sock (sk);
@@ -2734,7 +2734,7 @@ int udp_lib_getsockopt(struct sock *sk,switch (optname) {case UDP_CORK : - val = up->corkflag; + val =READ_ONCE (up->corkflag);break ;case UDP_ENCAP :
net/ipv6/udp.c +1 -1
@@ -1288,7 +1288,7 @@ int udpv6_sendmsg(struct sock *sk, strucint addr_len = msg->msg_namelen;bool connected = false;int ulen = len; -int corkreq = up->corkflag || msg->msg_flags&MSG_MORE ; +int corkreq =READ_ONCE (up->corkflag) || msg->msg_flags&MSG_MORE ;int err;int is_udplite =IS_UDPLITE (sk);int (*getfrag)(void *,char *,int ,int ,int ,struct sk_buff *);
Greg Kroah-Hartman
maintainerPATCH 83/93 ASoC: dapm: use component prefix when checking widget names
In reply to Greg Kroah-HartmanFrom: Shuming Fan <[email protected]>
commit ae4fc532244b3bb4d86c397418d980b0c6be1dfd upstream.
On a TigerLake SoundWire platform, we see these warnings:
[ 27.360086] rt5682 sdw:0:25d:5682:0: ASoC: DAPM unknown pin MICBIAS [ 27.360092] rt5682 sdw:0:25d:5682:0: ASoC: DAPM unknown pin Vref2
This is root-caused to the addition of a component prefix in the machine driver. The tests in soc-dapm should account for a prefix instead of reporting an invalid issue.
--- sound/soc/soc-dapm.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
sound/soc/soc-dapm.c +12 -1
@@ -2528,9 +2528,20 @@ static struct snd_soc_dapm_widget *dapm_ {struct snd_soc_dapm_widget *w;struct snd_soc_dapm_widget *fallback =NULL ; +char prefixed_pin[80 ]; +const char *pin_name; +const char *prefix =soc_dapm_prefix (dapm); + +if (prefix) { +snprintf (prefixed_pin,sizeof (prefixed_pin),"%s %s" , + prefix, pin); + pin_name = prefixed_pin; + }else { + pin_name = pin; + }for_each_card_widgets (dapm->card, w) { -if (!strcmp (w->name, pin)) { +if (!strcmp (w->name, pin_name)) {if (w->dapm == dapm)return w;else
Greg Kroah-Hartman
maintainerPATCH 84/93 usb: hso: remove the bailout parameter
In reply to Greg Kroah-HartmanFrom: Dongliang Mu <[email protected]>
commit dcb713d53e2eadf42b878c12a471e74dc6ed3145 upstream.
There are two invocation sites of hso_free_net_device. After refactoring hso_create_net_device, this parameter is useless. Remove the bailout in the hso_free_net_device and change the invocation sites of this function.
[Backport this cleanup patch to 5.10 and 5.14 in order to keep the codebase consistent with the 4.14/4.19/5.4 patchseries]
--- drivers/net/usb/hso.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/usb/hso.c +3 -3
@@ -2354,7 +2354,7 @@ static int remove_net_device(struct hso_ }/* Frees our network device */ -static void hso_free_net_device (struct hso_device *hso_dev,bool bailout) +static void hso_free_net_device (struct hso_device *hso_dev) {int i;struct hso_net *hso_net =dev2net (hso_dev);
@@ -2377,7 +2377,7 @@ static void hso_free_net_device(struct hkfree (hso_net->mux_bulk_tx_buf); hso_net->mux_bulk_tx_buf =NULL ; -if (hso_net->net && !bailout) +if (hso_net->net)free_netdev (hso_net->net);kfree (hso_dev);
@@ -3137,7 +3137,7 @@ static void hso_free_interface(struct usrfkill_unregister (rfk);rfkill_destroy (rfk); } -hso_free_net_device (network_table[i], false); +hso_free_net_device (network_table[i]); } } }
Greg Kroah-Hartman
maintainerPATCH 85/93 crypto: ccp - fix resource leaks in ccp_run_aes_gcm_cmd()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
commit 505d9dcb0f7ddf9d075e729523a33d38642ae680 upstream.
