* [PATCH 3.16 001/136] hrtimer: Store cpu-number in struct hrtimer_cpu_base
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 002/136] tick: broadcast-hrtimer: Remove overly clever return value abuse Ben Hutchings
` (135 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Frederic Weisbecker, Thomas Gleixner, Viresh Kumar
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Viresh Kumar <viresh.kumar@linaro.org>
commit cddd02489f52ccf635ed65931214729a23b93cd6 upstream.
In lowres mode, hrtimers are serviced by the tick instead of a clock
event. Now it works well as long as the tick stays periodic but we
must also make sure that the hrtimers are serviced in dynticks mode.
Part of that job consist in kicking a dynticks hrtimer target in order
to make it reconsider the next tick to schedule to correctly handle the
hrtimer's expiring time. And that part isn't handled by the hrtimers
subsystem.
To prepare for fixing this, we need __hrtimer_start_range_ns() to be
able to resolve the CPU target associated to a hrtimer's object
'cpu_base' so that the kick can be centralized there.
So lets store it in the 'struct hrtimer_cpu_base' to resolve the CPU
without overhead. It is set once at CPU's online notification.
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Link: http://lkml.kernel.org/r/1403393357-2070-4-git-send-email-fweisbec@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 3.16 as dependency of commit b9023b91dd02
"tick: broadcast-hrtimer: Fix a race in bc_set_next":
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/hrtimer.h | 2 ++
kernel/hrtimer.c | 1 +
2 files changed, 3 insertions(+)
--- a/include/linux/hrtimer.h
+++ b/include/linux/hrtimer.h
@@ -165,6 +165,7 @@ enum hrtimer_base_type {
* struct hrtimer_cpu_base - the per cpu clock bases
* @lock: lock protecting the base and associated clock bases
* and timers
+ * @cpu: cpu number
* @active_bases: Bitfield to mark bases with active timers
* @clock_was_set: Indicates that clock was set from irq context.
* @expires_next: absolute time of the next event which was scheduled
@@ -179,6 +180,7 @@ enum hrtimer_base_type {
*/
struct hrtimer_cpu_base {
raw_spinlock_t lock;
+ unsigned int cpu;
unsigned int active_bases;
unsigned int clock_was_set;
#ifdef CONFIG_HIGH_RES_TIMERS
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1687,6 +1687,7 @@ static void init_hrtimers_cpu(int cpu)
}
cpu_base->active_bases = 0;
+ cpu_base->cpu = cpu;
hrtimer_init_hres(cpu_base);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 002/136] tick: broadcast-hrtimer: Remove overly clever return value abuse
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 001/136] hrtimer: Store cpu-number in struct hrtimer_cpu_base Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 003/136] tick: hrtimer-broadcast: Prevent endless restarting when broadcast device is unused Ben Hutchings
` (134 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Frederic Weisbecker, Viresh Kumar,
Thomas Gleixner, Peter Zijlstra, Preeti U Murthy,
Marcelo Tosatti
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit b8a62f1ff0ccb18fdc25c6150d1cd394610f4753 upstream.
The assignment of bc_moved in the conditional construct relies on the
fact that in the case of hrtimer_start() invocation the return value
is always 0. It took me a while to understand it.
We want to get rid of the hrtimer_start() return value. Open code the
logic which makes it readable as well.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Preeti U Murthy <preeti@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Viresh Kumar <viresh.kumar@linaro.org>
Cc: Marcelo Tosatti <mtosatti@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Link: http://lkml.kernel.org/r/20150414203503.404751457@linutronix.de
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 3.16 to ease backporting commit b9023b91dd02
"tick: broadcast-hrtimer: Fix a race in bc_set_next"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/time/tick-broadcast-hrtimer.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -66,9 +66,11 @@ static int bc_set_next(ktime_t expires,
* hrtimer_{start/cancel} functions call into tracing,
* calls to these functions must be bound within RCU_NONIDLE.
*/
- RCU_NONIDLE(bc_moved = (hrtimer_try_to_cancel(&bctimer) >= 0) ?
- !hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED) :
- 0);
+ RCU_NONIDLE({
+ bc_moved = hrtimer_try_to_cancel(&bctimer) >= 0;
+ if (bc_moved)
+ hrtimer_start(&bctimer, expires,
+ HRTIMER_MODE_ABS_PINNED);});
if (bc_moved) {
/* Bind the "device" to the cpu */
bc->bound_on = smp_processor_id();
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 003/136] tick: hrtimer-broadcast: Prevent endless restarting when broadcast device is unused
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 001/136] hrtimer: Store cpu-number in struct hrtimer_cpu_base Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 002/136] tick: broadcast-hrtimer: Remove overly clever return value abuse Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 004/136] tick: broadcast-hrtimer: Fix a race in bc_set_next Ben Hutchings
` (133 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Mark Rutland, Preeti U Murthy,
Andreas Sandberg, Catalin Marinas, Thomas Gleixner
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andreas Sandberg <andreas.sandberg@arm.com>
commit 38d23a6cc16c02f7b0c920266053f340b5601735 upstream.
The hrtimer callback in the hrtimer's tick broadcast code sometimes
incorrectly ends up scheduling events at the current tick causing the
kernel to hang servicing the same hrtimer forever. This typically
happens when a device is swapped out by
tick_install_broadcast_device(), which replaces the event handler with
clock_events_handle_noop() and sets the device mode to
CLOCK_EVT_MODE_UNUSED. If the timer is scheduled when this happens,
the next_event field will not be updated and the hrtimer ends up being
restarted at the current tick. To prevent this from happening, only
try to restart the hrtimer if the broadcast clock event device is in
one of the active modes and try to cancel the timer when entering the
CLOCK_EVT_MODE_UNUSED mode.
Signed-off-by: Andreas Sandberg <andreas.sandberg@arm.com>
Tested-by: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Preeti U Murthy <preeti@linux.vnet.ibm.com>
Link: http://lkml.kernel.org/r/1429880765-5558-1-git-send-email-andreas.sandberg@arm.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 3.16 as dependency of commit b9023b91dd02
"tick: broadcast-hrtimer: Fix a race in bc_set_next"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/time/tick-broadcast-hrtimer.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -22,6 +22,7 @@ static void bc_set_mode(enum clock_event
struct clock_event_device *bc)
{
switch (mode) {
+ case CLOCK_EVT_MODE_UNUSED:
case CLOCK_EVT_MODE_SHUTDOWN:
/*
* Note, we cannot cancel the timer here as we might
@@ -101,10 +102,13 @@ static enum hrtimer_restart bc_handler(s
{
ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer);
- if (ce_broadcast_hrtimer.next_event.tv64 == KTIME_MAX)
+ switch (ce_broadcast_hrtimer.mode) {
+ case CLOCK_EVT_MODE_ONESHOT:
+ if (ce_broadcast_hrtimer.next_event.tv64 != KTIME_MAX)
+ return HRTIMER_RESTART;
+ default:
return HRTIMER_NORESTART;
-
- return HRTIMER_RESTART;
+ }
}
void tick_setup_hrtimer_broadcast(void)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 004/136] tick: broadcast-hrtimer: Fix a race in bc_set_next
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (2 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 003/136] tick: hrtimer-broadcast: Prevent endless restarting when broadcast device is unused Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 005/136] sch_cbq: validate TCA_CBQ_WRROPT to avoid crash Ben Hutchings
` (132 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Thomas Gleixner, Balasubramani Vivekanandan
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Balasubramani Vivekanandan <balasubramani_vivekanandan@mentor.com>
commit b9023b91dd020ad7e093baa5122b6968c48cc9e0 upstream.
When a cpu requests broadcasting, before starting the tick broadcast
hrtimer, bc_set_next() checks if the timer callback (bc_handler) is active
using hrtimer_try_to_cancel(). But hrtimer_try_to_cancel() does not provide
the required synchronization when the callback is active on other core.
The callback could have already executed tick_handle_oneshot_broadcast()
and could have also returned. But still there is a small time window where
the hrtimer_try_to_cancel() returns -1. In that case bc_set_next() returns
without doing anything, but the next_event of the tick broadcast clock
device is already set to a timeout value.
In the race condition diagram below, CPU #1 is running the timer callback
and CPU #2 is entering idle state and so calls bc_set_next().
In the worst case, the next_event will contain an expiry time, but the
hrtimer will not be started which happens when the racing callback returns
HRTIMER_NORESTART. The hrtimer might never recover if all further requests
from the CPUs to subscribe to tick broadcast have timeout greater than the
next_event of tick broadcast clock device. This leads to cascading of
failures and finally noticed as rcu stall warnings
Here is a depiction of the race condition
CPU #1 (Running timer callback) CPU #2 (Enter idle
and subscribe to
tick broadcast)
--------------------- ---------------------
__run_hrtimer() tick_broadcast_enter()
bc_handler() __tick_broadcast_oneshot_control()
tick_handle_oneshot_broadcast()
raw_spin_lock(&tick_broadcast_lock);
dev->next_event = KTIME_MAX; //wait for tick_broadcast_lock
//next_event for tick broadcast clock
set to KTIME_MAX since no other cores
subscribed to tick broadcasting
raw_spin_unlock(&tick_broadcast_lock);
if (dev->next_event == KTIME_MAX)
return HRTIMER_NORESTART
// callback function exits without
restarting the hrtimer //tick_broadcast_lock acquired
raw_spin_lock(&tick_broadcast_lock);
tick_broadcast_set_event()
clockevents_program_event()
dev->next_event = expires;
bc_set_next()
hrtimer_try_to_cancel()
//returns -1 since the timer
callback is active. Exits without
restarting the timer
cpu_base->running = NULL;
The comment that hrtimer cannot be armed from within the callback is
wrong. It is fine to start the hrtimer from within the callback. Also it is
safe to start the hrtimer from the enter/exit idle code while the broadcast
handler is active. The enter/exit idle code and the broadcast handler are
synchronized using tick_broadcast_lock. So there is no need for the
existing try to cancel logic. All this can be removed which will eliminate
the race condition as well.
Fixes: 5d1638acb9f6 ("tick: Introduce hrtimer based broadcast")
Originally-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Balasubramani Vivekanandan <balasubramani_vivekanandan@mentor.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20190926135101.12102-2-balasubramani_vivekanandan@mentor.com
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/kernel/time/tick-broadcast-hrtimer.c
+++ b/kernel/time/tick-broadcast-hrtimer.c
@@ -50,34 +50,39 @@ static void bc_set_mode(enum clock_event
*/
static int bc_set_next(ktime_t expires, struct clock_event_device *bc)
{
- int bc_moved;
/*
- * We try to cancel the timer first. If the callback is on
- * flight on some other cpu then we let it handle it. If we
- * were able to cancel the timer nothing can rearm it as we
- * own broadcast_lock.
+ * This is called either from enter/exit idle code or from the
+ * broadcast handler. In all cases tick_broadcast_lock is held.
*
- * However we can also be called from the event handler of
- * ce_broadcast_hrtimer itself when it expires. We cannot
- * restart the timer because we are in the callback, but we
- * can set the expiry time and let the callback return
- * HRTIMER_RESTART.
+ * hrtimer_cancel() cannot be called here neither from the
+ * broadcast handler nor from the enter/exit idle code. The idle
+ * code can run into the problem described in bc_shutdown() and the
+ * broadcast handler cannot wait for itself to complete for obvious
+ * reasons.
*
- * Since we are in the idle loop at this point and because
- * hrtimer_{start/cancel} functions call into tracing,
- * calls to these functions must be bound within RCU_NONIDLE.
+ * Each caller tries to arm the hrtimer on its own CPU, but if the
+ * hrtimer callbback function is currently running, then
+ * hrtimer_start() cannot move it and the timer stays on the CPU on
+ * which it is assigned at the moment.
+ *
+ * As this can be called from idle code, the hrtimer_start()
+ * invocation has to be wrapped with RCU_NONIDLE() as
+ * hrtimer_start() can call into tracing.
*/
- RCU_NONIDLE({
- bc_moved = hrtimer_try_to_cancel(&bctimer) >= 0;
- if (bc_moved)
- hrtimer_start(&bctimer, expires,
- HRTIMER_MODE_ABS_PINNED);});
- if (bc_moved) {
- /* Bind the "device" to the cpu */
- bc->bound_on = smp_processor_id();
- } else if (bc->bound_on == smp_processor_id()) {
- hrtimer_set_expires(&bctimer, expires);
- }
+ RCU_NONIDLE( {
+ hrtimer_start(&bctimer, expires, HRTIMER_MODE_ABS_PINNED);
+ /*
+ * The core tick broadcast mode expects bc->bound_on to be set
+ * correctly to prevent a CPU which has the broadcast hrtimer
+ * armed from going deep idle.
+ *
+ * As tick_broadcast_lock is held, nothing can change the cpu
+ * base which was just established in hrtimer_start() above. So
+ * the below access is safe even without holding the hrtimer
+ * base lock.
+ */
+ bc->bound_on = bctimer.base->cpu_base->cpu;
+ } );
return 0;
}
@@ -102,13 +107,7 @@ static enum hrtimer_restart bc_handler(s
{
ce_broadcast_hrtimer.event_handler(&ce_broadcast_hrtimer);
- switch (ce_broadcast_hrtimer.mode) {
- case CLOCK_EVT_MODE_ONESHOT:
- if (ce_broadcast_hrtimer.next_event.tv64 != KTIME_MAX)
- return HRTIMER_RESTART;
- default:
- return HRTIMER_NORESTART;
- }
+ return HRTIMER_NORESTART;
}
void tick_setup_hrtimer_broadcast(void)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 005/136] sch_cbq: validate TCA_CBQ_WRROPT to avoid crash
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (3 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 004/136] tick: broadcast-hrtimer: Fix a race in bc_set_next Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 006/136] scsi: sd: Ignore a failure to sync cache due to lack of authorization Ben Hutchings
` (131 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Eric Dumazet, syzbot, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit e9789c7cc182484fc031fd88097eb14cb26c4596 upstream.
syzbot reported a crash in cbq_normalize_quanta() caused
by an out of range cl->priority.
iproute2 enforces this check, but malicious users do not.
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN PTI
Modules linked in:
CPU: 1 PID: 26447 Comm: syz-executor.1 Not tainted 5.3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:cbq_normalize_quanta.part.0+0x1fd/0x430 net/sched/sch_cbq.c:902
RSP: 0018:ffff8801a5c333b0 EFLAGS: 00010206
RAX: 0000000020000003 RBX: 00000000fffffff8 RCX: ffffc9000712f000
RDX: 00000000000043bf RSI: ffffffff83be8962 RDI: 0000000100000018
RBP: ffff8801a5c33420 R08: 000000000000003a R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 00000000000002ef
R13: ffff88018da95188 R14: dffffc0000000000 R15: 0000000000000015
FS: 00007f37d26b1700(0000) GS:ffff8801dad00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000004c7cec CR3: 00000001bcd0a006 CR4: 00000000001626f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
[<ffffffff83be9d57>] cbq_normalize_quanta include/net/pkt_sched.h:27 [inline]
[<ffffffff83be9d57>] cbq_addprio net/sched/sch_cbq.c:1097 [inline]
[<ffffffff83be9d57>] cbq_set_wrr+0x2d7/0x450 net/sched/sch_cbq.c:1115
[<ffffffff83bee8a7>] cbq_change_class+0x987/0x225b net/sched/sch_cbq.c:1537
[<ffffffff83b96985>] tc_ctl_tclass+0x555/0xcd0 net/sched/sch_api.c:2329
[<ffffffff83a84655>] rtnetlink_rcv_msg+0x485/0xc10 net/core/rtnetlink.c:5248
[<ffffffff83cadf0a>] netlink_rcv_skb+0x17a/0x460 net/netlink/af_netlink.c:2510
[<ffffffff83a7db6d>] rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5266
[<ffffffff83cac2c6>] netlink_unicast_kernel net/netlink/af_netlink.c:1324 [inline]
[<ffffffff83cac2c6>] netlink_unicast+0x536/0x720 net/netlink/af_netlink.c:1350
[<ffffffff83cacd4a>] netlink_sendmsg+0x89a/0xd50 net/netlink/af_netlink.c:1939
[<ffffffff8399d46e>] sock_sendmsg_nosec net/socket.c:673 [inline]
[<ffffffff8399d46e>] sock_sendmsg+0x12e/0x170 net/socket.c:684
[<ffffffff8399f1fd>] ___sys_sendmsg+0x81d/0x960 net/socket.c:2359
[<ffffffff839a2d05>] __sys_sendmsg+0x105/0x1d0 net/socket.c:2397
[<ffffffff839a2df9>] SYSC_sendmsg net/socket.c:2406 [inline]
[<ffffffff839a2df9>] SyS_sendmsg+0x29/0x30 net/socket.c:2404
[<ffffffff8101ccc8>] do_syscall_64+0x528/0x770 arch/x86/entry/common.c:305
[<ffffffff84400091>] entry_SYSCALL_64_after_hwframe+0x42/0xb7
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
- netlink doesn't support error messages
- Keep calling nla_parse_nested()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_cbq.c | 43 +++++++++++++++++++++++++++++--------------
1 file changed, 29 insertions(+), 14 deletions(-)
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1357,6 +1357,27 @@ static const struct nla_policy cbq_polic
[TCA_CBQ_POLICE] = { .len = sizeof(struct tc_cbq_police) },
};
+static int cbq_opt_parse(struct nlattr *tb[TCA_CBQ_MAX + 1],
+ struct nlattr *opt)
+{
+ int err;
+
+ if (!opt)
+ return -EINVAL;
+
+ err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy);
+ if (err < 0)
+ return err;
+
+ if (tb[TCA_CBQ_WRROPT]) {
+ const struct tc_cbq_wrropt *wrr = nla_data(tb[TCA_CBQ_WRROPT]);
+
+ if (wrr->priority > TC_CBQ_MAXPRIO)
+ err = -EINVAL;
+ }
+ return err;
+}
+
static int cbq_init(struct Qdisc *sch, struct nlattr *opt)
{
struct cbq_sched_data *q = qdisc_priv(sch);
@@ -1368,10 +1389,7 @@ static int cbq_init(struct Qdisc *sch, s
hrtimer_init(&q->delay_timer, CLOCK_MONOTONIC, HRTIMER_MODE_ABS_PINNED);
q->delay_timer.function = cbq_undelay;
- if (!opt)
- return -EINVAL;
-
- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy);
+ err = cbq_opt_parse(tb, opt);
if (err < 0)
return err;
@@ -1751,10 +1769,7 @@ cbq_change_class(struct Qdisc *sch, u32
struct cbq_class *parent;
struct qdisc_rate_table *rtab = NULL;
- if (opt == NULL)
- return -EINVAL;
-
- err = nla_parse_nested(tb, TCA_CBQ_MAX, opt, cbq_policy);
+ err = cbq_opt_parse(tb, opt);
if (err < 0)
return err;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 006/136] scsi: sd: Ignore a failure to sync cache due to lack of authorization
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (4 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 005/136] sch_cbq: validate TCA_CBQ_WRROPT to avoid crash Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 007/136] staging: rtl8188eu: fix HighestRate check in odm_ARFBRefresh_8188E() Ben Hutchings
` (130 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Oliver Neukum, Martin K. Petersen
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
commit 21e3d6c81179bbdfa279efc8de456c34b814cfd2 upstream.
I've got a report about a UAS drive enclosure reporting back Sense: Logical
unit access not authorized if the drive it holds is password protected.
While the drive is obviously unusable in that state as a mass storage
device, it still exists as a sd device and when the system is asked to
perform a suspend of the drive, it will be sent a SYNCHRONIZE CACHE. If
that fails due to password protection, the error must be ignored.
Link: https://lore.kernel.org/r/20190903101840.16483-1-oneukum@suse.com
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[bwh: Backported to 3.16: sshdr is a struct not a pointer here]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/sd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -1470,7 +1470,8 @@ static int sd_sync_cache(struct scsi_dis
/* we need to evaluate the error return */
if (scsi_sense_valid(&sshdr) &&
(sshdr.asc == 0x3a || /* medium not present */
- sshdr.asc == 0x20)) /* invalid command */
+ sshdr.asc == 0x20 || /* invalid command */
+ (sshdr.asc == 0x74 && sshdr.ascq == 0x71))) /* drive is password locked */
/* this is no error here */
return 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 007/136] staging: rtl8188eu: fix HighestRate check in odm_ARFBRefresh_8188E()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (5 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 006/136] scsi: sd: Ignore a failure to sync cache due to lack of authorization Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 008/136] HID: fix error message in hid_open_report() Ben Hutchings
` (129 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Larry Finger, Greg Kroah-Hartman,
Denis Efremov, Michael Straube
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Denis Efremov <efremov@linux.com>
commit 22d67a01d8d89552b989c9651419824bb4111200 upstream.
It's incorrect to compare HighestRate with 0x0b twice in the following
manner "if (HighestRate > 0x0b) ... else if (HighestRate > 0x0b) ...". The
"else if" branch is constantly false. The second comparision should be
with 0x03 according to the max_rate_idx in ODM_RAInfo_Init().
Cc: Michael Straube <straube.linux@gmail.com>
Signed-off-by: Denis Efremov <efremov@linux.com>
Acked-by: Larry Finger <Larry.Finger@lwfinger.net>
Link: https://lore.kernel.org/r/20190926073138.12109-1-efremov@linux.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filename, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c
+++ b/drivers/staging/rtl8188eu/hal/Hal8188ERateAdaptive.c
@@ -403,7 +403,7 @@ static int odm_ARFBRefresh_8188E(struct
pRaInfo->PTModeSS = 3;
else if (pRaInfo->HighestRate > 0x0b)
pRaInfo->PTModeSS = 2;
- else if (pRaInfo->HighestRate > 0x0b)
+ else if (pRaInfo->HighestRate > 0x03)
pRaInfo->PTModeSS = 1;
else
pRaInfo->PTModeSS = 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 008/136] HID: fix error message in hid_open_report()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (6 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 007/136] staging: rtl8188eu: fix HighestRate check in odm_ARFBRefresh_8188E() Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 009/136] RDMA/iwcm: Fix a lock inversion issue Ben Hutchings
` (128 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jiri Kosina, Michał Mirosław
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
commit b3a81c777dcb093020680490ab970d85e2f6f04f upstream.
On HID report descriptor parsing error the code displays bogus
pointer instead of error offset (subtracts start=NULL from end).
Make the message more useful by displaying correct error offset
and include total buffer size for reference.
This was carried over from ancient times - "Fixed" commit just
promoted the message from DEBUG to ERROR.
Fixes: 8c3d52fc393b ("HID: make parser more verbose about parsing errors by default")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/hid/hid-core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -911,6 +911,7 @@ int hid_open_report(struct hid_device *d
__u8 *start;
__u8 *buf;
__u8 *end;
+ __u8 *next;
int ret;
static int (*dispatch_type[])(struct hid_parser *parser,
struct hid_item *item) = {
@@ -964,7 +965,8 @@ int hid_open_report(struct hid_device *d
device->collection_size = HID_DEFAULT_NUM_COLLECTIONS;
ret = -EINVAL;
- while ((start = fetch_item(start, end, &item)) != NULL) {
+ while ((next = fetch_item(start, end, &item)) != NULL) {
+ start = next;
if (item.format != HID_ITEM_FORMAT_SHORT) {
hid_err(device, "unexpected long global item\n");
@@ -993,7 +995,8 @@ int hid_open_report(struct hid_device *d
}
}
- hid_err(device, "item fetching failed at offset %d\n", (int)(end - start));
+ hid_err(device, "item fetching failed at offset %u/%u\n",
+ size - (unsigned int)(end - start), size);
err:
vfree(parser);
hid_close_report(device);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 009/136] RDMA/iwcm: Fix a lock inversion issue
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (7 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 008/136] HID: fix error message in hid_open_report() Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 010/136] net: stmmac: Correctly take timestamp for PTPv2 Ben Hutchings
` (127 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Bart Van Assche, Jason Gunthorpe
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit b66f31efbdad95ec274345721d99d1d835e6de01 upstream.
This patch fixes the lock inversion complaint:
============================================
WARNING: possible recursive locking detected
5.3.0-rc7-dbg+ #1 Not tainted
--------------------------------------------
kworker/u16:6/171 is trying to acquire lock:
00000000035c6e6c (&id_priv->handler_mutex){+.+.}, at: rdma_destroy_id+0x78/0x4a0 [rdma_cm]
but task is already holding lock:
00000000bc7c307d (&id_priv->handler_mutex){+.+.}, at: iw_conn_req_handler+0x151/0x680 [rdma_cm]
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&id_priv->handler_mutex);
lock(&id_priv->handler_mutex);
*** DEADLOCK ***
May be due to missing lock nesting notation
3 locks held by kworker/u16:6/171:
#0: 00000000e2eaa773 ((wq_completion)iw_cm_wq){+.+.}, at: process_one_work+0x472/0xac0
#1: 000000001efd357b ((work_completion)(&work->work)#3){+.+.}, at: process_one_work+0x476/0xac0
#2: 00000000bc7c307d (&id_priv->handler_mutex){+.+.}, at: iw_conn_req_handler+0x151/0x680 [rdma_cm]
stack backtrace:
CPU: 3 PID: 171 Comm: kworker/u16:6 Not tainted 5.3.0-rc7-dbg+ #1
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
Workqueue: iw_cm_wq cm_work_handler [iw_cm]
Call Trace:
dump_stack+0x8a/0xd6
__lock_acquire.cold+0xe1/0x24d
lock_acquire+0x106/0x240
__mutex_lock+0x12e/0xcb0
mutex_lock_nested+0x1f/0x30
rdma_destroy_id+0x78/0x4a0 [rdma_cm]
iw_conn_req_handler+0x5c9/0x680 [rdma_cm]
cm_work_handler+0xe62/0x1100 [iw_cm]
process_one_work+0x56d/0xac0
worker_thread+0x7a/0x5d0
kthread+0x1bc/0x210
ret_from_fork+0x24/0x30
This is not a bug as there are actually two lock classes here.
Link: https://lore.kernel.org/r/20190930231707.48259-3-bvanassche@acm.org
Fixes: de910bd92137 ("RDMA/cma: Simplify locking needed for serialization of callbacks")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/infiniband/core/cma.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -1549,9 +1549,10 @@ static int iw_conn_req_handler(struct iw
conn_id->cm_id.iw = NULL;
cma_exch(conn_id, RDMA_CM_DESTROYING);
mutex_unlock(&conn_id->handler_mutex);
+ mutex_unlock(&listen_id->handler_mutex);
cma_deref_id(conn_id);
rdma_destroy_id(&conn_id->id);
- goto out;
+ return ret;
}
mutex_unlock(&conn_id->handler_mutex);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 010/136] net: stmmac: Correctly take timestamp for PTPv2
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (8 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 009/136] RDMA/iwcm: Fix a lock inversion issue Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 011/136] hso: fix NULL-deref on tty open Ben Hutchings
` (126 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Jose Abreu, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jose Abreu <Jose.Abreu@synopsys.com>
commit 14f347334bf232074616e29e29103dd0c7c54dec upstream.
The case for PTPV2_EVENT requires event packets to be captured so add
this setting to the list of enabled captures.
Fixes: 891434b18ec0 ("stmmac: add IEEE PTPv1 and PTPv2 support.")
Signed-off-by: Jose Abreu <Jose.Abreu@synopsys.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -539,6 +539,7 @@ static int stmmac_hwtstamp_ioctl(struct
ptp_v2 = PTP_TCR_TSVER2ENA;
/* take time stamp for all event messages */
snap_type_sel = PTP_TCR_SNAPTYPSEL_1;
+ ts_event_en = PTP_TCR_TSEVNTENA;
ptp_over_ipv4_udp = PTP_TCR_TSIPV4ENA;
ptp_over_ipv6_udp = PTP_TCR_TSIPV6ENA;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 011/136] hso: fix NULL-deref on tty open
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (9 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 010/136] net: stmmac: Correctly take timestamp for PTPv2 Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 012/136] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Ben Hutchings
` (125 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, David S. Miller, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 8353da9fa69722b54cba82b2ec740afd3d438748 upstream.
Fix NULL-pointer dereference on tty open due to a failure to handle a
missing interrupt-in endpoint when probing modem ports:
BUG: kernel NULL pointer dereference, address: 0000000000000006
...
RIP: 0010:tiocmget_submit_urb+0x1c/0xe0 [hso]
...
Call Trace:
hso_start_serial_device+0xdc/0x140 [hso]
hso_serial_open+0x118/0x1b0 [hso]
tty_open+0xf1/0x490
Fixes: 542f54823614 ("tty: Modem functions for the HSO driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/usb/hso.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2637,14 +2637,18 @@ static struct hso_device *hso_create_bul
*/
if (serial->tiocmget) {
tiocmget = serial->tiocmget;
+ tiocmget->endp = hso_get_ep(interface,
+ USB_ENDPOINT_XFER_INT,
+ USB_DIR_IN);
+ if (!tiocmget->endp) {
+ dev_err(&interface->dev, "Failed to find INT IN ep\n");
+ goto exit;
+ }
+
tiocmget->urb = usb_alloc_urb(0, GFP_KERNEL);
if (tiocmget->urb) {
mutex_init(&tiocmget->mutex);
init_waitqueue_head(&tiocmget->waitq);
- tiocmget->endp = hso_get_ep(
- interface,
- USB_ENDPOINT_XFER_INT,
- USB_DIR_IN);
} else
hso_free_tiomget(serial);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 012/136] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (10 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 011/136] hso: fix NULL-deref on tty open Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 013/136] drm/omap: fix max fclk divider for omap36xx Ben Hutchings
` (124 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Beni Mahler, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Beni Mahler <beni.mahler@gmx.net>
commit 357f16d9e0194cdbc36531ff88b453481560b76a upstream.
Both devices added here have a FTDI chip inside. The device from Echelon
is called 'Network Interface' it is actually a LON network gateway.
ID 0403:8348 Future Technology Devices International, Ltd
https://www.eltako.com/fileadmin/downloads/de/datenblatt/Datenblatt_PL-SW-PROF.pdf
ID 0920:7500 Network Interface
https://www.echelon.com/products/u20-usb-network-interface
Signed-off-by: Beni Mahler <beni.mahler@gmx.net>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/ftdi_sio.c | 3 +++
drivers/usb/serial/ftdi_sio_ids.h | 9 +++++++++
2 files changed, 12 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1038,6 +1038,9 @@ static const struct usb_device_id id_tab
/* EZPrototypes devices */
{ USB_DEVICE(EZPROTOTYPES_VID, HJELMSLUND_USB485_ISO_PID) },
{ USB_DEVICE_INTERFACE_NUMBER(UNJO_VID, UNJO_ISODEBUG_V1_PID, 1) },
+ /* Sienna devices */
+ { USB_DEVICE(FTDI_VID, FTDI_SIENNA_PID) },
+ { USB_DEVICE(ECHELON_VID, ECHELON_U20_PID) },
{ } /* Terminating entry */
};
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,9 @@
#define FTDI_LUMEL_PD12_PID 0x6002
+/* Sienna Serial Interface by Secyourit GmbH */
+#define FTDI_SIENNA_PID 0x8348
+
/* Cyber Cortex AV by Fabulous Silicon (http://fabuloussilicon.com) */
#define CYBER_CORTEX_AV_PID 0x8698
@@ -688,6 +691,12 @@
#define BANDB_ZZ_PROG1_USB_PID 0xBA02
/*
+ * Echelon USB Serial Interface
+ */
+#define ECHELON_VID 0x0920
+#define ECHELON_U20_PID 0x7500
+
+/*
* Intrepid Control Systems (http://www.intrepidcs.com/) ValueCAN and NeoVI
*/
#define INTREPID_VID 0x093C
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 013/136] drm/omap: fix max fclk divider for omap36xx
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (11 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 012/136] USB: serial: ftdi_sio: add device IDs for Sienna and Echelon PL-20 Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-23 14:00 ` Adam Ford
2019-12-17 0:45 ` [PATCH 3.16 014/136] ipv6: drop incoming packets having a v4mapped source address Ben Hutchings
` (123 subsequent siblings)
136 siblings, 1 reply; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jyri Sarha, Tomi Valkeinen, Adam Ford
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ti.com>
commit e2c4ed148cf3ec8669a1d90dc66966028e5fad70 upstream.
The OMAP36xx and AM/DM37x TRMs say that the maximum divider for DSS fclk
(in CM_CLKSEL_DSS) is 32. Experimentation shows that this is not
correct, and using divider of 32 breaks DSS with a flood or underflows
and sync losts. Dividers up to 31 seem to work fine.
There is another patch to the DT files to limit the divider correctly,
but as the DSS driver also needs to know the maximum divider to be able
to iteratively find good rates, we also need to do the fix in the DSS
driver.
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
Cc: Adam Ford <aford173@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20191002122542.8449-1-tomi.valkeinen@ti.com
Tested-by: Adam Ford <aford173@gmail.com>
Reviewed-by: Jyri Sarha <jsarha@ti.com>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/video/fbdev/omap2/dss/dss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/fbdev/omap2/dss/dss.c
+++ b/drivers/video/fbdev/omap2/dss/dss.c
@@ -708,7 +708,7 @@ static const struct dss_features omap34x
};
static const struct dss_features omap3630_dss_feats __initconst = {
- .fck_div_max = 32,
+ .fck_div_max = 31,
.dss_fck_multiplier = 1,
.parent_clk_name = "dpll4_ck",
.dpi_select_source = &dss_dpi_select_source_omap2_omap3,
^ permalink raw reply [flat|nested] 140+ messages in thread* Re: [PATCH 3.16 013/136] drm/omap: fix max fclk divider for omap36xx
2019-12-17 0:45 ` [PATCH 3.16 013/136] drm/omap: fix max fclk divider for omap36xx Ben Hutchings
@ 2019-12-23 14:00 ` Adam Ford
0 siblings, 0 replies; 140+ messages in thread
From: Adam Ford @ 2019-12-23 14:00 UTC (permalink / raw)
To: Ben Hutchings
Cc: Linux Kernel Mailing List, stable, Andrew Morton, Denis Kirjanov,
Jyri Sarha, Tomi Valkeinen
On Mon, Dec 16, 2019 at 6:51 PM Ben Hutchings <ben@decadent.org.uk> wrote:
>
> 3.16.80-rc1 review patch. If anyone has any objections, please let me know.
>
> ------------------
I tried to do the same for 4.4, 4.9 and 4.14, but I haven't seen
anything applied yet.
I just looked at the upstream fbdev driver for the dss, and it's still
showing 32 and the value.
Even though the fbdev driver isn't enabled by default any more, I
wonder if it should be fixed as part of the justification for the
backports.
adam
>
> From: Tomi Valkeinen <tomi.valkeinen@ti.com>
>
> commit e2c4ed148cf3ec8669a1d90dc66966028e5fad70 upstream.
>
> The OMAP36xx and AM/DM37x TRMs say that the maximum divider for DSS fclk
> (in CM_CLKSEL_DSS) is 32. Experimentation shows that this is not
> correct, and using divider of 32 breaks DSS with a flood or underflows
> and sync losts. Dividers up to 31 seem to work fine.
>
> There is another patch to the DT files to limit the divider correctly,
> but as the DSS driver also needs to know the maximum divider to be able
> to iteratively find good rates, we also need to do the fix in the DSS
> driver.
>
> Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
> Cc: Adam Ford <aford173@gmail.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20191002122542.8449-1-tomi.valkeinen@ti.com
> Tested-by: Adam Ford <aford173@gmail.com>
> Reviewed-by: Jyri Sarha <jsarha@ti.com>
> [bwh: Backported to 3.16: adjust filename, context]
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
> ---
> drivers/video/fbdev/omap2/dss/dss.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/drivers/video/fbdev/omap2/dss/dss.c
> +++ b/drivers/video/fbdev/omap2/dss/dss.c
> @@ -708,7 +708,7 @@ static const struct dss_features omap34x
> };
>
> static const struct dss_features omap3630_dss_feats __initconst = {
> - .fck_div_max = 32,
> + .fck_div_max = 31,
> .dss_fck_multiplier = 1,
> .parent_clk_name = "dpll4_ck",
> .dpi_select_source = &dss_dpi_select_source_omap2_omap3,
>
^ permalink raw reply [flat|nested] 140+ messages in thread
* [PATCH 3.16 014/136] ipv6: drop incoming packets having a v4mapped source address
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (12 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 013/136] drm/omap: fix max fclk divider for omap36xx Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 015/136] scsi: zfcp: fix reaction on bit error threshold notification Ben Hutchings
` (122 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Hannes Frederic Sowa, syzbot, Eric Dumazet,
Florian Westphal, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 6af1799aaf3f1bc8defedddfa00df3192445bbf3 upstream.
This began with a syzbot report. syzkaller was injecting
IPv6 TCP SYN packets having a v4mapped source address.
After an unsuccessful 4-tuple lookup, TCP creates a request
socket (SYN_RECV) and calls reqsk_queue_hash_req()
reqsk_queue_hash_req() calls sk_ehashfn(sk)
At this point we have AF_INET6 sockets, and the heuristic
used by sk_ehashfn() to either hash the IPv4 or IPv6 addresses
is to use ipv6_addr_v4mapped(&sk->sk_v6_daddr)
For the particular spoofed packet, we end up hashing V4 addresses
which were not initialized by the TCP IPv6 stack, so KMSAN fired
a warning.
I first fixed sk_ehashfn() to test both source and destination addresses,
but then faced various problems, including user-space programs
like packetdrill that had similar assumptions.
Instead of trying to fix the whole ecosystem, it is better
to admit that we have a dual stack behavior, and that we
can not build linux kernels without V4 stack anyway.
The dual stack API automatically forces the traffic to be IPv4
if v4mapped addresses are used at bind() or connect(), so it makes
no sense to allow IPv6 traffic to use the same v4mapped class.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv6/ip6_input.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -151,6 +151,16 @@ int ipv6_rcv(struct sk_buff *skb, struct
if (ipv6_addr_is_multicast(&hdr->saddr))
goto err;
+ /* While RFC4291 is not explicit about v4mapped addresses
+ * in IPv6 headers, it seems clear linux dual-stack
+ * model can not deal properly with these.
+ * Security models could be fooled by ::ffff:127.0.0.1 for example.
+ *
+ * https://tools.ietf.org/html/draft-itojun-v6ops-v4mapped-harmful-02
+ */
+ if (ipv6_addr_v4mapped(&hdr->saddr))
+ goto err;
+
skb->transport_header = skb->network_header + sizeof(*hdr);
IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 015/136] scsi: zfcp: fix reaction on bit error threshold notification
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (13 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 014/136] ipv6: drop incoming packets having a v4mapped source address Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 016/136] USB: rio500: Remove Rio 500 kernel driver Ben Hutchings
` (121 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Benjamin Block, Martin K. Petersen,
Jens Remus, Steffen Maier
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Maier <maier@linux.ibm.com>
commit 2190168aaea42c31bff7b9a967e7b045f07df095 upstream.
On excessive bit errors for the FCP channel ingress fibre path, the channel
notifies us. Previously, we only emitted a kernel message and a trace
record. Since performance can become suboptimal with I/O timeouts due to
bit errors, we now stop using an FCP device by default on channel
notification so multipath on top can timely failover to other paths. A new
module parameter zfcp.ber_stop can be used to get zfcp old behavior.
User explanation of new kernel message:
* Description:
* The FCP channel reported that its bit error threshold has been exceeded.
* These errors might result from a problem with the physical components
* of the local fibre link into the FCP channel.
* The problem might be damage or malfunction of the cable or
* cable connection between the FCP channel and
* the adjacent fabric switch port or the point-to-point peer.
* Find details about the errors in the HBA trace for the FCP device.
* The zfcp device driver closed down the FCP device
* to limit the performance impact from possible I/O command timeouts.
* User action:
* Check for problems on the local fibre link, ensure that fibre optics are
* clean and functional, and all cables are properly plugged.
* After the repair action, you can manually recover the FCP device by
* writing "0" into its "failed" sysfs attribute.
* If recovery through sysfs is not possible, set the CHPID of the device
* offline and back online on the service element.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/r/20191001104949.42810-1-maier@linux.ibm.com
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Reviewed-by: Benjamin Block <bblock@linux.ibm.com>
Signed-off-by: Steffen Maier <maier@linux.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/s390/scsi/zfcp_fsf.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -20,6 +20,11 @@
struct kmem_cache *zfcp_fsf_qtcb_cache;
+static bool ber_stop = true;
+module_param(ber_stop, bool, 0600);
+MODULE_PARM_DESC(ber_stop,
+ "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)");
+
static void zfcp_fsf_request_timeout_handler(unsigned long data)
{
struct zfcp_adapter *adapter = (struct zfcp_adapter *) data;
@@ -231,10 +236,15 @@ static void zfcp_fsf_status_read_handler
case FSF_STATUS_READ_SENSE_DATA_AVAIL:
break;
case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
- dev_warn(&adapter->ccw_device->dev,
- "The error threshold for checksum statistics "
- "has been exceeded\n");
zfcp_dbf_hba_bit_err("fssrh_3", req);
+ if (ber_stop) {
+ dev_warn(&adapter->ccw_device->dev,
+ "All paths over this FCP device are disused because of excessive bit errors\n");
+ zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b");
+ } else {
+ dev_warn(&adapter->ccw_device->dev,
+ "The error threshold for checksum statistics has been exceeded\n");
+ }
break;
case FSF_STATUS_READ_LINK_DOWN:
zfcp_fsf_status_read_link_down(req);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 016/136] USB: rio500: Remove Rio 500 kernel driver
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (14 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 015/136] scsi: zfcp: fix reaction on bit error threshold notification Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 017/136] USB: serial: keyspan: fix NULL-derefs on open() and write() Ben Hutchings
` (120 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Bastien Nocera, Cesar Miquel
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Bastien Nocera <hadess@hadess.net>
commit 015664d15270a112c2371d812f03f7c579b35a73 upstream.
The Rio500 kernel driver has not been used by Rio500 owners since 2001
not long after the rio500 project added support for a user-space USB stack
through the very first versions of usbdevfs and then libusb.
Support for the kernel driver was removed from the upstream utilities
in 2008:
https://gitlab.freedesktop.org/hadess/rio500/commit/943f624ab721eb8281c287650fcc9e2026f6f5db
Cc: Cesar Miquel <miquel@df.uba.ar>
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Link: https://lore.kernel.org/r/6251c17584d220472ce882a3d9c199c401a51a71.camel@hadess.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16:
- Also delete CONFIG_USB_RIO500 from arch/powerpc/configs/c2k_defconfig
- Drop change to arch/arm/configs/pxa_defconfig
- Adjust filename, content]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/Documentation/usb/rio.txt
+++ /dev/null
@@ -1,138 +0,0 @@
-Copyright (C) 1999, 2000 Bruce Tenison
-Portions Copyright (C) 1999, 2000 David Nelson
-Thanks to David Nelson for guidance and the usage of the scanner.txt
-and scanner.c files to model our driver and this informative file.
-
-Mar. 2, 2000
-
-CHANGES
-
-- Initial Revision
-
-
-OVERVIEW
-
-This README will address issues regarding how to configure the kernel
-to access a RIO 500 mp3 player.
