June 2019 - Linux-stable-mirror

Kernel 4.19.47 with commit 8715ce033eb37f539e73b1570bf56404b21d46cd failed to execute NX-protected page

by Daniel Dao

Hi there, We are testing kernel 4.19.47 with some tools utilizing kprobe, resulting in panics that look like: [ 1085.318031] kernel tried to execute NX-protected page - exploit attempt? (uid: 65534) [ 1085.334028] BUG: unable to handle kernel paging request at ffffffffc0428000 [ 1085.349128] PGD 13a3e10067 P4D 13a3e10067 PUD 13a3e12067 PMD c1e860067 PTE 8000000bbd075061 [ 1085.365779] Oops: 0011 [#1] SMP KASAN PTI [ 1085.377879] CPU: 30 PID: 29734 Comm: nginx-fl Tainted: G B O 4.19.47-cloudflare-kasan-2019.6.0 #2019.6.0 [ 1085.396652] Hardware name: Quanta Computer Inc QuantaPlex T41S-2U/S2S-MB, BIOS S2S_3B10.03 06/21/2018 [ 1085.414041] RIP: 0010:0xffffffffc0428000 [ 1085.425965] Code: Bad RIP value. [ 1085.436832] RSP: 0018:ffff88a015e2fb18 EFLAGS: 00010246 [ 1085.449853] RAX: 0000000000000003 RBX: ffff889f73448900 RCX: 0000000000000218 [ 1085.464719] RDX: ffff889fe4893c00 RSI: 0000000000000002 RDI: ffff889f73448900 [ 1085.479626] RBP: ffff88a015e2fe18 R08: 0000000000000006 R09: 0000000000000000 [ 1085.494677] R10: 000000008a08850a R11: 0000000000000000 R12: ffff889f7344890c [ 1085.509890] R13: ffff889f73448c54 R14: ffff889f73448c7a R15: 0000000000002c19 [ 1085.525252] FS: 00007f51582f5680(0000) GS:ffff88a03fb80000(0000) knlGS:0000000000000000 [ 1085.541810] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1085.555812] CR2: ffffffffc0427fd6 CR3: 0000002039fee004 CR4: 00000000001606e0 [ 1085.571154] Call Trace: [ 1085.581676] ? tcp_set_state+0x5/0x5b0 [ 1085.593532] ? tcp_v4_connect+0xbd7/0x2000 [ 1085.605809] ? tcp_sk_init+0x1220/0x1220 [ 1085.617810] ? selinux_socket_connect_helper.isra.55+0x277/0x400 [ 1085.631808] ? sock_poll+0x218/0x300 [ 1085.643407] ? selinux_netcache_avc_callback+0x30/0x30 [ 1085.656701] ? __inet_stream_connect+0x630/0xbd0 [ 1085.669508] ? expand_files.part.9+0x640/0x640 [ 1085.682145] ? ipip_gro_complete+0x110/0x110 [ 1085.694627] ? __inet_stream_connect+0xbd0/0xbd0 [ 1085.707397] ? inet_stream_connect+0x53/0xa0 [ 1085.719830] ? __sys_connect+0x1f6/0x270 [ 1085.731964] ? __ia32_sys_accept+0xb0/0xb0 [ 1085.744201] ? mutex_lock+0x85/0xe0 [ 1085.755815] ? ep_show_fdinfo+0x3c0/0x3c0 [ 1085.767916] ? syscall_trace_enter+0x566/0xc30 [ 1085.780429] ? __x64_sys_epoll_ctl+0x237/0x1080 [ 1085.792883] ? exit_to_usermode_loop+0x140/0x140 [ 1085.805425] ? __audit_syscall_exit+0x73e/0xa30 [ 1085.817925] ? __x64_sys_connect+0x6f/0xb0 [ 1085.829915] ? do_syscall_64+0x8e/0x280 [ 1085.841539] ? prepare_exit_to_usermode+0xe1/0x140 [ 1085.854067] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1085.867000] Modules linked in: xt_length xt_connlimit nf_conncount xt_hashlimit iptable_security sch_fq md_mod dm_crypt algif_skcipher af_alg dm_mod dax ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw xt_nat iptable_nat nf_nat_ipv4 nf_nat xt_TPROXY nf_tproxy_ipv6 nf_tproxy_ipv4 xt_connmark iptable_mangle xt_owner ip6table_filter ip6_tables xt_CT xt_socket nf_socket_ipv4 nf_socket_ipv6 iptable_raw nfnetlink_log xt_NFLOG xt_bpf xt_comment xt_conntrack xt_mark xt_multiport xt_set xt_tcpudp ipt_GLBREDIRECT(O) nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 fou ip6_udp_tunnel udp_tunnel iptable_filter bpfilter ip_set_hash_netport ip_set_hash_net ip_set_hash_ip ip_set nfnetlink sit ipip tunnel4 ip_tunnel tun 8021q garp stp mrp llc sb_edac x86_pkg_temp_thermal kvm_intel kvm irqbypass [ 1085.996378] crc32_pclmul crc32c_intel pcbc aesni_intel aes_x86_64 ipmi_ssif crypto_simd cryptd glue_helper intel_cstate intel_uncore sfc(O) intel_rapl_perf tpm_tis tpm_tis_core mdio tpm ipmi_si ipmi_devintf ipmi_msghandler efivarfs ip_tables x_tables Reproducible steps on my local machine are as follow: 1. Run kernel 4.19.47 2. We are going to test kprobe on tcp_set_state using https://github.com/iovisor/bcc/blob/master/tools/tcplife.py. But probably any workload utilizing kprobe would work - Run some workload that creating tcp connections. I'm runing `python -m SimpleHTTPServer` and `wrk -d60s -c10 http://localhost:8000` - Run the script https://github.com/iovisor/bcc/blob/master/tools/tcplife.py. Expect it to not crash the kernel and producing some output Reverting commit 8715ce033eb37f539e73b1570bf56404b21d46cd makes it work for me locally. I also tested kernel 5.2.0-rc3-00024-g788a024921c4 locally (latest Linus tree) and not seeing the issue, so maybe somewhere along the backporting process, we failed to backport all the required patches ? Cheers, Daniel.

