* [PATCH 4.4 002/105] can: kvaser_usb: free buf in error paths
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 003/105] can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() Greg Kroah-Hartman
` (100 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jimmy Assarsson, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <jimmyassarsson@gmail.com>
commit 435019b48033138581a6171093b181fc6b4d3d30 upstream.
The allocated buffer was not freed if usb_submit_urb() failed.
Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/kvaser_usb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -809,6 +809,7 @@ static int kvaser_usb_simple_msg_async(s
if (err) {
netdev_err(netdev, "Error transmitting URB\n");
usb_unanchor_urb(urb);
+ kfree(buf);
usb_free_urb(urb);
return err;
}
@@ -1767,6 +1768,7 @@ static netdev_tx_t kvaser_usb_start_xmit
spin_unlock_irqrestore(&priv->tx_contexts_lock, flags);
usb_unanchor_urb(urb);
+ kfree(buf);
stats->tx_dropped++;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 003/105] can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 002/105] can: kvaser_usb: free buf in error paths Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 004/105] can: kvaser_usb: ratelimit errors if incomplete messages are received Greg Kroah-Hartman
` (99 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jimmy Assarsson, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <jimmyassarsson@gmail.com>
commit e84f44eb5523401faeb9cc1c97895b68e3cfb78d upstream.
The conditon in the while-loop becomes true when actual_length is less than
2 (MSG_HEADER_LEN). In best case we end up with a former, already
dispatched msg, that got msg->len greater than actual_length. This will
result in a "Format error" error printout.
Problem seen when unplugging a Kvaser USB device connected to a vbox guest.
warning: comparison between signed and unsigned integer expressions
[-Wsign-compare]
Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/kvaser_usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1330,7 +1330,7 @@ static void kvaser_usb_read_bulk_callbac
goto resubmit_urb;
}
- while (pos <= urb->actual_length - MSG_HEADER_LEN) {
+ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) {
msg = urb->transfer_buffer + pos;
/* The Kvaser firmware can only read and write messages that
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 004/105] can: kvaser_usb: ratelimit errors if incomplete messages are received
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 002/105] can: kvaser_usb: free buf in error paths Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 003/105] can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 005/105] can: kvaser_usb: cancel urb on -EPIPE and -EPROTO Greg Kroah-Hartman
` (98 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jimmy Assarsson, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jimmy Assarsson <jimmyassarsson@gmail.com>
commit 8bd13bd522ff7dfa0eb371921aeb417155f7a3be upstream.
Avoid flooding the kernel log with "Formate error", if incomplete message
are received.
Signed-off-by: Jimmy Assarsson <jimmyassarsson@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/kvaser_usb.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -603,8 +603,8 @@ static int kvaser_usb_wait_msg(const str
}
if (pos + tmp->len > actual_len) {
- dev_err(dev->udev->dev.parent,
- "Format error\n");
+ dev_err_ratelimited(dev->udev->dev.parent,
+ "Format error\n");
break;
}
@@ -1349,7 +1349,8 @@ static void kvaser_usb_read_bulk_callbac
}
if (pos + msg->len > urb->actual_length) {
- dev_err(dev->udev->dev.parent, "Format error\n");
+ dev_err_ratelimited(dev->udev->dev.parent,
+ "Format error\n");
break;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 005/105] can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 004/105] can: kvaser_usb: ratelimit errors if incomplete messages are received Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 006/105] can: ems_usb: " Greg Kroah-Hartman
` (97 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Kelly, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kelly <mkelly@xevo.com>
commit 6aa8d5945502baf4687d80de59b7ac865e9e666b upstream.
In mcba_usb, we have observed that when you unplug the device, the driver will
endlessly resubmit failing URBs, which can cause CPU stalls. This issue
is fixed in mcba_usb by catching the codes seen on device disconnect
(-EPIPE and -EPROTO).
This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
in the same way.
Signed-off-by: Martin Kelly <mkelly@xevo.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/kvaser_usb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/kvaser_usb.c
+++ b/drivers/net/can/usb/kvaser_usb.c
@@ -1322,6 +1322,8 @@ static void kvaser_usb_read_bulk_callbac
case 0:
break;
case -ENOENT:
+ case -EPIPE:
+ case -EPROTO:
case -ESHUTDOWN:
return;
default:
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 006/105] can: ems_usb: cancel urb on -EPIPE and -EPROTO
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 005/105] can: kvaser_usb: cancel urb on -EPIPE and -EPROTO Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 007/105] can: esd_usb2: " Greg Kroah-Hartman
` (96 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Kelly, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kelly <mkelly@xevo.com>
commit bd352e1adfe0d02d3ea7c8e3fb19183dc317e679 upstream.
In mcba_usb, we have observed that when you unplug the device, the driver will
endlessly resubmit failing URBs, which can cause CPU stalls. This issue
is fixed in mcba_usb by catching the codes seen on device disconnect
(-EPIPE and -EPROTO).
This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
in the same way.
Signed-off-by: Martin Kelly <mkelly@xevo.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/ems_usb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -290,6 +290,8 @@ static void ems_usb_read_interrupt_callb
case -ECONNRESET: /* unlink */
case -ENOENT:
+ case -EPIPE:
+ case -EPROTO:
case -ESHUTDOWN:
return;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 007/105] can: esd_usb2: cancel urb on -EPIPE and -EPROTO
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 006/105] can: ems_usb: " Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 008/105] can: usb_8dev: " Greg Kroah-Hartman
` (95 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Kelly, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kelly <mkelly@xevo.com>
commit 7a31ced3de06e9878e4f9c3abe8f87d9344d8144 upstream.
In mcba_usb, we have observed that when you unplug the device, the driver will
endlessly resubmit failing URBs, which can cause CPU stalls. This issue
is fixed in mcba_usb by catching the codes seen on device disconnect
(-EPIPE and -EPROTO).
This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
in the same way.
Signed-off-by: Martin Kelly <mkelly@xevo.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/esd_usb2.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(
break;
case -ENOENT:
+ case -EPIPE:
+ case -EPROTO:
case -ESHUTDOWN:
return;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 008/105] can: usb_8dev: cancel urb on -EPIPE and -EPROTO
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 007/105] can: esd_usb2: " Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 009/105] virtio: release virtio index when fail to device_register Greg Kroah-Hartman
` (94 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Martin Kelly, Marc Kleine-Budde
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kelly <mkelly@xevo.com>
commit 12147edc434c9e4c7c2f5fee2e5519b2e5ac34ce upstream.
In mcba_usb, we have observed that when you unplug the device, the driver will
endlessly resubmit failing URBs, which can cause CPU stalls. This issue
is fixed in mcba_usb by catching the codes seen on device disconnect
(-EPIPE and -EPROTO).
This driver also resubmits in the case of -EPIPE and -EPROTO, so fix it
in the same way.
Signed-off-by: Martin Kelly <mkelly@xevo.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/usb_8dev.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(
break;
case -ENOENT:
+ case -EPIPE:
+ case -EPROTO:
case -ESHUTDOWN:
return;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 009/105] virtio: release virtio index when fail to device_register
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 008/105] can: usb_8dev: " Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 010/105] hv: kvp: Avoid reading past allocated blocks from KVP file Greg Kroah-Hartman
` (93 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, weiping zhang, Cornelia Huck,
Michael S. Tsirkin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: weiping zhang <zwp10758@gmail.com>
commit e60ea67bb60459b95a50a156296041a13e0e380e upstream.
index can be reused by other virtio device.
Signed-off-by: weiping zhang <zhangweiping@didichuxing.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/virtio/virtio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/virtio/virtio.c
+++ b/drivers/virtio/virtio.c
@@ -323,6 +323,8 @@ int register_virtio_device(struct virtio
/* device_register() causes the bus infrastructure to look for a
* matching driver. */
err = device_register(&dev->dev);
+ if (err)
+ ida_simple_remove(&virtio_index_ida, dev->index);
out:
if (err)
add_status(dev, VIRTIO_CONFIG_S_FAILED);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 010/105] hv: kvp: Avoid reading past allocated blocks from KVP file
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 009/105] virtio: release virtio index when fail to device_register Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 011/105] isa: Prevent NULL dereference in isa_bus driver callbacks Greg Kroah-Hartman
` (92 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Meyer, Long Li, K. Y. Srinivasan
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Meyer <Paul.Meyer@microsoft.com>
commit 297d6b6e56c2977fc504c61bbeeaa21296923f89 upstream.
While reading in more than one block (50) of KVP records, the allocation
goes per block, but the reads used the total number of allocated records
(without resetting the pointer/stream). This causes the records buffer to
overrun when the refresh reads more than one block over the previous
capacity (e.g. reading more than 100 KVP records whereas the in-memory
database was empty before).
Fix this by reading the correct number of KVP records from file each time.
Signed-off-by: Paul Meyer <Paul.Meyer@microsoft.com>
Signed-off-by: Long Li <longli@microsoft.com>
Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/hv/hv_kvp_daemon.c | 70 +++++++++--------------------------------------
1 file changed, 14 insertions(+), 56 deletions(-)
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -193,11 +193,14 @@ static void kvp_update_mem_state(int poo
for (;;) {
readp = &record[records_read];
records_read += fread(readp, sizeof(struct kvp_record),
- ENTRIES_PER_BLOCK * num_blocks,
- filep);
+ ENTRIES_PER_BLOCK * num_blocks - records_read,
+ filep);
if (ferror(filep)) {
- syslog(LOG_ERR, "Failed to read file, pool: %d", pool);
+ syslog(LOG_ERR,
+ "Failed to read file, pool: %d; error: %d %s",
+ pool, errno, strerror(errno));
+ kvp_release_lock(pool);
exit(EXIT_FAILURE);
}
@@ -210,6 +213,7 @@ static void kvp_update_mem_state(int poo
if (record == NULL) {
syslog(LOG_ERR, "malloc failed");
+ kvp_release_lock(pool);
exit(EXIT_FAILURE);
}
continue;
@@ -224,15 +228,11 @@ static void kvp_update_mem_state(int poo
fclose(filep);
kvp_release_lock(pool);
}
+
static int kvp_file_init(void)
{
int fd;
- FILE *filep;
- size_t records_read;
char *fname;
- struct kvp_record *record;
- struct kvp_record *readp;
- int num_blocks;
int i;
int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK;
@@ -246,61 +246,19 @@ static int kvp_file_init(void)
for (i = 0; i < KVP_POOL_COUNT; i++) {
fname = kvp_file_info[i].fname;
- records_read = 0;
- num_blocks = 1;
sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i);
fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */);
if (fd == -1)
return 1;
-
- filep = fopen(fname, "re");
- if (!filep) {
- close(fd);
- return 1;
- }
-
- record = malloc(alloc_unit * num_blocks);
- if (record == NULL) {
- fclose(filep);
- close(fd);
- return 1;
- }
- for (;;) {
- readp = &record[records_read];
- records_read += fread(readp, sizeof(struct kvp_record),
- ENTRIES_PER_BLOCK,
- filep);
-
- if (ferror(filep)) {
- syslog(LOG_ERR, "Failed to read file, pool: %d",
- i);
- exit(EXIT_FAILURE);
- }
-
- if (!feof(filep)) {
- /*
- * We have more data to read.
- */
- num_blocks++;
- record = realloc(record, alloc_unit *
- num_blocks);
- if (record == NULL) {
- fclose(filep);
- close(fd);
- return 1;
- }
- continue;
- }
- break;
- }
kvp_file_info[i].fd = fd;
- kvp_file_info[i].num_blocks = num_blocks;
- kvp_file_info[i].records = record;
- kvp_file_info[i].num_records = records_read;
- fclose(filep);
-
+ kvp_file_info[i].num_blocks = 1;
+ kvp_file_info[i].records = malloc(alloc_unit);
+ if (kvp_file_info[i].records == NULL)
+ return 1;
+ kvp_file_info[i].num_records = 0;
+ kvp_update_mem_state(i);
}
return 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 011/105] isa: Prevent NULL dereference in isa_bus driver callbacks
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 010/105] hv: kvp: Avoid reading past allocated blocks from KVP file Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 012/105] scsi: libsas: align sata_devices rps_resp on a cacheline Greg Kroah-Hartman
` (91 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, William Breathitt Gray, Linus Torvalds
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Breathitt Gray <vilhelm.gray@gmail.com>
commit 5a244727f428a06634f22bb890e78024ab0c89f3 upstream.
The isa_driver structure for an isa_bus device is stored in the device
platform_data member of the respective device structure. This
platform_data member may be reset to NULL if isa_driver match callback
for the device fails, indicating a device unsupported by the ISA driver.
This patch fixes a possible NULL pointer dereference if one of the
isa_driver callbacks to attempted for an unsupported device. This error
should not occur in practice since ISA devices are typically manually
configured and loaded by the users, but we may as well prevent this
error from popping up for the 0day testers.
Fixes: a5117ba7da37 ("[PATCH] Driver model: add ISA bus")
Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/isa.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/base/isa.c
+++ b/drivers/base/isa.c
@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *
{
struct isa_driver *isa_driver = dev->platform_data;
- if (isa_driver->probe)
+ if (isa_driver && isa_driver->probe)
return isa_driver->probe(dev, to_isa_dev(dev)->id);
return 0;
@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device
{
struct isa_driver *isa_driver = dev->platform_data;
- if (isa_driver->remove)
+ if (isa_driver && isa_driver->remove)
return isa_driver->remove(dev, to_isa_dev(dev)->id);
return 0;
@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct devi
{
struct isa_driver *isa_driver = dev->platform_data;
- if (isa_driver->shutdown)
+ if (isa_driver && isa_driver->shutdown)
isa_driver->shutdown(dev, to_isa_dev(dev)->id);
}
@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device
{
struct isa_driver *isa_driver = dev->platform_data;
- if (isa_driver->suspend)
+ if (isa_driver && isa_driver->suspend)
return isa_driver->suspend(dev, to_isa_dev(dev)->id, state);
return 0;
@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device
{
struct isa_driver *isa_driver = dev->platform_data;
- if (isa_driver->resume)
+ if (isa_driver && isa_driver->resume)
return isa_driver->resume(dev, to_isa_dev(dev)->id);
return 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 012/105] scsi: libsas: align sata_devices rps_resp on a cacheline
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 011/105] isa: Prevent NULL dereference in isa_bus driver callbacks Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 013/105] efi: Move some sysfs files to be read-only by root Greg Kroah-Hartman
` (90 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Huacai Chen, Christoph Hellwig,
Martin K. Petersen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Huacai Chen <chenhc@lemote.com>
commit c2e8fbf908afd81ad502b567a6639598f92c9b9d upstream.
The rps_resp buffer in ata_device is a DMA target, but it isn't
explicitly cacheline aligned. Due to this, adjacent fields can be
overwritten with stale data from memory on non-coherent architectures.
As a result, the kernel is sometimes unable to communicate with an SATA
device behind a SAS expander.
Fix this by ensuring that the rps_resp buffer is cacheline aligned.
This issue is similar to that fixed by Commit 84bda12af31f93 ("libata:
align ap->sector_buf") and Commit 4ee34ea3a12396f35b26 ("libata: Align
ata_device's id on a cacheline").
Signed-off-by: Huacai Chen <chenhc@lemote.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/scsi/libsas.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -165,11 +165,11 @@ struct expander_device {
struct sata_device {
unsigned int class;
- struct smp_resp rps_resp; /* report_phy_sata_resp */
u8 port_no; /* port number, if this is a PM (Port) */
struct ata_port *ap;
struct ata_host ata_host;
+ struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */
u8 fis[ATA_RESP_FIS_SIZE];
};
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 013/105] efi: Move some sysfs files to be read-only by root
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 012/105] scsi: libsas: align sata_devices rps_resp on a cacheline Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 014/105] ASN.1: fix out-of-bounds read when parsing indefinite length item Greg Kroah-Hartman
` (89 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Dave Young,
Ard Biesheuvel, H. Peter Anvin, Matt Fleming, Peter Zijlstra,
Thomas Gleixner, linux-efi, Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit af97a77bc01ce49a466f9d4c0125479e2e2230b6 upstream.
Thanks to the scripts/leaking_addresses.pl script, it was found that
some EFI values should not be readable by non-root users.
So make them root-only, and to do that, add a __ATTR_RO_MODE() macro to
make this easier, and use it in other places at the same time.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Tested-by: Dave Young <dyoung@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/20171206095010.24170-2-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/efi.c | 3 +--
drivers/firmware/efi/esrt.c | 15 ++++++---------
drivers/firmware/efi/runtime-map.c | 10 +++++-----
include/linux/sysfs.h | 6 ++++++
4 files changed, 18 insertions(+), 16 deletions(-)
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -113,8 +113,7 @@ static ssize_t systab_show(struct kobjec
return str - buf;
}
-static struct kobj_attribute efi_attr_systab =
- __ATTR(systab, 0400, systab_show, NULL);
+static struct kobj_attribute efi_attr_systab = __ATTR_RO_MODE(systab, 0400);
#define EFI_FIELD(var) efi.var
--- a/drivers/firmware/efi/esrt.c
+++ b/drivers/firmware/efi/esrt.c
@@ -105,7 +105,7 @@ static const struct sysfs_ops esre_attr_
};
/* Generic ESRT Entry ("ESRE") support. */
-static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf)
+static ssize_t fw_class_show(struct esre_entry *entry, char *buf)
{
char *str = buf;
@@ -116,18 +116,16 @@ static ssize_t esre_fw_class_show(struct
return str - buf;
}
-static struct esre_attribute esre_fw_class = __ATTR(fw_class, 0400,
- esre_fw_class_show, NULL);
+static struct esre_attribute esre_fw_class = __ATTR_RO_MODE(fw_class, 0400);
#define esre_attr_decl(name, size, fmt) \
-static ssize_t esre_##name##_show(struct esre_entry *entry, char *buf) \
+static ssize_t name##_show(struct esre_entry *entry, char *buf) \
{ \
return sprintf(buf, fmt "\n", \
le##size##_to_cpu(entry->esre.esre1->name)); \
} \
\
-static struct esre_attribute esre_##name = __ATTR(name, 0400, \
- esre_##name##_show, NULL)
+static struct esre_attribute esre_##name = __ATTR_RO_MODE(name, 0400)
esre_attr_decl(fw_type, 32, "%u");
esre_attr_decl(fw_version, 32, "%u");
@@ -195,14 +193,13 @@ static int esre_create_sysfs_entry(void
/* support for displaying ESRT fields at the top level */
#define esrt_attr_decl(name, size, fmt) \
-static ssize_t esrt_##name##_show(struct kobject *kobj, \
+static ssize_t name##_show(struct kobject *kobj, \
struct kobj_attribute *attr, char *buf)\
{ \
return sprintf(buf, fmt "\n", le##size##_to_cpu(esrt->name)); \
} \
\
-static struct kobj_attribute esrt_##name = __ATTR(name, 0400, \
- esrt_##name##_show, NULL)
+static struct kobj_attribute esrt_##name = __ATTR_RO_MODE(name, 0400)
esrt_attr_decl(fw_resource_count, 32, "%u");
esrt_attr_decl(fw_resource_count_max, 32, "%u");
--- a/drivers/firmware/efi/runtime-map.c
+++ b/drivers/firmware/efi/runtime-map.c
@@ -67,11 +67,11 @@ static ssize_t map_attr_show(struct kobj
return map_attr->show(entry, buf);
}
-static struct map_attribute map_type_attr = __ATTR_RO(type);
-static struct map_attribute map_phys_addr_attr = __ATTR_RO(phys_addr);
-static struct map_attribute map_virt_addr_attr = __ATTR_RO(virt_addr);
-static struct map_attribute map_num_pages_attr = __ATTR_RO(num_pages);
-static struct map_attribute map_attribute_attr = __ATTR_RO(attribute);
+static struct map_attribute map_type_attr = __ATTR_RO_MODE(type, 0400);
+static struct map_attribute map_phys_addr_attr = __ATTR_RO_MODE(phys_addr, 0400);
+static struct map_attribute map_virt_addr_attr = __ATTR_RO_MODE(virt_addr, 0400);
+static struct map_attribute map_num_pages_attr = __ATTR_RO_MODE(num_pages, 0400);
+static struct map_attribute map_attribute_attr = __ATTR_RO_MODE(attribute, 0400);
/*
* These are default attributes that are added for every memmap entry.
--- a/include/linux/sysfs.h
+++ b/include/linux/sysfs.h
@@ -116,6 +116,12 @@ struct attribute_group {
.show = _name##_show, \
}
+#define __ATTR_RO_MODE(_name, _mode) { \
+ .attr = { .name = __stringify(_name), \
+ .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \
+ .show = _name##_show, \
+}
+
#define __ATTR_WO(_name) { \
.attr = { .name = __stringify(_name), .mode = S_IWUSR }, \
.store = _name##_store, \
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 014/105] ASN.1: fix out-of-bounds read when parsing indefinite length item
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 013/105] efi: Move some sysfs files to be read-only by root Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 015/105] ASN.1: check for error from ASN1_OP_END__ACT actions Greg Kroah-Hartman
` (88 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexander Potapenko, Eric Biggers,
David Howells
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit e0058f3a874ebb48b25be7ff79bc3b4e59929f90 upstream.
In asn1_ber_decoder(), indefinitely-sized ASN.1 items were being passed
to the action functions before their lengths had been computed, using
the bogus length of 0x80 (ASN1_INDEFINITE_LENGTH). This resulted in
reading data past the end of the input buffer, when given a specially
crafted message.
Fix it by rearranging the code so that the indefinite length is resolved
before the action is called.
This bug was originally found by fuzzing the X.509 parser in userspace
using libFuzzer from the LLVM project.
KASAN report (cleaned up slightly):
BUG: KASAN: slab-out-of-bounds in memcpy ./include/linux/string.h:341 [inline]
BUG: KASAN: slab-out-of-bounds in x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366
Read of size 128 at addr ffff880035dd9eaf by task keyctl/195
CPU: 1 PID: 195 Comm: keyctl Not tainted 4.14.0-09238-g1d3b78bbc6e9 #26
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0xd1/0x175 lib/dump_stack.c:53
print_address_description+0x78/0x260 mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report+0x23f/0x350 mm/kasan/report.c:409
memcpy+0x1f/0x50 mm/kasan/kasan.c:302
memcpy ./include/linux/string.h:341 [inline]
x509_fabricate_name.constprop.1+0x1a4/0x940 crypto/asymmetric_keys/x509_cert_parser.c:366
asn1_ber_decoder+0xb4a/0x1fd0 lib/asn1_decoder.c:447
x509_cert_parse+0x1c7/0x620 crypto/asymmetric_keys/x509_cert_parser.c:89
x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174
asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388
key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850
SYSC_add_key security/keys/keyctl.c:122 [inline]
SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62
entry_SYSCALL_64_fastpath+0x1f/0x96
Allocated by task 195:
__do_kmalloc_node mm/slab.c:3675 [inline]
__kmalloc_node+0x47/0x60 mm/slab.c:3682
kvmalloc ./include/linux/mm.h:540 [inline]
SYSC_add_key security/keys/keyctl.c:104 [inline]
SyS_add_key+0x19e/0x290 security/keys/keyctl.c:62
entry_SYSCALL_64_fastpath+0x1f/0x96
Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Reported-by: Alexander Potapenko <glider@google.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/asn1_decoder.c | 47 ++++++++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 21 deletions(-)
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -312,42 +312,47 @@ next_op:
/* Decide how to handle the operation */
switch (op) {
- case ASN1_OP_MATCH_ANY_ACT:
- case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
- case ASN1_OP_COND_MATCH_ANY_ACT:
- case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
- ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len);
- if (ret < 0)
- return ret;
- goto skip_data;
-
- case ASN1_OP_MATCH_ACT:
- case ASN1_OP_MATCH_ACT_OR_SKIP:
- case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
- ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len);
- if (ret < 0)
- return ret;
- goto skip_data;
-
case ASN1_OP_MATCH:
case ASN1_OP_MATCH_OR_SKIP:
+ case ASN1_OP_MATCH_ACT:
+ case ASN1_OP_MATCH_ACT_OR_SKIP:
case ASN1_OP_MATCH_ANY:
case ASN1_OP_MATCH_ANY_OR_SKIP:
+ case ASN1_OP_MATCH_ANY_ACT:
+ case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
case ASN1_OP_COND_MATCH_OR_SKIP:
+ case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
case ASN1_OP_COND_MATCH_ANY:
case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
- skip_data:
+ case ASN1_OP_COND_MATCH_ANY_ACT:
+ case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
+
if (!(flags & FLAG_CONS)) {
if (flags & FLAG_INDEFINITE_LENGTH) {
+ size_t tmp = dp;
+
ret = asn1_find_indefinite_length(
- data, datalen, &dp, &len, &errmsg);
+ data, datalen, &tmp, &len, &errmsg);
if (ret < 0)
goto error;
- } else {
- dp += len;
}
pr_debug("- LEAF: %zu\n", len);
}
+
+ if (op & ASN1_OP_MATCH__ACT) {
+ unsigned char act;
+
+ if (op & ASN1_OP_MATCH__ANY)
+ act = machine[pc + 1];
+ else
+ act = machine[pc + 2];
+ ret = actions[act](context, hdr, tag, data + dp, len);
+ if (ret < 0)
+ return ret;
+ }
+
+ if (!(flags & FLAG_CONS))
+ dp += len;
pc += asn1_op_lengths[op];
goto next_op;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 015/105] ASN.1: check for error from ASN1_OP_END__ACT actions
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 014/105] ASN.1: fix out-of-bounds read when parsing indefinite length item Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 016/105] X.509: reject invalid BIT STRING for subjectPublicKey Greg Kroah-Hartman
` (87 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Biggers, David Howells, James Morris
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 81a7be2cd69b412ab6aeacfe5ebf1bb6e5bce955 upstream.
asn1_ber_decoder() was ignoring errors from actions associated with the
opcodes ASN1_OP_END_SEQ_ACT, ASN1_OP_END_SET_ACT,
ASN1_OP_END_SEQ_OF_ACT, and ASN1_OP_END_SET_OF_ACT. In practice, this
meant the pkcs7_note_signed_info() action (since that was the only user
of those opcodes). Fix it by checking for the error, just like the
decoder does for actions associated with the other opcodes.
This bug allowed users to leak slab memory by repeatedly trying to add a
specially crafted "pkcs7_test" key (requires CONFIG_PKCS7_TEST_KEY).
In theory, this bug could also be used to bypass module signature
verification, by providing a PKCS#7 message that is misparsed such that
a signature's ->authattrs do not contain its ->msgdigest. But it
doesn't seem practical in normal cases, due to restrictions on the
format of the ->authattrs.
Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/asn1_decoder.c | 2 ++
1 file changed, 2 insertions(+)
--- a/lib/asn1_decoder.c
+++ b/lib/asn1_decoder.c
@@ -438,6 +438,8 @@ next_op:
else
act = machine[pc + 1];
ret = actions[act](context, hdr, 0, data + tdp, len);
+ if (ret < 0)
+ return ret;
}
pc += asn1_op_lengths[op];
goto next_op;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 016/105] X.509: reject invalid BIT STRING for subjectPublicKey
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 015/105] ASN.1: check for error from ASN1_OP_END__ACT actions Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 017/105] x86/PCI: Make broadcom_postcore_init() check acpi_disabled Greg Kroah-Hartman
` (86 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Biggers, David Howells, James Morris
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 0f30cbea005bd3077bd98cd29277d7fc2699c1da upstream.
Adding a specially crafted X.509 certificate whose subjectPublicKey
ASN.1 value is zero-length caused x509_extract_key_data() to set the
public key size to SIZE_MAX, as it subtracted the nonexistent BIT STRING
metadata byte. Then, x509_cert_parse() called kmemdup() with that bogus
size, triggering the WARN_ON_ONCE() in kmalloc_slab().
This appears to be harmless, but it still must be fixed since WARNs are
never supposed to be user-triggerable.
Fix it by updating x509_cert_parse() to validate that the value has a
BIT STRING metadata byte, and that the byte is 0 which indicates that
the number of bits in the bitstring is a multiple of 8.
It would be nice to handle the metadata byte in asn1_ber_decoder()
instead. But that would be tricky because in the general case a BIT
STRING could be implicitly tagged, and/or could legitimately have a
length that is not a whole number of bytes.
Here was the WARN (cleaned up slightly):
WARNING: CPU: 1 PID: 202 at mm/slab_common.c:971 kmalloc_slab+0x5d/0x70 mm/slab_common.c:971
Modules linked in:
CPU: 1 PID: 202 Comm: keyctl Tainted: G B 4.14.0-09238-g1d3b78bbc6e9 #26
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-20171110_100015-anatol 04/01/2014
task: ffff880033014180 task.stack: ffff8800305c8000
Call Trace:
__do_kmalloc mm/slab.c:3706 [inline]
__kmalloc_track_caller+0x22/0x2e0 mm/slab.c:3726
kmemdup+0x17/0x40 mm/util.c:118
kmemdup include/linux/string.h:414 [inline]
x509_cert_parse+0x2cb/0x620 crypto/asymmetric_keys/x509_cert_parser.c:106
x509_key_preparse+0x61/0x750 crypto/asymmetric_keys/x509_public_key.c:174
asymmetric_key_preparse+0xa4/0x150 crypto/asymmetric_keys/asymmetric_type.c:388
key_create_or_update+0x4d4/0x10a0 security/keys/key.c:850
SYSC_add_key security/keys/keyctl.c:122 [inline]
SyS_add_key+0xe8/0x290 security/keys/keyctl.c:62
entry_SYSCALL_64_fastpath+0x1f/0x96
Fixes: 42d5ec27f873 ("X.509: Add an ASN.1 decoder")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/asymmetric_keys/x509_cert_parser.c | 2 ++
1 file changed, 2 insertions(+)
--- a/crypto/asymmetric_keys/x509_cert_parser.c
+++ b/crypto/asymmetric_keys/x509_cert_parser.c
@@ -399,6 +399,8 @@ int x509_extract_key_data(void *context,
ctx->cert->pub->pkey_algo = PKEY_ALGO_RSA;
/* Discard the BIT STRING metadata */
+ if (vlen < 1 || *(const u8 *)value != 0)
+ return -EBADMSG;
ctx->key = value + 1;
ctx->key_size = vlen - 1;
return 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 017/105] x86/PCI: Make broadcom_postcore_init() check acpi_disabled
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 016/105] X.509: reject invalid BIT STRING for subjectPublicKey Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 018/105] ALSA: pcm: prevent UAF in snd_pcm_info Greg Kroah-Hartman
` (85 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Hansen, Rafael J. Wysocki,
Thomas Gleixner, Bjorn Helgaas, Linux PCI, Ingo Molnar
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit ddec3bdee05b06f1dda20ded003c3e10e4184cab upstream.
acpi_os_get_root_pointer() may return a valid address even if acpi_disabled
is set, but the host bridge information from the ACPI tables is not going
to be used in that case and the Broadcom host bridge initialization should
not be skipped then, So make broadcom_postcore_init() check acpi_disabled
too to avoid this issue.
Fixes: 6361d72b04d1 (x86/PCI: read Broadcom CNB20LE host bridge info before PCI scan)
Reported-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Linux PCI <linux-pci@vger.kernel.org>
Link: https://lkml.kernel.org/r/3186627.pxZj1QbYNg@aspire.rjw.lan
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/pci/broadcom_bus.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/pci/broadcom_bus.c
+++ b/arch/x86/pci/broadcom_bus.c
@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init
* We should get host bridge information from ACPI unless the BIOS
* doesn't support it.
*/
- if (acpi_os_get_root_pointer())
+ if (!acpi_disabled && acpi_os_get_root_pointer())
return 0;
#endif
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 018/105] ALSA: pcm: prevent UAF in snd_pcm_info
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 017/105] x86/PCI: Make broadcom_postcore_init() check acpi_disabled Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 019/105] ALSA: seq: Remove spurious WARN_ON() at timer check Greg Kroah-Hartman
` (84 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Robb Glasser, Nick Desaulniers, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robb Glasser <rglasser@google.com>
commit 362bca57f5d78220f8b5907b875961af9436e229 upstream.
When the device descriptor is closed, the `substream->runtime` pointer
is freed. But another thread may be in the ioctl handler, case
SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
calls snd_pcm_info() which accesses the now freed `substream->runtime`.
