4.14.291-rc1 review
Subsystems (3)
Greg Kroah-Hartman
maintainercover 4.14.291-rc1 review
This is the start of the stable review cycle for the 4.14.291 release. There are 229 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Thu, 25 Aug 2022 08:00:15 +0000. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.291-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.14.291-rc1
Nathan Chancellor <[email protected]>
MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0
Zheyu Ma <[email protected]>
video: fbdev: i740fb: Check the argument of i740_calc_vclk()
Zhouyi Zhou <[email protected]>
powerpc/64: Init jump labels before parse_early_param()
Steve French <[email protected]>
smb3: check xattr value length earlier
Takashi Iwai <[email protected]>
ALSA: timer: Use deferred fasync helper
Takashi Iwai <[email protected]>
ALSA: core: Add async signal helpers
Liang He <[email protected]>
mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start
Schspa Shi <[email protected]>
vfio: Clear the caps->buf to NULL after free
Liang He <[email protected]>
tty: serial: Fix refcount leak bug in ucc_uart.c
Kiselev, Oleg <[email protected]>
ext4: avoid resizing to a partial cluster size
Ye Bin <[email protected]>
ext4: avoid remove directory when directory is corrupted
Wentao_Liang <[email protected]>
drivers:md:fix a potential use-after-free bug
Christophe JAILLET <[email protected]>
cxl: Fix a memory leak in an error handling path
Jozef Martiniak <[email protected]>
gadgetfs: ep_io - wait until IRQ finishes
Robert Marko <[email protected]>
clk: qcom: ipq8074: dont disable gcc_sleep_clk_src
Liang He <[email protected]>
usb: host: ohci-ppc-of: Fix refcount leak bug
Sai Prakash Ranjan <[email protected]>
irqchip/tegra: Fix overflow implicit truncation warnings
Pavan Chebbi <[email protected]>
PCI: Add ACS quirk for Broadcom BCM5750x NICs
Liang He <[email protected]>
drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()
Qu Wenruo <[email protected]>
btrfs: raid56: don't trust any cached sector in __raid56_parity_recover()
Qu Wenruo <[email protected]>
btrfs: only write the sectors in the vertical stripe which has data stripes
Masahiro Yamada <[email protected]>
kbuild: clear LDFLAGS in the top Makefile
Lin Ma <[email protected]>
igb: Add lock to avoid data race
Csókás Bence <[email protected]>
fec: Fix timer capture timing in fec_ptp_enable_pps()
Alan Brady <[email protected]>
i40e: Fix to stop tx_timeout recovery if GLOBR fails
Michael Ellerman <[email protected]>
powerpc/pci: Fix get_phb_number() locking
Pablo Neira Ayuso <[email protected]>
netfilter: nf_tables: really skip inactive sets when allocating name
Al Viro <[email protected]>
nios2: add force_successful_syscall_return()
Al Viro <[email protected]>
nios2: restarts apply only to the first sigframe we build...
Al Viro <[email protected]>
nios2: fix syscall restart checks
Al Viro <[email protected]>
nios2: traced syscall does need to check the syscall number
Al Viro <[email protected]>
nios2: don't leave NULLs in sys_call_table[]
Al Viro <[email protected]>
nios2: page fault et.al. are *not* restartable syscalls...
Duoming Zhou <[email protected]>
atm: idt77252: fix use-after-free bugs caused by tst_timer
Dan Carpenter <[email protected]>
xen/xenbus: fix return type in xenbus_file_read()
Roberto Sassu <[email protected]>
tools build: Switch to new openssl API for test-libcrypto
Peilin Ye <[email protected]>
vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout()
Peilin Ye <[email protected]>
vsock: Fix memory leak in vsock_connect()
Matthias May <[email protected]>
geneve: do not use RT_TOS for IPv6 flowlabel
Sakari Ailus <[email protected]>
ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool
Nikita Travkin <[email protected]>
pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed
Miaoqian Lin <[email protected]>
pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map
Trond Myklebust <[email protected]>
SUNRPC: Reinitialise the backchannel request buffers before reuse
Zhang Xianwei <[email protected]>
NFSv4.1: RECLAIM_COMPLETE must handle EACCES
Trond Myklebust <[email protected]>
NFSv4: Fix races in the legacy idmapper upcall
Xin Xiong <[email protected]>
apparmor: fix reference count leak in aa_pivotroot()
Tom Rix <[email protected]>
apparmor: fix aa_label_asxprint return check
John Johansen <[email protected]>
apparmor: Fix failed mount permission check error message
John Johansen <[email protected]>
apparmor: fix quiet_denied for file rules
Marc Kleine-Budde <[email protected]>
can: ems_usb: fix clang's -Wunaligned-access warning
Filipe Manana <[email protected]>
btrfs: fix lost error handling when looking up extended ref on log replay
Damien Le Moal <[email protected]>
ata: libata-eh: Add missing command name
Mikulas Patocka <[email protected]>
rds: add missing barrier to release_refill
Amadeusz Sławiński <[email protected]>
ALSA: info: Fix llseek return value when using callback
Christophe Leroy <[email protected]>
powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
Jamal Hadi Salim <[email protected]>
net_sched: cls_route: disallow handle of 0
Tyler Hicks <[email protected]>
net/9p: Initialize the iounit field during fid creation
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Jose Alonso <[email protected]>
Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
Tony Battersby <[email protected]>
scsi: sg: Allow waiting for commands to complete on removed device
Eric Dumazet <[email protected]>
tcp: fix over estimation in sk_forced_mem_schedule()
Vitaly Kuznetsov <[email protected]>
KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
Vitaly Kuznetsov <[email protected]>
KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
Sean Christopherson <[email protected]>
KVM: Add infrastructure and macro to mark VM as bugged
Qu Wenruo <[email protected]>
btrfs: reject log replay if there is unsupported RO compat flag
Thadeu Lima de Souza Cascardo <[email protected]>
net_sched: cls_route: remove from list when handle is 0
Mikulas Patocka <[email protected]>
dm raid: fix address sanitizer warning in raid_status
Mikulas Patocka <[email protected]>
dm raid: fix address sanitizer warning in raid_resume
Alexander Shishkin <[email protected]>
intel_th: pci: Add Meteor Lake-P support
Alexander Shishkin <[email protected]>
intel_th: pci: Add Raptor Lake-S PCH support
Alexander Shishkin <[email protected]>
intel_th: pci: Add Raptor Lake-S CPU support
Baokun Li <[email protected]>
ext4: correct the misjudgment in ext4_iget_extra_inode
Baokun Li <[email protected]>
ext4: correct max_inline_xattr_value_size computing
Eric Whitney <[email protected]>
ext4: fix extent status tree race in writeback error recovery path
Theodore Ts'o <[email protected]>
ext4: update s_overhead_clusters in the superblock during an on-line resize
Baokun Li <[email protected]>
ext4: fix use-after-free in ext4_xattr_set_entry
Lukas Czerner <[email protected]>
ext4: make sure ext4_append() always allocates new block
Baokun Li <[email protected]>
ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
David Collins <[email protected]>
spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
Alexander Lobakin <[email protected]>
x86/olpc: fix 'logical not is only applied to the left hand side'
Steffen Maier <[email protected]>
scsi: zfcp: Fix missing auto port scan and thus missing target ports
Zheyu Ma <[email protected]>
video: fbdev: s3fb: Check the size of screen before memset_io()
Zheyu Ma <[email protected]>
video: fbdev: arkfb: Check the size of screen before memset_io()
Zheyu Ma <[email protected]>
video: fbdev: vt8623fb: Check the size of screen before memset_io()
Florian Fainelli <[email protected]>
tools/thermal: Fix possible path truncations
Zheyu Ma <[email protected]>
video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
Siddh Raman Pant <[email protected]>
x86/numa: Use cpumask_available instead of hardcoded NULL check
Arnaldo Carvalho de Melo <[email protected]>
genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
Michael Ellerman <[email protected]>
powerpc/pci: Fix PHB numbering when using opal-phbid
Chen Zhongjin <[email protected]>
kprobes: Forbid probing on trampoline and BPF code areas
Miaoqian Lin <[email protected]>
powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
Miaoqian Lin <[email protected]>
powerpc/xive: Fix refcount leak in xive_get_max_prio
Miaoqian Lin <[email protected]>
powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
Pali Rohár <[email protected]>
powerpc/pci: Prefer PCI domain assignment via DT 'linux,pci-domain' and alias
Rustam Subkhankulov <[email protected]>
video: fbdev: sis: fix typos in SiS_GetModeID()
Liang He <[email protected]>
video: fbdev: amba-clcd: Fix refcount leak bugs
Alexander Gordeev <[email protected]>
s390/zcore: fix race when reading from hardware system area
Liang He <[email protected]>
iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
Uwe Kleine-König <[email protected]>
mfd: t7l66xb: Drop platform disable callback
Dan Carpenter <[email protected]>
kfifo: fix kfifo_to_user() return type
Sam Protsenko <[email protected]>
iommu/exynos: Handle failed IOMMU device registration properly
Daniel Starke <[email protected]>
tty: n_gsm: fix DM command
Daniel Starke <[email protected]>
tty: n_gsm: fix wrong T1 retry count handling
Eric Farman <[email protected]>
vfio/ccw: Do not change FSM state in subchannel event
Sireesh Kodali <[email protected]>
remoteproc: qcom: wcnss: Fix handling of IRQs
Daniel Starke <[email protected]>
tty: n_gsm: fix race condition in gsmld_write()
Daniel Starke <[email protected]>
tty: n_gsm: fix packet re-transmission without open control channel
Daniel Starke <[email protected]>
tty: n_gsm: fix non flow control frames during mux flow off
Chen Zhongjin <[email protected]>
profiling: fix shift too large makes kernel panic
Miaoqian Lin <[email protected]>
ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
Jiasheng Jiang <[email protected]>
ASoC: codecs: da7210: add check for i2c_add_driver
Miaoqian Lin <[email protected]>
ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
Zhihao Cheng <[email protected]>
jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted
Li Lingfeng <[email protected]>
ext4: recover csum seed of tmp_inode after migrating to extents
Zhu Yanjun <[email protected]>
RDMA/rxe: Fix error unwind in rxe_create_qp()
Miaohe Lin <[email protected]>
mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
Dan Carpenter <[email protected]>
platform/olpc: Fix uninitialized data in debugfs write
Johan Hovold <[email protected]>
USB: serial: fix tty-port initialized comments
Liang He <[email protected]>
mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
Liang He <[email protected]>
mmc: cavium-octeon: Add of_node_put() when breaking out of loop
Liang He <[email protected]>
gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
Jianglei Nie <[email protected]>
RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
Randy Dunlap <[email protected]>
usb: gadget: udc: amd5536 depends on HAS_DMA
Mahesh Rajashekhara <[email protected]>
scsi: smartpqi: Fix DMA direction for RAID requests
Eugen Hristev <[email protected]>
mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
Christophe JAILLET <[email protected]>
memstick/ms_block: Fix a memory leak
Christophe JAILLET <[email protected]>
memstick/ms_block: Fix some incorrect memory allocation
Miaoqian Lin <[email protected]>
mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
Christophe JAILLET <[email protected]>
misc: rtsx: Fix an error handling path in rtsx_pci_probe()
Miaoqian Lin <[email protected]>
usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
Miaoqian Lin <[email protected]>
usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
Marco Pagani <[email protected]>
fpga: altera-pr-ip: fix unsigned comparison with less than zero
Uwe Kleine-König <[email protected]>
mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path
Duoming Zhou <[email protected]>
mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
Miaoqian Lin <[email protected]>
mtd: maps: Fix refcount leak in ap_flash_init
Miaoqian Lin <[email protected]>
mtd: maps: Fix refcount leak in of_flash_probe_versatile
Hangyu Hua <[email protected]>
dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
Eric Dumazet <[email protected]>
net: rose: fix netdev reference changes
Hangyu Hua <[email protected]>
wifi: libertas: Fix possible refcount leak in if_usb_probe()
Ammar Faizi <[email protected]>
wifi: wil6210: debugfs: fix uninitialized variable use in wil_write_file_wmi()
Liang He <[email protected]>
i2c: mux-gpmux: Add of_node_put() when breaking out of loop
Lars-Peter Clausen <[email protected]>
i2c: cadence: Support PEC for SMBus block read
Jiasheng Jiang <[email protected]>
Bluetooth: hci_intel: Add check for platform_driver_register
Vincent Mailhol <[email protected]>
can: pch_can: pch_can_error(): initialize errc before using it
Vincent Mailhol <[email protected]>
can: error: specify the values of data[5..7] of CAN error frames
Vincent Mailhol <[email protected]>
can: usb_8dev: do not report txerr and rxerr during bus-off
Vincent Mailhol <[email protected]>
can: sun4i_can: do not report txerr and rxerr during bus-off
Vincent Mailhol <[email protected]>
can: hi311x: do not report txerr and rxerr during bus-off
Vincent Mailhol <[email protected]>
can: sja1000: do not report txerr and rxerr during bus-off
Vincent Mailhol <[email protected]>
can: rcar_can: do not report txerr and rxerr during bus-off
Vincent Mailhol <[email protected]>
can: pch_can: do not report txerr and rxerr during bus-off
Rustam Subkhankulov <[email protected]>
wifi: p54: add missing parentheses in p54_flush()
Christophe JAILLET <[email protected]>
wifi: p54: Fix an error handling path in p54spi_probe()
Dan Carpenter <[email protected]>
wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
Jason A. Donenfeld <[email protected]>
fs: check FMODE_LSEEK to control internal pipe splicing
Wolfram Sang <[email protected]>
selftests: timers: clocksource-switch: fix passing errors from child
Wolfram Sang <[email protected]>
selftests: timers: valid-adjtimex: build fix for newer toolchains
Yonglong Li <[email protected]>
tcp: make retransmitted SKB fit into the send window
AngeloGioacchino Del Regno <[email protected]>
media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
Hangyu Hua <[email protected]>
drm: bridge: sii8620: fix possible off-by-one
Bo-Chen Chen <[email protected]>
drm/mediatek: dpi: Remove output format of YUV
Brian Norris <[email protected]>
drm/rockchip: vop: Don't crash for invalid duplicate_state()
Dave Stevenson <[email protected]>
drm/vc4: dsi: Correct DSI divider calculations
Niels Dossche <[email protected]>
media: hdpvr: fix error value returns in hdpvr_read
Jiasheng Jiang <[email protected]>
drm: bridge: adv7511: Add check for mipi_dsi_driver_register
Alexey Kodanev <[email protected]>
wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
Pavel Skripkin <[email protected]>
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Xu Wang <[email protected]>
i2c: Fix a potential use after free
Xinlei Lee <[email protected]>
drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
Alexey Kodanev <[email protected]>
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
Mike Snitzer <[email protected]>
dm: return early from dm_pr_call() if DM device is suspended
Markus Mayer <[email protected]>
thermal/tools/tmon: Include pthread and time headers in tmon.h
Liang He <[email protected]>
regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
Sireesh Kodali <[email protected]>
arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
Krzysztof Kozlowski <[email protected]>
ARM: dts: qcom: pm8841: add required thermal-sensor-cells
Miaoqian Lin <[email protected]>
cpufreq: zynq: Fix refcount leak in zynq_get_revision
Michael Walle <[email protected]>
soc: fsl: guts: machine variable might be unset
Krzysztof Kozlowski <[email protected]>
ARM: dts: ast2500-evb: fix board compatible
Johan Hovold <[email protected]>
x86/pmem: Fix platform-device leak in error path
Miaoqian Lin <[email protected]>
ARM: bcm: Fix refcount leak in bcm_kona_smc_init
Russell King (Oracle) <[email protected]>
ARM: findbit: fix overflowing offset
Xiu Jianfeng <[email protected]>
selinux: Add boundary check in put_entry()
Tetsuo Handa <[email protected]>
PM: hibernate: defer device probing when resuming from hibernation
huhai <[email protected]>
ACPI: LPSS: Fix missing check in register_device_clock()
Manyi Li <[email protected]>
ACPI: PM: save NVS memory for Lenovo G40-45
Liang He <[email protected]>
ARM: OMAP2+: display: Fix refcount leak bug
Alexander Stein <[email protected]>
ARM: dts: imx6ul: fix qspi node compatible
Alexander Stein <[email protected]>
ARM: dts: imx6ul: add missing properties for sram
Jan Kara <[email protected]>
ext2: Add more validity checks for inode counts
haibinzhang (张海斌) <[email protected]>
arm64: fix oops in concurrently setting insn_emulation sysctls
Francis Laniel <[email protected]>
arm64: Do not forget syscall when starting a new thread.
Florian Westphal <[email protected]>
netfilter: nf_tables: fix null deref due to zeroed list head
Weitao Wang <[email protected]>
USB: HCD: Fix URB giveback issue in tasklet function
Huacai Chen <[email protected]>
MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
Michael Ellerman <[email protected]>
powerpc/powernv: Avoid crashing if rng is NULL
Pali Rohár <[email protected]>
powerpc/fsl-pci: Fix Class Code of PCIe Root Port
Pali Rohár <[email protected]>
PCI: Add defines for normal and subtractive PCI bridges
Alexander Lobakin <[email protected]>
ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
Mikulas Patocka <[email protected]>
md-raid10: fix KASAN warning
Miklos Szeredi <[email protected]>
fuse: limit nsec
Zheyu Ma <[email protected]>
iio: light: isl29028: Fix the warning in isl29028_remove()
Leo Li <[email protected]>
drm/amdgpu: Check BO's requested pinning domains against its preferred_domains
Timur Tabi <[email protected]>
drm/nouveau: fix another off-by-one in nvbios_addr
Helge Deller <[email protected]>
parisc: Fix device names in /proc/iomem
Lukas Wunner <[email protected]>
usbnet: Fix linkwatch use-after-free on disconnect
Yang Xu <[email protected]>
fs: Add missing umask strip in vfs_tmpfile
David Howells <[email protected]>
vfs: Check the truncate maximum size in inode_newsize_ok()
Allen Ballway <[email protected]>
ALSA: hda/cirrus - support for iMac 12,1 model
Meng Tang <[email protected]>
ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
Sean Christopherson <[email protected]>
KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
Sean Christopherson <[email protected]>
KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
Maciej S. Szmigiero <[email protected]>
KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0
Ping Cheng <[email protected]>
HID: wacom: Don't register pad_input for touch switch
Mikulas Patocka <[email protected]>
add barriers to buffer_uptodate and set_buffer_uptodate
Zheyu Ma <[email protected]>
ALSA: bcd2000: Fix a UAF bug on the error path of probing
Nick Desaulniers <[email protected]>
x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
Nick Desaulniers <[email protected]>
Makefile: link with -z noexecstack --no-warn-rwx-segments
Ning Qiang <[email protected]>
macintosh/adb: fix oob read in do_adb_query() function
Werner Sembach <[email protected]>
ACPI: video: Shortening quirk list by identifying Clevo by board_name only
Werner Sembach <[email protected]>
ACPI: video: Force backlight native for some TongFang devices
Wei Mingzhi <[email protected]>
mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
Greg Kroah-Hartman <[email protected]>
ARM: crypto: comment out gcc warning that breaks clang builds
Florian Westphal <[email protected]>
netfilter: nf_queue: do not allow packet truncation below transport header offset
Liang He <[email protected]>
net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
Kuniyuki Iwashima <[email protected]>
net: ping6: Fix memleak in ipv6_renew_options().
Liang He <[email protected]>
scsi: ufs: host: Hold reference returned by of_parse_phandle()
Harald Freudenberger <[email protected]>
s390/archrandom: prevent CPACF trng invocations in interrupt context
ChenXiaoSong <[email protected]>
ntfs: fix use-after-free in ntfs_ucsncmp()
Luiz Augusto von Dentz <[email protected]>
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
-------------
Diffstat:
Makefile | 8 +- arch/arm/boot/dts/aspeed-ast2500-evb.dts | 2 +- arch/arm/boot/dts/imx6ul.dtsi | 5 +- arch/arm/boot/dts/qcom-pm8841.dtsi | 1 + arch/arm/lib/findbit.S | 16 ++-- arch/arm/lib/xor-neon.c | 3 +- arch/arm/mach-bcm/bcm_kona_smc.c | 1 + arch/arm/mach-omap2/display.c | 1 + arch/arm/mach-zynq/common.c | 1 + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 +- arch/arm64/include/asm/processor.h | 3 +- arch/arm64/kernel/armv8_deprecated.c | 9 ++- arch/ia64/include/asm/processor.h | 2 +- arch/mips/cavium-octeon/octeon-platform.c | 3 +- arch/mips/kernel/proc.c | 2 +- arch/mips/mm/tlbex.c | 4 +- arch/nios2/include/asm/entry.h | 3 +- arch/nios2/include/asm/ptrace.h | 2 + arch/nios2/kernel/entry.S | 22 +++-- arch/nios2/kernel/signal.c | 3 +- arch/nios2/kernel/syscall_table.c | 1 + arch/parisc/kernel/drivers.c | 9 +-- arch/powerpc/kernel/pci-common.c | 45 +++++++---- arch/powerpc/kernel/prom.c | 7 ++ arch/powerpc/mm/dump_linuxpagetables.c | 13 +-- arch/powerpc/platforms/cell/axon_msi.c | 1 + arch/powerpc/platforms/cell/spufs/inode.c | 1 + arch/powerpc/platforms/powernv/rng.c | 2 + arch/powerpc/sysdev/fsl_pci.c | 8 ++ arch/powerpc/sysdev/fsl_pci.h | 1 + arch/powerpc/sysdev/xive/spapr.c | 1 + arch/s390/include/asm/archrandom.h | 9 ++- arch/x86/boot/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 4 + arch/x86/entry/vdso/Makefile | 2 +- arch/x86/kernel/pmem.c | 7 +- arch/x86/kvm/emulate.c | 23 +++--- arch/x86/kvm/hyperv.c | 3 + arch/x86/kvm/lapic.c | 4 + arch/x86/kvm/svm.c | 2 - arch/x86/mm/numa.c | 4 +- arch/x86/platform/olpc/olpc-xo1-sci.c | 2 +- drivers/acpi/acpi_lpss.c | 3 + drivers/acpi/property.c | 8 +- drivers/acpi/sleep.c | 8 ++ drivers/acpi/video_detect.c | 55 ++++++++----- drivers/ata/libata-eh.c | 1 + drivers/atm/idt77252.c | 1 + drivers/bluetooth/hci_intel.c | 6 +- drivers/clk/qcom/gcc-ipq8074.c | 1 + drivers/fpga/altera-pr-ip-core.c | 2 +- drivers/gpio/gpiolib-of.c | 4 +- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 4 + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 17 +++- drivers/gpu/drm/bridge/sil-sii8620.c | 4 +- drivers/gpu/drm/mediatek/mtk_dpi.c | 31 ++----- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 + drivers/gpu/drm/meson/meson_drv.c | 5 +- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- drivers/gpu/drm/radeon/ni_dpm.c | 6 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 + drivers/gpu/drm/vc4/vc4_dsi.c | 6 +- drivers/hid/wacom_sys.c | 2 +- drivers/hid/wacom_wac.c | 43 +++++----- drivers/hwtracing/intel_th/pci.c | 15 ++++ drivers/i2c/busses/i2c-cadence.c | 10 ++- drivers/i2c/i2c-core-base.c | 3 +- drivers/i2c/muxes/i2c-mux-gpmux.c | 1 + drivers/iio/light/isl29028.c | 2 +- drivers/infiniband/hw/hfi1/file_ops.c | 4 +- drivers/infiniband/sw/rxe/rxe_qp.c | 12 ++- drivers/iommu/exynos-iommu.c | 6 +- drivers/iommu/qcom_iommu.c | 7 +- drivers/irqchip/irq-tegra.c | 10 +-- drivers/macintosh/adb.c | 2 +- drivers/md/dm-raid.c | 4 +- drivers/md/dm.c | 5 ++ drivers/md/raid10.c | 5 +- drivers/md/raid5.c | 2 +- drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h | 2 + drivers/media/usb/hdpvr/hdpvr-video.c | 2 +- drivers/memstick/core/ms_block.c | 11 +-- drivers/mfd/rtsx_pcr.c | 6 +- drivers/mfd/t7l66xb.c | 6 +- drivers/misc/cxl/irq.c | 1 + drivers/mmc/host/cavium-octeon.c | 1 + drivers/mmc/host/cavium-thunderx.c | 4 +- drivers/mmc/host/sdhci-of-at91.c | 9 ++- drivers/mmc/host/sdhci-of-esdhc.c | 1 + drivers/mtd/devices/st_spi_fsm.c | 8 +- drivers/mtd/maps/physmap_of_versatile.c | 2 + drivers/mtd/sm_ftl.c | 2 +- drivers/net/can/pch_can.c | 8 +- drivers/net/can/rcar/rcar_can.c | 8 +- drivers/net/can/sja1000/sja1000.c | 7 +- drivers/net/can/spi/hi311x.c | 5 +- drivers/net/can/sun4i_can.c | 9 +-- drivers/net/can/usb/ems_usb.c | 2 +- drivers/net/can/usb/usb_8dev.c | 7 +- drivers/net/ethernet/freescale/fec_ptp.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/igb/igb.h | 2 + drivers/net/ethernet/intel/igb/igb_main.c | 12 ++- drivers/net/geneve.c | 3 +- drivers/net/sungem_phy.c | 1 + drivers/net/usb/ax88179_178a.c | 16 ++-- drivers/net/usb/usbnet.c | 8 +- drivers/net/wireless/ath/ath9k/htc.h | 10 +-- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 +- drivers/net/wireless/ath/wil6210/debugfs.c | 18 ++--- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 +- drivers/net/wireless/intersil/p54/main.c | 2 +- drivers/net/wireless/intersil/p54/p54spi.c | 3 +- drivers/net/wireless/marvell/libertas/if_usb.c | 1 + drivers/net/wireless/mediatek/mt7601u/usb.c | 1 + drivers/pci/quirks.c | 3 + drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 +- drivers/platform/olpc/olpc-ec.c | 2 +- drivers/regulator/of_regulator.c | 6 +- drivers/remoteproc/qcom_wcnss.c | 10 ++- drivers/s390/char/zcore.c | 11 ++- drivers/s390/cio/vfio_ccw_drv.c | 14 +--- drivers/s390/scsi/zfcp_fc.c | 29 ++++--- drivers/s390/scsi/zfcp_fc.h | 6 +- drivers/s390/scsi/zfcp_fsf.c | 4 +- drivers/scsi/sg.c | 57 +++++++------ drivers/scsi/smartpqi/smartpqi_init.c | 4 +- drivers/scsi/ufs/ufshcd-pltfrm.c | 15 +++- drivers/soc/fsl/guts.c | 2 +- drivers/tty/n_gsm.c | 83 ++++++++++++++++--- drivers/tty/serial/ucc_uart.c | 2 + drivers/usb/core/hcd.c | 26 +++--- drivers/usb/gadget/legacy/inode.c | 1 + drivers/usb/gadget/udc/Kconfig | 2 +- drivers/usb/host/ehci-ppc-of.c | 1 + drivers/usb/host/ohci-nxp.c | 1 + drivers/usb/host/ohci-ppc-of.c | 1 + drivers/usb/serial/sierra.c | 3 +- drivers/usb/serial/usb-serial.c | 2 +- drivers/usb/serial/usb_wwan.c | 3 +- drivers/vfio/vfio.c | 1 + drivers/video/fbdev/amba-clcd.c | 24 ++++-- drivers/video/fbdev/arkfb.c | 9 ++- drivers/video/fbdev/i740fb.c | 9 ++- drivers/video/fbdev/s3fb.c | 2 + drivers/video/fbdev/sis/init.c | 4 +- drivers/video/fbdev/vt8623fb.c | 2 + drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +- fs/attr.c | 2 + fs/btrfs/disk-io.c | 14 ++++ fs/btrfs/raid56.c | 74 +++++++++++++---- fs/btrfs/tree-log.c | 4 +- fs/cifs/smb2ops.c | 5 +- fs/ext2/super.c | 12 ++- fs/ext4/inline.c | 3 + fs/ext4/inode.c | 10 ++- fs/ext4/migrate.c | 4 +- fs/ext4/namei.c | 23 ++++-- fs/ext4/resize.c | 11 +++ fs/ext4/xattr.c | 6 +- fs/ext4/xattr.h | 13 +++ fs/fuse/inode.c | 6 ++ fs/jbd2/transaction.c | 14 +++- fs/namei.c | 2 + fs/nfs/nfs4idmap.c | 46 ++++++----- fs/nfs/nfs4proc.c | 3 + fs/ntfs/attrib.c | 8 +- fs/splice.c | 10 +-- include/linux/buffer_head.h | 25 +++++- include/linux/kfifo.h | 2 +- include/linux/kvm_host.h | 28 ++++++- include/linux/mfd/t7l66xb.h | 1 - include/linux/pci_ids.h | 2 + include/linux/usb/hcd.h | 1 + include/net/bluetooth/l2cap.h | 1 + include/sound/core.h | 8 ++ include/trace/events/spmi.h | 12 +-- include/uapi/linux/can/error.h | 5 +- kernel/kprobes.c | 3 +- kernel/power/user.c | 13 ++- kernel/profile.c | 7 ++ mm/mmap.c | 1 - net/9p/client.c | 4 +- net/bluetooth/l2cap_core.c | 68 ++++++++++++---- net/dccp/proto.c | 10 +-- net/ipv4/tcp_output.c | 30 ++++--- net/ipv6/ping.c | 6 ++ net/netfilter/nf_tables_api.c | 3 +- net/netfilter/nfnetlink_queue.c | 7 +- net/rds/ib_recv.c | 1 + net/rose/af_rose.c | 11 ++- net/rose/rose_route.c | 2 + net/sched/cls_route.c | 8 +- net/sunrpc/backchannel_rqst.c | 14 ++++ net/vmw_vsock/af_vsock.c | 10 ++- security/apparmor/audit.c | 2 +- security/apparmor/label.c | 6 +- security/apparmor/mount.c | 8 +- security/selinux/ss/policydb.h | 2 + sound/core/info.c | 6 +- sound/core/misc.c | 94 ++++++++++++++++++++++ sound/core/timer.c | 11 +-- sound/pci/hda/patch_cirrus.c | 1 + sound/pci/hda/patch_conexant.c | 11 ++- sound/soc/codecs/da7210.c | 2 + sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 10 ++- sound/soc/mediatek/mt8173/mt8173-rt5650.c | 9 ++- sound/usb/bcd2000/bcd2000.c | 3 +- tools/build/feature/test-libcrypto.c | 15 +++- tools/perf/util/genelf.c | 6 +- .../testing/selftests/timers/clocksource-switch.c | 6 +- tools/testing/selftests/timers/valid-adjtimex.c | 2 +- tools/thermal/tmon/sysfs.c | 24 +++--- tools/thermal/tmon/tmon.h | 3 + virt/kvm/kvm_main.c | 10 +-- 216 files changed, 1338 insertions(+), 541 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/229 Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put
From: Luiz Augusto von Dentz <[email protected]>
commit d0be8347c623e0ac4202a1d4e0373882821f56b0 upstream.
This fixes the following trace which is caused by hci_rx_work starting up *after* the final channel reference has been put() during sock_close() but *before* the references to the channel have been destroyed, so instead the code now rely on kref_get_unless_zero/l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed.
refcount_t: increment on 0; use-after-free.
BUG: KASAN: use-after-free in refcount_dec_and_test+0x20/0xd0 Read of size 4 at addr ffffffc114f5bf18 by task kworker/u17:14/705 CPU: 4 PID: 705 Comm: kworker/u17:14 Tainted: G S W 4.14.234-00003-g1fb6d0bd49a4-dirty #28 Hardware name: Qualcomm Technologies, Inc. SM8150 V2 PM8150 Google Inc. MSM sm8150 Flame DVT (DT) Workqueue: hci0 hci_rx_work Call trace: dump_backtrace+0x0/0x378 show_stack+0x20/0x2c dump_stack+0x124/0x148 print_address_description+0x80/0x2e8 __kasan_report+0x168/0x188 kasan_report+0x10/0x18 __asan_load4+0x84/0x8c refcount_dec_and_test+0x20/0xd0 l2cap_chan_put+0x48/0x12c l2cap_recv_frame+0x4770/0x6550 l2cap_recv_acldata+0x44c/0x7a4 hci_acldata_packet+0x100/0x188 hci_rx_work+0x178/0x23c process_one_work+0x35c/0x95c worker_thread+0x4cc/0x960 kthread+0x1a8/0x1c4 ret_from_fork+0x10/0x18
--- include/net/bluetooth/l2cap.h | 1 net/bluetooth/l2cap_core.c | 61 +++++++++++++++++++++++++++++++++--------- 2 files changed, 49 insertions(+), 13 deletions(-)
include/net/bluetooth/l2cap.h +1 -0
@@ -798,6 +798,7 @@ enum { };void l2cap_chan_hold (struct l2cap_chan *c); +struct l2cap_chan *l2cap_chan_hold_unless_zero (struct l2cap_chan *c);void l2cap_chan_put (struct l2cap_chan *c);static inline void l2cap_chan_lock (struct l2cap_chan *chan)
net/bluetooth/l2cap_core.c +48 -13
180 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 2/229 ntfs: fix use-after-free in ntfs_ucsncmp()
In reply to Greg Kroah-HartmanFrom: ChenXiaoSong <[email protected]>
commit 38c9c22a85aeed28d0831f230136e9cf6fa2ed44 upstream.
Syzkaller reported use-after-free bug as follows:
==================================================================
BUG: KASAN: use-after-free in ntfs_ucsncmp+0x123/0x130
Read of size 2 at addr ffff8880751acee8 by task a.out/879
CPU: 7 PID: 879 Comm: a.out Not tainted 5.19.0-rc4-next-20220630-00001-gcc5218c8bd2c-dirty #7
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x1c0/0x2b0
print_address_description.constprop.0.cold+0xd4/0x484
print_report.cold+0x55/0x232
kasan_report+0xbf/0xf0
ntfs_ucsncmp+0x123/0x130
ntfs_are_names_equal.cold+0x2b/0x41
ntfs_attr_find+0x43b/0xb90
ntfs_attr_lookup+0x16d/0x1e0
ntfs_read_locked_attr_inode+0x4aa/0x2360
ntfs_attr_iget+0x1af/0x220
ntfs_read_locked_inode+0x246c/0x5120
ntfs_iget+0x132/0x180
load_system_files+0x1cc6/0x3480
ntfs_fill_super+0xa66/0x1cf0
mount_bdev+0x38d/0x460
legacy_get_tree+0x10d/0x220
vfs_get_tree+0x93/0x300
do_new_mount+0x2da/0x6d0
path_mount+0x496/0x19d0
__x64_sys_mount+0x284/0x300
do_syscall_64+0x3b/0xc0
entry_SYSCALL_64_after_hwframe+0x46/0xb0
RIP: 0033:0x7f3f2118d9ea
Code: 48 8b 0d a9 f4 0b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 76 f4 0b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffc269deac8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3f2118d9ea
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007ffc269dec00
RBP: 00007ffc269dec80 R08: 00007ffc269deb00 R09: 00007ffc269dec44
R10: 0000000000000000 R11: 0000000000000202 R12: 000055f81ab1d220
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
The buggy address belongs to the physical page:
page:0000000085430378 refcount:1 mapcount:1 mapping:0000000000000000 index:0x555c6a81d pfn:0x751ac
memcg:ffff888101f7e180
anon flags: 0xfffffc00a0014(uptodate|lru|mappedtodisk|swapbacked|node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc00a0014 ffffea0001bf2988 ffffea0001de2448 ffff88801712e201
raw: 0000000555c6a81d 0000000000000000 0000000100000000 ffff888101f7e180
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880751acd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880751ace00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880751ace80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8880751acf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8880751acf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================The reason is that struct ATTR_RECORD->name_offset is 6485, end address of name string is out of bounds.
Fix this by adding sanity check on end address of attribute name string.
--- fs/ntfs/attrib.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
fs/ntfs/attrib.c +6 -2
@@ -606,8 +606,12 @@ static int ntfs_attr_find(const ATTR_TYP a = (ATTR_RECORD *)((u8 *)ctx->attr +le32_to_cpu (ctx->attr->length));for (;; a = (ATTR_RECORD *)((u8 *)a +le32_to_cpu (a->length))) { -if ((u8 *)a < (u8 *)ctx->mrec || (u8 *)a > (u8 *)ctx->mrec + -le32_to_cpu (ctx->mrec->bytes_allocated)) +u8 *mrec_end = (u8 *)ctx->mrec + +le32_to_cpu (ctx->mrec->bytes_allocated); +u8 *name_end = (u8 *)a +le16_to_cpu (a->name_offset) + + a->name_length *sizeof (ntfschar); +if ((u8 *)a < (u8 *)ctx->mrec || (u8 *)a > mrec_end || + name_end > mrec_end)break ; ctx->attr = a; if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) ||
Greg Kroah-Hartman
maintainerPATCH 3/229 s390/archrandom: prevent CPACF trng invocations in interrupt context
In reply to Greg Kroah-HartmanFrom: Harald Freudenberger <[email protected]>
commit 918e75f77af7d2e049bb70469ec0a2c12782d96a upstream.
This patch slightly reworks the s390 arch_get_random_seed_{int,long}
implementation: Make sure the CPACF trng instruction is never called in any interrupt context. This is done by adding an additional condition in_task().
Justification:
There are some constrains to satisfy for the invocation of the arch_get_random_seed_{int,long}() functions:
- They should provide good random data during kernel initialization.
- They should not be called in interrupt context as the TRNG instruction is relatively heavy weight and may for example make some network loads cause to timeout and buck.
However, it was not clear what kind of interrupt context is exactly encountered during kernel init or network traffic eventually calling arch_get_random_seed_long().
After some days of investigations it is clear that the s390 start_kernel function is not running in any interrupt context and so the trng is called:
Jul 11 18:33:39 t35lp54 kernel: [<00000001064e90ca>] arch_get_random_seed_long.part.0+0x32/0x70 Jul 11 18:33:39 t35lp54 kernel: [<000000010715f246>] random_init+0xf6/0x238 Jul 11 18:33:39 t35lp54 kernel: [<000000010712545c>] start_kernel+0x4a4/0x628 Jul 11 18:33:39 t35lp54 kernel: [<000000010590402a>] startup_continue+0x2a/0x40
The condition in_task() is true and the CPACF trng provides random data during kernel startup.
The network traffic however, is more difficult. A typical call stack looks like this:
Jul 06 17:37:07 t35lp54 kernel: [<000000008b5600fc>] extract_entropy.constprop.0+0x23c/0x240 Jul 06 17:37:07 t35lp54 kernel: [<000000008b560136>] crng_reseed+0x36/0xd8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5604b8>] crng_make_state+0x78/0x340 Jul 06 17:37:07 t35lp54 kernel: [<000000008b5607e0>] _get_random_bytes+0x60/0xf8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b56108a>] get_random_u32+0xda/0x248 Jul 06 17:37:07 t35lp54 kernel: [<000000008aefe7a8>] kfence_guarded_alloc+0x48/0x4b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aeff35e>] __kfence_alloc+0x18e/0x1b8 Jul 06 17:37:07 t35lp54 kernel: [<000000008aef7f10>] __kmalloc_node_track_caller+0x368/0x4d8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611eac>] kmalloc_reserve+0x44/0xa0 Jul 06 17:37:07 t35lp54 kernel: [<000000008b611f98>] __alloc_skb+0x90/0x178 Jul 06 17:37:07 t35lp54 kernel: [<000000008b6120dc>] __napi_alloc_skb+0x5c/0x118 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f06b4>] qeth_extract_skb+0x13c/0x680 Jul 06 17:37:07 t35lp54 kernel: [<000000008b8f6526>] qeth_poll+0x256/0x3f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63d76e>] __napi_poll.constprop.0+0x46/0x2f8 Jul 06 17:37:07 t35lp54 kernel: [<000000008b63dbec>] net_rx_action+0x1cc/0x408 Jul 06 17:37:07 t35lp54 kernel: [<000000008b937302>] __do_softirq+0x132/0x6b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf46ce>] __irq_exit_rcu+0x13e/0x170 Jul 06 17:37:07 t35lp54 kernel: [<000000008abf531a>] irq_exit_rcu+0x22/0x50 Jul 06 17:37:07 t35lp54 kernel: [<000000008b922506>] do_io_irq+0xe6/0x198 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935826>] io_int_handler+0xd6/0x110 Jul 06 17:37:07 t35lp54 kernel: [<000000008b9358a6>] psw_idle_exit+0x0/0xa Jul 06 17:37:07 t35lp54 kernel: ([<000000008ab9c59a>] arch_cpu_idle+0x52/0xe0) Jul 06 17:37:07 t35lp54 kernel: [<000000008b933cfe>] default_idle_call+0x6e/0xd0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac59f4e>] do_idle+0xf6/0x1b0 Jul 06 17:37:07 t35lp54 kernel: [<000000008ac5a28e>] cpu_startup_entry+0x36/0x40 Jul 06 17:37:07 t35lp54 kernel: [<000000008abb0d90>] smp_start_secondary+0x148/0x158 Jul 06 17:37:07 t35lp54 kernel: [<000000008b935b9e>] restart_int_handler+0x6e/0x90
which confirms that the call is in softirq context. So in_task() covers exactly the cases where we want to have CPACF trng called: not in nmi, not in hard irq, not in soft irq but in normal task context and during kernel init.