-Before I explain how to use this to access the Rio500 please be warned:
-
-W A R N I N G:
---------------
-
-Please note that this software is still under development. The authors
-are in no way responsible for any damage that may occur, no matter how
-inconsequential.
-
-It seems that the Rio has a problem when sending .mp3 with low batteries.
-I suggest when the batteries are low and you want to transfer stuff that you
-replace it with a fresh one. In my case, what happened is I lost two 16kb
-blocks (they are no longer usable to store information to it). But I don't
-know if that's normal or not; it could simply be a problem with the flash
-memory.
-
-In an extreme case, I left my Rio playing overnight and the batteries wore
-down to nothing and appear to have corrupted the flash memory. My RIO
-needed to be replaced as a result. Diamond tech support is aware of the
-problem. Do NOT allow your batteries to wear down to nothing before
-changing them. It appears RIO 500 firmware does not handle low battery
-power well at all.
-
-On systems with OHCI controllers, the kernel OHCI code appears to have
-power on problems with some chipsets. If you are having problems
-connecting to your RIO 500, try turning it on first and then plugging it
-into the USB cable.
-
-Contact information:
---------------------
-
- The main page for the project is hosted at sourceforge.net in the following
- URL: <http://rio500.sourceforge.net>. You can also go to the project's
- sourceforge home page at: <http://sourceforge.net/projects/rio500/>.
- There is also a mailing list: rio500-users@lists.sourceforge.net
-
-Authors:
--------
-
-Most of the code was written by Cesar Miquel <miquel@df.uba.ar>. Keith
-Clayton <kclayton@jps.net> is incharge of the PPC port and making sure
-things work there. Bruce Tenison <btenison@dibbs.net> is adding support
-for .fon files and also does testing. The program will mostly sure be
-re-written and Pete Ikusz along with the rest will re-design it. I would
-also like to thank Tri Nguyen <tmn_3022000@hotmail.com> who provided use
-with some important information regarding the communication with the Rio.
-
-ADDITIONAL INFORMATION and Userspace tools
-
-http://rio500.sourceforge.net/
-
-
-REQUIREMENTS
-
-A host with a USB port. Ideally, either a UHCI (Intel) or OHCI
-(Compaq and others) hardware port should work.
-
-A Linux development kernel (2.3.x) with USB support enabled or a
-backported version to linux-2.2.x. See http://www.linux-usb.org for
-more information on accomplishing this.
-
-A Linux kernel with RIO 500 support enabled.
-
-'lspci' which is only needed to determine the type of USB hardware
-available in your machine.
-
-CONFIGURATION
-
-Using `lspci -v`, determine the type of USB hardware available.
-
- If you see something like:
-
- USB Controller: ......
- Flags: .....
- I/O ports at ....
-
- Then you have a UHCI based controller.
-
- If you see something like:
-
- USB Controller: .....
- Flags: ....
- Memory at .....
-
- Then you have a OHCI based controller.
-
-Using `make menuconfig` or your preferred method for configuring the
-kernel, select 'Support for USB', 'OHCI/UHCI' depending on your
-hardware (determined from the steps above), 'USB Diamond Rio500 support', and
-'Preliminary USB device filesystem'. Compile and install the modules
-(you may need to execute `depmod -a` to update the module
-dependencies).
-
-Add a device for the USB rio500:
- `mknod /dev/usb/rio500 c 180 64`
-
-Set appropriate permissions for /dev/usb/rio500 (don't forget about
-group and world permissions). Both read and write permissions are
-required for proper operation.
-
-Load the appropriate modules (if compiled as modules):
-
- OHCI:
- modprobe usbcore
- modprobe usb-ohci
- modprobe rio500
-
- UHCI:
- modprobe usbcore
- modprobe usb-uhci (or uhci)
- modprobe rio500
-
-That's it. The Rio500 Utils at: http://rio500.sourceforge.net should
-be able to access the rio500.
-
-BUGS
-
-If you encounter any problems feel free to drop me an email.
-
-Bruce Tenison
-btenison@dibbs.net
-
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -9420,13 +9420,6 @@ W: http://www.linux-usb.org/usbnet
S: Maintained
F: drivers/net/usb/dm9601.c
-USB DIAMOND RIO500 DRIVER
-M: Cesar Miquel <miquel@df.uba.ar>
-L: rio500-users@lists.sourceforge.net
-W: http://rio500.sourceforge.net
-S: Maintained
-F: drivers/usb/misc/rio500*
-
USB EHCI DRIVER
M: Alan Stern <stern@rowland.harvard.edu>
L: linux-usb@vger.kernel.org
--- a/arch/arm/configs/badge4_defconfig
+++ b/arch/arm/configs/badge4_defconfig
@@ -98,7 +98,6 @@ CONFIG_USB_SERIAL_PL2303=m
CONFIG_USB_SERIAL_CYBERJACK=m
CONFIG_USB_SERIAL_XIRCOM=m
CONFIG_USB_SERIAL_OMNINET=m
-CONFIG_USB_RIO500=m
CONFIG_EXT2_FS=m
CONFIG_EXT3_FS=m
CONFIG_MSDOS_FS=y
--- a/arch/arm/configs/corgi_defconfig
+++ b/arch/arm/configs/corgi_defconfig
@@ -207,7 +207,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
CONFIG_USB_SERIAL_OMNINET=m
CONFIG_USB_EMI62=m
CONFIG_USB_EMI26=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/arch/arm/configs/s3c2410_defconfig
+++ b/arch/arm/configs/s3c2410_defconfig
@@ -355,7 +355,6 @@ CONFIG_USB_EMI62=m
CONFIG_USB_EMI26=m
CONFIG_USB_ADUTUX=m
CONFIG_USB_SEVSEG=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/arch/arm/configs/spitz_defconfig
+++ b/arch/arm/configs/spitz_defconfig
@@ -202,7 +202,6 @@ CONFIG_USB_SERIAL_XIRCOM=m
CONFIG_USB_SERIAL_OMNINET=m
CONFIG_USB_EMI62=m
CONFIG_USB_EMI26=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/arch/mips/configs/mtx1_defconfig
+++ b/arch/mips/configs/mtx1_defconfig
@@ -637,7 +637,6 @@ CONFIG_USB_SERIAL_OMNINET=m
CONFIG_USB_EMI62=m
CONFIG_USB_EMI26=m
CONFIG_USB_ADUTUX=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/arch/mips/configs/rm200_defconfig
+++ b/arch/mips/configs/rm200_defconfig
@@ -351,7 +351,6 @@ CONFIG_USB_SERIAL_SAFE_PADDED=y
CONFIG_USB_SERIAL_CYBERJACK=m
CONFIG_USB_SERIAL_XIRCOM=m
CONFIG_USB_SERIAL_OMNINET=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/arch/powerpc/configs/c2k_defconfig
+++ b/arch/powerpc/configs/c2k_defconfig
@@ -315,7 +315,6 @@ CONFIG_USB_SERIAL_CYBERJACK=m
CONFIG_USB_SERIAL_XIRCOM=m
CONFIG_USB_SERIAL_OMNINET=m
CONFIG_USB_EMI62=m
-CONFIG_USB_RIO500=m
CONFIG_USB_LEGOTOWER=m
CONFIG_USB_LCD=m
CONFIG_USB_LED=m
--- a/drivers/usb/misc/Kconfig
+++ b/drivers/usb/misc/Kconfig
@@ -46,16 +46,6 @@ config USB_SEVSEG
To compile this driver as a module, choose M here: the
module will be called usbsevseg.
-config USB_RIO500
- tristate "USB Diamond Rio500 support"
- help
- Say Y here if you want to connect a USB Rio500 mp3 player to your
- computer's USB port. Please read <file:Documentation/usb/rio.txt>
- for more information.
-
- To compile this driver as a module, choose M here: the
- module will be called rio500.
-
config USB_LEGOTOWER
tristate "USB Lego Infrared Tower support"
help
--- a/drivers/usb/misc/Makefile
+++ b/drivers/usb/misc/Makefile
@@ -17,7 +17,6 @@ obj-$(CONFIG_USB_LCD) += usblcd.o
obj-$(CONFIG_USB_LD) += ldusb.o
obj-$(CONFIG_USB_LED) += usbled.o
obj-$(CONFIG_USB_LEGOTOWER) += legousbtower.o
-obj-$(CONFIG_USB_RIO500) += rio500.o
obj-$(CONFIG_USB_TEST) += usbtest.o
obj-$(CONFIG_USB_EHSET_TEST_FIXTURE) += ehset.o
obj-$(CONFIG_USB_TRANCEVIBRATOR) += trancevibrator.o
--- a/drivers/usb/misc/rio500.c
+++ /dev/null
@@ -1,578 +0,0 @@
-/* -*- linux-c -*- */
-
-/*
- * Driver for USB Rio 500
- *
- * Cesar Miquel (miquel@df.uba.ar)
- *
- * based on hp_scanner.c by David E. Nelson (dnelson@jump.net)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License as
- * published by the Free Software Foundation; either version 2 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- * Based upon mouse.c (Brad Keryan) and printer.c (Michael Gee).
- *
- * Changelog:
- * 30/05/2003 replaced lock/unlock kernel with up/down
- * Daniele Bellucci bellucda@tiscali.it
- * */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/signal.h>
-#include <linux/sched.h>
-#include <linux/mutex.h>
-#include <linux/errno.h>
-#include <linux/random.h>
-#include <linux/poll.h>
-#include <linux/slab.h>
-#include <linux/spinlock.h>
-#include <linux/usb.h>
-#include <linux/wait.h>
-
-#include "rio500_usb.h"
-
-/*
- * Version Information
- */
-#define DRIVER_VERSION "v1.1"
-#define DRIVER_AUTHOR "Cesar Miquel <miquel@df.uba.ar>"
-#define DRIVER_DESC "USB Rio 500 driver"
-
-#define RIO_MINOR 64
-
-/* stall/wait timeout for rio */
-#define NAK_TIMEOUT (HZ)
-
-#define IBUF_SIZE 0x1000
-
-/* Size of the rio buffer */
-#define OBUF_SIZE 0x10000
-
-struct rio_usb_data {
- struct usb_device *rio_dev; /* init: probe_rio */
- unsigned int ifnum; /* Interface number of the USB device */
- int isopen; /* nz if open */
- int present; /* Device is present on the bus */
- char *obuf, *ibuf; /* transfer buffers */
- char bulk_in_ep, bulk_out_ep; /* Endpoint assignments */
- wait_queue_head_t wait_q; /* for timeouts */
- struct mutex lock; /* general race avoidance */
-};
-
-static DEFINE_MUTEX(rio500_mutex);
-static struct rio_usb_data rio_instance;
-
-static int open_rio(struct inode *inode, struct file *file)
-{
- struct rio_usb_data *rio = &rio_instance;
-
- /* against disconnect() */
- mutex_lock(&rio500_mutex);
- mutex_lock(&(rio->lock));
-
- if (rio->isopen || !rio->present) {
- mutex_unlock(&(rio->lock));
- mutex_unlock(&rio500_mutex);
- return -EBUSY;
- }
- rio->isopen = 1;
-
- init_waitqueue_head(&rio->wait_q);
-
- mutex_unlock(&(rio->lock));
-
- dev_info(&rio->rio_dev->dev, "Rio opened.\n");
- mutex_unlock(&rio500_mutex);
-
- return 0;
-}
-
-static int close_rio(struct inode *inode, struct file *file)
-{
- struct rio_usb_data *rio = &rio_instance;
-
- /* against disconnect() */
- mutex_lock(&rio500_mutex);
- mutex_lock(&(rio->lock));
-
- rio->isopen = 0;
- if (!rio->present) {
- /* cleanup has been delayed */
- kfree(rio->ibuf);
- kfree(rio->obuf);
- rio->ibuf = NULL;
- rio->obuf = NULL;
- } else {
- dev_info(&rio->rio_dev->dev, "Rio closed.\n");
- }
- mutex_unlock(&(rio->lock));
- mutex_unlock(&rio500_mutex);
- return 0;
-}
-
-static long ioctl_rio(struct file *file, unsigned int cmd, unsigned long arg)
-{
- struct RioCommand rio_cmd;
- struct rio_usb_data *rio = &rio_instance;
- void __user *data;
- unsigned char *buffer;
- int result, requesttype;
- int retries;
- int retval=0;
-
- mutex_lock(&(rio->lock));
- /* Sanity check to make sure rio is connected, powered, etc */
- if (rio->present == 0 || rio->rio_dev == NULL) {
- retval = -ENODEV;
- goto err_out;
- }
-
- switch (cmd) {
- case RIO_RECV_COMMAND:
- data = (void __user *) arg;
- if (data == NULL)
- break;
- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
- retval = -EFAULT;
- goto err_out;
- }
- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
- retval = -EINVAL;
- goto err_out;
- }
- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
- if (buffer == NULL) {
- retval = -ENOMEM;
- goto err_out;
- }
- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
- retval = -EFAULT;
- free_page((unsigned long) buffer);
- goto err_out;
- }
-
- requesttype = rio_cmd.requesttype | USB_DIR_IN |
- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
- dev_dbg(&rio->rio_dev->dev,
- "sending command:reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
- requesttype, rio_cmd.request, rio_cmd.value,
- rio_cmd.index, rio_cmd.length);
- /* Send rio control message */
- retries = 3;
- while (retries) {
- result = usb_control_msg(rio->rio_dev,
- usb_rcvctrlpipe(rio-> rio_dev, 0),
- rio_cmd.request,
- requesttype,
- rio_cmd.value,
- rio_cmd.index, buffer,
- rio_cmd.length,
- jiffies_to_msecs(rio_cmd.timeout));
- if (result == -ETIMEDOUT)
- retries--;
- else if (result < 0) {
- dev_err(&rio->rio_dev->dev,
- "Error executing ioctrl. code = %d\n",
- result);
- retries = 0;
- } else {
- dev_dbg(&rio->rio_dev->dev,
- "Executed ioctl. Result = %d (data=%02x)\n",
- result, buffer[0]);
- if (copy_to_user(rio_cmd.buffer, buffer,
- rio_cmd.length)) {
- free_page((unsigned long) buffer);
- retval = -EFAULT;
- goto err_out;
- }
- retries = 0;
- }
-
- /* rio_cmd.buffer contains a raw stream of single byte
- data which has been returned from rio. Data is
- interpreted at application level. For data that
- will be cast to data types longer than 1 byte, data
- will be little_endian and will potentially need to
- be swapped at the app level */
-
- }
- free_page((unsigned long) buffer);
- break;
-
- case RIO_SEND_COMMAND:
- data = (void __user *) arg;
- if (data == NULL)
- break;
- if (copy_from_user(&rio_cmd, data, sizeof(struct RioCommand))) {
- retval = -EFAULT;
- goto err_out;
- }
- if (rio_cmd.length < 0 || rio_cmd.length > PAGE_SIZE) {
- retval = -EINVAL;
- goto err_out;
- }
- buffer = (unsigned char *) __get_free_page(GFP_KERNEL);
- if (buffer == NULL) {
- retval = -ENOMEM;
- goto err_out;
- }
- if (copy_from_user(buffer, rio_cmd.buffer, rio_cmd.length)) {
- free_page((unsigned long)buffer);
- retval = -EFAULT;
- goto err_out;
- }
-
- requesttype = rio_cmd.requesttype | USB_DIR_OUT |
- USB_TYPE_VENDOR | USB_RECIP_DEVICE;
- dev_dbg(&rio->rio_dev->dev,
- "sending command: reqtype=%0x req=%0x value=%0x index=%0x len=%0x\n",
- requesttype, rio_cmd.request, rio_cmd.value,
- rio_cmd.index, rio_cmd.length);
- /* Send rio control message */
- retries = 3;
- while (retries) {
- result = usb_control_msg(rio->rio_dev,
- usb_sndctrlpipe(rio-> rio_dev, 0),
- rio_cmd.request,
- requesttype,
- rio_cmd.value,
- rio_cmd.index, buffer,
- rio_cmd.length,
- jiffies_to_msecs(rio_cmd.timeout));
- if (result == -ETIMEDOUT)
- retries--;
- else if (result < 0) {
- dev_err(&rio->rio_dev->dev,
- "Error executing ioctrl. code = %d\n",
- result);
- retries = 0;
- } else {
- dev_dbg(&rio->rio_dev->dev,
- "Executed ioctl. Result = %d\n", result);
- retries = 0;
-
- }
-
- }
- free_page((unsigned long) buffer);
- break;
-
- default:
- retval = -ENOTTY;
- break;
- }
-
-
-err_out:
- mutex_unlock(&(rio->lock));
- return retval;
-}
-
-static ssize_t
-write_rio(struct file *file, const char __user *buffer,
- size_t count, loff_t * ppos)
-{
- DEFINE_WAIT(wait);
- struct rio_usb_data *rio = &rio_instance;
-
- unsigned long copy_size;
- unsigned long bytes_written = 0;
- unsigned int partial;
-
- int result = 0;
- int maxretry;
- int errn = 0;
- int intr;
-
- intr = mutex_lock_interruptible(&(rio->lock));
- if (intr)
- return -EINTR;
- /* Sanity check to make sure rio is connected, powered, etc */
- if (rio->present == 0 || rio->rio_dev == NULL) {
- mutex_unlock(&(rio->lock));
- return -ENODEV;
- }
-
-
-
- do {
- unsigned long thistime;
- char *obuf = rio->obuf;
-
- thistime = copy_size =
- (count >= OBUF_SIZE) ? OBUF_SIZE : count;
- if (copy_from_user(rio->obuf, buffer, copy_size)) {
- errn = -EFAULT;
- goto error;
- }
- maxretry = 5;
- while (thistime) {
- if (!rio->rio_dev) {
- errn = -ENODEV;
- goto error;
- }
- if (signal_pending(current)) {
- mutex_unlock(&(rio->lock));
- return bytes_written ? bytes_written : -EINTR;
- }
-
- result = usb_bulk_msg(rio->rio_dev,
- usb_sndbulkpipe(rio->rio_dev, 2),
- obuf, thistime, &partial, 5000);
-
- dev_dbg(&rio->rio_dev->dev,
- "write stats: result:%d thistime:%lu partial:%u\n",
- result, thistime, partial);
-
- if (result == -ETIMEDOUT) { /* NAK - so hold for a while */
- if (!maxretry--) {
- errn = -ETIME;
- goto error;
- }
- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
- schedule_timeout(NAK_TIMEOUT);
- finish_wait(&rio->wait_q, &wait);
- continue;
- } else if (!result && partial) {
- obuf += partial;
- thistime -= partial;
- } else
- break;
- }
- if (result) {
- dev_err(&rio->rio_dev->dev, "Write Whoops - %x\n",
- result);
- errn = -EIO;
- goto error;
- }
- bytes_written += copy_size;
- count -= copy_size;
- buffer += copy_size;
- } while (count > 0);
-
- mutex_unlock(&(rio->lock));
-
- return bytes_written ? bytes_written : -EIO;
-
-error:
- mutex_unlock(&(rio->lock));
- return errn;
-}
-
-static ssize_t
-read_rio(struct file *file, char __user *buffer, size_t count, loff_t * ppos)
-{
- DEFINE_WAIT(wait);
- struct rio_usb_data *rio = &rio_instance;
- ssize_t read_count;
- unsigned int partial;
- int this_read;
- int result;
- int maxretry = 10;
- char *ibuf;
- int intr;
-
- intr = mutex_lock_interruptible(&(rio->lock));
- if (intr)
- return -EINTR;
- /* Sanity check to make sure rio is connected, powered, etc */
- if (rio->present == 0 || rio->rio_dev == NULL) {
- mutex_unlock(&(rio->lock));
- return -ENODEV;
- }
-
- ibuf = rio->ibuf;
-
- read_count = 0;
-
-
- while (count > 0) {
- if (signal_pending(current)) {
- mutex_unlock(&(rio->lock));
- return read_count ? read_count : -EINTR;
- }
- if (!rio->rio_dev) {
- mutex_unlock(&(rio->lock));
- return -ENODEV;
- }
- this_read = (count >= IBUF_SIZE) ? IBUF_SIZE : count;
-
- result = usb_bulk_msg(rio->rio_dev,
- usb_rcvbulkpipe(rio->rio_dev, 1),
- ibuf, this_read, &partial,
- 8000);
-
- dev_dbg(&rio->rio_dev->dev,
- "read stats: result:%d this_read:%u partial:%u\n",
- result, this_read, partial);
-
- if (partial) {
- count = this_read = partial;
- } else if (result == -ETIMEDOUT || result == 15) { /* FIXME: 15 ??? */
- if (!maxretry--) {
- mutex_unlock(&(rio->lock));
- dev_err(&rio->rio_dev->dev,
- "read_rio: maxretry timeout\n");
- return -ETIME;
- }
- prepare_to_wait(&rio->wait_q, &wait, TASK_INTERRUPTIBLE);
- schedule_timeout(NAK_TIMEOUT);
- finish_wait(&rio->wait_q, &wait);
- continue;
- } else if (result != -EREMOTEIO) {
- mutex_unlock(&(rio->lock));
- dev_err(&rio->rio_dev->dev,
- "Read Whoops - result:%u partial:%u this_read:%u\n",
- result, partial, this_read);
- return -EIO;
- } else {
- mutex_unlock(&(rio->lock));
- return (0);
- }
-
- if (this_read) {
- if (copy_to_user(buffer, ibuf, this_read)) {
- mutex_unlock(&(rio->lock));
- return -EFAULT;
- }
- count -= this_read;
- read_count += this_read;
- buffer += this_read;
- }
- }
- mutex_unlock(&(rio->lock));
- return read_count;
-}
-
-static const struct file_operations usb_rio_fops = {
- .owner = THIS_MODULE,
- .read = read_rio,
- .write = write_rio,
- .unlocked_ioctl = ioctl_rio,
- .open = open_rio,
- .release = close_rio,
- .llseek = noop_llseek,
-};
-
-static struct usb_class_driver usb_rio_class = {
- .name = "rio500%d",
- .fops = &usb_rio_fops,
- .minor_base = RIO_MINOR,
-};
-
-static int probe_rio(struct usb_interface *intf,
- const struct usb_device_id *id)
-{
- struct usb_device *dev = interface_to_usbdev(intf);
- struct rio_usb_data *rio = &rio_instance;
- int retval = 0;
-
- mutex_lock(&rio500_mutex);
- if (rio->present) {
- dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
- retval = -EBUSY;
- goto bail_out;
- } else {
- dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
- }
-
- retval = usb_register_dev(intf, &usb_rio_class);
- if (retval) {
- dev_err(&dev->dev,
- "Not able to get a minor for this device.\n");
- retval = -ENOMEM;
- goto bail_out;
- }
-
- rio->rio_dev = dev;
-
- if (!(rio->obuf = kmalloc(OBUF_SIZE, GFP_KERNEL))) {
- dev_err(&dev->dev,
- "probe_rio: Not enough memory for the output buffer\n");
- usb_deregister_dev(intf, &usb_rio_class);
- retval = -ENOMEM;
- goto bail_out;
- }
- dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
-
- if (!(rio->ibuf = kmalloc(IBUF_SIZE, GFP_KERNEL))) {
- dev_err(&dev->dev,
- "probe_rio: Not enough memory for the input buffer\n");
- usb_deregister_dev(intf, &usb_rio_class);
- kfree(rio->obuf);
- retval = -ENOMEM;
- goto bail_out;
- }
- dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
-
- mutex_init(&(rio->lock));
-
- usb_set_intfdata (intf, rio);
- rio->present = 1;
-bail_out:
- mutex_unlock(&rio500_mutex);
-
- return retval;
-}
-
-static void disconnect_rio(struct usb_interface *intf)
-{
- struct rio_usb_data *rio = usb_get_intfdata (intf);
-
- usb_set_intfdata (intf, NULL);
- mutex_lock(&rio500_mutex);
- if (rio) {
- usb_deregister_dev(intf, &usb_rio_class);
-
- mutex_lock(&(rio->lock));
- if (rio->isopen) {
- rio->isopen = 0;
- /* better let it finish - the release will do whats needed */
- rio->rio_dev = NULL;
- mutex_unlock(&(rio->lock));
- mutex_unlock(&rio500_mutex);
- return;
- }
- kfree(rio->ibuf);
- kfree(rio->obuf);
-
- dev_info(&intf->dev, "USB Rio disconnected.\n");
-
- rio->present = 0;
- mutex_unlock(&(rio->lock));
- }
- mutex_unlock(&rio500_mutex);
-}
-
-static const struct usb_device_id rio_table[] = {
- { USB_DEVICE(0x0841, 1) }, /* Rio 500 */
- { } /* Terminating entry */
-};
-
-MODULE_DEVICE_TABLE (usb, rio_table);
-
-static struct usb_driver rio_driver = {
- .name = "rio500",
- .probe = probe_rio,
- .disconnect = disconnect_rio,
- .id_table = rio_table,
-};
-
-module_usb_driver(rio_driver);
-
-MODULE_AUTHOR( DRIVER_AUTHOR );
-MODULE_DESCRIPTION( DRIVER_DESC );
-MODULE_LICENSE("GPL");
-
--- a/drivers/usb/misc/rio500_usb.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/* ----------------------------------------------------------------------
-
- Copyright (C) 2000 Cesar Miquel (miquel@df.uba.ar)
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-
- ---------------------------------------------------------------------- */
-
-
-
-#define RIO_SEND_COMMAND 0x1
-#define RIO_RECV_COMMAND 0x2
-
-#define RIO_DIR_OUT 0x0
-#define RIO_DIR_IN 0x1
-
-struct RioCommand {
- short length;
- int request;
- int requesttype;
- int value;
- int index;
- void __user *buffer;
- int timeout;
-};
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 017/136] USB: serial: keyspan: fix NULL-derefs on open() and write()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (15 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 016/136] USB: rio500: Remove Rio 500 kernel driver Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 018/136] USB: microtek: fix info-leak at probe Ben Hutchings
` (119 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7d7e21fafdbc7fcf0854b877bd0975b487ed2717 upstream.
Fix NULL-pointer dereferences on open() and write() which can be
triggered by a malicious USB device.
The current URB allocation helper would fail to initialise the newly
allocated URB if the device has unexpected endpoint descriptors,
something which could lead NULL-pointer dereferences in a number of
open() and write() paths when accessing the URB. For example:
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:usb_clear_halt+0x11/0xc0
...
Call Trace:
? tty_port_open+0x4d/0xd0
keyspan_open+0x70/0x160 [keyspan]
serial_port_activate+0x5b/0x80 [usbserial]
tty_port_open+0x7b/0xd0
? check_tty_count+0x43/0xa0
tty_open+0xf1/0x490
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:keyspan_write+0x14e/0x1f3 [keyspan]
...
Call Trace:
serial_write+0x43/0xa0 [usbserial]
n_tty_write+0x1af/0x4f0
? do_wait_intr_irq+0x80/0x80
? process_echoes+0x60/0x60
tty_write+0x13f/0x2f0
BUG: kernel NULL pointer dereference, address: 0000000000000000
...
RIP: 0010:keyspan_usa26_send_setup+0x298/0x305 [keyspan]
...
Call Trace:
keyspan_open+0x10f/0x160 [keyspan]
serial_port_activate+0x5b/0x80 [usbserial]
tty_port_open+0x7b/0xd0
? check_tty_count+0x43/0xa0
tty_open+0xf1/0x490
Fixes: fdcba53e2d58 ("fix for bugzilla #7544 (keyspan USB-to-serial converter)")
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/keyspan.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -1249,8 +1249,8 @@ static struct urb *keyspan_setup_urb(str
ep_desc = find_ep(serial, endpoint);
if (!ep_desc) {
- /* leak the urb, something's wrong and the callers don't care */
- return urb;
+ usb_free_urb(urb);
+ return NULL;
}
if (usb_endpoint_xfer_int(ep_desc)) {
ep_type_name = "INT";
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 018/136] USB: microtek: fix info-leak at probe
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (16 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 017/136] USB: serial: keyspan: fix NULL-derefs on open() and write() Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 019/136] USB: adutux: fix NULL-derefs on disconnect Ben Hutchings
` (118 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot+5630ca7c3b2be5c9da5e, Johan Hovold,
Greg Kroah-Hartman, Oliver Neukum
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 177238c3d47d54b2ed8f0da7a4290db492f4a057 upstream.
Add missing bulk-in endpoint sanity check to prevent uninitialised stack
data from being reported to the system log and used as endpoint
addresses.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+5630ca7c3b2be5c9da5e@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20191003070931.17009-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/image/microtek.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/image/microtek.c
+++ b/drivers/usb/image/microtek.c
@@ -727,6 +727,10 @@ static int mts_usb_probe(struct usb_inte
}
+ if (ep_in_current != &ep_in_set[2]) {
+ MTS_WARNING("couldn't find two input bulk endpoints. Bailing out.\n");
+ return -ENODEV;
+ }
if ( ep_out == -1 ) {
MTS_WARNING( "couldn't find an output bulk endpoint. Bailing out.\n" );
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 019/136] USB: adutux: fix NULL-derefs on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (17 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 018/136] USB: microtek: fix info-leak at probe Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 020/136] USB: yurex: Don't retry on unexpected errors Ben Hutchings
` (117 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b2fa7baee744fde746c17bc1860b9c6f5c2eebb7 upstream.
The driver was using its struct usb_device pointer as an inverted
disconnected flag, but was setting it to NULL before making sure all
completion handlers had run. This could lead to a NULL-pointer
dereference in a number of dev_dbg statements in the completion handlers
which relies on said pointer.
The pointer was also dereferenced unconditionally in a dev_dbg statement
release() something which would lead to a NULL-deref whenever a device
was disconnected before the final character-device close if debugging
was enabled.
Fix this by unconditionally stopping all I/O and preventing
resubmissions by poisoning the interrupt URBs at disconnect and using a
dedicated disconnected flag.
This also makes sure that all I/O has completed by the time the
disconnect callback returns.
Fixes: 1ef37c6047fe ("USB: adutux: remove custom debug macro and module parameter")
Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190925092913.8608-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/adutux.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -80,6 +80,7 @@ struct adu_device {
char serial_number[8];
int open_count; /* number of times this port has been opened */
+ unsigned long disconnected:1;
char *read_buffer_primary;
int read_buffer_length;
@@ -121,7 +122,7 @@ static void adu_abort_transfers(struct a
{
unsigned long flags;
- if (dev->udev == NULL)
+ if (dev->disconnected)
return;
/* shutdown transfer */
@@ -244,7 +245,7 @@ static int adu_open(struct inode *inode,
}
dev = usb_get_intfdata(interface);
- if (!dev || !dev->udev) {
+ if (!dev) {
retval = -ENODEV;
goto exit_no_device;
}
@@ -327,7 +328,7 @@ static int adu_release(struct inode *ino
}
adu_release_internal(dev);
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
/* the device was unplugged before the file was released */
if (!dev->open_count) /* ... and we're the last user */
adu_delete(dev);
@@ -356,7 +357,7 @@ static ssize_t adu_read(struct file *fil
return -ERESTARTSYS;
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto exit;
@@ -521,7 +522,7 @@ static ssize_t adu_write(struct file *fi
goto exit_nolock;
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto exit;
@@ -801,11 +802,14 @@ static void adu_disconnect(struct usb_in
usb_deregister_dev(interface, &adu_class);
+ usb_poison_urb(dev->interrupt_in_urb);
+ usb_poison_urb(dev->interrupt_out_urb);
+
mutex_lock(&adutux_mutex);
usb_set_intfdata(interface, NULL);
mutex_lock(&dev->mtx); /* not interruptible */
- dev->udev = NULL; /* poison */
+ dev->disconnected = 1;
mutex_unlock(&dev->mtx);
/* if the device is not opened, then we clean up right now */
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 020/136] USB: yurex: Don't retry on unexpected errors
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (18 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 019/136] USB: adutux: fix NULL-derefs on disconnect Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 021/136] USB: dummy-hcd: fix power budget for SuperSpeed mode Ben Hutchings
` (116 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Tomoki Sekiyama, Alan Stern, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 32a0721c6620b77504916dac0cea8ad497c4878a upstream.
According to Greg KH, it has been generally agreed that when a USB
driver encounters an unknown error (or one it can't handle directly),
it should just give up instead of going into a potentially infinite
retry loop.
The three codes -EPROTO, -EILSEQ, and -ETIME fall into this category.
They can be caused by bus errors such as packet loss or corruption,
attempting to communicate with a disconnected device, or by malicious
firmware. Nowadays the extent of packet loss or corruption is
negligible, so it should be safe for a driver to give up whenever one
of these errors occurs.
Although the yurex driver handles -EILSEQ errors in this way, it
doesn't do the same for -EPROTO (as discovered by the syzbot fuzzer)
or other unrecognized errors. This patch adjusts the driver so that
it doesn't log an error message for -EPROTO or -ETIME, and it doesn't
retry after any errors.
Reported-and-tested-by: syzbot+b24d736f18a1541ad550@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: Tomoki Sekiyama <tomoki.sekiyama@gmail.com>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1909171245410.1590-100000@iolanthe.rowland.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/yurex.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -136,6 +136,7 @@ static void yurex_interrupt(struct urb *
switch (status) {
case 0: /*success*/
break;
+ /* The device is terminated or messed up, give up */
case -EOVERFLOW:
dev_err(&dev->interface->dev,
"%s - overflow with length %d, actual length is %d\n",
@@ -144,12 +145,13 @@ static void yurex_interrupt(struct urb *
case -ENOENT:
case -ESHUTDOWN:
case -EILSEQ:
- /* The device is terminated, clean up */
+ case -EPROTO:
+ case -ETIME:
return;
default:
dev_err(&dev->interface->dev,
"%s - unknown status received: %d\n", __func__, status);
- goto exit;
+ return;
}
/* handle received message */
@@ -181,7 +183,6 @@ static void yurex_interrupt(struct urb *
break;
}
-exit:
retval = usb_submit_urb(dev->urb, GFP_ATOMIC);
if (retval) {
dev_err(&dev->interface->dev, "%s - usb_submit_urb failed: %d\n",
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 021/136] USB: dummy-hcd: fix power budget for SuperSpeed mode
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (19 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 020/136] USB: yurex: Don't retry on unexpected errors Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 022/136] USB: usblcd: fix I/O after disconnect Ben Hutchings
` (115 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Alan Stern, Jacky.Cao, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Jacky.Cao@sony.com" <Jacky.Cao@sony.com>
commit 2636d49b64671d3d90ecc4daf971b58df3956519 upstream.
The power budget for SuperSpeed mode should be 900 mA
according to USB specification, so set the power budget
to 900mA for dummy_start_ss which is only used for
SuperSpeed mode.
If the max power consumption of SuperSpeed device is
larger than 500 mA, insufficient available bus power
error happens in usb_choose_configuration function
when the device connects to dummy hcd.
Signed-off-by: Jacky Cao <Jacky.Cao@sony.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/16EA1F625E922C43B00B9D82250220500871CDE5@APYOKXMS108.ap.sony.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/gadget/dummy_hcd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -50,6 +50,7 @@
#define DRIVER_VERSION "02 May 2005"
#define POWER_BUDGET 500 /* in mA; use 8 for low-power port testing */
+#define POWER_BUDGET_3 900 /* in mA */
static const char driver_name[] = "dummy_hcd";
static const char driver_desc[] = "USB Host+Gadget Emulator";
@@ -2359,7 +2360,7 @@ static int dummy_start_ss(struct dummy_h
dum_hcd->rh_state = DUMMY_RH_RUNNING;
dum_hcd->stream_en_ep = 0;
INIT_LIST_HEAD(&dum_hcd->urbp_list);
- dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET;
+ dummy_hcd_to_hcd(dum_hcd)->power_budget = POWER_BUDGET_3;
dummy_hcd_to_hcd(dum_hcd)->state = HC_STATE_RUNNING;
dummy_hcd_to_hcd(dum_hcd)->uses_new_polling = 1;
#ifdef CONFIG_USB_OTG
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 022/136] USB: usblcd: fix I/O after disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (20 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 021/136] USB: dummy-hcd: fix power budget for SuperSpeed mode Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 023/136] mac80211: Reject malformed SSID elements Ben Hutchings
` (114 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit eb7f5a490c5edfe8126f64bc58b9ba2edef0a425 upstream.
Make sure to stop all I/O on disconnect by adding a disconnected flag
which is used to prevent new I/O from being started and by stopping all
ongoing I/O before returning.
This also fixes a potential use-after-free on driver unbind in case the
driver data is freed before the completion handler has run.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190926091228.24634-7-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/usblcd.c | 33 +++++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/usblcd.c
+++ b/drivers/usb/misc/usblcd.c
@@ -17,6 +17,7 @@
#include <linux/slab.h>
#include <linux/errno.h>
#include <linux/mutex.h>
+#include <linux/rwsem.h>
#include <linux/uaccess.h>
#include <linux/usb.h>
@@ -56,6 +57,8 @@ struct usb_lcd {
using up all RAM */
struct usb_anchor submitted; /* URBs to wait for
before suspend */
+ struct rw_semaphore io_rwsem;
+ unsigned long disconnected:1;
};
#define to_lcd_dev(d) container_of(d, struct usb_lcd, kref)
@@ -141,6 +144,13 @@ static ssize_t lcd_read(struct file *fil
dev = file->private_data;
+ down_read(&dev->io_rwsem);
+
+ if (dev->disconnected) {
+ retval = -ENODEV;
+ goto out_up_io;
+ }
+
/* do a blocking bulk read to get data from the device */
retval = usb_bulk_msg(dev->udev,
usb_rcvbulkpipe(dev->udev,
@@ -157,6 +167,9 @@ static ssize_t lcd_read(struct file *fil
retval = bytes_read;
}
+out_up_io:
+ up_read(&dev->io_rwsem);
+
return retval;
}
@@ -236,11 +249,18 @@ static ssize_t lcd_write(struct file *fi
if (r < 0)
return -EINTR;
+ down_read(&dev->io_rwsem);
+
+ if (dev->disconnected) {
+ retval = -ENODEV;
+ goto err_up_io;
+ }
+
/* create a urb, and a buffer for it, and copy the data to the urb */
urb = usb_alloc_urb(0, GFP_KERNEL);
if (!urb) {
retval = -ENOMEM;
- goto err_no_buf;
+ goto err_up_io;
}
buf = usb_alloc_coherent(dev->udev, count, GFP_KERNEL,
@@ -277,6 +297,7 @@ static ssize_t lcd_write(struct file *fi
the USB core will eventually free it entirely */
usb_free_urb(urb);
+ up_read(&dev->io_rwsem);
exit:
return count;
error_unanchor:
@@ -284,7 +305,8 @@ error_unanchor:
error:
usb_free_coherent(dev->udev, count, buf, urb->transfer_dma);
usb_free_urb(urb);
-err_no_buf:
+err_up_io:
+ up_read(&dev->io_rwsem);
up(&dev->limit_sem);
return retval;
}
@@ -327,6 +349,7 @@ static int lcd_probe(struct usb_interfac
}
kref_init(&dev->kref);
sema_init(&dev->limit_sem, USB_LCD_CONCURRENT_WRITES);
+ init_rwsem(&dev->io_rwsem);
init_usb_anchor(&dev->submitted);
dev->udev = usb_get_dev(interface_to_usbdev(interface));
@@ -437,6 +460,12 @@ static void lcd_disconnect(struct usb_in
/* give back our minor */
usb_deregister_dev(interface, &lcd_class);
+ down_write(&dev->io_rwsem);
+ dev->disconnected = 1;
+ up_write(&dev->io_rwsem);
+
+ usb_kill_anchored_urbs(&dev->submitted);
+
/* decrement our usage count */
kref_put(&dev->kref, lcd_delete);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 023/136] mac80211: Reject malformed SSID elements
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (21 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 022/136] USB: usblcd: fix I/O after disconnect Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 024/136] USB: legousbtower: fix slab info leak at probe Ben Hutchings
` (113 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Nicolas Waisman, Will Deacon,
Johannes Berg, Kees Cook
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will@kernel.org>
commit 4152561f5da3fca92af7179dd538ea89e248f9d0 upstream.
Although this shouldn't occur in practice, it's a good idea to bounds
check the length field of the SSID element prior to using it for things
like allocations or memcpy operations.
Cc: Kees Cook <keescook@chromium.org>
Reported-by: Nicolas Waisman <nico@semmle.com>
Signed-off-by: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20191004095132.15777-1-will@kernel.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/mac80211/mlme.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2046,7 +2046,8 @@ struct sk_buff *ieee80211_ap_probereq_ge
rcu_read_lock();
ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
- if (WARN_ON_ONCE(ssid == NULL))
+ if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
+ "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
ssid_len = 0;
else
ssid_len = ssid[1];
@@ -4195,7 +4196,7 @@ int ieee80211_mgd_assoc(struct ieee80211
rcu_read_lock();
ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
- if (!ssidie) {
+ if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
rcu_read_unlock();
kfree(assoc_data);
return -EINVAL;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 024/136] USB: legousbtower: fix slab info leak at probe
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (22 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 023/136] mac80211: Reject malformed SSID elements Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:45 ` [PATCH 3.16 025/136] USB: legousbtower: fix deadlock on disconnect Ben Hutchings
` (112 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1d427be4a39defadda6dd8f4659bc17f7591740f upstream.
Make sure to check for short transfers when retrieving the version
information at probe to avoid leaking uninitialised slab data when
logging it.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190919083039.30898-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -923,8 +923,10 @@ static int tower_probe (struct usb_inter
get_version_reply,
sizeof(*get_version_reply),
1000);
- if (result < 0) {
- dev_err(idev, "LEGO USB Tower get version control request failed\n");
+ if (result < sizeof(*get_version_reply)) {
+ if (result >= 0)
+ result = -EIO;
+ dev_err(idev, "get version request failed: %d\n", result);
retval = result;
goto error;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 025/136] USB: legousbtower: fix deadlock on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (23 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 024/136] USB: legousbtower: fix slab info leak at probe Ben Hutchings
@ 2019-12-17 0:45 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 026/136] USB: legousbtower: fix potential NULL-deref " Ben Hutchings
` (111 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:45 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot+f9549f5ee8a5416f0b95, Johan Hovold,
Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 33a7813219f208f4952ece60ee255fd983272dec upstream.
Fix a potential deadlock if disconnect races with open.
Since commit d4ead16f50f9 ("USB: prevent char device open/deregister
race") core holds an rw-semaphore while open is called and when
releasing the minor number during deregistration. This can lead to an
ABBA deadlock if a driver takes a lock in open which it also holds
during deregistration.
This effectively reverts commit 78663ecc344b ("USB: disconnect open race
in legousbtower") which needlessly introduced this issue after a generic
fix for this race had been added to core by commit d4ead16f50f9 ("USB:
prevent char device open/deregister race").