Note: this fixes CVE-2017-0861
Signed-off-by: Robb Glasser <rglasser@google.com>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm.c | 2 ++
1 file changed, 2 insertions(+)
--- a/sound/core/pcm.c
+++ b/sound/core/pcm.c
@@ -149,7 +149,9 @@ static int snd_pcm_control_ioctl(struct
err = -ENXIO;
goto _error;
}
+ mutex_lock(&pcm->open_mutex);
err = snd_pcm_info_user(substream, info);
+ mutex_unlock(&pcm->open_mutex);
_error:
mutex_unlock(®ister_mutex);
return err;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 019/105] ALSA: seq: Remove spurious WARN_ON() at timer check
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 018/105] ALSA: pcm: prevent UAF in snd_pcm_info Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 020/105] ALSA: usb-audio: Fix out-of-bound error Greg Kroah-Hartman
` (83 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, syzbot, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 43a3542870328601be02fcc9d27b09db467336ef upstream.
The use of snd_BUG_ON() in ALSA sequencer timer may lead to a spurious
WARN_ON() when a slave timer is deployed as its backend and a
corresponding master timer stops meanwhile. The symptom was triggered
by syzkaller spontaneously.
Since the NULL timer is valid there, rip off snd_BUG_ON().
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/seq/seq_timer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/core/seq/seq_timer.c
+++ b/sound/core/seq/seq_timer.c
@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_s
unsigned long freq;
t = tmr->timeri->timer;
- if (snd_BUG_ON(!t))
+ if (!t)
return -EINVAL;
freq = tmr->preferred_resolution;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 020/105] ALSA: usb-audio: Fix out-of-bound error
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 019/105] ALSA: seq: Remove spurious WARN_ON() at timer check Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 021/105] ALSA: usb-audio: Add check return value for usb_string() Greg Kroah-Hartman
` (82 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaejoong Kim, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaejoong Kim <climbbb.kim@gmail.com>
commit 251552a2b0d454badc8f486e6d79100970c744b0 upstream.
The snd_usb_copy_string_desc() retrieves the usb string corresponding to
the index number through the usb_string(). The problem is that the
usb_string() returns the length of the string (>= 0) when successful, but
it can also return a negative value about the error case or status of
usb_control_msg().
If iClockSource is '0' as shown below, usb_string() will returns -EINVAL.
This will result in '0' being inserted into buf[-22], and the following
KASAN out-of-bound error message will be output.
AudioControl Interface Descriptor:
bLength 8
bDescriptorType 36
bDescriptorSubtype 10 (CLOCK_SOURCE)
bClockID 1
bmAttributes 0x07 Internal programmable Clock (synced to SOF)
bmControls 0x07
Clock Frequency Control (read/write)
Clock Validity Control (read-only)
bAssocTerminal 0
iClockSource 0
To fix it, check usb_string()'return value and bail out.
==================================================================
BUG: KASAN: stack-out-of-bounds in parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
Write of size 1 at addr ffff88007e66735a by task systemd-udevd/18376
CPU: 0 PID: 18376 Comm: systemd-udevd Not tainted 4.13.0+ #3
Hardware name: LG Electronics 15N540-RFLGL/White Tip Mountain, BIOS 15N5
Call Trace:
dump_stack+0x63/0x8d
print_address_description+0x70/0x290
? parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
kasan_report+0x265/0x350
__asan_store1+0x4a/0x50
parse_audio_unit+0x1327/0x1960 [snd_usb_audio]
? save_stack+0xb5/0xd0
? save_stack_trace+0x1b/0x20
? save_stack+0x46/0xd0
? kasan_kmalloc+0xad/0xe0
? kmem_cache_alloc_trace+0xff/0x230
? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio]
? usb_audio_probe+0x4de/0xf40 [snd_usb_audio]
? usb_probe_interface+0x1f5/0x440
? driver_probe_device+0x3ed/0x660
? build_feature_ctl+0xb10/0xb10 [snd_usb_audio]
? save_stack_trace+0x1b/0x20
? init_object+0x69/0xa0
? snd_usb_find_csint_desc+0xa8/0xf0 [snd_usb_audio]
snd_usb_mixer_controls+0x1dc/0x370 [snd_usb_audio]
? build_audio_procunit+0x890/0x890 [snd_usb_audio]
? snd_usb_create_mixer+0xb0/0x4b0 [snd_usb_audio]
? kmem_cache_alloc_trace+0xff/0x230
? usb_ifnum_to_if+0xbd/0xf0
snd_usb_create_mixer+0x25b/0x4b0 [snd_usb_audio]
? snd_usb_create_stream+0x255/0x2c0 [snd_usb_audio]
usb_audio_probe+0x4de/0xf40 [snd_usb_audio]
? snd_usb_autosuspend.part.7+0x30/0x30 [snd_usb_audio]
? __pm_runtime_idle+0x90/0x90
? kernfs_activate+0xa6/0xc0
? usb_match_one_id_intf+0xdc/0x130
? __pm_runtime_set_status+0x2d4/0x450
usb_probe_interface+0x1f5/0x440
Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -203,6 +203,10 @@ static int snd_usb_copy_string_desc(stru
int index, char *buf, int maxlen)
{
int len = usb_string(state->chip->dev, index, buf, maxlen - 1);
+
+ if (len < 0)
+ return 0;
+
buf[len] = 0;
return len;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 021/105] ALSA: usb-audio: Add check return value for usb_string()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 020/105] ALSA: usb-audio: Fix out-of-bound error Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 022/105] iommu/vt-d: Fix scatterlist offset handling Greg Kroah-Hartman
` (81 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jaejoong Kim, Takashi Iwai
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaejoong Kim <climbbb.kim@gmail.com>
commit 89b89d121ffcf8d9546633b98ded9d18b8f75891 upstream.
snd_usb_copy_string_desc() returns zero if usb_string() fails.
In case of failure, we need to check the snd_usb_copy_string_desc()'s
return value and add an exception case
Signed-off-by: Jaejoong Kim <climbbb.kim@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/mixer.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2106,13 +2106,14 @@ static int parse_audio_selector_unit(str
if (len)
;
else if (nameid)
- snd_usb_copy_string_desc(state, nameid, kctl->id.name,
+ len = snd_usb_copy_string_desc(state, nameid, kctl->id.name,
sizeof(kctl->id.name));
- else {
+ else
len = get_term_name(state, &state->oterm,
kctl->id.name, sizeof(kctl->id.name), 0);
- if (!len)
- strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));
+
+ if (!len) {
+ strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name));
if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR)
append_ctl_name(kctl, " Clock Source");
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 022/105] iommu/vt-d: Fix scatterlist offset handling
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 021/105] ALSA: usb-audio: Add check return value for usb_string() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 023/105] s390: fix compat system call table Greg Kroah-Hartman
` (80 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Harsh Jain, Robin Murphy, Alex Williamson
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robin Murphy <robin.murphy@arm.com>
commit 29a90b70893817e2f2bb3cea40a29f5308e21b21 upstream.
The intel-iommu DMA ops fail to correctly handle scatterlists where
sg->offset is greater than PAGE_SIZE - the IOVA allocation is computed
appropriately based on the page-aligned portion of the offset, but the
mapping is set up relative to sg->page, which means it fails to actually
cover the whole buffer (and in the worst case doesn't cover it at all):
(sg->dma_address + sg->dma_len) ----+
sg->dma_address ---------+ |
iov_pfn------+ | |
| | |
v v v
iova: a b c d e f
|--------|--------|--------|--------|--------|
<...calculated....>
[_____mapped______]
pfn: 0 1 2 3 4 5
|--------|--------|--------|--------|--------|
^ ^ ^
| | |
sg->page ----+ | |
sg->offset --------------+ |
(sg->offset + sg->length) ----------+
As a result, the caller ends up overrunning the mapping into whatever
lies beyond, which usually goes badly:
[ 429.645492] DMAR: DRHD: handling fault status reg 2
[ 429.650847] DMAR: [DMA Write] Request device [02:00.4] fault addr f2682000 ...
Whilst this is a fairly rare occurrence, it can happen from the result
of intermediate scatterlist processing such as scatterwalk_ffwd() in the
crypto layer. Whilst that particular site could be fixed up, it still
seems worthwhile to bring intel-iommu in line with other DMA API
implementations in handling this robustly.
To that end, fix the intel_map_sg() path to line up the mapping
correctly (in units of MM pages rather than VT-d pages to match the
aligned_nrpages() calculation) regardless of the offset, and use
sg_phys() consistently for clarity.
Reported-by: Harsh Jain <Harsh@chelsio.com>
Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Reviewed by: Ashok Raj <ashok.raj@intel.com>
Tested by: Jacob Pan <jacob.jun.pan@intel.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/intel-iommu.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -2201,10 +2201,12 @@ static int __domain_mapping(struct dmar_
uint64_t tmp;
if (!sg_res) {
+ unsigned int pgoff = sg->offset & ~PAGE_MASK;
+
sg_res = aligned_nrpages(sg->offset, sg->length);
- sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
+ sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff;
sg->dma_length = sg->length;
- pteval = page_to_phys(sg_page(sg)) | prot;
+ pteval = (sg_phys(sg) - pgoff) | prot;
phys_pfn = pteval >> VTD_PAGE_SHIFT;
}
@@ -3757,7 +3759,7 @@ static int intel_nontranslate_map_sg(str
for_each_sg(sglist, sg, nelems, i) {
BUG_ON(!sg_page(sg));
- sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset;
+ sg->dma_address = sg_phys(sg);
sg->dma_length = sg->length;
}
return nelems;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 023/105] s390: fix compat system call table
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 022/105] iommu/vt-d: Fix scatterlist offset handling Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 024/105] kdb: Fix handling of kallsyms_symbol_next() return value Greg Kroah-Hartman
` (79 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit e779498df587dd2189b30fe5b9245aefab870eb8 upstream.
When wiring up the socket system calls the compat entries were
incorrectly set. Not all of them point to the corresponding compat
wrapper functions, which clear the upper 33 bits of user space
pointers, like it is required.
Fixes: 977108f89c989 ("s390: wire up separate socketcalls system calls")
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/syscalls.S | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -369,10 +369,10 @@ SYSCALL(sys_recvmmsg,compat_sys_recvmmsg
SYSCALL(sys_sendmmsg,compat_sys_sendmmsg)
SYSCALL(sys_socket,sys_socket)
SYSCALL(sys_socketpair,compat_sys_socketpair) /* 360 */
-SYSCALL(sys_bind,sys_bind)
-SYSCALL(sys_connect,sys_connect)
+SYSCALL(sys_bind,compat_sys_bind)
+SYSCALL(sys_connect,compat_sys_connect)
SYSCALL(sys_listen,sys_listen)
-SYSCALL(sys_accept4,sys_accept4)
+SYSCALL(sys_accept4,compat_sys_accept4)
SYSCALL(sys_getsockopt,compat_sys_getsockopt) /* 365 */
SYSCALL(sys_setsockopt,compat_sys_setsockopt)
SYSCALL(sys_getsockname,compat_sys_getsockname)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 024/105] kdb: Fix handling of kallsyms_symbol_next() return value
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 023/105] s390: fix compat system call table Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 025/105] drm: extra printk() wrapper macros Greg Kroah-Hartman
` (78 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Daniel Thompson, Jason Wessel
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Thompson <daniel.thompson@linaro.org>
commit c07d35338081d107e57cf37572d8cc931a8e32e2 upstream.
kallsyms_symbol_next() returns a boolean (true on success). Currently
kdb_read() tests the return value with an inequality that
unconditionally evaluates to true.
This is fixed in the obvious way and, since the conditional branch is
supposed to be unreachable, we also add a WARN_ON().
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Thompson <daniel.thompson@linaro.org>
Signed-off-by: Jason Wessel <jason.wessel@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/debug/kdb/kdb_io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c
@@ -349,7 +349,7 @@ poll_again:
}
kdb_printf("\n");
for (i = 0; i < count; i++) {
- if (kallsyms_symbol_next(p_tmp, i) < 0)
+ if (WARN_ON(!kallsyms_symbol_next(p_tmp, i)))
break;
kdb_printf("%s ", p_tmp);
*(p_tmp + len) = '\0';
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 025/105] drm: extra printk() wrapper macros
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 024/105] kdb: Fix handling of kallsyms_symbol_next() return value Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 026/105] drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU Greg Kroah-Hartman
` (77 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Gordon, Eric Engestrom,
dri-devel, Dave Airlie, Tvrtko Ursulin, Arnd Bergmann
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Gordon <david.s.gordon@intel.com>
commit 30b0da8d556e65ff935a56cd82c05ba0516d3e4a upstream.
We had only DRM_INFO() and DRM_ERROR(), whereas the underlying printk()
provides several other useful intermediate levels such as NOTICE and
WARNING. So this patch fills out the set by providing both regular and
once-only macros for each of the levels INFO, NOTICE, and WARNING, using
a common underlying macro that does all the token-pasting.
DRM_ERROR is unchanged, as it's not just a printk wrapper.
v2:
Fix whitespace, missing ## (Eric Engestrom)
Signed-off-by: Dave Gordon <david.s.gordon@intel.com>
Reviewed-by: Eric Engestrom <eric.engestrom@imgtec.com>
Cc: dri-devel@lists.freedesktop.org
Acked-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/drm/drmP.h | 26 ++++++++++++++++++++------
1 file changed, 20 insertions(+), 6 deletions(-)
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -158,6 +158,26 @@ void drm_err(const char *format, ...);
/** \name Macros to make printk easier */
/*@{*/
+#define _DRM_PRINTK(once, level, fmt, ...) \
+ do { \
+ printk##once(KERN_##level "[" DRM_NAME "] " fmt, \
+ ##__VA_ARGS__); \
+ } while (0)
+
+#define DRM_INFO(fmt, ...) \
+ _DRM_PRINTK(, INFO, fmt, ##__VA_ARGS__)
+#define DRM_NOTE(fmt, ...) \
+ _DRM_PRINTK(, NOTICE, fmt, ##__VA_ARGS__)
+#define DRM_WARN(fmt, ...) \
+ _DRM_PRINTK(, WARNING, fmt, ##__VA_ARGS__)
+
+#define DRM_INFO_ONCE(fmt, ...) \
+ _DRM_PRINTK(_once, INFO, fmt, ##__VA_ARGS__)
+#define DRM_NOTE_ONCE(fmt, ...) \
+ _DRM_PRINTK(_once, NOTICE, fmt, ##__VA_ARGS__)
+#define DRM_WARN_ONCE(fmt, ...) \
+ _DRM_PRINTK(_once, WARNING, fmt, ##__VA_ARGS__)
+
/**
* Error output.
*
@@ -183,12 +203,6 @@ void drm_err(const char *format, ...);
drm_err(fmt, ##__VA_ARGS__); \
})
-#define DRM_INFO(fmt, ...) \
- printk(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__)
-
-#define DRM_INFO_ONCE(fmt, ...) \
- printk_once(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__)
-
/**
* Debug output.
*
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 026/105] drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 025/105] drm: extra printk() wrapper macros Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 027/105] media: dvb: i2c transfers over usb cannot be done from stack Greg Kroah-Hartman
` (76 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Marek Szyprowski, Inki Dae
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit 120a264f9c2782682027d931d83dcbd22e01da80 upstream.
When no IOMMU is available, all GEM buffers allocated by Exynos DRM driver
are contiguous, because of the underlying dma_alloc_attrs() function
provides only such buffers. In such case it makes no sense to keep
BO_NONCONTIG flag for the allocated GEM buffers. This allows to avoid
failures for buffer contiguity checks in the subsequent operations on GEM
objects.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/exynos/exynos_drm_gem.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/gpu/drm/exynos/exynos_drm_gem.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c
@@ -245,6 +245,15 @@ struct exynos_drm_gem *exynos_drm_gem_cr
if (IS_ERR(exynos_gem))
return exynos_gem;
+ if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) {
+ /*
+ * when no IOMMU is available, all allocated buffers are
+ * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag
+ */
+ flags &= ~EXYNOS_BO_NONCONTIG;
+ DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n");
+ }
+
/* set memory type and cache attribute from user side. */
exynos_gem->flags = flags;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 027/105] media: dvb: i2c transfers over usb cannot be done from stack
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 026/105] drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 028/105] arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one Greg Kroah-Hartman
` (75 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laurent Caumont, Sean Young,
Mauro Carvalho Chehab
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Caumont <lcaumont2@gmail.com>
commit 6d33377f2abbf9f0e561b116dd468d1c3ff36a6a upstream.
Signed-off-by: Laurent Caumont <lcaumont2@gmail.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/dvb-usb/dibusb-common.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/media/usb/dvb-usb/dibusb-common.c
+++ b/drivers/media/usb/dvb-usb/dibusb-common.c
@@ -179,8 +179,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo);
int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val)
{
- u8 wbuf[1] = { offs };
- return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1);
+ u8 *buf;
+ int rc;
+
+ buf = kmalloc(2, GFP_KERNEL);
+ if (!buf)
+ return -ENOMEM;
+
+ buf[0] = offs;
+
+ rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1);
+ *val = buf[1];
+ kfree(buf);
+
+ return rc;
}
EXPORT_SYMBOL(dibusb_read_eeprom_byte);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 028/105] arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 027/105] media: dvb: i2c transfers over usb cannot be done from stack Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 030/105] arm64: fpsimd: Prevent registers leaking from dead tasks Greg Kroah-Hartman
` (74 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Suzuki K Poulose, Christoffer Dall,
Kristina Martsenko, Marc Zyngier
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kristina Martsenko <kristina.martsenko@arm.com>
commit 26aa7b3b1c0fb3f1a6176a0c1847204ef4355693 upstream.
VTTBR_BADDR_MASK is used to sanity check the size and alignment of the
VTTBR address. It seems to currently be off by one, thereby only
allowing up to 47-bit addresses (instead of 48-bit) and also
insufficiently checking the alignment. This patch fixes it.
As an example, with 4k pages, before this patch we have:
PHYS_MASK_SHIFT = 48
VTTBR_X = 37 - 24 = 13
VTTBR_BADDR_SHIFT = 13 - 1 = 12
VTTBR_BADDR_MASK = ((1 << 35) - 1) << 12 = 0x00007ffffffff000
Which is wrong, because the mask doesn't allow bit 47 of the VTTBR
address to be set, and only requires the address to be 12-bit (4k)
aligned, while it actually needs to be 13-bit (8k) aligned because we
concatenate two 4k tables.
With this patch, the mask becomes 0x0000ffffffffe000, which is what we
want.
Fixes: 0369f6a34b9f ("arm64: KVM: EL2 register definitions")
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Kristina Martsenko <kristina.martsenko@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/kvm_arm.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/arm64/include/asm/kvm_arm.h
+++ b/arch/arm64/include/asm/kvm_arm.h
@@ -164,8 +164,7 @@
#define VTTBR_X (37 - VTCR_EL2_T0SZ_40B)
#endif
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X)
#define VTTBR_VMID_SHIFT (UL(48))
#define VTTBR_VMID_MASK (UL(0xFF) << VTTBR_VMID_SHIFT)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 030/105] arm64: fpsimd: Prevent registers leaking from dead tasks
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 028/105] arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 031/105] ARM: BUG if jumping to usermode address in kernel mode Greg Kroah-Hartman
` (73 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Martin, Ard Biesheuvel, Will Deacon
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Martin <Dave.Martin@arm.com>
commit 071b6d4a5d343046f253a5a8835d477d93992002 upstream.
Currently, loading of a task's fpsimd state into the CPU registers
is skipped if that task's state is already present in the registers
of that CPU.
However, the code relies on the struct fpsimd_state * (and by
extension struct task_struct *) to unambiguously identify a task.
There is a particular case in which this doesn't work reliably:
when a task exits, its task_struct may be recycled to describe a
new task.
Consider the following scenario:
1) Task P loads its fpsimd state onto cpu C.
per_cpu(fpsimd_last_state, C) := P;
P->thread.fpsimd_state.cpu := C;
2) Task X is scheduled onto C and loads its fpsimd state on C.
per_cpu(fpsimd_last_state, C) := X;
X->thread.fpsimd_state.cpu := C;
3) X exits, causing X's task_struct to be freed.
4) P forks a new child T, which obtains X's recycled task_struct.
T == X.
T->thread.fpsimd_state.cpu == C (inherited from P).
5) T is scheduled on C.
T's fpsimd state is not loaded, because
per_cpu(fpsimd_last_state, C) == T (== X) &&
T->thread.fpsimd_state.cpu == C.
(This is the check performed by fpsimd_thread_switch().)
So, T gets X's registers because the last registers loaded onto C
were those of X, in (2).
This patch fixes the problem by ensuring that the sched-in check
fails in (5): fpsimd_flush_task_state(T) is called when T is
forked, so that T->thread.fpsimd_state.cpu == C cannot be true.
This relies on the fact that T is not schedulable until after
copy_thread() completes.
Once T's fpsimd state has been loaded on some CPU C there may still
be other cpus D for which per_cpu(fpsimd_last_state, D) ==
&X->thread.fpsimd_state. But D is necessarily != C in this case,
and the check in (5) must fail.
An alternative fix would be to do refcounting on task_struct. This
would result in each CPU holding a reference to the last task whose
fpsimd state was loaded there. It's not clear whether this is
preferable, and it involves higher overhead than the fix proposed
in this patch. It would also move all the task_struct freeing
work into the context switch critical section, or otherwise some
deferred cleanup mechanism would need to be introduced, neither of
which seems obviously justified.
Fixes: 005f78cd8849 ("arm64: defer reloading a task's FPSIMD state to userland resume")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
[will: word-smithed the comment so it makes more sense]
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/process.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -251,6 +251,15 @@ int copy_thread(unsigned long clone_flag
memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context));
+ /*
+ * In case p was allocated the same task_struct pointer as some
+ * other recently-exited task, make sure p is disassociated from
+ * any cpu that may have run that now-exited task recently.
+ * Otherwise we could erroneously skip reloading the FPSIMD
+ * registers for p.
+ */
+ fpsimd_flush_task_state(p);
+
if (likely(!(p->flags & PF_KTHREAD))) {
*childregs = *current_pt_regs();
childregs->regs[0] = 0;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 031/105] ARM: BUG if jumping to usermode address in kernel mode
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 030/105] arm64: fpsimd: Prevent registers leaking from dead tasks Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 032/105] ARM: avoid faulting on qemu Greg Kroah-Hartman
` (72 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Alex Shi
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit 8bafae202c82dc257f649ea3c275a0f35ee15113 upstream.
Detect if we are returning to usermode via the normal kernel exit paths
but the saved PSR value indicates that we are in kernel mode. This
could occur due to corrupted stack state, which has been observed with
"ftracetest".
This ensures that we catch the problem case before we get to user code.
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Cc: Alex Shi <alex.shi@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/assembler.h | 18 ++++++++++++++++++
arch/arm/kernel/entry-header.S | 6 ++++++
2 files changed, 24 insertions(+)
--- a/arch/arm/include/asm/assembler.h
+++ b/arch/arm/include/asm/assembler.h
@@ -512,4 +512,22 @@ THUMB( orr \reg , \reg , #PSR_T_BIT )
#endif
.endm
+ .macro bug, msg, line
+#ifdef CONFIG_THUMB2_KERNEL
+1: .inst 0xde02
+#else
+1: .inst 0xe7f001f2
+#endif
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+ .pushsection .rodata.str, "aMS", %progbits, 1
+2: .asciz "\msg"
+ .popsection
+ .pushsection __bug_table, "aw"
+ .align 2
+ .word 1b, 2b
+ .hword \line
+ .popsection
+#endif
+ .endm
+
#endif /* __ASM_ASSEMBLER_H__ */
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -295,6 +295,8 @@
mov r2, sp
ldr r1, [r2, #\offset + S_PSR] @ get calling cpsr
ldr lr, [r2, #\offset + S_PC]! @ get pc
+ tst r1, #0xcf
+ bne 1f
msr spsr_cxsf, r1 @ save in spsr_svc
#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
@ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -309,6 +311,7 @@
@ after ldm {}^
add sp, sp, #\offset + S_FRAME_SIZE
movs pc, lr @ return & move spsr_svc into cpsr
+1: bug "Returning to usermode but unexpected PSR bits set?", \@
#elif defined(CONFIG_CPU_V7M)
@ V7M restore.
@ Note that we don't need to do clrex here as clearing the local
@@ -324,6 +327,8 @@
ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr
ldr lr, [sp, #\offset + S_PC] @ get pc
add sp, sp, #\offset + S_SP
+ tst r1, #0xcf
+ bne 1f
msr spsr_cxsf, r1 @ save in spsr_svc
@ We must avoid clrex due to Cortex-A15 erratum #830321
@@ -336,6 +341,7 @@
.endif
add sp, sp, #S_FRAME_SIZE - S_SP
movs pc, lr @ return & move spsr_svc into cpsr
+1: bug "Returning to usermode but unexpected PSR bits set?", \@
#endif /* !CONFIG_THUMB2_KERNEL */
.endm
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 032/105] ARM: avoid faulting on qemu
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 031/105] ARM: BUG if jumping to usermode address in kernel mode Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 033/105] scsi: storvsc: Workaround for virtual DVD SCSI version Greg Kroah-Hartman
` (71 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Russell King, Alex Shi
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit 3aaf33bebda8d4ffcc0fc8ef39e6c1ac68823b11 upstream.
When qemu starts a kernel in a bare environment, the default SCR has
the AW and FW bits clear, which means that the kernel can't modify
the PSR A or PSR F bits, and means that FIQs and imprecise aborts are
always masked.
When running uboot under qemu, the AW and FW SCR bits are set, and the
kernel functions normally - and this is how real hardware behaves.
Fix this for qemu by ignoring the FIQ bit.
Fixes: 8bafae202c82 ("ARM: BUG if jumping to usermode address in kernel mode")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Cc: Alex Shi <alex.shi@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/entry-header.S | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arm/kernel/entry-header.S
+++ b/arch/arm/kernel/entry-header.S
@@ -295,7 +295,7 @@
mov r2, sp
ldr r1, [r2, #\offset + S_PSR] @ get calling cpsr
ldr lr, [r2, #\offset + S_PC]! @ get pc
- tst r1, #0xcf
+ tst r1, #PSR_I_BIT | 0x0f
bne 1f
msr spsr_cxsf, r1 @ save in spsr_svc
#if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K)
@@ -327,7 +327,7 @@
ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr
ldr lr, [sp, #\offset + S_PC] @ get pc
add sp, sp, #\offset + S_SP
- tst r1, #0xcf
+ tst r1, #PSR_I_BIT | 0x0f
bne 1f
msr spsr_cxsf, r1 @ save in spsr_svc
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 033/105] scsi: storvsc: Workaround for virtual DVD SCSI version
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 032/105] ARM: avoid faulting on qemu Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 034/105] thp: reduce indentation level in change_huge_pmd() Greg Kroah-Hartman
` (70 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Hemminger, K. Y. Srinivasan,
Christoph Hellwig, Martin K. Petersen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Hemminger <stephen@networkplumber.org>
commit f1c635b439a5c01776fe3a25b1e2dc546ea82e6f upstream.
Hyper-V host emulation of SCSI for virtual DVD device reports SCSI
version 0 (UNKNOWN) but is still capable of supporting REPORTLUN.
Without this patch, a GEN2 Linux guest on Hyper-V will not boot 4.11
successfully with virtual DVD ROM device. What happens is that the SCSI
scan process falls back to doing sequential probing by INQUIRY. But the
storvsc driver has a previous workaround that masks/blocks all errors
reports from INQUIRY (or MODE_SENSE) commands. This workaround causes
the scan to then populate a full set of bogus LUN's on the target and
then sends kernel spinning off into a death spiral doing block reads on
the non-existent LUNs.
By setting the correct blacklist flags, the target with the DVD device
is scanned with REPORTLUN and that works correctly.
Patch needs to go in current 4.11, it is safe but not necessary in older
kernels.
Signed-off-by: Stephen Hemminger <sthemmin@microsoft.com>
Reviewed-by: K. Y. Srinivasan <kys@microsoft.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/storvsc_drv.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -379,8 +379,6 @@ MODULE_PARM_DESC(vcpus_per_sub_channel,
*/
static int storvsc_timeout = 180;
-static int msft_blist_flags = BLIST_TRY_VPD_PAGES;
-
static void storvsc_on_channel_callback(void *context);
@@ -1241,6 +1239,22 @@ static int storvsc_do_io(struct hv_devic
return ret;
}
+static int storvsc_device_alloc(struct scsi_device *sdevice)
+{
+ /*
+ * Set blist flag to permit the reading of the VPD pages even when
+ * the target may claim SPC-2 compliance. MSFT targets currently
+ * claim SPC-2 compliance while they implement post SPC-2 features.
+ * With this flag we can correctly handle WRITE_SAME_16 issues.
+ *
+ * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but
+ * still supports REPORT LUN.
+ */
+ sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES;
+
+ return 0;
+}
+
static int storvsc_device_configure(struct scsi_device *sdevice)
{
@@ -1256,14 +1270,6 @@ static int storvsc_device_configure(stru
sdevice->no_write_same = 1;
/*
- * Add blist flags to permit the reading of the VPD pages even when
- * the target may claim SPC-2 compliance. MSFT targets currently
- * claim SPC-2 compliance while they implement post SPC-2 features.
- * With this patch we can correctly handle WRITE_SAME_16 issues.
- */
- sdevice->sdev_bflags |= msft_blist_flags;
-
- /*
* If the host is WIN8 or WIN8 R2, claim conformance to SPC-3
* if the device is a MSFT virtual device. If the host is
* WIN10 or newer, allow write_same.
@@ -1529,6 +1535,7 @@ static struct scsi_host_template scsi_dr
.eh_host_reset_handler = storvsc_host_reset_handler,
.proc_name = "storvsc_host",
.eh_timed_out = storvsc_eh_timed_out,
+ .slave_alloc = storvsc_device_alloc,
.slave_configure = storvsc_device_configure,
.cmd_per_lun = 255,
.this_id = -1,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 034/105] thp: reduce indentation level in change_huge_pmd()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 033/105] scsi: storvsc: Workaround for virtual DVD SCSI version Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 035/105] thp: fix MADV_DONTNEED vs. numa balancing race Greg Kroah-Hartman
` (69 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov, Vlastimil Babka,
Andrea Arcangeli, Hillf Danton, Andrew Morton, Linus Torvalds,
Jack Wang
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit 0a85e51d37645e9ce57e5e1a30859e07810ed07c upstream.
Patch series "thp: fix few MADV_DONTNEED races"
For MADV_DONTNEED to work properly with huge pages, it's critical to not
clear pmd intermittently unless you hold down_write(mmap_sem).
Otherwise MADV_DONTNEED can miss the THP which can lead to userspace
breakage.
See example of such race in commit message of patch 2/4.
All these races are found by code inspection. I haven't seen them
triggered. I don't think it's worth to apply them to stable@.
This patch (of 4):
Restructure code in preparation for a fix.
Link: http://lkml.kernel.org/r/20170302151034.27829-2-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[jwang: adjust context for 4.4 kernel]
Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 54 ++++++++++++++++++++++++++++--------------------------
1 file changed, 28 insertions(+), 26 deletions(-)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1566,35 +1566,37 @@ int change_huge_pmd(struct vm_area_struc
{
struct mm_struct *mm = vma->vm_mm;
spinlock_t *ptl;
+ pmd_t entry;
+ bool preserve_write;
+
int ret = 0;
- if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) {
- pmd_t entry;
- bool preserve_write = prot_numa && pmd_write(*pmd);
- ret = 1;
-
- /*
- * Avoid trapping faults against the zero page. The read-only
- * data is likely to be read-cached on the local CPU and
- * local/remote hits to the zero page are not interesting.
- */
- if (prot_numa && is_huge_zero_pmd(*pmd)) {
- spin_unlock(ptl);
- return ret;
- }
-
- if (!prot_numa || !pmd_protnone(*pmd)) {
- entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
- entry = pmd_modify(entry, newprot);
- if (preserve_write)
- entry = pmd_mkwrite(entry);
- ret = HPAGE_PMD_NR;
- set_pmd_at(mm, addr, pmd, entry);
- BUG_ON(!preserve_write && pmd_write(entry));
- }
- spin_unlock(ptl);
- }
+ if (__pmd_trans_huge_lock(pmd, vma, &ptl) != 1)
+ return 0;
+
+ preserve_write = prot_numa && pmd_write(*pmd);
+ ret = 1;
+
+ /*
+ * Avoid trapping faults against the zero page. The read-only
+ * data is likely to be read-cached on the local CPU and
+ * local/remote hits to the zero page are not interesting.
