* [PATCH 3.2 075/147] sch_tbf: fix two null pointer dereferences on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 123/147] platform/x86: samsung-laptop: Initialize loca variable Ben Hutchings
` (146 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Nikolay Aleksandrov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit c2d6511e6a4f1f3673d711569c00c3849549e9b0 upstream.
sch_tbf calls qdisc_watchdog_cancel() in both its ->reset and ->destroy
callbacks but it may fail before the timer is initialized due to missing
options (either not supplied by user-space or set as a default qdisc),
also q->qdisc is used by ->reset and ->destroy so we need it initialized.
Reproduce:
$ sysctl net.core.default_qdisc=tbf
$ ip l set ethX up
Crash log:
[ 959.160172] BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
[ 959.160323] IP: qdisc_reset+0xa/0x5c
[ 959.160400] PGD 59cdb067
[ 959.160401] P4D 59cdb067
[ 959.160466] PUD 59ccb067
[ 959.160532] PMD 0
[ 959.160597]
[ 959.160706] Oops: 0000 [#1] SMP
[ 959.160778] Modules linked in: sch_tbf sch_sfb sch_prio sch_netem
[ 959.160891] CPU: 2 PID: 1562 Comm: ip Not tainted 4.13.0-rc6+ #62
[ 959.160998] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 959.161157] task: ffff880059c9a700 task.stack: ffff8800376d0000
[ 959.161263] RIP: 0010:qdisc_reset+0xa/0x5c
[ 959.161347] RSP: 0018:ffff8800376d3610 EFLAGS: 00010286
[ 959.161531] RAX: ffffffffa001b1dd RBX: ffff8800373a2800 RCX: 0000000000000000
[ 959.161733] RDX: ffffffff8215f160 RSI: ffffffff8215f160 RDI: 0000000000000000
[ 959.161939] RBP: ffff8800376d3618 R08: 00000000014080c0 R09: 00000000ffffffff
[ 959.162141] R10: ffff8800376d3578 R11: 0000000000000020 R12: ffffffffa001d2c0
[ 959.162343] R13: ffff880037538000 R14: 00000000ffffffff R15: 0000000000000001
[ 959.162546] FS: 00007fcc5126b740(0000) GS:ffff88005d900000(0000) knlGS:0000000000000000
[ 959.162844] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 959.163030] CR2: 0000000000000018 CR3: 000000005abc4000 CR4: 00000000000406e0
[ 959.163233] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 959.163436] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 959.163638] Call Trace:
[ 959.163788] tbf_reset+0x19/0x64 [sch_tbf]
[ 959.163957] qdisc_destroy+0x8b/0xe5
[ 959.164119] qdisc_create_dflt+0x86/0x94
[ 959.164284] ? dev_activate+0x129/0x129
[ 959.164449] attach_one_default_qdisc+0x36/0x63
[ 959.164623] netdev_for_each_tx_queue+0x3d/0x48
[ 959.164795] dev_activate+0x4b/0x129
[ 959.164957] __dev_open+0xe7/0x104
[ 959.165118] __dev_change_flags+0xc6/0x15c
[ 959.165287] dev_change_flags+0x25/0x59
[ 959.165451] do_setlink+0x30c/0xb3f
[ 959.165613] ? check_chain_key+0xb0/0xfd
[ 959.165782] rtnl_newlink+0x3a4/0x729
[ 959.165947] ? rtnl_newlink+0x117/0x729
[ 959.166121] ? ns_capable_common+0xd/0xb1
[ 959.166288] ? ns_capable+0x13/0x15
[ 959.166450] rtnetlink_rcv_msg+0x188/0x197
[ 959.166617] ? rcu_read_unlock+0x3e/0x5f
[ 959.166783] ? rtnl_newlink+0x729/0x729
[ 959.166948] netlink_rcv_skb+0x6c/0xce
[ 959.167113] rtnetlink_rcv+0x23/0x2a
[ 959.167273] netlink_unicast+0x103/0x181
[ 959.167439] netlink_sendmsg+0x326/0x337
[ 959.167607] sock_sendmsg_nosec+0x14/0x3f
[ 959.167772] sock_sendmsg+0x29/0x2e
[ 959.167932] ___sys_sendmsg+0x209/0x28b
[ 959.168098] ? do_raw_spin_unlock+0xcd/0xf8
[ 959.168267] ? _raw_spin_unlock+0x27/0x31
[ 959.168432] ? __handle_mm_fault+0x651/0xdb1
[ 959.168602] ? check_chain_key+0xb0/0xfd
[ 959.168773] __sys_sendmsg+0x45/0x63
[ 959.168934] ? __sys_sendmsg+0x45/0x63
[ 959.169100] SyS_sendmsg+0x19/0x1b
[ 959.169260] entry_SYSCALL_64_fastpath+0x23/0xc2
[ 959.169432] RIP: 0033:0x7fcc5097e690
[ 959.169592] RSP: 002b:00007ffd0d5c7b48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 959.169887] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007fcc5097e690
[ 959.170089] RDX: 0000000000000000 RSI: 00007ffd0d5c7b90 RDI: 0000000000000003
[ 959.170292] RBP: ffff8800376d3f98 R08: 0000000000000001 R09: 0000000000000003
[ 959.170494] R10: 00007ffd0d5c7910 R11: 0000000000000246 R12: 0000000000000006
[ 959.170697] R13: 000000000066f1a0 R14: 00007ffd0d5cfc40 R15: 0000000000000000
[ 959.170900] ? trace_hardirqs_off_caller+0xa7/0xcf
[ 959.171076] Code: 00 41 c7 84 24 14 01 00 00 00 00 00 00 41 c7 84 24
98 00 00 00 00 00 00 00 41 5c 41 5d 41 5e 5d c3 66 66 66 66 90 55 48 89
e5 53 <48> 8b 47 18 48 89 fb 48 8b 40 48 48 85 c0 74 02 ff d0 48 8b bb
[ 959.171637] RIP: qdisc_reset+0xa/0x5c RSP: ffff8800376d3610
[ 959.171821] CR2: 0000000000000018
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Fixes: 0fbbeb1ba43b ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_tbf.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -316,12 +316,13 @@ static int tbf_init(struct Qdisc *sch, s
{
struct tbf_sched_data *q = qdisc_priv(sch);
+ qdisc_watchdog_init(&q->watchdog, sch);
+ q->qdisc = &noop_qdisc;
+
if (opt == NULL)
return -EINVAL;
q->t_c = psched_get_time();
- qdisc_watchdog_init(&q->watchdog, sch);
- q->qdisc = &noop_qdisc;
return tbf_change(sch, opt);
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 123/147] platform/x86: samsung-laptop: Initialize loca variable
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 075/147] sch_tbf: fix two null pointer dereferences on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 096/147] ACPICA: Fix 'may be used uninitialized' warning in acpi_ns_repair_object() Ben Hutchings
` (145 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Andy Shevchenko, Geert Uytterhoeven
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 0d2c95354a3b63256e92d9fb865c08902d2c9b0b upstream.
The variable is used uninitialized which might come into unexpected
behaviour on some Samsung laptops.
Initialize it to 0xffff which seems a proper value for non-supported
feature.
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/platform/x86/samsung-laptop.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -601,7 +601,7 @@ static int __init samsung_init(void)
struct sabi_retval sretval;
unsigned int ifaceP;
int i;
- int loca;
+ int loca = 0xffff;
int retval;
if (efi_enabled(EFI_BOOT))
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 096/147] ACPICA: Fix 'may be used uninitialized' warning in acpi_ns_repair_object()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 075/147] sch_tbf: fix two null pointer dereferences on init failure Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 123/147] platform/x86: samsung-laptop: Initialize loca variable Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 113/147] IB/mlx4: Fix compiler warning about uninitialized 'vlan' variable Ben Hutchings
` (144 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
gcc 4.7 warns that new_object may be used uninitialized in this
function. In fact, all the cases where it's not initialised are
errors that will result in returning early without using it.
Silence the warning by initialising to NULL.
This was done upstream as part of commit d5a36100f62f "ACPICA: Add
mechanism for early object repairs on a per-name basis".
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/acpi/acpica/nsrepair.c
+++ b/drivers/acpi/acpica/nsrepair.c
@@ -121,7 +121,7 @@ acpi_ns_repair_object(struct acpi_predef
union acpi_operand_object **return_object_ptr)
{
union acpi_operand_object *return_object = *return_object_ptr;
- union acpi_operand_object *new_object;
+ union acpi_operand_object *new_object = NULL;
acpi_status status;
ACPI_FUNCTION_NAME(ns_repair_object);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 113/147] IB/mlx4: Fix compiler warning about uninitialized 'vlan' variable
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (2 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 096/147] ACPICA: Fix 'may be used uninitialized' warning in acpi_ns_repair_object() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 140/147] [SCSI] libsas: prevent double completion of scmds from eh Ben Hutchings
` (143 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul Bolle, Roland Dreier
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <pebolle@tiscali.nl>
commit 57d88cffc83a2120266bbe9e72cbba5bd5f33675 upstream.
Building qp.o triggers this gcc warning:
drivers/infiniband/hw/mlx4/qp.c: In function ‘mlx4_ib_post_send’:
drivers/infiniband/hw/mlx4/qp.c:1862:62: warning: ‘vlan’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/infiniband/hw/mlx4/qp.c:1752:6: note: ‘vlan’ was declared here
Looking at the code it is clear 'vlan' is only set and used if 'is_eth'
is non-zero. But by initializing 'vlan' to 0xffff, on
gcc (Ubuntu 4.7.2-22ubuntu1) 4.7.2
on x86-64 at least, we fix the warning, and the compiler was already
setting 'vlan' to 0 in the generated code, so there's no real downside.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
[ Get rid of unnecessary move of 'is_vlan' initialization. - Roland ]
Signed-off-by: Roland Dreier <roland@purestorage.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/hw/mlx4/qp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1363,7 +1363,7 @@ static int build_mlx_header(struct mlx4_
int is_eth;
int is_vlan = 0;
int is_grh;
- u16 vlan;
+ u16 vlan = 0xffff;
send_size = 0;
for (i = 0; i < wr->num_sge; ++i)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 140/147] [SCSI] libsas: prevent double completion of scmds from eh
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (3 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 113/147] IB/mlx4: Fix compiler warning about uninitialized 'vlan' variable Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 116/147] [media] xc4000: Fix a few warnings Ben Hutchings
` (142 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, James Bottomley, Dan Williams
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Williams <dan.j.williams@intel.com>
commit a3a142524aa4b1539a64a55087bf12ffa4b1f94e upstream.
We invoke task->task_done() to free the task in the eh case, but at this
point we are prepared for scsi_eh_flush_done_q() to finish off the scmd.
Introduce sas_end_task() to capture the final response status from the
lldd and free the task.
Also take the opportunity to kill this warning.
drivers/scsi/libsas/sas_scsi_host.c: In function ‘sas_end_task’:
drivers/scsi/libsas/sas_scsi_host.c:102:3: warning: case value ‘2’ not in enumerated type ‘enum exec_status’ [-Wswitch]
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/libsas/sas_scsi_host.c | 61 ++++++++++++++++++++-----------------
include/scsi/libsas.h | 5 ++-
2 files changed, 37 insertions(+), 29 deletions(-)
--- a/drivers/scsi/libsas/sas_scsi_host.c
+++ b/drivers/scsi/libsas/sas_scsi_host.c
@@ -49,27 +49,12 @@
#include <linux/scatterlist.h>
#include <linux/libata.h>
-/* ---------- SCSI Host glue ---------- */
-
-static void sas_scsi_task_done(struct sas_task *task)
+/* record final status and free the task */
+static void sas_end_task(struct scsi_cmnd *sc, struct sas_task *task)
{
struct task_status_struct *ts = &task->task_status;
- struct scsi_cmnd *sc = task->uldd_task;
int hs = 0, stat = 0;
- if (unlikely(task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
- /* Aborted tasks will be completed by the error handler */
- SAS_DPRINTK("task done but aborted\n");
- return;
- }
-
- if (unlikely(!sc)) {
- SAS_DPRINTK("task_done called with non existing SCSI cmnd!\n");
- list_del_init(&task->list);
- sas_free_task(task);
- return;
- }
-
if (ts->resp == SAS_TASK_UNDELIVERED) {
/* transport error */
hs = DID_NO_CONNECT;
@@ -124,10 +109,32 @@ static void sas_scsi_task_done(struct sa
break;
}
}
- ASSIGN_SAS_TASK(sc, NULL);
+
sc->result = (hs << 16) | stat;
+ ASSIGN_SAS_TASK(sc, NULL);
list_del_init(&task->list);
sas_free_task(task);
+}
+
+static void sas_scsi_task_done(struct sas_task *task)
+{
+ struct scsi_cmnd *sc = task->uldd_task;
+
+ if (unlikely(task->task_state_flags & SAS_TASK_STATE_ABORTED)) {
+ /* Aborted tasks will be completed by the error handler */
+ SAS_DPRINTK("task done but aborted\n");
+ return;
+ }
+
+ if (unlikely(!sc)) {
+ SAS_DPRINTK("task_done called with non existing SCSI cmnd!\n");
+ list_del_init(&task->list);
+ sas_free_task(task);
+ return;
+ }
+
+ ASSIGN_SAS_TASK(sc, NULL);
+ sas_end_task(sc, task);
sc->scsi_done(sc);
}
@@ -238,18 +245,16 @@ static void sas_eh_finish_cmd(struct scs
struct sas_task *task = TO_SAS_TASK(cmd);
struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host);
- /* remove the aborted task flag to allow the task to be
- * completed now. At this point, we only get called following
- * an actual abort of the task, so we should be guaranteed not
- * to be racing with any completions from the LLD (hence we
- * don't need the task state lock to clear the flag) */
- task->task_state_flags &= ~SAS_TASK_STATE_ABORTED;
- /* Now call task_done. However, task will be free'd after
- * this */
- task->task_done(task);
+ /* At this point, we only get called following an actual abort
+ * of the task, so we should be guaranteed not to be racing with
+ * any completions from the LLD. Task is freed after this.
+ */
+ sas_end_task(cmd, task);
+
/* now finish the command and move it on to the error
* handler done list, this also takes it off the
- * error handler pending list */
+ * error handler pending list.
+ */
scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q);
}
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -449,7 +449,10 @@ enum service_response {
};
enum exec_status {
- /* The SAM_STAT_.. codes fit in the lower 6 bits */
+ /* The SAM_STAT_.. codes fit in the lower 6 bits, alias some of
+ * them here to silence 'case value not in enumerated type' warnings
+ */
+ __SAM_STAT_CHECK_CONDITION = SAM_STAT_CHECK_CONDITION,
SAS_DEV_NO_RESPONSE = 0x80,
SAS_DATA_UNDERRUN,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 116/147] [media] xc4000: Fix a few warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (4 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 140/147] [SCSI] libsas: prevent double completion of scmds from eh Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 017/147] perf/core: Invert perf_read_group() loops Ben Hutchings
` (141 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@redhat.com>
commit 0d0d76e5bcd70439b0e736a99539d7eef4f87baf upstream.
drivers/media/tuners/xc4000.c: In function ‘check_firmware’:
drivers/media/tuners/xc4000.c:1048:45: warning: ‘fw_minor’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1048:39: warning: ‘fw_major’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1062:39: warning: ‘hw_minor’ may be used uninitialized in this function [-Wmaybe-uninitialized]
drivers/media/tuners/xc4000.c:1062:33: warning: ‘hw_major’ may be used uninitialized in this function [-Wmaybe-uninitialized]
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/common/tuners/xc4000.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/common/tuners/xc4000.c
+++ b/drivers/media/common/tuners/xc4000.c
@@ -923,7 +923,7 @@ static int check_firmware(struct dvb_fro
int rc = 0, is_retry = 0;
u16 hwmodel;
v4l2_std_id std0;
- u8 hw_major, hw_minor, fw_major, fw_minor;
+ u8 hw_major = 0, hw_minor = 0, fw_major = 0, fw_minor = 0;
dprintk(1, "%s called\n", __func__);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 017/147] perf/core: Invert perf_read_group() loops
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (5 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 116/147] [media] xc4000: Fix a few warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 036/147] audit: Fix use after free in audit_remove_watch_rule() Ben Hutchings
` (140 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Thomas Gleixner, Sukadev Bhattiprolu,
Arnaldo Carvalho de Melo, Michael Ellerman, Peter Zijlstra,
Arnaldo Carvalho de Melo, Jiri Olsa, Stephane Eranian,
Vince Weaver, Linus Torvalds, Ingo Molnar
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit fa8c269353d560b7c28119ad7617029f92e40b15 upstream.
In order to enable the use of perf_event_read(.group = true), we need
to invert the sibling-child loop nesting of perf_read_group().
Currently we iterate the child list for each sibling, this precludes
using group reads. Flip things around so we iterate each group for
each child.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
[ Made the patch compile and things. ]
Signed-off-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Link: http://lkml.kernel.org/r/1441336073-22750-7-git-send-email-sukadev@linux.vnet.ibm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2 as a dependency of commit 2aeb18835476 ("perf/core: Fix
locking for children siblings group read"):
- Keep the function name perf_event_read_group()
- Keep using perf_event_read_value()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3277,50 +3277,71 @@ u64 perf_event_read_value(struct perf_ev
}
EXPORT_SYMBOL_GPL(perf_event_read_value);
-static int perf_event_read_group(struct perf_event *event,
- u64 read_format, char __user *buf)
+static void __perf_read_group_add(struct perf_event *leader,
+ u64 read_format, u64 *values)
{
- struct perf_event *leader = event->group_leader, *sub;
- struct perf_event_context *ctx = leader->ctx;
- int n = 0, size = 0, ret;
+ struct perf_event *sub;
+ int n = 1; /* skip @nr */
u64 count, enabled, running;
- u64 values[5];
-
- lockdep_assert_held(&ctx->mutex);
count = perf_event_read_value(leader, &enabled, &running);
- values[n++] = 1 + leader->nr_siblings;
+ /*
+ * Since we co-schedule groups, {enabled,running} times of siblings
+ * will be identical to those of the leader, so we only publish one
+ * set.
+ */
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
values[n++] = enabled;
if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
values[n++] = running;
- values[n++] = count;
+
+ /*
+ * Write {count,id} tuples for every sibling.
+ */
+ values[n++] += count;
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(leader);
- size = n * sizeof(u64);
-
- if (copy_to_user(buf, values, size))
- return -EFAULT;
-
- ret = size;
-
list_for_each_entry(sub, &leader->sibling_list, group_entry) {
- n = 0;
-
values[n++] = perf_event_read_value(sub, &enabled, &running);
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(sub);
+ }
+}
- size = n * sizeof(u64);
+static int perf_event_read_group(struct perf_event *event,
+ u64 read_format, char __user *buf)
+{
+ struct perf_event *leader = event->group_leader, *child;
+ struct perf_event_context *ctx = leader->ctx;
+ int ret = event->read_size;
+ u64 *values;
- if (copy_to_user(buf + ret, values, size)) {
- return -EFAULT;
- }
+ lockdep_assert_held(&ctx->mutex);
- ret += size;
- }
+ values = kzalloc(event->read_size, GFP_KERNEL);
+ if (!values)
+ return -ENOMEM;
+
+ values[0] = 1 + leader->nr_siblings;
+
+ /*
+ * By locking the child_mutex of the leader we effectively
+ * lock the child list of all siblings.. XXX explain how.
+ */
+ mutex_lock(&leader->child_mutex);
+
+ __perf_read_group_add(leader, read_format, values);
+ list_for_each_entry(child, &leader->child_list, child_list)
+ __perf_read_group_add(child, read_format, values);
+
+ mutex_unlock(&leader->child_mutex);
+
+ if (copy_to_user(buf, values, event->read_size))
+ ret = -EFAULT;
+
+ kfree(values);
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 036/147] audit: Fix use after free in audit_remove_watch_rule()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (6 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 017/147] perf/core: Invert perf_read_group() loops Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 143/147] am2150: Update nmclan_cs.c to use update PCMCIA API Ben Hutchings
` (139 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tony Jones, Jan Kara, Paul Moore
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit d76036ab47eafa6ce52b69482e91ca3ba337d6d6 upstream.
audit_remove_watch_rule() drops watch's reference to parent but then
continues to work with it. That is not safe as parent can get freed once
we drop our reference. The following is a trivial reproducer:
mount -o loop image /mnt
touch /mnt/file
auditctl -w /mnt/file -p wax
umount /mnt
auditctl -D
<crash in fsnotify_destroy_mark()>
Grab our own reference in audit_remove_watch_rule() earlier to make sure
mark does not get freed under us.
Reported-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Tested-by: Tony Jones <tonyj@suse.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/audit_watch.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -471,13 +471,15 @@ void audit_remove_watch_rule(struct audi
list_del(&krule->rlist);
if (list_empty(&watch->rules)) {
+ /*
+ * audit_remove_watch() drops our reference to 'parent' which
+ * can get freed. Grab our own reference to be safe.
+ */
+ audit_get_parent(parent);
audit_remove_watch(watch);
-
- if (list_empty(&parent->watches)) {
- audit_get_parent(parent);
+ if (list_empty(&parent->watches))
fsnotify_destroy_mark(&parent->mark);
- audit_put_parent(parent);
- }
+ audit_put_parent(parent);
}
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 143/147] am2150: Update nmclan_cs.c to use update PCMCIA API
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (7 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 036/147] audit: Fix use after free in audit_remove_watch_rule() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 021/147] sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}() Ben Hutchings
` (138 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Roger Pao, David S. Miller, Jeff Kirsher
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
commit 5f5316fcd08ef74b282adf6774956431fac62663 upstream.
Resolves compile warning about use of a deprecated function call:
drivers/net/ethernet/amd/nmclan_cs.c: In function ‘nmclan_config’:
drivers/net/ethernet/amd/nmclan_cs.c:624:3: warning: ‘pcmcia_request_exclusive_irq’ is deprecated (declared at include/pcmcia/ds.h:213) [-Wdeprecated-declarations]
ret = pcmcia_request_exclusive_irq(link, mace_interrupt);
Updates pcmcia_request_exclusive_irq() to pcmcia_request_irq().
CC: Roger Pao <rpao@paonet.org>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/amd/nmclan_cs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/amd/nmclan_cs.c
+++ b/drivers/net/ethernet/amd/nmclan_cs.c
@@ -625,7 +625,7 @@ static int nmclan_config(struct pcmcia_d
ret = pcmcia_request_io(link);
if (ret)
goto failed;
- ret = pcmcia_request_exclusive_irq(link, mace_interrupt);
+ ret = pcmcia_request_irq(link, mace_interrupt);
if (ret)
goto failed;
ret = pcmcia_enable_device(link);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 021/147] sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (8 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 143/147] am2150: Update nmclan_cs.c to use update PCMCIA API Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 057/147] l2tp: initialise session's refcount before making it reachable Ben Hutchings
` (137 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Alexander Potapenko
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Potapenko <glider@google.com>
commit b1f5bfc27a19f214006b9b4db7b9126df2dfdf5a upstream.
If the length field of the iterator (|pos.p| or |err|) is past the end
of the chunk, we shouldn't access it.
This bug has been detected by KMSAN. For the following pair of system
calls:
socket(PF_INET6, SOCK_STREAM, 0x84 /* IPPROTO_??? */) = 3
sendto(3, "A", 1, MSG_OOB, {sa_family=AF_INET6, sin6_port=htons(0),
inet_pton(AF_INET6, "::1", &sin6_addr), sin6_flowinfo=0,
sin6_scope_id=0}, 28) = 1
the tool has reported a use of uninitialized memory:
==================================================================
BUG: KMSAN: use of uninitialized memory in sctp_rcv+0x17b8/0x43b0
CPU: 1 PID: 2940 Comm: probe Not tainted 4.11.0-rc5+ #2926
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs
01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x172/0x1c0 lib/dump_stack.c:52
kmsan_report+0x12a/0x180 mm/kmsan/kmsan.c:927
__msan_warning_32+0x61/0xb0 mm/kmsan/kmsan_instr.c:469
__sctp_rcv_init_lookup net/sctp/input.c:1074
__sctp_rcv_lookup_harder net/sctp/input.c:1233
__sctp_rcv_lookup net/sctp/input.c:1255
sctp_rcv+0x17b8/0x43b0 net/sctp/input.c:170
sctp6_rcv+0x32/0x70 net/sctp/ipv6.c:984
ip6_input_finish+0x82f/0x1ee0 net/ipv6/ip6_input.c:279
NF_HOOK ./include/linux/netfilter.h:257
ip6_input+0x239/0x290 net/ipv6/ip6_input.c:322
dst_input ./include/net/dst.h:492
ip6_rcv_finish net/ipv6/ip6_input.c:69
NF_HOOK ./include/linux/netfilter.h:257
ipv6_rcv+0x1dbd/0x22e0 net/ipv6/ip6_input.c:203
__netif_receive_skb_core+0x2f6f/0x3a20 net/core/dev.c:4208
__netif_receive_skb net/core/dev.c:4246
process_backlog+0x667/0xba0 net/core/dev.c:4866
napi_poll net/core/dev.c:5268
net_rx_action+0xc95/0x1590 net/core/dev.c:5333
__do_softirq+0x485/0x942 kernel/softirq.c:284
do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:902
</IRQ>
do_softirq kernel/softirq.c:328
__local_bh_enable_ip+0x25b/0x290 kernel/softirq.c:181
local_bh_enable+0x37/0x40 ./include/linux/bottom_half.h:31
rcu_read_unlock_bh ./include/linux/rcupdate.h:931
ip6_finish_output2+0x19b2/0x1cf0 net/ipv6/ip6_output.c:124
ip6_finish_output+0x764/0x970 net/ipv6/ip6_output.c:149
NF_HOOK_COND ./include/linux/netfilter.h:246
ip6_output+0x456/0x520 net/ipv6/ip6_output.c:163
dst_output ./include/net/dst.h:486
NF_HOOK ./include/linux/netfilter.h:257
ip6_xmit+0x1841/0x1c00 net/ipv6/ip6_output.c:261
sctp_v6_xmit+0x3b7/0x470 net/sctp/ipv6.c:225
sctp_packet_transmit+0x38cb/0x3a20 net/sctp/output.c:632
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
entry_SYSCALL64_slow_path+0x25/0x25 arch/x86/entry/entry_64.S:246
RIP: 0033:0x401133
RSP: 002b:00007fff6d99cd38 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00000000004002b0 RCX: 0000000000401133
RDX: 0000000000000001 RSI: 0000000000494088 RDI: 0000000000000003
RBP: 00007fff6d99cd90 R08: 00007fff6d99cd50 R09: 000000000000001c
R10: 0000000000000001 R11: 0000000000000246 R12: 0000000000000000
R13: 00000000004063d0 R14: 0000000000406460 R15: 0000000000000000
origin:
save_stack_trace+0x37/0x40 arch/x86/kernel/stacktrace.c:59
kmsan_save_stack_with_flags mm/kmsan/kmsan.c:302
kmsan_internal_poison_shadow+0xb1/0x1a0 mm/kmsan/kmsan.c:198
kmsan_poison_shadow+0x6d/0xc0 mm/kmsan/kmsan.c:211
slab_alloc_node mm/slub.c:2743
__kmalloc_node_track_caller+0x200/0x360 mm/slub.c:4351
__kmalloc_reserve net/core/skbuff.c:138
__alloc_skb+0x26b/0x840 net/core/skbuff.c:231
alloc_skb ./include/linux/skbuff.h:933
sctp_packet_transmit+0x31e/0x3a20 net/sctp/output.c:570
sctp_outq_flush+0xeb3/0x46e0 net/sctp/outqueue.c:885
sctp_outq_uncork+0xb2/0xd0 net/sctp/outqueue.c:750
sctp_side_effects net/sctp/sm_sideeffect.c:1773
sctp_do_sm+0x6962/0x6ec0 net/sctp/sm_sideeffect.c:1147
sctp_primitive_ASSOCIATE+0x12c/0x160 net/sctp/primitive.c:88
sctp_sendmsg+0x43e5/0x4f90 net/sctp/socket.c:1954
inet_sendmsg+0x498/0x670 net/ipv4/af_inet.c:762
sock_sendmsg_nosec net/socket.c:633
sock_sendmsg net/socket.c:643
SYSC_sendto+0x608/0x710 net/socket.c:1696
SyS_sendto+0x8a/0xb0 net/socket.c:1664
do_syscall_64+0xe6/0x130 arch/x86/entry/common.c:285
return_from_SYSCALL_64+0x0/0x6a arch/x86/entry/entry_64.S:246
==================================================================
Signed-off-by: Alexander Potapenko <glider@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/sctp/sctp.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -538,6 +538,8 @@ _sctp_walk_params((pos), (chunk), ntohs(
#define _sctp_walk_params(pos, chunk, end, member)\
for (pos.v = chunk->member;\
+ (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\
+ (void *)chunk + end) &&\
pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
pos.v += WORD_ROUND(ntohs(pos.p->length)))
@@ -548,6 +550,8 @@ _sctp_walk_errors((err), (chunk_hdr), nt
#define _sctp_walk_errors(err, chunk_hdr, end)\
for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
sizeof(sctp_chunkhdr_t));\
+ ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\
+ (void *)chunk_hdr + end) &&\
(void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
ntohs(err->length) >= sizeof(sctp_errhdr_t); \
err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length))))
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 057/147] l2tp: initialise session's refcount before making it reachable
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (9 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 021/147] sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 084/147] packet: hold bind lock when rebinding to fanout hook Ben Hutchings
` (136 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Guillaume Nault, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 9ee369a405c57613d7c83a3967780c3e30c52ecc upstream.
Sessions must be fully initialised before calling
l2tp_session_add_to_tunnel(). Otherwise, there's a short time frame
where partially initialised sessions can be accessed by external users.
Fixes: dbdbc73b4478 ("l2tp: fix duplicate session creation")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: keep using l2tp_session_inc_refcount()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_core.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1715,6 +1715,8 @@ struct l2tp_session *l2tp_session_create
l2tp_session_set_header_len(session, tunnel->version);
+ l2tp_session_inc_refcount(session);
+
err = l2tp_session_add_to_tunnel(tunnel, session);
if (err) {
kfree(session);
@@ -1722,10 +1724,6 @@ struct l2tp_session *l2tp_session_create
return ERR_PTR(err);
}
- /* Bump the reference count. The session context is deleted
- * only when this drops to zero.
- */
- l2tp_session_inc_refcount(session);
l2tp_tunnel_inc_refcount(tunnel);
/* Ensure tunnel socket isn't deleted */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 084/147] packet: hold bind lock when rebinding to fanout hook
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (10 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 057/147] l2tp: initialise session's refcount before making it reachable Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 040/147] Input: trackpoint - add new trackpoint firmware ID Ben Hutchings
` (135 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Willem de Bruijn, David S. Miller, nixioaming
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
commit 008ba2a13f2d04c947adc536d19debb8fe66f110 upstream.
Packet socket bind operations must hold the po->bind_lock. This keeps
po->running consistent with whether the socket is actually on a ptype
list to receive packets.
fanout_add unbinds a socket and its packet_rcv/tpacket_rcv call, then
binds the fanout object to receive through packet_rcv_fanout.
Make it hold the po->bind_lock when testing po->running and rebinding.
Else, it can race with other rebind operations, such as that in
packet_set_ring from packet_rcv to tpacket_rcv. Concurrent updates
can result in a socket being added to a fanout group twice, causing
use-after-free KASAN bug reports, among others.
Reported independently by both trinity and syzkaller.
Verified that the syzkaller reproducer passes after this patch.
Fixes: dc99f600698d ("packet: Add fanout support.")
Reported-by: nixioaming <nixiaoming@huawei.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: use atomic_read() not refcount_read()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/packet/af_packet.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1294,10 +1294,6 @@ static int fanout_add(struct sock *sk, u
mutex_lock(&fanout_mutex);
- err = -EINVAL;
- if (!po->running)
- goto out;
-
err = -EALREADY;
if (po->fanout)
goto out;
@@ -1334,7 +1330,10 @@ static int fanout_add(struct sock *sk, u
list_add(&match->list, &fanout_list);
}
err = -EINVAL;
- if (match->type == type &&
+
+ spin_lock(&po->bind_lock);
+ if (po->running &&
+ match->type == type &&
match->prot_hook.type == po->prot_hook.type &&
match->prot_hook.dev == po->prot_hook.dev) {
err = -ENOSPC;
@@ -1346,6 +1345,13 @@ static int fanout_add(struct sock *sk, u
err = 0;
}
}
+ spin_unlock(&po->bind_lock);
+
+ if (err && !atomic_read(&match->sk_ref)) {
+ list_del(&match->list);
+ kfree(match);
+ }
+
out:
mutex_unlock(&fanout_mutex);
return err;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 040/147] Input: trackpoint - add new trackpoint firmware ID
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (11 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 084/147] packet: hold bind lock when rebinding to fanout hook Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 002/147] iio: light: tsl2563: use correct event code Ben Hutchings
` (134 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dmitry Torokhov, Aaron Ma
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Ma <aaron.ma@canonical.com>
commit ec667683c532c93fb41e100e5d61a518971060e2 upstream.
Synaptics add new TP firmware ID: 0x2 and 0x3, for now both lower 2 bits
are indicated as TP. Change the constant to bitwise values.
This makes trackpoint to be recognized on Lenovo Carbon X1 Gen5 instead
of it being identified as "PS/2 Generic Mouse".
Signed-off-by: Aaron Ma <aaron.ma@canonical.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/input/mouse/trackpoint.c | 3 ++-
drivers/input/mouse/trackpoint.h | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/input/mouse/trackpoint.c
+++ b/drivers/input/mouse/trackpoint.c
@@ -186,7 +186,8 @@ static int trackpoint_start_protocol(str
if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
return -1;
- if (param[0] != TP_MAGIC_IDENT)
+ /* add new TP ID. */
+ if (!(param[0] & TP_MAGIC_IDENT))
return -1;
if (firmware_id)
--- a/drivers/input/mouse/trackpoint.h
+++ b/drivers/input/mouse/trackpoint.h
@@ -21,8 +21,9 @@
#define TP_COMMAND 0xE2 /* Commands start with this */
#define TP_READ_ID 0xE1 /* Sent for device identification */
-#define TP_MAGIC_IDENT 0x01 /* Sent after a TP_READ_ID followed */
+#define TP_MAGIC_IDENT 0x03 /* Sent after a TP_READ_ID followed */
/* by the firmware ID */
+ /* Firmware ID includes 0x1, 0x2, 0x3 */
/*
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 002/147] iio: light: tsl2563: use correct event code
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (12 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 040/147] Input: trackpoint - add new trackpoint firmware ID Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 082/147] KEYS: don't let add_key() update an uninstantiated key Ben Hutchings
` (133 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Akinobu Mita, Jonathan Cameron
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Akinobu Mita <akinobu.mita@gmail.com>
commit a3507e48d3f99a93a3056a34a5365f310434570f upstream.
The TSL2563 driver provides three iio channels, two of which are raw ADC
channels (channel 0 and channel 1) in the device and the remaining one
is calculated by the two. The ADC channel 0 only supports programmable
interrupt with threshold settings and this driver supports the event but
the generated event code does not contain the corresponding iio channel
type.
This is going to change userspace ABI. Hopefully fixing this to be
what it should always have been won't break any userspace code.
Cc: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Akinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/light/tsl2563.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/light/tsl2563.c
+++ b/drivers/staging/iio/light/tsl2563.c
@@ -606,7 +606,7 @@ static irqreturn_t tsl2563_event_handler
struct tsl2563_chip *chip = iio_priv(dev_info);
iio_push_event(dev_info,
- IIO_UNMOD_EVENT_CODE(IIO_LIGHT,
+ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY,
0,
IIO_EV_TYPE_THRESH,
IIO_EV_DIR_EITHER),
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 082/147] KEYS: don't let add_key() update an uninstantiated key
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (13 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 002/147] iio: light: tsl2563: use correct event code Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 069/147] net_sched: fix error recovery at qdisc creation Ben Hutchings
` (132 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David Howells, Eric Biggers
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 60ff5b2f547af3828aebafd54daded44cfb0807a upstream.
Currently, when passed a key that already exists, add_key() will call the
key's ->update() method if such exists. But this is heavily broken in the
case where the key is uninstantiated because it doesn't call
__key_instantiate_and_link(). Consequently, it doesn't do most of the
things that are supposed to happen when the key is instantiated, such as
setting the instantiation state, clearing KEY_FLAG_USER_CONSTRUCT and
awakening tasks waiting on it, and incrementing key->user->nikeys.
It also never takes key_construction_mutex, which means that
->instantiate() can run concurrently with ->update() on the same key. In
the case of the "user" and "logon" key types this causes a memory leak, at
best. Maybe even worse, the ->update() methods of the "encrypted" and
"trusted" key types actually just dereference a NULL pointer when passed an
uninstantiated key.
Change key_create_or_update() to wait interruptibly for the key to finish
construction before continuing.
This patch only affects *uninstantiated* keys. For now we still allow a
negatively instantiated key to be updated (thereby positively
instantiating it), although that's broken too (the next patch fixes it)
and I'm not sure that anyone actually uses that functionality either.
Here is a simple reproducer for the bug using the "encrypted" key type
(requires CONFIG_ENCRYPTED_KEYS=y), though as noted above the bug
pertained to more than just the "encrypted" key type:
#include <stdlib.h>
#include <unistd.h>
#include <keyutils.h>
int main(void)
{
int ringid = keyctl_join_session_keyring(NULL);
if (fork()) {
for (;;) {
const char payload[] = "update user:foo 32";
usleep(rand() % 10000);
add_key("encrypted", "desc", payload, sizeof(payload), ringid);
keyctl_clear(ringid);
}
} else {
for (;;)
request_key("encrypted", "desc", "callout_info", ringid);
}
}
It causes:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
IP: encrypted_update+0xb0/0x170
PGD 7a178067 P4D 7a178067 PUD 77269067 PMD 0
PREEMPT SMP
CPU: 0 PID: 340 Comm: reproduce Tainted: G D 4.14.0-rc1-00025-g428490e38b2e #796
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff8a467a39a340 task.stack: ffffb15c40770000
RIP: 0010:encrypted_update+0xb0/0x170
RSP: 0018:ffffb15c40773de8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff8a467a275b00 RCX: 0000000000000000
RDX: 0000000000000005 RSI: ffff8a467a275b14 RDI: ffffffffb742f303
RBP: ffffb15c40773e20 R08: 0000000000000000 R09: ffff8a467a275b17
R10: 0000000000000020 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff8a4677057180 R15: ffff8a467a275b0f
FS: 00007f5d7fb08700(0000) GS:ffff8a467f200000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 0000000077262005 CR4: 00000000001606f0
Call Trace:
key_create_or_update+0x2bc/0x460
SyS_add_key+0x10c/0x1d0
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x7f5d7f211259
RSP: 002b:00007ffed03904c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000f8
RAX: ffffffffffffffda RBX: 000000003b2a7955 RCX: 00007f5d7f211259
RDX: 00000000004009e4 RSI: 00000000004009ff RDI: 0000000000400a04
RBP: 0000000068db8bad R08: 000000003b2a7955 R09: 0000000000000004
R10: 000000000000001a R11: 0000000000000246 R12: 0000000000400868
R13: 00007ffed03905d0 R14: 0000000000000000 R15: 0000000000000000
Code: 77 28 e8 64 34 1f 00 45 31 c0 31 c9 48 8d 55 c8 48 89 df 48 8d 75 d0 e8 ff f9 ff ff 85 c0 41 89 c4 0f 88 84 00 00 00 4c 8b 7d c8 <49> 8b 75 18 4c 89 ff e8 24 f8 ff ff 85 c0 41 89 c4 78 6d 49 8b
RIP: encrypted_update+0xb0/0x170 RSP: ffffb15c40773de8
CR2: 0000000000000018
Reported-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Eric Biggers <ebiggers@google.com>
[bwh: Backported to 3.2:
- Use the 'error' label to return, not 'error_free_prep'
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
security/keys/key.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -847,6 +847,16 @@ key_ref_t key_create_or_update(key_ref_t
__key_link_end(keyring, ktype, prealloc);
key_type_put(ktype);
+ key = key_ref_to_ptr(key_ref);
+ if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) {
+ ret = wait_for_key_construction(key, true);
+ if (ret < 0) {
+ key_ref_put(key_ref);
+ key_ref = ERR_PTR(ret);
+ goto error;
+ }
+ }
+
key_ref = __key_update(key_ref, payload, plen);
goto error;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 069/147] net_sched: fix error recovery at qdisc creation
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (14 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 082/147] KEYS: don't let add_key() update an uninstantiated key Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 025/147] USB: hcd: Mark secondary HCD as dead if the primary one died Ben Hutchings
` (131 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dmitry Vyukov, David S. Miller, Eric Dumazet
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 87b60cfacf9f17cf71933c6e33b66e68160af71d upstream.
Dmitry reported uses after free in qdisc code [1]
The problem here is that ops->init() can return an error.
qdisc_create_dflt() then call ops->destroy(),
while qdisc_create() does _not_ call it.
Four qdisc chose to call their own ops->destroy(), assuming their caller
would not.
This patch makes sure qdisc_create() calls ops->destroy()
and fixes the four qdisc to avoid double free.
[1]
BUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440
Read of size 8 by task syz-executor2/5030
CPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400
ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898
ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0
Call Trace:
[<ffffffff81bbbed4>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81bbbed4>] dump_stack+0x6c/0x98 lib/dump_stack.c:51
[<ffffffff816682b1>] kasan_object_err+0x21/0x70 mm/kasan/report.c:158
[<ffffffff81668524>] print_address_description mm/kasan/report.c:196 [inline]
[<ffffffff81668524>] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285
[<ffffffff81668953>] kasan_report mm/kasan/report.c:305 [inline]
[<ffffffff81668953>] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326
[<ffffffff82527b02>] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33
[<ffffffff82524bdd>] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953
[<ffffffff82524e30>] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848
[<ffffffff8252550d>] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]
[<ffffffff8252550d>] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064
[<ffffffff824b1db1>] __dev_open+0x221/0x320 net/core/dev.c:1403
[<ffffffff824b24ce>] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858
[<ffffffff824b27de>] dev_change_flags+0x8e/0x140 net/core/dev.c:6926
[<ffffffff824f5bf6>] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260
[<ffffffff824f61fa>] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546
[<ffffffff82430509>] sock_do_ioctl+0x99/0xb0 net/socket.c:879
[<ffffffff82430d30>] sock_ioctl+0x2a0/0x390 net/socket.c:958
[<ffffffff816f3b68>] vfs_ioctl fs/ioctl.c:44 [inline]
[<ffffffff816f3b68>] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611
[<ffffffff816f41a4>] SYSC_ioctl fs/ioctl.c:626 [inline]
[<ffffffff816f41a4>] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617
[<ffffffff8123e357>] entry_SYSCALL_64_fastpath+0x12/0x17
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Drop changes to sch_hhf (doesn't exist) and sch_sfq (doesn't have this bug)
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -866,6 +866,8 @@ qdisc_create(struct net_device *dev, str
return sch;
}
+ /* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */
+ ops->destroy(sch);
err_out3:
dev_put(dev);
kfree((char *) sch - sch->padded);
--- a/net/sched/sch_mq.c
+++ b/net/sched/sch_mq.c
@@ -52,7 +52,7 @@ static int mq_init(struct Qdisc *sch, st
/* pre-allocate qdiscs, attachment can't fail */
priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
GFP_KERNEL);
- if (priv->qdiscs == NULL)
+ if (!priv->qdiscs)
return -ENOMEM;
for (ntx = 0; ntx < dev->num_tx_queues; ntx++) {
@@ -60,17 +60,13 @@ static int mq_init(struct Qdisc *sch, st
qdisc = qdisc_create_dflt(dev_queue, &pfifo_fast_ops,
TC_H_MAKE(TC_H_MAJ(sch->handle),
TC_H_MIN(ntx + 1)));
- if (qdisc == NULL)
- goto err;
+ if (!qdisc)
+ return -ENOMEM;
priv->qdiscs[ntx] = qdisc;
}
sch->flags |= TCQ_F_MQROOT;
return 0;
-
-err:
- mq_destroy(sch);
- return -ENOMEM;
}
static void mq_attach(struct Qdisc *sch)
--- a/net/sched/sch_mqprio.c
+++ b/net/sched/sch_mqprio.c
@@ -117,20 +117,17 @@ static int mqprio_init(struct Qdisc *sch
/* pre-allocate qdisc, attachment can't fail */
priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]),
GFP_KERNEL);
- if (priv->qdiscs == NULL) {
- err = -ENOMEM;
- goto err;
- }
+ if (!priv->qdiscs)
+ return -ENOMEM;
for (i = 0; i < dev->num_tx_queues; i++) {
dev_queue = netdev_get_tx_queue(dev, i);
qdisc = qdisc_create_dflt(dev_queue, &pfifo_fast_ops,
TC_H_MAKE(TC_H_MAJ(sch->handle),
TC_H_MIN(i + 1)));
- if (qdisc == NULL) {
- err = -ENOMEM;
- goto err;
- }
+ if (!qdisc)
+ return -ENOMEM;
+
priv->qdiscs[i] = qdisc;
}
@@ -142,7 +139,7 @@ static int mqprio_init(struct Qdisc *sch
priv->hw_owned = 1;
err = dev->netdev_ops->ndo_setup_tc(dev, qopt->num_tc);
if (err)
- goto err;
+ return err;
} else {
netdev_set_num_tc(dev, qopt->num_tc);
for (i = 0; i < qopt->num_tc; i++)
@@ -156,10 +153,6 @@ static int mqprio_init(struct Qdisc *sch
sch->flags |= TCQ_F_MQROOT;
return 0;
-
-err:
- mqprio_destroy(sch);
- return err;
}
static void mqprio_attach(struct Qdisc *sch)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 025/147] USB: hcd: Mark secondary HCD as dead if the primary one died
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (15 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 069/147] net_sched: fix error recovery at qdisc creation Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 030/147] net/mlx4_en: Fix wrong indication of Wake-on-LAN (WoL) support Ben Hutchings
` (130 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Greg Kroah-Hartman, Rafael J. Wysocki, Alan Stern
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit cd5a6a4fdaba150089af2afc220eae0fef74878a upstream.