5 years, 10 months

3
4
0 0

[PATCH v2 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

by Ajay Kaher

From: Andrea Arcangeli <aarcange(a)redhat.com> commit 04f5866e41fb70690e28397487d8bd8eea7d712a upstream. The core dumping code has always run without holding the mmap_sem for writing, despite that is the only way to ensure that the entire vma layout will not change from under it. Only using some signal serialization on the processes belonging to the mm is not nearly enough. This was pointed out earlier. For example in Hugh's post from Jul 2017: https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils "Not strictly relevant here, but a related note: I was very surprised to discover, only quite recently, how handle_mm_fault() may be called without down_read(mmap_sem) - when core dumping. That seems a misguided optimization to me, which would also be nice to correct" In particular because the growsdown and growsup can move the vm_start/vm_end the various loops the core dump does around the vma will not be consistent if page faults can happen concurrently. Pretty much all users calling mmget_not_zero()/get_task_mm() and then taking the mmap_sem had the potential to introduce unexpected side effects in the core dumping code. Adding mmap_sem for writing around the ->core_dump invocation is a viable long term fix, but it requires removing all copy user and page faults and to replace them with get_dump_page() for all binary formats which is not suitable as a short term fix. For the time being this solution manually covers the places that can confuse the core dump either by altering the vma layout or the vma flags while it runs. Once ->core_dump runs under mmap_sem for writing the function mmget_still_valid() can be dropped. Allowing mmap_sem protected sections to run in parallel with the coredump provides some minor parallelism advantage to the swapoff code (which seems to be safe enough by never mangling any vma field and can keep doing swapins in parallel to the core dumping) and to some other corner case. In order to facilitate the backporting I added "Fixes: 86039bd3b4e6" however the side effect of this same race condition in /proc/pid/mem should be reproducible since before 2.6.12-rc2 so I couldn't add any other "Fixes:" because there's no hash beyond the git genesis commit. Because find_extend_vma() is the only location outside of the process context that could modify the "mm" structures under mmap_sem for reading, by adding the mmget_still_valid() check to it, all other cases that take the mmap_sem for reading don't need the new check after mmget_not_zero()/get_task_mm(). The expand_stack() in page fault context also doesn't need the new check, because all tasks under core dumping are frozen. Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com> Reported-by: Jann Horn <jannh(a)google.com> Suggested-by: Oleg Nesterov <oleg(a)redhat.com> Acked-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Reviewed-by: Jann Horn <jannh(a)google.com> Acked-by: Jason Gunthorpe <jgg(a)mellanox.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Ajay: Dropped infiniband changes to get patch to apply on 4.9.y] Signed-off-by: Ajay Kaher <akaher(a)vmware.com> --- fs/proc/task_mmu.c | 18 ++++++++++++++++++ fs/userfaultfd.c | 9 +++++++++ include/linux/sched.h | 21 +++++++++++++++++++++ mm/mmap.c | 7 ++++++- 4 files changed, 54 insertions(+), 1 deletion(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 5138e78..4b207b1 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1057,6 +1057,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, count = -EINTR; goto out_mm; } + /* + * Avoid to modify vma->vm_flags + * without locked ops while the + * coredump reads the vm_flags. + */ + if (!mmget_still_valid(mm)) { + /* + * Silently return "count" + * like if get_task_mm() + * failed. FIXME: should this + * function have returned + * -ESRCH if get_task_mm() + * failed like if + * get_proc_task() fails? + */ + up_write(&mm->mmap_sem); + goto out_mm; + } for (vma = mm->mmap; vma; vma = vma->vm_next) { vma->vm_flags &= ~VM_SOFTDIRTY; vma_set_page_prot(vma); diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 784d667..8bf425a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -479,6 +479,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) * taking the mmap_sem for writing. */ down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto skip_mm; prev = NULL; for (vma = mm->mmap; vma; vma = vma->vm_next) { cond_resched(); @@ -501,6 +503,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) vma->vm_flags = new_flags; vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; } +skip_mm: up_write(&mm->mmap_sem); mmput(mm); wakeup: @@ -802,6 +805,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; @@ -947,6 +953,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; diff --git a/include/linux/sched.h b/include/linux/sched.h index 1c487a3..c3d9ca0 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2933,6 +2933,27 @@ static inline void mmdrop_async(struct mm_struct *mm) } } +/* + * This has to be called after a get_task_mm()/mmget_not_zero() + * followed by taking the mmap_sem for writing before modifying the + * vmas or anything the coredump pretends not to change from under it. + * + * NOTE: find_extend_vma() called from GUP context is the only place + * that can modify the "mm" (notably the vm_start/end) under mmap_sem + * for reading and outside the context of the process, so it is also + * the only case that holds the mmap_sem for reading that must call + * this function. Generally if the mmap_sem is hold for reading + * there's no need of this check after get_task_mm()/mmget_not_zero(). + * + * This function can be obsoleted and the check can be removed, after + * the coredump code will hold the mmap_sem for writing before + * invoking the ->core_dump methods. + */ +static inline bool mmget_still_valid(struct mm_struct *mm) +{ + return likely(!mm->core_state); +} + static inline bool mmget_not_zero(struct mm_struct *mm) { return atomic_inc_not_zero(&mm->mm_users); diff --git a/mm/mmap.c b/mm/mmap.c index 3f2314a..acd93d1 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -45,6 +45,7 @@ #include <linux/moduleparam.h> #include <linux/pkeys.h> +#include <linux/sched.h> #include <asm/uaccess.h> #include <asm/cacheflush.h> #include <asm/tlb.h> @@ -2448,7 +2449,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) vma = find_vma_prev(mm, addr, &prev); if (vma && (vma->vm_start <= addr)) return vma; - if (!prev || expand_stack(prev, addr)) + /* don't alter vm_end if the coredump is running */ + if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); @@ -2474,6 +2476,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) return vma; if (!(vma->vm_flags & VM_GROWSDOWN)) return NULL; + /* don't alter vm_start if the coredump is running */ + if (!mmget_still_valid(mm)) + return NULL; start = vma->vm_start; if (expand_stack(vma, addr)) return NULL; -- 2.7.4

5 years, 10 months

2
1
0 0

Re: Patch "coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping" has been added to the 4.4-stable tree

by Greg KH

On Tue, Jun 04, 2019 at 04:52:31PM +0200, Michal Hocko wrote: > Please note that I have posted my backport today > http://lkml.kernel.org/r/20190604094953.26688-1-mhocko@kernel.org and it > differs from this one. Please have a look! Ah, good point, I just noticed that. Ben, any thoughts as to the difference? thanks, greg k-h