+ */
+ if (prot_numa && is_huge_zero_pmd(*pmd))
+ goto unlock;
+
+ if (prot_numa && pmd_protnone(*pmd))
+ goto unlock;
+ entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
+ entry = pmd_modify(entry, newprot);
+ if (preserve_write)
+ entry = pmd_mkwrite(entry);
+ ret = HPAGE_PMD_NR;
+ set_pmd_at(mm, addr, pmd, entry);
+ BUG_ON(!preserve_write && pmd_write(entry));
+unlock:
+ spin_unlock(ptl);
return ret;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 035/105] thp: fix MADV_DONTNEED vs. numa balancing race
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 034/105] thp: reduce indentation level in change_huge_pmd() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 036/105] mm: drop unused pmdp_huge_get_and_clear_notify() Greg Kroah-Hartman
` (68 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov, Andrea Arcangeli,
Hillf Danton, Andrew Morton, Linus Torvalds, Jack Wang
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit ced108037c2aa542b3ed8b7afd1576064ad1362a upstream.
In case prot_numa, we are under down_read(mmap_sem). It's critical to
not clear pmd intermittently to avoid race with MADV_DONTNEED which is
also under down_read(mmap_sem):
CPU0: CPU1:
change_huge_pmd(prot_numa=1)
pmdp_huge_get_and_clear_notify()
madvise_dontneed()
zap_pmd_range()
pmd_trans_huge(*pmd) == 0 (without ptl)
// skip the pmd
set_pmd_at();
// pmd is re-established
The race makes MADV_DONTNEED miss the huge pmd and don't clear it
which may break userspace.
Found by code analysis, never saw triggered.
Link: http://lkml.kernel.org/r/20170302151034.27829-3-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Hillf Danton <hillf.zj@alibaba-inc.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[jwang: adjust context for 4.4]
Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/huge_memory.c | 34 +++++++++++++++++++++++++++++++++-
1 file changed, 33 insertions(+), 1 deletion(-)
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1588,7 +1588,39 @@ int change_huge_pmd(struct vm_area_struc
if (prot_numa && pmd_protnone(*pmd))
goto unlock;
- entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd);
+ /*
+ * In case prot_numa, we are under down_read(mmap_sem). It's critical
+ * to not clear pmd intermittently to avoid race with MADV_DONTNEED
+ * which is also under down_read(mmap_sem):
+ *
+ * CPU0: CPU1:
+ * change_huge_pmd(prot_numa=1)
+ * pmdp_huge_get_and_clear_notify()
+ * madvise_dontneed()
+ * zap_pmd_range()
+ * pmd_trans_huge(*pmd) == 0 (without ptl)
+ * // skip the pmd
+ * set_pmd_at();
+ * // pmd is re-established
+ *
+ * The race makes MADV_DONTNEED miss the huge pmd and don't clear it
+ * which may break userspace.
+ *
+ * pmdp_invalidate() is required to make sure we don't miss
+ * dirty/young flags set by hardware.
+ */
+ entry = *pmd;
+ pmdp_invalidate(vma, addr, pmd);
+
+ /*
+ * Recover dirty/young flags. It relies on pmdp_invalidate to not
+ * corrupt them.
+ */
+ if (pmd_dirty(*pmd))
+ entry = pmd_mkdirty(entry);
+ if (pmd_young(*pmd))
+ entry = pmd_mkyoung(entry);
+
entry = pmd_modify(entry, newprot);
if (preserve_write)
entry = pmd_mkwrite(entry);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 036/105] mm: drop unused pmdp_huge_get_and_clear_notify()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 035/105] thp: fix MADV_DONTNEED vs. numa balancing race Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 037/105] Revert "drm/armada: Fix compile fail" Greg Kroah-Hartman
` (67 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kirill A. Shutemov, Dave Hansen,
Andrew Morton, Linus Torvalds, Jack Wang
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit c0c379e2931b05facef538e53bf3b21f283d9a0b upstream.
Dave noticed that after fixing MADV_DONTNEED vs numa balancing race the
last pmdp_huge_get_and_clear_notify() user is gone.
Let's drop the helper.
Link: http://lkml.kernel.org/r/20170306112047.24809-1-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[jwang: adjust context for 4.4]
Signed-off-by: Jack Wang <jinpu.wang@profitbricks.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/mmu_notifier.h | 13 -------------
1 file changed, 13 deletions(-)
--- a/include/linux/mmu_notifier.h
+++ b/include/linux/mmu_notifier.h
@@ -381,18 +381,6 @@ static inline void mmu_notifier_mm_destr
___pmd; \
})
-#define pmdp_huge_get_and_clear_notify(__mm, __haddr, __pmd) \
-({ \
- unsigned long ___haddr = __haddr & HPAGE_PMD_MASK; \
- pmd_t ___pmd; \
- \
- ___pmd = pmdp_huge_get_and_clear(__mm, __haddr, __pmd); \
- mmu_notifier_invalidate_range(__mm, ___haddr, \
- ___haddr + HPAGE_PMD_SIZE); \
- \
- ___pmd; \
-})
-
/*
* set_pte_at_notify() sets the pte _after_ running the notifier.
* This is safe to start by updating the secondary MMUs, because the primary MMU
@@ -475,7 +463,6 @@ static inline void mmu_notifier_mm_destr
#define pmdp_clear_young_notify pmdp_test_and_clear_young
#define ptep_clear_flush_notify ptep_clear_flush
#define pmdp_huge_clear_flush_notify pmdp_huge_clear_flush
-#define pmdp_huge_get_and_clear_notify pmdp_huge_get_and_clear
#define set_pte_at_notify set_pte_at
#endif /* CONFIG_MMU_NOTIFIER */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 037/105] Revert "drm/armada: Fix compile fail"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 036/105] mm: drop unused pmdp_huge_get_and_clear_notify() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 038/105] Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA" Greg Kroah-Hartman
` (66 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <alexander.levin@verizon.com>
This reverts commit 82f260d472c3b4dbb7324624e395c3e91f73a040.
Not required on < 4.10.
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/armada/Makefile | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/gpu/drm/armada/Makefile
+++ b/drivers/gpu/drm/armada/Makefile
@@ -4,5 +4,3 @@ armada-y += armada_510.o
armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o
obj-$(CONFIG_DRM_ARMADA) := armada.o
-
-CFLAGS_armada_trace.o := -I$(src)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 038/105] Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 037/105] Revert "drm/armada: Fix compile fail" Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 039/105] Revert "s390/kbuild: enable modversions for symbols exported from asm" Greg Kroah-Hartman
` (65 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <alexander.levin@verizon.com>
This reverts commit dadab2d4e3cf708ceba22ecddd94aedfecb39199.
Not required on < 4.10.
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/Kconfig | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -315,7 +315,6 @@ config SPI_FSL_SPI
config SPI_FSL_DSPI
tristate "Freescale DSPI controller"
select REGMAP_MMIO
- depends on HAS_DMA
depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST
help
This enables support for the Freescale DSPI controller in master
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 039/105] Revert "s390/kbuild: enable modversions for symbols exported from asm"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 038/105] Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA" Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 040/105] vti6: Dont report path MTU below IPV6_MIN_MTU Greg Kroah-Hartman
` (64 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sasha Levin <alexander.levin@verizon.com>
This reverts commit cabab3f9f5ca077535080b3252e6168935b914af.
Not needed for < 4.9.
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/asm-prototypes.h | 8 --------
1 file changed, 8 deletions(-)
delete mode 100644 arch/s390/include/asm/asm-prototypes.h
--- a/arch/s390/include/asm/asm-prototypes.h
+++ /dev/null
@@ -1,8 +0,0 @@
-#ifndef _ASM_S390_PROTOTYPES_H
-
-#include <linux/kvm_host.h>
-#include <linux/ftrace.h>
-#include <asm/fpu/api.h>
-#include <asm-generic/asm-prototypes.h>
-
-#endif /* _ASM_S390_PROTOTYPES_H */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 040/105] vti6: Dont report path MTU below IPV6_MIN_MTU.
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 039/105] Revert "s390/kbuild: enable modversions for symbols exported from asm" Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 041/105] ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure Greg Kroah-Hartman
` (63 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Steffen Klassert, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Klassert <steffen.klassert@secunet.com>
[ Upstream commit e3dc847a5f85b43ee2bfc8eae407a7e383483228 ]
In vti6_xmit(), the check for IPV6_MIN_MTU before we
send a ICMPV6_PKT_TOOBIG message is missing. So we might
report a PMTU below 1280. Fix this by adding the required
check.
Fixes: ccd740cbc6e ("vti6: Add pmtu handling to vti6_xmit.")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/ip6_vti.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -474,11 +474,15 @@ vti6_xmit(struct sk_buff *skb, struct ne
if (!skb->ignore_df && skb->len > mtu) {
skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
- if (skb->protocol == htons(ETH_P_IPV6))
+ if (skb->protocol == htons(ETH_P_IPV6)) {
+ if (mtu < IPV6_MIN_MTU)
+ mtu = IPV6_MIN_MTU;
+
icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
- else
+ } else {
icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
htonl(mtu));
+ }
return -EMSGSIZE;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 041/105] ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 040/105] vti6: Dont report path MTU below IPV6_MIN_MTU Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 042/105] x86/hpet: Prevent might sleep splat on resume Greg Kroah-Hartman
` (62 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ladislav Michl, Roger Quadros,
Tony Lindgren, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ladislav Michl <ladis@linux-mips.org>
[ Upstream commit 7807e086a2d1f69cc1a57958cac04fea79fc2112 ]
gpmc_probe_onenand_child returns success even on gpmc_onenand_init
failure. Fix that.
Signed-off-by: Ladislav Michl <ladis@linux-mips.org>
Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/gpmc-onenand.c | 10 ++++++----
drivers/memory/omap-gpmc.c | 4 +---
include/linux/omap-gpmc.h | 5 +++--
3 files changed, 10 insertions(+), 9 deletions(-)
--- a/arch/arm/mach-omap2/gpmc-onenand.c
+++ b/arch/arm/mach-omap2/gpmc-onenand.c
@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iom
return ret;
}
-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data)
{
int err;
struct device *dev = &gpmc_onenand_device.dev;
@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onena
if (err < 0) {
dev_err(dev, "Cannot request GPMC CS %d, error %d\n",
gpmc_onenand_data->cs, err);
- return;
+ return err;
}
gpmc_onenand_resource.end = gpmc_onenand_resource.start +
ONENAND_IO_SIZE - 1;
- if (platform_device_register(&gpmc_onenand_device) < 0) {
+ err = platform_device_register(&gpmc_onenand_device);
+ if (err) {
dev_err(dev, "Unable to register OneNAND device\n");
gpmc_cs_free(gpmc_onenand_data->cs);
- return;
}
+
+ return err;
}
--- a/drivers/memory/omap-gpmc.c
+++ b/drivers/memory/omap-gpmc.c
@@ -1890,9 +1890,7 @@ static int gpmc_probe_onenand_child(stru
if (!of_property_read_u32(child, "dma-channel", &val))
gpmc_onenand_data->dma_channel = val;
- gpmc_onenand_init(gpmc_onenand_data);
-
- return 0;
+ return gpmc_onenand_init(gpmc_onenand_data);
}
#else
static int gpmc_probe_onenand_child(struct platform_device *pdev,
--- a/include/linux/omap-gpmc.h
+++ b/include/linux/omap-gpmc.h
@@ -191,10 +191,11 @@ static inline int gpmc_nand_init(struct
#endif
#if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2)
-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d);
+extern int gpmc_onenand_init(struct omap_onenand_platform_data *d);
#else
#define board_onenand_data NULL
-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d)
+static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d)
{
+ return 0;
}
#endif
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 042/105] x86/hpet: Prevent might sleep splat on resume
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 041/105] ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 043/105] selftest/powerpc: Fix false failures for skipped tests Greg Kroah-Hartman
` (61 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Thomas Gleixner, Peter Zijlstra,
Rafael J. Wysocki, Sergey Senozhatsky, Borislav Petkov,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
[ Upstream commit bb1a2c26165640ba2cbcfe06c81e9f9d6db4e643 ]
Sergey reported a might sleep warning triggered from the hpet resume
path. It's caused by the call to disable_irq() from interrupt disabled
context.
The problem with the low level resume code is that it is not accounted as a
special system_state like we do during the boot process. Calling the same
code during system boot would not trigger the warning. That's inconsistent
at best.
In this particular case it's trivial to replace the disable_irq() with
disable_hardirq() because this particular code path is solely used from
system resume and the involved hpet interrupts can never be force threaded.
Reported-and-tested-by: Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Borislav Petkov <bp@alien8.de>
Link: http://lkml.kernel.org/r/alpine.DEB.2.20.1703012108460.3684@nanos
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/hpet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -353,7 +353,7 @@ static int hpet_resume(struct clock_even
irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq));
irq_domain_activate_irq(irq_get_irq_data(hdev->irq));
- disable_irq(hdev->irq);
+ disable_hardirq(hdev->irq);
irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu));
enable_irq(hdev->irq);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 043/105] selftest/powerpc: Fix false failures for skipped tests
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 042/105] x86/hpet: Prevent might sleep splat on resume Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 044/105] module: set __jump_table alignment to 8 Greg Kroah-Hartman
` (60 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sachin Sant, Michael Ellerman, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sachin Sant <sachinp@linux.vnet.ibm.com>
[ Upstream commit a6d8a21596df041f36f4c2ccc260c459e3e851f1 ]
Tests under alignment subdirectory are skipped when executed on previous
generation hardware, but harness still marks them as failed.
test: test_copy_unaligned
tags: git_version:unknown
[SKIP] Test skipped on line 26
skip: test_copy_unaligned
selftests: copy_unaligned [FAIL]
The MAGIC_SKIP_RETURN_VALUE value assigned to rc variable is retained till
the program exit which causes the test to be marked as failed.
This patch resets the value before returning to the main() routine.
With this patch the test o/p is as follows:
test: test_copy_unaligned
tags: git_version:unknown
[SKIP] Test skipped on line 26
skip: test_copy_unaligned
selftests: copy_unaligned [PASS]
Signed-off-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/powerpc/harness.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/tools/testing/selftests/powerpc/harness.c
+++ b/tools/testing/selftests/powerpc/harness.c
@@ -109,9 +109,11 @@ int test_harness(int (test_function)(voi
rc = run_test(test_function, name);
- if (rc == MAGIC_SKIP_RETURN_VALUE)
+ if (rc == MAGIC_SKIP_RETURN_VALUE) {
test_skip(name);
- else
+ /* so that skipped test is not marked as failed */
+ rc = 0;
+ } else
test_finish(name, rc);
return rc;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 044/105] module: set __jump_table alignment to 8
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 043/105] selftest/powerpc: Fix false failures for skipped tests Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 045/105] ARM: OMAP2+: Fix device node reference counts Greg Kroah-Hartman
` (59 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Baron, Jessica Yu, Sachin Sant,
David Daney, Steven Rostedt (VMware),
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Daney <david.daney@cavium.com>
[ Upstream commit ab42632156becd35d3884ee5c14da2bedbf3149a ]
For powerpc the __jump_table section in modules is not aligned, this
causes a WARN_ON() splat when loading a module containing a __jump_table.
Strict alignment became necessary with commit 3821fd35b58d
("jump_label: Reduce the size of struct static_key"), currently in
linux-next, which uses the two least significant bits of pointers to
__jump_table elements.
Fix by forcing __jump_table to 8, which is the same alignment used for
this section in the kernel proper.
Link: http://lkml.kernel.org/r/20170301220453.4756-1-david.daney@cavium.com
Reviewed-by: Jason Baron <jbaron@akamai.com>
Acked-by: Jessica Yu <jeyu@redhat.com>
Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc)
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: David Daney <david.daney@cavium.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/module-common.lds | 2 ++
1 file changed, 2 insertions(+)
--- a/scripts/module-common.lds
+++ b/scripts/module-common.lds
@@ -19,4 +19,6 @@ SECTIONS {
. = ALIGN(8);
.init_array 0 : { *(SORT(.init_array.*)) *(.init_array) }
+
+ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) }
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 045/105] ARM: OMAP2+: Fix device node reference counts
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 044/105] module: set __jump_table alignment to 8 Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 046/105] ARM: OMAP2+: Release device node after it is no longer needed Greg Kroah-Hartman
` (58 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qi Hou, Peter Rosin, Rob Herring,
Guenter Roeck, Tony Lindgren, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit 10e5778f54765c96fe0c8f104b7a030e5b35bc72 ]
After commit 0549bde0fcb1 ("of: fix of_node leak caused in
of_find_node_opts_by_path"), the following error may be
reported when running omap images.
OF: ERROR: Bad of_node_put() on /ocp@68000000
CPU: 0 PID: 0 Comm: swapper Not tainted 4.10.0-rc7-next-20170210 #1
Hardware name: Generic OMAP3-GP (Flattened Device Tree)
[<c0310604>] (unwind_backtrace) from [<c030bbf4>] (show_stack+0x10/0x14)
[<c030bbf4>] (show_stack) from [<c05add8c>] (dump_stack+0x98/0xac)
[<c05add8c>] (dump_stack) from [<c05af1b0>] (kobject_release+0x48/0x7c)
[<c05af1b0>] (kobject_release)
from [<c0ad1aa4>] (of_find_node_by_name+0x74/0x94)
[<c0ad1aa4>] (of_find_node_by_name)
from [<c1215bd4>] (omap3xxx_hwmod_is_hs_ip_block_usable+0x24/0x2c)
[<c1215bd4>] (omap3xxx_hwmod_is_hs_ip_block_usable) from
[<c1215d5c>] (omap3xxx_hwmod_init+0x180/0x274)
[<c1215d5c>] (omap3xxx_hwmod_init)
from [<c120faa8>] (omap3_init_early+0xa0/0x11c)
[<c120faa8>] (omap3_init_early)
from [<c120fb2c>] (omap3430_init_early+0x8/0x30)
[<c120fb2c>] (omap3430_init_early)
from [<c1204710>] (setup_arch+0xc04/0xc34)
[<c1204710>] (setup_arch) from [<c1200948>] (start_kernel+0x68/0x38c)
[<c1200948>] (start_kernel) from [<8020807c>] (0x8020807c)
of_find_node_by_name() drops the reference to the passed device node.
The commit referenced above exposes this problem.
To fix the problem, use of_get_child_by_name() instead of
of_find_node_by_name(); of_get_child_by_name() does not drop
the reference count of passed device nodes. While semantically
different, we only look for immediate children of the passed
device node, so of_get_child_by_name() is a more appropriate
function to use anyway.
Release the reference to the device node obtained with
of_get_child_by_name() after it is no longer needed to avoid
another device node leak.
While at it, clean up the code and change the return type of
omap3xxx_hwmod_is_hs_ip_block_usable() to bool to match its use
and the return type of of_device_is_available().
Cc: Qi Hou <qi.hou@windriver.com>
Cc: Peter Rosin <peda@axentia.se>
Cc: Rob Herring <robh@kernel.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -3885,16 +3885,20 @@ static struct omap_hwmod_ocp_if *omap3xx
* Return: 0 if device named @dev_name is not likely to be accessible,
* or 1 if it is likely to be accessible.
*/
-static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
- const char *dev_name)
+static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus,
+ const char *dev_name)
{
+ struct device_node *node;
+ bool available;
+
if (!bus)
- return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0;
+ return omap_type() == OMAP2_DEVICE_TYPE_GP;
- if (of_device_is_available(of_find_node_by_name(bus, dev_name)))
- return 1;
+ node = of_get_child_by_name(bus, dev_name);
+ available = of_device_is_available(node);
+ of_node_put(node);
- return 0;
+ return available;
}
int __init omap3xxx_hwmod_init(void)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 046/105] ARM: OMAP2+: Release device node after it is no longer needed.
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 045/105] ARM: OMAP2+: Fix device node reference counts Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 047/105] gpio: altera: Use handle_level_irq when configured as a level_high Greg Kroah-Hartman
` (57 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Guenter Roeck, Tony Lindgren, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guenter Roeck <linux@roeck-us.net>
[ Upstream commit b92675d998a9fa37fe9e0e35053a95b4a23c158b ]
The device node returned by of_find_node_by_name() needs to be released
after it is no longer needed to avoid a device node leak.
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -3967,15 +3967,20 @@ int __init omap3xxx_hwmod_init(void)
if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) {
r = omap_hwmod_register_links(h_sham);
- if (r < 0)
+ if (r < 0) {
+ of_node_put(bus);
return r;
+ }
}
if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) {
r = omap_hwmod_register_links(h_aes);
- if (r < 0)
+ if (r < 0) {
+ of_node_put(bus);
return r;
+ }
}
+ of_node_put(bus);
/*
* Register hwmod links specific to certain ES levels of a
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 047/105] gpio: altera: Use handle_level_irq when configured as a level_high
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 046/105] ARM: OMAP2+: Release device node after it is no longer needed Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 048/105] HID: chicony: Add support for another ASUS Zen AiO keyboard Greg Kroah-Hartman
` (56 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Phil Reid, Linus Walleij, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Reid <preid@electromag.com.au>
[ Upstream commit f759921cfbf4847319d197a6ed7c9534d593f8bc ]
When a threaded irq handler is chained attached to one of the gpio
pins when configure for level irq the altera_gpio_irq_leveL_high_handler
does not mask the interrupt while being handled by the chained irq.
This resulting in the threaded irq not getting enough cycles to complete
quickly enough before the irq was disabled as faulty. handle_level_irq
should be used in this situation instead of handle_simple_irq.
In gpiochip_irqchip_add set default handler to handle_bad_irq as
per Documentation/gpio/driver.txt. Then set the correct handler in
the set_type callback.
Signed-off-by: Phil Reid <preid@electromag.com.au>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-altera.c | 26 +++++++++++---------------
1 file changed, 11 insertions(+), 15 deletions(-)
--- a/drivers/gpio/gpio-altera.c
+++ b/drivers/gpio/gpio-altera.c
@@ -94,21 +94,18 @@ static int altera_gpio_irq_set_type(stru
altera_gc = to_altera(irq_data_get_irq_chip_data(d));
- if (type == IRQ_TYPE_NONE)
+ if (type == IRQ_TYPE_NONE) {
+ irq_set_handler_locked(d, handle_bad_irq);
return 0;
- if (type == IRQ_TYPE_LEVEL_HIGH &&
- altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH)
- return 0;
- if (type == IRQ_TYPE_EDGE_RISING &&
- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING)
- return 0;
- if (type == IRQ_TYPE_EDGE_FALLING &&
- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING)
- return 0;
- if (type == IRQ_TYPE_EDGE_BOTH &&
- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH)
+ }
+ if (type == altera_gc->interrupt_trigger) {
+ if (type == IRQ_TYPE_LEVEL_HIGH)
+ irq_set_handler_locked(d, handle_level_irq);
+ else
+ irq_set_handler_locked(d, handle_simple_irq);
return 0;
-
+ }
+ irq_set_handler_locked(d, handle_bad_irq);
return -EINVAL;
}
@@ -234,7 +231,6 @@ static void altera_gpio_irq_edge_handler
chained_irq_exit(chip, desc);
}
-
static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc)
{
struct altera_gpio_chip *altera_gc;
@@ -314,7 +310,7 @@ static int altera_gpio_probe(struct plat
altera_gc->interrupt_trigger = reg;
ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0,
- handle_simple_irq, IRQ_TYPE_NONE);
+ handle_bad_irq, IRQ_TYPE_NONE);
if (ret) {
dev_info(&pdev->dev, "could not add irqchip\n");
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 048/105] HID: chicony: Add support for another ASUS Zen AiO keyboard
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 047/105] gpio: altera: Use handle_level_irq when configured as a level_high Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 049/105] usb: gadget: configs: plug memory leak Greg Kroah-Hartman
` (55 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Daniel Drake, Jiri Kosina, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Drake <drake@endlessm.com>
[ Upstream commit f2f10b7e722a75c6d75a7f7cd06b0eee3ae20f7c ]
Add support for media keys on the keyboard that comes with the
Asus V221ID and ZN241IC All In One computers.
The keys to support here are WLAN, BRIGHTNESSDOWN and BRIGHTNESSUP.
This device is not visibly branded as Chicony, and the USB Vendor ID
suggests that it is a JESS device. However this seems like the right place
to put it: the usage codes are identical to the currently supported
devices, and this driver already supports the ASUS AIO keyboard AK1D.
Signed-off-by: Daniel Drake <drake@endlessm.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/Kconfig | 4 ++--
drivers/hid/hid-chicony.c | 1 +
drivers/hid/hid-core.c | 1 +
drivers/hid/hid-ids.h | 1 +
4 files changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -165,11 +165,11 @@ config HID_CHERRY
Support for Cherry Cymotion keyboard.
config HID_CHICONY
- tristate "Chicony Tactical pad"
+ tristate "Chicony devices"
depends on HID
default !EXPERT
---help---
- Support for Chicony Tactical pad.
+ Support for Chicony Tactical pad and special keys on Chicony keyboards.
config HID_CORSAIR
tristate "Corsair devices"
--- a/drivers/hid/hid-chicony.c
+++ b/drivers/hid/hid-chicony.c
@@ -86,6 +86,7 @@ static const struct hid_device_id ch_dev
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) },
{ HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
{ }
};
MODULE_DEVICE_TABLE(hid, ch_devices);
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1867,6 +1867,7 @@ static const struct hid_device_id hid_ha
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) },
{ HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) },
{ HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) },
{ HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) },
{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) },
{ HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -523,6 +523,7 @@
#define USB_VENDOR_ID_JESS 0x0c45
#define USB_DEVICE_ID_JESS_YUREX 0x1010
+#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD 0x5112
#define USB_VENDOR_ID_JESS2 0x0f30
#define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 049/105] usb: gadget: configs: plug memory leak
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 048/105] HID: chicony: Add support for another ASUS Zen AiO keyboard Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 050/105] USB: gadgetfs: Fix a potential memory leak in dev_config() Greg Kroah-Hartman
` (54 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, John Keeping, Felipe Balbi, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <john@metanate.com>
[ Upstream commit 38355b2a44776c25b0f2ad466e8c51bb805b3032 ]
When binding a gadget to a device, "name" is stored in gi->udc_name, but
this does not happen when unregistering and the string is leaked.
Signed-off-by: John Keeping <john@metanate.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/configfs.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/gadget/configfs.c
+++ b/drivers/usb/gadget/configfs.c
@@ -270,6 +270,7 @@ static ssize_t gadget_dev_desc_UDC_store
ret = unregister_gadget(gi);
if (ret)
goto err;
+ kfree(name);
} else {
if (gi->udc_name) {
ret = -EBUSY;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 050/105] USB: gadgetfs: Fix a potential memory leak in dev_config()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 049/105] usb: gadget: configs: plug memory leak Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 052/105] libata: drop WARN from protocol error in ata_sff_qc_issue() Greg Kroah-Hartman
` (53 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Christophe JAILLET, Felipe Balbi,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit b6e7aeeaf235901c42ec35de4633c7c69501d303 ]
'kbuf' is allocated just a few lines above using 'memdup_user()'.
If the 'if (dev->buf)' test fails, this memory is never released.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/legacy/inode.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1837,8 +1837,10 @@ dev_config (struct file *fd, const char
spin_lock_irq (&dev->lock);
value = -EINVAL;
- if (dev->buf)
+ if (dev->buf) {
+ kfree(kbuf);
goto fail;
+ }
dev->buf = kbuf;
/* full or low speed config */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 052/105] libata: drop WARN from protocol error in ata_sff_qc_issue()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 050/105] USB: gadgetfs: Fix a potential memory leak in dev_config() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 053/105] workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq Greg Kroah-Hartman
` (52 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Tejun Heo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
[ Upstream commit 0580b762a4d6b70817476b90042813f8573283fa ]
ata_sff_qc_issue() expects upper layers to never issue commands on a
command protocol that it doesn't implement. While the assumption
holds fine with the usual IO path, nothing filters based on the
command protocol in the passthrough path (which was added later),
allowing the warning to be tripped with a passthrough command with the
right (well, wrong) protocol.
Failing with AC_ERR_SYSTEM is the right thing to do anyway. Remove
the unnecessary WARN.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Link: http://lkml.kernel.org/r/CACT4Y+bXkvevNZU8uP6X0QVqsj6wNoUA_1exfTSOzc+SmUtMOA@mail.gmail.com
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-sff.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -1480,7 +1480,6 @@ unsigned int ata_sff_qc_issue(struct ata
break;
default:
- WARN_ON_ONCE(1);
return AC_ERR_SYSTEM;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 053/105] workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 052/105] libata: drop WARN from protocol error in ata_sff_qc_issue() Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 054/105] scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters Greg Kroah-Hartman
` (51 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Jones, Tejun Heo, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
[ Upstream commit 637fdbae60d6cb9f6e963c1079d7e0445c86ff7d ]
If queue_delayed_work() gets called with NULL @wq, the kernel will
oops asynchronuosly on timer expiration which isn't too helpful in
tracking down the offender. This actually happened with smc.
__queue_delayed_work() already does several input sanity checks
synchronously. Add NULL @wq check.
Reported-by: Dave Jones <davej@codemonkey.org.uk>
Link: http://lkml.kernel.org/r/20170227171439.jshx3qplflyrgcv7@codemonkey.org.uk
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/workqueue.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -1479,6 +1479,7 @@ static void __queue_delayed_work(int cpu
struct timer_list *timer = &dwork->timer;
struct work_struct *work = &dwork->work;
+ WARN_ON_ONCE(!wq);
WARN_ON_ONCE(timer->function != delayed_work_timer_fn ||
timer->data != (unsigned long)dwork);
WARN_ON_ONCE(timer_pending(timer));
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 054/105] scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 053/105] workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 055/105] irqchip/crossbar: Fix incorrect type of register size Greg Kroah-Hartman
` (50 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
Martin K. Petersen, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Smart <jsmart2021@gmail.com>
[ Upstream commit 5d181531bc6169e19a02a27d202cf0e982db9d0e ]
if REG_VPI fails, the driver was incorrectly issuing INIT_VFI
(a SLI4 command) on a SLI3 adapter.
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/lpfc/lpfc_els.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -7887,11 +7887,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba
spin_lock_irq(shost->host_lock);
vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI;
spin_unlock_irq(shost->host_lock);
- if (vport->port_type == LPFC_PHYSICAL_PORT
- && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG))
- lpfc_issue_init_vfi(vport);
- else
+ if (mb->mbxStatus == MBX_NOT_FINISHED)
+ break;
+ if ((vport->port_type == LPFC_PHYSICAL_PORT) &&
+ !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) {
+ if (phba->sli_rev == LPFC_SLI_REV4)
+ lpfc_issue_init_vfi(vport);
+ else
+ lpfc_initial_flogi(vport);
+ } else {
lpfc_initial_fdisc(vport);
+ }
break;
}
} else {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 055/105] irqchip/crossbar: Fix incorrect type of register size
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 054/105] scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 057/105] arm: KVM: Survive unknown traps from guests Greg Kroah-Hartman
` (49 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Franck Demathieu, Marc Zyngier, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Franck Demathieu <fdemathieu@gmail.com>
[ Upstream commit 4b9de5da7e120c7f02395da729f0ec77ce7a6044 ]
The 'size' variable is unsigned according to the dt-bindings.
As this variable is used as integer in other places, create a new variable
that allows to fix the following sparse issue (-Wtypesign):
drivers/irqchip/irq-crossbar.c:279:52: warning: incorrect type in argument 3 (different signedness)
drivers/irqchip/irq-crossbar.c:279:52: expected unsigned int [usertype] *out_value
drivers/irqchip/irq-crossbar.c:279:52: got int *<noident>
Signed-off-by: Franck Demathieu <fdemathieu@gmail.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-crossbar.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/irqchip/irq-crossbar.c
+++ b/drivers/irqchip/irq-crossbar.c
@@ -199,7 +199,7 @@ static const struct irq_domain_ops cross
static int __init crossbar_of_init(struct device_node *node)
{
int i, size, reserved = 0;
- u32 max = 0, entry;
+ u32 max = 0, entry, reg_size;
const __be32 *irqsr;
int ret = -ENOMEM;
@@ -276,9 +276,9 @@ static int __init crossbar_of_init(struc
if (!cb->register_offsets)
goto err_irq_map;
- of_property_read_u32(node, "ti,reg-size", &size);
+ of_property_read_u32(node, "ti,reg-size", ®_size);
- switch (size) {
+ switch (reg_size) {
case 1:
cb->write = crossbar_writeb;
break;
@@ -304,7 +304,7 @@ static int __init crossbar_of_init(struc
continue;
cb->register_offsets[i] = reserved;
- reserved += size;
+ reserved += reg_size;
}
of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 057/105] arm: KVM: Survive unknown traps from guests
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 055/105] irqchip/crossbar: Fix incorrect type of register size Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 058/105] arm64: " Greg Kroah-Hartman
` (48 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Martin, Suzuki K Poulose,
Christoffer Dall, Mark Rutland, Marc Zyngier, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit f050fe7a9164945dd1c28be05bf00e8cfb082ccf ]
Currently we BUG() if we see a HSR.EC value we don't recognise. As
configurable disables/enables are added to the architecture (controlled
by RES1/RES0 bits respectively), with associated synchronous exceptions,
it may be possible for a guest to trigger exceptions with classes that
we don't recognise.