Make usb_hc_died() clear the HCD_FLAG_RH_RUNNING flag for the shared
HCD and set HCD_FLAG_DEAD for it, in analogy with what is done for
the primary one.
Among other thigs, this prevents check_root_hub_suspended() from
returning -EBUSY for dead HCDs which helps to work around system
suspend issues in some situations.
This actually fixes occasional suspend failures on one of my test
machines.
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/hcd.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2194,6 +2194,8 @@ void usb_hc_died (struct usb_hcd *hcd)
}
if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) {
hcd = hcd->shared_hcd;
+ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags);
+ set_bit(HCD_FLAG_DEAD, &hcd->flags);
if (hcd->rh_registered) {
clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 030/147] net/mlx4_en: Fix wrong indication of Wake-on-LAN (WoL) support
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (16 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 025/147] USB: hcd: Mark secondary HCD as dead if the primary one died Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 044/147] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Ben Hutchings
` (129 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Inbar Karmy, Tariq Toukan
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Inbar Karmy <inbark@mellanox.com>
commit c994f778bb1cca8ebe7a4e528cefec233e93b5cc upstream.
Currently when WoL is supported but disabled, ethtool reports:
"Supports Wake-on: d".
Fix the indication of Wol support, so that the indication
remains "g" all the time if the NIC supports WoL.
Tested:
As accepted, when NIC supports WoL- ethtool reports:
Supports Wake-on: g
Wake-on: d
when NIC doesn't support WoL- ethtool reports:
Supports Wake-on: d
Wake-on: d
Fixes: 14c07b1358ed ("mlx4: Wake on LAN support")
Signed-off-by: Inbar Karmy <inbark@mellanox.com>
Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 15 ++++++++-------
drivers/net/ethernet/mellanox/mlx4/fw.c | 4 ++++
drivers/net/ethernet/mellanox/mlx4/fw.h | 1 +
drivers/net/ethernet/mellanox/mlx4/main.c | 2 ++
include/linux/mlx4/device.h | 1 +
5 files changed, 16 insertions(+), 7 deletions(-)
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -101,27 +101,28 @@ static void mlx4_en_get_wol(struct net_d
struct ethtool_wolinfo *wol)
{
struct mlx4_en_priv *priv = netdev_priv(netdev);
+ struct mlx4_caps *caps = &priv->mdev->dev->caps;
int err = 0;
u64 config = 0;
- if (!(priv->mdev->dev->caps.flags & MLX4_DEV_CAP_FLAG_WOL)) {
+ if (!(caps->flags & MLX4_DEV_CAP_FLAG_WOL)) {
wol->supported = 0;
wol->wolopts = 0;
return;
}
+ if (caps->wol_port[priv->port])
+ wol->supported = WAKE_MAGIC;
+ else
+ wol->supported = 0;
+
err = mlx4_wol_read(priv->mdev->dev, &config, priv->port);
if (err) {
en_err(priv, "Failed to get WoL information\n");
return;
}
- if (config & MLX4_EN_WOL_MAGIC)
- wol->supported = WAKE_MAGIC;
- else
- wol->supported = 0;
-
- if (config & MLX4_EN_WOL_ENABLED)
+ if ((config & MLX4_EN_WOL_ENABLED) && (config & MLX4_EN_WOL_MAGIC))
wol->wolopts = WAKE_MAGIC;
else
wol->wolopts = 0;
--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
@@ -189,6 +189,7 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *
#define QUERY_DEV_CAP_RATE_SUPPORT_OFFSET 0x3c
#define QUERY_DEV_CAP_MAX_PKEY_OFFSET 0x3f
#define QUERY_DEV_CAP_EXT_FLAGS_OFFSET 0x40
+#define QUERY_DEV_CAP_WOL_OFFSET 0x43
#define QUERY_DEV_CAP_FLAGS_OFFSET 0x44
#define QUERY_DEV_CAP_RSVD_UAR_OFFSET 0x48
#define QUERY_DEV_CAP_UAR_SZ_OFFSET 0x49
@@ -285,6 +286,9 @@ int mlx4_QUERY_DEV_CAP(struct mlx4_dev *
MLX4_GET(ext_flags, outbox, QUERY_DEV_CAP_EXT_FLAGS_OFFSET);
MLX4_GET(flags, outbox, QUERY_DEV_CAP_FLAGS_OFFSET);
dev_cap->flags = flags | (u64)ext_flags << 32;
+ MLX4_GET(field, outbox, QUERY_DEV_CAP_WOL_OFFSET);
+ dev_cap->wol_port[1] = !!(field & 0x20);
+ dev_cap->wol_port[2] = !!(field & 0x40);
MLX4_GET(field, outbox, QUERY_DEV_CAP_RSVD_UAR_OFFSET);
dev_cap->reserved_uars = field >> 4;
MLX4_GET(field, outbox, QUERY_DEV_CAP_UAR_SZ_OFFSET);
--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
+++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
@@ -114,6 +114,7 @@ struct mlx4_dev_cap {
u8 log_max_macs[MLX4_MAX_PORTS + 1];
u8 log_max_vlans[MLX4_MAX_PORTS + 1];
u32 max_counters;
+ bool wol_port[MLX4_MAX_PORTS + 1];
};
struct mlx4_adapter {
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -234,6 +234,8 @@ static int mlx4_dev_cap(struct mlx4_dev
dev->caps.reserved_lkey = dev_cap->reserved_lkey;
dev->caps.stat_rate_support = dev_cap->stat_rate_support;
dev->caps.max_gso_sz = dev_cap->max_gso_sz;
+ dev->caps.wol_port[1] = dev_cap->wol_port[1];
+ dev->caps.wol_port[2] = dev_cap->wol_port[2];
dev->caps.log_num_macs = log_num_mac;
dev->caps.log_num_vlans = MLX4_LOG_NUM_VLANS;
--- a/include/linux/mlx4/device.h
+++ b/include/linux/mlx4/device.h
@@ -287,6 +287,7 @@ struct mlx4_caps {
enum mlx4_port_type possible_type[MLX4_MAX_PORTS + 1];
u32 max_counters;
u8 ext_port_cap[MLX4_MAX_PORTS + 1];
+ bool wol_port[MLX4_MAX_PORTS + 1];
};
struct mlx4_buf_list {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 044/147] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (17 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 030/147] net/mlx4_en: Fix wrong indication of Wake-on-LAN (WoL) support Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 061/147] l2tp: hold tunnel while handling genl tunnel updates Ben Hutchings
` (128 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ronnie Sahlberg, Steve French
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <lsahlber@redhat.com>
commit d3edede29f74d335f81d95a4588f5f136a9f7dcf upstream.
Add checking for the path component length and verify it is <= the maximum
that the server advertizes via FileFsAttributeInformation.
With this patch cifs.ko will now return ENAMETOOLONG instead of ENOENT
when users to access an overlong path.
To test this, try to cd into a (non-existing) directory on a CIFS share
that has a too long name:
cd /mnt/aaaaaaaaaaaaaaa...
and it now should show a good error message from the shell:
bash: cd: /mnt/aaaaaaaaaaaaaaaa...aaaaaa: File name too long
rh bz 1153996
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
[bwh: Backported to 3.2: name checks are done only in cifs_lookup()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -520,6 +520,13 @@ cifs_lookup(struct inode *parent_dir_ino
oplock = pTcon->ses->server->oplocks ? REQ_OPLOCK : 0;
+ /* Don't allow path components longer than the server max. */
+ if (unlikely(direntry->d_name.len >
+ pTcon->fsAttrInfo.MaxPathNameComponentLength)) {
+ rc = -ENAMETOOLONG;
+ goto lookup_out;
+ }
+
/*
* Don't allow the separator character in a path component.
* The VFS will not allow "/", but "\" is allowed by posix.
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 061/147] l2tp: hold tunnel while handling genl tunnel updates
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (18 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 044/147] cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 076/147] wl1251: add a missing spin_lock_init() Ben Hutchings
` (127 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Guillaume Nault
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 8c0e421525c9eb50d68e8f633f703ca31680b746 upstream.
We need to make sure the tunnel is not going to be destroyed by
l2tp_tunnel_destruct() concurrently.
Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_netlink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -211,8 +211,8 @@ static int l2tp_nl_cmd_tunnel_modify(str
}
tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
- tunnel = l2tp_tunnel_find(net, tunnel_id);
- if (tunnel == NULL) {
+ tunnel = l2tp_tunnel_get(net, tunnel_id);
+ if (!tunnel) {
ret = -ENODEV;
goto out;
}
@@ -220,6 +220,8 @@ static int l2tp_nl_cmd_tunnel_modify(str
if (info->attrs[L2TP_ATTR_DEBUG])
tunnel->debug = nla_get_u32(info->attrs[L2TP_ATTR_DEBUG]);
+ l2tp_tunnel_dec_refcount(tunnel);
+
out:
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 076/147] wl1251: add a missing spin_lock_init()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (19 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 061/147] l2tp: hold tunnel while handling genl tunnel updates Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 118/147] [media] tda18218: silence compiler warning Ben Hutchings
` (126 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David S. Miller, Kalle Valo, Pavel Machek, Cong Wang
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
commit f581a0dd744fe32b0a8805e279c59ec1ac676d60 upstream.
wl1251: add a missing spin_lock_init()
This fixes the following kernel warning:
[ 5668.771453] BUG: spinlock bad magic on CPU#0, kworker/u2:3/9745
[ 5668.771850] lock: 0xce63ef20, .magic: 00000000, .owner: <none>/-1,
.owner_cpu: 0
[ 5668.772277] CPU: 0 PID: 9745 Comm: kworker/u2:3 Tainted: G W
4.12.0-03002-gec979a4-dirty #40
[ 5668.772796] Hardware name: Nokia RX-51 board
[ 5668.773071] Workqueue: phy1 wl1251_irq_work
[ 5668.773345] [<c010c9e4>] (unwind_backtrace) from [<c010a274>]
(show_stack+0x10/0x14)
[ 5668.773803] [<c010a274>] (show_stack) from [<c01545a4>]
(do_raw_spin_lock+0x6c/0xa0)
[ 5668.774230] [<c01545a4>] (do_raw_spin_lock) from [<c06ca578>]
(_raw_spin_lock_irqsave+0x10/0x18)
[ 5668.774658] [<c06ca578>] (_raw_spin_lock_irqsave) from [<c048c010>]
(wl1251_op_tx+0x38/0x5c)
[ 5668.775115] [<c048c010>] (wl1251_op_tx) from [<c06a12e8>]
(ieee80211_tx_frags+0x188/0x1c0)
[ 5668.775543] [<c06a12e8>] (ieee80211_tx_frags) from [<c06a138c>]
(__ieee80211_tx+0x6c/0x130)
[ 5668.775970] [<c06a138c>] (__ieee80211_tx) from [<c06a3dbc>]
(ieee80211_tx+0xdc/0x104)
[ 5668.776367] [<c06a3dbc>] (ieee80211_tx) from [<c06a4af0>]
(__ieee80211_subif_start_xmit+0x454/0x8c8)
[ 5668.776824] [<c06a4af0>] (__ieee80211_subif_start_xmit) from
[<c06a4f94>] (ieee80211_subif_start_xmit+0x30/0x2fc)
[ 5668.777343] [<c06a4f94>] (ieee80211_subif_start_xmit) from
[<c0578848>] (dev_hard_start_xmit+0x80/0x118)
...
by adding the missing spin_lock_init().
Reported-by: Pavel Machek <pavel@ucw.cz>
Cc: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/wl1251/main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/wl1251/main.c
+++ b/drivers/net/wireless/wl1251/main.c
@@ -1428,6 +1428,7 @@ struct ieee80211_hw *wl1251_alloc_hw(voi
wl->state = WL1251_STATE_OFF;
mutex_init(&wl->mutex);
+ spin_lock_init(&wl->wl_lock);
wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE;
wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 118/147] [media] tda18218: silence compiler warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (20 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 076/147] wl1251: add a missing spin_lock_init() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 060/147] l2tp: hold tunnel while processing genl delete command Ben Hutchings
` (125 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab, Antti Palosaari
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit e0e52d4e9f5bce7ea887027c127473eb654a5a04 upstream.
Trivial fix.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/common/tuners/tda18218.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/common/tuners/tda18218.c
+++ b/drivers/media/common/tuners/tda18218.c
@@ -274,7 +274,7 @@ struct dvb_frontend *tda18218_attach(str
struct i2c_adapter *i2c, struct tda18218_config *cfg)
{
struct tda18218_priv *priv = NULL;
- u8 val;
+ u8 uninitialized_var(val);
int ret;
/* chip default registers values */
static u8 def_regs[] = {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 060/147] l2tp: hold tunnel while processing genl delete command
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (21 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 118/147] [media] tda18218: silence compiler warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 041/147] ALSA: core: Fix unexpected error at replacing user TLV Ben Hutchings
` (124 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Guillaume Nault, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit bb0a32ce4389e17e47e198d2cddaf141561581ad upstream.
l2tp_nl_cmd_tunnel_delete() needs to take a reference on the tunnel, to
prevent it from being concurrently freed by l2tp_tunnel_destruct().
Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_netlink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -184,14 +184,16 @@ static int l2tp_nl_cmd_tunnel_delete(str
}
tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
- tunnel = l2tp_tunnel_find(net, tunnel_id);
- if (tunnel == NULL) {
+ tunnel = l2tp_tunnel_get(net, tunnel_id);
+ if (!tunnel) {
ret = -ENODEV;
goto out;
}
(void) l2tp_tunnel_delete(tunnel);
+ l2tp_tunnel_dec_refcount(tunnel);
+
out:
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 041/147] ALSA: core: Fix unexpected error at replacing user TLV
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (22 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 060/147] l2tp: hold tunnel while processing genl delete command Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 054/147] xfrm_user: fix info leak in build_aevent() Ben Hutchings
` (123 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 88c54cdf61f508ebcf8da2d819f5dfc03e954d1d upstream.
When user tries to replace the user-defined control TLV, the kernel
checks the change of its content via memcmp(). The problem is that
the kernel passes the return value from memcmp() as is. memcmp()
gives a non-zero negative value depending on the comparison result,
and this shall be recognized as an error code.
The patch covers that corner-case, return 1 properly for the changed
TLV.
Fixes: 8aa9b586e420 ("[ALSA] Control API - more robust TLV implementation")
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/control.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/control.c
+++ b/sound/core/control.c
@@ -1084,7 +1084,7 @@ static int snd_ctl_elem_user_tlv(struct
mutex_lock(&ue->card->user_ctl_lock);
change = ue->tlv_data_size != size;
if (!change)
- change = memcmp(ue->tlv_data, new_data, size);
+ change = memcmp(ue->tlv_data, new_data, size) != 0;
kfree(ue->tlv_data);
ue->tlv_data = new_data;
ue->tlv_data_size = size;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 054/147] xfrm_user: fix info leak in build_aevent()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (23 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 041/147] ALSA: core: Fix unexpected error at replacing user TLV Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 108/147] nilfs2: fix gcc uninitialized-variable warnings in powerpc build Ben Hutchings
` (122 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Jamal Hadi Salim, Mathias Krause, Steffen Klassert
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
commit 931e79d7a7ddee4709c56b39de169a36804589a1 upstream.
The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the sa_id before filling it.
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Fixes: d51d081d6504 ("[IPSEC]: Sync series - user")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/xfrm/xfrm_user.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1719,6 +1719,7 @@ static int build_aevent(struct sk_buff *
return -EMSGSIZE;
id = nlmsg_data(nlh);
+ memset(&id->sa_id, 0, sizeof(id->sa_id));
memcpy(&id->sa_id.daddr, &x->id.daddr,sizeof(x->id.daddr));
id->sa_id.spi = x->id.spi;
id->sa_id.family = x->props.family;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 108/147] nilfs2: fix gcc uninitialized-variable warnings in powerpc build
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (24 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 054/147] xfrm_user: fix info leak in build_aevent() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 129/147] iio: staging: ad7298_ring: Fix maybe-uninitialized warning Ben Hutchings
` (121 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Geert Uytterhoeven, Linus Torvalds, Ryusuke Konishi
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
commit 4f05028f8d1af782cfd03d09e0a052e9745dc5ad upstream.
Some false positive warnings are reported for powerpc build.
The following warnings are reported in
http://kisskb.ellerman.id.au/kisskb/buildresult/12519703/
CC fs/nilfs2/super.o
fs/nilfs2/super.c: In function 'nilfs_resize_fs':
fs/nilfs2/super.c:376:2: warning: 'blocknr' may be used uninitialized in this function [-Wuninitialized]
fs/nilfs2/super.c:362:11: note: 'blocknr' was declared here
CC fs/nilfs2/recovery.o
fs/nilfs2/recovery.c: In function 'nilfs_salvage_orphan_logs':
fs/nilfs2/recovery.c:631:21: warning: 'sum' may be used uninitialized in this function [-Wuninitialized]
fs/nilfs2/recovery.c:585:32: note: 'sum' was declared here
fs/nilfs2/recovery.c: In function 'nilfs_search_super_root':
fs/nilfs2/recovery.c:873:11: warning: 'sum' may be used uninitialized in this function [-Wuninitialized]
Another similar warning is reported in
http://kisskb.ellerman.id.au/kisskb/buildresult/12520079/
CC fs/nilfs2/btree.o
fs/nilfs2/btree.c: In function 'nilfs_btree_convert_and_insert':
include/asm-generic/bitops/non-atomic.h:105:20: warning: 'bh' may be used uninitialized in this function [-Wuninitialized]
fs/nilfs2/btree.c:1859:22: note: 'bh' was declared here
This cleans out these warnings by forcing the variables to be initialized.
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/nilfs2/btree.c | 2 +-
fs/nilfs2/recovery.c | 4 ++--
fs/nilfs2/super.c | 5 ++++-
3 files changed, 7 insertions(+), 4 deletions(-)
--- a/fs/nilfs2/btree.c
+++ b/fs/nilfs2/btree.c
@@ -1797,7 +1797,7 @@ int nilfs_btree_convert_and_insert(struc
__u64 key, __u64 ptr,
const __u64 *keys, const __u64 *ptrs, int n)
{
- struct buffer_head *bh;
+ struct buffer_head *bh = NULL;
union nilfs_bmap_ptr_req dreq, nreq, *di, *ni;
struct nilfs_bmap_stats stats;
int ret;
--- a/fs/nilfs2/recovery.c
+++ b/fs/nilfs2/recovery.c
@@ -581,7 +581,7 @@ static int nilfs_do_roll_forward(struct
struct nilfs_recovery_info *ri)
{
struct buffer_head *bh_sum = NULL;
- struct nilfs_segment_summary *sum;
+ struct nilfs_segment_summary *sum = NULL;
sector_t pseg_start;
sector_t seg_start, seg_end; /* Starting/ending DBN of full segment */
unsigned long nsalvaged_blocks = 0;
@@ -813,7 +813,7 @@ int nilfs_search_super_root(struct the_n
struct nilfs_recovery_info *ri)
{
struct buffer_head *bh_sum = NULL;
- struct nilfs_segment_summary *sum;
+ struct nilfs_segment_summary *sum = NULL;
sector_t pseg_start, pseg_end, sr_pseg_start = 0;
sector_t seg_start, seg_end; /* range of full segment (block number) */
sector_t b, end;
--- a/fs/nilfs2/super.c
+++ b/fs/nilfs2/super.c
@@ -360,7 +360,7 @@ static int nilfs_move_2nd_super(struct s
struct nilfs_super_block *nsbp;
sector_t blocknr, newblocknr;
unsigned long offset;
- int sb2i = -1; /* array index of the secondary superblock */
+ int sb2i; /* array index of the secondary superblock */
int ret = 0;
/* nilfs->ns_sem must be locked by the caller. */
@@ -371,6 +371,9 @@ static int nilfs_move_2nd_super(struct s
} else if (nilfs->ns_sbh[0]->b_blocknr > nilfs->ns_first_data_block) {
sb2i = 0;
blocknr = nilfs->ns_sbh[0]->b_blocknr;
+ } else {
+ sb2i = -1;
+ blocknr = 0;
}
if (sb2i >= 0 && (u64)blocknr << nilfs->ns_blocksize_bits == sb2off)
goto out; /* super block location is unchanged */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 129/147] iio: staging: ad7298_ring: Fix maybe-uninitialized warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (25 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 108/147] nilfs2: fix gcc uninitialized-variable warnings in powerpc build Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 135/147] mct_u232: Fix use of uninitialized pointer in mct_u323_startup() Ben Hutchings
` (120 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Fengguang Wu, Michael Hennerich, Jonathan Cameron
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michael Hennerich <michael.hennerich@analog.com>
commit dfffd0d65fdf16d034681716dcbea74776f62e40 upstream.
drivers/staging/iio/adc/ad7298_ring.c:97:37: warning: 'time_ns' may
be used uninitialized in this function [-Wmaybe-uninitialized]
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Michael Hennerich <michael.hennerich@analog.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/adc/ad7298_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/adc/ad7298_ring.c
+++ b/drivers/staging/iio/adc/ad7298_ring.c
@@ -120,7 +120,7 @@ static irqreturn_t ad7298_trigger_handle
struct iio_dev *indio_dev = pf->indio_dev;
struct ad7298_state *st = iio_priv(indio_dev);
struct iio_buffer *ring = indio_dev->buffer;
- s64 time_ns;
+ s64 time_ns = 0;
__u16 buf[16];
int b_sent, i;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 135/147] mct_u232: Fix use of uninitialized pointer in mct_u323_startup()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (26 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 129/147] iio: staging: ad7298_ring: Fix maybe-uninitialized warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 012/147] cxgb4: Fix error codes in c4iw_create_cq() Ben Hutchings
` (119 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
My backport of commit 4e9a0b05257f "USB: mct_u232: add sanity checking in
probe" incorrectly added a dev_err() call using port->dev before 'port' was
initialised. Use the 'serial' parameter to look up the device instead.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/usb/serial/mct_u232.c
+++ b/drivers/usb/serial/mct_u232.c
@@ -449,7 +449,7 @@ static int mct_u232_startup(struct usb_s
/* check first to simplify error handling */
if (!serial->port[1] || !serial->port[1]->interrupt_in_urb) {
- dev_err(&port->dev, "expected endpoint missing\n");
+ dev_err(&serial->dev->dev, "expected endpoint missing\n");
return -ENODEV;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 012/147] cxgb4: Fix error codes in c4iw_create_cq()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (27 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 135/147] mct_u232: Fix use of uninitialized pointer in mct_u323_startup() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 058/147] l2tp: define parameters of l2tp_session_get*() as "const" Ben Hutchings
` (118 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Doug Ledford, Steve Wise, Dan Carpenter
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 6ebedacbb44602d4dec3348dee5ec31dd9b09521 upstream.
If one of these kmalloc() calls fails then we return ERR_PTR(0) which is
NULL. It results in a NULL dereference in the callers.
Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/hw/cxgb4/cq.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/hw/cxgb4/cq.c
+++ b/drivers/infiniband/hw/cxgb4/cq.c
@@ -826,6 +826,7 @@ struct ib_cq *c4iw_create_cq(struct ib_d
goto err2;
if (ucontext) {
+ ret = -ENOMEM;
mm = kmalloc(sizeof *mm, GFP_KERNEL);
if (!mm)
goto err3;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 058/147] l2tp: define parameters of l2tp_session_get*() as "const"
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (28 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 012/147] cxgb4: Fix error codes in c4iw_create_cq() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 049/147] ipv6: Add rt6_get_cookie() function Ben Hutchings
` (117 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Guillaume Nault
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 9aaef50c44f132e040dcd7686c8e78a3390037c5 upstream.
Make l2tp_pernet()'s parameter constant, so that l2tp_session_get*() can
declare their "net" variable as "const".
Also constify "ifname" in l2tp_session_get_by_ifname().
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_core.c | 7 ++++---
net/l2tp/l2tp_core.h | 5 +++--
2 files changed, 7 insertions(+), 5 deletions(-)
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -115,7 +115,7 @@ static void l2tp_session_set_header_len(
static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
-static inline struct l2tp_net *l2tp_pernet(struct net *net)
+static inline struct l2tp_net *l2tp_pernet(const struct net *net)
{
BUG_ON(!net);
@@ -228,7 +228,7 @@ EXPORT_SYMBOL_GPL(l2tp_session_find);
/* Like l2tp_session_find() but takes a reference on the returned session.
* Optionally calls session->ref() too if do_ref is true.
*/
-struct l2tp_session *l2tp_session_get(struct net *net,
+struct l2tp_session *l2tp_session_get(const struct net *net,
struct l2tp_tunnel *tunnel,
u32 session_id, bool do_ref)
{
@@ -305,7 +305,8 @@ EXPORT_SYMBOL_GPL(l2tp_session_get_nth);
/* Lookup a session by interface name.
* This is very inefficient but is only used by management interfaces.
*/
-struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
+ const char *ifname,
bool do_ref)
{
struct l2tp_net *pn = l2tp_pernet(net);
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -222,13 +222,14 @@ out:
return tunnel;
}
-struct l2tp_session *l2tp_session_get(struct net *net,
+struct l2tp_session *l2tp_session_get(const struct net *net,
struct l2tp_tunnel *tunnel,
u32 session_id, bool do_ref);
extern struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunnel, u32 session_id);
struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth,
bool do_ref);
-struct l2tp_session *l2tp_session_get_by_ifname(struct net *net, char *ifname,
+struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
+ const char *ifname,
bool do_ref);
extern struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id);
extern struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 049/147] ipv6: Add rt6_get_cookie() function
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (29 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 058/147] l2tp: define parameters of l2tp_session_get*() as "const" Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 136/147] ray_cs: Fix array bounds warnings Ben Hutchings
` (116 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Julian Anastasov, David S. Miller, Steffen Klassert,
Hannes Frederic Sowa, Martin KaFai Lau
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Martin KaFai Lau <kafai@fb.com>
commit b197df4f0f3782782e9ea8996e91b65ae33e8dd9 upstream.
Instead of doing the rt6->rt6i_node check whenever we need
to get the route's cookie. Refactor it into rt6_get_cookie().
It is a prep work to handle FLOWI_FLAG_KNOWN_NH and also
percpu rt6_info later.
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Drop changes in inet6_sk_rx_dst_set(), sctp_v6_get_dst()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -126,6 +126,11 @@ static inline struct inet6_dev *ip6_dst_
return ((struct rt6_info *)dst)->rt6i_idev;
}
+static inline u32 rt6_get_cookie(const struct rt6_info *rt)
+{
+ return rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+}
+
struct fib6_walker_t {
struct list_head lh;
struct fib6_node *root, *node;
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -167,7 +167,7 @@ static inline void __ip6_dst_store(struc
#ifdef CONFIG_IPV6_SUBTREES
np->saddr_cache = saddr;
#endif
- np->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+ np->dst_cookie = rt6_get_cookie(rt);
}
static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -143,7 +143,7 @@ static inline void ip6_tnl_dst_reset(str
static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
{
struct rt6_info *rt = (struct rt6_info *) dst;
- t->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+ t->dst_cookie = rt6_get_cookie(rt);
dst_release(t->dst_cache);
t->dst_cache = dst;
}
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -78,8 +78,7 @@ static int xfrm6_init_path(struct xfrm_d
{
if (dst->ops->family == AF_INET6) {
struct rt6_info *rt = (struct rt6_info*)dst;
- if (rt->rt6i_node)
- path->path_cookie = rt->rt6i_node->fn_sernum;
+ path->path_cookie = rt6_get_cookie(rt);
}
path->u.rt6.rt6i_nfheader_len = nfheader_len;
@@ -111,8 +110,7 @@ static int xfrm6_fill_dst(struct xfrm_ds
RTF_LOCAL);
xdst->u.rt6.rt6i_metric = rt->rt6i_metric;
xdst->u.rt6.rt6i_node = rt->rt6i_node;
- if (rt->rt6i_node)
- xdst->route_cookie = rt->rt6i_node->fn_sernum;
+ xdst->route_cookie = rt6_get_cookie(rt);
xdst->u.rt6.rt6i_gateway = rt->rt6i_gateway;
xdst->u.rt6.rt6i_dst = rt->rt6i_dst;
xdst->u.rt6.rt6i_src = rt->rt6i_src;
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -272,7 +272,7 @@ __ip_vs_get_out_rt_v6(struct sk_buff *sk
return NULL;
}
rt = (struct rt6_info *) dst;
- cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+ cookie = rt6_get_cookie(rt);
__ip_vs_dst_set(dest, 0, dst_clone(&rt->dst), cookie);
IP_VS_DBG(10, "new dst %pI6, src %pI6, refcnt=%d\n",
&dest->addr.in6, &dest->dst_saddr.in6,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 136/147] ray_cs: Fix array bounds warnings.
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (30 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 049/147] ipv6: Add rt6_get_cookie() function Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 073/147] sch_cbq: fix null pointer dereferences on init failure Ben Hutchings
` (115 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
commit b4c0e72e80e2e04b462ea05cc5a001807d7feed6 upstream.
rx_msg is defined to have a 1 entry array at the end, so gcc warns:
drivers/net/wireless/ray_cs.c: In function ‘rx_authenticate’:
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2436:3: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2439:15: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2452:16: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2453:18: warning: array subscript is above array bounds [-Warray-bounds]
drivers/net/wireless/ray_cs.c:2453:32: warning: array subscript is above array bounds [-Warray-bounds]
Use a zero length array and rename to "ray_rx_msg" to make sure we hit all
of the necessary cases.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/wireless/ray_cs.c | 4 ++--
drivers/net/wireless/rayctl.h | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/ray_cs.c
+++ b/drivers/net/wireless/ray_cs.c
@@ -2426,7 +2426,7 @@ static void rx_authenticate(ray_dev_t *l
unsigned int pkt_addr, int rx_len)
{
UCHAR buff[256];
- struct rx_msg *msg = (struct rx_msg *)buff;
+ struct ray_rx_msg *msg = (struct ray_rx_msg *) buff;
del_timer(&local->timer);
@@ -2513,7 +2513,7 @@ static void rx_deauthenticate(ray_dev_t
unsigned int pkt_addr, int rx_len)
{
/* UCHAR buff[256];
- struct rx_msg *msg = (struct rx_msg *)buff;
+ struct ray_rx_msg *msg = (struct ray_rx_msg *) buff;
*/
pr_debug("Deauthentication frame received\n");
local->authentication_state = UNAUTHENTICATED;
--- a/drivers/net/wireless/rayctl.h
+++ b/drivers/net/wireless/rayctl.h
@@ -566,9 +566,9 @@ struct phy_header {
UCHAR hdr_3;
UCHAR hdr_4;
};
-struct rx_msg {
+struct ray_rx_msg {
struct mac_header mac;
- UCHAR var[1];
+ UCHAR var[0];
};
struct tx_msg {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 073/147] sch_cbq: fix null pointer dereferences on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (31 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 136/147] ray_cs: Fix array bounds warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 112/147] intel_idle: Fix a cast to pointer from integer of different size warning in intel_idle Ben Hutchings
` (114 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Aleksandrov, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit 3501d059921246ff617b43e86250a719c140bd97 upstream.
CBQ can fail on ->init by wrong nl attributes or simply for missing any,
f.e. if it's set as a default qdisc then TCA_OPTIONS (opt) will be NULL
when it is activated. The first thing init does is parse opt but it will
dereference a null pointer if used as a default qdisc, also since init
failure at default qdisc invokes ->reset() which cancels all timers then
we'll also dereference two more null pointers (timer->base) as they were
never initialized.
To reproduce:
$ sysctl net.core.default_qdisc=cbq
$ ip l set ethX up
Crash log of the first null ptr deref:
[44727.907454] BUG: unable to handle kernel NULL pointer dereference at (null)
[44727.907600] IP: cbq_init+0x27/0x205
[44727.907676] PGD 59ff4067
[44727.907677] P4D 59ff4067
[44727.907742] PUD 59c70067
[44727.907807] PMD 0
[44727.907873]
[44727.907982] Oops: 0000 [#1] SMP
[44727.908054] Modules linked in:
[44727.908126] CPU: 1 PID: 21312 Comm: ip Not tainted 4.13.0-rc6+ #60
[44727.908235] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[44727.908477] task: ffff88005ad42700 task.stack: ffff880037214000
[44727.908672] RIP: 0010:cbq_init+0x27/0x205
[44727.908838] RSP: 0018:ffff8800372175f0 EFLAGS: 00010286
[44727.909018] RAX: ffffffff816c3852 RBX: ffff880058c53800 RCX: 0000000000000000
[44727.909222] RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffff8800372175f8
[44727.909427] RBP: ffff880037217650 R08: ffffffff81b0f380 R09: 0000000000000000
[44727.909631] R10: ffff880037217660 R11: 0000000000000020 R12: ffffffff822a44c0
[44727.909835] R13: ffff880058b92000 R14: 00000000ffffffff R15: 0000000000000001
[44727.910040] FS: 00007ff8bc583740(0000) GS:ffff88005d880000(0000) knlGS:0000000000000000
[44727.910339] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[44727.910525] CR2: 0000000000000000 CR3: 00000000371e5000 CR4: 00000000000406e0
[44727.910731] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[44727.910936] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[44727.911141] Call Trace:
[44727.911291] ? lockdep_init_map+0xb6/0x1ba
[44727.911461] ? qdisc_alloc+0x14e/0x187
[44727.911626] qdisc_create_dflt+0x7a/0x94
[44727.911794] ? dev_activate+0x129/0x129
[44727.911959] attach_one_default_qdisc+0x36/0x63
[44727.912132] netdev_for_each_tx_queue+0x3d/0x48
[44727.912305] dev_activate+0x4b/0x129
[44727.912468] __dev_open+0xe7/0x104
[44727.912631] __dev_change_flags+0xc6/0x15c
[44727.912799] dev_change_flags+0x25/0x59
[44727.912966] do_setlink+0x30c/0xb3f
[44727.913129] ? check_chain_key+0xb0/0xfd
[44727.913294] ? check_chain_key+0xb0/0xfd
[44727.913463] rtnl_newlink+0x3a4/0x729
[44727.913626] ? rtnl_newlink+0x117/0x729
[44727.913801] ? ns_capable_common+0xd/0xb1
[44727.913968] ? ns_capable+0x13/0x15
[44727.914131] rtnetlink_rcv_msg+0x188/0x197
[44727.914300] ? rcu_read_unlock+0x3e/0x5f
[44727.914465] ? rtnl_newlink+0x729/0x729
[44727.914630] netlink_rcv_skb+0x6c/0xce
[44727.914796] rtnetlink_rcv+0x23/0x2a
[44727.914956] netlink_unicast+0x103/0x181
[44727.915122] netlink_sendmsg+0x326/0x337
[44727.915291] sock_sendmsg_nosec+0x14/0x3f
[44727.915459] sock_sendmsg+0x29/0x2e
[44727.915619] ___sys_sendmsg+0x209/0x28b
[44727.915784] ? do_raw_spin_unlock+0xcd/0xf8
[44727.915954] ? _raw_spin_unlock+0x27/0x31
[44727.916121] ? __handle_mm_fault+0x651/0xdb1
[44727.916290] ? check_chain_key+0xb0/0xfd
[44727.916461] __sys_sendmsg+0x45/0x63
[44727.916626] ? __sys_sendmsg+0x45/0x63
[44727.916792] SyS_sendmsg+0x19/0x1b
[44727.916950] entry_SYSCALL_64_fastpath+0x23/0xc2
[44727.917125] RIP: 0033:0x7ff8bbc96690
[44727.917286] RSP: 002b:00007ffc360991e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[44727.917579] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007ff8bbc96690
[44727.917783] RDX: 0000000000000000 RSI: 00007ffc36099230 RDI: 0000000000000003
[44727.917987] RBP: ffff880037217f98 R08: 0000000000000001 R09: 0000000000000003
[44727.918190] R10: 00007ffc36098fb0 R11: 0000000000000246 R12: 0000000000000006
[44727.918393] R13: 000000000066f1a0 R14: 00007ffc360a12e0 R15: 0000000000000000
[44727.918597] ? trace_hardirqs_off_caller+0xa7/0xcf
[44727.918774] Code: 41 5f 5d c3 66 66 66 66 90 55 48 8d 56 04 45 31 c9
49 c7 c0 80 f3 b0 81 48 89 e5 41 55 41 54 53 48 89 fb 48 8d 7d a8 48 83
ec 48 <0f> b7 0e be 07 00 00 00 83 e9 04 e8 e6 f7 d8 ff 85 c0 0f 88 bb
[44727.919332] RIP: cbq_init+0x27/0x205 RSP: ffff8800372175f0
[44727.919516] CR2: 0000000000000000
Fixes: 0fbbeb1ba43b ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Keep using HRTIMER_MODE_ABS
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_cbq.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1367,6 +1367,13 @@ static int cbq_init(struct Qdisc *sch, s
struct tc_ratespec *r;
int err;
+ qdisc_watchdog_init(&q->watchdog, sch);
+ hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+ q->delay_timer.function = cbq_undelay;
+
+ if (!opt)
+ return -EINVAL;
+
err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy);
if (err < 0)
return err;
@@ -1405,9 +1412,6 @@ static int cbq_init(struct Qdisc *sch, s
q->link.avpkt = q->link.allot/2;
q->link.minidle = -0x7FFFFFFF;
- qdisc_watchdog_init(&q->watchdog, sch);
- hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
- q->delay_timer.function = cbq_undelay;
q->toplevel = TC_CBQ_MAXLEVEL;
q->now = psched_get_time();
q->now_rt = q->now;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 112/147] intel_idle: Fix a cast to pointer from integer of different size warning in intel_idle
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (32 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 073/147] sch_cbq: fix null pointer dereferences on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 106/147] edac: i7300_edac: Fix 'may be used uninitialized' warning Ben Hutchings
` (113 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David Howells, Len Brown
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit 95e3ec11491d0cbce9fcdf1cc17a527c114c7dcf upstream.
Fix the following warning:
drivers/idle/intel_idle.c: In function 'intel_idle_cpuidle_devices_init':
drivers/idle/intel_idle.c:518:5: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast]
By making get_driver_data() return a long instead of an int.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/idle/intel_idle.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -229,7 +229,7 @@ static struct cpuidle_state atom_cstates
.enter = &intel_idle },
};
-static int get_driver_data(int cstate)
+static long get_driver_data(int cstate)
{
int driver_data;
switch (cstate) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 106/147] edac: i7300_edac: Fix 'may be used uninitialized' warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (33 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 112/147] intel_idle: Fix a cast to pointer from integer of different size warning in intel_idle Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 005/147] USB: cdc-acm: add device-id for quirky printer Ben Hutchings
` (112 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
gcc 4.7 warns that nr_pages may be used uninitialized in
i7300_init_csrows(). In fact, the case where it's not initialised is
an error that will result in returning early without using it.
Silence the warning by initialising to 0.
This was done upstream as part of commit 084a4fccef39 "edac: move dimm
properties to struct dimm_info".
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/edac/i7300_edac.c
+++ b/drivers/edac/i7300_edac.c
@@ -803,6 +803,7 @@ static int i7300_init_csrows(struct mem_
}
/* Get the set of MTR[0-7] regs by each branch */
+ nr_pages = 0;
for (slot = 0; slot < MAX_SLOTS; slot++) {
int where = mtr_regs[slot];
for (branch = 0; branch < MAX_BRANCHES; branch++) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 005/147] USB: cdc-acm: add device-id for quirky printer
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (34 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 106/147] edac: i7300_edac: Fix 'may be used uninitialized' warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 048/147] PM/hibernate: touch NMI watchdog when creating snapshot Ben Hutchings
` (111 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Johan Hovold, Greg Kroah-Hartman, Oliver Neukum, Anton Avramov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit fe855789d605590e57f9cd968d85ecce46f5c3fd upstream.
Add device-id entry for DATECS FP-2000 fiscal printer needing the
NO_UNION_NORMAL quirk.
Reported-by: Anton Avramov <lukav@lukav.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/class/cdc-acm.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1592,6 +1592,9 @@ static const struct usb_device_id acm_id
{ USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
},
+ { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+ },
{ USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
.driver_info = CLEAR_HALT_CONDITIONS,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 048/147] PM/hibernate: touch NMI watchdog when creating snapshot
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (35 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 005/147] USB: cdc-acm: add device-id for quirky printer Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 056/147] dm: fix printk() rate limiting code Ben Hutchings
` (110 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Mel Gorman, Michal Hocko, Linus Torvalds, Dan Williams,
Jan Filipcewicz, Vlastimil Babka, Rafael J. Wysocki, Len Brown,
Chen Yu
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Chen Yu <yu.c.chen@intel.com>
commit 556b969a1cfe2686aae149137fa1dfcac0eefe54 upstream.
There is a problem that when counting the pages for creating the
hibernation snapshot will take significant amount of time, especially on
system with large memory. Since the counting job is performed with irq
disabled, this might lead to NMI lockup. The following warning were
found on a system with 1.5TB DRAM:
Freezing user space processes ... (elapsed 0.002 seconds) done.
OOM killer disabled.
PM: Preallocating image memory...
NMI watchdog: Watchdog detected hard LOCKUP on cpu 27
CPU: 27 PID: 3128 Comm: systemd-sleep Not tainted 4.13.0-0.rc2.git0.1.fc27.x86_64 #1
task: ffff9f01971ac000 task.stack: ffffb1a3f325c000
RIP: 0010:memory_bm_find_bit+0xf4/0x100
Call Trace:
swsusp_set_page_free+0x2b/0x30
mark_free_pages+0x147/0x1c0
count_data_pages+0x41/0xa0
hibernate_preallocate_memory+0x80/0x450
hibernation_snapshot+0x58/0x410
hibernate+0x17c/0x310
state_store+0xdf/0xf0
kobj_attr_store+0xf/0x20
sysfs_kf_write+0x37/0x40
kernfs_fop_write+0x11c/0x1a0
__vfs_write+0x37/0x170
vfs_write+0xb1/0x1a0
SyS_write+0x55/0xc0
entry_SYSCALL_64_fastpath+0x1a/0xa5
...
done (allocated 6590003 pages)
PM: Allocated 26360012 kbytes in 19.89 seconds (1325.28 MB/s)
It has taken nearly 20 seconds(2.10GHz CPU) thus the NMI lockup was
triggered. In case the timeout of the NMI watch dog has been set to 1
second, a safe interval should be 6590003/20 = 320k pages in theory.
However there might also be some platforms running at a lower frequency,
so feed the watchdog every 100k pages.
[yu.c.chen@intel.com: simplification]
Link: http://lkml.kernel.org/r/1503460079-29721-1-git-send-email-yu.c.chen@intel.com
[yu.c.chen@intel.com: use interval of 128k instead of 100k to avoid modulus]
Link: http://lkml.kernel.org/r/1503328098-5120-1-git-send-email-yu.c.chen@intel.com
Signed-off-by: Chen Yu <yu.c.chen@intel.com>
Reported-by: Jan Filipcewicz <jan.filipcewicz@intel.com>
Suggested-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Michal Hocko <mhocko@suse.com>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Len Brown <lenb@kernel.org>
Cc: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/page_alloc.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -57,6 +57,7 @@
#include <linux/ftrace_event.h>
#include <linux/memcontrol.h>
#include <linux/prefetch.h>
+#include <linux/nmi.h>
#include <asm/tlbflush.h>
#include <asm/div64.h>
@@ -1124,9 +1125,14 @@ void drain_all_pages(void)
#ifdef CONFIG_HIBERNATION
+/*
+ * Touch the watchdog for every WD_PAGE_COUNT pages.