There are three bugs in this code:
1) If we ccp_init_data() fails for &src then we need to free aad. Use goto e_aad instead of goto e_ctx.
2) The label to free the &final_wa was named incorrectly as "e_tag" but it should have been "e_final_wa". One error path leaked &final_wa.
3) The &tag was leaked on one error path. In that case, I added a free before the goto because the resource was local to that block.
--- drivers/crypto/ccp/ccp-ops.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-)
drivers/crypto/ccp/ccp-ops.c +8 -6
@@ -778,7 +778,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue in_place ?DMA_BIDIRECTIONAL : DMA_TO_DEVICE);if (ret) - goto e_ctx; + goto e_aad;if (in_place) { dst = src;
@@ -863,7 +863,7 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue op.u.aes.size =0 ; ret = cmd_q->ccp->vdata->perform->aes (&op);if (ret) - goto e_dst; + goto e_final_wa;if (aes->action ==CCP_AES_ACTION_ENCRYPT ) {/* Put the ciphered tag after the ciphertext. */
@@ -873,17 +873,19 @@ ccp_run_aes_gcm_cmd(struct ccp_cmd_queue ret =ccp_init_dm_workarea (&tag, cmd_q, authsize,DMA_BIDIRECTIONAL );if (ret) - goto e_tag; + goto e_final_wa; ret =ccp_set_dm_area (&tag,0 , p_tag,0 , authsize); -if (ret) - goto e_tag; +if (ret) { +ccp_dm_free (&tag); + goto e_final_wa; + } ret =crypto_memneq (tag.address, final_wa.address, authsize) ? -EBADMSG :0 ;ccp_dm_free (&tag); } -e_tag: +e_final_wa:ccp_dm_free (&final_wa); e_dst:
Greg Kroah-Hartman
maintainerPATCH 86/93 HID: betop: fix slab-out-of-bounds Write in betop_probe
In reply to Greg Kroah-HartmanFrom: F.A.Sulaiman <[email protected]>
commit 1e4ce418b1cb1a810256b5fb3fd33d22d1325993 upstream.
Syzbot reported slab-out-of-bounds Write bug in hid-betopff driver. The problem is the driver assumes the device must have an input report but some malicious devices violate this assumption.
So this patch checks hid_device's input is non empty before it's been used.
--- drivers/hid/hid-betopff.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-)
drivers/hid/hid-betopff.c +10 -3
@@ -56,15 +56,22 @@ static int betopff_init(struct hid_devic {struct betopff_device *betopff;struct hid_report *report; -struct hid_input *hidinput = - list_first_entry(&hid->inputs, struct hid_input, list); +struct hid_input *hidinput;struct list_head *report_list = &hid->report_enum[HID_OUTPUT_REPORT ].report_list; -struct input_dev *dev = hidinput->input; +struct input_dev *dev;int field_count =0 ;int error;int i, j; +if (list_empty (&hid->inputs)) { +hid_err (hid,"no inputs found\n" ); +return -ENODEV ; + } + + hidinput = list_first_entry(&hid->inputs, struct hid_input, list); + dev = hidinput->input; +if (list_empty (report_list)) {hid_err (hid,"no output reports found\n" );return -ENODEV ;
Greg Kroah-Hartman
maintainerPATCH 87/93 netfilter: ipset: Fix oversized kvmalloc() calls
In reply to Greg Kroah-HartmanFrom: Jozsef Kadlecsik <[email protected]>
commit 7bbc3d385bd813077acaf0e6fdb2a86a901f5382 upstream.
The commit
commit 7661809d493b426e979f39ab512e3adf41fbcc69
Author: Linus Torvalds <[email protected]> Date: Wed Jul 14 09:45:49 2021 -0700
mm: don't allow oversized kvmalloc() calls
limits the max allocatable memory via kvmalloc() to MAX_INT. Apply the same limit in ipset.