5 years, 10 months

3
4
0 0

[PATCH 2/7] drm/i915/sdvo: Implement proper HDMI audio support for SDVO

by Ville Syrjala

From: Ville Syrjälä <ville.syrjala(a)linux.intel.com> Our SDVO audio support is pretty bogus. We can't push audio over the SDVO bus, so trying to enable audio in the SDVO control register doesn't do anything. In fact it looks like the SDVO encoder will always mix in the audio coming over HDA, and there's no (at least documented) way to disable that from our side. So HDMI audio does work currently but only by luck really. What is missing though is the ELD. To pass the ELD to the audio driver we need to write it to magic buffer in the SDVO encoder hardware which then gets pulled out via HDA in the other end. Ie. pretty much the same thing we had for native HDMI before we started to just pass the ELD between the drivers. This sort of explains why we even have that silly hardware buffer with native HDMI. $ cat /proc/asound/card0/eld#1.0 -monitor_present 0 -eld_valid 0 +monitor_present 1 +eld_valid 1 +monitor_name LG TV +connection_type HDMI +... This also fixes our state readout since we can now query the SDVO encoder about the state of the "ELD valid" and "presence detect" bits. As mentioned those don't actually control whether audio gets sent over the HDMI cable, but it's the best we can do. Cc: stable(a)vger.kernel.org Cc: Daniel Vetter <daniel.vetter(a)ffwll.ch> Cc: zardam(a)gmail.com Tested-by: zardam(a)gmail.com Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=108976 Fixes: de44e256b92c ("drm/i915/sdvo: Shut up state checker with hdmi cards on gen3") Signed-off-by: Ville Syrjälä <ville.syrjala(a)linux.intel.com> --- drivers/gpu/drm/i915/intel_sdvo.c | 58 +++++++++++++++++++++----- drivers/gpu/drm/i915/intel_sdvo_regs.h | 3 ++ 2 files changed, 50 insertions(+), 11 deletions(-) diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c index 61db07244296..7f64352a3413 100644 --- a/drivers/gpu/drm/i915/intel_sdvo.c +++ b/drivers/gpu/drm/i915/intel_sdvo.c @@ -916,6 +916,13 @@ static bool intel_sdvo_set_colorimetry(struct intel_sdvo *intel_sdvo, return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_COLORIMETRY, &mode, 1); } +static bool intel_sdvo_set_audio_state(struct intel_sdvo *intel_sdvo, + u8 audio_state) +{ + return intel_sdvo_set_value(intel_sdvo, SDVO_CMD_SET_AUDIO_STAT, + &audio_state, 1); +} + #if 0 static void intel_sdvo_dump_hdmi_buf(struct intel_sdvo *intel_sdvo) { @@ -1487,11 +1494,6 @@ static void intel_sdvo_pre_enable(struct intel_encoder *intel_encoder, else sdvox |= SDVO_PIPE_SEL(crtc->pipe); - if (crtc_state->has_audio) { - WARN_ON_ONCE(INTEL_GEN(dev_priv) < 4); - sdvox |= SDVO_AUDIO_ENABLE; - } - if (INTEL_GEN(dev_priv) >= 4) { /* done in crtc_mode_set as the dpll_md reg must be written early */ } else if (IS_I945G(dev_priv) || IS_I945GM(dev_priv) || @@ -1635,8 +1637,13 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder, if (sdvox & HDMI_COLOR_RANGE_16_235) pipe_config->limited_color_range = true; - if (sdvox & SDVO_AUDIO_ENABLE) - pipe_config->has_audio = true; + if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_AUDIO_STAT, + &val, 1)) { + u8 mask = SDVO_AUDIO_ELD_VALID | SDVO_AUDIO_PRESENCE_DETECT; + + if ((val & mask) == mask) + pipe_config->has_audio = true; + } if (intel_sdvo_get_value(intel_sdvo, SDVO_CMD_GET_ENCODE, &val, 1)) { @@ -1647,6 +1654,32 @@ static void intel_sdvo_get_config(struct intel_encoder *encoder, intel_sdvo_get_avi_infoframe(intel_sdvo, pipe_config); } +static void intel_sdvo_disable_audio(struct intel_sdvo *intel_sdvo) +{ + intel_sdvo_set_audio_state(intel_sdvo, 0); +} + +static void intel_sdvo_enable_audio(struct intel_sdvo *intel_sdvo, + const struct intel_crtc_state *crtc_state, + const struct drm_connector_state *conn_state) +{ + const struct drm_display_mode *adjusted_mode = + &crtc_state->base.adjusted_mode; + struct drm_connector *connector = conn_state->connector; + u8 *eld = connector->eld; + + eld[6] = drm_av_sync_delay(connector, adjusted_mode) / 2; + + intel_sdvo_set_audio_state(intel_sdvo, 0); + + intel_sdvo_write_infoframe(intel_sdvo, SDVO_HBUF_INDEX_ELD, + SDVO_HBUF_TX_DISABLED, + eld, drm_eld_size(eld)); + + intel_sdvo_set_audio_state(intel_sdvo, SDVO_AUDIO_ELD_VALID | + SDVO_AUDIO_PRESENCE_DETECT); +} + static void intel_disable_sdvo(struct intel_encoder *encoder, const struct intel_crtc_state *old_crtc_state, const struct drm_connector_state *conn_state) @@ -1656,6 +1689,9 @@ static void intel_disable_sdvo(struct intel_encoder *encoder, struct intel_crtc *crtc = to_intel_crtc(old_crtc_state->base.crtc); u32 temp; + if (old_crtc_state->has_audio) + intel_sdvo_disable_audio(intel_sdvo); + intel_sdvo_set_active_outputs(intel_sdvo, 0); if (0) intel_sdvo_set_encoder_power_state(intel_sdvo, @@ -1741,6 +1777,9 @@ static void intel_enable_sdvo(struct intel_encoder *encoder, intel_sdvo_set_encoder_power_state(intel_sdvo, DRM_MODE_DPMS_ON); intel_sdvo_set_active_outputs(intel_sdvo, intel_sdvo->attached_output); + + if (pipe_config->has_audio) + intel_sdvo_enable_audio(intel_sdvo, pipe_config, conn_state); } static enum drm_mode_status @@ -2603,7 +2642,6 @@ static bool intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device) { struct drm_encoder *encoder = &intel_sdvo->base.base; - struct drm_i915_private *dev_priv = to_i915(encoder->dev); struct drm_connector *connector; struct intel_encoder *intel_encoder = to_intel_encoder(encoder); struct intel_connector *intel_connector; @@ -2640,9 +2678,7 @@ intel_sdvo_dvi_init(struct intel_sdvo *intel_sdvo, int device) encoder->encoder_type = DRM_MODE_ENCODER_TMDS; connector->connector_type = DRM_MODE_CONNECTOR_DVID; - /* gen3 doesn't do the hdmi bits in the SDVO register */ - if (INTEL_GEN(dev_priv) >= 4 && - intel_sdvo_is_hdmi_connector(intel_sdvo, device)) { + if (intel_sdvo_is_hdmi_connector(intel_sdvo, device)) { connector->connector_type = DRM_MODE_CONNECTOR_HDMIA; intel_sdvo_connector->is_hdmi = true; } diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h index db0ed499268a..e9ba3b047f93 100644 --- a/drivers/gpu/drm/i915/intel_sdvo_regs.h +++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h @@ -707,6 +707,9 @@ struct intel_sdvo_enhancements_arg { #define SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER 0x90 #define SDVO_CMD_SET_AUDIO_STAT 0x91 #define SDVO_CMD_GET_AUDIO_STAT 0x92 + #define SDVO_AUDIO_ELD_VALID (1 << 0) + #define SDVO_AUDIO_PRESENCE_DETECT (1 << 1) + #define SDVO_AUDIO_CP_READY (1 << 2) #define SDVO_CMD_SET_HBUF_INDEX 0x93 #define SDVO_HBUF_INDEX_ELD 0 #define SDVO_HBUF_INDEX_AVI_IF 1 -- 2.21.0