+ */
+#define WD_PAGE_COUNT (128*1024)
+
void mark_free_pages(struct zone *zone)
{
- unsigned long pfn, max_zone_pfn;
+ unsigned long pfn, max_zone_pfn, page_count = WD_PAGE_COUNT;
unsigned long flags;
int order, t;
struct list_head *curr;
@@ -1141,6 +1147,11 @@ void mark_free_pages(struct zone *zone)
if (pfn_valid(pfn)) {
struct page *page = pfn_to_page(pfn);
+ if (!--page_count) {
+ touch_nmi_watchdog();
+ page_count = WD_PAGE_COUNT;
+ }
+
if (!swsusp_page_is_forbidden(page))
swsusp_unset_page_free(page);
}
@@ -1150,8 +1161,13 @@ void mark_free_pages(struct zone *zone)
unsigned long i;
pfn = page_to_pfn(list_entry(curr, struct page, lru));
- for (i = 0; i < (1UL << order); i++)
+ for (i = 0; i < (1UL << order); i++) {
+ if (!--page_count) {
+ touch_nmi_watchdog();
+ page_count = WD_PAGE_COUNT;
+ }
swsusp_set_page_free(pfn_to_page(pfn + i));
+ }
}
}
spin_unlock_irqrestore(&zone->lock, flags);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 056/147] dm: fix printk() rate limiting code
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (36 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 048/147] PM/hibernate: touch NMI watchdog when creating snapshot Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 087/147] ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor Ben Hutchings
` (109 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mike Snitzer, Bart Van Assche
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bart.vanassche@wdc.com>
commit 604407890ecf624c2fb41013c82b22aade59b455 upstream.
Using the same rate limiting state for different kinds of messages
is wrong because this can cause a high frequency message to suppress
a report of a low frequency message. Hence use a unique rate limiting
state per message type.
Fixes: 71a16736a15e ("dm: use local printk ratelimit")
Signed-off-by: Bart Van Assche <bart.vanassche@wdc.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/md/dm.c | 10 ----------
include/linux/device-mapper.h | 41 ++++++++++++-----------------------------
2 files changed, 12 insertions(+), 39 deletions(-)
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -25,16 +25,6 @@
#define DM_MSG_PREFIX "core"
-#ifdef CONFIG_PRINTK
-/*
- * ratelimit state to be used in DMXXX_LIMIT().
- */
-DEFINE_RATELIMIT_STATE(dm_ratelimit_state,
- DEFAULT_RATELIMIT_INTERVAL,
- DEFAULT_RATELIMIT_BURST);
-EXPORT_SYMBOL(dm_ratelimit_state);
-#endif
-
/*
* Cookies are numeric values sent with CHANGE and REMOVE
* uevents while resuming, removing or renaming the device.
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -398,46 +398,29 @@ void *dm_vcalloc(unsigned long nmemb, un
*---------------------------------------------------------------*/
#define DM_NAME "device-mapper"
-#ifdef CONFIG_PRINTK
-extern struct ratelimit_state dm_ratelimit_state;
-
-#define dm_ratelimit() __ratelimit(&dm_ratelimit_state)
-#else
-#define dm_ratelimit() 0
-#endif
+#define DM_RATELIMIT(pr_func, fmt, ...) \
+do { \
+ static DEFINE_RATELIMIT_STATE(rs, DEFAULT_RATELIMIT_INTERVAL, \
+ DEFAULT_RATELIMIT_BURST); \
+ \
+ if (__ratelimit(&rs)) \
+ pr_func(DM_FMT(fmt), ##__VA_ARGS__); \
+} while (0)
#define DM_FMT(fmt) DM_NAME ": " DM_MSG_PREFIX ": " fmt "\n"
#define DMCRIT(fmt, ...) pr_crit(DM_FMT(fmt), ##__VA_ARGS__)
#define DMERR(fmt, ...) pr_err(DM_FMT(fmt), ##__VA_ARGS__)
-#define DMERR_LIMIT(fmt, ...) \
-do { \
- if (dm_ratelimit()) \
- DMERR(fmt, ##__VA_ARGS__); \
-} while (0)
-
+#define DMERR_LIMIT(fmt, ...) DM_RATELIMIT(pr_err, fmt, ##__VA_ARGS__)
#define DMWARN(fmt, ...) pr_warn(DM_FMT(fmt), ##__VA_ARGS__)
-#define DMWARN_LIMIT(fmt, ...) \
-do { \
- if (dm_ratelimit()) \
- DMWARN(fmt, ##__VA_ARGS__); \
-} while (0)
-
+#define DMWARN_LIMIT(fmt, ...) DM_RATELIMIT(pr_warn, fmt, ##__VA_ARGS__)
#define DMINFO(fmt, ...) pr_info(DM_FMT(fmt), ##__VA_ARGS__)
-#define DMINFO_LIMIT(fmt, ...) \
-do { \
- if (dm_ratelimit()) \
- DMINFO(fmt, ##__VA_ARGS__); \
-} while (0)
+#define DMINFO_LIMIT(fmt, ...) DM_RATELIMIT(pr_info, fmt, ##__VA_ARGS__)
#ifdef CONFIG_DM_DEBUG
#define DMDEBUG(fmt, ...) printk(KERN_DEBUG DM_FMT(fmt), ##__VA_ARGS__)
-#define DMDEBUG_LIMIT(fmt, ...) \
-do { \
- if (dm_ratelimit()) \
- DMDEBUG(fmt, ##__VA_ARGS__); \
-} while (0)
+#define DMDEBUG_LIMIT(fmt, ...) DM_RATELIMIT(pr_debug, fmt, ##__VA_ARGS__)
#else
#define DMDEBUG(fmt, ...) no_printk(fmt, ##__VA_ARGS__)
#define DMDEBUG_LIMIT(fmt, ...) no_printk(fmt, ##__VA_ARGS__)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 087/147] ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (37 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 056/147] dm: fix printk() rate limiting code Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 081/147] ALSA: seq: Fix use-after-free at creating a port Ben Hutchings
` (108 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Andrey Konovalov, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit bfc81a8bc18e3c4ba0cbaa7666ff76be2f998991 upstream.
When a USB-audio device receives a maliciously adjusted or corrupted
buffer descriptor, the USB-audio driver may access an out-of-bounce
value at its parser. This was detected by syzkaller, something like:
BUG: KASAN: slab-out-of-bounds in usb_audio_probe+0x27b2/0x2ab0
Read of size 1 at addr ffff88006b83a9e8 by task kworker/0:1/24
CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.0-rc1-42251-gebb2c2437d80 #224
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x395 lib/dump_stack.c:52
print_address_description+0x78/0x280 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351
kasan_report+0x22f/0x340 mm/kasan/report.c:409
__asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
snd_usb_create_streams sound/usb/card.c:248
usb_audio_probe+0x27b2/0x2ab0 sound/usb/card.c:605
usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
hub_port_connect drivers/usb/core/hub.c:4903
hub_port_connect_change drivers/usb/core/hub.c:5009
port_event drivers/usb/core/hub.c:5115
hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
worker_thread+0x221/0x1850 kernel/workqueue.c:2253
kthread+0x3a1/0x470 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
This patch adds the checks of out-of-bounce accesses at appropriate
places and bails out when it goes out of the given buffer.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/card.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
--- a/sound/usb/card.c
+++ b/sound/usb/card.c
@@ -222,6 +222,7 @@ static int snd_usb_create_streams(struct
struct usb_interface_descriptor *altsd;
void *control_header;
int i, protocol;
+ int rest_bytes;
/* find audiocontrol interface */
host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0];
@@ -236,6 +237,15 @@ static int snd_usb_create_streams(struct
return -EINVAL;
}
+ rest_bytes = (void *)(host_iface->extra + host_iface->extralen) -
+ control_header;
+
+ /* just to be sure -- this shouldn't hit at all */
+ if (rest_bytes <= 0) {
+ dev_err(&dev->dev, "invalid control header\n");
+ return -EINVAL;
+ }
+
switch (protocol) {
default:
snd_printdd(KERN_WARNING "unknown interface protocol %#02x, assuming v1\n",
@@ -245,11 +255,21 @@ static int snd_usb_create_streams(struct
case UAC_VERSION_1: {
struct uac1_ac_header_descriptor *h1 = control_header;
+ if (rest_bytes < sizeof(*h1)) {
+ dev_err(&dev->dev, "too short v1 buffer descriptor\n");
+ return -EINVAL;
+ }
+
if (!h1->bInCollection) {
snd_printk(KERN_INFO "skipping empty audio interface (v1)\n");
return -EINVAL;
}
+ if (rest_bytes < h1->bLength) {
+ dev_err(&dev->dev, "invalid buffer length (v1)\n");
+ return -EINVAL;
+ }
+
if (h1->bLength < sizeof(*h1) + h1->bInCollection) {
snd_printk(KERN_ERR "invalid UAC_HEADER (v1)\n");
return -EINVAL;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 081/147] ALSA: seq: Fix use-after-free at creating a port
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (38 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 087/147] ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 064/147] l2tp: hold tunnel used while creating sessions with netlink Ben Hutchings
` (107 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Takashi Iwai, Linus Torvalds
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 71105998845fb012937332fe2e806d443c09e026 upstream.
There is a potential race window opened at creating and deleting a
port via ioctl, as spotted by fuzzing. snd_seq_create_port() creates
a port object and returns its pointer, but it doesn't take the
refcount, thus it can be deleted immediately by another thread.
Meanwhile, snd_seq_ioctl_create_port() still calls the function
snd_seq_system_client_ev_port_start() with the created port object
that is being deleted, and this triggers use-after-free like:
BUG: KASAN: use-after-free in snd_seq_ioctl_create_port+0x504/0x630 [snd_seq] at addr ffff8801f2241cb1
=============================================================================
BUG kmalloc-512 (Tainted: G B ): kasan: bad access detected
-----------------------------------------------------------------------------
INFO: Allocated in snd_seq_create_port+0x94/0x9b0 [snd_seq] age=1 cpu=3 pid=4511
___slab_alloc+0x425/0x460
__slab_alloc+0x20/0x40
kmem_cache_alloc_trace+0x150/0x190
snd_seq_create_port+0x94/0x9b0 [snd_seq]
snd_seq_ioctl_create_port+0xd1/0x630 [snd_seq]
snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
snd_seq_ioctl+0x40/0x80 [snd_seq]
do_vfs_ioctl+0x54b/0xda0
SyS_ioctl+0x79/0x90
entry_SYSCALL_64_fastpath+0x16/0x75
INFO: Freed in port_delete+0x136/0x1a0 [snd_seq] age=1 cpu=2 pid=4717
__slab_free+0x204/0x310
kfree+0x15f/0x180
port_delete+0x136/0x1a0 [snd_seq]
snd_seq_delete_port+0x235/0x350 [snd_seq]
snd_seq_ioctl_delete_port+0xc8/0x180 [snd_seq]
snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
snd_seq_ioctl+0x40/0x80 [snd_seq]
do_vfs_ioctl+0x54b/0xda0
SyS_ioctl+0x79/0x90
entry_SYSCALL_64_fastpath+0x16/0x75
Call Trace:
[<ffffffff81b03781>] dump_stack+0x63/0x82
[<ffffffff81531b3b>] print_trailer+0xfb/0x160
[<ffffffff81536db4>] object_err+0x34/0x40
[<ffffffff815392d3>] kasan_report.part.2+0x223/0x520
[<ffffffffa07aadf4>] ? snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
[<ffffffff815395fe>] __asan_report_load1_noabort+0x2e/0x30
[<ffffffffa07aadf4>] snd_seq_ioctl_create_port+0x504/0x630 [snd_seq]
[<ffffffffa07aa8f0>] ? snd_seq_ioctl_delete_port+0x180/0x180 [snd_seq]
[<ffffffff8136be50>] ? taskstats_exit+0xbc0/0xbc0
[<ffffffffa07abc5c>] snd_seq_do_ioctl+0x11c/0x190 [snd_seq]
[<ffffffffa07abd10>] snd_seq_ioctl+0x40/0x80 [snd_seq]
[<ffffffff8136d433>] ? acct_account_cputime+0x63/0x80
[<ffffffff815b515b>] do_vfs_ioctl+0x54b/0xda0
.....
We may fix this in a few different ways, and in this patch, it's fixed
simply by taking the refcount properly at snd_seq_create_port() and
letting the caller unref the object after use. Also, there is another
potential use-after-free by sprintf() call in snd_seq_create_port(),
and this is moved inside the lock.
This fix covers CVE-2017-15265.
Reported-and-tested-by: Michael23 Yu <ycqzsy@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/seq/seq_clientmgr.c | 6 +++++-
sound/core/seq/seq_ports.c | 7 +++++--
2 files changed, 10 insertions(+), 3 deletions(-)
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1248,6 +1248,7 @@ static int snd_seq_ioctl_create_port(str
struct snd_seq_client_port *port;
struct snd_seq_port_info info;
struct snd_seq_port_callback *callback;
+ int port_idx;
if (copy_from_user(&info, arg, sizeof(info)))
return -EFAULT;
@@ -1261,7 +1262,9 @@ static int snd_seq_ioctl_create_port(str
return -ENOMEM;
if (client->type == USER_CLIENT && info.kernel) {
- snd_seq_delete_port(client, port->addr.port);
+ port_idx = port->addr.port;
+ snd_seq_port_unlock(port);
+ snd_seq_delete_port(client, port_idx);
return -EINVAL;
}
if (client->type == KERNEL_CLIENT) {
@@ -1283,6 +1286,7 @@ static int snd_seq_ioctl_create_port(str
snd_seq_set_port_info(port, &info);
snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
+ snd_seq_port_unlock(port);
if (copy_to_user(arg, &info, sizeof(info)))
return -EFAULT;
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -122,7 +122,9 @@ static void port_subs_info_init(struct s
}
-/* create a port, port number is returned (-1 on failure) */
+/* create a port, port number is returned (-1 on failure);
+ * the caller needs to unref the port via snd_seq_port_unlock() appropriately
+ */
struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
int port)
{
@@ -153,6 +155,7 @@ struct snd_seq_client_port *snd_seq_crea
snd_use_lock_init(&new_port->use_lock);
port_subs_info_init(&new_port->c_src);
port_subs_info_init(&new_port->c_dest);
+ snd_use_lock_use(&new_port->use_lock);
num = port >= 0 ? port : 0;
mutex_lock(&client->ports_mutex);
@@ -167,9 +170,9 @@ struct snd_seq_client_port *snd_seq_crea
list_add_tail(&new_port->list, &p->list);
client->num_ports++;
new_port->addr.port = num; /* store the port number in the port */
+ sprintf(new_port->name, "port-%d", num);
write_unlock_irqrestore(&client->ports_lock, flags);
mutex_unlock(&client->ports_mutex);
- sprintf(new_port->name, "port-%d", num);
return new_port;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 064/147] l2tp: hold tunnel used while creating sessions with netlink
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (39 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 081/147] ALSA: seq: Fix use-after-free at creating a port Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 138/147] drm/i915: Clean up multi-threaded forcewake patch Ben Hutchings
` (106 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Guillaume Nault
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit e702c1204eb57788ef189c839c8c779368267d70 upstream.
Use l2tp_tunnel_get() to retrieve tunnel, so that it can't go away on
us. Otherwise l2tp_tunnel_destruct() might release the last reference
count concurrently, thus freeing the tunnel while we're using it.
Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_netlink.c | 21 ++++++++++++---------
1 file changed, 12 insertions(+), 9 deletions(-)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -368,8 +368,9 @@ static int l2tp_nl_cmd_session_create(st
ret = -EINVAL;
goto out;
}
+
tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
- tunnel = l2tp_tunnel_find(net, tunnel_id);
+ tunnel = l2tp_tunnel_get(net, tunnel_id);
if (!tunnel) {
ret = -ENODEV;
goto out;
@@ -377,24 +378,24 @@ static int l2tp_nl_cmd_session_create(st
if (!info->attrs[L2TP_ATTR_SESSION_ID]) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
if (!info->attrs[L2TP_ATTR_PEER_SESSION_ID]) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
peer_session_id = nla_get_u32(info->attrs[L2TP_ATTR_PEER_SESSION_ID]);
if (!info->attrs[L2TP_ATTR_PW_TYPE]) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
cfg.pw_type = nla_get_u16(info->attrs[L2TP_ATTR_PW_TYPE]);
if (cfg.pw_type >= __L2TP_PWTYPE_MAX) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
if (tunnel->version > 2) {
@@ -416,7 +417,7 @@ static int l2tp_nl_cmd_session_create(st
u16 len = nla_len(info->attrs[L2TP_ATTR_COOKIE]);
if (len > 8) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
cfg.cookie_len = len;
memcpy(&cfg.cookie[0], nla_data(info->attrs[L2TP_ATTR_COOKIE]), len);
@@ -425,7 +426,7 @@ static int l2tp_nl_cmd_session_create(st
u16 len = nla_len(info->attrs[L2TP_ATTR_PEER_COOKIE]);
if (len > 8) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
cfg.peer_cookie_len = len;
memcpy(&cfg.peer_cookie[0], nla_data(info->attrs[L2TP_ATTR_PEER_COOKIE]), len);
@@ -461,7 +462,7 @@ static int l2tp_nl_cmd_session_create(st
if ((l2tp_nl_cmd_ops[cfg.pw_type] == NULL) ||
(l2tp_nl_cmd_ops[cfg.pw_type]->session_create == NULL)) {
ret = -EPROTONOSUPPORT;
- goto out;
+ goto out_tunnel;
}
/* Check that pseudowire-specific params are present */
@@ -471,7 +472,7 @@ static int l2tp_nl_cmd_session_create(st
case L2TP_PWTYPE_ETH_VLAN:
if (!info->attrs[L2TP_ATTR_VLAN_ID]) {
ret = -EINVAL;
- goto out;
+ goto out_tunnel;
}
break;
case L2TP_PWTYPE_ETH:
@@ -490,6 +491,8 @@ static int l2tp_nl_cmd_session_create(st
ret = (*l2tp_nl_cmd_ops[cfg.pw_type]->session_create)(net, tunnel_id,
session_id, peer_session_id, &cfg);
+out_tunnel:
+ l2tp_tunnel_dec_refcount(tunnel);
out:
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 138/147] drm/i915: Clean up multi-threaded forcewake patch
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (40 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 064/147] l2tp: hold tunnel used while creating sessions with netlink Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 022/147] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Ben Hutchings
` (105 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Keith Packard, Jesse Barnes
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Keith Packard <keithp@keithp.com>
commit c7dffff7cc8de748edf0e9f6571cdabecb198705 upstream.
We learned that the ECOBUS register was inside the GT power well, and
so *did* need force wake to be read, so it gets removed from the list
of 'doesn't need force wake' registers.
That means the code reading ECOBUS after forcing the mt_force_wake
function to be called needs to use I915_READ_NOTRACE; it doesn't need
to do more force wake fun as it's already done it manually.
This also adds a comment explaining why the MT forcewake testing code
only needs to call mt_forcewake_get/put and not disable RC6 manually
-- the ECOBUS read will return 0 if the device is in RC6 and isn't
using MT forcewake, causing the test to work correctly.
Signed-off-by: Keith Packard <keithp@keithp.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
[bwh: Backported to 3.2: I previously backported a change to
NEEDS_FORCE_WAKE() and applied it to the version in i915_drv.c, the one
that was actually being used. Move that change to i915_drv.h now.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/i915/i915_drv.c | 7 -------
drivers/gpu/drm/i915/i915_drv.h | 3 +--
drivers/gpu/drm/i915/intel_display.c | 8 +++++++-
3 files changed, 8 insertions(+), 10 deletions(-)
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -971,13 +971,6 @@ MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL and additional rights");
-/* We give fast paths for the really cool registers */
-#define NEEDS_FORCE_WAKE(dev_priv, reg) \
- ((HAS_FORCE_WAKE((dev_priv)->dev)) && \
- ((reg) < 0x40000) && \
- ((reg) != FORCEWAKE) && \
- ((reg) != ECOBUS))
-
#define __i915_read(x, y) \
u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg) { \
u##x val = 0; \
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -1369,10 +1369,9 @@ void __gen6_gt_wait_for_fifo(struct drm_
/* We give fast paths for the really cool registers */
#define NEEDS_FORCE_WAKE(dev_priv, reg) \
- (((dev_priv)->info->gen >= 6) && \
+ ((HAS_FORCE_WAKE((dev_priv)->dev)) && \
((reg) < 0x40000) && \
- ((reg) != FORCEWAKE) && \
- ((reg) != ECOBUS))
+ ((reg) != FORCEWAKE))
#define __i915_read(x, y) \
u##x i915_read##x(struct drm_i915_private *dev_priv, u32 reg);
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8699,9 +8699,15 @@ static void intel_init_display(struct dr
if (IS_IVYBRIDGE(dev)) {
u32 ecobus;
+ /* A small trick here - if the bios hasn't configured MT forcewake,
+ * and if the device is in RC6, then force_wake_mt_get will not wake
+ * the device and the ECOBUS read will return zero. Which will be
+ * (correctly) interpreted by the test below as MT forcewake being
+ * disabled.
+ */
mutex_lock(&dev->struct_mutex);
__gen6_gt_force_wake_mt_get(dev_priv);
- ecobus = I915_READ(ECOBUS);
+ ecobus = I915_READ_NOTRACE(ECOBUS);
__gen6_gt_force_wake_mt_put(dev_priv);
mutex_unlock(&dev->struct_mutex);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 022/147] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (41 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 138/147] drm/i915: Clean up multi-threaded forcewake patch Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 016/147] ipv4: initialize fib_trie prior to register_netdev_notifier call Ben Hutchings
` (104 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Neil Horman, Xin Long, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
commit 6b84202c946cd3da3a8daa92c682510e9ed80321 upstream.
Commit b1f5bfc27a19 ("sctp: don't dereference ptr before leaving
_sctp_walk_{params, errors}()") tried to fix the issue that it
may overstep the chunk end for _sctp_walk_{params, errors} with
'chunk_end > offset(length) + sizeof(length)'.
But it introduced a side effect: When processing INIT, it verifies
the chunks with 'param.v == chunk_end' after iterating all params
by sctp_walk_params(). With the check 'chunk_end > offset(length)
+ sizeof(length)', it would return when the last param is not yet
accessed. Because the last param usually is fwdtsn supported param
whose size is 4 and 'chunk_end == offset(length) + sizeof(length)'
This is a badly issue even causing sctp couldn't process 4-shakes.
Client would always get abort when connecting to server, due to
the failure of INIT chunk verification on server.
The patch is to use 'chunk_end <= offset(length) + sizeof(length)'
instead of 'chunk_end < offset(length) + sizeof(length)' for both
_sctp_walk_params and _sctp_walk_errors.
Fixes: b1f5bfc27a19 ("sctp: don't dereference ptr before leaving _sctp_walk_{params, errors}()")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/sctp/sctp.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -538,7 +538,7 @@ _sctp_walk_params((pos), (chunk), ntohs(
#define _sctp_walk_params(pos, chunk, end, member)\
for (pos.v = chunk->member;\
- (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <\
+ (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\
(void *)chunk + end) &&\
pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\
ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\
@@ -550,7 +550,7 @@ _sctp_walk_errors((err), (chunk_hdr), nt
#define _sctp_walk_errors(err, chunk_hdr, end)\
for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \
sizeof(sctp_chunkhdr_t));\
- ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <\
+ ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\
(void *)chunk_hdr + end) &&\
(void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\
ntohs(err->length) >= sizeof(sctp_errhdr_t); \
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 016/147] ipv4: initialize fib_trie prior to register_netdev_notifier call.
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (42 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 022/147] sctp: fix the check for _sctp_walk_params and _sctp_walk_errors Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 132/147] sfc: Merge efx_mcdi_mac_check_fault() and efx_mcdi_get_mac_faults() Ben Hutchings
` (103 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David S. Miller, Mahesh Bandewar, Eric W. Biederman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mahesh Bandewar <maheshb@google.com>
commit 8799a221f5944a7d74516ecf46d58c28ec1d1f75 upstream.
Net stack initialization currently initializes fib-trie after the
first call to netdevice_notifier() call. In fact fib_trie initialization
needs to happen before first rtnl_register(). It does not cause any problem
since there are no devices UP at this moment, but trying to bring 'lo'
UP at initialization would make this assumption wrong and exposes the issue.
Fixes following crash
Call Trace:
? alternate_node_alloc+0x76/0xa0
fib_table_insert+0x1b7/0x4b0
fib_magic.isra.17+0xea/0x120
fib_add_ifaddr+0x7b/0x190
fib_netdev_event+0xc0/0x130
register_netdevice_notifier+0x1c1/0x1d0
ip_fib_init+0x72/0x85
ip_rt_init+0x187/0x1e9
ip_init+0xe/0x1a
inet_init+0x171/0x26c
? ipv4_offload_init+0x66/0x66
do_one_initcall+0x43/0x160
kernel_init_freeable+0x191/0x219
? rest_init+0x80/0x80
kernel_init+0xe/0x150
ret_from_fork+0x22/0x30
Code: f6 46 23 04 74 86 4c 89 f7 e8 ae 45 01 00 49 89 c7 4d 85 ff 0f 85 7b ff ff ff 31 db eb 08 4c 89 ff e8 16 47 01 00 48 8b 44 24 38 <45> 8b 6e 14 4d 63 76 74 48 89 04 24 0f 1f 44 00 00 48 83 c4 08
RIP: kmem_cache_alloc+0xcf/0x1c0 RSP: ffff9b1500017c28
CR2: 0000000000000014
Fixes: 7b1a74fdbb9e ("[NETNS]: Refactor fib initialization so it can handle multiple namespaces.")
Fixes: 7f9b80529b8a ("[IPV4]: fib hash|trie initialization")
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/fib_frontend.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1128,13 +1128,14 @@ static struct pernet_operations fib_net_
void __init ip_fib_init(void)
{
- rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
- rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
- rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+ fib_trie_init();
register_pernet_subsys(&fib_net_ops);
+
register_netdevice_notifier(&fib_netdev_notifier);
register_inetaddr_notifier(&fib_inetaddr_notifier);
- fib_trie_init();
+ rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+ rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+ rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 132/147] sfc: Merge efx_mcdi_mac_check_fault() and efx_mcdi_get_mac_faults()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (43 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 016/147] ipv4: initialize fib_trie prior to register_netdev_notifier call Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 019/147] IB/ipoib: Prevent setting negative values to max_nonsrq_conn_qp Ben Hutchings
` (102 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ben Hutchings
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <bhutchings@solarflare.com>
commit 1daf417029ddc10b7854430c1e1118df791d0eaf upstream.
The latter is only called by the former, which is a very short
wrapper. Further, gcc 4.5 may currently wrongly warn that the
'faults' variable may be used uninitialised.
Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
[bwh: Backported to 3.2: keep efx_mcdi_get_mac_faults() static]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/sfc/mcdi_mac.c | 25 +++++++------------------
1 file changed, 7 insertions(+), 18 deletions(-)
--- a/drivers/net/ethernet/sfc/mcdi_mac.c
+++ b/drivers/net/ethernet/sfc/mcdi_mac.c
@@ -54,7 +54,7 @@ int efx_mcdi_set_mac(struct efx_nic *efx
NULL, 0, NULL);
}
-static int efx_mcdi_get_mac_faults(struct efx_nic *efx, u32 *faults)
+static bool efx_mcdi_mac_check_fault(struct efx_nic *efx)
{
u8 outbuf[MC_CMD_GET_LINK_OUT_LEN];
size_t outlength;
@@ -64,16 +64,13 @@ static int efx_mcdi_get_mac_faults(struc
rc = efx_mcdi_rpc(efx, MC_CMD_GET_LINK, NULL, 0,
outbuf, sizeof(outbuf), &outlength);
- if (rc)
- goto fail;
+ if (rc) {
+ netif_err(efx, hw, efx->net_dev, "%s: failed rc=%d\n",
+ __func__, rc);
+ return true;
+ }
- *faults = MCDI_DWORD(outbuf, GET_LINK_OUT_MAC_FAULT);
- return 0;
-
-fail:
- netif_err(efx, hw, efx->net_dev, "%s: failed rc=%d\n",
- __func__, rc);
- return rc;
+ return MCDI_DWORD(outbuf, GET_LINK_OUT_MAC_FAULT) != 0;
}
int efx_mcdi_mac_stats(struct efx_nic *efx, dma_addr_t dma_addr,
@@ -132,14 +129,6 @@ static int efx_mcdi_mac_reconfigure(stru
}
-static bool efx_mcdi_mac_check_fault(struct efx_nic *efx)
-{
- u32 faults;
- int rc = efx_mcdi_get_mac_faults(efx, &faults);
- return (rc != 0) || (faults != 0);
-}
-
-
const struct efx_mac_operations efx_mcdi_mac_operations = {
.reconfigure = efx_mcdi_mac_reconfigure,
.update_stats = efx_port_dummy_op_void,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 019/147] IB/ipoib: Prevent setting negative values to max_nonsrq_conn_qp
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (44 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 132/147] sfc: Merge efx_mcdi_mac_check_fault() and efx_mcdi_get_mac_faults() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 009/147] libata: array underflow in ata_find_dev() Ben Hutchings
` (101 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Alex Vesker, Leon Romanovsky
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Vesker <valex@mellanox.com>
commit 11f74b40359b19f760964e71d04882a6caf530cc upstream.
Don't allow negative values to max_nonsrq_conn_qp. There is no functional
impact on a negative value but it is logicically incorrect.
Fixes: 68e995a29572 ("IPoIB/cm: Add connected mode support for devices without SRQs")
Signed-off-by: Alex Vesker <valex@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/ulp/ipoib/ipoib_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1366,6 +1366,7 @@ static int __init ipoib_init_module(void
ipoib_sendq_size = max3(ipoib_sendq_size, 2 * MAX_SEND_CQE, IPOIB_MIN_QUEUE_SIZE);
#ifdef CONFIG_INFINIBAND_IPOIB_CM
ipoib_max_conn_qp = min(ipoib_max_conn_qp, IPOIB_CM_MAX_CONN_QP);
+ ipoib_max_conn_qp = max(ipoib_max_conn_qp, 0);
#endif
/*
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 009/147] libata: array underflow in ata_find_dev()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (45 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 019/147] IB/ipoib: Prevent setting negative values to max_nonsrq_conn_qp Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 088/147] USB: fix out-of-bounds in usb_set_configuration Ben Hutchings
` (100 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Dan Carpenter, Tejun Heo
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 59a5e266c3f5c1567508888dd61a45b86daed0fa upstream.
My static checker complains that "devno" can be negative, meaning that
we read before the start of the loop. I've looked at the code, and I
think the warning is right. This come from /proc so it's root only or
it would be quite a quite a serious bug. The call tree looks like this:
proc_scsi_write() <- gets id and channel from simple_strtoul()
-> scsi_add_single_device() <- calls shost->transportt->user_scan()
-> ata_scsi_user_scan()
-> ata_find_dev()
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/ata/libata-scsi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2755,10 +2755,12 @@ static unsigned int atapi_xlat(struct at
static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
{
if (!sata_pmp_attached(ap)) {
- if (likely(devno < ata_link_max_devices(&ap->link)))
+ if (likely(devno >= 0 &&
+ devno < ata_link_max_devices(&ap->link)))
return &ap->link.device[devno];
} else {
- if (likely(devno < ap->nr_pmp_links))
+ if (likely(devno >= 0 &&
+ devno < ap->nr_pmp_links))
return &ap->pmp_link[devno].device[0];
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 088/147] USB: fix out-of-bounds in usb_set_configuration
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (46 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 009/147] libata: array underflow in ata_find_dev() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 011/147] x86/acpi: Prevent out of bound access caused by broken ACPI tables Ben Hutchings
` (99 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Andrey Konovalov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit bd7a3fe770ebd8391d1c7d072ff88e9e76d063eb upstream.
Andrey Konovalov reported a possible out-of-bounds problem for a USB interface
association descriptor. He writes:
It seems there's no proper size check of a USB_DT_INTERFACE_ASSOCIATION
descriptor. It's only checked that the size is >= 2 in
usb_parse_configuration(), so find_iad() might do out-of-bounds access
to intf_assoc->bInterfaceCount.
And he's right, we don't check for crazy descriptors of this type very well, so
resolve this problem. Yet another issue found by syzkaller...
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/config.c | 14 +++++++++++---
include/linux/usb/ch9.h | 1 +
2 files changed, 12 insertions(+), 3 deletions(-)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -609,15 +609,23 @@ static int usb_parse_configuration(struc
} else if (header->bDescriptorType ==
USB_DT_INTERFACE_ASSOCIATION) {
+ struct usb_interface_assoc_descriptor *d;
+
+ d = (struct usb_interface_assoc_descriptor *)header;
+ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) {
+ dev_warn(ddev,
+ "config %d has an invalid interface association descriptor of length %d, skipping\n",
+ cfgno, d->bLength);
+ continue;
+ }
+
if (iad_num == USB_MAXIADS) {
dev_warn(ddev, "found more Interface "
"Association Descriptors "
"than allocated for in "
"configuration %d\n", cfgno);
} else {
- config->intf_assoc[iad_num] =
- (struct usb_interface_assoc_descriptor
- *)header;
+ config->intf_assoc[iad_num] = d;
iad_num++;
}
--- a/include/linux/usb/ch9.h
+++ b/include/linux/usb/ch9.h
@@ -686,6 +686,7 @@ struct usb_interface_assoc_descriptor {
__u8 iFunction;
} __attribute__ ((packed));
+#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8
/*-------------------------------------------------------------------------*/
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 011/147] x86/acpi: Prevent out of bound access caused by broken ACPI tables
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (47 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 088/147] USB: fix out-of-bounds in usb_set_configuration Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 045/147] qlge: avoid memcpy buffer overflow Ben Hutchings
` (98 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Seunghun Han, Thomas Gleixner, security, Rafael J. Wysocki,
Ingo Molnar
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Seunghun Han <kkamagui@gmail.com>
commit dad5ab0db8deac535d03e3fe3d8f2892173fa6a4 upstream.
The bus_irq argument of mp_override_legacy_irq() is used as the index into
the isa_irq_to_gsi[] array. The bus_irq argument originates from
ACPI_MADT_TYPE_IO_APIC and ACPI_MADT_TYPE_INTERRUPT items in the ACPI
tables, but is nowhere sanity checked.
That allows broken or malicious ACPI tables to overwrite memory, which
might cause malfunction, panic or arbitrary code execution.
Add a sanity check and emit a warning when that triggers.
[ tglx: Added warning and rewrote changelog ]
Signed-off-by: Seunghun Han <kkamagui@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: security@kernel.org
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kernel/acpi/boot.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -952,6 +952,14 @@ void __init mp_override_legacy_irq(u8 bu
struct mpc_intsrc mp_irq;
/*
+ * Check bus_irq boundary.
+ */
+ if (bus_irq >= NR_IRQS_LEGACY) {
+ pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq);
+ return;
+ }
+
+ /*
* Convert 'gsi' to 'ioapic.pin'.
*/
ioapic = mp_find_ioapic(gsi);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 045/147] qlge: avoid memcpy buffer overflow
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (48 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 011/147] x86/acpi: Prevent out of bound access caused by broken ACPI tables Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 117/147] isdn: hfcpci_softirq: get func return to suppress compiler warning Ben Hutchings
` (97 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Arnd Bergmann, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit e58f95831e7468d25eb6e41f234842ecfe6f014f upstream.
gcc-8.0.0 (snapshot) points out that we copy a variable-length string
into a fixed length field using memcpy() with the destination length,
and that ends up copying whatever follows the string:
inlined from 'ql_core_dump' at drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:1106:2:
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:708:2: error: 'memcpy' reading 15 bytes from a region of size 14 [-Werror=stringop-overflow=]
memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
Changing it to use strncpy() will instead zero-pad the destination,
which seems to be the right thing to do here.
The bug is probably harmless, but it seems like a good idea to address
it in stable kernels as well, if only for the purpose of building with
gcc-8 without warnings.
Fixes: a61f80261306 ("qlge: Add ethtool register dump function.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -724,7 +724,7 @@ static void ql_build_coredump_seg_header
seg_hdr->cookie = MPI_COREDUMP_COOKIE;
seg_hdr->segNum = seg_number;
seg_hdr->segSize = seg_size;
- memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
+ strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
}
/*
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 117/147] isdn: hfcpci_softirq: get func return to suppress compiler warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (49 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 045/147] qlge: avoid memcpy buffer overflow Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 014/147] RDMA/uverbs: Fix the check for port number Ben Hutchings
` (96 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Antonio Alecrim Jr
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Antonio Alecrim Jr <antonio.alecrim@gmail.com>
commit d6d6d1bc44362112e10a48d434e5b3c716152003 upstream.
Signed-off-by: Antonio Alecrim Jr <antonio.alecrim@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/isdn/hardware/mISDN/hfcpci.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/isdn/hardware/mISDN/hfcpci.c
+++ b/drivers/isdn/hardware/mISDN/hfcpci.c
@@ -2316,8 +2316,8 @@ _hfcpci_softirq(struct device *dev, void
static void
hfcpci_softirq(void *arg)
{
- (void) driver_for_each_device(&hfc_driver.driver, NULL, arg,
- _hfcpci_softirq);
+ WARN_ON_ONCE(driver_for_each_device(&hfc_driver.driver, NULL, arg,
+ _hfcpci_softirq) != 0);
/* if next event would be in the past ... */
if ((s32)(hfc_jiffies + tics - jiffies) <= 0)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 014/147] RDMA/uverbs: Fix the check for port number
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (50 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 117/147] isdn: hfcpci_softirq: get func return to suppress compiler warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 033/147] IB/uverbs: Fix device cleanup Ben Hutchings
` (95 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Ismail, Mustafa, Doug Ledford, Mike Marciniszyn, Steve Wise
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Ismail, Mustafa" <mustafa.ismail@intel.com>
commit 5a7a88f1b488e4ee49eb3d5b82612d4d9ffdf2c3 upstream.
The port number is only valid if IB_QP_PORT is set in the mask.
So only check port number if it is valid to prevent modify_qp from
failing due to an invalid port number.
Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Reviewed-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[bwh: Backported to 3.2: command structure is cmd not cmd->base]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/core/uverbs_cmd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1790,7 +1790,8 @@ ssize_t ib_uverbs_modify_qp(struct ib_uv
goto out;
}
- if (!rdma_is_port_valid(qp->device, cmd.port_num)) {
+ if ((cmd.attr_mask & IB_QP_PORT) &&
+ !rdma_is_port_valid(qp->device, cmd.port_num)) {
ret = -EINVAL;
goto release_qp;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 033/147] IB/uverbs: Fix device cleanup
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (51 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 014/147] RDMA/uverbs: Fix the check for port number Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 001/147] fuse: initialize the flock flag in fuse_file on allocation Ben Hutchings
` (94 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Doug Ledford, Yishai Hadas, Matan Barak, Leon Romanovsky,
Jason Gunthorpe
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yishai Hadas <yishaih@mellanox.com>
commit efdd6f53b10aead0f5cf19a93dd3eb268ac0d991 upstream.
Uverbs device should be cleaned up only when there is no
potential usage of.
As part of ib_uverbs_remove_one which might be triggered upon reset flow
the device reference count is decreased as expected and leave the final
cleanup to the FDs that were opened.
Current code increases reference count upon opening a new command FD and
decreases it upon closing the file. The event FD is opened internally
and rely on the command FD by taking on it a reference count.
In case that the command FD was closed and just later the event FD we
may ensure that the device resources as of srcu are still alive as they
are still in use.
Fixing the above by moving the reference count decreasing to the place
where the command FD is really freed instead of doing that when it was
just closed.
fixes: 036b10635739 ("IB/uverbs: Enable device removal when there are active user space applications")
Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
Reviewed-by: Matan Barak <matanb@mellanox.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Tested-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/core/uverbs_main.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -290,6 +290,7 @@ static void ib_uverbs_release_file(struc
if (atomic_dec_and_test(&file->device->refcount))
ib_uverbs_comp_dev(file->device);
+ kobject_put(&file->device->kobj);
kfree(file);
}
@@ -671,7 +672,6 @@ err:
static int ib_uverbs_close(struct inode *inode, struct file *filp)
{
struct ib_uverbs_file *file = filp->private_data;
- struct ib_uverbs_device *dev = file->device;
ib_uverbs_cleanup_ucontext(file, file->ucontext);
@@ -679,7 +679,6 @@ static int ib_uverbs_close(struct inode
kref_put(&file->async_file->ref, ib_uverbs_release_event_file);
kref_put(&file->ref, ib_uverbs_release_file);
- kobject_put(&dev->kobj);
return 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 001/147] fuse: initialize the flock flag in fuse_file on allocation
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (52 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 033/147] IB/uverbs: Fix device cleanup Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 093/147] mm/huge_memory: Fix unused label warning Ben Hutchings
` (93 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mateusz Jurczyk, Miklos Szeredi
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mateusz Jurczyk <mjurczyk@google.com>
commit 68227c03cba84a24faf8a7277d2b1a03c8959c2c upstream.
Before the patch, the flock flag could remain uninitialized for the
lifespan of the fuse_file allocation. Unless set to true in
fuse_file_flock(), it would remain in an indeterminate state until read in
an if statement in fuse_release_common(). This could consequently lead to
taking an unexpected branch in the code.
The bug was discovered by a runtime instrumentation designed to detect use
of uninitialized memory in the kernel.
Signed-off-by: Mateusz Jurczyk <mjurczyk@google.com>
Fixes: 37fb3a30b462 ("fuse: fix flock")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/fuse/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -52,7 +52,7 @@ struct fuse_file *fuse_file_alloc(struct
{
struct fuse_file *ff;
- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL);
+ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL);
if (unlikely(!ff))
return NULL;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 093/147] mm/huge_memory: Fix unused label warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (53 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 001/147] fuse: initialize the flock flag in fuse_file on allocation Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 122/147] mtd: sst25l: kill unused variable Ben Hutchings
` (92 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
This label is unused since commit 2ea6895123eb8604c1c0c153e2fcd1305fb96aca
"mm/huge_memory.c: fix up "mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for
thp" backport". There's no upstream equivalent of this as the label is
still used there.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1009,7 +1009,6 @@ struct page *follow_trans_huge_pmd(struc
if (flags & FOLL_GET)
get_page_foll(page);
-out:
return page;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 122/147] mtd: sst25l: kill unused variable
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (54 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 093/147] mm/huge_memory: Fix unused label warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 100/147] drbd: check MODULE for THIS_MODULE Ben Hutchings
` (91 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Artem Bityutskiy, David Woodhouse
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
commit d81a32f2c16a3c42cf26f2216765c520630daa4e upstream.
Fix the following gcc warning:
drivers/mtd/devices/sst25l.c: In function ‘sst25l_probe’:
drivers/mtd/devices/sst25l.c:381:11: warning: unused variable ‘i’ [-Wunused-variable]
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/mtd/devices/sst25l.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/devices/sst25l.c
+++ b/drivers/mtd/devices/sst25l.c
@@ -378,7 +378,7 @@ static int __devinit sst25l_probe(struct
struct flash_info *flash_info;
struct sst25l_flash *flash;
struct flash_platform_data *data;
- int ret, i;
+ int ret;
flash_info = sst25l_match_device(spi);
if (!flash_info)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 100/147] drbd: check MODULE for THIS_MODULE
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (55 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 122/147] mtd: sst25l: kill unused variable Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 127/147] staging: cxt1e1: remove unnecessary function, VMETRO_TRACE Ben Hutchings
` (90 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Lars Ellenberg, Cong Wang, Philipp Reisner
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Cong Wang <xiyou.wangcong@gmail.com>
commit bc4854bc91c9a7f117437215cd8b16a0a5671d93 upstream.
THIS_MODULE is NULL only when drbd is compiled as built-in,
so the #ifdef CONFIG_MODULES should be #ifdef MODULE instead.
This fixes the warning:
drivers/block/drbd/drbd_main.c: In function ‘drbd_buildtag’:
drivers/block/drbd/drbd_main.c:4187:24: warning: the comparison will always evaluate as ‘true’ for the address of ‘__this_module’ will never be NULL [-Waddress]
Signed-off-by: WANG Cong <xiyou.wangcong@gmail.com>
Signed-off-by: Philipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: Lars Ellenberg <lars.ellenberg@linbit.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/block/drbd/drbd_main.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -4183,12 +4183,11 @@ const char *drbd_buildtag(void)
static char buildtag[38] = "\0uilt-in";
if (buildtag[0] == 0) {
-#ifdef CONFIG_MODULES
- if (THIS_MODULE != NULL)
- sprintf(buildtag, "srcversion: %-24s", THIS_MODULE->srcversion);
- else
+#ifdef MODULE
+ sprintf(buildtag, "srcversion: %-24s", THIS_MODULE->srcversion);
+#else
+ buildtag[0] = 'b';
#endif
- buildtag[0] = 'b';
}
return buildtag;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 127/147] staging: cxt1e1: remove unnecessary function, VMETRO_TRACE
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (56 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 100/147] drbd: check MODULE for THIS_MODULE Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 051/147] ipv6: Fix may be used uninitialized warning in rt6_check Ben Hutchings
` (89 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Dan Carpenter, Greg Kroah-Hartman, SeongJae Park
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj38.park@gmail.com>
commit ce8386da7488c998969288355111996c2c23c892 upstream.