While we can't service these exceptions in a manner useful to the guest,
we can avoid bringing down the host. Per ARM DDI 0406C.c, all currently
unallocated HSR EC encodings are reserved, and per ARM DDI
0487A.k_iss10775, page G6-4395, EC values within the range 0x00 - 0x2c
are reserved for future use with synchronous exceptions, and EC values
within the range 0x2d - 0x3f may be used for either synchronous or
asynchronous exceptions.
The patch makes KVM handle any unknown EC by injecting an UNDEFINED
exception into the guest, with a corresponding (ratelimited) warning in
the host dmesg. We could later improve on this with with a new (opt-in)
exit to the host userspace.
Cc: Dave Martin <dave.martin@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/kvm_arm.h | 1 +
arch/arm/kvm/handle_exit.c | 19 ++++++++++++-------
2 files changed, 13 insertions(+), 7 deletions(-)
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -209,6 +209,7 @@
#define HSR_EC_IABT_HYP (0x21)
#define HSR_EC_DABT (0x24)
#define HSR_EC_DABT_HYP (0x25)
+#define HSR_EC_MAX (0x3f)
#define HSR_WFI_IS_WFE (1U << 0)
--- a/arch/arm/kvm/handle_exit.c
+++ b/arch/arm/kvm/handle_exit.c
@@ -100,7 +100,19 @@ static int kvm_handle_wfx(struct kvm_vcp
return 1;
}
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+ u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+ kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n",
+ hsr);
+
+ kvm_inject_undefined(vcpu);
+ return 1;
+}
+
static exit_handle_fn arm_exit_handlers[] = {
+ [0 ... HSR_EC_MAX] = kvm_handle_unknown_ec,
[HSR_EC_WFI] = kvm_handle_wfx,
[HSR_EC_CP15_32] = kvm_handle_cp15_32,
[HSR_EC_CP15_64] = kvm_handle_cp15_64,
@@ -122,13 +134,6 @@ static exit_handle_fn kvm_get_exit_handl
{
u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu);
- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
- !arm_exit_handlers[hsr_ec]) {
- kvm_err("Unknown exception class: hsr: %#08x\n",
- (unsigned int)kvm_vcpu_get_hsr(vcpu));
- BUG();
- }
-
return arm_exit_handlers[hsr_ec];
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 058/105] arm64: KVM: Survive unknown traps from guests
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 057/105] arm: KVM: Survive unknown traps from guests Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 059/105] spi_ks8995: fix "BUG: key accdaa28 not in .data!" Greg Kroah-Hartman
` (47 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dave Martin, Suzuki K Poulose,
Christoffer Dall, Mark Rutland, Marc Zyngier, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
[ Upstream commit ba4dd156eabdca93501d92a980ba27fa5f4bbd27 ]
Currently we BUG() if we see an ESR_EL2.EC value we don't recognise. As
configurable disables/enables are added to the architecture (controlled
by RES1/RES0 bits respectively), with associated synchronous exceptions,
it may be possible for a guest to trigger exceptions with classes that
we don't recognise.
While we can't service these exceptions in a manner useful to the guest,
we can avoid bringing down the host. Per ARM DDI 0487A.k_iss10775, page
D7-1937, EC values within the range 0x00 - 0x2c are reserved for future
use with synchronous exceptions, and EC values within the range 0x2d -
0x3f may be used for either synchronous or asynchronous exceptions.
The patch makes KVM handle any unknown EC by injecting an UNDEFINED
exception into the guest, with a corresponding (ratelimited) warning in
the host dmesg. We could later improve on this with with a new (opt-in)
exit to the host userspace.
Cc: Dave Martin <dave.martin@arm.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/handle_exit.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -121,7 +121,19 @@ static int kvm_handle_guest_debug(struct
return ret;
}
+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run)
+{
+ u32 hsr = kvm_vcpu_get_hsr(vcpu);
+
+ kvm_pr_unimpl("Unknown exception class: hsr: %#08x -- %s\n",
+ hsr, esr_get_class_string(hsr));
+
+ kvm_inject_undefined(vcpu);
+ return 1;
+}
+
static exit_handle_fn arm_exit_handlers[] = {
+ [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec,
[ESR_ELx_EC_WFx] = kvm_handle_wfx,
[ESR_ELx_EC_CP15_32] = kvm_handle_cp15_32,
[ESR_ELx_EC_CP15_64] = kvm_handle_cp15_64,
@@ -147,13 +159,6 @@ static exit_handle_fn kvm_get_exit_handl
u32 hsr = kvm_vcpu_get_hsr(vcpu);
u8 hsr_ec = hsr >> ESR_ELx_EC_SHIFT;
- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) ||
- !arm_exit_handlers[hsr_ec]) {
- kvm_err("Unknown exception class: hsr: %#08x -- %s\n",
- hsr, esr_get_class_string(hsr));
- BUG();
- }
-
return arm_exit_handlers[hsr_ec];
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 059/105] spi_ks8995: fix "BUG: key accdaa28 not in .data!"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 058/105] arm64: " Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 060/105] bnx2x: prevent crash when accessing PTP with interface down Greg Kroah-Hartman
` (46 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Maarten Blomme, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Blomme, Maarten" <Maarten.Blomme@flir.com>
[ Upstream commit 4342696df764ec65dcdfbd0c10d90ea52505f8ba ]
Signed-off-by: Maarten Blomme <Maarten.Blomme@flir.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/spi_ks8995.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/phy/spi_ks8995.c
+++ b/drivers/net/phy/spi_ks8995.c
@@ -310,6 +310,7 @@ static int ks8995_probe(struct spi_devic
if (err)
return err;
+ sysfs_attr_init(&ks->regs_attr.attr);
err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr);
if (err) {
dev_err(&spi->dev, "unable to create sysfs file, err=%d\n",
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 060/105] bnx2x: prevent crash when accessing PTP with interface down
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 059/105] spi_ks8995: fix "BUG: key accdaa28 not in .data!" Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:44 ` [PATCH 4.4 061/105] bnx2x: fix possible overrun of VFPF multicast addresses array Greg Kroah-Hartman
` (45 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Schmidt, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 466e8bf10ac104d96e1ea813e8126e11cb72ea20 ]
It is possible to crash the kernel by accessing a PTP device while its
associated bnx2x interface is down. Before the interface is brought up,
the timecounter is not initialized, so accessing it results in NULL
dereference.
Fix it by checking if the interface is up.
Use -ENETDOWN as the error code when the interface is down.
-EFAULT in bnx2x_ptp_adjfreq() did not seem right.
Tested using phc_ctl get/set/adj/freq commands.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -13646,7 +13646,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_
if (!netif_running(bp->dev)) {
DP(BNX2X_MSG_PTP,
"PTP adjfreq called while the interface is down\n");
- return -EFAULT;
+ return -ENETDOWN;
}
if (ppb < 0) {
@@ -13705,6 +13705,12 @@ static int bnx2x_ptp_adjtime(struct ptp_
{
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
+ if (!netif_running(bp->dev)) {
+ DP(BNX2X_MSG_PTP,
+ "PTP adjtime called while the interface is down\n");
+ return -ENETDOWN;
+ }
+
DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta);
timecounter_adjtime(&bp->timecounter, delta);
@@ -13717,6 +13723,12 @@ static int bnx2x_ptp_gettime(struct ptp_
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
u64 ns;
+ if (!netif_running(bp->dev)) {
+ DP(BNX2X_MSG_PTP,
+ "PTP gettime called while the interface is down\n");
+ return -ENETDOWN;
+ }
+
ns = timecounter_read(&bp->timecounter);
DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns);
@@ -13732,6 +13744,12 @@ static int bnx2x_ptp_settime(struct ptp_
struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info);
u64 ns;
+ if (!netif_running(bp->dev)) {
+ DP(BNX2X_MSG_PTP,
+ "PTP settime called while the interface is down\n");
+ return -ENETDOWN;
+ }
+
ns = timespec64_to_ns(ts);
DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 061/105] bnx2x: fix possible overrun of VFPF multicast addresses array
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 060/105] bnx2x: prevent crash when accessing PTP with interface down Greg Kroah-Hartman
@ 2017-12-15 9:44 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 062/105] bnx2x: do not rollback VF MAC/VLAN filters we did not configure Greg Kroah-Hartman
` (44 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:44 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Schmidt, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 22118d861cec5da6ed525aaf12a3de9bfeffc58f ]
It is too late to check for the limit of the number of VF multicast
addresses after they have already been copied to the req->multicast[]
array, possibly overflowing it.
Do the check before copying.
Also fix the error path to not skip unlocking vf2pf_mutex.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -868,7 +868,7 @@ int bnx2x_vfpf_set_mcast(struct net_devi
struct bnx2x *bp = netdev_priv(dev);
struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters;
struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp;
- int rc, i = 0;
+ int rc = 0, i = 0;
struct netdev_hw_addr *ha;
if (bp->state != BNX2X_STATE_OPEN) {
@@ -883,6 +883,15 @@ int bnx2x_vfpf_set_mcast(struct net_devi
/* Get Rx mode requested */
DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags);
+ /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */
+ if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) {
+ DP(NETIF_MSG_IFUP,
+ "VF supports not more than %d multicast MAC addresses\n",
+ PFVF_MAX_MULTICAST_PER_VF);
+ rc = -EINVAL;
+ goto out;
+ }
+
netdev_for_each_mc_addr(ha, dev) {
DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n",
bnx2x_mc_addr(ha));
@@ -890,16 +899,6 @@ int bnx2x_vfpf_set_mcast(struct net_devi
i++;
}
- /* We support four PFVF_MAX_MULTICAST_PER_VF mcast
- * addresses tops
- */
- if (i >= PFVF_MAX_MULTICAST_PER_VF) {
- DP(NETIF_MSG_IFUP,
- "VF supports not more than %d multicast MAC addresses\n",
- PFVF_MAX_MULTICAST_PER_VF);
- return -EINVAL;
- }
-
req->n_multicast = i;
req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED;
req->vf_qid = 0;
@@ -924,7 +923,7 @@ int bnx2x_vfpf_set_mcast(struct net_devi
out:
bnx2x_vfpf_finalize(bp, &req->first_tlv);
- return 0;
+ return rc;
}
/* request pf to add a vlan for the vf */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 062/105] bnx2x: do not rollback VF MAC/VLAN filters we did not configure
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2017-12-15 9:44 ` [PATCH 4.4 061/105] bnx2x: fix possible overrun of VFPF multicast addresses array Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 063/105] ipv6: reorder icmpv6_init() and ip6_mr_init() Greg Kroah-Hartman
` (43 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Schmidt, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 78d5505432436516456c12abbe705ec8dee7ee2b ]
On failure to configure a VF MAC/VLAN filter we should not attempt to
rollback filters that we failed to configure with -EEXIST.
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 8 +++++++-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 +
2 files changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -434,7 +434,9 @@ static int bnx2x_vf_mac_vlan_config(stru
/* Add/Remove the filter */
rc = bnx2x_config_vlan_mac(bp, &ramrod);
- if (rc && rc != -EEXIST) {
+ if (rc == -EEXIST)
+ return 0;
+ if (rc) {
BNX2X_ERR("Failed to %s %s\n",
filter->add ? "add" : "delete",
(filter->type == BNX2X_VF_FILTER_VLAN_MAC) ?
@@ -444,6 +446,8 @@ static int bnx2x_vf_mac_vlan_config(stru
return rc;
}
+ filter->applied = true;
+
return 0;
}
@@ -471,6 +475,8 @@ int bnx2x_vf_mac_vlan_config_list(struct
BNX2X_ERR("Managed only %d/%d filters - rolling back\n",
i, filters->count + 1);
while (--i >= 0) {
+ if (!filters->filters[i].applied)
+ continue;
filters->filters[i].add = !filters->filters[i].add;
bnx2x_vf_mac_vlan_config(bp, vf, qid,
&filters->filters[i],
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -114,6 +114,7 @@ struct bnx2x_vf_mac_vlan_filter {
(BNX2X_VF_FILTER_MAC | BNX2X_VF_FILTER_VLAN) /*shortcut*/
bool add;
+ bool applied;
u8 *mac;
u16 vid;
};
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 063/105] ipv6: reorder icmpv6_init() and ip6_mr_init()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 062/105] bnx2x: do not rollback VF MAC/VLAN filters we did not configure Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 064/105] crypto: s5p-sss - Fix completing crypto request in IRQ handler Greg Kroah-Hartman
` (42 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Cong Wang,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: WANG Cong <xiyou.wangcong@gmail.com>
[ Upstream commit 15e668070a64bb97f102ad9cf3bccbca0545cda8 ]
Andrey reported the following kernel crash:
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 14446 Comm: syz-executor6 Not tainted 4.10.0+ #82
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
task: ffff88001f311700 task.stack: ffff88001f6e8000
RIP: 0010:ip6mr_sk_done+0x15a/0x3d0 net/ipv6/ip6mr.c:1618
RSP: 0018:ffff88001f6ef418 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 1ffff10003edde8c RCX: ffffc900043ee000
RDX: 0000000000000004 RSI: ffffffff83e3b3f8 RDI: 0000000000000020
RBP: ffff88001f6ef508 R08: fffffbfff0dcc5d8 R09: 0000000000000000
R10: ffffffff86e62ec0 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: ffff88001f6ef4e0 R15: ffff8800380a0040
FS: 00007f7a52cec700(0000) GS:ffff88003ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000061c500 CR3: 000000001f1ae000 CR4: 00000000000006f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
rawv6_close+0x4c/0x80 net/ipv6/raw.c:1217
inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:432
sock_release+0x8d/0x1e0 net/socket.c:597
__sock_create+0x39d/0x880 net/socket.c:1226
sock_create_kern+0x3f/0x50 net/socket.c:1243
inet_ctl_sock_create+0xbb/0x280 net/ipv4/af_inet.c:1526
icmpv6_sk_init+0x163/0x500 net/ipv6/icmp.c:954
ops_init+0x10a/0x550 net/core/net_namespace.c:115
setup_net+0x261/0x660 net/core/net_namespace.c:291
copy_net_ns+0x27e/0x540 net/core/net_namespace.c:396
9pnet_virtio: no channels available for device ./file1
create_new_namespaces+0x437/0x9b0 kernel/nsproxy.c:106
unshare_nsproxy_namespaces+0xae/0x1e0 kernel/nsproxy.c:205
SYSC_unshare kernel/fork.c:2281 [inline]
SyS_unshare+0x64e/0x1000 kernel/fork.c:2231
entry_SYSCALL_64_fastpath+0x1f/0xc2
This is because net->ipv6.mr6_tables is not initialized at that point,
ip6mr_rules_init() is not called yet, therefore on the error path when
we iterator the list, we trigger this oops. Fix this by reordering
ip6mr_rules_init() before icmpv6_sk_init().
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/af_inet6.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -893,12 +893,12 @@ static int __init inet6_init(void)
err = register_pernet_subsys(&inet6_net_ops);
if (err)
goto register_pernet_fail;
- err = icmpv6_init();
- if (err)
- goto icmp_fail;
err = ip6_mr_init();
if (err)
goto ipmr_fail;
+ err = icmpv6_init();
+ if (err)
+ goto icmp_fail;
err = ndisc_init();
if (err)
goto ndisc_fail;
@@ -1016,10 +1016,10 @@ igmp_fail:
ndisc_cleanup();
ndisc_fail:
ip6_mr_cleanup();
-ipmr_fail:
- icmpv6_cleanup();
icmp_fail:
unregister_pernet_subsys(&inet6_net_ops);
+ipmr_fail:
+ icmpv6_cleanup();
register_pernet_fail:
sock_unregister(PF_INET6);
rtnl_unregister_all(PF_INET6);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 064/105] crypto: s5p-sss - Fix completing crypto request in IRQ handler
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 063/105] ipv6: reorder icmpv6_init() and ip6_mr_init() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 065/105] i2c: riic: fix restart condition Greg Kroah-Hartman
` (41 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Krzysztof Kozlowski, Herbert Xu, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit 07de4bc88ce6a4d898cad9aa4c99c1df7e87702d ]
In a regular interrupt handler driver was finishing the crypt/decrypt
request by calling complete on crypto request. This is disallowed since
converting to skcipher in commit b286d8b1a690 ("crypto: skcipher - Add
skcipher walk interface") and causes a warning:
WARNING: CPU: 0 PID: 0 at crypto/skcipher.c:430 skcipher_walk_first+0x13c/0x14c
The interrupt is marked shared but in fact there are no other users
sharing it. Thus the simplest solution seems to be to just use a
threaded interrupt handler, after converting it to oneshot.
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/s5p-sss.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/crypto/s5p-sss.c
+++ b/drivers/crypto/s5p-sss.c
@@ -664,8 +664,9 @@ static int s5p_aes_probe(struct platform
dev_warn(dev, "feed control interrupt is not available.\n");
goto err_irq;
}
- err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt,
- IRQF_SHARED, pdev->name, pdev);
+ err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL,
+ s5p_aes_interrupt, IRQF_ONESHOT,
+ pdev->name, pdev);
if (err < 0) {
dev_warn(dev, "feed control interrupt is not available.\n");
goto err_irq;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 065/105] i2c: riic: fix restart condition
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 064/105] crypto: s5p-sss - Fix completing crypto request in IRQ handler Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 066/105] zram: set physical queue limits to avoid array out of bounds accesses Greg Kroah-Hartman
` (40 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Simon Horman, Chris Brandt,
Simon Horman, Wolfram Sang, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Brandt <chris.brandt@renesas.com>
[ Upstream commit 2501c1bb054290679baad0ff7f4f07c714251f4c ]
While modifying the driver to use the STOP interrupt, the completion of the
intermediate transfers need to wake the driver back up in order to initiate
the next transfer (restart condition). Otherwise you get never ending
interrupts and only the first transfer sent.
Fixes: 71ccea095ea1 ("i2c: riic: correctly finish transfers")
Reported-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Chris Brandt <chris.brandt@renesas.com>
Tested-by: Simon Horman <horms+renesas@verge.net.au>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-riic.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/i2c/busses/i2c-riic.c
+++ b/drivers/i2c/busses/i2c-riic.c
@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq
}
if (riic->is_last || riic->err) {
- riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER);
+ riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER);
writeb(ICCR2_SP, riic->base + RIIC_ICCR2);
+ } else {
+ /* Transfer is complete, but do not send STOP */
+ riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER);
+ complete(&riic->msg_done);
}
return IRQ_HANDLED;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 066/105] zram: set physical queue limits to avoid array out of bounds accesses
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 065/105] i2c: riic: fix restart condition Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 067/105] netfilter: dont track fragmented packets Greg Kroah-Hartman
` (39 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Thumshirn, Hannes Reinecke,
Sergey Senozhatsky, Jens Axboe, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <jthumshirn@suse.de>
[ Upstream commit 0bc315381fe9ed9fb91db8b0e82171b645ac008f ]
zram can handle at most SECTORS_PER_PAGE sectors in a bio's bvec. When using
the NVMe over Fabrics loopback target which potentially sends a huge bulk of
pages attached to the bio's bvec this results in a kernel panic because of
array out of bounds accesses in zram_decompress_page().
Signed-off-by: Johannes Thumshirn <jthumshirn@suse.de>
Reviewed-by: Hannes Reinecke <hare@suse.com>
Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1247,6 +1247,8 @@ static int zram_add(void)
blk_queue_io_min(zram->disk->queue, PAGE_SIZE);
blk_queue_io_opt(zram->disk->queue, PAGE_SIZE);
zram->disk->queue->limits.discard_granularity = PAGE_SIZE;
+ zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE;
+ zram->disk->queue->limits.chunk_sectors = 0;
blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX);
/*
* zram_bio_discard() will clear all logical blocks if logical block
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 067/105] netfilter: dont track fragmented packets
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 066/105] zram: set physical queue limits to avoid array out of bounds accesses Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 068/105] axonram: Fix gendisk handling Greg Kroah-Hartman
` (38 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Konovalov, Florian Westphal,
Pablo Neira Ayuso, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 7b4fdf77a450ec0fdcb2f677b080ddbf2c186544 ]
Andrey reports syzkaller splat caused by
NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
in ipv4 nat. But this assertion (and the comment) are wrong, this function
does see fragments when IP_NODEFRAG setsockopt is used.
As conntrack doesn't track packets without complete l4 header, only the
first fragment is tracked.
Because applying nat to first packet but not the rest makes no sense this
also turns off tracking of all fragments.
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 ++++
net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 5 -----
2 files changed, 4 insertions(+), 5 deletions(-)
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -158,6 +158,10 @@ static unsigned int ipv4_conntrack_local
if (skb->len < sizeof(struct iphdr) ||
ip_hdrlen(skb) < sizeof(struct iphdr))
return NF_ACCEPT;
+
+ if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */
+ return NF_ACCEPT;
+
return nf_conntrack_in(state->net, PF_INET, state->hook, skb);
}
--- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c
@@ -268,11 +268,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buf
/* maniptype == SRC for postrouting. */
enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook);
- /* We never see fragments: conntrack defrags on pre-routing
- * and local-out, and nf_nat_out protects post-routing.
- */
- NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb)));
-
ct = nf_ct_get(skb, &ctinfo);
/* Can't track? It's not due to stress, or conntrack would
* have dropped it. Hence it's the user's responsibilty to
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 068/105] axonram: Fix gendisk handling
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 067/105] netfilter: dont track fragmented packets Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 069/105] drm/amd/amdgpu: fix console deadlock if late init failed Greg Kroah-Hartman
` (37 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dan Carpenter, Jan Kara, Jens Axboe,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
[ Upstream commit 672a2c87c83649fb0167202342ce85af9a3b4f1c ]
It is invalid to call del_gendisk() when disk->queue is NULL. Fix error
handling in axon_ram_probe() to avoid doing that.
Also del_gendisk() does not drop a reference to gendisk allocated by
alloc_disk(). That has to be done by put_disk(). Add that call where
needed.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/sysdev/axonram.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/powerpc/sysdev/axonram.c
+++ b/arch/powerpc/sysdev/axonram.c
@@ -276,7 +276,9 @@ failed:
if (bank->disk->major > 0)
unregister_blkdev(bank->disk->major,
bank->disk->disk_name);
- del_gendisk(bank->disk);
+ if (bank->disk->flags & GENHD_FL_UP)
+ del_gendisk(bank->disk);
+ put_disk(bank->disk);
}
device->dev.platform_data = NULL;
if (bank->io_addr != 0)
@@ -301,6 +303,7 @@ axon_ram_remove(struct platform_device *
device_remove_file(&device->dev, &dev_attr_ecc);
free_irq(bank->irq_id, device);
del_gendisk(bank->disk);
+ put_disk(bank->disk);
iounmap((void __iomem *) bank->io_addr);
kfree(bank);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 069/105] drm/amd/amdgpu: fix console deadlock if late init failed
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 068/105] axonram: Fix gendisk handling Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 070/105] powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested Greg Kroah-Hartman
` (36 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jim Qu, Alex Deucher, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Qu <Jim.Qu@amd.com>
[ Upstream commit c085bd5119d5d0bdf3ef591a5563566be7dedced ]
Signed-off-by: Jim Qu <Jim.Qu@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1760,8 +1760,11 @@ int amdgpu_resume_kms(struct drm_device
}
r = amdgpu_late_init(adev);
- if (r)
+ if (r) {
+ if (fbcon)
+ console_unlock();
return r;
+ }
/* pin cursors */
list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 070/105] powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 069/105] drm/amd/amdgpu: fix console deadlock if late init failed Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 073/105] kbuild: pkg: use --transform option to prefix paths in tar Greg Kroah-Hartman
` (35 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Gavin Shan,
Michael Ellerman, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kardashevskiy <aik@ozlabs.ru>
[ Upstream commit 7aafac11e308d37ed3c509829bb43d80c1811ac3 ]
The IODA2 specification says that a 64 DMA address cannot use top 4 bits
(3 are reserved and one is a "TVE select"); bottom page_shift bits
cannot be used for multilevel table addressing either.
The existing IODA2 table allocation code aligns the minimum TCE table
size to PAGE_SIZE so in the case of 64K system pages and 4K IOMMU pages,
we have 64-4-12=48 bits. Since 64K page stores 8192 TCEs, i.e. needs
13 bits, the maximum number of levels is 48/13 = 3 so we physically
cannot address more and EEH happens on DMA accesses.
This adds a check that too many levels were requested.
It is still possible to have 5 levels in the case of 4K system page size.
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Acked-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/powernv/pci-ioda.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/powerpc/platforms/powernv/pci-ioda.c
+++ b/arch/powerpc/platforms/powernv/pci-ioda.c
@@ -2270,6 +2270,9 @@ static long pnv_pci_ioda2_table_alloc_pa
level_shift = entries_shift + 3;
level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
+ if ((level_shift - 3) * levels + page_shift >= 60)
+ return -EINVAL;
+
/* Allocate TCE table */
addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift,
levels, tce_table_size, &offset, &total_allocated);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 073/105] kbuild: pkg: use --transform option to prefix paths in tar
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 070/105] powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 074/105] mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() Greg Kroah-Hartman
` (34 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Masahiro Yamada, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <yamada.masahiro@socionext.com>
[ Upstream commit 2dbc644ac62bbcb9ee78e84719953f611be0413d ]
For rpm-pkg and deb-pkg, a source tar file is created. All paths in
the archive must be prefixed with the base name of the tar so that
everything is contained in the directory when you extract it.
Currently, scripts/package/Makefile uses a symlink for that, and
removes it after the tar is created.
If you terminate the build during the tar creation, the symlink is
left over. Then, at the next package build, you will see a warning
like follows:
ln: '.' and 'kernel-4.14.0+/.' are the same file
It is possible to fix it by adding -n (--no-dereference) option to
the "ln" command, but a cleaner way is to use --transform option
of "tar" command. This option is GNU extension, but it should not
hurt to use it in the Linux build system.
The 'S' flag is needed to exclude symlinks from the path fixup.
Without it, symlinks in the kernel are broken.
Signed-off-by: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/package/Makefile | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/scripts/package/Makefile
+++ b/scripts/package/Makefile
@@ -39,10 +39,9 @@ if test "$(objtree)" != "$(srctree)"; th
false; \
fi ; \
$(srctree)/scripts/setlocalversion --save-scmversion; \
-ln -sf $(srctree) $(2); \
tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \
- $(addprefix $(2)/,$(TAR_CONTENT) $(3)); \
-rm -f $(2) $(objtree)/.scmversion
+ --transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \
+rm -f $(objtree)/.scmversion
# rpm-pkg
# ---------------------------------------------------------------------------
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 074/105] mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 073/105] kbuild: pkg: use --transform option to prefix paths in tar Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 075/105] route: also update fnhe_genid when updating a route cache Greg Kroah-Hartman
` (33 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Johannes Berg, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
[ Upstream commit 67bd52386125ce1159c0581cbcd2740addf33cd4 ]
hwsim_new_radio_nl() now copies the name attribute in order to add a
null-terminator. mac80211_hwsim_new_radio() (indirectly) copies it
again into the net_device structure, so the first copy is not used or
freed later. Free the first copy before returning.
Fixes: ff4dd73dd2b4 ("mac80211_hwsim: check HWSIM_ATTR_RADIO_NAME length")
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mac80211_hwsim.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2885,6 +2885,7 @@ static int hwsim_new_radio_nl(struct sk_
{
struct hwsim_new_radio_params param = { 0 };
const char *hwname = NULL;
+ int ret;
param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG];
param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE];
@@ -2924,7 +2925,9 @@ static int hwsim_new_radio_nl(struct sk_
param.regd = hwsim_world_regdom_custom[idx];
}
- return mac80211_hwsim_new_radio(info, ¶m);
+ ret = mac80211_hwsim_new_radio(info, ¶m);
+ kfree(hwname);
+ return ret;
}
static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 075/105] route: also update fnhe_genid when updating a route cache
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 074/105] mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 076/105] route: update fnhe_expires for redirect when the fnhe exists Greg Kroah-Hartman
` (32 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hannes Frederic Sowa, Xin Long,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit cebe84c6190d741045a322f5343f717139993c08 ]
Now when ip route flush cache and it turn out all fnhe_genid != genid.
If a redirect/pmtu icmp packet comes and the old fnhe is found and all
it's members but fnhe_genid will be updated.
Then next time when it looks up route and tries to rebind this fnhe to
the new dst, the fnhe will be flushed due to fnhe_genid != genid. It
causes this redirect/pmtu icmp packet acutally not to be applied.
This patch is to also reset fnhe_genid when updating a route cache.
Fixes: 5aad1de5ea2c ("ipv4: use separate genid for next hop exceptions")
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -624,9 +624,12 @@ static void update_or_create_fnhe(struct
struct fnhe_hash_bucket *hash;
struct fib_nh_exception *fnhe;
struct rtable *rt;
+ u32 genid, hval;
unsigned int i;
int depth;
- u32 hval = fnhe_hashfun(daddr);
+
+ genid = fnhe_genid(dev_net(nh->nh_dev));
+ hval = fnhe_hashfun(daddr);
spin_lock_bh(&fnhe_lock);
@@ -649,6 +652,8 @@ static void update_or_create_fnhe(struct
}
if (fnhe) {
+ if (fnhe->fnhe_genid != genid)
+ fnhe->fnhe_genid = genid;
if (gw)
fnhe->fnhe_gw = gw;
if (pmtu) {
@@ -673,7 +678,7 @@ static void update_or_create_fnhe(struct
fnhe->fnhe_next = hash->chain;
rcu_assign_pointer(hash->chain, fnhe);
}
- fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev));
+ fnhe->fnhe_genid = genid;
fnhe->fnhe_daddr = daddr;
fnhe->fnhe_gw = gw;
fnhe->fnhe_pmtu = pmtu;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 076/105] route: update fnhe_expires for redirect when the fnhe exists
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 075/105] route: also update fnhe_genid when updating a route cache Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 077/105] lib/genalloc.c: make the avail variable an atomic_long_t Greg Kroah-Hartman
` (31 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianlin Shi, Hannes Frederic Sowa,
Xin Long, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit e39d5246111399dbc6e11cd39fd8580191b86c47 ]
Now when creating fnhe for redirect, it sets fnhe_expires for this
new route cache. But when updating the exist one, it doesn't do it.
It will cause this fnhe never to be expired.
Paolo already noticed it before, in Jianlin's test case, it became
even worse:
When ip route flush cache, the old fnhe is not to be removed, but
only clean it's members. When redirect comes again, this fnhe will
be found and updated, but never be expired due to fnhe_expires not
being set.
So fix it by simply updating fnhe_expires even it's for redirect.
Fixes: aee06da6726d ("ipv4: use seqlock for nh_exceptions")
Reported-by: Jianlin Shi <jishi@redhat.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -656,10 +656,9 @@ static void update_or_create_fnhe(struct
fnhe->fnhe_genid = genid;
if (gw)
fnhe->fnhe_gw = gw;
- if (pmtu) {
+ if (pmtu)
fnhe->fnhe_pmtu = pmtu;
- fnhe->fnhe_expires = max(1UL, expires);
- }
+ fnhe->fnhe_expires = max(1UL, expires);
/* Update all cached dsts too */
rt = rcu_dereference(fnhe->fnhe_rth_input);
if (rt)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 077/105] lib/genalloc.c: make the avail variable an atomic_long_t
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 076/105] route: update fnhe_expires for redirect when the fnhe exists Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 078/105] dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 Greg Kroah-Hartman
` (30 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Stephen Bates, Logan Gunthorpe,
Mathieu Desnoyers, Daniel Mentz, Jonathan Corbet, Andrew Morton,
Will Deacon, Linus Torvalds, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Bates <sbates@raithlin.com>
[ Upstream commit 36a3d1dd4e16bcd0d2ddfb4a2ec7092f0ae0d931 ]
If the amount of resources allocated to a gen_pool exceeds 2^32 then the
avail atomic overflows and this causes problems when clients try and
borrow resources from the pool. This is only expected to be an issue on
64 bit systems.