5 years, 10 months

3
2
0 0

[PATCH 1/1] [v4.9.y] coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping

by Ajay Kaher

From: Andrea Arcangeli <aarcange(a)redhat.com> commit 1eb719f09f7e319e79f6abf2b9e8c0dcc1c477b5 upstream. The core dumping code has always run without holding the mmap_sem for writing, despite that is the only way to ensure that the entire vma layout will not change from under it. Only using some signal serialization on the processes belonging to the mm is not nearly enough. This was pointed out earlier. For example in Hugh's post from Jul 2017: https://lkml.kernel.org/r/alpine.LSU.2.11.1707191716030.2055@eggly.anvils "Not strictly relevant here, but a related note: I was very surprised to discover, only quite recently, how handle_mm_fault() may be called without down_read(mmap_sem) - when core dumping. That seems a misguided optimization to me, which would also be nice to correct" In particular because the growsdown and growsup can move the vm_start/vm_end the various loops the core dump does around the vma will not be consistent if page faults can happen concurrently. Pretty much all users calling mmget_not_zero()/get_task_mm() and then taking the mmap_sem had the potential to introduce unexpected side effects in the core dumping code. Adding mmap_sem for writing around the ->core_dump invocation is a viable long term fix, but it requires removing all copy user and page faults and to replace them with get_dump_page() for all binary formats which is not suitable as a short term fix. For the time being this solution manually covers the places that can confuse the core dump either by altering the vma layout or the vma flags while it runs. Once ->core_dump runs under mmap_sem for writing the function mmget_still_valid() can be dropped. Allowing mmap_sem protected sections to run in parallel with the coredump provides some minor parallelism advantage to the swapoff code (which seems to be safe enough by never mangling any vma field and can keep doing swapins in parallel to the core dumping) and to some other corner case. In order to facilitate the backporting I added "Fixes: 86039bd3b4e6" however the side effect of this same race condition in /proc/pid/mem should be reproducible since before 2.6.12-rc2 so I couldn't add any other "Fixes:" because there's no hash beyond the git genesis commit. Because find_extend_vma() is the only location outside of the process context that could modify the "mm" structures under mmap_sem for reading, by adding the mmget_still_valid() check to it, all other cases that take the mmap_sem for reading don't need the new check after mmget_not_zero()/get_task_mm(). The expand_stack() in page fault context also doesn't need the new check, because all tasks under core dumping are frozen. Link: http://lkml.kernel.org/r/20190325224949.11068-1-aarcange@redhat.com Fixes: 86039bd3b4e6 ("userfaultfd: add new syscall to provide memory externalization") Signed-off-by: Andrea Arcangeli <aarcange(a)redhat.com> Reported-by: Jann Horn <jannh(a)google.com> Suggested-by: Oleg Nesterov <oleg(a)redhat.com> Acked-by: Peter Xu <peterx(a)redhat.com> Reviewed-by: Mike Rapoport <rppt(a)linux.ibm.com> Reviewed-by: Oleg Nesterov <oleg(a)redhat.com> Reviewed-by: Jann Horn <jannh(a)google.com> Acked-by: Jason Gunthorpe <jgg(a)mellanox.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> [Ajay: Dropped infiniband changes to get patch to apply on 4.9.y] Signed-off-by: Ajay Kaher <akaher(a)vmware.com> Reviewed-by: Srivatsa S. Bhat (VMware) <srivatsa(a)csail.mit.edu> --- fs/proc/task_mmu.c | 18 ++++++++++++++++++ fs/userfaultfd.c | 9 +++++++++ include/linux/sched.h | 21 +++++++++++++++++++++ mm/mmap.c | 7 ++++++- 4 files changed, 54 insertions(+), 1 deletion(-) diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c index 5138e78..4b207b1 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -1057,6 +1057,24 @@ static ssize_t clear_refs_write(struct file *file, const char __user *buf, count = -EINTR; goto out_mm; } + /* + * Avoid to modify vma->vm_flags + * without locked ops while the + * coredump reads the vm_flags. + */ + if (!mmget_still_valid(mm)) { + /* + * Silently return "count" + * like if get_task_mm() + * failed. FIXME: should this + * function have returned + * -ESRCH if get_task_mm() + * failed like if + * get_proc_task() fails? + */ + up_write(&mm->mmap_sem); + goto out_mm; + } for (vma = mm->mmap; vma; vma = vma->vm_next) { vma->vm_flags &= ~VM_SOFTDIRTY; vma_set_page_prot(vma); diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 784d667..8bf425a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -479,6 +479,8 @@ static int userfaultfd_release(struct inode *inode, struct file *file) * taking the mmap_sem for writing. */ down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto skip_mm; prev = NULL; for (vma = mm->mmap; vma; vma = vma->vm_next) { cond_resched(); @@ -501,6 +503,7 @@ static int userfaultfd_release(struct inode *inode, struct file *file) vma->vm_flags = new_flags; vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; } +skip_mm: up_write(&mm->mmap_sem); mmput(mm); wakeup: @@ -802,6 +805,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; @@ -947,6 +953,9 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, goto out; down_write(&mm->mmap_sem); + if (!mmget_still_valid(mm)) + goto out_unlock; + vma = find_vma_prev(mm, start, &prev); if (!vma) goto out_unlock; diff --git a/include/linux/sched.h b/include/linux/sched.h index 1c487a3..c3d9ca0 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -2933,6 +2933,27 @@ static inline void mmdrop_async(struct mm_struct *mm) } } +/* + * This has to be called after a get_task_mm()/mmget_not_zero() + * followed by taking the mmap_sem for writing before modifying the + * vmas or anything the coredump pretends not to change from under it. + * + * NOTE: find_extend_vma() called from GUP context is the only place + * that can modify the "mm" (notably the vm_start/end) under mmap_sem + * for reading and outside the context of the process, so it is also + * the only case that holds the mmap_sem for reading that must call + * this function. Generally if the mmap_sem is hold for reading + * there's no need of this check after get_task_mm()/mmget_not_zero(). + * + * This function can be obsoleted and the check can be removed, after + * the coredump code will hold the mmap_sem for writing before + * invoking the ->core_dump methods. + */ +static inline bool mmget_still_valid(struct mm_struct *mm) +{ + return likely(!mm->core_state); +} + static inline bool mmget_not_zero(struct mm_struct *mm) { return atomic_inc_not_zero(&mm->mm_users); diff --git a/mm/mmap.c b/mm/mmap.c index 3f2314a..acd93d1 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -45,6 +45,7 @@ #include <linux/moduleparam.h> #include <linux/pkeys.h> +#include <linux/sched.h> #include <asm/uaccess.h> #include <asm/cacheflush.h> #include <asm/tlb.h> @@ -2448,7 +2449,8 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) vma = find_vma_prev(mm, addr, &prev); if (vma && (vma->vm_start <= addr)) return vma; - if (!prev || expand_stack(prev, addr)) + /* don't alter vm_end if the coredump is running */ + if (!prev || !mmget_still_valid(mm) || expand_stack(prev, addr)) return NULL; if (prev->vm_flags & VM_LOCKED) populate_vma_page_range(prev, addr, prev->vm_end, NULL); @@ -2474,6 +2476,9 @@ find_extend_vma(struct mm_struct *mm, unsigned long addr) return vma; if (!(vma->vm_flags & VM_GROWSDOWN)) return NULL; + /* don't alter vm_start if the coredump is running */ + if (!mmget_still_valid(mm)) + return NULL; start = vma->vm_start; if (expand_stack(vma, addr)) return NULL; -- 2.7.4

5 years, 10 months

2
4
0 0

Re: [PATCH RFC] svcrdma: Ignore source port when computing DRC hash

by Sasha Levin

Hi, [This is an automated email] This commit has been processed because it contains a -stable tag. The stable tag indicates that it's relevant for the following trees: all The bot has tested the following trees: v5.1.7, v5.0.21, v4.19.48, v4.14.123, v4.9.180, v4.4.180. v5.1.7: Build OK! v5.0.21: Build OK! v4.19.48: Build OK! v4.14.123: Build OK! v4.9.180: Build failed! Errors: net/sunrpc/xprtrdma/svc_rdma_transport.c:712:2: error: implicit declaration of function ‘rpc_set_port’; did you mean ‘rpc_net_ns’? [-Werror=implicit-function-declaration] v4.4.180: Build failed! Errors: net/sunrpc/xprtrdma/svc_rdma_transport.c:635:2: error: implicit declaration of function ‘rpc_set_port’; did you mean ‘rpc_net_ns’? [-Werror=implicit-function-declaration] How should we proceed with this patch? -- Thanks, Sasha

5 years, 10 months

2
1
0 0

[SRU][Bionic][PATCH] selinux: use kernel linux/socket.h for genheaders and mdp

by Dimitri John Ledkov

From: Paulo Alcantara <paulo(a)paulo.ac> BugLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1823429 When compiling genheaders and mdp from a newer host kernel, the following error happens: In file included from scripts/selinux/genheaders/genheaders.c:18: ./security/selinux/include/classmap.h:238:2: error: #error New address family defined, please update secclass_map. #error New address family defined, please update secclass_map. ^~~~~ make[3]: *** [scripts/Makefile.host:107: scripts/selinux/genheaders/genheaders] Error 1 make[2]: *** [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2 make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2 make[1]: *** Waiting for unfinished jobs.... Instead of relying on the host definition, include linux/socket.h in classmap.h to have PF_MAX. Cc: stable(a)vger.kernel.org Signed-off-by: Paulo Alcantara <paulo(a)paulo.ac> Acked-by: Stephen Smalley <sds(a)tycho.nsa.gov> [PM: manually merge in mdp.c, subject line tweaks] Signed-off-by: Paul Moore <paul(a)paul-moore.com> (cherry picked from commit dfbd199a7cfe3e3cd8531e1353cdbd7175bfbc5e) Signed-off-by: Dimitri John Ledkov <xnox(a)ubuntu.com> --- scripts/selinux/genheaders/genheaders.c | 1 - scripts/selinux/mdp/mdp.c | 1 - security/selinux/include/classmap.h | 1 + 3 files changed, 1 insertion(+), 2 deletions(-) diff --git a/scripts/selinux/genheaders/genheaders.c b/scripts/selinux/genheaders/genheaders.c index fa48fabcb330..3cc4893d98cc 100644 --- a/scripts/selinux/genheaders/genheaders.c +++ b/scripts/selinux/genheaders/genheaders.c @@ -9,7 +9,6 @@ #include <string.h> #include <errno.h> #include <ctype.h> -#include <sys/socket.h> struct security_class_mapping { const char *name; diff --git a/scripts/selinux/mdp/mdp.c b/scripts/selinux/mdp/mdp.c index ffe8179f5d41..c29fa4a6228d 100644 --- a/scripts/selinux/mdp/mdp.c +++ b/scripts/selinux/mdp/mdp.c @@ -32,7 +32,6 @@ #include <stdlib.h> #include <unistd.h> #include <string.h> -#include <sys/socket.h> static void usage(char *name) { diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index acdee7795297..5ae315ab060b 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -1,5 +1,6 @@ /* SPDX-License-Identifier: GPL-2.0 */ #include <linux/capability.h> +#include <linux/socket.h> #define COMMON_FILE_SOCK_PERMS "ioctl", "read", "write", "create", \ "getattr", "setattr", "lock", "relabelfrom", "relabelto", "append", "map" -- 2.20.1