--- net/netfilter/ipset/ip_set_hash_gen.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
net/netfilter/ipset/ip_set_hash_gen.h +2 -2
@@ -132,11 +132,11 @@ htable_size(u8 hbits) {size_t hsize; -/* We must fit both into u32 in jhash and size_t */ +/* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ if (hbits >31 )return 0 ; hsize =jhash_size (hbits); -if ((((size_t )-1 ) -sizeof (struct htable )) /sizeof (struct hbucket *) +if ((INT_MAX -sizeof (struct htable )) /sizeof (struct hbucket *) < hsize)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 88/93 mm: dont allow oversized kvmalloc() calls
In reply to Greg Kroah-HartmanFrom: Linus Torvalds <[email protected]>
commit 7661809d493b426e979f39ab512e3adf41fbcc69 upstream.
'kvmalloc()' is a convenience function for people who want to do a kmalloc() but fall back on vmalloc() if there aren't enough physically contiguous pages, or if the allocation is larger than what kmalloc() supports.
However, let's make sure it doesn't get _too_ easy to do crazy things with it. In particular, don't allow big allocations that could be due to integer overflow or underflow. So make sure the allocation size fits in an 'int', to protect against trivial integer conversion issues.
--- mm/util.c | 4 ++++ 1 file changed, 4 insertions(+)
mm/util.c +4 -0
@@ -581,6 +581,10 @@ void *kvmalloc_node(size_t size, gfp_t fif (ret || size <=PAGE_SIZE )return ret; +/* Don't even allow crazy sizes */ +if (WARN_ON_ONCE (size >INT_MAX )) +return NULL ; +return __vmalloc_node (size,1 , flags, node,__builtin_return_address (0 )); }
Greg Kroah-Hartman
maintainerPATCH 89/93 HID: usbhid: free raw_report buffers in usbhid_stop
In reply to Greg Kroah-HartmanFrom: Anirudh Rayabharam <[email protected]>
commit f7744fa16b96da57187dc8e5634152d3b63d72de upstream.
Free the unsent raw_report buffers when the device is removed.
Fixes a memory leak reported by syzbot at:
https://syzkaller.appspot.com/bug?id=7b4fa7cb1a7c2d3342a2a8a6c53371c8c418ab47
--- drivers/hid/usbhid/hid-core.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
drivers/hid/usbhid/hid-core.c +12 -1
@@ -503,7 +503,7 @@ static void hid_ctrl(struct urb *urb)if (unplug) { usbhid->ctrltail = usbhid->ctrlhead; - }else { + }else if (usbhid->ctrlhead != usbhid->ctrltail) { usbhid->ctrltail = (usbhid->ctrltail +1 ) & (HID_CONTROL_FIFO_SIZE -1 ); if (usbhid->ctrlhead != usbhid->ctrltail &&
@@ -1221,9 +1221,20 @@ static void usbhid_stop(struct hid_devicmutex_lock (&usbhid->mutex);clear_bit (HID_STARTED , &usbhid->iofl); +spin_lock_irq (&usbhid->lock);/* Sync with error and led handlers */ set_bit (HID_DISCONNECTED , &usbhid->iofl); +while (usbhid->ctrltail != usbhid->ctrlhead) { +if (usbhid->ctrl[usbhid->ctrltail].dir ==USB_DIR_OUT ) { +kfree (usbhid->ctrl[usbhid->ctrltail].raw_report); + usbhid->ctrl[usbhid->ctrltail].raw_report =NULL ; + } + + usbhid->ctrltail = (usbhid->ctrltail +1 ) & + (HID_CONTROL_FIFO_SIZE -1 ); + }spin_unlock_irq (&usbhid->lock); +usb_kill_urb (usbhid->urbin);usb_kill_urb (usbhid->urbout);usb_kill_urb (usbhid->urbctrl);
Greg Kroah-Hartman
maintainerPATCH 90/93 net: mdiobus: Fix memory leak in __mdiobus_register
In reply to Greg Kroah-HartmanFrom: Yanfei Xu <[email protected]>
commit ab609f25d19858513919369ff3d9a63c02cd9e2e upstream.
Once device_register() failed, we should call put_device() to decrement reference count for cleanup. Or it will cause memory leak.