--- arch/s390/include/asm/archrandom.h | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
arch/s390/include/asm/archrandom.h +6 -3
@@ -2,7 +2,7 @@/* * Kernel interface for the s390 arch_random_* functions * -* Copyright IBM Corp. 2017, 2020 +* Copyright IBM Corp. 2017, 2022 * * Author: Harald Freudenberger <[email protected]> *
@@ -14,6 +14,7 @@#ifdef CONFIG_ARCH_RANDOM #include <linux/static_key.h> +#include <linux/preempt.h> #include <linux/atomic.h> #include <asm/cpacf.h>
@@ -32,7 +33,8 @@ static inline bool __must_check arch_getstatic inline bool __must_check arch_get_random_seed_long (unsigned long *v) { -if (static_branch_likely (&s390_arch_random_available)) { +if (static_branch_likely (&s390_arch_random_available) && +in_task ()) {cpacf_trng (NULL ,0 , (u8 *)v,sizeof (*v));atomic64_add (sizeof (*v), &s390_arch_random_counter);return true;
@@ -42,7 +44,8 @@ static inline bool __must_check arch_getstatic inline bool __must_check arch_get_random_seed_int (unsigned int *v) { -if (static_branch_likely (&s390_arch_random_available)) { +if (static_branch_likely (&s390_arch_random_available) && +in_task ()) {cpacf_trng (NULL ,0 , (u8 *)v,sizeof (*v));atomic64_add (sizeof (*v), &s390_arch_random_counter);return true;
Greg Kroah-Hartman
maintainerPATCH 4/229 scsi: ufs: host: Hold reference returned by of_parse_phandle()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
commit a3435afba87dc6cd83f5595e7607f3c40f93ef01 upstream.
In ufshcd_populate_vreg(), we should hold the reference returned by of_parse_phandle() and then use it to call of_node_put() for refcount balance.
--- drivers/scsi/ufs/ufshcd-pltfrm.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-)
drivers/scsi/ufs/ufshcd-pltfrm.c +13 -2
@@ -124,9 +124,20 @@ out:return ret; } +static bool phandle_exists (const struct device_node *np, +const char *phandle_name,int index) +{ +struct device_node *parse_np =of_parse_phandle (np, phandle_name, index); + +if (parse_np) +of_node_put (parse_np); + +return parse_np !=NULL ; +} +#define MAX_PROP_SIZE 32static int ufshcd_populate_vreg (struct device *dev,const char *name, -struct ufs_vreg **out_vreg) +struct ufs_vreg **out_vreg) {int ret =0 ;char prop_name[MAX_PROP_SIZE ];
@@ -139,7 +150,7 @@ static int ufshcd_populate_vreg(struct d }snprintf (prop_name,MAX_PROP_SIZE ,"%s-supply" , name); -if (!of_parse_phandle (np, prop_name,0 )) { +if (!phandle_exists (np, prop_name,0 )) {dev_info (dev,"%s: Unable to find %s regulator, assuming enabled\n" , __func__, prop_name); goto out;
Greg Kroah-Hartman
maintainerPATCH 5/229 net: ping6: Fix memleak in ipv6_renew_options().
In reply to Greg Kroah-HartmanFrom: Kuniyuki Iwashima <[email protected]>
commit e27326009a3d247b831eda38878c777f6f4eb3d1 upstream.
When we close ping6 sockets, some resources are left unfreed because pingv6_prot is missing sk->sk_prot->destroy(). As reported by syzbot [0], just three syscalls leak 96 bytes and easily cause OOM.
struct ipv6_sr_hdr *hdr;
char data[24] = {0};
int fd;
hdr = (struct ipv6_sr_hdr *)data;
hdr->hdrlen = 2;
hdr->type = IPV6_SRCRT_TYPE_4;
fd = socket(AF_INET6, SOCK_DGRAM, NEXTHDR_ICMP);
setsockopt(fd, IPPROTO_IPV6, IPV6_RTHDR, data, 24);
close(fd);To fix memory leaks, let's add a destroy function.
Note the socket() syscall checks if the GID is within the range of net.ipv4.ping_group_range. The default value is [1, 0] so that no GID meets the condition (1 <= GID <= 0). Thus, the local DoS does not succeed until we change the default value. However, at least Ubuntu/Fedora/RHEL loosen it.
$ cat /usr/lib/sysctl.d/50-default.conf
...
-net.ipv4.ping_group_range = 0 2147483647Also, there could be another path reported with these options, and some of them require CAP_NET_RAW.
setsockopt
IPV6_ADDRFORM (inet6_sk(sk)->pktoptions)
IPV6_RECVPATHMTU (inet6_sk(sk)->rxpmtu)
IPV6_HOPOPTS (inet6_sk(sk)->opt)
IPV6_RTHDRDSTOPTS (inet6_sk(sk)->opt)
IPV6_RTHDR (inet6_sk(sk)->opt)
IPV6_DSTOPTS (inet6_sk(sk)->opt)
IPV6_2292PKTOPTIONS (inet6_sk(sk)->opt)getsockopt
IPV6_FLOWLABEL_MGR (inet6_sk(sk)->ipv6_fl_list)
For the record, I left a different splat with syzbot's one.
unreferenced object 0xffff888006270c60 (size 96):
comm "repro2", pid 231, jiffies 4294696626 (age 13.118s)
hex dump (first 32 bytes):
01 00 00 00 44 00 00 00 00 00 00 00 00 00 00 00 ....D...........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<00000000f6bc7ea9>] sock_kmalloc (net/core/sock.c:2564 net/core/sock.c:2554)
[<000000006d699550>] do_ipv6_setsockopt.constprop.0 (net/ipv6/ipv6_sockglue.c:715)
[<00000000c3c3b1f5>] ipv6_setsockopt (net/ipv6/ipv6_sockglue.c:1024)
[<000000007096a025>] __sys_setsockopt (net/socket.c:2254)
[<000000003a8ff47b>] __x64_sys_setsockopt (net/socket.c:2265 net/socket.c:2262 net/socket.c:2262)
[<000000007c409dcb>] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80)
[<00000000e939c4a9>] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)[0]: https://syzkaller.appspot.com/bug?extid=a8430774139ec3ab7176
--- net/ipv6/ping.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/ipv6/ping.c +6 -0
@@ -26,6 +26,11 @@#include <net/transp_v6.h> #include <net/ping.h> +static void ping_v6_destroy (struct sock *sk) +{ +inet6_destroy_sock (sk); +} +/* Compatibility glue so we can support IPv6 when it's compiled as a module */ static int dummy_ipv6_recv_error (struct sock *sk,struct msghdr *msg,int len,int *addr_len)
@@ -173,6 +178,7 @@ struct proto pingv6_prot = { .owner = THIS_MODULE, .init = ping_init_sock, .close = ping_close, + .destroy = ping_v6_destroy, .connect = ip6_datagram_connect_v6_only, .disconnect = __udp_disconnect, .setsockopt = ipv6_setsockopt,
Greg Kroah-Hartman
maintainerPATCH 6/229 net: sungem_phy: Add of_node_put() for reference returned by of_get_parent()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit ebbbe23fdf6070e31509638df3321688358cc211 ]
In bcm5421_init(), we should call of_node_put() for the reference returned by of_get_parent() which has increased the refcount.
--- drivers/net/sungem_phy.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/sungem_phy.c +1 -0
@@ -453,6 +453,7 @@ static int bcm5421_init(struct mii_phy* phy)int can_low_power =1 ;if (np ==NULL ||of_get_property (np,"no-autolowpower" ,NULL )) can_low_power =0 ; +of_node_put (np);if (can_low_power) {/* Enable automatic low-power */ sungem_phy_write (phy,0x1c ,0x9002 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 7/229 netfilter: nf_queue: do not allow packet truncation below transport header offset
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
[ Upstream commit 99a63d36cb3ed5ca3aa6fcb64cffbeaf3b0fb164 ]
Domingo Dirutigliano and Nicola Guerrera report kernel panic when sending nf_queue verdict with 1-byte nfta_payload attribute.
The IP/IPv6 stack pulls the IP(v6) header from the packet after the input hook.
If user truncates the packet below the header size, this skb_pull() will result in a malformed skb (skb->len < 0).
--- net/netfilter/nfnetlink_queue.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
net/netfilter/nfnetlink_queue.c +6 -1
@@ -827,11 +827,16 @@ nfqnl_enqueue_packet(struct nf_queue_entry *entry, unsigned int queuenum) }static int -nfqnl_mangle (void *data,int data_len,struct nf_queue_entry *e,int diff) +nfqnl_mangle (void *data,unsigned int data_len,struct nf_queue_entry *e,int diff) {struct sk_buff *nskb;if (diff <0 ) { +unsigned int min_len =skb_transport_offset (e->skb); + +if (data_len < min_len) +return -EINVAL ; +if (pskb_trim (e->skb, data_len))return -ENOMEM ; }else if (diff >0 ) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 8/229 ARM: crypto: comment out gcc warning that breaks clang builds
In reply to Greg Kroah-HartmanFrom: Greg Kroah-Hartman <[email protected]>
The gcc build warning prevents all clang-built kernels from working properly, so comment it out to fix the build.
This is a -stable kernel only patch for now, it will be resolved differently in mainline releases in the future.
--- arch/arm/lib/xor-neon.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm/lib/xor-neon.c +2 -1
@@ -29,8 +29,9 @@ MODULE_LICENSE("GPL");* While older versions of GCC do not generate incorrect code, they fail to * recognize the parallel nature of these functions, and emit plain ARM code, * which is known to be slower than the optimized ARM code in asm-arm/xor.h. +* +* #warning This code requires at least version 4.6 of GCC */ -#warning This code requires at least version 4.6 of GCC#endif #pragma GCC diagnostic ignored "-Wunused-variable"
Greg Kroah-Hartman
maintainerPATCH 9/229 mt7601u: add USB device ID for some versions of XiaoDu WiFi Dongle.
In reply to Greg Kroah-HartmanFrom: Wei Mingzhi <[email protected]>
commit 829eea7c94e0bac804e65975639a2f2e5f147033 upstream.
USB device ID of some versions of XiaoDu WiFi Dongle is 2955:1003 instead of 2955:1001. Both are the same mt7601u hardware.
--- drivers/net/wireless/mediatek/mt7601u/usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/mediatek/mt7601u/usb.c +1 -0
@@ -34,6 +34,7 @@ static const struct usb_device_id mt7601 { USB_DEVICE(0x2717, 0x4106) }, { USB_DEVICE(0x2955, 0x0001) }, { USB_DEVICE(0x2955, 0x1001) }, + { USB_DEVICE(0x2955, 0x1003) }, { USB_DEVICE(0x2a5f, 0x1000) }, { USB_DEVICE(0x7392, 0x7710) }, { 0, }
Greg Kroah-Hartman
maintainerPATCH 10/229 ACPI: video: Force backlight native for some TongFang devices
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
commit c752089f7cf5b5800c6ace4cdd1a8351ee78a598 upstream.
The TongFang PF5PU1G, PF4NU1F, PF5NU1G, and PF5LUXG/TUXEDO BA15 Gen10, Pulse 14/15 Gen1, and Pulse 15 Gen2 have the same problem as the Clevo NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2:
They have a working native and video interface. However the default detection mechanism first registers the video interface before unregistering it again and switching to the native interface during boot. This results in a dangling SBIOS request for backlight change for some reason, causing the backlight to switch to ~2% once per boot on the first power cord connect or disconnect event. Setting the native interface explicitly circumvents this buggy behaviour by avoiding the unregistering process.
--- drivers/acpi/video_detect.c | 51 +++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 50 insertions(+), 1 deletion(-)
drivers/acpi/video_detect.c +50 -1
@@ -431,7 +431,56 @@ static const struct dmi_system_id video_ DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), }, }, - +/* +* The TongFang PF5PU1G, PF4NU1F, PF5NU1G, and PF5LUXG/TUXEDO BA15 Gen10, +* Pulse 14/15 Gen1, and Pulse 15 Gen2 have the same problem as the Clevo +* NL5xRU and NL5xNU/TUXEDO Aura 15 Gen1 and Gen2. See the description +* above. +*/ + { + .callback = video_detect_force_native, + .ident = "TongFang PF5PU1G", + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PF5PU1G"), + }, + }, + { + .callback = video_detect_force_native, + .ident = "TongFang PF4NU1F", + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PF4NU1F"), + }, + }, + { + .callback = video_detect_force_native, + .ident = "TongFang PF4NU1F", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "PULSE1401"), + }, + }, + { + .callback = video_detect_force_native, + .ident = "TongFang PF5NU1G", + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PF5NU1G"), + }, + }, + { + .callback = video_detect_force_native, + .ident = "TongFang PF5NU1G", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "TUXEDO"), + DMI_MATCH(DMI_BOARD_NAME, "PULSE1501"), + }, + }, + { + .callback = video_detect_force_native, + .ident = "TongFang PF5LUXG", + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "PF5LUXG"), + }, + }, /* * Desktops which falsely report a backlight and which our heuristics * for this do not catch.
Greg Kroah-Hartman
maintainerPATCH 11/229 ACPI: video: Shortening quirk list by identifying Clevo by board_name only
In reply to Greg Kroah-HartmanFrom: Werner Sembach <[email protected]>
commit f0341e67b3782603737f7788e71bd3530012a4f4 upstream.
Taking a recent change in the i8042 quirklist to this one: Clevo board_names are somewhat unique, and if not: The generic Board_-/Sys_Vendor string "Notebook" doesn't help much anyway. So identifying the devices just by the board_name helps keeping the list significantly shorter and might even hit more devices requiring the fix.
--- drivers/acpi/video_detect.c | 34 ---------------------------------- 1 file changed, 34 deletions(-)
drivers/acpi/video_detect.c +0 -34
@@ -371,23 +371,6 @@ static const struct dmi_system_id video_ .callback = video_detect_force_native, .ident = "Clevo NL5xRU", .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"TUXEDO" ), - DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), - }, - }, - { - .callback = video_detect_force_native, - .ident = "Clevo NL5xRU", - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"SchenkerTechnologiesGmbH" ), - DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), - }, - }, - { - .callback = video_detect_force_native, - .ident = "Clevo NL5xRU", - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), DMI_MATCH(DMI_BOARD_NAME, "NL5xRU"), }, },
@@ -411,23 +394,6 @@ static const struct dmi_system_id video_ .callback = video_detect_force_native, .ident = "Clevo NL5xNU", .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"TUXEDO" ), - DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), - }, - }, - { - .callback = video_detect_force_native, - .ident = "Clevo NL5xNU", - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"SchenkerTechnologiesGmbH" ), - DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), - }, - }, - { - .callback = video_detect_force_native, - .ident = "Clevo NL5xNU", - .matches = { -DMI_MATCH (DMI_SYS_VENDOR ,"Notebook" ), DMI_MATCH(DMI_BOARD_NAME, "NL5xNU"), }, },
Greg Kroah-Hartman
maintainerPATCH 12/229 macintosh/adb: fix oob read in do_adb_query() function
In reply to Greg Kroah-HartmanFrom: Ning Qiang <[email protected]>
commit fd97e4ad6d3b0c9fce3bca8ea8e6969d9ce7423b upstream.
In do_adb_query() function of drivers/macintosh/adb.c, req->data is copied form userland. The parameter "req->data[2]" is missing check, the array size of adb_handler[] is 16, so adb_handler[req->data[2]].original_address and adb_handler[req->data[2]].handler_id will lead to oob read.
--- drivers/macintosh/adb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/macintosh/adb.c +1 -1
@@ -647,7 +647,7 @@ do_adb_query(struct adb_request *req)switch (req->data[1 ]) {case ADB_QUERY_GETDEVINFO : -if (req->nbytes <3 ) +if (req->nbytes <3 || req->data[2 ] >=16 )break ;mutex_lock (&adb_handler_mutex); req->reply[0 ] = adb_handler[req->data[2 ]].original_address;
Greg Kroah-Hartman
maintainerPATCH 13/229 Makefile: link with -z noexecstack --no-warn-rwx-segments
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit 0d362be5b14200b77ecc2127936a5ff82fbffe41 upstream.
Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form:
ld: warning: vmlinux: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: vmlinux has a LOAD segment with RWX permissions
Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack.
LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check.
While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments.
--- Makefile | 3 +++ 1 file changed, 3 insertions(+)
Makefile +3 -0
@@ -873,6 +873,9 @@ ifdef CONFIG_LD_DEAD_CODE_DATA_ELIMINATI LDFLAGS_vmlinux += $(call ld-option, --gc-sections,) endif +LDFLAGS += -z noexecstack +LDFLAGS += $(call ld-option,--no-warn-rwx-segments) + ifeq ($(CONFIG_STRIP_ASM_SYMS),y) LDFLAGS_vmlinux += $(call ld-option, -X,) endif
Greg Kroah-Hartman
maintainerPATCH 14/229 x86: link vdso and boot with -z noexecstack --no-warn-rwx-segments
In reply to Greg Kroah-HartmanFrom: Nick Desaulniers <[email protected]>
commit ffcf9c5700e49c0aee42dcba9a12ba21338e8136 upstream.
Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instances of a new warning when linking kernels in the form:
ld: warning: arch/x86/boot/pmjump.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker
ld: warning: arch/x86/boot/compressed/vmlinux has a LOAD segment with RWX permissions
Generally, we would like to avoid the stack being executable. Because there could be a need for the stack to be executable, assembler sources have to opt-in to this security feature via explicit creation of the .note.GNU-stack feature (which compilers create by default) or command line flag --noexecstack. Or we can simply tell the linker the production of such sections is irrelevant and to link the stack as --noexecstack.
LLVM's LLD linker defaults to -z noexecstack, so this flag isn't strictly necessary when linking with LLD, only BFD, but it doesn't hurt to be explicit here for all linkers IMO. --no-warn-rwx-segments is currently BFD specific and only available in the current latest release, so it's wrapped in an ld-option check.
While the kernel makes extensive usage of ELF sections, it doesn't use permissions from ELF segments.
--- arch/x86/boot/Makefile | 2 +- arch/x86/boot/compressed/Makefile | 4 ++++ arch/x86/entry/vdso/Makefile | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-)
arch/x86/boot/Makefile +1 -1
@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmli AFLAGS_header.o += -I$(objtree)/$(obj) $(obj)/header.o: $(obj)/zoffset.h -LDFLAGS_setup.elf := -m elf_i386 -T +LDFLAGS_setup.elf := -m elf_i386 -z noexecstack -T $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE $(call if_changed,ld)
arch/x86/boot/compressed/Makefile +4 -0
@@ -55,6 +55,10 @@ else LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \ && echo "-z noreloc-overflow -pie --no-dynamic-linker") endif + +LDFLAGS += -z noexecstack +LDFLAGS += $(call ld-option,--no-warn-rwx-segments) + LDFLAGS_vmlinux := -T hostprogs-y := mkpiggy
arch/x86/entry/vdso/Makefile +1 -1
@@ -183,7 +183,7 @@ quiet_cmd_vdso = VDSO $@ VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \ $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \ - -Bsymbolic + -Bsymbolic -z noexecstack GCOV_PROFILE := n #
Greg Kroah-Hartman
maintainerPATCH 15/229 ALSA: bcd2000: Fix a UAF bug on the error path of probing
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit ffb2759df7efbc00187bfd9d1072434a13a54139 upstream.
When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause a UAF bug.
The following log can reveal it:
[ 50.727020] BUG: KASAN: use-after-free in bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000] [ 50.727623] Read of size 8 at addr ffff88810fab0e88 by task swapper/4/0 [ 50.729530] Call Trace: [ 50.732899] bcd2000_input_complete+0x1f1/0x2e0 [snd_bcd2000]
Fix this by adding usb_kill_urb() before usb_free_urb().
--- sound/usb/bcd2000/bcd2000.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/bcd2000/bcd2000.c +2 -1
@@ -357,7 +357,8 @@ static int bcd2000_init_midi(struct bcd2static void bcd2000_free_usb_related_resources (struct bcd2000 *bcd2k,struct usb_interface *interface) { -/* usb_kill_urb not necessary, urb is aborted automatically */ +usb_kill_urb (bcd2k->midi_out_urb); +usb_kill_urb (bcd2k->midi_in_urb);usb_free_urb (bcd2k->midi_out_urb);usb_free_urb (bcd2k->midi_in_urb);
Greg Kroah-Hartman
maintainerPATCH 16/229 add barriers to buffer_uptodate and set_buffer_uptodate
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit d4252071b97d2027d246f6a82cbee4d52f618b47 upstream.
Let's have a look at this piece of code in __bread_slow:
get_bh(bh); bh->b_end_io = end_buffer_read_sync; submit_bh(REQ_OP_READ, 0, bh); wait_on_buffer(bh); if (buffer_uptodate(bh)) return bh;
Neither wait_on_buffer nor buffer_uptodate contain any memory barrier. Consequently, if someone calls sb_bread and then reads the buffer data, the read of buffer data may be executed before wait_on_buffer(bh) on architectures with weak memory ordering and it may return invalid data.
Fix this bug by adding a memory barrier to set_buffer_uptodate and an acquire barrier to buffer_uptodate (in a similar way as folio_test_uptodate and folio_mark_uptodate).
--- include/linux/buffer_head.h | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-)
include/linux/buffer_head.h +24 -1
@@ -114,7 +114,6 @@ static __always_inline int test_clear_bu* of the form "mark_buffer_foo()". These are higher-level functions which * do something in addition to setting a b_state bit. */ -BUFFER_FNS(Uptodate, uptodate) BUFFER_FNS(Dirty, dirty) TAS_BUFFER_FNS(Dirty, dirty)BUFFER_FNS (Lock, locked)
@@ -132,6 +131,30 @@ BUFFER_FNS(Meta, meta) BUFFER_FNS(Prio, prio) BUFFER_FNS(Defer_Completion, defer_completion) +static __always_inline void set_buffer_uptodate(struct buffer_head *bh) +{ +/* +* make it consistent with folio_mark_uptodate +* pairs with smp_load_acquire in buffer_uptodate +*/ +smp_mb__before_atomic (); +set_bit (BH_Uptodate, &bh->b_state); +} + +static __always_inline void clear_buffer_uptodate(struct buffer_head *bh) +{ +clear_bit (BH_Uptodate, &bh->b_state); +} + +static __always_inline int buffer_uptodate(const struct buffer_head *bh) +{ +/* +* make it consistent with folio_test_uptodate +* pairs with smp_mb__before_atomic in set_buffer_uptodate +*/ +return (smp_load_acquire (&bh->b_state) & (1UL << BH_Uptodate)) !=0 ; +} +#define bh_offset (bh) ((unsigned long)(bh)->b_data & ~PAGE_MASK)/* If we *know* page->private refers to buffer_heads */
Greg Kroah-Hartman
maintainerPATCH 17/229 HID: wacom: Dont register pad_input for touch switch
In reply to Greg Kroah-HartmanFrom: Ping Cheng <[email protected]>
commit d6b675687a4ab4dba684716d97c8c6f81bf10905 upstream.
Touch switch state is received through WACOM_PAD_FIELD. However, it is reported by touch_input. Don't register pad_input if no other pad events require the interface.
--- drivers/hid/wacom_sys.c | 2 +- drivers/hid/wacom_wac.c | 43 +++++++++++++++++++++++++------------------ 2 files changed, 26 insertions(+), 19 deletions(-)
drivers/hid/wacom_sys.c +1 -1
@@ -1956,7 +1956,7 @@ static int wacom_register_inputs(struct error =wacom_setup_pad_input_capabilities (pad_input_dev, wacom_wac);if (error) { -/* no pad in use on this interface */ +/* no pad events using this interface */ input_free_device (pad_input_dev); wacom_wac->pad_input =NULL ; pad_input_dev =NULL ;
drivers/hid/wacom_wac.c +25 -18
67 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 18/229 KVM: SVM: Dont BUG if userspace injects an interrupt with GIF=0
In reply to Greg Kroah-HartmanFrom: Maciej S. Szmigiero <[email protected]>
commit f17c31c48e5cde9895a491d91c424eeeada3e134 upstream.
Don't BUG/WARN on interrupt injection due to GIF being cleared, since it's trivial for userspace to force the situation via KVM_SET_VCPU_EVENTS (even if having at least a WARN there would be correct for KVM internally generated injections).
kernel BUG at arch/x86/kvm/svm/svm.c:3386!
invalid opcode: 0000 [#1] SMP
CPU: 15 PID: 926 Comm: smm_test Not tainted 5.17.0-rc3+ #264 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:svm_inject_irq+0xab/0xb0 [kvm_amd] Code: <0f> 0b 0f 1f 00 0f 1f 44 00 00 80 3d ac b3 01 00 00 55 48 89 f5 53 RSP: 0018:ffffc90000b37d88 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88810a234ac0 RCX: 0000000000000006 RDX: 0000000000000000 RSI: ffffc90000b37df7 RDI: ffff88810a234ac0 RBP: ffffc90000b37df7 R08: ffff88810a1fa410 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffff888109571000 R14: ffff88810a234ac0 R15: 0000000000000000 FS: 0000000001821380(0000) GS:ffff88846fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f74fc550008 CR3: 000000010a6fe000 CR4: 0000000000350ea0 Call Trace: <TASK> inject_pending_event+0x2f7/0x4c0 [kvm] kvm_arch_vcpu_ioctl_run+0x791/0x17a0 [kvm] kvm_vcpu_ioctl+0x26d/0x650 [kvm] __x64_sys_ioctl+0x82/0xb0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae </TASK>
Message-Id: <35426af6e123cbe91ec7ce5132ce72521f02b1b5.1651440202.git.maciej.szmigiero@oracle.com>
--- arch/x86/kvm/svm.c | 2 -- 1 file changed, 2 deletions(-)
arch/x86/kvm/svm.c +0 -2
@@ -4611,8 +4611,6 @@ static void svm_set_irq(struct kvm_vcpu {struct vcpu_svm *svm =to_svm (vcpu); -BUG_ON (!(gif_set (svm))); -trace_kvm_inj_virq (vcpu->arch.interrupt.nr); ++vcpu->stat.irq_injections;
Greg Kroah-Hartman
maintainerPATCH 19/229 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit ec6e4d863258d4bfb36d48d5e3ef68140234d688 upstream.
Wait to mark the TSS as busy during LTR emulation until after all fault checks for the LTR have passed. Specifically, don't mark the TSS busy if the new TSS base is non-canonical.
Opportunistically drop the one-off !seg_desc.PRESENT check for TR as the only reason for the early check was to avoid marking a !PRESENT TSS as busy, i.e. the common !PRESENT is now done before setting the busy bit.
--- arch/x86/kvm/emulate.c | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-)
arch/x86/kvm/emulate.c +9 -10
@@ -1721,16 +1721,6 @@ static int __load_segment_descriptor(strcase VCPU_SREG_TR :if (seg_desc.s || (seg_desc.type !=1 && seg_desc.type !=9 )) goto exception; -if (!seg_desc.p) { - err_vec =NP_VECTOR ; - goto exception; - } - old_desc = seg_desc; - seg_desc.type |=2 ;/* busy */ - ret = ctxt->ops->cmpxchg_emulated (ctxt, desc_addr, &old_desc, &seg_desc, -sizeof (seg_desc), &ctxt->exception); -if (ret !=X86EMUL_CONTINUE ) -return ret;break ;case VCPU_SREG_LDTR :if (seg_desc.s || seg_desc.type !=2 )
@@ -1771,6 +1761,15 @@ static int __load_segment_descriptor(str ((u64)base3 << 32), ctxt))return emulate_gp (ctxt,0 ); } + +if (seg ==VCPU_SREG_TR ) { + old_desc = seg_desc; + seg_desc.type |=2 ;/* busy */ + ret = ctxt->ops->cmpxchg_emulated (ctxt, desc_addr, &old_desc, &seg_desc, +sizeof (seg_desc), &ctxt->exception); +if (ret !=X86EMUL_CONTINUE ) +return ret; + } load: ctxt->ops->set_segment (ctxt, selector, &seg_desc, base3, seg);if (desc)
Greg Kroah-Hartman
maintainerPATCH 20/229 KVM: x86: Set error code to segment selector on LLDT/LTR non-canonical #GP
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 2626206963ace9e8bf92b6eea5ff78dd674c555c upstream.
When injecting a #GP on LLDT/LTR due to a non-canonical LDT/TSS base, set the error code to the selector. Intel SDM's says nothing about the #GP, but AMD's APM explicitly states that both LLDT and LTR set the error code to the selector, not zero.
Note, a non-canonical memory operand on LLDT/LTR does generate a #GP(0), but the KVM code in question is specific to the base from the descriptor.
--- arch/x86/kvm/emulate.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/kvm/emulate.c +2 -2
@@ -1758,8 +1758,8 @@ static int __load_segment_descriptor(strif (ret !=X86EMUL_CONTINUE )return ret;if (emul_is_noncanonical_address (get_desc_base (&seg_desc) | - ((u64 )base3 <<32 ), ctxt)) -return emulate_gp (ctxt,0 ); + ((u64 )base3 <<32 ), ctxt)) +return emulate_gp (ctxt, err_code); }if (seg ==VCPU_SREG_TR ) {
Greg Kroah-Hartman
maintainerPATCH 21/229 ALSA: hda/conexant: Add quirk for LENOVO 20149 Notebook model
In reply to Greg Kroah-HartmanFrom: Meng Tang <[email protected]>
commit f83bb2592482fe94c6eea07a8121763c80f36ce5 upstream.
There is another LENOVO 20149 (Type1Sku0) Notebook model with CX20590, the device PCI SSID is 17aa:3977, which headphones are not responding, that requires the quirk CXT_PINCFG_LENOVO_NOTEBOOK. Add the corresponding entry to the quirk table.
--- sound/pci/hda/patch_conexant.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
sound/pci/hda/patch_conexant.c +10 -1
@@ -244,6 +244,7 @@ enum {CXT_PINCFG_LEMOTE_A1205 ,CXT_PINCFG_COMPAQ_CQ60 ,CXT_FIXUP_STEREO_DMIC , +CXT_PINCFG_LENOVO_NOTEBOOK ,CXT_FIXUP_INC_MIC_BOOST ,CXT_FIXUP_HEADPHONE_MIC_PIN , CXT_FIXUP_HEADPHONE_MIC,
@@ -787,6 +788,14 @@ static const struct hda_fixup cxt_fixups .type = HDA_FIXUP_FUNC, .v.func = cxt_fixup_stereo_dmic, }, + [CXT_PINCFG_LENOVO_NOTEBOOK] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl []) { + {0x1a ,0x05d71030 }, + { } + }, + .chain_id = CXT_FIXUP_STEREO_DMIC, + }, [CXT_FIXUP_INC_MIC_BOOST] = { .type = HDA_FIXUP_FUNC, .v.func = cxt5066_increase_mic_boost,
@@ -977,7 +986,7 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x17aa ,0x3905 ,"Lenovo G50-30" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x390b ,"Lenovo G50-80" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x3975 ,"Lenovo U300s" ,CXT_FIXUP_STEREO_DMIC ), -SND_PCI_QUIRK (0x17aa ,0x3977 ,"Lenovo IdeaPad U310" ,CXT_FIXUP_STEREO_DMIC ), +SND_PCI_QUIRK (0x17aa ,0x3977 ,"Lenovo IdeaPad U310" ,CXT_PINCFG_LENOVO_NOTEBOOK ),SND_PCI_QUIRK (0x17aa ,0x3978 ,"Lenovo G50-70" ,CXT_FIXUP_STEREO_DMIC ),SND_PCI_QUIRK (0x17aa ,0x397b ,"Lenovo S205" ,CXT_FIXUP_STEREO_DMIC ), SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
Greg Kroah-Hartman
maintainerPATCH 22/229 ALSA: hda/cirrus - support for iMac 12,1 model
In reply to Greg Kroah-HartmanFrom: Allen Ballway <[email protected]>
commit 74bba640d69914cf832b87f6bbb700e5ba430672 upstream.
The 12,1 model requires the same configuration as the 12,2 model to enable headphones but has a different codec SSID. Adds 12,1 SSID for matching quirk.
[ re-sorted in SSID order by tiwai ]
--- sound/pci/hda/patch_cirrus.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_cirrus.c +1 -0
@@ -409,6 +409,7 @@ static const struct snd_pci_quirk cs420x/* codec SSID */ SND_PCI_QUIRK (0x106b ,0x0600 ,"iMac 14,1" ,CS420X_IMAC27_122 ), +SND_PCI_QUIRK (0x106b ,0x0900 ,"iMac 12,1" ,CS420X_IMAC27_122 ),SND_PCI_QUIRK (0x106b ,0x1c00 ,"MacBookPro 8,1" ,CS420X_MBP81 ),SND_PCI_QUIRK (0x106b ,0x2000 ,"iMac 12,2" ,CS420X_IMAC27_122 ), SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101),
Greg Kroah-Hartman
maintainerPATCH 23/229 vfs: Check the truncate maximum size in inode_newsize_ok()
In reply to Greg Kroah-HartmanFrom: David Howells <[email protected]>
commit e2ebff9c57fe4eb104ce4768f6ebcccf76bef849 upstream.
If something manages to set the maximum file size to MAX_OFFSET+1, this can cause the xfs and ext4 filesystems at least to become corrupt.
Ordinarily, the kernel protects against userspace trying this by checking the value early in the truncate() and ftruncate() system calls calls - but there are at least two places that this check is bypassed:
(1) Cachefiles will round up the EOF of the backing file to DIO block size so as to allow DIO on the final block - but this might push the offset negative. It then calls notify_change(), but this inadvertently bypasses the checking. This can be triggered if someone puts an 8EiB-1 file on a server for someone else to try and access by, say, nfs.
(2) ksmbd doesn't check the value it is given in set_end_of_file_info() and then calls vfs_truncate() directly - which also bypasses the check.
In both cases, it is potentially possible for a network filesystem to cause a disk filesystem to be corrupted: cachefiles in the client's cache filesystem; ksmbd in the server's filesystem.
nfsd is okay as it checks the value, but we can then remove this check too.
Fix this by adding a check to inode_newsize_ok(), as called from setattr_prepare(), thereby catching the issue as filesystems set up to perform the truncate with minimal opportunity for bypassing the new check.
--- fs/attr.c | 2 ++ 1 file changed, 2 insertions(+)
fs/attr.c +2 -0
@@ -113,6 +113,8 @@ EXPORT_SYMBOL(setattr_prepare);*/ int inode_newsize_ok (const struct inode *inode,loff_t offset) { +if (offset <0 ) +return -EINVAL ;if (inode->i_size < offset) {unsigned long limit;
Greg Kroah-Hartman
maintainerPATCH 24/229 fs: Add missing umask strip in vfs_tmpfile
In reply to Greg Kroah-HartmanFrom: Yang Xu <[email protected]>
commit ac6800e279a22b28f4fc21439843025a0d5bf03e upstream.
All creation paths except for O_TMPFILE handle umask in the vfs directly if the filesystem doesn't support or enable POSIX ACLs. If the filesystem does then umask handling is deferred until posix_acl_create(). Because, O_TMPFILE misses umask handling in the vfs it will not honor umask settings. Fix this by adding the missing umask handling.
--- fs/namei.c | 2 ++ 1 file changed, 2 insertions(+)
fs/namei.c +2 -0
@@ -3465,6 +3465,8 @@ struct dentry *vfs_tmpfile(struct dentry child =d_alloc (dentry, &slash_name);if (unlikely (!child)) goto out_err; +if (!IS_POSIXACL (dir)) + mode &= ~current_umask (); error = dir->i_op->tmpfile (dir, child, mode);if (error) goto out_err;
Greg Kroah-Hartman
maintainerPATCH 25/229 usbnet: Fix linkwatch use-after-free on disconnect
In reply to Greg Kroah-HartmanFrom: Lukas Wunner <[email protected]>
commit a69e617e533edddf3fa3123149900f36e0a6dc74 upstream.
usbnet uses the work usbnet_deferred_kevent() to perform tasks which may sleep. On disconnect, completion of the work was originally awaited in ->ndo_stop(). But in 2003, that was moved to ->disconnect() by historic commit "[PATCH] USB: usbnet, prevent exotic rtnl deadlock":
https://git.kernel.org/tglx/history/c/0f138bbfd83c
The change was made because back then, the kernel's workqueue implementation did not allow waiting for a single work. One had to wait for completion of *all* work by calling flush_scheduled_work(), and that could deadlock when waiting for usbnet_deferred_kevent() with rtnl_mutex held in ->ndo_stop().
The commit solved one problem but created another: It causes a use-after-free in USB Ethernet drivers aqc111.c, asix_devices.c, ax88179_178a.c, ch9200.c and smsc75xx.c:
* If the drivers receive a link change interrupt immediately before disconnect, they raise EVENT_LINK_RESET in their (non-sleepable) ->status() callback and schedule usbnet_deferred_kevent().
* usbnet_deferred_kevent() invokes the driver's ->link_reset() callback, which calls netif_carrier_{on,off}().
* That in turn schedules the work linkwatch_event().
Because usbnet_deferred_kevent() is awaited after unregister_netdev(), netif_carrier_{on,off}() may operate on an unregistered netdev and linkwatch_event() may run after free_netdev(), causing a use-after-free.
In 2010, usbnet was changed to only wait for a single instance of usbnet_deferred_kevent() instead of *all* work by commit 23f333a2bfaf ("drivers/net: don't use flush_scheduled_work()").
Unfortunately the commit neglected to move the wait back to ->ndo_stop(). Rectify that omission at long last.
--- drivers/net/usb/usbnet.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-)
drivers/net/usb/usbnet.c +2 -6
@@ -847,13 +847,11 @@ int usbnet_stop (struct net_device *net) mpn = !test_and_clear_bit (EVENT_NO_RUNTIME_PM , &dev->flags); -/* deferred work (task, timer, softirq) must also stop. -* can't flush_scheduled_work() until we drop rtnl (later), -* else workers could deadlock; so make workers a NOP. -*/ +/* deferred work (timer, softirq, task) must also stop */ dev->flags =0 ;del_timer_sync (&dev->delay);tasklet_kill (&dev->bh); +cancel_work_sync (&dev->kevent);if (!pm)usb_autopm_put_interface (dev->intf);
@@ -1616,8 +1614,6 @@ void usbnet_disconnect (struct usb_inter net = dev->net;unregister_netdev (net); -cancel_work_sync (&dev->kevent); -usb_scuttle_anchored_urbs (&dev->deferred);if (dev->driver_info->unbind)
Greg Kroah-Hartman
maintainerPATCH 26/229 parisc: Fix device names in /proc/iomem
In reply to Greg Kroah-HartmanFrom: Helge Deller <[email protected]>
commit cab56b51ec0e69128909cef4650e1907248d821b upstream.
Fix the output of /proc/iomem to show the real hardware device name including the pa_pathname, e.g. "Merlin 160 Core Centronics [8:16:0]". Up to now only the pa_pathname ("[8:16.0]") was shown.
--- arch/parisc/kernel/drivers.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
arch/parisc/kernel/drivers.c +4 -5
@@ -505,7 +505,6 @@ alloc_pa_dev(unsigned long hpa, struct h dev->id.hversion_rev = iodc_data[1 ] &0x0f ; dev->id.sversion = ((iodc_data[4 ] &0x0f ) <<16 ) | (iodc_data[5 ] <<8 ) | iodc_data[6 ]; - dev->hpa.name =parisc_pathname (dev); dev->hpa.start = hpa;/* This is awkward. The STI spec says that gfx devices may occupy * 32MB or 64MB. Unfortunately, we don't know how to tell whether
@@ -519,10 +518,10 @@ alloc_pa_dev(unsigned long hpa, struct h dev->hpa.end = hpa +0xfff ; } dev->hpa.flags =IORESOURCE_MEM ; - name =parisc_hardware_description (&dev->id); -if (name) { -strlcpy (dev->name, name,sizeof (dev->name)); - } + dev->hpa.name = dev->name; + name =parisc_hardware_description (&dev->id) ? :"unknown" ; +snprintf (dev->name,sizeof (dev->name),"%s [%s]" , + name,parisc_pathname (dev));/* Silently fail things like mouse ports which are subsumed within * the keyboard controller
Greg Kroah-Hartman
maintainerPATCH 27/229 drm/nouveau: fix another off-by-one in nvbios_addr
In reply to Greg Kroah-HartmanFrom: Timur Tabi <[email protected]>
commit c441d28945fb113220d48d6c86ebc0b090a2b677 upstream.