5 years, 10 months

1
0
0 0

[PATCH] btrfs: fix out-of-bounds access in property handling

by Naohiro Aota

xattr value is not NULL-terminated string. When you specify "lz" as the property value, strncmp("lzo", value, 3) will try to read one byte after the value buffer, causing the following OOB access. Fix this out-of-bound by explicitly check the required length. [ 1519.998589] ================================================================== [ 1520.007505] BUG: KASAN: slab-out-of-bounds in strncmp+0xab/0xc0 [ 1520.015116] Read of size 1 at addr ffff8886daec16c2 by task btrfs/15317 [ 1520.026628] CPU: 4 PID: 15317 Comm: btrfs Not tainted 5.1.0-rc7+ #3 [ 1520.034635] Hardware name: Supermicro X10SLL-F/X10SLL-F, BIOS 3.0 04/24/2015 [ 1520.043416] Call Trace: [ 1520.047562] dump_stack+0x71/0xa0 [ 1520.052584] print_address_description+0x65/0x229 [ 1520.058997] ? strncmp+0xab/0xc0 [ 1520.063929] ? strncmp+0xab/0xc0 [ 1520.068834] kasan_report.cold+0x1a/0x38 [ 1520.074439] ? strncmp+0xab/0xc0 [ 1520.079343] strncmp+0xab/0xc0 [ 1520.084110] prop_compression_validate+0x22/0x70 [btrfs] [ 1520.091135] btrfs_xattr_handler_set_prop+0x6c/0x1f0 [btrfs] [ 1520.098452] __vfs_setxattr+0xd8/0x130 [ 1520.103821] ? xattr_resolve_name+0x3e0/0x3e0 [ 1520.109812] __vfs_setxattr_noperm+0xeb/0x3b0 [ 1520.115790] vfs_setxattr+0xa3/0xd0 [ 1520.120898] setxattr+0x17a/0x2c0 [ 1520.125824] ? vfs_setxattr+0xd0/0xd0 [ 1520.131102] ? __pmd_alloc+0x560/0x560 [ 1520.136452] ? __do_sys_newfstat+0xd3/0xe0 [ 1520.142123] ? __ia32_sys_newfstatat+0xf0/0xf0 [ 1520.148140] ? __kasan_slab_free+0x141/0x170 [ 1520.153955] ? handle_mm_fault+0x1ae/0x640 [ 1520.159564] __x64_sys_fsetxattr+0x1a0/0x220 [ 1520.165347] do_syscall_64+0xa0/0x2e0 [ 1520.170515] ? page_fault+0x8/0x30 [ 1520.175408] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1520.181975] RIP: 0033:0x7f84f257ae6e [ 1520.187068] Code: 48 8b 0d 1d 70 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 49 89 ca b8 be 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ea 6f 0c 00 f7 d8 64 89 01 48 [ 1520.209083] RSP: 002b:00007fff87996fa8 EFLAGS: 00000246 ORIG_RAX: 00000000000000be [ 1520.218336] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00007f84f257ae6e [ 1520.227132] RDX: 00007fff8799798b RSI: 00005561caf83270 RDI: 0000000000000003 [ 1520.235912] RBP: 00007fff8799798b R08: 0000000000000000 R09: 00005561caf83290 [ 1520.244691] R10: 0000000000000002 R11: 0000000000000246 R12: 00005561caf83270 [ 1520.253462] R13: 0000000000000003 R14: 00007fff87997972 R15: 00007fff8799797f [ 1520.265443] Allocated by task 15317: [ 1520.270697] __kasan_kmalloc.constprop.0+0xc2/0xd0 [ 1520.277677] setxattr+0xe8/0x2c0 [ 1520.283084] __x64_sys_fsetxattr+0x1a0/0x220 [ 1520.289540] do_syscall_64+0xa0/0x2e0 [ 1520.295379] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1520.306288] Freed by task 12227: [ 1520.311632] __kasan_slab_free+0x12c/0x170 [ 1520.317828] kfree+0x90/0x1e0 [ 1520.322891] btrfs_free_block_groups+0x8a1/0xd80 [btrfs] [ 1520.330313] close_ctree+0x37e/0x650 [btrfs] [ 1520.336627] generic_shutdown_super+0x12e/0x320 [ 1520.343177] kill_anon_super+0x36/0x60 [ 1520.348983] btrfs_kill_super+0x3d/0x2c0 [btrfs] [ 1520.355636] deactivate_locked_super+0x85/0xd0 [ 1520.362108] deactivate_super+0x122/0x140 [ 1520.368166] cleanup_mnt+0x9f/0x130 [ 1520.373699] task_work_run+0x131/0x1c0 [ 1520.379490] exit_to_usermode_loop+0x133/0x160 [ 1520.386002] do_syscall_64+0x259/0x2e0 [ 1520.391796] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 1520.402415] The buggy address belongs to the object at ffff8886daec16c0 which belongs to the cache kmalloc-8 of size 8 [ 1520.418769] The buggy address is located 2 bytes inside of 8-byte region [ffff8886daec16c0, ffff8886daec16c8) [ 1520.434407] The buggy address belongs to the page: [ 1520.441358] page:ffffea001b6bb040 count:1 mapcount:0 mapping:ffff8886ff40fb80 index:0x0 [ 1520.451601] flags: 0x17ffe000000200(slab) [ 1520.457868] raw: 0017ffe000000200 ffffea001bedcec0 0000000700000007 ffff8886ff40fb80 [ 1520.467940] raw: 0000000000000000 0000000080aa00aa 00000001ffffffff 0000000000000000 [ 1520.478024] page dumped because: kasan: bad access detected [ 1520.489795] Memory state around the buggy address: [ 1520.496963] ffff8886daec1580: fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc [ 1520.506621] ffff8886daec1600: 00 fc fc 04 fc fc fb fc fc fb fc fc fb fc fc fb [ 1520.516277] >ffff8886daec1680: fc fc 04 fc fc 00 fc fc 02 fc fc fb fc fc 00 fc [ 1520.525915] ^ [ 1520.533584] ffff8886daec1700: fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc 04 fc fc [ 1520.543137] ffff8886daec1780: fb fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc 00 [ 1520.552642] ================================================================== Fixes: 272e5326c783 ("btrfs: prop: fix vanished compression property after failed set") Fixes: 50398fde997f ("btrfs: prop: fix zstd compression parameter validation") Cc: stable(a)vger.kernel.org # 4.14+: 802a5c69584a: btrfs: prop: use common helper for type to string conversion Cc: stable(a)vger.kernel.org # 4.14+: 3dcf96c7b9fe: btrfs: drop redundant forward declaration in props.c Cc: stable(a)vger.kernel.org # 4.14+ Signed-off-by: Naohiro Aota <naohiro.aota(a)wdc.com> --- fs/btrfs/props.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c index a9e2e66152ee..428141bf545d 100644 --- a/fs/btrfs/props.c +++ b/fs/btrfs/props.c @@ -257,11 +257,11 @@ static int prop_compression_validate(const char *value, size_t len) if (!value) return 0; - if (!strncmp("lzo", value, 3)) + if (len >= 3 && !strncmp("lzo", value, 3)) return 0; - else if (!strncmp("zlib", value, 4)) + else if (len >= 4 && !strncmp("zlib", value, 4)) return 0; - else if (!strncmp("zstd", value, 4)) + else if (len >= 4 && !strncmp("zstd", value, 4)) return 0; return -EINVAL; @@ -281,12 +281,12 @@ static int prop_compression_apply(struct inode *inode, const char *value, return 0; } - if (!strncmp("lzo", value, 3)) { + if (len >= 3 && !strncmp("lzo", value, 3)) { type = BTRFS_COMPRESS_LZO; btrfs_set_fs_incompat(fs_info, COMPRESS_LZO); - } else if (!strncmp("zlib", value, 4)) { + } else if (len >= 4 && !strncmp("zlib", value, 4)) { type = BTRFS_COMPRESS_ZLIB; - } else if (!strncmp("zstd", value, 4)) { + } else if (len >= 4 && !strncmp("zstd", value, 4)) { type = BTRFS_COMPRESS_ZSTD; btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD); } else { -- 2.21.0