Fixes: 78663ecc344b ("USB: disconnect open race in legousbtower")
Reported-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com
Tested-by: syzbot+f9549f5ee8a5416f0b95@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190919083039.30898-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 19 ++-----------------
1 file changed, 2 insertions(+), 17 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -185,7 +185,6 @@ static const struct usb_device_id tower_
};
MODULE_DEVICE_TABLE (usb, tower_table);
-static DEFINE_MUTEX(open_disc_mutex);
#define LEGO_USB_TOWER_MINOR_BASE 160
@@ -338,18 +337,14 @@ static int tower_open (struct inode *ino
goto exit;
}
- mutex_lock(&open_disc_mutex);
dev = usb_get_intfdata(interface);
-
if (!dev) {
- mutex_unlock(&open_disc_mutex);
retval = -ENODEV;
goto exit;
}
/* lock this device */
if (mutex_lock_interruptible(&dev->lock)) {
- mutex_unlock(&open_disc_mutex);
retval = -ERESTARTSYS;
goto exit;
}
@@ -357,12 +352,10 @@ static int tower_open (struct inode *ino
/* allow opening only once */
if (dev->open_count) {
- mutex_unlock(&open_disc_mutex);
retval = -EBUSY;
goto unlock_exit;
}
dev->open_count = 1;
- mutex_unlock(&open_disc_mutex);
/* reset the tower */
result = usb_control_msg (dev->udev,
@@ -429,10 +422,9 @@ static int tower_release (struct inode *
if (dev == NULL) {
retval = -ENODEV;
- goto exit_nolock;
+ goto exit;
}
- mutex_lock(&open_disc_mutex);
if (mutex_lock_interruptible(&dev->lock)) {
retval = -ERESTARTSYS;
goto exit;
@@ -462,10 +454,7 @@ static int tower_release (struct inode *
unlock_exit:
mutex_unlock(&dev->lock);
-
exit:
- mutex_unlock(&open_disc_mutex);
-exit_nolock:
return retval;
}
@@ -944,7 +933,6 @@ static int tower_probe (struct usb_inter
if (retval) {
/* something prevented us from registering this driver */
dev_err(idev, "Not able to get a minor for this device.\n");
- usb_set_intfdata (interface, NULL);
goto error;
}
dev->minor = interface->minor;
@@ -976,16 +964,13 @@ static void tower_disconnect (struct usb
int minor;
dev = usb_get_intfdata (interface);
- mutex_lock(&open_disc_mutex);
- usb_set_intfdata (interface, NULL);
minor = dev->minor;
- /* give back our minor */
+ /* give back our minor and prevent further open() */
usb_deregister_dev (interface, &tower_class);
mutex_lock(&dev->lock);
- mutex_unlock(&open_disc_mutex);
/* if the device is not opened, then we clean up right now */
if (!dev->open_count) {
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 026/136] USB: legousbtower: fix potential NULL-deref on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (24 preceding siblings ...)
2019-12-17 0:45 ` [PATCH 3.16 025/136] USB: legousbtower: fix deadlock on disconnect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 027/136] USB: legousbtower: fix open after failed reset request Ben Hutchings
` (110 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit cd81e6fa8e033e7bcd59415b4a65672b4780030b upstream.
The driver is using its struct usb_device pointer as an inverted
disconnected flag, but was setting it to NULL before making sure all
completion handlers had run. This could lead to a NULL-pointer
dereference in a number of dev_dbg and dev_err statements in the
completion handlers which relies on said pointer.
Fix this by unconditionally stopping all I/O and preventing
resubmissions by poisoning the interrupt URBs at disconnect and using a
dedicated disconnected flag.
This also makes sure that all I/O has completed by the time the
disconnect callback returns.
Fixes: 9d974b2a06e3 ("USB: legousbtower.c: remove err() usage")
Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro")
Fixes: 4dae99638097 ("USB: legotower: remove custom debug macro and module parameter")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190919083039.30898-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 26 +++++++++++++++-----------
1 file changed, 15 insertions(+), 11 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -196,6 +196,7 @@ struct lego_usb_tower {
unsigned char minor; /* the starting minor number for this device */
int open_count; /* number of times this port has been opened */
+ unsigned long disconnected:1;
char* read_buffer;
size_t read_buffer_length; /* this much came in */
@@ -295,8 +296,6 @@ static inline void lego_usb_tower_debug_
*/
static inline void tower_delete (struct lego_usb_tower *dev)
{
- tower_abort_transfers (dev);
-
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -436,7 +435,8 @@ static int tower_release (struct inode *
retval = -ENODEV;
goto unlock_exit;
}
- if (dev->udev == NULL) {
+
+ if (dev->disconnected) {
/* the device was unplugged before the file was released */
/* unlock here as tower_delete frees dev */
@@ -472,10 +472,9 @@ static void tower_abort_transfers (struc
if (dev->interrupt_in_running) {
dev->interrupt_in_running = 0;
mb();
- if (dev->udev)
- usb_kill_urb (dev->interrupt_in_urb);
+ usb_kill_urb(dev->interrupt_in_urb);
}
- if (dev->interrupt_out_busy && dev->udev)
+ if (dev->interrupt_out_busy)
usb_kill_urb(dev->interrupt_out_urb);
}
@@ -511,7 +510,7 @@ static unsigned int tower_poll (struct f
dev = file->private_data;
- if (!dev->udev)
+ if (dev->disconnected)
return POLLERR | POLLHUP;
poll_wait(file, &dev->read_wait, wait);
@@ -558,7 +557,7 @@ static ssize_t tower_read (struct file *
}
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto unlock_exit;
@@ -644,7 +643,7 @@ static ssize_t tower_write (struct file
}
/* verify that the device wasn't unplugged */
- if (dev->udev == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
pr_err("No device or device unplugged %d\n", retval);
goto unlock_exit;
@@ -753,7 +752,7 @@ static void tower_interrupt_in_callback
resubmit:
/* resubmit if we're still running */
- if (dev->interrupt_in_running && dev->udev) {
+ if (dev->interrupt_in_running) {
retval = usb_submit_urb (dev->interrupt_in_urb, GFP_ATOMIC);
if (retval)
dev_err(&dev->udev->dev,
@@ -823,6 +822,7 @@ static int tower_probe (struct usb_inter
dev->udev = udev;
dev->open_count = 0;
+ dev->disconnected = 0;
dev->read_buffer = NULL;
dev->read_buffer_length = 0;
@@ -970,6 +970,10 @@ static void tower_disconnect (struct usb
/* give back our minor and prevent further open() */
usb_deregister_dev (interface, &tower_class);
+ /* stop I/O */
+ usb_poison_urb(dev->interrupt_in_urb);
+ usb_poison_urb(dev->interrupt_out_urb);
+
mutex_lock(&dev->lock);
/* if the device is not opened, then we clean up right now */
@@ -977,7 +981,7 @@ static void tower_disconnect (struct usb
mutex_unlock(&dev->lock);
tower_delete (dev);
} else {
- dev->udev = NULL;
+ dev->disconnected = 1;
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 027/136] USB: legousbtower: fix open after failed reset request
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (25 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 026/136] USB: legousbtower: fix potential NULL-deref " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 028/136] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Ben Hutchings
` (109 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 0b074f6986751361ff442bc1127c1648567aa8d6 upstream.
The driver would return with a nonzero open count in case the reset
control request failed. This would prevent any further attempts to open
the char dev until the device was disconnected.
Fix this by incrementing the open count only on successful open.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20190919083039.30898-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -354,7 +354,6 @@ static int tower_open (struct inode *ino
retval = -EBUSY;
goto unlock_exit;
}
- dev->open_count = 1;
/* reset the tower */
result = usb_control_msg (dev->udev,
@@ -394,13 +393,14 @@ static int tower_open (struct inode *ino
dev_err(&dev->udev->dev,
"Couldn't submit interrupt_in_urb %d\n", retval);
dev->interrupt_in_running = 0;
- dev->open_count = 0;
goto unlock_exit;
}
/* save device in the file's private structure */
file->private_data = dev;
+ dev->open_count = 1;
+
unlock_exit:
mutex_unlock(&dev->lock);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 028/136] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (26 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 027/136] USB: legousbtower: fix open after failed reset request Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 029/136] xhci: Check all endpoints for LPM timeout Ben Hutchings
` (108 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Mathias Nyman, Jan Schmidt
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit cd9d9491e835a845c1a98b8471f88d26285e0bb9 upstream.
If host/hub initiated link pm is prevented by a driver flag we still must
ensure that periodic endpoints have longer service intervals than link pm
exit latency before allowing device initiated link pm.
Fix this by continue walking and checking endpoint service interval if
xhci_get_timeout_no_hub_lpm() returns anything else than USB3_LPM_DISABLED
While at it fix the split line error message
Tested-by: Jan Schmidt <jan@centricular.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1570190373-30684-3-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4618,10 +4618,12 @@ static u16 xhci_calculate_lpm_timeout(st
if (intf->dev.driver) {
driver = to_usb_driver(intf->dev.driver);
if (driver && driver->disable_hub_initiated_lpm) {
- dev_dbg(&udev->dev, "Hub-initiated %s disabled "
- "at request of driver %s\n",
- state_name, driver->name);
- return xhci_get_timeout_no_hub_lpm(udev, state);
+ dev_dbg(&udev->dev, "Hub-initiated %s disabled at request of driver %s\n",
+ state_name, driver->name);
+ timeout = xhci_get_timeout_no_hub_lpm(udev,
+ state);
+ if (timeout == USB3_LPM_DISABLED)
+ return timeout;
}
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 029/136] xhci: Check all endpoints for LPM timeout
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (27 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 028/136] xhci: Prevent device initiated U1/U2 link pm if exit latency is too long Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 030/136] usb: xhci: wait for CNR controller not ready bit in xhci resume Ben Hutchings
` (107 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Philipp Zabel, Greg Kroah-Hartman,
Mathias Nyman, Jan Schmidt
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jan Schmidt <jan@centricular.com>
commit d500c63f80f2ea08ee300e57da5f2af1c13875f5 upstream.
If an endpoint is encountered that returns USB3_LPM_DEVICE_INITIATED, keep
checking further endpoints, as there might be periodic endpoints later
that return USB3_LPM_DISABLED due to shorter service intervals.
Without this, the code can set too high a maximum-exit-latency and
prevent the use of multiple USB3 cameras that should be able to work.
Signed-off-by: Jan Schmidt <jan@centricular.com>
Tested-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1570190373-30684-4-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -4503,12 +4503,12 @@ static int xhci_update_timeout_for_endpo
alt_timeout = xhci_call_host_update_timeout_for_endpoint(xhci, udev,
desc, state, timeout);
- /* If we found we can't enable hub-initiated LPM, or
+ /* If we found we can't enable hub-initiated LPM, and
* the U1 or U2 exit latency was too high to allow
- * device-initiated LPM as well, just stop searching.
+ * device-initiated LPM as well, then we will disable LPM
+ * for this device, so stop searching any further.
*/
- if (alt_timeout == USB3_LPM_DISABLED ||
- alt_timeout == USB3_LPM_DEVICE_INITIATED) {
+ if (alt_timeout == USB3_LPM_DISABLED) {
*timeout = alt_timeout;
return -E2BIG;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 030/136] usb: xhci: wait for CNR controller not ready bit in xhci resume
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (28 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 029/136] xhci: Check all endpoints for LPM timeout Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 031/136] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Ben Hutchings
` (106 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Rick Tseng, Mathias Nyman, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Rick Tseng <rtseng@nvidia.com>
commit a70bcbc322837eda1ab5994d12db941dc9733a7d upstream.
NVIDIA 3.1 xHCI card would lose power when moving power state into D3Cold.
Thus we need to wait for CNR bit to clear in xhci resume, just as in
xhci init.
[Minor changes to comment and commit message -Mathias]
Signed-off-by: Rick Tseng <rtseng@nvidia.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1570190373-30684-6-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: Add xhci as parameter to xhci_handshake()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/host/xhci.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1029,6 +1029,18 @@ int xhci_resume(struct xhci_hcd *xhci, b
hibernated = true;
if (!hibernated) {
+ /*
+ * Some controllers might lose power during suspend, so wait
+ * for controller not ready bit to clear, just as in xHC init.
+ */
+ retval = xhci_handshake(xhci, &xhci->op_regs->status,
+ STS_CNR, 0, 10 * 1000 * 1000);
+ if (retval) {
+ xhci_warn(xhci, "Controller not ready at resume %d\n",
+ retval);
+ spin_unlock_irq(&xhci->lock);
+ return retval;
+ }
/* step 1: restore register */
xhci_restore_registers(xhci);
/* step 2: initialize command ring buffer */
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 031/136] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (29 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 030/136] usb: xhci: wait for CNR controller not ready bit in xhci resume Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 032/136] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior Ben Hutchings
` (105 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Yoshihiro Shimoda
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 1aae1394294cb71c6aa0bc904a94a7f2f1e75936 upstream.
The commit 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area")
had added a usbhsg_pipe_disable() calling into
__usbhsg_ep_set_halt_wedge() accidentally. But, this driver should
not call the usbhsg_pipe_disable() because the function discards
all queues. So, this patch removes it.
Fixes: 97664a207bc2 ("usb: renesas_usbhs: shrink spin lock area")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1569924633-322-2-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/renesas_usbhs/mod_gadget.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -705,8 +705,6 @@ static int __usbhsg_ep_set_halt_wedge(st
struct device *dev = usbhsg_gpriv_to_dev(gpriv);
unsigned long flags;
- usbhsg_pipe_disable(uep);
-
dev_dbg(dev, "set halt %d (pipe %d)\n",
halt, usbhs_pipe_number(pipe));
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 032/136] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (30 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 031/136] usb: renesas_usbhs: gadget: Do not discard queues in usb_ep_set_{halt,wedge}() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 033/136] USB: usb-skeleton: fix runtime PM after driver unbind Ben Hutchings
` (104 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Yoshihiro Shimoda, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 4d599cd3a097a85a5c68a2c82b9a48cddf9953ec upstream.
According to usb_ep_set_halt()'s description,
__usbhsg_ep_set_halt_wedge() should return -EAGAIN if the IN endpoint
has any queue or data. Otherwise, this driver is possible to cause
just STALL without sending a short packet data on g_mass_storage driver,
and then a few resetting a device happens on a host side during
a usb enumaration.
Fixes: 2f98382dcdfe ("usb: renesas_usbhs: Add Renesas USBHS Gadget")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/1569924633-322-3-git-send-email-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/renesas_usbhs/common.h | 1 +
drivers/usb/renesas_usbhs/fifo.c | 2 +-
drivers/usb/renesas_usbhs/fifo.h | 1 +
drivers/usb/renesas_usbhs/mod_gadget.c | 16 +++++++++++++++-
drivers/usb/renesas_usbhs/pipe.c | 15 +++++++++++++++
drivers/usb/renesas_usbhs/pipe.h | 1 +
6 files changed, 34 insertions(+), 2 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.h
+++ b/drivers/usb/renesas_usbhs/common.h
@@ -207,6 +207,7 @@ struct usbhs_priv;
/* DCPCTR */
#define BSTS (1 << 15) /* Buffer Status */
#define SUREQ (1 << 14) /* Sending SETUP Token */
+#define INBUFM (1 << 14) /* (PIPEnCTR) Transfer Buffer Monitor */
#define CSSTS (1 << 12) /* CSSTS Status */
#define ACLRM (1 << 9) /* Buffer Auto-Clear Mode */
#define SQCLR (1 << 8) /* Toggle Bit Clear */
--- a/drivers/usb/renesas_usbhs/fifo.c
+++ b/drivers/usb/renesas_usbhs/fifo.c
@@ -100,7 +100,7 @@ static void __usbhsf_pkt_del(struct usbh
list_del_init(&pkt->node);
}
-static struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe)
{
if (list_empty(&pipe->list))
return NULL;
--- a/drivers/usb/renesas_usbhs/fifo.h
+++ b/drivers/usb/renesas_usbhs/fifo.h
@@ -98,5 +98,6 @@ void usbhs_pkt_push(struct usbhs_pipe *p
void *buf, int len, int zero, int sequence);
struct usbhs_pkt *usbhs_pkt_pop(struct usbhs_pipe *pipe, struct usbhs_pkt *pkt);
void usbhs_pkt_start(struct usbhs_pipe *pipe);
+struct usbhs_pkt *__usbhsf_pkt_get(struct usbhs_pipe *pipe);
#endif /* RENESAS_USB_FIFO_H */
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -704,6 +704,7 @@ static int __usbhsg_ep_set_halt_wedge(st
struct usbhs_priv *priv = usbhsg_gpriv_to_priv(gpriv);
struct device *dev = usbhsg_gpriv_to_dev(gpriv);
unsigned long flags;
+ int ret = 0;
dev_dbg(dev, "set halt %d (pipe %d)\n",
halt, usbhs_pipe_number(pipe));
@@ -711,6 +712,18 @@ static int __usbhsg_ep_set_halt_wedge(st
/******************** spin lock ********************/
usbhs_lock(priv, flags);
+ /*
+ * According to usb_ep_set_halt()'s description, this function should
+ * return -EAGAIN if the IN endpoint has any queue or data. Note
+ * that the usbhs_pipe_is_dir_in() returns false if the pipe is an
+ * IN endpoint in the gadget mode.
+ */
+ if (!usbhs_pipe_is_dir_in(pipe) && (__usbhsf_pkt_get(pipe) ||
+ usbhs_pipe_contains_transmittable_data(pipe))) {
+ ret = -EAGAIN;
+ goto out;
+ }
+
if (halt)
usbhs_pipe_stall(pipe);
else
@@ -721,10 +734,11 @@ static int __usbhsg_ep_set_halt_wedge(st
else
usbhsg_status_clr(gpriv, USBHSG_STATUS_WEDGE);
+out:
usbhs_unlock(priv, flags);
/******************** spin unlock ******************/
- return 0;
+ return ret;
}
static int usbhsg_ep_set_halt(struct usb_ep *ep, int value)
--- a/drivers/usb/renesas_usbhs/pipe.c
+++ b/drivers/usb/renesas_usbhs/pipe.c
@@ -263,6 +263,21 @@ int usbhs_pipe_is_accessible(struct usbh
return -EBUSY;
}
+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe)
+{
+ u16 val;
+
+ /* Do not support for DCP pipe */
+ if (usbhs_pipe_is_dcp(pipe))
+ return false;
+
+ val = usbhsp_pipectrl_get(pipe);
+ if (val & INBUFM)
+ return true;
+
+ return false;
+}
+
/*
* PID ctrl
*/
--- a/drivers/usb/renesas_usbhs/pipe.h
+++ b/drivers/usb/renesas_usbhs/pipe.h
@@ -85,6 +85,7 @@ void usbhs_pipe_init(struct usbhs_priv *
int usbhs_pipe_get_maxpacket(struct usbhs_pipe *pipe);
void usbhs_pipe_clear(struct usbhs_pipe *pipe);
int usbhs_pipe_is_accessible(struct usbhs_pipe *pipe);
+bool usbhs_pipe_contains_transmittable_data(struct usbhs_pipe *pipe);
void usbhs_pipe_enable(struct usbhs_pipe *pipe);
void usbhs_pipe_disable(struct usbhs_pipe *pipe);
void usbhs_pipe_stall(struct usbhs_pipe *pipe);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 033/136] USB: usb-skeleton: fix runtime PM after driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (31 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 032/136] usb: renesas_usbhs: gadget: Fix usb_ep_set_{halt,wedge}() behavior Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 034/136] USB: usblp: " Ben Hutchings
` (103 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 5c290a5e42c3387e82de86965784d30e6c5270fd upstream.
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate
interface PM usage counter") USB drivers must always balance their
runtime PM gets and puts, including when the driver has already been
unbound from the interface.
Leaving the interface with a positive PM usage counter would prevent a
later bound driver from suspending the device.
Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191001084908.2003-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/usb-skeleton.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -75,6 +75,7 @@ static void skel_delete(struct kref *kre
struct usb_skel *dev = to_skel_dev(kref);
usb_free_urb(dev->bulk_in_urb);
+ usb_put_intf(dev->interface);
usb_put_dev(dev->udev);
kfree(dev->bulk_in_buffer);
kfree(dev);
@@ -126,10 +127,7 @@ static int skel_release(struct inode *in
return -ENODEV;
/* allow the device to be autosuspended */
- mutex_lock(&dev->io_mutex);
- if (dev->interface)
- usb_autopm_put_interface(dev->interface);
- mutex_unlock(&dev->io_mutex);
+ usb_autopm_put_interface(dev->interface);
/* decrement the count on our device */
kref_put(&dev->kref, skel_delete);
@@ -511,7 +509,7 @@ static int skel_probe(struct usb_interfa
init_waitqueue_head(&dev->bulk_in_wait);
dev->udev = usb_get_dev(interface_to_usbdev(interface));
- dev->interface = interface;
+ dev->interface = usb_get_intf(interface);
/* set up the endpoint information */
/* use only the first bulk-in and bulk-out endpoints */
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 034/136] USB: usblp: fix runtime PM after driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (32 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 033/136] USB: usb-skeleton: fix runtime PM after driver unbind Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 035/136] USB: serial: " Ben Hutchings
` (102 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 9a31535859bfd8d1c3ed391f5e9247cd87bb7909 upstream.
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate
interface PM usage counter") USB drivers must always balance their
runtime PM gets and puts, including when the driver has already been
unbound from the interface.
Leaving the interface with a positive PM usage counter would prevent a
later bound driver from suspending the device.
Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191001084908.2003-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/class/usblp.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -463,10 +463,12 @@ static int usblp_release(struct inode *i
mutex_lock(&usblp_mutex);
usblp->used = 0;
- if (usblp->present) {
+ if (usblp->present)
usblp_unlink_urbs(usblp);
- usb_autopm_put_interface(usblp->intf);
- } else /* finish cleanup from disconnect */
+
+ usb_autopm_put_interface(usblp->intf);
+
+ if (!usblp->present) /* finish cleanup from disconnect */
usblp_cleanup(usblp);
mutex_unlock(&usblp_mutex);
return 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 035/136] USB: serial: fix runtime PM after driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (33 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 034/136] USB: usblp: " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 036/136] media: stkwebcam: " Ben Hutchings
` (101 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d51bdb93ca7e71d7fb30a572c7b47ed0194bf3fe upstream.
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate
interface PM usage counter") USB drivers must always balance their
runtime PM gets and puts, including when the driver has already been
unbound from the interface.
Leaving the interface with a positive PM usage counter would prevent a
later bound driver from suspending the device.
Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191001084908.2003-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/usb-serial.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -317,10 +317,7 @@ static void serial_cleanup(struct tty_st
serial = port->serial;
owner = serial->type->driver.owner;
- mutex_lock(&serial->disc_mutex);
- if (!serial->disconnected)
- usb_autopm_put_interface(serial->interface);
- mutex_unlock(&serial->disc_mutex);
+ usb_autopm_put_interface(serial->interface);
usb_serial_put(serial);
module_put(owner);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 036/136] media: stkwebcam: fix runtime PM after driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (34 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 035/136] USB: serial: " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 037/136] serial: uartlite: fix exit path null pointer Ben Hutchings
` (100 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Mauro Carvalho Chehab, Greg Kroah-Hartman,
Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 30045f2174aab7fb4db7a9cf902d0aa6c75856a7 upstream.
Since commit c2b71462d294 ("USB: core: Fix bug caused by duplicate
interface PM usage counter") USB drivers must always balance their
runtime PM gets and puts, including when the driver has already been
unbound from the interface.
Leaving the interface with a positive PM usage counter would prevent a
later bound driver from suspending the device.
Note that runtime PM has never actually been enabled for this driver
since the support_autosuspend flag in its usb_driver struct is not set.
Fixes: c2b71462d294 ("USB: core: Fix bug caused by duplicate interface PM usage counter")
Acked-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191001084908.2003-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/usb/stkwebcam/stk-webcam.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/usb/stkwebcam/stk-webcam.c
+++ b/drivers/media/usb/stkwebcam/stk-webcam.c
@@ -644,8 +644,7 @@ static int v4l_stk_release(struct file *
dev->owner = NULL;
}
- if (is_present(dev))
- usb_autopm_put_interface(dev->interface);
+ usb_autopm_put_interface(dev->interface);
mutex_unlock(&dev->lock);
return v4l2_fh_release(fp);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 037/136] serial: uartlite: fix exit path null pointer
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (35 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 036/136] media: stkwebcam: " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 038/136] net: ipv4: use a dedicated counter for icmp_v4 redirect packets Ben Hutchings
` (99 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Peter Korsgaard, Randy Dunlap
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
commit a553add0846f355a28ed4e81134012e4a1e280c2 upstream.
Call uart_unregister_driver() conditionally instead of
unconditionally, only if it has been previously registered.
This uses driver.state, just as the sh-sci.c driver does.
Fixes this null pointer dereference in tty_unregister_driver(),
since the 'driver' argument is null:
general protection fault: 0000 [#1] PREEMPT SMP KASAN PTI
RIP: 0010:tty_unregister_driver+0x25/0x1d0
Fixes: 238b8721a554 ("[PATCH] serial uartlite driver")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Peter Korsgaard <jacmet@sunsite.dk>
Link: https://lore.kernel.org/r/9c8e6581-6fcc-a595-0897-4d90f5d710df@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/tty/serial/uartlite.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/uartlite.c
+++ b/drivers/tty/serial/uartlite.c
@@ -708,7 +708,8 @@ err_uart:
static void __exit ulite_exit(void)
{
platform_driver_unregister(&ulite_platform_driver);
- uart_unregister_driver(&ulite_uart_driver);
+ if (ulite_uart_driver.state)
+ uart_unregister_driver(&ulite_uart_driver);
}
module_init(ulite_init);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 038/136] net: ipv4: use a dedicated counter for icmp_v4 redirect packets
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (36 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 037/136] serial: uartlite: fix exit path null pointer Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 039/136] net: ipv4: avoid mixed n_redirects and rate_tokens usage Ben Hutchings
` (98 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Lorenzo Bianconi, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
commit c09551c6ff7fe16a79a42133bcecba5fc2fc3291 upstream.
According to the algorithm described in the comment block at the
beginning of ip_rt_send_redirect, the host should try to send
'ip_rt_redirect_number' ICMP redirect packets with an exponential
backoff and then stop sending them at all assuming that the destination
ignores redirects.
If the device has previously sent some ICMP error packets that are
rate-limited (e.g TTL expired) and continues to receive traffic,
the redirect packets will never be transmitted. This happens since
peer->rate_tokens will be typically greater than 'ip_rt_redirect_number'
and so it will never be reset even if the redirect silence timeout
(ip_rt_redirect_silence) has elapsed without receiving any packet
requiring redirects.
Fix it by using a dedicated counter for the number of ICMP redirect
packets that has been sent by the host
I have not been able to identify a given commit that introduced the
issue since ip_rt_send_redirect implements the same rate-limiting
algorithm from commit 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context, indentation]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/inetpeer.h | 1 +
net/ipv4/inetpeer.c | 1 +
net/ipv4/route.c | 7 +++++--
3 files changed, 7 insertions(+), 2 deletions(-)
--- a/include/net/inetpeer.h
+++ b/include/net/inetpeer.h
@@ -35,6 +35,7 @@ struct inet_peer {
u32 metrics[RTAX_MAX];
u32 rate_tokens; /* rate limiting for ICMP */
+ u32 n_redirects;
unsigned long rate_last;
union {
struct list_head gc_list;
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -485,6 +485,7 @@ relookup:
atomic_set(&p->rid, 0);
p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW;
p->rate_tokens = 0;
+ p->n_redirects = 0;
/* 60*HZ is arbitrary, but chosen enough high so that the first
* calculation of tokens is at its maximum.
*/
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -872,13 +872,15 @@ void ip_rt_send_redirect(struct sk_buff
/* No redirected packets during ip_rt_redirect_silence;
* reset the algorithm.
*/
- if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence))
+ if (time_after(jiffies, peer->rate_last + ip_rt_redirect_silence)) {
peer->rate_tokens = 0;
+ peer->n_redirects = 0;
+ }
/* Too many ignored redirects; do not send anything
* set dst.rate_last to the last seen redirected packet.
*/
- if (peer->rate_tokens >= ip_rt_redirect_number) {
+ if (peer->n_redirects >= ip_rt_redirect_number) {
peer->rate_last = jiffies;
goto out_put_peer;
}
@@ -895,6 +897,7 @@ void ip_rt_send_redirect(struct sk_buff
icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
peer->rate_last = jiffies;
++peer->rate_tokens;
+ ++peer->n_redirects;
#ifdef CONFIG_IP_ROUTE_VERBOSE
if (log_martians &&
peer->rate_tokens == ip_rt_redirect_number)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 039/136] net: ipv4: avoid mixed n_redirects and rate_tokens usage
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (37 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 038/136] net: ipv4: use a dedicated counter for icmp_v4 redirect packets Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 040/136] sch_dsmark: fix potential NULL deref in dsmark_init() Ben Hutchings
` (97 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Paolo Abeni, Xiumei Mu,
Lorenzo Bianconi
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit b406472b5ad79ede8d10077f0c8f05505ace8b6d upstream.
Since commit c09551c6ff7f ("net: ipv4: use a dedicated counter
for icmp_v4 redirect packets") we use 'n_redirects' to account
for redirect packets, but we still use 'rate_tokens' to compute
the redirect packets exponential backoff.
If the device sent to the relevant peer any ICMP error packet
after sending a redirect, it will also update 'rate_token' according
to the leaking bucket schema; typically 'rate_token' will raise
above BITS_PER_LONG and the redirect packets backoff algorithm
will produce undefined behavior.
Fix the issue using 'n_redirects' to compute the exponential backoff
in ip_rt_send_redirect().
Note that we still clear rate_tokens after a redirect silence period,
to avoid changing an established behaviour.
The root cause predates git history; before the mentioned commit in
the critical scenario, the kernel stopped sending redirects, after
the mentioned commit the behavior more randomic.
Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: c09551c6ff7f ("net: ipv4: use a dedicated counter for icmp_v4 redirect packets")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/ipv4/route.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -891,16 +891,15 @@ void ip_rt_send_redirect(struct sk_buff
if (peer->rate_tokens == 0 ||
time_after(jiffies,
(peer->rate_last +
- (ip_rt_redirect_load << peer->rate_tokens)))) {
+ (ip_rt_redirect_load << peer->n_redirects)))) {
__be32 gw = rt_nexthop(rt, ip_hdr(skb)->daddr);
icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
peer->rate_last = jiffies;
- ++peer->rate_tokens;
++peer->n_redirects;
#ifdef CONFIG_IP_ROUTE_VERBOSE
if (log_martians &&
- peer->rate_tokens == ip_rt_redirect_number)
+ peer->n_redirects == ip_rt_redirect_number)
net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
&ip_hdr(skb)->saddr, inet_iif(skb),
&ip_hdr(skb)->daddr, &gw);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 040/136] sch_dsmark: fix potential NULL deref in dsmark_init()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (38 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 039/136] net: ipv4: avoid mixed n_redirects and rate_tokens usage Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 041/136] nfc: fix memory leak in llcp_sock_bind() Ben Hutchings
` (96 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Eric Dumazet, syzbot
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 474f0813a3002cb299bb73a5a93aa1f537a80ca8 upstream.
Make sure TCA_DSMARK_INDICES was provided by the user.
syzbot reported :
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8799 Comm: syz-executor235 Not tainted 5.3.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nla_get_u16 include/net/netlink.h:1501 [inline]
RIP: 0010:dsmark_init net/sched/sch_dsmark.c:364 [inline]
RIP: 0010:dsmark_init+0x193/0x640 net/sched/sch_dsmark.c:339
Code: 85 db 58 0f 88 7d 03 00 00 e8 e9 1a ac fb 48 8b 9d 70 ff ff ff 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 ca
RSP: 0018:ffff88809426f3b8 EFLAGS: 00010247
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff85c6eb09
RDX: 0000000000000000 RSI: ffffffff85c6eb17 RDI: 0000000000000004
RBP: ffff88809426f4b0 R08: ffff88808c4085c0 R09: ffffed1015d26159
R10: ffffed1015d26158 R11: ffff8880ae930ac7 R12: ffff8880a7e96940
R13: dffffc0000000000 R14: ffff88809426f8c0 R15: 0000000000000000
FS: 0000000001292880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000080 CR3: 000000008ca1b000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
qdisc_create+0x4ee/0x1210 net/sched/sch_api.c:1237
tc_modify_qdisc+0x524/0x1c50 net/sched/sch_api.c:1653
rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:5223
netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5241
netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328
netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:637 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:657
___sys_sendmsg+0x803/0x920 net/socket.c:2311
__sys_sendmsg+0x105/0x1d0 net/socket.c:2356
__do_sys_sendmsg net/socket.c:2365 [inline]
__se_sys_sendmsg net/socket.c:2363 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2363
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440369
Fixes: 758cc43c6d73 ("[PKT_SCHED]: Fix dsmark to apply changes consistent")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_dsmark.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -359,6 +359,8 @@ static int dsmark_init(struct Qdisc *sch
goto errout;
err = -EINVAL;
+ if (!tb[TCA_DSMARK_INDICES])
+ goto errout;
indices = nla_get_u16(tb[TCA_DSMARK_INDICES]);
if (hweight32(indices) != 1)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 041/136] nfc: fix memory leak in llcp_sock_bind()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (39 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 040/136] sch_dsmark: fix potential NULL deref in dsmark_init() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 042/136] CIFS: Gracefully handle QueryInfo errors during open Ben Hutchings
` (95 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Eric Dumazet, syzbot
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit a0c2dc1fe63e2869b74c1c7f6a81d1745c8a695d upstream.
sysbot reported a memory leak after a bind() has failed.
While we are at it, abort the operation if kmemdup() has failed.
BUG: memory leak
unreferenced object 0xffff888105d83ec0 (size 32):
comm "syz-executor067", pid 7207, jiffies 4294956228 (age 19.430s)
hex dump (first 32 bytes):
00 69 6c 65 20 72 65 61 64 00 6e 65 74 3a 5b 34 .ile read.net:[4
30 32 36 35 33 33 30 39 37 5d 00 00 00 00 00 00 026533097]......
backtrace:
[<0000000036bac473>] kmemleak_alloc_recursive /./include/linux/kmemleak.h:43 [inline]
[<0000000036bac473>] slab_post_alloc_hook /mm/slab.h:522 [inline]
[<0000000036bac473>] slab_alloc /mm/slab.c:3319 [inline]
[<0000000036bac473>] __do_kmalloc /mm/slab.c:3653 [inline]
[<0000000036bac473>] __kmalloc_track_caller+0x169/0x2d0 /mm/slab.c:3670
[<000000000cd39d07>] kmemdup+0x27/0x60 /mm/util.c:120
[<000000008e57e5fc>] kmemdup /./include/linux/string.h:432 [inline]
[<000000008e57e5fc>] llcp_sock_bind+0x1b3/0x230 /net/nfc/llcp_sock.c:107
[<000000009cb0b5d3>] __sys_bind+0x11c/0x140 /net/socket.c:1647
[<00000000492c3bbc>] __do_sys_bind /net/socket.c:1658 [inline]
[<00000000492c3bbc>] __se_sys_bind /net/socket.c:1656 [inline]
[<00000000492c3bbc>] __x64_sys_bind+0x1e/0x30 /net/socket.c:1656
[<0000000008704b2a>] do_syscall_64+0x76/0x1a0 /arch/x86/entry/common.c:296
[<000000009f4c57a4>] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Fixes: 30cc4587659e ("NFC: Move LLCP code to the NFC top level diirectory")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/nfc/llcp_sock.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -117,9 +117,14 @@ static int llcp_sock_bind(struct socket
llcp_sock->service_name = kmemdup(llcp_addr.service_name,
llcp_sock->service_name_len,
GFP_KERNEL);
-
+ if (!llcp_sock->service_name) {
+ ret = -ENOMEM;
+ goto put_dev;
+ }
llcp_sock->ssap = nfc_llcp_get_sdp_ssap(local, llcp_sock);
if (llcp_sock->ssap == LLCP_SAP_MAX) {
+ kfree(llcp_sock->service_name);
+ llcp_sock->service_name = NULL;
ret = -EADDRINUSE;
goto put_dev;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 042/136] CIFS: Gracefully handle QueryInfo errors during open
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (40 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 041/136] nfc: fix memory leak in llcp_sock_bind() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 043/136] panic: ensure preemption is disabled during panic() Ben Hutchings
` (94 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Steve French, Pavel Shilovsky, Pavel Shilovsky
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <piastryyy@gmail.com>
commit 30573a82fb179420b8aac30a3a3595aa96a93156 upstream.
Currently if the client identifies problems when processing
metadata returned in CREATE response, the open handle is being
leaked. This causes multiple problems like a file missing a lease
break by that client which causes high latencies to other clients
accessing the file. Another side-effect of this is that the file
can't be deleted.
Fix this by closing the file after the client hits an error after
the file was opened and the open descriptor wasn't returned to
the user space. Also convert -ESTALE to -EOPENSTALE to allow
the VFS to revalidate a dentry and retry the open.
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/file.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -253,6 +253,12 @@ cifs_nt_open(char *full_path, struct ino
rc = cifs_get_inode_info(&inode, full_path, buf, inode->i_sb,
xid, fid);
+ if (rc) {
+ server->ops->close(xid, tcon, fid);
+ if (rc == -ESTALE)
+ rc = -EOPENSTALE;
+ }
+
out:
kfree(buf);
return rc;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 043/136] panic: ensure preemption is disabled during panic()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (41 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 042/136] CIFS: Gracefully handle QueryInfo errors during open Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 044/136] llc: fix sk_buff leak in llc_sap_state_process() Ben Hutchings
` (93 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Ingo Molnar, Linus Torvalds, Russell King,
Greg Kroah-Hartman, Kees Cook, Feng Tang, Xogium, Petr Mladek,
Will Deacon
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will@kernel.org>
commit 20bb759a66be52cf4a9ddd17fddaf509e11490cd upstream.
Calling 'panic()' on a kernel with CONFIG_PREEMPT=y can leave the
calling CPU in an infinite loop, but with interrupts and preemption
enabled. From this state, userspace can continue to be scheduled,
despite the system being "dead" as far as the kernel is concerned.
This is easily reproducible on arm64 when booting with "nosmp" on the
command line; a couple of shell scripts print out a periodic "Ping"
message whilst another triggers a crash by writing to
/proc/sysrq-trigger:
| sysrq: Trigger a crash
| Kernel panic - not syncing: sysrq triggered crash
| CPU: 0 PID: 1 Comm: init Not tainted 5.2.15 #1
| Hardware name: linux,dummy-virt (DT)
| Call trace:
| dump_backtrace+0x0/0x148
| show_stack+0x14/0x20
| dump_stack+0xa0/0xc4
| panic+0x140/0x32c
| sysrq_handle_reboot+0x0/0x20
| __handle_sysrq+0x124/0x190
| write_sysrq_trigger+0x64/0x88
| proc_reg_write+0x60/0xa8
| __vfs_write+0x18/0x40
| vfs_write+0xa4/0x1b8
| ksys_write+0x64/0xf0
| __arm64_sys_write+0x14/0x20
| el0_svc_common.constprop.0+0xb0/0x168
| el0_svc_handler+0x28/0x78
| el0_svc+0x8/0xc
| Kernel Offset: disabled
| CPU features: 0x0002,24002004
| Memory Limit: none
| ---[ end Kernel panic - not syncing: sysrq triggered crash ]---
| Ping 2!
| Ping 1!
| Ping 1!
| Ping 2!
The issue can also be triggered on x86 kernels if CONFIG_SMP=n,
otherwise local interrupts are disabled in 'smp_send_stop()'.
Disable preemption in 'panic()' before re-enabling interrupts.
Link: http://lkml.kernel.org/r/20191002123538.22609-1-will@kernel.org
Link: https://lore.kernel.org/r/BX1W47JXPMR8.58IYW53H6M5N@dragonstone
Signed-off-by: Will Deacon <will@kernel.org>
Reported-by: Xogium <contact@xogium.me>
Reviewed-by: Kees Cook <keescook@chromium.org>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Feng Tang <feng.tang@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/panic.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -110,6 +110,7 @@ void panic(const char *fmt, ...)
* after the panic_lock is acquired) from invoking panic again.
*/
local_irq_disable();
+ preempt_disable_notrace();
/*
* It's possible to come here directly from a panic-assertion and
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 044/136] llc: fix sk_buff leak in llc_sap_state_process()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (42 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 043/136] panic: ensure preemption is disabled during panic() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 045/136] Fix to check Unique id and FileType when client refer file directly Ben Hutchings
` (92 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot+31c16aa4202dace3812e,
Jakub Kicinski, syzbot+6bf095f9becf5efef645, Eric Biggers
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit c6ee11c39fcc1fb55130748990a8f199e76263b4 upstream.
syzbot reported:
BUG: memory leak
unreferenced object 0xffff888116270800 (size 224):
comm "syz-executor641", pid 7047, jiffies 4294947360 (age 13.860s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 20 e1 2a 81 88 ff ff 00 40 3d 2a 81 88 ff ff . .*.....@=*....
backtrace:
[<000000004d41b4cc>] kmemleak_alloc_recursive include/linux/kmemleak.h:55 [inline]
[<000000004d41b4cc>] slab_post_alloc_hook mm/slab.h:439 [inline]
[<000000004d41b4cc>] slab_alloc_node mm/slab.c:3269 [inline]
[<000000004d41b4cc>] kmem_cache_alloc_node+0x153/0x2a0 mm/slab.c:3579
[<00000000506a5965>] __alloc_skb+0x6e/0x210 net/core/skbuff.c:198
[<000000001ba5a161>] alloc_skb include/linux/skbuff.h:1058 [inline]
[<000000001ba5a161>] alloc_skb_with_frags+0x5f/0x250 net/core/skbuff.c:5327
[<0000000047d9c78b>] sock_alloc_send_pskb+0x269/0x2a0 net/core/sock.c:2225
[<000000003828fe54>] sock_alloc_send_skb+0x32/0x40 net/core/sock.c:2242
[<00000000e34d94f9>] llc_ui_sendmsg+0x10a/0x540 net/llc/af_llc.c:933
[<00000000de2de3fb>] sock_sendmsg_nosec net/socket.c:652 [inline]
[<00000000de2de3fb>] sock_sendmsg+0x54/0x70 net/socket.c:671
[<000000008fe16e7a>] __sys_sendto+0x148/0x1f0 net/socket.c:1964
[...]
The bug is that llc_sap_state_process() always takes an extra reference
to the skb, but sometimes neither llc_sap_next_state() nor
llc_sap_state_process() itself drops this reference.
Fix it by changing llc_sap_next_state() to never consume a reference to
the skb, rather than sometimes do so and sometimes not. Then remove the
extra skb_get() and kfree_skb() from llc_sap_state_process().