This check determines whether a given address is part of image 0 or image 1. Image 1 starts at offset image0_size, so that address should be included.
--- drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/gpu/drm/nouveau/nvkm/subdev/bios/base.c +1 -1
@@ -33,7 +33,7 @@ nvbios_addr(struct nvkm_bios *bios, u32 {u32 p = *addr; -if (*addr > bios->image0_size && bios->imaged_addr) { +if (*addr >= bios->image0_size && bios->imaged_addr) { *addr -= bios->image0_size; *addr += bios->imaged_addr; }
Greg Kroah-Hartman
maintainerPATCH 28/229 drm/amdgpu: Check BOs requested pinning domains against its preferred_domains
In reply to Greg Kroah-HartmanFrom: Leo Li <[email protected]>
commit f5ba14043621f4afdf3ad5f92ee2d8dbebbe4340 upstream.
When pinning a buffer, we should check to see if there are any additional restrictions imposed by bo->preferred_domains. This will prevent the BO from being moved to an invalid domain when pinning.
For example, this can happen if the user requests to create a BO in GTT domain for display scanout. amdgpu_dm will allow pinning to either VRAM or GTT domains, since DCN can scanout from either or. However, in amdgpu_bo_pin_restricted(), pinning to VRAM is preferred if there is adequate carveout. This can lead to pinning to VRAM despite the user requesting GTT placement for the BO.
v2: Allow the kernel to override the domain, which can happen when
exporting a BO to a V4L camera (for example).
--- drivers/gpu/drm/amd/amdgpu/amdgpu_object.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +4 -0
@@ -682,6 +682,10 @@ int amdgpu_bo_pin_restricted(struct amdgif (WARN_ON_ONCE (min_offset > max_offset))return -EINVAL ; +/* Check domain to be pinned to against preferred domains */ +if (bo->preferred_domains & domain) + domain = bo->preferred_domains & domain; +/* A shared bo cannot be migrated to VRAM */ if (bo->prime_shared_count) {if (domain &AMDGPU_GEM_DOMAIN_GTT )
Greg Kroah-Hartman
maintainerPATCH 29/229 iio: light: isl29028: Fix the warning in isl29028_remove()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
commit 06674fc7c003b9d0aa1d37fef7ab2c24802cc6ad upstream.
The driver use the non-managed form of the register function in isl29028_remove(). To keep the release order as mirroring the ordering in probe, the driver should use non-managed form in probe, too.
The following log reveals it:
[ 32.374955] isl29028 0-0010: remove [ 32.376861] general protection fault, probably for non-canonical address 0xdffffc0000000006: 0000 [#1] PREEMPT SMP KASAN PTI [ 32.377676] KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] [ 32.379432] RIP: 0010:kernfs_find_and_get_ns+0x28/0xe0 [ 32.385461] Call Trace: [ 32.385807] sysfs_unmerge_group+0x59/0x110 [ 32.386110] dpm_sysfs_remove+0x58/0xc0 [ 32.386391] device_del+0x296/0xe50 [ 32.386959] cdev_device_del+0x1d/0xd0 [ 32.387231] devm_iio_device_unreg+0x27/0xb0 [ 32.387542] devres_release_group+0x319/0x3d0 [ 32.388162] i2c_device_remove+0x93/0x1f0
--- drivers/iio/light/isl29028.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/iio/light/isl29028.c +1 -1
@@ -640,7 +640,7 @@ static int isl29028_probe(struct i2c_cli ISL29028_POWER_OFF_DELAY_MS);pm_runtime_use_autosuspend (&client->dev); - ret =devm_iio_device_register (indio_dev->dev.parent, indio_dev); + ret =iio_device_register (indio_dev);if (ret <0 ) { dev_err(&client->dev, "%s(): iio registration failed with error %d\n",
Greg Kroah-Hartman
maintainerPATCH 30/229 fuse: limit nsec
In reply to Greg Kroah-HartmanFrom: Miklos Szeredi <[email protected]>
commit 47912eaa061a6a81e4aa790591a1874c650733c0 upstream.
Limit nanoseconds to 0..999999999.
--- fs/fuse/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/fuse/inode.c +6 -0
@@ -174,6 +174,12 @@ void fuse_change_attributes_common(struc inode->i_uid =make_kuid (&init_user_ns, attr->uid); inode->i_gid =make_kgid (&init_user_ns, attr->gid); inode->i_blocks = attr->blocks; + +/* Sanitize nsecs */ + attr->atimensec =min_t (u32, attr->atimensec,NSEC_PER_SEC -1 ); + attr->mtimensec =min_t (u32, attr->mtimensec,NSEC_PER_SEC -1 ); + attr->ctimensec =min_t (u32, attr->ctimensec,NSEC_PER_SEC -1 ); + inode->i_atime.tv_sec = attr->atime; inode->i_atime.tv_nsec = attr->atimensec;/* mtime from server may be stale due to local buffered write */
Greg Kroah-Hartman
maintainerPATCH 31/229 md-raid10: fix KASAN warning
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit d17f744e883b2f8d13cca252d71cfe8ace346f7d upstream.
There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is valid.
BUG: KASAN: slab-out-of-bounds in raid10_remove_disk+0x61/0x2a0 [raid10] Read of size 8 at addr ffff889108f3d300 by task mdX_raid10/124682 CPU: 3 PID: 124682 Comm: mdX_raid10 Not tainted 5.19.0-rc6 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 print_report.cold+0x45/0x57a ? __lock_text_start+0x18/0x18 ? raid10_remove_disk+0x61/0x2a0 [raid10] kasan_report+0xa8/0xe0 ? raid10_remove_disk+0x61/0x2a0 [raid10] raid10_remove_disk+0x61/0x2a0 [raid10] Buffer I/O error on dev dm-76, logical block 15344, async page read ? __mutex_unlock_slowpath.constprop.0+0x1e0/0x1e0 remove_and_add_spares+0x367/0x8a0 [md_mod] ? super_written+0x1c0/0x1c0 [md_mod] ? mutex_trylock+0xac/0x120 ? _raw_spin_lock+0x72/0xc0 ? _raw_spin_lock_bh+0xc0/0xc0 md_check_recovery+0x848/0x960 [md_mod] raid10d+0xcf/0x3360 [raid10] ? sched_clock_cpu+0x185/0x1a0 ? rb_erase+0x4d4/0x620 ? var_wake_function+0xe0/0xe0 ? psi_group_change+0x411/0x500 ? preempt_count_sub+0xf/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? raid10_sync_request+0x36c0/0x36c0 [raid10] ? preempt_count_sub+0xf/0xc0 ? _raw_spin_unlock_irqrestore+0x19/0x40 ? del_timer_sync+0xa9/0x100 ? try_to_del_timer_sync+0xc0/0xc0 ? _raw_spin_lock_irqsave+0x78/0xc0 ? __lock_text_start+0x18/0x18 ? _raw_spin_unlock_irq+0x11/0x24 ? __list_del_entry_valid+0x68/0xa0 ? finish_wait+0xa3/0x100 md_thread+0x161/0x260 [md_mod] ? unregister_md_personality+0xa0/0xa0 [md_mod] ? _raw_spin_lock_irqsave+0x78/0xc0 ? prepare_to_wait_event+0x2c0/0x2c0 ? unregister_md_personality+0xa0/0xa0 [md_mod] kthread+0x148/0x180 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Allocated by task 124495: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x80/0xa0 setup_conf+0x140/0x5c0 [raid10] raid10_run+0x4cd/0x740 [raid10] md_run+0x6f9/0x1300 [md_mod] raid_ctr+0x2531/0x4ac0 [dm_raid] dm_table_add_target+0x2b0/0x620 [dm_mod] table_load+0x1c8/0x400 [dm_mod] ctl_ioctl+0x29e/0x560 [dm_mod] dm_compat_ctl_ioctl+0x7/0x20 [dm_mod] __do_compat_sys_ioctl+0xfa/0x160 do_syscall_64+0x90/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 L __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 __kasan_record_aux_stack+0x9e/0xc0 kvfree_call_rcu+0x84/0x480 timerfd_release+0x82/0x140 __fput+0xfa/0x400 task_work_run+0x80/0xc0 exit_to_user_mode_prepare+0x155/0x160 syscall_exit_to_user_mode+0x12/0x40 do_syscall_64+0x42/0xc0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff889108f3d200 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 0 bytes to the right of
256-byte region [ffff889108f3d200, ffff889108f3d300)
The buggy address belongs to the physical page:
page:000000007ef2a34c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1108f3c
head:000000007ef2a34c order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4000000000010200(slab|head|zone=2)
raw: 4000000000010200 0000000000000000 dead000000000001 ffff889100042b40
raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff889108f3d200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff889108f3d280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff889108f3d300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff889108f3d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff889108f3d400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00--- drivers/md/raid10.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/md/raid10.c +4 -1
@@ -1831,9 +1831,12 @@ static int raid10_remove_disk(struct mddint err =0 ;int number = rdev->raid_disk;struct md_rdev **rdevp; -struct raid10_info *p = conf->mirrors + number; +struct raid10_info *p;print_conf (conf); +if (unlikely (number >= mddev->raid_disks)) +return 0 ; + p = conf->mirrors + number;if (rdev == p->rdev) rdevp = &p->rdev;else if (rdev == p->replacement)
Greg Kroah-Hartman
maintainerPATCH 32/229 ia64, processor: fix -Wincompatible-pointer-types in ia64_get_irr()
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit e5a16a5c4602c119262f350274021f90465f479d upstream.
test_bit(), as any other bitmap op, takes unsigned long * as a second argument (pointer to the actual bitmap), as any bitmap itself is an array of unsigned longs. However, the ia64_get_irr() code passes a ref to u64 as a second argument.
This works with the ia64 bitops implementation due to that they have void * as the second argument and then cast it later on. This works with the bitmap API itself due to that unsigned long has the same size on ia64 as u64 (unsigned long long), but from the compiler PoV those two are different.
Define @irr as unsigned long to fix that. That implies no functional changes. Has been hidden for 16 years!
--- arch/ia64/include/asm/processor.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/ia64/include/asm/processor.h +1 -1
@@ -552,7 +552,7 @@ ia64_get_irr(unsigned int vector) {unsigned int reg = vector /64 ;unsigned int bit = vector %64 ; -u64 irr; +unsigned long irr;switch (reg) {case 0 : irr =ia64_getreg (_IA64_REG_CR_IRR0);break ;
Greg Kroah-Hartman
maintainerPATCH 33/229 PCI: Add defines for normal and subtractive PCI bridges
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 904b10fb189cc15376e9bfce1ef0282e68b0b004 upstream.
Add these PCI class codes to pci_ids.h:
PCI_CLASS_BRIDGE_PCI_NORMAL
PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE
Use these defines in all kernel code for describing PCI class codes for normal and subtractive PCI bridges.
--- include/linux/pci_ids.h | 2 ++ 1 file changed, 2 insertions(+)
include/linux/pci_ids.h +2 -0
@@ -59,6 +59,8 @@#define PCI_CLASS_BRIDGE_EISA 0x0602#define PCI_CLASS_BRIDGE_MC 0x0603#define PCI_CLASS_BRIDGE_PCI 0x0604 +#define PCI_CLASS_BRIDGE_PCI_NORMAL 0x060400 +#define PCI_CLASS_BRIDGE_PCI_SUBTRACTIVE 0x060401#define PCI_CLASS_BRIDGE_PCMCIA 0x0605#define PCI_CLASS_BRIDGE_NUBUS 0x0606#define PCI_CLASS_BRIDGE_CARDBUS 0x0607
Greg Kroah-Hartman
maintainerPATCH 34/229 powerpc/fsl-pci: Fix Class Code of PCIe Root Port
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
commit 0c551abfa004ce154d487d91777bf221c808a64f upstream.
By default old pre-3.0 Freescale PCIe controllers reports invalid PCI Class Code 0x0b20 for PCIe Root Port. It can be seen by lspci -b output on P2020 board which has this pre-3.0 controller:
$ lspci -bvnn
00:00.0 Power PC [0b20]: Freescale Semiconductor Inc P2020E [1957:0070] (rev 21)
!!! Invalid class 0b20 for header type 01
Capabilities: [4c] Express Root Port (Slot-), MSI 00Fix this issue by programming correct PCI Class Code 0x0604 for PCIe Root Port to the Freescale specific PCIe register 0x474.
With this change lspci -b output is:
$ lspci -bvnn
00:00.0 PCI bridge [0604]: Freescale Semiconductor Inc P2020E [1957:0070] (rev 21) (prog-if 00 [Normal decode])
Capabilities: [4c] Express Root Port (Slot-), MSI 00Without any "Invalid class" error. So class code was properly reflected into standard (read-only) PCI register 0x08.
Same fix is already implemented in U-Boot pcie_fsl.c driver in commit:
http://source.denx.de/u-boot/u-boot/-/commit/d18d06ac35229345a0af80977a408cfbe1d1015b
Fix activated by U-Boot stay active also after booting Linux kernel. But boards which use older U-Boot version without that fix are affected and still require this fix.
So implement this class code fix also in kernel fsl_pci.c driver.
--- arch/powerpc/sysdev/fsl_pci.c | 8 ++++++++ arch/powerpc/sysdev/fsl_pci.h | 1 + 2 files changed, 9 insertions(+)
arch/powerpc/sysdev/fsl_pci.c +8 -0
@@ -523,6 +523,7 @@ int fsl_add_bridge(struct platform_devicstruct resource rsrc;const int *bus_range;u8 hdr_type, progif; +u32 class_code;struct device_node *dev;struct ccsr_pci __iomem *pci;u16 temp;
@@ -596,6 +597,13 @@ int fsl_add_bridge(struct platform_devicPPC_INDIRECT_TYPE_SURPRESS_PRIMARY_BUS ;if (fsl_pcie_check_link (hose)) hose->indirect_type |=PPC_INDIRECT_TYPE_NO_PCIE_LINK ; +/* Fix Class Code to PCI_CLASS_BRIDGE_PCI_NORMAL for pre-3.0 controller */ +if (in_be32 (&pci->block_rev1) <PCIE_IP_REV_3_0 ) { +early_read_config_dword (hose,0 ,0 ,PCIE_FSL_CSR_CLASSCODE , &class_code); + class_code &=0xff ; + class_code |=PCI_CLASS_BRIDGE_PCI_NORMAL <<8 ; +early_write_config_dword (hose,0 ,0 ,PCIE_FSL_CSR_CLASSCODE , class_code); + } }else {/* * Set PBFR(PCI Bus Function Register)[10] = 1 to
arch/powerpc/sysdev/fsl_pci.h +1 -0
@@ -23,6 +23,7 @@ struct platform_device;#define PCIE_LTSSM 0x0404/* PCIE Link Training and Status */ #define PCIE_LTSSM_L0 0x16/* L0 state */ +#define PCIE_FSL_CSR_CLASSCODE 0x474/* FSL GPEX CSR */ #define PCIE_IP_REV_2_2 0x02080202/* PCIE IP block version Rev2.2 */ #define PCIE_IP_REV_3_0 0x02080300/* PCIE IP block version Rev3.0 */ #define PIWAR_EN 0x80000000/* Enable */
Greg Kroah-Hartman
maintainerPATCH 35/229 powerpc/powernv: Avoid crashing if rng is NULL
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
commit 90b5d4fe0b3ba7f589c6723c6bfb559d9e83956a upstream.
On a bare-metal Power8 system that doesn't have an "ibm,power-rng", a malicious QEMU and guest that ignore the absence of the KVM_CAP_PPC_HWRNG flag, and calls H_RANDOM anyway, will dereference a NULL pointer.
In practice all Power8 machines have an "ibm,power-rng", but let's not rely on that, add a NULL check and early return in powernv_get_random_real_mode().
--- arch/powerpc/platforms/powernv/rng.c | 2 ++ 1 file changed, 2 insertions(+)
arch/powerpc/platforms/powernv/rng.c +2 -0
@@ -63,6 +63,8 @@ int powernv_get_random_real_mode(unsignestruct powernv_rng *rng; rng =raw_cpu_read (powernv_rng); +if (!rng) +return 0 ; *v =rng_whiten (rng,__raw_rm_readq (rng->regs_real));
Greg Kroah-Hartman
maintainerPATCH 36/229 MIPS: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
In reply to Greg Kroah-HartmanFrom: Huacai Chen <[email protected]>
commit e1a534f5d074db45ae5cbac41d8912b98e96a006 upstream.
When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS is selected, cpu_max_bits_warn() generates a runtime warning similar as below while we show /proc/cpuinfo. Fix this by using nr_cpu_ids (the runtime limit) instead of NR_CPUS to iterate CPUs.
[ 3.052463] ------------[ cut here ]------------ [ 3.059679] WARNING: CPU: 3 PID: 1 at include/linux/cpumask.h:108 show_cpuinfo+0x5e8/0x5f0 [ 3.070072] Modules linked in: efivarfs autofs4 [ 3.076257] CPU: 0 PID: 1 Comm: systemd Not tainted 5.19-rc5+ #1052 [ 3.084034] Hardware name: Loongson Loongson-3A4000-7A1000-1w-V0.1-CRB/Loongson-LS3A4000-7A1000-1w-EVB-V1.21, BIOS Loongson-UDK2018-V2.0.04082-beta7 04/27 [ 3.099465] Stack : 9000000100157b08 9000000000f18530 9000000000cf846c 9000000100154000 [ 3.109127] 9000000100157a50 0000000000000000 9000000100157a58 9000000000ef7430 [ 3.118774] 90000001001578e8 0000000000000040 0000000000000020 ffffffffffffffff [ 3.128412] 0000000000aaaaaa 1ab25f00eec96a37 900000010021de80 900000000101c890 [ 3.138056] 0000000000000000 0000000000000000 0000000000000000 0000000000aaaaaa [ 3.147711] ffff8000339dc220 0000000000000001 0000000006ab4000 0000000000000000 [ 3.157364] 900000000101c998 0000000000000004 9000000000ef7430 0000000000000000 [ 3.167012] 0000000000000009 000000000000006c 0000000000000000 0000000000000000 [ 3.176641] 9000000000d3de08 9000000001639390 90000000002086d8 00007ffff0080286 [ 3.186260] 00000000000000b0 0000000000000004 0000000000000000 0000000000071c1c [ 3.195868] ... [ 3.199917] Call Trace: [ 3.203941] [<98000000002086d8>] show_stack+0x38/0x14c [ 3.210666] [<9800000000cf846c>] dump_stack_lvl+0x60/0x88 [ 3.217625] [<980000000023d268>] __warn+0xd0/0x100 [ 3.223958] [<9800000000cf3c90>] warn_slowpath_fmt+0x7c/0xcc [ 3.231150] [<9800000000210220>] show_cpuinfo+0x5e8/0x5f0 [ 3.238080] [<98000000004f578c>] seq_read_iter+0x354/0x4b4 [ 3.245098] [<98000000004c2e90>] new_sync_read+0x17c/0x1c4 [ 3.252114] [<98000000004c5174>] vfs_read+0x138/0x1d0 [ 3.258694] [<98000000004c55f8>] ksys_read+0x70/0x100 [ 3.265265] [<9800000000cfde9c>] do_syscall+0x7c/0x94 [ 3.271820] [<9800000000202fe4>] handle_syscall+0xc4/0x160 [ 3.281824] ---[ end trace 8b484262b4b8c24c ]---
--- arch/mips/kernel/proc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/mips/kernel/proc.c +1 -1
@@ -164,7 +164,7 @@ static void *c_start(struct seq_file *m, {unsigned long i = *pos; -return i <NR_CPUS ? (void *) (i +1 ) :NULL ; +return i < nr_cpu_ids ? (void *) (i +1 ) :NULL ; }static void *c_next (struct seq_file *m,void *v,loff_t *pos)
Greg Kroah-Hartman
maintainerPATCH 37/229 USB: HCD: Fix URB giveback issue in tasklet function
In reply to Greg Kroah-HartmanFrom: Weitao Wang <[email protected]>
commit 26c6c2f8a907c9e3a2f24990552a4d77235791e6 upstream.
Usb core introduce the mechanism of giveback of URB in tasklet context to reduce hardware interrupt handling time. On some test situation(such as FIO with 4KB block size), when tasklet callback function called to giveback URB, interrupt handler add URB node to the bh->head list also. If check bh->head list again after finish all URB giveback of local_list, then it may introduce a "dynamic balance" between giveback URB and add URB to bh->head list. This tasklet callback function may not exit for a long time, which will cause other tasklet function calls to be delayed. Some real-time applications(such as KB and Mouse) will see noticeable lag.
In order to prevent the tasklet function from occupying the cpu for a long time at a time, new URBS will not be added to the local_list even though the bh->head list is not empty. But also need to ensure the left URB giveback to be processed in time, so add a member high_prio for structure giveback_urb_bh to prioritize tasklet and schelule this tasklet again if bh->head list is not empty.
At the same time, we are able to prioritize tasklet through structure member high_prio. So, replace the local high_prio_bh variable with this structure member in usb_hcd_giveback_urb.
--- drivers/usb/core/hcd.c | 26 +++++++++++++++----------- include/linux/usb/hcd.h | 1 + 2 files changed, 16 insertions(+), 11 deletions(-)
drivers/usb/core/hcd.c +15 -11
@@ -1814,7 +1814,6 @@ static void usb_giveback_urb_bh(unsignedspin_lock_irq (&bh->lock); bh->running = true; - restart:list_replace_init (&bh->head, &local_list);spin_unlock_irq (&bh->lock);
@@ -1828,10 +1827,17 @@ static void usb_giveback_urb_bh(unsigned bh->completing_ep =NULL ; } -/* check if there are new URBs to giveback */ +/* +* giveback new URBs next time to prevent this function +* from not exiting for a long time. +*/ spin_lock_irq (&bh->lock); -if (!list_empty (&bh->head)) - goto restart; +if (!list_empty (&bh->head)) { +if (bh->high_prio) +tasklet_hi_schedule (&bh->bh); +else +tasklet_schedule (&bh->bh); + } bh->running = false;spin_unlock_irq (&bh->lock); }
@@ -1856,7 +1862,7 @@ static void usb_giveback_urb_bh(unsignedvoid usb_hcd_giveback_urb (struct usb_hcd *hcd,struct urb *urb,int status) {struct giveback_urb_bh *bh; -bool running, high_prio_bh; +bool running;/* pass status to tasklet via unlinked */ if (likely (!urb->unlinked))
@@ -1867,13 +1873,10 @@ void usb_hcd_giveback_urb(struct usb_hcdreturn ; } -if (usb_pipeisoc (urb->pipe) ||usb_pipeint (urb->pipe)) { +if (usb_pipeisoc (urb->pipe) ||usb_pipeint (urb->pipe)) bh = &hcd->high_prio_bh; - high_prio_bh = true; - }else { +else bh = &hcd->low_prio_bh; - high_prio_bh = false; - }spin_lock (&bh->lock);list_add_tail (&urb->urb_list, &bh->head);
@@ -1882,7 +1885,7 @@ void usb_hcd_giveback_urb(struct usb_hcdif (running) ; -else if (high_prio_bh) +else if (bh->high_prio)tasklet_hi_schedule (&bh->bh);else tasklet_schedule (&bh->bh);
@@ -2900,6 +2903,7 @@ int usb_add_hcd(struct usb_hcd *hcd,/* initialize tasklets */ init_giveback_urb_bh (&hcd->high_prio_bh); + hcd->high_prio_bh.high_prio = true;init_giveback_urb_bh (&hcd->low_prio_bh);/* enable irqs just before we start the controller,
include/linux/usb/hcd.h +1 -0
@@ -65,6 +65,7 @@struct giveback_urb_bh {bool running; +bool high_prio;spinlock_t lock;struct list_head head;struct tasklet_struct bh;
Greg Kroah-Hartman
maintainerPATCH 38/229 netfilter: nf_tables: fix null deref due to zeroed list head
In reply to Greg Kroah-HartmanFrom: Florian Westphal <[email protected]>
commit 580077855a40741cf511766129702d97ff02f4d9 upstream.
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object.
nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a null dereference:
BUG: KASAN: null-ptr-deref in nft_trans_destroy+0x26/0x59 Call Trace: nft_trans_destroy+0x26/0x59 nf_tables_newtable+0x4bc/0x9bc [..]
Its sane to assume that nft_trans_destroy() can be called on the transaction object returned by nft_trans_alloc(), so make sure the list head is initialised.
--- net/netfilter/nf_tables_api.c | 1 + 1 file changed, 1 insertion(+)
net/netfilter/nf_tables_api.c +1 -0
@@ -121,6 +121,7 @@ static struct nft_trans *nft_trans_allocif (trans ==NULL )return NULL ; +INIT_LIST_HEAD (&trans->list); trans->msg_type = msg_type; trans->ctx = *ctx;
Greg Kroah-Hartman
maintainerPATCH 39/229 arm64: Do not forget syscall when starting a new thread.
In reply to Greg Kroah-HartmanFrom: Francis Laniel <[email protected]>
[ Upstream commit de6921856f99c11d3986c6702d851e1328d4f7f6 ]
Enable tracing of the execve*() system calls with the syscalls:sys_exit_execve tracepoint by removing the call to forget_syscall() when starting a new thread and preserving the value of regs->syscallno across exec.
--- arch/arm64/include/asm/processor.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
arch/arm64/include/asm/processor.h +2 -1
@@ -143,8 +143,9 @@ void tls_preserve_current_state(void);static inline void start_thread_common (struct pt_regs *regs,unsigned long pc) { +s32 previous_syscall = regs->syscallno;memset (regs,0 ,sizeof (*regs)); -forget_syscall (regs); + regs->syscallno = previous_syscall; regs->pc = pc; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 40/229 arm64: fix oops in concurrently setting insn_emulation sysctls
In reply to Greg Kroah-HartmanFrom: haibinzhang (张海斌) <[email protected]>
[ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ]
emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself:
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200
To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing.
--- arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
arch/arm64/kernel/armv8_deprecated.c +5 -4
@@ -63,6 +63,7 @@ struct insn_emulation {static LIST_HEAD (insn_emulation);static int nr_insn_emulated__initdata ;static DEFINE_RAW_SPINLOCK (insn_emulation_lock); +static DEFINE_MUTEX (insn_emulation_mutex);static void register_emulation_hooks (struct insn_emulation_ops *ops) {
@@ -208,10 +209,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, loff_t *ppos) {int ret =0 ; -struct insn_emulation *insn = (struct insn_emulation *) table->data; + struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);enum insn_emulation_mode prev_mode = insn->current_mode; - table->data = &insn->current_mode; +mutex_lock (&insn_emulation_mutex); ret =proc_dointvec_minmax (table, write, buffer, lenp, ppos);if (ret || !write || prev_mode == insn->current_mode)
@@ -224,7 +225,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write,update_insn_emulation_mode (insn,INSN_UNDEF ); } ret: - table->data = insn; +mutex_unlock (&insn_emulation_mutex);return ret; }
@@ -254,7 +255,7 @@ static void __init register_insn_emulation_sysctl(struct ctl_table *table) sysctl->maxlen =sizeof (int ); sysctl->procname = insn->ops->name; - sysctl->data = insn; + sysctl->data = &insn->current_mode; sysctl->extra1 = &insn->min; sysctl->extra2 = &insn->max; sysctl->proc_handler = emulation_proc_handler;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 41/229 ext2: Add more validity checks for inode counts
In reply to Greg Kroah-HartmanFrom: Jan Kara <[email protected]>
[ Upstream commit fa78f336937240d1bc598db817d638086060e7e9 ]
Add checks verifying number of inodes stored in the superblock matches the number computed from number of inodes per group. Also verify we have at least one block worth of inodes per group. This prevents crashes on corrupted filesystems.
--- fs/ext2/super.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
fs/ext2/super.c +10 -2
@@ -1072,9 +1072,10 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_frags_per_group); goto failed_mount; } -if (sbi->s_inodes_per_group > sb->s_blocksize *8 ) { +if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > sb->s_blocksize *8 ) {ext2_msg (sb,KERN_ERR , -"error: #inodes per group too big: %lu" , +"error: invalid #inodes per group: %lu" , sbi->s_inodes_per_group); goto failed_mount; }
@@ -1084,6 +1085,13 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) sbi->s_groups_count = ((le32_to_cpu (es->s_blocks_count) -le32_to_cpu (es->s_first_data_block) -1 ) /EXT2_BLOCKS_PER_GROUP (sb)) +1 ; +if ((u64 )sbi->s_groups_count * sbi->s_inodes_per_group != +le32_to_cpu (es->s_inodes_count)) { +ext2_msg (sb,KERN_ERR ,"error: invalid #inodes: %u vs computed %llu" , +le32_to_cpu (es->s_inodes_count), + (u64 )sbi->s_groups_count * sbi->s_inodes_per_group); + goto failed_mount; + } db_count = (sbi->s_groups_count +EXT2_DESC_PER_BLOCK (sb) -1 ) /EXT2_DESC_PER_BLOCK (sb); sbi->s_group_desc =kmalloc (db_count *sizeof (struct buffer_head *),GFP_KERNEL );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 42/229 ARM: dts: imx6ul: add missing properties for sram
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 5655699cf5cff9f4c4ee703792156bdd05d1addf ]
All 3 properties are required by sram.yaml. Fixes the dtbs_check warning:
sram@900000: '#address-cells' is a required property sram@900000: '#size-cells' is a required property sram@900000: 'ranges' is a required property
--- arch/arm/boot/dts/imx6ul.dtsi | 3 +++ 1 file changed, 3 insertions(+)
arch/arm/boot/dts/imx6ul.dtsi +3 -0
@@ -152,6 +152,9 @@ pmu { ocram: sram@00900000 { compatible = "mmio-sram"; reg = <0x00900000 0x20000>; + ranges = <0 0x00900000 0x20000>; + #address-cells = <1>; + #size-cells = <1>; }; dma_apbh: dma-apbh@01804000 {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 43/229 ARM: dts: imx6ul: fix qspi node compatible
In reply to Greg Kroah-HartmanFrom: Alexander Stein <[email protected]>
[ Upstream commit 0c6cf86e1ab433b2d421880fdd9c6e954f404948 ]
imx6ul is not compatible to imx6sx, both have different erratas. Fixes the dt_binding_check warning:
spi@21e0000: compatible: 'oneOf' conditional failed, one must be fixed:
['fsl,imx6ul-qspi', 'fsl,imx6sx-qspi'] is too long Additional items are not allowed ('fsl,imx6sx-qspi' was unexpected) 'fsl,imx6ul-qspi' is not one of ['fsl,ls1043a-qspi'] 'fsl,imx6ul-qspi' is not one of ['fsl,imx8mq-qspi'] 'fsl,ls1021a-qspi' was expected
'fsl,imx7d-qspi' was expected
--- arch/arm/boot/dts/imx6ul.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/imx6ul.dtsi +1 -1
@@ -883,7 +883,7 @@ lcdif: lcdif@021c8000 { qspi: qspi@021e0000 { #address-cells = <1>; #size-cells = <0>; - compatible = "fsl,imx6ul-qspi", "fsl,imx6sx-qspi"; + compatible = "fsl,imx6ul-qspi"; reg = <0x021e0000 0x4000>, <0x60000000 0x10000000>; reg-names = "QuadSPI", "QuadSPI-memory"; interrupts = <GIC_SPI 107 IRQ_TYPE_LEVEL_HIGH>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 44/229 ARM: OMAP2+: display: Fix refcount leak bug
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 50b87a32a79bca6e275918a711fb8cc55e16d739 ]
In omapdss_init_fbdev(), of_find_node_by_name() will return a node pointer with refcount incremented. We should use of_node_put() when it is not used anymore.
Message-Id: <[email protected]>
--- arch/arm/mach-omap2/display.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-omap2/display.c +1 -0
@@ -218,6 +218,7 @@ static int __init omapdss_init_fbdev(void) node =of_find_node_by_name (NULL ,"omap4_padconf_global" );if (node) omap4_dsi_mux_syscon =syscon_node_to_regmap (node); +of_node_put (node);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 45/229 ACPI: PM: save NVS memory for Lenovo G40-45
In reply to Greg Kroah-HartmanFrom: Manyi Li <[email protected]>
[ Upstream commit 4b7ef7b05afcde44142225c184bf43a0cd9e2178 ]
[821d6f0359b0614792ab8e2fb93b503e25a65079] is to make machines produced from 2012 to now not saving NVS region to accelerate S3.
But, Lenovo G40-45, a platform released in 2015, still needs NVS memory saving during S3. A quirk is introduced for this platform.
--- drivers/acpi/sleep.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/acpi/sleep.c +8 -0
@@ -359,6 +359,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { DMI_MATCH(DMI_PRODUCT_NAME, "80E3"), }, }, + { + .callback = init_nvs_save_s3, + .ident = "Lenovo G40-45", + .matches = { + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), + DMI_MATCH(DMI_PRODUCT_NAME, "80E1"), + }, + },/* * https://bugzilla.kernel.org/show_bug.cgi?id=196907 * Some Dell XPS13 9360 cannot do suspend-to-idle using the Low Power
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 46/229 ACPI: LPSS: Fix missing check in register_device_clock()
In reply to Greg Kroah-HartmanFrom: huhai <[email protected]>
[ Upstream commit b4f1f61ed5928b1128e60e38d0dffa16966f06dc ]
register_device_clock() misses a check for platform_device_register_simple(). Add a check to fix it.
--- drivers/acpi/acpi_lpss.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/acpi/acpi_lpss.c +3 -0
@@ -396,6 +396,9 @@ static int register_device_clock(struct acpi_device *adev,if (!lpss_clk_dev)lpt_register_clock_device (); +if (IS_ERR (lpss_clk_dev)) +return PTR_ERR (lpss_clk_dev); + clk_data =platform_get_drvdata (lpss_clk_dev);if (!clk_data)return -ENODEV ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 47/229 PM: hibernate: defer device probing when resuming from hibernation
In reply to Greg Kroah-HartmanFrom: Tetsuo Handa <[email protected]>
[ Upstream commit 8386c414e27caba8501119948e9551e52b527f59 ]
syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count variable. Currently wait_for_device_probe() from snapshot_open() from misc_open() can sleep forever with misc_mtx held if probe_count cannot become 0.
When a device is probed by hub_event() work function, probe_count is incremented before the probe function starts, and probe_count is decremented after the probe function completed.
There are three cases that can prevent probe_count from dropping to 0.
(a) A device being probed stopped responding (i.e. broken/malicious hardware).
(b) A process emulating a USB device using /dev/raw-gadget interface stopped responding for some reason.
(c) New device probe requests keeps coming in before existing device probe requests complete.
The phenomenon syzbot is reporting is (b). A process which is holding system_transition_mutex and misc_mtx is waiting for probe_count to become 0 inside wait_for_device_probe(), but the probe function which is called
from hub_event() work function is waiting for the processes which are
blocked at mutex_lock(&misc_mtx) to respond via /dev/raw-gadget interface.
This patch mitigates (b) by deferring wait_for_device_probe() from snapshot_open() to snapshot_write() and snapshot_ioctl(). Please note that the possibility of (b) remains as long as any thread which is emulating a USB device via /dev/raw-gadget interface can be blocked by uninterruptible blocking operations (e.g. mutex_lock()).
Please also note that (a) and (c) are not addressed. Regarding (c), we should change the code to wait for only one device which contains the image for resuming from hibernation. I don't know how to address (a), for use of timeout for wait_for_device_probe() might result in loss of user data in the image. Maybe we should require the userland to wait for the image device before opening /dev/snapshot interface.
--- kernel/power/user.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
kernel/power/user.c +12 -1
@@ -29,6 +29,7 @@#include "power.h" +static bool need_wait;#define SNAPSHOT_MINOR 231
@@ -82,7 +83,7 @@ static int snapshot_open(struct inode *inode, struct file *filp)* Resuming. We may need to wait for the image device to * appear. */ -wait_for_device_probe (); + need_wait = true; data->swap =-1 ; data->mode =O_WRONLY ;
@@ -174,6 +175,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf,ssize_t res;loff_t pg_offp = *offp & ~PAGE_MASK ; +if (need_wait) { +wait_for_device_probe (); + need_wait = false; + } +lock_system_sleep (); data = filp->private_data;
@@ -209,6 +215,11 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd,loff_t size;sector_t offset; +if (need_wait) { +wait_for_device_probe (); + need_wait = false; + } +if (_IOC_TYPE (cmd) !=SNAPSHOT_IOC_MAGIC )return -ENOTTY ;if (_IOC_NR (cmd) >SNAPSHOT_IOC_MAXNR )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 48/229 selinux: Add boundary check in put_entry()
In reply to Greg Kroah-HartmanFrom: Xiu Jianfeng <[email protected]>
[ Upstream commit 15ec76fb29be31df2bccb30fc09875274cba2776 ]
Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access.
--- security/selinux/ss/policydb.h | 2 ++ 1 file changed, 2 insertions(+)
security/selinux/ss/policydb.h +2 -0
@@ -360,6 +360,8 @@ static inline int put_entry(const void *buf, size_t bytes, int num, struct polic {size_t len = bytes * num; +if (len > fp->len) +return -EINVAL ;memcpy (fp->data, buf, len); fp->data += len; fp->len -= len;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 49/229 ARM: findbit: fix overflowing offset
In reply to Greg Kroah-HartmanFrom: Russell King (Oracle) <[email protected]>
[ Upstream commit ec85bd369fd2bfaed6f45dd678706429d4f75b48 ]
When offset is larger than the size of the bit array, we should not attempt to access the array as we can perform an access beyond the end of the array. Fix this by changing the pre-condition.
Using "cmp r2, r1; bhs ..." covers us for the size == 0 case, since this will always take the branch when r1 is zero, irrespective of the value of r2. This means we can fix this bug without adding any additional code!
--- arch/arm/lib/findbit.S | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
arch/arm/lib/findbit.S +8 -8
@@ -43,8 +43,8 @@ ENDPROC(_find_first_zero_bit_le) * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) */ ENTRY(_find_next_zero_bit_le) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine ARM( ldrb r3, [r0, r2, lsr #3] )
@@ -84,8 +84,8 @@ ENDPROC(_find_first_bit_le) * Prototype: int find_next_zero_bit(void *addr, unsigned int maxbit, int offset) */ ENTRY(_find_next_bit_le) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine ARM( ldrb r3, [r0, r2, lsr #3] )
@@ -118,8 +118,8 @@ ENTRY(_find_first_zero_bit_be) ENDPROC(_find_first_zero_bit_be) ENTRY(_find_next_zero_bit_be) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine eor r3, r2, #0x18 @ big endian byte ordering
@@ -152,8 +152,8 @@ ENTRY(_find_first_bit_be) ENDPROC(_find_first_bit_be) ENTRY(_find_next_bit_be) - teq r1, #0 - beq 3b + cmp r2, r1 + bhs 3b ands ip, r2, #7 beq 1b @ If new byte, goto old routine eor r3, r2, #0x18 @ big endian byte ordering
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 50/229 ARM: bcm: Fix refcount leak in bcm_kona_smc_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit cb23389a2458c2e4bfd6c86a513cbbe1c4d35e76 ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-bcm/bcm_kona_smc.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-bcm/bcm_kona_smc.c +1 -0
@@ -54,6 +54,7 @@ int __init bcm_kona_smc_init(void)return -ENODEV ; prop_val =of_get_address (node,0 , &prop_size,NULL ); +of_node_put (node);if (!prop_val)return -EINVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 51/229 x86/pmem: Fix platform-device leak in error path
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 229e73d46994f15314f58b2d39bf952111d89193 ]
Make sure to free the platform device in the unlikely event that registration fails.
--- arch/x86/kernel/pmem.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
arch/x86/kernel/pmem.c +6 -1
@@ -27,6 +27,11 @@ static __init int register_e820_pmem(void)* simply here to trigger the module to load on demand. */ pdev =platform_device_alloc ("e820_pmem" ,-1 ); -return platform_device_add (pdev); + + rc =platform_device_add (pdev); +if (rc) +platform_device_put (pdev); + +return rc; }device_initcall (register_e820_pmem);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 52/229 ARM: dts: ast2500-evb: fix board compatible
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit 30b276fca5c0644f3cb17bceb1bd6a626c670184 ]
The AST2500 EVB board should have dedicated compatible.