Add the <linux/atomic.h> header to pull in atomic_long* operations. So
that 32 bit systems continue to use atomic32_t but 64 bit systems can
use atomic64_t.
Link: http://lkml.kernel.org/r/1509033843-25667-1-git-send-email-sbates@raithlin.com
Signed-off-by: Stephen Bates <sbates@raithlin.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Daniel Mentz <danielmentz@google.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/genalloc.h | 3 ++-
lib/genalloc.c | 10 +++++-----
2 files changed, 7 insertions(+), 6 deletions(-)
--- a/include/linux/genalloc.h
+++ b/include/linux/genalloc.h
@@ -31,6 +31,7 @@
#define __GENALLOC_H__
#include <linux/spinlock_types.h>
+#include <linux/atomic.h>
struct device;
struct device_node;
@@ -68,7 +69,7 @@ struct gen_pool {
*/
struct gen_pool_chunk {
struct list_head next_chunk; /* next chunk in pool */
- atomic_t avail;
+ atomic_long_t avail;
phys_addr_t phys_addr; /* physical starting address of memory chunk */
unsigned long start_addr; /* start address of memory chunk */
unsigned long end_addr; /* end address of memory chunk (inclusive) */
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -194,7 +194,7 @@ int gen_pool_add_virt(struct gen_pool *p
chunk->phys_addr = phys;
chunk->start_addr = virt;
chunk->end_addr = virt + size - 1;
- atomic_set(&chunk->avail, size);
+ atomic_long_set(&chunk->avail, size);
spin_lock(&pool->lock);
list_add_rcu(&chunk->next_chunk, &pool->chunks);
@@ -285,7 +285,7 @@ unsigned long gen_pool_alloc(struct gen_
nbits = (size + (1UL << order) - 1) >> order;
rcu_read_lock();
list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) {
- if (size > atomic_read(&chunk->avail))
+ if (size > atomic_long_read(&chunk->avail))
continue;
start_bit = 0;
@@ -305,7 +305,7 @@ retry:
addr = chunk->start_addr + ((unsigned long)start_bit << order);
size = nbits << order;
- atomic_sub(size, &chunk->avail);
+ atomic_long_sub(size, &chunk->avail);
break;
}
rcu_read_unlock();
@@ -371,7 +371,7 @@ void gen_pool_free(struct gen_pool *pool
remain = bitmap_clear_ll(chunk->bits, start_bit, nbits);
BUG_ON(remain);
size = nbits << order;
- atomic_add(size, &chunk->avail);
+ atomic_long_add(size, &chunk->avail);
rcu_read_unlock();
return;
}
@@ -445,7 +445,7 @@ size_t gen_pool_avail(struct gen_pool *p
rcu_read_lock();
list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk)
- avail += atomic_read(&chunk->avail);
+ avail += atomic_long_read(&chunk->avail);
rcu_read_unlock();
return avail;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 078/105] dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 077/105] lib/genalloc.c: make the avail variable an atomic_long_t Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 079/105] NFS: Fix a typo in nfs_rename() Greg Kroah-Hartman
` (29 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Jason Baron,
Andrew Morton, Linus Torvalds, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 1f3c790bd5989fcfec9e53ad8fa09f5b740c958f ]
line-range is supposed to treat "1-" as "1-endoffile", so
handle the special case by setting last_lineno to UINT_MAX.
Fixes this error:
dynamic_debug:ddebug_parse_query: last-line:0 < 1st-line:1
dynamic_debug:ddebug_exec_query: query parse failed
Link: http://lkml.kernel.org/r/10a6a101-e2be-209f-1f41-54637824788e@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Jason Baron <jbaron@akamai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/dynamic_debug.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -353,6 +353,10 @@ static int ddebug_parse_query(char *word
if (parse_lineno(last, &query->last_lineno) < 0)
return -EINVAL;
+ /* special case for last lineno not specified */
+ if (query->last_lineno == 0)
+ query->last_lineno = UINT_MAX;
+
if (query->last_lineno < query->first_lineno) {
pr_err("last-line:%d < 1st-line:%d\n",
query->last_lineno,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 079/105] NFS: Fix a typo in nfs_rename()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 078/105] dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 080/105] sunrpc: Fix rpc_task_begin trace point Greg Kroah-Hartman
` (28 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Trond Myklebust, Anna Schumaker, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@primarydata.com>
[ Upstream commit d803224c84be067754db7fa58a93f36f61566493 ]
On successful rename, the "old_dentry" is retained and is attached to
the "new_dir", so we need to call nfs_set_verifier() accordingly.
Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/dir.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -2051,7 +2051,7 @@ out:
if (new_inode != NULL)
nfs_drop_nlink(new_inode);
d_move(old_dentry, new_dentry);
- nfs_set_verifier(new_dentry,
+ nfs_set_verifier(old_dentry,
nfs_save_change_attribute(new_dir));
} else if (error == -ENOENT)
nfs_dentry_handle_enoent(old_dentry);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 080/105] sunrpc: Fix rpc_task_begin trace point
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 079/105] NFS: Fix a typo in nfs_rename() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 081/105] block: wake up all tasks blocked in get_request() Greg Kroah-Hartman
` (27 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chuck Lever, Anna Schumaker, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit b2bfe5915d5fe7577221031a39ac722a0a2a1199 ]
The rpc_task_begin trace point always display a task ID of zero.
Move the trace point call site so that it picks up the new task ID.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sunrpc/sched.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -273,10 +273,9 @@ static inline void rpc_task_set_debuginf
static void rpc_set_active(struct rpc_task *task)
{
- trace_rpc_task_begin(task->tk_client, task, NULL);
-
rpc_task_set_debuginfo(task);
set_bit(RPC_TASK_ACTIVE, &task->tk_runstate);
+ trace_rpc_task_begin(task->tk_client, task, NULL);
}
/*
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 081/105] block: wake up all tasks blocked in get_request()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 080/105] sunrpc: Fix rpc_task_begin trace point Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 082/105] sparc64/mm: set fields in deferred pages Greg Kroah-Hartman
` (26 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ming Lei, Jens Axboe, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <ming.lei@redhat.com>
[ Upstream commit 34d9715ac1edd50285168dd8d80c972739a4f6a4 ]
Once blk_set_queue_dying() is done in blk_cleanup_queue(), we call
blk_freeze_queue() and wait for q->q_usage_counter becoming zero. But
if there are tasks blocked in get_request(), q->q_usage_counter can
never become zero. So we have to wake up all these tasks in
blk_set_queue_dying() first.
Fixes: 3ef28e83ab157997 ("block: generic request_queue reference counting")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -526,8 +526,8 @@ void blk_set_queue_dying(struct request_
blk_queue_for_each_rl(rl, q) {
if (rl->rq_pool) {
- wake_up(&rl->wait[BLK_RW_SYNC]);
- wake_up(&rl->wait[BLK_RW_ASYNC]);
+ wake_up_all(&rl->wait[BLK_RW_SYNC]);
+ wake_up_all(&rl->wait[BLK_RW_ASYNC]);
}
}
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 082/105] sparc64/mm: set fields in deferred pages
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 081/105] block: wake up all tasks blocked in get_request() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 083/105] sctp: do not free asoc when it is already dead in sctp_sendmsg Greg Kroah-Hartman
` (25 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pavel Tatashin, Steven Sistare,
Daniel Jordan, Bob Picco, David S. Miller, Michal Hocko,
Alexander Potapenko, Andrey Ryabinin, Ard Biesheuvel,
Catalin Marinas, Christian Borntraeger, Dmitry Vyukov,
Heiko Carstens, H. Peter Anvin, Ingo Molnar, Mark Rutland,
Matthew Wilcox, Mel Gorman, Michal Hocko, Sam Ravnborg,
Thomas Gleixner, Will Deacon, Andrew Morton, Linus Torvalds,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Tatashin <pasha.tatashin@oracle.com>
[ Upstream commit 2a20aa171071a334d80c4e5d5af719d8374702fc ]
Without deferred struct page feature (CONFIG_DEFERRED_STRUCT_PAGE_INIT),
flags and other fields in "struct page"es are never changed prior to
first initializing struct pages by going through __init_single_page().
With deferred struct page feature enabled there is a case where we set
some fields prior to initializing:
mem_init() {
register_page_bootmem_info();
free_all_bootmem();
...
}
When register_page_bootmem_info() is called only non-deferred struct
pages are initialized. But, this function goes through some reserved
pages which might be part of the deferred, and thus are not yet
initialized.
mem_init
register_page_bootmem_info
register_page_bootmem_info_node
get_page_bootmem
.. setting fields here ..
such as: page->freelist = (void *)type;
free_all_bootmem()
free_low_memory_core_early()
for_each_reserved_mem_region()
reserve_bootmem_region()
init_reserved_page() <- Only if this is deferred reserved page
__init_single_pfn()
__init_single_page()
memset(0) <-- Loose the set fields here
We end up with similar issue as in the previous patch, where currently
we do not observe problem as memory is zeroed. But, if flag asserts are
changed we can start hitting issues.
Also, because in this patch series we will stop zeroing struct page
memory during allocation, we must make sure that struct pages are
properly initialized prior to using them.
The deferred-reserved pages are initialized in free_all_bootmem().
Therefore, the fix is to switch the above calls.
Link: http://lkml.kernel.org/r/20171013173214.27300-4-pasha.tatashin@oracle.com
Signed-off-by: Pavel Tatashin <pasha.tatashin@oracle.com>
Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
Reviewed-by: Daniel Jordan <daniel.m.jordan@oracle.com>
Reviewed-by: Bob Picco <bob.picco@oracle.com>
Acked-by: David S. Miller <davem@davemloft.net>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/sparc/mm/init_64.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/arch/sparc/mm/init_64.c
+++ b/arch/sparc/mm/init_64.c
@@ -2402,10 +2402,17 @@ void __init mem_init(void)
{
high_memory = __va(last_valid_pfn << PAGE_SHIFT);
- register_page_bootmem_info();
free_all_bootmem();
/*
+ * Must be done after boot memory is put on freelist, because here we
+ * might set fields in deferred struct pages that have not yet been
+ * initialized, and free_all_bootmem() initializes all the reserved
+ * deferred pages for us.
+ */
+ register_page_bootmem_info();
+
+ /*
* Set up the zero page, mark it reserved, so that page count
* is not manipulated when freeing the page from user ptes.
*/
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 083/105] sctp: do not free asoc when it is already dead in sctp_sendmsg
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 082/105] sparc64/mm: set fields in deferred pages Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 084/105] sctp: use the right sk after waking up from wait_buf sleep Greg Kroah-Hartman
` (24 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Horman, Dmitry Vyukov, Xin Long,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit ca3af4dd28cff4e7216e213ba3b671fbf9f84758 ]
Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without
holding sock sk. It means the current asoc can be freed elsewhere,
like when receiving an abort packet.
If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf
returns err, the asoc will be freed again due to new_asoc is not nil.
An use-after-free issue would be triggered by this.
This patch is to fix it by setting new_asoc with nil if the asoc is
already dead when cpu schedules back, so that it will not be freed
again in sctp_sendmsg.
v1->v2:
set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf.
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1954,8 +1954,14 @@ static int sctp_sendmsg(struct sock *sk,
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
if (!sctp_wspace(asoc)) {
err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
- if (err)
+ if (err) {
+ if (err == -ESRCH) {
+ /* asoc is already dead. */
+ new_asoc = NULL;
+ err = -EPIPE;
+ }
goto out_free;
+ }
}
/* If an address is passed with the sendto/sendmsg call, it is used
@@ -6992,10 +6998,11 @@ static int sctp_wait_for_sndbuf(struct s
for (;;) {
prepare_to_wait_exclusive(&asoc->wait, &wait,
TASK_INTERRUPTIBLE);
+ if (asoc->base.dead)
+ goto do_dead;
if (!*timeo_p)
goto do_nonblock;
- if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING ||
- asoc->base.dead)
+ if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING)
goto do_error;
if (signal_pending(current))
goto do_interrupted;
@@ -7020,6 +7027,10 @@ out:
return err;
+do_dead:
+ err = -ESRCH;
+ goto out;
+
do_error:
err = -EPIPE;
goto out;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 084/105] sctp: use the right sk after waking up from wait_buf sleep
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 083/105] sctp: do not free asoc when it is already dead in sctp_sendmsg Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 085/105] atm: horizon: Fix irq release error Greg Kroah-Hartman
` (23 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Neil Horman, Xin Long,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit cea0cc80a6777beb6eb643d4ad53690e1ad1d4ff ]
Commit dfcb9f4f99f1 ("sctp: deny peeloff operation on asocs with threads
sleeping on it") fixed the race between peeloff and wait sndbuf by
checking waitqueue_active(&asoc->wait) in sctp_do_peeloff().
But it actually doesn't work, as even if waitqueue_active returns false
the waiting sndbuf thread may still not yet hold sk lock. After asoc is
peeled off, sk is not asoc->base.sk any more, then to hold the old sk
lock couldn't make assoc safe to access.
This patch is to fix this by changing to hold the new sk lock if sk is
not asoc->base.sk, meanwhile, also set the sk in sctp_sendmsg with the
new sk.
With this fix, there is no more race between peeloff and waitbuf, the
check 'waitqueue_active' in sctp_do_peeloff can be removed.
Thanks Marcelo and Neil for making this clear.
v1->v2:
fix it by changing to lock the new sock instead of adding a flag in asoc.
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sctp/socket.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -82,8 +82,8 @@
/* Forward declarations for internal helper functions. */
static int sctp_writeable(struct sock *sk);
static void sctp_wfree(struct sk_buff *skb);
-static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,
- size_t msg_len);
+static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
+ size_t msg_len, struct sock **orig_sk);
static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);
static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);
static int sctp_wait_for_accept(struct sock *sk, long timeo);
@@ -1953,7 +1953,8 @@ static int sctp_sendmsg(struct sock *sk,
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
if (!sctp_wspace(asoc)) {
- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);
+ /* sk can be changed by peel off when waiting for buf. */
+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);
if (err) {
if (err == -ESRCH) {
/* asoc is already dead. */
@@ -4466,12 +4467,6 @@ int sctp_do_peeloff(struct sock *sk, sct
if (!asoc)
return -EINVAL;
- /* If there is a thread waiting on more sndbuf space for
- * sending on this asoc, it cannot be peeled.
- */
- if (waitqueue_active(&asoc->wait))
- return -EBUSY;
-
/* An association cannot be branched off from an already peeled-off
* socket, nor is this supported for tcp style sockets.
*/
@@ -6981,7 +6976,7 @@ void sctp_sock_rfree(struct sk_buff *skb
/* Helper function to wait for space in the sndbuf. */
static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
- size_t msg_len)
+ size_t msg_len, struct sock **orig_sk)
{
struct sock *sk = asoc->base.sk;
int err = 0;
@@ -7015,11 +7010,17 @@ static int sctp_wait_for_sndbuf(struct s
release_sock(sk);
current_timeo = schedule_timeout(current_timeo);
lock_sock(sk);
+ if (sk != asoc->base.sk) {
+ release_sock(sk);
+ sk = asoc->base.sk;
+ lock_sock(sk);
+ }
*timeo_p = current_timeo;
}
out:
+ *orig_sk = sk;
finish_wait(&asoc->wait, &wait);
/* Release the association's refcnt. */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 085/105] atm: horizon: Fix irq release error
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (77 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 084/105] sctp: use the right sk after waking up from wait_buf sleep Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 086/105] jump_label: Invoke jump_label_test() via early_initcall() Greg Kroah-Hartman
` (22 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Arvind Yadav, David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arvind Yadav <arvind.yadav.cs@gmail.com>
[ Upstream commit bde533f2ea607cbbbe76ef8738b36243939a7bc2 ]
atm_dev_register() can fail here and passed parameters to free irq
which is not initialised. Initialization of 'dev->irq' happened after
the 'goto out_free_irq'. So using 'irq' insted of 'dev->irq' in
free_irq().
Signed-off-by: Arvind Yadav <arvind.yadav.cs@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/horizon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@@ -2804,7 +2804,7 @@ out:
return err;
out_free_irq:
- free_irq(dev->irq, dev);
+ free_irq(irq, dev);
out_free:
kfree(dev);
out_release:
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 086/105] jump_label: Invoke jump_label_test() via early_initcall()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 085/105] atm: horizon: Fix irq release error Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 087/105] xfrm: Copy policy family in clone_policy Greg Kroah-Hartman
` (21 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Fengguang Wu, Jason Baron,
Paul E. McKenney, Linus Torvalds, Peter Zijlstra, Steven Rostedt,
Thomas Gleixner, Ingo Molnar, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Baron <jbaron@akamai.com>
[ Upstream commit 92ee46efeb505ead3ab06d3c5ce695637ed5f152 ]
Fengguang Wu reported that running the rcuperf test during boot can cause
the jump_label_test() to hit a WARN_ON(). The issue is that the core jump
label code relies on kernel_text_address() to detect when it can no longer
update branches that may be contained in __init sections. The
kernel_text_address() in turn assumes that if the system_state variable is
greter than or equal to SYSTEM_RUNNING then __init sections are no longer
valid (since the assumption is that they have been freed). However, when
rcuperf is setup to run in early boot it can call kernel_power_off() which
sets the system_state to SYSTEM_POWER_OFF.
Since rcuperf initialization is invoked via a module_init(), we can make
the dependency of jump_label_test() needing to complete before rcuperf
explicit by calling it via early_initcall().
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Jason Baron <jbaron@akamai.com>
Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1510609727-2238-1-git-send-email-jbaron@akamai.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/jump_label.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/jump_label.c
+++ b/kernel/jump_label.c
@@ -553,7 +553,7 @@ static __init int jump_label_test(void)
return 0;
}
-late_initcall(jump_label_test);
+early_initcall(jump_label_test);
#endif /* STATIC_KEYS_SELFTEST */
#endif /* HAVE_JUMP_LABEL */
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 087/105] xfrm: Copy policy family in clone_policy
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 086/105] jump_label: Invoke jump_label_test() via early_initcall() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 088/105] IB/mlx4: Increase maximal message size under UD QP Greg Kroah-Hartman
` (20 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Herbert Xu, Steffen Klassert,
Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 0e74aa1d79a5bbc663e03a2804399cae418a0321 ]
The syzbot found an ancient bug in the IPsec code. When we cloned
a socket policy (for example, for a child TCP socket derived from a
listening socket), we did not copy the family field. This results
in a live policy with a zero family field. This triggers a BUG_ON
check in the af_key code when the cloned policy is retrieved.
This patch fixes it by copying the family field over.
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_policy.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1361,6 +1361,7 @@ static struct xfrm_policy *clone_policy(
newp->xfrm_nr = old->xfrm_nr;
newp->index = old->index;
newp->type = old->type;
+ newp->family = old->family;
memcpy(newp->xfrm_vec, old->xfrm_vec,
newp->xfrm_nr*sizeof(struct xfrm_tmpl));
write_lock_bh(&net->xfrm.xfrm_policy_lock);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 088/105] IB/mlx4: Increase maximal message size under UD QP
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 087/105] xfrm: Copy policy family in clone_policy Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 089/105] IB/mlx5: Assign send CQ and recv CQ of UMR QP Greg Kroah-Hartman
` (19 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mark Bloch, Majd Dibbiny,
Leon Romanovsky, Doug Ledford, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Bloch <markb@mellanox.com>
[ Upstream commit 5f22a1d87c5315a98981ecf93cd8de226cffe6ca ]
Maximal message should be used as a limit to the max message payload allowed,
without the headers. The ConnectX-3 check is done against this value includes
the headers. When the payload is 4K this will cause the NIC to drop packets.
Increase maximal message to 8K as workaround, this shouldn't change current
behaviour because we continue to set the MTU to 4k.
To reproduce;
set MTU to 4296 on the corresponding interface, for example:
ifconfig eth0 mtu 4296 (both server and client)
On server:
ib_send_bw -c UD -d mlx4_0 -s 4096 -n 1000000 -i1 -m 4096
On client:
ib_send_bw -d mlx4_0 -c UD <server_ip> -s 4096 -n 1000000 -i 1 -m 4096
Fixes: 6e0d733d9215 ("IB/mlx4: Allow 4K messages for UD QPs")
Signed-off-by: Mark Bloch <markb@mellanox.com>
Reviewed-by: Majd Dibbiny <majd@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx4/qp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1564,7 +1564,7 @@ static int __mlx4_ib_modify_qp(struct ib
context->mtu_msgmax = (IB_MTU_4096 << 5) |
ilog2(dev->dev->caps.max_gso_sz);
else
- context->mtu_msgmax = (IB_MTU_4096 << 5) | 12;
+ context->mtu_msgmax = (IB_MTU_4096 << 5) | 13;
} else if (attr_mask & IB_QP_PATH_MTU) {
if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_4096) {
pr_err("path MTU (%u) is invalid\n",
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 089/105] IB/mlx5: Assign send CQ and recv CQ of UMR QP
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 088/105] IB/mlx4: Increase maximal message size under UD QP Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 090/105] afs: Connect up the CB.ProbeUuid Greg Kroah-Hartman
` (18 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Majd Dibbiny, Yishai Hadas,
Leon Romanovsky, Doug Ledford, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Majd Dibbiny <majd@mellanox.com>
[ Upstream commit 31fde034a8bd964a5c7c1a5663fc87a913158db2 ]
The UMR's QP is created by calling mlx5_ib_create_qp directly, and
therefore the send CQ and the recv CQ on the ibqp weren't assigned.
Assign them right after calling the mlx5_ib_create_qp to assure
that any access to those pointers will work as expected and won't
crash the system as might happen as part of reset flow.
Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
Signed-off-by: Majd Dibbiny <majd@mellanox.com>
Reviewed-by: Yishai Hadas <yishaih@mellanox.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/hw/mlx5/main.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/infiniband/hw/mlx5/main.c
+++ b/drivers/infiniband/hw/mlx5/main.c
@@ -1123,6 +1123,8 @@ static int create_umr_res(struct mlx5_ib
qp->real_qp = qp;
qp->uobject = NULL;
qp->qp_type = MLX5_IB_QPT_REG_UMR;
+ qp->send_cq = init_attr->send_cq;
+ qp->recv_cq = init_attr->recv_cq;
attr->qp_state = IB_QPS_INIT;
attr->port_num = 1;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 090/105] afs: Connect up the CB.ProbeUuid
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 089/105] IB/mlx5: Assign send CQ and recv CQ of UMR QP Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 091/105] ipvlan: fix ipv6 outbound device Greg Kroah-Hartman
` (17 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David Howells, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit f4b3526d83c40dd8bf5948b9d7a1b2c340f0dcc8 ]
The handler for the CB.ProbeUuid operation in the cache manager is
implemented, but isn't listed in the switch-statement of operation
selection, so won't be used. Fix this by adding it.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/afs/cmservice.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -115,6 +115,9 @@ bool afs_cm_incoming_call(struct afs_cal
case CBProbe:
call->type = &afs_SRXCBProbe;
return true;
+ case CBProbeUuid:
+ call->type = &afs_SRXCBProbeUuid;
+ return true;
case CBTellMeAboutYourself:
call->type = &afs_SRXCBTellMeAboutYourself;
return true;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 091/105] ipvlan: fix ipv6 outbound device
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 090/105] afs: Connect up the CB.ProbeUuid Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 092/105] audit: ensure that audit=1 actually enables audit for PID 1 Greg Kroah-Hartman
` (16 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Keefe Liu, Mahesh Bandewar,
David S. Miller, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keefe Liu <liuqifa@huawei.com>
[ Upstream commit ca29fd7cce5a6444d57fb86517589a1a31c759e1 ]
When process the outbound packet of ipv6, we should assign the master
device to output device other than input device.
Signed-off-by: Keefe Liu <liuqifa@huawei.com>
Acked-by: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipvlan/ipvlan_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c
@@ -388,7 +388,7 @@ static int ipvlan_process_v6_outbound(st
struct dst_entry *dst;
int err, ret = NET_XMIT_DROP;
struct flowi6 fl6 = {
- .flowi6_iif = dev->ifindex,
+ .flowi6_oif = dev->ifindex,
.daddr = ip6h->daddr,
.saddr = ip6h->saddr,
.flowi6_flags = FLOWI_FLAG_ANYSRC,
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 092/105] audit: ensure that audit=1 actually enables audit for PID 1
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 091/105] ipvlan: fix ipv6 outbound device Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 093/105] ipmi: Stop timers before cleaning up the module Greg Kroah-Hartman
` (15 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Guy Briggs, Paul Moore, Sasha Levin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Moore <paul@paul-moore.com>
[ Upstream commit 173743dd99a49c956b124a74c8aacb0384739a4c ]
Prior to this patch we enabled audit in audit_init(), which is too
late for PID 1 as the standard initcalls are run after the PID 1 task
is forked. This means that we never allocate an audit_context (see
audit_alloc()) for PID 1 and therefore miss a lot of audit events
generated by PID 1.
This patch enables audit as early as possible to help ensure that when
PID 1 is forked it can allocate an audit_context if required.
Reviewed-by: Richard Guy Briggs <rgb@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/audit.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -80,13 +80,13 @@ static int audit_initialized;
#define AUDIT_OFF 0
#define AUDIT_ON 1
#define AUDIT_LOCKED 2
-u32 audit_enabled;
-u32 audit_ever_enabled;
+u32 audit_enabled = AUDIT_OFF;
+u32 audit_ever_enabled = !!AUDIT_OFF;
EXPORT_SYMBOL_GPL(audit_enabled);
/* Default state when kernel boots without any parameters. */
-static u32 audit_default;
+static u32 audit_default = AUDIT_OFF;
/* If auditing cannot proceed, audit_failure selects what happens. */
static u32 audit_failure = AUDIT_FAIL_PRINTK;
@@ -1179,8 +1179,6 @@ static int __init audit_init(void)
skb_queue_head_init(&audit_skb_queue);
skb_queue_head_init(&audit_skb_hold_queue);
audit_initialized = AUDIT_INITIALIZED;
- audit_enabled = audit_default;
- audit_ever_enabled |= !!audit_default;
audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
@@ -1197,6 +1195,8 @@ static int __init audit_enable(char *str
audit_default = !!simple_strtol(str, NULL, 0);
if (!audit_default)
audit_initialized = AUDIT_DISABLED;
+ audit_enabled = audit_default;
+ audit_ever_enabled = !!audit_enabled;
pr_info("%s\n", audit_default ?
"enabled (after initialization)" : "disabled (until reboot)");
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 093/105] ipmi: Stop timers before cleaning up the module
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 092/105] audit: ensure that audit=1 actually enables audit for PID 1 Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 094/105] s390: always save and restore all registers on context switch Greg Kroah-Hartman
` (14 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Yamazaki Masamitsu, Corey Minyard
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masamitsu Yamazaki <m-yamazaki@ah.jp.nec.com>
commit 4f7f5551a760eb0124267be65763008169db7087 upstream.
System may crash after unloading ipmi_si.ko module
because a timer may remain and fire after the module cleaned up resources.
cleanup_one_si() contains the following processing.
/*
* Make sure that interrupts, the timer and the thread are
* stopped and will not run again.
*/
if (to_clean->irq_cleanup)
to_clean->irq_cleanup(to_clean);
wait_for_timer_and_thread(to_clean);
/*
* Timeouts are stopped, now make sure the interrupts are off
* in the BMC. Note that timers and CPU interrupts are off,
* so no need for locks.
*/
while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
poll(to_clean);
schedule_timeout_uninterruptible(1);
}
si_state changes as following in the while loop calling poll(to_clean).
SI_GETTING_MESSAGES
=> SI_CHECKING_ENABLES
=> SI_SETTING_ENABLES
=> SI_GETTING_EVENTS
=> SI_NORMAL
As written in the code comments above,
timers are expected to stop before the polling loop and not to run again.
But the timer is set again in the following process
when si_state becomes SI_SETTING_ENABLES.
=> poll
=> smi_event_handler
=> handle_transaction_done
// smi_info->si_state == SI_SETTING_ENABLES
=> start_getting_events
=> start_new_msg
=> smi_mod_timer
=> mod_timer
As a result, before the timer set in start_new_msg() expires,
the polling loop may see si_state becoming SI_NORMAL
and the module clean-up finishes.
For example, hard LOCKUP and panic occurred as following.
smi_timeout was called after smi_event_handler,
kcs_event and hangs at port_inb()
trying to access I/O port after release.
[exception RIP: port_inb+19]
RIP: ffffffffc0473053 RSP: ffff88069fdc3d80 RFLAGS: 00000006
RAX: ffff8806800f8e00 RBX: ffff880682bd9400 RCX: 0000000000000000
RDX: 0000000000000ca3 RSI: 0000000000000ca3 RDI: ffff8806800f8e40
RBP: ffff88069fdc3d80 R8: ffffffff81d86dfc R9: ffffffff81e36426
R10: 00000000000509f0 R11: 0000000000100000 R12: 0000000000]:000000
R13: 0000000000000000 R14: 0000000000000246 R15: ffff8806800f8e00
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0000
--- <NMI exception stack> ---
To fix the problem I defined a flag, timer_can_start,
as member of struct smi_info.
The flag is enabled immediately after initializing the timer
and disabled immediately before waiting for timer deletion.
Fixes: 0cfec916e86d ("ipmi: Start the timer and thread on internal msgs")
Signed-off-by: Yamazaki Masamitsu <m-yamazaki@ah.jp.nec.com>
[Adjusted for recent changes in the driver.]
[Some fairly major changes went into the IPMI driver in 4.15, so this
required a backport as the code had changed and moved to a different
file. The 4.14 version of this patch moved some code under an
if statement and there was an API change causing it to not apply to
4.4-4.6.]
Signed-off-by: Corey Minyard <cminyard@mvista.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
This is for kernel version 4.4-4.6 only. Code and API changes required
backporting. There is another version for 4.7-4.13 and another for
4.14 coming, too. Bug was introduced in 4.4.
drivers/char/ipmi/ipmi_si_intf.c | 44 ++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 21 deletions(-)
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -239,6 +239,9 @@ struct smi_info {
/* The timer for this si. */
struct timer_list si_timer;
+ /* This flag is set, if the timer can be set */
+ bool timer_can_start;
+
/* This flag is set, if the timer is running (timer_pending() isn't enough) */
bool timer_running;
@@ -414,6 +417,8 @@ static enum si_sm_result start_next_msg(
static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
{
+ if (!smi_info->timer_can_start)
+ return;
smi_info->last_timeout_jiffies = jiffies;
mod_timer(&smi_info->si_timer, new_val);
smi_info->timer_running = true;
@@ -433,21 +438,18 @@ static void start_new_msg(struct smi_inf
smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
}
-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
+static void start_check_enables(struct smi_info *smi_info)
{
unsigned char msg[2];
msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
- if (start_timer)
- start_new_msg(smi_info, msg, 2);
- else
- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
+ start_new_msg(smi_info, msg, 2);
smi_info->si_state = SI_CHECKING_ENABLES;
}
-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+static void start_clear_flags(struct smi_info *smi_info)
{
unsigned char msg[3];
@@ -456,10 +458,7 @@ static void start_clear_flags(struct smi
msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
msg[2] = WDT_PRE_TIMEOUT_INT;
- if (start_timer)
- start_new_msg(smi_info, msg, 3);
- else
- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
+ start_new_msg(smi_info, msg, 3);
smi_info->si_state = SI_CLEARING_FLAGS;
}
@@ -494,11 +493,11 @@ static void start_getting_events(struct
* Note that we cannot just use disable_irq(), since the interrupt may
* be shared.
*/
-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
+static inline bool disable_si_irq(struct smi_info *smi_info)
{
if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
smi_info->interrupt_disabled = true;
- start_check_enables(smi_info, start_timer);
+ start_check_enables(smi_info);
return true;
}
return false;
@@ -508,7 +507,7 @@ static inline bool enable_si_irq(struct
{
if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
smi_info->interrupt_disabled = false;
- start_check_enables(smi_info, true);
+ start_check_enables(smi_info);
return true;
}
return false;
@@ -526,7 +525,7 @@ static struct ipmi_smi_msg *alloc_msg_ha
msg = ipmi_alloc_smi_msg();
if (!msg) {
- if (!disable_si_irq(smi_info, true))
+ if (!disable_si_irq(smi_info))
smi_info->si_state = SI_NORMAL;
} else if (enable_si_irq(smi_info)) {
ipmi_free_smi_msg(msg);
@@ -542,7 +541,7 @@ static void handle_flags(struct smi_info
/* Watchdog pre-timeout */
smi_inc_stat(smi_info, watchdog_pretimeouts);
- start_clear_flags(smi_info, true);
+ start_clear_flags(smi_info);
smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
if (smi_info->intf)
ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -925,7 +924,7 @@ static enum si_sm_result smi_event_handl
* disable and messages disabled.