Reported-by: syzbot+6bf095f9becf5efef645@syzkaller.appspotmail.com
Reported-by: syzbot+31c16aa4202dace3812e@syzkaller.appspotmail.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/llc/llc_s_ac.c | 12 +++++++++---
net/llc/llc_sap.c | 23 ++++++++---------------
2 files changed, 17 insertions(+), 18 deletions(-)
--- a/net/llc/llc_s_ac.c
+++ b/net/llc/llc_s_ac.c
@@ -58,8 +58,10 @@ int llc_sap_action_send_ui(struct llc_sa
ev->daddr.lsap, LLC_PDU_CMD);
llc_pdu_init_as_ui_cmd(skb);
rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
- if (likely(!rc))
+ if (likely(!rc)) {
+ skb_get(skb);
rc = dev_queue_xmit(skb);
+ }
return rc;
}
@@ -81,8 +83,10 @@ int llc_sap_action_send_xid_c(struct llc
ev->daddr.lsap, LLC_PDU_CMD);
llc_pdu_init_as_xid_cmd(skb, LLC_XID_NULL_CLASS_2, 0);
rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
- if (likely(!rc))
+ if (likely(!rc)) {
+ skb_get(skb);
rc = dev_queue_xmit(skb);
+ }
return rc;
}
@@ -135,8 +139,10 @@ int llc_sap_action_send_test_c(struct ll
ev->daddr.lsap, LLC_PDU_CMD);
llc_pdu_init_as_test_cmd(skb);
rc = llc_mac_hdr_init(skb, ev->saddr.mac, ev->daddr.mac);
- if (likely(!rc))
+ if (likely(!rc)) {
+ skb_get(skb);
rc = dev_queue_xmit(skb);
+ }
return rc;
}
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -197,29 +197,22 @@ out:
* After executing actions of the event, upper layer will be indicated
* if needed(on receiving an UI frame). sk can be null for the
* datalink_proto case.
+ *
+ * This function always consumes a reference to the skb.
*/
static void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
{
struct llc_sap_state_ev *ev = llc_sap_ev(skb);
- /*
- * We have to hold the skb, because llc_sap_next_state
- * will kfree it in the sending path and we need to
- * look at the skb->cb, where we encode llc_sap_state_ev.
- */
- skb_get(skb);
ev->ind_cfm_flag = 0;
llc_sap_next_state(sap, skb);
- if (ev->ind_cfm_flag == LLC_IND) {
- if (skb->sk->sk_state == TCP_LISTEN)
- kfree_skb(skb);
- else {
- llc_save_primitive(skb->sk, skb, ev->prim);
- /* queue skb to the user. */
- if (sock_queue_rcv_skb(skb->sk, skb))
- kfree_skb(skb);
- }
+ if (ev->ind_cfm_flag == LLC_IND && skb->sk->sk_state != TCP_LISTEN) {
+ llc_save_primitive(skb->sk, skb, ev->prim);
+
+ /* queue skb to the user. */
+ if (sock_queue_rcv_skb(skb->sk, skb) == 0)
+ return;
}
kfree_skb(skb);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 045/136] Fix to check Unique id and FileType when client refer file directly.
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (43 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 044/136] llc: fix sk_buff leak in llc_sap_state_process() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 046/136] cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary Ben Hutchings
` (91 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Nakajima Akira, Steve French, Shirish Pargaonkar
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nakajima Akira <nakajima.akira@nttcom.co.jp>
commit 7196ac113a4f38b7ca1a3282fd9edf328bd22287 upstream.
When you refer file directly on cifs client,
(e.g. ls -li <filename>, cd <dir>, stat <filename>)
the function return old inode number and filetype from old inode cache,
though server has different inode number or filetype.
When server is Windows, cifs client has same problem.
When Server is Windows
, This patch fixes bug in different filetype,
but does not fix bug in different inode number.
Because QUERY_PATH_INFO response by Windows does not include inode number(Index Number) .
BUG INFO
https://bugzilla.kernel.org/show_bug.cgi?id=90021
https://bugzilla.kernel.org/show_bug.cgi?id=90031
Reported-by: Nakajima Akira <nakajima.akira@nttcom.co.jp>
Signed-off-by: Nakajima Akira <nakajima.akira@nttcom.co.jp>
Reviewed-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/inode.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -401,9 +401,25 @@ int cifs_get_inode_info_unix(struct inod
rc = -ENOMEM;
} else {
/* we already have inode, update it */
+
+ /* if uniqueid is different, return error */
+ if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
+ CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) {
+ rc = -ESTALE;
+ goto cgiiu_exit;
+ }
+
+ /* if filetype is different, return error */
+ if (unlikely(((*pinode)->i_mode & S_IFMT) !=
+ (fattr.cf_mode & S_IFMT))) {
+ rc = -ESTALE;
+ goto cgiiu_exit;
+ }
+
cifs_fattr_to_inode(*pinode, &fattr);
}
+cgiiu_exit:
return rc;
}
@@ -839,6 +855,15 @@ cifs_get_inode_info(struct inode **inode
if (!*inode)
rc = -ENOMEM;
} else {
+ /* we already have inode, update it */
+
+ /* if filetype is different, return error */
+ if (unlikely(((*inode)->i_mode & S_IFMT) !=
+ (fattr.cf_mode & S_IFMT))) {
+ rc = -ESTALE;
+ goto cgii_exit;
+ }
+
cifs_fattr_to_inode(*inode, &fattr);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 046/136] cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (44 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 045/136] Fix to check Unique id and FileType when client refer file directly Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 047/136] CIFS: Force revalidate inode when dentry is stale Ben Hutchings
` (90 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Steve French, Ross Lagerwall
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Ross Lagerwall <ross.lagerwall@citrix.com>
commit a108471b5730b52017e73b58c9f486319d2ac308 upstream.
Commit 7196ac113a4f ("Fix to check Unique id and FileType when client
refer file directly.") checks whether the uniqueid of an inode has
changed when getting the inode info, but only when using the UNIX
extensions. Add a similar check for SMB2+, since this can be done
without an extra network roundtrip.
Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Signed-off-by: Steve French <smfrench@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/inode.c | 24 ++++++++++++++++++++++--
1 file changed, 22 insertions(+), 2 deletions(-)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -815,8 +815,21 @@ cifs_get_inode_info(struct inode **inode
}
} else
fattr.cf_uniqueid = iunique(sb, ROOT_I);
- } else
- fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid;
+ } else {
+ if ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM) &&
+ validinum == false && server->ops->get_srv_inum) {
+ /*
+ * Pass a NULL tcon to ensure we don't make a round
+ * trip to the server. This only works for SMB2+.
+ */
+ tmprc = server->ops->get_srv_inum(xid,
+ NULL, cifs_sb, full_path,
+ &fattr.cf_uniqueid, data);
+ if (tmprc)
+ fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid;
+ } else
+ fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid;
+ }
/* query for SFU type info if supported and needed */
if (fattr.cf_cifsattrs & ATTR_SYSTEM &&
@@ -857,6 +870,13 @@ cifs_get_inode_info(struct inode **inode
} else {
/* we already have inode, update it */
+ /* if uniqueid is different, return error */
+ if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
+ CIFS_I(*inode)->uniqueid != fattr.cf_uniqueid)) {
+ rc = -ESTALE;
+ goto cgii_exit;
+ }
+
/* if filetype is different, return error */
if (unlikely(((*inode)->i_mode & S_IFMT) !=
(fattr.cf_mode & S_IFMT))) {
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 047/136] CIFS: Force revalidate inode when dentry is stale
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (45 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 046/136] cifs: Check uniqueid for SMB2+ and return -ESTALE if necessary Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 048/136] CIFS: Force reval dentry if LOOKUP_REVAL flag is set Ben Hutchings
` (89 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Steve French, Pavel Shilovsky, Pavel Shilovsky
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <piastryyy@gmail.com>
commit c82e5ac7fe3570a269c0929bf7899f62048e7dbc upstream.
Currently the client indicates that a dentry is stale when inode
numbers or type types between a local inode and a remote file
don't match. If this is the case attributes is not being copied
from remote to local, so, it is already known that the local copy
has stale metadata. That's why the inode needs to be marked for
revalidation in order to tell the VFS to lookup the dentry again
before openning a file. This prevents unexpected stale errors
to be returned to the user space when openning a file.
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/inode.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -405,6 +405,7 @@ int cifs_get_inode_info_unix(struct inod
/* if uniqueid is different, return error */
if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
CIFS_I(*pinode)->uniqueid != fattr.cf_uniqueid)) {
+ CIFS_I(*pinode)->time = 0; /* force reval */
rc = -ESTALE;
goto cgiiu_exit;
}
@@ -412,6 +413,7 @@ int cifs_get_inode_info_unix(struct inod
/* if filetype is different, return error */
if (unlikely(((*pinode)->i_mode & S_IFMT) !=
(fattr.cf_mode & S_IFMT))) {
+ CIFS_I(*pinode)->time = 0; /* force reval */
rc = -ESTALE;
goto cgiiu_exit;
}
@@ -873,6 +875,7 @@ cifs_get_inode_info(struct inode **inode
/* if uniqueid is different, return error */
if (unlikely(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SERVER_INUM &&
CIFS_I(*inode)->uniqueid != fattr.cf_uniqueid)) {
+ CIFS_I(*inode)->time = 0; /* force reval */
rc = -ESTALE;
goto cgii_exit;
}
@@ -880,6 +883,7 @@ cifs_get_inode_info(struct inode **inode
/* if filetype is different, return error */
if (unlikely(((*inode)->i_mode & S_IFMT) !=
(fattr.cf_mode & S_IFMT))) {
+ CIFS_I(*inode)->time = 0; /* force reval */
rc = -ESTALE;
goto cgii_exit;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 048/136] CIFS: Force reval dentry if LOOKUP_REVAL flag is set
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (46 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 047/136] CIFS: Force revalidate inode when dentry is stale Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 049/136] memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' Ben Hutchings
` (88 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Steve French, Pavel Shilovsky, Pavel Shilovsky
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <piastryyy@gmail.com>
commit 0b3d0ef9840f7be202393ca9116b857f6f793715 upstream.
Mark inode for force revalidation if LOOKUP_REVAL flag is set.
This tells the client to actually send a QueryInfo request to
the server to obtain the latest metadata in case a directory
or a file were changed remotely. Only do that if the client
doesn't have a lease for the file to avoid unneeded round
trips to the server.
Signed-off-by: Pavel Shilovsky <pshilov@microsoft.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/dir.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -817,10 +817,16 @@ lookup_out:
static int
cifs_d_revalidate(struct dentry *direntry, unsigned int flags)
{
+ struct inode *inode;
+
if (flags & LOOKUP_RCU)
return -ECHILD;
if (direntry->d_inode) {
+ inode = d_inode(direntry);
+ if ((flags & LOOKUP_REVAL) && !CIFS_CACHE_READ(CIFS_I(inode)))
+ CIFS_I(inode)->time = 0; /* force reval */
+
if (cifs_revalidate_dentry(direntry))
return 0;
else {
@@ -831,7 +837,7 @@ cifs_d_revalidate(struct dentry *direntr
* attributes will have been updated by
* cifs_revalidate_dentry().
*/
- if (IS_AUTOMOUNT(direntry->d_inode) &&
+ if (IS_AUTOMOUNT(inode) &&
!(direntry->d_flags & DCACHE_NEED_AUTOMOUNT)) {
spin_lock(&direntry->d_lock);
direntry->d_flags |= DCACHE_NEED_AUTOMOUNT;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 049/136] memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()'
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (47 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 048/136] CIFS: Force reval dentry if LOOKUP_REVAL flag is set Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 050/136] sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision Ben Hutchings
` (87 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Christophe JAILLET, Ulf Hansson
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 28c9fac09ab0147158db0baeec630407a5e9b892 upstream.
If 'jmb38x_ms_count_slots()' returns 0, we must undo the previous
'pci_request_regions()' call.
Goto 'err_out_int' to fix it.
Fixes: 60fdd931d577 ("memstick: add support for JMicron jmb38x MemoryStick host controller")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/memstick/host/jmb38x_ms.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/memstick/host/jmb38x_ms.c
+++ b/drivers/memstick/host/jmb38x_ms.c
@@ -947,7 +947,7 @@ static int jmb38x_ms_probe(struct pci_de
if (!cnt) {
rc = -ENODEV;
pci_dev_busy = 1;
- goto err_out;
+ goto err_out_int;
}
jm = kzalloc(sizeof(struct jmb38x_ms)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 050/136] sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (48 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 049/136] memstick: jmb38x_ms: Fix an error handling path in 'jmb38x_ms_probe()' Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 051/136] ARM: mm: fix alignment handler faults under memory pressure Ben Hutchings
` (86 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Xuewei Zhang, Steven Rostedt, Ingo Molnar,
Mel Gorman, Phil Auld, Linus Torvalds, Dietmar Eggemann,
Vincent Guittot, Thomas Gleixner, Ben Segall, Juri Lelli,
Peter Zijlstra (Intel),
Anton Blanchard
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Xuewei Zhang <xueweiz@google.com>
commit 4929a4e6faa0f13289a67cae98139e727f0d4a97 upstream.
The quota/period ratio is used to ensure a child task group won't get
more bandwidth than the parent task group, and is calculated as:
normalized_cfs_quota() = [(quota_us << 20) / period_us]
If the quota/period ratio was changed during this scaling due to
precision loss, it will cause inconsistency between parent and child
task groups.
See below example:
A userspace container manager (kubelet) does three operations:
1) Create a parent cgroup, set quota to 1,000us and period to 10,000us.
2) Create a few children cgroups.
3) Set quota to 1,000us and period to 10,000us on a child cgroup.
These operations are expected to succeed. However, if the scaling of
147/128 happens before step 3, quota and period of the parent cgroup
will be changed:
new_quota: 1148437ns, 1148us
new_period: 11484375ns, 11484us
And when step 3 comes in, the ratio of the child cgroup will be
104857, which will be larger than the parent cgroup ratio (104821),
and will fail.
Scaling them by a factor of 2 will fix the problem.
Tested-by: Phil Auld <pauld@redhat.com>
Signed-off-by: Xuewei Zhang <xueweiz@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Phil Auld <pauld@redhat.com>
Cc: Anton Blanchard <anton@ozlabs.org>
Cc: Ben Segall <bsegall@google.com>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Fixes: 2e8e19226398 ("sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup")
Link: https://lkml.kernel.org/r/20191004001243.140897-1-xueweiz@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/sched/fair.c | 36 ++++++++++++++++++++++--------------
1 file changed, 22 insertions(+), 14 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3753,20 +3753,28 @@ static enum hrtimer_restart sched_cfs_pe
if (++count > 3) {
u64 new, old = ktime_to_ns(cfs_b->period);
- new = (old * 147) / 128; /* ~115% */
- new = min(new, max_cfs_quota_period);
+ /*
+ * Grow period by a factor of 2 to avoid losing precision.
+ * Precision loss in the quota/period ratio can cause __cfs_schedulable
+ * to fail.
+ */
+ new = old * 2;
+ if (new < max_cfs_quota_period) {
+ cfs_b->period = ns_to_ktime(new);
+ cfs_b->quota *= 2;
- cfs_b->period = ns_to_ktime(new);
-
- /* since max is 1s, this is limited to 1e9^2, which fits in u64 */
- cfs_b->quota *= new;
- cfs_b->quota = div64_u64(cfs_b->quota, old);
-
- pr_warn_ratelimited(
- "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n",
- smp_processor_id(),
- div_u64(new, NSEC_PER_USEC),
- div_u64(cfs_b->quota, NSEC_PER_USEC));
+ pr_warn_ratelimited(
+ "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us = %lld, cfs_quota_us = %lld)\n",
+ smp_processor_id(),
+ div_u64(new, NSEC_PER_USEC),
+ div_u64(cfs_b->quota, NSEC_PER_USEC));
+ } else {
+ pr_warn_ratelimited(
+ "cfs_period_timer[cpu%d]: period too short, but cannot scale up without losing precision (cfs_period_us = %lld, cfs_quota_us = %lld)\n",
+ smp_processor_id(),
+ div_u64(old, NSEC_PER_USEC),
+ div_u64(cfs_b->quota, NSEC_PER_USEC));
+ }
/* reset count so we don't come right back in here */
count = 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 051/136] ARM: mm: fix alignment handler faults under memory pressure
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (49 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 050/136] sched/fair: Scale bandwidth quota and period without losing quota/period ratio precision Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 052/136] USB: usb-skeleton: fix NULL-deref on disconnect Ben Hutchings
` (85 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Jing Xiangfeng, Russell King
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit 67e15fa5b487adb9b78a92789eeff2d6ec8f5cee upstream.
When the system has high memory pressure, the page containing the
instruction may be paged out. Using probe_kernel_address() means that
if the page is swapped out, the resulting page fault will not be
handled because page faults are disabled by this function.
Use get_user() to read the instruction instead.
Reported-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Fixes: b255188f90e2 ("ARM: fix scheduling while atomic warning in alignment handling code")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arm/mm/alignment.c | 44 +++++++++++++++++++++++++++++++++--------
1 file changed, 36 insertions(+), 8 deletions(-)
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -746,6 +746,36 @@ do_alignment_t32_to_handler(unsigned lon
return NULL;
}
+static int alignment_get_arm(struct pt_regs *regs, u32 *ip, unsigned long *inst)
+{
+ u32 instr = 0;
+ int fault;
+
+ if (user_mode(regs))
+ fault = get_user(instr, ip);
+ else
+ fault = probe_kernel_address(ip, instr);
+
+ *inst = __mem_to_opcode_arm(instr);
+
+ return fault;
+}
+
+static int alignment_get_thumb(struct pt_regs *regs, u16 *ip, u16 *inst)
+{
+ u16 instr = 0;
+ int fault;
+
+ if (user_mode(regs))
+ fault = get_user(instr, ip);
+ else
+ fault = probe_kernel_address(ip, instr);
+
+ *inst = __mem_to_opcode_thumb16(instr);
+
+ return fault;
+}
+
static int
do_alignment(unsigned long addr, unsigned int fsr, struct pt_regs *regs)
{
@@ -753,10 +783,10 @@ do_alignment(unsigned long addr, unsigne
unsigned long instr = 0, instrptr;
int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs *regs);
unsigned int type;
- unsigned int fault;
u16 tinstr = 0;
int isize = 4;
int thumb2_32b = 0;
+ int fault;
if (interrupts_enabled(regs))
local_irq_enable();
@@ -765,15 +795,14 @@ do_alignment(unsigned long addr, unsigne
if (thumb_mode(regs)) {
u16 *ptr = (u16 *)(instrptr & ~1);
- fault = probe_kernel_address(ptr, tinstr);
- tinstr = __mem_to_opcode_thumb16(tinstr);
+
+ fault = alignment_get_thumb(regs, ptr, &tinstr);
if (!fault) {
if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
IS_T32(tinstr)) {
/* Thumb-2 32-bit */
- u16 tinst2 = 0;
- fault = probe_kernel_address(ptr + 1, tinst2);
- tinst2 = __mem_to_opcode_thumb16(tinst2);
+ u16 tinst2;
+ fault = alignment_get_thumb(regs, ptr + 1, &tinst2);
instr = __opcode_thumb32_compose(tinstr, tinst2);
thumb2_32b = 1;
} else {
@@ -782,8 +811,7 @@ do_alignment(unsigned long addr, unsigne
}
}
} else {
- fault = probe_kernel_address(instrptr, instr);
- instr = __mem_to_opcode_arm(instr);
+ fault = alignment_get_arm(regs, (void *)instrptr, &instr);
}
if (fault) {
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 052/136] USB: usb-skeleton: fix NULL-deref on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (50 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 051/136] ARM: mm: fix alignment handler faults under memory pressure Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 053/136] USB: legousbtower: fix use-after-free on release Ben Hutchings
` (84 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit bed5ef230943863b9abf5eae226a20fad9a8ff71 upstream.
The driver was using its struct usb_interface pointer as an inverted
disconnected flag and was setting it to NULL before making sure all
completion handlers had run. This could lead to NULL-pointer
dereferences in the dev_err() statements in the completion handlers
which relies on said pointer.
Fix this by using a dedicated disconnected flag.
Note that this is also addresses a NULL-pointer dereference at release()
and a struct usb_interface reference leak introduced by a recent runtime
PM fix, which depends on and should have been submitted together with
this patch.
Fixes: 4212cd74ca6f ("USB: usb-skeleton.c: remove err() usage")
Fixes: 5c290a5e42c3 ("USB: usb-skeleton: fix runtime PM after driver unbind")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009170944.30057-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/usb-skeleton.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/usb/usb-skeleton.c
+++ b/drivers/usb/usb-skeleton.c
@@ -63,6 +63,7 @@ struct usb_skel {
spinlock_t err_lock; /* lock for errors */
struct kref kref;
struct mutex io_mutex; /* synchronize I/O with disconnect */
+ unsigned long disconnected:1;
wait_queue_head_t bulk_in_wait; /* to wait for an ongoing read */
};
#define to_skel_dev(d) container_of(d, struct usb_skel, kref)
@@ -239,7 +240,7 @@ static ssize_t skel_read(struct file *fi
if (rv < 0)
return rv;
- if (!dev->interface) { /* disconnect() was called */
+ if (dev->disconnected) { /* disconnect() was called */
rv = -ENODEV;
goto exit;
}
@@ -420,7 +421,7 @@ static ssize_t skel_write(struct file *f
/* this lock makes sure we don't submit URBs to gone devices */
mutex_lock(&dev->io_mutex);
- if (!dev->interface) { /* disconnect() was called */
+ if (dev->disconnected) { /* disconnect() was called */
mutex_unlock(&dev->io_mutex);
retval = -ENODEV;
goto error;
@@ -588,7 +589,7 @@ static void skel_disconnect(struct usb_i
/* prevent more I/O from starting */
mutex_lock(&dev->io_mutex);
- dev->interface = NULL;
+ dev->disconnected = 1;
mutex_unlock(&dev->io_mutex);
usb_kill_anchored_urbs(&dev->submitted);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 053/136] USB: legousbtower: fix use-after-free on release
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (51 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 052/136] USB: usb-skeleton: fix NULL-deref on disconnect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 054/136] USB: ldusb: fix NULL-derefs on driver unbind Ben Hutchings
` (83 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 726b55d0e22ca72c69c947af87785c830289ddbc upstream.
The driver was accessing its struct usb_device in its release()
callback without holding a reference. This would lead to a
use-after-free whenever the device was disconnected while the character
device was still open.
Fixes: fef526cae700 ("USB: legousbtower: remove custom debug macro")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009153848.8664-5-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -302,6 +302,7 @@ static inline void tower_delete (struct
kfree (dev->read_buffer);
kfree (dev->interrupt_in_buffer);
kfree (dev->interrupt_out_buffer);
+ usb_put_dev(dev->udev);
kfree (dev);
}
@@ -820,7 +821,7 @@ static int tower_probe (struct usb_inter
mutex_init(&dev->lock);
- dev->udev = udev;
+ dev->udev = usb_get_dev(udev);
dev->open_count = 0;
dev->disconnected = 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 054/136] USB: ldusb: fix NULL-derefs on driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (52 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 053/136] USB: legousbtower: fix use-after-free on release Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 055/136] USB: adutux: fix use-after-free on release Ben Hutchings
` (82 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 58ecf131e74620305175a7aa103f81350bb37570 upstream.
The driver was using its struct usb_interface pointer as an inverted
disconnected flag, but was setting it to NULL before making sure all
completion handlers had run. This could lead to a NULL-pointer
dereference in a number of dev_dbg, dev_warn and dev_err statements in
the completion handlers which relies on said pointer.
Fix this by unconditionally stopping all I/O and preventing
resubmissions by poisoning the interrupt URBs at disconnect and using a
dedicated disconnected flag.
This also makes sure that all I/O has completed by the time the
disconnect callback returns.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009153848.8664-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/ldusb.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -168,6 +168,7 @@ MODULE_PARM_DESC(min_interrupt_out_inter
struct ld_usb {
struct mutex mutex; /* locks this structure */
struct usb_interface* intf; /* save off the usb interface pointer */
+ unsigned long disconnected:1;
int open_count; /* number of times this port has been opened */
@@ -207,12 +208,10 @@ static void ld_usb_abort_transfers(struc
/* shutdown transfer */
if (dev->interrupt_in_running) {
dev->interrupt_in_running = 0;
- if (dev->intf)
- usb_kill_urb(dev->interrupt_in_urb);
+ usb_kill_urb(dev->interrupt_in_urb);
}
if (dev->interrupt_out_busy)
- if (dev->intf)
- usb_kill_urb(dev->interrupt_out_urb);
+ usb_kill_urb(dev->interrupt_out_urb);
}
/**
@@ -220,8 +219,6 @@ static void ld_usb_abort_transfers(struc
*/
static void ld_usb_delete(struct ld_usb *dev)
{
- ld_usb_abort_transfers(dev);
-
/* free data structures */
usb_free_urb(dev->interrupt_in_urb);
usb_free_urb(dev->interrupt_out_urb);
@@ -277,7 +274,7 @@ static void ld_usb_interrupt_in_callback
resubmit:
/* resubmit if we're still running */
- if (dev->interrupt_in_running && !dev->buffer_overflow && dev->intf) {
+ if (dev->interrupt_in_running && !dev->buffer_overflow) {
retval = usb_submit_urb(dev->interrupt_in_urb, GFP_ATOMIC);
if (retval) {
dev_err(&dev->intf->dev,
@@ -406,7 +403,7 @@ static int ld_usb_release(struct inode *
retval = -ENODEV;
goto unlock_exit;
}
- if (dev->intf == NULL) {
+ if (dev->disconnected) {
/* the device was unplugged before the file was released */
mutex_unlock(&dev->mutex);
/* unlock here as ld_usb_delete frees dev */
@@ -437,7 +434,7 @@ static unsigned int ld_usb_poll(struct f
dev = file->private_data;
- if (!dev->intf)
+ if (dev->disconnected)
return POLLERR | POLLHUP;
poll_wait(file, &dev->read_wait, wait);
@@ -476,7 +473,7 @@ static ssize_t ld_usb_read(struct file *
}
/* verify that the device wasn't unplugged */
- if (dev->intf == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
goto unlock_exit;
@@ -556,7 +553,7 @@ static ssize_t ld_usb_write(struct file
}
/* verify that the device wasn't unplugged */
- if (dev->intf == NULL) {
+ if (dev->disconnected) {
retval = -ENODEV;
printk(KERN_ERR "ldusb: No device or device unplugged %d\n", retval);
goto unlock_exit;
@@ -792,6 +789,9 @@ static void ld_usb_disconnect(struct usb
/* give back our minor */
usb_deregister_dev(intf, &ld_usb_class);
+ usb_poison_urb(dev->interrupt_in_urb);
+ usb_poison_urb(dev->interrupt_out_urb);
+
mutex_lock(&dev->mutex);
/* if the device is not opened, then we clean up right now */
@@ -799,7 +799,7 @@ static void ld_usb_disconnect(struct usb
mutex_unlock(&dev->mutex);
ld_usb_delete(dev);
} else {
- dev->intf = NULL;
+ dev->disconnected = 1;
/* wake up pollers */
wake_up_interruptible_all(&dev->read_wait);
wake_up_interruptible_all(&dev->write_wait);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 055/136] USB: adutux: fix use-after-free on release
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (53 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 054/136] USB: ldusb: fix NULL-derefs on driver unbind Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 056/136] USB: iowarrior: " Ben Hutchings
` (81 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 123a0f125fa3d2104043697baa62899d9e549272 upstream.
The driver was accessing its struct usb_device in its release()
callback without holding a reference. This would lead to a
use-after-free whenever the device was disconnected while the character
device was still open.
Fixes: 66d4bc30d128 ("USB: adutux: remove custom debug macro")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009153848.8664-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/adutux.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/adutux.c
+++ b/drivers/usb/misc/adutux.c
@@ -152,6 +152,7 @@ static void adu_delete(struct adu_device
kfree(dev->read_buffer_secondary);
kfree(dev->interrupt_in_buffer);
kfree(dev->interrupt_out_buffer);
+ usb_put_dev(dev->udev);
kfree(dev);
}
@@ -677,7 +678,7 @@ static int adu_probe(struct usb_interfac
mutex_init(&dev->mtx);
spin_lock_init(&dev->buflock);
- dev->udev = udev;
+ dev->udev = usb_get_dev(udev);
init_waitqueue_head(&dev->read_wait);
init_waitqueue_head(&dev->write_wait);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 056/136] USB: iowarrior: fix use-after-free on release
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (54 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 055/136] USB: adutux: fix use-after-free on release Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 057/136] USB: iowarrior: fix use-after-free after driver unbind Ben Hutchings
` (80 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 80cd5479b525093a56ef768553045741af61b250 upstream.
The driver was accessing its struct usb_interface from its release()
callback without holding a reference. This would lead to a
use-after-free whenever debugging was enabled and the device was
disconnected while its character device was open.
Fixes: 549e83500b80 ("USB: iowarrior: Convert local dbg macro to dev_dbg")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009104846.5925-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/iowarrior.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -248,6 +248,7 @@ static inline void iowarrior_delete(stru
kfree(dev->int_in_buffer);
usb_free_urb(dev->int_in_urb);
kfree(dev->read_queue);
+ usb_put_intf(dev->interface);
kfree(dev);
}
@@ -782,7 +783,7 @@ static int iowarrior_probe(struct usb_in
init_waitqueue_head(&dev->write_wait);
dev->udev = udev;
- dev->interface = interface;
+ dev->interface = usb_get_intf(interface);
iface_desc = interface->cur_altsetting;
dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 057/136] USB: iowarrior: fix use-after-free after driver unbind
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (55 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 056/136] USB: iowarrior: " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 058/136] USB: yurex: fix NULL-derefs on disconnect Ben Hutchings
` (79 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b5f8d46867ca233d773408ffbe691a8062ed718f upstream.
Make sure to stop also the asynchronous write URBs on disconnect() to
avoid use-after-free in the completion handler after driver unbind.
Fixes: 946b960d13c1 ("USB: add driver for iowarrior devices.")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009104846.5925-4-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/iowarrior.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/misc/iowarrior.c
+++ b/drivers/usb/misc/iowarrior.c
@@ -89,6 +89,7 @@ struct iowarrior {
char chip_serial[9]; /* the serial number string of the chip connected */
int report_size; /* number of bytes in a report */
u16 product_id;
+ struct usb_anchor submitted;
};
/*--------------*/
@@ -437,11 +438,13 @@ static ssize_t iowarrior_write(struct fi
retval = -EFAULT;
goto error;
}
+ usb_anchor_urb(int_out_urb, &dev->submitted);
retval = usb_submit_urb(int_out_urb, GFP_KERNEL);
if (retval) {
dev_dbg(&dev->interface->dev,
"submit error %d for urb nr.%d\n",
retval, atomic_read(&dev->write_busy));
+ usb_unanchor_urb(int_out_urb);
goto error;
}
/* submit was ok */
@@ -788,6 +791,8 @@ static int iowarrior_probe(struct usb_in
iface_desc = interface->cur_altsetting;
dev->product_id = le16_to_cpu(udev->descriptor.idProduct);
+ init_usb_anchor(&dev->submitted);
+
/* set up the endpoint information */
for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) {
endpoint = &iface_desc->endpoint[i].desc;
@@ -917,6 +922,7 @@ static void iowarrior_disconnect(struct
Deleting the device is postponed until close() was called.
*/
usb_kill_urb(dev->int_in_urb);
+ usb_kill_anchored_urbs(&dev->submitted);
wake_up_interruptible(&dev->read_wait);
wake_up_interruptible(&dev->write_wait);
mutex_unlock(&dev->mutex);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 058/136] USB: yurex: fix NULL-derefs on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (56 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 057/136] USB: iowarrior: fix use-after-free after driver unbind Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 059/136] tracing: Get trace_array reference for available_tracers files Ben Hutchings
` (78 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit aafb00a977cf7d81821f7c9d12e04c558c22dc3c upstream.
The driver was using its struct usb_interface pointer as an inverted
disconnected flag, but was setting it to NULL without making sure all
code paths that used it were done with it.
Before commit ef61eb43ada6 ("USB: yurex: Fix protection fault after
device removal") this included the interrupt-in completion handler, but
there are further accesses in dev_err and dev_dbg statements in
yurex_write() and the driver-data destructor (sic!).
Fix this by unconditionally stopping also the control URB at disconnect
and by using a dedicated disconnected flag.
Note that we need to take a reference to the struct usb_interface to
avoid a use-after-free in the destructor whenever the device was
disconnected while the character device was still open.
Fixes: aadd6472d904 ("USB: yurex.c: remove dbg() usage")
Fixes: 45714104b9e8 ("USB: yurex.c: remove err() usage")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191009153848.8664-6-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/yurex.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -64,6 +64,7 @@ struct usb_yurex {
struct kref kref;
struct mutex io_mutex;
+ unsigned long disconnected:1;
struct fasync_struct *async_queue;
wait_queue_head_t waitq;
@@ -111,6 +112,7 @@ static void yurex_delete(struct kref *kr
dev->int_buffer, dev->urb->transfer_dma);
usb_free_urb(dev->urb);
}
+ usb_put_intf(dev->interface);
usb_put_dev(dev->udev);
kfree(dev);
}
@@ -211,7 +213,7 @@ static int yurex_probe(struct usb_interf
init_waitqueue_head(&dev->waitq);
dev->udev = usb_get_dev(interface_to_usbdev(interface));
- dev->interface = interface;
+ dev->interface = usb_get_intf(interface);
/* set up the endpoint information */
iface_desc = interface->cur_altsetting;
@@ -334,8 +336,9 @@ static void yurex_disconnect(struct usb_
/* prevent more I/O from starting */
usb_poison_urb(dev->urb);
+ usb_poison_urb(dev->cntl_urb);
mutex_lock(&dev->io_mutex);
- dev->interface = NULL;
+ dev->disconnected = 1;
mutex_unlock(&dev->io_mutex);
/* wakeup waiters */
@@ -422,7 +425,7 @@ static ssize_t yurex_read(struct file *f
dev = (struct usb_yurex *)file->private_data;
mutex_lock(&dev->io_mutex);
- if (!dev->interface) { /* already disconnected */
+ if (dev->disconnected) { /* already disconnected */
mutex_unlock(&dev->io_mutex);
return -ENODEV;
}
@@ -453,7 +456,7 @@ static ssize_t yurex_write(struct file *
goto error;
mutex_lock(&dev->io_mutex);
- if (!dev->interface) { /* already disconnected */
+ if (dev->disconnected) { /* already disconnected */
mutex_unlock(&dev->io_mutex);
retval = -ENODEV;
goto error;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 059/136] tracing: Get trace_array reference for available_tracers files
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (57 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 058/136] USB: yurex: fix NULL-derefs on disconnect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 060/136] batman-adv: iv_ogm_iface_enable, direct return values Ben Hutchings
` (77 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Steven Rostedt (VMware)
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
commit 194c2c74f5532e62c218adeb8e2b683119503907 upstream.
As instances may have different tracers available, we need to look at the
trace_array descriptor that shows the list of the available tracers for the
instance. But there's a race between opening the file and an admin
deleting the instance. The trace_array_get() needs to be called before
accessing the trace_array.
Fixes: 607e2ea167e56 ("tracing: Set up infrastructure to allow tracers for instances")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
kernel/trace/trace.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3311,9 +3311,14 @@ static int show_traces_open(struct inode
if (tracing_disabled)
return -ENODEV;
+ if (trace_array_get(tr) < 0)
+ return -ENODEV;
+
ret = seq_open(file, &show_traces_seq_ops);
- if (ret)
+ if (ret) {
+ trace_array_put(tr);
return ret;
+ }
m = file->private_data;
m->private = tr;
@@ -3321,6 +3326,14 @@ static int show_traces_open(struct inode
return 0;
}
+static int show_traces_release(struct inode *inode, struct file *file)
+{
+ struct trace_array *tr = inode->i_private;
+
+ trace_array_put(tr);
+ return seq_release(inode, file);
+}
+
static ssize_t
tracing_write_stub(struct file *filp, const char __user *ubuf,
size_t count, loff_t *ppos)
@@ -3351,8 +3364,8 @@ static const struct file_operations trac
static const struct file_operations show_traces_fops = {
.open = show_traces_open,
.read = seq_read,
- .release = seq_release,
.llseek = seq_lseek,
+ .release = show_traces_release,
};
/*
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 060/136] batman-adv: iv_ogm_iface_enable, direct return values
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (58 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 059/136] tracing: Get trace_array reference for available_tracers files Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 061/136] batman-adv: Avoid free/alloc race when handling OGM buffer Ben Hutchings
` (76 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Markus Pargmann, Marek Lindner
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Markus Pargmann <mpa@pengutronix.de>
commit 42d9f2cbd42e1ba137584da8305cf6f68b84f39d upstream.
Directly return error values. No need to use a return variable.
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
[bwh: Backported to 3.16 as dependency of commit 40e220b4218b
"batman-adv: Avoid free/alloc race when handling OGM buffer"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/batman-adv/bat_iv_ogm.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -307,7 +307,6 @@ static int batadv_iv_ogm_iface_enable(st
struct batadv_ogm_packet *batadv_ogm_packet;
unsigned char *ogm_buff;
uint32_t random_seqno;
- int res = -ENOMEM;
/* randomize initial seqno to avoid collision */
get_random_bytes(&random_seqno, sizeof(random_seqno));
@@ -316,7 +315,7 @@ static int batadv_iv_ogm_iface_enable(st
hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
if (!ogm_buff)
- goto out;
+ return -ENOMEM;
hard_iface->bat_iv.ogm_buff = ogm_buff;
@@ -328,10 +327,7 @@ static int batadv_iv_ogm_iface_enable(st
batadv_ogm_packet->reserved = 0;
batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
- res = 0;
-
-out:
- return res;
+ return 0;
}
static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 061/136] batman-adv: Avoid free/alloc race when handling OGM buffer
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (59 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 060/136] batman-adv: iv_ogm_iface_enable, direct return values Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 062/136] parisc: Fix vmap memory leak in ioremap()/iounmap() Ben Hutchings
` (75 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot+0cc629f19ccb8534935b,
Simon Wunderlich, Sven Eckelmann
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Sven Eckelmann <sven@narfation.org>
commit 40e220b4218bb3d278e5e8cc04ccdfd1c7ff8307 upstream.
Each slave interface of an B.A.T.M.A.N. IV virtual interface has an OGM
packet buffer which is initialized using data from netdevice notifier and
other rtnetlink related hooks. It is sent regularly via various slave
interfaces of the batadv virtual interface and in this process also
modified (realloced) to integrate additional state information via TVLV
containers.
It must be avoided that the worker item is executed without a common lock
with the netdevice notifier/rtnetlink helpers. Otherwise it can either
happen that half modified/freed data is sent out or functions modifying the
OGM buffer try to access already freed memory regions.
Reported-by: syzbot+0cc629f19ccb8534935b@syzkaller.appspotmail.com
Fixes: c6c8fea29769 ("net: Add batman-adv meshing protocol")
Signed-off-by: Sven Eckelmann <sven@narfation.org>
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
[bwh: Backported to 3.16:
- Don't add status check in batadv_iv_ogm_schedule()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -26,6 +26,8 @@
#include "bat_algo.h"
#include "network-coding.h"
+#include <linux/lockdep.h>
+#include <linux/mutex.h>
/**
* batadv_dup_status - duplicate status
@@ -308,14 +310,18 @@ static int batadv_iv_ogm_iface_enable(st
unsigned char *ogm_buff;
uint32_t random_seqno;
+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
/* randomize initial seqno to avoid collision */
get_random_bytes(&random_seqno, sizeof(random_seqno));
atomic_set(&hard_iface->bat_iv.ogm_seqno, random_seqno);
hard_iface->bat_iv.ogm_buff_len = BATADV_OGM_HLEN;
ogm_buff = kmalloc(hard_iface->bat_iv.ogm_buff_len, GFP_ATOMIC);
- if (!ogm_buff)
+ if (!ogm_buff) {
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
return -ENOMEM;
+ }
hard_iface->bat_iv.ogm_buff = ogm_buff;
@@ -327,36 +333,60 @@ static int batadv_iv_ogm_iface_enable(st
batadv_ogm_packet->reserved = 0;
batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+
return 0;
}
static void batadv_iv_ogm_iface_disable(struct batadv_hard_iface *hard_iface)
{
+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
kfree(hard_iface->bat_iv.ogm_buff);
hard_iface->bat_iv.ogm_buff = NULL;
+
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
}
static void batadv_iv_ogm_iface_update_mac(struct batadv_hard_iface *hard_iface)
{
struct batadv_ogm_packet *batadv_ogm_packet;
- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+ void *ogm_buff;
- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+ ogm_buff = hard_iface->bat_iv.ogm_buff;
+ if (!ogm_buff)
+ goto unlock;
+
+ batadv_ogm_packet = ogm_buff;
ether_addr_copy(batadv_ogm_packet->orig,
hard_iface->net_dev->dev_addr);
ether_addr_copy(batadv_ogm_packet->prev_sender,
hard_iface->net_dev->dev_addr);
+
+unlock:
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
}
static void
batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
{
struct batadv_ogm_packet *batadv_ogm_packet;
- unsigned char *ogm_buff = hard_iface->bat_iv.ogm_buff;
+ void *ogm_buff;
- batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+
+ ogm_buff = hard_iface->bat_iv.ogm_buff;
+ if (!ogm_buff)
+ goto unlock;
+
+ batadv_ogm_packet = ogm_buff;
batadv_ogm_packet->flags = BATADV_PRIMARIES_FIRST_HOP;
batadv_ogm_packet->ttl = BATADV_TTL;
+
+unlock:
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
}
/* when do we schedule our own ogm to be sent */
@@ -891,7 +921,11 @@ batadv_iv_ogm_slide_own_bcast_window(str
}
}
-static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+/**
+ * batadv_iv_ogm_schedule_buff() - schedule submission of hardif ogm buffer
+ * @hard_iface: interface whose ogm buffer should be transmitted
+ */
+static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface)
{
struct batadv_priv *bat_priv = netdev_priv(hard_iface->soft_iface);
unsigned char **ogm_buff = &hard_iface->bat_iv.ogm_buff;
@@ -902,6 +936,8 @@ static void batadv_iv_ogm_schedule(struc
uint16_t tvlv_len = 0;
unsigned long send_time;
+ lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex);
+
primary_if = batadv_primary_if_get_selected(bat_priv);
if (hard_iface == primary_if) {
@@ -1560,6 +1596,13 @@ out:
kfree_skb(skb_priv);
}
+static void batadv_iv_ogm_schedule(struct batadv_hard_iface *hard_iface)
+{
+ mutex_lock(&hard_iface->bat_iv.ogm_buff_mutex);
+ batadv_iv_ogm_schedule_buff(hard_iface);
+ mutex_unlock(&hard_iface->bat_iv.ogm_buff_mutex);
+}
+
/**
* batadv_iv_ogm_process - process an incoming batman iv OGM
* @skb: the skb containing the OGM
--- a/net/batman-adv/hard-interface.c
+++ b/net/batman-adv/hard-interface.c
@@ -31,6 +31,7 @@
#include <linux/if_arp.h>
#include <linux/if_ether.h>
+#include <linux/mutex.h>
void batadv_hardif_free_rcu(struct rcu_head *rcu)
{
@@ -591,6 +592,7 @@ batadv_hardif_add_interface(struct net_d
INIT_WORK(&hard_iface->cleanup_work,
batadv_hardif_remove_interface_finish);
+ mutex_init(&hard_iface->bat_iv.ogm_buff_mutex);
hard_iface->num_bcasts = BATADV_NUM_BCASTS_DEFAULT;
if (batadv_is_wifi_netdev(net_dev))
hard_iface->num_bcasts = BATADV_NUM_BCASTS_WIRELESS;
--- a/net/batman-adv/types.h
+++ b/net/batman-adv/types.h
@@ -68,6 +68,9 @@ struct batadv_hard_iface_bat_iv {
unsigned char *ogm_buff;
int ogm_buff_len;
atomic_t ogm_seqno;
+
+ /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */
+ struct mutex ogm_buff_mutex;
};
/**
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 062/136] parisc: Fix vmap memory leak in ioremap()/iounmap()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (60 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 061/136] batman-adv: Avoid free/alloc race when handling OGM buffer Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 063/136] mm/slub: fix a deadlock in show_slab_objects() Ben Hutchings
` (74 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Helge Deller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 513f7f747e1cba81f28a436911fba0b485878ebd upstream.