--- arch/arm/boot/dts/aspeed-ast2500-evb.dts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/arm/boot/dts/aspeed-ast2500-evb.dts +1 -1
@@ -5,7 +5,7 @@ / { model = "AST2500 EVB"; - compatible = "aspeed,ast2500"; + compatible = "aspeed,ast2500-evb", "aspeed,ast2500"; aliases { serial4 = &uart5;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 53/229 soc: fsl: guts: machine variable might be unset
In reply to Greg Kroah-HartmanFrom: Michael Walle <[email protected]>
[ Upstream commit ab3f045774f704c4e7b6a878102f4e9d4ae7bc74 ]
If both the model and the compatible properties are missing, then machine will not be set. Initialize it with NULL.
--- drivers/soc/fsl/guts.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/soc/fsl/guts.c +1 -1
@@ -136,7 +136,7 @@ static int fsl_guts_probe(struct platform_device *pdev)struct device *dev = &pdev->dev;struct resource *res;const struct fsl_soc_die_attr *soc_die; -const char *machine; +const char *machine =NULL ;u32 svr;/* Initialize guts */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 54/229 cpufreq: zynq: Fix refcount leak in zynq_get_revision
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit d1ff2559cef0f6f8d97fba6337b28adb10689e16 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- arch/arm/mach-zynq/common.c | 1 + 1 file changed, 1 insertion(+)
arch/arm/mach-zynq/common.c +1 -0
@@ -84,6 +84,7 @@ static int __init zynq_get_revision(void) } zynq_devcfg_base =of_iomap (np,0 ); +of_node_put (np);if (!zynq_devcfg_base) {pr_err ("%s: Unable to map I/O memory\n" , __func__);return -1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 55/229 ARM: dts: qcom: pm8841: add required thermal-sensor-cells
In reply to Greg Kroah-HartmanFrom: Krzysztof Kozlowski <[email protected]>
[ Upstream commit e2759fa0676c9a32bbddb9aff955b54bb35066ad ]
The PM8841 temperature sensor has to define thermal-sensor-cells.
--- arch/arm/boot/dts/qcom-pm8841.dtsi | 1 + 1 file changed, 1 insertion(+)
arch/arm/boot/dts/qcom-pm8841.dtsi +1 -0
@@ -25,6 +25,7 @@ temp-alarm@2400 { compatible = "qcom,spmi-temp-alarm"; reg = <0x2400>; interrupts = <4 0x24 0 IRQ_TYPE_EDGE_RISING>; + #thermal-sensor-cells = <0>; }; };
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 56/229 arm64: dts: qcom: msm8916: Fix typo in pronto remoteproc node
In reply to Greg Kroah-HartmanFrom: Sireesh Kodali <[email protected]>
[ Upstream commit 5458d6f2827cd30218570f266b8d238417461f2f ]
The smem-state properties for the pronto node were incorrectly labelled, reading qcom,state* rather than qcom,smem-state*. Fix that, allowing the stop state to be used.
--- arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm64/boot/dts/qcom/msm8916.dtsi +2 -2
@@ -980,8 +980,8 @@ pronto: wcnss@a21b000 { vddmx-supply = <&pm8916_l3>; vddpx-supply = <&pm8916_l7>; - qcom,state = <&wcnss_smp2p_out 0>; - qcom,state-names = "stop"; + qcom,smem-states = <&wcnss_smp2p_out 0>; + qcom,smem-state-names = "stop"; pinctrl-names = "default"; pinctrl-0 = <&wcnss_pin_a>;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 57/229 regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 66efb665cd5ad69b27dca8571bf89fc6b9c628a4 ]
We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount.
--- drivers/regulator/of_regulator.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/regulator/of_regulator.c +5 -1
@@ -158,8 +158,12 @@ static void of_get_regulation_constraints(struct device_node *np, } suspend_np =of_get_child_by_name (np, regulator_states[i]); -if (!suspend_np || !suspend_state) +if (!suspend_np)continue ; +if (!suspend_state) { +of_node_put (suspend_np); +continue ; + }if (!of_property_read_u32 (suspend_np,"regulator-mode" , &pval)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 58/229 thermal/tools/tmon: Include pthread and time headers in tmon.h
In reply to Greg Kroah-HartmanFrom: Markus Mayer <[email protected]>
[ Upstream commit 0cf51bfe999524377fbb71becb583b4ca6d07cfc ]
Include sys/time.h and pthread.h in tmon.h, so that types "pthread_mutex_t" and "struct timeval tv" are known when tmon.h references them.
Without these headers, compiling tmon against musl-libc will fail with these errors:
In file included from sysfs.c:31:0:
tmon.h:47:8: error: unknown type name 'pthread_mutex_t'
extern pthread_mutex_t input_lock;
^~~~~~~~~~~~~~~make[3]: *** [<builtin>: sysfs.o] Error 1 make[3]: *** Waiting for unfinished jobs.... In file included from tui.c:31:0:
tmon.h:54:17: error: field 'tv' has incomplete type
struct timeval tv;
^~make[3]: *** [<builtin>: tui.o] Error 1
make[2]: *** [Makefile:83: tmon] Error 2
--- tools/thermal/tmon/tmon.h | 3 +++ 1 file changed, 3 insertions(+)
tools/thermal/tmon/tmon.h +3 -0
@@ -36,6 +36,9 @@#define NR_LINES_TZDATA 1#define TMON_LOG_FILE "/var/tmp/tmon.log" +#include <sys/time.h> +#include <pthread.h> +extern unsigned long ticktime;extern double time_elapsed;extern unsigned long target_temp_user;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 59/229 dm: return early from dm_pr_call() if DM device is suspended
In reply to Greg Kroah-HartmanFrom: Mike Snitzer <[email protected]>
[ Upstream commit e120a5f1e78fab6223544e425015f393d90d6f0d ]
Otherwise PR ops may be issued while the broader DM device is being reconfigured, etc.
--- drivers/md/dm.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/dm.c +5 -0
@@ -2859,6 +2859,11 @@ static int dm_call_pr(struct block_device *bdev, iterate_devices_callout_fn fn, goto out; ti =dm_table_get_target (table,0 ); +if (dm_suspended_md (md)) { + ret = -EAGAIN ; + goto out; + } + ret = -EINVAL ;if (!ti->type->iterate_devices) goto out;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 60/229 drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
[ Upstream commit 136f614931a2bb73616b292cf542da3a18daefd5 ]
The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after the last 'j++'.
Instead of changing '>' to '>=' there, add the bounds check at the start of the second 'case' (the first one already has it).
Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it seems it can be a valid value.
Detected using the static analysis tool - Svace.
--- drivers/gpu/drm/radeon/ni_dpm.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/radeon/ni_dpm.c +2 -4
@@ -2738,10 +2738,10 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, table->mc_reg_table_entry[k].mc_data[j] |=0x100 ; } j++; -if (j >SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE ) -return -EINVAL ;break ;case MC_SEQ_RESERVE_M >>2 : +if (j >=SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE ) +return -EINVAL ; temp_reg =RREG32 (MC_PMG_CMD_MRS1 ); table->mc_reg_address[j].s1 =MC_PMG_CMD_MRS1 >>2 ; table->mc_reg_address[j].s0 =MC_SEQ_PMG_CMD_MRS1_LP >>2 ;
@@ -2750,8 +2750,6 @@ static int ni_set_mc_special_registers(struct radeon_device *rdev, (temp_reg &0xffff0000 ) | (table->mc_reg_table_entry[k].mc_data[i] &0x0000ffff ); j++; -if (j >SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE ) -return -EINVAL ;break ;default :break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 61/229 drm/mediatek: Add pull-down MIPI operation in mtk_dsi_poweroff function
In reply to Greg Kroah-HartmanFrom: Xinlei Lee <[email protected]>
[ Upstream commit fa5d0a0205c34734c5b8daa77e39ac2817f63a10 ]
In the dsi_enable function, mtk_dsi_rxtx_control is to pull up the MIPI signal operation. Before dsi_disable, MIPI should also be pulled down by writing a register instead of disabling dsi.
If disable dsi without pulling the mipi signal low, the value of the register will still maintain the setting of the mipi signal being pulled high.
After resume, even if the mipi signal is not pulled high, it will still be in the high state.
--- drivers/gpu/drm/mediatek/mtk_dsi.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/mediatek/mtk_dsi.c +2 -0
@@ -652,6 +652,8 @@ static void mtk_dsi_poweroff(struct mtk_dsi *dsi)mtk_dsi_reset_engine (dsi);mtk_dsi_lane0_ulp_mode_enter (dsi);mtk_dsi_clk_ulp_mode_enter (dsi); +/* set the lane number as 0 to pull down mipi */ +writel (0 , dsi->regs +DSI_TXRX_CTRL );mtk_dsi_disable (dsi);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 62/229 i2c: Fix a potential use after free
In reply to Greg Kroah-HartmanFrom: Xu Wang <[email protected]>
[ Upstream commit e4c72c06c367758a14f227c847f9d623f1994ecf ]
Free the adap structure only after we are done using it. This patch just moves the put_device() down a bit to avoid the use after free.
--- drivers/i2c/i2c-core-base.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/i2c/i2c-core-base.c +2 -1
@@ -2243,8 +2243,9 @@ void i2c_put_adapter(struct i2c_adapter *adap)if (!adap)return ; -put_device (&adap->dev);module_put (adap->owner); +/* Should be last, otherwise we risk use-after-free with 'adap' */ +put_device (&adap->dev); }EXPORT_SYMBOL (i2c_put_adapter);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 63/229 ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
In reply to Greg Kroah-HartmanFrom: Pavel Skripkin <[email protected]>
[ Upstream commit 0ac4827f78c7ffe8eef074bc010e7e34bc22f533 ]
Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization.
Probable call trace which can trigger use-after-free:
ath9k_htc_probe_device()
/* htc_handle->drv_priv = priv; */
ath9k_htc_wait_for_target() <--- Failed
ieee80211_free_hw() <--- priv pointer is freed
<IRQ>
...ath9k_hif_usb_rx_cb()
ath9k_hif_usb_rx_stream()
RX_STAT_INC() <--- htc_handle->drv_priv access
In order to not add fancy protection for drv_priv we can move htc_handle->drv_priv initialization at the end of the ath9k_htc_probe_device() and add helper macro to make
all *_STAT_* macros NULL safe, since syzbot has reported related NULL deref in that macros [1]
--- drivers/net/wireless/ath/ath9k/htc.h | 10 +++++----- drivers/net/wireless/ath/ath9k/htc_drv_init.c | 3 ++- 2 files changed, 7 insertions(+), 6 deletions(-)
drivers/net/wireless/ath/ath9k/htc.h +5 -5
@@ -325,11 +325,11 @@ static inline struct ath9k_htc_tx_ctl *HTC_SKB_CB(struct sk_buff *skb) }#ifdef CONFIG_ATH9K_HTC_DEBUGFS - -#define TX_STAT_INC (c) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) -#define TX_STAT_ADD (c, a) (hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) -#define RX_STAT_INC (c) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) -#define RX_STAT_ADD (c, a) (hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a) +#define __STAT_SAFE (expr) (hif_dev->htc_handle->drv_priv ? (expr) : 0) +#define TX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c++) +#define TX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.tx_stats.c += a) +#define RX_STAT_INC (c) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c++) +#define RX_STAT_ADD (c, a) __STAT_SAFE(hif_dev->htc_handle->drv_priv->debug.skbrx_stats.c += a)#define CAB_STAT_INC priv->debug.tx_stats.cab_queued++#define TX_QSTAT_INC (q) (priv->debug.tx_stats.queue_stats[q]++)
drivers/net/wireless/ath/ath9k/htc_drv_init.c +2 -1
@@ -946,7 +946,6 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev, priv->hw = hw; priv->htc = htc_handle; priv->dev = dev; - htc_handle->drv_priv = priv;SET_IEEE80211_DEV (hw, priv->dev); ret =ath9k_htc_wait_for_target (priv);
@@ -967,6 +966,8 @@ int ath9k_htc_probe_device(struct htc_target *htc_handle, struct device *dev,if (ret) goto err_init; + htc_handle->drv_priv = priv; +return 0 ; err_init:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 64/229 wifi: iwlegacy: 4965: fix potential off-by-one overflow in il4965_rs_fill_link_cmd()
In reply to Greg Kroah-HartmanFrom: Alexey Kodanev <[email protected]>
[ Upstream commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 ]
As a result of the execution of the inner while loop, the value of 'idx' can be equal to LINK_QUAL_MAX_RETRY_NUM. However, this is not checked after the loop and 'idx' is used to write the LINK_QUAL_MAX_RETRY_NUM size array 'lq_cmd->rs_table[idx]' below in the outer loop.
The fix is to check the new value of 'idx' inside the nested loop, and break both loops if index equals the size. Checking it at the start is now pointless, so let's remove it.
Detected using the static analysis tool - Svace.
--- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
drivers/net/wireless/intel/iwlegacy/4965-rs.c +4 -1
@@ -2424,7 +2424,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,/* Repeat initial/next rate. * For legacy IL_NUMBER_TRY == 1, this loop will not execute. * For HT IL_HT_NUMBER_TRY == 3, this executes twice. */ -while (repeat_rate >0 && idx <LINK_QUAL_MAX_RETRY_NUM ) { +while (repeat_rate >0 ) {if (is_legacy (tbl_type.lq_type)) {if (ant_toggle_cnt <NUM_TRY_BEFORE_ANT_TOGGLE ) ant_toggle_cnt++;
@@ -2443,6 +2443,8 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta,cpu_to_le32 (new_rate); repeat_rate--; idx++; +if (idx >=LINK_QUAL_MAX_RETRY_NUM ) + goto out; } il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band,
@@ -2487,6 +2489,7 @@ il4965_rs_fill_link_cmd(struct il_priv *il, struct il_lq_sta *lq_sta, repeat_rate--; } +out: lq_cmd->agg_params.agg_frame_cnt_limit =LINK_QUAL_AGG_FRAME_LIMIT_DEF ; lq_cmd->agg_params.agg_dis_start_th =LINK_QUAL_AGG_DISABLE_START_DEF ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 65/229 drm: bridge: adv7511: Add check for mipi_dsi_driver_register
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 831463667b5f4f1e5bce9c3b94e9e794d2bc8923 ]
As mipi_dsi_driver_register could return error if fails, it should be better to check the return value and return error if fails.
Moreover, if i2c_add_driver fails, mipi_dsi_driver_register should be reverted.
--- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-)
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +14 -3
@@ -1213,10 +1213,21 @@ static struct i2c_driver adv7511_driver = {static int __init adv7511_init (void ) { -if (IS_ENABLED (CONFIG_DRM_MIPI_DSI )) -mipi_dsi_driver_register (&adv7533_dsi_driver); +int ret; + +if (IS_ENABLED (CONFIG_DRM_MIPI_DSI )) { + ret =mipi_dsi_driver_register (&adv7533_dsi_driver); +if (ret) +return ret; + } -return i2c_add_driver (&adv7511_driver); + ret =i2c_add_driver (&adv7511_driver); +if (ret) { +if (IS_ENABLED (CONFIG_DRM_MIPI_DSI )) +mipi_dsi_driver_unregister (&adv7533_dsi_driver); + } + +return ret; }module_init (adv7511_init);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 66/229 media: hdpvr: fix error value returns in hdpvr_read
In reply to Greg Kroah-HartmanFrom: Niels Dossche <[email protected]>
[ Upstream commit 359c27c6ddbde404f44a9c0d3ec88ccd1e2042f2 ]
Error return values are supposed to be negative in hdpvr_read. Most error returns are currently handled via an unsigned integer "ret". When setting a negative error value to "ret", the value actually becomes a large positive value, because "ret" is unsigned. Later on, the "ret" value is returned. But as ssize_t is a 64-bit signed number, the error return value stays a large positive integer instead of a negative integer. This can cause an error value to be interpreted as the read size, which can cause a buffer overread for applications relying on the returned size.
--- drivers/media/usb/hdpvr/hdpvr-video.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/media/usb/hdpvr/hdpvr-video.c +1 -1
@@ -413,7 +413,7 @@ static ssize_t hdpvr_read(struct file *file, char __user *buffer, size_t count,struct hdpvr_device *dev =video_drvdata (file);struct hdpvr_buffer *buf =NULL ;struct urb *urb; -unsigned int ret =0 ; +int ret =0 ;int rem, cnt;if (*pos)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 67/229 drm/vc4: dsi: Correct DSI divider calculations
In reply to Greg Kroah-HartmanFrom: Dave Stevenson <[email protected]>
[ Upstream commit 3b45eee87da171caa28f61240ddb5c21170cda53 ]
The divider calculations tried to find the divider just faster than the clock requested. However if it required a divider of 7 then the for loop aborted without handling the "error" case, and could end up with a clock lower than requested.
The integer divider from parent PLL to DSI clock is also capable of going up to /255, not just /7 that the driver was trying. This allows for slower link frequencies on the DSI bus where the resolution permits.
Correct the loop so that we always have a clock greater than requested, and covering the whole range of dividers.
--- drivers/gpu/drm/vc4/vc4_dsi.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)
drivers/gpu/drm/vc4/vc4_dsi.c +2 -4
@@ -846,11 +846,9 @@ static bool vc4_dsi_encoder_mode_fixup(struct drm_encoder *encoder,/* Find what divider gets us a faster clock than the requested * pixel clock. */ -for (divider =1 ; divider <8 ; divider++) { -if (parent_rate / divider < pll_clock) { - divider--; +for (divider =1 ; divider <255 ; divider++) { +if (parent_rate / (divider +1 ) < pll_clock)break ; - } }/* Now that we've picked a PLL divider, calculate back to its
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 68/229 drm/rockchip: vop: Dont crash for invalid duplicate_state()
In reply to Greg Kroah-HartmanFrom: Brian Norris <[email protected]>
[ Upstream commit 1449110b0dade8b638d2c17ab7c5b0ff696bfccb ]
It's possible for users to try to duplicate the CRTC state even when the state doesn't exist. drm_atomic_helper_crtc_duplicate_state() (and other users of __drm_atomic_helper_crtc_duplicate_state()) already guard this with a WARN_ON() instead of crashing, so let's do that here too.
--- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 3 +++ 1 file changed, 3 insertions(+)
drivers/gpu/drm/rockchip/rockchip_drm_vop.c +3 -0
@@ -1068,6 +1068,9 @@ static struct drm_crtc_state *vop_crtc_duplicate_state(struct drm_crtc *crtc) {struct rockchip_crtc_state *rockchip_state; +if (WARN_ON (!crtc->state)) +return NULL ; + rockchip_state =kzalloc (sizeof (*rockchip_state),GFP_KERNEL );if (!rockchip_state)return NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 69/229 drm/mediatek: dpi: Remove output format of YUV
In reply to Greg Kroah-HartmanFrom: Bo-Chen Chen <[email protected]>
[ Upstream commit c9ed0713b3c35fc45677707ba47f432cad95da56 ]
DPI is not support output format as YUV, but there is the setting of configuring output YUV. Therefore, remove them in this patch.
--- drivers/gpu/drm/mediatek/mtk_dpi.c | 31 ++++++------------------------ 1 file changed, 6 insertions(+), 25 deletions(-)
drivers/gpu/drm/mediatek/mtk_dpi.c +6 -25
@@ -51,13 +51,7 @@ enum mtk_dpi_out_channel_swap { };enum mtk_dpi_out_color_format { -MTK_DPI_COLOR_FORMAT_RGB , -MTK_DPI_COLOR_FORMAT_RGB_FULL , -MTK_DPI_COLOR_FORMAT_YCBCR_444 , -MTK_DPI_COLOR_FORMAT_YCBCR_422 , -MTK_DPI_COLOR_FORMAT_XV_YCC , -MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL , -MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL +MTK_DPI_COLOR_FORMAT_RGB };struct mtk_dpi {
@@ -346,24 +340,11 @@ static void mtk_dpi_config_2n_h_fre(struct mtk_dpi *dpi)static void mtk_dpi_config_color_format (struct mtk_dpi *dpi,enum mtk_dpi_out_color_format format) { -if ((format ==MTK_DPI_COLOR_FORMAT_YCBCR_444 ) || - (format ==MTK_DPI_COLOR_FORMAT_YCBCR_444_FULL )) { -mtk_dpi_config_yuv422_enable (dpi, false); -mtk_dpi_config_csc_enable (dpi, true); -mtk_dpi_config_swap_input (dpi, false); -mtk_dpi_config_channel_swap (dpi,MTK_DPI_OUT_CHANNEL_SWAP_BGR ); - }else if ((format ==MTK_DPI_COLOR_FORMAT_YCBCR_422 ) || - (format ==MTK_DPI_COLOR_FORMAT_YCBCR_422_FULL )) { -mtk_dpi_config_yuv422_enable (dpi, true); -mtk_dpi_config_csc_enable (dpi, true); -mtk_dpi_config_swap_input (dpi, true); -mtk_dpi_config_channel_swap (dpi,MTK_DPI_OUT_CHANNEL_SWAP_RGB ); - }else { -mtk_dpi_config_yuv422_enable (dpi, false); -mtk_dpi_config_csc_enable (dpi, false); -mtk_dpi_config_swap_input (dpi, false); -mtk_dpi_config_channel_swap (dpi,MTK_DPI_OUT_CHANNEL_SWAP_RGB ); - } +/* only support RGB888 */ +mtk_dpi_config_yuv422_enable (dpi, false); +mtk_dpi_config_csc_enable (dpi, false); +mtk_dpi_config_swap_input (dpi, false); +mtk_dpi_config_channel_swap (dpi,MTK_DPI_OUT_CHANNEL_SWAP_RGB ); }static void mtk_dpi_power_off (struct mtk_dpi *dpi,enum mtk_dpi_power_ctl pctl)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 70/229 drm: bridge: sii8620: fix possible off-by-one
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 21779cc21c732c5eff8ea1624be6590450baa30f ]
The next call to sii8620_burst_get_tx_buf will result in off-by-one When ctx->burst.tx_count + size == ARRAY_SIZE(ctx->burst.tx_buf). The same thing happens in sii8620_burst_get_rx_buf.
This patch also change tx_count and tx_buf to rx_count and rx_buf in sii8620_burst_get_rx_buf. It is unreasonable to check tx_buf's size and use rx_buf.
--- drivers/gpu/drm/bridge/sil-sii8620.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/gpu/drm/bridge/sil-sii8620.c +2 -2
@@ -628,7 +628,7 @@ static void *sii8620_burst_get_tx_buf(struct sii8620 *ctx, int len)u8 *buf = &ctx->burst.tx_buf[ctx->burst.tx_count];int size = len +2 ; -if (ctx->burst.tx_count + size >ARRAY_SIZE (ctx->burst.tx_buf)) { +if (ctx->burst.tx_count + size >=ARRAY_SIZE (ctx->burst.tx_buf)) {dev_err (ctx->dev,"TX-BLK buffer exhausted\n" ); ctx->error = -EINVAL ;return NULL ;
@@ -645,7 +645,7 @@ static u8 *sii8620_burst_get_rx_buf(struct sii8620 *ctx, int len)u8 *buf = &ctx->burst.rx_buf[ctx->burst.rx_count];int size = len +1 ; -if (ctx->burst.tx_count + size >ARRAY_SIZE (ctx->burst.tx_buf)) { +if (ctx->burst.rx_count + size >=ARRAY_SIZE (ctx->burst.rx_buf)) {dev_err (ctx->dev,"RX-BLK buffer exhausted\n" ); ctx->error = -EINVAL ;return NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 71/229 media: platform: mtk-mdp: Fix mdp_ipi_comm structure alignment
In reply to Greg Kroah-HartmanFrom: AngeloGioacchino Del Regno <[email protected]>
[ Upstream commit ab14c99c035da7156a3b66fa171171295bc4b89a ]
The mdp_ipi_comm structure defines a command that is either PROCESS (start processing) or DEINIT (destroy instance); we are using this one to send PROCESS or DEINIT commands from Linux to an MDP instance through a VPU write but, while the first wants us to stay 4-bytes aligned, the VPU instead requires an 8-bytes data alignment.
Keeping in mind that these commands are executed immediately after sending them (hence not chained with others before the VPU/MDP "actually" start executing), it is fine to simply add a padding of 4 bytes to this structure: this keeps the same performance as before, as we're still stack-allocating it, while avoiding hackery inside of mtk-vpu to ensure alignment bringing a definitely bigger performance impact.
--- drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h | 2 ++ 1 file changed, 2 insertions(+)
drivers/media/platform/mtk-mdp/mtk_mdp_ipi.h +2 -0
@@ -48,12 +48,14 @@ struct mdp_ipi_init {* @ipi_id : IPI_MDP * @ap_inst : AP mtk_mdp_vpu address * @vpu_inst_addr : VPU MDP instance address +* @padding : Alignment padding */ struct mdp_ipi_comm {uint32_t msg_id;uint32_t ipi_id;uint64_t ap_inst;uint32_t vpu_inst_addr; +uint32_t padding; };/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 72/229 tcp: make retransmitted SKB fit into the send window
In reply to Greg Kroah-HartmanFrom: Yonglong Li <[email protected]>
[ Upstream commit 536a6c8e05f95e3d1118c40ae8b3022ee2d05d52 ]
current code of __tcp_retransmit_skb only check TCP_SKB_CB(skb)->seq in send window, and TCP_SKB_CB(skb)->seq_end maybe out of send window. If receiver has shrunk his window, and skb is out of new window, it should retransmit a smaller portion of the payload.
test packetdrill script:
0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+0 fcntl(3, F_GETFL) = 0x2 (flags O_RDWR)
+0 fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0
+0 connect(3, ..., ...) = -1 EINPROGRESS (Operation now in progress) +0 > S 0:0(0) win 65535 <mss 1460,sackOK,TS val 100 ecr 0,nop,wscale 8>
+.05 < S. 0:0(0) ack 1 win 6000 <mss 1000,nop,nop,sackOK>
+0 > . 1:1(0) ack 1
+0 write(3, ..., 10000) = 10000
+0 > . 1:2001(2000) ack 1 win 65535
+0 > . 2001:4001(2000) ack 1 win 65535
+0 > . 4001:6001(2000) ack 1 win 65535
+.05 < . 1:1(0) ack 4001 win 1001
and tcpdump show:
192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 1:2001, ack 1, win 65535, length 2000 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 2001:4001, ack 1, win 65535, length 2000 192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 65535, length 1000 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65535, length 1000 192.0.2.1.8080 > 192.168.226.67.55: Flags [.], ack 4001, win 1001, length 0 192.168.226.67.55 > 192.0.2.1.8080: Flags [.], seq 5001:6001, ack 1, win 65535, length 1000 192.168.226.67.55 > 192.0.2.1.8080: Flags [P.], seq 4001:5001, ack 1, win 65535, length 1000
when cient retract window to 1001, send window is [4001,5002], but TLP send 5001-6001 packet which is out of send window.
--- net/ipv4/tcp_output.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-)
net/ipv4/tcp_output.c +16 -7
@@ -2861,7 +2861,7 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)struct tcp_sock *tp =tcp_sk (sk);unsigned int cur_mss;int diff, len, err; - +int avail_wnd;/* Inconclusive MTU probe */ if (icsk->icsk_mtup.probe_size)
@@ -2891,17 +2891,25 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs)return -EHOSTUNREACH ;/* Routing failure or similar. */ cur_mss =tcp_current_mss (sk); + avail_wnd =tcp_wnd_end (tp) -TCP_SKB_CB (skb)->seq;/* If receiver has shrunk his window, and skb is out of * new window, do not retransmit it. The exception is the * case, when window is shrunk to zero. In this case -* our retransmit serves as a zero window probe. +* our retransmit of one segment serves as a zero window probe. */ -if (!before (TCP_SKB_CB (skb)->seq,tcp_wnd_end (tp)) && -TCP_SKB_CB (skb)->seq != tp->snd_una) -return -EAGAIN ; +if (avail_wnd <=0 ) { +if (TCP_SKB_CB (skb)->seq != tp->snd_una) +return -EAGAIN ; + avail_wnd = cur_mss; + } len = cur_mss * segs; +if (len > avail_wnd) { + len =rounddown (avail_wnd, cur_mss); +if (!len) + len = avail_wnd; + }if (skb->len > len) {if (tcp_fragment (sk, skb, len, cur_mss,GFP_ATOMIC ))return -ENOMEM ;/* We'll try again later. */
@@ -2914,8 +2922,9 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) diff -=tcp_skb_pcount (skb);if (diff)tcp_adjust_pcount (sk, skb, diff); -if (skb->len < cur_mss) -tcp_retrans_try_collapse (sk, skb, cur_mss); + avail_wnd =min_t (int, avail_wnd, cur_mss); +if (skb->len < avail_wnd) +tcp_retrans_try_collapse (sk, skb, avail_wnd); }/* RFC3168, section 6.1.1.1. ECN fallback */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 73/229 selftests: timers: valid-adjtimex: build fix for newer toolchains
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 9a162977d20436be5678a8e21a8e58eb4616d86a ]
Toolchains with an include file 'sys/timex.h' based on 3.18 will have a 'clock_adjtime' definition added, so it can't be static in the code:
valid-adjtimex.c:43:12: error: static declaration of ‘clock_adjtime’ follows non-static declaration
--- tools/testing/selftests/timers/valid-adjtimex.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
tools/testing/selftests/timers/valid-adjtimex.c +1 -1
@@ -40,7 +40,7 @@#define ADJ_SETOFFSET 0x0100#include <sys/syscall.h> -static int clock_adjtime (clockid_t id,struct timex *tx) +int clock_adjtime (clockid_t id,struct timex *tx) {return syscall (__NR_clock_adjtime, id, tx); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 74/229 selftests: timers: clocksource-switch: fix passing errors from child
In reply to Greg Kroah-HartmanFrom: Wolfram Sang <[email protected]>
[ Upstream commit 4d8f52ac5fa9eede7b7aa2f2d67c841d9eeb655f ]
The return value from system() is a waitpid-style integer. Do not return it directly because with the implicit masking in exit() it will always return 0. Access it with appropriate macros to really pass on errors.
--- tools/testing/selftests/timers/clocksource-switch.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
tools/testing/selftests/timers/clocksource-switch.c +3 -3
@@ -110,10 +110,10 @@ int run_tests(int secs)sprintf (buf,"./inconsistency-check -t %i" , secs); ret =system (buf); -if (ret) -return ret; +if (WIFEXITED (ret) &&WEXITSTATUS (ret)) +return WEXITSTATUS (ret); ret =system ("./nanosleep" ); -return ret; +return WIFEXITED (ret) ?WEXITSTATUS (ret) :0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 75/229 fs: check FMODE_LSEEK to control internal pipe splicing
In reply to Greg Kroah-HartmanFrom: Jason A. Donenfeld <[email protected]>
[ Upstream commit 97ef77c52b789ec1411d360ed99dca1efe4b2c81 ]
The original direct splicing mechanism from Jens required the input to be a regular file because it was avoiding the special socket case. It also recognized blkdevs as being close enough to a regular file. But it forgot about chardevs, which behave the same way and work fine here.
This is an okayish heuristic, but it doesn't totally work. For example, a few chardevs should be spliceable here. And a few regular files shouldn't. This patch fixes this by instead checking whether FMODE_LSEEK is set, which represents decently enough what we need rewinding for when splicing to internal pipes.
--- fs/splice.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)
fs/splice.c +4 -6
@@ -898,17 +898,15 @@ ssize_t splice_direct_to_actor(struct file *in, struct splice_desc *sd, {struct pipe_inode_info *pipe;long ret, bytes; -umode_t i_mode;size_t len;int i, flags, more;/* -* We require the input being a regular file, as we don't want to -* randomly drop data for eg socket -> socket splicing. Use the -* piped splicing for that! +* We require the input to be seekable, as we don't want to randomly +* drop data for eg socket -> socket splicing. Use the piped splicing +* for that! */ - i_mode =file_inode (in)->i_mode; -if (unlikely (!S_ISREG (i_mode) && !S_ISBLK (i_mode))) +if (unlikely (!(in->f_mode &FMODE_LSEEK )))return -EINVAL ;/*
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 76/229 wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi()
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 7a4836560a6198d245d5732e26f94898b12eb760 ]
The simple_write_to_buffer() function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use memdup_user().
--- drivers/net/wireless/ath/wil6210/debugfs.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-)
drivers/net/wireless/ath/wil6210/debugfs.c +4 -10
@@ -836,18 +836,12 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,u16 cmdid;int rc, rc1; -if (cmdlen <0 ) +if (cmdlen <0 || *ppos !=0 )return -EINVAL ; - wmi =kmalloc (len,GFP_KERNEL ); -if (!wmi) -return -ENOMEM ; - - rc =simple_write_to_buffer (wmi, len, ppos, buf, len); -if (rc <0 ) { -kfree (wmi); -return rc; - } + wmi =memdup_user (buf, len); +if (IS_ERR (wmi)) +return PTR_ERR (wmi); cmd = (cmdlen >0 ) ? &wmi[1 ] :NULL ; cmdid =le16_to_cpu (wmi->command_id);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 77/229 wifi: p54: Fix an error handling path in p54spi_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 83781f0162d080fec7dcb911afd1bc2f5ad04471 ]
If an error occurs after a successful call to p54spi_request_firmware(), it must be undone by a corresponding release_firmware() as already done in the error handling path of p54spi_request_firmware() and in the .remove() function.
Add the missing call in the error handling path and remove it from p54spi_request_firmware() now that it is the responsibility of the caller to release the firmware
--- drivers/net/wireless/intersil/p54/p54spi.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/net/wireless/intersil/p54/p54spi.c +2 -1
@@ -177,7 +177,7 @@ static int p54spi_request_firmware(struct ieee80211_hw *dev) ret =p54_parse_firmware (dev, priv->firmware);if (ret) { -release_firmware (priv->firmware); +/* the firmware is released by the caller */ return ret; }
@@ -672,6 +672,7 @@ static int p54spi_probe(struct spi_device *spi)return 0 ; err_free_common: +release_firmware (priv->firmware);free_irq (gpio_to_irq (p54spi_gpio_irq), spi); err_free_gpio_irq:gpio_free (p54spi_gpio_irq);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 78/229 wifi: p54: add missing parentheses in p54_flush()
In reply to Greg Kroah-HartmanFrom: Rustam Subkhankulov <[email protected]>
[ Upstream commit bcfd9d7f6840b06d5988c7141127795cf405805e ]
The assignment of the value to the variable total in the loop condition must be enclosed in additional parentheses, since otherwise, in accordance with the precedence of the operators, the conjunction will be performed first, and only then the assignment.
Due to this error, a warning later in the function after the loop may not occur in the situation when it should.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/net/wireless/intersil/p54/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/wireless/intersil/p54/main.c +1 -1
@@ -688,7 +688,7 @@ static void p54_flush(struct ieee80211_hw *dev, struct ieee80211_vif *vif,* queues have already been stopped and no new frames can sneak * up from behind. */ -while ((total =p54_flush_count (priv) && i--)) { +while ((total =p54_flush_count (priv)) && i--) {/* waste time */ msleep (20 ); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 79/229 can: pch_can: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 3a5c7e4611ddcf0ef37a3a17296b964d986161a6 ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/pch_can.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
drivers/net/can/pch_can.c +3 -3
@@ -507,6 +507,9 @@ static void pch_can_error(struct net_device *ndev, u32 status) cf->can_id |=CAN_ERR_BUSOFF ; priv->can.can_stats.bus_off++;can_bus_off (ndev); + }else { + cf->data[6 ] = errc &PCH_TEC ; + cf->data[7 ] = (errc &PCH_REC ) >>8 ; } errc =ioread32 (&priv->regs->errc);
@@ -567,9 +570,6 @@ static void pch_can_error(struct net_device *ndev, u32 status)break ; } - cf->data[6 ] = errc &PCH_TEC ; - cf->data[7 ] = (errc &PCH_REC ) >>8 ; - priv->can.state = state;netif_receive_skb (skb);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 80/229 can: rcar_can: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit a37b7245e831a641df360ca41db6a71c023d3746 ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/rcar/rcar_can.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-)
drivers/net/can/rcar/rcar_can.c +4 -4
@@ -233,11 +233,8 @@ static void rcar_can_error(struct net_device *ndev)if (eifr & (RCAR_CAN_EIFR_EWIF |RCAR_CAN_EIFR_EPIF )) { txerr =readb (&priv->regs->tecr); rxerr =readb (&priv->regs->recr); -if (skb) { +if (skb) cf->can_id |=CAN_ERR_CRTL ; - cf->data[6 ] = txerr; - cf->data[7 ] = rxerr; - } }if (eifr &RCAR_CAN_EIFR_BEIF ) {int rx_errors =0 , tx_errors =0 ;
@@ -337,6 +334,9 @@ static void rcar_can_error(struct net_device *ndev)can_bus_off (ndev);if (skb) cf->can_id |=CAN_ERR_BUSOFF ; + }else if (skb) { + cf->data[6 ] = txerr; + cf->data[7 ] = rxerr; }if (eifr &RCAR_CAN_EIFR_ORIF ) {netdev_dbg (priv->ndev,"Receive overrun error interrupt\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 81/229 can: sja1000: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 164d7cb2d5a30f1b3a5ab4fab1a27731fb1494a8 ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/sja1000/sja1000.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/can/sja1000/sja1000.c +4 -3
@@ -405,9 +405,6 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status) txerr = priv->read_reg (priv,SJA1000_TXERR ); rxerr = priv->read_reg (priv,SJA1000_RXERR ); - cf->data[6 ] = txerr; - cf->data[7 ] = rxerr; -if (isrc &IRQ_DOI ) {/* data overrun interrupt */ netdev_dbg (dev,"data overrun interrupt\n" );
@@ -429,6 +426,10 @@ static int sja1000_err(struct net_device *dev, uint8_t isrc, uint8_t status)else state =CAN_STATE_ERROR_ACTIVE ; } +if (state !=CAN_STATE_BUS_OFF ) { + cf->data[6 ] = txerr; + cf->data[7 ] = rxerr; + }if (isrc &IRQ_BEI ) {/* bus error interrupt */ priv->can.can_stats.bus_error++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 82/229 can: hi311x: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit a22bd630cfff496b270211745536e50e98eb3a45 ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/spi/hi311x.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/can/spi/hi311x.c +3 -2
@@ -688,8 +688,6 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) txerr =hi3110_read (spi,HI3110_READ_TEC ); rxerr =hi3110_read (spi,HI3110_READ_REC ); - cf->data[6 ] = txerr; - cf->data[7 ] = rxerr; tx_state = txerr >= rxerr ? new_state :0 ; rx_state = txerr <= rxerr ? new_state :0 ;can_change_state (net, cf, tx_state, rx_state);
@@ -702,6 +700,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id)hi3110_hw_sleep (spi);break ; } + }else { + cf->data[6 ] = txerr; + cf->data[7 ] = rxerr; } }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 83/229 can: sun4i_can: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 0ac15a8f661b941519379831d09bfb12271b23ee ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/sun4i_can.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-)
drivers/net/can/sun4i_can.c +4 -5
@@ -525,11 +525,6 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) rxerr = (errc >>16 ) &0xFF ; txerr = errc &0xFF ; -if (skb) { - cf->data[6 ] = txerr; - cf->data[7 ] = rxerr; - } -if (isrc &SUN4I_INT_DATA_OR ) {/* data overrun interrupt */ netdev_dbg (dev,"data overrun interrupt\n" );
@@ -560,6 +555,10 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status)else state =CAN_STATE_ERROR_ACTIVE ; } +if (skb && state !=CAN_STATE_BUS_OFF ) { + cf->data[6 ] = txerr; + cf->data[7 ] = rxerr; + }if (isrc &SUN4I_INT_BUS_ERR ) {/* bus error interrupt */ netdev_dbg (dev,"bus error interrupt\n" );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 84/229 can: usb_8dev: do not report txerr and rxerr during bus-off
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit aebe8a2433cd090ccdc222861f44bddb75eb01de ]
During bus off, the error count is greater than 255 and can not fit in a u8.
--- drivers/net/can/usb/usb_8dev.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
drivers/net/can/usb/usb_8dev.c +4 -3
@@ -453,9 +453,10 @@ static void usb_8dev_rx_err_msg(struct usb_8dev_priv *priv,if (rx_errors) stats->rx_errors++; - - cf->data[6 ] = txerr; - cf->data[7 ] = rxerr; +if (priv->can.state !=CAN_STATE_BUS_OFF ) { + cf->data[6 ] = txerr; + cf->data[7 ] = rxerr; + } priv->bec.txerr = txerr; priv->bec.rxerr = rxerr;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 85/229 can: error: specify the values of data[5..7] of CAN error frames
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit e70a3263a7eed768d5f947b8f2aff8d2a79c9d97 ]
Currently, data[5..7] of struct can_frame, when used as a CAN error frame, are defined as being "controller specific". Device specific behaviours are problematic because it prevents someone from writing code which is portable between devices.
As a matter of fact, data[5] is never used, data[6] is always used to report TX error counter and data[7] is always used to report RX error counter. can-utils also relies on this.