*/
if (smi_info->supports_event_msg_buff || smi_info->irq) {
- start_check_enables(smi_info, true);
+ start_check_enables(smi_info);
} else {
smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
if (!smi_info->curr_msg)
@@ -1232,6 +1231,7 @@ static int smi_start_processing(void
/* Set up the timer that drives the interface. */
setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
+ new_smi->timer_can_start = true;
smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
/* Try to claim any interrupts. */
@@ -3434,10 +3434,12 @@ static void check_for_broken_irqs(struct
check_set_rcv_irq(smi_info);
}
-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
+static inline void stop_timer_and_thread(struct smi_info *smi_info)
{
if (smi_info->thread != NULL)
kthread_stop(smi_info->thread);
+
+ smi_info->timer_can_start = false;
if (smi_info->timer_running)
del_timer_sync(&smi_info->si_timer);
}
@@ -3635,7 +3637,7 @@ static int try_smi_init(struct smi_info
* Start clearing the flags before we enable interrupts or the
* timer to avoid racing with the timer.
*/
- start_clear_flags(new_smi, false);
+ start_clear_flags(new_smi);
/*
* IRQ is defined to be set when non-zero. req_events will
@@ -3713,7 +3715,7 @@ static int try_smi_init(struct smi_info
return 0;
out_err_stop_timer:
- wait_for_timer_and_thread(new_smi);
+ stop_timer_and_thread(new_smi);
out_err:
new_smi->interrupt_disabled = true;
@@ -3919,7 +3921,7 @@ static void cleanup_one_si(struct smi_in
*/
if (to_clean->irq_cleanup)
to_clean->irq_cleanup(to_clean);
- wait_for_timer_and_thread(to_clean);
+ stop_timer_and_thread(to_clean);
/*
* Timeouts are stopped, now make sure the interrupts are off
@@ -3930,7 +3932,7 @@ static void cleanup_one_si(struct smi_in
poll(to_clean);
schedule_timeout_uninterruptible(1);
}
- disable_si_irq(to_clean, false);
+ disable_si_irq(to_clean);
while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
poll(to_clean);
schedule_timeout_uninterruptible(1);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 094/105] s390: always save and restore all registers on context switch
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 093/105] ipmi: Stop timers before cleaning up the module Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 095/105] more bio_map_user_iov() leak fixes Greg Kroah-Hartman
` (13 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heiko Carstens, Martin Schwidefsky
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <heiko.carstens@de.ibm.com>
commit fbbd7f1a51965b50dd12924841da0d478f3da71b upstream.
The switch_to() macro has an optimization to avoid saving and
restoring register contents that aren't needed for kernel threads.
There is however the possibility that a kernel thread execve's a user
space program. In such a case the execve'd process can partially see
the contents of the previous process, which shouldn't be allowed.
To avoid this, simply always save and restore register contents on
context switch.
Cc: <stable@vger.kernel.org> # v2.6.37+
Fixes: fdb6d070effba ("switch_to: dont restore/save access & fpu regs for kernel threads")
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/include/asm/switch_to.h | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/arch/s390/include/asm/switch_to.h
+++ b/arch/s390/include/asm/switch_to.h
@@ -29,17 +29,16 @@ static inline void restore_access_regs(u
}
#define switch_to(prev,next,last) do { \
- if (prev->mm) { \
- save_fpu_regs(); \
- save_access_regs(&prev->thread.acrs[0]); \
- save_ri_cb(prev->thread.ri_cb); \
- } \
+ /* save_fpu_regs() sets the CIF_FPU flag, which enforces \
+ * a restore of the floating point / vector registers as \
+ * soon as the next task returns to user space \
+ */ \
+ save_fpu_regs(); \
+ save_access_regs(&prev->thread.acrs[0]); \
+ save_ri_cb(prev->thread.ri_cb); \
update_cr_regs(next); \
- if (next->mm) { \
- set_cpu_flag(CIF_FPU); \
- restore_access_regs(&next->thread.acrs[0]); \
- restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb); \
- } \
+ restore_access_regs(&next->thread.acrs[0]); \
+ restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb); \
prev = __switch_to(prev,next); \
} while (0)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 095/105] more bio_map_user_iov() leak fixes
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 094/105] s390: always save and restore all registers on context switch Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 096/105] tipc: fix memory leak in tipc_accept_from_sock() Greg Kroah-Hartman
` (12 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Al Viro, Guenter Roeck
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 2b04e8f6bbb196cab4b232af0f8d48ff2c7a8058 upstream.
we need to take care of failure exit as well - pages already
in bio should be dropped by analogue of bio_unmap_pages(),
since their refcounts had been bumped only once per reference
in bio.
Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Fixed conflicts.
Intended for v4.4.y. Does not apply to v3.18.y or older kernels.
block/bio.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/block/bio.c
+++ b/block/bio.c
@@ -1268,6 +1268,7 @@ struct bio *bio_map_user_iov(struct requ
int ret, offset;
struct iov_iter i;
struct iovec iov;
+ struct bio_vec *bvec;
iov_for_each(iov, i, *iter) {
unsigned long uaddr = (unsigned long) iov.iov_base;
@@ -1312,7 +1313,12 @@ struct bio *bio_map_user_iov(struct requ
ret = get_user_pages_fast(uaddr, local_nr_pages,
(iter->type & WRITE) != WRITE,
&pages[cur_page]);
- if (ret < local_nr_pages) {
+ if (unlikely(ret < local_nr_pages)) {
+ for (j = cur_page; j < page_limit; j++) {
+ if (!pages[j])
+ break;
+ put_page(pages[j]);
+ }
ret = -EFAULT;
goto out_unmap;
}
@@ -1374,10 +1380,8 @@ struct bio *bio_map_user_iov(struct requ
return bio;
out_unmap:
- for (j = 0; j < nr_pages; j++) {
- if (!pages[j])
- break;
- page_cache_release(pages[j]);
+ bio_for_each_segment_all(bvec, bio, j) {
+ put_page(bvec->bv_page);
}
out:
kfree(pages);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 096/105] tipc: fix memory leak in tipc_accept_from_sock()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 095/105] more bio_map_user_iov() leak fixes Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 098/105] sit: update frag_off info Greg Kroah-Hartman
` (11 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, David S. Miller, Jon Maloy
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jon Maloy <jon.maloy@ericsson.com>
[ Upstream commit a7d5f107b4978e08eeab599ee7449af34d034053 ]
When the function tipc_accept_from_sock() fails to create an instance of
struct tipc_subscriber it omits to free the already created instance of
struct tipc_conn instance before it returns.
We fix that with this commit.
Reported-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/server.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@ -311,6 +311,7 @@ static int tipc_accept_from_sock(struct
newcon->usr_data = s->tipc_conn_new(newcon->conid);
if (!newcon->usr_data) {
sock_release(newsock);
+ conn_put(newcon);
return -ENOMEM;
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 098/105] sit: update frag_off info
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 096/105] tipc: fix memory leak in tipc_accept_from_sock() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 099/105] packet: fix crash in fanout_demux_rollover() Greg Kroah-Hartman
` (10 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jianlin Shi, Hangbin Liu,
Nicolas Dichtel, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit f859b4af1c52493ec21173ccc73d0b60029b5b88 ]
After parsing the sit netlink change info, we forget to update frag_off in
ipip6_tunnel_update(). Fix it by assigning frag_off with new value.
Reported-by: Jianlin Shi <jishi@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/sit.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1093,6 +1093,7 @@ static void ipip6_tunnel_update(struct i
ipip6_tunnel_link(sitn, t);
t->parms.iph.ttl = p->iph.ttl;
t->parms.iph.tos = p->iph.tos;
+ t->parms.iph.frag_off = p->iph.frag_off;
if (t->parms.link != p->link) {
t->parms.link = p->link;
ipip6_tunnel_bind_dev(t->dev);
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 099/105] packet: fix crash in fanout_demux_rollover()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 098/105] sit: update frag_off info Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 100/105] net/packet: fix a race in packet_bind() and packet_notifier() Greg Kroah-Hartman
` (9 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot, Mike Maloney, Eric Dumazet,
David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Maloney <maloney@google.com>
syzkaller found a race condition fanout_demux_rollover() while removing
a packet socket from a fanout group.
po->rollover is read and operated on during packet_rcv_fanout(), via
fanout_demux_rollover(), but the pointer is currently cleared before the
synchronization in packet_release(). It is safer to delay the cleanup
until after synchronize_net() has been called, ensuring all calls to
packet_rcv_fanout() for this socket have finished.
To further simplify synchronization around the rollover structure, set
po->rollover in fanout_add() only if there are no errors. This removes
the need for rcu in the struct and in the call to
packet_getsockopt(..., PACKET_ROLLOVER_STATS, ...).
Crashing stack trace:
fanout_demux_rollover+0xb6/0x4d0 net/packet/af_packet.c:1392
packet_rcv_fanout+0x649/0x7c8 net/packet/af_packet.c:1487
dev_queue_xmit_nit+0x835/0xc10 net/core/dev.c:1953
xmit_one net/core/dev.c:2975 [inline]
dev_hard_start_xmit+0x16b/0xac0 net/core/dev.c:2995
__dev_queue_xmit+0x17a4/0x2050 net/core/dev.c:3476
dev_queue_xmit+0x17/0x20 net/core/dev.c:3509
neigh_connected_output+0x489/0x720 net/core/neighbour.c:1379
neigh_output include/net/neighbour.h:482 [inline]
ip6_finish_output2+0xad1/0x22a0 net/ipv6/ip6_output.c:120
ip6_finish_output+0x2f9/0x920 net/ipv6/ip6_output.c:146
NF_HOOK_COND include/linux/netfilter.h:239 [inline]
ip6_output+0x1f4/0x850 net/ipv6/ip6_output.c:163
dst_output include/net/dst.h:459 [inline]
NF_HOOK.constprop.35+0xff/0x630 include/linux/netfilter.h:250
mld_sendpack+0x6a8/0xcc0 net/ipv6/mcast.c:1660
mld_send_initial_cr.part.24+0x103/0x150 net/ipv6/mcast.c:2072
mld_send_initial_cr net/ipv6/mcast.c:2056 [inline]
ipv6_mc_dad_complete+0x99/0x130 net/ipv6/mcast.c:2079
addrconf_dad_completed+0x595/0x970 net/ipv6/addrconf.c:4039
addrconf_dad_work+0xac9/0x1160 net/ipv6/addrconf.c:3971
process_one_work+0xbf0/0x1bc0 kernel/workqueue.c:2113
worker_thread+0x223/0x1990 kernel/workqueue.c:2247
kthread+0x35e/0x430 kernel/kthread.c:231
ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:432
Fixes: 0648ab70afe6 ("packet: rollover prepare: per-socket state")
Fixes: 509c7a1ecc860 ("packet: avoid panic in packet_getsockopt()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Mike Maloney <maloney@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 32 ++++++++++----------------------
net/packet/internal.h | 1 -
2 files changed, 10 insertions(+), 23 deletions(-)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1665,7 +1665,6 @@ static int fanout_add(struct sock *sk, u
atomic_long_set(&rollover->num, 0);
atomic_long_set(&rollover->num_huge, 0);
atomic_long_set(&rollover->num_failed, 0);
- po->rollover = rollover;
}
match = NULL;
@@ -1710,6 +1709,8 @@ static int fanout_add(struct sock *sk, u
if (atomic_read(&match->sk_ref) < PACKET_FANOUT_MAX) {
__dev_remove_pack(&po->prot_hook);
po->fanout = match;
+ po->rollover = rollover;
+ rollover = NULL;
atomic_inc(&match->sk_ref);
__fanout_link(sk, po);
err = 0;
@@ -1723,10 +1724,7 @@ static int fanout_add(struct sock *sk, u
}
out:
- if (err && rollover) {
- kfree_rcu(rollover, rcu);
- po->rollover = NULL;
- }
+ kfree(rollover);
mutex_unlock(&fanout_mutex);
return err;
}
@@ -1750,11 +1748,6 @@ static struct packet_fanout *fanout_rele
list_del(&f->list);
else
f = NULL;
-
- if (po->rollover) {
- kfree_rcu(po->rollover, rcu);
- po->rollover = NULL;
- }
}
mutex_unlock(&fanout_mutex);
@@ -2914,6 +2907,7 @@ static int packet_release(struct socket
synchronize_net();
if (f) {
+ kfree(po->rollover);
fanout_release_data(f);
kfree(f);
}
@@ -3771,7 +3765,6 @@ static int packet_getsockopt(struct sock
void *data = &val;
union tpacket_stats_u st;
struct tpacket_rollover_stats rstats;
- struct packet_rollover *rollover;
if (level != SOL_PACKET)
return -ENOPROTOOPT;
@@ -3850,18 +3843,13 @@ static int packet_getsockopt(struct sock
0);
break;
case PACKET_ROLLOVER_STATS:
- rcu_read_lock();
- rollover = rcu_dereference(po->rollover);
- if (rollover) {
- rstats.tp_all = atomic_long_read(&rollover->num);
- rstats.tp_huge = atomic_long_read(&rollover->num_huge);
- rstats.tp_failed = atomic_long_read(&rollover->num_failed);
- data = &rstats;
- lv = sizeof(rstats);
- }
- rcu_read_unlock();
- if (!rollover)
+ if (!po->rollover)
return -EINVAL;
+ rstats.tp_all = atomic_long_read(&po->rollover->num);
+ rstats.tp_huge = atomic_long_read(&po->rollover->num_huge);
+ rstats.tp_failed = atomic_long_read(&po->rollover->num_failed);
+ data = &rstats;
+ lv = sizeof(rstats);
break;
case PACKET_TX_HAS_OFF:
val = po->tp_tx_has_off;
--- a/net/packet/internal.h
+++ b/net/packet/internal.h
@@ -92,7 +92,6 @@ struct packet_fanout {
struct packet_rollover {
int sock;
- struct rcu_head rcu;
atomic_long_t num;
atomic_long_t num_huge;
atomic_long_t num_failed;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 100/105] net/packet: fix a race in packet_bind() and packet_notifier()
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (91 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 099/105] packet: fix crash in fanout_demux_rollover() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 101/105] Revert "x86/efi: Build our own page table structures" Greg Kroah-Hartman
` (8 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eric Dumazet, syzbot,
Francesco Ruggeri, David S. Miller
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 15fe076edea787807a7cdc168df832544b58eba6 ]
syzbot reported crashes [1] and provided a C repro easing bug hunting.
When/if packet_do_bind() calls __unregister_prot_hook() and releases
po->bind_lock, another thread can run packet_notifier() and process an
NETDEV_UP event.
This calls register_prot_hook() and hooks again the socket right before
first thread is able to grab again po->bind_lock.
Fixes this issue by temporarily setting po->num to 0, as suggested by
David Miller.
[1]
dev_remove_pack: ffff8801bf16fa80 not found
------------[ cut here ]------------
kernel BUG at net/core/dev.c:7945! ( BUG_ON(!list_empty(&dev->ptype_all)); )
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in:
device syz0 entered promiscuous mode
CPU: 0 PID: 3161 Comm: syzkaller404108 Not tainted 4.14.0+ #190
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cc57a500 task.stack: ffff8801cc588000
RIP: 0010:netdev_run_todo+0x772/0xae0 net/core/dev.c:7945
RSP: 0018:ffff8801cc58f598 EFLAGS: 00010293
RAX: ffff8801cc57a500 RBX: dffffc0000000000 RCX: ffffffff841f75b2
RDX: 0000000000000000 RSI: 1ffff100398b1ede RDI: ffff8801bf1f8810
device syz0 entered promiscuous mode
RBP: ffff8801cc58f898 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8801bf1f8cd8
R13: ffff8801cc58f870 R14: ffff8801bf1f8780 R15: ffff8801cc58f7f0
FS: 0000000001716880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020b13000 CR3: 0000000005e25000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:106
tun_detach drivers/net/tun.c:670 [inline]
tun_chr_close+0x49/0x60 drivers/net/tun.c:2845
__fput+0x333/0x7f0 fs/file_table.c:210
____fput+0x15/0x20 fs/file_table.c:244
task_work_run+0x199/0x270 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x9bb/0x1ae0 kernel/exit.c:865
do_group_exit+0x149/0x400 kernel/exit.c:968
SYSC_exit_group kernel/exit.c:979 [inline]
SyS_exit_group+0x1d/0x20 kernel/exit.c:977
entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x44ad19
Fixes: 30f7ea1c2b5f ("packet: race condition in packet_bind")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Francesco Ruggeri <fruggeri@aristanetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/packet/af_packet.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2976,6 +2976,10 @@ static int packet_do_bind(struct sock *s
if (need_rehook) {
if (po->running) {
rcu_read_unlock();
+ /* prevents packet_notifier() from calling
+ * register_prot_hook()
+ */
+ po->num = 0;
__unregister_prot_hook(sk, true);
rcu_read_lock();
dev_curr = po->prot_hook.dev;
@@ -2984,6 +2988,7 @@ static int packet_do_bind(struct sock *s
dev->ifindex);
}
+ BUG_ON(po->running);
po->num = proto;
po->prot_hook.type = proto;
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 101/105] Revert "x86/efi: Build our own page table structures"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (92 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 100/105] net/packet: fix a race in packet_bind() and packet_notifier() Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 102/105] Revert "x86/efi: Hoist page table switching code into efi_call_virt()" Greg Kroah-Hartman
` (7 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Matt Fleming,
Borislav Petkov, Andrew Morton, Andy Lutomirski, Andy Lutomirski,
Ard Biesheuvel, Borislav Petkov, Brian Gerst, Dave Jones,
Denys Vlasenko, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
Sai Praneeth Prakhya, Stephen Smalley, Thomas Gleixner,
Toshi Kani, linux-efi, Ingo Molnar, Ghannam, Yazen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 36e0f05afd4e1d09fd47936761a502aedbc50649 which is
commit 67a9108ed4313b85a9c53406d80dc1ae3f8c3e36 upstream.
Turns there was too many other issues with this patch to make it viable
for the stable tree.
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Jones <davej@codemonkey.org.uk>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: linux-efi@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Ghannam, Yazen" <Yazen.Ghannam@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/efi.h | 1
arch/x86/platform/efi/efi.c | 39 ++++++++++------
arch/x86/platform/efi/efi_32.c | 5 --
arch/x86/platform/efi/efi_64.c | 97 ++++++-----------------------------------
4 files changed, 40 insertions(+), 102 deletions(-)
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -136,7 +136,6 @@ extern void __init efi_memory_uc(u64 add
extern void __init efi_map_region(efi_memory_desc_t *md);
extern void __init efi_map_region_fixed(efi_memory_desc_t *md);
extern void efi_sync_low_kernel_mappings(void);
-extern int __init efi_alloc_page_tables(void);
extern int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages);
extern void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages);
extern void __init old_map_region(efi_memory_desc_t *md);
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -869,7 +869,7 @@ static void __init kexec_enter_virtual_m
* This function will switch the EFI runtime services to virtual mode.
* Essentially, we look through the EFI memmap and map every region that
* has the runtime attribute bit set in its memory descriptor into the
- * efi_pgd page table.
+ * ->trampoline_pgd page table using a top-down VA allocation scheme.
*
* The old method which used to update that memory descriptor with the
* virtual address obtained from ioremap() is still supported when the
@@ -879,8 +879,8 @@ static void __init kexec_enter_virtual_m
*
* The new method does a pagetable switch in a preemption-safe manner
* so that we're in a different address space when calling a runtime
- * function. For function arguments passing we do copy the PUDs of the
- * kernel page table into efi_pgd prior to each call.
+ * function. For function arguments passing we do copy the PGDs of the
+ * kernel page table into ->trampoline_pgd prior to each call.
*
* Specially for kexec boot, efi runtime maps in previous kernel should
* be passed in via setup_data. In that case runtime ranges will be mapped
@@ -895,12 +895,6 @@ static void __init __efi_enter_virtual_m
efi.systab = NULL;
- if (efi_alloc_page_tables()) {
- pr_err("Failed to allocate EFI page tables\n");
- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags);
- return;
- }
-
efi_merge_regions();
new_memmap = efi_map_regions(&count, &pg_shift);
if (!new_memmap) {
@@ -960,11 +954,28 @@ static void __init __efi_enter_virtual_m
efi_runtime_mkexec();
/*
- * We mapped the descriptor array into the EFI pagetable above
- * but we're not unmapping it here because if we're running in
- * EFI mixed mode we need all of memory to be accessible when
- * we pass parameters to the EFI runtime services in the
- * thunking code.
+ * We mapped the descriptor array into the EFI pagetable above but we're
+ * not unmapping it here. Here's why:
+ *
+ * We're copying select PGDs from the kernel page table to the EFI page
+ * table and when we do so and make changes to those PGDs like unmapping
+ * stuff from them, those changes appear in the kernel page table and we
+ * go boom.
+ *
+ * From setup_real_mode():
+ *
+ * ...
+ * trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd;
+ *
+ * In this particular case, our allocation is in PGD 0 of the EFI page
+ * table but we've copied that PGD from PGD[272] of the EFI page table:
+ *
+ * pgd_index(__PAGE_OFFSET = 0xffff880000000000) = 272
+ *
+ * where the direct memory mapping in kernel space is.
+ *
+ * new_memmap's VA comes from that direct mapping and thus clearing it,
+ * it would get cleared in the kernel page table too.
*
* efi_cleanup_page_tables(__pa(new_memmap), 1 << pg_shift);
*/
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -38,11 +38,6 @@
* say 0 - 3G.
*/
-int __init efi_alloc_page_tables(void)
-{
- return 0;
-}
-
void efi_sync_low_kernel_mappings(void) {}
void __init efi_dump_pagetable(void) {}
int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -40,7 +40,6 @@
#include <asm/fixmap.h>
#include <asm/realmode.h>
#include <asm/time.h>
-#include <asm/pgalloc.h>
/*
* We allocate runtime services regions bottom-up, starting from -4G, i.e.
@@ -122,92 +121,22 @@ void __init efi_call_phys_epilog(pgd_t *
early_code_mapping_set_exec(0);
}
-static pgd_t *efi_pgd;
-
-/*
- * We need our own copy of the higher levels of the page tables
- * because we want to avoid inserting EFI region mappings (EFI_VA_END
- * to EFI_VA_START) into the standard kernel page tables. Everything
- * else can be shared, see efi_sync_low_kernel_mappings().
- */
-int __init efi_alloc_page_tables(void)
-{
- pgd_t *pgd;
- pud_t *pud;
- gfp_t gfp_mask;
-
- if (efi_enabled(EFI_OLD_MEMMAP))
- return 0;
-
- gfp_mask = GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO;
- efi_pgd = (pgd_t *)__get_free_page(gfp_mask);
- if (!efi_pgd)
- return -ENOMEM;
-
- pgd = efi_pgd + pgd_index(EFI_VA_END);
-
- pud = pud_alloc_one(NULL, 0);
- if (!pud) {
- free_page((unsigned long)efi_pgd);
- return -ENOMEM;
- }
-
- pgd_populate(NULL, pgd, pud);
-
- return 0;
-}
-
/*
* Add low kernel mappings for passing arguments to EFI functions.
*/
void efi_sync_low_kernel_mappings(void)
{
- unsigned num_entries;
- pgd_t *pgd_k, *pgd_efi;
- pud_t *pud_k, *pud_efi;
+ unsigned num_pgds;
+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
if (efi_enabled(EFI_OLD_MEMMAP))
return;
- /*
- * We can share all PGD entries apart from the one entry that
- * covers the EFI runtime mapping space.
- *
- * Make sure the EFI runtime region mappings are guaranteed to
- * only span a single PGD entry and that the entry also maps
- * other important kernel regions.
- */
- BUILD_BUG_ON(pgd_index(EFI_VA_END) != pgd_index(MODULES_END));
- BUILD_BUG_ON((EFI_VA_START & PGDIR_MASK) !=
- (EFI_VA_END & PGDIR_MASK));
-
- pgd_efi = efi_pgd + pgd_index(PAGE_OFFSET);
- pgd_k = pgd_offset_k(PAGE_OFFSET);
-
- num_entries = pgd_index(EFI_VA_END) - pgd_index(PAGE_OFFSET);
- memcpy(pgd_efi, pgd_k, sizeof(pgd_t) * num_entries);
-
- /*
- * We share all the PUD entries apart from those that map the
- * EFI regions. Copy around them.
- */
- BUILD_BUG_ON((EFI_VA_START & ~PUD_MASK) != 0);
- BUILD_BUG_ON((EFI_VA_END & ~PUD_MASK) != 0);
-
- pgd_efi = efi_pgd + pgd_index(EFI_VA_END);
- pud_efi = pud_offset(pgd_efi, 0);
-
- pgd_k = pgd_offset_k(EFI_VA_END);
- pud_k = pud_offset(pgd_k, 0);
-
- num_entries = pud_index(EFI_VA_END);
- memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries);
+ num_pgds = pgd_index(MODULES_END - 1) - pgd_index(PAGE_OFFSET);
- pud_efi = pud_offset(pgd_efi, EFI_VA_START);
- pud_k = pud_offset(pgd_k, EFI_VA_START);
-
- num_entries = PTRS_PER_PUD - pud_index(EFI_VA_START);
- memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries);
+ memcpy(pgd + pgd_index(PAGE_OFFSET),
+ init_mm.pgd + pgd_index(PAGE_OFFSET),
+ sizeof(pgd_t) * num_pgds);
}
int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
@@ -220,8 +149,8 @@ int __init efi_setup_page_tables(unsigne
if (efi_enabled(EFI_OLD_MEMMAP))
return 0;
- efi_scratch.efi_pgt = (pgd_t *)__pa(efi_pgd);
- pgd = efi_pgd;
+ efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd;
+ pgd = __va(efi_scratch.efi_pgt);
/*
* It can happen that the physical address of new_memmap lands in memory
@@ -267,14 +196,16 @@ int __init efi_setup_page_tables(unsigne
void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages)
{
- kernel_unmap_pages_in_pgd(efi_pgd, pa_memmap, num_pages);
+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
+
+ kernel_unmap_pages_in_pgd(pgd, pa_memmap, num_pages);
}
static void __init __map_region(efi_memory_desc_t *md, u64 va)
{
+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
unsigned long flags = 0;
unsigned long pfn;
- pgd_t *pgd = efi_pgd;
if (!(md->attribute & EFI_MEMORY_WB))
flags |= _PAGE_PCD;
@@ -383,7 +314,9 @@ void __init efi_runtime_mkexec(void)
void __init efi_dump_pagetable(void)
{
#ifdef CONFIG_EFI_PGT_DUMP
- ptdump_walk_pgd_level(NULL, efi_pgd);
+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
+
+ ptdump_walk_pgd_level(NULL, pgd);
#endif
}
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 102/105] Revert "x86/efi: Hoist page table switching code into efi_call_virt()"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (93 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 101/105] Revert "x86/efi: Build our own page table structures" Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers" Greg Kroah-Hartman
` (6 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Matt Fleming,
Borislav Petkov, Andrew Morton, Andy Lutomirski, Andy Lutomirski,
Ard Biesheuvel, Borislav Petkov, Brian Gerst, Dave Jones,
Denys Vlasenko, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
Sai Praneeth Prakhya, Stephen Smalley, Thomas Gleixner,
Toshi Kani, linux-efi, Ingo Molnar, Ghannam, Yazen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit b73adb60852034d84092d123b323196ca42529cd which is
commit c9f2a9a65e4855b74d92cdad688f6ee4a1a323ff upstream.
Turns there was too many other issues with this patch to make it viable
for the stable tree.
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Jones <davej@codemonkey.org.uk>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: linux-efi@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Ghannam, Yazen" <Yazen.Ghannam@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/efi.h | 25 --------------------
arch/x86/platform/efi/efi_64.c | 24 ++++++++++----------
arch/x86/platform/efi/efi_stub_64.S | 43 ++++++++++++++++++++++++++++++++++++
3 files changed, 56 insertions(+), 36 deletions(-)
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -3,7 +3,6 @@
#include <asm/fpu/api.h>
#include <asm/pgtable.h>
-#include <asm/tlb.h>
/*
* We map the EFI regions needed for runtime services non-contiguously,
@@ -65,17 +64,6 @@ extern u64 asmlinkage efi_call(void *fp,
#define efi_call_phys(f, args...) efi_call((f), args)
-/*
- * Scratch space used for switching the pagetable in the EFI stub
- */
-struct efi_scratch {
- u64 r15;
- u64 prev_cr3;
- pgd_t *efi_pgt;
- bool use_pgd;
- u64 phys_stack;
-} __packed;
-
#define efi_call_virt(f, ...) \
({ \
efi_status_t __s; \
@@ -83,20 +71,7 @@ struct efi_scratch {
efi_sync_low_kernel_mappings(); \
preempt_disable(); \
__kernel_fpu_begin(); \
- \
- if (efi_scratch.use_pgd) { \
- efi_scratch.prev_cr3 = read_cr3(); \
- write_cr3((unsigned long)efi_scratch.efi_pgt); \
- __flush_tlb_all(); \
- } \
- \
__s = efi_call((void *)efi.systab->runtime->f, __VA_ARGS__); \
- \
- if (efi_scratch.use_pgd) { \
- write_cr3(efi_scratch.prev_cr3); \
- __flush_tlb_all(); \
- } \
- \
__kernel_fpu_end(); \
preempt_enable(); \
__s; \
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -47,7 +47,16 @@
*/
static u64 efi_va = EFI_VA_START;
-struct efi_scratch efi_scratch;
+/*
+ * Scratch space used for switching the pagetable in the EFI stub
+ */
+struct efi_scratch {
+ u64 r15;
+ u64 prev_cr3;
+ pgd_t *efi_pgt;
+ bool use_pgd;
+ u64 phys_stack;
+} __packed;
static void __init early_code_mapping_set_exec(int executable)
{
@@ -74,11 +83,8 @@ pgd_t * __init efi_call_phys_prolog(void
int pgd;
int n_pgds;
- if (!efi_enabled(EFI_OLD_MEMMAP)) {
- save_pgd = (pgd_t *)read_cr3();
- write_cr3((unsigned long)efi_scratch.efi_pgt);
- goto out;
- }
+ if (!efi_enabled(EFI_OLD_MEMMAP))
+ return NULL;
early_code_mapping_set_exec(1);
@@ -90,7 +96,6 @@ pgd_t * __init efi_call_phys_prolog(void
vaddress = (unsigned long)__va(pgd * PGDIR_SIZE);
set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress));
}
-out:
__flush_tlb_all();
return save_pgd;
@@ -104,11 +109,8 @@ void __init efi_call_phys_epilog(pgd_t *
int pgd_idx;
int nr_pgds;
- if (!efi_enabled(EFI_OLD_MEMMAP)) {
- write_cr3((unsigned long)save_pgd);
- __flush_tlb_all();
+ if (!save_pgd)
return;
- }
nr_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
--- a/arch/x86/platform/efi/efi_stub_64.S
+++ b/arch/x86/platform/efi/efi_stub_64.S
@@ -38,6 +38,41 @@
mov %rsi, %cr0; \
mov (%rsp), %rsp
+ /* stolen from gcc */
+ .macro FLUSH_TLB_ALL
+ movq %r15, efi_scratch(%rip)
+ movq %r14, efi_scratch+8(%rip)
+ movq %cr4, %r15
+ movq %r15, %r14
+ andb $0x7f, %r14b
+ movq %r14, %cr4
+ movq %r15, %cr4
+ movq efi_scratch+8(%rip), %r14
+ movq efi_scratch(%rip), %r15
+ .endm
+
+ .macro SWITCH_PGT
+ cmpb $0, efi_scratch+24(%rip)
+ je 1f
+ movq %r15, efi_scratch(%rip) # r15
+ # save previous CR3
+ movq %cr3, %r15
+ movq %r15, efi_scratch+8(%rip) # prev_cr3
+ movq efi_scratch+16(%rip), %r15 # EFI pgt
+ movq %r15, %cr3
+ 1:
+ .endm
+
+ .macro RESTORE_PGT
+ cmpb $0, efi_scratch+24(%rip)
+ je 2f
+ movq efi_scratch+8(%rip), %r15
+ movq %r15, %cr3
+ movq efi_scratch(%rip), %r15
+ FLUSH_TLB_ALL
+ 2:
+ .endm
+
ENTRY(efi_call)
SAVE_XMM
mov (%rsp), %rax
@@ -48,8 +83,16 @@ ENTRY(efi_call)
mov %r8, %r9
mov %rcx, %r8
mov %rsi, %rcx
+ SWITCH_PGT
call *%rdi
+ RESTORE_PGT
addq $48, %rsp
RESTORE_XMM
ret
ENDPROC(efi_call)
+
+ .data
+ENTRY(efi_scratch)
+ .fill 3,8,0
+ .byte 0
+ .quad 0
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (94 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 102/105] Revert "x86/efi: Hoist page table switching code into efi_call_virt()" Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2018-08-23 0:48 ` Roland Dreier
2017-12-15 9:45 ` [PATCH 4.4 104/105] arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one Greg Kroah-Hartman
` (5 subsequent siblings)
101 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ben Hutchings, Matt Fleming,
Borislav Petkov, Andrew Morton, Andy Lutomirski, Andy Lutomirski,
Ard Biesheuvel, Borislav Petkov, Brian Gerst, Dave Jones,
Denys Vlasenko, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
Sai Praneeth Prakhya, Stephen Smalley, Thomas Gleixner,
Toshi Kani, linux-efi, Ingo Molnar, Ghannam, Yazen
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit 87e2bd898d3a79a8c609f183180adac47879a2a4 which is
commit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
Turns there was too many other issues with this patch to make it viable
for the stable tree.