VMETRO_TRACE isn't called from anywhere. So delete it.
Signed-off-by: SeongJae Park <sj38.park@gmail.com>
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/cxt1e1/functions.c | 9 ---------
drivers/staging/cxt1e1/pmcc4.h | 1 -
2 files changed, 10 deletions(-)
--- a/drivers/staging/cxt1e1/functions.c
+++ b/drivers/staging/cxt1e1/functions.c
@@ -270,15 +270,6 @@ void sd_recv_consume(void *token, size_t
extern ci_t *CI; /* dummy pointer to board ZERO's data */
void
-VMETRO_TRACE (void *x)
-{
- u_int32_t y = (u_int32_t) x;
-
- pci_write_32 ((u_int32_t *) &CI->cpldbase->leds, y);
-}
-
-
-void
VMETRO_TRIGGER (ci_t * ci, int x)
{
comet_t *comet;
--- a/drivers/staging/cxt1e1/pmcc4.h
+++ b/drivers/staging/cxt1e1/pmcc4.h
@@ -138,7 +138,6 @@ void sbeid_set_bdtype (ci_t * ci)
void sbeid_set_hdwbid (ci_t * ci);
u_int32_t sbeCrc (u_int8_t *, u_int32_t, u_int32_t, u_int32_t *);
-void VMETRO_TRACE (void *); /* put data into 8 LEDs */
void VMETRO_TRIGGER (ci_t *, int); /* Note: int = 0(default)
* thru 15 */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 051/147] ipv6: Fix may be used uninitialized warning in rt6_check
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (57 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 127/147] staging: cxt1e1: remove unnecessary function, VMETRO_TRACE Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 062/147] l2tp: hold tunnel while handling genl TUNNEL_GET commands Ben Hutchings
` (88 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Steffen Klassert
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
commit 3614364527daa870264f6dde77f02853cdecd02c upstream.
rt_cookie might be used uninitialized, fix this by
initializing it.
Fixes: c5cff8561d2d ("ipv6: add rcu grace period before freeing fib6_node")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv6/route.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -964,7 +964,7 @@ struct dst_entry *ip6_blackhole_route(st
static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
{
struct rt6_info *rt;
- u32 rt_cookie;
+ u32 rt_cookie = 0;
rt = (struct rt6_info *) dst;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 062/147] l2tp: hold tunnel while handling genl TUNNEL_GET commands
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (58 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 051/147] ipv6: Fix may be used uninitialized warning in rt6_check Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 090/147] HID: usbhid: fix out-of-bounds bug Ben Hutchings
` (87 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Guillaume Nault
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 4e4b21da3acc68a7ea55f850cacc13706b7480e9 upstream.
Use l2tp_tunnel_get() instead of l2tp_tunnel_find() so that we get
a reference on the tunnel, preventing l2tp_tunnel_destruct() from
freeing it from under us.
Also move l2tp_tunnel_get() below nlmsg_new() so that we only take
the reference when needed.
Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/l2tp/l2tp_netlink.c | 27 +++++++++++++++------------
1 file changed, 15 insertions(+), 12 deletions(-)
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -295,34 +295,37 @@ static int l2tp_nl_cmd_tunnel_get(struct
if (!info->attrs[L2TP_ATTR_CONN_ID]) {
ret = -EINVAL;
- goto out;
+ goto err;
}
tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
- tunnel = l2tp_tunnel_find(net, tunnel_id);
- if (tunnel == NULL) {
- ret = -ENODEV;
- goto out;
- }
-
msg = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL);
if (!msg) {
ret = -ENOMEM;
- goto out;
+ goto err;
+ }
+
+ tunnel = l2tp_tunnel_get(net, tunnel_id);
+ if (!tunnel) {
+ ret = -ENODEV;
+ goto err_nlmsg;
}
ret = l2tp_nl_tunnel_send(msg, info->snd_pid, info->snd_seq,
NLM_F_ACK, tunnel);
if (ret < 0)
- goto err_out;
+ goto err_nlmsg_tunnel;
+
+ l2tp_tunnel_dec_refcount(tunnel);
return genlmsg_unicast(net, msg, info->snd_pid);
-err_out:
+err_nlmsg_tunnel:
+ l2tp_tunnel_dec_refcount(tunnel);
+err_nlmsg:
nlmsg_free(msg);
-
-out:
+err:
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 090/147] HID: usbhid: fix out-of-bounds bug
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (59 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 062/147] l2tp: hold tunnel while handling genl TUNNEL_GET commands Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 111/147] pkt_sched: Fix warning false positives Ben Hutchings
` (86 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andrey Konovalov, Jiri Kosina, Alan Stern, Jaejoong Kim
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jaejoong Kim <climbbb.kim@gmail.com>
commit f043bfc98c193c284e2cd768fefabe18ac2fed9b upstream.
The hid descriptor identifies the length and type of subordinate
descriptors for a device. If the received hid descriptor is smaller than
the size of the struct hid_descriptor, it is possible to cause
out-of-bounds.
In addition, if bNumDescriptors of the hid descriptor have an incorrect
value, this can also cause out-of-bounds while approaching hdesc->desc[n].
So check the size of hid descriptor and bNumDescriptors.
BUG: KASAN: slab-out-of-bounds in usbhid_parse+0x9b1/0xa20
Read of size 1 at addr ffff88006c5f8edf by task kworker/1:2/1261
CPU: 1 PID: 1261 Comm: kworker/1:2 Not tainted
4.14.0-rc1-42251-gebb2c2437d80 #169
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Workqueue: usb_hub_wq hub_event
Call Trace:
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x395 lib/dump_stack.c:52
print_address_description+0x78/0x280 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351
kasan_report+0x22f/0x340 mm/kasan/report.c:409
__asan_report_load1_noabort+0x19/0x20 mm/kasan/report.c:427
usbhid_parse+0x9b1/0xa20 drivers/hid/usbhid/hid-core.c:1004
hid_add_device+0x16b/0xb30 drivers/hid/hid-core.c:2944
usbhid_probe+0xc28/0x1100 drivers/hid/usbhid/hid-core.c:1369
usb_probe_interface+0x35d/0x8e0 drivers/usb/core/driver.c:361
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_set_configuration+0x104e/0x1870 drivers/usb/core/message.c:1932
generic_probe+0x73/0xe0 drivers/usb/core/generic.c:174
usb_probe_device+0xaf/0xe0 drivers/usb/core/driver.c:266
really_probe drivers/base/dd.c:413
driver_probe_device+0x610/0xa00 drivers/base/dd.c:557
__device_attach_driver+0x230/0x290 drivers/base/dd.c:653
bus_for_each_drv+0x161/0x210 drivers/base/bus.c:463
__device_attach+0x26e/0x3d0 drivers/base/dd.c:710
device_initial_probe+0x1f/0x30 drivers/base/dd.c:757
bus_probe_device+0x1eb/0x290 drivers/base/bus.c:523
device_add+0xd0b/0x1660 drivers/base/core.c:1835
usb_new_device+0x7b8/0x1020 drivers/usb/core/hub.c:2457
hub_port_connect drivers/usb/core/hub.c:4903
hub_port_connect_change drivers/usb/core/hub.c:5009
port_event drivers/usb/core/hub.c:5115
hub_event+0x194d/0x3740 drivers/usb/core/hub.c:5195
process_one_work+0xc7f/0x1db0 kernel/workqueue.c:2119
worker_thread+0x221/0x1850 kernel/workqueue.c:2253
kthread+0x3a1/0x470 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/usbhid/hid-core.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -912,6 +912,8 @@ static int usbhid_parse(struct hid_devic
unsigned int rsize = 0;
char *rdesc;
int ret, n;
+ int num_descriptors;
+ size_t offset = offsetof(struct hid_descriptor, desc);
quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
le16_to_cpu(dev->descriptor.idProduct));
@@ -934,10 +936,18 @@ static int usbhid_parse(struct hid_devic
return -ENODEV;
}
+ if (hdesc->bLength < sizeof(struct hid_descriptor)) {
+ dbg_hid("hid descriptor is too short\n");
+ return -EINVAL;
+ }
+
hid->version = le16_to_cpu(hdesc->bcdHID);
hid->country = hdesc->bCountryCode;
- for (n = 0; n < hdesc->bNumDescriptors; n++)
+ num_descriptors = min_t(int, hdesc->bNumDescriptors,
+ (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
+
+ for (n = 0; n < num_descriptors; n++)
if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 111/147] pkt_sched: Fix warning false positives.
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (60 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 090/147] HID: usbhid: fix out-of-bounds bug Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 120/147] mtd: map: Fix compilation warning Ben Hutchings
` (85 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
commit f54ba7798848ce1385a71b36a2c997422c82220a upstream.
GCC refuses to recognize that all error control flows do in fact
set err to something.
Add an explicit initialization to shut it up.
net/sched/sch_drr.c: In function ‘drr_enqueue’:
net/sched/sch_drr.c:359:11: warning: ‘err’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/sched/sch_qfq.c: In function ‘qfq_enqueue’:
net/sched/sch_qfq.c:885:11: warning: ‘err’ may be used uninitialized in this function [-Wmaybe-uninitialized]
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_drr.c | 2 +-
net/sched/sch_qfq.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -351,7 +351,7 @@ static int drr_enqueue(struct sk_buff *s
{
struct drr_sched *q = qdisc_priv(sch);
struct drr_class *cl;
- int err;
+ int err = 0;
cl = drr_classify(skb, sch, &err);
if (cl == NULL) {
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -846,7 +846,7 @@ static int qfq_enqueue(struct sk_buff *s
struct qfq_sched *q = qdisc_priv(sch);
struct qfq_group *grp;
struct qfq_class *cl;
- int err;
+ int err = 0;
u64 roundedS;
int s;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 120/147] mtd: map: Fix compilation warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (61 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 111/147] pkt_sched: Fix warning false positives Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 128/147] Staging: iio/accel: Changed return type of lis3l02dq_read_event_config() to int Ben Hutchings
` (84 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Artem Bityutskiy, Viresh Kumar
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit 3e9ce49e0ef95e22790a74720f0068696b2477c9 upstream.
This patch is an attempt to fix following compilation warning.
In file included from drivers/mtd/chips/cfi_cmdset_0001.c:35:0:
drivers/mtd/chips/cfi_cmdset_0001.c: In function 'cfi_intelext_write_words':
include/linux/mtd/map.h:331:11: warning: 'r.x[0]' may be used uninitialized in this function [-Wmaybe-uninitialized]
I could have used uninitialized_var() too, but didn't used it as the final else
part of map_word_load() is missing. So there is a chance that it might be passed
uninitialized. Better initialize to zero.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/mtd/map.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/mtd/map.h
+++ b/include/linux/mtd/map.h
@@ -327,7 +327,7 @@ static inline int map_word_bitsset(struc
static inline map_word map_word_load(struct map_info *map, const void *ptr)
{
- map_word r;
+ map_word r = {{0} };
if (map_bankwidth_is_1(map))
r.x[0] = *(unsigned char *)ptr;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 128/147] Staging: iio/accel: Changed return type of lis3l02dq_read_event_config() to int
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (62 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 120/147] mtd: map: Fix compilation warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 142/147] net: am2150: fix nmclan_cs.c shared interrupt handling Ben Hutchings
` (83 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andreas Ruprecht, Jonathan Cameron, Greg Kroah-Hartman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Ruprecht <rupran@einserver.de>
commit 28998e005bb669b60de0e432d6f142267f5c1403 upstream.
The lis3l02dq_read_event_config() function returned an ssize_t up to
now, which lead to a compiler warning in line 660 (initialization from
incompatible pointer type). The iio_info struct is defined to accept an
int-returning function as the read_event_config parameter.
Also it seems odd to have the check for (ret < 0) and return ret in
this case, when the return type is signed.
Signed-off-by: Andreas Ruprecht <rupran@einserver.de>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/accel/lis3l02dq_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/accel/lis3l02dq_core.c
+++ b/drivers/staging/iio/accel/lis3l02dq_core.c
@@ -534,7 +534,7 @@ static struct iio_chan_spec lis3l02dq_ch
};
-static ssize_t lis3l02dq_read_event_config(struct iio_dev *indio_dev,
+static int lis3l02dq_read_event_config(struct iio_dev *indio_dev,
u64 event_code)
{
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 142/147] net: am2150: fix nmclan_cs.c shared interrupt handling
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (63 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 128/147] Staging: iio/accel: Changed return type of lis3l02dq_read_event_config() to int Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 023/147] ARM: pxa: select both FB and FB_W100 for eseries Ben Hutchings
` (82 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Arnd Bergmann, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 96a30175f927facfb421655ef08b7a0fe546fbed upstream.
A recent patch tried to work around a valid warning for the use of a
deprecated interface by blindly changing from the old
pcmcia_request_exclusive_irq() interface to pcmcia_request_irq().
This driver has an interrupt handler that is not currently aware
of shared interrupts, but can be easily converted to be.
At the moment, the driver reads the interrupt status register
repeatedly until it contains only zeroes in the interesting bits,
and handles each bit individually.
This patch adds the missing part of returning IRQ_NONE in case none
of the bits are set to start with, so we can move on to the next
interrupt source.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Fixes: 5f5316fcd08ef7 ("am2150: Update nmclan_cs.c to use update PCMCIA API")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/amd/nmclan_cs.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/ethernet/amd/nmclan_cs.c
+++ b/drivers/net/ethernet/amd/nmclan_cs.c
@@ -955,6 +955,8 @@ static irqreturn_t mace_interrupt(int ir
do {
/* WARNING: MACE_IR is a READ/CLEAR port! */
status = inb(ioaddr + AM2150_MACE_BASE + MACE_IR);
+ if (!(status & ~MACE_IMR_DEFAULT) && IntrCnt == MACE_MAX_IR_ITERATIONS)
+ return IRQ_NONE;
pr_debug("mace_interrupt: irq 0x%X status 0x%X.\n", irq, status);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 023/147] ARM: pxa: select both FB and FB_W100 for eseries
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (64 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 142/147] net: am2150: fix nmclan_cs.c shared interrupt handling Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 029/147] gpio: tegra: fix unbalanced chained_irq_enter/exit Ben Hutchings
` (81 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Arnd Bergmann
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 1d20d8a9fce8f1e2ef00a0f3d068fa18d59ddf8f upstream.
We get a link error trying to access the w100fb_gpio_read/write
functions from the platform when the driver is a loadable module
or not built-in, so the platform already uses 'select' to hard-enable
the driver.
However, that fails if the framebuffer subsystem is disabled
altogether.
I've considered various ways to fix this properly, but they
all seem like too much work or too risky, so this simply
adds another 'select' to force the subsystem on as well.
Fixes: 82427de2c7c3 ("ARM: pxa: PXA_ESERIES depends on FB_W100.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/mach-pxa/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/mach-pxa/Kconfig
+++ b/arch/arm/mach-pxa/Kconfig
@@ -563,6 +563,7 @@ config ARCH_PXA_ESERIES
bool "PXA based Toshiba e-series PDAs"
select PXA25x
select FB_W100
+ select FB
config MACH_E330
bool "Toshiba e330"
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 029/147] gpio: tegra: fix unbalanced chained_irq_enter/exit
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (65 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 023/147] ARM: pxa: select both FB and FB_W100 for eseries Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 124/147] drivers/rtc/rtc-m41t80.c: remove disabled alarm functionality Ben Hutchings
` (80 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Michał Mirosław, Linus Walleij
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit 9e9509e38fbe034782339eb09c915f0b5765ff69 upstream.
When more than one GPIO IRQs are triggered simultaneously,
tegra_gpio_irq_handler() called chained_irq_exit() multiple
times for one chained_irq_enter().
Fixes: 3c92db9ac0ca3eee8e46e2424b6c074e2e394ad9
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
[Also changed the variable to a bool]
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpio/gpio-tegra.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/gpio/gpio-tegra.c
+++ b/drivers/gpio/gpio-tegra.c
@@ -230,7 +230,7 @@ static void tegra_gpio_irq_handler(unsig
struct tegra_gpio_bank *bank;
int port;
int pin;
- int unmasked = 0;
+ bool unmasked = false;
struct irq_chip *chip = irq_desc_get_chip(desc);
chained_irq_enter(chip, desc);
@@ -250,8 +250,8 @@ static void tegra_gpio_irq_handler(unsig
* before executing the hander so that we don't
* miss edges
*/
- if (lvl & (0x100 << pin)) {
- unmasked = 1;
+ if (!unmasked && lvl & (0x100 << pin)) {
+ unmasked = true;
chained_irq_exit(chip, desc);
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 124/147] drivers/rtc/rtc-m41t80.c: remove disabled alarm functionality
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (66 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 029/147] gpio: tegra: fix unbalanced chained_irq_enter/exit Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 020/147] IB/ipoib: Remove double pointer assigning Ben Hutchings
` (79 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul Bolle, John Stultz, Linus Torvalds
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <pebolle@tiscali.nl>
commit 48e9766726ebb8f5d98823fe6b32dff570bc04d8 upstream.
Commit c3b79770e51a ("rtc: m41t80: Workaround broken alarm
functionality") disabled m41t80's alarm functions. But since those
functions were not touched, building this driver triggers these GCC
warnings:
drivers/rtc/rtc-m41t80.c:216:12: warning: 'm41t80_rtc_alarm_irq_enable' defined but not used [-Wunused-function]
drivers/rtc/rtc-m41t80.c:238:12: warning: 'm41t80_rtc_set_alarm' defined but not used [-Wunused-function]
drivers/rtc/rtc-m41t80.c:308:12: warning: 'm41t80_rtc_read_alarm' defined but not used [-Wunused-function]
Remove these functions (and the commented out references to them) to
silence these warnings. Anyone wanting to fix the alarm irq functionality
can easily find the removed code in the git log of this file or through
some web searches.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Cc: John Stultz <john.stultz@linaro.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/rtc/rtc-m41t80.c | 157 ++---------------------------------------------
1 file changed, 4 insertions(+), 153 deletions(-)
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -213,163 +213,14 @@ static int m41t80_rtc_set_time(struct de
return m41t80_set_datetime(to_i2c_client(dev), tm);
}
-static int m41t80_rtc_alarm_irq_enable(struct device *dev, unsigned int enabled)
-{
- struct i2c_client *client = to_i2c_client(dev);
- int rc;
-
- rc = i2c_smbus_read_byte_data(client, M41T80_REG_ALARM_MON);
- if (rc < 0)
- goto err;
-
- if (enabled)
- rc |= M41T80_ALMON_AFE;
- else
- rc &= ~M41T80_ALMON_AFE;
-
- if (i2c_smbus_write_byte_data(client, M41T80_REG_ALARM_MON, rc) < 0)
- goto err;
-
- return 0;
-err:
- return -EIO;
-}
-
-static int m41t80_rtc_set_alarm(struct device *dev, struct rtc_wkalrm *t)
-{
- struct i2c_client *client = to_i2c_client(dev);
- u8 wbuf[1 + M41T80_ALARM_REG_SIZE];
- u8 *buf = &wbuf[1];
- u8 *reg = buf - M41T80_REG_ALARM_MON;
- u8 dt_addr[1] = { M41T80_REG_ALARM_MON };
- struct i2c_msg msgs_in[] = {
- {
- .addr = client->addr,
- .flags = 0,
- .len = 1,
- .buf = dt_addr,
- },
- {
- .addr = client->addr,
- .flags = I2C_M_RD,
- .len = M41T80_ALARM_REG_SIZE,
- .buf = buf,
- },
- };
- struct i2c_msg msgs[] = {
- {
- .addr = client->addr,
- .flags = 0,
- .len = 1 + M41T80_ALARM_REG_SIZE,
- .buf = wbuf,
- },
- };
-
- if (i2c_transfer(client->adapter, msgs_in, 2) < 0) {
- dev_err(&client->dev, "read error\n");
- return -EIO;
- }
- reg[M41T80_REG_ALARM_MON] &= ~(0x1f | M41T80_ALMON_AFE);
- reg[M41T80_REG_ALARM_DAY] = 0;
- reg[M41T80_REG_ALARM_HOUR] &= ~(0x3f | 0x80);
- reg[M41T80_REG_ALARM_MIN] = 0;
- reg[M41T80_REG_ALARM_SEC] = 0;
-
- wbuf[0] = M41T80_REG_ALARM_MON; /* offset into rtc's regs */
- reg[M41T80_REG_ALARM_SEC] |= t->time.tm_sec >= 0 ?
- bin2bcd(t->time.tm_sec) : 0x80;
- reg[M41T80_REG_ALARM_MIN] |= t->time.tm_min >= 0 ?
- bin2bcd(t->time.tm_min) : 0x80;
- reg[M41T80_REG_ALARM_HOUR] |= t->time.tm_hour >= 0 ?
- bin2bcd(t->time.tm_hour) : 0x80;
- reg[M41T80_REG_ALARM_DAY] |= t->time.tm_mday >= 0 ?
- bin2bcd(t->time.tm_mday) : 0x80;
- if (t->time.tm_mon >= 0)
- reg[M41T80_REG_ALARM_MON] |= bin2bcd(t->time.tm_mon + 1);
- else
- reg[M41T80_REG_ALARM_DAY] |= 0x40;
-
- if (i2c_transfer(client->adapter, msgs, 1) != 1) {
- dev_err(&client->dev, "write error\n");
- return -EIO;
- }
-
- if (t->enabled) {
- reg[M41T80_REG_ALARM_MON] |= M41T80_ALMON_AFE;
- if (i2c_smbus_write_byte_data(client, M41T80_REG_ALARM_MON,
- reg[M41T80_REG_ALARM_MON]) < 0) {
- dev_err(&client->dev, "write error\n");
- return -EIO;
- }
- }
- return 0;
-}
-
-static int m41t80_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *t)
-{
- struct i2c_client *client = to_i2c_client(dev);
- u8 buf[M41T80_ALARM_REG_SIZE + 1]; /* all alarm regs and flags */
- u8 dt_addr[1] = { M41T80_REG_ALARM_MON };
- u8 *reg = buf - M41T80_REG_ALARM_MON;
- struct i2c_msg msgs[] = {
- {
- .addr = client->addr,
- .flags = 0,
- .len = 1,
- .buf = dt_addr,
- },
- {
- .addr = client->addr,
- .flags = I2C_M_RD,
- .len = M41T80_ALARM_REG_SIZE + 1,
- .buf = buf,
- },
- };
-
- if (i2c_transfer(client->adapter, msgs, 2) < 0) {
- dev_err(&client->dev, "read error\n");
- return -EIO;
- }
- t->time.tm_sec = -1;
- t->time.tm_min = -1;
- t->time.tm_hour = -1;
- t->time.tm_mday = -1;
- t->time.tm_mon = -1;
- if (!(reg[M41T80_REG_ALARM_SEC] & 0x80))
- t->time.tm_sec = bcd2bin(reg[M41T80_REG_ALARM_SEC] & 0x7f);
- if (!(reg[M41T80_REG_ALARM_MIN] & 0x80))
- t->time.tm_min = bcd2bin(reg[M41T80_REG_ALARM_MIN] & 0x7f);
- if (!(reg[M41T80_REG_ALARM_HOUR] & 0x80))
- t->time.tm_hour = bcd2bin(reg[M41T80_REG_ALARM_HOUR] & 0x3f);
- if (!(reg[M41T80_REG_ALARM_DAY] & 0x80))
- t->time.tm_mday = bcd2bin(reg[M41T80_REG_ALARM_DAY] & 0x3f);
- if (!(reg[M41T80_REG_ALARM_DAY] & 0x40))
- t->time.tm_mon = bcd2bin(reg[M41T80_REG_ALARM_MON] & 0x1f) - 1;
- t->time.tm_year = -1;
- t->time.tm_wday = -1;
- t->time.tm_yday = -1;
- t->time.tm_isdst = -1;
- t->enabled = !!(reg[M41T80_REG_ALARM_MON] & M41T80_ALMON_AFE);
- t->pending = !!(reg[M41T80_REG_FLAGS] & M41T80_FLAGS_AF);
- return 0;
-}
-
+/*
+ * XXX - m41t80 alarm functionality is reported broken.
+ * until it is fixed, don't register alarm functions.
+ */
static struct rtc_class_ops m41t80_rtc_ops = {
.read_time = m41t80_rtc_read_time,
.set_time = m41t80_rtc_set_time,
- /*
- * XXX - m41t80 alarm functionality is reported broken.
- * until it is fixed, don't register alarm functions.
- *
- .read_alarm = m41t80_rtc_read_alarm,
- .set_alarm = m41t80_rtc_set_alarm,
- */
.proc = m41t80_rtc_proc,
- /*
- * See above comment on broken alarm
- *
- .alarm_irq_enable = m41t80_rtc_alarm_irq_enable,
- */
};
#if defined(CONFIG_RTC_INTF_SYSFS) || defined(CONFIG_RTC_INTF_SYSFS_MODULE)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 020/147] IB/ipoib: Remove double pointer assigning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (67 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 124/147] drivers/rtc/rtc-m41t80.c: remove disabled alarm functionality Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 059/147] l2tp: hold tunnel while looking up sessions in l2tp_netlink Ben Hutchings
` (78 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Leon Romanovsky
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit 1b355094b308f3377c8f574ce86135ee159c6285 upstream.
There is no need to assign "p" pointer twice.
This patch fixes the following smatch warning:
drivers/infiniband/ulp/ipoib/ipoib_cm.c:517 ipoib_cm_rx_handler() warn:
missing break? reassigning 'p->id'
Fixes: 839fcaba355a ("IPoIB: Connected mode experimental support")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/ulp/ipoib/ipoib_cm.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -506,7 +506,6 @@ static int ipoib_cm_rx_handler(struct ib
case IB_CM_REQ_RECEIVED:
return ipoib_cm_req_handler(cm_id, event);
case IB_CM_DREQ_RECEIVED:
- p = cm_id->context;
ib_send_cm_drep(cm_id, NULL, 0);
/* Fall through */
case IB_CM_REJ_RECEIVED:
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 059/147] l2tp: hold tunnel while looking up sessions in l2tp_netlink
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (68 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 020/147] IB/ipoib: Remove double pointer assigning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 066/147] cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs Ben Hutchings
` (77 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Guillaume Nault, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit 54652eb12c1b72e9602d09cb2821d5760939190f upstream.
l2tp_tunnel_find() doesn't take a reference on the returned tunnel.
Therefore, it's unsafe to use it because the returned tunnel can go
away on us anytime.
Fix this by defining l2tp_tunnel_get(), which works like
l2tp_tunnel_find(), but takes a reference on the returned tunnel.
Caller then has to drop this reference using l2tp_tunnel_dec_refcount().
As l2tp_tunnel_dec_refcount() needs to be moved to l2tp_core.h, let's
simplify the patch and not move the L2TP_REFCNT_DEBUG part. This code
has been broken (not even compiling) in May 2012 by
commit a4ca44fa578c ("net: l2tp: Standardize logging styles")
and fixed more than two years later by
commit 29abe2fda54f ("l2tp: fix missing line continuation"). So it
doesn't appear to be used by anyone.
Same thing for l2tp_tunnel_free(); instead of moving it to l2tp_core.h,
let's just simplify things and call kfree_rcu() directly in
l2tp_tunnel_dec_refcount(). Extra assertions and debugging code
provided by l2tp_tunnel_free() didn't help catching any of the
reference counting and socket handling issues found while working on
this series.
Fixes: 309795f4bec2 ("l2tp: Add netlink control API for L2TP")
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: l2tp_tunnel_free() does more than just kfree_rcu(), so
don't remove it]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -112,7 +112,6 @@ struct l2tp_net {
};
static void l2tp_session_set_header_len(struct l2tp_session *session, int version);
-static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
static void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
static inline struct l2tp_net *l2tp_pernet(const struct net *net)
@@ -123,33 +122,6 @@ static inline struct l2tp_net *l2tp_pern
}
-/* Tunnel reference counts. Incremented per session that is added to
- * the tunnel.
- */
-static inline void l2tp_tunnel_inc_refcount_1(struct l2tp_tunnel *tunnel)
-{
- atomic_inc(&tunnel->ref_count);
-}
-
-static inline void l2tp_tunnel_dec_refcount_1(struct l2tp_tunnel *tunnel)
-{
- if (atomic_dec_and_test(&tunnel->ref_count))
- l2tp_tunnel_free(tunnel);
-}
-#ifdef L2TP_REFCNT_DEBUG
-#define l2tp_tunnel_inc_refcount(_t) do { \
- printk(KERN_DEBUG "l2tp_tunnel_inc_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
- l2tp_tunnel_inc_refcount_1(_t); \
- } while (0)
-#define l2tp_tunnel_dec_refcount(_t) do { \
- printk(KERN_DEBUG "l2tp_tunnel_dec_refcount: %s:%d %s: cnt=%d\n", __func__, __LINE__, (_t)->name, atomic_read(&_t->ref_count)); \
- l2tp_tunnel_dec_refcount_1(_t); \
- } while (0)
-#else
-#define l2tp_tunnel_inc_refcount(t) l2tp_tunnel_inc_refcount_1(t)
-#define l2tp_tunnel_dec_refcount(t) l2tp_tunnel_dec_refcount_1(t)
-#endif
-
/* Session hash global list for L2TPv3.
* The session_id SHOULD be random according to RFC3931, but several
* L2TP implementations use incrementing session_ids. So we do a real
@@ -225,6 +197,27 @@ struct l2tp_session *l2tp_session_find(s
}
EXPORT_SYMBOL_GPL(l2tp_session_find);
+/* Lookup a tunnel. A new reference is held on the returned tunnel. */
+struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
+{
+ const struct l2tp_net *pn = l2tp_pernet(net);
+ struct l2tp_tunnel *tunnel;
+
+ rcu_read_lock_bh();
+ list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+ if (tunnel->tunnel_id == tunnel_id) {
+ l2tp_tunnel_inc_refcount(tunnel);
+ rcu_read_unlock_bh();
+
+ return tunnel;
+ }
+ }
+ rcu_read_unlock_bh();
+
+ return NULL;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
+
/* Like l2tp_session_find() but takes a reference on the returned session.
* Optionally calls session->ref() too if do_ref is true.
*/
@@ -1341,7 +1334,7 @@ again:
/* Really kill the tunnel.
* Come here only when all sessions have been cleared from the tunnel.
*/
-static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel)
{
struct l2tp_net *pn = l2tp_pernet(tunnel->l2tp_net);
@@ -1359,6 +1352,7 @@ static void l2tp_tunnel_free(struct l2tp
atomic_dec(&l2tp_tunnel_count);
}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_free);
/* Create a socket for the tunnel, if one isn't set up by
* userspace. This is used for static tunnels where there is no
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -222,6 +222,9 @@ out:
return tunnel;
}
+struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
+void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
+
struct l2tp_session *l2tp_session_get(const struct net *net,
struct l2tp_tunnel *tunnel,
u32 session_id, bool do_ref);
@@ -248,6 +251,17 @@ extern int l2tp_nl_register_ops(enum l2t
extern void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type);
int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg);
+static inline void l2tp_tunnel_inc_refcount(struct l2tp_tunnel *tunnel)
+{
+ atomic_inc(&tunnel->ref_count);
+}
+
+static inline void l2tp_tunnel_dec_refcount(struct l2tp_tunnel *tunnel)
+{
+ if (atomic_dec_and_test(&tunnel->ref_count))
+ l2tp_tunnel_free(tunnel);
+}
+
/* Session reference counts. Incremented when code obtains a reference
* to a session.
*/
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -57,10 +57,12 @@ static struct l2tp_session *l2tp_nl_sess
(info->attrs[L2TP_ATTR_CONN_ID])) {
tunnel_id = nla_get_u32(info->attrs[L2TP_ATTR_CONN_ID]);
session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
- tunnel = l2tp_tunnel_find(net, tunnel_id);
- if (tunnel)
+ tunnel = l2tp_tunnel_get(net, tunnel_id);
+ if (tunnel) {
session = l2tp_session_get(net, tunnel, session_id,
do_ref);
+ l2tp_tunnel_dec_refcount(tunnel);
+ }
}
return session;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 066/147] cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (69 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 059/147] l2tp: hold tunnel while looking up sessions in l2tp_netlink Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 102/147] ASoC: wm_hubs: Silence reg_r and reg_l 'may be used uninitialized' warnings Ben Hutchings
` (76 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tejun Heo, Linus Torvalds
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit b339752d054fb32863418452dff350a1086885b1 upstream.
When !NUMA, cpumask_of_node(@node) equals cpu_online_mask regardless of
@node. The assumption seems that if !NUMA, there shouldn't be more than
one node and thus reporting cpu_online_mask regardless of @node is
correct. However, that assumption was broken years ago to support
DISCONTIGMEM and whether a system has multiple nodes or not is
separately controlled by NEED_MULTIPLE_NODES.
This means that, on a system with !NUMA && NEED_MULTIPLE_NODES,
cpumask_of_node() will report cpu_online_mask for all possible nodes,
indicating that the CPUs are associated with multiple nodes which is an
impossible configuration.
This bug has been around forever but doesn't look like it has caused any
noticeable symptoms. However, it triggers a WARN recently added to
workqueue to verify NUMA affinity configuration.
Fix it by reporting empty cpumask on non-zero nodes if !NUMA.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/asm-generic/topology.h | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/include/asm-generic/topology.h
+++ b/include/asm-generic/topology.h
@@ -48,7 +48,11 @@
#define parent_node(node) ((void)(node),0)
#endif
#ifndef cpumask_of_node
-#define cpumask_of_node(node) ((void)node, cpu_online_mask)
+ #ifdef CONFIG_NEED_MULTIPLE_NODES
+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
+ #else
+ #define cpumask_of_node(node) ((void)node, cpu_online_mask)
+ #endif
#endif
#ifndef pcibus_to_node
#define pcibus_to_node(bus) ((void)(bus), -1)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 102/147] ASoC: wm_hubs: Silence reg_r and reg_l 'may be used uninitialized' warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (70 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 066/147] cpumask: fix spurious cpumask_of_node() on non-NUMA multi-node configs Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 114/147] gigaset: silence GCC warning for unused 'format_ie' Ben Hutchings
` (75 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tim Gardner, Mark Brown
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tim Gardner <tim.gardner@canonical.com>
commit 1f5353e765fe2a1168477bfe55e4dd7cdd96b477 upstream.
Return an error from wm_hubs_read_dc_servo() if hubs->dcs_readback_mode is not
correctly initialized. You might as well bail out since nothing is likely to
work correctly afterwards.
sound/soc/codecs/wm_hubs.c:321:11: warning: 'reg_r' may be used uninitialized in this function [-Wuninitialized]
sound/soc/codecs/wm_hubs.c:251:13: note: 'reg_r' was declared here
sound/soc/codecs/wm_hubs.c:322:11: warning: 'reg_l' may be used uninitialized in this function [-Wuninitialized]
sound/soc/codecs/wm_hubs.c:251:6: note: 'reg_l' was declared here
gcc version 4.6.3
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
[bwh: Backported to 3.2: There's no separate wm_hubs_read_dc_servo() function,
so return directly from calibrate_dc_servo().]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/sound/soc/codecs/wm_hubs.c
+++ b/sound/soc/codecs/wm_hubs.c
@@ -173,7 +173,7 @@ static void calibrate_dc_servo(struct sn
break;
default:
WARN(1, "Unknown DCS readback method\n");
- break;
+ return;
}
dev_dbg(codec->dev, "DCS input: %x %x\n", reg_l, reg_r);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 114/147] gigaset: silence GCC warning for unused 'format_ie'
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (71 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 102/147] ASoC: wm_hubs: Silence reg_r and reg_l 'may be used uninitialized' warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 024/147] xtensa: fix cache aliasing handling code for WT cache Ben Hutchings
` (74 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Paul Bolle, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Bolle <pebolle@tiscali.nl>
commit 6ba6047bf99cf4ade4f63b6b3d97cc3ad763b678 upstream.
Building Gigaset's CAPI support without Gigaset's debugging enabled
triggers this GCC warning:
'format_ie' defined but not used [-Wunused-function]
Silence this warning by wrapping format_ie() in an "#ifdef
CONFIG_GIGASET_DEBUG" and "#endif" pair.
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/isdn/gigaset/capi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -306,6 +306,7 @@ static inline void dump_rawmsg(enum debu
* format CAPI IE as string
*/
+#ifdef CONFIG_GIGASET_DEBUG
static const char *format_ie(const char *ie)
{
static char result[3*MAX_FMT_IE_LEN];
@@ -331,6 +332,7 @@ static const char *format_ie(const char
*--pout = 0;
return result;
}
+#endif
/*
* emit DATA_B3_CONF message
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 024/147] xtensa: fix cache aliasing handling code for WT cache
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (72 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 114/147] gigaset: silence GCC warning for unused 'format_ie' Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 101/147] ASoC: adau1373: adau1373_hw_params: Silence overflow warning Ben Hutchings
` (73 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Max Filippov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 6d0f581d1768d3eaba15776e7dd1fdfec10cfe36 upstream.
Currently building kernel for xtensa core with aliasing WT cache fails
with the following messages:
mm/memory.c:2152: undefined reference to `flush_dcache_page'
mm/memory.c:2332: undefined reference to `local_flush_cache_page'
mm/memory.c:1919: undefined reference to `local_flush_cache_range'
mm/memory.c:4179: undefined reference to `copy_to_user_page'
mm/memory.c:4183: undefined reference to `copy_from_user_page'
This happens because implementation of these functions is only compiled
when data cache is WB, which looks wrong: even when data cache doesn't
need flushing it still needs invalidation. The functions like
__flush_[invalidate_]dcache_* are correctly defined for both WB and WT
caches (and even if they weren't that'd still be ok, just slower).
Fix this by providing the same implementation of the above functions for
both WB and WT cache.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -59,7 +59,7 @@
*
*/
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
/*
* Any time the kernel writes to a user page cache page, or it is about to
@@ -144,7 +144,7 @@ void flush_cache_page(struct vm_area_str
__invalidate_icache_page_alias(virt, phys);
}
-#endif
+#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
void
update_mmu_cache(struct vm_area_struct * vma, unsigned long addr, pte_t *ptep)
@@ -162,7 +162,7 @@ update_mmu_cache(struct vm_area_struct *
invalidate_itlb_mapping(addr);
invalidate_dtlb_mapping(addr);
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
if (!PageReserved(page) && test_bit(PG_arch_1, &page->flags)) {
@@ -193,7 +193,7 @@ update_mmu_cache(struct vm_area_struct *
* flush_dcache_page() on the page.
*/
-#if (DCACHE_WAY_SIZE > PAGE_SIZE) && XCHAL_DCACHE_IS_WRITEBACK
+#if (DCACHE_WAY_SIZE > PAGE_SIZE)
void copy_to_user_page(struct vm_area_struct *vma, struct page *page,
unsigned long vaddr, void *dst, const void *src,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 101/147] ASoC: adau1373: adau1373_hw_params: Silence overflow warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (73 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 024/147] xtensa: fix cache aliasing handling code for WT cache Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 137/147] [media] mxl111sf: remove an unused variable Ben Hutchings
` (72 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Lars-Peter Clausen, Mark Brown, Tim Gardner
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tim Gardner <tim.gardner@canonical.com>
commit 14a1b8ca172f4cfbc544051a729d85a380447a82 upstream.
ADAU1373_BCLKDIV_SOURCE is defined as BIT(5) which uses UL constants. On
amd64 the result of the ones complement operator is then truncated to
unsigned int according to the prototype of snd_soc_update_bits(). I think
gcc is correctly warning that the upper 32 bits are lost.
sound/soc/codecs/adau1373.c: In function 'adau1373_hw_params':
sound/soc/codecs/adau1373.c:940:3: warning: large integer implicitly truncated to unsigned type [-Woverflow]
gcc version 4.6.3
Add 2 more BCLKDIV mask macros as explained by Lars:
The BCLKDIV has three fields. The bitclock divider (bit 0-1), the samplerate
(bit 2-4) and the source select (bit 5). Here we want to update the bitclock
divider field and the samplerate field. When I wrote the code I was lazy and
used ~ADAU1373_BCLKDIV_SOURCE as the mask, which for this register is
functionally equivalent to ADAU1373_BCLKDIV_SR_MASK | ADAU1373_BCLKDIV_BCLK_MASK.
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/adau1373.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/sound/soc/codecs/adau1373.c
+++ b/sound/soc/codecs/adau1373.c
@@ -133,6 +133,8 @@ struct adau1373 {
#define ADAU1373_DAI_FORMAT_DSP 0x3
#define ADAU1373_BCLKDIV_SOURCE BIT(5)
+#define ADAU1373_BCLKDIV_SR_MASK (0x07 << 2)
+#define ADAU1373_BCLKDIV_BCLK_MASK 0x03
#define ADAU1373_BCLKDIV_32 0x03
#define ADAU1373_BCLKDIV_64 0x02
#define ADAU1373_BCLKDIV_128 0x01
@@ -937,7 +939,8 @@ static int adau1373_hw_params(struct snd
adau1373_dai->enable_src = (div != 0);
snd_soc_update_bits(codec, ADAU1373_BCLKDIV(dai->id),
- ~ADAU1373_BCLKDIV_SOURCE, (div << 2) | ADAU1373_BCLKDIV_64);
+ ADAU1373_BCLKDIV_SR_MASK | ADAU1373_BCLKDIV_BCLK_MASK,
+ (div << 2) | ADAU1373_BCLKDIV_64);
switch (params_format(params)) {
case SNDRV_PCM_FORMAT_S16_LE:
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 137/147] [media] mxl111sf: remove an unused variable
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (74 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 101/147] ASoC: adau1373: adau1373_hw_params: Silence overflow warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 110/147] hwmon: (w83781d) Fix compile warning Ben Hutchings
` (71 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab, Dan Carpenter
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 3fd7e4341e04f80e2605f56bbd8cb1e8b027901a upstream.
We don't use this any more after 3be5bb71fb "[media] mxl111sf: fix error
on stream stop in mxl111sf_ep6_streaming_ctrl()" and it makes GCC
complain.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/dvb/dvb-usb/mxl111sf.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/media/dvb/dvb-usb/mxl111sf.c
+++ b/drivers/media/dvb/dvb-usb/mxl111sf.c
@@ -340,7 +340,6 @@ static int mxl111sf_ep6_streaming_ctrl(s
struct mxl111sf_state *state = d->priv;
struct mxl111sf_adap_state *adap_state = adap->fe_adap[adap->active_fe].priv;
int ret = 0;
- u8 tmp;
deb_info("%s(%d)\n", __func__, onoff);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 110/147] hwmon: (w83781d) Fix compile warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (75 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 137/147] [media] mxl111sf: remove an unused variable Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 067/147] alpha: uapi: Add support for __SANE_USERSPACE_TYPES__ Ben Hutchings
` (70 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jean Delvare, Guenter Roeck
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
commit bbc8a569ae91e0951f4b7f8eb33ef1970bf2129c upstream.
The following compile warning may be seen if the driver is compiled with
-Wuninitialized:
drivers/hwmon/w83781d.c: warning: 'sc_addr[1]' may be used uninitialized in this
function [-Wuninitialized]
While this is a false positive, it is annoying in nightly builds, and may help
to conceal real problems. The current code is quite tricky, and and it is easy
to rearrage the code to make the warning disappear. So fix it.
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hwmon/w83781d.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -826,6 +826,7 @@ w83781d_detect_subclients(struct i2c_cli
struct i2c_adapter *adapter = new_client->adapter;
struct w83781d_data *data = i2c_get_clientdata(new_client);
enum chips kind = data->type;
+ int num_sc = 1;
id = i2c_adapter_id(adapter);
@@ -850,6 +851,7 @@ w83781d_detect_subclients(struct i2c_cli
}
if (kind != w83783s) {
+ num_sc = 2;
if (force_subclients[0] == id &&
force_subclients[1] == address) {
sc_addr[1] = force_subclients[3];
@@ -865,7 +867,7 @@ w83781d_detect_subclients(struct i2c_cli
}
}
- for (i = 0; i <= 1; i++) {
+ for (i = 0; i < num_sc; i++) {
data->lm75[i] = i2c_new_dummy(adapter, sc_addr[i]);
if (!data->lm75[i]) {
dev_err(&new_client->dev, "Subclient %d "
@@ -876,8 +878,6 @@ w83781d_detect_subclients(struct i2c_cli
goto ERROR_SC_3;
goto ERROR_SC_2;
}
- if (kind == w83783s)
- break;
}
return 0;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 067/147] alpha: uapi: Add support for __SANE_USERSPACE_TYPES__
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (76 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 110/147] hwmon: (w83781d) Fix compile warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 115/147] eicon: fix -Warray-bounds warning Ben Hutchings
` (69 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Matt Turner, Michael Cree
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben@decadent.org.uk>
commit cec80d82142ab25c71eee24b529cfeaf17c43062 upstream.