5 years, 10 months

3
2
0 0

[PATCH] usb: dwc2: host: Fix wMaxPacketSize handling (fix webcam regression)

by Douglas Anderson

In commit abb621844f6a ("usb: ch9: make usb_endpoint_maxp() return only packet size") the API to usb_endpoint_maxp() changed. It used to just return wMaxPacketSize but after that commit it returned wMaxPacketSize with the high bits (the multiplier) masked off. If you wanted to get the multiplier it was now up to your code to call the new usb_endpoint_maxp_mult() which was introduced in commit 541b6fe63023 ("usb: add helper to extract bits 12:11 of wMaxPacketSize"). Prior to the API change most host drivers were updated, but no update was made to dwc2. Presumably it was assumed that dwc2 was too simplistic to use the multiplier and thus just didn't support a certain class of USB devices. However, it turns out that dwc2 did use the multiplier and many devices using it were working quite nicely. That means that many USB devices have been broken since the API change. One such device is a Logitech HD Pro Webcam C920. Specifically, though dwc2 didn't directly call usb_endpoint_maxp(), it did call usb_maxpacket() which in turn called usb_endpoint_maxp(). Let's update dwc2 to work properly with the new API. Fixes: abb621844f6a ("usb: ch9: make usb_endpoint_maxp() return only packet size") Cc: stable(a)vger.kernel.org Signed-off-by: Douglas Anderson <dianders(a)chromium.org> --- drivers/usb/dwc2/hcd.c | 29 +++++++++++++++++------------ drivers/usb/dwc2/hcd.h | 20 +++++++++++--------- drivers/usb/dwc2/hcd_intr.c | 5 +++-- drivers/usb/dwc2/hcd_queue.c | 10 ++++++---- 4 files changed, 37 insertions(+), 27 deletions(-) diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c index b50ec3714fd8..5c51bf5506d1 100644 --- a/drivers/usb/dwc2/hcd.c +++ b/drivers/usb/dwc2/hcd.c @@ -2608,7 +2608,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) chan->dev_addr = dwc2_hcd_get_dev_addr(&urb->pipe_info); chan->ep_num = dwc2_hcd_get_ep_num(&urb->pipe_info); chan->speed = qh->dev_speed; - chan->max_packet = dwc2_max_packet(qh->maxp); + chan->max_packet = qh->maxp; chan->xfer_started = 0; chan->halt_status = DWC2_HC_XFER_NO_HALT_STATUS; @@ -2686,7 +2686,7 @@ static int dwc2_assign_and_init_hc(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) * This value may be modified when the transfer is started * to reflect the actual transfer length */ - chan->multi_count = dwc2_hb_mult(qh->maxp); + chan->multi_count = qh->maxp_mult; if (hsotg->params.dma_desc_enable) { chan->desc_list_addr = qh->desc_list_dma; @@ -3806,19 +3806,21 @@ static struct dwc2_hcd_urb *dwc2_hcd_urb_alloc(struct dwc2_hsotg *hsotg, static void dwc2_hcd_urb_set_pipeinfo(struct dwc2_hsotg *hsotg, struct dwc2_hcd_urb *urb, u8 dev_addr, - u8 ep_num, u8 ep_type, u8 ep_dir, u16 mps) + u8 ep_num, u8 ep_type, u8 ep_dir, + u16 maxp, u16 maxp_mult) { if (dbg_perio() || ep_type == USB_ENDPOINT_XFER_BULK || ep_type == USB_ENDPOINT_XFER_CONTROL) dev_vdbg(hsotg->dev, - "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, mps=%d\n", - dev_addr, ep_num, ep_dir, ep_type, mps); + "addr=%d, ep_num=%d, ep_dir=%1x, ep_type=%1x, maxp=%d (%d mult)\n", + dev_addr, ep_num, ep_dir, ep_type, maxp, maxp_mult); urb->pipe_info.dev_addr = dev_addr; urb->pipe_info.ep_num = ep_num; urb->pipe_info.pipe_type = ep_type; urb->pipe_info.pipe_dir = ep_dir; - urb->pipe_info.mps = mps; + urb->pipe_info.maxp = maxp; + urb->pipe_info.maxp_mult = maxp_mult; } /* @@ -3909,8 +3911,9 @@ void dwc2_hcd_dump_state(struct dwc2_hsotg *hsotg) dwc2_hcd_is_pipe_in(&urb->pipe_info) ? "IN" : "OUT"); dev_dbg(hsotg->dev, - " Max packet size: %d\n", - dwc2_hcd_get_mps(&urb->pipe_info)); + " Max packet size: %d (%d mult)\n", + dwc2_hcd_get_maxp(&urb->pipe_info), + dwc2_hcd_get_maxp_mult(&urb->pipe_info)); dev_dbg(hsotg->dev, " transfer_buffer: %p\n", urb->buf); @@ -4510,8 +4513,10 @@ static void dwc2_dump_urb_info(struct usb_hcd *hcd, struct urb *urb, } dev_vdbg(hsotg->dev, " Speed: %s\n", speed); - dev_vdbg(hsotg->dev, " Max packet size: %d\n", - usb_maxpacket(urb->dev, urb->pipe, usb_pipeout(urb->pipe))); + dev_vdbg(hsotg->dev, " Max packet size: %d (%d mult)\n", + usb_endpoint_maxp(&urb->ep->desc), + usb_endpoint_maxp_mult(&urb->ep->desc)); + dev_vdbg(hsotg->dev, " Data buffer length: %d\n", urb->transfer_buffer_length); dev_vdbg(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n", @@ -4594,8 +4599,8 @@ static int _dwc2_hcd_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, dwc2_hcd_urb_set_pipeinfo(hsotg, dwc2_urb, usb_pipedevice(urb->pipe), usb_pipeendpoint(urb->pipe), ep_type, usb_pipein(urb->pipe), - usb_maxpacket(urb->dev, urb->pipe, - !