Sven noticed that calling ioremap() and iounmap() multiple times leads
to a vmap memory leak:
vmap allocation for size 4198400 failed:
use vmalloc=<size> to increase size
It seems we missed calling vunmap() in iounmap().
Signed-off-by: Helge Deller <deller@gmx.de>
Noticed-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/parisc/mm/ioremap.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/arch/parisc/mm/ioremap.c
+++ b/arch/parisc/mm/ioremap.c
@@ -2,7 +2,7 @@
* arch/parisc/mm/ioremap.c
*
* (C) Copyright 1995 1996 Linus Torvalds
- * (C) Copyright 2001-2006 Helge Deller <deller@gmx.de>
+ * (C) Copyright 2001-2019 Helge Deller <deller@gmx.de>
* (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
*/
@@ -83,7 +83,7 @@ void __iomem * __ioremap(unsigned long p
addr = (void __iomem *) area->addr;
if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
phys_addr, pgprot)) {
- vfree(addr);
+ vunmap(addr);
return NULL;
}
@@ -91,9 +91,11 @@ void __iomem * __ioremap(unsigned long p
}
EXPORT_SYMBOL(__ioremap);
-void iounmap(const volatile void __iomem *addr)
+void iounmap(const volatile void __iomem *io_addr)
{
- if (addr > high_memory)
- return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
+ unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
+
+ if (is_vmalloc_addr((void *)addr))
+ vunmap((void *)addr);
}
EXPORT_SYMBOL(iounmap);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 063/136] mm/slub: fix a deadlock in show_slab_objects()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (61 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 062/136] parisc: Fix vmap memory leak in ioremap()/iounmap() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 064/136] xtensa: drop EXPORT_SYMBOL for outs*/ins* Ben Hutchings
` (73 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Pekka Enberg, Roman Gushchin,
Vladimir Davydov, Qian Cai, Michal Hocko, David Rientjes,
Joonsoo Kim, Linus Torvalds, Tejun Heo, Christoph Lameter
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Qian Cai <cai@lca.pw>
commit e4f8e513c3d353c134ad4eef9fd0bba12406c7c8 upstream.
A long time ago we fixed a similar deadlock in show_slab_objects() [1].
However, it is apparently due to the commits like 01fb58bcba63 ("slab:
remove synchronous synchronize_sched() from memcg cache deactivation
path") and 03afc0e25f7f ("slab: get_online_mems for
kmem_cache_{create,destroy,shrink}"), this kind of deadlock is back by
just reading files in /sys/kernel/slab which will generate a lockdep
splat below.
Since the "mem_hotplug_lock" here is only to obtain a stable online node
mask while racing with NUMA node hotplug, in the worst case, the results
may me miscalculated while doing NUMA node hotplug, but they shall be
corrected by later reads of the same files.
WARNING: possible circular locking dependency detected
------------------------------------------------------
cat/5224 is trying to acquire lock:
ffff900012ac3120 (mem_hotplug_lock.rw_sem){++++}, at:
show_slab_objects+0x94/0x3a8
but task is already holding lock:
b8ff009693eee398 (kn->count#45){++++}, at: kernfs_seq_start+0x44/0xf0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (kn->count#45){++++}:
lock_acquire+0x31c/0x360
__kernfs_remove+0x290/0x490
kernfs_remove+0x30/0x44
sysfs_remove_dir+0x70/0x88
kobject_del+0x50/0xb0
sysfs_slab_unlink+0x2c/0x38
shutdown_cache+0xa0/0xf0
kmemcg_cache_shutdown_fn+0x1c/0x34
kmemcg_workfn+0x44/0x64
process_one_work+0x4f4/0x950
worker_thread+0x390/0x4bc
kthread+0x1cc/0x1e8
ret_from_fork+0x10/0x18
-> #1 (slab_mutex){+.+.}:
lock_acquire+0x31c/0x360
__mutex_lock_common+0x16c/0xf78
mutex_lock_nested+0x40/0x50
memcg_create_kmem_cache+0x38/0x16c
memcg_kmem_cache_create_func+0x3c/0x70
process_one_work+0x4f4/0x950
worker_thread+0x390/0x4bc
kthread+0x1cc/0x1e8
ret_from_fork+0x10/0x18
-> #0 (mem_hotplug_lock.rw_sem){++++}:
validate_chain+0xd10/0x2bcc
__lock_acquire+0x7f4/0xb8c
lock_acquire+0x31c/0x360
get_online_mems+0x54/0x150
show_slab_objects+0x94/0x3a8
total_objects_show+0x28/0x34
slab_attr_show+0x38/0x54
sysfs_kf_seq_show+0x198/0x2d4
kernfs_seq_show+0xa4/0xcc
seq_read+0x30c/0x8a8
kernfs_fop_read+0xa8/0x314
__vfs_read+0x88/0x20c
vfs_read+0xd8/0x10c
ksys_read+0xb0/0x120
__arm64_sys_read+0x54/0x88
el0_svc_handler+0x170/0x240
el0_svc+0x8/0xc
other info that might help us debug this:
Chain exists of:
mem_hotplug_lock.rw_sem --> slab_mutex --> kn->count#45
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(kn->count#45);
lock(slab_mutex);
lock(kn->count#45);
lock(mem_hotplug_lock.rw_sem);
*** DEADLOCK ***
3 locks held by cat/5224:
#0: 9eff00095b14b2a0 (&p->lock){+.+.}, at: seq_read+0x4c/0x8a8
#1: 0eff008997041480 (&of->mutex){+.+.}, at: kernfs_seq_start+0x34/0xf0
#2: b8ff009693eee398 (kn->count#45){++++}, at:
kernfs_seq_start+0x44/0xf0
stack backtrace:
Call trace:
dump_backtrace+0x0/0x248
show_stack+0x20/0x2c
dump_stack+0xd0/0x140
print_circular_bug+0x368/0x380
check_noncircular+0x248/0x250
validate_chain+0xd10/0x2bcc
__lock_acquire+0x7f4/0xb8c
lock_acquire+0x31c/0x360
get_online_mems+0x54/0x150
show_slab_objects+0x94/0x3a8
total_objects_show+0x28/0x34
slab_attr_show+0x38/0x54
sysfs_kf_seq_show+0x198/0x2d4
kernfs_seq_show+0xa4/0xcc
seq_read+0x30c/0x8a8
kernfs_fop_read+0xa8/0x314
__vfs_read+0x88/0x20c
vfs_read+0xd8/0x10c
ksys_read+0xb0/0x120
__arm64_sys_read+0x54/0x88
el0_svc_handler+0x170/0x240
el0_svc+0x8/0xc
I think it is important to mention that this doesn't expose the
show_slab_objects to use-after-free. There is only a single path that
might really race here and that is the slab hotplug notifier callback
__kmem_cache_shrink (via slab_mem_going_offline_callback) but that path
doesn't really destroy kmem_cache_node data structures.
[1] http://lkml.iu.edu/hypermail/linux/kernel/1101.0/02850.html
[akpm@linux-foundation.org: add comment explaining why we don't need mem_hotplug_lock]
Link: http://lkml.kernel.org/r/1570192309-10132-1-git-send-email-cai@lca.pw
Fixes: 01fb58bcba63 ("slab: remove synchronous synchronize_sched() from memcg cache deactivation path")
Fixes: 03afc0e25f7f ("slab: get_online_mems for kmem_cache_{create,destroy,shrink}")
Signed-off-by: Qian Cai <cai@lca.pw>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/slub.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4329,7 +4329,17 @@ static ssize_t show_slab_objects(struct
}
}
- get_online_mems();
+ /*
+ * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
+ * already held which will conflict with an existing lock order:
+ *
+ * mem_hotplug_lock->slab_mutex->kernfs_mutex
+ *
+ * We don't really need mem_hotplug_lock (to hold off
+ * slab_mem_going_offline_callback) here because slab's memory hot
+ * unplug code doesn't destroy the kmem_cache->node[] data.
+ */
+
#ifdef CONFIG_SLUB_DEBUG
if (flags & SO_ALL) {
for_each_node_state(node, N_NORMAL_MEMORY) {
@@ -4369,7 +4379,6 @@ static ssize_t show_slab_objects(struct
x += sprintf(buf + x, " N%d=%lu",
node, nodes[node]);
#endif
- put_online_mems();
kfree(nodes);
return x + sprintf(buf + x, "\n");
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 064/136] xtensa: drop EXPORT_SYMBOL for outs*/ins*
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (62 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 063/136] mm/slub: fix a deadlock in show_slab_objects() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 065/136] ceph: just skip unrecognized info in ceph_reply_info_extra Ben Hutchings
` (72 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Max Filippov
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 8b39da985194aac2998dd9e3a22d00b596cebf1e upstream.
Custom outs*/ins* implementations are long gone from the xtensa port,
remove matching EXPORT_SYMBOLs.
This fixes the following build warnings issued by modpost since commit
15bfc2348d54 ("modpost: check for static EXPORT_SYMBOL* functions"):
WARNING: "insb" [vmlinux] is a static EXPORT_SYMBOL
WARNING: "insw" [vmlinux] is a static EXPORT_SYMBOL
WARNING: "insl" [vmlinux] is a static EXPORT_SYMBOL
WARNING: "outsb" [vmlinux] is a static EXPORT_SYMBOL
WARNING: "outsw" [vmlinux] is a static EXPORT_SYMBOL
WARNING: "outsl" [vmlinux] is a static EXPORT_SYMBOL
Fixes: d38efc1f150f ("xtensa: adopt generic io routines")
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/xtensa/kernel/xtensa_ksyms.c | 7 -------
1 file changed, 7 deletions(-)
--- a/arch/xtensa/kernel/xtensa_ksyms.c
+++ b/arch/xtensa/kernel/xtensa_ksyms.c
@@ -114,13 +114,6 @@ EXPORT_SYMBOL(__invalidate_icache_range)
// FIXME EXPORT_SYMBOL(screen_info);
#endif
-EXPORT_SYMBOL(outsb);
-EXPORT_SYMBOL(outsw);
-EXPORT_SYMBOL(outsl);
-EXPORT_SYMBOL(insb);
-EXPORT_SYMBOL(insw);
-EXPORT_SYMBOL(insl);
-
extern long common_exception_return;
EXPORT_SYMBOL(common_exception_return);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 065/136] ceph: just skip unrecognized info in ceph_reply_info_extra
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (63 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 064/136] xtensa: drop EXPORT_SYMBOL for outs*/ins* Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 066/136] USB: ldusb: fix memleak on disconnect Ben Hutchings
` (71 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Jeff Layton, Ilya Dryomov
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
commit 1d3f87233e26362fc3d4e59f0f31a71b570f90b9 upstream.
In the future, we're going to want to extend the ceph_reply_info_extra
for create replies. Currently though, the kernel code doesn't accept an
extra blob that is larger than the expected data.
Change the code to skip over any unrecognized fields at the end of the
extra blob, rather than returning -EIO.
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ceph/mds_client.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -199,8 +199,8 @@ static int parse_reply_info_dir(void **p
}
done:
- if (*p != end)
- goto bad;
+ /* Skip over any unrecognized fields */
+ *p = end;
return 0;
bad:
@@ -221,12 +221,10 @@ static int parse_reply_info_filelock(voi
goto bad;
info->filelock_reply = *p;
- *p += sizeof(*info->filelock_reply);
- if (unlikely(*p != end))
- goto bad;
+ /* Skip over any unrecognized fields */
+ *p = end;
return 0;
-
bad:
return -EIO;
}
@@ -239,18 +237,21 @@ static int parse_reply_info_create(void
u64 features)
{
if (features & CEPH_FEATURE_REPLY_CREATE_INODE) {
+ /* Malformed reply? */
if (*p == end) {
info->has_create_ino = false;
} else {
info->has_create_ino = true;
- info->ino = ceph_decode_64(p);
+ ceph_decode_64_safe(p, end, info->ino, bad);
}
+ } else {
+ if (*p != end)
+ goto bad;
}
- if (unlikely(*p != end))
- goto bad;
+ /* Skip over any unrecognized fields */
+ *p = end;
return 0;
-
bad:
return -EIO;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 066/136] USB: ldusb: fix memleak on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (64 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 065/136] ceph: just skip unrecognized info in ceph_reply_info_extra Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 067/136] USB: legousbtower: " Ben Hutchings
` (70 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b14a39048c1156cfee76228bf449852da2f14df8 upstream.
If disconnect() races with release() after a process has been
interrupted, release() could end up returning early and the driver would
fail to free its driver data.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191010125835.27031-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/ldusb.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -394,10 +394,7 @@ static int ld_usb_release(struct inode *
goto exit;
}
- if (mutex_lock_interruptible(&dev->mutex)) {
- retval = -ERESTARTSYS;
- goto exit;
- }
+ mutex_lock(&dev->mutex);
if (dev->open_count != 1) {
retval = -ENODEV;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 067/136] USB: legousbtower: fix memleak on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (65 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 066/136] USB: ldusb: fix memleak on disconnect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 068/136] USB: legousbtower: fix a signedness bug in tower_probe() Ben Hutchings
` (69 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit b6c03e5f7b463efcafd1ce141bd5a8fc4e583ae2 upstream.
If disconnect() races with release() after a process has been
interrupted, release() could end up returning early and the driver would
fail to free its driver data.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191010125835.27031-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -425,10 +425,7 @@ static int tower_release (struct inode *
goto exit;
}
- if (mutex_lock_interruptible(&dev->lock)) {
- retval = -ERESTARTSYS;
- goto exit;
- }
+ mutex_lock(&dev->lock);
if (dev->open_count != 1) {
dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 068/136] USB: legousbtower: fix a signedness bug in tower_probe()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (66 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 067/136] USB: legousbtower: " Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 069/136] usb: udc: lpc32xx: fix bad bit shift operation Ben Hutchings
` (68 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold, Dan Carpenter
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit fd47a417e75e2506eb3672ae569b1c87e3774155 upstream.
The problem is that sizeof() is unsigned long so negative error codes
are type promoted to high positive values and the condition becomes
false.
Fixes: 1d427be4a39d ("USB: legousbtower: fix slab info leak at probe")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191011141115.GA4521@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/legousbtower.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/legousbtower.c
+++ b/drivers/usb/misc/legousbtower.c
@@ -910,7 +910,7 @@ static int tower_probe (struct usb_inter
get_version_reply,
sizeof(*get_version_reply),
1000);
- if (result < sizeof(*get_version_reply)) {
+ if (result != sizeof(*get_version_reply)) {
if (result >= 0)
result = -EIO;
dev_err(idev, "get version request failed: %d\n", result);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 069/136] usb: udc: lpc32xx: fix bad bit shift operation
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (67 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 068/136] USB: legousbtower: fix a signedness bug in tower_probe() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 070/136] USB: usblp: fix use-after-free on disconnect Ben Hutchings
` (67 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Gustavo A. R. Silva
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
commit b987b66ac3a2bc2f7b03a0ba48a07dc553100c07 upstream.
It seems that the right variable to use in this case is *i*, instead of
*n*, otherwise there is an undefined behavior when right shifiting by more
than 31 bits when multiplying n by 8; notice that *n* can take values
equal or greater than 4 (4, 8, 16, ...).
Also, notice that under the current conditions (bl = 3), we are skiping
the handling of bytes 3, 7, 31... So, fix this by updating this logic
and limit *bl* up to 4 instead of up to 3.
This fix is based on function udc_stuff_fifo().
Addresses-Coverity-ID: 1454834 ("Bad bit shift operation")
Fixes: 24a28e428351 ("USB: gadget driver for LPC32xx")
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Link: https://lore.kernel.org/r/20191014191830.GA10721@embeddedor
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/gadget/lpc32xx_udc.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/usb/gadget/lpc32xx_udc.c
+++ b/drivers/usb/gadget/lpc32xx_udc.c
@@ -1228,11 +1228,11 @@ static void udc_pop_fifo(struct lpc32xx_
tmp = readl(USBD_RXDATA(udc->udp_baseaddr));
bl = bytes - n;
- if (bl > 3)
- bl = 3;
+ if (bl > 4)
+ bl = 4;
for (i = 0; i < bl; i++)
- data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF);
+ data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF);
}
break;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 070/136] USB: usblp: fix use-after-free on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (68 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 069/136] usb: udc: lpc32xx: fix bad bit shift operation Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 071/136] PCI: PM: Fix pci_power_up() Ben Hutchings
` (66 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold,
syzbot+cd24df4d075c319ebfc5
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7a759197974894213621aa65f0571b51904733d6 upstream.
A recent commit addressing a runtime PM use-count regression, introduced
a use-after-free by not making sure we held a reference to the struct
usb_interface for the lifetime of the driver data.
Fixes: 9a31535859bf ("USB: usblp: fix runtime PM after driver unbind")
Reported-by: syzbot+cd24df4d075c319ebfc5@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191015175522.18490-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/class/usblp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/usb/class/usblp.c
+++ b/drivers/usb/class/usblp.c
@@ -447,6 +447,7 @@ static void usblp_cleanup(struct usblp *
kfree(usblp->readbuf);
kfree(usblp->device_id_string);
kfree(usblp->statusbuf);
+ usb_put_intf(usblp->intf);
kfree(usblp);
}
@@ -1104,7 +1105,7 @@ static int usblp_probe(struct usb_interf
init_waitqueue_head(&usblp->wwait);
init_usb_anchor(&usblp->urbs);
usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
- usblp->intf = intf;
+ usblp->intf = usb_get_intf(intf);
/* Malloc device ID string buffer to the largest expected length,
* since we can re-query it on an ioctl and a dynamic string
@@ -1193,6 +1194,7 @@ abort:
kfree(usblp->readbuf);
kfree(usblp->statusbuf);
kfree(usblp->device_id_string);
+ usb_put_intf(usblp->intf);
kfree(usblp);
abort_ret:
return retval;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 071/136] PCI: PM: Fix pci_power_up()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (69 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 070/136] USB: usblp: fix use-after-free on disconnect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 072/136] net: avoid potential infinite loop in tc_ctl_action() Ben Hutchings
` (65 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Daniel Drake, Rafael J. Wysocki, Bjorn Helgaas
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "Rafael J. Wysocki" <rafael.j.wysocki@intel.com>
commit 45144d42f299455911cc29366656c7324a3a7c97 upstream.
There is an arbitrary difference between the system resume and
runtime resume code paths for PCI devices regarding the delay to
apply when switching the devices from D3cold to D0.
Namely, pci_restore_standard_config() used in the runtime resume
code path calls pci_set_power_state() which in turn invokes
__pci_start_power_transition() to power up the device through the
platform firmware and that function applies the transition delay
(as per PCI Express Base Specification Revision 2.0, Section 6.6.1).
However, pci_pm_default_resume_early() used in the system resume
code path calls pci_power_up() which doesn't apply the delay at
all and that causes issues to occur during resume from
suspend-to-idle on some systems where the delay is required.
Since there is no reason for that difference to exist, modify
pci_power_up() to follow pci_set_power_state() more closely and
invoke __pci_start_power_transition() from there to call the
platform firmware to power up the device (in case that's necessary).
Fixes: db288c9c5f9d ("PCI / PM: restore the original behavior of pci_set_power_state()")
Reported-by: Daniel Drake <drake@endlessm.com>
Tested-by: Daniel Drake <drake@endlessm.com>
Link: https://lore.kernel.org/linux-pm/CAD8Lp44TYxrMgPLkHCqF9hv6smEurMXvmmvmtyFhZ6Q4SE+dig@mail.gmail.com/T/#m21be74af263c6a34f36e0fc5c77c5449d9406925
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/pci/pci.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -657,19 +657,6 @@ void pci_update_current_state(struct pci
}
/**
- * pci_power_up - Put the given device into D0 forcibly
- * @dev: PCI device to power up
- */
-void pci_power_up(struct pci_dev *dev)
-{
- if (platform_pci_power_manageable(dev))
- platform_pci_set_power_state(dev, PCI_D0);
-
- pci_raw_set_power_state(dev, PCI_D0);
- pci_update_current_state(dev, PCI_D0);
-}
-
-/**
* pci_platform_power_transition - Use platform to change device power state
* @dev: PCI device to handle.
* @state: State to put the device into.
@@ -845,6 +832,17 @@ int pci_set_power_state(struct pci_dev *
EXPORT_SYMBOL(pci_set_power_state);
/**
+ * pci_power_up - Put the given device into D0 forcibly
+ * @dev: PCI device to power up
+ */
+void pci_power_up(struct pci_dev *dev)
+{
+ __pci_start_power_transition(dev, PCI_D0);
+ pci_raw_set_power_state(dev, PCI_D0);
+ pci_update_current_state(dev, PCI_D0);
+}
+
+/**
* pci_choose_state - Choose the power state of a PCI device
* @dev: PCI device to be suspended
* @state: target sleep state for the whole system. This is the value
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 072/136] net: avoid potential infinite loop in tc_ctl_action()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (70 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 071/136] PCI: PM: Fix pci_power_up() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 073/136] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Ben Hutchings
` (64 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Eric Dumazet,
syzbot+cf0adbb9c28c8866c788
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 39f13ea2f61b439ebe0060393e9c39925c9ee28c upstream.
tc_ctl_action() has the ability to loop forever if tcf_action_add()
returns -EAGAIN.
This special case has been done in case a module needed to be loaded,
but it turns out that tcf_add_notify() could also return -EAGAIN
if the socket sk_rcvbuf limit is hit.
We need to separate the two cases, and only loop for the module
loading case.
While we are at it, add a limit of 10 attempts since unbounded
loops are always scary.
syzbot repro was something like :
socket(PF_NETLINK, SOCK_RAW|SOCK_NONBLOCK, NETLINK_ROUTE) = 3
write(3, ..., 38) = 38
setsockopt(3, SOL_SOCKET, SO_RCVBUF, [0], 4) = 0
sendmsg(3, {msg_name(0)=NULL, msg_iov(1)=[{..., 388}], msg_controllen=0, msg_flags=0x10}, ...)
NMI backtrace for cpu 0
CPU: 0 PID: 1054 Comm: khungtaskd Not tainted 5.4.0-rc1+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
nmi_cpu_backtrace.cold+0x70/0xb2 lib/nmi_backtrace.c:101
nmi_trigger_cpumask_backtrace+0x23b/0x28b lib/nmi_backtrace.c:62
arch_trigger_cpumask_backtrace+0x14/0x20 arch/x86/kernel/apic/hw_nmi.c:38
trigger_all_cpu_backtrace include/linux/nmi.h:146 [inline]
check_hung_uninterruptible_tasks kernel/hung_task.c:205 [inline]
watchdog+0x9d0/0xef0 kernel/hung_task.c:289
kthread+0x361/0x430 kernel/kthread.c:255
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Sending NMI from CPU 0 to CPUs 1:
NMI backtrace for cpu 1
CPU: 1 PID: 8859 Comm: syz-executor910 Not tainted 5.4.0-rc1+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_local_save_flags arch/x86/include/asm/paravirt.h:751 [inline]
RIP: 0010:lockdep_hardirqs_off+0x1df/0x2e0 kernel/locking/lockdep.c:3453
Code: 5c 08 00 00 5b 41 5c 41 5d 5d c3 48 c7 c0 58 1d f3 88 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 d3 00 00 00 <48> 83 3d 21 9e 99 07 00 0f 84 b9 00 00 00 9c 58 0f 1f 44 00 00 f6
RSP: 0018:ffff8880a6f3f1b8 EFLAGS: 00000046
RAX: 1ffffffff11e63ab RBX: ffff88808c9c6080 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88808c9c6914
RBP: ffff8880a6f3f1d0 R08: ffff88808c9c6080 R09: fffffbfff16be5d1
R10: fffffbfff16be5d0 R11: 0000000000000003 R12: ffffffff8746591f
R13: ffff88808c9c6080 R14: ffffffff8746591f R15: 0000000000000003
FS: 00000000011e4880(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600400 CR3: 00000000a8920000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
trace_hardirqs_off+0x62/0x240 kernel/trace/trace_preemptirq.c:45
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
_raw_spin_lock_irqsave+0x6f/0xcd kernel/locking/spinlock.c:159
__wake_up_common_lock+0xc8/0x150 kernel/sched/wait.c:122
__wake_up+0xe/0x10 kernel/sched/wait.c:142
netlink_unlock_table net/netlink/af_netlink.c:466 [inline]
netlink_unlock_table net/netlink/af_netlink.c:463 [inline]
netlink_broadcast_filtered+0x705/0xb80 net/netlink/af_netlink.c:1514
netlink_broadcast+0x3a/0x50 net/netlink/af_netlink.c:1534
rtnetlink_send+0xdd/0x110 net/core/rtnetlink.c:714
tcf_add_notify net/sched/act_api.c:1343 [inline]
tcf_action_add+0x243/0x370 net/sched/act_api.c:1362
tc_ctl_action+0x3b5/0x4bc net/sched/act_api.c:1410
rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:5386
netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477
rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5404
netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline]
netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328
netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917
sock_sendmsg_nosec net/socket.c:637 [inline]
sock_sendmsg+0xd7/0x130 net/socket.c:657
___sys_sendmsg+0x803/0x920 net/socket.c:2311
__sys_sendmsg+0x105/0x1d0 net/socket.c:2356
__do_sys_sendmsg net/socket.c:2365 [inline]
__se_sys_sendmsg net/socket.c:2363 [inline]
__x64_sys_sendmsg+0x78/0xb0 net/socket.c:2363
do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x440939
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+cf0adbb9c28c8866c788@syzkaller.appspotmail.com
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -923,10 +923,15 @@ static int
tcf_action_add(struct net *net, struct nlattr *nla, struct nlmsghdr *n,
u32 portid, int ovr)
{
- int ret = 0;
+ int loop, ret;
LIST_HEAD(actions);
- ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
+ for (loop = 0; loop < 10; loop++) {
+ ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
+ if (ret != -EAGAIN)
+ break;
+ }
+
if (ret)
goto done;
@@ -969,10 +974,7 @@ static int tc_ctl_action(struct sk_buff
*/
if (n->nlmsg_flags & NLM_F_REPLACE)
ovr = 1;
-replay:
ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr);
- if (ret == -EAGAIN)
- goto replay;
break;
case RTM_DELACTION:
ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 073/136] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (71 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 072/136] net: avoid potential infinite loop in tc_ctl_action() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 074/136] USB: serial: ti_usb_3410_5052: fix port-close races Ben Hutchings
` (63 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Florian Fainelli, David S. Miller, Doug Berger
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <f.fainelli@gmail.com>
commit efb86fede98cdc70b674692ff617b1162f642c49 upstream.
The RGMII_MODE_EN bit value was 0 for GENET versions 1 through 3, and
became 6 for GENET v4 and above, account for that difference.
Fixes: aa09677cba42 ("net: bcmgenet: add MDIO routines")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Doug Berger <opendmb@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/broadcom/genet/bcmgenet.h | 1 +
drivers/net/ethernet/broadcom/genet/bcmmii.c | 6 +++++-
2 files changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
@@ -335,6 +335,7 @@ struct bcmgenet_mib_counters {
#define EXT_ENERGY_DET_MASK (1 << 12)
#define EXT_RGMII_OOB_CTRL 0x0C
+#define RGMII_MODE_EN_V123 (1 << 0)
#define RGMII_LINK (1 << 4)
#define OOB_DISABLE (1 << 5)
#define RGMII_MODE_EN (1 << 6)
--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
@@ -280,7 +280,11 @@ int bcmgenet_mii_config(struct net_devic
else
phy_name = "external RGMII (TX delay)";
reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
- reg |= RGMII_MODE_EN | id_mode_dis;
+ reg |= id_mode_dis;
+ if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
+ reg |= RGMII_MODE_EN_V123;
+ else
+ reg |= RGMII_MODE_EN;
bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
bcmgenet_sys_writel(priv,
PORT_MODE_EXT_GPHY, SYS_PORT_CTRL);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 074/136] USB: serial: ti_usb_3410_5052: fix port-close races
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (72 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 073/136] net: bcmgenet: Fix RGMII_MODE_EN value for GENET v1/2/3 Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 075/136] Btrfs: check for the full sync flag while holding the inode lock during fsync Ben Hutchings
` (62 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 6f1d1dc8d540a9aa6e39b9cb86d3a67bbc1c8d8d upstream.
Fix races between closing a port and opening or closing another port on
the same device which could lead to a failure to start or stop the
shared interrupt URB. The latter could potentially cause a
use-after-free or worse in the completion handler on driver unbind.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/ti_usb_3410_5052.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -542,7 +542,6 @@ static void ti_close(struct usb_serial_p
struct ti_port *tport;
int port_number;
int status;
- int do_unlock;
unsigned long flags;
tdev = usb_get_serial_data(port->serial);
@@ -569,16 +568,13 @@ static void ti_close(struct usb_serial_p
"%s - cannot send close port command, %d\n"
, __func__, status);
- /* if mutex_lock is interrupted, continue anyway */
- do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
+ mutex_lock(&tdev->td_open_close_lock);
--tport->tp_tdev->td_open_port_count;
- if (tport->tp_tdev->td_open_port_count <= 0) {
+ if (tport->tp_tdev->td_open_port_count == 0) {
/* last port is closed, shut down interrupt urb */
usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
- tport->tp_tdev->td_open_port_count = 0;
}
- if (do_unlock)
- mutex_unlock(&tdev->td_open_close_lock);
+ mutex_unlock(&tdev->td_open_close_lock);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 075/136] Btrfs: check for the full sync flag while holding the inode lock during fsync
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (73 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 074/136] USB: serial: ti_usb_3410_5052: fix port-close races Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 076/136] scsi: core: try to get module before removing device Ben Hutchings
` (61 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, David Sterba, Filipe Manana
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit ba0b084ac309283db6e329785c1dc4f45fdbd379 upstream.
We were checking for the full fsync flag in the inode before locking the
inode, which is racy, since at that that time it might not be set but
after we acquire the inode lock some other task set it. One case where
this can happen is on a system low on memory and some concurrent task
failed to allocate an extent map and therefore set the full sync flag on
the inode, to force the next fsync to work in full mode.
A consequence of missing the full fsync flag set is hitting the problems
fixed by commit 0c713cbab620 ("Btrfs: fix race between ranged fsync and
writeback of adjacent ranges"), BUG_ON() when dropping extents from a log
tree, hitting assertion failures at tree-log.c:copy_items() or all sorts
of weird inconsistencies after replaying a log due to file extents items
representing ranges that overlap.
So just move the check such that it's done after locking the inode and
before starting writeback again.
Fixes: 0c713cbab620 ("Btrfs: fix race between ranged fsync and writeback of adjacent ranges")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
[bwh: Backported to 3.16:
- Keep the "len" variable since we pass it to btrfs_wait_ordered_range()
in two different places here
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -1888,23 +1888,6 @@ int btrfs_sync_file(struct file *file, l
bool full_sync = 0;
u64 len;
- /*
- * If the inode needs a full sync, make sure we use a full range to
- * avoid log tree corruption, due to hole detection racing with ordered
- * extent completion for adjacent ranges, and assertion failures during
- * hole detection.
- */
- if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
- &BTRFS_I(inode)->runtime_flags)) {
- start = 0;
- end = LLONG_MAX;
- }
-
- /*
- * The range length can be represented by u64, we have to do the typecasts
- * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
- */
- len = (u64)end - (u64)start + 1;
trace_btrfs_sync_file(file, datasync);
/*
@@ -1925,6 +1908,25 @@ int btrfs_sync_file(struct file *file, l
mutex_lock(&inode->i_mutex);
/*
+ * If the inode needs a full sync, make sure we use a full range to
+ * avoid log tree corruption, due to hole detection racing with ordered
+ * extent completion for adjacent ranges, and assertion failures during
+ * hole detection. Do this while holding the inode lock, to avoid races
+ * with other tasks.
+ */
+ if (test_bit(BTRFS_INODE_NEEDS_FULL_SYNC,
+ &BTRFS_I(inode)->runtime_flags)) {
+ start = 0;
+ end = LLONG_MAX;
+ }
+
+ /*
+ * The range length can be represented by u64, we have to do the typecasts
+ * to avoid signed overflow if it's [0, LLONG_MAX] eg. from fsync()
+ */
+ len = (u64)end - (u64)start + 1;
+
+ /*
* We flush the dirty pages again to avoid some dirty pages in the
* range being left.
*/
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 076/136] scsi: core: try to get module before removing device
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (74 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 075/136] Btrfs: check for the full sync flag while holding the inode lock during fsync Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 077/136] net: phy: bcm7xxx: define soft_reset for 40nm EPHY Ben Hutchings
` (60 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Yufen Yu, Bart Van Assche, Martin K. Petersen
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yufen Yu <yuyufen@huawei.com>
commit 77c301287ebae86cc71d03eb3806f271cb14da79 upstream.
We have a test case like block/001 in blktests, which will create a scsi
device by loading scsi_debug module and then try to delete the device by
sysfs interface. At the same time, it may remove the scsi_debug module.
And getting a invalid paging request BUG_ON as following:
[ 34.625854] BUG: unable to handle page fault for address: ffffffffa0016bb8
[ 34.629189] Oops: 0000 [#1] SMP PTI
[ 34.629618] CPU: 1 PID: 450 Comm: bash Tainted: G W 5.4.0-rc3+ #473
[ 34.632524] RIP: 0010:scsi_proc_hostdir_rm+0x5/0xa0
[ 34.643555] CR2: ffffffffa0016bb8 CR3: 000000012cd88000 CR4: 00000000000006e0
[ 34.644545] Call Trace:
[ 34.644907] scsi_host_dev_release+0x6b/0x1f0
[ 34.645511] device_release+0x74/0x110
[ 34.646046] kobject_put+0x116/0x390
[ 34.646559] put_device+0x17/0x30
[ 34.647041] scsi_target_dev_release+0x2b/0x40
[ 34.647652] device_release+0x74/0x110
[ 34.648186] kobject_put+0x116/0x390
[ 34.648691] put_device+0x17/0x30
[ 34.649157] scsi_device_dev_release_usercontext+0x2e8/0x360
[ 34.649953] execute_in_process_context+0x29/0x80
[ 34.650603] scsi_device_dev_release+0x20/0x30
[ 34.651221] device_release+0x74/0x110
[ 34.651732] kobject_put+0x116/0x390
[ 34.652230] sysfs_unbreak_active_protection+0x3f/0x50
[ 34.652935] sdev_store_delete.cold.4+0x71/0x8f
[ 34.653579] dev_attr_store+0x1b/0x40
[ 34.654103] sysfs_kf_write+0x3d/0x60
[ 34.654603] kernfs_fop_write+0x174/0x250
[ 34.655165] __vfs_write+0x1f/0x60
[ 34.655639] vfs_write+0xc7/0x280
[ 34.656117] ksys_write+0x6d/0x140
[ 34.656591] __x64_sys_write+0x1e/0x30
[ 34.657114] do_syscall_64+0xb1/0x400
[ 34.657627] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 34.658335] RIP: 0033:0x7f156f337130
During deleting scsi target, the scsi_debug module have been removed. Then,
sdebug_driver_template belonged to the module cannot be accessd, resulting
in scsi_proc_hostdir_rm() BUG_ON.
To fix the bug, we add scsi_device_get() in sdev_store_delete() to try to
increase refcount of module, avoiding the module been removed.
Link: https://lore.kernel.org/r/20191015130556.18061-1-yuyufen@huawei.com
Signed-off-by: Yufen Yu <yuyufen@huawei.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/scsi_sysfs.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/scsi/scsi_sysfs.c
+++ b/drivers/scsi/scsi_sysfs.c
@@ -652,6 +652,14 @@ sdev_store_delete(struct device *dev, st
const char *buf, size_t count)
{
struct kernfs_node *kn;
+ struct scsi_device *sdev = to_scsi_device(dev);
+
+ /*
+ * We need to try to get module, avoiding the module been removed
+ * during delete.
+ */
+ if (scsi_device_get(sdev))
+ return -ENODEV;
kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
WARN_ON_ONCE(!kn);
@@ -666,9 +674,10 @@ sdev_store_delete(struct device *dev, st
* state into SDEV_DEL.
*/
device_remove_file(dev, attr);
- scsi_remove_device(to_scsi_device(dev));
+ scsi_remove_device(sdev);
if (kn)
sysfs_unbreak_active_protection(kn);
+ scsi_device_put(sdev);
return count;
};
static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 077/136] net: phy: bcm7xxx: define soft_reset for 40nm EPHY
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (75 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 076/136] scsi: core: try to get module before removing device Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 078/136] net: bcmgenet: reset 40nm EPHY on energy detect Ben Hutchings
` (59 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Florian Fainelli, Doug Berger, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <opendmb@gmail.com>
commit fe586b823372a9f43f90e2c6aa0573992ce7ccb7 upstream.
The internal 40nm EPHYs use a "Workaround for putting the PHY in
IDDQ mode." These PHYs require a soft reset to restore functionality
after they are powered back up.
This commit defines the soft_reset function to use genphy_soft_reset
during phy_init_hw to accommodate this.
Fixes: 6e2d85ec0559 ("net: phy: Stop with excessive soft reset")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
- Delete trailing backslash; there is a single entry for 40 nm PHYs
and not a macro definition
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/phy/bcm7xxx.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/phy/bcm7xxx.c
+++ b/drivers/net/phy/bcm7xxx.c
@@ -306,6 +306,7 @@ static struct phy_driver bcm7xxx_driver[
.features = PHY_GBIT_FEATURES |
SUPPORTED_Pause | SUPPORTED_Asym_Pause,
.flags = PHY_IS_INTERNAL,
+ .soft_reset = genphy_soft_reset,
.config_init = bcm7xxx_config_init,
.config_aneg = genphy_config_aneg,
.read_status = genphy_read_status,
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 078/136] net: bcmgenet: reset 40nm EPHY on energy detect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (76 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 077/136] net: phy: bcm7xxx: define soft_reset for 40nm EPHY Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 079/136] USB: ldusb: fix read info leaks Ben Hutchings
` (58 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Doug Berger, David S. Miller, Florian Fainelli
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Doug Berger <opendmb@gmail.com>
commit 25382b991d252aed961cd434176240f9de6bb15f upstream.
The EPHY integrated into the 40nm Set-Top Box devices can falsely
detect energy when connected to a disabled peer interface. When the
peer interface is enabled the EPHY will detect and report the link
as active, but on occasion may get into a state where it is not
able to exchange data with the connected GENET MAC. This issue has
not been observed when the link parameters are auto-negotiated;
however, it has been observed with a manually configured link.
It has been empirically determined that issuing a soft reset to the
EPHY when energy is detected prevents it from getting into this bad
state.
Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
Signed-off-by: Doug Berger <opendmb@gmail.com>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/broadcom/genet/bcmgenet.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
@@ -1558,11 +1558,13 @@ static void init_umac(struct bcmgenet_pr
dev_dbg(kdev, "%s:Enabling RXDMA_BDONE interrupt\n", __func__);
/* Monitor cable plug/unpluged event for internal PHY */
- if (phy_is_internal(priv->phydev))
+ if (phy_is_internal(priv->phydev)) {
cpu_mask_clear |= (UMAC_IRQ_LINK_DOWN | UMAC_IRQ_LINK_UP);
- else if (priv->ext_phy)
+ if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
+ cpu_mask_clear |= UMAC_IRQ_PHY_DET_R;
+ } else if (priv->ext_phy) {
cpu_mask_clear |= (UMAC_IRQ_LINK_DOWN | UMAC_IRQ_LINK_UP);
- else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
+ } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) {
reg = bcmgenet_bp_mc_get(priv);
reg |= BIT(priv->hw_params->bp_in_en_shift);
@@ -1861,11 +1863,16 @@ static void bcmgenet_irq_task(struct wor
priv->irq0_stat = 0;
spin_unlock_irqrestore(&priv->lock, flags);
+ if (status & UMAC_IRQ_PHY_DET_R &&
+ priv->dev->phydev->autoneg != AUTONEG_ENABLE)
+ phy_init_hw(priv->dev->phydev);
+
/* Link UP/DOWN event */
if ((priv->hw_params->flags & GENET_HAS_MDIO_INTR) &&
(status & (UMAC_IRQ_LINK_UP|UMAC_IRQ_LINK_DOWN)))
phy_mac_interrupt(priv->phydev,
status & UMAC_IRQ_LINK_UP);
+
}
/* bcmgenet_isr1: interrupt handler for ring buffer. */
@@ -1934,7 +1941,7 @@ static irqreturn_t bcmgenet_isr0(int irq
}
/* all other interested interrupts handled in bottom half */
- status &= UMAC_IRQ_LINK_UP | UMAC_IRQ_LINK_DOWN;
+ status &= (UMAC_IRQ_LINK_UP | UMAC_IRQ_LINK_DOWN | UMAC_IRQ_PHY_DET_R);
if (status) {
/* Save irq status for bottom-half processing. */
spin_lock_irqsave(&priv->lock, flags);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 079/136] USB: ldusb: fix read info leaks
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (77 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 078/136] net: bcmgenet: reset 40nm EPHY on energy detect Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 080/136] xen/netback: fix error path of xenvif_connect_data() Ben Hutchings
` (57 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot+6fe95b826644f7f12b0b,
Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 7a6f22d7479b7a0b68eadd308a997dd64dda7dae upstream.
Fix broken read implementation, which could be used to trigger slab info
leaks.
The driver failed to check if the custom ring buffer was still empty
when waking up after having waited for more data. This would happen on
every interrupt-in completion, even if no data had been added to the
ring buffer (e.g. on disconnect events).
Due to missing sanity checks and uninitialised (kmalloced) ring-buffer
entries, this meant that huge slab info leaks could easily be triggered.