Reported-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Borislav Petkov <bp@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Dave Jones <davej@codemonkey.org.uk>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sai Praneeth Prakhya <sai.praneeth.prakhya@intel.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: linux-efi@vger.kernel.org
Cc: Ingo Molnar <mingo@kernel.org>
Cc: "Ghannam, Yazen" <Yazen.Ghannam@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/pageattr.c | 17 +++++++++++------
arch/x86/platform/efi/efi_64.c | 16 ++++++----------
2 files changed, 17 insertions(+), 16 deletions(-)
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -911,10 +911,15 @@ static void populate_pte(struct cpa_data
pte = pte_offset_kernel(pmd, start);
while (num_pages-- && start < end) {
- set_pte(pte, pfn_pte(cpa->pfn, pgprot));
+
+ /* deal with the NX bit */
+ if (!(pgprot_val(pgprot) & _PAGE_NX))
+ cpa->pfn &= ~_PAGE_NX;
+
+ set_pte(pte, pfn_pte(cpa->pfn >> PAGE_SHIFT, pgprot));
start += PAGE_SIZE;
- cpa->pfn++;
+ cpa->pfn += PAGE_SIZE;
pte++;
}
}
@@ -970,11 +975,11 @@ static int populate_pmd(struct cpa_data
pmd = pmd_offset(pud, start);
- set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
+ set_pmd(pmd, __pmd(cpa->pfn | _PAGE_PSE |
massage_pgprot(pmd_pgprot)));
start += PMD_SIZE;
- cpa->pfn += PMD_SIZE >> PAGE_SHIFT;
+ cpa->pfn += PMD_SIZE;
cur_pages += PMD_SIZE >> PAGE_SHIFT;
}
@@ -1043,11 +1048,11 @@ static int populate_pud(struct cpa_data
* Map everything starting from the Gb boundary, possibly with 1G pages
*/
while (end - start >= PUD_SIZE) {
- set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE |
+ set_pud(pud, __pud(cpa->pfn | _PAGE_PSE |
massage_pgprot(pud_pgprot)));
start += PUD_SIZE;
- cpa->pfn += PUD_SIZE >> PAGE_SHIFT;
+ cpa->pfn += PUD_SIZE;
cur_pages += PUD_SIZE >> PAGE_SHIFT;
pud++;
}
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -143,7 +143,7 @@ void efi_sync_low_kernel_mappings(void)
int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages)
{
- unsigned long pfn, text;
+ unsigned long text;
struct page *page;
unsigned npages;
pgd_t *pgd;
@@ -160,8 +160,7 @@ int __init efi_setup_page_tables(unsigne
* and ident-map those pages containing the map before calling
* phys_efi_set_virtual_address_map().
*/
- pfn = pa_memmap >> PAGE_SHIFT;
- if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, _PAGE_NX)) {
+ if (kernel_map_pages_in_pgd(pgd, pa_memmap, pa_memmap, num_pages, _PAGE_NX)) {
pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap);
return 1;
}
@@ -186,9 +185,8 @@ int __init efi_setup_page_tables(unsigne
npages = (_end - _text) >> PAGE_SHIFT;
text = __pa(_text);
- pfn = text >> PAGE_SHIFT;
- if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, 0)) {
+ if (kernel_map_pages_in_pgd(pgd, text >> PAGE_SHIFT, text, npages, 0)) {
pr_err("Failed to map kernel text 1:1\n");
return 1;
}
@@ -206,14 +204,12 @@ void __init efi_cleanup_page_tables(unsi
static void __init __map_region(efi_memory_desc_t *md, u64 va)
{
pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
- unsigned long flags = 0;
- unsigned long pfn;
+ unsigned long pf = 0;
if (!(md->attribute & EFI_MEMORY_WB))
- flags |= _PAGE_PCD;
+ pf |= _PAGE_PCD;
- pfn = md->phys_addr >> PAGE_SHIFT;
- if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags))
+ if (kernel_map_pages_in_pgd(pgd, md->phys_addr, va, md->num_pages, pf))
pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n",
md->phys_addr, va);
}
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2017-12-15 9:45 ` [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers" Greg Kroah-Hartman
@ 2018-08-23 0:48 ` Roland Dreier
2018-08-23 6:12 ` Greg Kroah-Hartman
2018-08-24 16:45 ` Ben Hutchings
0 siblings, 2 replies; 124+ messages in thread
From: Roland Dreier @ 2018-08-23 0:48 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: LKML, stable, ben.hutchings, matt, bp, Andrew Morton,
Andy Lutomirski, luto, ard.biesheuvel, bp, brgerst, davej,
dvlasenk, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
sai.praneeth.prakhya, sds, Thomas Gleixner, toshi.kani,
linux-efi, Ingo Molnar, Yazen.Ghannam
On Fri, Dec 15, 2017 at 2:20 AM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This reverts commit 87e2bd898d3a79a8c609f183180adac47879a2a4 which is
> commit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
>
> Turns there was too many other issues with this patch to make it viable
> for the stable tree.
This was sort of a long time ago, but does anyone remember why this
needed to be reverted from 4.4?
The reason I ask is that without this, commit 02ff2769edbc /
"x86/mm/pat: Make set_memory_np() L1TF safe" in 4.4.148 is broken.
That patch has
- set_pud(pud, __pud(cpa->pfn | _PAGE_PSE |
- massage_pgprot(pud_pgprot)));
+ set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn,
+ canon_pgprot(pud_pgprot))));
(and similarly for pmds) but pfn_pud() is operating on page frame
numbers and __pud(cpa->pfn... in the old code is operating on physical
addresses.
This is bad enough that 4.4.148 and all newer 4.4.y crash early in
boot on some EFI systems that I have.
For now I am re-applying the "ensure cpa->pfn only contains page frame
numbers" patch, ported on top of 4.4.151.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-23 0:48 ` Roland Dreier
@ 2018-08-23 6:12 ` Greg Kroah-Hartman
2018-08-23 16:37 ` Roland Dreier
2018-08-24 16:45 ` Ben Hutchings
1 sibling, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-23 6:12 UTC (permalink / raw)
To: Roland Dreier
Cc: LKML, stable, ben.hutchings, matt, bp, Andrew Morton,
Andy Lutomirski, luto, ard.biesheuvel, bp, brgerst, davej,
dvlasenk, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
sai.praneeth.prakhya, sds, Thomas Gleixner, toshi.kani,
linux-efi, Ingo Molnar, Yazen.Ghannam
On Wed, Aug 22, 2018 at 05:48:32PM -0700, Roland Dreier wrote:
> On Fri, Dec 15, 2017 at 2:20 AM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> > This reverts commit 87e2bd898d3a79a8c609f183180adac47879a2a4 which is
> > commit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
> >
> > Turns there was too many other issues with this patch to make it viable
> > for the stable tree.
>
> This was sort of a long time ago, but does anyone remember why this
> needed to be reverted from 4.4?
I tried to dig through my old emails, but could not find anything,
sorry.
> The reason I ask is that without this, commit 02ff2769edbc /
> "x86/mm/pat: Make set_memory_np() L1TF safe" in 4.4.148 is broken.
> That patch has
>
> - set_pud(pud, __pud(cpa->pfn | _PAGE_PSE |
> - massage_pgprot(pud_pgprot)));
> + set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn,
> + canon_pgprot(pud_pgprot))));
>
> (and similarly for pmds) but pfn_pud() is operating on page frame
> numbers and __pud(cpa->pfn... in the old code is operating on physical
> addresses.
>
> This is bad enough that 4.4.148 and all newer 4.4.y crash early in
> boot on some EFI systems that I have.
Ugh, not good.
> For now I am re-applying the "ensure cpa->pfn only contains page frame
> numbers" patch, ported on top of 4.4.151.
I can try to add it back and see what blows up, want me to attempt that?
:)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-23 6:12 ` Greg Kroah-Hartman
@ 2018-08-23 16:37 ` Roland Dreier
2018-08-24 14:54 ` Matt Fleming
0 siblings, 1 reply; 124+ messages in thread
From: Roland Dreier @ 2018-08-23 16:37 UTC (permalink / raw)
To: Greg Kroah-Hartman, matt, ben.hutchings
Cc: LKML, stable, bp, Andrew Morton, Andy Lutomirski, luto,
ard.biesheuvel, bp, brgerst, davej, dvlasenk, H. Peter Anvin,
Linus Torvalds, Peter Zijlstra, sai.praneeth.prakhya, sds,
Thomas Gleixner, toshi.kani, linux-efi, Ingo Molnar,
Yazen.Ghannam
> > This is bad enough that 4.4.148 and all newer 4.4.y crash early in
> > boot on some EFI systems that I have.
>
> Ugh, not good.
>
> > For now I am re-applying the "ensure cpa->pfn only contains page frame
> > numbers" patch, ported on top of 4.4.151.
>
> I can try to add it back and see what blows up, want me to attempt that?
Not sure what to say... the current state is obviously broken. If you
look at what 02ff2769edbc is doing, it's clear that we're now shifting
cpa->pfn by PAGE_SHIFT where we weren't before, so we're putting bogus
values in the page table. And this is enough that my server system
booting with EFI crashes early in boot efi_enter_virtual_mode() with
the symptom that NX is improperly set on some pages (booting with
"noexec=off" fixes things, although obviously I don't want to run that
way). FWIW I can confirm that reverting the single patch 02ff2769edbc
fixes things, as does the cpa->pfn fix I mentioned above.
It's hard for me to make a call on applying "ensure cpa->pfn only
contains page frame numbers" without knowing the problems it caused
before. The patch looks fine to me and I definitely need it, but
maybe it exposes some other bug elsewhere? Maybe Ben or Matt remember
more above why this was reverted in 4.4.106? Otherwise I'd say yeah,
we should re-apply it, since I don't think we want to revert
02ff2769edbc.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-23 16:37 ` Roland Dreier
@ 2018-08-24 14:54 ` Matt Fleming
0 siblings, 0 replies; 124+ messages in thread
From: Matt Fleming @ 2018-08-24 14:54 UTC (permalink / raw)
To: Roland Dreier
Cc: Greg Kroah-Hartman, ben.hutchings, LKML, stable, bp,
Andrew Morton, Andy Lutomirski, luto, ard.biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Thu, 23 Aug, at 09:37:28AM, Roland Dreier wrote:
> > > This is bad enough that 4.4.148 and all newer 4.4.y crash early in
> > > boot on some EFI systems that I have.
> >
> > Ugh, not good.
> >
> > > For now I am re-applying the "ensure cpa->pfn only contains page frame
> > > numbers" patch, ported on top of 4.4.151.
> >
> > I can try to add it back and see what blows up, want me to attempt that?
>
> Not sure what to say... the current state is obviously broken. If you
> look at what 02ff2769edbc is doing, it's clear that we're now shifting
> cpa->pfn by PAGE_SHIFT where we weren't before, so we're putting bogus
> values in the page table. And this is enough that my server system
> booting with EFI crashes early in boot efi_enter_virtual_mode() with
> the symptom that NX is improperly set on some pages (booting with
> "noexec=off" fixes things, although obviously I don't want to run that
> way). FWIW I can confirm that reverting the single patch 02ff2769edbc
> fixes things, as does the cpa->pfn fix I mentioned above.
>
> It's hard for me to make a call on applying "ensure cpa->pfn only
> contains page frame numbers" without knowing the problems it caused
> before. The patch looks fine to me and I definitely need it, but
> maybe it exposes some other bug elsewhere? Maybe Ben or Matt remember
> more above why this was reverted in 4.4.106? Otherwise I'd say yeah,
> we should re-apply it, since I don't think we want to revert
> 02ff2769edbc.
For the record, I wasn't even aware it had been reverted.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-23 0:48 ` Roland Dreier
2018-08-23 6:12 ` Greg Kroah-Hartman
@ 2018-08-24 16:45 ` Ben Hutchings
2018-08-24 17:08 ` Roland Dreier
1 sibling, 1 reply; 124+ messages in thread
From: Ben Hutchings @ 2018-08-24 16:45 UTC (permalink / raw)
To: Roland Dreier, Greg Kroah-Hartman
Cc: LKML, stable, matt, bp, Andrew Morton, Andy Lutomirski, luto,
ard.biesheuvel, bp, brgerst, davej, dvlasenk, H. Peter Anvin,
Linus Torvalds, Peter Zijlstra, sai.praneeth.prakhya, sds,
Thomas Gleixner, toshi.kani, linux-efi, Ingo Molnar,
Yazen.Ghannam
On Wed, 2018-08-22 at 17:48 -0700, Roland Dreier wrote:
> On Fri, Dec 15, 2017 at 2:20 AM Greg Kroah-Hartman
> > <gregkh@linuxfoundation.org> wrote:
> > This reverts commit 87e2bd898d3a79a8c609f183180adac47879a2a4 which is
> > commit edc3b9129cecd0f0857112136f5b8b1bc1d45918 upstream.
> >
> > Turns there was too many other issues with this patch to make it viable
> > for the stable tree.
>
> This was sort of a long time ago, but does anyone remember why this
> needed to be reverted from 4.4?
See
<https://lore.kernel.org/lkml/1512686629.18523.217.camel@codethink.co.uk/T/#u>.
Ben.
> The reason I ask is that without this, commit 02ff2769edbc /
> "x86/mm/pat: Make set_memory_np() L1TF safe" in 4.4.148 is broken.
> That patch has
>
> - set_pud(pud, __pud(cpa->pfn | _PAGE_PSE |
> - massage_pgprot(pud_pgprot)));
> + set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn,
> + canon_pgprot(pud_pgprot))));
>
> (and similarly for pmds) but pfn_pud() is operating on page frame
> numbers and __pud(cpa->pfn... in the old code is operating on physical
> addresses.
>
> This is bad enough that 4.4.148 and all newer 4.4.y crash early in
> boot on some EFI systems that I have.
>
> For now I am re-applying the "ensure cpa->pfn only contains page frame
> numbers" patch, ported on top of 4.4.151.
>
> - R.
>
--
Ben Hutchings, Software Developer Codethink Ltd
https://www.codethink.co.uk/ Dale House, 35 Dale Street
Manchester, M1 2HF, United Kingdom
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 16:45 ` Ben Hutchings
@ 2018-08-24 17:08 ` Roland Dreier
2018-08-24 19:17 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Roland Dreier @ 2018-08-24 17:08 UTC (permalink / raw)
To: Ben Hutchings, Greg Kroah-Hartman
Cc: LKML, stable, matt, bp, Andrew Morton, Andy Lutomirski, luto,
Ard Biesheuvel, bp, brgerst, davej, dvlasenk, H. Peter Anvin,
Linus Torvalds, Peter Zijlstra, sai.praneeth.prakhya, sds,
Thomas Gleixner, toshi.kani, linux-efi, Ingo Molnar,
Yazen.Ghannam
> See
> <https://lore.kernel.org/lkml/1512686629.18523.217.camel@codethink.co.uk/T/#u>.
Thanks! I'm not using SGI UV and I'm not using kexec, so I guess I
sidestepped most of those issues. Greg, I think we need to unrevert
the cpa->pfn change (otherwise the L1TF fix probably gets pretty
messy) and I guess pull in the other patches that Ben mentions.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 17:08 ` Roland Dreier
@ 2018-08-24 19:17 ` Greg Kroah-Hartman
2018-08-24 20:04 ` Roland Dreier
2018-08-24 20:06 ` Guenter Roeck
0 siblings, 2 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-24 19:17 UTC (permalink / raw)
To: Roland Dreier, Guenter Roeck
Cc: Ben Hutchings, LKML, stable, matt, bp, Andrew Morton,
Andy Lutomirski, luto, Ard Biesheuvel, bp, brgerst, davej,
dvlasenk, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
sai.praneeth.prakhya, sds, Thomas Gleixner, toshi.kani,
linux-efi, Ingo Molnar, Yazen.Ghannam
On Fri, Aug 24, 2018 at 10:08:28AM -0700, Roland Dreier wrote:
> > See
> > <https://lore.kernel.org/lkml/1512686629.18523.217.camel@codethink.co.uk/T/#u>.
>
> Thanks! I'm not using SGI UV and I'm not using kexec, so I guess I
> sidestepped most of those issues. Greg, I think we need to unrevert
> the cpa->pfn change (otherwise the L1TF fix probably gets pretty
> messy) and I guess pull in the other patches that Ben mentions.
Ok, so what patch should be reverted? I'm seeing other reports of
problems all around this same area, but I can't figure out exactly what
to do.
Guenter, any ideas?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 19:17 ` Greg Kroah-Hartman
@ 2018-08-24 20:04 ` Roland Dreier
2018-08-24 20:10 ` Guenter Roeck
` (2 more replies)
2018-08-24 20:06 ` Guenter Roeck
1 sibling, 3 replies; 124+ messages in thread
From: Roland Dreier @ 2018-08-24 20:04 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux, Ben Hutchings, LKML, stable, matt, bp, Andrew Morton,
Andy Lutomirski, luto, Ard Biesheuvel, bp, brgerst, davej,
dvlasenk, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
sai.praneeth.prakhya, sds, Thomas Gleixner, toshi.kani,
linux-efi, Ingo Molnar, Yazen.Ghannam
> Ok, so what patch should be reverted? I'm seeing other reports of
> problems all around this same area, but I can't figure out exactly what
> to do.
Are any of those reports public? If so can you point me at them, I'm
curious if the symptoms match up.
I don't think we want to revert anything. I think you should pull in
edc3b9129cec and at least the first three patches that Ben listed:
21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
the first patch takes a bit of massaging (mostly because some of it is
already touched by 02ff2769edbc, which keeps the changes from
edc3b9129cec, and so we can drop a good bit when applying). The other
three apply cleanly.
I'm currently testing that and can send you the state of my tree in a bit.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:04 ` Roland Dreier
@ 2018-08-24 20:10 ` Guenter Roeck
2018-08-24 20:16 ` Roland Dreier
2018-08-24 21:19 ` Guenter Roeck
2018-08-25 13:52 ` Guenter Roeck
2 siblings, 1 reply; 124+ messages in thread
From: Guenter Roeck @ 2018-08-24 20:10 UTC (permalink / raw)
To: Roland Dreier
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Fri, Aug 24, 2018 at 01:04:09PM -0700, Roland Dreier wrote:
> > Ok, so what patch should be reverted? I'm seeing other reports of
> > problems all around this same area, but I can't figure out exactly what
> > to do.
>
> Are any of those reports public? If so can you point me at them, I'm
> curious if the symptoms match up.
>
> I don't think we want to revert anything. I think you should pull in
> edc3b9129cec and at least the first three patches that Ben listed:
>
> 21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
> b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
> 753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
>
> the first patch takes a bit of massaging (mostly because some of it is
> already touched by 02ff2769edbc, which keeps the changes from
> edc3b9129cec, and so we can drop a good bit when applying). The other
> three apply cleanly.
>
> I'm currently testing that and can send you the state of my tree in a bit.
>
Sounds great. I'll hold off with sending my RFT series and wait for your
test results. I think we'll also need d367cef0a7f0c6 ("x86/mm/pat: Fix
boot crash when 1GB pages are not supported by the CPU").
Thanks,
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:10 ` Guenter Roeck
@ 2018-08-24 20:16 ` Roland Dreier
2018-08-24 20:32 ` Guenter Roeck
0 siblings, 1 reply; 124+ messages in thread
From: Roland Dreier @ 2018-08-24 20:16 UTC (permalink / raw)
To: linux
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
> Sounds great. I'll hold off with sending my RFT series and wait for your
> test results. I think we'll also need d367cef0a7f0c6 ("x86/mm/pat: Fix
> boot crash when 1GB pages are not supported by the CPU").
Sure, makes sense - I don't have any EFI systems with CPUs old enough
not to support 1G pages but that looks reasonable. I'll pull that
into my tree as well.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:16 ` Roland Dreier
@ 2018-08-24 20:32 ` Guenter Roeck
2018-08-31 6:24 ` Guillaume Tucker
0 siblings, 1 reply; 124+ messages in thread
From: Guenter Roeck @ 2018-08-24 20:32 UTC (permalink / raw)
To: Roland Dreier
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam,
Guillaume Tucker
On Fri, Aug 24, 2018 at 01:16:18PM -0700, Roland Dreier wrote:
> > Sounds great. I'll hold off with sending my RFT series and wait for your
> > test results. I think we'll also need d367cef0a7f0c6 ("x86/mm/pat: Fix
> > boot crash when 1GB pages are not supported by the CPU").
>
> Sure, makes sense - I don't have any EFI systems with CPUs old enough
> not to support 1G pages but that looks reasonable. I'll pull that
> into my tree as well.
>
kernelci reported a crash on a CPU which doesn't support 1G pages.
See https://kernelci.org/boot/id/5b7d39ea59b514c03796ba9c/
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:32 ` Guenter Roeck
@ 2018-08-31 6:24 ` Guillaume Tucker
2018-08-31 16:02 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Guillaume Tucker @ 2018-08-31 6:24 UTC (permalink / raw)
To: Guenter Roeck, Roland Dreier
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On 24/08/18 21:32, Guenter Roeck wrote:
> On Fri, Aug 24, 2018 at 01:16:18PM -0700, Roland Dreier wrote:
>>> Sounds great. I'll hold off with sending my RFT series and wait for your
>>> test results. I think we'll also need d367cef0a7f0c6 ("x86/mm/pat: Fix
>>> boot crash when 1GB pages are not supported by the CPU").
>>
>> Sure, makes sense - I don't have any EFI systems with CPUs old enough
>> not to support 1G pages but that looks reasonable. I'll pull that
>> into my tree as well.
>>
> kernelci reported a crash on a CPU which doesn't support 1G pages.
> See https://kernelci.org/boot/id/5b7d39ea59b514c03796ba9c/
Looks like this has now been fixed with Andi's patch in 4.4.153:
"x86/mm/pat: Fix L1TF stable backport for CPA"
I can confirm this platform is now booting fine in kernelci:
http://lava.streamtester.net/scheduler/job/146195
Thanks,
Guillaume
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-31 6:24 ` Guillaume Tucker
@ 2018-08-31 16:02 ` Greg Kroah-Hartman
0 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-31 16:02 UTC (permalink / raw)
To: Guillaume Tucker
Cc: Guenter Roeck, Roland Dreier, Ben Hutchings, LKML, stable, matt,
bp, Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Fri, Aug 31, 2018 at 07:24:08AM +0100, Guillaume Tucker wrote:
> On 24/08/18 21:32, Guenter Roeck wrote:
> > On Fri, Aug 24, 2018 at 01:16:18PM -0700, Roland Dreier wrote:
> >>> Sounds great. I'll hold off with sending my RFT series and wait for your
> >>> test results. I think we'll also need d367cef0a7f0c6 ("x86/mm/pat: Fix
> >>> boot crash when 1GB pages are not supported by the CPU").
> >>
> >> Sure, makes sense - I don't have any EFI systems with CPUs old enough
> >> not to support 1G pages but that looks reasonable. I'll pull that
> >> into my tree as well.
> >>
> > kernelci reported a crash on a CPU which doesn't support 1G pages.
> > See https://kernelci.org/boot/id/5b7d39ea59b514c03796ba9c/
>
> Looks like this has now been fixed with Andi's patch in 4.4.153:
>
> "x86/mm/pat: Fix L1TF stable backport for CPA"
>
> I can confirm this platform is now booting fine in kernelci:
>
> http://lava.streamtester.net/scheduler/job/146195
Wonderful, thanks for letting us know.
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:04 ` Roland Dreier
2018-08-24 20:10 ` Guenter Roeck
@ 2018-08-24 21:19 ` Guenter Roeck
2018-08-25 13:52 ` Guenter Roeck
2 siblings, 0 replies; 124+ messages in thread
From: Guenter Roeck @ 2018-08-24 21:19 UTC (permalink / raw)
To: Roland Dreier
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam, Andi Kleen
+Andi Kleen <ak@linux.intel.com>
On Fri, Aug 24, 2018 at 01:04:09PM -0700, Roland Dreier wrote:
> > Ok, so what patch should be reverted? I'm seeing other reports of
> > problems all around this same area, but I can't figure out exactly what
> > to do.
>
> Are any of those reports public? If so can you point me at them, I'm
> curious if the symptoms match up.
>
> I don't think we want to revert anything. I think you should pull in
> edc3b9129cec and at least the first three patches that Ben listed:
>
> 21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
> b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
> 753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
>
> the first patch takes a bit of massaging (mostly because some of it is
> already touched by 02ff2769edbc, which keeps the changes from
> edc3b9129cec, and so we can drop a good bit when applying). The other
> three apply cleanly.
>
> I'm currently testing that and can send you the state of my tree in a bit.
>
> - R.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 20:04 ` Roland Dreier
2018-08-24 20:10 ` Guenter Roeck
2018-08-24 21:19 ` Guenter Roeck
@ 2018-08-25 13:52 ` Guenter Roeck
2018-08-25 15:07 ` Greg Kroah-Hartman
2 siblings, 1 reply; 124+ messages in thread
From: Guenter Roeck @ 2018-08-25 13:52 UTC (permalink / raw)
To: Roland Dreier, Greg Kroah-Hartman
Cc: Ben Hutchings, LKML, stable, matt, bp, Andrew Morton,
Andy Lutomirski, luto, Ard Biesheuvel, bp, brgerst, davej,
dvlasenk, H. Peter Anvin, Linus Torvalds, Peter Zijlstra,
sai.praneeth.prakhya, sds, Thomas Gleixner, toshi.kani,
linux-efi, Ingo Molnar, Yazen.Ghannam
Hi Roland,
On 08/24/2018 01:04 PM, Roland Dreier wrote:
>> Ok, so what patch should be reverted? I'm seeing other reports of
>> problems all around this same area, but I can't figure out exactly what
>> to do.
>
> Are any of those reports public? If so can you point me at them, I'm
> curious if the symptoms match up.
>
> I don't think we want to revert anything. I think you should pull in
> edc3b9129cec and at least the first three patches that Ben listed:
>
> 21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
> b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
> 753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
>
> the first patch takes a bit of massaging (mostly because some of it is
> already touched by 02ff2769edbc, which keeps the changes from
> edc3b9129cec, and so we can drop a good bit when applying). The other
> three apply cleanly.
>
> I'm currently testing that and can send you the state of my tree in a bit.
>
Have you made any progress ? On my side I am still out of luck since I can not
reproduce the problem.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-25 13:52 ` Guenter Roeck
@ 2018-08-25 15:07 ` Greg Kroah-Hartman
2018-08-26 2:30 ` Guenter Roeck
0 siblings, 1 reply; 124+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-25 15:07 UTC (permalink / raw)
To: Guenter Roeck
Cc: Roland Dreier, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Sat, Aug 25, 2018 at 06:52:32AM -0700, Guenter Roeck wrote:
> Hi Roland,
>
> On 08/24/2018 01:04 PM, Roland Dreier wrote:
> > > Ok, so what patch should be reverted? I'm seeing other reports of
> > > problems all around this same area, but I can't figure out exactly what
> > > to do.
> >
> > Are any of those reports public? If so can you point me at them, I'm
> > curious if the symptoms match up.
> >
> > I don't think we want to revert anything. I think you should pull in
> > edc3b9129cec and at least the first three patches that Ben listed:
> >
> > 21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
> > b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
> > 753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
> >
> > the first patch takes a bit of massaging (mostly because some of it is
> > already touched by 02ff2769edbc, which keeps the changes from
> > edc3b9129cec, and so we can drop a good bit when applying). The other
> > three apply cleanly.
> >
> > I'm currently testing that and can send you the state of my tree in a bit.
> >
>
> Have you made any progress ? On my side I am still out of luck since I can not
> reproduce the problem.
Perhaps just the patch that Andi posted to the stable list helps out
here?
Roland, can you try just that?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-25 15:07 ` Greg Kroah-Hartman
@ 2018-08-26 2:30 ` Guenter Roeck
2018-08-29 19:58 ` Roland Dreier
0 siblings, 1 reply; 124+ messages in thread
From: Guenter Roeck @ 2018-08-26 2:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Roland Dreier, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On 08/25/2018 08:07 AM, Greg Kroah-Hartman wrote:
> On Sat, Aug 25, 2018 at 06:52:32AM -0700, Guenter Roeck wrote:
>> Hi Roland,
>>
>> On 08/24/2018 01:04 PM, Roland Dreier wrote:
>>>> Ok, so what patch should be reverted? I'm seeing other reports of
>>>> problems all around this same area, but I can't figure out exactly what
>>>> to do.
>>>
>>> Are any of those reports public? If so can you point me at them, I'm
>>> curious if the symptoms match up.
>>>
>>> I don't think we want to revert anything. I think you should pull in
>>> edc3b9129cec and at least the first three patches that Ben listed:
>>>
>>> 21cdb6b56843 x86/mm: Page align the '_end' symbol to avoid pfn conversion bugs
>>> b61a76f8850d x86/efi: Map RAM into the identity page table for mixed mode
>>> 753b11ef8e92 x86/efi: Setup separate EFI page tables in kexec paths
>>>
>>> the first patch takes a bit of massaging (mostly because some of it is
>>> already touched by 02ff2769edbc, which keeps the changes from
>>> edc3b9129cec, and so we can drop a good bit when applying). The other
>>> three apply cleanly.
>>>
>>> I'm currently testing that and can send you the state of my tree in a bit.
>>>
>>
>> Have you made any progress ? On my side I am still out of luck since I can not
>> reproduce the problem.
>
> Perhaps just the patch that Andi posted to the stable list helps out
> here?
>
For reference:
https://www.spinics.net/lists/stable/msg253357.html
That would be the most straightforward and simple fix, so I would prefer
to go with it if it works.
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-26 2:30 ` Guenter Roeck
@ 2018-08-29 19:58 ` Roland Dreier
2018-08-30 12:10 ` Greg Kroah-Hartman
0 siblings, 1 reply; 124+ messages in thread
From: Roland Dreier @ 2018-08-29 19:58 UTC (permalink / raw)
To: Guenter Roeck
Cc: Greg Kroah-Hartman, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
> > Perhaps just the patch that Andi posted to the stable list helps out
> > here?
> >
>
> For reference:
>
> https://www.spinics.net/lists/stable/msg253357.html
>
> That would be the most straightforward and simple fix, so I would prefer
> to go with it if it works.
Sorry for being slow, it turned out to take a slightly bigger stack of
patches to get everything working.
I agree, Andi's simple fix is better anyway.
- R.
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-29 19:58 ` Roland Dreier
@ 2018-08-30 12:10 ` Greg Kroah-Hartman
0 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2018-08-30 12:10 UTC (permalink / raw)
To: Roland Dreier
Cc: Guenter Roeck, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Wed, Aug 29, 2018 at 12:58:00PM -0700, Roland Dreier wrote:
> > > Perhaps just the patch that Andi posted to the stable list helps out
> > > here?
> > >
> >
> > For reference:
> >
> > https://www.spinics.net/lists/stable/msg253357.html
> >
> > That would be the most straightforward and simple fix, so I would prefer
> > to go with it if it works.