(usb_pipein(urb->pipe)))); + usb_endpoint_maxp(&ep->desc), + usb_endpoint_maxp_mult(&ep->desc)); buf = urb->transfer_buffer; diff --git a/drivers/usb/dwc2/hcd.h b/drivers/usb/dwc2/hcd.h index c089ffa1f0a8..ce6445a06588 100644 --- a/drivers/usb/dwc2/hcd.h +++ b/drivers/usb/dwc2/hcd.h @@ -171,7 +171,8 @@ struct dwc2_hcd_pipe_info { u8 ep_num; u8 pipe_type; u8 pipe_dir; - u16 mps; + u16 maxp; + u16 maxp_mult; }; struct dwc2_hcd_iso_packet_desc { @@ -264,6 +265,7 @@ struct dwc2_hs_transfer_time { * - USB_ENDPOINT_XFER_ISOC * @ep_is_in: Endpoint direction * @maxp: Value from wMaxPacketSize field of Endpoint Descriptor + * @maxp_mult: Multiplier for maxp * @dev_speed: Device speed. One of the following values: * - USB_SPEED_LOW * - USB_SPEED_FULL @@ -340,6 +342,7 @@ struct dwc2_qh { u8 ep_type; u8 ep_is_in; u16 maxp; + u16 maxp_mult; u8 dev_speed; u8 data_toggle; u8 ping_state; @@ -503,9 +506,14 @@ static inline u8 dwc2_hcd_get_pipe_type(struct dwc2_hcd_pipe_info *pipe) return pipe->pipe_type; } -static inline u16 dwc2_hcd_get_mps(struct dwc2_hcd_pipe_info *pipe) +static inline u16 dwc2_hcd_get_maxp(struct dwc2_hcd_pipe_info *pipe) +{ + return pipe->maxp; +} + +static inline u16 dwc2_hcd_get_maxp_mult(struct dwc2_hcd_pipe_info *pipe) { - return pipe->mps; + return pipe->maxp_mult; } static inline u8 dwc2_hcd_get_dev_addr(struct dwc2_hcd_pipe_info *pipe) @@ -620,12 +628,6 @@ static inline bool dbg_urb(struct urb *urb) static inline bool dbg_perio(void) { return false; } #endif -/* High bandwidth multiplier as encoded in highspeed endpoint descriptors */ -#define dwc2_hb_mult(wmaxpacketsize) (1 + (((wmaxpacketsize) >> 11) & 0x03)) - -/* Packet size for any kind of endpoint descriptor */ -#define dwc2_max_packet(wmaxpacketsize) ((wmaxpacketsize) & 0x07ff) - /* * Returns true if frame1 index is greater than frame2 index. The comparison * is done modulo FRLISTEN_64_SIZE. This accounts for the rollover of the diff --git a/drivers/usb/dwc2/hcd_intr.c b/drivers/usb/dwc2/hcd_intr.c index 88b5dcf3aefc..a052d39b4375 100644 --- a/drivers/usb/dwc2/hcd_intr.c +++ b/drivers/usb/dwc2/hcd_intr.c @@ -1617,8 +1617,9 @@ static void dwc2_hc_ahberr_intr(struct dwc2_hsotg *hsotg, dev_err(hsotg->dev, " Speed: %s\n", speed); - dev_err(hsotg->dev, " Max packet size: %d\n", - dwc2_hcd_get_mps(&urb->pipe_info)); + dev_err(hsotg->dev, " Max packet size: %d (mult %d)\n", + dwc2_hcd_get_maxp(&urb->pipe_info), + dwc2_hcd_get_maxp_mult(&urb->pipe_info)); dev_err(hsotg->dev, " Data buffer length: %d\n", urb->length); dev_err(hsotg->dev, " Transfer buffer: %p, Transfer DMA: %08lx\n", urb->buf, (unsigned long)urb->dma); diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c index ea3aa640c15c..68bbac64b753 100644 --- a/drivers/usb/dwc2/hcd_queue.c +++ b/drivers/usb/dwc2/hcd_queue.c @@ -708,7 +708,7 @@ static void dwc2_hs_pmap_unschedule(struct dwc2_hsotg *hsotg, static int dwc2_uframe_schedule_split(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh) { - int bytecount = dwc2_hb_mult(qh->maxp) * dwc2_max_packet(qh->maxp); + int bytecount = qh->maxp_mult * qh->maxp; int ls_search_slice; int err = 0; int host_interval_in_sched; @@ -1332,7 +1332,7 @@ static int dwc2_check_max_xfer_size(struct dwc2_hsotg *hsotg, u32 max_channel_xfer_size; int status = 0; - max_xfer_size = dwc2_max_packet(qh->maxp) * dwc2_hb_mult(qh->maxp); + max_xfer_size = qh->maxp * qh->maxp_mult; max_channel_xfer_size = hsotg->params.max_transfer_size; if (max_xfer_size > max_channel_xfer_size) { @@ -1517,8 +1517,9 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh, u32 prtspd = (hprt & HPRT0_SPD_MASK) >> HPRT0_SPD_SHIFT; bool do_split = (prtspd == HPRT0_SPD_HIGH_SPEED && dev_speed != USB_SPEED_HIGH); - int maxp = dwc2_hcd_get_mps(&urb->pipe_info); - int bytecount = dwc2_hb_mult(maxp) * dwc2_max_packet(maxp); + int maxp = dwc2_hcd_get_maxp(&urb->pipe_info); + int maxp_mult = dwc2_hcd_get_maxp_mult(&urb->pipe_info); + int bytecount = maxp_mult * maxp; char *speed, *type; /* Initialize QH */ @@ -1531,6 +1532,7 @@ static void dwc2_qh_init(struct dwc2_hsotg *hsotg, struct dwc2_qh *qh, qh->data_toggle = DWC2_HC_PID_DATA0; qh->maxp = maxp; + qh->maxp_mult = maxp_mult; INIT_LIST_HEAD(&qh->qtd_list); INIT_LIST_HEAD(&qh->qh_list_entry); -- 2.22.0.rc1.311.g5d7573a151-goog