Note that the empty-buffer check after wakeup is enough to fix the info
leak on disconnect, but let's clear the buffer on allocation and add a
sanity check to read() to prevent further leaks.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Reported-by: syzbot+6fe95b826644f7f12b0b@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191018151955.25135-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -478,7 +478,7 @@ static ssize_t ld_usb_read(struct file *
/* wait for data */
spin_lock_irq(&dev->rbsl);
- if (dev->ring_head == dev->ring_tail) {
+ while (dev->ring_head == dev->ring_tail) {
dev->interrupt_in_done = 0;
spin_unlock_irq(&dev->rbsl);
if (file->f_flags & O_NONBLOCK) {
@@ -488,12 +488,17 @@ static ssize_t ld_usb_read(struct file *
retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
if (retval < 0)
goto unlock_exit;
- } else {
- spin_unlock_irq(&dev->rbsl);
+
+ spin_lock_irq(&dev->rbsl);
}
+ spin_unlock_irq(&dev->rbsl);
/* actual_buffer contains actual_length + interrupt_in_buffer */
actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_tail*(sizeof(size_t)+dev->interrupt_in_endpoint_size));
+ if (*actual_buffer > dev->interrupt_in_endpoint_size) {
+ retval = -EIO;
+ goto unlock_exit;
+ }
bytes_to_read = min(count, *actual_buffer);
if (bytes_to_read < *actual_buffer)
dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
@@ -713,7 +718,9 @@ static int ld_usb_probe(struct usb_inter
dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
- dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
+ dev->ring_buffer = kcalloc(ring_buffer_size,
+ sizeof(size_t) + dev->interrupt_in_endpoint_size,
+ GFP_KERNEL);
if (!dev->ring_buffer) {
dev_err(&intf->dev, "Couldn't allocate ring_buffer\n");
goto error;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 080/136] xen/netback: fix error path of xenvif_connect_data()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (78 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 079/136] USB: ldusb: fix read info leaks Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 081/136] net: netem: correct the parent's backlog when corrupted packet was dropped Ben Hutchings
` (56 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Wei Liu, Paul Durrant, Juergen Gross,
David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Juergen Gross <jgross@suse.com>
commit 3d5c1a037d37392a6859afbde49be5ba6a70a6b3 upstream.
xenvif_connect_data() calls module_put() in case of error. This is
wrong as there is no related module_get().
Remove the superfluous module_put().
Fixes: 279f438e36c0a7 ("xen-netback: Don't destroy the netdev until the vif is shut down")
Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Reviewed-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/xen-netback/interface.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -616,7 +616,6 @@ err_tx_unbind:
err_unmap:
xenvif_unmap_frontend_rings(queue);
err:
- module_put(THIS_MODULE);
return err;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 081/136] net: netem: correct the parent's backlog when corrupted packet was dropped
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (79 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 080/136] xen/netback: fix error path of xenvif_connect_data() Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 082/136] CIFS: avoid using MID 0xFFFF Ben Hutchings
` (55 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Jakub Kicinski, Simon Horman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Kicinski <jakub.kicinski@netronome.com>
commit e0ad032e144731a5928f2d75e91c2064ba1a764c upstream.
If packet corruption failed we jump to finish_segs and return
NET_XMIT_SUCCESS. Seeing success will make the parent qdisc
increment its backlog, that's incorrect - we need to return
NET_XMIT_DROP.
Fixes: 6071bd1aa13e ("netem: Segment GSO packets on enqueue")
Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Simon Horman <simon.horman@netronome.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sched/sch_netem.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -599,6 +599,8 @@ finish_segs:
}
/* Parent qdiscs accounted for 1 skb of size @prev_len */
qdisc_tree_reduce_backlog(sch, -(nb - 1), -(len - prev_len));
+ } else if (!skb) {
+ return NET_XMIT_DROP;
}
return NET_XMIT_SUCCESS;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 082/136] CIFS: avoid using MID 0xFFFF
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (80 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 081/136] net: netem: correct the parent's backlog when corrupted packet was dropped Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 083/136] ARC: perf: Accommodate big-endian CPU Ben Hutchings
` (54 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Aurelien Aptel, Ronnie Sahlberg,
Roberto Bergantinos Corpas, Steve French
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Roberto Bergantinos Corpas <rbergant@redhat.com>
commit 03d9a9fe3f3aec508e485dd3dcfa1e99933b4bdb upstream.
According to MS-CIFS specification MID 0xFFFF should not be used by the
CIFS client, but we actually do. Besides, this has proven to cause races
leading to oops between SendReceive2/cifs_demultiplex_thread. On SMB1,
MID is a 2 byte value easy to reach in CurrentMid which may conflict with
an oplock break notification request coming from server
Signed-off-by: Roberto Bergantinos Corpas <rbergant@redhat.com>
Reviewed-by: Ronnie Sahlberg <lsahlber@redhat.com>
Reviewed-by: Aurelien Aptel <aaptel@suse.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/cifs/smb1ops.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -180,6 +180,9 @@ cifs_get_next_mid(struct TCP_Server_Info
/* we do not want to loop forever */
last_mid = cur_mid;
cur_mid++;
+ /* avoid 0xFFFF MID */
+ if (cur_mid == 0xffff)
+ cur_mid++;
/*
* This nested loop looks more expensive than it is.
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 083/136] ARC: perf: Accommodate big-endian CPU
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (81 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 082/136] CIFS: avoid using MID 0xFFFF Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 084/136] scsi: lpfc: Honor module parameter lpfc_use_adisc Ben Hutchings
` (53 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Vineet Gupta, Alexey Brodkin, Alexey Brodkin
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
commit 5effc09c4907901f0e71e68e5f2e14211d9a203f upstream.
8-letter strings representing ARC perf events are stores in two
32-bit registers as ASCII characters like that: "IJMP", "IALL", "IJMPTAK" etc.
And the same order of bytes in the word is used regardless CPU endianness.
Which means in case of big-endian CPU core we need to swap bytes to get
the same order as if it was on little-endian CPU.
Otherwise we're seeing the following error message on boot:
------------------------->8----------------------
ARC perf : 8 counters (32 bits), 40 conditions, [overflow IRQ support]
sysfs: cannot create duplicate filename '/devices/arc_pct/events/pmji'
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.2.18 #3
Stack Trace:
arc_unwind_core+0xd4/0xfc
dump_stack+0x64/0x80
sysfs_warn_dup+0x46/0x58
sysfs_add_file_mode_ns+0xb2/0x168
create_files+0x70/0x2a0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 1 at kernel/events/core.c:12144 perf_event_sysfs_init+0x70/0xa0
Failed to register pmu: arc_pct, reason -17
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.2.18 #3
Stack Trace:
arc_unwind_core+0xd4/0xfc
dump_stack+0x64/0x80
__warn+0x9c/0xd4
warn_slowpath_fmt+0x22/0x2c
perf_event_sysfs_init+0x70/0xa0
---[ end trace a75fb9a9837bd1ec ]---
------------------------->8----------------------
What happens here we're trying to register more than one raw perf event
with the same name "PMJI". Why? Because ARC perf events are 4 to 8 letters
and encoded into two 32-bit words. In this particular case we deal with 2
events:
* "IJMP____" which counts all jump & branch instructions
* "IJMPC___" which counts only conditional jumps & branches
Those strings are split in two 32-bit words this way "IJMP" + "____" &
"IJMP" + "C___" correspondingly. Now if we read them swapped due to CPU core
being big-endian then we read "PMJI" + "____" & "PMJI" + "___C".
And since we interpret read array of ASCII letters as a null-terminated string
on big-endian CPU we end up with 2 events of the same name "PMJI".
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/arc/kernel/perf_event.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/arc/kernel/perf_event.c
+++ b/arch/arc/kernel/perf_event.c
@@ -274,8 +274,8 @@ static int arc_pmu_device_probe(struct p
for (j = 0; j < cc_bcr.c; j++) {
write_aux_reg(ARC_REG_CC_INDEX, j);
- cc_name.indiv.word0 = read_aux_reg(ARC_REG_CC_NAME0);
- cc_name.indiv.word1 = read_aux_reg(ARC_REG_CC_NAME1);
+ cc_name.indiv.word0 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME0));
+ cc_name.indiv.word1 = le32_to_cpu(read_aux_reg(ARC_REG_CC_NAME1));
for (i = 0; i < ARRAY_SIZE(arc_pmu_ev_hw_map); i++) {
if (arc_pmu_ev_hw_map[i] &&
!strcmp(arc_pmu_ev_hw_map[i], cc_name.str) &&
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 084/136] scsi: lpfc: Honor module parameter lpfc_use_adisc
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (82 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 083/136] ARC: perf: Accommodate big-endian CPU Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:46 ` [PATCH 3.16 085/136] fuse: flush dirty data/metadata before non-truncate setattr Ben Hutchings
` (52 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Daniel Wagner, Hannes Reinecke,
Martin K. Petersen, Dick Kennedy, James Smart
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <dwagner@suse.de>
commit 0fd103ccfe6a06e40e2d9d8c91d96332cc9e1239 upstream.
The initial lpfc_desc_set_adisc implementation in commit
dea3101e0a5c ("lpfc: add Emulex FC driver version 8.0.28") enabled ADISC if
cfg_use_adisc && RSCN_MODE && FCP_2_DEVICE
In commit 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of
SLI-3") this changed to
(cfg_use_adisc && RSC_MODE) || FCP_2_DEVICE
and later in commit ffc954936b13 ("[SCSI] lpfc 8.3.13: FC Discovery Fixes
and enhancements.") to
(cfg_use_adisc && RSC_MODE) || (FCP_2_DEVICE && FCP_TARGET)
A customer reports that after a devloss, an ADISC failure is logged. It
turns out the ADISC flag is set even the user explicitly set lpfc_use_adisc
= 0.
[Sat Dec 22 22:55:58 2018] lpfc 0000:82:00.0: 2:(0):0203 Devloss timeout on WWPN 50:01:43:80:12:8e:40:20 NPort x05df00 Data: x82000000 x8 xa
[Sat Dec 22 23:08:20 2018] lpfc 0000:82:00.0: 2:(0):2755 ADISC failure DID:05DF00 Status:x9/x70000
[mkp: fixed Hannes' email]
Fixes: 92d7f7b0cde3 ("[SCSI] lpfc: NPIV: add NPIV support on top of SLI-3")
Cc: Dick Kennedy <dick.kennedy@broadcom.com>
Cc: James Smart <james.smart@broadcom.com>
Link: https://lore.kernel.org/r/20191022072112.132268-1-dwagner@suse.de
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: James Smart <james.smart@broadcom.com>
Signed-off-by: Daniel Wagner <dwagner@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/lpfc/lpfc_nportdisc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/scsi/lpfc/lpfc_nportdisc.c
+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
@@ -742,9 +742,9 @@ lpfc_disc_set_adisc(struct lpfc_vport *v
if (!(vport->fc_flag & FC_PT2PT)) {
/* Check config parameter use-adisc or FCP-2 */
- if ((vport->cfg_use_adisc && (vport->fc_flag & FC_RSCN_MODE)) ||
+ if (vport->cfg_use_adisc && ((vport->fc_flag & FC_RSCN_MODE) ||
((ndlp->nlp_fcp_info & NLP_FCP_2_DEVICE) &&
- (ndlp->nlp_type & NLP_FCP_TARGET))) {
+ (ndlp->nlp_type & NLP_FCP_TARGET)))) {
spin_lock_irq(shost->host_lock);
ndlp->nlp_flag |= NLP_NPR_ADISC;
spin_unlock_irq(shost->host_lock);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 085/136] fuse: flush dirty data/metadata before non-truncate setattr
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (83 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 084/136] scsi: lpfc: Honor module parameter lpfc_use_adisc Ben Hutchings
@ 2019-12-17 0:46 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 086/136] fuse: truncate pending writes on O_TRUNC Ben Hutchings
` (51 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:46 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Giuseppe Scrivano, Miklos Szeredi
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit b24e7598db62386a95a3c8b9c75630c5d56fe077 upstream.
If writeback cache is enabled, then writes might get reordered with
chmod/chown/utimes. The problem with this is that performing the write in
the fuse daemon might itself change some of these attributes. In such case
the following sequence of operations will result in file ending up with the
wrong mode, for example:
int fd = open ("suid", O_WRONLY|O_CREAT|O_EXCL);
write (fd, "1", 1);
fchown (fd, 0, 0);
fchmod (fd, 04755);
close (fd);
This patch fixes this by flushing pending writes before performing
chown/chmod/utimes.
Reported-by: Giuseppe Scrivano <gscrivan@redhat.com>
Tested-by: Giuseppe Scrivano <gscrivan@redhat.com>
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/fuse/dir.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1751,6 +1751,19 @@ int fuse_do_setattr(struct dentry *dentr
if (IS_ERR(req))
return PTR_ERR(req);
+ /* Flush dirty data/metadata before non-truncate SETATTR */
+ if (is_wb && S_ISREG(inode->i_mode) &&
+ attr->ia_valid &
+ (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_MTIME_SET |
+ ATTR_TIMES_SET)) {
+ err = write_inode_now(inode, true);
+ if (err)
+ return err;
+
+ fuse_set_nowrite(inode);
+ fuse_release_nowrite(inode);
+ }
+
if (is_truncate) {
fuse_set_nowrite(inode);
set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 086/136] fuse: truncate pending writes on O_TRUNC
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (84 preceding siblings ...)
2019-12-17 0:46 ` [PATCH 3.16 085/136] fuse: flush dirty data/metadata before non-truncate setattr Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 087/136] ASoC: kirkwood: fix external clock probe defer Ben Hutchings
` (50 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Miklos Szeredi
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit e4648309b85a78f8c787457832269a8712a8673e upstream.
Make sure cached writes are not reordered around open(..., O_TRUNC), with
the obvious wrong results.
Fixes: 4d99ff8f12eb ("fuse: Turn writeback cache on")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/fuse/file.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
--- a/fs/fuse/file.c
+++ b/fs/fuse/file.c
@@ -237,7 +237,7 @@ int fuse_open_common(struct inode *inode
{
struct fuse_conn *fc = get_fuse_conn(inode);
int err;
- bool lock_inode = (file->f_flags & O_TRUNC) &&
+ bool is_wb_truncate = (file->f_flags & O_TRUNC) &&
fc->atomic_o_trunc &&
fc->writeback_cache;
@@ -245,16 +245,20 @@ int fuse_open_common(struct inode *inode
if (err)
return err;
- if (lock_inode)
+ if (is_wb_truncate) {
mutex_lock(&inode->i_mutex);
+ fuse_set_nowrite(inode);
+ }
err = fuse_do_open(fc, get_node_id(inode), file, isdir);
if (!err)
fuse_finish_open(inode, file);
- if (lock_inode)
+ if (is_wb_truncate) {
+ fuse_release_nowrite(inode);
mutex_unlock(&inode->i_mutex);
+ }
return err;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 087/136] ASoC: kirkwood: fix external clock probe defer
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (85 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 086/136] fuse: truncate pending writes on O_TRUNC Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 088/136] MIPS: bmips: mark exception vectors as char arrays Ben Hutchings
` (49 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Russell King, Mark Brown
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Russell King <rmk+kernel@armlinux.org.uk>
commit 4523817d51bc3b2ef38da768d004fda2c8bc41de upstream.
When our call to get the external clock fails, we forget to clean up
the enabled internal clock correctly. Enable the clock after we have
obtained all our resources.
Fixes: 84aac6c79bfd ("ASoC: kirkwood: fix loss of external clock at probe time")
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
Link: https://lore.kernel.org/r/E1iNGyK-0004oF-6A@rmk-PC.armlinux.org.uk
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/soc/kirkwood/kirkwood-i2s.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/sound/soc/kirkwood/kirkwood-i2s.c
+++ b/sound/soc/kirkwood/kirkwood-i2s.c
@@ -557,10 +557,6 @@ static int kirkwood_i2s_dev_probe(struct
return PTR_ERR(priv->clk);
}
- err = clk_prepare_enable(priv->clk);
- if (err < 0)
- return err;
-
priv->extclk = devm_clk_get(&pdev->dev, "extclk");
if (IS_ERR(priv->extclk)) {
if (PTR_ERR(priv->extclk) == -EPROBE_DEFER)
@@ -576,6 +572,10 @@ static int kirkwood_i2s_dev_probe(struct
}
}
+ err = clk_prepare_enable(priv->clk);
+ if (err < 0)
+ return err;
+
/* Some sensible defaults - this reflects the powerup values */
priv->ctl_play = KIRKWOOD_PLAYCTL_SIZE_24;
priv->ctl_rec = KIRKWOOD_RECCTL_SIZE_24;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 088/136] MIPS: bmips: mark exception vectors as char arrays
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (86 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 087/136] ASoC: kirkwood: fix external clock probe defer Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 089/136] MIPS: tlbex: Fix build_restore_pagemask KScratch restore Ben Hutchings
` (48 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jonas Gorski, linux-mips, James Hogan,
Ralf Baechle, Paul Burton, Florian Fainelli
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
commit e4f5cb1a9b27c0f94ef4f5a0178a3fde2d3d0e9e upstream.
The vectors span more than one byte, so mark them as arrays.
Fixes the following build error when building when using GCC 8.3:
In file included from ./include/linux/string.h:19,
from ./include/linux/bitmap.h:9,
from ./include/linux/cpumask.h:12,
from ./arch/mips/include/asm/processor.h:15,
from ./arch/mips/include/asm/thread_info.h:16,
from ./include/linux/thread_info.h:38,
from ./include/asm-generic/preempt.h:5,
from ./arch/mips/include/generated/asm/preempt.h:1,
from ./include/linux/preempt.h:81,
from ./include/linux/spinlock.h:51,
from ./include/linux/mmzone.h:8,
from ./include/linux/bootmem.h:8,
from arch/mips/bcm63xx/prom.c:10:
arch/mips/bcm63xx/prom.c: In function 'prom_init':
./arch/mips/include/asm/string.h:162:11: error: '__builtin_memcpy' forming offset [2, 32] is out of the bounds [0, 1] of object 'bmips_smp_movevec' with type 'char' [-Werror=array-bounds]
__ret = __builtin_memcpy((dst), (src), __len); \
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
arch/mips/bcm63xx/prom.c:97:3: note: in expansion of macro 'memcpy'
memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
^~~~~~
In file included from arch/mips/bcm63xx/prom.c:14:
./arch/mips/include/asm/bmips.h:80:13: note: 'bmips_smp_movevec' declared here
extern char bmips_smp_movevec;
Fixes: 18a1eef92dcd ("MIPS: BMIPS: Introduce bmips.h")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Paul Burton <paulburton@kernel.org>
Cc: linux-mips@vger.kernel.org
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: James Hogan <jhogan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/bcm63xx/prom.c | 2 +-
arch/mips/include/asm/bmips.h | 10 +++++-----
arch/mips/kernel/smp-bmips.c | 8 ++++----
3 files changed, 10 insertions(+), 10 deletions(-)
--- a/arch/mips/bcm63xx/prom.c
+++ b/arch/mips/bcm63xx/prom.c
@@ -88,7 +88,7 @@ void __init prom_init(void)
* Here we will start up CPU1 in the background and ask it to
* reconfigure itself then go back to sleep.
*/
- memcpy((void *)0xa0000200, &bmips_smp_movevec, 0x20);
+ memcpy((void *)0xa0000200, bmips_smp_movevec, 0x20);
__sync();
set_c0_cause(C_SW0);
cpumask_set_cpu(1, &bmips_booted_mask);
--- a/arch/mips/include/asm/bmips.h
+++ b/arch/mips/include/asm/bmips.h
@@ -75,11 +75,11 @@ static inline int register_bmips_smp_ops
#endif
}
-extern char bmips_reset_nmi_vec;
-extern char bmips_reset_nmi_vec_end;
-extern char bmips_smp_movevec;
-extern char bmips_smp_int_vec;
-extern char bmips_smp_int_vec_end;
+extern char bmips_reset_nmi_vec[];
+extern char bmips_reset_nmi_vec_end[];
+extern char bmips_smp_movevec[];
+extern char bmips_smp_int_vec[];
+extern char bmips_smp_int_vec_end[];
extern int bmips_smp_enabled;
extern int bmips_cpu_offset;
--- a/arch/mips/kernel/smp-bmips.c
+++ b/arch/mips/kernel/smp-bmips.c
@@ -467,10 +467,10 @@ static void bmips_wr_vec(unsigned long d
static inline void bmips_nmi_handler_setup(void)
{
- bmips_wr_vec(BMIPS_NMI_RESET_VEC, &bmips_reset_nmi_vec,
- &bmips_reset_nmi_vec_end);
- bmips_wr_vec(BMIPS_WARM_RESTART_VEC, &bmips_smp_int_vec,
- &bmips_smp_int_vec_end);
+ bmips_wr_vec(BMIPS_NMI_RESET_VEC, bmips_reset_nmi_vec,
+ bmips_reset_nmi_vec_end);
+ bmips_wr_vec(BMIPS_WARM_RESTART_VEC, bmips_smp_int_vec,
+ bmips_smp_int_vec_end);
}
void bmips_ebase_setup(void)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 089/136] MIPS: tlbex: Fix build_restore_pagemask KScratch restore
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (87 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 088/136] MIPS: bmips: mark exception vectors as char arrays Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 090/136] ipvs: move old_secure_tcp into struct netns_ipvs Ben Hutchings
` (47 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Dmitry Korotin, linux-mips, Paul Burton
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paulburton@kernel.org>
commit b42aa3fd5957e4daf4b69129e5ce752a2a53e7d6 upstream.
build_restore_pagemask() will restore the value of register $1/$at when
its restore_scratch argument is non-zero, and aims to do so by filling a
branch delay slot. Commit 0b24cae4d535 ("MIPS: Add missing EHB in mtc0
-> mfc0 sequence.") added an EHB instruction (Execution Hazard Barrier)
prior to restoring $1 from a KScratch register, in order to resolve a
hazard that can result in stale values of the KScratch register being
observed. In particular, P-class CPUs from MIPS with out of order
execution pipelines such as the P5600 & P6600 are affected.
Unfortunately this EHB instruction was inserted in the branch delay slot
causing the MFC0 instruction which performs the restoration to no longer
execute along with the branch. The result is that the $1 register isn't
actually restored, ie. the TLB refill exception handler clobbers it -
which is exactly the problem the EHB is meant to avoid for the P-class
CPUs.
Similarly build_get_pgd_vmalloc() will restore the value of $1/$at when
its mode argument equals refill_scratch, and suffers from the same
problem.
Fix this by in both cases moving the EHB earlier in the emitted code.
There's no reason it needs to immediately precede the MFC0 - it simply
needs to be between the MTC0 & MFC0.
This bug only affects Cavium Octeon systems which use
build_fast_tlb_refill_handler().
Signed-off-by: Paul Burton <paulburton@kernel.org>
Fixes: 0b24cae4d535 ("MIPS: Add missing EHB in mtc0 -> mfc0 sequence.")
Cc: Dmitry Korotin <dkorotin@wavecomp.com>
Cc: linux-mips@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/mips/mm/tlbex.c | 23 +++++++++++++++--------
1 file changed, 15 insertions(+), 8 deletions(-)
--- a/arch/mips/mm/tlbex.c
+++ b/arch/mips/mm/tlbex.c
@@ -652,6 +652,13 @@ static void build_restore_pagemask(u32 *
int restore_scratch)
{
if (restore_scratch) {
+ /*
+ * Ensure the MFC0 below observes the value written to the
+ * KScratch register by the prior MTC0.
+ */
+ if (scratch_reg >= 0)
+ uasm_i_ehb(p);
+
/* Reset default page size */
if (PM_DEFAULT_MASK >> 16) {
uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
@@ -666,12 +673,10 @@ static void build_restore_pagemask(u32 *
uasm_i_mtc0(p, 0, C0_PAGEMASK);
uasm_il_b(p, r, lid);
}
- if (scratch_reg >= 0) {
- uasm_i_ehb(p);
+ if (scratch_reg >= 0)
UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
- } else {
+ else
UASM_i_LW(p, 1, scratchpad_offset(0), 0);
- }
} else {
/* Reset default page size */
if (PM_DEFAULT_MASK >> 16) {
@@ -893,6 +898,10 @@ build_get_pgd_vmalloc64(u32 **p, struct
}
if (mode != not_refill && check_for_high_segbits) {
uasm_l_large_segbits_fault(l, *p);
+
+ if (mode == refill_scratch && scratch_reg >= 0)
+ uasm_i_ehb(p);
+
/*
* We get here if we are an xsseg address, or if we are
* an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
@@ -909,12 +918,10 @@ build_get_pgd_vmalloc64(u32 **p, struct
uasm_i_jr(p, ptr);
if (mode == refill_scratch) {
- if (scratch_reg >= 0) {
- uasm_i_ehb(p);
+ if (scratch_reg >= 0)
UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
- } else {
+ else
UASM_i_LW(p, 1, scratchpad_offset(0), 0);
- }
} else {
uasm_i_nop(p);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 090/136] ipvs: move old_secure_tcp into struct netns_ipvs
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (88 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 089/136] MIPS: tlbex: Fix build_restore_pagemask KScratch restore Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 091/136] bonding: fix unexpected IFF_BONDING bit unset Ben Hutchings
` (46 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, syzbot, Eric Dumazet, Simon Horman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit c24b75e0f9239e78105f81c5f03a751641eb07ef upstream.
syzbot reported the following issue :
BUG: KCSAN: data-race in update_defense_level / update_defense_level
read to 0xffffffff861a6260 of 4 bytes by task 3006 on cpu 1:
update_defense_level+0x621/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:177
defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
worker_thread+0xa0/0x800 kernel/workqueue.c:2415
kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
write to 0xffffffff861a6260 of 4 bytes by task 7333 on cpu 0:
update_defense_level+0xa62/0xb30 net/netfilter/ipvs/ip_vs_ctl.c:205
defense_work_handler+0x3d/0xd0 net/netfilter/ipvs/ip_vs_ctl.c:225
process_one_work+0x3d4/0x890 kernel/workqueue.c:2269
worker_thread+0xa0/0x800 kernel/workqueue.c:2415
kthread+0x1d4/0x200 drivers/block/aoe/aoecmd.c:1253
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:352
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 7333 Comm: kworker/0:5 Not tainted 5.4.0-rc3+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events defense_work_handler
Indeed, old_secure_tcp is currently a static variable, while it
needs to be a per netns variable.
Fixes: a0840e2e165a ("IPVS: netns, ip_vs_ctl local vars moved to ipvs struct.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/ip_vs.h | 1 +
net/netfilter/ipvs/ip_vs_ctl.c | 15 +++++++--------
2 files changed, 8 insertions(+), 8 deletions(-)
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -919,6 +919,7 @@ struct netns_ipvs {
struct delayed_work defense_work; /* Work handler */
int drop_rate;
int drop_counter;
+ int old_secure_tcp;
atomic_t dropentry;
/* locks in ctl.c */
spinlock_t dropentry_lock; /* drop entry handling */
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -97,7 +97,6 @@ static bool __ip_vs_addr_is_local_v6(str
static void update_defense_level(struct netns_ipvs *ipvs)
{
struct sysinfo i;
- static int old_secure_tcp = 0;
int availmem;
int nomem;
int to_change = -1;
@@ -178,35 +177,35 @@ static void update_defense_level(struct
spin_lock(&ipvs->securetcp_lock);
switch (ipvs->sysctl_secure_tcp) {
case 0:
- if (old_secure_tcp >= 2)
+ if (ipvs->old_secure_tcp >= 2)
to_change = 0;
break;
case 1:
if (nomem) {
- if (old_secure_tcp < 2)
+ if (ipvs->old_secure_tcp < 2)
to_change = 1;
ipvs->sysctl_secure_tcp = 2;
} else {
- if (old_secure_tcp >= 2)
+ if (ipvs->old_secure_tcp >= 2)
to_change = 0;
}
break;
case 2:
if (nomem) {
- if (old_secure_tcp < 2)
+ if (ipvs->old_secure_tcp < 2)
to_change = 1;
} else {
- if (old_secure_tcp >= 2)
+ if (ipvs->old_secure_tcp >= 2)
to_change = 0;
ipvs->sysctl_secure_tcp = 1;
}
break;
case 3:
- if (old_secure_tcp < 2)
+ if (ipvs->old_secure_tcp < 2)
to_change = 1;
break;
}
- old_secure_tcp = ipvs->sysctl_secure_tcp;
+ ipvs->old_secure_tcp = ipvs->sysctl_secure_tcp;
if (to_change >= 0)
ip_vs_protocol_timeout_change(ipvs,
ipvs->sysctl_secure_tcp > 1);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 091/136] bonding: fix unexpected IFF_BONDING bit unset
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (89 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 090/136] ipvs: move old_secure_tcp into struct netns_ipvs Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 092/136] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume Ben Hutchings
` (45 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, David S. Miller, Taehee Yoo
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Taehee Yoo <ap420073@gmail.com>
commit 65de65d9033750d2cf1b336c9d6e9da3a8b5cc6e upstream.
The IFF_BONDING means bonding master or bonding slave device.
->ndo_add_slave() sets IFF_BONDING flag and ->ndo_del_slave() unsets
IFF_BONDING flag.
bond0<--bond1
Both bond0 and bond1 are bonding device and these should keep having
IFF_BONDING flag until they are removed.
But bond1 would lose IFF_BONDING at ->ndo_del_slave() because that routine
do not check whether the slave device is the bonding type or not.
This patch adds the interface type check routine before removing
IFF_BONDING flag.
Test commands:
ip link add bond0 type bond
ip link add bond1 type bond
ip link set bond1 master bond0
ip link set bond1 nomaster
ip link del bond1 type bond
ip link add bond1 type bond
Splat looks like:
[ 226.665555] proc_dir_entry 'bonding/bond1' already registered
[ 226.666440] WARNING: CPU: 0 PID: 737 at fs/proc/generic.c:361 proc_register+0x2a9/0x3e0
[ 226.667571] Modules linked in: bonding af_packet sch_fq_codel ip_tables x_tables unix
[ 226.668662] CPU: 0 PID: 737 Comm: ip Not tainted 5.4.0-rc3+ #96
[ 226.669508] Hardware name: innotek GmbH VirtualBox/VirtualBox, BIOS VirtualBox 12/01/2006
[ 226.670652] RIP: 0010:proc_register+0x2a9/0x3e0
[ 226.671612] Code: 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 39 01 00 00 48 8b 04 24 48 89 ea 48 c7 c7 a0 0b 14 9f 48 8b b0 e
0 00 00 00 e8 07 e7 88 ff <0f> 0b 48 c7 c7 40 2d a5 9f e8 59 d6 23 01 48 8b 4c 24 10 48 b8 00
[ 226.675007] RSP: 0018:ffff888050e17078 EFLAGS: 00010282
[ 226.675761] RAX: dffffc0000000008 RBX: ffff88805fdd0f10 RCX: ffffffff9dd344e2
[ 226.676757] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88806c9f6b8c
[ 226.677751] RBP: ffff8880507160f3 R08: ffffed100d940019 R09: ffffed100d940019
[ 226.678761] R10: 0000000000000001 R11: ffffed100d940018 R12: ffff888050716008
[ 226.679757] R13: ffff8880507160f2 R14: dffffc0000000000 R15: ffffed100a0e2c1e
[ 226.680758] FS: 00007fdc217cc0c0(0000) GS:ffff88806c800000(0000) knlGS:0000000000000000
[ 226.681886] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 226.682719] CR2: 00007f49313424d0 CR3: 0000000050e46001 CR4: 00000000000606f0
[ 226.683727] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 226.684725] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 226.685681] Call Trace:
[ 226.687089] proc_create_seq_private+0xb3/0xf0
[ 226.687778] bond_create_proc_entry+0x1b3/0x3f0 [bonding]
[ 226.691458] bond_netdev_event+0x433/0x970 [bonding]
[ 226.692139] ? __module_text_address+0x13/0x140
[ 226.692779] notifier_call_chain+0x90/0x160
[ 226.693401] register_netdevice+0x9b3/0xd80
[ 226.694010] ? alloc_netdev_mqs+0x854/0xc10
[ 226.694629] ? netdev_change_features+0xa0/0xa0
[ 226.695278] ? rtnl_create_link+0x2ed/0xad0
[ 226.695849] bond_newlink+0x2a/0x60 [bonding]
[ 226.696422] __rtnl_newlink+0xb9f/0x11b0
[ 226.696968] ? rtnl_link_unregister+0x220/0x220
[ ... ]
Fixes: 0b680e753724 ("[PATCH] bonding: Add priv_flag to avoid event mishandling")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/bonding/bond_main.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1645,7 +1645,8 @@ err_detach:
slave_disable_netpoll(new_slave);
err_close:
- slave_dev->priv_flags &= ~IFF_BONDING;
+ if (!netif_is_bond_master(slave_dev))
+ slave_dev->priv_flags &= ~IFF_BONDING;
dev_close(slave_dev);
err_restore_mac:
@@ -1858,7 +1859,8 @@ static int __bond_release_one(struct net
dev_set_mtu(slave_dev, slave->original_mtu);
- slave_dev->priv_flags &= ~IFF_BONDING;
+ if (!netif_is_bond_master(slave_dev))
+ slave_dev->priv_flags &= ~IFF_BONDING;
bond_free_slave(slave);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 092/136] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (90 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 091/136] bonding: fix unexpected IFF_BONDING bit unset Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 093/136] ALSA: bebob: Fix prototype of helper function to return negative value Ben Hutchings
` (44 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Marek Szyprowski,
Reported-by: Marian Mihailescu, Sylwester Nawrocki
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
commit e9323b664ce29547d996195e8a6129a351c39108 upstream.
Properly save and restore all top PLL related configuration registers
during suspend/resume cycle. So far driver only handled EPLL and RPLL
clocks, all other were reset to default values after suspend/resume cycle.
This caused for example lower G3D (MALI Panfrost) performance after system
resume, even if performance governor has been selected.
Reported-by: Reported-by: Marian Mihailescu <mihailescu2m@gmail.com>
Fixes: 773424326b51 ("clk: samsung: exynos5420: add more registers to restore list")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/clk/samsung/clk-exynos5420.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/clk/samsung/clk-exynos5420.c
+++ b/drivers/clk/samsung/clk-exynos5420.c
@@ -162,12 +162,18 @@ static unsigned long exynos5x_clk_regs[]
GATE_BUS_CPU,
GATE_SCLK_CPU,
CLKOUT_CMU_CPU,
+ CPLL_CON0,
+ DPLL_CON0,
EPLL_CON0,
EPLL_CON1,
EPLL_CON2,
RPLL_CON0,
RPLL_CON1,
RPLL_CON2,
+ IPLL_CON0,
+ SPLL_CON0,
+ VPLL_CON0,
+ MPLL_CON0,
SRC_TOP0,
SRC_TOP1,
SRC_TOP2,
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 093/136] ALSA: bebob: Fix prototype of helper function to return negative value
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (91 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 092/136] clk: samsung: exynos5420: Preserve PLL configuration during suspend/resume Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 094/136] usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode Ben Hutchings
` (43 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Sakamoto, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit f2bbdbcb075f3977a53da3bdcb7cd460bc8ae5f2 upstream.
A helper function of ALSA bebob driver returns negative value in a
function which has a prototype to return unsigned value.
This commit fixes it by changing the prototype.
Fixes: eb7b3a056cd8 ("ALSA: bebob: Add commands and connections/streams management")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20191026030620.12077-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/firewire/bebob/bebob_stream.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/sound/firewire/bebob/bebob_stream.c
+++ b/sound/firewire/bebob/bebob_stream.c
@@ -196,8 +196,7 @@ end:
return err;
}
-static unsigned int
-map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
+static int map_data_channels(struct snd_bebob *bebob, struct amdtp_stream *s)
{
unsigned int sec, sections, ch, channels;
unsigned int pcm, midi, location;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 094/136] usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode.
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (92 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 093/136] ALSA: bebob: Fix prototype of helper function to return negative value Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 095/136] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity Ben Hutchings
` (42 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Cristian Birsan, Felipe Balbi
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Cristian Birsan <cristian.birsan@microchip.com>
commit ba3a1a915c49cc3023e4ddfc88f21e7514e82aa4 upstream.
Fix interrupt storm generated by endpoints when working in FIFO mode.
The TX_COMPLETE interrupt is used only by control endpoints processing.
Do not enable it for other types of endpoints.
Fixes: 914a3f3b3754 ("USB: add atmel_usba_udc driver")
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/gadget/atmel_usba_udc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/usb/gadget/atmel_usba_udc.c
+++ b/drivers/usb/gadget/atmel_usba_udc.c
@@ -392,9 +392,11 @@ static void submit_request(struct usba_e
next_fifo_transaction(ep, req);
if (req->last_transaction) {
usba_ep_writel(ep, CTL_DIS, USBA_TX_PK_RDY);
- usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
+ if (ep_is_control(ep))
+ usba_ep_writel(ep, CTL_ENB, USBA_TX_COMPLETE);
} else {
- usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
+ if (ep_is_control(ep))
+ usba_ep_writel(ep, CTL_DIS, USBA_TX_COMPLETE);
usba_ep_writel(ep, CTL_ENB, USBA_TX_PK_RDY);
}
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 095/136] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (93 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 094/136] usb: gadget: udc: atmel: Fix interrupt storm in FIFO mode Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 096/136] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h) Ben Hutchings
` (41 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Arnaldo Carvalho de Melo, Stephane Eranian,
Kim Phillips, Linus Torvalds, Ingo Molnar, Jiri Olsa,
Mark Rutland, Alexander Shishkin, Arnaldo Carvalho de Melo,
H. Peter Anvin, Namhyung Kim, Thomas Gleixner, Borislav Petkov,
Peter Zijlstra (Intel),
Vince Weaver
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@amd.com>
commit 317b96bb14303c7998dbcd5bc606bd8038fdd4b4 upstream.
The loop that reads all the IBS MSRs into *buf stopped one MSR short of
reading the IbsOpData register, which contains the RipInvalid status bit.
Fix the offset_max assignment so the MSR gets read, so the RIP invalid
evaluation is based on what the IBS h/w output, instead of what was
left in memory.
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: d47e8238cd76 ("perf/x86-ibs: Take instruction pointer from ibs sample")
Link: https://lkml.kernel.org/r/20191023150955.30292-1-kim.phillips@amd.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.16: adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kernel/cpu/perf_event_amd_ibs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -555,7 +555,7 @@ static int perf_ibs_handle_irq(struct pe
if (event->attr.sample_type & PERF_SAMPLE_RAW)
offset_max = perf_ibs->offset_max;
else if (check_rip)
- offset_max = 2;
+ offset_max = 3;
else
offset_max = 1;
do {
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 096/136] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h)
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (94 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 095/136] perf/x86/amd/ibs: Fix reading of the IBS OpData register and thus precise RIP validity Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 097/136] clk: at91: avoid sleeping early Ben Hutchings
` (40 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Borislav Petkov, Peter Zijlstra (Intel),
Thomas Gleixner, Vince Weaver, Mark Rutland, Alexander Shishkin,
Jiri Olsa, Namhyung Kim, H. Peter Anvin,
Arnaldo Carvalho de Melo, Linus Torvalds, Ingo Molnar,
Stephane Eranian, Arnaldo Carvalho de Melo, Kim Phillips
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kim Phillips <kim.phillips@amd.com>
commit e431e79b60603079d269e0c2a5177943b95fa4b6 upstream.
This saves us writing the IBS control MSR twice when disabling the
event.
I searched revision guides for all families since 10h, and did not
find occurrence of erratum #420, nor anything remotely similar:
so we isolate the secondary MSR write to family 10h only.
Also unconditionally update the count mask for IBS Op implementations
that have read & writeable current count (CurCnt) fields in addition
to the MaxCnt field. These bits were reserved on prior
implementations, and therefore shouldn't have negative impact.
Signed-off-by: Kim Phillips <kim.phillips@amd.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: c9574fe0bdb9 ("perf/x86-ibs: Implement workaround for IBS erratum #420")
Link: https://lkml.kernel.org/r/20191023150955.30292-2-kim.phillips@amd.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
[bwh: Backported to 3.16:
- Don't update the count mask; we don't use or define the CurCnt fields here
- Adjust filename]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -351,7 +351,8 @@ static inline void perf_ibs_disable_even
struct hw_perf_event *hwc, u64 config)
{
config &= ~perf_ibs->cnt_mask;
- wrmsrl(hwc->config_base, config);
+ if (boot_cpu_data.x86 == 0x10)
+ wrmsrl(hwc->config_base, config);
config &= ~perf_ibs->enable_mask;
wrmsrl(hwc->config_base, config);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 097/136] clk: at91: avoid sleeping early
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (95 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 096/136] perf/x86/amd/ibs: Handle erratum #420 only on the affected CPU family (10h) Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 098/136] USB: ldusb: fix ring-buffer locking Ben Hutchings
` (39 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Uwe Kleine-König, Stephen Boyd,
Alexandre Belloni
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Belloni <alexandre.belloni@bootlin.com>
commit 658fd65cf0b0d511de1718e48d9a28844c385ae0 upstream.
It is not allowed to sleep to early in the boot process and this may lead
to kernel issues if the bootloader didn't prepare the slow clock and main
clock.
This results in the following error and dump stack on the AriettaG25:
bad: scheduling from the idle thread!
Ensure it is possible to sleep, else simply have a delay.
Reported-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lkml.kernel.org/r/20190920153906.20887-1-alexandre.belloni@bootlin.com
Fixes: 80eded6ce8bb ("clk: at91: add slow clks driver")
Tested-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
[bwh: Backported to 3.16:
- Drop changes in clk_sama5d4_slow_osc_prepare()
- Adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/clk/at91/clk-main.c | 5 ++++-
drivers/clk/at91/clk-slow.c | 20 ++++++++++++++++----
2 files changed, 20 insertions(+), 5 deletions(-)
--- a/drivers/clk/at91/clk-main.c
+++ b/drivers/clk/at91/clk-main.c
@@ -374,7 +374,10 @@ static int clk_main_probe_frequency(stru
tmp = pmc_read(pmc, AT91_CKGR_MCFR);
if (tmp & AT91_PMC_MAINRDY)
return 0;
- usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
+ if (system_state < SYSTEM_RUNNING)
+ udelay(MAINF_LOOP_MIN_WAIT);
+ else
+ usleep_range(MAINF_LOOP_MIN_WAIT, MAINF_LOOP_MAX_WAIT);
} while (time_before(prep_time, timeout));
return -ETIMEDOUT;
--- a/drivers/clk/at91/clk-slow.c
+++ b/drivers/clk/at91/clk-slow.c
@@ -83,7 +83,10 @@ static int clk_slow_osc_prepare(struct c
writel(tmp | AT91_SCKC_OSC32EN, sckcr);
- usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ if (system_state < SYSTEM_RUNNING)
+ udelay(osc->startup_usec);
+ else
+ usleep_range(osc->startup_usec, osc->startup_usec + 1);
return 0;
}
@@ -202,7 +205,10 @@ static int clk_slow_rc_osc_prepare(struc
writel(readl(sckcr) | AT91_SCKC_RCEN, sckcr);
- usleep_range(osc->startup_usec, osc->startup_usec + 1);
+ if (system_state < SYSTEM_RUNNING)
+ udelay(osc->startup_usec);
+ else
+ usleep_range(osc->startup_usec, osc->startup_usec + 1);
return 0;
}
@@ -311,7 +317,10 @@ static int clk_sam9x5_slow_set_parent(st
writel(tmp, sckcr);
- usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
+ if (system_state < SYSTEM_RUNNING)
+ udelay(SLOWCK_SW_TIME_USEC);
+ else
+ usleep_range(SLOWCK_SW_TIME_USEC, SLOWCK_SW_TIME_USEC + 1);
return 0;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 098/136] USB: ldusb: fix ring-buffer locking
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (96 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 097/136] clk: at91: avoid sleeping early Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 099/136] USB: ldusb: fix control-message timeout Ben Hutchings
` (38 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit d98ee2a19c3334e9343df3ce254b496f1fc428eb upstream.