>
> Sorry for being slow, it turned out to take a slightly bigger stack of
> patches to get everything working.
>
> I agree, Andi's simple fix is better anyway.
So 4.4.153 works fine for you now?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
2018-08-24 19:17 ` Greg Kroah-Hartman
2018-08-24 20:04 ` Roland Dreier
@ 2018-08-24 20:06 ` Guenter Roeck
1 sibling, 0 replies; 124+ messages in thread
From: Guenter Roeck @ 2018-08-24 20:06 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Roland Dreier, Ben Hutchings, LKML, stable, matt, bp,
Andrew Morton, Andy Lutomirski, luto, Ard Biesheuvel, bp,
brgerst, davej, dvlasenk, H. Peter Anvin, Linus Torvalds,
Peter Zijlstra, sai.praneeth.prakhya, sds, Thomas Gleixner,
toshi.kani, linux-efi, Ingo Molnar, Yazen.Ghannam
On Fri, Aug 24, 2018 at 09:17:49PM +0200, Greg Kroah-Hartman wrote:
> On Fri, Aug 24, 2018 at 10:08:28AM -0700, Roland Dreier wrote:
> > > See
> > > <https://lore.kernel.org/lkml/1512686629.18523.217.camel@codethink.co.uk/T/#u>.
> >
> > Thanks! I'm not using SGI UV and I'm not using kexec, so I guess I
> > sidestepped most of those issues. Greg, I think we need to unrevert
> > the cpa->pfn change (otherwise the L1TF fix probably gets pretty
> > messy) and I guess pull in the other patches that Ben mentions.
>
> Ok, so what patch should be reverted? I'm seeing other reports of
> problems all around this same area, but I can't figure out exactly what
> to do.
>
> Guenter, any ideas?
>
I think we'll need to reapply 87e2bd898d3a ("x86/mm/pat: Ensure cpa->pfn only
contains page frame numbers"), and possibly apply d367cef0a7f0 ("x86/mm/pat:
Fix boot crash when 1GB pages are not supported by the CPU"). Both require
conflict resolutions, but they are quite straightforward. I am not sure
about the other EFI patches.
I am going to send the backports as RFT in a minute. Problem is that I don't
have an EFI system at hand and can not test if this fixes the problem
(or maybe introduces a new one), so someone will need to step in and do
those tests.
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread
* [PATCH 4.4 104/105] arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (95 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 103/105] Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers" Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 9:45 ` [PATCH 4.4 105/105] usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping Greg Kroah-Hartman
` (4 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Kristina Martsenko, Christoffer Dall,
Marc Zyngier
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <marc.zyngier@arm.com>
commit 5553b142be11e794ebc0805950b2e8313f93d718 upstream.
VTTBR_BADDR_MASK is used to sanity check the size and alignment of the
VTTBR address. It seems to currently be off by one, thereby only
allowing up to 39-bit addresses (instead of 40-bit) and also
insufficiently checking the alignment. This patch fixes it.
This patch is the 32bit pendent of Kristina's arm64 fix, and
she deserves the actual kudos for pinpointing that one.
Fixes: f7ed45be3ba52 ("KVM: ARM: World-switch implementation")
Cc: <stable@vger.kernel.org> # 3.9
Reported-by: Kristina Martsenko <kristina.martsenko@arm.com>
Reviewed-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/include/asm/kvm_arm.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/arch/arm/include/asm/kvm_arm.h
+++ b/arch/arm/include/asm/kvm_arm.h
@@ -161,8 +161,7 @@
#else
#define VTTBR_X (5 - KVM_T0SZ)
#endif
-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1)
-#define VTTBR_BADDR_MASK (((1LLU << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT)
+#define VTTBR_BADDR_MASK (((1LLU << (40 - VTTBR_X)) - 1) << VTTBR_X)
#define VTTBR_VMID_SHIFT (48LLU)
#define VTTBR_VMID_MASK (0xffLLU << VTTBR_VMID_SHIFT)
^ permalink raw reply [flat|nested] 124+ messages in thread* [PATCH 4.4 105/105] usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (96 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 104/105] arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one Greg Kroah-Hartman
@ 2017-12-15 9:45 ` Greg Kroah-Hartman
2017-12-15 10:01 ` [PATCH 4.4 000/105] 4.4.106-stable review Nathan Chancellor
` (3 subsequent siblings)
101 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 9:45 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vincent Pelletier, Felipe Balbi, Siqi Lin
4.4-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Pelletier <plr.vincent@gmail.com>
commit 30bf90ccdec1da9c8198b161ecbff39ce4e5a9ba upstream.
Found using DEBUG_ATOMIC_SLEEP while submitting an AIO read operation:
[ 100.853642] BUG: sleeping function called from invalid context at mm/slab.h:421
[ 100.861148] in_atomic(): 1, irqs_disabled(): 1, pid: 1880, name: python
[ 100.867954] 2 locks held by python/1880:
[ 100.867961] #0: (&epfile->mutex){....}, at: [<f8188627>] ffs_mutex_lock+0x27/0x30 [usb_f_fs]
[ 100.868020] #1: (&(&ffs->eps_lock)->rlock){....}, at: [<f818ad4b>] ffs_epfile_io.isra.17+0x24b/0x590 [usb_f_fs]
[ 100.868076] CPU: 1 PID: 1880 Comm: python Not tainted 4.14.0-edison+ #118
[ 100.868085] Hardware name: Intel Corporation Merrifield/BODEGA BAY, BIOS 542 2015.01.21:18.19.48
[ 100.868093] Call Trace:
[ 100.868122] dump_stack+0x47/0x62
[ 100.868156] ___might_sleep+0xfd/0x110
[ 100.868182] __might_sleep+0x68/0x70
[ 100.868217] kmem_cache_alloc_trace+0x4b/0x200
[ 100.868248] ? dwc3_gadget_ep_alloc_request+0x24/0xe0 [dwc3]
[ 100.868302] dwc3_gadget_ep_alloc_request+0x24/0xe0 [dwc3]
[ 100.868343] usb_ep_alloc_request+0x16/0xc0 [udc_core]
[ 100.868386] ffs_epfile_io.isra.17+0x444/0x590 [usb_f_fs]
[ 100.868424] ? _raw_spin_unlock_irqrestore+0x27/0x40
[ 100.868457] ? kiocb_set_cancel_fn+0x57/0x60
[ 100.868477] ? ffs_ep0_poll+0xc0/0xc0 [usb_f_fs]
[ 100.868512] ffs_epfile_read_iter+0xfe/0x157 [usb_f_fs]
[ 100.868551] ? security_file_permission+0x9c/0xd0
[ 100.868587] ? rw_verify_area+0xac/0x120
[ 100.868633] aio_read+0x9d/0x100
[ 100.868692] ? __fget+0xa2/0xd0
[ 100.868727] ? __might_sleep+0x68/0x70
[ 100.868763] SyS_io_submit+0x471/0x680
[ 100.868878] do_int80_syscall_32+0x4e/0xd0
[ 100.868921] entry_INT80_32+0x2a/0x2a
[ 100.868932] EIP: 0xb7fbb676
[ 100.868941] EFLAGS: 00000292 CPU: 1
[ 100.868951] EAX: ffffffda EBX: b7aa2000 ECX: 00000002 EDX: b7af8368
[ 100.868961] ESI: b7fbb660 EDI: b7aab000 EBP: bfb6c658 ESP: bfb6c638
[ 100.868973] DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 007b
Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Siqi Lin <siqilin@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -791,7 +791,7 @@ static ssize_t ffs_epfile_io(struct file
}
if (io_data->aio) {
- req = usb_ep_alloc_request(ep->ep, GFP_KERNEL);
+ req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC);
if (unlikely(!req))
goto error_lock;
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 000/105] 4.4.106-stable review
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (97 preceding siblings ...)
2017-12-15 9:45 ` [PATCH 4.4 105/105] usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping Greg Kroah-Hartman
@ 2017-12-15 10:01 ` Nathan Chancellor
2017-12-15 13:07 ` Greg Kroah-Hartman
2017-12-15 17:39 ` Guenter Roeck
` (2 subsequent siblings)
101 siblings, 1 reply; 124+ messages in thread
From: Nathan Chancellor @ 2017-12-15 10:01 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, lkft-triage, stable
On Fri, Dec 15, 2017 at 10:43:58AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.106 release.
> There are 105 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Dec 17 09:22:39 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.106-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 4.4.106-rc1
>
> Vincent Pelletier <plr.vincent@gmail.com>
> usb: gadget: ffs: Forbid usb_ep_alloc_request from sleeping
>
> Marc Zyngier <marc.zyngier@arm.com>
> arm: KVM: Fix VTTBR_BADDR_MASK BUG_ON off-by-one
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Revert "x86/mm/pat: Ensure cpa->pfn only contains page frame numbers"
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Revert "x86/efi: Hoist page table switching code into efi_call_virt()"
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Revert "x86/efi: Build our own page table structures"
>
> Eric Dumazet <edumazet@google.com>
> net/packet: fix a race in packet_bind() and packet_notifier()
>
> Mike Maloney <maloney@google.com>
> packet: fix crash in fanout_demux_rollover()
>
> Hangbin Liu <liuhangbin@gmail.com>
> sit: update frag_off info
>
> Håkon Bugge <Haakon.Bugge@oracle.com>
> rds: Fix NULL pointer dereference in __rds_rdma_map
>
> Jon Maloy <jon.maloy@ericsson.com>
> tipc: fix memory leak in tipc_accept_from_sock()
>
> Al Viro <viro@zeniv.linux.org.uk>
> more bio_map_user_iov() leak fixes
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390: always save and restore all registers on context switch
>
> Masamitsu Yamazaki <m-yamazaki@ah.jp.nec.com>
> ipmi: Stop timers before cleaning up the module
>
> Paul Moore <paul@paul-moore.com>
> audit: ensure that 'audit=1' actually enables audit for PID 1
>
> Keefe Liu <liuqifa@huawei.com>
> ipvlan: fix ipv6 outbound device
>
> David Howells <dhowells@redhat.com>
> afs: Connect up the CB.ProbeUuid
>
> Majd Dibbiny <majd@mellanox.com>
> IB/mlx5: Assign send CQ and recv CQ of UMR QP
>
> Mark Bloch <markb@mellanox.com>
> IB/mlx4: Increase maximal message size under UD QP
>
> Herbert Xu <herbert@gondor.apana.org.au>
> xfrm: Copy policy family in clone_policy
>
> Jason Baron <jbaron@akamai.com>
> jump_label: Invoke jump_label_test() via early_initcall()
>
> Arvind Yadav <arvind.yadav.cs@gmail.com>
> atm: horizon: Fix irq release error
>
> Xin Long <lucien.xin@gmail.com>
> sctp: use the right sk after waking up from wait_buf sleep
>
> Xin Long <lucien.xin@gmail.com>
> sctp: do not free asoc when it is already dead in sctp_sendmsg
>
> Pavel Tatashin <pasha.tatashin@oracle.com>
> sparc64/mm: set fields in deferred pages
>
> Ming Lei <ming.lei@redhat.com>
> block: wake up all tasks blocked in get_request()
>
> Chuck Lever <chuck.lever@oracle.com>
> sunrpc: Fix rpc_task_begin trace point
>
> Trond Myklebust <trond.myklebust@primarydata.com>
> NFS: Fix a typo in nfs_rename()
>
> Randy Dunlap <rdunlap@infradead.org>
> dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0
>
> Stephen Bates <sbates@raithlin.com>
> lib/genalloc.c: make the avail variable an atomic_long_t
>
> Xin Long <lucien.xin@gmail.com>
> route: update fnhe_expires for redirect when the fnhe exists
>
> Xin Long <lucien.xin@gmail.com>
> route: also update fnhe_genid when updating a route cache
>
> Ben Hutchings <ben.hutchings@codethink.co.uk>
> mac80211_hwsim: Fix memory leak in hwsim_new_radio_nl()
>
> Masahiro Yamada <yamada.masahiro@socionext.com>
> kbuild: pkg: use --transform option to prefix paths in tar
>
> Jérémy Lefaure <jeremy.lefaure@lse.epita.fr>
> EDAC, i5000, i5400: Fix definition of NRECMEMB register
>
> Jérémy Lefaure <jeremy.lefaure@lse.epita.fr>
> EDAC, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro
>
> Alexey Kardashevskiy <aik@ozlabs.ru>
> powerpc/powernv/ioda2: Gracefully fail if too many TCE levels requested
>
> Jim Qu <Jim.Qu@amd.com>
> drm/amd/amdgpu: fix console deadlock if late init failed
>
> Jan Kara <jack@suse.cz>
> axonram: Fix gendisk handling
>
> Florian Westphal <fw@strlen.de>
> netfilter: don't track fragmented packets
>
> Johannes Thumshirn <jthumshirn@suse.de>
> zram: set physical queue limits to avoid array out of bounds accesses
>
> Chris Brandt <chris.brandt@renesas.com>
> i2c: riic: fix restart condition
>
> Krzysztof Kozlowski <krzk@kernel.org>
> crypto: s5p-sss - Fix completing crypto request in IRQ handler
>
> WANG Cong <xiyou.wangcong@gmail.com>
> ipv6: reorder icmpv6_init() and ip6_mr_init()
>
> Michal Schmidt <mschmidt@redhat.com>
> bnx2x: do not rollback VF MAC/VLAN filters we did not configure
>
> Michal Schmidt <mschmidt@redhat.com>
> bnx2x: fix possible overrun of VFPF multicast addresses array
>
> Michal Schmidt <mschmidt@redhat.com>
> bnx2x: prevent crash when accessing PTP with interface down
>
> Blomme, Maarten <Maarten.Blomme@flir.com>
> spi_ks8995: fix "BUG: key accdaa28 not in .data!"
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: KVM: Survive unknown traps from guests
>
> Mark Rutland <mark.rutland@arm.com>
> arm: KVM: Survive unknown traps from guests
>
> Wanpeng Li <wanpeng.li@hotmail.com>
> KVM: nVMX: reset nested_run_pending if the vCPU is going to be reset
>
> Franck Demathieu <fdemathieu@gmail.com>
> irqchip/crossbar: Fix incorrect type of register size
>
> James Smart <jsmart2021@gmail.com>
> scsi: lpfc: Fix crash during Hardware error recovery on SLI3 adapters
>
> Tejun Heo <tj@kernel.org>
> workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
>
> Tejun Heo <tj@kernel.org>
> libata: drop WARN from protocol error in ata_sff_qc_issue()
>
> Jim Mattson <jmattson@google.com>
> kvm: nVMX: VMCLEAR should not cause the vCPU to shut down
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> USB: gadgetfs: Fix a potential memory leak in 'dev_config()'
>
> John Keeping <john@metanate.com>
> usb: gadget: configs: plug memory leak
>
> Daniel Drake <drake@endlessm.com>
> HID: chicony: Add support for another ASUS Zen AiO keyboard
>
> Phil Reid <preid@electromag.com.au>
> gpio: altera: Use handle_level_irq when configured as a level_high
>
> Guenter Roeck <linux@roeck-us.net>
> ARM: OMAP2+: Release device node after it is no longer needed.
>
> Guenter Roeck <linux@roeck-us.net>
> ARM: OMAP2+: Fix device node reference counts
>
> David Daney <david.daney@cavium.com>
> module: set __jump_table alignment to 8
>
> Sachin Sant <sachinp@linux.vnet.ibm.com>
> selftest/powerpc: Fix false failures for skipped tests
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/hpet: Prevent might sleep splat on resume
>
> Ladislav Michl <ladis@linux-mips.org>
> ARM: OMAP2+: gpmc-onenand: propagate error on initialization failure
>
> Steffen Klassert <steffen.klassert@secunet.com>
> vti6: Don't report path MTU below IPV6_MIN_MTU.
>
> Sasha Levin <alexander.levin@verizon.com>
> Revert "s390/kbuild: enable modversions for symbols exported from asm"
>
> Sasha Levin <alexander.levin@verizon.com>
> Revert "spi: SPI_FSL_DSPI should depend on HAS_DMA"
>
> Sasha Levin <alexander.levin@verizon.com>
> Revert "drm/armada: Fix compile fail"
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> mm: drop unused pmdp_huge_get_and_clear_notify()
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> thp: fix MADV_DONTNEED vs. numa balancing race
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> thp: reduce indentation level in change_huge_pmd()
>
> Stephen Hemminger <stephen@networkplumber.org>
> scsi: storvsc: Workaround for virtual DVD SCSI version
>
> Russell King <rmk+kernel@armlinux.org.uk>
> ARM: avoid faulting on qemu
>
> Russell King <rmk+kernel@armlinux.org.uk>
> ARM: BUG if jumping to usermode address in kernel mode
>
> Dave Martin <Dave.Martin@arm.com>
> arm64: fpsimd: Prevent registers leaking from dead tasks
>
> Andrew Honig <ahonig@google.com>
> KVM: VMX: remove I/O port 0x80 bypass on Intel hosts
>
> Kristina Martsenko <kristina.martsenko@arm.com>
> arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one
>
> Laurent Caumont <lcaumont2@gmail.com>
> media: dvb: i2c transfers over usb cannot be done from stack
>
> Marek Szyprowski <m.szyprowski@samsung.com>
> drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU
>
> Dave Gordon <david.s.gordon@intel.com>
> drm: extra printk() wrapper macros
>
> Daniel Thompson <daniel.thompson@linaro.org>
> kdb: Fix handling of kallsyms_symbol_next() return value
>
> Heiko Carstens <heiko.carstens@de.ibm.com>
> s390: fix compat system call table
>
> Robin Murphy <robin.murphy@arm.com>
> iommu/vt-d: Fix scatterlist offset handling
>
> Jaejoong Kim <climbbb.kim@gmail.com>
> ALSA: usb-audio: Add check return value for usb_string()
>
> Jaejoong Kim <climbbb.kim@gmail.com>
> ALSA: usb-audio: Fix out-of-bound error
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: seq: Remove spurious WARN_ON() at timer check
>
> Robb Glasser <rglasser@google.com>
> ALSA: pcm: prevent UAF in snd_pcm_info
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> x86/PCI: Make broadcom_postcore_init() check acpi_disabled
>
> Eric Biggers <ebiggers@google.com>
> X.509: reject invalid BIT STRING for subjectPublicKey
>
> Eric Biggers <ebiggers@google.com>
> ASN.1: check for error from ASN1_OP_END__ACT actions
>
> Eric Biggers <ebiggers@google.com>
> ASN.1: fix out-of-bounds read when parsing indefinite length item
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> efi: Move some sysfs files to be read-only by root
>
> Huacai Chen <chenhc@lemote.com>
> scsi: libsas: align sata_device's rps_resp on a cacheline
>
> William Breathitt Gray <vilhelm.gray@gmail.com>
> isa: Prevent NULL dereference in isa_bus driver callbacks
>
> Paul Meyer <Paul.Meyer@microsoft.com>
> hv: kvp: Avoid reading past allocated blocks from KVP file
>
> weiping zhang <zwp10758@gmail.com>
> virtio: release virtio index when fail to device_register
>
> Martin Kelly <mkelly@xevo.com>
> can: usb_8dev: cancel urb on -EPIPE and -EPROTO
>
> Martin Kelly <mkelly@xevo.com>
> can: esd_usb2: cancel urb on -EPIPE and -EPROTO
>
> Martin Kelly <mkelly@xevo.com>
> can: ems_usb: cancel urb on -EPIPE and -EPROTO
>
> Martin Kelly <mkelly@xevo.com>
> can: kvaser_usb: cancel urb on -EPIPE and -EPROTO
>
> Jimmy Assarsson <jimmyassarsson@gmail.com>
> can: kvaser_usb: ratelimit errors if incomplete messages are received
>
> Jimmy Assarsson <jimmyassarsson@gmail.com>
> can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback()
>
> Jimmy Assarsson <jimmyassarsson@gmail.com>
> can: kvaser_usb: free buf in error paths
>
> Oliver Stäbler <oliver.staebler@bytesatwork.ch>
> can: ti_hecc: Fix napi poll return value for repoll
>
>
> -------------
>
> Diffstat:
>
> Makefile | 4 +-
> arch/arm/include/asm/assembler.h | 18 +++
> arch/arm/include/asm/kvm_arm.h | 4 +-
> arch/arm/kernel/entry-header.S | 6 +
> arch/arm/kvm/handle_exit.c | 19 +--
> arch/arm/mach-omap2/gpmc-onenand.c | 10 +-
> arch/arm/mach-omap2/omap_hwmod_3xxx_data.c | 25 ++--
> arch/arm64/include/asm/kvm_arm.h | 3 +-
> arch/arm64/kernel/process.c | 9 ++
> arch/arm64/kvm/handle_exit.c | 19 +--
> arch/powerpc/platforms/powernv/pci-ioda.c | 3 +
> arch/powerpc/sysdev/axonram.c | 5 +-
> arch/s390/include/asm/asm-prototypes.h | 8 --
> arch/s390/include/asm/switch_to.h | 19 ++-
> arch/s390/kernel/syscalls.S | 6 +-
> arch/sparc/mm/init_64.c | 9 +-
> arch/x86/include/asm/efi.h | 26 ----
> arch/x86/kernel/hpet.c | 2 +-
> arch/x86/kvm/vmx.c | 31 ++---
> arch/x86/mm/pageattr.c | 17 ++-
> arch/x86/pci/broadcom_bus.c | 2 +-
> arch/x86/platform/efi/efi.c | 39 +++---
> arch/x86/platform/efi/efi_32.c | 5 -
> arch/x86/platform/efi/efi_64.c | 137 ++++++----------------
> arch/x86/platform/efi/efi_stub_64.S | 43 +++++++
> block/bio.c | 14 ++-
> block/blk-core.c | 4 +-
> crypto/asymmetric_keys/x509_cert_parser.c | 2 +
> drivers/ata/libata-sff.c | 1 -
> drivers/atm/horizon.c | 2 +-
> drivers/base/isa.c | 10 +-
> drivers/block/zram/zram_drv.c | 2 +
> drivers/char/ipmi/ipmi_si_intf.c | 44 +++----
> drivers/crypto/s5p-sss.c | 5 +-
> drivers/edac/i5000_edac.c | 8 +-
> drivers/edac/i5400_edac.c | 9 +-
> drivers/firmware/efi/efi.c | 3 +-
> drivers/firmware/efi/esrt.c | 15 +--
> drivers/firmware/efi/runtime-map.c | 10 +-
> drivers/gpio/gpio-altera.c | 26 ++--
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 5 +-
> drivers/gpu/drm/armada/Makefile | 2 -
> drivers/gpu/drm/exynos/exynos_drm_gem.c | 9 ++
> drivers/hid/Kconfig | 4 +-
> drivers/hid/hid-chicony.c | 1 +
> drivers/hid/hid-core.c | 1 +
> drivers/hid/hid-ids.h | 1 +
> drivers/i2c/busses/i2c-riic.c | 6 +-
> drivers/infiniband/hw/mlx4/qp.c | 2 +-
> drivers/infiniband/hw/mlx5/main.c | 2 +
> drivers/iommu/intel-iommu.c | 8 +-
> drivers/irqchip/irq-crossbar.c | 8 +-
> drivers/media/usb/dvb-usb/dibusb-common.c | 16 ++-
> drivers/memory/omap-gpmc.c | 4 +-
> drivers/net/can/ti_hecc.c | 3 +
> drivers/net/can/usb/ems_usb.c | 2 +
> drivers/net/can/usb/esd_usb2.c | 2 +
> drivers/net/can/usb/kvaser_usb.c | 13 +-
> drivers/net/can/usb/usb_8dev.c | 2 +
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 20 +++-
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 8 +-
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h | 1 +
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c | 23 ++--
> drivers/net/ipvlan/ipvlan_core.c | 2 +-
> drivers/net/phy/spi_ks8995.c | 1 +
> drivers/net/wireless/mac80211_hwsim.c | 5 +-
> drivers/scsi/lpfc/lpfc_els.c | 14 ++-
> drivers/scsi/storvsc_drv.c | 27 +++--
> drivers/spi/Kconfig | 1 -
> drivers/usb/gadget/configfs.c | 1 +
> drivers/usb/gadget/function/f_fs.c | 2 +-
> drivers/usb/gadget/legacy/inode.c | 4 +-
> drivers/virtio/virtio.c | 2 +
> fs/afs/cmservice.c | 3 +
> fs/nfs/dir.c | 2 +-
> include/drm/drmP.h | 26 +++-
> include/linux/genalloc.h | 3 +-
> include/linux/mmu_notifier.h | 13 --
> include/linux/omap-gpmc.h | 5 +-
> include/linux/sysfs.h | 6 +
> include/scsi/libsas.h | 2 +-
> kernel/audit.c | 10 +-
> kernel/debug/kdb/kdb_io.c | 2 +-
> kernel/jump_label.c | 2 +-
> kernel/workqueue.c | 1 +
> lib/asn1_decoder.c | 49 ++++----
> lib/dynamic_debug.c | 4 +
> lib/genalloc.c | 10 +-
> mm/huge_memory.c | 82 +++++++++----
> net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 4 +
> net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 5 -
> net/ipv4/route.c | 14 ++-
> net/ipv6/af_inet6.c | 10 +-
> net/ipv6/ip6_vti.c | 8 +-
> net/ipv6/sit.c | 1 +
> net/packet/af_packet.c | 37 +++---
> net/packet/internal.h | 1 -
> net/rds/rdma.c | 2 +-
> net/sctp/socket.c | 38 ++++--
> net/sunrpc/sched.c | 3 +-
> net/tipc/server.c | 1 +
> net/xfrm/xfrm_policy.c | 1 +
> scripts/module-common.lds | 2 +
> scripts/package/Makefile | 5 +-
> sound/core/pcm.c | 2 +
> sound/core/seq/seq_timer.c | 2 +-
> sound/usb/mixer.c | 13 +-
> tools/hv/hv_kvp_daemon.c | 70 +++--------
> tools/testing/selftests/powerpc/harness.c | 6 +-
> 109 files changed, 701 insertions(+), 570 deletions(-)
>
>
Merged, compiled, and flashed onto my Pixel 2 XL and OnePlus 5.
No initial issues noticed in general usage or dmesg.
Cheers!
Nathan
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 000/105] 4.4.106-stable review
2017-12-15 10:01 ` [PATCH 4.4 000/105] 4.4.106-stable review Nathan Chancellor
@ 2017-12-15 13:07 ` Greg Kroah-Hartman
0 siblings, 0 replies; 124+ messages in thread
From: Greg Kroah-Hartman @ 2017-12-15 13:07 UTC (permalink / raw)
To: Nathan Chancellor
Cc: linux-kernel, torvalds, akpm, linux, shuahkh, patches,
ben.hutchings, lkft-triage, stable
On Fri, Dec 15, 2017 at 03:01:10AM -0700, Nathan Chancellor wrote:
>
> Merged, compiled, and flashed onto my Pixel 2 XL and OnePlus 5.
>
> No initial issues noticed in general usage or dmesg.
Wonderful, thanks for testing and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 124+ messages in thread
* Re: [PATCH 4.4 000/105] 4.4.106-stable review
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (98 preceding siblings ...)
2017-12-15 10:01 ` [PATCH 4.4 000/105] 4.4.106-stable review Nathan Chancellor
@ 2017-12-15 17:39 ` Guenter Roeck
2017-12-15 21:14 ` Shuah Khan
2017-12-16 5:36 ` Naresh Kamboju
101 siblings, 0 replies; 124+ messages in thread
From: Guenter Roeck @ 2017-12-15 17:39 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, shuahkh, patches, ben.hutchings,
lkft-triage, stable
On Fri, Dec 15, 2017 at 10:43:58AM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.106 release.
> There are 105 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Dec 17 09:22:39 UTC 2017.
> Anything received after that time might be too late.
>
Build results:
total: 145 pass: 145 fail: 0
Qemu test results:
total: 116 pass: 116 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 000/105] 4.4.106-stable review
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (99 preceding siblings ...)
2017-12-15 17:39 ` Guenter Roeck
@ 2017-12-15 21:14 ` Shuah Khan
2017-12-16 5:36 ` Naresh Kamboju
101 siblings, 0 replies; 124+ messages in thread
From: Shuah Khan @ 2017-12-15 21:14 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, ben.hutchings, lkft-triage,
stable, Shuah Khan
On 12/15/2017 02:43 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.106 release.
> There are 105 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Dec 17 09:22:39 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.106-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 124+ messages in thread* Re: [PATCH 4.4 000/105] 4.4.106-stable review
2017-12-15 9:43 [PATCH 4.4 000/105] 4.4.106-stable review Greg Kroah-Hartman
` (100 preceding siblings ...)
2017-12-15 21:14 ` Shuah Khan
@ 2017-12-16 5:36 ` Naresh Kamboju
101 siblings, 0 replies; 124+ messages in thread
From: Naresh Kamboju @ 2017-12-16 5:36 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: linux-kernel, torvalds, akpm, Guenter Roeck, Shuah Khan, patches,
Ben Hutchings, lkft-triage, linux- stable, Tom Gall
On 15 December 2017 at 15:13, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 4.4.106 release.
> There are 105 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun Dec 17 09:22:39 UTC 2017.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.4.106-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.4.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm and x86_64.
NOTE:
We do not have arm64 hikey board results due to the changes required
from the firmware update. Hikey board is under maintenance.
readahead02 failed once in 3 iterations of full syscall run which is
intermittently failure on ARM64 juno running 4.4.106-rc1.
Resubmitted test looped for 20 Iterations out of which 7 times TCONF
and 13 times PASS.
Test log failed instance:
readahead02 0 TINFO : read_testfile(0) used cache: 65468 kB
readahead02 0 TINFO : read_testfile(1) used cache: 32592 kB
readahead02 0 TWARN : readahead02.c:351: using less cache than expected
Test pass log:
readahead02 0 TINFO : read_testfile(0) used cache: 65568 kB
readahead02 0 TINFO : read_testfile(1) used cache: 65268 kB
readahead02 3 TPASS : using cache as expected
Test CONF log:
readahead02 0 TINFO : read_testfile(0) used cache: 65376 kB
readahead02 0 TINFO : read_testfile(1) used cache: 65564 kB
readahead02 3 TCONF : readahead02.c:354: Page cache on your
system is too small to hold whole testfile.
Bug reported for the investigation.
https://bugs.linaro.org/show_bug.cgi?id=3539
Summary
------------------------------------------------------------------------
kernel: 4.4.106-rc1
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.4.y
git commit: 67065bd41780929c2b8406ac3dd5356e83cd2d19
git describe: v4.4.105-106-g67065bd41780
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.4-oe/build/v4.4.105-106-g67065bd41780
No regressions (compared to build v4.4.105-108-g894d367e5d93)
------------------------------------------------------------------------
Boards, architectures and test suites:
-------------------------------------
juno-r2 - arm64
* boot - pass: 20,
* kselftest - pass: 32, skip: 29
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 28, skip: 36
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 60,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 14,
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - fail: 2, pass: 980, skip: 124
* ltp-timers-tests - pass: 12,
x15 - arm
* boot - pass: 20,
* kselftest - pass: 31, skip: 29
* libhugetlbfs - pass: 87, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 60,
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 20, skip: 2
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 13, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 1035, skip: 67
* ltp-timers-tests - pass: 12,
x86_64
* boot - pass: 20,
* kselftest - pass: 44, skip: 32
* libhugetlbfs - pass: 90, skip: 1
* ltp-cap_bounds-tests - pass: 2,
* ltp-containers-tests - pass: 64,
* ltp-fcntl-locktests-tests - pass: 2,
* ltp-filecaps-tests - pass: 2,
* ltp-fs-tests - pass: 61, skip: 1
* ltp-fs_bind-tests - pass: 2,
* ltp-fs_perms_simple-tests - pass: 19,
* ltp-fsx-tests - pass: 2,
* ltp-hugetlb-tests - pass: 22,
* ltp-io-tests - pass: 3,
* ltp-ipc-tests - pass: 9,
* ltp-math-tests - pass: 11,
* ltp-nptl-tests - pass: 2,
* ltp-pty-tests - pass: 4,
* ltp-sched-tests - pass: 9, skip: 1
* ltp-securebits-tests - pass: 4,
* ltp-syscalls-tests - pass: 956, skip: 164
* ltp-timers-tests - pass: 12,
Documentation - https://collaborate.linaro.org/display/LKFT/Email+Reports
Tested-by: Naresh Kamboju <naresh.kamboju@linaro.org>
^ permalink raw reply [flat|nested] 124+ messages in thread