This fixes compiler errors in perf such as:
tests/attr.c: In function 'store_event':
tests/attr.c:66:27: error: format '%llu' expects argument of type 'long long unsigned int', but argument 6 has type '__u64 {aka long unsigned int}' [-Werror=format=]
snprintf(path, PATH_MAX, "%s/event-%d-%llu-%d", dir,
^
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Tested-by: Michael Cree <mcree@orcon.net.nz>
Signed-off-by: Matt Turner <mattst88@gmail.com>
---
--- a/arch/alpha/include/asm/types.h
+++ b/arch/alpha/include/asm/types.h
@@ -9,10 +9,18 @@
* need to be careful to avoid a name clashes.
*/
-#ifdef __KERNEL__
-#include <asm-generic/int-ll64.h>
-#else
+/*
+ * This is here because we used to use l64 for alpha
+ * and we don't want to impact user mode with our change to ll64
+ * in the kernel.
+ *
+ * However, some user programs are fine with this. They can
+ * flag __SANE_USERSPACE_TYPES__ to get int-ll64.h here.
+ */
+#if !defined(__SANE_USERSPACE_TYPES__) && !defined(__KERNEL__)
#include <asm-generic/int-l64.h>
+#else
+#include <asm-generic/int-ll64.h>
#endif
#ifndef __ASSEMBLY__
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 115/147] eicon: fix -Warray-bounds warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (77 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 067/147] alpha: uapi: Add support for __SANE_USERSPACE_TYPES__ Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 050/147] ipv6: add rcu grace period before freeing fib6_node Ben Hutchings
` (68 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Danny Kukawka
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Danny Kukawka <danny.kukawka@bisect.de>
commit e1f4c485cdb2b1d7aae172b731f6c2b403381ebb upstream.
Fix for a -Warray-bounds warning. mixer_notify_update() tries to
write to ((CAPI_MSG *) msg)->info.facility_req.structs[3] while
structs is defined as byte structs[1]. Set all 'structs' which are
part of the typdefs in the info union to 'byte structs[0]'.
v2: set all info.*.structs to byte structs[0]
Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/isdn/hardware/eicon/capi20.h | 60 ++++++++++++++++++------------------
1 file changed, 30 insertions(+), 30 deletions(-)
--- a/drivers/isdn/hardware/eicon/capi20.h
+++ b/drivers/isdn/hardware/eicon/capi20.h
@@ -117,7 +117,7 @@ typedef struct api_profile_s {
/*------------------------------------------------------------------*/
/* ALERT-REQUEST */
typedef struct {
- byte structs[1]; /* Additional Info */
+ byte structs[0]; /* Additional Info */
} _ALT_REQP;
/* ALERT-CONFIRM */
typedef struct {
@@ -126,7 +126,7 @@ typedef struct {
/* CONNECT-REQUEST */
typedef struct {
word CIP_Value;
- byte structs[1]; /* Called party number,
+ byte structs[0]; /* Called party number,
Called party subaddress,
Calling party number,
Calling party subaddress,
@@ -143,7 +143,7 @@ typedef struct {
/* CONNECT-INDICATION */
typedef struct {
word CIP_Value;
- byte structs[1]; /* Called party number,
+ byte structs[0]; /* Called party number,
Called party subaddress,
Calling party number,
Calling party subaddress,
@@ -155,24 +155,24 @@ typedef struct {
/* CONNECT-RESPONSE */
typedef struct {
word Accept;
- byte structs[1]; /* B_protocol,
+ byte structs[0]; /* B_protocol,
Connected party number,
Connected party subaddress,
LLC */
} _CON_RESP;
/* CONNECT-ACTIVE-INDICATION */
typedef struct {
- byte structs[1]; /* Connected party number,
+ byte structs[0]; /* Connected party number,
Connected party subaddress,
LLC */
} _CON_A_INDP;
/* CONNECT-ACTIVE-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _CON_A_RESP;
/* DISCONNECT-REQUEST */
typedef struct {
- byte structs[1]; /* Additional Info */
+ byte structs[0]; /* Additional Info */
} _DIS_REQP;
/* DISCONNECT-CONFIRM */
typedef struct {
@@ -184,13 +184,13 @@ typedef struct {
} _DIS_INDP;
/* DISCONNECT-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _DIS_RESP;
/* LISTEN-REQUEST */
typedef struct {
dword Info_Mask;
dword CIP_Mask;
- byte structs[1]; /* Calling party number,
+ byte structs[0]; /* Calling party number,
Calling party subaddress */
} _LIS_REQP;
/* LISTEN-CONFIRM */
@@ -199,7 +199,7 @@ typedef struct {
} _LIS_CONP;
/* INFO-REQUEST */
typedef struct {
- byte structs[1]; /* Called party number,
+ byte structs[0]; /* Called party number,
Additional Info */
} _INF_REQP;
/* INFO-CONFIRM */
@@ -209,15 +209,15 @@ typedef struct {
/* INFO-INDICATION */
typedef struct {
word Number;
- byte structs[1]; /* Info element */
+ byte structs[0]; /* Info element */
} _INF_INDP;
/* INFO-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _INF_RESP;
/* SELECT-B-REQUEST */
typedef struct {
- byte structs[1]; /* B-protocol */
+ byte structs[0]; /* B-protocol */
} _SEL_B_REQP;
/* SELECT-B-CONFIRM */
typedef struct {
@@ -226,7 +226,7 @@ typedef struct {
/* FACILITY-REQUEST */
typedef struct {
word Selector;
- byte structs[1]; /* Facility parameters */
+ byte structs[0]; /* Facility parameters */
} _FAC_REQP;
/* FACILITY-CONFIRM STRUCT FOR SUPPLEMENT. SERVICES */
typedef struct {
@@ -240,21 +240,21 @@ typedef struct {
typedef struct {
word Info;
word Selector;
- byte structs[1]; /* Facility parameters */
+ byte structs[0]; /* Facility parameters */
} _FAC_CONP;
/* FACILITY-INDICATION */
typedef struct {
word Selector;
- byte structs[1]; /* Facility parameters */
+ byte structs[0]; /* Facility parameters */
} _FAC_INDP;
/* FACILITY-RESPONSE */
typedef struct {
word Selector;
- byte structs[1]; /* Facility parameters */
+ byte structs[0]; /* Facility parameters */
} _FAC_RESP;
/* CONNECT-B3-REQUEST */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_REQP;
/* CONNECT-B3-CONFIRM */
typedef struct {
@@ -262,24 +262,24 @@ typedef struct {
} _CON_B3_CONP;
/* CONNECT-B3-INDICATION */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_INDP;
/* CONNECT-B3-RESPONSE */
typedef struct {
word Accept;
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_RESP;
/* CONNECT-B3-ACTIVE-INDICATION */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_A_INDP;
/* CONNECT-B3-ACTIVE-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _CON_B3_A_RESP;
/* DISCONNECT-B3-REQUEST */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _DIS_B3_REQP;
/* DISCONNECT-B3-CONFIRM */
typedef struct {
@@ -288,11 +288,11 @@ typedef struct {
/* DISCONNECT-B3-INDICATION */
typedef struct {
word Info;
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _DIS_B3_INDP;
/* DISCONNECT-B3-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _DIS_B3_RESP;
/* DATA-B3-REQUEST */
typedef struct {
@@ -335,7 +335,7 @@ typedef struct {
} _DAT_B3_RESP;
/* RESET-B3-REQUEST */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _RES_B3_REQP;
/* RESET-B3-CONFIRM */
typedef struct {
@@ -343,20 +343,20 @@ typedef struct {
} _RES_B3_CONP;
/* RESET-B3-INDICATION */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _RES_B3_INDP;
/* RESET-B3-RESPONSE */
typedef struct {
- byte structs[1]; /* empty */
+ byte structs[0]; /* empty */
} _RES_B3_RESP;
/* CONNECT-B3-T90-ACTIVE-INDICATION */
typedef struct {
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_T90_A_INDP;
/* CONNECT-B3-T90-ACTIVE-RESPONSE */
typedef struct {
word Reject;
- byte structs[1]; /* NCPI */
+ byte structs[0]; /* NCPI */
} _CON_B3_T90_A_RESP;
/*------------------------------------------------------------------*/
/* message structure */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 050/147] ipv6: add rcu grace period before freeing fib6_node
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (78 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 115/147] eicon: fix -Warray-bounds warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 039/147] mm/mempolicy: fix use after free when calling get_mempolicy Ben Hutchings
` (67 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Eric Dumazet, David S. Miller, Martin KaFai Lau, Wei Wang
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
commit c5cff8561d2d0006e972bd114afd51f082fee77c upstream.
We currently keep rt->rt6i_node pointing to the fib6_node for the route.
And some functions make use of this pointer to dereference the fib6_node
from rt structure, e.g. rt6_check(). However, as there is neither
refcount nor rcu taken when dereferencing rt->rt6i_node, it could
potentially cause crashes as rt->rt6i_node could be set to NULL by other
CPUs when doing a route deletion.
This patch introduces an rcu grace period before freeing fib6_node and
makes sure the functions that dereference it takes rcu_read_lock().
Note: there is no "Fixes" tag because this bug was there in a very
early stage.
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/ip6_fib.h | 30 +++++++++++++++++++++++++++++-
net/ipv6/ip6_fib.c | 20 ++++++++++++++++----
net/ipv6/route.c | 14 +++++++++++---
3 files changed, 56 insertions(+), 8 deletions(-)
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -63,6 +63,7 @@ struct fib6_node {
__u16 fn_flags;
__u32 fn_sernum;
struct rt6_info *rr_ptr;
+ struct rcu_head rcu;
};
#ifndef CONFIG_IPV6_SUBTREES
@@ -126,9 +127,36 @@ static inline struct inet6_dev *ip6_dst_
return ((struct rt6_info *)dst)->rt6i_idev;
}
+/* Function to safely get fn->sernum for passed in rt
+ * and store result in passed in cookie.
+ * Return true if we can get cookie safely
+ * Return false if not
+ */
+static inline bool rt6_get_cookie_safe(const struct rt6_info *rt,
+ u32 *cookie)
+{
+ struct fib6_node *fn;
+ bool status = false;
+
+ rcu_read_lock();
+ fn = rcu_dereference(rt->rt6i_node);
+
+ if (fn) {
+ *cookie = fn->fn_sernum;
+ status = true;
+ }
+
+ rcu_read_unlock();
+ return status;
+}
+
static inline u32 rt6_get_cookie(const struct rt6_info *rt)
{
- return rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+ u32 cookie = 0;
+
+ rt6_get_cookie_safe(rt, &cookie);
+
+ return cookie;
}
struct fib6_walker_t {
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -153,11 +153,23 @@ static __inline__ struct fib6_node * nod
return fn;
}
-static __inline__ void node_free(struct fib6_node * fn)
+static void node_free_immediate(struct fib6_node *fn)
{
kmem_cache_free(fib6_node_kmem, fn);
}
+static void node_free_rcu(struct rcu_head *head)
+{
+ struct fib6_node *fn = container_of(head, struct fib6_node, rcu);
+
+ kmem_cache_free(fib6_node_kmem, fn);
+}
+
+static void node_free(struct fib6_node *fn)
+{
+ call_rcu(&fn->rcu, node_free_rcu);
+}
+
static __inline__ void rt6_release(struct rt6_info *rt)
{
if (atomic_dec_and_test(&rt->rt6i_ref))
@@ -529,9 +541,9 @@ insert_above:
if (in == NULL || ln == NULL) {
if (in)
- node_free(in);
+ node_free_immediate(in);
if (ln)
- node_free(ln);
+ node_free_immediate(ln);
return NULL;
}
@@ -743,7 +755,7 @@ int fib6_add(struct fib6_node *root, str
root, and then (in st_failure) stale node
in main tree.
*/
- node_free(sfn);
+ node_free_immediate(sfn);
goto st_failure;
}
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -964,10 +964,11 @@ struct dst_entry *ip6_blackhole_route(st
static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
{
struct rt6_info *rt;
+ u32 rt_cookie;
rt = (struct rt6_info *) dst;
- if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
+ if (rt6_get_cookie_safe(rt, &rt_cookie) && rt_cookie == cookie) {
if (rt->rt6i_peer_genid != rt6_peer_genid()) {
if (!rt->rt6i_peer)
rt6_bind_peer(rt, 0);
@@ -1007,8 +1008,15 @@ static void ip6_link_failure(struct sk_b
if (rt->rt6i_flags&RTF_CACHE) {
dst_set_expires(&rt->dst, 0);
rt->rt6i_flags |= RTF_EXPIRES;
- } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT))
- rt->rt6i_node->fn_sernum = -1;
+ } else {
+ struct fib6_node *fn;
+
+ rcu_read_lock();
+ fn = rcu_dereference(rt->rt6i_node);
+ if (fn && (rt->rt6i_flags & RTF_DEFAULT))
+ fn->fn_sernum = -1;
+ rcu_read_unlock();
+ }
}
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 039/147] mm/mempolicy: fix use after free when calling get_mempolicy
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (79 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 050/147] ipv6: add rcu grace period before freeing fib6_node Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 099/147] drivers/block/DAC960: fix -Wuninitialized warning Ben Hutchings
` (66 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Michal Hocko, Linus Torvalds, Mel Gorman, zhong jiang,
Minchan Kim, David Rientjes, Vlastimil Babka
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: zhong jiang <zhongjiang@huawei.com>
commit 73223e4e2e3867ebf033a5a8eb2e5df0158ccc99 upstream.
I hit a use after free issue when executing trinity and repoduced it
with KASAN enabled. The related call trace is as follows.
BUG: KASan: use after free in SyS_get_mempolicy+0x3c8/0x960 at addr ffff8801f582d766
Read of size 2 by task syz-executor1/798
INFO: Allocated in mpol_new.part.2+0x74/0x160 age=3 cpu=1 pid=799
__slab_alloc+0x768/0x970
kmem_cache_alloc+0x2e7/0x450
mpol_new.part.2+0x74/0x160
mpol_new+0x66/0x80
SyS_mbind+0x267/0x9f0
system_call_fastpath+0x16/0x1b
INFO: Freed in __mpol_put+0x2b/0x40 age=4 cpu=1 pid=799
__slab_free+0x495/0x8e0
kmem_cache_free+0x2f3/0x4c0
__mpol_put+0x2b/0x40
SyS_mbind+0x383/0x9f0
system_call_fastpath+0x16/0x1b
INFO: Slab 0xffffea0009cb8dc0 objects=23 used=8 fp=0xffff8801f582de40 flags=0x200000000004080
INFO: Object 0xffff8801f582d760 @offset=5984 fp=0xffff8801f582d600
Bytes b4 ffff8801f582d750: ae 01 ff ff 00 00 00 00 5a 5a 5a 5a 5a 5a 5a 5a ........ZZZZZZZZ
Object ffff8801f582d760: 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk
Object ffff8801f582d770: 6b 6b 6b 6b 6b 6b 6b a5 kkkkkkk.
Redzone ffff8801f582d778: bb bb bb bb bb bb bb bb ........
Padding ffff8801f582d8b8: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ
Memory state around the buggy address:
ffff8801f582d600: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801f582d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801f582d700: fc fc fc fc fc fc fc fc fc fc fc fc fb fb fb fc
!shared memory policy is not protected against parallel removal by other
thread which is normally protected by the mmap_sem. do_get_mempolicy,
however, drops the lock midway while we can still access it later.
Early premature up_read is a historical artifact from times when
put_user was called in this path see https://lwn.net/Articles/124754/
but that is gone since 8bccd85ffbaf ("[PATCH] Implement sys_* do_*
layering in the memory policy layer."). but when we have the the
current mempolicy ref count model. The issue was introduced
accordingly.
Fix the issue by removing the premature release.
Link: http://lkml.kernel.org/r/1502950924-27521-1-git-send-email-zhongjiang@huawei.com
Signed-off-by: zhong jiang <zhongjiang@huawei.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/mempolicy.c | 5 -----
1 file changed, 5 deletions(-)
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -885,11 +885,6 @@ static long do_get_mempolicy(int *policy
*policy |= (pol->flags & MPOL_MODE_FLAGS);
}
- if (vma) {
- up_read(¤t->mm->mmap_sem);
- vma = NULL;
- }
-
err = 0;
if (nmask) {
if (mpol_store_user_nodemask(pol)) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 099/147] drivers/block/DAC960: fix -Wuninitialized warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (80 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 039/147] mm/mempolicy: fix use after free when calling get_mempolicy Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 094/147] cifs: silence compiler warnings showing up with gcc-4.7.0 Ben Hutchings
` (65 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Danny Kukawka, Jens Axboe
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Danny Kukawka <danny.kukawka@bisect.de>
commit cecd353a02fb1405c8a72a324b26b5acf97e7411 upstream.
Set CommandMailbox with memset before use it. Fix for:
drivers/block/DAC960.c: In function ‘DAC960_V1_EnableMemoryMailboxInterface’:
arch/x86/include/asm/io.h:61:1: warning: ‘CommandMailbox.Bytes[12]’
may be used uninitialized in this function [-Wuninitialized]
drivers/block/DAC960.c:1175:30: note: ‘CommandMailbox.Bytes[12]’
was declared here
Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/block/DAC960.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -1177,7 +1177,8 @@ static bool DAC960_V1_EnableMemoryMailbo
int TimeoutCounter;
int i;
-
+ memset(&CommandMailbox, 0, sizeof(DAC960_V1_CommandMailbox_T));
+
if (pci_set_dma_mask(Controller->PCIDevice, DMA_BIT_MASK(32)))
return DAC960_Failure(Controller, "DMA mask out of range");
Controller->BounceBufferLimit = DMA_BIT_MASK(32);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 094/147] cifs: silence compiler warnings showing up with gcc-4.7.0
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (81 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 099/147] drivers/block/DAC960: fix -Wuninitialized warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 130/147] [SCSI] mpt2sas: fix for unused variable 'event_data' warning Ben Hutchings
` (64 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jeff Layton, Steve French
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@redhat.com>
commit b2a3ad9ca502169fc4c11296fa20f56059c7c031 upstream.
gcc-4.7.0 has started throwing these warnings when building cifs.ko.
CC [M] fs/cifs/cifssmb.o
fs/cifs/cifssmb.c: In function ‘CIFSSMBSetCIFSACL’:
fs/cifs/cifssmb.c:3905:9: warning: array subscript is above array bounds [-Warray-bounds]
fs/cifs/cifssmb.c: In function ‘CIFSSMBSetFileInfo’:
fs/cifs/cifssmb.c:5711:8: warning: array subscript is above array bounds [-Warray-bounds]
fs/cifs/cifssmb.c: In function ‘CIFSSMBUnixSetFileInfo’:
fs/cifs/cifssmb.c:6001:25: warning: array subscript is above array bounds [-Warray-bounds]
This patch cleans up the code a bit by using the offsetof macro instead
of the funky "&pSMB->hdr.Protocol" construct.
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve French <sfrench@us.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/cifssmb.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -3909,13 +3909,12 @@ CIFSSMBSetCIFSACL(const int xid, struct
int rc = 0;
int bytes_returned = 0;
SET_SEC_DESC_REQ *pSMB = NULL;
- NTRANSACT_RSP *pSMBr = NULL;
+ void *pSMBr;
setCifsAclRetry:
- rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB,
- (void **) &pSMBr);
+ rc = smb_init(SMB_COM_NT_TRANSACT, 19, tcon, (void **) &pSMB, &pSMBr);
if (rc)
- return (rc);
+ return rc;
pSMB->MaxSetupCount = 0;
pSMB->Reserved = 0;
@@ -3943,9 +3942,8 @@ setCifsAclRetry:
pSMB->AclFlags = cpu_to_le32(aclflag);
if (pntsd && acllen) {
- memcpy((char *) &pSMBr->hdr.Protocol + data_offset,
- (char *) pntsd,
- acllen);
+ memcpy((char *)pSMBr + offsetof(struct smb_hdr, Protocol) +
+ data_offset, pntsd, acllen);
inc_rfc1001_len(pSMB, byte_count + data_count);
} else
inc_rfc1001_len(pSMB, byte_count);
@@ -5724,7 +5722,8 @@ CIFSSMBSetFileInfo(const int xid, struct
param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
offset = param_offset + params;
- data_offset = (char *) (&pSMB->hdr.Protocol) + offset;
+ data_offset = (char *)pSMB +
+ offsetof(struct smb_hdr, Protocol) + offset;
count = sizeof(FILE_BASIC_INFO);
pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -5993,7 +5992,7 @@ CIFSSMBUnixSetFileInfo(const int xid, st
u16 fid, u32 pid_of_opener)
{
struct smb_com_transaction2_sfi_req *pSMB = NULL;
- FILE_UNIX_BASIC_INFO *data_offset;
+ char *data_offset;
int rc = 0;
u16 params, param_offset, offset, byte_count, count;
@@ -6015,8 +6014,9 @@ CIFSSMBUnixSetFileInfo(const int xid, st
param_offset = offsetof(struct smb_com_transaction2_sfi_req, Fid) - 4;
offset = param_offset + params;
- data_offset = (FILE_UNIX_BASIC_INFO *)
- ((char *)(&pSMB->hdr.Protocol) + offset);
+ data_offset = (char *)pSMB +
+ offsetof(struct smb_hdr, Protocol) + offset;
+
count = sizeof(FILE_UNIX_BASIC_INFO);
pSMB->MaxParameterCount = cpu_to_le16(2);
@@ -6038,7 +6038,7 @@ CIFSSMBUnixSetFileInfo(const int xid, st
inc_rfc1001_len(pSMB, byte_count);
pSMB->ByteCount = cpu_to_le16(byte_count);
- cifs_fill_unix_set_info(data_offset, args);
+ cifs_fill_unix_set_info((FILE_UNIX_BASIC_INFO *)data_offset, args);
rc = SendReceiveNoRsp(xid, tcon->ses, (struct smb_hdr *) pSMB, 0);
if (rc)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 130/147] [SCSI] mpt2sas: fix for unused variable 'event_data' warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (82 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 094/147] cifs: silence compiler warnings showing up with gcc-4.7.0 Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 063/147] l2tp: remove useless duplicate session detection in l2tp_netlink Ben Hutchings
` (63 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Reddy, Sreekanth, James Bottomley
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Reddy, Sreekanth" <Sreekanth.Reddy@lsi.com>
commit c3a634bf78242177fba9c85deb709e7b63ed0ef1 upstream.
If CONFIG_SCSI_MPT2SAS_LOGGING is undefined, then these warnings are emitted
drivers/scsi/mpt2sas/mpt2sas_scsih.c: In function '_scsih_sas_broadcast_primitive_event'
drivers/scsi/mpt2sas/mpt2sas_scsih.c:5810:40: warning: unused variable 'event_data'
Use pr_info() function instead of dewtprintk().
Signed-off-by: Sreekanth Reddy <Sreekanth.Reddy@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/mpt2sas/mpt2sas_scsih.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -5734,9 +5734,10 @@ _scsih_sas_broadcast_primative_event(str
u8 task_abort_retries;
mutex_lock(&ioc->tm_cmds.mutex);
- dewtprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: enter: phy number(%d), "
- "width(%d)\n", ioc->name, __func__, event_data->PhyNum,
- event_data->PortWidth));
+ pr_info(MPT2SAS_FMT
+ "%s: enter: phy number(%d), width(%d)\n",
+ ioc->name, __func__, event_data->PhyNum,
+ event_data->PortWidth);
_scsih_block_io_all_device(ioc);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 063/147] l2tp: remove useless duplicate session detection in l2tp_netlink
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (83 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 130/147] [SCSI] mpt2sas: fix for unused variable 'event_data' warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 007/147] usb: renesas_usbhs: fixup resume method for autonomy mode Ben Hutchings
` (62 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Guillaume Nault, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Guillaume Nault <g.nault@alphalink.fr>
commit af87ae465abdc070de0dc35d6c6a9e7a8cd82987 upstream.
There's no point in checking for duplicate sessions at the beginning of
l2tp_nl_cmd_session_create(); the ->session_create() callbacks already
return -EEXIST when the session already exists.
Furthermore, even if l2tp_session_find() returns NULL, a new session
might be created right after the test. So relying on ->session_create()
to avoid duplicate session is the only sane behaviour.
Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: also delete the now-unused local variable]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -361,7 +361,6 @@ static int l2tp_nl_cmd_session_create(st
u32 peer_session_id;
int ret = 0;
struct l2tp_tunnel *tunnel;
- struct l2tp_session *session;
struct l2tp_session_cfg cfg = { 0, };
struct net *net = genl_info_net(info);
@@ -381,11 +380,6 @@ static int l2tp_nl_cmd_session_create(st
goto out;
}
session_id = nla_get_u32(info->attrs[L2TP_ATTR_SESSION_ID]);
- session = l2tp_session_find(net, tunnel, session_id);
- if (session) {
- ret = -EEXIST;
- goto out;
- }
if (!info->attrs[L2TP_ATTR_PEER_SESSION_ID]) {
ret = -EINVAL;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 007/147] usb: renesas_usbhs: fixup resume method for autonomy mode
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (84 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 063/147] l2tp: remove useless duplicate session detection in l2tp_netlink Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 077/147] epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() Ben Hutchings
` (61 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Kuninori Morimoto
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
commit 5b50d3b52601651ef3183cfb33d03cf486180e48 upstream.
If renesas_usbhs is probed as autonomy mode,
phy reset should be called after power resumed,
and manual cold-plug should be called with slight delay.
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/renesas_usbhs/common.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -599,12 +599,12 @@ static int usbhsc_resume(struct device *
struct usbhs_priv *priv = dev_get_drvdata(dev);
struct platform_device *pdev = usbhs_priv_to_pdev(priv);
- usbhs_platform_call(priv, phy_reset, pdev);
-
if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
usbhsc_power_ctrl(priv, 1);
- usbhsc_hotplug(priv);
+ usbhs_platform_call(priv, phy_reset, pdev);
+
+ usbhsc_drvcllbck_notify_hotplug(pdev);
return 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 077/147] epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (85 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 007/147] usb: renesas_usbhs: fixup resume method for autonomy mode Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 043/147] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Ben Hutchings
` (60 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, 范龙飞, Linus Torvalds, Oleg Nesterov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oleg Nesterov <oleg@redhat.com>
commit 138e4ad67afd5c6c318b056b4d17c17f2c0ca5c0 upstream.
The race was introduced by me in commit 971316f0503a ("epoll:
ep_unregister_pollwait() can use the freed pwq->whead"). I did not
realize that nothing can protect eventpoll after ep_poll_callback() sets
->whead = NULL, only whead->lock can save us from the race with
ep_free() or ep_remove().
Move ->whead = NULL to the end of ep_poll_callback() and add the
necessary barriers.
TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
before this patch.
Hopefully this explains use-after-free reported by syzcaller:
BUG: KASAN: use-after-free in debug_spin_lock_before
...
_raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
this is spin_lock(eventpoll->lock),
...
Freed by task 17774:
...
kfree+0xe8/0x2c0 mm/slub.c:3883
ep_free+0x22c/0x2a0 fs/eventpoll.c:865
Fixes: 971316f0503a ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
Reported-by: 范龙飞 <long7573@126.com>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
- Use smp_mb() and ACCESS_ONCE() instead of smp_{load_acquire,store_release}()
- EPOLLEXCLUSIVE is not supported]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -477,8 +477,14 @@ static void ep_remove_wait_queue(struct
wait_queue_head_t *whead;
rcu_read_lock();
- /* If it is cleared by POLLFREE, it should be rcu-safe */
- whead = rcu_dereference(pwq->whead);
+ /*
+ * If it is cleared by POLLFREE, it should be rcu-safe.
+ * If we read NULL we need a barrier paired with
+ * smp_store_release() in ep_poll_callback(), otherwise
+ * we rely on whead->lock.
+ */
+ whead = ACCESS_ONCE(pwq->whead);
+ smp_mb();
if (whead)
remove_wait_queue(whead, &pwq->wait);
rcu_read_unlock();
@@ -859,17 +865,6 @@ static int ep_poll_callback(wait_queue_t
struct epitem *epi = ep_item_from_wait(wait);
struct eventpoll *ep = epi->ep;
- if ((unsigned long)key & POLLFREE) {
- ep_pwq_from_wait(wait)->whead = NULL;
- /*
- * whead = NULL above can race with ep_remove_wait_queue()
- * which can do another remove_wait_queue() after us, so we
- * can't use __remove_wait_queue(). whead->lock is held by
- * the caller.
- */
- list_del_init(&wait->task_list);
- }
-
spin_lock_irqsave(&ep->lock, flags);
/*
@@ -924,6 +919,23 @@ out_unlock:
if (pwake)
ep_poll_safewake(&ep->poll_wait);
+ if ((unsigned long)key & POLLFREE) {
+ /*
+ * If we race with ep_remove_wait_queue() it can miss
+ * ->whead = NULL and do another remove_wait_queue() after
+ * us, so we can't use __remove_wait_queue().
+ */
+ list_del_init(&wait->task_list);
+ /*
+ * ->whead != NULL protects us from the race with ep_free()
+ * or ep_remove(), ep_remove_wait_queue() takes whead->lock
+ * held by the caller. Once we nullify it, nothing protects
+ * ep/epi or even wait.
+ */
+ smp_mb();
+ ACCESS_ONCE(ep_pwq_from_wait(wait)->whead) = NULL;
+ }
+
return 1;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 043/147] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978)
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (86 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 077/147] epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 032/147] RDMA/uverbs: Prevent leak of reserved field Ben Hutchings
` (59 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit bbba6f9d3da357bbabc6fda81e99ff5584500e76 upstream.
Lenovo G50-70 (17aa:3978) with Conexant codec chip requires the
similar workaround for the inverted stereo dmic like other Lenovo
models.
Bugzilla: https://bugzilla.suse.com/show_bug.cgi?id=1020657
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/pci/hda/patch_conexant.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -4498,6 +4498,7 @@ static const struct snd_pci_quirk cxt506
SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
{}
};
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 032/147] RDMA/uverbs: Prevent leak of reserved field
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (87 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 043/147] ALSA: hda - Add stereo mic quirk for Lenovo G50-70 (17aa:3978) Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 098/147] drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning Ben Hutchings
` (58 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Leon Romanovsky, Doug Ledford, Dennis Dalessandro
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@mellanox.com>
commit f7a6cb7b38c6845b26aaa8bbdf519ff6e3090831 upstream.
initialize to zero the response structure to prevent
the leakage of "resp.reserved" field.
drivers/infiniband/core/uverbs_cmd.c:1178 ib_uverbs_resize_cq() warn:
check that 'resp.reserved' doesn't leak information
Fixes: 33b9b3ee9709 ("IB: Add userspace support for resizing CQs")
Signed-off-by: Leon Romanovsky <leonro@mellanox.com>
Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/core/uverbs_cmd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -1192,7 +1192,7 @@ ssize_t ib_uverbs_resize_cq(struct ib_uv
int out_len)
{
struct ib_uverbs_resize_cq cmd;
- struct ib_uverbs_resize_cq_resp resp;
+ struct ib_uverbs_resize_cq_resp resp = {};
struct ib_udata udata;
struct ib_cq *cq;
int ret = -EINVAL;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 098/147] drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (88 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 032/147] RDMA/uverbs: Prevent leak of reserved field Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 126/147] staging: comedi: vmk80xx: fix compiler warning Ben Hutchings
` (57 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Danny Kukawka, Jens Axboe
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Danny Kukawka <danny.kukawka@bisect.de>
commit bca505f1097c725708ddc055cf8055e922b0904b upstream.
Fixed compiler warning:
comparison between ‘DAC960_V2_IOCTL_Opcode_T’ and ‘enum <anonymous>’
Renamed enum, added a new enum for SCSI_10.CommandOpcode in
DAC960_V2_ProcessCompletedCommand().
Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/block/DAC960.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -4627,7 +4627,8 @@ static void DAC960_V2_ProcessCompletedCo
DAC960_Controller_T *Controller = Command->Controller;
DAC960_CommandType_T CommandType = Command->CommandType;
DAC960_V2_CommandMailbox_T *CommandMailbox = &Command->V2.CommandMailbox;
- DAC960_V2_IOCTL_Opcode_T CommandOpcode = CommandMailbox->Common.IOCTL_Opcode;
+ DAC960_V2_IOCTL_Opcode_T IOCTLOpcode = CommandMailbox->Common.IOCTL_Opcode;
+ DAC960_V2_CommandOpcode_T CommandOpcode = CommandMailbox->SCSI_10.CommandOpcode;
DAC960_V2_CommandStatus_T CommandStatus = Command->V2.CommandStatus;
if (CommandType == DAC960_ReadCommand ||
@@ -4699,7 +4700,7 @@ static void DAC960_V2_ProcessCompletedCo
{
if (Controller->ShutdownMonitoringTimer)
return;
- if (CommandOpcode == DAC960_V2_GetControllerInfo)
+ if (IOCTLOpcode == DAC960_V2_GetControllerInfo)
{
DAC960_V2_ControllerInfo_T *NewControllerInfo =
Controller->V2.NewControllerInformation;
@@ -4719,14 +4720,14 @@ static void DAC960_V2_ProcessCompletedCo
memcpy(ControllerInfo, NewControllerInfo,
sizeof(DAC960_V2_ControllerInfo_T));
}
- else if (CommandOpcode == DAC960_V2_GetEvent)
+ else if (IOCTLOpcode == DAC960_V2_GetEvent)
{
if (CommandStatus == DAC960_V2_NormalCompletion) {
DAC960_V2_ReportEvent(Controller, Controller->V2.Event);
}
Controller->V2.NextEventSequenceNumber++;
}
- else if (CommandOpcode == DAC960_V2_GetPhysicalDeviceInfoValid &&
+ else if (IOCTLOpcode == DAC960_V2_GetPhysicalDeviceInfoValid &&
CommandStatus == DAC960_V2_NormalCompletion)
{
DAC960_V2_PhysicalDeviceInfo_T *NewPhysicalDeviceInfo =
@@ -4915,7 +4916,7 @@ static void DAC960_V2_ProcessCompletedCo
NewPhysicalDeviceInfo->LogicalUnit++;
Controller->V2.PhysicalDeviceIndex++;
}
- else if (CommandOpcode == DAC960_V2_GetPhysicalDeviceInfoValid)
+ else if (IOCTLOpcode == DAC960_V2_GetPhysicalDeviceInfoValid)
{
unsigned int DeviceIndex;
for (DeviceIndex = Controller->V2.PhysicalDeviceIndex;
@@ -4938,7 +4939,7 @@ static void DAC960_V2_ProcessCompletedCo
}
Controller->V2.NeedPhysicalDeviceInformation = false;
}
- else if (CommandOpcode == DAC960_V2_GetLogicalDeviceInfoValid &&
+ else if (IOCTLOpcode == DAC960_V2_GetLogicalDeviceInfoValid &&
CommandStatus == DAC960_V2_NormalCompletion)
{
DAC960_V2_LogicalDeviceInfo_T *NewLogicalDeviceInfo =
@@ -5065,7 +5066,7 @@ static void DAC960_V2_ProcessCompletedCo
[LogicalDeviceNumber] = true;
NewLogicalDeviceInfo->LogicalDeviceNumber++;
}
- else if (CommandOpcode == DAC960_V2_GetLogicalDeviceInfoValid)
+ else if (IOCTLOpcode == DAC960_V2_GetLogicalDeviceInfoValid)
{
int LogicalDriveNumber;
for (LogicalDriveNumber = 0;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 126/147] staging: comedi: vmk80xx: fix compiler warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (89 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 098/147] drivers/block/DAC960: fix DAC960_V2_IOCTL_Opcode_T -Wenum-compare warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 026/147] xtensa: add missing symbol exports Ben Hutchings
` (56 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, H Hartley Sweeten, Greg Kroah-Hartman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 13f7952f8f13fb1bbd18b85988e3a5bbbed00879 upstream.
gcc complains about some potentially uninitalized variables here, yet it
can not happen, due to an enumerated type (either the board is one type
or the other.) Make the compiler happy by providing a default case
option that makes the logic a bit simpler for it to determine that there
really isn't a problem here.
Cc: H Hartley Sweeten <hartleys@visionengravers.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/comedi/drivers/vmk80xx.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -605,6 +605,7 @@ static int vmk80xx_ai_rinsn(struct comed
reg[0] = VMK8055_AI2_REG;
break;
case VMK8061_MODEL:
+ default:
reg[0] = VMK8061_AI_REG1;
reg[1] = VMK8061_AI_REG2;
dev->usb_tx_buf[0] = VMK8061_CMD_RD_AI;
@@ -979,6 +980,7 @@ static int vmk80xx_cnt_rinsn(struct come
reg[0] = VMK8055_CNT2_REG;
break;
case VMK8061_MODEL:
+ default:
reg[0] = VMK8061_CNT_REG;
reg[1] = VMK8061_CNT_REG;
dev->usb_tx_buf[0] = VMK8061_CMD_RD_CNT;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 026/147] xtensa: add missing symbol exports
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (90 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 126/147] staging: comedi: vmk80xx: fix compiler warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 053/147] xfrm_user: fix info leak in xfrm_notify_sa() Ben Hutchings
` (55 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Max Filippov, Chris Zankel
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit d3738f407c8ced4fd17dccf6cce729023c735c73 upstream.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Chris Zankel <chris@zankel.net>
[bwh: Backported to 3.2: drop exports of some functions that aren't defined here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/xtensa/kernel/pci-dma.c
+++ b/arch/xtensa/kernel/pci-dma.c
@@ -21,6 +21,7 @@
#include <linux/string.h>
#include <linux/pci.h>
#include <linux/gfp.h>
+#include <linux/module.h>
#include <asm/io.h>
#include <asm/cacheflush.h>
@@ -62,6 +63,7 @@ dma_alloc_coherent(struct device *dev,si
return (void*)uncached;
}
+EXPORT_SYMBOL(dma_alloc_coherent);
void dma_free_coherent(struct device *hwdev, size_t size,
void *vaddr, dma_addr_t dma_handle)
@@ -73,6 +75,7 @@ void dma_free_coherent(struct device *hw
free_pages(addr, get_order(size));
}
+EXPORT_SYMBOL(dma_free_coherent);
void consistent_sync(void *vaddr, size_t size, int direction)
@@ -92,3 +95,4 @@ void consistent_sync(void *vaddr, size_t
break;
}
}
+EXPORT_SYMBOL(consistent_sync);
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -39,8 +39,12 @@
EXPORT_SYMBOL(memset);
EXPORT_SYMBOL(memcpy);
EXPORT_SYMBOL(memmove);
+EXPORT_SYMBOL(__strncpy_user);
+EXPORT_SYMBOL(clear_page);
+EXPORT_SYMBOL(copy_page);
EXPORT_SYMBOL(kernel_thread);
+EXPORT_SYMBOL(empty_zero_page);
/*
* gcc internal math functions
@@ -73,6 +77,7 @@ EXPORT_SYMBOL(__umoddi3);
/*
* Networking support
*/
+EXPORT_SYMBOL(csum_partial);
EXPORT_SYMBOL(csum_partial_copy_generic);
#endif /* CONFIG_NET */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 053/147] xfrm_user: fix info leak in xfrm_notify_sa()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (91 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 026/147] xtensa: add missing symbol exports Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 003/147] staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read Ben Hutchings
` (54 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Herbert Xu, Mathias Krause, Steffen Klassert
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Krause <minipli@googlemail.com>
commit 50329c8a340c9dea60d837645fcf13fc36bfb84d upstream.
The memory reserved to dump the ID of the xfrm state includes a padding
byte in struct xfrm_usersa_id added by the compiler for alignment. To
prevent the heap info leak, memset(0) the whole struct before filling
it.
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Fixes: 0603eac0d6b7 ("[IPSEC]: Add XFRMA_SA/XFRMA_POLICY for delete notification")
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/xfrm/xfrm_user.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -2507,6 +2507,7 @@ static int xfrm_notify_sa(struct xfrm_st
struct nlattr *attr;
id = nlmsg_data(nlh);
+ memset(id, 0, sizeof(*id));
memcpy(&id->daddr, &x->id.daddr, sizeof(id->daddr));
id->spi = x->id.spi;
id->family = x->props.family;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 003/147] staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (92 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 053/147] xfrm_user: fix info leak in xfrm_notify_sa() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 047/147] perf/core: Fix group {cpu,task} validation Ben Hutchings
` (53 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Jonathan Cameron, Arnd Bergmann
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 105967ad68d2eb1a041bc041f9cf96af2a653b65 upstream.
gcc-7 points out an older regression:
drivers/staging/iio/resolver/ad2s1210.c: In function 'ad2s1210_read_raw':
drivers/staging/iio/resolver/ad2s1210.c:515:42: error: '<<' in boolean context, did you mean '<' ? [-Werror=int-in-bool-context]
The original code had 'unsigned short' here, but incorrectly got
converted to 'bool'. This reverts the regression and uses a normal
type instead.
Fixes: 29148543c521 ("staging:iio:resolver:ad2s1210 minimal chan spec conversion.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/resolver/ad2s1210.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/resolver/ad2s1210.c
+++ b/drivers/staging/iio/resolver/ad2s1210.c
@@ -480,7 +480,7 @@ static int ad2s1210_read_raw(struct iio_
long m)
{
struct ad2s1210_state *st = iio_priv(indio_dev);
- bool negative;
+ u16 negative;
int ret = 0;
u16 pos;
s16 vel;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 047/147] perf/core: Fix group {cpu,task} validation
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (93 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 003/147] staging:iio:resolver:ad2s1210 fix negative IIO_ANGL_VEL read Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 015/147] RDMA/core: Initialize port_num in qp_attr Ben Hutchings
` (52 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Linus Torvalds, Mark Rutland, Ingo Molnar,
Peter Zijlstra (Intel),
Thomas Gleixner, Arnaldo Carvalho de Melo, Alexander Shishkin,
Zhou Chengming
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 64aee2a965cf2954a038b5522f11d2cd2f0f8f3e upstream.
Regardless of which events form a group, it does not make sense for the
events to target different tasks and/or CPUs, as this leaves the group
inconsistent and impossible to schedule. The core perf code assumes that
these are consistent across (successfully intialised) groups.
Core perf code only verifies this when moving SW events into a HW
context. Thus, we can violate this requirement for pure SW groups and
pure HW groups, unless the relevant PMU driver happens to perform this
verification itself. These mismatched groups subsequently wreak havoc
elsewhere.
For example, we handle watchpoints as SW events, and reserve watchpoint
HW on a per-CPU basis at pmu::event_init() time to ensure that any event
that is initialised is guaranteed to have a slot at pmu::add() time.
However, the core code only checks the group leader's cpu filter (via
event_filter_match()), and can thus install follower events onto CPUs
violating thier (mismatched) CPU filters, potentially installing them
into a CPU without sufficient reserved slots.
This can be triggered with the below test case, resulting in warnings
from arch backends.
#define _GNU_SOURCE
#include <linux/hw_breakpoint.h>
#include <linux/perf_event.h>
#include <sched.h>
#include <stdio.h>
#include <sys/prctl.h>
#include <sys/syscall.h>
#include <unistd.h>
static int perf_event_open(struct perf_event_attr *attr, pid_t pid, int cpu,
int group_fd, unsigned long flags)
{
return syscall(__NR_perf_event_open, attr, pid, cpu, group_fd, flags);
}
char watched_char;
struct perf_event_attr wp_attr = {
.type = PERF_TYPE_BREAKPOINT,
.bp_type = HW_BREAKPOINT_RW,
.bp_addr = (unsigned long)&watched_char,
.bp_len = 1,
.size = sizeof(wp_attr),
};
int main(int argc, char *argv[])
{
int leader, ret;
cpu_set_t cpus;
/*
* Force use of CPU0 to ensure our CPU0-bound events get scheduled.
*/
CPU_ZERO(&cpus);
CPU_SET(0, &cpus);
ret = sched_setaffinity(0, sizeof(cpus), &cpus);
if (ret) {
printf("Unable to set cpu affinity\n");
return 1;
}
/* open leader event, bound to this task, CPU0 only */
leader = perf_event_open(&wp_attr, 0, 0, -1, 0);
if (leader < 0) {
printf("Couldn't open leader: %d\n", leader);
return 1;
}
/*
* Open a follower event that is bound to the same task, but a
* different CPU. This means that the group should never be possible to
* schedule.
*/
ret = perf_event_open(&wp_attr, 0, 1, leader, 0);
if (ret < 0) {
printf("Couldn't open mismatched follower: %d\n", ret);
return 1;
} else {
printf("Opened leader/follower with mismastched CPUs\n");
}
/*
* Open as many independent events as we can, all bound to the same
* task, CPU0 only.