The custom ring-buffer implementation was merged without any locking or
explicit memory barriers, but a spinlock was later added by commit
9d33efd9a791 ("USB: ldusb bugfix").
The lock did not cover the update of the tail index once the entry had
been processed, something which could lead to memory corruption on
weakly ordered architectures or due to compiler optimisations.
Specifically, a completion handler running on another CPU might observe
the incremented tail index and update the entry before ld_usb_read() is
done with it.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Fixes: 9d33efd9a791 ("USB: ldusb bugfix")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191022143203.5260-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/ldusb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -509,11 +509,11 @@ static ssize_t ld_usb_read(struct file *
retval = -EFAULT;
goto unlock_exit;
}
- dev->ring_tail = (dev->ring_tail+1) % ring_buffer_size;
-
retval = bytes_to_read;
spin_lock_irq(&dev->rbsl);
+ dev->ring_tail = (dev->ring_tail + 1) % ring_buffer_size;
+
if (dev->buffer_overflow) {
dev->buffer_overflow = 0;
spin_unlock_irq(&dev->rbsl);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 099/136] USB: ldusb: fix control-message timeout
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (97 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 098/136] USB: ldusb: fix ring-buffer locking Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 100/136] net: fix sk_page_frag() recursion from memory reclaim Ben Hutchings
` (37 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold,
syzbot+a4fbb3bb76cda0ea4e58
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 52403cfbc635d28195167618690595013776ebde upstream.
USB control-message timeouts are specified in milliseconds, not jiffies.
Waiting 83 minutes for a transfer to complete is a bit excessive.
Fixes: 2824bd250f0b ("[PATCH] USB: add ldusb driver")
Reported-by: syzbot+a4fbb3bb76cda0ea4e58@syzkaller.appspotmail.com
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191022153127.22295-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/misc/ldusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/ldusb.c
+++ b/drivers/usb/misc/ldusb.c
@@ -594,7 +594,7 @@ static ssize_t ld_usb_write(struct file
1 << 8, 0,
dev->interrupt_out_buffer,
bytes_to_write,
- USB_CTRL_SET_TIMEOUT * HZ);
+ USB_CTRL_SET_TIMEOUT);
if (retval < 0)
dev_err(&dev->intf->dev,
"Couldn't submit HID_REQ_SET_REPORT %d\n",
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 100/136] net: fix sk_page_frag() recursion from memory reclaim
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (98 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 099/136] USB: ldusb: fix control-message timeout Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 101/136] scsi: qla2xxx: stop timer in shutdown path Ben Hutchings
` (36 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Tejun Heo, Josef Bacik, David S. Miller,
Eric Dumazet
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 20eb4f29b60286e0d6dc01d9c260b4bd383c58fb upstream.
sk_page_frag() optimizes skb_frag allocations by using per-task
skb_frag cache when it knows it's the only user. The condition is
determined by seeing whether the socket allocation mask allows
blocking - if the allocation may block, it obviously owns the task's
context and ergo exclusively owns current->task_frag.
Unfortunately, this misses recursion through memory reclaim path.
Please take a look at the following backtrace.
[2] RIP: 0010:tcp_sendmsg_locked+0xccf/0xe10
...
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
sock_xmit.isra.24+0xa1/0x170 [nbd]
nbd_send_cmd+0x1d2/0x690 [nbd]
nbd_queue_rq+0x1b5/0x3b0 [nbd]
__blk_mq_try_issue_directly+0x108/0x1b0
blk_mq_request_issue_directly+0xbd/0xe0
blk_mq_try_issue_list_directly+0x41/0xb0
blk_mq_sched_insert_requests+0xa2/0xe0
blk_mq_flush_plug_list+0x205/0x2a0
blk_flush_plug_list+0xc3/0xf0
[1] blk_finish_plug+0x21/0x2e
_xfs_buf_ioapply+0x313/0x460
__xfs_buf_submit+0x67/0x220
xfs_buf_read_map+0x113/0x1a0
xfs_trans_read_buf_map+0xbf/0x330
xfs_btree_read_buf_block.constprop.42+0x95/0xd0
xfs_btree_lookup_get_block+0x95/0x170
xfs_btree_lookup+0xcc/0x470
xfs_bmap_del_extent_real+0x254/0x9a0
__xfs_bunmapi+0x45c/0xab0
xfs_bunmapi+0x15/0x30
xfs_itruncate_extents_flags+0xca/0x250
xfs_free_eofblocks+0x181/0x1e0
xfs_fs_destroy_inode+0xa8/0x1b0
destroy_inode+0x38/0x70
dispose_list+0x35/0x50
prune_icache_sb+0x52/0x70
super_cache_scan+0x120/0x1a0
do_shrink_slab+0x120/0x290
shrink_slab+0x216/0x2b0
shrink_node+0x1b6/0x4a0
do_try_to_free_pages+0xc6/0x370
try_to_free_mem_cgroup_pages+0xe3/0x1e0
try_charge+0x29e/0x790
mem_cgroup_charge_skmem+0x6a/0x100
__sk_mem_raise_allocated+0x18e/0x390
__sk_mem_schedule+0x2a/0x40
[0] tcp_sendmsg_locked+0x8eb/0xe10
tcp_sendmsg+0x27/0x40
sock_sendmsg+0x30/0x40
___sys_sendmsg+0x26d/0x2b0
__sys_sendmsg+0x57/0xa0
do_syscall_64+0x42/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
In [0], tcp_send_msg_locked() was using current->page_frag when it
called sk_wmem_schedule(). It already calculated how many bytes can
be fit into current->page_frag. Due to memory pressure,
sk_wmem_schedule() called into memory reclaim path which called into
xfs and then IO issue path. Because the filesystem in question is
backed by nbd, the control goes back into the tcp layer - back into
tcp_sendmsg_locked().
nbd sets sk_allocation to (GFP_NOIO | __GFP_MEMALLOC) which makes
sense - it's in the process of freeing memory and wants to be able to,
e.g., drop clean pages to make forward progress. However, this
confused sk_page_frag() called from [2]. Because it only tests
whether the allocation allows blocking which it does, it now thinks
current->page_frag can be used again although it already was being
used in [0].
After [2] used current->page_frag, the offset would be increased by
the used amount. When the control returns to [0],
current->page_frag's offset is increased and the previously calculated
number of bytes now may overrun the end of allocated memory leading to
silent memory corruptions.
Fix it by adding gfpflags_normal_context() which tests sleepable &&
!reclaim and use it to determine whether to use current->task_frag.
v2: Eric didn't like gfp flags being tested twice. Introduce a new
helper gfpflags_normal_context() and combine the two tests.
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: Keep testing __GFP_WAIT flag instead of
__GFP_DIRECT_RECLAIM.]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/include/linux/gfp.h
+++ b/include/linux/gfp.h
@@ -168,6 +168,28 @@ static inline int allocflags_to_migratet
((gfp_flags & __GFP_RECLAIMABLE) != 0);
}
+/**
+ * gfpflags_normal_context - is gfp_flags a normal sleepable context?
+ * @gfp_flags: gfp_flags to test
+ *
+ * Test whether @gfp_flags indicates that the allocation is from the
+ * %current context and allowed to sleep.
+ *
+ * An allocation being allowed to block doesn't mean it owns the %current
+ * context. When direct reclaim path tries to allocate memory, the
+ * allocation context is nested inside whatever %current was doing at the
+ * time of the original allocation. The nested allocation may be allowed
+ * to block but modifying anything %current owns can corrupt the outer
+ * context's expectations.
+ *
+ * %true result from this function indicates that the allocation context
+ * can sleep and use anything that's associated with %current.
+ */
+static inline bool gfpflags_normal_context(const gfp_t gfp_flags)
+{
+ return (gfp_flags & (__GFP_WAIT | __GFP_MEMALLOC)) == __GFP_WAIT;
+}
+
#ifdef CONFIG_HIGHMEM
#define OPT_ZONE_HIGHMEM ZONE_HIGHMEM
#else
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2103,12 +2103,17 @@ struct sk_buff *sk_stream_alloc_skb(stru
* sk_page_frag - return an appropriate page_frag
* @sk: socket
*
- * If socket allocation mode allows current thread to sleep, it means its
- * safe to use the per task page_frag instead of the per socket one.
+ * Use the per task page_frag instead of the per socket one for
+ * optimization when we know that we're in the normal context and owns
+ * everything that's associated with %current.
+ *
+ * Testing __GFP_WAIT isn't enough here as direct reclaim may nest
+ * inside other socket operations and end up recursing into sk_page_frag()
+ * while it's already in use.
*/
static inline struct page_frag *sk_page_frag(struct sock *sk)
{
- if (sk->sk_allocation & __GFP_WAIT)
+ if (gfpflags_normal_context(sk->sk_allocation))
return ¤t->task_frag;
return &sk->sk_frag;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 101/136] scsi: qla2xxx: stop timer in shutdown path
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (99 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 100/136] net: fix sk_page_frag() recursion from memory reclaim Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 102/136] USB: gadget: Reject endpoints with 0 maxpacket value Ben Hutchings
` (35 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Himanshu Madhani, Nicholas Piggin,
Martin K. Petersen
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Nicholas Piggin <npiggin@gmail.com>
commit d3566abb1a1e7772116e4d50fb6a58d19c9802e5 upstream.
In shutdown/reboot paths, the timer is not stopped:
qla2x00_shutdown
pci_device_shutdown
device_shutdown
kernel_restart_prepare
kernel_restart
sys_reboot
This causes lockups (on powerpc) when firmware config space access calls
are interrupted by smp_send_stop later in reboot.
Fixes: e30d1756480dc ("[SCSI] qla2xxx: Addition of shutdown callback handler.")
Link: https://lore.kernel.org/r/20191024063804.14538-1-npiggin@gmail.com
Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
Acked-by: Himanshu Madhani <hmadhani@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/scsi/qla2xxx/qla_os.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3006,6 +3006,10 @@ qla2x00_shutdown(struct pci_dev *pdev)
/* Stop currently executing firmware. */
qla2x00_try_to_stop_firmware(vha);
+ /* Disable timer */
+ if (vha->timer_active)
+ qla2x00_stop_timer(vha);
+
/* Turn adapter off line */
vha->flags.online = 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 102/136] USB: gadget: Reject endpoints with 0 maxpacket value
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (100 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 101/136] scsi: qla2xxx: stop timer in shutdown path Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 103/136] ceph: fix use-after-free in __ceph_remove_cap() Ben Hutchings
` (34 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Alan Stern, Felipe Balbi, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 54f83b8c8ea9b22082a496deadf90447a326954e upstream.
Endpoints with a maxpacket length of 0 are probably useless. They
can't transfer any data, and it's not at all unlikely that a UDC will
crash or hang when trying to handle a non-zero-length usb_request for
such an endpoint. Indeed, dummy-hcd gets a divide error when trying
to calculate the remainder of a transfer length by the maxpacket
value, as discovered by the syzbot fuzzer.
Currently the gadget core does not check for endpoints having a
maxpacket value of 0. This patch adds a check to usb_ep_enable(),
preventing such endpoints from being used.
As far as I know, none of the gadget drivers in the kernel tries to
create an endpoint with maxpacket = 0, but until now there has been
nothing to prevent userspace programs under gadgetfs or configfs from
doing it.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Reported-and-tested-by: syzbot+8ab8bf161038a8768553@syzkaller.appspotmail.com
Acked-by: Felipe Balbi <balbi@kernel.org>
Link: https://lore.kernel.org/r/Pine.LNX.4.44L0.1910281052370.1485-100000@iolanthe.rowland.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/linux/usb/gadget.h | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/include/linux/usb/gadget.h
+++ b/include/linux/usb/gadget.h
@@ -222,6 +222,16 @@ static inline void usb_ep_set_maxpacket_
*/
static inline int usb_ep_enable(struct usb_ep *ep)
{
+ /* UDC drivers can't handle endpoints with maxpacket size 0 */
+ if (usb_endpoint_maxp(ep->desc) == 0) {
+ /*
+ * We should log an error message here, but we can't call
+ * dev_err() because there's no way to find the gadget
+ * given only ep.
+ */
+ return -EINVAL;
+ }
+
return ep->ops->enable(ep, ep->desc);
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 103/136] ceph: fix use-after-free in __ceph_remove_cap()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (101 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 102/136] USB: gadget: Reject endpoints with 0 maxpacket value Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 104/136] ceph: add missing check in d_revalidate snapdir handling Ben Hutchings
` (33 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Luis Henriques, Ilya Dryomov, Jeff Layton
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Luis Henriques <lhenriques@suse.com>
commit ea60ed6fcf29eebc78f2ce91491e6309ee005a01 upstream.
KASAN reports a use-after-free when running xfstest generic/531, with the
following trace:
[ 293.903362] kasan_report+0xe/0x20
[ 293.903365] rb_erase+0x1f/0x790
[ 293.903370] __ceph_remove_cap+0x201/0x370
[ 293.903375] __ceph_remove_caps+0x4b/0x70
[ 293.903380] ceph_evict_inode+0x4e/0x360
[ 293.903386] evict+0x169/0x290
[ 293.903390] __dentry_kill+0x16f/0x250
[ 293.903394] dput+0x1c6/0x440
[ 293.903398] __fput+0x184/0x330
[ 293.903404] task_work_run+0xb9/0xe0
[ 293.903410] exit_to_usermode_loop+0xd3/0xe0
[ 293.903413] do_syscall_64+0x1a0/0x1c0
[ 293.903417] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This happens because __ceph_remove_cap() may queue a cap release
(__ceph_queue_cap_release) which can be scheduled before that cap is
removed from the inode list with
rb_erase(&cap->ci_node, &ci->i_caps);
And, when this finally happens, the use-after-free will occur.
This can be fixed by removing the cap from the inode list before being
removed from the session list, and thus eliminating the risk of an UAF.
Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ceph/caps.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/fs/ceph/caps.c
+++ b/fs/ceph/caps.c
@@ -913,6 +913,11 @@ void __ceph_remove_cap(struct ceph_cap *
dout("__ceph_remove_cap %p from %p\n", cap, &ci->vfs_inode);
+ /* remove from inode's cap rbtree, and clear auth cap */
+ rb_erase(&cap->ci_node, &ci->i_caps);
+ if (ci->i_auth_cap == cap)
+ ci->i_auth_cap = NULL;
+
/* remove from session list */
spin_lock(&session->s_cap_lock);
/*
@@ -939,11 +944,6 @@ void __ceph_remove_cap(struct ceph_cap *
cap->ci = NULL;
spin_unlock(&session->s_cap_lock);
- /* remove from inode list */
- rb_erase(&cap->ci_node, &ci->i_caps);
- if (ci->i_auth_cap == cap)
- ci->i_auth_cap = NULL;
-
if (removed)
ceph_put_cap(mdsc, cap);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 104/136] ceph: add missing check in d_revalidate snapdir handling
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (102 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 103/136] ceph: fix use-after-free in __ceph_remove_cap() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 105/136] USB: serial: whiteheat: fix potential slab corruption Ben Hutchings
` (32 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jeff Layton, Al Viro, Ilya Dryomov
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 1f08529c84cfecaf1261ed9b7e17fab18541c58f upstream.
We should not play with dcache without parent locked...
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
[bwh: Backported to 3.16:
- Test ceph_mds_request::r_locked_dir
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ceph/inode.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1260,6 +1260,7 @@ retry_lookup:
req->r_request_started);
dout(" final dn %p\n", dn);
} else if (!req->r_aborted &&
+ req->r_locked_dir &&
(req->r_op == CEPH_MDS_OP_LOOKUPSNAP ||
req->r_op == CEPH_MDS_OP_MKSNAP)) {
struct dentry *dn = req->r_dentry;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 105/136] USB: serial: whiteheat: fix potential slab corruption
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (103 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 104/136] ceph: add missing check in d_revalidate snapdir handling Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 106/136] USB: serial: whiteheat: fix line-speed endianness Ben Hutchings
` (31 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Johan Hovold, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 1251dab9e0a2c4d0d2d48370ba5baa095a5e8774 upstream.
Fix a user-controlled slab buffer overflow due to a missing sanity check
on the bulk-out transfer buffer used for control requests.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191029102354.2733-2-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/whiteheat.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -604,6 +604,10 @@ static int firm_send_command(struct usb_
command_port = port->serial->port[COMMAND_PORT];
command_info = usb_get_serial_port_data(command_port);
+
+ if (command_port->bulk_out_size < datasize + 1)
+ return -EIO;
+
mutex_lock(&command_info->mutex);
command_info->command_finished = false;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 106/136] USB: serial: whiteheat: fix line-speed endianness
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (104 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 105/136] USB: serial: whiteheat: fix potential slab corruption Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 107/136] nl80211: fix validation of mesh path nexthop Ben Hutchings
` (30 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Greg Kroah-Hartman, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 84968291d7924261c6a0624b9a72f952398e258b upstream.
Add missing endianness conversion when setting the line speed so that
this driver might work also on big-endian machines.
Also use an unsigned format specifier in the corresponding debug
message.
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://lore.kernel.org/r/20191029102354.2733-3-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/usb/serial/whiteheat.c | 9 ++++++---
drivers/usb/serial/whiteheat.h | 2 +-
2 files changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/usb/serial/whiteheat.c
+++ b/drivers/usb/serial/whiteheat.c
@@ -681,6 +681,7 @@ static void firm_setup_port(struct tty_s
struct device *dev = &port->dev;
struct whiteheat_port_settings port_settings;
unsigned int cflag = tty->termios.c_cflag;
+ speed_t baud;
port_settings.port = port->port_number + 1;
@@ -741,11 +742,13 @@ static void firm_setup_port(struct tty_s
dev_dbg(dev, "%s - XON = %2x, XOFF = %2x\n", __func__, port_settings.xon, port_settings.xoff);
/* get the baud rate wanted */
- port_settings.baud = tty_get_baud_rate(tty);
- dev_dbg(dev, "%s - baud rate = %d\n", __func__, port_settings.baud);
+ baud = tty_get_baud_rate(tty);
+ port_settings.baud = cpu_to_le32(baud);
+ dev_dbg(dev, "%s - baud rate = %u\n", __func__, baud);
/* fixme: should set validated settings */
- tty_encode_baud_rate(tty, port_settings.baud, port_settings.baud);
+ tty_encode_baud_rate(tty, baud, baud);
+
/* handle any settings that aren't specified in the tty structure */
port_settings.lloop = 0;
--- a/drivers/usb/serial/whiteheat.h
+++ b/drivers/usb/serial/whiteheat.h
@@ -91,7 +91,7 @@ struct whiteheat_simple {
struct whiteheat_port_settings {
__u8 port; /* port number (1 to N) */
- __u32 baud; /* any value 7 - 460800, firmware calculates
+ __le32 baud; /* any value 7 - 460800, firmware calculates
best fit; arrives little endian */
__u8 bits; /* 5, 6, 7, or 8 */
__u8 stop; /* 1 or 2, default 1 (2 = 1.5 if bits = 5) */
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 107/136] nl80211: fix validation of mesh path nexthop
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (105 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 106/136] USB: serial: whiteheat: fix line-speed endianness Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 108/136] ALSA: timer: Simplify error path in snd_timer_open() Ben Hutchings
` (29 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Markus Theil, Johannes Berg, Greg Kroah-Hartman
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Markus Theil <markus.theil@tu-ilmenau.de>
commit 1fab1b89e2e8f01204a9c05a39fd0b6411a48593 upstream.
Mesh path nexthop should be a ethernet address, but current validation
checks against 4 byte integers.
Fixes: 2ec600d672e74 ("nl80211/cfg80211: support for mesh, sta dumping")
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
Link: https://lore.kernel.org/r/20191029093003.10355-1-markus.theil@tu-ilmenau.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/wireless/nl80211.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -289,7 +289,8 @@ static const struct nla_policy nl80211_p
[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
.len = IEEE80211_MAX_MESH_ID_LEN },
- [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
+ [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY,
+ .len = ETH_ALEN },
[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 108/136] ALSA: timer: Simplify error path in snd_timer_open()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (106 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 107/136] nl80211: fix validation of mesh path nexthop Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 109/136] ALSA: timer: Fix incorrectly assigned timer instance Ben Hutchings
` (28 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 41672c0c24a62699d20aab53b98d843b16483053 upstream.
Just a minor refactoring to use the standard goto for error paths in
snd_timer_open() instead of open code. The first mutex_lock() is
moved to the beginning of the function to make the code clearer.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.16 as dependency of commit a39331867335
"ALSA: timer: Fix mutex deadlock at releasing card"]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/timer.c | 39 ++++++++++++++++++++-------------------
1 file changed, 20 insertions(+), 19 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -255,19 +255,20 @@ int snd_timer_open(struct snd_timer_inst
struct snd_timer_instance *timeri = NULL;
int err;
+ mutex_lock(®ister_mutex);
if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
/* open a slave instance */
if (tid->dev_sclass <= SNDRV_TIMER_SCLASS_NONE ||
tid->dev_sclass > SNDRV_TIMER_SCLASS_OSS_SEQUENCER) {
pr_debug("ALSA: timer: invalid slave class %i\n",
tid->dev_sclass);
- return -EINVAL;
+ err = -EINVAL;
+ goto unlock;
}
- mutex_lock(®ister_mutex);
timeri = snd_timer_instance_new(owner, NULL);
if (!timeri) {
- mutex_unlock(®ister_mutex);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto unlock;
}
timeri->slave_class = tid->dev_sclass;
timeri->slave_id = tid->device;
@@ -278,13 +279,10 @@ int snd_timer_open(struct snd_timer_inst
snd_timer_close_locked(timeri);
timeri = NULL;
}
- mutex_unlock(®ister_mutex);
- *ti = timeri;
- return err;
+ goto unlock;
}
/* open a master instance */
- mutex_lock(®ister_mutex);
timer = snd_timer_find(tid);
#ifdef CONFIG_MODULES
if (!timer) {
@@ -295,25 +293,26 @@ int snd_timer_open(struct snd_timer_inst
}
#endif
if (!timer) {
- mutex_unlock(®ister_mutex);
- return -ENODEV;
+ err = -ENODEV;
+ goto unlock;
}
if (!list_empty(&timer->open_list_head)) {
timeri = list_entry(timer->open_list_head.next,
struct snd_timer_instance, open_list);
if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
- mutex_unlock(®ister_mutex);
- return -EBUSY;
+ err = -EBUSY;
+ timeri = NULL;
+ goto unlock;
}
}
if (timer->num_instances >= timer->max_instances) {
- mutex_unlock(®ister_mutex);
- return -EBUSY;
+ err = -EBUSY;
+ goto unlock;
}
timeri = snd_timer_instance_new(owner, timer);
if (!timeri) {
- mutex_unlock(®ister_mutex);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto unlock;
}
/* take a card refcount for safe disconnection */
if (timer->card)
@@ -322,16 +321,16 @@ int snd_timer_open(struct snd_timer_inst
timeri->slave_id = slave_id;
if (list_empty(&timer->open_list_head) && timer->hw.open) {
- int err = timer->hw.open(timer);
+ err = timer->hw.open(timer);
if (err) {
kfree(timeri->owner);
kfree(timeri);
+ timeri = NULL;
if (timer->card)
put_device(&timer->card->card_dev);
module_put(timer->module);
- mutex_unlock(®ister_mutex);
- return err;
+ goto unlock;
}
}
@@ -342,6 +341,8 @@ int snd_timer_open(struct snd_timer_inst
snd_timer_close_locked(timeri);
timeri = NULL;
}
+
+ unlock:
mutex_unlock(®ister_mutex);
*ti = timeri;
return err;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 109/136] ALSA: timer: Fix incorrectly assigned timer instance
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (107 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 108/136] ALSA: timer: Simplify error path in snd_timer_open() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 110/136] ALSA: timer: Fix mutex deadlock at releasing card Ben Hutchings
` (27 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit e7af6307a8a54f0b873960b32b6a644f2d0fbd97 upstream.
The clean up commit 41672c0c24a6 ("ALSA: timer: Simplify error path in
snd_timer_open()") unified the error handling code paths with the
standard goto, but it introduced a subtle bug: the timer instance is
stored in snd_timer_open() incorrectly even if it returns an error.
This may eventually lead to UAF, as spotted by fuzzer.
The culprit is the snd_timer_open() code checks the
SNDRV_TIMER_IFLG_EXCLUSIVE flag with the common variable timeri.
This variable is supposed to be the newly created instance, but we
(ab-)used it for a temporary check before the actual creation of a
timer instance. After that point, there is another check for the max
number of instances, and it bails out if over the threshold. Before
the refactoring above, it worked fine because the code returned
directly from that point. After the refactoring, however, it jumps to
the unified error path that stores the timeri variable in return --
even if it returns an error. Unfortunately this stored value is kept
in the caller side (snd_timer_user_tselect()) in tu->timeri. This
causes inconsistency later, as if the timer was successfully
assigned.
In this patch, we fix it by not re-using timeri variable but a
temporary variable for testing the exclusive connection, so timeri
remains NULL at that point.
Fixes: 41672c0c24a6 ("ALSA: timer: Simplify error path in snd_timer_open()")
Reported-and-tested-by: Tristan Madani <tristmd@gmail.com>
Link: https://lore.kernel.org/r/20191106165547.23518-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/timer.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -297,11 +297,11 @@ int snd_timer_open(struct snd_timer_inst
goto unlock;
}
if (!list_empty(&timer->open_list_head)) {
- timeri = list_entry(timer->open_list_head.next,
+ struct snd_timer_instance *t =
+ list_entry(timer->open_list_head.next,
struct snd_timer_instance, open_list);
- if (timeri->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
+ if (t->flags & SNDRV_TIMER_IFLG_EXCLUSIVE) {
err = -EBUSY;
- timeri = NULL;
goto unlock;
}
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 110/136] ALSA: timer: Fix mutex deadlock at releasing card
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (108 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 109/136] ALSA: timer: Fix incorrectly assigned timer instance Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 111/136] s390/cmm: fix information leak in cmm_timeout_handler() Ben Hutchings
` (26 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit a39331867335d4a94b6165e306265c9e24aca073 upstream.
When a card is disconnected while in use, the system waits until all
opened files are closed then releases the card. This is done via
put_device() of the card device in each device release code.
The recently reported mutex deadlock bug happens in this code path;
snd_timer_close() for the timer device deals with the global
register_mutex and it calls put_device() there. When this timer
device is the last one, the card gets freed and it eventually calls
snd_timer_free(), which has again the protection with the global
register_mutex -- boom.
Basically put_device() call itself is race-free, so a relative simple
workaround is to move this put_device() call out of the mutex. For
achieving that, in this patch, snd_timer_close_locked() got a new
argument to store the card device pointer in return, and each caller
invokes put_device() with the returned object after the mutex unlock.
Reported-and-tested-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/core/timer.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
--- a/sound/core/timer.c
+++ b/sound/core/timer.c
@@ -241,7 +241,8 @@ static int snd_timer_check_master(struct
return 0;
}
-static int snd_timer_close_locked(struct snd_timer_instance *timeri);
+static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+ struct device **card_devp_to_put);
/*
* open a timer instance
@@ -253,6 +254,7 @@ int snd_timer_open(struct snd_timer_inst
{
struct snd_timer *timer;
struct snd_timer_instance *timeri = NULL;
+ struct device *card_dev_to_put = NULL;
int err;
mutex_lock(®ister_mutex);
@@ -276,7 +278,7 @@ int snd_timer_open(struct snd_timer_inst
list_add_tail(&timeri->open_list, &snd_timer_slave_list);
err = snd_timer_check_slave(timeri);
if (err < 0) {
- snd_timer_close_locked(timeri);
+ snd_timer_close_locked(timeri, &card_dev_to_put);
timeri = NULL;
}
goto unlock;
@@ -328,7 +330,7 @@ int snd_timer_open(struct snd_timer_inst
timeri = NULL;
if (timer->card)
- put_device(&timer->card->card_dev);
+ card_dev_to_put = &timer->card->card_dev;
module_put(timer->module);
goto unlock;
}
@@ -338,12 +340,15 @@ int snd_timer_open(struct snd_timer_inst
timer->num_instances++;
err = snd_timer_check_master(timeri);
if (err < 0) {
- snd_timer_close_locked(timeri);
+ snd_timer_close_locked(timeri, &card_dev_to_put);
timeri = NULL;
}
unlock:
mutex_unlock(®ister_mutex);
+ /* put_device() is called after unlock for avoiding deadlock */
+ if (card_dev_to_put)
+ put_device(card_dev_to_put);
*ti = timeri;
return err;
}
@@ -352,7 +357,8 @@ int snd_timer_open(struct snd_timer_inst
* close a timer instance
* call this with register_mutex down.
*/
-static int snd_timer_close_locked(struct snd_timer_instance *timeri)
+static int snd_timer_close_locked(struct snd_timer_instance *timeri,
+ struct device **card_devp_to_put)
{
struct snd_timer *timer = NULL;
struct snd_timer_instance *slave, *tmp;
@@ -404,7 +410,7 @@ static int snd_timer_close_locked(struct
timer->hw.close(timer);
/* release a card refcount for safe disconnection */
if (timer->card)
- put_device(&timer->card->card_dev);
+ *card_devp_to_put = &timer->card->card_dev;
module_put(timer->module);
}
@@ -416,14 +422,18 @@ static int snd_timer_close_locked(struct
*/
int snd_timer_close(struct snd_timer_instance *timeri)
{
+ struct device *card_dev_to_put = NULL;
int err;
if (snd_BUG_ON(!timeri))
return -ENXIO;
mutex_lock(®ister_mutex);
- err = snd_timer_close_locked(timeri);
+ err = snd_timer_close_locked(timeri, &card_dev_to_put);
mutex_unlock(®ister_mutex);
+ /* put_device() is called after unlock for avoiding deadlock */
+ if (card_dev_to_put)
+ put_device(card_dev_to_put);
return err;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 111/136] s390/cmm: fix information leak in cmm_timeout_handler()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (109 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 110/136] ALSA: timer: Fix mutex deadlock at releasing card Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 112/136] inet: stop leaking jiffies on the wire Ben Hutchings
` (25 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Yihui ZENG, Vasily Gorbik, Heiko Carstens,
Dan Carpenter
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Yihui ZENG <yzeng56@asu.edu>
commit b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f upstream.
The problem is that we were putting the NUL terminator too far:
buf[sizeof(buf) - 1] = '\0';
If the user input isn't NUL terminated and they haven't initialized the
whole buffer then it leads to an info leak. The NUL terminator should
be:
buf[len - 1] = '\0';
Signed-off-by: Yihui Zeng <yzeng56@asu.edu>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[heiko.carstens@de.ibm.com: keep semantics of how *lenp and *ppos are handled]
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/s390/mm/cmm.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -306,16 +306,16 @@ static int cmm_timeout_handler(struct ct
}
if (write) {
- len = *lenp;
- if (copy_from_user(buf, buffer,
- len > sizeof(buf) ? sizeof(buf) : len))
+ len = min(*lenp, sizeof(buf));
+ if (copy_from_user(buf, buffer, len))
return -EFAULT;
- buf[sizeof(buf) - 1] = '\0';
+ buf[len - 1] = '\0';
cmm_skip_blanks(buf, &p);
nr = simple_strtoul(p, &p, 0);
cmm_skip_blanks(p, &p);
seconds = simple_strtoul(p, &p, 0);
cmm_set_timeout(nr, seconds);
+ *ppos += *lenp;
} else {
len = sprintf(buf, "%ld %ld\n",
cmm_timeout_pages, cmm_timeout_seconds);
@@ -323,9 +323,9 @@ static int cmm_timeout_handler(struct ct
len = *lenp;
if (copy_to_user(buffer, buf, len))
return -EFAULT;
+ *lenp = len;
+ *ppos += len;
}
- *lenp = len;
- *ppos += len;
return 0;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 112/136] inet: stop leaking jiffies on the wire
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (110 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 111/136] s390/cmm: fix information leak in cmm_timeout_handler() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 113/136] ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series Ben Hutchings
` (24 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Eric Dumazet, Thiemo Nagel, David S. Miller
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit a904a0693c189691eeee64f6c6b188bd7dc244e9 upstream.
Historically linux tried to stick to RFC 791, 1122, 2003
for IPv4 ID field generation.
RFC 6864 made clear that no matter how hard we try,
we can not ensure unicity of IP ID within maximum
lifetime for all datagrams with a given source
address/destination address/protocol tuple.
Linux uses a per socket inet generator (inet_id), initialized
at connection startup with a XOR of 'jiffies' and other
fields that appear clear on the wire.
Thiemo Nagel pointed that this strategy is a privacy
concern as this provides 16 bits of entropy to fingerprint
devices.
Let's switch to a random starting point, this is just as
good as far as RFC 6864 is concerned and does not leak
anything critical.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Thiemo Nagel <tnagel@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16: drop changes in chelsio]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -122,7 +122,7 @@ int dccp_v4_connect(struct sock *sk, str
inet->inet_daddr,
inet->inet_sport,
inet->inet_dport);
- inet->inet_id = dp->dccps_iss ^ jiffies;
+ inet->inet_id = prandom_u32();
err = dccp_connect(sk);
rt = NULL;
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -74,7 +74,7 @@ int __ip4_datagram_connect(struct sock *
inet->inet_daddr = fl4->daddr;
inet->inet_dport = usin->sin_port;
sk->sk_state = TCP_ESTABLISHED;
- inet->inet_id = jiffies;
+ inet->inet_id = prandom_u32();
sk_dst_set(sk, &rt->dst);
err = 0;
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -241,7 +241,7 @@ int tcp_v4_connect(struct sock *sk, stru
inet->inet_sport,
usin->sin_port);
- inet->inet_id = tp->write_seq ^ jiffies;
+ inet->inet_id = prandom_u32();
err = tcp_connect(sk);
@@ -1449,7 +1449,7 @@ struct sock *tcp_v4_syn_recv_sock(struct
inet_csk(newsk)->icsk_ext_hdr_len = 0;
if (inet_opt)
inet_csk(newsk)->icsk_ext_hdr_len = inet_opt->opt.optlen;
- newinet->inet_id = newtp->write_seq ^ jiffies;
+ newinet->inet_id = prandom_u32();
if (!dst) {
dst = inet_csk_route_child_sock(sk, newsk, req);
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -7006,7 +7006,7 @@ void sctp_copy_sock(struct sock *newsk,
newinet->inet_rcv_saddr = inet->inet_rcv_saddr;
newinet->inet_dport = htons(asoc->peer.port);
newinet->pmtudisc = inet->pmtudisc;
- newinet->inet_id = asoc->next_tsn ^ jiffies;
+ newinet->inet_id = prandom_u32();
newinet->uc_ttl = inet->uc_ttl;
newinet->mc_loop = 1;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 113/136] ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (111 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 112/136] inet: stop leaking jiffies on the wire Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 114/136] dccp: do not leak jiffies on the wire Ben Hutchings
` (23 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Sakamoto, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Sakamoto <o-takashi@sakamocchi.jp>
commit 706ad6746a66546daf96d4e4a95e46faf6cf689a upstream.
For Focusrite Saffire Pro i/o, the lowest 8 bits of register represents
configured source of sampling clock. The next lowest 8 bits represents
whether the configured source is actually detected or not just after
the register is changed for the source.
Current implementation evaluates whole the register to detect configured
source. This results in failure due to the next lowest 8 bits when the
source is connected in advance.
This commit fixes the bug.
Fixes: 25784ec2d034 ("ALSA: bebob: Add support for Focusrite Saffire/SaffirePro series")
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://lore.kernel.org/r/20191102150920.20367-1-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/firewire/bebob/bebob_focusrite.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/firewire/bebob/bebob_focusrite.c
+++ b/sound/firewire/bebob/bebob_focusrite.c
@@ -28,6 +28,8 @@
#define SAFFIRE_CLOCK_SOURCE_SPDIF 1
/* clock sources as returned from register of Saffire Pro 10 and 26 */
+#define SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK 0x000000ff
+#define SAFFIREPRO_CLOCK_SOURCE_DETECT_MASK 0x0000ff00
#define SAFFIREPRO_CLOCK_SOURCE_INTERNAL 0
#define SAFFIREPRO_CLOCK_SOURCE_SKIP 1 /* never used on hardware */
#define SAFFIREPRO_CLOCK_SOURCE_SPDIF 2
@@ -184,6 +186,7 @@ saffirepro_both_clk_src_get(struct snd_b
map = saffirepro_clk_maps[1];
/* In a case that this driver cannot handle the value of register. */
+ value &= SAFFIREPRO_CLOCK_SOURCE_SELECT_MASK;
if (value >= SAFFIREPRO_CLOCK_SOURCE_COUNT || map[value] < 0) {
err = -EIO;
goto end;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 114/136] dccp: do not leak jiffies on the wire
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (112 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 113/136] ALSA: bebob: fix to detect configured source of sampling clock for Focusrite Saffire Pro i/o series Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 115/136] netfilter: ipset: Fix an error code in ip_set_sockfn_get() Ben Hutchings
` (22 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Thiemo Nagel, David S. Miller, Eric Dumazet
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 3d1e5039f5f87a8731202ceca08764ee7cb010d3 upstream.
For some reason I missed the case of DCCP passive
flows in my previous patch.
Fixes: a904a0693c18 ("inet: stop leaking jiffies on the wire")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Thiemo Nagel <tnagel@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/dccp/ipv4.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -420,7 +420,7 @@ struct sock *dccp_v4_request_recv_sock(s
ireq->opt = NULL;
newinet->mc_index = inet_iif(skb);
newinet->mc_ttl = ip_hdr(skb)->ttl;
- newinet->inet_id = jiffies;
+ newinet->inet_id = prandom_u32();
if (dst == NULL && (dst = inet_csk_route_child_sock(sk, newsk, req)) == NULL)
goto put_and_exit;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 115/136] netfilter: ipset: Fix an error code in ip_set_sockfn_get()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (113 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 114/136] dccp: do not leak jiffies on the wire Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 116/136] netfilter: nf_tables: Align nft_expr private data to 64-bit Ben Hutchings
` (21 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jozsef Kadlecsik, Dan Carpenter
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 30b7244d79651460ff114ba8f7987ed94c86b99a upstream.
The copy_to_user() function returns the number of bytes remaining to be
copied. In this code, that positive return is checked at the end of the
function and we return zero/success. What we should do instead is
return -EFAULT.
Fixes: a7b4f989a629 ("netfilter: ipset: IP set core support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/netfilter/ipset/ip_set_core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1860,8 +1860,9 @@ ip_set_sockfn_get(struct sock *sk, int o
}
req_version->version = IPSET_PROTOCOL;
- ret = copy_to_user(user, req_version,
- sizeof(struct ip_set_req_version));
+ if (copy_to_user(user, req_version,
+ sizeof(struct ip_set_req_version)))
+ ret = -EFAULT;
goto done;
}
case IP_SET_OP_GET_BYNAME: {
@@ -1918,7 +1919,8 @@ ip_set_sockfn_get(struct sock *sk, int o
} /* end of switch(op) */
copy:
- ret = copy_to_user(user, data, copylen);
+ if (copy_to_user(user, data, copylen))
+ ret = -EFAULT;
done:
vfree(data);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 116/136] netfilter: nf_tables: Align nft_expr private data to 64-bit
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (114 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 115/136] netfilter: ipset: Fix an error code in ip_set_sockfn_get() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 117/136] can: usb_8dev: fix use-after-free on disconnect Ben Hutchings
` (20 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Pablo Neira Ayuso, Lukas Wunner
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 250367c59e6ba0d79d702a059712d66edacd4a1a upstream.
Invoking the following commands on a 32-bit architecture with strict
alignment requirements (such as an ARMv7-based Raspberry Pi) results
in an alignment exception:
# nft add table ip test-ip4
# nft add chain ip test-ip4 output { type filter hook output priority 0; }
# nft add rule ip test-ip4 output quota 1025 bytes
Alignment trap: not handling instruction e1b26f9f at [<7f4473f8>]
Unhandled fault: alignment exception (0x001) at 0xb832e824
Internal error: : 1 [#1] PREEMPT SMP ARM
Hardware name: BCM2835
[<7f4473fc>] (nft_quota_do_init [nft_quota])
[<7f447448>] (nft_quota_init [nft_quota])
[<7f4260d0>] (nf_tables_newrule [nf_tables])
[<7f4168dc>] (nfnetlink_rcv_batch [nfnetlink])
[<7f416bd0>] (nfnetlink_rcv [nfnetlink])
[<8078b334>] (netlink_unicast)
[<8078b664>] (netlink_sendmsg)
[<8071b47c>] (sock_sendmsg)
[<8071bd18>] (___sys_sendmsg)
[<8071ce3c>] (__sys_sendmsg)
[<8071ce94>] (sys_sendmsg)
The reason is that nft_quota_do_init() calls atomic64_set() on an
atomic64_t which is only aligned to 32-bit, not 64-bit, because it
succeeds struct nft_expr in memory which only contains a 32-bit pointer.
Fix by aligning the nft_expr private data to 64-bit.
Fixes: 96518518cc41 ("netfilter: add nftables")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
include/net/netfilter/nf_tables.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -364,7 +364,8 @@ struct nft_expr_ops {
*/
struct nft_expr {
const struct nft_expr_ops *ops;
- unsigned char data[];
+ unsigned char data[]
+ __attribute__((aligned(__alignof__(u64))));
};
static inline void *nft_expr_priv(const struct nft_expr *expr)
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 117/136] can: usb_8dev: fix use-after-free on disconnect
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (115 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 116/136] netfilter: nf_tables: Align nft_expr private data to 64-bit Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 118/136] can: peak_usb: fix a potential out-of-sync while decoding packets Ben Hutchings
` (19 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Bernd Krumboeck, Marc Kleine-Budde,
Wolfgang Grandegger, Johan Hovold
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 3759739426186a924675651b388d1c3963c5710e upstream.
The driver was accessing its driver data after having freed it.
Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices")
Cc: Bernd Krumboeck <b.krumboeck@gmail.com>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/can/usb/usb_8dev.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -1013,9 +1013,8 @@ static void usb_8dev_disconnect(struct u
netdev_info(priv->netdev, "device disconnected\n");
unregister_netdev(priv->netdev);
- free_candev(priv->netdev);
-
unlink_all_urbs(priv);
+ free_candev(priv->netdev);
}
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 118/136] can: peak_usb: fix a potential out-of-sync while decoding packets
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (116 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 117/136] can: usb_8dev: fix use-after-free on disconnect Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 119/136] can: c_can: c_can_poll(): only read status register after status IRQ Ben Hutchings
` (18 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Stephane Grosjean, Marc Kleine-Budde
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Stephane Grosjean <s.grosjean@peak-system.com>
commit de280f403f2996679e2607384980703710576fed upstream.
When decoding a buffer received from PCAN-USB, the first timestamp read in
a packet is a 16-bit coded time base, and the next ones are an 8-bit
offset to this base, regardless of the type of packet read.
This patch corrects a potential loss of synchronization by using a
timestamp index read from the buffer, rather than an index of received
data packets, to determine on the sizeof the timestamp to be read from the
packet being decoded.
Signed-off-by: Stephane Grosjean <s.grosjean@peak-system.com>
Fixes: 46be265d3388 ("can: usb: PEAK-System Technik PCAN-USB specific part")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/can/usb/peak_usb/pcan_usb.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
--- a/drivers/net/can/usb/peak_usb/pcan_usb.c
+++ b/drivers/net/can/usb/peak_usb/pcan_usb.c
@@ -108,7 +108,7 @@ struct pcan_usb_msg_context {
u8 *end;
u8 rec_cnt;
u8 rec_idx;
- u8 rec_data_idx;
+ u8 rec_ts_idx;
struct net_device *netdev;
struct pcan_usb *pdev;
};
@@ -551,10 +551,15 @@ static int pcan_usb_decode_status(struct
mc->ptr += PCAN_USB_CMD_ARGS;
if (status_len & PCAN_USB_STATUSLEN_TIMESTAMP) {
- int err = pcan_usb_decode_ts(mc, !mc->rec_idx);
+ int err = pcan_usb_decode_ts(mc, !mc->rec_ts_idx);
if (err)
return err;
+
+ /* Next packet in the buffer will have a timestamp on a single
+ * byte
+ */
+ mc->rec_ts_idx++;
}
switch (f) {
@@ -637,10 +642,13 @@ static int pcan_usb_decode_data(struct p
cf->can_dlc = get_can_dlc(rec_len);
- /* first data packet timestamp is a word */
- if (pcan_usb_decode_ts(mc, !mc->rec_data_idx))
+ /* Only first packet timestamp is a word */
+ if (pcan_usb_decode_ts(mc, !mc->rec_ts_idx))
goto decode_failed;
+ /* Next packet in the buffer will have a timestamp on a single byte */
+ mc->rec_ts_idx++;
+
/* read data */
memset(cf->data, 0x0, sizeof(cf->data));
if (status_len & PCAN_USB_STATUSLEN_RTR) {
@@ -695,7 +703,6 @@ static int pcan_usb_decode_msg(struct pe
/* handle normal can frames here */
} else {
err = pcan_usb_decode_data(&mc, sl);
- mc.rec_data_idx++;
}
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 119/136] can: c_can: c_can_poll(): only read status register after status IRQ
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (117 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 118/136] can: peak_usb: fix a potential out-of-sync while decoding packets Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 120/136] perf tools: Fix time sorting Ben Hutchings
` (17 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Joe Burmeister, Kurt Van Dijck,
Marc Kleine-Budde, Wolfgang Grandegger
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
commit 3cb3eaac52c0f145d895f4b6c22834d5f02b8569 upstream.
When the status register is read without the status IRQ pending, the
chip may not raise the interrupt line for an upcoming status interrupt
and the driver may miss a status interrupt.
It is critical that the BUSOFF status interrupt is forwarded to the
higher layers, since no more interrupts will follow without
intervention.
Thanks to Wolfgang and Joe for bringing up the first idea.
Signed-off-by: Kurt Van Dijck <dev.kurt@vandijck-laurijssen.be>
Cc: Wolfgang Grandegger <wg@grandegger.com>
Cc: Joe Burmeister <joe.burmeister@devtank.co.uk>
Fixes: fa39b54ccf28 ("can: c_can: Get rid of pointless interrupts")
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/can/c_can/c_can.c | 25 ++++++++++++++++++++-----
drivers/net/can/c_can/c_can.h | 1 +
2 files changed, 21 insertions(+), 5 deletions(-)
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -96,6 +96,9 @@
#define BTR_TSEG2_SHIFT 12
#define BTR_TSEG2_MASK (0x7 << BTR_TSEG2_SHIFT)
+/* interrupt register */
+#define INT_STS_PENDING 0x8000
+
/* brp extension register */
#define BRP_EXT_BRPE_MASK 0x0f
#define BRP_EXT_BRPE_SHIFT 0
@@ -1021,10 +1024,16 @@ static int c_can_poll(struct napi_struct
u16 curr, last = priv->last_status;
int work_done = 0;
- priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
- /* Ack status on C_CAN. D_CAN is self clearing */
- if (priv->type != BOSCH_D_CAN)
- priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+ /* Only read the status register if a status interrupt was pending */
+ if (atomic_xchg(&priv->sie_pending, 0)) {
+ priv->last_status = curr = priv->read_reg(priv, C_CAN_STS_REG);
+ /* Ack status on C_CAN. D_CAN is self clearing */
+ if (priv->type != BOSCH_D_CAN)
+ priv->write_reg(priv, C_CAN_STS_REG, LEC_UNUSED);
+ } else {
+ /* no change detected ... */
+ curr = last;
+ }
/* handle state changes */
if ((curr & STATUS_EWARN) && (!(last & STATUS_EWARN))) {
@@ -1075,10 +1084,16 @@ static irqreturn_t c_can_isr(int irq, vo
{
struct net_device *dev = (struct net_device *)dev_id;
struct c_can_priv *priv = netdev_priv(dev);
+ int reg_int;
- if (!priv->read_reg(priv, C_CAN_INT_REG))
+ reg_int = priv->read_reg(priv, C_CAN_INT_REG);
+ if (!reg_int)
return IRQ_NONE;
+ /* save for later use */
+ if (reg_int & INT_STS_PENDING)
+ atomic_set(&priv->sie_pending, 1);
+
/* disable all interrupts and schedule the NAPI */
c_can_irq_control(priv, false);
napi_schedule(&priv->napi);
--- a/drivers/net/can/c_can/c_can.h
+++ b/drivers/net/can/c_can/c_can.h
@@ -176,6 +176,7 @@ struct c_can_priv {
struct net_device *dev;
struct device *device;
atomic_t tx_active;
+ atomic_t sie_pending;
unsigned long tx_dir;
int last_status;
u16 (*read_reg) (const struct c_can_priv *priv, enum reg index);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 120/136] perf tools: Fix time sorting
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (118 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 119/136] can: c_can: c_can_poll(): only read status register after status IRQ Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 121/136] mm, vmstat: hide /proc/pagetypeinfo from normal users Ben Hutchings
` (16 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Jiri Olsa, Michael Petlan,
Alexander Shishkin, Namhyung Kim, Arnaldo Carvalho de Melo,
Andi Kleen, Peter Zijlstra
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 722ddfde366fd46205456a9c5ff9b3359dc9a75e upstream.
The final sort might get confused when the comparison is done over
bigger numbers than int like for -s time.
Check the following report for longer workloads:
$ perf report -s time -F time,overhead --stdio
Fix hist_entry__sort() to properly return int64_t and not possible cut
int.
Fixes: 043ca389a318 ("perf tools: Use hpp formats to sort final output")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Michael Petlan <mpetlan@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lore.kernel.org/lkml/20191104232711.16055-1-jolsa@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
tools/perf/util/hist.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1032,7 +1032,7 @@ void hists__collapse_resort(struct hists
}
}
-static int hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
+static int64_t hist_entry__sort(struct hist_entry *a, struct hist_entry *b)
{
struct perf_hpp_fmt *fmt;
int64_t cmp = 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 121/136] mm, vmstat: hide /proc/pagetypeinfo from normal users
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (119 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 120/136] perf tools: Fix time sorting Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 122/136] dump_stack: avoid the livelock of the dump_lock Ben Hutchings
` (15 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Konstantin Khlebnikov, David Hildenbrand,
Johannes Weiner, Vlastimil Babka, Waiman Long, Mel Gorman,
Linus Torvalds, Rafael Aquini, Greg Kroah-Hartman, Song Liu,
David Rientjes, Michal Hocko, Jann Horn, Roman Gushchin
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michal Hocko <mhocko@suse.com>
commit abaed0112c1db08be15a784a2c5c8a8b3063cdd3 upstream.
/proc/pagetypeinfo is a debugging tool to examine internal page
allocator state wrt to fragmentation. It is not very useful for any
other use so normal users really do not need to read this file.
Waiman Long has noticed that reading this file can have negative side
effects because zone->lock is necessary for gathering data and that a)
interferes with the page allocator and its users and b) can lead to hard
lockups on large machines which have very long free_list.
Reduce both issues by simply not exporting the file to regular users.
Link: http://lkml.kernel.org/r/20191025072610.18526-2-mhocko@kernel.org
Fixes: 467c996c1e19 ("Print out statistics in relation to fragmentation avoidance to /proc/pagetypeinfo")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Reported-by: Waiman Long <longman@redhat.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Waiman Long <longman@redhat.com>
Acked-by: Rafael Aquini <aquini@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: David Hildenbrand <david@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Roman Gushchin <guro@fb.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Jann Horn <jannh@google.com>
Cc: Song Liu <songliubraving@fb.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/vmstat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1318,7 +1318,7 @@ static int __init setup_vmstat(void)
#endif
#ifdef CONFIG_PROC_FS
proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
- proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
+ proc_create("pagetypeinfo", 0400, NULL, &pagetypeinfo_file_ops);
proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
#endif
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 122/136] dump_stack: avoid the livelock of the dump_lock
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (120 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 121/136] mm, vmstat: hide /proc/pagetypeinfo from normal users Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 123/136] drm/radeon: fix si_enable_smc_cac() failed issue Ben Hutchings
` (14 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Linus Torvalds, Kevin Hao
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kevin Hao <haokexin@gmail.com>
commit 5cbf2fff3bba8d3c6a4d47c1754de1cf57e2b01f upstream.
In the current code, we use the atomic_cmpxchg() to serialize the output
of the dump_stack(), but this implementation suffers the thundering herd
problem. We have observed such kind of livelock on a Marvell cn96xx
board(24 cpus) when heavily using the dump_stack() in a kprobe handler.
Actually we can let the competitors to wait for the releasing of the
lock before jumping to atomic_cmpxchg(). This will definitely mitigate
the thundering herd problem. Thanks Linus for the suggestion.
[akpm@linux-foundation.org: fix comment]
Link: http://lkml.kernel.org/r/20191030031637.6025-1-haokexin@gmail.com
Fixes: b58d977432c8 ("dump_stack: serialize the output from dump_stack()")
Signed-off-by: Kevin Hao <haokexin@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
lib/dump_stack.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/lib/dump_stack.c
+++ b/lib/dump_stack.c
@@ -44,7 +44,12 @@ retry:
was_locked = 1;
} else {
local_irq_restore(flags);
- cpu_relax();
+ /*
+ * Wait for the lock to release before jumping to
+ * atomic_cmpxchg() in order to mitigate the thundering herd
+ * problem.
+ */
+ do { cpu_relax(); } while (atomic_read(&dump_lock) != -1);
goto retry;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 123/136] drm/radeon: fix si_enable_smc_cac() failed issue
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (121 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 122/136] dump_stack: avoid the livelock of the dump_lock Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 124/136] block: drbd: remove a stray unlock in __drbd_send_protocol() Ben Hutchings
` (13 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Yong Zhao, Alex Deucher
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 2c409ba81be25516afe05ae27a4a15da01740b01 upstream.
Need to set the dte flag on this asic.
Port the fix from amdgpu:
5cb818b861be114 ("drm/amd/amdgpu: fix si_enable_smc_cac() failed issue")
Reviewed-by: Yong Zhao <yong.zhao@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/gpu/drm/radeon/si_dpm.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/radeon/si_dpm.c
+++ b/drivers/gpu/drm/radeon/si_dpm.c
@@ -1951,6 +1951,7 @@ static void si_initialize_powertune_defa
case 0x682C:
si_pi->cac_weights = cac_weights_cape_verde_pro;
si_pi->dte_data = dte_data_sun_xt;
+ update_dte_from_pl2 = true;
break;
case 0x6825:
case 0x6827:
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 124/136] block: drbd: remove a stray unlock in __drbd_send_protocol()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (122 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 123/136] drm/radeon: fix si_enable_smc_cac() failed issue Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 125/136] ALSA: usb-audio: Fix missing error check at mixer resolution test Ben Hutchings
` (12 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Jens Axboe, Dan Carpenter
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 8e9c523016cf9983b295e4bc659183d1fa6ef8e0 upstream.
There are two callers of this function and they both unlock the mutex so
this ends up being a double unlock.
Fixes: 44ed167da748 ("drbd: rcu_read_lock() and rcu_dereference() for tconn->net_conf")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/block/drbd/drbd_main.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -786,7 +786,6 @@ int __drbd_send_protocol(struct drbd_con
if (nc->tentative && connection->agreed_pro_version < 92) {
rcu_read_unlock();
- mutex_unlock(&sock->mutex);
drbd_err(connection, "--dry-run is not supported by peer");
return -EOPNOTSUPP;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 125/136] ALSA: usb-audio: Fix missing error check at mixer resolution test
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (123 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 124/136] block: drbd: remove a stray unlock in __drbd_send_protocol() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 126/136] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable Ben Hutchings
` (11 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 167beb1756791e0806365a3f86a0da10d7a327ee upstream.
A check of the return value from get_cur_mix_raw() is missing at the
resolution test code in get_min_max_with_quirks(), which may leave the
variable untouched, leading to a random uninitialized value, as
detected by syzkaller fuzzer.
Add the missing return error check for fixing that.
Reported-and-tested-by: syzbot+abe1ab7afc62c6bb6377@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20191109181658.30368-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/mixer.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1014,7 +1014,8 @@ static int get_min_max_with_quirks(struc
if (cval->min + cval->res < cval->max) {
int last_valid_res = cval->res;
int saved, test, check;
- get_cur_mix_raw(cval, minchn, &saved);
+ if (get_cur_mix_raw(cval, minchn, &saved) < 0)
+ goto no_res_check;
for (;;) {
test = saved;
if (test < cval->max)
@@ -1034,6 +1035,7 @@ static int get_min_max_with_quirks(struc
set_cur_mix_value(cval, minchn, 0, saved);
}
+no_res_check:
cval->initialized = 1;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 126/136] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (124 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 125/136] ALSA: usb-audio: Fix missing error check at mixer resolution test Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 127/136] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either Ben Hutchings
` (10 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Al Viro
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit e72b9dd6a5f17d0fb51f16f8685f3004361e83d0 upstream.
lower_dentry can't go from positive to negative (we have it pinned),
but it *can* go from negative to positive. So fetching ->d_inode
into a local variable, doing a blocking allocation, checking that
now ->d_inode is non-NULL and feeding the value we'd fetched
earlier to a function that won't accept NULL is not a good idea.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.16:
- Use ACCESS_ONCE() instead of READ_ONCE()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ecryptfs/inode.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -341,7 +341,7 @@ static int ecryptfs_lookup_interpose(str
struct dentry *lower_dentry,
struct inode *dir_inode)
{
- struct inode *inode, *lower_inode = lower_dentry->d_inode;
+ struct inode *inode, *lower_inode;
struct ecryptfs_dentry_info *dentry_info;
struct vfsmount *lower_mnt;
int rc = 0;
@@ -363,7 +363,15 @@ static int ecryptfs_lookup_interpose(str
dentry_info->lower_path.mnt = lower_mnt;
dentry_info->lower_path.dentry = lower_dentry;
- if (!lower_dentry->d_inode) {
+ /*
+ * negative dentry can go positive under us here - its parent is not
+ * locked. That's OK and that could happen just as we return from
+ * ecryptfs_lookup() anyway. Just need to be careful and fetch
+ * ->d_inode only once - it's not stable here.
+ */
+ lower_inode = ACCESS_ONCE(lower_dentry->d_inode);
+
+ if (!lower_inode) {
/* We want to add because we couldn't find in lower */
d_add(dentry, NULL);
return 0;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 127/136] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (125 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 126/136] ecryptfs_lookup_interpose(): lower_dentry->d_inode is not stable Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 128/136] x86/quirks: Disable HPET on Intel Coffe Lake platforms Ben Hutchings
` (9 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Al Viro
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
commit 762c69685ff7ad5ad7fee0656671e20a0c9c864d upstream.
We need to get the underlying dentry of parent; sure, absent the races
it is the parent of underlying dentry, but there's nothing to prevent
losing a timeslice to preemtion in the middle of evaluation of
lower_dentry->d_parent->d_inode, having another process move lower_dentry
around and have its (ex)parent not pinned anymore and freed on memory
pressure. Then we regain CPU and try to fetch ->d_inode from memory
that is freed by that point.
dentry->d_parent *is* stable here - it's an argument of ->lookup() and
we are guaranteed that it won't be moved anywhere until we feed it
to d_add/d_splice_alias. So we safely go that way to get to its
underlying dentry.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
[bwh: Backported to 3.16:
- Open-code d_inode()
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/ecryptfs/inode.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -341,9 +341,9 @@ static int ecryptfs_lookup_interpose(str
struct dentry *lower_dentry,
struct inode *dir_inode)
{
+ struct path *path = ecryptfs_dentry_to_lower_path(dentry->d_parent);
struct inode *inode, *lower_inode;
struct ecryptfs_dentry_info *dentry_info;
- struct vfsmount *lower_mnt;
int rc = 0;
dentry_info = kmem_cache_alloc(ecryptfs_dentry_info_cache, GFP_KERNEL);
@@ -355,12 +355,11 @@ static int ecryptfs_lookup_interpose(str
return -ENOMEM;
}
- lower_mnt = mntget(ecryptfs_dentry_to_lower_mnt(dentry->d_parent));
- fsstack_copy_attr_atime(dir_inode, lower_dentry->d_parent->d_inode);
+ fsstack_copy_attr_atime(dir_inode, path->dentry->d_inode);
BUG_ON(!d_count(lower_dentry));
ecryptfs_set_dentry_private(dentry, dentry_info);
- dentry_info->lower_path.mnt = lower_mnt;
+ dentry_info->lower_path.mnt = mntget(path->mnt);
dentry_info->lower_path.dentry = lower_dentry;
/*
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 128/136] x86/quirks: Disable HPET on Intel Coffe Lake platforms
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (126 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 127/136] ecryptfs_lookup_interpose(): lower_dentry->d_parent is not stable either Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 129/136] ALSA: usb-audio: not submit urb for stopped endpoint Ben Hutchings
` (8 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Feng Tang, Kai-Heng Feng, Thomas Gleixner
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit fc5db58539b49351e76f19817ed1102bf7c712d0 upstream.
Some Coffee Lake platforms have a skewed HPET timer once the SoCs entered
PC10, which in consequence marks TSC as unstable because HPET is used as
watchdog clocksource for TSC.
Harry Pan tried to work around it in the clocksource watchdog code [1]
thereby creating a circular dependency between HPET and TSC. This also
ignores the fact, that HPET is not only unsuitable as watchdog clocksource
on these systems, it becomes unusable in general.
Disable HPET on affected platforms.
Suggested-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=203183
Link: https://lore.kernel.org/lkml/20190516090651.1396-1-harry.pan@intel.com/ [1]
Link: https://lkml.kernel.org/r/20191016103816.30650-1-kai.heng.feng@canonical.com
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
arch/x86/kernel/early-quirks.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -672,6 +672,8 @@ static struct chipset early_qrk[] __init
*/
{ PCI_VENDOR_ID_INTEL, 0x0f00,
PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
+ { PCI_VENDOR_ID_INTEL, 0x3ec4,
+ PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
{ PCI_VENDOR_ID_BROADCOM, 0x4331,
PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
{}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 129/136] ALSA: usb-audio: not submit urb for stopped endpoint
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (127 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 128/136] x86/quirks: Disable HPET on Intel Coffe Lake platforms Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 130/136] mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() Ben Hutchings
` (7 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Henry Lin, Takashi Iwai
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Henry Lin <henryl@nvidia.com>
commit 528699317dd6dc722dccc11b68800cf945109390 upstream.
While output urb's snd_complete_urb() is executing, calling
prepare_outbound_urb() may cause endpoint stopped before
prepare_outbound_urb() returns and result in next urb submitted
to stopped endpoint. usb-audio driver cannot re-use it afterwards as
the urb is still hold by usb stack.
This change checks EP_FLAG_RUNNING flag after prepare_outbound_urb() again
to let snd_complete_urb() know the endpoint already stopped and does not
submit next urb. Below kind of error will be fixed:
[ 213.153103] usb 1-2: timeout: still 1 active urbs on EP #1
[ 213.164121] usb 1-2: cannot submit urb 0, error -16: unknown error
Signed-off-by: Henry Lin <henryl@nvidia.com>
Link: https://lore.kernel.org/r/20191113021420.13377-1-henryl@nvidia.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
sound/usb/endpoint.c | 3 +++
1 file changed, 3 insertions(+)
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -377,6 +377,9 @@ static void snd_complete_urb(struct urb
}
prepare_outbound_urb(ep, ctx);
+ /* can be stopped during prepare callback */
+ if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags)))
+ goto exit_clear;
} else {
retire_inbound_urb(ep, ctx);
/* can be stopped during retire callback */
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 130/136] mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (128 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 129/136] ALSA: usb-audio: not submit urb for stopped endpoint Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 131/136] mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() Ben Hutchings
` (6 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Shakeel Butt, Michal Koutn,
Johannes Weiner, Tejun Heo, Linus Torvalds, Roman Gushchin,
Michal Hocko
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <guro@fb.com>
commit 00d484f354d85845991b40141d40ba9e5eb60faf upstream.
We've encountered a rcu stall in get_mem_cgroup_from_mm():
rcu: INFO: rcu_sched self-detected stall on CPU
rcu: 33-....: (21000 ticks this GP) idle=6c6/1/0x4000000000000002 softirq=35441/35441 fqs=5017
(t=21031 jiffies g=324821 q=95837) NMI backtrace for cpu 33
<...>
RIP: 0010:get_mem_cgroup_from_mm+0x2f/0x90
<...>
__memcg_kmem_charge+0x55/0x140
__alloc_pages_nodemask+0x267/0x320
pipe_write+0x1ad/0x400
new_sync_write+0x127/0x1c0
__kernel_write+0x4f/0xf0
dump_emit+0x91/0xc0
writenote+0xa0/0xc0
elf_core_dump+0x11af/0x1430
do_coredump+0xc65/0xee0
get_signal+0x132/0x7c0
do_signal+0x36/0x640
exit_to_usermode_loop+0x61/0xd0
do_syscall_64+0xd4/0x100
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The problem is caused by an exiting task which is associated with an
offline memcg. We're iterating over and over in the do {} while
(!css_tryget_online()) loop, but obviously the memcg won't become online
and the exiting task won't be migrated to a live memcg.
Let's fix it by switching from css_tryget_online() to css_tryget().
As css_tryget_online() cannot guarantee that the memcg won't go offline,
the check is usually useless, except some rare cases when for example it
determines if something should be presented to a user.
A similar problem is described by commit 18fa84a2db0e ("cgroup: Use
css_tryget() instead of css_tryget_online() in task_get_css()").
Johannes:
: The bug aside, it doesn't matter whether the cgroup is online for the
: callers. It used to matter when offlining needed to evacuate all charges
: from the memcg, and so needed to prevent new ones from showing up, but we
: don't care now.
Link: http://lkml.kernel.org/r/20191106225131.3543616-1-guro@fb.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Shakeel Butt <shakeeb@google.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Michal Koutn <mkoutny@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/memcontrol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -1073,7 +1073,7 @@ static struct mem_cgroup *get_mem_cgroup
if (unlikely(!memcg))
memcg = root_mem_cgroup;
}
- } while (!css_tryget_online(&memcg->css));
+ } while (!css_tryget(&memcg->css));
rcu_read_unlock();
return memcg;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 131/136] mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (129 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 130/136] mm: memcg: switch to css_tryget() in get_mem_cgroup_from_mm() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 132/136] virtio_console: allocate inbufs in add_port() only if it is needed Ben Hutchings
` (5 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Michal Hocko, Roman Gushchin, Shakeel Butt,
Linus Torvalds, Tejun Heo, Johannes Weiner
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Roman Gushchin <guro@fb.com>
commit 0362f326d86c645b5e96b7dbc3ee515986ed019d upstream.
An exiting task might belong to an offline cgroup. In this case an
attempt to grab a cgroup reference from the task can end up with an
infinite loop in hugetlb_cgroup_charge_cgroup(), because neither the
cgroup will become online, neither the task will be migrated to a live
cgroup.
Fix this by switching over to css_tryget(). As css_tryget_online()
can't guarantee that the cgroup won't go offline, in most cases the
check doesn't make sense. In this particular case users of
hugetlb_cgroup_charge_cgroup() are not affected by this change.
A similar problem is described by commit 18fa84a2db0e ("cgroup: Use
css_tryget() instead of css_tryget_online() in task_get_css()").
Link: http://lkml.kernel.org/r/20191106225131.3543616-2-guro@fb.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/hugetlb_cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/hugetlb_cgroup.c
+++ b/mm/hugetlb_cgroup.c
@@ -181,7 +181,7 @@ int hugetlb_cgroup_charge_cgroup(int idx
again:
rcu_read_lock();
h_cg = hugetlb_cgroup_from_task(current);
- if (!css_tryget_online(&h_cg->css)) {
+ if (!css_tryget(&h_cg->css)) {
rcu_read_unlock();
goto again;
}
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 132/136] virtio_console: allocate inbufs in add_port() only if it is needed
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (130 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 131/136] mm: hugetlb: switch to css_tryget() in hugetlb_cgroup_charge_cgroup() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 133/136] net/sched: act_pedit: fix WARN() in the traffic path Ben Hutchings
` (4 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, Laurent Vivier, mst
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Vivier <lvivier@redhat.com>
commit d791cfcbf98191122af70b053a21075cb450d119 upstream.
When we hot unplug a virtserialport and then try to hot plug again,
it fails:
(qemu) chardev-add socket,id=serial0,path=/tmp/serial0,server,nowait
(qemu) device_add virtserialport,bus=virtio-serial0.0,nr=2,\
chardev=serial0,id=serial0,name=serial0
(qemu) device_del serial0
(qemu) device_add virtserialport,bus=virtio-serial0.0,nr=2,\
chardev=serial0,id=serial0,name=serial0
kernel error:
virtio-ports vport2p2: Error allocating inbufs
qemu error:
virtio-serial-bus: Guest failure in adding port 2 for device \
virtio-serial0.0
This happens because buffers for the in_vq are allocated when the port is
added but are not released when the port is unplugged.
They are only released when virtconsole is removed (see a7a69ec0d8e4)
To avoid the problem and to be symmetric, we could allocate all the buffers
in init_vqs() as they are released in remove_vqs(), but it sounds like
a waste of memory.
Rather than that, this patch changes add_port() logic to ignore ENOSPC
error in fill_queue(), which means queue has already been filled.
Fixes: a7a69ec0d8e4 ("virtio_console: free buffers after reset")
Cc: mst@redhat.com
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/char/virtio_console.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1362,24 +1362,24 @@ static void set_console_size(struct port
port->cons.ws.ws_col = cols;
}
-static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
+static int fill_queue(struct virtqueue *vq, spinlock_t *lock)
{
struct port_buffer *buf;
- unsigned int nr_added_bufs;
+ int nr_added_bufs;
int ret;
nr_added_bufs = 0;
do {
buf = alloc_buf(vq->vdev, PAGE_SIZE, 0);
if (!buf)
- break;
+ return -ENOMEM;
spin_lock_irq(lock);
ret = add_inbuf(vq, buf);
if (ret < 0) {
spin_unlock_irq(lock);
free_buf(buf, true);
- break;
+ return ret;
}
nr_added_bufs++;
spin_unlock_irq(lock);
@@ -1399,7 +1399,6 @@ static int add_port(struct ports_device
char debugfs_name[16];
struct port *port;
dev_t devt;
- unsigned int nr_added_bufs;
int err;
port = kmalloc(sizeof(*port), GFP_KERNEL);
@@ -1457,11 +1456,13 @@ static int add_port(struct ports_device
spin_lock_init(&port->outvq_lock);
init_waitqueue_head(&port->waitqueue);
- /* Fill the in_vq with buffers so the host can send us data. */
- nr_added_bufs = fill_queue(port->in_vq, &port->inbuf_lock);
- if (!nr_added_bufs) {
+ /* We can safely ignore ENOSPC because it means
+ * the queue already has buffers. Buffers are removed
+ * only by virtcons_remove(), not by unplug_port()
+ */
+ err = fill_queue(port->in_vq, &port->inbuf_lock);
+ if (err < 0 && err != -ENOSPC) {
dev_err(port->dev, "Error allocating inbufs\n");
- err = -ENOMEM;
goto free_device;
}
@@ -2079,14 +2080,11 @@ static int virtcons_probe(struct virtio_
INIT_WORK(&portdev->control_work, &control_work_handler);
if (multiport) {
- unsigned int nr_added_bufs;
-
spin_lock_init(&portdev->c_ivq_lock);
spin_lock_init(&portdev->c_ovq_lock);
- nr_added_bufs = fill_queue(portdev->c_ivq,
- &portdev->c_ivq_lock);
- if (!nr_added_bufs) {
+ err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
+ if (err < 0) {
dev_err(&vdev->dev,
"Error allocating buffers for control queue\n");
/*
@@ -2097,7 +2095,7 @@ static int virtcons_probe(struct virtio_
VIRTIO_CONSOLE_DEVICE_READY, 0);
/* Device was functional: we need full cleanup. */
virtcons_remove(vdev);
- return -ENOMEM;
+ return err;
}
} else {
/*
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 133/136] net/sched: act_pedit: fix WARN() in the traffic path
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (131 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 132/136] virtio_console: allocate inbufs in add_port() only if it is needed Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 134/136] sfc: Only cancel the PPS workqueue if it exists Ben Hutchings
` (3 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, David S. Miller, Davide Caratti
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Davide Caratti <dcaratti@redhat.com>
commit f67169fef8dbcc1ac6a6a109ecaad0d3b259002c upstream.
when configuring act_pedit rules, the number of keys is validated only on
addition of a new entry. This is not sufficient to avoid hitting a WARN()
in the traffic path: for example, it is possible to replace a valid entry
with a new one having 0 extended keys, thus causing splats in dmesg like:
pedit BUG: index 42
WARNING: CPU: 2 PID: 4054 at net/sched/act_pedit.c:410 tcf_pedit_act+0xc84/0x1200 [act_pedit]
[...]
RIP: 0010:tcf_pedit_act+0xc84/0x1200 [act_pedit]
Code: 89 fa 48 c1 ea 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ac 00 00 00 48 8b 44 24 10 48 c7 c7 a0 c4 e4 c0 8b 70 18 e8 1c 30 95 ea <0f> 0b e9 a0 fa ff ff e8 00 03 f5 ea e9 14 f4 ff ff 48 89 58 40 e9
RSP: 0018:ffff888077c9f320 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffffac2983a2
RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff888053927bec
RBP: dffffc0000000000 R08: ffffed100a726209 R09: ffffed100a726209
R10: 0000000000000001 R11: ffffed100a726208 R12: ffff88804beea780
R13: ffff888079a77400 R14: ffff88804beea780 R15: ffff888027ab2000
FS: 00007fdeec9bd740(0000) GS:ffff888053900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffdb3dfd000 CR3: 000000004adb4006 CR4: 00000000001606e0
Call Trace:
tcf_action_exec+0x105/0x3f0
tcf_classify+0xf2/0x410
__dev_queue_xmit+0xcbf/0x2ae0
ip_finish_output2+0x711/0x1fb0
ip_output+0x1bf/0x4b0
ip_send_skb+0x37/0xa0
raw_sendmsg+0x180c/0x2430
sock_sendmsg+0xdb/0x110
__sys_sendto+0x257/0x2b0
__x64_sys_sendto+0xdd/0x1b0
do_syscall_64+0xa5/0x4e0
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7fdeeb72e993
Code: 48 8b 0d e0 74 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 0d d6 2c 00 00 75 13 49 89 ca b8 2c 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 4b cc 00 00 48 89 04 24
RSP: 002b:00007ffdb3de8a18 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 000055c81972b700 RCX: 00007fdeeb72e993
RDX: 0000000000000040 RSI: 000055c81972b700 RDI: 0000000000000003
RBP: 00007ffdb3dea130 R08: 000055c819728510 R09: 0000000000000010
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
R13: 000055c81972b6c0 R14: 000055c81972969c R15: 0000000000000080
Fix this moving the check on 'nkeys' earlier in tcf_pedit_init(), so that
attempts to install rules having 0 keys are always rejected with -EINVAL.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 3.16:
- Drop change in tcf_pedit_keys_ex_parse()
- netlink doesn't support error messages
- Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -50,13 +50,13 @@ static int tcf_pedit_init(struct net *ne
if (tb[TCA_PEDIT_PARMS] == NULL)
return -EINVAL;
parm = nla_data(tb[TCA_PEDIT_PARMS]);
+ if (!parm->nkeys)
+ return -EINVAL;
ksize = parm->nkeys * sizeof(struct tc_pedit_key);
if (nla_len(tb[TCA_PEDIT_PARMS]) < sizeof(*parm) + ksize)
return -EINVAL;
if (!tcf_hash_check(parm->index, a, bind)) {
- if (!parm->nkeys)
- return -EINVAL;
ret = tcf_hash_create(parm->index, est, a, sizeof(*p), bind);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 134/136] sfc: Only cancel the PPS workqueue if it exists
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (132 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 133/136] net/sched: act_pedit: fix WARN() in the traffic path Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 135/136] mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() Ben Hutchings
` (2 subsequent siblings)
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, David S. Miller, Martin Habets
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Martin Habets <mhabets@solarflare.com>
commit 723eb53690041740a13ac78efeaf6804f5d684c9 upstream.
The workqueue only exists for the primary PF. For other functions
we hit a WARN_ON in kernel/workqueue.c.
Fixes: 7c236c43b838 ("sfc: Add support for IEEE-1588 PTP")
Signed-off-by: Martin Habets <mhabets@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/net/ethernet/sfc/ptp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/ethernet/sfc/ptp.c
+++ b/drivers/net/ethernet/sfc/ptp.c
@@ -1310,7 +1310,8 @@ void efx_ptp_remove(struct efx_nic *efx)
(void)efx_ptp_disable(efx);
cancel_work_sync(&efx->ptp_data->work);
- cancel_work_sync(&efx->ptp_data->pps_work);
+ if (efx->ptp_data->pps_workwq)
+ cancel_work_sync(&efx->ptp_data->pps_work);
skb_queue_purge(&efx->ptp_data->rxq);
skb_queue_purge(&efx->ptp_data->txq);
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 135/136] mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (133 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 134/136] sfc: Only cancel the PPS workqueue if it exists Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 0:47 ` [PATCH 3.16 136/136] fs/dcache: move security_d_instantiate() behind attaching dentry to inode Ben Hutchings
2019-12-17 18:19 ` [PATCH 3.16 000/136] 3.16.80-rc1 review Guenter Roeck
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable
Cc: akpm, Denis Kirjanov, Andrey Ryabinin, Hugh Dickins,
Andrea Arcangeli, Linus Torvalds
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit 9a63236f1ad82d71a98aa80320b6cb618fb32f44 upstream.
It's possible to hit the WARN_ON_ONCE(page_mapped(page)) in
remove_stable_node() when it races with __mmput() and squeezes in
between ksm_exit() and exit_mmap().
WARNING: CPU: 0 PID: 3295 at mm/ksm.c:888 remove_stable_node+0x10c/0x150
Call Trace:
remove_all_stable_nodes+0x12b/0x330
run_store+0x4ef/0x7b0
kernfs_fop_write+0x200/0x420
vfs_write+0x154/0x450
ksys_write+0xf9/0x1d0
do_syscall_64+0x99/0x510
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Remove the warning as there is nothing scary going on.
Link: http://lkml.kernel.org/r/20191119131850.5675-1-aryabinin@virtuozzo.com
Fixes: cbf86cfe04a6 ("ksm: remove old stable nodes more thoroughly")
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
mm/ksm.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/mm/ksm.c
+++ b/mm/ksm.c
@@ -715,13 +715,13 @@ static int remove_stable_node(struct sta
return 0;
}
- if (WARN_ON_ONCE(page_mapped(page))) {
- /*
- * This should not happen: but if it does, just refuse to let
- * merge_across_nodes be switched - there is no need to panic.
- */
- err = -EBUSY;
- } else {
+ /*
+ * Page could be still mapped if this races with __mmput() running in
+ * between ksm_exit() and exit_mmap(). Just refuse to let
+ * merge_across_nodes/max_page_sharing be switched.
+ */
+ err = -EBUSY;
+ if (!page_mapped(page)) {
/*
* The stable node did not yet appear stale to get_ksm_page(),
* since that allows for an unmapped ksm page to be recognized
^ permalink raw reply [flat|nested] 140+ messages in thread* [PATCH 3.16 136/136] fs/dcache: move security_d_instantiate() behind attaching dentry to inode
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (134 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 135/136] mm/ksm.c: don't WARN if page is still mapped in remove_stable_node() Ben Hutchings
@ 2019-12-17 0:47 ` Ben Hutchings
2019-12-17 18:19 ` [PATCH 3.16 000/136] 3.16.80-rc1 review Guenter Roeck
136 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 0:47 UTC (permalink / raw)
To: linux-kernel, stable; +Cc: akpm, Denis Kirjanov, stable, zhangyi (F)
3.16.80-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: "zhangyi (F)" <yi.zhang@huawei.com>
During backport 1e2e547a93a "do d_instantiate/unlock_new_inode
combinations safely", there was a error instantiating sequence of
attaching dentry to inode and calling security_d_instantiate().
Before commit ce23e640133 "->getxattr(): pass dentry and inode as
separate arguments" and b96809173e9 "security_d_instantiate(): move to
the point prior to attaching dentry to inode", security_d_instantiate()
should be called beind __d_instantiate(), otherwise it will trigger
below problem when CONFIG_SECURITY_SMACK on ext4 was enabled because
d_inode(dentry) used by ->getxattr() is NULL before __d_instantiate()
instantiate inode.
[ 31.858026] BUG: unable to handle kernel paging request at ffffffffffffff70
...
[ 31.882024] Call Trace:
[ 31.882378] [<ffffffffa347f75c>] ext4_xattr_get+0x8c/0x3e0
[ 31.883195] [<ffffffffa3489454>] ext4_xattr_security_get+0x24/0x40
[ 31.884086] [<ffffffffa336a56b>] generic_getxattr+0x5b/0x90
[ 31.884907] [<ffffffffa3700514>] smk_fetch+0xb4/0x150
[ 31.885634] [<ffffffffa3700772>] smack_d_instantiate+0x1c2/0x550
[ 31.886508] [<ffffffffa36f9a5a>] security_d_instantiate+0x3a/0x80
[ 31.887389] [<ffffffffa3353b26>] d_instantiate_new+0x36/0x130
[ 31.888223] [<ffffffffa342b1ef>] ext4_mkdir+0x4af/0x6a0
[ 31.888928] [<ffffffffa3343470>] vfs_mkdir+0x100/0x280
[ 31.889536] [<ffffffffa334b086>] SyS_mkdir+0xb6/0x170
[ 31.890255] [<ffffffffa307c855>] ? trace_do_page_fault+0x95/0x2b0
[ 31.891134] [<ffffffffa3c5e078>] entry_SYSCALL_64_fastpath+0x18/0x73
Cc: <stable@vger.kernel.org> # 3.16, 4.4
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
fs/dcache.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -1685,7 +1685,6 @@ void d_instantiate_new(struct dentry *en
BUG_ON(!hlist_unhashed(&entry->d_u.d_alias));
BUG_ON(!inode);
lockdep_annotate_inode_mutex_key(inode);
- security_d_instantiate(entry, inode);
spin_lock(&inode->i_lock);
__d_instantiate(entry, inode);
WARN_ON(!(inode->i_state & I_NEW));
@@ -1693,6 +1692,7 @@ void d_instantiate_new(struct dentry *en
smp_mb();
wake_up_bit(&inode->i_state, __I_NEW);
spin_unlock(&inode->i_lock);
+ security_d_instantiate(entry, inode);
}
EXPORT_SYMBOL(d_instantiate_new);
^ permalink raw reply [flat|nested] 140+ messages in thread* Re: [PATCH 3.16 000/136] 3.16.80-rc1 review
2019-12-17 0:45 [PATCH 3.16 000/136] 3.16.80-rc1 review Ben Hutchings
` (135 preceding siblings ...)
2019-12-17 0:47 ` [PATCH 3.16 136/136] fs/dcache: move security_d_instantiate() behind attaching dentry to inode Ben Hutchings
@ 2019-12-17 18:19 ` Guenter Roeck
2019-12-17 18:43 ` Ben Hutchings
136 siblings, 1 reply; 140+ messages in thread
From: Guenter Roeck @ 2019-12-17 18:19 UTC (permalink / raw)
To: Ben Hutchings; +Cc: linux-kernel, stable, torvalds, akpm, Denis Kirjanov
On Tue, Dec 17, 2019 at 12:45:34AM +0000, Ben Hutchings wrote:
> This is the start of the stable review cycle for the 3.16.80 release.
> There are 136 patches in this series, which will be posted as responses
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu Dec 19 12:00:00 UTC 2019.
> Anything received after that time might be too late.
>
Build results:
total: 136 pass: 136 fail: 0
Qemu test results:
total: 229 pass: 229 fail: 0
Guenter
^ permalink raw reply [flat|nested] 140+ messages in thread* Re: [PATCH 3.16 000/136] 3.16.80-rc1 review
2019-12-17 18:19 ` [PATCH 3.16 000/136] 3.16.80-rc1 review Guenter Roeck
@ 2019-12-17 18:43 ` Ben Hutchings
0 siblings, 0 replies; 140+ messages in thread
From: Ben Hutchings @ 2019-12-17 18:43 UTC (permalink / raw)
To: Guenter Roeck; +Cc: linux-kernel, stable, torvalds, akpm, Denis Kirjanov
[-- Attachment #1: Type: text/plain, Size: 741 bytes --]
On Tue, 2019-12-17 at 10:19 -0800, Guenter Roeck wrote:
> On Tue, Dec 17, 2019 at 12:45:34AM +0000, Ben Hutchings wrote:
> > This is the start of the stable review cycle for the 3.16.80 release.
> > There are 136 patches in this series, which will be posted as responses
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu Dec 19 12:00:00 UTC 2019.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 136 pass: 136 fail: 0
> Qemu test results:
> total: 229 pass: 229 fail: 0
Thanks for testing,
Ben.
--
Ben Hutchings
If the facts do not conform to your theory, they must be disposed of.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 140+ messages in thread