This patch updates the comment in the uapi header to specify that data[5] is reserved (and thus should not be used) and that data[6..7] are used for error counters.
--- include/uapi/linux/can/error.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
include/uapi/linux/can/error.h +4 -1
@@ -120,6 +120,9 @@#define CAN_ERR_TRX_CANL_SHORT_TO_GND 0x70/* 0111 0000 */ #define CAN_ERR_TRX_CANL_SHORT_TO_CANH 0x80/* 1000 0000 */ -/* controller specific additional information / data[5..7] */ +/* data[5] is reserved (do not use) */ + +/* TX error counter / data[6] */ +/* RX error counter / data[7] */ #endif /* _UAPI_CAN_ERROR_H */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 86/229 can: pch_can: pch_can_error(): initialize errc before using it
In reply to Greg Kroah-HartmanFrom: Vincent Mailhol <[email protected]>
[ Upstream commit 9950f11211331180269867aef848c7cf56861742 ]
After commit 3a5c7e4611dd, the variable errc is accessed before being initialized, c.f. below W=2 warning:
| In function 'pch_can_error', | inlined from 'pch_can_poll' at drivers/net/can/pch_can.c:739:4: | drivers/net/can/pch_can.c:501:29: warning: 'errc' may be used uninitialized [-Wmaybe-uninitialized] | 501 | cf->data[6] = errc & PCH_TEC; | | ^ | drivers/net/can/pch_can.c: In function 'pch_can_poll': | drivers/net/can/pch_can.c:484:13: note: 'errc' was declared here | 484 | u32 errc, lec; | | ^~~~
Moving errc initialization up solves this issue.
--- drivers/net/can/pch_can.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/pch_can.c +1 -1
@@ -500,6 +500,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)if (!skb)return ; + errc =ioread32 (&priv->regs->errc);if (status &PCH_BUS_OFF ) {pch_can_set_tx_all (priv,0 );pch_can_set_rx_all (priv,0 );
@@ -512,7 +513,6 @@ static void pch_can_error(struct net_device *ndev, u32 status) cf->data[7 ] = (errc &PCH_REC ) >>8 ; } - errc =ioread32 (&priv->regs->errc);/* Warning interrupt. */ if (status &PCH_EWARN ) { state =CAN_STATE_ERROR_WARNING ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 87/229 Bluetooth: hci_intel: Add check for platform_driver_register
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit ab2d2a982ff721f4b029282d9a40602ea46a745e ]
As platform_driver_register() could fail, it should be better to deal with the return value in order to maintain the code consisitency.
--- drivers/bluetooth/hci_intel.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/bluetooth/hci_intel.c +5 -1
@@ -1303,7 +1303,11 @@ static struct platform_driver intel_driver = {int __init intel_init (void ) { -platform_driver_register (&intel_driver); +int err; + + err =platform_driver_register (&intel_driver); +if (err) +return err;return hci_uart_register_proto (&intel_proto); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 88/229 i2c: cadence: Support PEC for SMBus block read
In reply to Greg Kroah-HartmanFrom: Lars-Peter Clausen <[email protected]>
[ Upstream commit 9fdf6d97f03035ad5298e2d1635036c74c2090ed ]
SMBus packet error checking (PEC) is implemented by appending one additional byte of checksum data at the end of the message. This provides additional protection and allows to detect data corruption on the I2C bus.
SMBus block reads support variable length reads. The first byte in the read message is the number of available data bytes.
The combination of PEC and block read is currently not supported by the Cadence I2C driver.
* When PEC is enabled the maximum transfer length for block reads increases from 33 to 34 bytes.
* The I2C core smbus emulation layer relies on the driver updating the i2c_msg len field with the number of received bytes. The updated length is used when checking the PEC.
Add support to the Cadence I2C driver for handling SMBus block reads with PEC. To determine the maximum transfer length uses the initial len value of the i2c_msg. When PEC is enabled this will be 2, when it is disabled it will be 1.
Once a read transfer is done also increment the len field by the amount of received data bytes.
This change has been tested with a UCM90320 PMBus power monitor, which requires block reads to access certain data fields, but also has PEC enabled by default.
--- drivers/i2c/busses/i2c-cadence.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
drivers/i2c/busses/i2c-cadence.c +9 -1
@@ -353,8 +353,13 @@ static void cdns_i2c_mrecv(struct cdns_i2c *id) ctrl_reg =cdns_i2c_readreg (CDNS_I2C_CR_OFFSET ); ctrl_reg |=CDNS_I2C_CR_RW |CDNS_I2C_CR_CLR_FIFO ; +/* +* Receive up to I2C_SMBUS_BLOCK_MAX data bytes, plus one message length +* byte, plus one checksum byte if PEC is enabled. p_msg->len will be 2 if +* PEC is enabled, otherwise 1. +*/ if (id->p_msg->flags &I2C_M_RECV_LEN ) - id->recv_count =I2C_SMBUS_BLOCK_MAX +1 ; + id->recv_count =I2C_SMBUS_BLOCK_MAX + id->p_msg->len; id->curr_recv_count = id->recv_count;
@@ -540,6 +545,9 @@ static int cdns_i2c_process_msg(struct cdns_i2c *id, struct i2c_msg *msg,if (id->err_status &CDNS_I2C_IXR_ARB_LOST )return -EAGAIN ; +if (msg->flags &I2C_M_RECV_LEN ) + msg->len += min_t(unsigned int, msg->buf[0], I2C_SMBUS_BLOCK_MAX); +return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 89/229 i2c: mux-gpmux: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 6435319c34704994e19b0767f6a4e6f37439867b ]
In i2c_mux_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount.
--- drivers/i2c/muxes/i2c-mux-gpmux.c | 1 + 1 file changed, 1 insertion(+)
drivers/i2c/muxes/i2c-mux-gpmux.c +1 -0
@@ -141,6 +141,7 @@ static int i2c_mux_probe(struct platform_device *pdev)return 0 ; err_children: +of_node_put (child);i2c_mux_del_adapters (muxc); err_parent:i2c_put_adapter (parent);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 90/229 wifi: wil6210: debugfs: fix uninitialized variable use in `wil_write_file_wmi()`
In reply to Greg Kroah-HartmanFrom: Ammar Faizi <[email protected]>
[ Upstream commit d578e0af3a003736f6c440188b156483d451b329 ]
Commit 7a4836560a61 changes simple_write_to_buffer() with memdup_user() but it forgets to change the value to be returned that came from simple_write_to_buffer() call. It results in the following warning:
warning: variable 'rc' is uninitialized when used here [-Wuninitialized]
return rc;
^~Remove rc variable and just return the passed in length if the memdup_user() succeeds.
--- drivers/net/wireless/ath/wil6210/debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/net/wireless/ath/wil6210/debugfs.c +2 -2
@@ -834,7 +834,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,void *cmd;int cmdlen = len -sizeof (struct wmi_cmd_hdr );u16 cmdid; -int rc, rc1; +int rc1;if (cmdlen <0 || *ppos !=0 )return -EINVAL ;
@@ -851,7 +851,7 @@ static ssize_t wil_write_file_wmi(struct file *file, const char __user *buf,wil_info (wil,"0x%04x[%d] -> %d\n" , cmdid, cmdlen, rc1); -return rc; +return len; }static const struct file_operations fops_wmi = {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 91/229 wifi: libertas: Fix possible refcount leak in if_usb_probe()
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit 6fd57e1d120bf13d4dc6c200a7cf914e6347a316 ]
usb_get_dev will be called before lbs_get_firmware_async which means that usb_put_dev need to be called when lbs_get_firmware_async fails.
--- drivers/net/wireless/marvell/libertas/if_usb.c | 1 + 1 file changed, 1 insertion(+)
drivers/net/wireless/marvell/libertas/if_usb.c +1 -0
@@ -283,6 +283,7 @@ static int if_usb_probe(struct usb_interface *intf,return 0 ; err_get_fw: +usb_put_dev (udev);lbs_remove_card (priv); err_add_card:if_usb_reset_device (cardp);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 92/229 net: rose: fix netdev reference changes
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
[ Upstream commit 931027820e4dafabc78aff82af59f8c1c4bd3128 ]
Bernard reported that trying to unload rose module would lead to infamous messages:
unregistered_netdevice: waiting for rose0 to become free. Usage count = xx
This patch solves the issue, by making sure each socket referring to a netdevice holds a reference count on it, and properly releases it in rose_release().
rose_dev_first() is also fixed to take a device reference before leaving the rcu_read_locked section.
Following patch will add ref_tracker annotations to ease future bug hunting.
--- net/rose/af_rose.c | 11 +++++++++-- net/rose/rose_route.c | 2 ++ 2 files changed, 11 insertions(+), 2 deletions(-)
net/rose/af_rose.c +9 -2
@@ -194,6 +194,7 @@ static void rose_kill_by_device(struct net_device *dev)rose_disconnect (s,ENETUNREACH ,ROSE_OUT_OF_ORDER ,0 );if (rose->neighbour) rose->neighbour->use--; +dev_put (rose->device); rose->device =NULL ; } }
@@ -594,6 +595,8 @@ static struct sock *rose_make_new(struct sock *osk) rose->idle = orose->idle; rose->defer = orose->defer; rose->device = orose->device; +if (rose->device) +dev_hold (rose->device); rose->qbitincl = orose->qbitincl;return sk;
@@ -647,6 +650,7 @@ static int rose_release(struct socket *sock)break ; } +dev_put (rose->device); sock->sk =NULL ;release_sock (sk);sock_put (sk);
@@ -721,7 +725,6 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_lestruct rose_sock *rose =rose_sk (sk);struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;unsigned char cause, diagnostic; -struct net_device *dev;ax25_uid_assoc *user;int n, err =0 ;
@@ -778,9 +781,12 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le }if (sock_flag (sk,SOCK_ZAPPED )) {/* Must bind first - autobinding in this may or may not work */ +struct net_device *dev; +sock_reset_flag (sk,SOCK_ZAPPED ); -if ((dev =rose_dev_first ()) ==NULL ) { + dev =rose_dev_first (); +if (!dev) { err = -ENETUNREACH ; goto out_release; }
@@ -788,6 +794,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le user =ax25_findbyuid (current_euid ());if (!user) { err = -EINVAL ; +dev_put (dev); goto out_release; }
net/rose/rose_route.c +2 -0
@@ -614,6 +614,8 @@ struct net_device *rose_dev_first(void)if (first ==NULL ||strncmp (dev->name, first->name,3 ) <0 ) first = dev; } +if (first) +dev_hold (first);rcu_read_unlock ();return first;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 93/229 dccp: put dccp_qpolicy_full() and dccp_qpolicy_push() in the same lock
In reply to Greg Kroah-HartmanFrom: Hangyu Hua <[email protected]>
[ Upstream commit a41b17ff9dacd22f5f118ee53d82da0f3e52d5e3 ]
In the case of sk->dccps_qpolicy == DCCPQ_POLICY_PRIO, dccp_qpolicy_full will drop a skb when qpolicy is full. And the lock in dccp_sendmsg is released before sock_alloc_send_skb and then relocked after sock_alloc_send_skb. The following conditions may lead dccp_qpolicy_push to add skb to an already full sk_write_queue:
thread1--->lock
thread1--->dccp_qpolicy_full: queue is full. drop a skb thread1--->unlock
thread2--->lock
thread2--->dccp_qpolicy_full: queue is not full. no need to drop. thread2--->unlock
thread1--->lock
thread1--->dccp_qpolicy_push: add a skb. queue is full. thread1--->unlock
thread2--->lock
thread2--->dccp_qpolicy_push: add a skb! thread2--->unlock
Fix this by moving dccp_qpolicy_full.
--- net/dccp/proto.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
net/dccp/proto.c +5 -5
@@ -764,11 +764,6 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)lock_sock (sk); -if (dccp_qpolicy_full (sk)) { - rc = -EAGAIN ; - goto out_release; - } - timeo =sock_sndtimeo (sk, noblock);/*
@@ -787,6 +782,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)if (skb ==NULL ) goto out_release; +if (dccp_qpolicy_full (sk)) { + rc = -EAGAIN ; + goto out_discard; + } +if (sk->sk_state ==DCCP_CLOSED ) { rc = -ENOTCONN ; goto out_discard;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 94/229 mtd: maps: Fix refcount leak in of_flash_probe_versatile
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 33ec82a6d2b119938f26e5c8040ed5d92378eb54 ]
of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/maps/physmap_of_versatile.c +1 -0
@@ -221,6 +221,7 @@ int of_flash_probe_versatile(struct platform_device *pdev, versatile_flashprot = (enum versatile_flashprot )devid->data; rmap =syscon_node_to_regmap (sysnp); +of_node_put (sysnp);if (IS_ERR (rmap))return PTR_ERR (rmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 95/229 mtd: maps: Fix refcount leak in ap_flash_init
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 77087a04c8fd554134bddcb8a9ff87b21f357926 ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/mtd/maps/physmap_of_versatile.c | 1 + 1 file changed, 1 insertion(+)
drivers/mtd/maps/physmap_of_versatile.c +1 -0
@@ -107,6 +107,7 @@ static int ap_flash_init(struct platform_device *pdev)return -ENODEV ; } ebi_base =of_iomap (ebi,0 ); +of_node_put (ebi);if (!ebi_base)return -ENODEV ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 96/229 mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release
In reply to Greg Kroah-HartmanFrom: Duoming Zhou <[email protected]>
[ Upstream commit a61528d997619a518ee8c51cf0ef0513021afaff ]
There is a deadlock between sm_release and sm_cache_flush_work which is a work item. The cancel_work_sync in sm_release will not return until sm_cache_flush_work is finished. If we hold mutex_lock and use cancel_work_sync to wait the work item to finish, the work item also requires mutex_lock. As a result, the sm_release will be blocked forever. The race condition is shown below:
(Thread 1) | (Thread 2)
sm_release |
mutex_lock(&ftl->mutex) | sm_cache_flush_work
| mutex_lock(&ftl->mutex)
cancel_work_sync | ...This patch moves del_timer_sync and cancel_work_sync out of mutex_lock in order to mitigate deadlock.
--- drivers/mtd/sm_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/mtd/sm_ftl.c +1 -1
@@ -1109,9 +1109,9 @@ static void sm_release(struct mtd_blktrans_dev *dev) {struct sm_ftl *ftl = dev->priv; -mutex_lock (&ftl->mutex);del_timer_sync (&ftl->timer);cancel_work_sync (&ftl->flush_work); +mutex_lock (&ftl->mutex);sm_cache_flush (ftl);mutex_unlock (&ftl->mutex); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 97/229 mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()s error path
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 28607b426c3d050714f250d0faeb99d2e9106e90 ]
For all but one error path clk_disable_unprepare() is already there. Add it to the one location where it's missing.
--- drivers/mtd/devices/st_spi_fsm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-)
drivers/mtd/devices/st_spi_fsm.c +5 -3
@@ -2125,10 +2125,12 @@ static int stfsm_probe(struct platform_device *pdev) (long long )fsm->mtd.size, (long long )(fsm->mtd.size >>20 ), fsm->mtd.erasesize, (fsm->mtd.erasesize >> 10)); -return mtd_device_register (&fsm->mtd,NULL ,0 ); - + ret =mtd_device_register (&fsm->mtd,NULL ,0 ); +if (ret) { err_clk_unprepare: -clk_disable_unprepare (fsm->clk); +clk_disable_unprepare (fsm->clk); + } +return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 98/229 fpga: altera-pr-ip: fix unsigned comparison with less than zero
In reply to Greg Kroah-HartmanFrom: Marco Pagani <[email protected]>
[ Upstream commit 2df84a757d87fd62869fc401119d429735377ec5 ]
Fix the "comparison with less than zero" warning reported by cppcheck for the unsigned (size_t) parameter count of the alt_pr_fpga_write() function.
--- drivers/fpga/altera-pr-ip-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/fpga/altera-pr-ip-core.c +1 -1
@@ -119,7 +119,7 @@ static int alt_pr_fpga_write(struct fpga_manager *mgr, const char *buf,u32 *buffer_32 = (u32 *)buf;size_t i =0 ; -if (count <=0 ) +if (!count)return -EINVAL ;/* Write out the complete 32-bit chunks */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 99/229 usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit b5c5b13cb45e2c88181308186b0001992cb41954 ]
of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- drivers/usb/host/ehci-ppc-of.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/ehci-ppc-of.c +1 -0
@@ -147,6 +147,7 @@ static int ehci_hcd_ppc_of_probe(struct platform_device *op) }else { ehci->has_amcc_usb23 =1 ; } +of_node_put (np); }if (of_get_property (dn,"big-endian" ,NULL )) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 100/229 usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 302970b4cad3ebfda2c05ce06c322ccdc447d17e ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak.
--- drivers/usb/host/ohci-nxp.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/host/ohci-nxp.c +1 -0
@@ -155,6 +155,7 @@ static int ohci_hcd_nxp_probe(struct platform_device *pdev) } isp1301_i2c_client =isp1301_get_client (isp1301_node); +of_node_put (isp1301_node);if (!isp1301_i2c_client)return -EPROBE_DEFER ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 101/229 misc: rtsx: Fix an error handling path in rtsx_pci_probe()
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 44fd1917314e9d4f53dd95dd65df1c152f503d3a ]
If an error occurs after a successful idr_alloc() call, the corresponding resource must be released with idr_remove() as already done in the .remove function.
Update the error handling path to add the missing idr_remove() call.
--- drivers/mfd/rtsx_pcr.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/mfd/rtsx_pcr.c +5 -1
@@ -1223,7 +1223,7 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, pcr->remap_addr =ioremap_nocache (base, len);if (!pcr->remap_addr) { ret = -ENOMEM ; - goto free_handle; + goto free_idr; } pcr->rtsx_resv_buf = dma_alloc_coherent(&(pcidev->dev),
@@ -1285,6 +1285,10 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, pcr->rtsx_resv_buf, pcr->rtsx_resv_buf_addr); unmap:iounmap (pcr->remap_addr); +free_idr: +spin_lock (&rtsx_pci_lock); +idr_remove (&rtsx_pci_idr, pcr->id); +spin_unlock (&rtsx_pci_lock); free_handle:kfree (handle); free_pcr:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 102/229 mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit b5899a3e2f783a27b268e38d37f9b24c71bddf45 ]
of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. of_node_put() checks null pointer.
--- drivers/mmc/host/sdhci-of-esdhc.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/sdhci-of-esdhc.c +1 -0
@@ -671,6 +671,7 @@ static int esdhc_signal_voltage_switch(struct mmc_host *mmc, scfg_node =of_find_matching_node (NULL , scfg_device_ids);if (scfg_node) scfg_base =of_iomap (scfg_node,0 ); +of_node_put (scfg_node);if (scfg_base) { sdhciovselcr =SDHCIOVSELCR_TGLEN |SDHCIOVSELCR_VSELVAL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 103/229 memstick/ms_block: Fix some incorrect memory allocation
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 2e531bc3e0d86362fcd8a577b3278d9ef3cc2ba0 ]
Some functions of the bitmap API take advantage of the fact that a bitmap is an array of long.
So, to make sure this assertion is correct, allocate bitmaps with bitmap_zalloc() instead of kzalloc()+hand-computed number of bytes.
While at it, also use bitmap_free() instead of kfree() to keep the semantic.
--- drivers/memstick/core/ms_block.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-)
drivers/memstick/core/ms_block.c +5 -5
@@ -1338,16 +1338,16 @@ static int msb_ftl_initialize(struct msb_data *msb) msb->zone_count = msb->block_count /MS_BLOCKS_IN_ZONE ; msb->logical_block_count = msb->zone_count *496 -2 ; - msb->used_blocks_bitmap =kzalloc (msb->block_count /8 ,GFP_KERNEL ); - msb->erased_blocks_bitmap =kzalloc (msb->block_count /8 ,GFP_KERNEL ); + msb->used_blocks_bitmap =bitmap_zalloc (msb->block_count,GFP_KERNEL ); + msb->erased_blocks_bitmap =bitmap_zalloc (msb->block_count,GFP_KERNEL ); msb->lba_to_pba_table =kmalloc (msb->logical_block_count *sizeof (u16),GFP_KERNEL );if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table || !msb->erased_blocks_bitmap) { -kfree (msb->used_blocks_bitmap); +bitmap_free (msb->used_blocks_bitmap); +bitmap_free (msb->erased_blocks_bitmap);kfree (msb->lba_to_pba_table); -kfree (msb->erased_blocks_bitmap);return -ENOMEM ; }
@@ -1960,7 +1960,7 @@ static int msb_bd_open(struct block_device *bdev, fmode_t mode)static void msb_data_clear (struct msb_data *msb) {kfree (msb->boot_page); -kfree (msb->used_blocks_bitmap); +bitmap_free (msb->used_blocks_bitmap);kfree (msb->lba_to_pba_table);kfree (msb->cache); msb->card =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 104/229 memstick/ms_block: Fix a memory leak
In reply to Greg Kroah-HartmanFrom: Christophe JAILLET <[email protected]>
[ Upstream commit 54eb7a55be6779c4d0c25eaf5056498a28595049 ]
'erased_blocks_bitmap' is never freed. As it is allocated at the same time as 'used_blocks_bitmap', it is likely that it should be freed also at the same time.
Add the corresponding bitmap_free() in msb_data_clear().
--- drivers/memstick/core/ms_block.c | 1 + 1 file changed, 1 insertion(+)
drivers/memstick/core/ms_block.c +1 -0
@@ -1961,6 +1961,7 @@ static void msb_data_clear(struct msb_data *msb) {kfree (msb->boot_page);bitmap_free (msb->used_blocks_bitmap); +bitmap_free (msb->erased_blocks_bitmap);kfree (msb->lba_to_pba_table);kfree (msb->cache); msb->card =NULL ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 105/229 mmc: sdhci-of-at91: fix set_uhs_signaling rewriting of MC1R
In reply to Greg Kroah-HartmanFrom: Eugen Hristev <[email protected]>
[ Upstream commit 5987e6ded29d52e42fc7b06aa575c60a25eee38e ]
In set_uhs_signaling, the DDR bit is being set by fully writing the MC1R register.
This can lead to accidental erase of certain bits in this register. Avoid this by doing a read-modify-write operation.
--- drivers/mmc/host/sdhci-of-at91.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-)
drivers/mmc/host/sdhci-of-at91.c +7 -2
@@ -116,8 +116,13 @@ static void sdhci_at91_set_power(struct sdhci_host *host, unsigned char mode,void sdhci_at91_set_uhs_signaling (struct sdhci_host *host,unsigned int timing) { -if (timing ==MMC_TIMING_MMC_DDR52 ) -sdhci_writeb (host,SDMMC_MC1R_DDR ,SDMMC_MC1R ); +u8 mc1r; + +if (timing ==MMC_TIMING_MMC_DDR52 ) { + mc1r =sdhci_readb (host,SDMMC_MC1R ); + mc1r |=SDMMC_MC1R_DDR ; +sdhci_writeb (host, mc1r,SDMMC_MC1R ); + }sdhci_set_uhs_signaling (host, timing); }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 106/229 scsi: smartpqi: Fix DMA direction for RAID requests
In reply to Greg Kroah-HartmanFrom: Mahesh Rajashekhara <[email protected]>
[ Upstream commit 69695aeaa6621bc49cdd7a8e5a8d1042461e496e ]
Correct a SOP READ and WRITE DMA flags for some requests.
This update corrects DMA direction issues with SCSI commands removed from the controller's internal lookup table.
Currently, SCSI READ BLOCK LIMITS (0x5) was removed from the controller lookup table and exposed a DMA direction flag issue.
SCSI READ BLOCK LIMITS was recently removed from our controller lookup table so the controller uses the respective IU flag field to set the DMA data direction. Since the DMA direction is incorrect the FW never completes the request causing a hang.
Some SCSI commands which use SCSI READ BLOCK LIMITS
* sg_map
* mt -f /dev/stX status
After updating controller firmware, users may notice their tape units failing. This patch resolves the issue.
Also, the AIO path DMA direction is correct.
The DMA direction flag is a day-one bug with no reported BZ.
--- drivers/scsi/smartpqi/smartpqi_init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/scsi/smartpqi/smartpqi_init.c +2 -2
@@ -4652,10 +4652,10 @@ static int pqi_raid_submit_scsi_cmd_with_io_request( }switch (scmd->sc_data_direction) { -case DMA_TO_DEVICE : +case DMA_FROM_DEVICE : request->data_direction =SOP_READ_FLAG ;break ; -case DMA_FROM_DEVICE : +case DMA_TO_DEVICE : request->data_direction =SOP_WRITE_FLAG ;break ;case DMA_NONE :
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 107/229 usb: gadget: udc: amd5536 depends on HAS_DMA
In reply to Greg Kroah-HartmanFrom: Randy Dunlap <[email protected]>
[ Upstream commit 8097cf2fb3b2205257f1c76f4808e3398d66b6d9 ]
USB_AMD5536UDC should depend on HAS_DMA since it selects USB_SNP_CORE, which depends on HAS_DMA and since 'select' does not follow any dependency chains.
Fixes this kconfig warning:
WARNING: unmet direct dependencies detected for USB_SNP_CORE
Depends on [n]: USB_SUPPORT [=y] && USB_GADGET [=y] && (USB_AMD5536UDC [=y] || USB_SNP_UDC_PLAT [=n]) && HAS_DMA [=n] Selected by [y]:
- USB_AMD5536UDC [=y] && USB_SUPPORT [=y] && USB_GADGET [=y] && USB_PCI [=y]
--- drivers/usb/gadget/udc/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/udc/Kconfig +1 -1
@@ -309,7 +309,7 @@ source "drivers/usb/gadget/udc/bdc/Kconfig" config USB_AMD5536UDC tristate "AMD5536 UDC" - depends on USB_PCI + depends on USB_PCI && HAS_DMA select USB_SNP_CORE help The AMD5536 UDC is part of the AMD Geode CS5536, an x86 southbridge.
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 108/229 RDMA/hfi1: fix potential memory leak in setup_base_ctxt()
In reply to Greg Kroah-HartmanFrom: Jianglei Nie <[email protected]>
[ Upstream commit aa2a1df3a2c85f855af7d54466ac10bd48645d63 ]
setup_base_ctxt() allocates a memory chunk for uctxt->groups with hfi1_alloc_ctxt_rcv_groups(). When init_user_ctxt() fails, uctxt->groups is not released, which will lead to a memory leak.
We should release the uctxt->groups with hfi1_free_ctxt_rcv_groups() when init_user_ctxt() fails.
--- drivers/infiniband/hw/hfi1/file_ops.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/infiniband/hw/hfi1/file_ops.c +3 -1
@@ -1327,8 +1327,10 @@ static int setup_base_ctxt(struct hfi1_filedata *fd, goto done; ret =init_user_ctxt (fd, uctxt); -if (ret) +if (ret) { +hfi1_free_ctxt_rcv_groups (uctxt); goto done; + }user_init (uctxt);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 109/229 gpio: gpiolib-of: Fix refcount bugs in of_mm_gpiochip_add_data()
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 5d07a692f9562f9c06e62cce369e9dd108173a0f ]
We should use of_node_get() when a new reference of device_node is created. It is noted that the old reference stored in 'mm_gc->gc.of_node' should also be decreased.
This patch is based on the fact that there is a call site in function 'qe_add_gpiochips()' of src file 'drivers\soc\fsl\qe\gpio.c'. In this function, of_mm_gpiochip_add_data() is contained in an iteration of for_each_compatible_node() which will automatically increase and decrease the refcount. So we need additional of_node_get() for the reference escape in of_mm_gpiochip_add_data().
--- drivers/gpio/gpiolib-of.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/gpio/gpiolib-of.c +3 -1
@@ -350,7 +350,8 @@ int of_mm_gpiochip_add_data(struct device_node *np,if (mm_gc->save_regs) mm_gc->save_regs (mm_gc); - mm_gc->gc.of_node = np; +of_node_put (mm_gc->gc.of_node); + mm_gc->gc.of_node =of_node_get (np); ret =gpiochip_add_data (gc, data);if (ret)
@@ -358,6 +359,7 @@ int of_mm_gpiochip_add_data(struct device_node *np,return 0 ; err2: +of_node_put (np);iounmap (mm_gc->regs); err1:kfree (gc->label);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 110/229 mmc: cavium-octeon: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 19bbb49acf8d7a03cb83e05624363741a4c3ec6f ]
In octeon_mmc_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which has increased and decreased the refcount during each iteration.
--- drivers/mmc/host/cavium-octeon.c | 1 + 1 file changed, 1 insertion(+)
drivers/mmc/host/cavium-octeon.c +1 -0
@@ -288,6 +288,7 @@ static int octeon_mmc_probe(struct platform_device *pdev)if (ret) {dev_err (&pdev->dev,"Error populating slots\n" );octeon_mmc_set_shared_power (host,0 ); +of_node_put (cn); goto error; } i++;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 111/229 mmc: cavium-thunderx: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 7ee480795e41db314f2c445c65ed854a5d6e8e32 ]
In thunder_mmc_probe(), we should call of_node_put() when breaking out of for_each_child_of_node() which has increased and decreased the refcount during each iteration.
--- drivers/mmc/host/cavium-thunderx.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
drivers/mmc/host/cavium-thunderx.c +3 -1
@@ -138,8 +138,10 @@ static int thunder_mmc_probe(struct pci_dev *pdev,continue ; ret =cvm_mmc_of_slot_probe (&host->slot_pdev[i]->dev, host); -if (ret) +if (ret) { +of_node_put (child_node); goto error; + } } i++; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 112/229 USB: serial: fix tty-port initialized comments
In reply to Greg Kroah-HartmanFrom: Johan Hovold <[email protected]>
[ Upstream commit 688ee1d1785c1359f9040f615dd8e6054962bce2 ]
Fix up the tty-port initialized comments which got truncated and obfuscated when replacing the old ASYNCB_INITIALIZED flag.
--- drivers/usb/serial/sierra.c | 3 ++- drivers/usb/serial/usb-serial.c | 2 +- drivers/usb/serial/usb_wwan.c | 3 ++- 3 files changed, 5 insertions(+), 3 deletions(-)
drivers/usb/serial/sierra.c +2 -1
@@ -759,7 +759,8 @@ static void sierra_close(struct usb_serial_port *port)/* * Need to take susp_lock to make sure port is not already being -* resumed, but no need to hold it due to initialized +* resumed, but no need to hold it due to the tty-port initialized +* flag. */ spin_lock_irq (&intfdata->susp_lock);if (--intfdata->open_ports ==0 )
drivers/usb/serial/usb-serial.c +1 -1
@@ -254,7 +254,7 @@ static int serial_open(struct tty_struct *tty, struct file *filp)* * Shut down a USB serial port. Serialized against activate by the * tport mutex and kept to matching open/close pairs -* of calls by the initialized flag. +* of calls by the tty-port initialized flag. * * Not called if tty is console. */
drivers/usb/serial/usb_wwan.c +2 -1
@@ -465,7 +465,8 @@ void usb_wwan_close(struct usb_serial_port *port)/* * Need to take susp_lock to make sure port is not already being -* resumed, but no need to hold it due to initialized +* resumed, but no need to hold it due to the tty-port initialized +* flag. */ spin_lock_irq (&intfdata->susp_lock);if (--intfdata->open_ports ==0 )
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 113/229 platform/olpc: Fix uninitialized data in debugfs write
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 40ec787e1adf302c11668d4cc69838f4d584187d ]
The call to:
size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size);
will succeed if at least one byte is written to the "cmdbuf" buffer. The "*ppos" value controls which byte is written. Another problem is that this code does not check for errors so it's possible for the entire buffer to be uninitialized.
Inintialize the struct to zero to prevent reading uninitialized stack data.
Debugfs is normally only writable by root so the impact of this bug is very minimal.
--- drivers/platform/olpc/olpc-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/platform/olpc/olpc-ec.c +1 -1
@@ -170,7 +170,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf,int i, m;unsigned char ec_cmd[EC_MAX_CMD_ARGS ];unsigned int ec_cmd_int[EC_MAX_CMD_ARGS ]; -char cmdbuf[64 ]; +char cmdbuf[64 ] ="" ;int ec_cmd_bytes;mutex_lock (&ec_dbgfs_lock);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 114/229 mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region
In reply to Greg Kroah-HartmanFrom: Miaohe Lin <[email protected]>
[ Upstream commit 7f82f922319ede486540e8746769865b9508d2c2 ]
Since the beginning, charged is set to 0 to avoid calling vm_unacct_memory twice because vm_unacct_memory will be called by above unmap_region. But since commit 4f74d2c8e827 ("vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces"), unmap_region doesn't call vm_unacct_memory anymore. So charged shouldn't be set to 0 now otherwise the calling to paired vm_unacct_memory will be missed and leads to imbalanced account.
--- mm/mmap.c | 1 - 1 file changed, 1 deletion(-)
mm/mmap.c +0 -1
@@ -1778,7 +1778,6 @@ unsigned long mmap_region(struct file *file, unsigned long addr,/* Undo any partial mapping done by a device driver. */ unmap_region (mm, vma, prev, vma->vm_start, vma->vm_end); - charged =0 ;if (vm_flags &VM_SHARED )mapping_unmap_writable (file->f_mapping); allow_write_and_free_vma:
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 115/229 RDMA/rxe: Fix error unwind in rxe_create_qp()
In reply to Greg Kroah-HartmanFrom: Zhu Yanjun <[email protected]>
[ Upstream commit fd5382c5805c4bcb50fd25b7246247d3f7114733 ]
In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_init_req().
If an error occures before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock.
Move the spinlock initializations earlier before any failures.
--- drivers/infiniband/sw/rxe/rxe_qp.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-)
drivers/infiniband/sw/rxe/rxe_qp.c +8 -4
@@ -220,6 +220,14 @@ static void rxe_qp_init_misc(struct rxe_dev *rxe, struct rxe_qp *qp,spin_lock_init (&qp->grp_lock);spin_lock_init (&qp->state_lock); +spin_lock_init (&qp->req.task.state_lock); +spin_lock_init (&qp->resp.task.state_lock); +spin_lock_init (&qp->comp.task.state_lock); + +spin_lock_init (&qp->sq.sq_lock); +spin_lock_init (&qp->rq.producer_lock); +spin_lock_init (&qp->rq.consumer_lock); +atomic_set (&qp->ssn,0 );atomic_set (&qp->skb_out,0 ); }
@@ -267,7 +275,6 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp, qp->req.opcode =-1 ; qp->comp.opcode =-1 ; -spin_lock_init (&qp->sq.sq_lock);skb_queue_head_init (&qp->req_pkts); rxe_init_task(rxe, &qp->req.task, qp,
@@ -317,9 +324,6 @@ static int rxe_qp_init_resp(struct rxe_dev *rxe, struct rxe_qp *qp, } } -spin_lock_init (&qp->rq.producer_lock); -spin_lock_init (&qp->rq.consumer_lock); -skb_queue_head_init (&qp->resp_pkts); rxe_init_task(rxe, &qp->resp.task, qp,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 116/229 ext4: recover csum seed of tmp_inode after migrating to extents
In reply to Greg Kroah-HartmanFrom: Li Lingfeng <[email protected]>
[ Upstream commit 07ea7a617d6b278fb7acedb5cbe1a81ce2de7d0c ]
When migrating to extents, the checksum seed of temporary inode need to be replaced by inode's, otherwise the inode checksums will be incorrect when swapping the inodes data.
However, the temporary inode can not match it's checksum to itself since it has lost it's own checksum seed.
mkfs.ext4 -F /dev/sdc
mount /dev/sdc /mnt/sdcxfs_io -fc "pwrite 4k 4k" -c "fsync" /mnt/sdc/testfile chattr -e /mnt/sdc/testfile
chattr +e /mnt/sdc/testfile
umount /dev/sdc
fsck -fn /dev/sdc
========
...
Pass 1: Checking inodes, blocks, and sizes
Inode 13 passes checks, but checksum does not match inode. Fix? no
...
========
The fix is simple, save the checksum seed of temporary inode, and recover it after migrating to extents.
--- fs/ext4/migrate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/migrate.c +3 -1
@@ -442,7 +442,7 @@ int ext4_ext_migrate(struct inode *inode)struct inode *tmp_inode =NULL ;struct migrate_struct lb;unsigned long max_entries; -__u32 goal; +__u32 goal, tmp_csum_seed;uid_t owner[2 ];/*
@@ -490,6 +490,7 @@ int ext4_ext_migrate(struct inode *inode)* the migration. */ ei =EXT4_I (inode); + tmp_csum_seed =EXT4_I (tmp_inode)->i_csum_seed;EXT4_I (tmp_inode)->i_csum_seed = ei->i_csum_seed;i_size_write (tmp_inode,i_size_read (inode));/*
@@ -600,6 +601,7 @@ int ext4_ext_migrate(struct inode *inode)* the inode is not visible to user space. */ tmp_inode->i_blocks =0 ; +EXT4_I (tmp_inode)->i_csum_seed = tmp_csum_seed;/* Reset the extent details */ ext4_ext_tree_init (handle, tmp_inode);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 117/229 jbd2: fix assertion jh->b_frozen_data == NULL failure when journal aborted
In reply to Greg Kroah-HartmanFrom: Zhihao Cheng <[email protected]>
[ Upstream commit 4a734f0869f970b8a9b65062ea40b09a5da9dba8 ]
Following process will fail assertion 'jh->b_frozen_data == NULL' in jbd2_journal_dirty_metadata():
jbd2_journal_commit_transaction
unlink(dir/a)
jh->b_transaction = trans1
jh->b_jlist = BJ_Metadata
journal->j_running_transaction = NULL
trans1->t_state = T_COMMITunlink(dir/b)
handle->h_trans = trans2
do_get_write_access
jh->b_modified = 0
jh->b_frozen_data = frozen_buffer
jh->b_next_transaction = trans2
jbd2_journal_dirty_metadata
is_handle_aborted
is_journal_aborted // return false
--> jbd2 abort <--
while (commit_transaction->t_buffers)
if (is_journal_aborted)
jbd2_journal_refile_buffer
__jbd2_journal_refile_buffer
WRITE_ONCE(jh->b_transaction,
jh->b_next_transaction)
WRITE_ONCE(jh->b_next_transaction, NULL)
__jbd2_journal_file_buffer(jh, BJ_Reserved)
J_ASSERT_JH(jh, jh->b_frozen_data == NULL) // assertion failure !The reproducer (See detail in [Link]) reports:
------------[ cut here ]------------ kernel BUG at fs/jbd2/transaction.c:1629! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 2 PID: 584 Comm: unlink Tainted: G W 5.19.0-rc6-00115-g4a57a8400075-dirty #697 RIP: 0010:jbd2_journal_dirty_metadata+0x3c5/0x470 RSP: 0018:ffffc90000be7ce0 EFLAGS: 00010202 Call Trace: <TASK> __ext4_handle_dirty_metadata+0xa0/0x290 ext4_handle_dirty_dirblock+0x10c/0x1d0 ext4_delete_entry+0x104/0x200 __ext4_unlink+0x22b/0x360 ext4_unlink+0x275/0x390 vfs_unlink+0x20b/0x4c0 do_unlinkat+0x42f/0x4c0 __x64_sys_unlink+0x37/0x50 do_syscall_64+0x35/0x80
After journal aborting, __jbd2_journal_refile_buffer() is executed with holding @jh->b_state_lock, we can fix it by moving 'is_handle_aborted()' into the area protected by @jh->b_state_lock.
--- fs/jbd2/transaction.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
fs/jbd2/transaction.c +12 -2
@@ -1338,8 +1338,6 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)struct journal_head *jh;int ret =0 ; -if (is_handle_aborted (handle)) -return -EROFS ;if (!buffer_jbd (bh))return -EUCLEAN ;
@@ -1386,6 +1384,18 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) journal = transaction->t_journal;jbd_lock_bh_state (bh); +if (is_handle_aborted (handle)) { +/* +* Check journal aborting with @jh->b_state_lock locked, +* since 'jh->b_transaction' could be replaced with +* 'jh->b_next_transaction' during old transaction +* committing if journal aborted, which may fail +* assertion on 'jh->b_frozen_data == NULL'. +*/ + ret = -EROFS ; + goto out_unlock_bh; + } +if (jh->b_modified ==0 ) {/* * This buffer's got modified and becoming part
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 118/229 ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit ae4f11c1ed2d67192fdf3d89db719ee439827c11 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix missing of_node_put() in error paths.
--- sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
sound/soc/mediatek/mt8173/mt8173-rt5650-rt5676.c +7 -3
@@ -255,14 +255,16 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)if (!mt8173_rt5650_rt5676_codecs[0 ].of_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_node; } mt8173_rt5650_rt5676_codecs[1 ].of_node =of_parse_phandle (pdev->dev.of_node,"mediatek,audio-codec" ,1 );if (!mt8173_rt5650_rt5676_codecs[1 ].of_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_node; } mt8173_rt5650_rt5676_codec_conf[0 ].of_node = mt8173_rt5650_rt5676_codecs[1 ].of_node;
@@ -275,7 +277,8 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)if (!mt8173_rt5650_rt5676_dais[DAI_LINK_HDMI_I2S ].codec_of_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_node; } card->dev = &pdev->dev;
@@ -285,6 +288,7 @@ static int mt8173_rt5650_rt5676_dev_probe(struct platform_device *pdev)dev_err (&pdev->dev,"%s snd_soc_register_card fail %d\n" , __func__, ret); +put_node:of_node_put (platform_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 119/229 ASoC: codecs: da7210: add check for i2c_add_driver
In reply to Greg Kroah-HartmanFrom: Jiasheng Jiang <[email protected]>
[ Upstream commit 82fa8f581a954ddeec1602bed9f8b4a09d100e6e ]
As i2c_add_driver could return error if fails, it should be better to check the return value.
However, if the CONFIG_I2C and CONFIG_SPI_MASTER are both true, the return value of i2c_add_driver will be covered by spi_register_driver.
Therefore, it is necessary to add check and return error if fails.
--- sound/soc/codecs/da7210.c | 2 ++ 1 file changed, 2 insertions(+)
sound/soc/codecs/da7210.c +2 -0
@@ -1351,6 +1351,8 @@ static int __init da7210_modinit(void)int ret =0 ;#if IS_ENABLED (CONFIG_I2C ) ret =i2c_add_driver (&da7210_i2c_driver); +if (ret) +return ret;#endif #if defined(CONFIG_SPI_MASTER ) ret =spi_register_driver (&da7210_spi_driver);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 120/229 ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit efe2178d1a32492f99e7f1f2568eea5c88a85729 ]
of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Fix refcount leak in some error paths.
--- sound/soc/mediatek/mt8173/mt8173-rt5650.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)
sound/soc/mediatek/mt8173/mt8173-rt5650.c +6 -3
@@ -270,7 +270,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)if (!mt8173_rt5650_codecs[0 ].of_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_platform_node; } mt8173_rt5650_codecs[1 ].of_node = mt8173_rt5650_codecs[0 ].of_node;
@@ -287,7 +288,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)dev_err (&pdev->dev,"%s codec_capture_dai name fail %d\n" , __func__, ret); -return ret; + goto put_platform_node; } mt8173_rt5650_codecs[1 ].dai_name = codec_capture_dai; }
@@ -308,7 +309,8 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)if (!mt8173_rt5650_dais[DAI_LINK_HDMI_I2S ].codec_of_node) {dev_err (&pdev->dev,"Property 'audio-codec' missing or invalid\n" ); -return -EINVAL ; + ret = -EINVAL ; + goto put_platform_node; } card->dev = &pdev->dev;
@@ -317,6 +319,7 @@ static int mt8173_rt5650_dev_probe(struct platform_device *pdev)dev_err (&pdev->dev,"%s snd_soc_register_card fail %d\n" , __func__, ret); +put_platform_node:of_node_put (platform_node);return ret; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 121/229 profiling: fix shift too large makes kernel panic
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
[ Upstream commit 0fe6ee8f123a4dfb529a5aff07536bb481f34043 ]
2d186afd04d6 ("profiling: fix shift-out-of-bounds bugs") limits shift value by [0, BITS_PER_LONG -1], which means [0, 63].
However, syzbot found that the max shift value should be the bit number of (_etext - _stext). If shift is outside of this, the "buffer_bytes" will be zero and will cause kzalloc(0). Then the kernel panics due to dereferencing the returned pointer 16.
This can be easily reproduced by passing a large number like 60 to enable profiling and then run readprofile.
LOGS:
BUG: kernel NULL pointer dereference, address: 0000000000000010 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 6148067 P4D 6148067 PUD 6142067 PMD 0 PREEMPT SMP CPU: 4 PID: 184 Comm: readprofile Not tainted 5.18.0+ #162 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:read_profile+0x104/0x220 RSP: 0018:ffffc900006fbe80 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888006150000 RSI: 0000000000000001 RDI: ffffffff82aba4a0 RBP: 000000000188bb60 R08: 0000000000000010 R09: ffff888006151000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff82aba4a0 R13: 0000000000000000 R14: ffffc900006fbf08 R15: 0000000000020c30 FS: 000000000188a8c0(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000010 CR3: 0000000006144000 CR4: 00000000000006e0 Call Trace: <TASK> proc_reg_read+0x56/0x70 vfs_read+0x9a/0x1b0 ksys_read+0xa1/0xe0 ? fpregs_assert_state_consistent+0x1e/0x40 do_syscall_64+0x3a/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x4d4b4e RSP: 002b:00007ffebb668d58 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 000000000188a8a0 RCX: 00000000004d4b4e RDX: 0000000000000400 RSI: 000000000188bb60 RDI: 0000000000000003 RBP: 0000000000000003 R08: 000000000000006e R09: 0000000000000000 R10: 0000000000000041 R11: 0000000000000246 R12: 000000000188bb60 R13: 0000000000000400 R14: 0000000000000000 R15: 000000000188bb60 </TASK> Modules linked in: CR2: 0000000000000010 Killed ---[ end trace 0000000000000000 ]---
Check prof_len in profile_init() to prevent it be zero.
--- kernel/profile.c | 7 +++++++ 1 file changed, 7 insertions(+)
kernel/profile.c +7 -0
@@ -108,6 +108,13 @@ int __ref profile_init(void)/* only text is profiled */ prof_len = (_etext - _stext) >> prof_shift; + +if (!prof_len) { +pr_warn ("profiling shift: %u too large\n" , prof_shift); + prof_on =0 ; +return -EINVAL ; + } + buffer_bytes = prof_len*sizeof (atomic_t);if (!alloc_cpumask_var (&prof_cpu_mask,GFP_KERNEL ))
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 122/229 tty: n_gsm: fix non flow control frames during mux flow off
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
[ Upstream commit bec0224816d19abe4fe503586d16d51890540615 ]
n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.4.6.3.6 states that FCoff stops the
transmission on all channels except the control channel. This is already
implemented in gsm_data_kick(). However, chapter 5.4.8.1 explains that this
shall result in the same behavior as software flow control on the ldisc in
advanced option mode. That means only flow control frames shall be sent
during flow off. The current implementation does not consider this case.
Change gsm_data_kick() to send only flow control frames if constipated to abide the standard. gsm_read_ea_val() and gsm_is_flow_ctrl_msg() are introduced as helper functions for this.
It is planned to use gsm_read_ea_val() in later code cleanups for other functions, too.
--- drivers/tty/n_gsm.c | 54 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 53 insertions(+), 1 deletion(-)
drivers/tty/n_gsm.c +53 -1
@@ -422,6 +422,27 @@ static int gsm_read_ea(unsigned int *val, u8 c)return c &EA ; } +/** +* gsm_read_ea_val - read a value until EA +* @val: variable holding value +* @data: buffer of data +* @dlen: length of data +* +* Processes an EA value. Updates the passed variable and +* returns the processed data length. +*/ +static unsigned int gsm_read_ea_val (unsigned int *val,const u8 *data,int dlen) +{ +unsigned int len =0 ; + +for (; dlen >0 ; dlen--) { + len++; +if (gsm_read_ea (val, *data++)) +break ; + } +return len; +} +/** * gsm_encode_modem - encode modem data bits * @dlci: DLCI to encode from
@@ -669,6 +690,37 @@ static struct gsm_msg *gsm_data_alloc(struct gsm_mux *gsm, u8 addr, int len,return m; } +/** +* gsm_is_flow_ctrl_msg - checks if flow control message +* @msg: message to check +* +* Returns true if the given message is a flow control command of the +* control channel. False is returned in any other case. +*/ +static bool gsm_is_flow_ctrl_msg (struct gsm_msg *msg) +{ +unsigned int cmd; + +if (msg->addr >0 ) +return false; + +switch (msg->ctrl & ~PF ) { +case UI : +case UIH : + cmd =0 ; +if (gsm_read_ea_val (&cmd, msg->data +2 , msg->len -2 ) <1 ) +break ; +switch (cmd & ~PF ) { +case CMD_FCOFF : +case CMD_FCON : +return true; + } +break ; + } + +return false; +} +/** * gsm_data_kick - poke the queue * @gsm: GSM Mux
@@ -687,7 +739,7 @@ static void gsm_data_kick(struct gsm_mux *gsm, struct gsm_dlci *dlci)int len;list_for_each_entry_safe (msg, nmsg, &gsm->tx_list, list) { -if (gsm->constipated && msg->addr) +if (gsm->constipated && !gsm_is_flow_ctrl_msg (msg))continue ;if (gsm->encoding !=0 ) { gsm->txframe[0 ] =GSM1_SOF ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 123/229 tty: n_gsm: fix packet re-transmission without open control channel
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
[ Upstream commit 4fae831b3a71fc5a44cc5c7d0b8c1267ee7659f5 ]
In the current implementation control packets are re-transmitted even if the control channel closed down during T2. This is wrong. Check whether the control channel is open before re-transmitting any packets. Note that control channel open/close is handled by T1 and not T2 and remains unaffected by this.
--- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/n_gsm.c +1 -1
@@ -1394,7 +1394,7 @@ static void gsm_control_retransmit(unsigned long data)spin_lock_irqsave (&gsm->control_lock, flags); ctrl = gsm->pending_cmd;if (ctrl) { -if (gsm->cretries ==0 ) { +if (gsm->cretries ==0 || !gsm->dlci[0 ] || gsm->dlci[0 ]->dead) { gsm->pending_cmd =NULL ; ctrl->error = -ETIMEDOUT ; ctrl->done =1 ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 124/229 tty: n_gsm: fix race condition in gsmld_write()
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
[ Upstream commit 32dd59f96924f45e33bc79854f7a00679c0fa28e ]
The function may be used by the user directly and also by the n_gsm internal functions. They can lead into a race condition which results in interleaved frames if both are writing at the same time. The receiving side is not able to decode those interleaved frames correctly.
Add a lock around the low side tty write to avoid race conditions and frame interleaving between user originated writes and n_gsm writes.
--- drivers/tty/n_gsm.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-)
drivers/tty/n_gsm.c +17 -4
@@ -2533,11 +2533,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file,static ssize_t gsmld_write (struct tty_struct *tty,struct file *file,const unsigned char *buf,size_t nr) { -int space =tty_write_room (tty); +struct gsm_mux *gsm = tty->disc_data; +unsigned long flags; +int space; +int ret; + +if (!gsm) +return -ENODEV ; + + ret = -ENOBUFS ; +spin_lock_irqsave (&gsm->tx_lock, flags); + space =tty_write_room (tty);if (space >= nr) -return tty->ops->write (tty, buf, nr); -set_bit (TTY_DO_WRITE_WAKEUP , &tty->flags); -return -ENOBUFS ; + ret = tty->ops->write (tty, buf, nr); +else +set_bit (TTY_DO_WRITE_WAKEUP , &tty->flags); +spin_unlock_irqrestore (&gsm->tx_lock, flags); + +return ret; }/**
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 125/229 remoteproc: qcom: wcnss: Fix handling of IRQs
In reply to Greg Kroah-HartmanFrom: Sireesh Kodali <[email protected]>
[ Upstream commit bed0adac1ded4cb486ba19a3a7e730fbd9a1c9c6 ]
The wcnss_get_irq function is expected to return a value > 0 in the event that an IRQ is succssfully obtained, but it instead returns 0. This causes the stop and ready IRQs to never actually be used despite being defined in the device-tree. This patch fixes that.
--- drivers/remoteproc/qcom_wcnss.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/remoteproc/qcom_wcnss.c +8 -2
@@ -418,6 +418,7 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss, irq_handler_t thread_fn) {int ret; +int irq_number; ret =platform_get_irq_byname (pdev, name);if (ret <0 && optional) {
@@ -428,14 +429,19 @@ static int wcnss_request_irq(struct qcom_wcnss *wcnss,return ret; } + irq_number = ret; + ret =devm_request_threaded_irq (&pdev->dev, ret,NULL , thread_fn,IRQF_TRIGGER_RISING |IRQF_ONESHOT ,"wcnss" , wcnss); -if (ret) +if (ret) {dev_err (&pdev->dev,"request %s IRQ failed\n" , name); +return ret; + } -return ret; +/* Return the IRQ number if the IRQ was successfully acquired */ +return irq_number; }static int wcnss_alloc_memory_region (struct qcom_wcnss *wcnss)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 126/229 vfio/ccw: Do not change FSM state in subchannel event
In reply to Greg Kroah-HartmanFrom: Eric Farman <[email protected]>
[ Upstream commit cffcc109fd682075dee79bade3d60a07152a8fd1 ]
The routine vfio_ccw_sch_event() is tasked with handling subchannel events, specifically machine checks, on behalf of vfio-ccw. It correctly calls cio_update_schib(), and if that fails (meaning the subchannel is gone) it makes an FSM event call to mark the subchannel Not Operational.
If that worked, however, then it decides that if the FSM state was already Not Operational (implying the subchannel just came back), then it should simply change the FSM to partially- or fully-open.
Remove this trickery, since a subchannel returning will require more probing than simply "oh all is well again" to ensure it works correctly.
--- drivers/s390/cio/vfio_ccw_drv.c | 14 +++----------- 1 file changed, 3 insertions(+), 11 deletions(-)
drivers/s390/cio/vfio_ccw_drv.c +3 -11
@@ -193,19 +193,11 @@ static int vfio_ccw_sch_event(struct subchannel *sch, int process)if (work_pending (&sch->todo_work)) goto out_unlock; -if (cio_update_schib (sch)) { -vfio_ccw_fsm_event (private,VFIO_CCW_EVENT_NOT_OPER ); - rc =0 ; - goto out_unlock; - } - - private =dev_get_drvdata (&sch->dev); -if (private->state ==VFIO_CCW_STATE_NOT_OPER ) { - private->state = private->mdev ?VFIO_CCW_STATE_IDLE : -VFIO_CCW_STATE_STANDBY ; - } rc =0 ; +if (cio_update_schib (sch)) +vfio_ccw_fsm_event (private,VFIO_CCW_EVENT_NOT_OPER ); + out_unlock:spin_unlock_irqrestore (sch->lock, flags);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 127/229 tty: n_gsm: fix wrong T1 retry count handling
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
[ Upstream commit f30e10caa80aa1f35508bc17fc302dbbde9a833c ]
n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.7.3 states that the valid range for the
maximum number of retransmissions (N2) is from 0 to 255 (both including).gsm_dlci_t1() handles this number incorrectly by performing N2 - 1
retransmission attempts. Setting N2 to zero results in more than 255
retransmission attempts.
Fix gsm_dlci_t1() to comply with 3GPP 27.010.
--- drivers/tty/n_gsm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/tty/n_gsm.c +2 -2
@@ -1546,8 +1546,8 @@ static void gsm_dlci_t1(unsigned long data)switch (dlci->state) {case DLCI_OPENING : - dlci->retries--;if (dlci->retries) { + dlci->retries--;gsm_command (dlci->gsm, dlci->addr,SABM |PF );mod_timer (&dlci->t1, jiffies + gsm->t1 *HZ /100 ); }else if (!dlci->addr && gsm->control == (DM |PF )) {
@@ -1562,8 +1562,8 @@ static void gsm_dlci_t1(unsigned long data)break ;case DLCI_CLOSING : - dlci->retries--;if (dlci->retries) { + dlci->retries--;gsm_command (dlci->gsm, dlci->addr,DISC |PF );mod_timer (&dlci->t1, jiffies + gsm->t1 *HZ /100 ); }else
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 128/229 tty: n_gsm: fix DM command
In reply to Greg Kroah-HartmanFrom: Daniel Starke <[email protected]>
[ Upstream commit 18a948c7d90995d127785e308fa7b701df4c499f ]
n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010.
See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDetails.aspx?specificationId=1516
The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to
the newer 27.010 here. Chapter 5.3.3 defines the DM response. There exists
no DM command. However, the current implementation incorrectly sends DM as
command in case of unexpected UIH frames in gsm_queue().
Correct this behavior by always sending DM as response.
--- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/tty/n_gsm.c +1 -1
@@ -1906,7 +1906,7 @@ static void gsm_queue(struct gsm_mux *gsm) goto invalid;#endif if (dlci ==NULL || dlci->state !=DLCI_OPEN ) { -gsm_command (gsm, address,DM |PF ); +gsm_response (gsm, address,DM |PF );return ; } dlci->data (dlci, gsm->buf, gsm->len);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 129/229 iommu/exynos: Handle failed IOMMU device registration properly
In reply to Greg Kroah-HartmanFrom: Sam Protsenko <[email protected]>
[ Upstream commit fce398d2d02c0a9a2bedf7c7201b123e153e8963 ]
If iommu_device_register() fails in exynos_sysmmu_probe(), the previous calls have to be cleaned up. In this case, the iommu_device_sysfs_add() should be cleaned up, by calling its remove counterpart call.
--- drivers/iommu/exynos-iommu.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
drivers/iommu/exynos-iommu.c +5 -1
@@ -638,7 +638,7 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev) ret =iommu_device_register (&data->iommu);if (ret) -return ret; + goto err_iommu_register;platform_set_drvdata (pdev, data);
@@ -665,6 +665,10 @@ static int __init exynos_sysmmu_probe(struct platform_device *pdev)pm_runtime_enable (dev);return 0 ; + +err_iommu_register: +iommu_device_sysfs_remove (&data->iommu); +return ret; }static int __maybe_unused exynos_sysmmu_suspend (struct device *dev)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 130/229 kfifo: fix kfifo_to_user() return type
In reply to Greg Kroah-HartmanFrom: Dan Carpenter <[email protected]>
[ Upstream commit 045ed31e23aea840648c290dbde04797064960db ]
The kfifo_to_user() macro is supposed to return zero for success or negative error codes. Unfortunately, there is a signedness bug so it returns unsigned int. This only affects callers which try to save the result in ssize_t and as far as I can see the only place which does that is line6_hwdep_read().
TL;DR: s/_uint/_int/.
--- include/linux/kfifo.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/linux/kfifo.h +1 -1
@@ -629,7 +629,7 @@ __kfifo_uint_must_check_helper( \* writer, you don't need extra locking to use these macro. */ #define kfifo_to_user (fifo, to, len, copied) \ -__kfifo_uint_must_check_helper( \ +__kfifo_int_must_check_helper( \ ({ \ typeof((fifo) + 1) __tmp = (fifo); \ void __user *__to = (to); \
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 131/229 mfd: t7l66xb: Drop platform disable callback
In reply to Greg Kroah-HartmanFrom: Uwe Kleine-König <[email protected]>
[ Upstream commit 128ac294e1b437cb8a7f2ff8ede1cde9082bddbe ]
None of the in-tree instantiations of struct t7l66xb_platform_data provides a disable callback. So better don't dereference this function pointer unconditionally. As there is no user, drop it completely instead of calling it conditional.
This is a preparation for making platform remove callbacks return void.
--- drivers/mfd/t7l66xb.c | 6 +----- include/linux/mfd/t7l66xb.h | 1 - 2 files changed, 1 insertion(+), 6 deletions(-)
drivers/mfd/t7l66xb.c +1 -5
@@ -412,11 +412,8 @@ static int t7l66xb_probe(struct platform_device *dev)static int t7l66xb_remove (struct platform_device *dev) { -struct t7l66xb_platform_data *pdata =dev_get_platdata (&dev->dev);struct t7l66xb *t7l66xb =platform_get_drvdata (dev); -int ret; - ret = pdata->disable (dev);clk_disable_unprepare (t7l66xb->clk48m);clk_put (t7l66xb->clk48m);clk_disable_unprepare (t7l66xb->clk32k);
@@ -427,8 +424,7 @@ static int t7l66xb_remove(struct platform_device *dev)mfd_remove_devices (&dev->dev);kfree (t7l66xb); -return ret; - +return 0 ; }static struct platform_driver t7l66xb_platform_driver = {
include/linux/mfd/t7l66xb.h +0 -1
@@ -16,7 +16,6 @@struct t7l66xb_platform_data {int (*enable)(struct platform_device *dev); -int (*disable)(struct platform_device *dev);int (*suspend)(struct platform_device *dev);int (*resume)(struct platform_device *dev);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 132/229 iommu/arm-smmu: qcom_iommu: Add of_node_put() when breaking out of loop
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit a91eb6803c1c715738682fece095145cbd68fe0b ]
In qcom_iommu_has_secure_context(), we should call of_node_put() for the reference 'child' when breaking out of for_each_child_of_node() which will automatically increase and decrease the refcount.
--- drivers/iommu/qcom_iommu.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/iommu/qcom_iommu.c +5 -2
@@ -745,9 +745,12 @@ static bool qcom_iommu_has_secure_context(struct qcom_iommu_dev *qcom_iommu) {struct device_node *child; -for_each_child_of_node (qcom_iommu->dev->of_node, child) -if (of_device_is_compatible (child,"qcom,msm-iommu-v1-sec" )) +for_each_child_of_node (qcom_iommu->dev->of_node, child) { +if (of_device_is_compatible (child,"qcom,msm-iommu-v1-sec" )) { +of_node_put (child);return true; + } + }return false; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 133/229 s390/zcore: fix race when reading from hardware system area
In reply to Greg Kroah-HartmanFrom: Alexander Gordeev <[email protected]>
[ Upstream commit 9ffed254d938c9e99eb7761c7f739294c84e0367 ]
Memory buffer used for reading out data from hardware system area is not protected against concurrent access.
--- drivers/s390/char/zcore.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-)
drivers/s390/char/zcore.c +10 -1
@@ -53,6 +53,7 @@ static struct dentry *zcore_reipl_file;static struct dentry *zcore_hsa_file;static struct ipl_parameter_block *ipl_block; +static DEFINE_MUTEX (hsa_buf_mutex);static char hsa_buf[PAGE_SIZE ]__aligned(PAGE_SIZE) ;/*
@@ -69,19 +70,24 @@ int memcpy_hsa_user(void __user *dest, unsigned long src, size_t count)if (!hsa_available)return -ENODATA ; +mutex_lock (&hsa_buf_mutex);while (count) {if (sclp_sdias_copy (hsa_buf, src /PAGE_SIZE +2 ,1 )) {TRACE ("sclp_sdias_copy() failed\n" ); +mutex_unlock (&hsa_buf_mutex);return -EIO ; } offset = src %PAGE_SIZE ; bytes =min (PAGE_SIZE - offset, count); -if (copy_to_user (dest, hsa_buf + offset, bytes)) +if (copy_to_user (dest, hsa_buf + offset, bytes)) { +mutex_unlock (&hsa_buf_mutex);return -EFAULT ; + } src += bytes; dest += bytes; count -= bytes; } +mutex_unlock (&hsa_buf_mutex);return 0 ; }
@@ -99,9 +105,11 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count)if (!hsa_available)return -ENODATA ; +mutex_lock (&hsa_buf_mutex);while (count) {if (sclp_sdias_copy (hsa_buf, src /PAGE_SIZE +2 ,1 )) {TRACE ("sclp_sdias_copy() failed\n" ); +mutex_unlock (&hsa_buf_mutex);return -EIO ; } offset = src %PAGE_SIZE ;
@@ -111,6 +119,7 @@ int memcpy_hsa_kernel(void *dest, unsigned long src, size_t count) dest += bytes; count -= bytes; } +mutex_unlock (&hsa_buf_mutex);return 0 ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 134/229 video: fbdev: amba-clcd: Fix refcount leak bugs
In reply to Greg Kroah-HartmanFrom: Liang He <[email protected]>
[ Upstream commit 26c2b7d9fac42eb8317f3ceefa4c1a9a9170ca69 ]
In clcdfb_of_init_display(), we should call of_node_put() for the references returned by of_graph_get_next_endpoint() and of_graph_get_remote_port_parent() which have increased the refcount.
Besides, we should call of_node_put() both in fail path or when the references are not used anymore.
--- drivers/video/fbdev/amba-clcd.c | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-)
drivers/video/fbdev/amba-clcd.c +18 -6
@@ -772,8 +772,10 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)return -ENODEV ; panel =of_graph_get_remote_port_parent (endpoint); -if (!panel) -return -ENODEV ; +if (!panel) { + err = -ENODEV ; + goto out_endpoint_put; + }if (fb->vendor->init_panel) { err = fb->vendor->init_panel (fb, panel);
@@ -783,11 +785,11 @@ static int clcdfb_of_init_display(struct clcd_fb *fb) err =clcdfb_of_get_backlight (panel, fb->panel);if (err) -return err; + goto out_panel_put; err =clcdfb_of_get_mode (&fb->dev->dev, panel, fb->panel);if (err) -return err; + goto out_panel_put; err =of_property_read_u32 (fb->dev->dev.of_node,"max-memory-bandwidth" , &max_bandwidth);
@@ -816,11 +818,21 @@ static int clcdfb_of_init_display(struct clcd_fb *fb)if (of_property_read_u32_array (endpoint,"arm,pl11x,tft-r0g0b0-pads" , - tft_r0b0g0,ARRAY_SIZE (tft_r0b0g0)) !=0 ) -return -ENOENT ; + tft_r0b0g0,ARRAY_SIZE (tft_r0b0g0)) !=0 ) { + err = -ENOENT ; + goto out_panel_put; + } + +of_node_put (panel); +of_node_put (endpoint);return clcdfb_of_init_tft_panel (fb, tft_r0b0g0[0 ], tft_r0b0g0[1 ], tft_r0b0g0[2 ]); +out_panel_put: +of_node_put (panel); +out_endpoint_put: +of_node_put (endpoint); +return err; }static int clcdfb_of_vram_setup (struct clcd_fb *fb)
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 135/229 video: fbdev: sis: fix typos in SiS_GetModeID()
In reply to Greg Kroah-HartmanFrom: Rustam Subkhankulov <[email protected]>
[ Upstream commit 3eb8fccc244bfb41a7961969e4db280d44911226 ]
The second operand of a '&&' operator has no impact on expression result for cases 400 and 512 in SiS_GetModeID().
Judging by the logic and the names of the variables, in both cases a typo was made.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
--- drivers/video/fbdev/sis/init.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/video/fbdev/sis/init.c +2 -2
@@ -355,12 +355,12 @@ SiS_GetModeID(int VGAEngine, unsigned int VBFlags, int HDisplay, int VDisplay, }break ;case 400 : -if ((!(VBFlags &CRT1_LCDA )) || ((LCDwidth >=800 ) && (LCDwidth >=600 ))) { +if ((!(VBFlags &CRT1_LCDA )) || ((LCDwidth >=800 ) && (LCDheight >=600 ))) {if (VDisplay ==300 ) ModeIndex = ModeIndex_400x300[Depth]; }break ;case 512 : -if ((!(VBFlags &CRT1_LCDA )) || ((LCDwidth >=1024 ) && (LCDwidth >=768 ))) { +if ((!(VBFlags &CRT1_LCDA )) || ((LCDwidth >=1024 ) && (LCDheight >=768 ))) {if (VDisplay ==384 ) ModeIndex = ModeIndex_512x384[Depth]; }break ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 136/229 powerpc/pci: Prefer PCI domain assignment via DT linux,pci-domain and alias
In reply to Greg Kroah-HartmanFrom: Pali Rohár <[email protected]>
[ Upstream commit 0fe1e96fef0a5c53b4c0d1500d356f3906000f81 ]
Other Linux architectures use DT property 'linux,pci-domain' for specifying fixed PCI domain of PCI controller specified in Device-Tree.
And lot of Freescale powerpc boards have defined numbered pci alias in Device-Tree for every PCIe controller which number specify preferred PCI domain.
So prefer usage of DT property 'linux,pci-domain' (via function of_get_pci_domain_nr()) and DT pci alias (via function of_alias_get_id()) on powerpc architecture for assigning PCI domain to PCI controller.
--- arch/powerpc/kernel/pci-common.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-)
arch/powerpc/kernel/pci-common.c +19 -8
@@ -80,16 +80,30 @@ EXPORT_SYMBOL(get_pci_dma_ops);static int get_phb_number (struct device_node *dn) {int ret, phb_id =-1 ; -u32 prop_32;u64 prop;/* * Try fixed PHB numbering first, by checking archs and reading -* the respective device-tree properties. Firstly, try powernv by -* reading "ibm,opal-phbid", only present in OPAL environment. +* the respective device-tree properties. Firstly, try reading +* standard "linux,pci-domain", then try reading "ibm,opal-phbid" +* (only present in powernv OPAL environment), then try device-tree +* alias and as the last try to use lower bits of "reg" property. */ - ret =of_property_read_u64 (dn,"ibm,opal-phbid" , &prop); + ret =of_get_pci_domain_nr (dn); +if (ret >=0 ) { + prop = ret; + ret =0 ; + } +if (ret) + ret =of_property_read_u64 (dn,"ibm,opal-phbid" , &prop); +if (ret) + ret =of_alias_get_id (dn,"pci" ); +if (ret >=0 ) { + prop = ret; + ret =0 ; + }if (ret) { +u32 prop_32; ret =of_property_read_u32_index (dn,"reg" ,1 , &prop_32); prop = prop_32; }
@@ -101,10 +115,7 @@ static int get_phb_number(struct device_node *dn)if ((phb_id >=0 ) && !test_and_set_bit (phb_id, phb_bitmap))return phb_id; -/* -* If not pseries nor powernv, or if fixed PHB numbering tried to add -* the same PHB number twice, then fallback to dynamic PHB numbering. -*/ +/* If everything fails then fallback to dynamic PHB numbering. */ phb_id =find_first_zero_bit (phb_bitmap,MAX_PHBS );BUG_ON (phb_id >=MAX_PHBS );set_bit (phb_id, phb_bitmap);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 137/229 powerpc/spufs: Fix refcount leak in spufs_init_isolated_loader
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 6ac059dacffa8ab2f7798f20e4bd3333890c541c ]
of_find_node_by_path() returns remote device nodepointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- arch/powerpc/platforms/cell/spufs/inode.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/cell/spufs/inode.c +1 -0
@@ -684,6 +684,7 @@ spufs_init_isolated_loader(void)return ; loader =of_get_property (dn,"loader" , &size); +of_node_put (dn);if (!loader)return ;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 138/229 powerpc/xive: Fix refcount leak in xive_get_max_prio
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit 255b650cbec6849443ce2e0cdd187fd5e61c218c ]
of_find_node_by_path() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of_node_put() to avoid refcount leak.
--- arch/powerpc/sysdev/xive/spapr.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/sysdev/xive/spapr.c +1 -0
@@ -569,6 +569,7 @@ static bool xive_get_max_prio(u8 *max_prio) } reg =of_get_property (rootdn,"ibm,plat-res-int-priorities" , &len); +of_node_put (rootdn);if (!reg) {pr_err ("Failed to read 'ibm,plat-res-int-priorities' property\n" );return false;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 139/229 powerpc/cell/axon_msi: Fix refcount leak in setup_msi_msg_address
In reply to Greg Kroah-HartmanFrom: Miaoqian Lin <[email protected]>
[ Upstream commit df5d4b616ee76abc97e5bd348e22659c2b095b1c ]
of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() in the error path to avoid refcount leak.
--- arch/powerpc/platforms/cell/axon_msi.c | 1 + 1 file changed, 1 insertion(+)
arch/powerpc/platforms/cell/axon_msi.c +1 -0
@@ -230,6 +230,7 @@ static int setup_msi_msg_address(struct pci_dev *dev, struct msi_msg *msg)if (!prop) {dev_dbg (&dev->dev,"axon_msi: no msi-address-(32|64) properties found\n" ); +of_node_put (dn);return -ENOENT ; }
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 140/229 kprobes: Forbid probing on trampoline and BPF code areas
In reply to Greg Kroah-HartmanFrom: Chen Zhongjin <[email protected]>
[ Upstream commit 28f6c37a2910f565b4f5960df52b2eccae28c891 ]
kernel_text_address() treats ftrace_trampoline, kprobe_insn_slot and bpf_text_address as valid kprobe addresses - which is not ideal.
These text areas are removable and changeable without any notification to kprobes, and probing on them can trigger unexpected behavior:
https://lkml.org/lkml/2022/7/26/1148
Considering that jump_label and static_call text are already forbiden to probe, kernel_text_address() should be replaced with core_kernel_text() and is_module_text_address() to check other text areas which are unsafe to kprobe.
[ mingo: Rewrote the changelog. ]
--- kernel/kprobes.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
kernel/kprobes.c +2 -1
@@ -1551,7 +1551,8 @@ static int check_kprobe_address_safe(struct kprobe *p,preempt_disable ();/* Ensure it is not in reserved area nor out of text */ -if (!kernel_text_address ((unsigned long ) p->addr) || +if (!(core_kernel_text ((unsigned long ) p->addr) || +is_module_text_address ((unsigned long ) p->addr)) ||within_kprobe_blacklist ((unsigned long ) p->addr) ||jump_label_text_reserved (p->addr, p->addr) ||find_bug ((unsigned long )p->addr)) {
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 141/229 powerpc/pci: Fix PHB numbering when using opal-phbid
In reply to Greg Kroah-HartmanFrom: Michael Ellerman <[email protected]>
[ Upstream commit f4b39e88b42d13366b831270306326b5c20971ca ]
The recent change to the PHB numbering logic has a logic error in the handling of "ibm,opal-phbid".
When an "ibm,opal-phbid" property is present, &prop is written to and ret is set to zero.
The following call to of_alias_get_id() is skipped because ret == 0.
But then the if (ret >= 0) is true, and the body of that if statement sets prop = ret which throws away the value that was just read from "ibm,opal-phbid".
Fix the logic by only doing the ret >= 0 check in the of_alias_get_id() case.
--- arch/powerpc/kernel/pci-common.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-)
arch/powerpc/kernel/pci-common.c +6 -4
@@ -96,11 +96,13 @@ static int get_phb_number(struct device_node *dn) }if (ret) ret =of_property_read_u64 (dn,"ibm,opal-phbid" , &prop); -if (ret) + +if (ret) { ret =of_alias_get_id (dn,"pci" ); -if (ret >=0 ) { - prop = ret; - ret =0 ; +if (ret >=0 ) { + prop = ret; + ret =0 ; + } }if (ret) {u32 prop_32;
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 142/229 genelf: Use HAVE_LIBCRYPTO_SUPPORT, not the never defined HAVE_LIBCRYPTO
In reply to Greg Kroah-HartmanFrom: Arnaldo Carvalho de Melo <[email protected]>
[ Upstream commit 91cea6be90e436c55cde8770a15e4dac9d3032d0 ]
When genelf was introduced it tested for HAVE_LIBCRYPTO not HAVE_LIBCRYPTO_SUPPORT, which is the define the feature test for openssl defines, fix it.
This also adds disables the deprecation warning, someone has to fix this to build with openssl 3.0 before the warning becomes a hard error.
--- tools/perf/util/genelf.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)
tools/perf/util/genelf.c +5 -1
@@ -35,7 +35,11 @@#define BUILD_ID_URANDOM /* different uuid for each run */ -#ifdef HAVE_LIBCRYPTO +// FIXME, remove this and fix the deprecation warnings before its removed and +// We'll break for good here... +#pragma GCC diagnostic ignored "-Wdeprecated-declarations" + +#ifdef HAVE_LIBCRYPTO_SUPPORT #define BUILD_ID_MD5 #undef BUILD_ID_SHA/* does not seem to work well when linked with Java */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 143/229 x86/numa: Use cpumask_available instead of hardcoded NULL check
In reply to Greg Kroah-HartmanFrom: Siddh Raman Pant <[email protected]>
[ Upstream commit 625395c4a0f4775e0fe00f616888d2e6c1ba49db ]
GCC-12 started triggering a new warning:
arch/x86/mm/numa.c: In function ‘cpumask_of_node’:
arch/x86/mm/numa.c:916:39: warning: the comparison will always evaluate as ‘false’ for the address of ‘node_to_cpumask_map’ will never be NULL [-Waddress]
916 | if (node_to_cpumask_map[node] == NULL) {
| ^~node_to_cpumask_map is of type cpumask_var_t[].
When CONFIG_CPUMASK_OFFSTACK is set, cpumask_var_t is typedef'd to a pointer for dynamic allocation, else to an array of one element. The "wicked game" can be checked on line 700 of include/linux/cpumask.h.
The original code in debug_cpumask_set_cpu() and cpumask_of_node() were probably written by the original authors with CONFIG_CPUMASK_OFFSTACK=y (i.e. dynamic allocation) in mind, checking if the cpumask was available via a direct NULL check.
When CONFIG_CPUMASK_OFFSTACK is not set, GCC gives the above warning while compiling the kernel.
Fix that by using cpumask_available(), which does the NULL check when CONFIG_CPUMASK_OFFSTACK is set, otherwise returns true. Use it wherever such checks are made.
Conditional definitions of cpumask_available() can be found along with the definition of cpumask_var_t. Check the cpumask.h reference mentioned above.
--- arch/x86/mm/numa.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
arch/x86/mm/numa.c +2 -2
@@ -826,7 +826,7 @@ void debug_cpumask_set_cpu(int cpu, int node, bool enable)return ; } mask = node_to_cpumask_map[node]; -if (!mask) { +if (!cpumask_available (mask)) {pr_err ("node_to_cpumask_map[%i] NULL\n" , node);dump_stack ();return ;
@@ -872,7 +872,7 @@ const struct cpumask *cpumask_of_node(int node)dump_stack ();return cpu_none_mask; } -if (node_to_cpumask_map[node] ==NULL ) { +if (!cpumask_available (node_to_cpumask_map[node])) {printk (KERN_WARNING "cpumask_of_node(%d): no node_to_cpumask_map!\n" , node);
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 144/229 video: fbdev: arkfb: Fix a divide-by-zero bug in ark_set_pixclock()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 2f1c4523f7a3aaabe7e53d3ebd378292947e95c8 ]
Since the user can control the arguments of the ioctl() from the user
space, under special arguments that may result in a divide-by-zero bug
in:
drivers/video/fbdev/arkfb.c:784: ark_set_pixclock(info, (hdiv * info->var.pixclock) / hmul);
with hdiv=1, pixclock=1 and hmul=2 you end up with (1*1)/2 = (int) 0.
and then in:
drivers/video/fbdev/arkfb.c:504: rv = dac_set_freq(par->dac, 0, 1000000000 / pixclock);
we'll get a division-by-zero.
The following log can reveal it:
divide error: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:ark_set_pixclock drivers/video/fbdev/arkfb.c:504 [inline] RIP: 0010:arkfb_set_par+0x10fc/0x24c0 drivers/video/fbdev/arkfb.c:784 Call Trace: fb_set_var+0x604/0xeb0 drivers/video/fbdev/core/fbmem.c:1034 do_fb_ioctl+0x234/0x670 drivers/video/fbdev/core/fbmem.c:1110 fb_ioctl+0xdd/0x130 drivers/video/fbdev/core/fbmem.c:1189
Fix this by checking the argument of ark_set_pixclock() first.
--- drivers/video/fbdev/arkfb.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/video/fbdev/arkfb.c +6 -1
@@ -778,7 +778,12 @@ static int arkfb_set_par(struct fb_info *info)return -EINVAL ; } -ark_set_pixclock (info, (hdiv * info->var.pixclock) / hmul); + value = (hdiv * info->var.pixclock) / hmul; +if (!value) { +fb_dbg (info,"invalid pixclock\n" ); + value =1 ; + } +ark_set_pixclock (info, value); svga_set_timings(par->state.vgabase, &ark_timing_regs, &(info->var), hmul, hdiv, (info->var.vmode & FB_VMODE_DOUBLE) ? 2 : 1, (info->var.vmode & FB_VMODE_INTERLACED) ? 2 : 1,
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 145/229 tools/thermal: Fix possible path truncations
In reply to Greg Kroah-HartmanFrom: Florian Fainelli <[email protected]>
[ Upstream commit 6c58cf40e3a1d2f47c09d3489857e9476316788a ]
A build with -D_FORTIFY_SOURCE=2 enabled will produce the following warnings:
sysfs.c:63:30: warning: '%s' directive output may be truncated writing up to 255 bytes into a region of size between 0 and 255 [-Wformat-truncation=]
snprintf(filepath, 256, "%s/%s", path, filename);
^~Bump up the buffer to PATH_MAX which is the limit and account for all of the possible NUL and separators that could lead to exceeding the allocated buffer sizes.