*/
do {
ret = perf_event_open(&wp_attr, 0, 0, -1, 0);
} while (ret >= 0);
/*
* Force enable/disble all events to trigger the erronoeous
* installation of the follower event.
*/
printf("Opened all events. Toggling..\n");
for (;;) {
prctl(PR_TASK_PERF_EVENTS_DISABLE, 0, 0, 0, 0);
prctl(PR_TASK_PERF_EVENTS_ENABLE, 0, 0, 0, 0);
}
return 0;
}
Fix this by validating this requirement regardless of whether we're
moving events.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Zhou Chengming <zhouchengming1@huawei.com>
Link: http://lkml.kernel.org/r/1498142498-15758-1-git-send-email-mark.rutland@arm.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/events/core.c | 39 +++++++++++++++++++--------------------
1 file changed, 19 insertions(+), 20 deletions(-)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6692,28 +6692,27 @@ SYSCALL_DEFINE5(perf_event_open,
if (group_leader->group_leader != group_leader)
goto err_context;
/*
- * Do not allow to attach to a group in a different
- * task or CPU context:
+ * Make sure we're both events for the same CPU;
+ * grouping events for different CPUs is broken; since
+ * you can never concurrently schedule them anyhow.
*/
- if (move_group) {
- /*
- * Make sure we're both on the same task, or both
- * per-cpu events.
- */
- if (group_leader->ctx->task != ctx->task)
- goto err_context;
+ if (group_leader->cpu != event->cpu)
+ goto err_context;
+
+ /*
+ * Make sure we're both on the same task, or both
+ * per-CPU events.
+ */
+ if (group_leader->ctx->task != ctx->task)
+ goto err_context;
- /*
- * Make sure we're both events for the same CPU;
- * grouping events for different CPUs is broken; since
- * you can never concurrently schedule them anyhow.
- */
- if (group_leader->cpu != event->cpu)
- goto err_context;
- } else {
- if (group_leader->ctx != ctx)
- goto err_context;
- }
+ /*
+ * Do not allow to attach to a group in a different task
+ * or CPU context. If we're moving SW events, we'll fix
+ * this up later, so allow that.
+ */
+ if (!move_group && group_leader->ctx != ctx)
+ goto err_context;
/*
* Only a group leader can be exclusive or pinned
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 015/147] RDMA/core: Initialize port_num in qp_attr
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (94 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 047/147] perf/core: Fix group {cpu,task} validation Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 080/147] mac80211: accept key reinstall without changing anything Ben Hutchings
` (51 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Mike Marciniszyn, Steve Wise, Ismail, Mustafa, Doug Ledford
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Ismail, Mustafa" <mustafa.ismail@intel.com>
commit a62ab66b13a0f9bcb17b7b761f6670941ed5cd62 upstream.
Initialize the port_num for iWARP in rdma_init_qp_attr.
Fixes: 5ecce4c9b17b("Check port number supplied by user verbs cmds")
Reviewed-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Tested-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/core/cma.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -661,6 +661,8 @@ int rdma_init_qp_attr(struct rdma_cm_id
} else
ret = iw_cm_init_qp_attr(id_priv->cm_id.iw, qp_attr,
qp_attr_mask);
+ qp_attr->port_num = id_priv->id.port_num;
+ *qp_attr_mask |= IB_QP_PORT;
break;
default:
ret = -ENOSYS;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 080/147] mac80211: accept key reinstall without changing anything
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (95 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 015/147] RDMA/core: Initialize port_num in qp_attr Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 091/147] USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() Ben Hutchings
` (50 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Johannes Berg
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit fdf7cb4185b60c68e1a75e61691c4afdc15dea0e upstream.
When a key is reinstalled we can reset the replay counters
etc. which can lead to nonce reuse and/or replay detection
being impossible, breaking security properties, as described
in the "KRACK attacks".
In particular, CVE-2017-13080 applies to GTK rekeying that
happened in firmware while the host is in D3, with the second
part of the attack being done after the host wakes up. In
this case, the wpa_supplicant mitigation isn't sufficient
since wpa_supplicant doesn't know the GTK material.
In case this happens, simply silently accept the new key
coming from userspace but don't take any action on it since
it's the same key; this keeps the PN replay counters intact.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
[bwh: Backported to 3.2:
- Use __ieee80211_key_free() instead of ieee80211_key_free_unused()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/key.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -3,6 +3,7 @@
* Copyright 2005-2006, Devicescape Software, Inc.
* Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
* Copyright 2007-2008 Johannes Berg <johannes@sipsolutions.net>
+ * Copyright 2017 Intel Deutschland GmbH
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@@ -456,9 +457,6 @@ int ieee80211_key_link(struct ieee80211_
pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE;
idx = key->conf.keyidx;
- key->local = sdata->local;
- key->sdata = sdata;
- key->sta = sta;
if (sta) {
/*
@@ -495,6 +493,21 @@ int ieee80211_key_link(struct ieee80211_
else
old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]);
+ /*
+ * Silently accept key re-installation without really installing the
+ * new version of the key to avoid nonce reuse or replay issues.
+ */
+ if (old_key && key->conf.keylen == old_key->conf.keylen &&
+ !memcmp(key->conf.key, old_key->conf.key, key->conf.keylen)) {
+ __ieee80211_key_free(key);
+ ret = 0;
+ goto out;
+ }
+
+ key->local = sdata->local;
+ key->sdata = sdata;
+ key->sta = sta;
+
increment_tailroom_need_count(sdata);
__ieee80211_key_replace(sdata, sta, pairwise, old_key, key);
@@ -504,6 +517,7 @@ int ieee80211_key_link(struct ieee80211_
ret = ieee80211_key_enable_hw_accel(key);
+ out:
mutex_unlock(&sdata->local->key_mtx);
return ret;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 091/147] USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (96 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 080/147] mac80211: accept key reinstall without changing anything Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 119/147] [media] tda18212: silence compiler warning Ben Hutchings
` (49 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andrey Konovalov, Alan Stern, Greg Kroah-Hartman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 1c0edc3633b56000e18d82fc241e3995ca18a69e upstream.
Andrey used the syzkaller fuzzer to find an out-of-bounds memory
access in usb_get_bos_descriptor(). The code wasn't checking that the
next usb_dev_cap_header structure could fit into the remaining buffer
space.
This patch fixes the error and also reduces the bNumDeviceCaps field
in the header to match the actual number of capabilities found, in
cases where there are fewer than expected.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/core/config.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -931,10 +931,12 @@ int usb_get_bos_descriptor(struct usb_de
for (i = 0; i < num; i++) {
buffer += length;
cap = (struct usb_dev_cap_header *)buffer;
- length = cap->bLength;
- if (total_len < length)
+ if (total_len < sizeof(*cap) || total_len < cap->bLength) {
+ dev->bos->desc->bNumDeviceCaps = i;
break;
+ }
+ length = cap->bLength;
total_len -= length;
if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 119/147] [media] tda18212: silence compiler warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (97 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 091/147] USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 068/147] CIFS: remove endian related sparse warning Ben Hutchings
` (48 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Mauro Carvalho Chehab, Antti Palosaari
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Antti Palosaari <crope@iki.fi>
commit e666a44fa313cb9329c0381ad02fc6ee1e21cb31 upstream.
Trivial fix.
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/common/tuners/tda18212.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/common/tuners/tda18212.c
+++ b/drivers/media/common/tuners/tda18212.c
@@ -241,7 +241,7 @@ struct dvb_frontend *tda18212_attach(str
{
struct tda18212_priv *priv = NULL;
int ret;
- u8 val;
+ u8 uninitialized_var(val);
priv = kzalloc(sizeof(struct tda18212_priv), GFP_KERNEL);
if (priv == NULL)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 068/147] CIFS: remove endian related sparse warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (98 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 119/147] [media] tda18212: silence compiler warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 086/147] ALSA: usb-audio: Kill stray URB at exiting Ben Hutchings
` (47 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ronnie Sahlberg, Steve French, Pavel Shilovsky
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Steve French <smfrench@gmail.com>
commit 6e3c1529c39e92ed64ca41d53abadabbaa1d5393 upstream.
Recent patch had an endian warning ie
cifs: return ENAMETOOLONG for overlong names in cifs_open()/cifs_lookup()
Signed-off-by: Steve French <smfrench@gmail.com>
CC: Ronnie Sahlberg <lsahlber@redhat.com>
Acked-by: Pavel Shilovsky <pshilov@microsoft.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -522,7 +522,7 @@ cifs_lookup(struct inode *parent_dir_ino
/* Don't allow path components longer than the server max. */
if (unlikely(direntry->d_name.len >
- pTcon->fsAttrInfo.MaxPathNameComponentLength)) {
+ le32_to_cpu(pTcon->fsAttrInfo.MaxPathNameComponentLength))) {
rc = -ENAMETOOLONG;
goto lookup_out;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 086/147] ALSA: usb-audio: Kill stray URB at exiting
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (99 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 068/147] CIFS: remove endian related sparse warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 071/147] sch_multiq: fix double free on init failure Ben Hutchings
` (46 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Takashi Iwai, Andrey Konovalov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 124751d5e63c823092060074bd0abaae61aaa9c4 upstream.
USB-audio driver may leave a stray URB for the mixer interrupt when it
exits by some error during probe. This leads to a use-after-free
error as spotted by syzkaller like:
==================================================================
BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:16
dump_stack+0x292/0x395 lib/dump_stack.c:52
print_address_description+0x78/0x280 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351
kasan_report+0x23d/0x350 mm/kasan/report.c:409
__asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430
snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490
__usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779
....
Allocated by task 1484:
save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459
kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772
kmalloc ./include/linux/slab.h:493
kzalloc ./include/linux/slab.h:666
snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540
create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516
snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59
snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560
usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618
....
Freed by task 1484:
save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59
save_stack+0x43/0xd0 mm/kasan/kasan.c:447
set_track mm/kasan/kasan.c:459
kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524
slab_free_hook mm/slub.c:1390
slab_free_freelist_hook mm/slub.c:1412
slab_free mm/slub.c:2988
kfree+0xf6/0x2f0 mm/slub.c:3919
snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244
snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250
__snd_device_free+0x1ff/0x380 sound/core/device.c:91
snd_device_free_all+0x8f/0xe0 sound/core/device.c:244
snd_card_do_free sound/core/init.c:461
release_card_device+0x47/0x170 sound/core/init.c:181
device_release+0x13f/0x210 drivers/base/core.c:814
....
Actually such a URB is killed properly at disconnection when the
device gets probed successfully, and what we need is to apply it for
the error-path, too.
In this patch, we apply snd_usb_mixer_disconnect() at releasing.
Also introduce a new flag, disconnected, to struct usb_mixer_interface
for not performing the disconnection procedure twice.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: snd_usb_mixer_disconnect() takes a pointer to
usb_mixer_interface::list, not to usb_mixer_interface itself]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/mixer.c | 12 ++++++++++--
sound/usb/mixer.h | 2 ++
2 files changed, 12 insertions(+), 2 deletions(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1985,6 +1985,9 @@ static int parse_audio_unit(struct mixer
static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
{
+ /* kill pending URBs */
+ snd_usb_mixer_disconnect(&mixer->list);
+
kfree(mixer->id_elems);
if (mixer->urb) {
kfree(mixer->urb->transfer_buffer);
@@ -2331,6 +2334,11 @@ void snd_usb_mixer_disconnect(struct lis
struct usb_mixer_interface *mixer;
mixer = list_entry(p, struct usb_mixer_interface, list);
- usb_kill_urb(mixer->urb);
- usb_kill_urb(mixer->rc_urb);
+ if (mixer->disconnected)
+ return;
+ if (mixer->urb)
+ usb_kill_urb(mixer->urb);
+ if (mixer->rc_urb)
+ usb_kill_urb(mixer->rc_urb);
+ mixer->disconnected = true;
}
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -23,6 +23,8 @@ struct usb_mixer_interface {
u8 audigy2nx_leds[3];
u8 xonar_u1_status;
+
+ bool disconnected;
};
#define MAX_CHANNELS 16 /* max logical channels */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 071/147] sch_multiq: fix double free on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (100 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 086/147] ALSA: usb-audio: Kill stray URB at exiting Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 144/147] staging: bcm: add 32-bit host dependency Ben Hutchings
` (45 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Aleksandrov, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit e89d469e3be3ed3d7124a803211a463ff83d0964 upstream.
The below commit added a call to ->destroy() on init failure, but multiq
still frees ->queues on error in init, but ->queues is also freed by
->destroy() thus we get double free and corrupted memory.
Very easy to reproduce (eth0 not multiqueue):
$ tc qdisc add dev eth0 root multiq
RTNETLINK answers: Operation not supported
$ ip l add dumdum type dummy
(crash)
Trace log:
[ 3929.467747] general protection fault: 0000 [#1] SMP
[ 3929.468083] Modules linked in:
[ 3929.468302] CPU: 3 PID: 967 Comm: ip Not tainted 4.13.0-rc6+ #56
[ 3929.468625] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 3929.469124] task: ffff88003716a700 task.stack: ffff88005872c000
[ 3929.469449] RIP: 0010:__kmalloc_track_caller+0x117/0x1be
[ 3929.469746] RSP: 0018:ffff88005872f6a0 EFLAGS: 00010246
[ 3929.470042] RAX: 00000000000002de RBX: 0000000058a59000 RCX: 00000000000002df
[ 3929.470406] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff821f7020
[ 3929.470770] RBP: ffff88005872f6e8 R08: 000000000001f010 R09: 0000000000000000
[ 3929.471133] R10: ffff88005872f730 R11: 0000000000008cdd R12: ff006d75646d7564
[ 3929.471496] R13: 00000000014000c0 R14: ffff88005b403c00 R15: ffff88005b403c00
[ 3929.471869] FS: 00007f0b70480740(0000) GS:ffff88005d980000(0000) knlGS:0000000000000000
[ 3929.472286] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 3929.472677] CR2: 00007ffcee4f3000 CR3: 0000000059d45000 CR4: 00000000000406e0
[ 3929.473209] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 3929.474109] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 3929.474873] Call Trace:
[ 3929.475337] ? kstrdup_const+0x23/0x25
[ 3929.475863] kstrdup+0x2e/0x4b
[ 3929.476338] kstrdup_const+0x23/0x25
[ 3929.478084] __kernfs_new_node+0x28/0xbc
[ 3929.478478] kernfs_new_node+0x35/0x55
[ 3929.478929] kernfs_create_link+0x23/0x76
[ 3929.479478] sysfs_do_create_link_sd.isra.2+0x85/0xd7
[ 3929.480096] sysfs_create_link+0x33/0x35
[ 3929.480649] device_add+0x200/0x589
[ 3929.481184] netdev_register_kobject+0x7c/0x12f
[ 3929.481711] register_netdevice+0x373/0x471
[ 3929.482174] rtnl_newlink+0x614/0x729
[ 3929.482610] ? rtnl_newlink+0x17f/0x729
[ 3929.483080] rtnetlink_rcv_msg+0x188/0x197
[ 3929.483533] ? rcu_read_unlock+0x3e/0x5f
[ 3929.483984] ? rtnl_newlink+0x729/0x729
[ 3929.484420] netlink_rcv_skb+0x6c/0xce
[ 3929.484858] rtnetlink_rcv+0x23/0x2a
[ 3929.485291] netlink_unicast+0x103/0x181
[ 3929.485735] netlink_sendmsg+0x326/0x337
[ 3929.486181] sock_sendmsg_nosec+0x14/0x3f
[ 3929.486614] sock_sendmsg+0x29/0x2e
[ 3929.486973] ___sys_sendmsg+0x209/0x28b
[ 3929.487340] ? do_raw_spin_unlock+0xcd/0xf8
[ 3929.487719] ? _raw_spin_unlock+0x27/0x31
[ 3929.488092] ? __handle_mm_fault+0x651/0xdb1
[ 3929.488471] ? check_chain_key+0xb0/0xfd
[ 3929.488847] __sys_sendmsg+0x45/0x63
[ 3929.489206] ? __sys_sendmsg+0x45/0x63
[ 3929.489576] SyS_sendmsg+0x19/0x1b
[ 3929.489901] entry_SYSCALL_64_fastpath+0x23/0xc2
[ 3929.490172] RIP: 0033:0x7f0b6fb93690
[ 3929.490423] RSP: 002b:00007ffcee4ed588 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 3929.490881] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007f0b6fb93690
[ 3929.491198] RDX: 0000000000000000 RSI: 00007ffcee4ed5d0 RDI: 0000000000000003
[ 3929.491521] RBP: ffff88005872ff98 R08: 0000000000000001 R09: 0000000000000000
[ 3929.491801] R10: 00007ffcee4ed350 R11: 0000000000000246 R12: 0000000000000002
[ 3929.492075] R13: 000000000066f1a0 R14: 00007ffcee4f5680 R15: 0000000000000000
[ 3929.492352] ? trace_hardirqs_off_caller+0xa7/0xcf
[ 3929.492590] Code: 8b 45 c0 48 8b 45 b8 74 17 48 8b 4d c8 83 ca ff 44
89 ee 4c 89 f7 e8 83 ca ff ff 49 89 c4 eb 49 49 63 56 20 48 8d 48 01 4d
8b 06 <49> 8b 1c 14 48 89 c2 4c 89 e0 65 49 0f c7 08 0f 94 c0 83 f0 01
[ 3929.493335] RIP: __kmalloc_track_caller+0x117/0x1be RSP: ffff88005872f6a0
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Fixes: f07d1501292b ("multiq: Further multiqueue cleanup")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: delete now-unused 'err' variable]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_multiq.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
--- a/net/sched/sch_multiq.c
+++ b/net/sched/sch_multiq.c
@@ -250,7 +250,7 @@ static int multiq_tune(struct Qdisc *sch
static int multiq_init(struct Qdisc *sch, struct nlattr *opt)
{
struct multiq_sched_data *q = qdisc_priv(sch);
- int i, err;
+ int i;
q->queues = NULL;
@@ -265,12 +265,7 @@ static int multiq_init(struct Qdisc *sch
for (i = 0; i < q->max_bands; i++)
q->queues[i] = &noop_qdisc;
- err = multiq_tune(sch, opt);
-
- if (err)
- kfree(q->queues);
-
- return err;
+ return multiq_tune(sch, opt);
}
static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 144/147] staging: bcm: add 32-bit host dependency
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (101 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 071/147] sch_multiq: fix double free on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 074/147] sch_netem: avoid null pointer deref on init failure Ben Hutchings
` (44 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Arnd Bergmann
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
The driver uses a 32-bit variable to store a pointer, causing a couple of
warnings:
../drivers/staging/bcm/CmHost.c: In function 'StoreCmControlResponseMessage':
../drivers/staging/bcm/CmHost.c:1503:3: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
(struct bcm_connect_mgr_params *) ntohl(
^
../drivers/staging/bcm/CmHost.c:1546:3: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
(struct bcm_connect_mgr_params *) ntohl(
^
../drivers/staging/bcm/CmHost.c:1564:3: error: cast to pointer from integer of different size [-Werror=int-to-pointer-cast]
(struct bcm_connect_mgr_params *) ntohl(
I fixed other warnings in an earlier commit 9f1c75ac2dba ("staging/bcm: fix most
build warnings"), but couldn't figure out what was the intended behavior on
64-bit machines here.
The driver was removed in linux-3.19, commit d09e9b160fc1 ("staging: bcm: remove
driver") which explains that it never worked on 64-bit machines. This adds
a Kconfig dependency instead to prevent it from being built in the known
broken configuration. This workaround applies to v2.6.37 or higher.
Fixes: f8942e07a3db ("staging: Beeceem USB Wimax driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/bcm/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/staging/bcm/Kconfig
+++ b/drivers/staging/bcm/Kconfig
@@ -1,6 +1,7 @@
config BCM_WIMAX
tristate "Beceem BCS200/BCS220-3 and BCSM250 wimax support"
depends on USB && NET && EXPERIMENTAL
+ depends on !64BIT
default N
help
This is an experimental driver for the Beceem WIMAX chipset used
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 074/147] sch_netem: avoid null pointer deref on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (102 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 144/147] staging: bcm: add 32-bit host dependency Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 095/147] eCryptfs: initialize payload_len in keystore.c Ben Hutchings
` (43 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Aleksandrov, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit 634576a1844dba15bc5e6fc61d72f37e13a21615 upstream.
netem can fail in ->init due to missing options (either not supplied by
user-space or used as a default qdisc) causing a timer->base null
pointer deref in its ->destroy() and ->reset() callbacks.
Reproduce:
$ sysctl net.core.default_qdisc=netem
$ ip l set ethX up
Crash log:
[ 1814.846943] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 1814.847181] IP: hrtimer_active+0x17/0x8a
[ 1814.847270] PGD 59c34067
[ 1814.847271] P4D 59c34067
[ 1814.847337] PUD 37374067
[ 1814.847403] PMD 0
[ 1814.847468]
[ 1814.847582] Oops: 0000 [#1] SMP
[ 1814.847655] Modules linked in: sch_netem(O) sch_fq_codel(O)
[ 1814.847761] CPU: 3 PID: 1573 Comm: ip Tainted: G O 4.13.0-rc6+ #62
[ 1814.847884] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 1814.848043] task: ffff88003723a700 task.stack: ffff88005adc8000
[ 1814.848235] RIP: 0010:hrtimer_active+0x17/0x8a
[ 1814.848407] RSP: 0018:ffff88005adcb590 EFLAGS: 00010246
[ 1814.848590] RAX: 0000000000000000 RBX: ffff880058e359d8 RCX: 0000000000000000
[ 1814.848793] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880058e359d8
[ 1814.848998] RBP: ffff88005adcb5b0 R08: 00000000014080c0 R09: 00000000ffffffff
[ 1814.849204] R10: ffff88005adcb660 R11: 0000000000000020 R12: 0000000000000000
[ 1814.849410] R13: ffff880058e359d8 R14: 00000000ffffffff R15: 0000000000000001
[ 1814.849616] FS: 00007f733bbca740(0000) GS:ffff88005d980000(0000) knlGS:0000000000000000
[ 1814.849919] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1814.850107] CR2: 0000000000000000 CR3: 0000000059f0d000 CR4: 00000000000406e0
[ 1814.850313] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1814.850518] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 1814.850723] Call Trace:
[ 1814.850875] hrtimer_try_to_cancel+0x1a/0x93
[ 1814.851047] hrtimer_cancel+0x15/0x20
[ 1814.851211] qdisc_watchdog_cancel+0x12/0x14
[ 1814.851383] netem_reset+0xe6/0xed [sch_netem]
[ 1814.851561] qdisc_destroy+0x8b/0xe5
[ 1814.851723] qdisc_create_dflt+0x86/0x94
[ 1814.851890] ? dev_activate+0x129/0x129
[ 1814.852057] attach_one_default_qdisc+0x36/0x63
[ 1814.852232] netdev_for_each_tx_queue+0x3d/0x48
[ 1814.852406] dev_activate+0x4b/0x129
[ 1814.852569] __dev_open+0xe7/0x104
[ 1814.852730] __dev_change_flags+0xc6/0x15c
[ 1814.852899] dev_change_flags+0x25/0x59
[ 1814.853064] do_setlink+0x30c/0xb3f
[ 1814.853228] ? check_chain_key+0xb0/0xfd
[ 1814.853396] ? check_chain_key+0xb0/0xfd
[ 1814.853565] rtnl_newlink+0x3a4/0x729
[ 1814.853728] ? rtnl_newlink+0x117/0x729
[ 1814.853905] ? ns_capable_common+0xd/0xb1
[ 1814.854072] ? ns_capable+0x13/0x15
[ 1814.854234] rtnetlink_rcv_msg+0x188/0x197
[ 1814.854404] ? rcu_read_unlock+0x3e/0x5f
[ 1814.854572] ? rtnl_newlink+0x729/0x729
[ 1814.854737] netlink_rcv_skb+0x6c/0xce
[ 1814.854902] rtnetlink_rcv+0x23/0x2a
[ 1814.855064] netlink_unicast+0x103/0x181
[ 1814.855230] netlink_sendmsg+0x326/0x337
[ 1814.855398] sock_sendmsg_nosec+0x14/0x3f
[ 1814.855584] sock_sendmsg+0x29/0x2e
[ 1814.855747] ___sys_sendmsg+0x209/0x28b
[ 1814.855912] ? do_raw_spin_unlock+0xcd/0xf8
[ 1814.856082] ? _raw_spin_unlock+0x27/0x31
[ 1814.856251] ? __handle_mm_fault+0x651/0xdb1
[ 1814.856421] ? check_chain_key+0xb0/0xfd
[ 1814.856592] __sys_sendmsg+0x45/0x63
[ 1814.856755] ? __sys_sendmsg+0x45/0x63
[ 1814.856923] SyS_sendmsg+0x19/0x1b
[ 1814.857083] entry_SYSCALL_64_fastpath+0x23/0xc2
[ 1814.857256] RIP: 0033:0x7f733b2dd690
[ 1814.857419] RSP: 002b:00007ffe1d3387d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[ 1814.858238] RAX: ffffffffffffffda RBX: ffffffff810d278c RCX: 00007f733b2dd690
[ 1814.858445] RDX: 0000000000000000 RSI: 00007ffe1d338820 RDI: 0000000000000003
[ 1814.858651] RBP: ffff88005adcbf98 R08: 0000000000000001 R09: 0000000000000003
[ 1814.858856] R10: 00007ffe1d3385a0 R11: 0000000000000246 R12: 0000000000000002
[ 1814.859060] R13: 000000000066f1a0 R14: 00007ffe1d3408d0 R15: 0000000000000000
[ 1814.859267] ? trace_hardirqs_off_caller+0xa7/0xcf
[ 1814.859446] Code: 10 55 48 89 c7 48 89 e5 e8 45 a1 fb ff 31 c0 5d c3
31 c0 c3 66 66 66 66 90 55 48 89 e5 41 56 41 55 41 54 53 49 89 fd 49 8b
45 30 <4c> 8b 20 41 8b 5c 24 38 31 c9 31 d2 48 c7 c7 50 8e 1d 82 41 89
[ 1814.860022] RIP: hrtimer_active+0x17/0x8a RSP: ffff88005adcb590
[ 1814.860214] CR2: 0000000000000000
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Fixes: 0fbbeb1ba43b ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_netem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -758,11 +758,11 @@ static int netem_init(struct Qdisc *sch,
struct netem_sched_data *q = qdisc_priv(sch);
int ret;
+ qdisc_watchdog_init(&q->watchdog, sch);
+
if (!opt)
return -EINVAL;
- qdisc_watchdog_init(&q->watchdog, sch);
-
q->loss_model = CLG_RANDOM;
q->qdisc = qdisc_create_dflt(sch->dev_queue, &tfifo_qdisc_ops,
TC_H_MAKE(sch->handle, 1));
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 095/147] eCryptfs: initialize payload_len in keystore.c
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (103 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 074/147] sch_netem: avoid null pointer deref on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 035/147] af_key: do not use GFP_KERNEL in atomic contexts Ben Hutchings
` (42 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Tyler Hicks, Simon Que
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Simon Que <sque@chromium.org>
commit fa5199648e273a5e3e80aca41c1eb53700438dc1 upstream.
This is meant to remove a compiler warning. It should not make any
functional change.
payload_len should be initialized when it is passed to
write_tag_64_packet() as a pointer. If that call fails, this function
should return early, and payload_len won't be used.
Signed-off-by: Simon Que <sque@chromium.org>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ecryptfs/keystore.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c
@@ -1152,7 +1152,7 @@ decrypt_pki_encrypted_session_key(struct
struct ecryptfs_message *msg = NULL;
char *auth_tok_sig;
char *payload = NULL;
- size_t payload_len;
+ size_t payload_len = 0;
int rc;
rc = ecryptfs_get_auth_tok_sig(&auth_tok_sig, auth_tok);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 035/147] af_key: do not use GFP_KERNEL in atomic contexts
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (104 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 095/147] eCryptfs: initialize payload_len in keystore.c Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 103/147] dccp: Fix compile warning in probe code Ben Hutchings
` (41 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David Ahern, Dmitry Vyukov, Eric Dumazet, David S. Miller,
David Ahern
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 36f41f8fc6d8aa9f8c9072d66ff7cf9055f5e69b upstream.
pfkey_broadcast() might be called from non process contexts,
we can not use GFP_KERNEL in these cases [1].
This patch partially reverts commit ba51b6be38c1 ("net: Fix RCU splat in
af_key"), only keeping the GFP_ATOMIC forcing under rcu_read_lock()
section.
[1] : syzkaller reported :
in_atomic(): 1, irqs_disabled(): 0, pid: 2932, name: syzkaller183439
3 locks held by syzkaller183439/2932:
#0: (&net->xfrm.xfrm_cfg_mutex){+.+.+.}, at: [<ffffffff83b43888>] pfkey_sendmsg+0x4c8/0x9f0 net/key/af_key.c:3649
#1: (&pfk->dump_lock){+.+.+.}, at: [<ffffffff83b467f6>] pfkey_do_dump+0x76/0x3f0 net/key/af_key.c:293
#2: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] spin_lock_bh include/linux/spinlock.h:304 [inline]
#2: (&(&net->xfrm.xfrm_policy_lock)->rlock){+...+.}, at: [<ffffffff83957632>] xfrm_policy_walk+0x192/0xa30 net/xfrm/xfrm_policy.c:1028
CPU: 0 PID: 2932 Comm: syzkaller183439 Not tainted 4.13.0-rc4+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:16 [inline]
dump_stack+0x194/0x257 lib/dump_stack.c:52
___might_sleep+0x2b2/0x470 kernel/sched/core.c:5994
__might_sleep+0x95/0x190 kernel/sched/core.c:5947
slab_pre_alloc_hook mm/slab.h:416 [inline]
slab_alloc mm/slab.c:3383 [inline]
kmem_cache_alloc+0x24b/0x6e0 mm/slab.c:3559
skb_clone+0x1a0/0x400 net/core/skbuff.c:1037
pfkey_broadcast_one+0x4b2/0x6f0 net/key/af_key.c:207
pfkey_broadcast+0x4ba/0x770 net/key/af_key.c:281
dump_sp+0x3d6/0x500 net/key/af_key.c:2685
xfrm_policy_walk+0x2f1/0xa30 net/xfrm/xfrm_policy.c:1042
pfkey_dump_sp+0x42/0x50 net/key/af_key.c:2695
pfkey_do_dump+0xaa/0x3f0 net/key/af_key.c:299
pfkey_spddump+0x1a0/0x210 net/key/af_key.c:2722
pfkey_process+0x606/0x710 net/key/af_key.c:2814
pfkey_sendmsg+0x4d6/0x9f0 net/key/af_key.c:3650
sock_sendmsg_nosec net/socket.c:633 [inline]
sock_sendmsg+0xca/0x110 net/socket.c:643
___sys_sendmsg+0x755/0x890 net/socket.c:2035
__sys_sendmsg+0xe5/0x210 net/socket.c:2069
SYSC_sendmsg net/socket.c:2080 [inline]
SyS_sendmsg+0x2d/0x50 net/socket.c:2076
entry_SYSCALL_64_fastpath+0x1f/0xbe
RIP: 0033:0x445d79
RSP: 002b:00007f32447c1dc8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000445d79
RDX: 0000000000000000 RSI: 000000002023dfc8 RDI: 0000000000000008
RBP: 0000000000000086 R08: 00007f32447c2700 R09: 00007f32447c2700
R10: 00007f32447c2700 R11: 0000000000000202 R12: 0000000000000000
R13: 00007ffe33edec4f R14: 00007f32447c29c0 R15: 0000000000000000
Fixes: ba51b6be38c1 ("net: Fix RCU splat in af_key")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: David Ahern <dsa@cumulusnetworks.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/key/af_key.c | 48 ++++++++++++++++++++++++++----------------------
1 file changed, 26 insertions(+), 22 deletions(-)
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -225,7 +225,7 @@ static int pfkey_broadcast_one(struct sk
#define BROADCAST_ONE 1
#define BROADCAST_REGISTERED 2
#define BROADCAST_PROMISC_ONLY 4
-static int pfkey_broadcast(struct sk_buff *skb,
+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
int broadcast_flags, struct sock *one_sk,
struct net *net)
{
@@ -276,7 +276,7 @@ static int pfkey_broadcast(struct sk_buf
rcu_read_unlock();
if (one_sk != NULL)
- err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
+ err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
kfree_skb(skb2);
kfree_skb(skb);
@@ -309,7 +309,7 @@ static int pfkey_do_dump(struct pfkey_so
hdr = (struct sadb_msg *) pfk->dump.skb->data;
hdr->sadb_msg_seq = 0;
hdr->sadb_msg_errno = rc;
- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
&pfk->sk, sock_net(&pfk->sk));
pfk->dump.skb = NULL;
}
@@ -353,7 +353,7 @@ static int pfkey_error(const struct sadb
hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
sizeof(uint64_t));
- pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
return 0;
}
@@ -1388,7 +1388,7 @@ static int pfkey_getspi(struct sock *sk,
xfrm_state_put(x);
- pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
+ pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
return 0;
}
@@ -1476,7 +1476,7 @@ static int key_notify_sa(struct xfrm_sta
hdr->sadb_msg_seq = c->seq;
hdr->sadb_msg_pid = c->pid;
- pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
return 0;
}
@@ -1593,7 +1593,7 @@ static int pfkey_get(struct sock *sk, st
out_hdr->sadb_msg_reserved = 0;
out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
return 0;
}
@@ -1694,8 +1694,8 @@ static int pfkey_register(struct sock *s
return -ENOBUFS;
}
- pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
-
+ pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
+ sock_net(sk));
return 0;
}
@@ -1713,7 +1713,8 @@ static int unicast_flush_resp(struct soc
hdr->sadb_msg_errno = (uint8_t) 0;
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
- return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
+ sock_net(sk));
}
static int key_notify_sa_flush(const struct km_event *c)
@@ -1734,7 +1735,7 @@ static int key_notify_sa_flush(const str
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
hdr->sadb_msg_reserved = 0;
- pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
return 0;
}
@@ -1795,7 +1796,7 @@ static int dump_sa(struct xfrm_state *x,
out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
if (pfk->dump.skb)
- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
&pfk->sk, sock_net(&pfk->sk));
pfk->dump.skb = out_skb;
@@ -1862,7 +1863,7 @@ static int pfkey_promisc(struct sock *sk
new_hdr->sadb_msg_errno = 0;
}
- pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
+ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
return 0;
}
@@ -2193,7 +2194,7 @@ static int key_notify_policy(struct xfrm
out_hdr->sadb_msg_errno = 0;
out_hdr->sadb_msg_seq = c->seq;
out_hdr->sadb_msg_pid = c->pid;
- pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
return 0;
}
@@ -2419,7 +2420,7 @@ static int key_pol_get_resp(struct sock
out_hdr->sadb_msg_errno = 0;
out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
err = 0;
out:
@@ -2672,7 +2673,7 @@ static int dump_sp(struct xfrm_policy *x
out_hdr->sadb_msg_pid = pfk->dump.msg_pid;
if (pfk->dump.skb)
- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
&pfk->sk, sock_net(&pfk->sk));
pfk->dump.skb = out_skb;
@@ -2727,7 +2728,7 @@ static int key_notify_policy_flush(const
hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
hdr->sadb_msg_reserved = 0;
- pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
+ pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
return 0;
}
@@ -2793,7 +2794,7 @@ static int pfkey_process(struct sock *sk
void *ext_hdrs[SADB_EXT_MAX];
int err;
- pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
memset(ext_hdrs, 0, sizeof(ext_hdrs));
@@ -2999,7 +3000,8 @@ static int key_notify_sa_expire(struct x
out_hdr->sadb_msg_seq = 0;
out_hdr->sadb_msg_pid = 0;
- pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+ xs_net(x));
return 0;
}
@@ -3171,7 +3173,8 @@ static int pfkey_send_acquire(struct xfr
xfrm_ctx->ctx_len);
}
- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+ xs_net(x));
}
static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
@@ -3369,7 +3372,8 @@ static int pfkey_send_new_mapping(struct
n_port->sadb_x_nat_t_port_port = sport;
n_port->sadb_x_nat_t_port_reserved = 0;
- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
+ xs_net(x));
}
#ifdef CONFIG_NET_KEY_MIGRATE
@@ -3561,7 +3565,7 @@ static int pfkey_send_migrate(const stru
}
/* broadcast migrate message to sockets */
- pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
return 0;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 103/147] dccp: Fix compile warning in probe code.
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (105 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 035/147] af_key: do not use GFP_KERNEL in atomic contexts Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 038/147] ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices Ben Hutchings
` (40 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "David S. Miller" <davem@davemloft.net>
commit d984e6197ecd2babc1537f42dc1e676133005cda upstream.
Commit 1386be55e32a3c5d8ef4a2b243c530a7b664c02c ("dccp: fix
auto-loading of dccp(_probe)") fixed a bug but created a new
compiler warning:
net/dccp/probe.c: In function ‘dccpprobe_init’:
net/dccp/probe.c:166:2: warning: the omitted middle operand in ?: will always be ‘true’, suggest explicit middle operand [-Wparentheses]
try_then_request_module() is built for situations where the
"existence" test is some lookup function that returns a non-NULL
object on success, and with a reference count of some kind held.
Here we're looking for a success return of zero from the jprobe
registry.
Instead of fighting the way try_then_request_module() works, simply
open code what we want to happen in a local helper function.
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/dccp/probe.c | 14 ++++++++++++--
1 file changed, 12 insertions(+), 2 deletions(-)
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -152,6 +152,17 @@ static const struct file_operations dccp
.llseek = noop_llseek,
};
+static __init int setup_jprobe(void)
+{
+ int ret = register_jprobe(&dccp_send_probe);
+
+ if (ret) {
+ request_module("dccp");
+ ret = register_jprobe(&dccp_send_probe);
+ }
+ return ret;
+}
+
static __init int dccpprobe_init(void)
{
int ret = -ENOMEM;
@@ -163,8 +174,7 @@ static __init int dccpprobe_init(void)
if (!proc_net_fops_create(&init_net, procname, S_IRUSR, &dccpprobe_fops))
goto err0;
- try_then_request_module((ret = register_jprobe(&dccp_send_probe)) == 0,
- "dccp");
+ ret = setup_jprobe();
if (ret)
goto err1;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 038/147] ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (106 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 103/147] dccp: Fix compile warning in probe code Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 008/147] usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL Ben Hutchings
` (39 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 0f174b3525a43bd51f9397394763925e0ebe7bc7 upstream.
C-Media devices (at least some models) mute the playback stream when
volumes are set to the minimum value. But this isn't informed via TLV
and the user-space, typically PulseAudio, gets confused as if it's
still played in a low volume.
This patch adds the new flag, min_mute, to struct usb_mixer_elem_info
for indicating that the mixer element is with the minimum-mute volume.
This flag is set for known C-Media devices in
snd_usb_mixer_fu_apply_quirk() in turn.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=196669
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/mixer.c | 2 ++
sound/usb/mixer.h | 1 +
sound/usb/mixer_quirks.c | 6 ++++++
3 files changed, 9 insertions(+)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -515,6 +515,8 @@ static int mixer_vol_tlv(struct snd_kcon
if (size < sizeof(scale))
return -ENOMEM;
+ if (cval->min_mute)
+ scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE;
scale[2] = cval->dBmin;
scale[3] = cval->dBmax;
if (copy_to_user(_tlv, scale, sizeof(scale)))
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -52,6 +52,7 @@ struct usb_mixer_elem_info {
int cached;
int cache_val[MAX_CHANNELS];
u8 initialized;
+ u8 min_mute;
};
int snd_usb_create_mixer(struct snd_usb_audio *chip, int ctrlif,
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -726,6 +726,12 @@ void snd_usb_mixer_fu_apply_quirk(struct
if (unitid == 7 && cval->control == UAC_FU_VOLUME)
snd_dragonfly_quirk_db_scale(mixer, cval, kctl);
break;
+ /* lowest playback value is muted on C-Media devices */
+ case USB_ID(0x0d8c, 0x000c):
+ case USB_ID(0x0d8c, 0x0014):
+ if (strstr(kctl->id.name, "Playback"))
+ cval->min_mute = 1;
+ break;
}
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 008/147] usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (107 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 038/147] ALSA: usb-audio: Add mute TLV for playback volumes on C-Media devices Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 145/147] staging: vt6655: fix overly large stack usage Ben Hutchings
` (38 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Yoshihiro Shimoda, Felipe Balbi
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 59a0879a0e17b2e43ecdc5e3299da85b8410d7ce upstream.
This patch fixes an issue that some registers may be not initialized
after resume if the USBHSF_RUNTIME_PWCTRL is not set. Otherwise,
if a cable is not connected, the driver will not enable INTENB0.VBSE
after resume. And then, the driver cannot detect the VBUS.
Fixes: ca8a282a5373 ("usb: gadget: renesas_usbhs: add suspend/resume support")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/renesas_usbhs/common.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -599,8 +599,10 @@ static int usbhsc_resume(struct device *
struct usbhs_priv *priv = dev_get_drvdata(dev);
struct platform_device *pdev = usbhs_priv_to_pdev(priv);
- if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL))
+ if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) {
usbhsc_power_ctrl(priv, 1);
+ usbhs_mod_autonomy_mode(priv);
+ }
usbhs_platform_call(priv, phy_reset, pdev);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 145/147] staging: vt6655: fix overly large stack usage
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (108 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 008/147] usb: renesas_usbhs: fix usbhsc_resume() for !USBHSF_RUNTIME_PWCTRL Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 028/147] xtensa: mm/cache: add missing EXPORT_SYMBOLs Ben Hutchings
` (37 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Arnd Bergmann
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
We get a warning for the large stack usage in some configurations:
drivers/staging/vt6655/device_main.c: In function 'device_ioctl':
drivers/staging/vt6655/device_main.c:2974:1: warning: the frame size of 1304 bytes is larger than 1024 bytes [-Wframe-larger-than=]
This is addressed in linux-3.19 with commit 67013f2c0e58 ("staging: vt6655:
mac80211 conversion add main mac80211 functions"), which obsoletes the
device_ioctl() function, but as that does not apply to stable kernels,
this picks an easier way out by using dynamic allocation.
The driver was merged in 2.6.31, and the fix applies to all versions
before 3.19.
Fixes: 5449c685a4b3 ("Staging: Add pristine upstream vt6655 driver sources")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/staging/vt6655/device_main.c
+++ b/drivers/staging/vt6655/device_main.c
@@ -3387,9 +3387,12 @@ static int device_ioctl(struct net_devi
case SIOCGIWAPLIST:
{
- char buffer[IW_MAX_AP * (sizeof(struct sockaddr) + sizeof(struct iw_quality))];
+ char *buffer = kzalloc(IW_MAX_AP * (sizeof(struct sockaddr) +
+ sizeof(struct iw_quality)), GFP_KERNEL);
- if (wrq->u.data.pointer) {
+ if (!buffer) {
+ rc = -ENOMEM;
+ } else if (wrq->u.data.pointer) {
rc = iwctl_giwaplist(dev, NULL, &(wrq->u.data), buffer);
if (rc == 0) {
if (copy_to_user(wrq->u.data.pointer,
@@ -3399,6 +3402,7 @@ static int device_ioctl(struct net_devi
rc = -EFAULT;
}
}
+ kfree(buffer);
}
break;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 028/147] xtensa: mm/cache: add missing EXPORT_SYMBOLs
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (109 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 145/147] staging: vt6655: fix overly large stack usage Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 046/147] perf: Tighten (and fix) the grouping condition Ben Hutchings
` (36 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Max Filippov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit bc652eb6a0d5cffaea7dc8e8ad488aab2a1bf1ed upstream.
Functions clear_user_highpage, copy_user_highpage, flush_dcache_page,
local_flush_cache_range and local_flush_cache_page may be used from
modules. Export them.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
[bwh: Backported to 3.2: drop exports of {clear,copy}_user_highpage()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/xtensa/mm/cache.c
+++ b/arch/xtensa/mm/cache.c
@@ -112,7 +112,7 @@ void flush_dcache_page(struct page *page
/* There shouldn't be an entry in the cache for this page anymore. */
}
-
+EXPORT_SYMBOL(flush_dcache_page);
/*
* For now, flush the whole cache. FIXME??
@@ -124,6 +124,7 @@ void flush_cache_range(struct vm_area_st
__flush_invalidate_dcache_all();
__invalidate_icache_all();
}
+EXPORT_SYMBOL(local_flush_cache_range);
/*
* Remove any entry in the cache for this page.
@@ -143,6 +144,7 @@ void flush_cache_page(struct vm_area_str
__flush_invalidate_dcache_page_alias(virt, phys);
__invalidate_icache_page_alias(virt, phys);
}
+EXPORT_SYMBOL(local_flush_cache_page);
#endif /* DCACHE_WAY_SIZE > PAGE_SIZE */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 046/147] perf: Tighten (and fix) the grouping condition
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (110 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 028/147] xtensa: mm/cache: add missing EXPORT_SYMBOLs Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 134/147] staging: reduce stack usage in prism2fw.c Ben Hutchings
` (35 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Peter Zijlstra, Arnaldo Carvalho de Melo, Jiri Olsa,
Linus Torvalds, Ingo Molnar
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit c3c87e770458aa004bd7ed3f29945ff436fd6511 upstream.