BUG: memory leak
unreferenced object 0xffff888114032e00 (size 256):
comm "kworker/1:3", pid 2960, jiffies 4294943572 (age 15.920s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 2e 03 14 81 88 ff ff ................
08 2e 03 14 81 88 ff ff 90 76 65 82 ff ff ff ff .........ve.....
backtrace:
[<ffffffff8265cfab>] kmalloc include/linux/slab.h:591 [inline]
[<ffffffff8265cfab>] kzalloc include/linux/slab.h:721 [inline]
[<ffffffff8265cfab>] device_private_init drivers/base/core.c:3203 [inline]
[<ffffffff8265cfab>] device_add+0x89b/0xdf0 drivers/base/core.c:3253
[<ffffffff828dd643>] __mdiobus_register+0xc3/0x450 drivers/net/phy/mdio_bus.c:537
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969
[<ffffffff82660916>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487
[<ffffffff8265cd0b>] device_add+0x5fb/0xdf0 drivers/base/core.c:3359
[<ffffffff82c343b9>] usb_set_configuration+0x9d9/0xb90 drivers/usb/core/message.c:2170
[<ffffffff82c4473c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238
BUG: memory leak
unreferenced object 0xffff888116f06900 (size 32):
comm "kworker/0:2", pid 2670, jiffies 4294944448 (age 7.160s)
hex dump (first 32 bytes):
75 73 62 2d 30 30 31 3a 30 30 33 00 00 00 00 00 usb-001:003.....
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff81484516>] kstrdup+0x36/0x70 mm/util.c:60
[<ffffffff814845a3>] kstrdup_const+0x53/0x80 mm/util.c:83
[<ffffffff82296ba2>] kvasprintf_const+0xc2/0x110 lib/kasprintf.c:48
[<ffffffff82358d4b>] kobject_set_name_vargs+0x3b/0xe0 lib/kobject.c:289
[<ffffffff826575f3>] dev_set_name+0x63/0x90 drivers/base/core.c:3147
[<ffffffff828dd63b>] __mdiobus_register+0xbb/0x450 drivers/net/phy/mdio_bus.c:535
[<ffffffff828cb835>] __devm_mdiobus_register+0x75/0xf0 drivers/net/phy/mdio_devres.c:87
[<ffffffff82b92a00>] ax88772_init_mdio drivers/net/usb/asix_devices.c:676 [inline]
[<ffffffff82b92a00>] ax88772_bind+0x330/0x480 drivers/net/usb/asix_devices.c:786
[<ffffffff82baa33f>] usbnet_probe+0x3ff/0xdf0 drivers/net/usb/usbnet.c:1745
[<ffffffff82c36e17>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396
[<ffffffff82661d17>] call_driver_probe drivers/base/dd.c:517 [inline]
[<ffffffff82661d17>] really_probe.part.0+0xe7/0x380 drivers/base/dd.c:596
[<ffffffff826620bc>] really_probe drivers/base/dd.c:558 [inline]
[<ffffffff826620bc>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:751
[<ffffffff826621ba>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:781
[<ffffffff82662a26>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:898
[<ffffffff8265eca7>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427
[<ffffffff826625a2>] __device_attach+0x122/0x260 drivers/base/dd.c:969--- drivers/net/phy/mdio_bus.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/phy/mdio_bus.c +1 -0
@@ -537,6 +537,7 @@ int __mdiobus_register(struct mii_bus *b err =device_register (&bus->dev);if (err) {pr_err ("mii_bus %s failed to register\n" , bus->id); +put_device (&bus->dev);return -EINVAL ; }
Re: [PATCH 5.10 90/93] net: mdiobus: Fix memory leak in __mdiobus_register
Quoted 7 lines · Greg Kroah-Hartman
From: Yanfei Xu <[email protected]>
commit
ab609f25d19858513919369ff3d9a63c02cd9e2eupstream.Once
device_register()failed, we should callput_device()to decrement reference count for cleanup. Or it will cause memory leak.
Also needs to be dropped.
Signature · 1 line
Florian
Greg Kroah-Hartman
maintainerPATCH 91/93 KVM: x86: Handle SRCU initialization failure during page track init
In reply to Greg Kroah-HartmanFrom: Haimin Zhang <[email protected]>
commit eb7511bf9182292ef1df1082d23039e856d1ddfb upstream.