5 years, 10 months

3
2
0 0

✅ PASS: Stable queue: queue-5.1

by CKI Project

Hello, We ran automated tests on a patchset that was proposed for merging into this kernel tree. The patches were applied to: Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 2f7d9d47575e - Linux 5.1.7 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Merge testing ------------- We cloned this repository and checked out the following commit: Repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Commit: 2f7d9d47575e - Linux 5.1.7 We then merged the patchset with `git am`: sparc64-fix-regression-in-non-hypervisor-tlb-flush-xcall.patch include-linux-bitops.h-sanitize-rotate-primitives.patch xhci-update-bounce-buffer-with-correct-sg-num.patch xhci-use-zu-for-printing-size_t-type.patch xhci-convert-xhci_handshake-to-use-readl_poll_timeout_atomic.patch usb-xhci-avoid-null-pointer-deref-when-bos-field-is-null.patch usbip-usbip_host-fix-bug-sleeping-function-called-from-invalid-context.patch usbip-usbip_host-fix-stub_dev-lock-context-imbalance-regression.patch usb-fix-slab-out-of-bounds-write-in-usb_get_bos_descriptor.patch usb-sisusbvga-fix-oops-in-error-path-of-sisusb_probe.patch usb-add-lpm-quirk-for-surface-dock-gige-adapter.patch usb-rio500-refuse-more-than-one-device-at-a-time.patch usb-rio500-fix-memory-leak-in-close-after-disconnect.patch media-usb-siano-fix-general-protection-fault-in-smsusb.patch media-usb-siano-fix-false-positive-uninitialized-variable-warning.patch media-smsusb-better-handle-optional-alignment.patch brcmfmac-fix-null-pointer-derefence-during-usb-disconnect.patch scsi-zfcp-fix-missing-zfcp_port-reference-put-on-ebusy-from-port_remove.patch scsi-zfcp-fix-to-prevent-port_remove-with-pure-auto-scan-luns-only-sdevs.patch tracing-avoid-memory-leak-in-predicate_parse.patch btrfs-fix-wrong-ctime-and-mtime-of-a-directory-after-log-replay.patch btrfs-fix-race-updating-log-root-item-during-fsync.patch btrfs-fix-fsync-not-persisting-changed-attributes-of-a-directory.patch btrfs-correct-zstd-workspace-manager-lock-to-use-spin_lock_bh.patch btrfs-qgroup-check-bg-while-resuming-relocation-to-avoid-null-pointer-dereference.patch btrfs-incremental-send-fix-file-corruption-when-no-holes-feature-is-enabled.patch btrfs-reloc-also-queue-orphan-reloc-tree-for-cleanup-to-avoid-bug_on.patch iio-dac-ds4422-ds4424-fix-chip-verification.patch iio-adc-ads124-avoid-buffer-overflow.patch iio-adc-modify-npcm-adc-read-reference-voltage.patch iio-adc-ti-ads8688-fix-timestamp-is-not-updated-in-buffer.patch s390-crypto-fix-gcm-aes-s390-selftest-failures.patch s390-crypto-fix-possible-sleep-during-spinlock-aquired.patch kvm-ppc-book3s-hv-xive-do-not-clear-irq-data-of-passthrough-interrupts.patch kvm-ppc-book3s-hv-fix-lockdep-warning-when-entering-guest-on-power9.patch kvm-ppc-book3s-hv-restore-sprg3-in-kvmhv_p9_guest_entry.patch powerpc-perf-fix-mmcra-corruption-by-bhrb_filter.patch powerpc-kexec-fix-loading-of-kernel-initramfs-with-kexec_file_load.patch alsa-line6-assure-canceling-delayed-work-at-disconnection.patch alsa-hda-realtek-set-default-power-save-node-to-0.patch alsa-hda-realtek-improve-the-headset-mic-for-acer-aspire-laptops.patch kvm-s390-do-not-report-unusabled-ids-via-kvm_cap_max_vcpu_id.patch drm-nouveau-i2c-disable-i2c-bus-access-after-fini.patch i2c-mlxcpld-fix-wrong-initialization-order-in-probe.patch i2c-synquacer-fix-synquacer_i2c_doxfer-return-value.patch tty-serial-msm_serial-fix-xon-xoff.patch tty-max310x-fix-external-crystal-register-setup.patch mm-memcg-consider-subtrees-in-memory.events.patch memcg-make-it-work-on-sparse-non-0-node-systems.patch kasan-initialize-tag-to-0xff-in-__kasan_kmalloc.patch kernel-signal.c-trace_signal_deliver-when-signal_group_exit.patch signal-arm64-use-force_sig-not-force_sig_fault-for-sigkill.patch mm-compaction-make-sure-we-isolate-a-valid-pfn.patch arm64-fix-the-arm64_personality-syscall-wrapper-redirection.patch docs-fix-conf.py-for-sphinx-2.0.patch doc-cope-with-the-deprecation-of-autoreporter.patch doc-cope-with-sphinx-logging-deprecations.patch x86-ima-check-efi_runtime_services-before-using.patch ima-fix-wrong-signed-policy-requirement-when-not-appraising.patch ima-show-rules-with-ima_inmask-correctly.patch evm-check-hash-algorithm-passed-to-init_desc.patch clk-imx-imx8mm-fix-int-pll-clk-gate.patch vt-fbcon-deinitialize-resources-in-visual_init-after-failed-memory-allocation.patch serial-sh-sci-disable-dma-for-uart_console.patch staging-vc04_services-prevent-integer-overflow-in-create_pagelist.patch staging-wlan-ng-fix-adapter-initialization-failure.patch cifs-fix-memory-leak-of-pneg_inbuf-on-eopnotsupp-ioctl-case.patch cifs-cifs_read_allocate_pages-don-t-iterate-through-whole-page-array-on-enomem.patch revert-lockd-show-pid-of-lockd-for-remote-locks.patch gcc-plugins-fix-build-failures-under-darwin-host.patch drm-tegra-gem-fix-cpu-cache-maintenance-for-bo-s-allocated-using-get_pages.patch drm-vmwgfx-fix-user-space-handle-equal-to-zero.patch drm-vmwgfx-fix-compat-mode-shader-operation.patch drm-vmwgfx-don-t-send-drm-sysfs-hotplug-events-on-initial-master-set.patch drm-sun4i-fix-sun8i-hdmi-phy-clock-initialization.patch drm-sun4i-fix-sun8i-hdmi-phy-configuration-for-148.5-mhz.patch drm-imx-ipuv3-plane-fix-atomic-update-status-query-for-non-plus-i.mx6q.patch drm-fb-helper-generic-call-drm_client_add-after-setup-is-done.patch drm-atomic-wire-file_priv-through-for-property-changes.patch drm-expose-fb_damage_clips-property-to-atomic-aware-user-space-only.patch drm-rockchip-shutdown-drm-subsystem-on-shutdown.patch drm-lease-make-sure-implicit-planes-are-leased.patch drm-cma-helper-fix-drm_gem_cma_free_object.patch revert-x86-build-move-_etext-to-actual-end-of-.text.patch Compile testing --------------- We compiled the kernel for 4 architectures: aarch64: build options: -j20 INSTALL_MOD_STRIP=1 targz-pkg configuration: https://artifacts.cki-project.org/builds/aarch64/kernel-stable_queue_5.1-aa… kernel build: https://artifacts.cki-project.org/builds/aarch64/kernel-stable_queue_5.1-aa… ppc64le: build options: -j20 INSTALL_MOD_STRIP=1 targz-pkg configuration: https://artifacts.cki-project.org/builds/ppc64le/kernel-stable_queue_5.1-pp… kernel build: https://artifacts.cki-project.org/builds/ppc64le/kernel-stable_queue_5.1-pp… s390x: build options: -j20 INSTALL_MOD_STRIP=1 targz-pkg configuration: https://artifacts.cki-project.org/builds/s390x/kernel-stable_queue_5.1-s390… kernel build: https://artifacts.cki-project.org/builds/s390x/kernel-stable_queue_5.1-s390… x86_64: build options: -j20 INSTALL_MOD_STRIP=1 targz-pkg configuration: https://artifacts.cki-project.org/builds/x86_64/kernel-stable_queue_5.1-x86… kernel build: https://artifacts.cki-project.org/builds/x86_64/kernel-stable_queue_5.1-x86… Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test [0] ✅ selinux-policy: serge-testsuite [1] Host 2: ✅ Boot test [0] ✅ LTP lite [2] ✅ Loopdev Sanity [3] ✅ AMTU (Abstract Machine Test Utility) [4] ✅ audit: audit testsuite test [5] ✅ httpd: mod_ssl smoke sanity [6] ✅ iotop: sanity [7] ✅ tuned: tune-processes-through-perf [8] ✅ Usex - version 1.9-29 [9] 🚧 ✅ stress: stress-ng [10] ppc64le: Host 1: ✅ Boot test [0] ✅ LTP lite [2] ✅ Loopdev Sanity [3] ✅ AMTU (Abstract Machine Test Utility) [4] ✅ audit: audit testsuite test [5] ✅ httpd: mod_ssl smoke sanity [6] ✅ iotop: sanity [7] ✅ tuned: tune-processes-through-perf [8] ✅ Usex - version 1.9-29 [9] Host 2: ✅ Boot test [0] ✅ selinux-policy: serge-testsuite [1] s390x: Host 1: ✅ Boot test [0] ✅ selinux-policy: serge-testsuite [1] Host 2: ✅ Boot test [0] ✅ LTP lite [2] ✅ Loopdev Sanity [3] ✅ audit: audit testsuite test [5] ✅ httpd: mod_ssl smoke sanity [6] ✅ iotop: sanity [7] ✅ tuned: tune-processes-through-perf [8] 🚧 ✅ stress: stress-ng [10] x86_64: Host 1: ✅ Boot test [0] ✅ selinux-policy: serge-testsuite [1] Host 2: ✅ Boot test [0] ✅ LTP lite [2] ✅ Loopdev Sanity [3] ✅ AMTU (Abstract Machine Test Utility) [4] ✅ audit: audit testsuite test [5] ✅ httpd: mod_ssl smoke sanity [6] ✅ iotop: sanity [7] ✅ tuned: tune-processes-through-perf [8] ✅ Usex - version 1.9-29 [9] 🚧 ✅ stress: stress-ng [10] Test source: 💚 Pull requests are welcome for new tests or improvements to existing tests! [0]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [1]: https://github.com/CKI-project/tests-beaker/archive/master.zip#/packages/se… [2]: https://github.com/CKI-project/tests-beaker/archive/master.zip#distribution… [3]: https://github.com/CKI-project/tests-beaker/archive/master.zip#filesystems/… [4]: https://github.com/CKI-project/tests-beaker/archive/master.zip#misc/amtu [5]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/aud… [6]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/htt… [7]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/iot… [8]: https://github.com/CKI-project/tests-beaker/archive/master.zip#packages/tun… [9]: https://github.com/CKI-project/tests-beaker/archive/master.zip#standards/us… [10]: https://github.com/CKI-project/tests-beaker/archive/master.zip#stress/stres… Waived tests (marked with 🚧) ----------------------------- This test run included waived tests. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed.

5 years, 10 months

1
0
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2019