The fix from 9fc81d87420d ("perf: Fix events installation during
moving group") was incomplete in that it failed to recognise that
creating a group with events for different CPUs is semantically
broken -- they cannot be co-scheduled.
Furthermore, it leads to real breakage where, when we create an event
for CPU Y and then migrate it to form a group on CPU X, the code gets
confused where the counter is programmed -- triggered in practice
as well by me via the perf fuzzer.
Fix this by tightening the rules for creating groups. Only allow
grouping of counters that can be co-scheduled in the same context.
This means for the same task and/or the same cpu.
Fixes: 9fc81d87420d ("perf: Fix events installation during moving group")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20150123125834.090683288@infradead.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/perf_event.h | 6 ------
kernel/events/core.c | 15 +++++++++++++--
2 files changed, 13 insertions(+), 8 deletions(-)
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -859,11 +859,6 @@ struct perf_event {
#endif /* CONFIG_PERF_EVENTS */
};
-enum perf_event_context_type {
- task_context,
- cpu_context,
-};
-
/**
* struct perf_event_context - event context structure
*
@@ -871,7 +866,6 @@ enum perf_event_context_type {
*/
struct perf_event_context {
struct pmu *pmu;
- enum perf_event_context_type type;
/*
* Protect the states of the events in the list,
* nr_active, and the list:
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6116,7 +6116,6 @@ skip_type:
__perf_event_init_context(&cpuctx->ctx);
lockdep_set_class(&cpuctx->ctx.mutex, &cpuctx_mutex);
lockdep_set_class(&cpuctx->ctx.lock, &cpuctx_lock);
- cpuctx->ctx.type = cpu_context;
cpuctx->ctx.pmu = pmu;
cpuctx->jiffies_interval = 1;
INIT_LIST_HEAD(&cpuctx->rotation_list);
@@ -6697,7 +6696,19 @@ SYSCALL_DEFINE5(perf_event_open,
* task or CPU context:
*/
if (move_group) {
- if (group_leader->ctx->type != ctx->type)
+ /*
+ * Make sure we're both on the same task, or both
+ * per-cpu events.
+ */
+ if (group_leader->ctx->task != ctx->task)
+ goto err_context;
+
+ /*
+ * Make sure we're both events for the same CPU;
+ * grouping events for different CPUs is broken; since
+ * you can never concurrently schedule them anyhow.
+ */
+ if (group_leader->cpu != event->cpu)
goto err_context;
} else {
if (group_leader->ctx != ctx)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 134/147] staging: reduce stack usage in prism2fw.c
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (111 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 046/147] perf: Tighten (and fix) the grouping condition Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 092/147] ALSA: seq: Enable 'use' locking in all configurations Ben Hutchings
` (34 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Randy Dunlap
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@xenotime.net>
commit c90e3e80b9751335cc98934ae32188fa7de6bccd upstream.
Fix frame size (stack usage) warning by allocating and freeing
pointers to the data.
drivers/staging/wlan-ng/prism2fw.c:1115:1: warning: the frame size of 4288 bytes is larger than 2048 bytes
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/wlan-ng/prism2fw.c | 124 +++++++++++++++++++++----------------
1 file changed, 69 insertions(+), 55 deletions(-)
--- a/drivers/staging/wlan-ng/prism2fw.c
+++ b/drivers/staging/wlan-ng/prism2fw.c
@@ -980,9 +980,8 @@ int writeimage(wlandevice_t *wlandev, st
unsigned int nfchunks)
{
int result = 0;
- struct p80211msg_p2req_ramdl_state rstatemsg;
- struct p80211msg_p2req_ramdl_write rwritemsg;
- struct p80211msg *msgp;
+ struct p80211msg_p2req_ramdl_state *rstmsg;
+ struct p80211msg_p2req_ramdl_write *rwrmsg;
u32 resultcode;
int i;
int j;
@@ -991,57 +990,68 @@ int writeimage(wlandevice_t *wlandev, st
u32 currlen;
u32 currdaddr;
+ rstmsg = kmalloc(sizeof(*rstmsg), GFP_KERNEL);
+ rwrmsg = kmalloc(sizeof(*rwrmsg), GFP_KERNEL);
+ if (!rstmsg || !rwrmsg) {
+ kfree(rstmsg);
+ kfree(rwrmsg);
+ printk(KERN_ERR
+ "writeimage: no memory for firmware download, "
+ "aborting download\n");
+ return -ENOMEM;
+ }
+
/* Initialize the messages */
- memset(&rstatemsg, 0, sizeof(rstatemsg));
- strcpy(rstatemsg.devname, wlandev->name);
- rstatemsg.msgcode = DIDmsg_p2req_ramdl_state;
- rstatemsg.msglen = sizeof(rstatemsg);
- rstatemsg.enable.did = DIDmsg_p2req_ramdl_state_enable;
- rstatemsg.exeaddr.did = DIDmsg_p2req_ramdl_state_exeaddr;
- rstatemsg.resultcode.did = DIDmsg_p2req_ramdl_state_resultcode;
- rstatemsg.enable.status = P80211ENUM_msgitem_status_data_ok;
- rstatemsg.exeaddr.status = P80211ENUM_msgitem_status_data_ok;
- rstatemsg.resultcode.status = P80211ENUM_msgitem_status_no_value;
- rstatemsg.enable.len = sizeof(u32);
- rstatemsg.exeaddr.len = sizeof(u32);
- rstatemsg.resultcode.len = sizeof(u32);
-
- memset(&rwritemsg, 0, sizeof(rwritemsg));
- strcpy(rwritemsg.devname, wlandev->name);
- rwritemsg.msgcode = DIDmsg_p2req_ramdl_write;
- rwritemsg.msglen = sizeof(rwritemsg);
- rwritemsg.addr.did = DIDmsg_p2req_ramdl_write_addr;
- rwritemsg.len.did = DIDmsg_p2req_ramdl_write_len;
- rwritemsg.data.did = DIDmsg_p2req_ramdl_write_data;
- rwritemsg.resultcode.did = DIDmsg_p2req_ramdl_write_resultcode;
- rwritemsg.addr.status = P80211ENUM_msgitem_status_data_ok;
- rwritemsg.len.status = P80211ENUM_msgitem_status_data_ok;
- rwritemsg.data.status = P80211ENUM_msgitem_status_data_ok;
- rwritemsg.resultcode.status = P80211ENUM_msgitem_status_no_value;
- rwritemsg.addr.len = sizeof(u32);
- rwritemsg.len.len = sizeof(u32);
- rwritemsg.data.len = WRITESIZE_MAX;
- rwritemsg.resultcode.len = sizeof(u32);
+ memset(rstmsg, 0, sizeof(*rstmsg));
+ strcpy(rstmsg->devname, wlandev->name);
+ rstmsg->msgcode = DIDmsg_p2req_ramdl_state;
+ rstmsg->msglen = sizeof(*rstmsg);
+ rstmsg->enable.did = DIDmsg_p2req_ramdl_state_enable;
+ rstmsg->exeaddr.did = DIDmsg_p2req_ramdl_state_exeaddr;
+ rstmsg->resultcode.did = DIDmsg_p2req_ramdl_state_resultcode;
+ rstmsg->enable.status = P80211ENUM_msgitem_status_data_ok;
+ rstmsg->exeaddr.status = P80211ENUM_msgitem_status_data_ok;
+ rstmsg->resultcode.status = P80211ENUM_msgitem_status_no_value;
+ rstmsg->enable.len = sizeof(u32);
+ rstmsg->exeaddr.len = sizeof(u32);
+ rstmsg->resultcode.len = sizeof(u32);
+
+ memset(rwrmsg, 0, sizeof(*rwrmsg));
+ strcpy(rwrmsg->devname, wlandev->name);
+ rwrmsg->msgcode = DIDmsg_p2req_ramdl_write;
+ rwrmsg->msglen = sizeof(*rwrmsg);
+ rwrmsg->addr.did = DIDmsg_p2req_ramdl_write_addr;
+ rwrmsg->len.did = DIDmsg_p2req_ramdl_write_len;
+ rwrmsg->data.did = DIDmsg_p2req_ramdl_write_data;
+ rwrmsg->resultcode.did = DIDmsg_p2req_ramdl_write_resultcode;
+ rwrmsg->addr.status = P80211ENUM_msgitem_status_data_ok;
+ rwrmsg->len.status = P80211ENUM_msgitem_status_data_ok;
+ rwrmsg->data.status = P80211ENUM_msgitem_status_data_ok;
+ rwrmsg->resultcode.status = P80211ENUM_msgitem_status_no_value;
+ rwrmsg->addr.len = sizeof(u32);
+ rwrmsg->len.len = sizeof(u32);
+ rwrmsg->data.len = WRITESIZE_MAX;
+ rwrmsg->resultcode.len = sizeof(u32);
/* Send xxx_state(enable) */
pr_debug("Sending dl_state(enable) message.\n");
- rstatemsg.enable.data = P80211ENUM_truth_true;
- rstatemsg.exeaddr.data = startaddr;
+ rstmsg->enable.data = P80211ENUM_truth_true;
+ rstmsg->exeaddr.data = startaddr;
- msgp = (struct p80211msg *) &rstatemsg;
- result = prism2mgmt_ramdl_state(wlandev, msgp);
+ result = prism2mgmt_ramdl_state(wlandev, rstmsg);
if (result) {
printk(KERN_ERR
"writeimage state enable failed w/ result=%d, "
"aborting download\n", result);
- return result;
+ goto free_result;
}
- resultcode = rstatemsg.resultcode.data;
+ resultcode = rstmsg->resultcode.data;
if (resultcode != P80211ENUM_resultcode_success) {
printk(KERN_ERR
"writeimage()->xxxdl_state msg indicates failure, "
"w/ resultcode=%d, aborting download.\n", resultcode);
- return 1;
+ result = 1;
+ goto free_result;
}
/* Now, loop through the data chunks and send WRITESIZE_MAX data */
@@ -1059,9 +1069,9 @@ int writeimage(wlandevice_t *wlandev, st
curroff = j * WRITESIZE_MAX;
currdaddr = fchunk[i].addr + curroff;
/* Setup the message */
- rwritemsg.addr.data = currdaddr;
- rwritemsg.len.data = currlen;
- memcpy(rwritemsg.data.data,
+ rwrmsg->addr.data = currdaddr;
+ rwrmsg->len.data = currlen;
+ memcpy(rwrmsg->data.data,
fchunk[i].data + curroff, currlen);
/* Send flashdl_write(pda) */
@@ -1069,23 +1079,23 @@ int writeimage(wlandevice_t *wlandev, st
("Sending xxxdl_write message addr=%06x len=%d.\n",
currdaddr, currlen);
- msgp = (struct p80211msg *) &rwritemsg;
- result = prism2mgmt_ramdl_write(wlandev, msgp);
+ result = prism2mgmt_ramdl_write(wlandev, rwrmsg);
/* Check the results */
if (result) {
printk(KERN_ERR
"writeimage chunk write failed w/ result=%d, "
"aborting download\n", result);
- return result;
+ goto free_result;
}
- resultcode = rstatemsg.resultcode.data;
+ resultcode = rstmsg->resultcode.data;
if (resultcode != P80211ENUM_resultcode_success) {
printk(KERN_ERR
"writeimage()->xxxdl_write msg indicates failure, "
"w/ resultcode=%d, aborting download.\n",
resultcode);
- return 1;
+ result = 1;
+ goto free_result;
}
}
@@ -1093,24 +1103,28 @@ int writeimage(wlandevice_t *wlandev, st
/* Send xxx_state(disable) */
pr_debug("Sending dl_state(disable) message.\n");
- rstatemsg.enable.data = P80211ENUM_truth_false;
- rstatemsg.exeaddr.data = 0;
+ rstmsg->enable.data = P80211ENUM_truth_false;
+ rstmsg->exeaddr.data = 0;
- msgp = (struct p80211msg *) &rstatemsg;
- result = prism2mgmt_ramdl_state(wlandev, msgp);
+ result = prism2mgmt_ramdl_state(wlandev, rstmsg);
if (result) {
printk(KERN_ERR
"writeimage state disable failed w/ result=%d, "
"aborting download\n", result);
- return result;
+ goto free_result;
}
- resultcode = rstatemsg.resultcode.data;
+ resultcode = rstmsg->resultcode.data;
if (resultcode != P80211ENUM_resultcode_success) {
printk(KERN_ERR
"writeimage()->xxxdl_state msg indicates failure, "
"w/ resultcode=%d, aborting download.\n", resultcode);
- return 1;
+ result = 1;
+ goto free_result;
}
+
+free_result:
+ kfree(rstmsg);
+ kfree(rwrmsg);
return result;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 092/147] ALSA: seq: Enable 'use' locking in all configurations
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (112 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 134/147] staging: reduce stack usage in prism2fw.c Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 034/147] xfs: fix inobt inode allocation search optimization Ben Hutchings
` (33 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Ben Hutchings, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
commit 8009d506a1dd00cf436b0c4cca0dcec130580a21 upstream.
The 'use' locking macros are no-ops if neither SMP or SND_DEBUG is
enabled. This might once have been OK in non-preemptible
configurations, but even in that case snd_seq_read() may sleep while
relying on a 'use' lock. So always use the proper implementations.
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/seq/seq_lock.c | 4 ----
sound/core/seq/seq_lock.h | 12 ------------
2 files changed, 16 deletions(-)
--- a/sound/core/seq/seq_lock.c
+++ b/sound/core/seq/seq_lock.c
@@ -23,8 +23,6 @@
#include <sound/core.h>
#include "seq_lock.h"
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
/* wait until all locks are released */
void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line)
{
@@ -42,5 +40,3 @@ void snd_use_lock_sync_helper(snd_use_lo
}
EXPORT_SYMBOL(snd_use_lock_sync_helper);
-
-#endif
--- a/sound/core/seq/seq_lock.h
+++ b/sound/core/seq/seq_lock.h
@@ -3,8 +3,6 @@
#include <linux/sched.h>
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
typedef atomic_t snd_use_lock_t;
/* initialize lock */
@@ -20,14 +18,4 @@ typedef atomic_t snd_use_lock_t;
void snd_use_lock_sync_helper(snd_use_lock_t *lock, const char *file, int line);
#define snd_use_lock_sync(lockp) snd_use_lock_sync_helper(lockp, __BASE_FILE__, __LINE__)
-#else /* SMP || CONFIG_SND_DEBUG */
-
-typedef spinlock_t snd_use_lock_t; /* dummy */
-#define snd_use_lock_init(lockp) /**/
-#define snd_use_lock_use(lockp) /**/
-#define snd_use_lock_free(lockp) /**/
-#define snd_use_lock_sync(lockp) /**/
-
-#endif /* SMP || CONFIG_SND_DEBUG */
-
#endif /* __SND_SEQ_LOCK_H */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 034/147] xfs: fix inobt inode allocation search optimization
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (113 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 092/147] ALSA: seq: Enable 'use' locking in all configurations Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 097/147] cuse: fix uninitialized variable warnings Ben Hutchings
` (32 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Omar Sandoval, Christoph Hellwig, Darrick J. Wong
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <osandov@fb.com>
commit c44245b3d5435f533ca8346ece65918f84c057f9 upstream.
When we try to allocate a free inode by searching the inobt, we try to
find the inode nearest the parent inode by searching chunks both left
and right of the chunk containing the parent. As an optimization, we
cache the leftmost and rightmost records that we previously searched; if
we do another allocation with the same parent inode, we'll pick up the
search where it last left off.
There's a bug in the case where we found a free inode to the left of the
parent's chunk: we need to update the cached left and right records, but
because we already reassigned the right record to point to the left, we
end up assigning the left record to both the cached left and right
records.
This isn't a correctness problem strictly, but it can result in the next
allocation rechecking chunks unnecessarily or allocating inodes further
away from the parent than it needs to. Fix it by swapping the record
pointer after we update the cached left and right records.
Fixes: bd169565993b ("xfs: speed up free inode search")
Signed-off-by: Omar Sandoval <osandov@fb.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/xfs/xfs_ialloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/xfs/xfs_ialloc.c
+++ b/fs/xfs/xfs_ialloc.c
@@ -894,13 +894,13 @@ nextag:
/* free inodes to the left? */
if (useleft && trec.ir_freecount) {
- rec = trec;
xfs_btree_del_cursor(cur, XFS_BTREE_NOERROR);
cur = tcur;
pag->pagl_leftrec = trec.ir_startino;
pag->pagl_rightrec = rec.ir_startino;
pag->pagl_pagino = pagino;
+ rec = trec;
goto alloc_inode;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 097/147] cuse: fix uninitialized variable warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (114 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 034/147] xfs: fix inobt inode allocation search optimization Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 018/147] perf/core: Fix locking for children siblings group read Ben Hutchings
` (31 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Miklos Szeredi
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@suse.cz>
commit e2560362cc2b39a0567cab510121a7e93dfbe797 upstream.
Fix the following compiler warnings:
fs/fuse/cuse.c: In function 'cuse_process_init_reply':
fs/fuse/cuse.c:288:24: warning: 'val' may be used uninitialized in this function [-Wmaybe-uninitialized]
fs/fuse/cuse.c:272:14: note: 'val' was declared here
fs/fuse/cuse.c:284:10: warning: 'key' may be used uninitialized in this function [-Wmaybe-uninitialized]
fs/fuse/cuse.c:272:8: note: 'key' was declared here
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/fuse/cuse.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/fuse/cuse.c
+++ b/fs/fuse/cuse.c
@@ -267,7 +267,7 @@ static int cuse_parse_one(char **pp, cha
static int cuse_parse_devinfo(char *p, size_t len, struct cuse_devinfo *devinfo)
{
char *end = p + len;
- char *key, *val;
+ char *uninitialized_var(key), *uninitialized_var(val);
int rc;
while (true) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 018/147] perf/core: Fix locking for children siblings group read
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (115 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 097/147] cuse: fix uninitialized variable warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 013/147] IB/cxgb3: Fix error codes in iwch_alloc_mr() Ben Hutchings
` (30 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Peter Zijlstra, Alexander Shishkin, Thomas Gleixner,
Peter Zijlstra (Intel),
Arnaldo Carvalho de Melo, Jiri Olsa, Andi Kleen, Jiri Olsa,
Linus Torvalds, Ingo Molnar
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 2aeb1883547626d82c597cce2c99f0b9c62e2425 upstream.
We're missing ctx lock when iterating children siblings
within the perf_read path for group reading. Following
race and crash can happen:
User space doing read syscall on event group leader:
T1:
perf_read
lock event->ctx->mutex
perf_read_group
lock leader->child_mutex
__perf_read_group_add(child)
list_for_each_entry(sub, &leader->sibling_list, group_entry)
----> sub might be invalid at this point, because it could
get removed via perf_event_exit_task_context in T2
Child exiting and cleaning up its events:
T2:
perf_event_exit_task_context
lock ctx->mutex
list_for_each_entry_safe(child_event, next, &child_ctx->event_list,...
perf_event_exit_event(child)
lock ctx->lock
perf_group_detach(child)
unlock ctx->lock
----> child is removed from sibling_list without any sync
with T1 path above
...
free_event(child)
Before the child is removed from the leader's child_list,
(and thus is omitted from perf_read_group processing), we
need to ensure that perf_read_group touches child's
siblings under its ctx->lock.
Peter further notes:
| One additional note; this bug got exposed by commit:
|
| ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
|
| which made it possible to actually trigger this code-path.
Tested-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
Link: http://lkml.kernel.org/r/20170720141455.2106-1-jolsa@kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3280,7 +3280,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value)
static void __perf_read_group_add(struct perf_event *leader,
u64 read_format, u64 *values)
{
+ struct perf_event_context *ctx = leader->ctx;
struct perf_event *sub;
+ unsigned long flags;
int n = 1; /* skip @nr */
u64 count, enabled, running;
@@ -3303,11 +3305,15 @@ static void __perf_read_group_add(struct
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(leader);
+ raw_spin_lock_irqsave(&ctx->lock, flags);
+
list_for_each_entry(sub, &leader->sibling_list, group_entry) {
values[n++] = perf_event_read_value(sub, &enabled, &running);
if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(sub);
}
+
+ raw_spin_unlock_irqrestore(&ctx->lock, flags);
}
static int perf_event_read_group(struct perf_event *event,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 013/147] IB/cxgb3: Fix error codes in iwch_alloc_mr()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (116 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 018/147] perf/core: Fix locking for children siblings group read Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 089/147] usb: usbtest: fix NULL pointer dereference Ben Hutchings
` (29 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Doug Ledford, Steve Wise, Dan Carpenter
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 9064d6055c14f700aa13f7c72fd3e63d12bee643 upstream.
We accidentally don't set the error code on some error paths. It means
return ERR_PTR(0) which is NULL and results in a NULL dereference in the
caller.
Fixes: 13a239330abd ("RDMA/cxgb3: Don't ignore insert_handle() failures")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
[bwh: Backported to 3.2: drop inapplicable hunk]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/infiniband/hw/cxgb3/iwch_provider.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_provider.c
@@ -795,7 +795,7 @@ static struct ib_mr *iwch_alloc_fast_reg
struct iwch_mr *mhp;
u32 mmid;
u32 stag = 0;
- int ret = 0;
+ int ret = -ENOMEM;
php = to_iwch_pd(pd);
rhp = php->rhp;
@@ -818,7 +818,8 @@ static struct ib_mr *iwch_alloc_fast_reg
mhp->attr.state = 1;
mmid = (stag) >> 8;
mhp->ibmr.rkey = mhp->ibmr.lkey = stag;
- if (insert_handle(rhp, &rhp->mmidr, mhp, mmid))
+ ret = insert_handle(rhp, &rhp->mmidr, mhp, mmid);
+ if (ret)
goto err3;
PDBG("%s mmid 0x%x mhp %p stag 0x%x\n", __func__, mmid, mhp, stag);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 089/147] usb: usbtest: fix NULL pointer dereference
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (117 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 013/147] IB/cxgb3: Fix error codes in iwch_alloc_mr() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 031/147] ocfs2: don't clear SGID when inheriting ACLs Ben Hutchings
` (28 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Felipe Balbi, Andrey Konovalov, Alan Stern
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 7c80f9e4a588f1925b07134bb2e3689335f6c6d8 upstream.
If the usbtest driver encounters a device with an IN bulk endpoint but
no OUT bulk endpoint, it will try to dereference a NULL pointer
(out->desc.bEndpointAddress). The problem can be solved by adding a
missing test.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/usbtest.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -152,12 +152,13 @@ found:
return tmp;
}
- if (in) {
+ if (in)
dev->in_pipe = usb_rcvbulkpipe(udev,
in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
+ if (out)
dev->out_pipe = usb_sndbulkpipe(udev,
out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK);
- }
+
if (iso_in) {
dev->iso_in = &iso_in->desc;
dev->in_iso_pipe = usb_rcvisocpipe(udev,
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 031/147] ocfs2: don't clear SGID when inheriting ACLs
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (118 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 089/147] usb: usbtest: fix NULL pointer dereference Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 065/147] ipv6: fix sparse warning on rt6i_node Ben Hutchings
` (27 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Joel Becker, Linus Torvalds, Mark Fasheh, Joseph Qi,
Jan Kara, Junxiao Bi
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 19ec8e48582670c021e998b9deb88e39a842ff45 upstream.
When new directory 'DIR1' is created in a directory 'DIR0' with SGID bit
set, DIR1 is expected to have SGID bit set (and owning group equal to
the owning group of 'DIR0'). However when 'DIR0' also has some default
ACLs that 'DIR1' inherits, setting these ACLs will result in SGID bit on
'DIR1' to get cleared if user is not member of the owning group.
Fix the problem by moving posix_acl_update_mode() out of ocfs2_set_acl()
into ocfs2_iop_set_acl(). That way the function will not be called when
inheriting ACLs which is what we want as it prevents SGID bit clearing
and the mode has been properly set by posix_acl_create() anyway. Also
posix_acl_chmod() that is calling ocfs2_set_acl() takes care of updating
mode itself.
Fixes: 073931017b4 ("posix_acl: Clear SGID bit when setting file permissions")
Link: http://lkml.kernel.org/r/20170801141252.19675-3-jack@suse.cz
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Mark Fasheh <mfasheh@versity.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Joseph Qi <jiangqi903@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2: Move the call to posix_acl_update_mode() into
ocfs2_xattr_set_acl(). Pass NULL as the bh argument to
ocfs2_acl_set_mode(). Reuse the existing cleanup label.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/ocfs2/acl.c
+++ b/fs/ocfs2/acl.c
@@ -246,19 +246,6 @@ static int ocfs2_set_acl(handle_t *handl
switch (type) {
case ACL_TYPE_ACCESS:
name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS;
- if (acl) {
- umode_t mode;
- ret = posix_acl_update_mode(inode, &mode, &acl);
- if (ret)
- return ret;
- else {
- ret = ocfs2_acl_set_mode(inode, di_bh,
- handle, mode);
- if (ret)
- return ret;
-
- }
- }
break;
case ACL_TYPE_DEFAULT:
name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT;
@@ -483,6 +470,17 @@ static int ocfs2_xattr_set_acl(struct de
} else
acl = NULL;
+ if (type == ACL_TYPE_ACCESS && acl) {
+ umode_t mode;
+
+ ret = posix_acl_update_mode(inode, &mode, &acl);
+ if (ret)
+ goto cleanup;
+
+ ret = ocfs2_acl_set_mode(inode, NULL, NULL, mode);
+ if (ret)
+ goto cleanup;
+ }
ret = ocfs2_set_acl(NULL, inode, NULL, type, acl, NULL, NULL);
cleanup:
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 065/147] ipv6: fix sparse warning on rt6i_node
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (119 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 031/147] ocfs2: don't clear SGID when inheriting ACLs Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 147/147] ARM: 8160/1: drop warning about return_address not using unwind tables Ben Hutchings
` (26 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Eric Dumazet, David S. Miller, Wei Wang, Martin KaFai Lau
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Wei Wang <weiwan@google.com>
commit 4e587ea71bf924f7dac621f1351653bd41e446cb upstream.
Commit c5cff8561d2d adds rcu grace period before freeing fib6_node. This
generates a new sparse warning on rt->rt6i_node related code:
net/ipv6/route.c:1394:30: error: incompatible types in comparison
expression (different address spaces)
./include/net/ip6_fib.h:187:14: error: incompatible types in comparison
expression (different address spaces)
This commit adds "__rcu" tag for rt6i_node and makes sure corresponding
rcu API is used for it.
After this fix, sparse no longer generates the above warning.
Fixes: c5cff8561d2d ("ipv6: add rcu grace period before freeing fib6_node")
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- fib6_add_rt2node() has only one assignment to update
- Drop changes in rt6_cache_allowed_for_pmtu()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -96,7 +96,7 @@ struct rt6_info {
* the same cache line.
*/
struct fib6_table *rt6i_table;
- struct fib6_node *rt6i_node;
+ struct fib6_node __rcu *rt6i_node;
struct in6_addr rt6i_gateway;
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4284,7 +4284,7 @@ static void __ipv6_ifa_notify(int event,
* our DAD process, so we don't need
* to do it again
*/
- if (!(ifp->rt->rt6i_node))
+ if (!rcu_access_pointer(ifp->rt->rt6i_node))
ip6_ins_rt(ifp->rt);
if (ifp->idev->cnf.forwarding)
addrconf_join_anycast(ifp);
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -670,7 +670,7 @@ static int fib6_add_rt2node(struct fib6_
rt->dst.rt6_next = iter;
*ins = rt;
- rt->rt6i_node = fn;
+ rcu_assign_pointer(rt->rt6i_node, fn);
atomic_inc(&rt->rt6i_ref);
inet6_rt_notify(RTM_NEWROUTE, rt, info);
info->nl_net->ipv6.rt6_stats->fib_rt_entries++;
@@ -1181,8 +1181,9 @@ static void fib6_del_route(struct fib6_n
int fib6_del(struct rt6_info *rt, struct nl_info *info)
{
+ struct fib6_node *fn = rcu_dereference_protected(rt->rt6i_node,
+ lockdep_is_held(&rt->rt6i_table->tb6_lock));
struct net *net = info->nl_net;
- struct fib6_node *fn = rt->rt6i_node;
struct rt6_info **rtp;
#if RT6_DEBUG >= 2
@@ -1360,7 +1361,10 @@ static int fib6_clean_node(struct fib6_w
res = fib6_del(rt, &info);
if (res) {
#if RT6_DEBUG >= 2
- printk(KERN_DEBUG "fib6_clean_node: del failed: rt=%p@%p err=%d\n", rt, rt->rt6i_node, res);
+ pr_debug("%s: del failed: rt=%p@%p err=%d\n",
+ __func__, rt,
+ rcu_access_pointer(rt->rt6i_node),
+ res);
#endif
continue;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 147/147] ARM: 8160/1: drop warning about return_address not using unwind tables
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (120 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 065/147] ipv6: fix sparse warning on rt6i_node Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 010/147] mount: copy the port field into the cloned nfs_server structure Ben Hutchings
` (25 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Uwe Kleine-König, Russell King
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit e16343c47e4276f5ebc77ca16feb5e50ca1918f9 upstream.
The warning was introduced in 2009 (commit 4bf1fa5a34aa ([ARM] 5613/1:
implement CALLER_ADDRESSx)). The only "problem" here is that
CALLER_ADDRESSx for x > 1 returns NULL which doesn't do much harm.
The drawback of implementing a fix (i.e. use unwind tables to implement CALLER_ADDRESSx) is that much of the unwinder code would need to be marked as not
traceable.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/kernel/return_address.c | 4 ----
1 file changed, 4 deletions(-)
--- a/arch/arm/kernel/return_address.c
+++ b/arch/arm/kernel/return_address.c
@@ -58,10 +58,6 @@ void *return_address(unsigned int level)
#else /* if defined(CONFIG_FRAME_POINTER) && !defined(CONFIG_ARM_UNWIND) */
-#if defined(CONFIG_ARM_UNWIND)
-#warning "TODO: return_address should use unwind tables"
-#endif
-
void *return_address(unsigned int level)
{
return NULL;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 010/147] mount: copy the port field into the cloned nfs_server structure.
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (121 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 147/147] ARM: 8160/1: drop warning about return_address not using unwind tables Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 139/147] [media] rc: Fix input deadlock and transmit error in redrat3 driver Ben Hutchings
` (24 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Anna Schumaker, Steve Dickson
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Steve Dickson <steved@redhat.com>
commit 89a6814d9b665b196aa3a102f96b6dc7e8cb669e upstream.
Doing this copy eliminates the "port=0" entry in
the /proc/mounts entries
Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=69241
Signed-off-by: Steve Dickson <steved@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/nfs/client.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -1018,6 +1018,7 @@ static void nfs_server_copy_userdata(str
target->acdirmax = source->acdirmax;
target->caps = source->caps;
target->options = source->options;
+ target->port = source->port;
}
static void nfs_server_insert_lists(struct nfs_server *server)
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 139/147] [media] rc: Fix input deadlock and transmit error in redrat3 driver
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (122 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 010/147] mount: copy the port field into the cloned nfs_server structure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 006/147] usb: storage: return on error to avoid a null pointer dereference Ben Hutchings
` (23 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Andrew Vincer, Andrew Vincer, Jarod Wilson, Mauro Carvalho Chehab
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Vincer <Andrew.Vincer@redrat.co.uk>
commit dbea1880368071dfa97d5e6aa4a368e7d0146a85 upstream.
Fixed submit urb logic so hardware doesn't hang trying to transmit
signal data
Removed unneeded enable/disable detector commands in
redrat3_transmit_ir (the hardware does this anyway) and converted
arguments to unsigned as per 5588dc2
Signed-off-by: Andrew Vincer <andrew@redrat.co.uk>
Cc: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/rc/redrat3.c | 52 ++++++++++++++++------------------------------
1 file changed, 18 insertions(+), 34 deletions(-)
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -286,12 +286,6 @@ static void redrat3_issue_async(struct r
rr3_ftr(rr3->dev, "Entering %s\n", __func__);
- if (!rr3->det_enabled) {
- dev_warn(rr3->dev, "not issuing async read, "
- "detector not enabled\n");
- return;
- }
-
memset(rr3->bulk_in_buf, 0, rr3->ep_in->wMaxPacketSize);
res = usb_submit_urb(rr3->read_urb, GFP_ATOMIC);
if (res)
@@ -827,6 +821,7 @@ out:
static void redrat3_handle_async(struct urb *urb, struct pt_regs *regs)
{
struct redrat3_dev *rr3;
+ int ret;
if (!urb)
return;
@@ -840,15 +835,13 @@ static void redrat3_handle_async(struct
rr3_ftr(rr3->dev, "Entering %s\n", __func__);
- if (!rr3->det_enabled) {
- rr3_dbg(rr3->dev, "received a read callback but detector "
- "disabled - ignoring\n");
- return;
- }
-
switch (urb->status) {
case 0:
- redrat3_get_ir_data(rr3, urb->actual_length);
+ ret = redrat3_get_ir_data(rr3, urb->actual_length);
+ if (!ret) {
+ /* no error, prepare to read more */
+ redrat3_issue_async(rr3);
+ }
break;
case -ECONNRESET:
@@ -865,11 +858,6 @@ static void redrat3_handle_async(struct
rr3->pkttype = 0;
break;
}
-
- if (!rr3->transmitting)
- redrat3_issue_async(rr3);
- else
- rr3_dbg(rr3->dev, "IR transmit in progress\n");
}
static void redrat3_write_bulk_callback(struct urb *urb, struct pt_regs *regs)
@@ -896,21 +884,24 @@ static u16 mod_freq_to_val(unsigned int
return (u16)(65536 - (mult / mod_freq));
}
-static int redrat3_set_tx_carrier(struct rc_dev *dev, u32 carrier)
+static int redrat3_set_tx_carrier(struct rc_dev *rcdev, u32 carrier)
{
- struct redrat3_dev *rr3 = dev->priv;
+ struct redrat3_dev *rr3 = rcdev->priv;
+ struct device *dev = rr3->dev;
+ rr3_dbg(dev, "Setting modulation frequency to %u", carrier);
rr3->carrier = carrier;
return carrier;
}
-static int redrat3_transmit_ir(struct rc_dev *rcdev, int *txbuf, u32 n)
+static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
+ unsigned count)
{
struct redrat3_dev *rr3 = rcdev->priv;
struct device *dev = rr3->dev;
struct redrat3_signal_header header;
- int i, j, count, ret, ret_len, offset;
+ int i, j, ret, ret_len, offset;
int lencheck, cur_sample_len, pipe;
char *buffer = NULL, *sigdata = NULL;
int *sample_lens = NULL;
@@ -928,20 +919,13 @@ static int redrat3_transmit_ir(struct rc
return -EAGAIN;
}
- count = n / sizeof(int);
if (count > (RR3_DRIVER_MAXLENS * 2))
return -EINVAL;
+ /* rr3 will disable rc detector on transmit */
+ rr3->det_enabled = false;
rr3->transmitting = true;
- redrat3_disable_detector(rr3);
-
- if (rr3->det_enabled) {
- dev_err(dev, "%s: cannot tx while rx is enabled\n", __func__);
- ret = -EIO;
- goto out;
- }
-
sample_lens = kzalloc(sizeof(int) * RR3_DRIVER_MAXLENS, GFP_KERNEL);
if (!sample_lens) {
ret = -ENOMEM;
@@ -1055,7 +1039,7 @@ static int redrat3_transmit_ir(struct rc
if (ret < 0)
dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
else
- ret = n;
+ ret = count;
out:
kfree(sample_lens);
@@ -1063,8 +1047,8 @@ out:
kfree(sigdata);
rr3->transmitting = false;
-
- redrat3_enable_detector(rr3);
+ /* rr3 re-enables rc detector because it was enabled before */
+ rr3->det_enabled = true;
return ret;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 006/147] usb: storage: return on error to avoid a null pointer dereference
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (123 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 139/147] [media] rc: Fix input deadlock and transmit error in redrat3 driver Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 146/147] Staging: wlan-ng: fix sparse warning in prism2fw.c Ben Hutchings
` (22 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Greg Kroah-Hartman, Colin Ian King, Alan Stern
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 446230f52a5bef593554510302465eabab45a372 upstream.
When us->extra is null the driver is not initialized, however, a
later call to osd200_scsi_to_ata is made that dereferences
us->extra, causing a null pointer dereference. The code
currently detects and reports that the driver is not initialized;
add a return to avoid the subsequent dereference issue in this
check.
Thanks to Alan Stern for pointing out that srb->result needs setting
to DID_ERROR << 16
Detected by CoverityScan, CID#100308 ("Dereference after null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/storage/isd200.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/storage/isd200.c
+++ b/drivers/usb/storage/isd200.c
@@ -1522,8 +1522,11 @@ static void isd200_ata_command(struct sc
/* Make sure driver was initialized */
- if (us->extra == NULL)
+ if (us->extra == NULL) {
US_DEBUGP("ERROR Driver not initialized\n");
+ srb->result = DID_ERROR << 16;
+ return;
+ }
scsi_set_resid(srb, 0);
/* scsi_bufflen might change in protocol translation to ata */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 146/147] Staging: wlan-ng: fix sparse warning in prism2fw.c
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (124 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 006/147] usb: storage: return on error to avoid a null pointer dereference Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 133/147] staging/slicoss: Fix operation may be undefined warning Ben Hutchings
` (21 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, A Raghavendra Rao, Greg Kroah-Hartman, A Raghavendra Rao
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: A Raghavendra Rao <raghav3276@gmail.com>
commit 41cb65c4854e14f12b1cbb8215e509d8ad4d0c88 upstream.
Fix the following sparse warning :
In file included from drivers/staging/wlan-ng/prism2usb.c:5:0:
drivers/staging/wlan-ng/prism2fw.c: In function
‘read_cardpda.constprop.43’:
drivers/staging/wlan-ng/prism2fw.c:792:1: warning: the frame size of
1068 bytes is larger than 1024 bytes [-Wframe-larger-than=]
The variable to 'struct p80211msg_p2req_readpda' was previously being created
on the stack, which inturn exeeded the frame size limit, resulting in a
sparse warning. This patch alloctes the memory to the structure dynamically
and the operations are left unchanged.
Signed-off-by: A Raghavendra Rao <arrao@cdac.in>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/wlan-ng/prism2fw.c | 33 +++++++++++++++++++--------------
1 file changed, 19 insertions(+), 14 deletions(-)
--- a/drivers/staging/wlan-ng/prism2fw.c
+++ b/drivers/staging/wlan-ng/prism2fw.c
@@ -765,30 +765,35 @@ int plugimage(struct imgchunk *fchunk, u
int read_cardpda(struct pda *pda, wlandevice_t *wlandev)
{
int result = 0;
- struct p80211msg_p2req_readpda msg;
+ struct p80211msg_p2req_readpda *msg;
+
+ msg = kzalloc(sizeof(*msg), GFP_KERNEL);
+ if (!msg)
+ return -ENOMEM;
/* set up the msg */
- msg.msgcode = DIDmsg_p2req_readpda;
- msg.msglen = sizeof(msg);
- strcpy(msg.devname, wlandev->name);
- msg.pda.did = DIDmsg_p2req_readpda_pda;
- msg.pda.len = HFA384x_PDA_LEN_MAX;
- msg.pda.status = P80211ENUM_msgitem_status_no_value;
- msg.resultcode.did = DIDmsg_p2req_readpda_resultcode;
- msg.resultcode.len = sizeof(u32);
- msg.resultcode.status = P80211ENUM_msgitem_status_no_value;
+ msg->msgcode = DIDmsg_p2req_readpda;
+ msg->msglen = sizeof(msg);
+ strcpy(msg->devname, wlandev->name);
+ msg->pda.did = DIDmsg_p2req_readpda_pda;
+ msg->pda.len = HFA384x_PDA_LEN_MAX;
+ msg->pda.status = P80211ENUM_msgitem_status_no_value;
+ msg->resultcode.did = DIDmsg_p2req_readpda_resultcode;
+ msg->resultcode.len = sizeof(u32);
+ msg->resultcode.status = P80211ENUM_msgitem_status_no_value;
- if (prism2mgmt_readpda(wlandev, &msg) != 0) {
+ if (prism2mgmt_readpda(wlandev, msg) != 0) {
/* prism2mgmt_readpda prints an errno if appropriate */
result = -1;
- } else if (msg.resultcode.data == P80211ENUM_resultcode_success) {
- memcpy(pda->buf, msg.pda.data, HFA384x_PDA_LEN_MAX);
+ } else if (msg->resultcode.data == P80211ENUM_resultcode_success) {
+ memcpy(pda->buf, msg->pda.data, HFA384x_PDA_LEN_MAX);
result = mkpdrlist(pda);
} else {
/* resultcode must've been something other than success */
result = -1;
}
+ kfree(msg);
return result;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 133/147] staging/slicoss: Fix operation may be undefined warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (125 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 146/147] Staging: wlan-ng: fix sparse warning in prism2fw.c Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0 before using it Ben Hutchings
` (20 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Peter Huewe, Greg Kroah-Hartman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Peter Huewe <peterhuewe@gmx.de>
commit 6d1b80fd886937ad4d6169ffa78cb0075eebce53 upstream.
gcc complains about an undefined operation:
slicoss.c:1417:19: warning: operation on 'rspq->pageindex' may be
undefined [-Wsequence-point]
The intended operation was (probably) to retrieve the pageindex + 1 and let
it wrap around if it reaches the num_pages.
Signed-off-by: Peter Huewe <peterhuewe@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/slicoss/slicoss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/slicoss/slicoss.c
+++ b/drivers/staging/slicoss/slicoss.c
@@ -1490,7 +1490,7 @@ static struct slic_rspbuf *slic_rspqueue
slic_reg64_write(adapter, &adapter->slic_regs->slic_rbar64,
(rspq->paddr[rspq->pageindex] | SLIC_RSPQ_BUFSINPAGE),
&adapter->slic_regs->slic_addr_upper, 0, DONT_FLUSH);
- rspq->pageindex = (++rspq->pageindex) % rspq->num_pages;
+ rspq->pageindex = (rspq->pageindex + 1) % rspq->num_pages;
rspq->offset = 0;
rspq->rspbuf = (struct slic_rspbuf *)
rspq->vaddr[rspq->pageindex];
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0 before using it
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (126 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 133/147] staging/slicoss: Fix operation may be undefined warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 052/147] r8169: Do not increment tx_dropped in TX ring cleaning Ben Hutchings
` (19 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, David Disseldorp, Ronnie Sahlberg, Steve French
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ronnie Sahlberg <lsahlber@redhat.com>
commit f74bc7c6679200a4a83156bb89cbf6c229fe8ec0 upstream.
And fix tcon leak in error path.
Signed-off-by: Ronnie Sahlberg <lsahlber@redhat.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Reviewed-by: David Disseldorp <ddiss@samba.org>
[bwh: Backported to 3.2: cifs_tcon pointer is tcon, and there's no leak to fix]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -521,7 +521,8 @@ cifs_lookup(struct inode *parent_dir_ino
oplock = pTcon->ses->server->oplocks ? REQ_OPLOCK : 0;
/* Don't allow path components longer than the server max. */
- if (unlikely(direntry->d_name.len >
+ if (unlikely(pTcon->fsAttrInfo.MaxPathNameComponentLength &&
+ direntry->d_name.len >
le32_to_cpu(pTcon->fsAttrInfo.MaxPathNameComponentLength))) {
rc = -ENAMETOOLONG;
goto lookup_out;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 052/147] r8169: Do not increment tx_dropped in TX ring cleaning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (127 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 078/147] cifs: check MaxPathNameComponentLength != 0 before using it Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 107/147] ALSA: snd-usb-caiaq: initialize card pointer Ben Hutchings
` (18 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Florian Fainelli
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
commit 1089650d8837095f63e001bbf14d7b48043d67ad upstream.
rtl8169_tx_clear_range() is responsible for cleaning up the TX ring
during interface shutdown, incrementing tx_dropped for every SKB that we
left at the time in the ring is misleading.
Fixes: cac4b22f3d6a ("r8169: do not account fragments as packets")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/realtek/r8169.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -5371,7 +5371,6 @@ static void rtl8169_tx_clear_range(struc
rtl8169_unmap_tx_skb(&tp->pci_dev->dev, tx_skb,
tp->TxDescArray + entry);
if (skb) {
- tp->dev->stats.tx_dropped++;
dev_kfree_skb_any(skb);
tx_skb->skb = NULL;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 107/147] ALSA: snd-usb-caiaq: initialize card pointer
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (128 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 052/147] r8169: Do not increment tx_dropped in TX ring cleaning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 121/147] vmw_balloon: fix for a -Wuninitialized warning Ben Hutchings
` (17 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Daniel Mack, Takashi Iwai
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Mack <zonque@gmail.com>
commit da185443c12f5ef7416af50293833a5654854186 upstream.