Check the return of init_srcu_struct(), which can fail due to OOM, when initializing the page track mechanism. Lack of checking leads to a NULL pointer deref found by a modified syzkaller.
Message-Id: <[email protected]>
--- arch/x86/include/asm/kvm_page_track.h | 2 +- arch/x86/kvm/mmu/page_track.c | 4 ++-- arch/x86/kvm/x86.c | 7 ++++++- 3 files changed, 9 insertions(+), 4 deletions(-)
arch/x86/include/asm/kvm_page_track.h +1 -1
@@ -46,7 +46,7 @@ struct kvm_page_track_notifier_node { struct kvm_page_track_notifier_node *node); }; -void kvm_page_track_init (struct kvm *kvm); +int kvm_page_track_init (struct kvm *kvm);void kvm_page_track_cleanup (struct kvm *kvm);void kvm_page_track_free_memslot (struct kvm_memory_slot *slot);
arch/x86/kvm/mmu/page_track.c +2 -2
@@ -163,13 +163,13 @@ void kvm_page_track_cleanup(struct kvm *cleanup_srcu_struct (&head->track_srcu); } -void kvm_page_track_init (struct kvm *kvm) +int kvm_page_track_init (struct kvm *kvm) {struct kvm_page_track_notifier_head *head; head = &kvm->arch.track_notifier_head; -init_srcu_struct (&head->track_srcu);INIT_HLIST_HEAD (&head->track_notifier_list); +return init_srcu_struct (&head->track_srcu); }/*
arch/x86/kvm/x86.c +6 -1
@@ -10392,9 +10392,15 @@ void kvm_arch_free_vm(struct kvm *kvm)int kvm_arch_init_vm (struct kvm *kvm,unsigned long type) { +int ret; +if (type)return -EINVAL ; + ret =kvm_page_track_init (kvm); +if (ret) +return ret; +INIT_HLIST_HEAD (&kvm->arch.mask_notifier_list);INIT_LIST_HEAD (&kvm->arch.active_mmu_pages);INIT_LIST_HEAD (&kvm->arch.zapped_obsolete_pages);
@@ -10421,7 +10427,6 @@ int kvm_arch_init_vm(struct kvm *kvm, unINIT_DELAYED_WORK (&kvm->arch.kvmclock_sync_work, kvmclock_sync_fn);kvm_hv_init_vm (kvm); -kvm_page_track_init (kvm);kvm_mmu_init_vm (kvm);return kvm_x86_ops.vm_init (kvm);
Greg Kroah-Hartman
maintainerPATCH 92/93 netfilter: conntrack: serialize hash resizes and cleanups
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit e9edc188fc76499b0b9bd60364084037f6d03773 upstream.
Syzbot was able to trigger the following warning [1]
No repro found by syzbot yet but I was able to trigger similar issue by having 2 scripts running in parallel, changing conntrack hash sizes, and:
for j in seq 1 1000 ; do unshare -n /bin/true >/dev/null ; done
It would take more than 5 minutes for net_namespace structures to be cleaned up.
This is because nf_ct_iterate_cleanup() has to restart everytime a resize happened.
By adding a mutex, we can serialize hash resizes and cleanups and also make get_next_corpse() faster by skipping over empty buckets.
Even without resizes in the picture, this patch considerably speeds up network namespace dismantles.
[1]
INFO: task syz-executor.0:8312 can't die for more than 144 seconds.