--- tools/thermal/tmon/sysfs.c | 24 +++++++++++++----------- 1 file changed, 13 insertions(+), 11 deletions(-)
tools/thermal/tmon/sysfs.c +13 -11
@@ -22,6 +22,7 @@#include <stdint.h> #include <dirent.h> #include <libintl.h> +#include <limits.h> #include <ctype.h> #include <time.h> #include <syslog.h>
@@ -42,9 +43,9 @@ int sysfs_set_ulong(char *path, char *filename, unsigned long val) {FILE *fd;int ret =-1 ; -char filepath[256 ]; +char filepath[PATH_MAX +2 ];/* NUL and '/' */ -snprintf (filepath,256 ,"%s/%s" , path, filename); +snprintf (filepath,sizeof (filepath),"%s/%s" , path, filename); fd =fopen (filepath,"w" );if (!fd) {
@@ -66,9 +67,9 @@ static int sysfs_get_ulong(char *path, char *filename, unsigned long *p_ulong) {FILE *fd;int ret =-1 ; -char filepath[256 ]; +char filepath[PATH_MAX +2 ];/* NUL and '/' */ -snprintf (filepath,256 ,"%s/%s" , path, filename); +snprintf (filepath,sizeof (filepath),"%s/%s" , path, filename); fd =fopen (filepath,"r" );if (!fd) {
@@ -85,9 +86,9 @@ static int sysfs_get_string(char *path, char *filename, char *str) {FILE *fd;int ret =-1 ; -char filepath[256 ]; +char filepath[PATH_MAX +2 ];/* NUL and '/' */ -snprintf (filepath,256 ,"%s/%s" , path, filename); +snprintf (filepath,sizeof (filepath),"%s/%s" , path, filename); fd =fopen (filepath,"r" );if (!fd) {
@@ -208,8 +209,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name, {unsigned long trip_instance =0 ;char cdev_name_linked[256 ]; -char cdev_name[256 ]; -char cdev_trip_name[256 ]; +char cdev_name[PATH_MAX ]; +char cdev_trip_name[PATH_MAX ];int cdev_id;if (nl->d_type ==DT_LNK ) {
@@ -222,7 +223,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name,return -EINVAL ; }/* find the link to real cooling device record binding */ -snprintf (cdev_name,256 ,"%s/%s" , tz_name, nl->d_name); +snprintf (cdev_name,sizeof (cdev_name) -2 ,"%s/%s" , + tz_name, nl->d_name);memset (cdev_name_linked,0 ,sizeof (cdev_name_linked));if (readlink (cdev_name, cdev_name_linked,sizeof (cdev_name_linked) -1 ) !=-1 ) {
@@ -235,8 +237,8 @@ static int find_tzone_cdev(struct dirent *nl, char *tz_name,/* find the trip point in which the cdev is binded to * in this tzone */ -snprintf (cdev_trip_name,256 ,"%s%s" , nl->d_name, -"_trip_point" ); +snprintf (cdev_trip_name,sizeof (cdev_trip_name) -1 , +"%s%s" , nl->d_name,"_trip_point" );sysfs_get_ulong (tz_name, cdev_trip_name, &trip_instance);/* validate trip point range, e.g. trip could return -1
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 146/229 video: fbdev: vt8623fb: Check the size of screen before memset_io()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit ec0754c60217248fa77cc9005d66b2b55200ac06 ]
In the function vt8623fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug:
[ 583.339036] BUG: unable to handle page fault for address: ffffc90005000000 [ 583.339049] #PF: supervisor write access in kernel mode [ 583.339052] #PF: error_code(0x0002) - not-present page [ 583.339074] RIP: 0010:memset_orig+0x33/0xb0 [ 583.339110] Call Trace: [ 583.339118] vt8623fb_set_par+0x11cd/0x21e0 [ 583.339146] fb_set_var+0x604/0xeb0 [ 583.339181] do_fb_ioctl+0x234/0x670 [ 583.339209] fb_ioctl+0xdd/0x130
Fix the this by checking the value of 'screen_size' before memset_io().
--- drivers/video/fbdev/vt8623fb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/vt8623fb.c +2 -0
@@ -504,6 +504,8 @@ static int vt8623fb_set_par(struct fb_info *info) (info->var.vmode &FB_VMODE_DOUBLE ) ?2 :1 ,1 , 1, info->node); +if (screen_size > info->screen_size) + screen_size = info->screen_size;memset_io (info->screen_base,0x00 , screen_size);/* Device and screen back on */
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 147/229 video: fbdev: arkfb: Check the size of screen before memset_io()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 96b550971c65d54d64728d8ba973487878a06454 ]
In the function arkfb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug:
[ 659.399066] BUG: unable to handle page fault for address: ffffc90003000000 [ 659.399077] #PF: supervisor write access in kernel mode [ 659.399079] #PF: error_code(0x0002) - not-present page [ 659.399094] RIP: 0010:memset_orig+0x33/0xb0 [ 659.399116] Call Trace: [ 659.399122] arkfb_set_par+0x143f/0x24c0 [ 659.399130] fb_set_var+0x604/0xeb0 [ 659.399161] do_fb_ioctl+0x234/0x670 [ 659.399189] fb_ioctl+0xdd/0x130
Fix the this by checking the value of 'screen_size' before memset_io().
--- drivers/video/fbdev/arkfb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/arkfb.c +2 -0
@@ -794,6 +794,8 @@ static int arkfb_set_par(struct fb_info *info) value = ((value * hmul / hdiv) /8 ) -5 ;vga_wcrt (par->state.vgabase,0x42 , (value +1 ) /2 ); +if (screen_size > info->screen_size) + screen_size = info->screen_size;memset_io (info->screen_base,0x00 , screen_size);/* Device and screen back on */ svga_wcrt_mask (par->state.vgabase,0x17 ,0x80 ,0x80 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 148/229 video: fbdev: s3fb: Check the size of screen before memset_io()
In reply to Greg Kroah-HartmanFrom: Zheyu Ma <[email protected]>
[ Upstream commit 6ba592fa014f21f35a8ee8da4ca7b95a018f13e8 ]
In the function s3fb_set_par(), the value of 'screen_size' is calculated by the user input. If the user provides the improper value, the value of 'screen_size' may larger than 'info->screen_size', which may cause the following bug:
[ 54.083733] BUG: unable to handle page fault for address: ffffc90003000000 [ 54.083742] #PF: supervisor write access in kernel mode [ 54.083744] #PF: error_code(0x0002) - not-present page [ 54.083760] RIP: 0010:memset_orig+0x33/0xb0 [ 54.083782] Call Trace: [ 54.083788] s3fb_set_par+0x1ec6/0x4040 [ 54.083806] fb_set_var+0x604/0xeb0 [ 54.083836] do_fb_ioctl+0x234/0x670
Fix the this by checking the value of 'screen_size' before memset_io().
--- drivers/video/fbdev/s3fb.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/video/fbdev/s3fb.c +2 -0
@@ -902,6 +902,8 @@ static int s3fb_set_par(struct fb_info *info) value =clamp ((htotal + hsstart +1 ) /2 +2 , hsstart +4 , htotal +1 );svga_wcrt_multi (par->state.vgabase, s3_dtpc_regs, value); +if (screen_size > info->screen_size) + screen_size = info->screen_size;memset_io (info->screen_base,0x00 , screen_size);/* Device and screen back on */ svga_wcrt_mask (par->state.vgabase,0x17 ,0x80 ,0x80 );
Signature · 1 line
2.35.1
Greg Kroah-Hartman
maintainerPATCH 149/229 scsi: zfcp: Fix missing auto port scan and thus missing target ports
In reply to Greg Kroah-HartmanFrom: Steffen Maier <[email protected]>
commit 4da8c5f76825269f28d6a89fa752934a4bcb6dfa upstream.
Case (1):
The only waiter on wka_port->completion_wq is zfcp_fc_wka_port_get() trying to open a WKA port. As such it should only be woken up by WKA port *open* responses, not by WKA port close responses.
Case (2):
A close WKA port response coming in just after having sent a new open WKA port request and before blocking for the open response with wait_event() in zfcp_fc_wka_port_get() erroneously renders the wait_event a NOP because the close handler overwrites wka_port->status. Hence the wait_event condition is erroneously true and it does not enter blocking state.
With non-negligible probability, the following time space sequence happens depending on timing without this fix:
user process ERP thread zfcp work queue tasklet system work queue
============ ========== =============== ======= =================
$ echo 1 > online
zfcp_ccw_set_online
zfcp_ccw_activate
zfcp_erp_adapter_reopen
msleep scan backoff zfcp_erp_strategy
| ...
| zfcp_erp_action_cleanup
| ...
| queue delayed scan_work
| queue ns_up_work
| ns_up_work:
| zfcp_fc_wka_port_get
| open wka request
| open response
| GSPN FC-GS
| RSPN FC-GS [NPIV-only]
| zfcp_fc_wka_port_put
| (--wka->refcount==0)
| sched delayed wka->work
|
~~~Case (1)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
zfcp_erp_wait
flush scan_work
| wka->work:
| wka->status=CLOSING
| close wka request
| scan_work:
| zfcp_fc_wka_port_get
| (wka->status==CLOSING)
| wka->status=OPENING
| open wka request
| wait_event
| | close response
| | wka->status=OFFLINE
| | wake_up /*WRONG*/
~~~Case (2)~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| wka->work:
| wka->status=CLOSING
| close wka request
zfcp_erp_wait
flush scan_work
| scan_work:
| zfcp_fc_wka_port_get
| (wka->status==CLOSING)
| wka->status=OPENING
| open wka request
| close response
| wka->status=OFFLINE
| wake_up /*WRONG&NOP*/
| wait_event /*NOP*/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| (wka->status!=ONLINE)
| return -EIO
| return early
open response
wka->status=ONLINE
wake_up /*NOP*/So we erroneously end up with no automatic port scan. This is a big problem when it happens during boot. The timing is influenced by v3.19 commit 18f87a67e6d6 ("zfcp: auto port scan resiliency").
Fix it by fully mutually excluding zfcp_fc_wka_port_get() and zfcp_fc_wka_port_offline(). For that to work, we make the latter block until we got the response for a close WKA port. In order not to penalize the system workqueue, we move wka_port->work to our own adapter workqueue. Note that before v2.6.30 commit 828bc1212a68 ("[SCSI] zfcp: Set WKA-port to offline on adapter deactivation"), zfcp did block in zfcp_fc_wka_port_offline() as well, but with a different condition.
While at it, make non-functional cleanups to improve code reading in zfcp_fc_wka_port_get(). If we cannot send the WKA port open request, don't rely on the subsequent wait_event condition to immediately let this case pass without blocking. Also don't want to rely on the additional condition handling the refcount to be skipped just to finally return with -EIO.
--- drivers/s390/scsi/zfcp_fc.c | 29 ++++++++++++++++++++--------- drivers/s390/scsi/zfcp_fc.h | 6 ++++-- drivers/s390/scsi/zfcp_fsf.c | 4 ++-- 3 files changed, 26 insertions(+), 13 deletions(-)
drivers/s390/scsi/zfcp_fc.c +20 -9
@@ -146,27 +146,33 @@ void zfcp_fc_enqueue_event(struct zfcp_astatic int zfcp_fc_wka_port_get (struct zfcp_fc_wka_port *wka_port) { +int ret = -EIO ; +if (mutex_lock_interruptible (&wka_port->mutex))return -ERESTARTSYS ;if (wka_port->status ==ZFCP_FC_WKA_PORT_OFFLINE || wka_port->status ==ZFCP_FC_WKA_PORT_CLOSING ) { wka_port->status =ZFCP_FC_WKA_PORT_OPENING ; -if (zfcp_fsf_open_wka_port (wka_port)) +if (zfcp_fsf_open_wka_port (wka_port)) { +/* could not even send request, nothing to wait for */ wka_port->status =ZFCP_FC_WKA_PORT_OFFLINE ; + goto out; + } } -mutex_unlock (&wka_port->mutex); - -wait_event (wka_port->completion_wq, +wait_event (wka_port->opened, wka_port->status ==ZFCP_FC_WKA_PORT_ONLINE || wka_port->status ==ZFCP_FC_WKA_PORT_OFFLINE );if (wka_port->status ==ZFCP_FC_WKA_PORT_ONLINE ) {atomic_inc (&wka_port->refcount); -return 0 ; + ret =0 ; + goto out; } -return -EIO ; +out: +mutex_unlock (&wka_port->mutex); +return ret; }static void zfcp_fc_wka_port_offline (struct work_struct *work)
@@ -182,9 +188,12 @@ static void zfcp_fc_wka_port_offline(str wka_port->status =ZFCP_FC_WKA_PORT_CLOSING ;if (zfcp_fsf_close_wka_port (wka_port)) { +/* could not even send request, nothing to wait for */ wka_port->status =ZFCP_FC_WKA_PORT_OFFLINE ; -wake_up (&wka_port->completion_wq); + goto out; } +wait_event (wka_port->closed, + wka_port->status ==ZFCP_FC_WKA_PORT_OFFLINE ); out:mutex_unlock (&wka_port->mutex); }
@@ -194,13 +203,15 @@ static void zfcp_fc_wka_port_put(structif (atomic_dec_return (&wka_port->refcount) !=0 )return ;/* wait 10 milliseconds, other reqs might pop in */ -schedule_delayed_work (&wka_port->work,HZ /100 ); +queue_delayed_work (wka_port->adapter->work_queue, &wka_port->work, +msecs_to_jiffies (10 )); }static void zfcp_fc_wka_port_init (struct zfcp_fc_wka_port *wka_port,u32 d_id,struct zfcp_adapter *adapter) { -init_waitqueue_head (&wka_port->completion_wq); +init_waitqueue_head (&wka_port->opened); +init_waitqueue_head (&wka_port->closed); wka_port->adapter = adapter; wka_port->d_id = d_id;
drivers/s390/scsi/zfcp_fc.h +4 -2
@@ -170,7 +170,8 @@ enum zfcp_fc_wka_status {/** * struct zfcp_fc_wka_port - representation of well-known-address (WKA) FC port * @adapter: Pointer to adapter structure this WKA port belongs to -* @completion_wq: Wait for completion of open/close command +* @opened: Wait for completion of open command +* @closed: Wait for completion of close command * @status: Current status of WKA port * @refcount: Reference count to keep port open as long as it is in use * @d_id: FC destination id or well-known-address
@@ -180,7 +181,8 @@ enum zfcp_fc_wka_status {*/ struct zfcp_fc_wka_port {struct zfcp_adapter *adapter; -wait_queue_head_t completion_wq; +wait_queue_head_t opened; +wait_queue_head_t closed;enum zfcp_fc_wka_status status;atomic_t refcount;u32 d_id;
drivers/s390/scsi/zfcp_fsf.c +2 -2
@@ -1582,7 +1582,7 @@ static void zfcp_fsf_open_wka_port_handl wka_port->status =ZFCP_FC_WKA_PORT_ONLINE ; } out: -wake_up (&wka_port->completion_wq); +wake_up (&wka_port->opened); }/**
@@ -1640,7 +1640,7 @@ static void zfcp_fsf_close_wka_port_hand } wka_port->status =ZFCP_FC_WKA_PORT_OFFLINE ; -wake_up (&wka_port->completion_wq); +wake_up (&wka_port->closed); }/**
Greg Kroah-Hartman
maintainerPATCH 150/229 x86/olpc: fix logical not is only applied to the left hand side
In reply to Greg Kroah-HartmanFrom: Alexander Lobakin <[email protected]>
commit 3a2ba42cbd0b669ce3837ba400905f93dd06c79f upstream.
The bitops compile-time optimization series revealed one more problem in olpc-xo1-sci.c:send_ebook_state(), resulted in GCC warnings:
arch/x86/platform/olpc/olpc-xo1-sci.c: In function 'send_ebook_state':arch/x86/platform/olpc/olpc-xo1-sci.c:83:63: warning: logical not is only applied to the left hand side of comparison [-Wlogical-not-parentheses]
83 | if (!!test_bit(SW_TABLET_MODE, ebook_switch_idev->sw) == state)
| ^~arch/x86/platform/olpc/olpc-xo1-sci.c:83:13: note: add parentheses around left hand side expression to silence this warning
Despite this code working as intended, this redundant double negation of boolean value, together with comparing to char with no explicit conversion to bool, makes compilers think the author made some unintentional logical mistakes here. Make it the other way around and negate the char instead to silence the warnings.
--- arch/x86/platform/olpc/olpc-xo1-sci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
arch/x86/platform/olpc/olpc-xo1-sci.c +1 -1
@@ -85,7 +85,7 @@ static void send_ebook_state(void)return ; } -if (!!test_bit (SW_TABLET_MODE , ebook_switch_idev->sw) == state) +if (test_bit (SW_TABLET_MODE , ebook_switch_idev->sw) == !!state)return ;/* Nothing new to report. */ input_report_switch (ebook_switch_idev,SW_TABLET_MODE , state);
Greg Kroah-Hartman
maintainerPATCH 151/229 spmi: trace: fix stack-out-of-bound access in SPMI tracing functions
In reply to Greg Kroah-HartmanFrom: David Collins <[email protected]>
commit 2af28b241eea816e6f7668d1954f15894b45d7e3 upstream.
trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of "len + 1". This leads to one extra byte being read beyond the end of the specified buffer. Fix this out-of-bound memory access by using a length of "len" instead.
Here is a KASAN log showing the issue:
BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234 Read of size 2 at addr ffffffc0265b7540 by task [email protected]/1314 ... Call trace: dump_backtrace+0x0/0x3e8 show_stack+0x2c/0x3c dump_stack_lvl+0xdc/0x11c print_address_description+0x74/0x384 kasan_report+0x188/0x268 kasan_check_range+0x270/0x2b0 memcpy+0x90/0xe8 trace_event_raw_event_spmi_read_end+0x1d0/0x234 spmi_read_cmd+0x294/0x3ac spmi_ext_register_readl+0x84/0x9c regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi] _regmap_raw_read+0x40c/0x754 regmap_raw_read+0x3a0/0x514 regmap_bulk_read+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x80/0x218 el0_svc_common+0xec/0x1c8 ...
addr ffffffc0265b7540 is located in stack of task [email protected]/1314 at offset 32 in frame:
adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]
this frame has 1 object:
[32, 33) 'status'
Memory state around the buggy address:
ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
>ffffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00
^
ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00
==================================================================--- include/trace/events/spmi.h | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-)
include/trace/events/spmi.h +6 -6
@@ -21,15 +21,15 @@ TRACE_EVENT(spmi_write_begin,__field ( u8, sid ) __field ( u16, addr ) __field ( u8, len ) -__dynamic_array ( u8, buf, len +1 ) +__dynamic_array ( u8, buf, len ) ),TP_fast_assign ( __entry->opcode = opcode; __entry->sid = sid; __entry->addr = addr; - __entry->len = len +1 ; -memcpy (__get_dynamic_array (buf), buf, len +1 ); + __entry->len = len; +memcpy (__get_dynamic_array (buf), buf, len); ), TP_printk("opc=%d sid=%02d addr=0x%04x len=%d buf=0x[%*phD]",
@@ -92,7 +92,7 @@ TRACE_EVENT(spmi_read_end,__field ( u16, addr ) __field ( int, ret ) __field ( u8, len ) -__dynamic_array ( u8, buf, len +1 ) +__dynamic_array ( u8, buf, len ) ), TP_fast_assign(
@@ -100,8 +100,8 @@ TRACE_EVENT(spmi_read_end, __entry->sid = sid; __entry->addr = addr; __entry->ret = ret; - __entry->len = len +1 ; -memcpy (__get_dynamic_array (buf), buf, len +1 ); + __entry->len = len; +memcpy (__get_dynamic_array (buf), buf, len); ), TP_printk("opc=%d sid=%02d addr=0x%04x ret=%d len=%02d buf=0x[%*phD]",
Greg Kroah-Hartman
maintainerPATCH 152/229 ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit 179b14152dcb6a24c3415200603aebca70ff13af upstream.
When adding an xattr to an inode, we must ensure that the inode_size is not less than EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. Otherwise, the end position may be greater than the start position, resulting in UAF.
--- fs/ext4/xattr.h | 13 +++++++++++++ 1 file changed, 13 insertions(+)
fs/ext4/xattr.h +13 -0
@@ -95,6 +95,19 @@ struct ext4_xattr_entry {#define EXT4_ZERO_XATTR_VALUE ((void *)-1) +/* +* If we want to add an xattr to the inode, we should make sure that +* i_extra_isize is not 0 and that the inode size is not less than +* EXT4_GOOD_OLD_INODE_SIZE + extra_isize + pad. +* EXT4_GOOD_OLD_INODE_SIZE extra_isize header entry pad data +* |--------------------------|------------|------|---------|---|-------| +*/ +#define EXT4_INODE_HAS_XATTR_SPACE (inode) \ + ((EXT4_I(inode)->i_extra_isize != 0) && \ + (EXT4_GOOD_OLD_INODE_SIZE + EXT4_I(inode)->i_extra_isize + \ + sizeof(struct ext4_xattr_ibody_header) + EXT4_XATTR_PAD <= \ + EXT4_INODE_SIZE((inode)->i_sb))) +struct ext4_xattr_info {const char *name;const void *value;
Greg Kroah-Hartman
maintainerPATCH 153/229 ext4: make sure ext4_append() always allocates new block
In reply to Greg Kroah-HartmanFrom: Lukas Czerner <[email protected]>
commit b8a04fe77ef1360fbf73c80fddbdfeaa9407ed1b upstream.
ext4_append() must always allocate a new block, otherwise we run the risk of overwriting existing directory block corrupting the directory tree in the process resulting in all manner of problems later on.
Add a sanity check to see if the logical block is already allocated and error out if it is.
--- fs/ext4/namei.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+)
fs/ext4/namei.c +16 -0
@@ -52,6 +52,7 @@ static struct buffer_head *ext4_append(hstruct inode *inode, ext4_lblk_t *block) { + struct ext4_map_blocks map;struct buffer_head *bh;int err;
@@ -61,6 +62,21 @@ static struct buffer_head *ext4_append(hreturn ERR_PTR (-ENOSPC ); *block = inode->i_size >> inode->i_sb->s_blocksize_bits; + map.m_lblk = *block; + map.m_len =1 ; + +/* +* We're appending new directory block. Make sure the block is not +* allocated yet, otherwise we will end up corrupting the +* directory. +*/ + err =ext4_map_blocks (NULL , inode, &map,0 ); +if (err <0 ) +return ERR_PTR (err); +if (err) { +EXT4_ERROR_INODE (inode,"Logical block already allocated" ); +return ERR_PTR (-EFSCORRUPTED ); + } bh =ext4_bread (handle, inode, *block,EXT4_GET_BLOCKS_CREATE );if (IS_ERR (bh))
Greg Kroah-Hartman
maintainerPATCH 154/229 ext4: fix use-after-free in ext4_xattr_set_entry
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit 67d7d8ad99beccd9fe92d585b87f1760dc9018e3 upstream.
Hulk Robot reported a issue:
==================================================================
BUG: KASAN: use-after-free in ext4_xattr_set_entry+0x18ab/0x3500 Write of size 4105 at addr ffff8881675ef5f4 by task syz-executor.0/7092 CPU: 1 PID: 7092 Comm: syz-executor.0 Not tainted 4.19.90-dirty #17 Call Trace: [...] memcpy+0x34/0x50 mm/kasan/kasan.c:303 ext4_xattr_set_entry+0x18ab/0x3500 fs/ext4/xattr.c:1747 ext4_xattr_ibody_inline_set+0x86/0x2a0 fs/ext4/xattr.c:2205 ext4_xattr_set_handle+0x940/0x1300 fs/ext4/xattr.c:2386 ext4_xattr_set+0x1da/0x300 fs/ext4/xattr.c:2498 __vfs_setxattr+0x112/0x170 fs/xattr.c:149 __vfs_setxattr_noperm+0x11b/0x2a0 fs/xattr.c:180 __vfs_setxattr_locked+0x17b/0x250 fs/xattr.c:238 vfs_setxattr+0xed/0x270 fs/xattr.c:255 setxattr+0x235/0x330 fs/xattr.c:520 path_setxattr+0x176/0x190 fs/xattr.c:539 __do_sys_lsetxattr fs/xattr.c:561 [inline] __se_sys_lsetxattr fs/xattr.c:557 [inline] __x64_sys_lsetxattr+0xc2/0x160 fs/xattr.c:557 do_syscall_64+0xdf/0x530 arch/x86/entry/common.c:298 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x459fe9 RSP: 002b:00007fa5e54b4c08 EFLAGS: 00000246 ORIG_RAX: 00000000000000bd RAX: ffffffffffffffda RBX: 000000000051bf60 RCX: 0000000000459fe9 RDX: 00000000200003c0 RSI: 0000000020000180 RDI: 0000000020000140 RBP: 000000000051bf60 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000001009 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc73c93fc0 R14: 000000000051bf60 R15: 00007fa5e54b4d80
[...]
==================================================================
Above issue may happen as follows:
-------------------------------------ext4_xattr_set
ext4_xattr_set_handle
ext4_xattr_ibody_find
>> s->end < s->base
>> no EXT4_STATE_XATTR
>> xattr_check_inode is not executed
ext4_xattr_ibody_set
ext4_xattr_set_entry
>> size_t min_offs = s->end - s->base
>> UAF in memcpy
we can easily reproduce this problem with the following commands:
mkfs.ext4 -F /dev/sda
mount -o debug_want_extra_isize=128 /dev/sda /mnt
touch /mnt/file
setfattr -n user.cat -v seq -s z 4096|tr -d '[:digit:]' /mnt/file
In ext4_xattr_ibody_find, we have the following assignment logic:
header = IHDR(inode, raw_inode)
= raw_inode + EXT4_GOOD_OLD_INODE_SIZE + i_extra_isize
is->s.base = IFIRST(header)
= header + sizeof(struct ext4_xattr_ibody_header)
is->s.end = raw_inode + s_inode_size
In ext4_xattr_set_entry
min_offs = s->end - s->base
= s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
sizeof(struct ext4_xattr_ibody_header)
last = s->first
free = min_offs - ((void *)last - s->base) - sizeof(__u32)
= s_inode_size - EXT4_GOOD_OLD_INODE_SIZE - i_extra_isize -
sizeof(struct ext4_xattr_ibody_header) - sizeof(__u32)
In the calculation formula, all values except s_inode_size and i_extra_size are fixed values. When i_extra_size is the maximum value s_inode_size - EXT4_GOOD_OLD_INODE_SIZE, min_offs is -4 and free is -8. The value overflows. As a result, the preceding issue is triggered when memcpy is executed.
Therefore, when finding xattr or setting xattr, check whether there is space for storing xattr in the inode to resolve this issue.
--- fs/ext4/xattr.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
fs/ext4/xattr.c +4 -2
@@ -2187,8 +2187,9 @@ int ext4_xattr_ibody_find(struct inode *struct ext4_inode *raw_inode;int error; -if (EXT4_I (inode)->i_extra_isize ==0 ) +if (!EXT4_INODE_HAS_XATTR_SPACE (inode))return 0 ; + raw_inode =ext4_raw_inode (&is->iloc); header =IHDR (inode, raw_inode); is->s.base = is->s.first =IFIRST (header);
@@ -2216,8 +2217,9 @@ int ext4_xattr_ibody_inline_set(handle_tstruct ext4_xattr_search *s = &is->s;int error; -if (EXT4_I (inode)->i_extra_isize ==0 ) +if (!EXT4_INODE_HAS_XATTR_SPACE (inode))return -ENOSPC ; + error =ext4_xattr_set_entry (i, s, handle, inode, false/* is_block */ );if (error)return error;
Greg Kroah-Hartman
maintainerPATCH 155/229 ext4: update s_overhead_clusters in the superblock during an on-line resize
In reply to Greg Kroah-HartmanFrom: Theodore Ts'o <[email protected]>
commit de394a86658ffe4e89e5328fd4993abfe41b7435 upstream.
When doing an online resize, the on-disk superblock on-disk wasn't updated. This means that when the file system is unmounted and remounted, and the on-disk overhead value is non-zero, this would result in the results of statfs(2) to be incorrect.
This was partially fixed by Commits 10b01ee92df5 ("ext4: fix overhead calculation to account for the reserved gdt blocks"), 85d825dbf489 ("ext4: force overhead calculation if the s_overhead_cluster makes no sense"), and eb7054212eac ("ext4: update the cached overhead value in the superblock").
However, since it was too expensive to forcibly recalculate the overhead for bigalloc file systems at every mount, this didn't fix the problem for bigalloc file systems. This commit should address the problem when resizing file systems with the bigalloc feature enabled.
--- fs/ext4/resize.c | 1 + 1 file changed, 1 insertion(+)
fs/ext4/resize.c +1 -0
@@ -1456,6 +1456,7 @@ static void ext4_update_super(struct sup* Update the fs overhead information */ ext4_calculate_overhead (sb); + es->s_overhead_clusters =cpu_to_le32 (sbi->s_overhead);if (test_opt (sb,DEBUG )) printk(KERN_DEBUG "EXT4-fs: added group %u:"
Greg Kroah-Hartman
maintainerPATCH 156/229 ext4: fix extent status tree race in writeback error recovery path
In reply to Greg Kroah-HartmanFrom: Eric Whitney <[email protected]>
commit 7f0d8e1d607c1a4fa9a27362a108921d82230874 upstream.
A race can occur in the unlikely event ext4 is unable to allocate a physical cluster for a delayed allocation in a bigalloc file system during writeback. Failure to allocate a cluster forces error recovery that includes a call to mpage_release_unused_pages(). That function removes any corresponding delayed allocated blocks from the extent status tree. If a new delayed write is in progress on the same cluster simultaneously, resulting in the addition of an new extent containing one or more blocks in that cluster to the extent status tree, delayed block accounting can be thrown off if that delayed write then encounters a similar cluster allocation failure during future writeback.
Write lock the i_data_sem in mpage_release_unused_pages() to fix this problem. Ext4's block/cluster accounting code for bigalloc relies on i_data_sem for mutual exclusion, as is found in the delayed write path, and the locking in mpage_release_unused_pages() is missing.
--- fs/ext4/inode.c | 7 +++++++ 1 file changed, 7 insertions(+)
fs/ext4/inode.c +7 -0
@@ -1754,7 +1754,14 @@ static void mpage_release_unused_pages(sext4_lblk_t start, last; start = index << (PAGE_SHIFT - inode->i_blkbits); last = end << (PAGE_SHIFT - inode->i_blkbits); + +/* +* avoid racing with extent status tree scans made by +* ext4_insert_delayed_block() +*/ +down_write (&EXT4_I (inode)->i_data_sem);ext4_es_remove_extent (inode, start, last - start +1 ); +up_write (&EXT4_I (inode)->i_data_sem); }pagevec_init (&pvec,0 );
Greg Kroah-Hartman
maintainerPATCH 157/229 ext4: correct max_inline_xattr_value_size computing
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit c9fd167d57133c5b748d16913c4eabc55e531c73 upstream.
If the ext4 inode does not have xattr space, 0 is returned in the get_max_inline_xattr_value_size function. Otherwise, the function returns a negative value when the inode does not contain EXT4_STATE_XATTR.
--- fs/ext4/inline.c | 3 +++ 1 file changed, 3 insertions(+)
fs/ext4/inline.c +3 -0
@@ -40,6 +40,9 @@ static int get_max_inline_xattr_value_sistruct ext4_inode *raw_inode;int free, min_offs; +if (!EXT4_INODE_HAS_XATTR_SPACE (inode)) +return 0 ; + min_offs =EXT4_SB (inode->i_sb)->s_inode_size -EXT4_GOOD_OLD_INODE_SIZE - EXT4_I(inode)->i_extra_isize -
Greg Kroah-Hartman
maintainerPATCH 158/229 ext4: correct the misjudgment in ext4_iget_extra_inode
In reply to Greg Kroah-HartmanFrom: Baokun Li <[email protected]>
commit fd7e672ea98b95b9d4c9dae316639f03c16a749d upstream.
Use the EXT4_INODE_HAS_XATTR_SPACE macro to more accurately determine whether the inode have xattr space.
--- fs/ext4/inode.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/ext4/inode.c +1 -2
@@ -4735,8 +4735,7 @@ static inline int ext4_iget_extra_inode(__le32 *magic = (void *)raw_inode +EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; -if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize +sizeof (__le32) <= -EXT4_INODE_SIZE (inode->i_sb) && +if (EXT4_INODE_HAS_XATTR_SPACE (inode) && *magic ==cpu_to_le32 (EXT4_XATTR_MAGIC )) {ext4_set_inode_state (inode,EXT4_STATE_XATTR );return ext4_find_inline_data_nolock (inode);
Greg Kroah-Hartman
maintainerPATCH 159/229 intel_th: pci: Add Raptor Lake-S CPU support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit ff46a601afc5a66a81c3945b83d0a2caeb88e8bc upstream.
Add support for the Trace Hub in Raptor Lake-S CPU.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -254,6 +254,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Raptor Lake-S CPU */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa76f), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Rocket Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x4c19 ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 160/229 intel_th: pci: Add Raptor Lake-S PCH support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 23e2de5826e2fc4dd43e08bab3a2ea1a5338b063 upstream.
Add support for the Trace Hub in Raptor Lake-S PCH.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -259,6 +259,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Raptor Lake-S */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Rocket Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x4c19 ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 161/229 intel_th: pci: Add Meteor Lake-P support
In reply to Greg Kroah-HartmanFrom: Alexander Shishkin <[email protected]>
commit 802a9a0b1d91274ef10d9fe429b4cc1e8c200aef upstream.
Add support for the Trace Hub in Meteor Lake-P.
--- drivers/hwtracing/intel_th/pci.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/hwtracing/intel_th/pci.c +5 -0
@@ -264,6 +264,11 @@ static const struct pci_device_id intel_ .driver_data = (kernel_ulong_t)&intel_th_2x, }, { +/* Meteor Lake-P */ + PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7e24), + .driver_data = (kernel_ulong_t)&intel_th_2x, + }, + {/* Rocket Lake CPU */ PCI_DEVICE (PCI_VENDOR_ID_INTEL ,0x4c19 ), .driver_data = (kernel_ulong_t)&intel_th_2x,
Greg Kroah-Hartman
maintainerPATCH 162/229 dm raid: fix address sanitizer warning in raid_resume
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 7dad24db59d2d2803576f2e3645728866a056dab upstream.
There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks is greater than rs->raid_disks, so the loop touches one entry beyond the allocated length.
--- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-raid.c +1 -1
@@ -3669,7 +3669,7 @@ static void attempt_restore_of_faulty_dememset (cleared_failed_devices,0 ,sizeof (cleared_failed_devices)); -for (i =0 ; i < mddev->raid_disks; i++) { +for (i =0 ; i < rs->raid_disks; i++) { r = &rs->dev[i].rdev;/* HM FIXME: enhance journal device recovery processing */ if (test_bit (Journal, &r->flags))
Greg Kroah-Hartman
maintainerPATCH 163/229 dm raid: fix address sanitizer warning in raid_status
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 1fbeea217d8f297fe0e0956a1516d14ba97d0396 upstream.
There is this warning when using a kernel with the address sanitizer and running this testsuite:
https://gitlab.com/cki-project/kernel-tests/-/tree/main/storage/swraid/scsi_raid
==================================================================
BUG: KASAN: slab-out-of-bounds in raid_status+0x1747/0x2820 [dm_raid] Read of size 4 at addr ffff888079d2c7e8 by task lvcreate/13319 CPU: 0 PID: 13319 Comm: lvcreate Not tainted 5.18.0-0.rc3.<snip> #1 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9c print_address_description.constprop.0+0x1f/0x1e0 print_report.cold+0x55/0x244 kasan_report+0xc9/0x100 raid_status+0x1747/0x2820 [dm_raid] dm_ima_measure_on_table_load+0x4b8/0xca0 [dm_mod] table_load+0x35c/0x630 [dm_mod] ctl_ioctl+0x411/0x630 [dm_mod] dm_ctl_ioctl+0xa/0x10 [dm_mod] __x64_sys_ioctl+0x12a/0x1a0 do_syscall_64+0x5b/0x80
The warning is caused by reading conf->max_nr_stripes in raid_status. The code in raid_status reads mddev->private, casts it to struct r5conf and reads the entry max_nr_stripes.
However, if we have different raid type than 4/5/6, mddev->private doesn't point to struct r5conf; it may point to struct r0conf, struct r1conf, struct r10conf or struct mpconf. If we cast a pointer to one of these structs to struct r5conf, we will be reading invalid memory and KASAN warns about it.
Fix this bug by reading struct r5conf only if raid type is 4, 5 or 6.
--- drivers/md/dm-raid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/md/dm-raid.c +1 -1
@@ -3394,7 +3394,7 @@ static void raid_status(struct dm_target {struct raid_set *rs = ti->private;struct mddev *mddev = &rs->md; -struct r5conf *conf = mddev->private; +struct r5conf *conf =rs_is_raid456 (rs) ? mddev->private :NULL ;int i, max_nr_stripes = conf ? conf->max_nr_stripes :0 ;bool array_in_sync;unsigned int raid_param_cnt =1 ;/* at least 1 for chunksize */
Greg Kroah-Hartman
maintainerPATCH 164/229 net_sched: cls_route: remove from list when handle is 0
In reply to Greg Kroah-HartmanFrom: Thadeu Lima de Souza Cascardo <[email protected]>
commit 9ad36309e2719a884f946678e0296be10f0bb4c1 upstream.
When a route filter is replaced and the old filter has a 0 handle, the old one won't be removed from the hashtable, while it will still be freed.
The test was there since before commit 1109c00547fc ("net: sched: RCU cls_route"), when a new filter was not allocated when there was an old one. The old filter was reused and the reinserting would only be necessary if an old filter was replaced. That was still wrong for the same case where the old handle was 0.
Remove the old filter from the list independently from its handle value.
This fixes CVE-2022-2588, also reported as ZDI-CAN-17440.
--- net/sched/cls_route.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/sched/cls_route.c +1 -1
@@ -531,7 +531,7 @@ static int route4_change(struct net *netrcu_assign_pointer (f->next, f1);rcu_assign_pointer (*fp, f); -if (fold && fold->handle && f->handle != fold->handle) { +if (fold) { th =to_hash (fold->handle); h =from_hash (fold->handle >>16 ); b =rtnl_dereference (head->table[th]);
Greg Kroah-Hartman
maintainerPATCH 165/229 btrfs: reject log replay if there is unsupported RO compat flag
In reply to Greg Kroah-HartmanFrom: Qu Wenruo <[email protected]>
commit dc4d31684974d140250f3ee612c3f0cab13b3146 upstream.
[BUG]
If we have a btrfs image with dirty log, along with an unsupported RO compatible flag:
log_root 30474240
...compat_flags 0x0compat_ro_flags 0x40000003
( FREE_SPACE_TREE | FREE_SPACE_TREE_VALID | unknown flag: 0x40000000 )
Then even if we can only mount it RO, we will still cause metadata update for log replay:
BTRFS info (device dm-1): flagging fs with big metadata feature BTRFS info (device dm-1): using free space tree
BTRFS info (device dm-1): has skinny extents
BTRFS info (device dm-1): start tree-log replay
This is definitely against RO compact flag requirement.
[CAUSE]
RO compact flag only forces us to do RO mount, but we will still do log replay for plain RO mount.
Thus this will result us to do log replay and update metadata.
This can be very problematic for new RO compat flag, for example older kernel can not understand v2 cache, and if we allow metadata update on RO mount and invalidate/corrupt v2 cache.
[FIX]
Just reject the mount unless rescue=nologreplay is provided:
BTRFS error (device dm-1): cannot replay dirty log with unsupport optional features (0x40000000), try rescue=nologreplay instead
We don't want to set rescue=nologreply directly, as this would make the end user to read the old data, and cause confusion.
Since the such case is really rare, we're mostly fine to just reject the mount with an error message, which also includes the proper workaround.