Fixes the following warning:
CC [M] sound/usb/caiaq/device.o
sound/usb/caiaq/device.c: In function ‘snd_probe’:
sound/usb/caiaq/device.c:500:16: warning: ‘card’ may be used
uninitialized in this function [-Wmaybe-uninitialized]
Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/caiaq/device.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 64aed432ae22..7da0d0aa72cb 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -485,7 +485,7 @@ static int __devinit snd_probe(struct usb_interface *intf,
const struct usb_device_id *id)
{
int ret;
- struct snd_card *card;
+ struct snd_card *card = NULL;
struct usb_device *device = interface_to_usbdev(intf);
ret = create_card(device, intf, &card);
^ permalink raw reply related [flat|nested] 149+ messages in thread* [PATCH 3.2 121/147] vmw_balloon: fix for a -Wuninitialized warning
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (129 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 107/147] ALSA: snd-usb-caiaq: initialize card pointer Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 131/147] staging:iio:gyro:adis16080: remove sparse warnings Ben Hutchings
` (16 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Danny Kukawka, Greg Kroah-Hartman
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Danny Kukawka <danny.kukawka@bisect.de>
commit 3e5ba466d515eb3fb1e0e975a3d8e499126ae2b5 upstream.
Fix for a -Wuninitialized compiler warning. Changed return value of
vmballoon_send_lock_page() from bool to int to be able to distinguish
between the error cases to avoid uninitialized use of hv_status in
vmballoon_reserve_page()
Signed-off-by: Danny Kukawka <danny.kukawka@bisect.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/misc/vmw_balloon.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/misc/vmw_balloon.c
+++ b/drivers/misc/vmw_balloon.c
@@ -314,7 +314,7 @@ static bool vmballoon_send_get_target(st
* fear that guest will need it. Host may reject some pages, we need to
* check the return value and maybe submit a different page.
*/
-static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
+static int vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn,
unsigned int *hv_status)
{
unsigned long status, dummy;
@@ -322,17 +322,17 @@ static bool vmballoon_send_lock_page(str
pfn32 = (u32)pfn;
if (pfn32 != pfn)
- return false;
+ return -1;
STATS_INC(b->stats.lock);
*hv_status = status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
if (vmballoon_check_status(b, status))
- return true;
+ return 0;
pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
STATS_INC(b->stats.lock_fail);
- return false;
+ return 1;
}
/*
@@ -411,7 +411,7 @@ static int vmballoon_reserve_page(struct
struct page *page;
gfp_t flags;
unsigned int hv_status;
- bool locked = false;
+ int locked;
flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
do {
@@ -431,7 +431,7 @@ static int vmballoon_reserve_page(struct
/* inform monitor */
locked = vmballoon_send_lock_page(b, page_to_pfn(page), &hv_status);
- if (!locked) {
+ if (locked > 0) {
STATS_INC(b->stats.refused_alloc);
if (hv_status == VMW_BALLOON_ERROR_RESET ||
@@ -449,7 +449,7 @@ static int vmballoon_reserve_page(struct
if (++b->n_refused_pages >= VMW_BALLOON_MAX_REFUSED)
return -EIO;
}
- } while (!locked);
+ } while (locked != 0);
/* track allocated page */
list_add(&page->lru, &b->pages);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 131/147] staging:iio:gyro:adis16080: remove sparse warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (130 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 121/147] vmw_balloon: fix for a -Wuninitialized warning Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 079/147] fix unbalanced page refcounting in bio_map_user_iov Ben Hutchings
` (15 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Leed Aguilar, Jonathan Cameron, Greg Kroah-Hartman,
Lars-Peter Clausen
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Leed Aguilar <leed.aguilar@ti.com>
commit 4d9505af7743828464d066795c6e1311c7884db4 upstream.
Removed the following sparse warning:
In function 'adis16080_read_raw':
warning: 'ut' may be used uninitialized in this function
Signed-off-by: Leed Aguilar <leed.aguilar@ti.com>
Acked-by: Lars-Peter Clausen <lars@metafoo.de>
Cc: Jonathan Cameron <jic23@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/iio/gyro/adis16080_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/iio/gyro/adis16080_core.c
+++ b/drivers/staging/iio/gyro/adis16080_core.c
@@ -82,7 +82,7 @@ static int adis16080_read_raw(struct iio
long mask)
{
int ret = -EINVAL;
- u16 ut;
+ u16 ut = 0;
/* Take the iio_dev status lock */
mutex_lock(&indio_dev->mlock);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 079/147] fix unbalanced page refcounting in bio_map_user_iov
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (131 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 131/147] staging:iio:gyro:adis16080: remove sparse warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 055/147] dm: convert DM printk macros to pr_<level> macros Ben Hutchings
` (14 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Vitaly Mayatskikh, Al Viro
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Mayatskikh <v.mayatskih@gmail.com>
commit 95d78c28b5a85bacbc29b8dba7c04babb9b0d467 upstream.
bio_map_user_iov and bio_unmap_user do unbalanced pages refcounting if
IO vector has small consecutive buffers belonging to the same page.
bio_add_pc_page merges them into one, but the page reference is never
dropped.
Signed-off-by: Vitaly Mayatskikh <v.mayatskih@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/bio.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/fs/bio.c
+++ b/fs/bio.c
@@ -1027,6 +1027,7 @@ static struct bio *__bio_map_user_iov(st
offset = uaddr & ~PAGE_MASK;
for (j = cur_page; j < page_limit; j++) {
unsigned int bytes = PAGE_SIZE - offset;
+ unsigned short prev_bi_vcnt = bio->bi_vcnt;
if (len <= 0)
break;
@@ -1041,6 +1042,13 @@ static struct bio *__bio_map_user_iov(st
bytes)
break;
+ /*
+ * check if vector was merged with previous
+ * drop page reference if needed
+ */
+ if (bio->bi_vcnt == prev_bi_vcnt)
+ put_page(pages[j]);
+
len -= bytes;
offset = 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 055/147] dm: convert DM printk macros to pr_<level> macros
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (132 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 079/147] fix unbalanced page refcounting in bio_map_user_iov Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 104/147] ASoC: wm8993: Refactor set_pll code to avoid GCC warnings Ben Hutchings
` (13 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Joe Perches, Mike Snitzer
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Joe Perches <joe@perches.com>
commit d2c3c8dcb5987b8352e82089c79a41b6e17e28d2 upstream.
Using pr_<level> is the more common logging style.
Standardize style and use new macro DM_FMT.
Use no_printk in DMDEBUG macros when CONFIG_DM_DEBUG is not #defined.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/device-mapper.h | 71 +++++++++++++++++++------------------------
1 file changed, 32 insertions(+), 39 deletions(-)
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -406,48 +406,41 @@ extern struct ratelimit_state dm_ratelim
#define dm_ratelimit() 0
#endif
-#define DMCRIT(f, arg...) \
- printk(KERN_CRIT DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
+#define DM_FMT(fmt) DM_NAME ": " DM_MSG_PREFIX ": " fmt "\n"
-#define DMERR(f, arg...) \
- printk(KERN_ERR DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMERR_LIMIT(f, arg...) \
- do { \
- if (dm_ratelimit()) \
- printk(KERN_ERR DM_NAME ": " DM_MSG_PREFIX ": " \
- f "\n", ## arg); \
- } while (0)
-
-#define DMWARN(f, arg...) \
- printk(KERN_WARNING DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMWARN_LIMIT(f, arg...) \
- do { \
- if (dm_ratelimit()) \
- printk(KERN_WARNING DM_NAME ": " DM_MSG_PREFIX ": " \
- f "\n", ## arg); \
- } while (0)
-
-#define DMINFO(f, arg...) \
- printk(KERN_INFO DM_NAME ": " DM_MSG_PREFIX ": " f "\n", ## arg)
-#define DMINFO_LIMIT(f, arg...) \
- do { \
- if (dm_ratelimit()) \
- printk(KERN_INFO DM_NAME ": " DM_MSG_PREFIX ": " f \
- "\n", ## arg); \
- } while (0)
+#define DMCRIT(fmt, ...) pr_crit(DM_FMT(fmt), ##__VA_ARGS__)
+
+#define DMERR(fmt, ...) pr_err(DM_FMT(fmt), ##__VA_ARGS__)
+#define DMERR_LIMIT(fmt, ...) \
+do { \
+ if (dm_ratelimit()) \
+ DMERR(fmt, ##__VA_ARGS__); \
+} while (0)
+
+#define DMWARN(fmt, ...) pr_warn(DM_FMT(fmt), ##__VA_ARGS__)
+#define DMWARN_LIMIT(fmt, ...) \
+do { \
+ if (dm_ratelimit()) \
+ DMWARN(fmt, ##__VA_ARGS__); \
+} while (0)
+
+#define DMINFO(fmt, ...) pr_info(DM_FMT(fmt), ##__VA_ARGS__)
+#define DMINFO_LIMIT(fmt, ...) \
+do { \
+ if (dm_ratelimit()) \
+ DMINFO(fmt, ##__VA_ARGS__); \
+} while (0)
#ifdef CONFIG_DM_DEBUG
-# define DMDEBUG(f, arg...) \
- printk(KERN_DEBUG DM_NAME ": " DM_MSG_PREFIX " DEBUG: " f "\n", ## arg)
-# define DMDEBUG_LIMIT(f, arg...) \
- do { \
- if (dm_ratelimit()) \
- printk(KERN_DEBUG DM_NAME ": " DM_MSG_PREFIX ": " f \
- "\n", ## arg); \
- } while (0)
+#define DMDEBUG(fmt, ...) printk(KERN_DEBUG DM_FMT(fmt), ##__VA_ARGS__)
+#define DMDEBUG_LIMIT(fmt, ...) \
+do { \
+ if (dm_ratelimit()) \
+ DMDEBUG(fmt, ##__VA_ARGS__); \
+} while (0)
#else
-# define DMDEBUG(f, arg...) do {} while (0)
-# define DMDEBUG_LIMIT(f, arg...) do {} while (0)
+#define DMDEBUG(fmt, ...) no_printk(fmt, ##__VA_ARGS__)
+#define DMDEBUG_LIMIT(fmt, ...) no_printk(fmt, ##__VA_ARGS__)
#endif
#define DMEMIT(x...) sz += ((sz >= maxlen) ? \
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 104/147] ASoC: wm8993: Refactor set_pll code to avoid GCC warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (133 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 055/147] dm: convert DM printk macros to pr_<level> macros Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 085/147] packet: in packet_do_bind, test fanout with bind_lock held Ben Hutchings
` (12 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Fabio Estevam, Mark Brown
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@freescale.com>
commit 6757d8cc0c6ff2e61972d84797d358a2f69f2217 upstream.
Refactor set_pll code to avoid the following warnings:
sound/soc/codecs/wm8983.c:873:40: warning: 'pll_div.k' may be used uninitialized in this function [-Wuninitialized]
sound/soc/codecs/wm8983.c:870:9: warning: 'pll_div.n' may be used uninitialized in this function [-Wuninitialized]
sound/soc/codecs/wm8983.c:869:23: warning: 'pll_div.div2' may be used uninitialized in this function [-Wuninitialized]
Do the same as in commit 86ce6c9a (ASoC: WM8804: Refactor set_pll code to avoid
GCC warnings).
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8983.c | 41 ++++++++++++++++++++++-------------------
1 file changed, 22 insertions(+), 19 deletions(-)
--- a/sound/soc/codecs/wm8983.c
+++ b/sound/soc/codecs/wm8983.c
@@ -855,30 +855,33 @@ static int wm8983_set_pll(struct snd_soc
struct pll_div pll_div;
codec = dai->codec;
- if (freq_in && freq_out) {
+ if (!freq_in || !freq_out) {
+ /* disable the PLL */
+ snd_soc_update_bits(codec, WM8983_POWER_MANAGEMENT_1,
+ WM8983_PLLEN_MASK, 0);
+ return 0;
+ } else {
ret = pll_factors(&pll_div, freq_out * 4 * 2, freq_in);
if (ret)
return ret;
- }
- /* disable the PLL before re-programming it */
- snd_soc_update_bits(codec, WM8983_POWER_MANAGEMENT_1,
- WM8983_PLLEN_MASK, 0);
+ /* disable the PLL before re-programming it */
+ snd_soc_update_bits(codec, WM8983_POWER_MANAGEMENT_1,
+ WM8983_PLLEN_MASK, 0);
- if (!freq_in || !freq_out)
- return 0;
+ /* set PLLN and PRESCALE */
+ snd_soc_write(codec, WM8983_PLL_N,
+ (pll_div.div2 << WM8983_PLL_PRESCALE_SHIFT)
+ | pll_div.n);
+ /* set PLLK */
+ snd_soc_write(codec, WM8983_PLL_K_3, pll_div.k & 0x1ff);
+ snd_soc_write(codec, WM8983_PLL_K_2, (pll_div.k >> 9) & 0x1ff);
+ snd_soc_write(codec, WM8983_PLL_K_1, (pll_div.k >> 18));
+ /* enable the PLL */
+ snd_soc_update_bits(codec, WM8983_POWER_MANAGEMENT_1,
+ WM8983_PLLEN_MASK, WM8983_PLLEN);
+ }
- /* set PLLN and PRESCALE */
- snd_soc_write(codec, WM8983_PLL_N,
- (pll_div.div2 << WM8983_PLL_PRESCALE_SHIFT)
- | pll_div.n);
- /* set PLLK */
- snd_soc_write(codec, WM8983_PLL_K_3, pll_div.k & 0x1ff);
- snd_soc_write(codec, WM8983_PLL_K_2, (pll_div.k >> 9) & 0x1ff);
- snd_soc_write(codec, WM8983_PLL_K_1, (pll_div.k >> 18));
- /* enable the PLL */
- snd_soc_update_bits(codec, WM8983_POWER_MANAGEMENT_1,
- WM8983_PLLEN_MASK, WM8983_PLLEN);
return 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 085/147] packet: in packet_do_bind, test fanout with bind_lock held
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (134 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 104/147] ASoC: wm8993: Refactor set_pll code to avoid GCC warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 037/147] parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo Ben Hutchings
` (11 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Eric Dumazet, Willem de Bruijn, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Willem de Bruijn <willemb@google.com>
commit 4971613c1639d8e5f102c4e797c3bf8f83a5a69e upstream.
Once a socket has po->fanout set, it remains a member of the group
until it is destroyed. The prot_hook must be constant and identical
across sockets in the group.
If fanout_add races with packet_do_bind between the test of po->fanout
and taking the lock, the bind call may make type or dev inconsistent
with that of the fanout group.
Hold po->bind_lock when testing po->fanout to avoid this race.
I had to introduce artificial delay (local_bh_enable) to actually
observe the race.
Fixes: dc99f600698d ("packet: Add fanout support.")
Signed-off-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/packet/af_packet.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2483,14 +2483,16 @@ static int packet_do_bind(struct sock *s
int ret = 0;
bool unlisted = false;
- if (po->fanout)
- return -EINVAL;
-
lock_sock(sk);
spin_lock(&po->bind_lock);
rcu_read_lock();
+ if (po->fanout) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
+
if (name) {
dev = dev_get_by_name_rcu(sock_net(sk), name);
if (!dev) {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 037/147] parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (135 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 085/147] packet: in packet_do_bind, test fanout with bind_lock held Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 109/147] netfilter: xt_socket: fix compilation warnings with gcc 4.7 Ben Hutchings
` (10 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Helge Deller, Thomas Bogendoerfer
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
commit 4098116039911e8870d84c975e2ec22dab65a909 upstream.
For 64bit kernels the lmmio_space_offset of the host bridge window
isn't set correctly on systems with dino/cujo PCI host bridges.
This leads to not assigned memory bars and failing drivers, which
need to use these bars.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Acked-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/parisc/dino.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/parisc/dino.c
+++ b/drivers/parisc/dino.c
@@ -988,7 +988,7 @@ static int __init dino_probe(struct pari
dino_dev->hba.dev = dev;
dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096);
- dino_dev->hba.lmmio_space_offset = 0; /* CPU addrs == bus addrs */
+ dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND;
spin_lock_init(&dino_dev->dinosaur_pen);
dino_dev->hba.iommu = ccio_get_iommu(dev);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 109/147] netfilter: xt_socket: fix compilation warnings with gcc 4.7
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (136 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 037/147] parisc: pci memory bar assignment fails with 64bit kernels on dino/cujo Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 004/147] USB: serial: cp210x: add support for Qivicon USB ZigBee dongle Ben Hutchings
` (9 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Pablo Neira Ayuso
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 6703aa74ad1ba2e598bb49a37f7518da1195bacb upstream.
This patch fixes compilation warnings in xt_socket with gcc-4.7.
In file included from net/netfilter/xt_socket.c:22:0:
net/netfilter/xt_socket.c: In function ‘socket_mt6_v1’:
include/net/netfilter/nf_tproxy_core.h:175:23: warning: ‘sport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:265:16: note: ‘sport’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:23: warning: ‘dport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:265:9: note: ‘dport’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:6: warning: ‘saddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:264:27: note: ‘saddr’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:6: warning: ‘daddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:264:19: note: ‘daddr’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
net/netfilter/xt_socket.c: In function ‘socket_match.isra.4’:
include/net/netfilter/nf_tproxy_core.h:75:2: warning: ‘protocol’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:113:5: note: ‘protocol’ was declared here
In file included from include/net/tcp.h:37:0,
from net/netfilter/xt_socket.c:17:
include/net/inet_hashtables.h:356:45: warning: ‘sport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:112:16: note: ‘sport’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:106:23: warning: ‘dport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:112:9: note: ‘dport’ was declared here
In file included from include/net/tcp.h:37:0,
from net/netfilter/xt_socket.c:17:
include/net/inet_hashtables.h:356:15: warning: ‘saddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:111:16: note: ‘saddr’ was declared here
In file included from include/net/tcp.h:37:0,
from net/netfilter/xt_socket.c:17:
include/net/inet_hashtables.h:356:15: warning: ‘daddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:111:9: note: ‘daddr’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
net/netfilter/xt_socket.c: In function ‘socket_mt6_v1’:
include/net/netfilter/nf_tproxy_core.h:175:23: warning: ‘sport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:268:16: note: ‘sport’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:23: warning: ‘dport’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:268:9: note: ‘dport’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:6: warning: ‘saddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:267:27: note: ‘saddr’ was declared here
In file included from net/netfilter/xt_socket.c:22:0:
include/net/netfilter/nf_tproxy_core.h:175:6: warning: ‘daddr’ may be used uninitialized in this function [-Wmaybe-uninitialized]
net/netfilter/xt_socket.c:267:19: note: ‘daddr’ was declared here
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/netfilter/xt_socket.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -108,9 +108,9 @@ socket_match(const struct sk_buff *skb,
const struct iphdr *iph = ip_hdr(skb);
struct udphdr _hdr, *hp = NULL;
struct sock *sk;
- __be32 daddr, saddr;
- __be16 dport, sport;
- u8 protocol;
+ __be32 uninitialized_var(daddr), uninitialized_var(saddr);
+ __be16 uninitialized_var(dport), uninitialized_var(sport);
+ u8 uninitialized_var(protocol);
#ifdef XT_SOCKET_HAVE_CONNTRACK
struct nf_conn const *ct;
enum ip_conntrack_info ctinfo;
@@ -263,9 +263,9 @@ socket_mt6_v1(const struct sk_buff *skb,
struct ipv6hdr ipv6_var, *iph = ipv6_hdr(skb);
struct udphdr _hdr, *hp = NULL;
struct sock *sk;
- const struct in6_addr *daddr, *saddr;
- __be16 dport, sport;
- int thoff, tproto;
+ const struct in6_addr *daddr = NULL, *saddr = NULL;
+ __be16 uninitialized_var(dport), uninitialized_var(sport);
+ int thoff, uninitialized_var(tproto);
const struct xt_socket_mtinfo1 *info = (struct xt_socket_mtinfo1 *) par->matchinfo;
tproto = ipv6_find_hdr(skb, &thoff, -1, NULL);
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 004/147] USB: serial: cp210x: add support for Qivicon USB ZigBee dongle
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (137 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 109/147] netfilter: xt_socket: fix compilation warnings with gcc 4.7 Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 042/147] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() Ben Hutchings
` (8 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Stefan Triller, Johan Hovold, Frans Klaver
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Triller <github@stefantriller.de>
commit 9585e340db9f6cc1c0928d82c3a23cc4460f0a3f upstream.
The German Telekom offers a ZigBee USB Stick under the brand name Qivicon
for their SmartHome Home Base in its 1. Generation. The productId is not
known by the according kernel module, this patch adds support for it.
Signed-off-by: Stefan Triller <github@stefantriller.de>
Reviewed-by: Frans Klaver <fransklaver@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/cp210x.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -141,6 +141,7 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */
{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 042/147] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt()
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (138 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 004/147] USB: serial: cp210x: add support for Qivicon USB ZigBee dongle Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 027/147] xtensa: don't limit csum_partial export by CONFIG_NET Ben Hutchings
` (7 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, David S. Miller, Stefano Brivio
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stefano Brivio <sbrivio@redhat.com>
commit 3de33e1ba0506723ab25734e098cf280ecc34756 upstream.
A packet length of exactly IPV6_MAXPLEN is allowed, we should
refuse parsing options only if the size is 64KiB or more.
While at it, remove one extra variable and one assignment which
were also introduced by the commit that introduced the size
check. Checking the sum 'offset + len' and only later adding
'len' to 'offset' doesn't provide any advantage over directly
summing to 'offset' and checking it.
Fixes: 6399f1fae4ec ("ipv6: avoid overflow of offset in ip6_find_1stfragopt")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv6/ip6_output.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -568,7 +568,6 @@ int ip6_find_1stfragopt(struct sk_buff *
while (offset <= packet_len) {
struct ipv6_opt_hdr *exthdr;
- unsigned int len;
switch (**nexthdr) {
@@ -594,10 +593,9 @@ int ip6_find_1stfragopt(struct sk_buff *
exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
offset);
- len = ipv6_optlen(exthdr);
- if (len + offset >= IPV6_MAXPLEN)
+ offset += ipv6_optlen(exthdr);
+ if (offset > IPV6_MAXPLEN)
return -EINVAL;
- offset += len;
*nexthdr = &exthdr->nexthdr;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 027/147] xtensa: don't limit csum_partial export by CONFIG_NET
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (139 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 042/147] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 125/147] aic94xx: Skip reading user settings if flash is not found Ben Hutchings
` (6 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Max Filippov
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 7f81e55c737a8fa82c71f290945d729a4902f8d2 upstream.
csum_partial and csum_partial_copy_generic are defined unconditionally
and are available even when CONFIG_NET is disabled. They are used not
only by the network drivers, but also by scsi and media.
Don't limit these functions export by CONFIG_NET.
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/xtensa/kernel/xtensa_ksyms.c | 2 --
1 file changed, 2 deletions(-)
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -73,13 +73,11 @@ EXPORT_SYMBOL(__umodsi3);
EXPORT_SYMBOL(__udivdi3);
EXPORT_SYMBOL(__umoddi3);
-#ifdef CONFIG_NET
/*
* Networking support
*/
EXPORT_SYMBOL(csum_partial);
EXPORT_SYMBOL(csum_partial_copy_generic);
-#endif /* CONFIG_NET */
/*
* Architecture-specific symbols
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 125/147] aic94xx: Skip reading user settings if flash is not found
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (140 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 027/147] xtensa: don't limit csum_partial export by CONFIG_NET Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 070/147] sch_htb: fix crash on init failure Ben Hutchings
` (5 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Hannes Reinecke, Christoph Hellwig, James Bottomley
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Hannes Reinecke <hare@suse.de>
commit 36dd5acd196574d41de3e81d8264df475bbb7123 upstream.
If no user settings are found it's pointless trying to
read them from flash. So skip that step.
This also fixes a compilation warning about uninitialized variables in
aic94xx.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: James Bottomley <JBottomley@Odin.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/aic94xx/aic94xx_sds.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/scsi/aic94xx/aic94xx_sds.c
+++ b/drivers/scsi/aic94xx/aic94xx_sds.c
@@ -983,7 +983,7 @@ static int asd_process_ctrl_a_user(struc
{
int err, i;
u32 offs, size;
- struct asd_ll_el *el;
+ struct asd_ll_el *el = NULL;
struct asd_ctrla_phy_settings *ps;
struct asd_ctrla_phy_settings dflt_ps;
@@ -1004,6 +1004,7 @@ static int asd_process_ctrl_a_user(struc
size = sizeof(struct asd_ctrla_phy_settings);
ps = &dflt_ps;
+ goto out_process;
}
if (size == 0)
@@ -1028,7 +1029,7 @@ static int asd_process_ctrl_a_user(struc
ASD_DPRINTK("couldn't find ctrla phy settings struct\n");
goto out2;
}
-
+out_process:
err = asd_process_ctrla_phy_settings(asd_ha, ps);
if (err) {
ASD_DPRINTK("couldn't process ctrla phy settings\n");
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 070/147] sch_htb: fix crash on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (141 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 125/147] aic94xx: Skip reading user settings if flash is not found Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 105/147] ASoC: wm8985: Refactor set_pll code to avoid gcc warnings Ben Hutchings
` (4 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Aleksandrov, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit 88c2ace69dbef696edba77712882af03879abc9c upstream.
The commit below added a call to the ->destroy() callback for all qdiscs
which failed in their ->init(), but some were not prepared for such
change and can't handle partially initialized qdisc. HTB is one of them
and if any error occurs before the qdisc watchdog timer and qdisc work are
initialized then we can hit either a null ptr deref (timer->base) when
canceling in ->destroy or lockdep error info about trying to register
a non-static key and a stack dump. So to fix these two move the watchdog
timer and workqueue init before anything that can err out.
To reproduce userspace needs to send broken htb qdisc create request,
tested with a modified tc (q_htb.c).
Trace log:
[ 2710.897602] BUG: unable to handle kernel NULL pointer dereference at (null)
[ 2710.897977] IP: hrtimer_active+0x17/0x8a
[ 2710.898174] PGD 58fab067
[ 2710.898175] P4D 58fab067
[ 2710.898353] PUD 586c0067
[ 2710.898531] PMD 0
[ 2710.898710]
[ 2710.899045] Oops: 0000 [#1] SMP
[ 2710.899232] Modules linked in:
[ 2710.899419] CPU: 1 PID: 950 Comm: tc Not tainted 4.13.0-rc6+ #54
[ 2710.899646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 2710.900035] task: ffff880059ed2700 task.stack: ffff88005ad4c000
[ 2710.900262] RIP: 0010:hrtimer_active+0x17/0x8a
[ 2710.900467] RSP: 0018:ffff88005ad4f960 EFLAGS: 00010246
[ 2710.900684] RAX: 0000000000000000 RBX: ffff88003701e298 RCX: 0000000000000000
[ 2710.900933] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88003701e298
[ 2710.901177] RBP: ffff88005ad4f980 R08: 0000000000000001 R09: 0000000000000001
[ 2710.901419] R10: ffff88005ad4f800 R11: 0000000000000400 R12: 0000000000000000
[ 2710.901663] R13: ffff88003701e298 R14: ffffffff822a4540 R15: ffff88005ad4fac0
[ 2710.901907] FS: 00007f2f5e90f740(0000) GS:ffff88005d880000(0000) knlGS:0000000000000000
[ 2710.902277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2710.902500] CR2: 0000000000000000 CR3: 0000000058ca3000 CR4: 00000000000406e0
[ 2710.902744] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2710.902977] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2710.903180] Call Trace:
[ 2710.903332] hrtimer_try_to_cancel+0x1a/0x93
[ 2710.903504] hrtimer_cancel+0x15/0x20
[ 2710.903667] qdisc_watchdog_cancel+0x12/0x14
[ 2710.903866] htb_destroy+0x2e/0xf7
[ 2710.904097] qdisc_create+0x377/0x3fd
[ 2710.904330] tc_modify_qdisc+0x4d2/0x4fd
[ 2710.904511] rtnetlink_rcv_msg+0x188/0x197
[ 2710.904682] ? rcu_read_unlock+0x3e/0x5f
[ 2710.904849] ? rtnl_newlink+0x729/0x729
[ 2710.905017] netlink_rcv_skb+0x6c/0xce
[ 2710.905183] rtnetlink_rcv+0x23/0x2a
[ 2710.905345] netlink_unicast+0x103/0x181
[ 2710.905511] netlink_sendmsg+0x326/0x337
[ 2710.905679] sock_sendmsg_nosec+0x14/0x3f
[ 2710.905847] sock_sendmsg+0x29/0x2e
[ 2710.906010] ___sys_sendmsg+0x209/0x28b
[ 2710.906176] ? do_raw_spin_unlock+0xcd/0xf8
[ 2710.906346] ? _raw_spin_unlock+0x27/0x31
[ 2710.906514] ? __handle_mm_fault+0x651/0xdb1
[ 2710.906685] ? check_chain_key+0xb0/0xfd
[ 2710.906855] __sys_sendmsg+0x45/0x63
[ 2710.907018] ? __sys_sendmsg+0x45/0x63
[ 2710.907185] SyS_sendmsg+0x19/0x1b
[ 2710.907344] entry_SYSCALL_64_fastpath+0x23/0xc2
Note that probably this bug goes further back because the default qdisc
handling always calls ->destroy on init failure too.
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Fixes: 0fbbeb1ba43b ("[PKT_SCHED]: Fix missing qdisc_destroy() in qdisc_create_dflt()")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_htb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -997,6 +997,9 @@ static int htb_init(struct Qdisc *sch, s
int err;
int i;
+ qdisc_watchdog_init(&q->watchdog, sch);
+ INIT_WORK(&q->work, htb_work_func);
+
if (!opt)
return -EINVAL;
@@ -1021,8 +1024,6 @@ static int htb_init(struct Qdisc *sch, s
for (i = 0; i < TC_HTB_NUMPRIO; i++)
INIT_LIST_HEAD(q->drops + i);
- qdisc_watchdog_init(&q->watchdog, sch);
- INIT_WORK(&q->work, htb_work_func);
skb_queue_head_init(&q->direct_queue);
q->direct_qlen = qdisc_dev(sch)->tx_queue_len;
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 105/147] ASoC: wm8985: Refactor set_pll code to avoid gcc warnings
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (142 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 070/147] sch_htb: fix crash on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 072/147] sch_hfsc: fix null pointer deref and double free on init failure Ben Hutchings
` (3 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Fabio Estevam, Mark Brown
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <fabio.estevam@freescale.com>
commit 5f3d25c08dee44a40229f1f9e8934f3217478a67 upstream.
Refactor set_pll code to avoid the following warnings:
sound/soc/codecs/wm8985.c:852:50: warning: 'pll_div.k' may be used uninitialized in this function
sound/soc/codecs/wm8985.c:849:9: warning: 'pll_div.n' may be used uninitialized in this function
sound/soc/codecs/wm8985.c:848:23: warning: 'pll_div.div2' may be used uninitialized in this function
Do the same as in commit 86ce6c9a (ASoC: WM8804: Refactor set_pll code to avoid
GCC warnings).
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/codecs/wm8985.c | 43 ++++++++++++++++++++-----------------------
1 file changed, 20 insertions(+), 23 deletions(-)
--- a/sound/soc/codecs/wm8985.c
+++ b/sound/soc/codecs/wm8985.c
@@ -785,33 +785,30 @@ static int wm8985_set_pll(struct snd_soc
struct pll_div pll_div;
codec = dai->codec;
- if (freq_in && freq_out) {
+ if (!freq_in || !freq_out) {
+ /* disable the PLL */
+ snd_soc_update_bits(codec, WM8985_POWER_MANAGEMENT_1,
+ WM8985_PLLEN_MASK, 0);
+ } else {
ret = pll_factors(&pll_div, freq_out * 4 * 2, freq_in);
if (ret)
return ret;
- }
-
- /* disable the PLL before reprogramming it */
- snd_soc_update_bits(codec, WM8985_POWER_MANAGEMENT_1,
- WM8985_PLLEN_MASK, 0);
-
- if (!freq_in || !freq_out)
- return 0;
- /* set PLLN and PRESCALE */
- snd_soc_write(codec, WM8985_PLL_N,
- (pll_div.div2 << WM8985_PLL_PRESCALE_SHIFT)
- | pll_div.n);
- /* set PLLK */
- snd_soc_write(codec, WM8985_PLL_K_3, pll_div.k & 0x1ff);
- snd_soc_write(codec, WM8985_PLL_K_2, (pll_div.k >> 9) & 0x1ff);
- snd_soc_write(codec, WM8985_PLL_K_1, (pll_div.k >> 18));
- /* set the source of the clock to be the PLL */
- snd_soc_update_bits(codec, WM8985_CLOCK_GEN_CONTROL,
- WM8985_CLKSEL_MASK, WM8985_CLKSEL);
- /* enable the PLL */
- snd_soc_update_bits(codec, WM8985_POWER_MANAGEMENT_1,
- WM8985_PLLEN_MASK, WM8985_PLLEN);
+ /* set PLLN and PRESCALE */
+ snd_soc_write(codec, WM8985_PLL_N,
+ (pll_div.div2 << WM8985_PLL_PRESCALE_SHIFT)
+ | pll_div.n);
+ /* set PLLK */
+ snd_soc_write(codec, WM8985_PLL_K_3, pll_div.k & 0x1ff);
+ snd_soc_write(codec, WM8985_PLL_K_2, (pll_div.k >> 9) & 0x1ff);
+ snd_soc_write(codec, WM8985_PLL_K_1, (pll_div.k >> 18));
+ /* set the source of the clock to be the PLL */
+ snd_soc_update_bits(codec, WM8985_CLOCK_GEN_CONTROL,
+ WM8985_CLKSEL_MASK, WM8985_CLKSEL);
+ /* enable the PLL */
+ snd_soc_update_bits(codec, WM8985_POWER_MANAGEMENT_1,
+ WM8985_PLLEN_MASK, WM8985_PLLEN);
+ }
return 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 072/147] sch_hfsc: fix null pointer deref and double free on init failure
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (143 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 105/147] ASoC: wm8985: Refactor set_pll code to avoid gcc warnings Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 083/147] packet: race condition in packet_bind Ben Hutchings
` (2 subsequent siblings)
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Nikolay Aleksandrov, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit 3bdac362a2f89ed3e148fa6f38c5f5d858f50b1a upstream.
Depending on where ->init fails we can get a null pointer deref due to
uninitialized hires timer (watchdog) or a double free of the qdisc hash
because it is already freed by ->destroy().
Fixes: 8d5537387505 ("net/sched/hfsc: allocate tcf block for hfsc root class")
Fixes: 87b60cfacf9f ("net_sched: fix error recovery at qdisc creation")
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2: sch_hfsc doesn't use a tcf block]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1435,6 +1435,8 @@ hfsc_init_qdisc(struct Qdisc *sch, struc
struct tc_hfsc_qopt *qopt;
int err;
+ qdisc_watchdog_init(&q->watchdog, sch);
+
if (opt == NULL || nla_len(opt) < sizeof(*qopt))
return -EINVAL;
qopt = nla_data(opt);
@@ -1460,8 +1462,6 @@ hfsc_init_qdisc(struct Qdisc *sch, struc
qdisc_class_hash_insert(&q->clhash, &q->root.cl_common);
qdisc_class_hash_grow(sch, &q->clhash);
- qdisc_watchdog_init(&q->watchdog, sch);
-
return 0;
}
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 083/147] packet: race condition in packet_bind
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (144 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 072/147] sch_hfsc: fix null pointer deref and double free on init failure Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-06 23:03 ` [PATCH 3.2 141/147] scsi: advansys: remove #warning message Ben Hutchings
2017-11-07 14:18 ` [PATCH 3.2 000/147] 3.2.95-rc1 review Guenter Roeck
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Francesco Ruggeri, Francesco Ruggeri, David S. Miller
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Ruggeri <fruggeri@aristanetworks.com>
commit 30f7ea1c2b5f5fb7462c5ae44fe2e40cb2d6a474 upstream.
There is a race conditions between packet_notifier and packet_bind{_spkt}.
It happens if packet_notifier(NETDEV_UNREGISTER) executes between the
time packet_bind{_spkt} takes a reference on the new netdevice and the
time packet_do_bind sets po->ifindex.
In this case the notification can be missed.
If this happens during a dev_change_net_namespace this can result in the
netdevice to be moved to the new namespace while the packet_sock in the
old namespace still holds a reference on it. When the netdevice is later
deleted in the new namespace the deletion hangs since the packet_sock
is not found in the new namespace' &net->packet.sklist.
It can be reproduced with the script below.
This patch makes packet_do_bind check again for the presence of the
netdevice in the packet_sock's namespace after the synchronize_net
in unregister_prot_hook.
More in general it also uses the rcu lock for the duration of the bind
to stop dev_change_net_namespace/rollback_registered_many from
going past the synchronize_net following unlist_netdevice, so that
no NETDEV_UNREGISTER notifications can happen on the new netdevice
while the bind is executing. In order to do this some code from
packet_bind{_spkt} is consolidated into packet_do_dev.
import socket, os, time, sys
proto=7
realDev='em1'
vlanId=400
if len(sys.argv) > 1:
vlanId=int(sys.argv[1])
dev='vlan%d' % vlanId
os.system('taskset -p 0x10 %d' % os.getpid())
s = socket.socket(socket.PF_PACKET, socket.SOCK_RAW, proto)
os.system('ip link add link %s name %s type vlan id %d' %
(realDev, dev, vlanId))
os.system('ip netns add dummy')
pid=os.fork()
if pid == 0:
# dev should be moved while packet_do_bind is in synchronize net
os.system('taskset -p 0x20000 %d' % os.getpid())
os.system('ip link set %s netns dummy' % dev)
os.system('ip netns exec dummy ip link del %s' % dev)
s.close()
sys.exit(0)
time.sleep(.004)
try:
s.bind(('%s' % dev, proto+1))
except:
print 'Could not bind socket'
s.close()
os.system('ip netns del dummy')
sys.exit(0)
os.waitpid(pid, 0)
s.close()
os.system('ip netns del dummy')
sys.exit(0)
Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.2:
- Add the 'dev_curr' variable
- Drop the packet_cached_dev changes
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/packet/af_packet.c | 80 +++++++++++++++++++++++++++++++-------------------
1 file changed, 49 insertions(+), 31 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2468,33 +2468,70 @@ static int packet_release(struct socket
* Attach a packet hook.
*/
-static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
+static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+ __be16 protocol)
{
struct packet_sock *po = pkt_sk(sk);
+ struct net_device *dev_curr;
+ struct net_device *dev = NULL;
+ int ret = 0;
+ bool unlisted = false;
- if (po->fanout) {
- if (dev)
- dev_put(dev);
-
+ if (po->fanout)
return -EINVAL;
- }
lock_sock(sk);
spin_lock(&po->bind_lock);
- unregister_prot_hook(sk, true);
+ rcu_read_lock();
+
+ if (name) {
+ dev = dev_get_by_name_rcu(sock_net(sk), name);
+ if (!dev) {
+ ret = -ENODEV;
+ goto out_unlock;
+ }
+ } else if (ifindex) {
+ dev = dev_get_by_index_rcu(sock_net(sk), ifindex);
+ if (!dev) {
+ ret = -ENODEV;
+ goto out_unlock;
+ }
+ }
+
+ if (dev)
+ dev_hold(dev);
+
+ dev_curr = po->prot_hook.dev;
+
+ if (po->running) {
+ rcu_read_unlock();
+ __unregister_prot_hook(sk, true);
+ rcu_read_lock();
+ dev_curr = po->prot_hook.dev;
+ if (dev)
+ unlisted = !dev_get_by_index_rcu(sock_net(sk),
+ dev->ifindex);
+ }
po->num = protocol;
po->prot_hook.type = protocol;
- if (po->prot_hook.dev)
- dev_put(po->prot_hook.dev);
- po->prot_hook.dev = dev;
- po->ifindex = dev ? dev->ifindex : 0;
+ if (unlikely(unlisted)) {
+ dev_put(dev);
+ po->prot_hook.dev = NULL;
+ po->ifindex = -1;
+ } else {
+ po->prot_hook.dev = dev;
+ po->ifindex = dev ? dev->ifindex : 0;
+ }
+
+ if (dev_curr)
+ dev_put(dev_curr);
if (protocol == 0)
goto out_unlock;
- if (!dev || (dev->flags & IFF_UP)) {
+ if (!unlisted && (!dev || (dev->flags & IFF_UP))) {
register_prot_hook(sk);
} else {
sk->sk_err = ENETDOWN;
@@ -2503,9 +2540,10 @@ static int packet_do_bind(struct sock *s
}
out_unlock:
+ rcu_read_unlock();
spin_unlock(&po->bind_lock);
release_sock(sk);
- return 0;
+ return ret;
}
/*
@@ -2517,8 +2555,6 @@ static int packet_bind_spkt(struct socke
{
struct sock *sk = sock->sk;
char name[15];
- struct net_device *dev;
- int err = -ENODEV;
/*
* Check legality
@@ -2528,19 +2564,13 @@ static int packet_bind_spkt(struct socke
return -EINVAL;
strlcpy(name, uaddr->sa_data, sizeof(name));
- dev = dev_get_by_name(sock_net(sk), name);
- if (dev)
- err = packet_do_bind(sk, dev, pkt_sk(sk)->num);
- return err;
+ return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
}
static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
{
struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
struct sock *sk = sock->sk;
- struct net_device *dev = NULL;
- int err;
-
/*
* Check legality
@@ -2551,16 +2581,8 @@ static int packet_bind(struct socket *so
if (sll->sll_family != AF_PACKET)
return -EINVAL;
- if (sll->sll_ifindex) {
- err = -ENODEV;
- dev = dev_get_by_index(sock_net(sk), sll->sll_ifindex);
- if (dev == NULL)
- goto out;
- }
- err = packet_do_bind(sk, dev, sll->sll_protocol ? : pkt_sk(sk)->num);
-
-out:
- return err;
+ return packet_do_bind(sk, NULL, sll->sll_ifindex,
+ sll->sll_protocol ? : pkt_sk(sk)->num);
}
static struct proto packet_proto = {
^ permalink raw reply [flat|nested] 149+ messages in thread* [PATCH 3.2 141/147] scsi: advansys: remove #warning message
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (145 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 083/147] packet: race condition in packet_bind Ben Hutchings
@ 2017-11-06 23:03 ` Ben Hutchings
2017-11-07 14:18 ` [PATCH 3.2 000/147] 3.2.95-rc1 review Guenter Roeck
147 siblings, 0 replies; 149+ messages in thread
From: Ben Hutchings @ 2017-11-06 23:03 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Hannes Reinecke, Arnd Bergmann
3.2.95-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
The advansys driver was converted to the proper DMA API in linux-4.2, but
the 3.18-stable kernel still warns about this:
drivers/scsi/advansys.c:71:2: warning: #warning this driver is still not properly converted to the DMA API [-Wcpp]
The warning clearly is not helpful in 3.18 any more, it just clutters up
the build log. This removes the warning instead, and clarifies the
comment above it.
Cc: Hannes Reinecke <hare@suse.de>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
[bwh: Changed comment to say 3.2]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/advansys.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/scsi/advansys.c
+++ b/drivers/scsi/advansys.c
@@ -50,7 +50,7 @@
#include <scsi/scsi.h>
#include <scsi/scsi_host.h>
-/* FIXME:
+/* Fixed in linux-4.2, not backported to 3.2:
*
* 1. Although all of the necessary command mapping places have the
* appropriate dma_map.. APIs, the driver still processes its internal
@@ -69,7 +69,6 @@
* 7. advansys_info is not safe against multiple simultaneous callers
* 8. Add module_param to override ISA/VLB ioport array
*/
-#warning this driver is still not properly converted to the DMA API
/* Enable driver /proc statistics. */
#define ADVANSYS_STATS
^ permalink raw reply [flat|nested] 149+ messages in thread* Re: [PATCH 3.2 000/147] 3.2.95-rc1 review
2017-11-06 23:03 [PATCH 3.2 000/147] 3.2.95-rc1 review Ben Hutchings
` (146 preceding siblings ...)
2017-11-06 23:03 ` [PATCH 3.2 141/147] scsi: advansys: remove #warning message Ben Hutchings
@ 2017-11-07 14:18 ` Guenter Roeck
147 siblings, 0 replies; 149+ messages in thread
From: Guenter Roeck @ 2017-11-07 14:18 UTC (permalink / raw)
To: Ben Hutchings, linux-kernel, stable; +Cc: torvalds, akpm
On 11/06/2017 03:03 PM, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.2.95 release.
> There are 147 patches in this series, which will be posted as responses
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri Nov 08 18:00:00 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 86 pass: 86 fail: 0
Qemu test results:
total: 69 pass: 69 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 149+ messages in thread