task:syz-executor.0 state:R running task stack:25672 pid: 8312 ppid: 6573 flags:0x00004006
Call Trace:
context_switch kernel/sched/core.c:4955 [inline]
__schedule+0x940/0x26f0 kernel/sched/core.c:6236
preempt_schedule_common+0x45/0xc0 kernel/sched/core.c:6408
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:35
__local_bh_enable_ip+0x109/0x120 kernel/softirq.c:390
local_bh_enable include/linux/bottom_half.h:32 [inline]
get_next_corpse net/netfilter/nf_conntrack_core.c:2252 [inline]
nf_ct_iterate_cleanup+0x15a/0x450 net/netfilter/nf_conntrack_core.c:2275
nf_conntrack_cleanup_net_list+0x14c/0x4f0 net/netfilter/nf_conntrack_core.c:2469
ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171
setup_net+0x639/0xa30 net/core/net_namespace.c:349
copy_net_ns+0x319/0x760 net/core/net_namespace.c:470
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3128
__do_sys_unshare kernel/fork.c:3202 [inline]
__se_sys_unshare kernel/fork.c:3200 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3200
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f63da68e739
RSP: 002b:00007f63d7c05188 EFLAGS: 00000246 ORIG_RAX: 0000000000000110
RAX: ffffffffffffffda RBX: 00007f63da792f80 RCX: 00007f63da68e739
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007f63da6e8cc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f63da792f80
R13: 00007fff50b75d3f R14: 00007f63d7c05300 R15: 0000000000022000
Showing all locks held in the system:
1 lock held by khungtaskd/27:
#0: ffffffff8b980020 (rcu_read_lock){....}-{1:2}, at: debug_show_all_locks+0x53/0x260 kernel/locking/lockdep.c:6446
2 locks held by kworker/u4:2/153:
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic64_set arch/x86/include/asm/atomic64_64.h:34 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: arch_atomic_long_set include/linux/atomic/atomic-long.h:41 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: atomic_long_set include/linux/atomic/atomic-instrumented.h:1198 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_data kernel/workqueue.c:634 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: set_work_pool_and_clear_pending kernel/workqueue.c:661 [inline]
#0: ffff888010c69138 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x896/0x1690 kernel/workqueue.c:2268
#1: ffffc9000140fdb0 ((kfence_timer).work){+.+.}-{0:0}, at: process_one_work+0x8ca/0x1690 kernel/workqueue.c:2272
1 lock held by systemd-udevd/2970:
1 lock held by in:imklog/6258:
#0: ffff88807f970ff0 (&f->f_pos_lock){+.+.}-{3:3}, at: __fdget_pos+0xe9/0x100 fs/file.c:990
3 locks held by kworker/1:6/8158:
1 lock held by syz-executor.0/8312:
2 locks held by kworker/u4:13/9320:
1 lock held by syz-executor.5/10178:
1 lock held by syz-executor.4/10217:--- net/netfilter/nf_conntrack_core.c | 70 ++++++++++++++++++++------------------ 1 file changed, 37 insertions(+), 33 deletions(-)
net/netfilter/nf_conntrack_core.c +37 -33
@@ -75,6 +75,9 @@ static __read_mostly struct kmem_cache *static DEFINE_SPINLOCK (nf_conntrack_locks_all_lock);static __read_mostly bool nf_conntrack_locks_all; +/* serialize hash resizes and nf_ct_iterate_cleanup */ +static DEFINE_MUTEX (nf_conntrack_mutex); +#define GC_SCAN_INTERVAL (120u * HZ)#define GC_SCAN_MAX_DURATION msecs_to_jiffies(10)
@@ -2173,28 +2176,31 @@ get_next_corpse(int (*iter)(struct nf_cospinlock_t *lockp;for (; *bucket < nf_conntrack_htable_size; (*bucket)++) { +struct hlist_nulls_head *hslot = &nf_conntrack_hash[*bucket]; + +if (hlist_nulls_empty (hslot)) +continue ; + lockp = &nf_conntrack_locks[*bucket %CONNTRACK_LOCKS ];local_bh_disable ();nf_conntrack_lock (lockp); -if (*bucket < nf_conntrack_htable_size) { -hlist_nulls_for_each_entry (h, n, &nf_conntrack_hash[*bucket], hnnode) { -if (NF_CT_DIRECTION (h) !