--- fs/btrfs/disk-io.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/btrfs/disk-io.c +14 -0
@@ -2718,6 +2718,20 @@ int open_ctree(struct super_block *sb, err = -EINVAL ; goto fail_alloc; } +/* +* We have unsupported RO compat features, although RO mounted, we +* should not cause any metadata write, including log replay. +* Or we could screw up whatever the new feature requires. +*/ +if (unlikely (features &&btrfs_super_log_root (disk_super) && + !btrfs_test_opt (fs_info,NOLOGREPLAY ))) { +btrfs_err (fs_info, +"cannot replay dirty log with unsupported compat_ro features (0x%llx), try rescue=nologreplay" , + features); + err = -EINVAL ; + goto fail_alloc; + } + max_active = fs_info->thread_pool_size;
Greg Kroah-Hartman
maintainerPATCH 166/229 KVM: Add infrastructure and macro to mark VM as bugged
In reply to Greg Kroah-HartmanFrom: Sean Christopherson <[email protected]>
commit 0b8f11737cffc1a406d1134b58687abc29d76b52 upstream
Message-Id: <3a0998645c328bf0895f1290e61821b70f048549.1625186503.git.isaku.yamahata@intel.com>
--- include/linux/kvm_host.h | 28 +++++++++++++++++++++++++++- virt/kvm/kvm_main.c | 10 +++++----- 2 files changed, 32 insertions(+), 6 deletions(-)
include/linux/kvm_host.h +27 -1
@@ -127,6 +127,7 @@ static inline bool is_error_page(struct#define KVM_REQ_MMU_RELOAD (1 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)#define KVM_REQ_PENDING_TIMER 2#define KVM_REQ_UNHALT 3 +#define KVM_REQ_VM_BUGGED (4 | KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP)#define KVM_REQUEST_ARCH_BASE 8#define KVM_ARCH_REQ_FLAGS (nr, flags) ({ \
@@ -446,6 +447,7 @@ struct kvm {struct kvm_stat_data **debugfs_stat_data;struct srcu_struct srcu;struct srcu_struct irq_srcu; +bool vm_bugged;pid_t userspace_pid; };
@@ -475,6 +477,31 @@ struct kvm {#define vcpu_err (vcpu, fmt, ...) \ kvm_err("vcpu%i " fmt, (vcpu)->vcpu_id, ## __VA_ARGS__) +bool kvm_make_all_cpus_request (struct kvm *kvm,unsigned int req); +static inline void kvm_vm_bugged (struct kvm *kvm) +{ + kvm->vm_bugged = true; +kvm_make_all_cpus_request (kvm,KVM_REQ_VM_BUGGED ); +} + +#define KVM_BUG(cond, kvm, fmt...) \ +({ \ + int __ret = (cond); \ + \ + if (WARN_ONCE(__ret && !(kvm)->vm_bugged, fmt)) \ + kvm_vm_bugged(kvm); \ + unlikely(__ret); \ +}) + +#define KVM_BUG_ON (cond, kvm) \ +({ \ + int __ret = (cond); \ + \ + if (WARN_ON_ONCE(__ret && !(kvm)->vm_bugged)) \ + kvm_vm_bugged(kvm); \ + unlikely(__ret); \ +}) +static inline struct kvm_io_bus *kvm_get_bus (struct kvm *kvm,enum kvm_bus idx) { return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,
@@ -732,7 +759,6 @@ void kvm_put_guest_fpu(struct kvm_vcpu *void kvm_flush_remote_tlbs (struct kvm *kvm);void kvm_reload_remote_mmus (struct kvm *kvm); -bool kvm_make_all_cpus_request (struct kvm *kvm,unsigned int req);long kvm_arch_dev_ioctl (struct file *filp,unsigned int ioctl,unsigned long arg);
virt/kvm/kvm_main.c +5 -5
@@ -2660,7 +2660,7 @@ static long kvm_vcpu_ioctl(struct file *struct kvm_fpu *fpu =NULL ;struct kvm_sregs *kvm_sregs =NULL ; -if (vcpu->kvm->mm != current->mm) +if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)return -EIO ;if (unlikely (_IOC_TYPE (ioctl) !=KVMIO ))
@@ -2864,7 +2864,7 @@ static long kvm_vcpu_compat_ioctl(structvoid __user *argp =compat_ptr (arg);int r; -if (vcpu->kvm->mm != current->mm) +if (vcpu->kvm->mm != current->mm || vcpu->kvm->vm_bugged)return -EIO ;switch (ioctl) {
@@ -2922,7 +2922,7 @@ static long kvm_device_ioctl(struct file {struct kvm_device *dev = filp->private_data; -if (dev->kvm->mm != current->mm) +if (dev->kvm->mm != current->mm || dev->kvm->vm_bugged)return -EIO ;switch (ioctl) {
@@ -3087,7 +3087,7 @@ static long kvm_vm_ioctl(struct file *fivoid __user *argp = (void __user *)arg;int r; -if (kvm->mm != current->mm) +if (kvm->mm != current->mm || kvm->vm_bugged)return -EIO ;switch (ioctl) {case KVM_CREATE_VCPU :
@@ -3264,7 +3264,7 @@ static long kvm_vm_compat_ioctl(struct fstruct kvm *kvm = filp->private_data;int r; -if (kvm->mm != current->mm) +if (kvm->mm != current->mm || kvm->vm_bugged)return -EIO ;switch (ioctl) {case KVM_GET_DIRTY_LOG : {
Greg Kroah-Hartman
maintainerPATCH 167/229 KVM: x86: Check lapic_in_kernel() before attempting to set a SynIC irq
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 7ec37d1cbe17d8189d9562178d8b29167fe1c31a upstream
When KVM_CAP_HYPERV_SYNIC{,2} is activated, KVM already checks for irqchip_in_kernel() so normally SynIC irqs should never be set. It is, however, possible for a misbehaving VMM to write to SYNIC/STIMER MSRs causing erroneous behavior.
The immediate issue being fixed is that kvm_irq_delivery_to_apic() (kvm_irq_delivery_to_apic_fast()) crashes when called with 'irq.shorthand = APIC_DEST_SELF' and 'src == NULL'.
Message-Id: <[email protected]>
--- arch/x86/kvm/hyperv.c | 3 +++ 1 file changed, 3 insertions(+)
arch/x86/kvm/hyperv.c +3 -0
@@ -317,6 +317,9 @@ static int synic_set_irq(struct kvm_vcpustruct kvm_lapic_irq irq;int ret, vector; +if (KVM_BUG_ON (!lapic_in_kernel (vcpu), vcpu->kvm)) +return -EINVAL ; +if (sint >=ARRAY_SIZE (synic->sint))return -EINVAL ;
Greg Kroah-Hartman
maintainerPATCH 168/229 KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()
In reply to Greg Kroah-HartmanFrom: Vitaly Kuznetsov <[email protected]>
commit 00b5f37189d24ac3ed46cb7f11742094778c46ce upstream
When kvm_irq_delivery_to_apic_fast() is called with APIC_DEST_SELF shorthand, 'src' must not be NULL. Crash the VM with KVM_BUG_ON() instead of crashing the host.
Message-Id: <[email protected]>
--- arch/x86/kvm/lapic.c | 4 ++++ 1 file changed, 4 insertions(+)
arch/x86/kvm/lapic.c +4 -0
@@ -894,6 +894,10 @@ bool kvm_irq_delivery_to_apic_fast(struc *r =-1 ;if (irq->shorthand ==APIC_DEST_SELF ) { +if (KVM_BUG_ON (!src, kvm)) { + *r =0 ; +return true; + } *r =kvm_apic_set_irq (src->vcpu, irq, dest_map);return true; }
Greg Kroah-Hartman
maintainerPATCH 169/229 tcp: fix over estimation in sk_forced_mem_schedule()
In reply to Greg Kroah-HartmanFrom: Eric Dumazet <[email protected]>
commit c4ee118561a0f74442439b7b5b486db1ac1ddfeb upstream.
sk_forced_mem_schedule() has a bug similar to ones fixed in commit 7c80b038d23e ("net: fix sk_wmem_schedule() and sk_rmem_schedule() errors")
While this bug has little chance to trigger in old kernels, we need to fix it before the following patch.
--- net/ipv4/tcp_output.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
net/ipv4/tcp_output.c +4 -3
@@ -3086,11 +3086,12 @@ void tcp_xmit_retransmit_queue(struct so*/ void sk_forced_mem_schedule (struct sock *sk,int size) { -int amt; +int delta, amt; -if (size <= sk->sk_forward_alloc) + delta = size - sk->sk_forward_alloc; +if (delta <=0 )return ; - amt =sk_mem_pages (size); + amt =sk_mem_pages (delta); sk->sk_forward_alloc += amt *SK_MEM_QUANTUM ;sk_memory_allocated_add (sk, amt);
Greg Kroah-Hartman
maintainerPATCH 170/229 scsi: sg: Allow waiting for commands to complete on removed device
In reply to Greg Kroah-HartmanFrom: Tony Battersby <[email protected]>
commit 3455607fd7be10b449f5135c00dc306b85dc0d21 upstream.
When a SCSI device is removed while in active use, currently sg will immediately return -ENODEV on any attempt to wait for active commands that were sent before the removal. This is problematic for commands that use SG_FLAG_DIRECT_IO since the data buffer may still be in use by the kernel when userspace frees or reuses it after getting ENODEV, leading to corrupted userspace memory (in the case of READ-type commands) or corrupted data being sent to the device (in the case of WRITE-type commands). This has been seen in practice when logging out of a iscsi_tcp session, where the iSCSI driver may still be processing commands after the device has been marked for removal.
Change the policy to allow userspace to wait for active sg commands even when the device is being removed. Return -ENODEV only when there are no more responses to read.
--- drivers/scsi/sg.c | 57 ++++++++++++++++++++++++++++++++---------------------- 1 file changed, 34 insertions(+), 23 deletions(-)
drivers/scsi/sg.c +34 -23
@@ -196,7 +196,7 @@ static void sg_link_reserve(Sg_fd * sfp,static void sg_unlink_reserve (Sg_fd * sfp,Sg_request * srp);static Sg_fd *sg_add_sfp (Sg_device * sdp);static void sg_remove_sfp (struct kref *); -static Sg_request *sg_get_rq_mark (Sg_fd * sfp,int pack_id); +static Sg_request *sg_get_rq_mark (Sg_fd * sfp,int pack_id,bool *busy);static Sg_request *sg_add_request (Sg_fd * sfp);static int sg_remove_request (Sg_fd * sfp,Sg_request * srp);static Sg_device *sg_get_dev (int dev);
@@ -418,6 +418,7 @@ sg_read(struct file *filp, char __user *Sg_fd *sfp;Sg_request *srp;int req_pack_id =-1 ; +bool busy;sg_io_hdr_t *hp;struct sg_header *old_hdr =NULL ;int retval =0 ;
@@ -465,25 +466,19 @@ sg_read(struct file *filp, char __user * }else req_pack_id = old_hdr->pack_id; } - srp =sg_get_rq_mark (sfp, req_pack_id); + srp =sg_get_rq_mark (sfp, req_pack_id, &busy);if (!srp) {/* now wait on packet to arrive */ -if (atomic_read (&sdp->detaching)) { - retval = -ENODEV ; - goto free_old_hdr; - }if (filp->f_flags &O_NONBLOCK ) { retval = -EAGAIN ; goto free_old_hdr; } retval =wait_event_interruptible (sfp->read_wait, - (atomic_read (&sdp->detaching) || - (srp =sg_get_rq_mark (sfp, req_pack_id)))); -if (atomic_read (&sdp->detaching)) { - retval = -ENODEV ; - goto free_old_hdr; - } -if (retval) { -/* -ERESTARTSYS as signal hit process */ + ((srp =sg_get_rq_mark (sfp, req_pack_id, &busy)) || + (!busy &&atomic_read (&sdp->detaching)))); +if (!srp) { +/* signal or detaching */ +if (!retval) + retval = -ENODEV ; goto free_old_hdr; } }
@@ -934,9 +929,7 @@ sg_ioctl(struct file *filp, unsigned intif (result <0 )return result; result =wait_event_interruptible (sfp->read_wait, - (srp_done (sfp, srp) ||atomic_read (&sdp->detaching))); -if (atomic_read (&sdp->detaching)) -return -ENODEV ; +srp_done (sfp, srp));write_lock_irq (&sfp->rq_list_lock);if (srp->done) { srp->done =2 ;
@@ -2096,19 +2089,28 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_reques }static Sg_request * -sg_get_rq_mark (Sg_fd * sfp,int pack_id) +sg_get_rq_mark (Sg_fd * sfp,int pack_id,bool *busy) {Sg_request *resp;unsigned long iflags; + *busy = false;write_lock_irqsave (&sfp->rq_list_lock, iflags);list_for_each_entry (resp, &sfp->rq_list, entry) { -/* look for requests that are ready + not SG_IO owned */ -if ((1 == resp->done) && (!resp->sg_io_owned) && +/* look for requests that are not SG_IO owned */ +if ((!resp->sg_io_owned) && ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { - resp->done =2 ;/* guard against other readers */ -write_unlock_irqrestore (&sfp->rq_list_lock, iflags); -return resp; +switch (resp->done) { +case 0 :/* request active */ + *busy = true; +break ; +case 1 :/* request done; response ready to return */ + resp->done =2 ;/* guard against other readers */ +write_unlock_irqrestore (&sfp->rq_list_lock, iflags); +return resp; +case 2 :/* response already being returned */ +break ; + } } }write_unlock_irqrestore (&sfp->rq_list_lock, iflags);
@@ -2162,6 +2164,15 @@ sg_remove_request(Sg_fd * sfp, Sg_reques res =1 ; }write_unlock_irqrestore (&sfp->rq_list_lock, iflags); + +/* +* If the device is detaching, wakeup any readers in case we just +* removed the last response, which would leave nothing for them to +* return other than -ENODEV. +*/ +if (unlikely (atomic_read (&sfp->parentdp->detaching))) +wake_up_interruptible_all (&sfp->read_wait); +return res; }
Greg Kroah-Hartman
maintainerPATCH 171/229 Revert "net: usb: ax88179_178a needs FLAG_SEND_ZLP"
In reply to Greg Kroah-HartmanFrom: Jose Alonso <[email protected]>
commit 6fd2c17fb6e02a8c0ab51df1cfec82ce96b8e83d upstream.
This reverts commit 36a15e1cb134c0395261ba1940762703f778438c.
The usage of FLAG_SEND_ZLP causes problems to other firmware/hardware versions that have no issues.
The FLAG_SEND_ZLP is not safe to use in this context. See:
https://patchwork.ozlabs.org/project/netdev/patch/1270599787.8900.8.camel@Linuxdev4-laptop/#118378
The original problem needs another way to solve.
--- drivers/net/usb/ax88179_178a.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-)
drivers/net/usb/ax88179_178a.c +8 -8
@@ -1707,7 +1707,7 @@ static const struct driver_info ax88179_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1720,7 +1720,7 @@ static const struct driver_info ax88178a .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1733,7 +1733,7 @@ static const struct driver_info cypress_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1746,7 +1746,7 @@ static const struct driver_info dlink_du .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1759,7 +1759,7 @@ static const struct driver_info sitecom_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1772,7 +1772,7 @@ static const struct driver_info samsung_ .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1785,7 +1785,7 @@ static const struct driver_info lenovo_i .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
@@ -1798,7 +1798,7 @@ static const struct driver_info belkin_i .link_reset = ax88179_link_reset, .reset = ax88179_reset, .stop = ax88179_stop, - .flags = FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, + .flags = FLAG_ETHER | FLAG_FRAMING_AX, .rx_fixup = ax88179_rx_fixup, .tx_fixup = ax88179_tx_fixup, };
Greg Kroah-Hartman
maintainerPATCH 172/229 Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
In reply to Greg Kroah-HartmanFrom: Luiz Augusto von Dentz <[email protected]>
commit 332f1795ca202489c665a75e62e18ff6284de077 upstream.
The patch d0be8347c623: "Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put" from Jul 21, 2022, leads to the following Smatch static checker warning:
net/bluetooth/l2cap_core.c:1977 l2cap_global_chan_by_psm()
error: we previously assumed 'c' could be null (see line 1996)
--- net/bluetooth/l2cap_core.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-)
net/bluetooth/l2cap_core.c +6 -7
@@ -1804,11 +1804,11 @@ static struct l2cap_chan *l2cap_global_c bdaddr_t *dst, u8 link_type) { -struct l2cap_chan *c, *c1 =NULL ; +struct l2cap_chan *c, *tmp, *c1 =NULL ;read_lock (&chan_list_lock); -list_for_each_entry (c, &chan_list, global_l) { +list_for_each_entry_safe (c, tmp, &chan_list, global_l) {if (state && c->state != state)continue ;
@@ -1827,11 +1827,10 @@ static struct l2cap_chan *l2cap_global_c dst_match = !bacmp (&c->dst, dst);if (src_match && dst_match) { c =l2cap_chan_hold_unless_zero (c); -if (!c) -continue ; - -read_unlock (&chan_list_lock); -return c; +if (c) { +read_unlock (&chan_list_lock); +return c; + } }/* Closest match */
Greg Kroah-Hartman
maintainerPATCH 173/229 net/9p: Initialize the iounit field during fid creation
In reply to Greg Kroah-HartmanFrom: Tyler Hicks <[email protected]>
commit aa7aeee169480e98cf41d83c01290a37e569be6d upstream.
Ensure that the fid's iounit field is set to zero when a new fid is created. Certain 9P operations, such as OPEN and CREATE, allow the server to reply with an iounit size which the client code assigns to the p9_fid struct shortly after the fid is created by p9_fid_create(). On the other hand, an XATTRWALK operation doesn't allow for the server to specify an iounit value. The iounit field of the newly allocated p9_fid struct remained uninitialized in that case. Depending on allocation patterns, the iounit value could have been something reasonable that was carried over from previously freed fids or, in the worst case, could have been arbitrary values from non-fid related usages of the memory location.
The bug was detected in the Windows Subsystem for Linux 2 (WSL2) kernel after the uninitialized iounit field resulted in the typical sequence of two getxattr(2) syscalls, one to get the size of an xattr and another after allocating a sufficiently sized buffer to fit the xattr value, to hit an unexpected ERANGE error in the second call to getxattr(2). An uninitialized iounit field would sometimes force rsize to be smaller than the xattr value size in p9_client_read_once() and the 9P server in WSL refused to chunk up the READ on the attr_fid and, instead, returned ERANGE to the client. The virtfs server in QEMU seems happy to chunk up the READ and this problem goes undetected there.
[tyhicks: Adjusted context due to:
- Lack of fid refcounting introduced in v5.11 commit 6636b6dcc3db ("9p:
add refcount to p9_fid struct")
- Difference in how buffer sizes are specified v5.16 commit 6e195b0f7c8e ("9p: fix a bunch of checkpatch warnings")
- Reimplementation of the fidlist as an IDR in v4.19 commit f28cdf0430fc ("9p: Replace the fidlist with an IDR")]
--- net/9p/client.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)
net/9p/client.c +1 -3
@@ -915,7 +915,7 @@ static struct p9_fid *p9_fid_create(struunsigned long flags;p9_debug (P9_DEBUG_FID ,"clnt %p\n" , clnt); - fid =kmalloc (sizeof (struct p9_fid ),GFP_KERNEL ); + fid =kzalloc (sizeof (struct p9_fid ),GFP_KERNEL );if (!fid)return ERR_PTR (-ENOMEM );
@@ -926,11 +926,9 @@ static struct p9_fid *p9_fid_create(stru } fid->fid = ret; -memset (&fid->qid,0 ,sizeof (struct p9_qid )); fid->mode =-1 ; fid->uid =current_fsuid (); fid->clnt = clnt; - fid->rdir =NULL ;spin_lock_irqsave (&clnt->lock, flags);list_add (&fid->flist, &clnt->fidlist);spin_unlock_irqrestore (&clnt->lock, flags);
Greg Kroah-Hartman
maintainerPATCH 174/229 net_sched: cls_route: disallow handle of 0
In reply to Greg Kroah-HartmanFrom: Jamal Hadi Salim <[email protected]>
commit 02799571714dc5dd6948824b9d080b44a295f695 upstream.
Follows up on:
https://lore.kernel.org/all/[email protected]/
handle of 0 implies from/to of universe realm which is not very sensible.
Lets see what this patch will do:
$sudo tc qdisc add dev $DEV root handle 1:0 prio
//lets manufacture a way to insert handle of 0
$sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 \
route to 0 from 0 classid 1:10 action ok
//gets rejected...
Error: handle of 0 is not valid.
We have an error talking to the kernel, -1
//lets create a legit entry..
sudo tc filter add dev $DEV parent 1:0 protocol ip prio 100 route from 10 \
classid 1:10 action ok
//what did the kernel insert?
$sudo tc filter ls dev $DEV parent 1:0
filter protocol ip pref 100 route chain 0
filter protocol ip pref 100 route chain 0 fh 0x000a8000 flowid 1:10 from 10
action order 1: gact action pass
random type none pass val 0
index 1 ref 1 bind 1
//Lets try to replace that legit entry with a handle of 0
$ sudo tc filter replace dev $DEV parent 1:0 protocol ip prio 100 \ handle 0x000a8000 route to 0 from 0 classid 1:10 action drop
Error: Replacing with handle of 0 is invalid.
We have an error talking to the kernel, -1
And last, lets run Cascardo's POC:
$ ./poc 0 0 -22 -22 -22
--- net/sched/cls_route.c | 6 ++++++ 1 file changed, 6 insertions(+)
net/sched/cls_route.c +6 -0
@@ -431,6 +431,9 @@ static int route4_set_parms(struct net *return -EINVAL ; } +if (!nhandle) +return -EINVAL ; + h1 =to_hash (nhandle); b =rtnl_dereference (head->table[h1]);if (!b) {
@@ -483,6 +486,9 @@ static int route4_change(struct net *netint err;bool new = true; +if (!handle) +return -EINVAL ; +if (opt ==NULL )return handle ? -EINVAL :0 ;
Greg Kroah-Hartman
maintainerPATCH 175/229 powerpc/ptdump: Fix display of RW pages on FSL_BOOK3E
In reply to Greg Kroah-HartmanFrom: Christophe Leroy <[email protected]>
commit dd8de84b57b02ba9c1fe530a6d916c0853f136bd upstream.
On FSL_BOOK3E, _PAGE_RW is defined with two bits, one for user and one for supervisor. As soon as one of the two bits is set, the page has to be display as RW. But the way it is implemented today requires both bits to be set in order to display it as RW.
Instead of display RW when _PAGE_RW bits are set and R otherwise, reverse the logic and display R when _PAGE_RW bits are all 0 and RW otherwise.
This change has no impact on other platforms as _PAGE_RW is a single bit on all of them.
--- arch/powerpc/mm/dump_linuxpagetables.c | 13 ++++--------- 1 file changed, 4 insertions(+), 9 deletions(-)
arch/powerpc/mm/dump_linuxpagetables.c +4 -9
@@ -123,15 +123,10 @@ static const struct flag_info flag_array .set = "user", .clear = " ", }, { -#if _PAGE_RO == 0 - .mask = _PAGE_RW, - .val = _PAGE_RW, -#else - .mask = _PAGE_RO, - .val = 0, -#endif - .set = "rw", - .clear = "ro", + .mask = _PAGE_RW | _PAGE_RO, + .val = _PAGE_RO, + .set = "ro", + .clear = "rw", }, { .mask = _PAGE_EXEC, .val = _PAGE_EXEC,
Greg Kroah-Hartman
maintainerPATCH 176/229 ALSA: info: Fix llseek return value when using callback
In reply to Greg Kroah-HartmanFrom: Amadeusz Sławiński <[email protected]>
commit 9be080edcca330be4af06b19916c35227891e8bc upstream.
When using callback there was a flow of
ret = -EINVAL
if (callback) {
offset = callback();
goto out;
}
...
offset = some other value in case of no callback;
ret = offset;
out:
return ret;which causes the snd_info_entry_llseek() to return -EINVAL when there is callback handler. Fix this by setting "ret" directly to callback return value before jumping to "out".
--- sound/core/info.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
sound/core/info.c +3 -3
@@ -127,9 +127,9 @@ static loff_t snd_info_entry_llseek(stru entry = data->entry;mutex_lock (&entry->access);if (entry->c.ops->llseek) { - offset = entry->c.ops->llseek (entry, - data->file_private_data, - file, offset, orig); + ret = entry->c.ops->llseek (entry, + data->file_private_data, + file, offset, orig); goto out; }
Greg Kroah-Hartman
maintainerPATCH 177/229 rds: add missing barrier to release_refill
In reply to Greg Kroah-HartmanFrom: Mikulas Patocka <[email protected]>
commit 9f414eb409daf4f778f011cf8266d36896bb930b upstream.
The functions clear_bit and set_bit do not imply a memory barrier, thus it may be possible that the waitqueue_active function (which does not take any locks) is moved before clear_bit and it could miss a wakeup event.
Fix this bug by adding a memory barrier after clear_bit.
--- net/rds/ib_recv.c | 1 + 1 file changed, 1 insertion(+)
net/rds/ib_recv.c +1 -0
@@ -362,6 +362,7 @@ static int acquire_refill(struct rds_constatic void release_refill (struct rds_connection *conn) {clear_bit (RDS_RECV_REFILL , &conn->c_flags); +smp_mb__after_atomic ();/* We don't use wait_on_bit()/wake_up_bit() because our waking is in a * hot path and finding waiters is very rare. We don't want to walk
Greg Kroah-Hartman
maintainerPATCH 178/229 ata: libata-eh: Add missing command name
In reply to Greg Kroah-HartmanFrom: Damien Le Moal <[email protected]>
commit d3122bf9aa4c974f5e2c0112f799757b3a2779da upstream.
Add the missing command name for ATA_CMD_NCQ_NON_DATA to ata_get_cmd_name().
--- drivers/ata/libata-eh.c | 1 + 1 file changed, 1 insertion(+)
drivers/ata/libata-eh.c +1 -0
@@ -2374,6 +2374,7 @@ const char *ata_get_cmd_descript(u8 comm { ATA_CMD_WRITE_QUEUED_FUA_EXT, "WRITE DMA QUEUED FUA EXT" }, { ATA_CMD_FPDMA_READ, "READ FPDMA QUEUED" }, { ATA_CMD_FPDMA_WRITE, "WRITE FPDMA QUEUED" }, + { ATA_CMD_NCQ_NON_DATA, "NCQ NON-DATA" }, { ATA_CMD_FPDMA_SEND, "SEND FPDMA QUEUED" }, { ATA_CMD_FPDMA_RECV, "RECEIVE FPDMA QUEUED" }, { ATA_CMD_PIO_READ, "READ SECTOR(S)" },
Greg Kroah-Hartman
maintainerPATCH 179/229 btrfs: fix lost error handling when looking up extended ref on log replay
In reply to Greg Kroah-HartmanFrom: Filipe Manana <[email protected]>
commit 7a6b75b79902e47f46328b57733f2604774fa2d9 upstream.
During log replay, when processing inode references, if we get an error when looking up for an extended reference at __add_inode_ref(), we ignore it and proceed, returning success (0) if no other error happens after the lookup. This is obviously wrong because in case an extended reference exists and it encodes some name not in the log, we need to unlink it, otherwise the filesystem state will not match the state it had after the last fsync.
So just make __add_inode_ref() return an error it gets from the extended reference lookup.
--- fs/btrfs/tree-log.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/btrfs/tree-log.c +3 -1
@@ -1100,7 +1100,9 @@ again: extref =btrfs_lookup_inode_extref (NULL , root, path, name, namelen, inode_objectid, parent_objectid,0 ,0 ); -if (!IS_ERR_OR_NULL (extref)) { +if (IS_ERR (extref)) { +return PTR_ERR (extref); + }else if (extref) {u32 item_size;u32 cur_offset =0 ;unsigned long base;
Greg Kroah-Hartman
maintainerPATCH 180/229 can: ems_usb: fix clangs -Wunaligned-access warning
In reply to Greg Kroah-HartmanFrom: Marc Kleine-Budde <[email protected]>
commit a4cb6e62ea4d36e53fb3c0f18ea4503d7b76674f upstream.
clang emits a -Wunaligned-access warning on struct __packed ems_cpc_msg.
The reason is that the anonymous union msg (not declared as packed) is being packed right after some non naturally aligned variables (3*8 bits + 2*32) inside a packed struct:
| struct __packed ems_cpc_msg {
| u8 type; /* type of message */
| u8 length; /* length of data within union 'msg' */
| u8 msgid; /* confirmation handle */
| __le32 ts_sec; /* timestamp in seconds */
| __le32 ts_nsec; /* timestamp in nano seconds */
| /* ^ not naturally aligned */
|
| union {
| /* ^ not declared as packed */
| u8 generic[64];
| struct cpc_can_msg can_msg;
| struct cpc_can_params can_params;
| struct cpc_confirm confirmation;
| struct cpc_overrun overrun;
| struct cpc_can_error error;
| struct cpc_can_err_counter err_counter;
| u8 can_state;
| } msg;
| };Starting from LLVM 14, having an unpacked struct nested in a packed struct triggers a warning. c.f. [1].
Fix the warning by marking the anonymous union as packed.
[1] https://github.com/llvm/llvm-project/issues/55520
--- drivers/net/can/usb/ems_usb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/net/can/usb/ems_usb.c +1 -1
@@ -206,7 +206,7 @@ struct __packed ems_cpc_msg {__le32 ts_sec;/* timestamp in seconds */ __le32 ts_nsec;/* timestamp in nano seconds */ -union { +union __packed {u8 generic[64 ];struct cpc_can_msg can_msg;struct cpc_can_params can_params;
Greg Kroah-Hartman
maintainerPATCH 181/229 apparmor: fix quiet_denied for file rules
In reply to Greg Kroah-HartmanFrom: John Johansen <[email protected]>
commit 68ff8540cc9e4ab557065b3f635c1ff4c96e1f1c upstream.
Global quieting of denied AppArmor generated file events is not handled correctly. Unfortunately the is checking if quieting of all audit events is set instead of just denied events.
--- security/apparmor/audit.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
security/apparmor/audit.c +1 -1
@@ -143,7 +143,7 @@ int aa_audit(int type, struct aa_profile }if (AUDIT_MODE (profile) ==AUDIT_QUIET || (type ==AUDIT_APPARMOR_DENIED && -AUDIT_MODE (profile) ==AUDIT_QUIET )) +AUDIT_MODE (profile) ==AUDIT_QUIET_DENIED ))return aad (sa)->error;if (KILL_MODE (profile) && type ==AUDIT_APPARMOR_DENIED )
Greg Kroah-Hartman
maintainerPATCH 182/229 apparmor: Fix failed mount permission check error message
In reply to Greg Kroah-HartmanFrom: John Johansen <[email protected]>
commit ec240b5905bbb09a03dccffee03062cf39e38dc2 upstream.
When the mount check fails due to a permission check failure instead of explicitly at one of the subcomponent checks, AppArmor is reporting a failure in the flags match. However this is not true and AppArmor can not attribute the error at this point to any particular component, and should only indicate the mount failed due to missing permissions.
--- security/apparmor/mount.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
security/apparmor/mount.c +4 -3
@@ -233,7 +233,8 @@ static const char * const mnt_info_table"failed srcname match" ,"failed type match" ,"failed flags match" , - "failed data match" +"failed data match" , + "failed perms check" };/*
@@ -288,8 +289,8 @@ static int do_match_mnt(struct aa_dfa *dreturn 0 ; } -/* failed at end of flags match */ -return 4 ; +/* failed at perms check, don't confuse with flags match */ +return 6 ; }
Greg Kroah-Hartman
maintainerPATCH 183/229 apparmor: fix aa_label_asxprint return check
In reply to Greg Kroah-HartmanFrom: Tom Rix <[email protected]>
commit 3e2a3a0830a2090e766d0d887d52c67de2a6f323 upstream.
Clang static analysis reports this issue label.c:1802:3: warning: 2nd function call argument
is an uninitialized value
pr_info("%s", str);
^~~~~~~~~~~~~~~~~~
str is set from a successful call to aa_label_asxprint(&str, ...) On failure a negative value is returned, not a -1. So change the check.
--- security/apparmor/label.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
security/apparmor/label.c +3 -3
@@ -1722,7 +1722,7 @@ void aa_label_xaudit(struct audit_bufferif (!use_label_hname (ns, label, flags) ||display_mode (ns, label, flags)) { len =aa_label_asxprint (&name, ns, label, flags, gfp); -if (len ==-1 ) { +if (len <0 ) {AA_DEBUG ("label print error" );return ; }
@@ -1750,7 +1750,7 @@ void aa_label_seq_xprint(struct seq_fileint len; len =aa_label_asxprint (&str, ns, label, flags, gfp); -if (len ==-1 ) { +if (len <0 ) {AA_DEBUG ("label print error" );return ; }
@@ -1773,7 +1773,7 @@ void aa_label_xprintk(struct aa_ns *ns,int len; len =aa_label_asxprint (&str, ns, label, flags, gfp); -if (len ==-1 ) { +if (len <0 ) {AA_DEBUG ("label print error" );return ; }
Greg Kroah-Hartman
maintainerPATCH 184/229 apparmor: fix reference count leak in aa_pivotroot()
In reply to Greg Kroah-HartmanFrom: Xin Xiong <[email protected]>
commit 11c3627ec6b56c1525013f336f41b79a983b4d46 upstream.
The aa_pivotroot() function has a reference counting bug in a specific path. When aa_replace_current_label() returns on success, the function forgets to decrement the reference count of “target”, which is increased earlier by build_pivotroot(), causing a reference leak.
Fix it by decreasing the refcount of “target” in that path.
--- security/apparmor/mount.c | 1 + 1 file changed, 1 insertion(+)
security/apparmor/mount.c +1 -0
@@ -687,6 +687,7 @@ int aa_pivotroot(struct aa_label *label,aa_put_label (target); goto out; } +aa_put_label (target); }else /* already audited error */ error =PTR_ERR (target);
Greg Kroah-Hartman
maintainerPATCH 185/229 NFSv4: Fix races in the legacy idmapper upcall
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 51fd2eb52c0ca8275a906eed81878ef50ae94eb0 upstream.
nfs_idmap_instantiate() will cause the process that is waiting in request_key_with_auxdata() to wake up and exit. If there is a second process waiting for the idmap->idmap_mutex, then it may wake up and start a new call to request_key_with_auxdata(). If the call to idmap_pipe_downcall() from the first process has not yet finished calling nfs_idmap_complete_pipe_upcall_locked(), then we may end up triggering the WARN_ON_ONCE() in nfs_idmap_prepare_pipe_upcall().
The fix is to ensure that we clear idmap->idmap_upcall_data before calling nfs_idmap_instantiate().
--- fs/nfs/nfs4idmap.c | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-)
fs/nfs/nfs4idmap.c +24 -22
@@ -543,22 +543,20 @@ nfs_idmap_prepare_pipe_upcall(struct idmreturn true; } -static void -nfs_idmap_complete_pipe_upcall_locked (struct idmap *idmap,int ret) +static void nfs_idmap_complete_pipe_upcall (struct idmap_legacy_upcalldata *data, +int ret) { -struct key *authkey = idmap->idmap_upcall_data->authkey; - -kfree (idmap->idmap_upcall_data); - idmap->idmap_upcall_data =NULL ; -complete_request_key (authkey, ret); -key_put (authkey); +complete_request_key (data->authkey, ret); +key_put (data->authkey); +kfree (data); } -static void -nfs_idmap_abort_pipe_upcall (struct idmap *idmap,int ret) +static void nfs_idmap_abort_pipe_upcall (struct idmap *idmap, +struct idmap_legacy_upcalldata *data, +int ret) { -if (idmap->idmap_upcall_data !=NULL ) -nfs_idmap_complete_pipe_upcall_locked (idmap, ret); +if (cmpxchg (&idmap->idmap_upcall_data, data,NULL ) == data) +nfs_idmap_complete_pipe_upcall (data, ret); }static int nfs_idmap_legacy_upcall (struct key *authkey,void *aux)
@@ -595,7 +593,7 @@ static int nfs_idmap_legacy_upcall(struc ret =rpc_queue_upcall (idmap->idmap_pipe, msg);if (ret <0 ) -nfs_idmap_abort_pipe_upcall (idmap, ret); +nfs_idmap_abort_pipe_upcall (idmap, data, ret);return ret; out2:
@@ -651,6 +649,7 @@ idmap_pipe_downcall(struct file *filp, cstruct request_key_auth *rka;struct rpc_inode *rpci =RPC_I (file_inode (filp));struct idmap *idmap = (struct idmap *)rpci->private; +struct idmap_legacy_upcalldata *data;struct key *authkey;struct idmap_msg im;size_t namelen_in;
@@ -660,10 +659,11 @@ idmap_pipe_downcall(struct file *filp, c* will have been woken up and someone else may now have used * idmap_key_cons - so after this point we may no longer touch it. */ -if (idmap->idmap_upcall_data ==NULL ) + data =xchg (&idmap->idmap_upcall_data,NULL ); +if (data ==NULL ) goto out_noupcall; - authkey = idmap->idmap_upcall_data->authkey; + authkey = data->authkey; rka =get_request_key_auth (authkey);if (mlen !=sizeof (im)) {
@@ -685,18 +685,17 @@ idmap_pipe_downcall(struct file *filp, cif (namelen_in ==0 || namelen_in ==IDMAP_NAMESZ ) { ret = -EINVAL ; goto out; -} + } - ret =nfs_idmap_read_and_verify_message (&im, - &idmap->idmap_upcall_data->idmap_msg, - rka->target_key, authkey); + ret =nfs_idmap_read_and_verify_message (&im, &data->idmap_msg, + rka->target_key, authkey);if (ret >=0 ) {key_set_timeout (rka->target_key, nfs_idmap_cache_timeout); ret = mlen; } out: -nfs_idmap_complete_pipe_upcall_locked (idmap, ret); +nfs_idmap_complete_pipe_upcall (data, ret); out_noupcall:return ret; }
@@ -710,7 +709,7 @@ idmap_pipe_destroy_msg(struct rpc_pipe_mstruct idmap *idmap = data->idmap;if (msg->errno) -nfs_idmap_abort_pipe_upcall (idmap, msg->errno); +nfs_idmap_abort_pipe_upcall (idmap, data, msg->errno); } static void
@@ -718,8 +717,11 @@ idmap_release_pipe(struct inode *inode) {struct rpc_inode *rpci =RPC_I (inode);struct idmap *idmap = (struct idmap *)rpci->private; +struct idmap_legacy_upcalldata *data; -nfs_idmap_abort_pipe_upcall (idmap, -EPIPE ); + data =xchg (&idmap->idmap_upcall_data,NULL ); +if (data) +nfs_idmap_complete_pipe_upcall (data, -EPIPE ); }int nfs_map_name_to_uid (const struct nfs_server *server,const char *name,size_t namelen,kuid_t *uid)
Greg Kroah-Hartman
maintainerPATCH 186/229 NFSv4.1: RECLAIM_COMPLETE must handle EACCES
In reply to Greg Kroah-HartmanFrom: Zhang Xianwei <[email protected]>
commit e35a5e782f67ed76a65ad0f23a484444a95f000f upstream.
A client should be able to handle getting an EACCES error while doing a mount operation to reclaim state due to NFS4CLNT_RECLAIM_REBOOT being set. If the server returns RPC_AUTH_BADCRED because authentication failed when we execute "exportfs -au", then RECLAIM_COMPLETE will go a wrong way. After mount succeeds, all OPEN call will fail due to an NFS4ERR_GRACE error being returned. This patch is to fix it by resending a RPC request.
--- fs/nfs/nfs4proc.c | 3 +++ 1 file changed, 3 insertions(+)
fs/nfs/nfs4proc.c +3 -0
@@ -8371,6 +8371,9 @@ static int nfs41_reclaim_complete_handlerpc_delay (task,NFS4_POLL_RETRY_MAX );/* fall through */ case -NFS4ERR_RETRY_UNCACHED_REP : +case -EACCES : +dprintk ("%s: failed to reclaim complete error %d for server %s, retrying\n" , + __func__, task->tk_status, clp->cl_hostname);return -EAGAIN ;case -NFS4ERR_BADSESSION :case -NFS4ERR_DEADSESSION :
Greg Kroah-Hartman
maintainerPATCH 187/229 SUNRPC: Reinitialise the backchannel request buffers before reuse
In reply to Greg Kroah-HartmanFrom: Trond Myklebust <[email protected]>
commit 6622e3a73112fc336c1c2c582428fb5ef18e456a upstream.
When we're reusing the backchannel requests instead of freeing them, then we should reinitialise any values of the send/receive xdr_bufs so that they reflect the available space.
--- net/sunrpc/backchannel_rqst.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
net/sunrpc/backchannel_rqst.c +14 -0
@@ -69,6 +69,17 @@ static void xprt_free_allocation(structkfree (req); } +static void xprt_bc_reinit_xdr_buf (struct xdr_buf *buf) +{ + buf->head[0 ].iov_len =PAGE_SIZE ; + buf->tail[0 ].iov_len =0 ; + buf->pages =NULL ; + buf->page_len =0 ; + buf->flags =0 ; + buf->len =0 ; + buf->buflen =PAGE_SIZE ; +} +static int xprt_alloc_xdr_buf (struct xdr_buf *buf,gfp_t gfp_flags) {struct page *page;
@@ -291,6 +302,9 @@ void xprt_free_bc_rqst(struct rpc_rqst **/ spin_lock_bh (&xprt->bc_pa_lock);if (xprt_need_to_requeue (xprt)) { +xprt_bc_reinit_xdr_buf (&req->rq_snd_buf); +xprt_bc_reinit_xdr_buf (&req->rq_rcv_buf); + req->rq_rcv_buf.len =PAGE_SIZE ;list_add_tail (&req->rq_bc_pa_list, &xprt->bc_pa_list); xprt->bc_alloc_count++; req =NULL ;