=IP_CT_DIR_REPLY ) -continue ; -/* All nf_conn objects are added to hash table twice, one -* for original direction tuple, once for the reply tuple. -* -* Exception: In the IPS_NAT_CLASH case, only the reply -* tuple is added (the original tuple already existed for -* a different object). -* -* We only need to call the iterator once for each -* conntrack, so we just use the 'reply' direction -* tuple while iterating. -*/ - ct =nf_ct_tuplehash_to_ctrack (h); -if (iter (ct, data)) - goto found; - } +hlist_nulls_for_each_entry (h, n, hslot, hnnode) { +if (NF_CT_DIRECTION (h) !=IP_CT_DIR_REPLY ) +continue ; +/* All nf_conn objects are added to hash table twice, one +* for original direction tuple, once for the reply tuple. +* +* Exception: In the IPS_NAT_CLASH case, only the reply +* tuple is added (the original tuple already existed for +* a different object). +* +* We only need to call the iterator once for each +* conntrack, so we just use the 'reply' direction +* tuple while iterating. +*/ + ct =nf_ct_tuplehash_to_ctrack (h); +if (iter (ct, data)) + goto found; }spin_unlock (lockp);local_bh_enable ();
@@ -2212,26 +2218,20 @@ found:static void nf_ct_iterate_cleanup (int (*iter)(struct nf_conn *i,void *data),void *data,u32 portid,int report) { -unsigned int bucket =0 , sequence; +unsigned int bucket =0 ;struct nf_conn *ct;might_sleep (); -for (;;) { - sequence =read_seqcount_begin (&nf_conntrack_generation); - -while ((ct =get_next_corpse (iter, data, &bucket)) !=NULL ) { -/* Time to push up daises... */ +mutex_lock (&nf_conntrack_mutex); +while ((ct =get_next_corpse (iter, data, &bucket)) !=NULL ) { +/* Time to push up daises... */ -nf_ct_delete (ct, portid, report); -nf_ct_put (ct); -cond_resched (); - } - -if (!read_seqcount_retry (&nf_conntrack_generation, sequence)) -break ; - bucket =0 ; +nf_ct_delete (ct, portid, report); +nf_ct_put (ct); +cond_resched (); } +mutex_unlock (&nf_conntrack_mutex); }struct iter_data {
@@ -2461,8 +2461,10 @@ int nf_conntrack_hash_resize(unsigned inif (!hash)return -ENOMEM ; +mutex_lock (&nf_conntrack_mutex); old_size = nf_conntrack_htable_size;if (old_size == hashsize) { +mutex_unlock (&nf_conntrack_mutex);kvfree (hash);return 0 ; }
@@ -2498,6 +2500,8 @@ int nf_conntrack_hash_resize(unsigned innf_conntrack_all_unlock ();local_bh_enable (); +mutex_unlock (&nf_conntrack_mutex); +synchronize_net ();kvfree (old_hash);return 0 ;
Greg Kroah-Hartman
maintainerPATCH 93/93 netfilter: nf_tables: Fix oversized kvmalloc() calls
In reply to Greg Kroah-HartmanFrom: Pablo Neira Ayuso <[email protected]>
commit 45928afe94a094bcda9af858b96673d59bc4a0e9 upstream.
The commit 7661809d493b ("mm: don't allow oversized kvmalloc() calls") limits the max allocatable memory via kvmalloc() to MAX_INT.
--- net/netfilter/nf_tables_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/netfilter/nf_tables_api.c +1 -1
@@ -4265,7 +4265,7 @@ static int nf_tables_newset(struct net *if (ops->privsize !=NULL ) size = ops->privsize (nla, &desc); alloc_size =sizeof (*set) + size + udlen; -if (alloc_size < size) +if (alloc_size < size || alloc_size >INT_MAX )return -ENOMEM ; set =kvzalloc (alloc_size,GFP_KERNEL );if (!set)
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.71-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
5.10.71-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)
Hi!
Quoted 4 lines
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
Signature · 2 lines
DENX Software Engineering GmbH, Managing Director: Wolfgang Denk HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.71-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 8 lines
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.71-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-5.10.y
and the diffstat can be found below.thanks,
greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels:
Signature · 1 line
Florian
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 5.10.71 release. There are 93 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Wed, 06 Oct 2021 12:50:17 +0000. Anything received after that time might be too late.
Build results:
total: 159 pass: 159 fail: 0 Qemu test results: total: 472 pass: 472 fail: 0
Guenter